Edit tour

Windows Analysis Report
a8BgfRCsUv.exe

Overview

General Information

Sample Name:	a8BgfRCsUv.exe
Original Sample Name:	2023-03-15_ae7795f6305ad315589ff4846ad1ef14_wannacry.exe
Analysis ID:	827583
MD5:	ae7795f6305ad315589ff4846ad1ef14
SHA1:	71f4143d89ce0dcb5729e2a8b2cd54bc9b423e65
SHA256:	074c7aa722ff77df5ed56b655cc11da0288550a7405dc439be4417c6fccf7d5f
Infos:

Detection

Chaos, Conti, TrojanRansom

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Conti ransomware

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected TrojanRansom

Antivirus / Scanner detection for submitted sample

Sigma detected: Delete shadow copy via WMIC

Antivirus detection for dropped file

Sigma detected: Drops script at startup location

Multi AV Scanner detection for dropped file

Yara detected Chaos Ransomware

Deletes the backup plan of Windows

Uses bcdedit to modify the Windows boot settings

Machine Learning detection for sample

Creates files inside the volume driver (system volume information)

Modifies existing user documents (likely ransomware behavior)

May disable shadow drive data (uses vssadmin)

Machine Learning detection for dropped file

Deletes shadow drive data (may be related to ransomware)

Found potential ransomware demand text

Drops PE files with benign system names

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Creates COM task schedule object (often to register a task for autostart)

Creates files inside the system directory

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Contains capabilities to detect virtual machines

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Enables security privileges

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

a8BgfRCsUv.exe (PID: 6136 cmdline: C:\Users\user\Desktop\a8BgfRCsUv.exe MD5: AE7795F6305AD315589FF4846AD1EF14)

svchost.exe (PID: 5472 cmdline: "C:\Users\user\AppData\Roaming\svchost.exe" MD5: AE7795F6305AD315589FF4846AD1EF14)

cmd.exe (PID: 2588 cmdline: "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 1420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vssadmin.exe (PID: 1792 cmdline: vssadmin delete shadows /all /quiet MD5: 47D51216EF45075B5F7EAA117CC70E40)

WMIC.exe (PID: 5432 cmdline: wmic shadowcopy delete MD5: EC80E603E0090B3AC3C1234C2BA43A0F)

cmd.exe (PID: 5424 cmdline: "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 3016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

bcdedit.exe (PID: 6132 cmdline: bcdedit /set {default} bootstatuspolicy ignoreallfailures MD5: 6E05CD5195FDB8B6C68FC90074817293)

bcdedit.exe (PID: 5296 cmdline: bcdedit /set {default} recoveryenabled no MD5: 6E05CD5195FDB8B6C68FC90074817293)

cmd.exe (PID: 4064 cmdline: "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 3068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

wbadmin.exe (PID: 5268 cmdline: wbadmin delete catalog -quiet MD5: EE1E2C4D42579B19D765420E07589148)

wbuser.exe (PID: 4908 cmdline: C:\Windows\system32\wbuser.exe MD5: 6E235F75DF84C387388D23D697D6540B)

vdsldr.exe (PID: 1332 cmdline: C:\Windows\System32\vdsldr.exe -Embedding MD5: CD0D2028997ABCA78774E062CEC4E701)

vds.exe (PID: 1964 cmdline: C:\Windows\System32\vds.exe MD5: 4940B49502323905B66039D0D1AB4613)

OpenWith.exe (PID: 404 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: D179D03728E95E040A889F760C1FC402)

svchost.exe (PID: 5236 cmdline: "C:\Users\user\AppData\Roaming\svchost.exe" MD5: AE7795F6305AD315589FF4846AD1EF14)

cmd.exe (PID: 5592 cmdline: "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vssadmin.exe (PID: 5152 cmdline: vssadmin delete shadows /all /quiet MD5: 47D51216EF45075B5F7EAA117CC70E40)

WMIC.exe (PID: 5952 cmdline: wmic shadowcopy delete MD5: EC80E603E0090B3AC3C1234C2BA43A0F)

cmd.exe (PID: 5276 cmdline: "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 2508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

bcdedit.exe (PID: 3128 cmdline: bcdedit /set {default} bootstatuspolicy ignoreallfailures MD5: 6E05CD5195FDB8B6C68FC90074817293)

bcdedit.exe (PID: 3424 cmdline: bcdedit /set {default} recoveryenabled no MD5: 6E05CD5195FDB8B6C68FC90074817293)

cmd.exe (PID: 2852 cmdline: "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 4456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

wbadmin.exe (PID: 2044 cmdline: wbadmin delete catalog -quiet MD5: EE1E2C4D42579B19D765420E07589148)

OpenWith.exe (PID: 3396 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: D179D03728E95E040A889F760C1FC402)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Chaos	In-development ransomware family which was released in June 2021 by an unknown threat actor. The builder initially claimed to be a "Ryuk .Net Ransomware Builder" even though it was completely unrelated to the Ryuk malware family. Presently it appears to contain trojan-like features, but lacks features commonly found in ransomware such as data exfiltration.	No Attribution	https://blog.qualys.com/vulnerabilities-threat-research/2022/01/17/the-chaos-ransomware-can-be-ravaging https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree https://brianstadnicki.github.io/posts/malware-chaos-ransomware-v4/ https://marcoramilli.com/2021/06/14/the-allegedly-ryuk-ransomware-builder-ryukjoke/ https://twitter.com/vinopaljiri/status/1519645742440329216	https://malpedia.caad.fkie.fraunhofer.de/details/win.chaos

Name	Description	Attribution	Blogpost URLs	Link
Conti, Conti Lock	Conti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems. It was first observed in 2020 and it is thought to be led by a Russia-based cybercrime group that goes under the Wizard Spider pseudonym. In early May 2022, the US government announced a reward of up to $10 million for information on the Conti ransomware gang.	No Attribution	http://chuongdong.com/reverse%20usering/2020/12/15/ContiRansomware/ https://0xthreatintel.medium.com/reversing-conti-ransomware-bfce15019e74 https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf https://arcticwolf.com/resources/blog/conti-ransomware-leak-analyzed	https://malpedia.caad.fkie.fraunhofer.de/details/win.conti

Malware Configuration

Threatname: Chaos

{"Ransom Note": "----> Chaos is multi language ransomware. Translate your note to any language <----\r\nAll of your files have been encrypted\r\nYour computer was infected with a ransomware virus. Your files have been encrypted and you won't \r\nbe able to decrypt them without our help.What can I do to get my files back?You can buy our special \r\ndecryption software, this software will allow you to recover all of your data and remove the\r\nransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only.\r\nHow do I pay, where do I get Bitcoin?\r\nPurchasing Bitcoin varies from country to country, you are best advised to do a quick google search\r\nyourself  to find out how to buy Bitcoin. \r\nMany of our customers have reported these sites to be fast and reliable:\r\nCoinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com\r\n\r\nPayment informationAmount: 0.1473766 BTC\r\nBitcoin Address:  bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0\r\n\r\n", "Bitcoin Wallet": "bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
a8BgfRCsUv.exe	JoeSecurity_Chaos_1	Yara detected Chaos Ransomware	Joe Security
a8BgfRCsUv.exe	JoeSecurity_Conti_ransomware	Yara detected Conti ransomware	Joe Security
a8BgfRCsUv.exe	MALWARE_Win_Chaos	Detects Chaos ransomware	ditekSHen	0x352a:$s1: <EncyptedKey> 0x3546:$s1: <EncyptedKey> 0x390f:$s2: <EncryptedKey> 0x3cbc:$s3: C:\Users\ 0x3d86:$s6: (?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}\|bc1[a-z0-9]{39,59}) 0x2802:$s7: checkSpread 0x2849:$s7: checkSleep 0x2887:$s7: checkAdminPrivilage 0x289b:$s7: checkdeleteShadowCopies 0x28b3:$s7: checkdisableRecoveryMode 0x28cc:$s7: checkdeleteBackupCatalog 0x2a94:$s8: deleteShadowCopies 0x2aa7:$s8: disableRecoveryMode 0x2abb:$s8: deleteBackupCatalog 0x280e:$s9: spreadName 0x282a:$s10: processName 0x294f:$s11: sleepOutOfTempFolder 0x2964:$s12: AlreadyRunning 0x2973:$s13: random_bytes 0x29d4:$s14: encryptDirectory 0x2f1f:$s14: encryptDirectory

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	URL_File_Local_EXE	Detects an .url file that points to a local executable	Florian Roth (Nextron Systems)	0x0:$s1: [InternetShortcut] 0x14:$s2: URL=file:///C:\Users\user\AppData\Roaming\svchost.exe
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	Methodology_Suspicious_Shortcut_Local_URL	Detects local script usage for .URL persistence	@itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)	0x14:$file: URL=file:/// 0x0:$url_explicit: [InternetShortcut]
C:\Users\user\AppData\Roaming\svchost.exe	JoeSecurity_Chaos_1	Yara detected Chaos Ransomware	Joe Security
C:\Users\user\AppData\Roaming\svchost.exe	JoeSecurity_Conti_ransomware	Yara detected Conti ransomware	Joe Security
C:\Users\user\AppData\Roaming\svchost.exe	MALWARE_Win_Chaos	Detects Chaos ransomware	ditekSHen	0x352a:$s1: <EncyptedKey> 0x3546:$s1: <EncyptedKey> 0x390f:$s2: <EncryptedKey> 0x3cbc:$s3: C:\Users\ 0x3d86:$s6: (?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}\|bc1[a-z0-9]{39,59}) 0x2802:$s7: checkSpread 0x2849:$s7: checkSleep 0x2887:$s7: checkAdminPrivilage 0x289b:$s7: checkdeleteShadowCopies 0x28b3:$s7: checkdisableRecoveryMode 0x28cc:$s7: checkdeleteBackupCatalog 0x2a94:$s8: deleteShadowCopies 0x2aa7:$s8: disableRecoveryMode 0x2abb:$s8: deleteBackupCatalog 0x280e:$s9: spreadName 0x282a:$s10: processName 0x294f:$s11: sleepOutOfTempFolder 0x2964:$s12: AlreadyRunning 0x2973:$s13: random_bytes 0x29d4:$s14: encryptDirectory 0x2f1f:$s14: encryptDirectory

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.243529247.0000000000E52000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Chaos_1	Yara detected Chaos Ransomware	Joe Security
00000000.00000000.243529247.0000000000E52000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_Chaos	Detects Chaos ransomware	ditekSHen	0x332a:$s1: <EncyptedKey> 0x3346:$s1: <EncyptedKey> 0x370f:$s2: <EncryptedKey> 0x3abc:$s3: C:\Users\ 0x3b86:$s6: (?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}\|bc1[a-z0-9]{39,59}) 0x2602:$s7: checkSpread 0x2649:$s7: checkSleep 0x2687:$s7: checkAdminPrivilage 0x269b:$s7: checkdeleteShadowCopies 0x26b3:$s7: checkdisableRecoveryMode 0x26cc:$s7: checkdeleteBackupCatalog 0x2894:$s8: deleteShadowCopies 0x28a7:$s8: disableRecoveryMode 0x28bb:$s8: deleteBackupCatalog 0x260e:$s9: spreadName 0x262a:$s10: processName 0x274f:$s11: sleepOutOfTempFolder 0x2764:$s12: AlreadyRunning 0x2773:$s13: random_bytes 0x27d4:$s14: encryptDirectory 0x2d1f:$s14: encryptDirectory
00000001.00000002.511531668.0000000002FC4000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_Chaos	Detects Chaos ransomware	ditekSHen	0x1fe4:$m1: Chaos is 0x343c:$m1: Chaos is 0x268c:$m2: Payment informationAmount: 0x3c30:$m2: Payment informationAmount: 0x25f6:$m3: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com 0x3b60:$m3: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com 0x240e:$m4: where do I get Bitcoin 0x390c:$m4: where do I get Bitcoin
0000001C.00000002.511323362.000000000302E000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_Chaos	Detects Chaos ransomware	ditekSHen	0x1094:$m1: Chaos is 0x24ec:$m1: Chaos is 0x173c:$m2: Payment informationAmount: 0x2ce0:$m2: Payment informationAmount: 0x16a6:$m3: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com 0x2c10:$m3: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com 0x14be:$m4: where do I get Bitcoin 0x29bc:$m4: where do I get Bitcoin
00000001.00000002.511531668.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_Chaos	Detects Chaos ransomware	ditekSHen	0x1c274:$m1: Chaos is 0x1d6cc:$m1: Chaos is 0xa2ecc:$m1: Chaos is 0xa4324:$m1: Chaos is 0x1c91c:$m2: Payment informationAmount: 0x1dec0:$m2: Payment informationAmount: 0xa3574:$m2: Payment informationAmount: 0xa4b18:$m2: Payment informationAmount: 0x1c886:$m3: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com 0x1ddf0:$m3: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com 0xa34de:$m3: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com 0xa4a48:$m3: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com 0x1c69e:$m4: where do I get Bitcoin 0x1db9c:$m4: where do I get Bitcoin 0xa32f6:$m4: where do I get Bitcoin 0xa47f4:$m4: where do I get Bitcoin
0000001C.00000002.511323362.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_Chaos	Detects Chaos ransomware	ditekSHen	0x185c:$s3: C:\Users\ 0x19fc:$s6: (?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}\|bc1[a-z0-9]{39,59}) 0x1a98:$m1: Chaos is 0x2254:$m2: Payment informationAmount: 0x21ac:$m3: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com 0x1f60:$m4: where do I get Bitcoin
00000001.00000002.511531668.0000000002EB6000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_Chaos	Detects Chaos ransomware	ditekSHen	0x7dc3c:$m1: Chaos is 0x7f094:$m1: Chaos is 0xff96c:$m1: Chaos is 0x100dc4:$m1: Chaos is 0x7e2e4:$m2: Payment informationAmount: 0x7f888:$m2: Payment informationAmount: 0x100014:$m2: Payment informationAmount: 0x1015b8:$m2: Payment informationAmount: 0x7e24e:$m3: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com 0x7f7b8:$m3: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com 0xfff7e:$m3: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com 0x1014e8:$m3: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com 0x7e066:$m4: where do I get Bitcoin 0x7f564:$m4: where do I get Bitcoin 0xffd96:$m4: where do I get Bitcoin 0x101294:$m4: where do I get Bitcoin
00000000.00000002.259028258.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_Chaos	Detects Chaos ransomware	ditekSHen	0x182c:$s3: C:\Users\ 0x19cc:$s6: (?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}\|bc1[a-z0-9]{39,59}) 0x1a68:$m1: Chaos is 0x2224:$m2: Payment informationAmount: 0x217c:$m3: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com 0x1f30:$m4: where do I get Bitcoin
Process Memory Space: a8BgfRCsUv.exe PID: 6136	JoeSecurity_TrojanRansom	Yara detected TrojanRansom	Joe Security
Process Memory Space: a8BgfRCsUv.exe PID: 6136	JoeSecurity_Chaos	Yara detected Chaos Ransomware	Joe Security
Process Memory Space: a8BgfRCsUv.exe PID: 6136	JoeSecurity_Chaos_1	Yara detected Chaos Ransomware	Joe Security
Process Memory Space: a8BgfRCsUv.exe PID: 6136	JoeSecurity_Conti_ransomware	Yara detected Conti ransomware	Joe Security
Process Memory Space: svchost.exe PID: 5472	JoeSecurity_TrojanRansom	Yara detected TrojanRansom	Joe Security
Process Memory Space: svchost.exe PID: 5472	JoeSecurity_Chaos	Yara detected Chaos Ransomware	Joe Security
Process Memory Space: svchost.exe PID: 5236	JoeSecurity_TrojanRansom	Yara detected TrojanRansom	Joe Security
Process Memory Space: svchost.exe PID: 5236	JoeSecurity_Chaos	Yara detected Chaos Ransomware	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.a8BgfRCsUv.exe.e50000.0.unpack	Destructive_Ransomware_Gen1	Detects destructive malware	Florian Roth (Nextron Systems)	0x3bc4:$x1: /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no 0x3b4b:$x2: delete shadows /all /quiet 0x3c90:$x3: delete catalog -quiet
0.0.a8BgfRCsUv.exe.e50000.0.unpack	JoeSecurity_Chaos_1	Yara detected Chaos Ransomware	Joe Security
0.0.a8BgfRCsUv.exe.e50000.0.unpack	MALWARE_Win_Chaos	Detects Chaos ransomware	ditekSHen	0x352a:$s1: <EncyptedKey> 0x3546:$s1: <EncyptedKey> 0x390f:$s2: <EncryptedKey> 0x3cbc:$s3: C:\Users\ 0x3d86:$s6: (?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}\|bc1[a-z0-9]{39,59}) 0x2802:$s7: checkSpread 0x2849:$s7: checkSleep 0x2887:$s7: checkAdminPrivilage 0x289b:$s7: checkdeleteShadowCopies 0x28b3:$s7: checkdisableRecoveryMode 0x28cc:$s7: checkdeleteBackupCatalog 0x2a94:$s8: deleteShadowCopies 0x2aa7:$s8: disableRecoveryMode 0x2abb:$s8: deleteBackupCatalog 0x280e:$s9: spreadName 0x282a:$s10: processName 0x294f:$s11: sleepOutOfTempFolder 0x2964:$s12: AlreadyRunning 0x2973:$s13: random_bytes 0x29d4:$s14: encryptDirectory 0x2f1f:$s14: encryptDirectory

Sigma Signatures

Operating System Destruction

Sigma detected: Delete shadow copy via WMIC

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete, CommandLine: "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\svchost.exe" , ParentImage: C:\Users\user\AppData\Roaming\svchost.exe, ParentProcessId: 5472, ParentProcessName: svchost.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete, ProcessId: 2588, ProcessName: cmd.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\svchost.exe, ProcessId: 5472, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: a8BgfRCsUv.exe	ReversingLabs: Detection: 92%
Source: a8BgfRCsUv.exe	Virustotal: Detection: 81%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: a8BgfRCsUv.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\svchost.exe

Avira: detection malicious, Label: TR/ATRAPS.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\svchost.exe	ReversingLabs: Detection: 92%
Source: C:\Users\user\AppData\Roaming\svchost.exe	Virustotal: Detection: 81%			Perma Link

Machine Learning detection for sample

Source: a8BgfRCsUv.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\svchost.exe

Joe Sandbox ML: detected

Source: 0.0.a8BgfRCsUv.exe.e50000.0.unpack

Avira: Label: TR/ATRAPS.Gen

Source: 0000001C.00000002.511323362.000000000302E000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Chaos {"Ransom Note": "----> Chaos is multi language ransomware. Translate your note to any language <----\r\nAll of your files have been encrypted\r\nYour computer was infected with a ransomware virus. Your files have been encrypted and you won't \r\nbe able to decrypt them without our help.What can I do to get my files back?You can buy our special \r\ndecryption software, this software will allow you to recover all of your data and remove the\r\nransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only.\r\nHow do I pay, where do I get Bitcoin?\r\nPurchasing Bitcoin varies from country to country, you are best advised to do a quick google search\r\nyourself to find out how to buy Bitcoin. \r\nMany of our customers have reported these sites to be fast and reliable:\r\nCoinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com\r\n\r\nPayment informationAmount: 0.1473766 BTC\r\nBitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0\r\n\r\n", "Bitcoin Wallet": "bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0"}

Source: a8BgfRCsUv.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: a8BgfRCsUv.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\BA\89\b\release\win32\Music.UI\Music.UI.pdb source: a8BgfRCsUv.exe, svchost.exe.0.dr
Source:	Binary string: ifsutil.pdb source: WBuser.0.etl.19.dr
Source:	Binary string: vssvc.pdb source: WBuser.0.etl.19.dr
Source:	Binary string: wbadmin.pdb source: WBuser.0.etl.19.dr
Source:	Binary string: .core.pdb.ico.pas source: a8BgfRCsUv.exe, svchost.exe.0.dr
Source:	Binary string: wbuser.pdb source: WBuser.0.etl.19.dr
Source:	Binary string: C:\BA\89\b\release\win32\Music.UI\Music.UI.pdbz source: a8BgfRCsUv.exe, svchost.exe.0.dr
Source:	Binary string: uudf.pdb source: WBuser.0.etl.19.dr
Source:	Binary string: vssapi.pdb source: WBuser.0.etl.19.dr
Source:	Binary string: spp.pdb source: WBuser.0.etl.19.dr

Source: C:\Windows\System32\wbuser.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\wbuser.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\wbuser.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\wbuser.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\wbuser.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\wbuser.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\wbuser.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\wbuser.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\wbuser.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\wbuser.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\wbuser.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\System32\wbuser.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\System32\wbuser.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\wbuser.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\System32\wbuser.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\wbuser.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: a8BgfRCsUv.exe, svchost.exe.0.dr

String found in binary or memory: http://oracle.com/contracts.

Source: C:\Users\user\AppData\Roaming\svchost.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Yara detected Conti ransomware

Source: Yara match	File source: a8BgfRCsUv.exe, type: SAMPLE
Source: Yara match	File source: Process Memory Space: a8BgfRCsUv.exe PID: 6136, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED

Yara detected TrojanRansom

Source: Yara match	File source: Process Memory Space: a8BgfRCsUv.exe PID: 6136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5236, type: MEMORYSTR

Yara detected Chaos Ransomware

Source: Yara match	File source: Process Memory Space: a8BgfRCsUv.exe PID: 6136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5236, type: MEMORYSTR
Source: Yara match	File source: a8BgfRCsUv.exe, type: SAMPLE
Source: Yara match	File source: 0.0.a8BgfRCsUv.exe.e50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.243529247.0000000000E52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Roaming\svchost.exe	File moved: C:\Users\user\Desktop\GNLQNHOLWB\WHZAGPPPLA.mp3	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	File deleted: C:\Users\user\Desktop\GNLQNHOLWB\WHZAGPPPLA.mp3	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	File moved: C:\Users\user\Desktop\MIVTQDBATG.mp3	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	File deleted: C:\Users\user\Desktop\MIVTQDBATG.mp3	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	File moved: C:\Users\user\Desktop\BWDRWEEARI\OVWVVIANZH.jpg	Jump to behavior

May disable shadow drive data (uses vssadmin)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet

Deletes shadow drive data (may be related to ransomware)

Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: a8BgfRCsUv.exe, 00000000.00000000.243529247.0000000000E52000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /C yvssadmin delete shadows /all /quiet & wmic shadowcopy delete
Source: a8BgfRCsUv.exe, 00000000.00000002.259028258.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <vssadmin delete shadows /all /quiet & wmic shadowcopy delete
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete	Jump to behavior
Source: svchost.exe, 00000001.00000002.511255734.0000000000CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
Source: svchost.exe, 00000001.00000002.519650531.000000001B700000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies/C vssadmin delete shadows /all /quiet & wmic shadowcopy deleteD:P(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;IU)(A;OICI;FA;;;SY)rs
Source: svchost.exe, 00000001.00000002.519650531.000000001B700000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /C vssadmin delete shadows /all /quiet & wmic shadowcopy deleteC:\Users\user\AppData\Local\Microsoft\Windows\INetCacheche
Source: svchost.exe, 00000001.00000002.511531668.0000000002FC0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ?/C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
Source: svchost.exe, 00000001.00000002.510991542.0000000000CA7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete/C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
Source: svchost.exe, 00000001.00000002.510991542.0000000000CA7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete#-
Source: svchost.exe, 00000001.00000002.511531668.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <vssadmin delete shadows /all /quiet & wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: vssadmin.exe, 00000006.00000002.289138345.000001B747855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmindeleteshadows/all/quiet
Source: vssadmin.exe, 00000006.00000002.289044687.000001B747510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\AppData\Roaming\C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet vssadmin delete shadows /all /quiet Winsta0\Default
Source: vssadmin.exe, 00000006.00000002.289044687.000001B747510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin delete shadows /all /quiet
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
Source: svchost.exe, 0000001C.00000002.510792106.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /C vssadmin delete shadows /all /quiet & wmic shadowcopy deleteLIST
Source: svchost.exe, 0000001C.00000002.510792106.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete@
Source: svchost.exe, 0000001C.00000002.511323362.0000000003029000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ?/C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
Source: svchost.exe, 0000001C.00000002.521009346.000000001D202000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /C vssadmin delete shadows /all /quiet & wmic shadowcopy deleteC:\Users\user\AppData\Local\Microsoft\Windows\INetCookies
Source: svchost.exe, 0000001C.00000002.511323362.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <vssadmin delete shadows /all /quiet & wmic shadowcopy delete
Source: svchost.exe, 0000001C.00000002.511003672.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: vssadmin.exe, 0000001F.00000002.334335372.000001C7DAFF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmindeleteshadows/all/quiet
Source: vssadmin.exe, 0000001F.00000002.334259530.000001C7DAE40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet vssadmin delete shadows /all /quiet Winsta0\Defaultp$
Source: vssadmin.exe, 0000001F.00000002.334259530.000001C7DAE40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin delete shadows /all /quiet
Source: vssadmin.exe, 0000001F.00000002.334259530.000001C7DAE40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin delete shadows /all /quiet 4$
Source: vssadmin.exe, 0000001F.00000002.334259530.000001C7DAE6D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: - Code: ADMPROCC00001737- Call: ADMPROCC00001712- PID: 00005152- TID: 00003228- CMD: vssadmin delete shadows /all /quiet - User: Name: computer\user, SID:S-1-5-21-3853321935-2125563209-4053062332-1002
Source: vssadmin.exe, 0000001F.00000002.334071343.0000007D43F3B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: - Code: ADMPROCC00001737- Call: ADMPROCC00001712- PID: 00005152- TID: 00003228- CMD: vssadmin delete shadows /all /quiet - User: Name: computer\user, SID:S-1-5-21-3853321935-2125563209-4053062332-1002
Source: a8BgfRCsUv.exe	Binary or memory string: /C yvssadmin delete shadows /all /quiet & wmic shadowcopy delete
Source: svchost.exe.0.dr	Binary or memory string: /C yvssadmin delete shadows /all /quiet & wmic shadowcopy delete

Found potential ransomware demand text

Source: a8BgfRCsUv.exe, 00000000.00000002.265402778.000000001BBE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
Source: a8BgfRCsUv.exe, 00000000.00000002.265402778.000000001BBE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ(
Source: a8BgfRCsUv.exe, 00000000.00000002.265402778.000000001BBE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
Source: a8BgfRCsUv.exe, 00000000.00000002.265402778.000000001BBE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ*
Source: a8BgfRCsUv.exe	String found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
Source: a8BgfRCsUv.exe	String found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ(
Source: a8BgfRCsUv.exe	String found in binary or memory: ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
Source: a8BgfRCsUv.exe	String found in binary or memory: ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ*
Source: svchost.exe.0.dr	String found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
Source: svchost.exe.0.dr	String found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ(
Source: svchost.exe.0.dr	String found in binary or memory: ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
Source: svchost.exe.0.dr	String found in binary or memory: ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ*

System Summary

Malicious sample detected (through community Yara rule)

Source: a8BgfRCsUv.exe, type: SAMPLE	Matched rule: Detects Chaos ransomware Author: ditekSHen
Source: 0.0.a8BgfRCsUv.exe.e50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects destructive malware Author: Florian Roth (Nextron Systems)
Source: 0.0.a8BgfRCsUv.exe.e50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Chaos ransomware Author: ditekSHen
Source: 00000000.00000000.243529247.0000000000E52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Chaos ransomware Author: ditekSHen
Source: 00000001.00000002.511531668.0000000002FC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Chaos ransomware Author: ditekSHen
Source: 0000001C.00000002.511323362.000000000302E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Chaos ransomware Author: ditekSHen
Source: 00000001.00000002.511531668.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Chaos ransomware Author: ditekSHen
Source: 0000001C.00000002.511323362.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Chaos ransomware Author: ditekSHen
Source: 00000001.00000002.511531668.0000000002EB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Chaos ransomware Author: ditekSHen
Source: 00000000.00000002.259028258.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Chaos ransomware Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED	Matched rule: Detects Chaos ransomware Author: ditekSHen

Source: a8BgfRCsUv.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: a8BgfRCsUv.exe, type: SAMPLE	Matched rule: MALWARE_Win_Chaos author = ditekSHen, description = Detects Chaos ransomware
Source: 0.0.a8BgfRCsUv.exe.e50000.0.unpack, type: UNPACKEDPE	Matched rule: Destructive_Ransomware_Gen1 date = 2018-02-12, hash1 = ae9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85, author = Florian Roth (Nextron Systems), description = Detects destructive malware, reference = http://blog.talosintelligence.com/2018/02/olympic-destroyer.html, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.a8BgfRCsUv.exe.e50000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chaos author = ditekSHen, description = Detects Chaos ransomware
Source: 00000000.00000000.243529247.0000000000E52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Chaos author = ditekSHen, description = Detects Chaos ransomware
Source: 00000001.00000002.511531668.0000000002FC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Chaos author = ditekSHen, description = Detects Chaos ransomware
Source: 0000001C.00000002.511323362.000000000302E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Chaos author = ditekSHen, description = Detects Chaos ransomware
Source: 00000001.00000002.511531668.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Chaos author = ditekSHen, description = Detects Chaos ransomware
Source: 0000001C.00000002.511323362.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Chaos author = ditekSHen, description = Detects Chaos ransomware
Source: 00000001.00000002.511531668.0000000002EB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Chaos author = ditekSHen, description = Detects Chaos ransomware
Source: 00000000.00000002.259028258.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Chaos author = ditekSHen, description = Detects Chaos ransomware
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url, type: DROPPED	Matched rule: URL_File_Local_EXE date = 2017-10-04, author = Florian Roth (Nextron Systems), description = Detects an .url file that points to a local executable, score = , reference = https://twitter.com/malwareforme/status/915300883012870144, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url, type: DROPPED	Matched rule: Methodology_Suspicious_Shortcut_Local_URL author = @itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson), description = Detects local script usage for .URL persistence, score = 27.09.2019, reference = https://twitter.com/cglyer/status/1176184798248919044
Source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED	Matched rule: MALWARE_Win_Chaos author = ditekSHen, description = Detects Chaos ransomware

Source: C:\Windows\System32\wbadmin.exe

File created: C:\Windows\Logs\WindowsBackup

Jump to behavior

Source: a8BgfRCsUv.exe, 00000000.00000000.243529247.0000000000E52000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNVPN.exe4 vs a8BgfRCsUv.exe
Source: a8BgfRCsUv.exe, 00000000.00000002.258406368.000000000131C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs a8BgfRCsUv.exe
Source: a8BgfRCsUv.exe	Binary or memory string: OriginalFilenameNVPN.exe4 vs a8BgfRCsUv.exe

Source: C:\Windows\System32\wbuser.exe

Process token adjusted: Security

Jump to behavior

Source: a8BgfRCsUv.exe	ReversingLabs: Detection: 92%
Source: a8BgfRCsUv.exe	Virustotal: Detection: 81%

Source: C:\Users\user\Desktop\a8BgfRCsUv.exe

File read: C:\Users\user\Desktop\a8BgfRCsUv.exe

Jump to behavior

Source: a8BgfRCsUv.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\a8BgfRCsUv.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\a8BgfRCsUv.exe C:\Users\user\Desktop\a8BgfRCsUv.exe
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet
Source: unknown	Process created: C:\Windows\System32\wbuser.exe C:\Windows\system32\wbuser.exe
Source: unknown	Process created: C:\Windows\System32\vdsldr.exe C:\Windows\System32\vdsldr.exe -Embedding
Source: unknown	Process created: C:\Windows\System32\vds.exe C:\Windows\System32\vds.exe
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet

Source: C:\Users\user\Desktop\a8BgfRCsUv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\a8BgfRCsUv.exe

File created: C:\Users\user\AppData\Roaming\svchost.exe

Jump to behavior

Source: WBuser.0.etl.19.dr

Binary string: \\?\GLOBALROOT\Device\HarddiskVolume2\v

Source: classification engine

Classification label: mal100.rans.expl.evad.winEXE@47/181@0/0

Source: C:\Users\user\Desktop\a8BgfRCsUv.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: a8BgfRCsUv.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:404:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3068:120:WilError_01
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3396:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4456:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3016:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5584:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2508:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1420:120:WilError_01

Source: a8BgfRCsUv.exe, svchost.exe.0.dr

Binary or memory string: .vb.m1v.sln.pst.obj

Source: a8BgfRCsUv.exe

String found in binary or memory: found-no-music-library-folderresultsucceeded-library-lookupdownload-in-progressIDS_MUSIC_PURCHASE_HISTORY_DOWNLOAD_TEXTIDS_DOWNLOAD_FOLDER_PURCHASESsuccessMS::Entertainment::Music::Commands::PurchaseHistoryBannerCommand::OnExecute::<lambda_d1296136707a3fe26255710e35bb18ec>::()::<lambda_b8051e8eae3a48cf504e28a19d943969>::()::<lambda_c23123ebf98e1fad0826f9e3055b61b6>::operator ()MS::Entertainment::Music::Commands::PurchaseHistoryBannerCommand::OnExecute::<lambda_2eabcd1832a4731440d98c0f836ec220>::operator ()found-no-purchasessucceeded-track-queryfound-nothing-to-add-to-queuefound-no-downloadable-purchasessucceeded-background-taskIDS_MUSIC_PURCHASE_HISTORY_DOWNLOAD_TITLEdialogDisplayedaddedToDownloadQueueCountnoDownloadRightsCountinDownloadQueueTracksCountlocalTracksCountIDS_MUSIC_PURCHASE_HISTORY_NOTHING_TITLEIDS_MUSIC_PURCHASE_HISTORY_NOTHING_TEXTnothing-to-dofailed-track-queryMS.Entertainment.Music.Commands.PurchaseHistoryBannerCommandMS.Entertainment.Music.Commands.__PurchaseHistoryBannerCommandActivationFactory

Source: C:\Users\user\AppData\Roaming\svchost.exe

File written: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: a8BgfRCsUv.exe

Static file information: File size 3075441 > 1048576

Source: a8BgfRCsUv.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: a8BgfRCsUv.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\BA\89\b\release\win32\Music.UI\Music.UI.pdb source: a8BgfRCsUv.exe, svchost.exe.0.dr
Source:	Binary string: ifsutil.pdb source: WBuser.0.etl.19.dr
Source:	Binary string: vssvc.pdb source: WBuser.0.etl.19.dr
Source:	Binary string: wbadmin.pdb source: WBuser.0.etl.19.dr
Source:	Binary string: .core.pdb.ico.pas source: a8BgfRCsUv.exe, svchost.exe.0.dr
Source:	Binary string: wbuser.pdb source: WBuser.0.etl.19.dr
Source:	Binary string: C:\BA\89\b\release\win32\Music.UI\Music.UI.pdbz source: a8BgfRCsUv.exe, svchost.exe.0.dr
Source:	Binary string: uudf.pdb source: WBuser.0.etl.19.dr
Source:	Binary string: vssapi.pdb source: WBuser.0.etl.19.dr
Source:	Binary string: spp.pdb source: WBuser.0.etl.19.dr

Persistence and Installation Behavior

Uses bcdedit to modify the Windows boot settings

Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no

Drops PE files with benign system names

Source: C:\Users\user\Desktop\a8BgfRCsUv.exe

File created: C:\Users\user\AppData\Roaming\svchost.exe

Jump to dropped file

Source: C:\Users\user\Desktop\a8BgfRCsUv.exe

File created: C:\Users\user\AppData\Roaming\svchost.exe

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\svchost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url

Jump to behavior

Source: C:\Users\user\AppData\Roaming\svchost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Creates files inside the volume driver (system volume information)

Source: C:\Windows\System32\wbuser.exe

File created: C:\System Volume Information\WindowsImageBackup

Jump to behavior

Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\a8BgfRCsUv.exe TID: 5148	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe TID: 3672	Thread sleep count: 581 > 30

Source: C:\Users\user\AppData\Roaming\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\svchost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\a8BgfRCsUv.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Roaming\svchost.exe	Window / User API: threadDelayed 722			Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Window / User API: threadDelayed 581

Source: C:\Windows\System32\vds.exe

File opened / queried: scsi#disk&ven_vmware&prod_virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\a8BgfRCsUv.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\a8BgfRCsUv.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: vds.exe, 00000017.00000002.510192605.000001819F948000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: vds.exe, 00000017.00000002.510192605.000001819F962000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00j+u
Source: a8BgfRCsUv.exe, 00000000.00000002.265402778.000000001BBE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_C/F
Source: vds.exe, 00000017.00000003.296460438.000001819F997000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b};o
Source: vds.exe, 00000017.00000002.510192605.000001819F948000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\scsi#disk&ven_vmware&prod_virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}@
Source: bcdedit.exe, 0000000E.00000002.291908574.0000020A9E789000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pEFI VMware V
Source: vds.exe, 00000017.00000003.297962307.000001819F9AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}6b5fa5c062}
Source: vds.exe, 00000017.00000002.510192605.000001819F948000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}fb8b}
Source: vds.exe, 00000017.00000002.510192605.000001819F962000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: vds.exe, 00000017.00000002.510192605.000001819F962000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000ch
Source: vds.exe, 00000017.00000003.296662992.000001819F98D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}l
Source: vds.exe, 00000017.00000002.510192605.000001819F948000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}j
Source: vds.exe, 00000017.00000003.296612081.000001819F9A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: vds.exe, 00000017.00000003.296612081.000001819F994000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000&prod_vmware_sata_cd00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}??
Source: bcdedit.exe, 0000000F.00000002.292530850.000002182FD49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pEFI VMware Virtual SATA CDROM Drive (0.0)
Source: vds.exe, 00000017.00000003.296460438.000001819F993000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}`j
Source: vds.exe, 00000017.00000003.296662992.000001819F994000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{7f108a28-9833-4b3b-b780-2c6b5fa5c062}\?\storage#volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\storage#volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: vds.exe, 00000017.00000003.297922626.000001819F9A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}4b
Source: vds.exe, 00000017.00000002.510192605.000001819F9A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb
Source: vds.exe, 00000017.00000002.510192605.000001819F948000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: vds.exe, 00000017.00000003.296650492.000001819F994000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: age#volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001f400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\storage#volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\storage#volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: vds.exe, 00000017.00000002.510192605.000001819F948000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: vds.exe, 00000017.00000003.296639021.000001819F99A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}a0c91efb8b}
Source: vds.exe, 00000017.00000003.296662992.000001819F994000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}`j
Source: vds.exe, 00000017.00000003.298048076.000001819F9A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}U
Source: bcdedit.exe, 0000000F.00000002.292530850.000002182FD49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EFI VMware Virtual SATA CDROM Drive (0.0)
Source: vds.exe, 00000017.00000002.510192605.000001819F962000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: vds.exe, 00000017.00000003.296460438.000001819F98C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: vds.exe, 00000017.00000002.510192605.000001819F962000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000Ch
Source: vds.exe, 00000017.00000003.298048076.000001819F9A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: vds.exe, 00000017.00000002.510192605.000001819F962000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000e
Source: vds.exe, 00000017.00000002.510192605.000001819F948000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}.dll
Source: vds.exe, 00000017.00000003.296690020.000001819F994000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: age#volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{7f108a28-9833-4b3b-b780-2c6b5fa5c062}\?\storage#volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\storage#volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: bcdedit.exe, 0000000F.00000002.292530850.000002182FD49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pEFI VMware Virtual SATA CDRO
Source: vds.exe, 00000017.00000002.510192605.000001819F962000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000`i

Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\a8BgfRCsUv.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet

Source: C:\Users\user\Desktop\a8BgfRCsUv.exe	Queries volume information: C:\Users\user\Desktop\a8BgfRCsUv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation

Source: C:\Users\user\AppData\Roaming\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Deletes the backup plan of Windows

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	211 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Clipboard Data	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	1 Scheduled Task/Job	2 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 Inhibit System Recovery
Domain Accounts	At (Linux)	Logon Script (Windows)	2 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 File Deletion	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
a8BgfRCsUv.exe	92%	ReversingLabs	ByteCode-MSIL.Ransomware.FileCoder
a8BgfRCsUv.exe	81%	Virustotal		Browse
a8BgfRCsUv.exe	100%	Avira	TR/ATRAPS.Gen
a8BgfRCsUv.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\svchost.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Roaming\svchost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\svchost.exe	92%	ReversingLabs	ByteCode-MSIL.Ransomware.FileCoder
C:\Users\user\AppData\Roaming\svchost.exe	81%	Virustotal		Browse

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.a8BgfRCsUv.exe.e50000.0.unpack	100%	Avira	TR/ATRAPS.Gen		Download File

Name	Source	Malicious	Antivirus Detection	Reputation
http://oracle.com/contracts.	a8BgfRCsUv.exe, svchost.exe.0.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	827583
Start date and time:	2023-03-16 05:06:14 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	a8BgfRCsUv.exe
Original Sample Name:	2023-03-15_ae7795f6305ad315589ff4846ad1ef14_wannacry.exe
Detection:	MAL
Classification:	mal100.rans.expl.evad.winEXE@47/181@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 95% Number of executed functions: 51 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, VSSVC.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 209.197.3.8
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, wu-bg-shim.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:07:28	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url
05:07:32	API Interceptor	2x Sleep call for process: WMIC.exe modified
05:07:36	API Interceptor	2x Sleep call for process: OpenWith.exe modified

Process:	C:\Users\user\Desktop\a8BgfRCsUv.exe
File Type:	CSV text
Category:	modified
Size (bytes):	226
Entropy (8bit):	5.354940450065058
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2wlAsDZiIv:Q3La/KDLI4MWuPTxAIv
MD5:	B10E37251C5B495643F331DB2EEC3394
SHA1:	25A5FFE4C2554C2B9A7C2794C9FE215998871193
SHA-256:	8A6B926C70F8DCFD915D68F167A1243B9DF7B9F642304F570CE584832D12102D
SHA-512:	296BC182515900934AA96E996FC48B565B7857801A07FEFA0D3D1E0C165981B266B084E344DB5B53041D1171F9C6708B4EE0D444906391C4FC073BCC23B92C37
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..

C:\Users\user\AppData\Roaming\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:///C:\Users\user\AppData\Roaming\svchost.exe>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.834655855253919
Encrypted:	false
SSDEEP:	3:HRAbABGQYm5uON+EaKC5ZACovQJ4ovsvXWKALPEkpEisKEx2NTGNKMACovn:HRYFVmwON7aZ5UvQJlvsubL8kpJsKEQJ
MD5:	53D73125CC9EC1BEEF70E81B95FD9FB6
SHA1:	FEA83558D2739C0ACA28CA8EC1358A363DD035FB
SHA-256:	B3B49B149FFD4174240A52ACF605B641FF67C1684421AEE22C50A7C28BC40317
SHA-512:	15AC6C87E4677CA276F51E6E2CFD7B2F9B9F93ECE71AB73E68F9C79D8D2032A16ED1F4DA558878C06E185826B640F65E71A2DD6CFAFF5FF97881C063E5B2CE9B
Malicious:	true
Yara Hits:	Rule: URL_File_Local_EXE, Description: Detects an .url file that points to a local executable, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url, Author: Florian Roth (Nextron Systems) Rule: Methodology_Suspicious_Shortcut_Local_URL, Description: Detects local script usage for .URL persistence, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url, Author: @itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)
Preview:	[InternetShortcut]..URL=file:///C:\Users\user\AppData\Roaming\svchost.exe..IconIndex=0..IconFile=C:/Users/user/AppData/Roaming/svchost.exe..

C:\Users\user\AppData\Roaming\svchost.exe

Download File

Process:	C:\Users\user\Desktop\a8BgfRCsUv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3075441
Entropy (8bit):	4.593559525776207
Encrypted:	false
SSDEEP:	24576:Rr8WJm8MoC9Dq9onkn+rnMSBLGLS0yt1huc82KT31obI:RZjQ+9ok+nMSBLGm0Yhu52y31
MD5:	AE7795F6305AD315589FF4846AD1EF14
SHA1:	71F4143D89CE0DCB5729E2A8B2CD54BC9B423E65
SHA-256:	074C7AA722FF77DF5ED56B655CC11DA0288550A7405DC439BE4417C6FCCF7D5F
SHA-512:	CCA6B64D61962E9DFB53802A52EE397FD1BF3213A97313362EA74E751D05E38319E807C423A0D834D6067CFF2C44D31D616BA119EA42F4A03B253DB42E7D8317
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Chaos_1, Description: Yara detected Chaos Ransomware, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: Joe Security Rule: JoeSecurity_Conti_ransomware, Description: Yara detected Conti ransomware, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: Joe Security Rule: MALWARE_Win_Chaos, Description: Detects Chaos ransomware, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92% Antivirus: Virustotal, Detection: 81%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H..`.................R...........p... ........@.. ....................................@.................................Hp..S.................................................................................... ............... ..H............text....P... ...R.................. ..`.rsrc................T..............@..@.reloc...............Z..............@..B.................p......H.......l:...5...........................................................(......0..........(....,..(....~....,.(....~....,.~....(....+.~....,.~....(....~....,.(....(....~....,$~....,.(....~....,.(....~....,.(....~....,.~....(....(....~....-........s.........~....s....(.....s"...(......0..2.......(....o....(.......(.......(....,.~.... ....Z(.......0..e.......(.....(...........+E.......o.....o....o....(....o....(....,..o.....o............&.....X.......i2..............6P..

C:\Users\user\AppData\Roaming\svchost.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\a8BgfRCsUv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Contacts\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\Contacts\desktop.ini

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (756), with no line terminators
Category:	dropped
Size (bytes):	756
Entropy (8bit):	5.962033775528535
Encrypted:	false
SSDEEP:	12:fMEJFVX1sadiVS+wOanZJTzbLmu+gVVEHa1J1I4EUJkM9FfbKwPn47F5lwFVd8ld:fMsVXpZ+kJHmu++EH2JCUWGLfUWjdQd
MD5:	5DC831140B81661BD523C5D1C4C1C977
SHA1:	65134C18305C7474E4F5A642CA2AFF4655D2F863
SHA-256:	3B766209F0CE977A0D0E91CEE9609454702686386F5C7FD9EFC492990FBA8D51
SHA-512:	401D5A09AE6D198CC333E98C5EBB797A357EECA704106EE7486CFC950F817647BF7051B44476C885327BAF6A17D1BC47824FF8CF4B72328C27DA721AAC8EE6FB
Malicious:	false
Preview:	<EncryptedKey>M75XmjmBBJnSuFQV1O1IBBnepxpIEYTmZKrmAGXW+VCBGawhROUr5HoGxrdJR3hwuY8Sk/MkjxAB/svwzaPhKv5UBZrMFFxgkEWAPFXLDWN2vwux6vXq9u5gpBTXyKIo2sluRPZCGW2HZs4qOm/ZnW38N7+9GtZZuDfIxa7whoQ=<EncryptedKey>rQ15QXQaFJqYFwuGSWlEFX8I58RWE2765ZIGkd7mD28sOKqe4UZvlAZ3Z66QfMNJ7DBIh2OOiXQSn7299LJ/+9gQu+ExpDchd1lU+tDmAcn+f+fY9PTsvcuhOg7Lpr1lLYUeWfQOMNZNCNYgtHJKCYuWkIr7D5f8Vy0Tfa3zjhFsJrulr6DaG/okhBB38yDKDI5J5T5oGfi7BIAV1qiwzid4XDORJpiWUZCms0luCmS4f0gFlv2TD/CpaUCZP+qqCd6N7BJ6D683ycYz+ZQXI2aXqgvYyp2IsMD4YfidubS/tAaFTqNyvB1xuFGzX2//j8jBAP4P3OeP/gkUu50f8H1xVfAD8AEdhsnsQND+mYQjQ9s+4Rwo15M2VSZh33W7gNSn8+cuCfg6SQykf5PrJ8sKBe3aa/F8r/jayrwQ/Z/gxoP3yIaa633zj/KV/y7aDdZfN5XUT3PE+03jNhOdBvzp5DIALkt3IcuLyqOvWPtxkYAkFTnUbt5CEuIMmeR/ZZO6guotChNHNuJBbsiQ0WzZRC9ty631VHEXBCrcNpQ=

C:\Users\user\Contacts\desktop.ini.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (756), with no line terminators
Category:	dropped
Size (bytes):	756
Entropy (8bit):	5.962033775528535
Encrypted:	false
SSDEEP:	12:fMEJFVX1sadiVS+wOanZJTzbLmu+gVVEHa1J1I4EUJkM9FfbKwPn47F5lwFVd8ld:fMsVXpZ+kJHmu++EH2JCUWGLfUWjdQd
MD5:	5DC831140B81661BD523C5D1C4C1C977
SHA1:	65134C18305C7474E4F5A642CA2AFF4655D2F863
SHA-256:	3B766209F0CE977A0D0E91CEE9609454702686386F5C7FD9EFC492990FBA8D51
SHA-512:	401D5A09AE6D198CC333E98C5EBB797A357EECA704106EE7486CFC950F817647BF7051B44476C885327BAF6A17D1BC47824FF8CF4B72328C27DA721AAC8EE6FB
Malicious:	false
Preview:	<EncryptedKey>M75XmjmBBJnSuFQV1O1IBBnepxpIEYTmZKrmAGXW+VCBGawhROUr5HoGxrdJR3hwuY8Sk/MkjxAB/svwzaPhKv5UBZrMFFxgkEWAPFXLDWN2vwux6vXq9u5gpBTXyKIo2sluRPZCGW2HZs4qOm/ZnW38N7+9GtZZuDfIxa7whoQ=<EncryptedKey>rQ15QXQaFJqYFwuGSWlEFX8I58RWE2765ZIGkd7mD28sOKqe4UZvlAZ3Z66QfMNJ7DBIh2OOiXQSn7299LJ/+9gQu+ExpDchd1lU+tDmAcn+f+fY9PTsvcuhOg7Lpr1lLYUeWfQOMNZNCNYgtHJKCYuWkIr7D5f8Vy0Tfa3zjhFsJrulr6DaG/okhBB38yDKDI5J5T5oGfi7BIAV1qiwzid4XDORJpiWUZCms0luCmS4f0gFlv2TD/CpaUCZP+qqCd6N7BJ6D683ycYz+ZQXI2aXqgvYyp2IsMD4YfidubS/tAaFTqNyvB1xuFGzX2//j8jBAP4P3OeP/gkUu50f8H1xVfAD8AEdhsnsQND+mYQjQ9s+4Rwo15M2VSZh33W7gNSn8+cuCfg6SQykf5PrJ8sKBe3aa/F8r/jayrwQ/Z/gxoP3yIaa633zj/KV/y7aDdZfN5XUT3PE+03jNhOdBvzp5DIALkt3IcuLyqOvWPtxkYAkFTnUbt5CEuIMmeR/ZZO6guotChNHNuJBbsiQ0WzZRC9ty631VHEXBCrcNpQ=

C:\Users\user\Desktop\BUFZSQPCOH.pdf

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.988814546379837
Encrypted:	false
SSDEEP:	24:fMsrTPtptEL+JcYbKxfMqhVcUOekDEiuikPeiofJ41KoNU9ckpf7Q25I4AJpR:UMT1puCJLEhVc8dPlYMKwSpTQy2R
MD5:	2C40CD90DB529097C7EA97ACECF202A9
SHA1:	3CAC02613689F9380B3FFE7A7A760AAA67097BAD
SHA-256:	1EF698027E536E7F7573E56F483F175A5CA95A6D479BCFA03A71D8DB3C2D6F09
SHA-512:	67F35424B5CBD39E4F884C8FA6D2D5459AA05D7C10CCB77F3BF030C33F03EEFFE53AC508E4DC4ED6C4D56D2E31E2DCA38D7A536208912B6843BAEDE8FC531F47
Malicious:	false
Preview:	<EncryptedKey>d625sBHsB9+RaXvjHLdVSyxjWcq9ze6kt/HJk3z47tqfu25XfG0baeJ8c7mids3+y4hwmJxMSiNAMm45ZnExSfyOhu1vpBEtVlxX8XuDMjYPi9K1tOB1onw5haLfLlgkmnP7ZDYo5Qb8T3/UxM4fcYyXfSwyh1n6mbqyn4OxU8Q=<EncryptedKey>dOHCfxbQHsAkxCF4g6rcZ0NuZisguDpI/z6hxMeFD8kgOolPj+XFn+n7PMWZ1nCIIeFgBTjAz5G2V8nlOr6d5R9RhMgSGlKx2W+kmg1X0QM+7XqGgMBLSdoOjtYGA4slliPeTPvBf2446ilZ0F6yYbObL3nfHravNcTg6U5vY4vXJCRlcA+wIyN4XYvQoKx0EKjQsrDJ1QYzB0U0FNzl6SwX+eF8NddGmzeXndRA1qeapwHT0Hm6H97bpzgh++tmvdOkLI/K83Im23ZyG1hDP4ueHjT1OQX1VnKQ0ezvlXX60s3Dr2Ci1eQKtZl01PwpQprfmTaMiCMc0VClaEdRRIfHVRSezrF/8NAOjWDtcEymwV664FVvBVypDb8KIUD28RE6lWsaW8B13cCd3fkHCVEgR/DHDDFLMEIXJfT6dJFIvNeo6wq8YKzlsqnqM3JAjQvVrU8fdU3D/MNlSOmf/Zyz8lvqaQf4AOPkUbXt6maLVeEEPPv7OJDvm52b0irjUPOqCEwXtXQHN1UyLZswREbCQvCA4DA70hT35EMd0l3XqtrZZgTDNwpk4yc5vmjK+6xinaiFGDcoITvI7gq5F0p1xTlo2AwXJPAgxHXMn/1XksK3SJj6BsLsmUxBB2BP8tCC0kcsxnhy496KbTgEB1exspr1ZpxLfkfHcGxLbk4dmndK6Z0LNplrPiiQ+LekxokTS9P4UBRshdmfK0Mvs+25CHgaA/sYlEUZ7ka5ByffitdIgDlzFfKhScqeFxTj1/en/xxAkwCWOdLF74JFX5jlZsDBnw8n

C:\Users\user\Desktop\BUFZSQPCOH.pdf.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.988814546379837
Encrypted:	false
SSDEEP:	24:fMsrTPtptEL+JcYbKxfMqhVcUOekDEiuikPeiofJ41KoNU9ckpf7Q25I4AJpR:UMT1puCJLEhVc8dPlYMKwSpTQy2R
MD5:	2C40CD90DB529097C7EA97ACECF202A9
SHA1:	3CAC02613689F9380B3FFE7A7A760AAA67097BAD
SHA-256:	1EF698027E536E7F7573E56F483F175A5CA95A6D479BCFA03A71D8DB3C2D6F09
SHA-512:	67F35424B5CBD39E4F884C8FA6D2D5459AA05D7C10CCB77F3BF030C33F03EEFFE53AC508E4DC4ED6C4D56D2E31E2DCA38D7A536208912B6843BAEDE8FC531F47
Malicious:	false
Preview:	<EncryptedKey>d625sBHsB9+RaXvjHLdVSyxjWcq9ze6kt/HJk3z47tqfu25XfG0baeJ8c7mids3+y4hwmJxMSiNAMm45ZnExSfyOhu1vpBEtVlxX8XuDMjYPi9K1tOB1onw5haLfLlgkmnP7ZDYo5Qb8T3/UxM4fcYyXfSwyh1n6mbqyn4OxU8Q=<EncryptedKey>dOHCfxbQHsAkxCF4g6rcZ0NuZisguDpI/z6hxMeFD8kgOolPj+XFn+n7PMWZ1nCIIeFgBTjAz5G2V8nlOr6d5R9RhMgSGlKx2W+kmg1X0QM+7XqGgMBLSdoOjtYGA4slliPeTPvBf2446ilZ0F6yYbObL3nfHravNcTg6U5vY4vXJCRlcA+wIyN4XYvQoKx0EKjQsrDJ1QYzB0U0FNzl6SwX+eF8NddGmzeXndRA1qeapwHT0Hm6H97bpzgh++tmvdOkLI/K83Im23ZyG1hDP4ueHjT1OQX1VnKQ0ezvlXX60s3Dr2Ci1eQKtZl01PwpQprfmTaMiCMc0VClaEdRRIfHVRSezrF/8NAOjWDtcEymwV664FVvBVypDb8KIUD28RE6lWsaW8B13cCd3fkHCVEgR/DHDDFLMEIXJfT6dJFIvNeo6wq8YKzlsqnqM3JAjQvVrU8fdU3D/MNlSOmf/Zyz8lvqaQf4AOPkUbXt6maLVeEEPPv7OJDvm52b0irjUPOqCEwXtXQHN1UyLZswREbCQvCA4DA70hT35EMd0l3XqtrZZgTDNwpk4yc5vmjK+6xinaiFGDcoITvI7gq5F0p1xTlo2AwXJPAgxHXMn/1XksK3SJj6BsLsmUxBB2BP8tCC0kcsxnhy496KbTgEB1exspr1ZpxLfkfHcGxLbk4dmndK6Z0LNplrPiiQ+LekxokTS9P4UBRshdmfK0Mvs+25CHgaA/sYlEUZ7ka5ByffitdIgDlzFfKhScqeFxTj1/en/xxAkwCWOdLF74JFX5jlZsDBnw8n

C:\Users\user\Desktop\BWDRWEEARI.docx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.993723703678881
Encrypted:	false
SSDEEP:	24:fMoEtMz7Ex5HAXdtvsFq93MDKJ2iRRYrdUNy8fKwSbhmZT5et66qj/2SJCZ9H:UoEtKQT+998mYr45EAatqCRZ9
MD5:	86203D74A8E1D059BA5D2FE07A7585F7
SHA1:	9BC958F2750B910199154E8327C99B5E991FAF46
SHA-256:	1E457A85DB75000F8F05A4CAEA39648B88C803164616FB5EEAF957869E1227ED
SHA-512:	F8CA54006661D6AFA4239179B7C879AA0202713ADC1CC2CED4A1F8D80015F704D1C9D041C8D40E5EBA9656E40D3D60CB86A89BD18EB39D1317E81A89CC2CAECF
Malicious:	false
Preview:	<EncryptedKey>kjLJ0NYsk72PX1YYnBhGO6UmCOjEzz6TyY2kMiisRS8skZeSQQbwdGWSnmeNzuu3P/0OMhGdTi86EdzSbg+0ilYR7H8Gmo96t020vrnwALetB5liCdbY7kKv/co/j0gkSHgZHJqGuKxj3LCkodL2DetfTiiDjtEoeT3QmP7rz5Y=<EncryptedKey>FT8d6ImpTAZG4B3hDHYbu4Ob+1yijbhctOlD7NxrP9P5/sCDCEsfK3wZPUSmUbiakt4DE63C0jlrv2IqZHcJV/phVQu9EG4KbKIszKJZrmUqbJCXI1WCk6qpQHMPWEKhLfLtAXPgjAu9EFneQtv3CBc55NHdHcdN/GohuXl0D5tuaJSBioriZ2Vox8xRe+2FiH7wDQP4ERbgxxHJYuKGV70jpT6T9uxyjAuD1T0NaZaPiXf7u5wOLk65kDmuTYDlxF42RNGLpew/6cU+Ydp7dIKw6POzF0hScw4Z6AEI2SS9NOqO7OkcGYHsyIJdR9QC90u5kUQFpVgArTAMEP0fVgowMvBYtRXJgrhmsRPg8fEqHabDwTpZeyr5UnpWIqKs+vFot/whGbgUC97Q5cRaNgYRa8ramBx9autA6pB1DHH7PmqlBKI9PpWG0RG2aWItLuJjKTq2amqgxP/fudObJmIA3aMljOvWKwGBiI+liuVmXK1jt+8zEuY8VxvTDHjdQRLk8OvAg085DBlqC1HVlhOdb9512d/9o+Tvq+Qwjb3xazFtVDXBDM/ry+zl5jxJxA5i0XTiCiV8QtKeKckdtxKKqVL+HE6lnqfkM0BxxnXSeKxoFJ22LuJVr05HYOuKALFicWGXm4J9guZme8CEJkF2AUGtwwKr1AghslRK41AWYJauUTkiQt6S0b7KxPwZCfsKMWWLwiQndc97KTJDHRL0BvlG1IhlvyQq1a+6ntnt64+zLLPbX6UvtXjGqefRUJF6x22EtRHrI1EmwpBANIDzkiyOKdVY

C:\Users\user\Desktop\BWDRWEEARI.docx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.993723703678881
Encrypted:	false
SSDEEP:	24:fMoEtMz7Ex5HAXdtvsFq93MDKJ2iRRYrdUNy8fKwSbhmZT5et66qj/2SJCZ9H:UoEtKQT+998mYr45EAatqCRZ9
MD5:	86203D74A8E1D059BA5D2FE07A7585F7
SHA1:	9BC958F2750B910199154E8327C99B5E991FAF46
SHA-256:	1E457A85DB75000F8F05A4CAEA39648B88C803164616FB5EEAF957869E1227ED
SHA-512:	F8CA54006661D6AFA4239179B7C879AA0202713ADC1CC2CED4A1F8D80015F704D1C9D041C8D40E5EBA9656E40D3D60CB86A89BD18EB39D1317E81A89CC2CAECF
Malicious:	false
Preview:	<EncryptedKey>kjLJ0NYsk72PX1YYnBhGO6UmCOjEzz6TyY2kMiisRS8skZeSQQbwdGWSnmeNzuu3P/0OMhGdTi86EdzSbg+0ilYR7H8Gmo96t020vrnwALetB5liCdbY7kKv/co/j0gkSHgZHJqGuKxj3LCkodL2DetfTiiDjtEoeT3QmP7rz5Y=<EncryptedKey>FT8d6ImpTAZG4B3hDHYbu4Ob+1yijbhctOlD7NxrP9P5/sCDCEsfK3wZPUSmUbiakt4DE63C0jlrv2IqZHcJV/phVQu9EG4KbKIszKJZrmUqbJCXI1WCk6qpQHMPWEKhLfLtAXPgjAu9EFneQtv3CBc55NHdHcdN/GohuXl0D5tuaJSBioriZ2Vox8xRe+2FiH7wDQP4ERbgxxHJYuKGV70jpT6T9uxyjAuD1T0NaZaPiXf7u5wOLk65kDmuTYDlxF42RNGLpew/6cU+Ydp7dIKw6POzF0hScw4Z6AEI2SS9NOqO7OkcGYHsyIJdR9QC90u5kUQFpVgArTAMEP0fVgowMvBYtRXJgrhmsRPg8fEqHabDwTpZeyr5UnpWIqKs+vFot/whGbgUC97Q5cRaNgYRa8ramBx9autA6pB1DHH7PmqlBKI9PpWG0RG2aWItLuJjKTq2amqgxP/fudObJmIA3aMljOvWKwGBiI+liuVmXK1jt+8zEuY8VxvTDHjdQRLk8OvAg085DBlqC1HVlhOdb9512d/9o+Tvq+Qwjb3xazFtVDXBDM/ry+zl5jxJxA5i0XTiCiV8QtKeKckdtxKKqVL+HE6lnqfkM0BxxnXSeKxoFJ22LuJVr05HYOuKALFicWGXm4J9guZme8CEJkF2AUGtwwKr1AghslRK41AWYJauUTkiQt6S0b7KxPwZCfsKMWWLwiQndc97KTJDHRL0BvlG1IhlvyQq1a+6ntnt64+zLLPbX6UvtXjGqefRUJF6x22EtRHrI1EmwpBANIDzkiyOKdVY

C:\Users\user\Desktop\BWDRWEEARI.xlsx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.986967409924134
Encrypted:	false
SSDEEP:	24:fM4UbnrLFbRnNo93xBBJKqSSvIm3WBFLzZl0dPYRkzNJfTk4A7n5ckWIrKliN3:U4UzHO7VKpSvF3S2FnTk4Kn3Wkiid
MD5:	AF1725C4DDAD83782AA6C36610D746A8
SHA1:	5647600D6485FBC8E6F21190DB9ECB2B78A3A7F4
SHA-256:	5CE2FCD0877B817918D22A0324049CA082C89C56EC25DB472B51DE40D7ACFFFA
SHA-512:	98EF7125C241852AE3B6389F000CDFE77BF53688870FF81AA64C9932AC5D8FB8EDA40807AD1C480ECD918DA11EBDD1A8812A2EFDFCC47D95BE63E9A9F1B69FAC
Malicious:	false
Preview:	<EncryptedKey>Xayih35pR0h6TybegUKc3EJxwvqbm3Qe8ykRaktnzQ0EJIvBma2Gn81U0CDcwVMK88qQqGppYFESSKdSuUFPdiUpq18DmpS/MRtln9yA0zZUq5pfgPmJ2NDasvYXBF9+pUZkrzONw2SNz46VptDIqHeUXil/dMUHFNxNKy8jrFg=<EncryptedKey>5WjRgCgbkvPNeocmkh+bBKPFbZ7npP2YKT53WBUmzxsYJOwlfSsJv3kfAUtkNAmh3D09/vX572FvlcICh2W+vuxgQJN2UBZA6EOf/zsb0Z4mcMceBF/3g8pWfQETul700zhZ8g4BEHYs90xyJX6xaXZDmMO+A5E5NQQX8SjvhlEF/pHpTk3yxceoBisjQ8bG3EyxrbU92++A/8rgOk82mU4y23q+wuYdbnReoWrvdmaT8RBXiLUgi93+ctnhh35lwueOzNoDVPPoYu0yDtxxlGAYev9KAlqplbrCXcx8gBvexWdBJoJHmfmw8K1KPd2uagZ7FS2gdULoU0L7anwO1VJbznEETPe6IvakAS+4EPT15MJ2LiT+/dlluU/GgZro2dj8m0sZhYAMAd3PPfltMkfkBGmZ4AYsYP2/uwLtmXWrQx0tVI4LJ7hrJmpq0JEf87d28m80JCQEusXB2LfyR80r6+QpiMsw04IK/ENZrftbOs2yvOlA99aAaBRMTlEtXmMLsb6lHzvSrbr2+oA8wFZn1RZ4C4zr16LTRMvtBq9FGxW6C+sxyl4AVLMBEbKscsjmZ2MEdep2+yKdJZ7pDnkrtInNeMoE8XIaQCAy+UzV6uiss3JMlUW0V7Mt4TQky+SQ+Z4K5TKvOdMQVNM7W+tOa9UGLQTTOSnPuWN+wuESIXz2kJm4lXMZp7GLn7X/UP7iw8MF8A8yP8pBTzgj77O38jp2WhgdatRuRuqoXpUIzHyYiMTxCX6hxh5XgBUHKGq6sxH4ye9PERhk5kGU8AkFjX3p3ccR

C:\Users\user\Desktop\BWDRWEEARI.xlsx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.986967409924134
Encrypted:	false
SSDEEP:	24:fM4UbnrLFbRnNo93xBBJKqSSvIm3WBFLzZl0dPYRkzNJfTk4A7n5ckWIrKliN3:U4UzHO7VKpSvF3S2FnTk4Kn3Wkiid
MD5:	AF1725C4DDAD83782AA6C36610D746A8
SHA1:	5647600D6485FBC8E6F21190DB9ECB2B78A3A7F4
SHA-256:	5CE2FCD0877B817918D22A0324049CA082C89C56EC25DB472B51DE40D7ACFFFA
SHA-512:	98EF7125C241852AE3B6389F000CDFE77BF53688870FF81AA64C9932AC5D8FB8EDA40807AD1C480ECD918DA11EBDD1A8812A2EFDFCC47D95BE63E9A9F1B69FAC
Malicious:	false
Preview:	<EncryptedKey>Xayih35pR0h6TybegUKc3EJxwvqbm3Qe8ykRaktnzQ0EJIvBma2Gn81U0CDcwVMK88qQqGppYFESSKdSuUFPdiUpq18DmpS/MRtln9yA0zZUq5pfgPmJ2NDasvYXBF9+pUZkrzONw2SNz46VptDIqHeUXil/dMUHFNxNKy8jrFg=<EncryptedKey>5WjRgCgbkvPNeocmkh+bBKPFbZ7npP2YKT53WBUmzxsYJOwlfSsJv3kfAUtkNAmh3D09/vX572FvlcICh2W+vuxgQJN2UBZA6EOf/zsb0Z4mcMceBF/3g8pWfQETul700zhZ8g4BEHYs90xyJX6xaXZDmMO+A5E5NQQX8SjvhlEF/pHpTk3yxceoBisjQ8bG3EyxrbU92++A/8rgOk82mU4y23q+wuYdbnReoWrvdmaT8RBXiLUgi93+ctnhh35lwueOzNoDVPPoYu0yDtxxlGAYev9KAlqplbrCXcx8gBvexWdBJoJHmfmw8K1KPd2uagZ7FS2gdULoU0L7anwO1VJbznEETPe6IvakAS+4EPT15MJ2LiT+/dlluU/GgZro2dj8m0sZhYAMAd3PPfltMkfkBGmZ4AYsYP2/uwLtmXWrQx0tVI4LJ7hrJmpq0JEf87d28m80JCQEusXB2LfyR80r6+QpiMsw04IK/ENZrftbOs2yvOlA99aAaBRMTlEtXmMLsb6lHzvSrbr2+oA8wFZn1RZ4C4zr16LTRMvtBq9FGxW6C+sxyl4AVLMBEbKscsjmZ2MEdep2+yKdJZ7pDnkrtInNeMoE8XIaQCAy+UzV6uiss3JMlUW0V7Mt4TQky+SQ+Z4K5TKvOdMQVNM7W+tOa9UGLQTTOSnPuWN+wuESIXz2kJm4lXMZp7GLn7X/UP7iw8MF8A8yP8pBTzgj77O38jp2WhgdatRuRuqoXpUIzHyYiMTxCX6hxh5XgBUHKGq6sxH4ye9PERhk5kGU8AkFjX3p3ccR

C:\Users\user\Desktop\BWDRWEEARI\BWDRWEEARI.docx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.99275116621444
Encrypted:	false
SSDEEP:	24:fM05ofKjm6Yhajq2j1sTrcKevLwu6gzGj7KMWZ5gPJB9VkM74PF0VUoiUaooM482:UZ6mnh8Jj1eDevvbGvuZ5EaoosuTGy
MD5:	428EA45C95F39ABEF8A9D99FA7274922
SHA1:	E288724BE380CC6FECECC3B20F508EA717985811
SHA-256:	4DFC03AF11E3173C76C3C8FA9ECD0B69787D30A3606C404EDF5B68D801306917
SHA-512:	DAA293D7A7F63B1C64CCA54004D1D0613C6D6F5C86222DD1E30ED3EB7C601869B64C7E8091900045BF55F4FD5D641800B66B32A346E5F6D4ED279D7F8FBC9079
Malicious:	false
Preview:	<EncryptedKey>l7ssIiHd7XfEPLCO7+XDQk2DlUQf86Mg+kSzmJ7aGAfv+swn06/iHessbB0FzyJQdkdJpa8Yhk0tX6wo5pCXAycZUds6VfyqQlc3ZQuQWYcB4oG6HLPCYfq/e5xNlHYSEc3Pu8ZBqWpthNCKfmlda8JaA2Qf3oin0Hfm6+KI81I=<EncryptedKey>giu0urL+wWcAOoPKMkP2xo+3k9J+2JYH4POfI+6lr0qs6RrBTftQTfkFI8xCy1/5S7tFBn8oWG9S9TC+LB0HLsbsM5fQw8ZHrMbOeYiHCliXSgJiyFgCgunbnEcS2y+S0NgF9Nc5U+Ia0tEl3qHy5x93yCYU1bcRLRHG9mYAMh1hM5lEUhb+DbwkbamvHr+2MdwYopfTqzoBhnMO15LybYdApIWSXVIkot/rmlN8HJ9cQSxZKvgHh6+FyR3+J8GqmQf+O0iW1zYI8Bmx0d73wtNV6pMvmRZrTG0Rb186ZfxTkbuwcoVpyhiBxvgE9LnsA2r9ilcW3mOxDQyRAUb2Jx9+BKiuQHN/PCPGdKQYFy71kuo4jxv/xtMPUEvxtQyI7VWQ73CKMRhCRnRoVDdJlmzcFwGbrJUxH9o9gz12sGmP6xg2cAPDYi1bt0/ENvyaJh0jJ7ZqOs/Ts5OMBJ7hfmrqwkvqUyNz4V6UleefL6dLKYUXFvDY6PiNHhLZToObjbrLhaUvfQL0s+3uHmXKhvUQNOXFj80Qb5lGQ8ljYdGc5WYyUBkbOxpho2n/gC79cBwzaHicSQ8m2fRLN25Aems8nPNwZVGLhvs89R39X/pmaMMmIfJcGkM4e4/nksh1Yp17rrJ0BNlQTrpk+cOWAdm1SWIKD8+gYvHF4gEveWHALXYcttDDX4UsZs+KOVeqoJ18zcm3Z47Hlk/JmL214+y41FB4u7+FuVn/0vM3nBofBC8/EIn/82kW5UlhntRlCmrK1DHanqSvIroR55HL9kOKbUpLWLIC

C:\Users\user\Desktop\BWDRWEEARI\BWDRWEEARI.docx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.99275116621444
Encrypted:	false
SSDEEP:	24:fM05ofKjm6Yhajq2j1sTrcKevLwu6gzGj7KMWZ5gPJB9VkM74PF0VUoiUaooM482:UZ6mnh8Jj1eDevvbGvuZ5EaoosuTGy
MD5:	428EA45C95F39ABEF8A9D99FA7274922
SHA1:	E288724BE380CC6FECECC3B20F508EA717985811
SHA-256:	4DFC03AF11E3173C76C3C8FA9ECD0B69787D30A3606C404EDF5B68D801306917
SHA-512:	DAA293D7A7F63B1C64CCA54004D1D0613C6D6F5C86222DD1E30ED3EB7C601869B64C7E8091900045BF55F4FD5D641800B66B32A346E5F6D4ED279D7F8FBC9079
Malicious:	false
Preview:	<EncryptedKey>l7ssIiHd7XfEPLCO7+XDQk2DlUQf86Mg+kSzmJ7aGAfv+swn06/iHessbB0FzyJQdkdJpa8Yhk0tX6wo5pCXAycZUds6VfyqQlc3ZQuQWYcB4oG6HLPCYfq/e5xNlHYSEc3Pu8ZBqWpthNCKfmlda8JaA2Qf3oin0Hfm6+KI81I=<EncryptedKey>giu0urL+wWcAOoPKMkP2xo+3k9J+2JYH4POfI+6lr0qs6RrBTftQTfkFI8xCy1/5S7tFBn8oWG9S9TC+LB0HLsbsM5fQw8ZHrMbOeYiHCliXSgJiyFgCgunbnEcS2y+S0NgF9Nc5U+Ia0tEl3qHy5x93yCYU1bcRLRHG9mYAMh1hM5lEUhb+DbwkbamvHr+2MdwYopfTqzoBhnMO15LybYdApIWSXVIkot/rmlN8HJ9cQSxZKvgHh6+FyR3+J8GqmQf+O0iW1zYI8Bmx0d73wtNV6pMvmRZrTG0Rb186ZfxTkbuwcoVpyhiBxvgE9LnsA2r9ilcW3mOxDQyRAUb2Jx9+BKiuQHN/PCPGdKQYFy71kuo4jxv/xtMPUEvxtQyI7VWQ73CKMRhCRnRoVDdJlmzcFwGbrJUxH9o9gz12sGmP6xg2cAPDYi1bt0/ENvyaJh0jJ7ZqOs/Ts5OMBJ7hfmrqwkvqUyNz4V6UleefL6dLKYUXFvDY6PiNHhLZToObjbrLhaUvfQL0s+3uHmXKhvUQNOXFj80Qb5lGQ8ljYdGc5WYyUBkbOxpho2n/gC79cBwzaHicSQ8m2fRLN25Aems8nPNwZVGLhvs89R39X/pmaMMmIfJcGkM4e4/nksh1Yp17rrJ0BNlQTrpk+cOWAdm1SWIKD8+gYvHF4gEveWHALXYcttDDX4UsZs+KOVeqoJ18zcm3Z47Hlk/JmL214+y41FB4u7+FuVn/0vM3nBofBC8/EIn/82kW5UlhntRlCmrK1DHanqSvIroR55HL9kOKbUpLWLIC

C:\Users\user\Desktop\BWDRWEEARI\DUKNXICOZT.png

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.99357219378322
Encrypted:	false
SSDEEP:	48:Um5uAluIMryqR2k4pXG5hE+YiIRMrtkKHU8t:UMkIMOq0katRsuK08t
MD5:	3F49374A06DAFAA00F182736D1A97ED6
SHA1:	F1282DB0B9CF76B1A6E163EF0F16EF137E792E30
SHA-256:	C68FD28B78700CFFB4E32DBB562DDC03AF5F212A3DFF8EB852DC48D6AC02C8EC
SHA-512:	E25E79C2E87AFE7D01990F6C13E8F74A8B0FAE54C58E7C3F40433A9825BF25421F762EF9B55AF300DD26FE8CDA6D5991C69C3D8D5B96535FAD134FD0BDAF4292
Malicious:	false
Preview:	<EncryptedKey>ERq5ObRno9ysR5xntnYNl5tUGvqbQ9+YTAp+DaB7mf86tBTtkMhicHuORjsvn+AFCXeNMWRQH+i/GCjkgyCdXX4eZVoxgB8gzisZKxSQ2+hJjhB99tGi0d0TgomIgAtUBzux592zmFHoS7AazkH45mn4dLHgZxAimZGCl6pQAC0=<EncryptedKey>Kc3fxxmPLNKOV8KS/aeHFYtMEA524ZK0T8ccQ+aj+f8p3+OoMMh+F6ZraMUDC+TooFu53HjBFKOupRAzfjNYg9d1niCbwzHPjhqhYVy/tHttyoaW8C05+rQn5LzkRwyXGc+KjaH7J8EKXPS1HM8evVu7wzEI+5lislsq+UOorkoXHLpjdk7tFnAKmH1TnbeKPYZL5OlVq8+zlIUGLK8u5H6wg8tJSYAbxtfLDyOfXrp+r8nNqToBlqDKw6WDOiaiI4AENy+Lucq/FThG5Xi0X2meLp07UPq/OMTBDjIrryai2oJAnReTcWdaab19LUHFabixxUJa1TFTVnSUfACrM2InluBUy52QL03UQtloAWMkczjBdhuxNBfE1AsKNre3wsWtCVjszTfkCm1zMduayxUPd5Z8XB4JWepL2kTiIvxu7paeL75c0Hs4IhPi4koNRUPzq/2VAT5SywFuFgqVdWinBHsrmyo8MJqbboKrElawWoflHXScWiDHhYhYlrW/bCk8OEHN6HABn0HqMbLcmmeBcHQU9WI/qY81QHCsVpDN6/uu9sWMu2MN8kPe5S3vdJByvBCC5tp16T05Je8iQxjvyEO6r0lY7HAFAw8kd4hIpfPUx9sw64TsOv22Dh4dEtG88lrvLx+pPZQ2XWN+LqIWRJPmKNlNZGdQHpkrfaGqD32odE8uUHiMONHt9lCFaZRawg+v9ewFReli5PjA2EIrZ9C97Mrgv7GOfYg1D/GC6KaLx9gZQLMQDDVLOxjzGaWS36fAkYyONnvJD2NfbUYZ/AOUWY/l

C:\Users\user\Desktop\BWDRWEEARI\DUKNXICOZT.png.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.99357219378322
Encrypted:	false
SSDEEP:	48:Um5uAluIMryqR2k4pXG5hE+YiIRMrtkKHU8t:UMkIMOq0katRsuK08t
MD5:	3F49374A06DAFAA00F182736D1A97ED6
SHA1:	F1282DB0B9CF76B1A6E163EF0F16EF137E792E30
SHA-256:	C68FD28B78700CFFB4E32DBB562DDC03AF5F212A3DFF8EB852DC48D6AC02C8EC
SHA-512:	E25E79C2E87AFE7D01990F6C13E8F74A8B0FAE54C58E7C3F40433A9825BF25421F762EF9B55AF300DD26FE8CDA6D5991C69C3D8D5B96535FAD134FD0BDAF4292
Malicious:	false
Preview:	<EncryptedKey>ERq5ObRno9ysR5xntnYNl5tUGvqbQ9+YTAp+DaB7mf86tBTtkMhicHuORjsvn+AFCXeNMWRQH+i/GCjkgyCdXX4eZVoxgB8gzisZKxSQ2+hJjhB99tGi0d0TgomIgAtUBzux592zmFHoS7AazkH45mn4dLHgZxAimZGCl6pQAC0=<EncryptedKey>Kc3fxxmPLNKOV8KS/aeHFYtMEA524ZK0T8ccQ+aj+f8p3+OoMMh+F6ZraMUDC+TooFu53HjBFKOupRAzfjNYg9d1niCbwzHPjhqhYVy/tHttyoaW8C05+rQn5LzkRwyXGc+KjaH7J8EKXPS1HM8evVu7wzEI+5lislsq+UOorkoXHLpjdk7tFnAKmH1TnbeKPYZL5OlVq8+zlIUGLK8u5H6wg8tJSYAbxtfLDyOfXrp+r8nNqToBlqDKw6WDOiaiI4AENy+Lucq/FThG5Xi0X2meLp07UPq/OMTBDjIrryai2oJAnReTcWdaab19LUHFabixxUJa1TFTVnSUfACrM2InluBUy52QL03UQtloAWMkczjBdhuxNBfE1AsKNre3wsWtCVjszTfkCm1zMduayxUPd5Z8XB4JWepL2kTiIvxu7paeL75c0Hs4IhPi4koNRUPzq/2VAT5SywFuFgqVdWinBHsrmyo8MJqbboKrElawWoflHXScWiDHhYhYlrW/bCk8OEHN6HABn0HqMbLcmmeBcHQU9WI/qY81QHCsVpDN6/uu9sWMu2MN8kPe5S3vdJByvBCC5tp16T05Je8iQxjvyEO6r0lY7HAFAw8kd4hIpfPUx9sw64TsOv22Dh4dEtG88lrvLx+pPZQ2XWN+LqIWRJPmKNlNZGdQHpkrfaGqD32odE8uUHiMONHt9lCFaZRawg+v9ewFReli5PjA2EIrZ9C97Mrgv7GOfYg1D/GC6KaLx9gZQLMQDDVLOxjzGaWS36fAkYyONnvJD2NfbUYZ/AOUWY/l

C:\Users\user\Desktop\BWDRWEEARI\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\Desktop\BWDRWEEARI\MIVTQDBATG.mp3

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	6.0014272273786275
Encrypted:	false
SSDEEP:	48:UXaon0YMTNXMH9omkqHmUqwvETluJo7SD0hBaiI/T:UXtn4i9oxRURvExuJo7Yche
MD5:	E7E1D970B18ADFA4AB19FFF348446A24
SHA1:	DDC8799472D8C7440DE98A9BDA4B196AA79B1483
SHA-256:	E9CBCD77842BDB93FB268FCC493870D30416D8D6450556750ECE5D9DA39896AE
SHA-512:	03301B43C6DDFF15E048C7945033B0A5B1A08A1EAFAEAB27F3A9C470F376D88E683E2C33F54A421FAE0388314A83051BCF9CA9C531593447DF4EBEF6DF937C45
Malicious:	false
Preview:	<EncryptedKey>dRUcsdEudadZ66AOTnt893DI/exF6eE2N3OmletDz8r8QTUKMw9uVtACLx91TsAd4C7TqpeEtMc9oUie15P0oFv06BeWAPiFs0vMa/CIccOTM8C7Q744h9gWpBXR7XAmSquD0Mr2LgK7j0YCFDr8zIRnWnjCMWbNeE/Zs+Z9jc4=<EncryptedKey>+liXdcbcvSc0ZQhFS9RMr0bIMIuP5PibGxodQ5xmO99NOHpwNQL8/3b9KA+8C6BGhiGvo4ANW3jVBWJSzDTzIVSPhtx9z43nYj9xIwL/kaJvvcgdrbhpKZOh7Tgvrqq/EM0Qye6H/gixDCqlvhUpdpz35Qj+fdCmdeN77Uicydh2NGV12xJc/rJPfCExHgpUIRsU8E7VzVOTlZbI5xnvYNFawculBC1/dinFrZ/Vy7O+lZm/2rBL0uL9LAWydSWZcqqX1dNiZIhugxmMH184esTh/jPey9jCibd36VcABXkqQCGYyLEHilCJKw+LOXBjs/hbmgLzfbSDIaEUKZBvxFSQ4e0hQayEy+6BQxmBlT2P2cFWqIfJ+VksATNnHZ5F6u9BRP8PEDYDK9BFdo/jVLsg3poZxMTR6ksm7cUkEnfSIBlC7UMPh8xlqsr5JEo9HRNIxUERwA7t2HPJlY9xiddqHwDOFP5m1aMvLzvm35wWrLgnP64NMGixBQKhM0Kgh09SZv9QPhTjRdmzJKHm1Od5SCuaXXkjn3fofYF9FcgJ1p0TV9tQ2ibKKSIHJ59QMD3xtn0wJvbXIpSwfUihTeq5Iu+hUjg4s3mDEQFFOPXPaa/5wN3p0LzaNc1AKni4iW4++EmYBMyWD3TixtYDZ6QRQ1u0MVMQZpUTidQFFuvRdrOlypMlMuUIgMvtGevzo9V3BkVIRlo41YvLnAROn/MjXfKBxOQ/OO1w+3IA6ICnsIhrSw1wHmZY5c+Y/JqqDGYFaNdUMW8zjdcpk+oQO9ACWCgZvBZc

C:\Users\user\Desktop\BWDRWEEARI\MIVTQDBATG.mp3.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	6.0014272273786275
Encrypted:	false
SSDEEP:	48:UXaon0YMTNXMH9omkqHmUqwvETluJo7SD0hBaiI/T:UXtn4i9oxRURvExuJo7Yche
MD5:	E7E1D970B18ADFA4AB19FFF348446A24
SHA1:	DDC8799472D8C7440DE98A9BDA4B196AA79B1483
SHA-256:	E9CBCD77842BDB93FB268FCC493870D30416D8D6450556750ECE5D9DA39896AE
SHA-512:	03301B43C6DDFF15E048C7945033B0A5B1A08A1EAFAEAB27F3A9C470F376D88E683E2C33F54A421FAE0388314A83051BCF9CA9C531593447DF4EBEF6DF937C45
Malicious:	false
Preview:	<EncryptedKey>dRUcsdEudadZ66AOTnt893DI/exF6eE2N3OmletDz8r8QTUKMw9uVtACLx91TsAd4C7TqpeEtMc9oUie15P0oFv06BeWAPiFs0vMa/CIccOTM8C7Q744h9gWpBXR7XAmSquD0Mr2LgK7j0YCFDr8zIRnWnjCMWbNeE/Zs+Z9jc4=<EncryptedKey>+liXdcbcvSc0ZQhFS9RMr0bIMIuP5PibGxodQ5xmO99NOHpwNQL8/3b9KA+8C6BGhiGvo4ANW3jVBWJSzDTzIVSPhtx9z43nYj9xIwL/kaJvvcgdrbhpKZOh7Tgvrqq/EM0Qye6H/gixDCqlvhUpdpz35Qj+fdCmdeN77Uicydh2NGV12xJc/rJPfCExHgpUIRsU8E7VzVOTlZbI5xnvYNFawculBC1/dinFrZ/Vy7O+lZm/2rBL0uL9LAWydSWZcqqX1dNiZIhugxmMH184esTh/jPey9jCibd36VcABXkqQCGYyLEHilCJKw+LOXBjs/hbmgLzfbSDIaEUKZBvxFSQ4e0hQayEy+6BQxmBlT2P2cFWqIfJ+VksATNnHZ5F6u9BRP8PEDYDK9BFdo/jVLsg3poZxMTR6ksm7cUkEnfSIBlC7UMPh8xlqsr5JEo9HRNIxUERwA7t2HPJlY9xiddqHwDOFP5m1aMvLzvm35wWrLgnP64NMGixBQKhM0Kgh09SZv9QPhTjRdmzJKHm1Od5SCuaXXkjn3fofYF9FcgJ1p0TV9tQ2ibKKSIHJ59QMD3xtn0wJvbXIpSwfUihTeq5Iu+hUjg4s3mDEQFFOPXPaa/5wN3p0LzaNc1AKni4iW4++EmYBMyWD3TixtYDZ6QRQ1u0MVMQZpUTidQFFuvRdrOlypMlMuUIgMvtGevzo9V3BkVIRlo41YvLnAROn/MjXfKBxOQ/OO1w+3IA6ICnsIhrSw1wHmZY5c+Y/JqqDGYFaNdUMW8zjdcpk+oQO9ACWCgZvBZc

C:\Users\user\Desktop\BWDRWEEARI\OVWVVIANZH.jpg

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.992311196777482
Encrypted:	false
SSDEEP:	24:fM3ML5XoJoMiP3vXRjhDvivDpty72I3PjvfpAE+m9oxV7sWH1UqAxtI9Xbbwl:U8dqB+Zz7ZdA/z7DWNtI5u
MD5:	C3145C89562B3BD7304EC79637658262
SHA1:	D6D8CB24320F0C8C8BFABFA2E7848A497840F665
SHA-256:	97AF7BDEC7755D5BDC2E0964F1AD626A48A3D6CC0B6CAB11A453728A4AA0BF9F
SHA-512:	508109C50ECE90B5919583BFF7612DD5A24EF6EB6DD261CD585BEE1D0D18E30303E42DD54F1D7FAD5AD02AE0D3F0998C525852BBD3626DCA6B07D4411E817774
Malicious:	true
Preview:	<EncryptedKey>Ou5NSgQz9lJ8LULzbfxsnLm/oVu/qkGDKI7KHHgKXfn5Vj21BgUq/IBQpAsjQ9GvsuNBddrSRtMF0BzjtZldkfF0J9CJXF+et7Tlki0YFB3P2w7XPPO2fLSXLjg0DHfdCH00Osm4RMN+UZuCYQZNP/CEtRIJn0ctic5rWXwIgKE=<EncryptedKey>T2pMzZS3mN0u5WzQdF/1yY7jYSutuHZw9CpjCs3atuwhlexGAIURWdoAxqSN64EG4eP3rGaBLAWoAjhrPhVBxi/Gg3nRPrnzZ6vW3BmiacOSQLHEAFak+zTapR2c0SEontfhi24pUvIH+hJmmtyFFmkXLX1KnjRDg4RXRictVb5ED+1vgfozwY+fVjJHtM5PTsCaLgDEQKSLtRLTSKW2WK3DXiKBXt9hnzhc4O6nn0h8S3VqC3KJjh6m1hXS7SqMxHwUouwm2Cc6260Li29m8d96cIp3BLG1zvNWVJoRj0omzi1rZjz4xVnriGCkVrurQAEqKUFBUlsehgbw6qR2fdxCJkophW6UiisWzA+nxaqXLf+UyvMHVCKUJmqSLsjD43Xp87pcN5HkUE4+WC4cFqEL/c/TcDaeWJ5PhjaJ45/Q/6lRktu/ivSUPp47ClXLQFeFiJYKKrxp9qPgZ3hfrx9Iw6to0Ah27X+AUsQLmLMUSeV+FlWeDxOEhDFW/70HqJLfVQm12/HjHQHcQklt/sS7aROI9inz5uXrL08LPp8UsrR2H6tpHTThvL35d67UWLt3it0rLw6mJVGGm8LvHByGnlswFm0akbrrxHeAzwddOUTQf90xxnwqeSOgltNc55N317IoZFw6purc4OuabXF1ISTuq7WN5NCpboVfGyYFvl5gKn+p+715SiBjAhs6wXfen3AiBtppWv9bPrCC9GeObC0TE2IeGaS54WZ2hfGAyNy0LzmCZFhuJW61hFFgd9LaEJMN7sH389L6gbE5JuSrM9fkoiDv

C:\Users\user\Desktop\BWDRWEEARI\OVWVVIANZH.jpg.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.992311196777482
Encrypted:	false
SSDEEP:	24:fM3ML5XoJoMiP3vXRjhDvivDpty72I3PjvfpAE+m9oxV7sWH1UqAxtI9Xbbwl:U8dqB+Zz7ZdA/z7DWNtI5u
MD5:	C3145C89562B3BD7304EC79637658262
SHA1:	D6D8CB24320F0C8C8BFABFA2E7848A497840F665
SHA-256:	97AF7BDEC7755D5BDC2E0964F1AD626A48A3D6CC0B6CAB11A453728A4AA0BF9F
SHA-512:	508109C50ECE90B5919583BFF7612DD5A24EF6EB6DD261CD585BEE1D0D18E30303E42DD54F1D7FAD5AD02AE0D3F0998C525852BBD3626DCA6B07D4411E817774
Malicious:	false
Preview:	<EncryptedKey>Ou5NSgQz9lJ8LULzbfxsnLm/oVu/qkGDKI7KHHgKXfn5Vj21BgUq/IBQpAsjQ9GvsuNBddrSRtMF0BzjtZldkfF0J9CJXF+et7Tlki0YFB3P2w7XPPO2fLSXLjg0DHfdCH00Osm4RMN+UZuCYQZNP/CEtRIJn0ctic5rWXwIgKE=<EncryptedKey>T2pMzZS3mN0u5WzQdF/1yY7jYSutuHZw9CpjCs3atuwhlexGAIURWdoAxqSN64EG4eP3rGaBLAWoAjhrPhVBxi/Gg3nRPrnzZ6vW3BmiacOSQLHEAFak+zTapR2c0SEontfhi24pUvIH+hJmmtyFFmkXLX1KnjRDg4RXRictVb5ED+1vgfozwY+fVjJHtM5PTsCaLgDEQKSLtRLTSKW2WK3DXiKBXt9hnzhc4O6nn0h8S3VqC3KJjh6m1hXS7SqMxHwUouwm2Cc6260Li29m8d96cIp3BLG1zvNWVJoRj0omzi1rZjz4xVnriGCkVrurQAEqKUFBUlsehgbw6qR2fdxCJkophW6UiisWzA+nxaqXLf+UyvMHVCKUJmqSLsjD43Xp87pcN5HkUE4+WC4cFqEL/c/TcDaeWJ5PhjaJ45/Q/6lRktu/ivSUPp47ClXLQFeFiJYKKrxp9qPgZ3hfrx9Iw6to0Ah27X+AUsQLmLMUSeV+FlWeDxOEhDFW/70HqJLfVQm12/HjHQHcQklt/sS7aROI9inz5uXrL08LPp8UsrR2H6tpHTThvL35d67UWLt3it0rLw6mJVGGm8LvHByGnlswFm0akbrrxHeAzwddOUTQf90xxnwqeSOgltNc55N317IoZFw6purc4OuabXF1ISTuq7WN5NCpboVfGyYFvl5gKn+p+715SiBjAhs6wXfen3AiBtppWv9bPrCC9GeObC0TE2IeGaS54WZ2hfGAyNy0LzmCZFhuJW61hFFgd9LaEJMN7sH389L6gbE5JuSrM9fkoiDv

C:\Users\user\Desktop\BWDRWEEARI\UBVUNTSCZJ.xlsx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.988940397305091
Encrypted:	false
SSDEEP:	24:fMZBbD6gVG5t1AZnLQ7GwnKJakQQ+DbLoK5Uj5AM/Ezte6JiVN8HJXlOVwMzWcXT:ULD6gVG5H7ln+akKEKsXgtBvkFDg+J
MD5:	A335A86086E718789022D02B319715D0
SHA1:	ADE4869BEF853EA83E9AA5AFF1FC07F50B4CD31B
SHA-256:	4581AFD221FECA24E757694045AC4803FF41E27281294FC909E5242CDB55A30E
SHA-512:	D4030F54034C255C05938447D28C8DA3F07F3477DD74A2802186E8D046A45ED2BA254273C6A197E35C1F9D1D9181D79B0ACD0E372A2453B3EB42C55507EF5917
Malicious:	false
Preview:	<EncryptedKey>N0H8tycg3NlnkFkzDxuM3qVNnJgSL1GUBwJmL40VGYPiCL7G1JFYzPWmEuk5ja3JL3igCH2MgCmTwix3iB2J5eUb1LVX4OxiOsQ3cZiyi2yp7bhCHF7uUnIswnMrlI57UExg8P7MlX/kJurrmQ5By5LK5T+9qw93ug2LlLHEYE8=<EncryptedKey>mEH9/KxpUVy4A+FL1+Plq+2ntp2jFtwaiFsGrv9MtM/mgaOEE73+u1+T9r52GWGVviBLMFnst85DFlyrD3Nvfw36hF3Tbc7p0/zM+BVKkA6JNFVelvlq1Z7qR2G35Asd8NqyjwdY6EUR5VTWAWUkZsTl/wHgNBH7WwYPdJFxAUwZT6wJACXIM9RvcARUh5u6n+4VH1eXXlFQ2N5+RryXmTHTrUMZ898HM3dsc6OTILqrJMLtvjkie36PP71ojjufnOLNm7CDhwGBl3JCrzoWUh0supw1M24aQlZErY+b6xtMDyyuykUvJiXSKixsj/xhZrNTdf30um/ynFjI4udgNt2/UPodcemOcAc3NodgpGcHoPrSaVpGbj/U6KwQnxYI7dhrBGYBBztsZyhLZ1RBOTannMemKdXARajk1Y62nmaWBu9IhTxzNcXpikx9ciGZfWIDQXs2rBydjGQ/iN7eIcXM/6GtLTKMmMk9fmJnAr1w3eGlNHk36KXBLTWlA9Q5bwSH6hUf/E2HXDxw3sx8sPceyoSuDCkx6pqXCFa3K1pvhx911zXsU0y6JZUcrWdAOISy9GzEDcsLsRqnI+aG0TXz8Ytb+4pR2sF2qn0B8yqpDj1SLgdHPZZkOxFSE4FbTv3wAtLPNP9NWd4uacwcUvJgNLCQhYM0eDCM/LCnCjtjLHSEr1kUsvFax3aLLyT50gyZikFGxmw5UNhNOEld5FAZhbawsEyRv3NZPezBmHJMUu5mcY6uZo/p0v9MY8mOdMebtOo3EmVUHmEEpyQ39HGvNqiIOyP9

C:\Users\user\Desktop\BWDRWEEARI\UBVUNTSCZJ.xlsx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.988940397305091
Encrypted:	false
SSDEEP:	24:fMZBbD6gVG5t1AZnLQ7GwnKJakQQ+DbLoK5Uj5AM/Ezte6JiVN8HJXlOVwMzWcXT:ULD6gVG5H7ln+akKEKsXgtBvkFDg+J
MD5:	A335A86086E718789022D02B319715D0
SHA1:	ADE4869BEF853EA83E9AA5AFF1FC07F50B4CD31B
SHA-256:	4581AFD221FECA24E757694045AC4803FF41E27281294FC909E5242CDB55A30E
SHA-512:	D4030F54034C255C05938447D28C8DA3F07F3477DD74A2802186E8D046A45ED2BA254273C6A197E35C1F9D1D9181D79B0ACD0E372A2453B3EB42C55507EF5917
Malicious:	false
Preview:	<EncryptedKey>N0H8tycg3NlnkFkzDxuM3qVNnJgSL1GUBwJmL40VGYPiCL7G1JFYzPWmEuk5ja3JL3igCH2MgCmTwix3iB2J5eUb1LVX4OxiOsQ3cZiyi2yp7bhCHF7uUnIswnMrlI57UExg8P7MlX/kJurrmQ5By5LK5T+9qw93ug2LlLHEYE8=<EncryptedKey>mEH9/KxpUVy4A+FL1+Plq+2ntp2jFtwaiFsGrv9MtM/mgaOEE73+u1+T9r52GWGVviBLMFnst85DFlyrD3Nvfw36hF3Tbc7p0/zM+BVKkA6JNFVelvlq1Z7qR2G35Asd8NqyjwdY6EUR5VTWAWUkZsTl/wHgNBH7WwYPdJFxAUwZT6wJACXIM9RvcARUh5u6n+4VH1eXXlFQ2N5+RryXmTHTrUMZ898HM3dsc6OTILqrJMLtvjkie36PP71ojjufnOLNm7CDhwGBl3JCrzoWUh0supw1M24aQlZErY+b6xtMDyyuykUvJiXSKixsj/xhZrNTdf30um/ynFjI4udgNt2/UPodcemOcAc3NodgpGcHoPrSaVpGbj/U6KwQnxYI7dhrBGYBBztsZyhLZ1RBOTannMemKdXARajk1Y62nmaWBu9IhTxzNcXpikx9ciGZfWIDQXs2rBydjGQ/iN7eIcXM/6GtLTKMmMk9fmJnAr1w3eGlNHk36KXBLTWlA9Q5bwSH6hUf/E2HXDxw3sx8sPceyoSuDCkx6pqXCFa3K1pvhx911zXsU0y6JZUcrWdAOISy9GzEDcsLsRqnI+aG0TXz8Ytb+4pR2sF2qn0B8yqpDj1SLgdHPZZkOxFSE4FbTv3wAtLPNP9NWd4uacwcUvJgNLCQhYM0eDCM/LCnCjtjLHSEr1kUsvFax3aLLyT50gyZikFGxmw5UNhNOEld5FAZhbawsEyRv3NZPezBmHJMUu5mcY6uZo/p0v9MY8mOdMebtOo3EmVUHmEEpyQ39HGvNqiIOyP9

C:\Users\user\Desktop\BWDRWEEARI\WHZAGPPPLA.pdf

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.9933914486142745
Encrypted:	false
SSDEEP:	48:UF3o5johCPGgIztWNKL03FofffgDFQUT2Wxk3H:UF3oOhCPAIa03IffgDFAIkX
MD5:	2984D2F9950CE65FC5D354B92EED36D6
SHA1:	4C38D26E5A31FFD36134D95602191E36E6456DC8
SHA-256:	56DF1C972BE7C4F675329E275B9D654ECE2E791805B0CA0E8A640E8A51879615
SHA-512:	B0533479F49E3D1CA3A5B8F952780DE7D60ACEC21EDCCCED75A7ABC7A9F5D9CA555B78C2880C2E0791067D86CA192722E94B02E95232AD47E69CE656C9FA329B
Malicious:	false
Preview:	<EncryptedKey>JNQZMyv5gJVrFlAYrtEBdHsvCZ3t532N5JqTHfyqae6WYa4ThAAGLiO/yM3hvhj/It1wlA6+0OFGRXbJET0nJnHs8wf6kH3h8AUsKhfG9Dt57Hf1Kfr8IufLON4tFGxGcCR+OL1EslqMqD7BGZS52UYtgj6M9ixu8DRGGFu25GA=<EncryptedKey>GVzI4REZYR6uQ2hg74yl+guHZkPbqtfvdoqbdPFQo4jxCKoKFXoADCEZv3PD3J9gCdW6HXtIDd+LOveWreZkrMRp3qFEir9mCGg44ClD7Xkf3yNx2C85nUkh6nX+BDZ9GAzjkOYZlenp6MdfrjK9mScrQYJL6ZrMVNvFqa5FJt6b1lmzFDaLAxw2ybAQfr/PGuWX2sCjgVC4Y6oUsUupLqIivNZogeHXaWHiBGivY4FHFOpDbxcs63rNMejlZ3fPwJB3UOYAweWJt3+y1cnw/vJX5S8Zb1aLQZhzj2IF7PSR8dvHbz+Nxy0WT38/RGDMupiFvK/KEtaXKq+qH7oUrCx5Mth7OX2GyHU65pHE2kHsNbbY6BDTrTmHUmx5AJDdGOxCB63q8/rfBm1jFo265jBcyQDXhm3qKMQTWCpHP++3opn18ugWnL0YPblQqoZa01y1aneSzeKwZ+WOKpECecLhzsMVgSbadQZZzFdo0EfFF5c5vORECkT71/w0hMd3YW6K7tflMHv9F3YnOD6IKa3AOJ4v5XC+tclEn6MLpumuesVFyWiUV85zy+NeggEhxisS7mwlt1VudjgyxW9YJa5SQDHqg497lal1IJu47lhHLY7ZQHIzLln4LX8NWi/fXAPgcFKwnpKM7wt2EDe35kbT4csH1T2CyMh5If3DhEXTiT1BsXlyyf/AXtrVgNxBCYU32hbvG0hUYnfjW5VKwmMV47vyjugz/K1AXCLIP8HrWvBxy6gMImA5sBodb8dLs9qD9JkFtUx7gN+NSGCtvVf7sh6xeLj+

C:\Users\user\Desktop\BWDRWEEARI\WHZAGPPPLA.pdf.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.9933914486142745
Encrypted:	false
SSDEEP:	48:UF3o5johCPGgIztWNKL03FofffgDFQUT2Wxk3H:UF3oOhCPAIa03IffgDFAIkX
MD5:	2984D2F9950CE65FC5D354B92EED36D6
SHA1:	4C38D26E5A31FFD36134D95602191E36E6456DC8
SHA-256:	56DF1C972BE7C4F675329E275B9D654ECE2E791805B0CA0E8A640E8A51879615
SHA-512:	B0533479F49E3D1CA3A5B8F952780DE7D60ACEC21EDCCCED75A7ABC7A9F5D9CA555B78C2880C2E0791067D86CA192722E94B02E95232AD47E69CE656C9FA329B
Malicious:	false
Preview:	<EncryptedKey>JNQZMyv5gJVrFlAYrtEBdHsvCZ3t532N5JqTHfyqae6WYa4ThAAGLiO/yM3hvhj/It1wlA6+0OFGRXbJET0nJnHs8wf6kH3h8AUsKhfG9Dt57Hf1Kfr8IufLON4tFGxGcCR+OL1EslqMqD7BGZS52UYtgj6M9ixu8DRGGFu25GA=<EncryptedKey>GVzI4REZYR6uQ2hg74yl+guHZkPbqtfvdoqbdPFQo4jxCKoKFXoADCEZv3PD3J9gCdW6HXtIDd+LOveWreZkrMRp3qFEir9mCGg44ClD7Xkf3yNx2C85nUkh6nX+BDZ9GAzjkOYZlenp6MdfrjK9mScrQYJL6ZrMVNvFqa5FJt6b1lmzFDaLAxw2ybAQfr/PGuWX2sCjgVC4Y6oUsUupLqIivNZogeHXaWHiBGivY4FHFOpDbxcs63rNMejlZ3fPwJB3UOYAweWJt3+y1cnw/vJX5S8Zb1aLQZhzj2IF7PSR8dvHbz+Nxy0WT38/RGDMupiFvK/KEtaXKq+qH7oUrCx5Mth7OX2GyHU65pHE2kHsNbbY6BDTrTmHUmx5AJDdGOxCB63q8/rfBm1jFo265jBcyQDXhm3qKMQTWCpHP++3opn18ugWnL0YPblQqoZa01y1aneSzeKwZ+WOKpECecLhzsMVgSbadQZZzFdo0EfFF5c5vORECkT71/w0hMd3YW6K7tflMHv9F3YnOD6IKa3AOJ4v5XC+tclEn6MLpumuesVFyWiUV85zy+NeggEhxisS7mwlt1VudjgyxW9YJa5SQDHqg497lal1IJu47lhHLY7ZQHIzLln4LX8NWi/fXAPgcFKwnpKM7wt2EDe35kbT4csH1T2CyMh5If3DhEXTiT1BsXlyyf/AXtrVgNxBCYU32hbvG0hUYnfjW5VKwmMV47vyjugz/K1AXCLIP8HrWvBxy6gMImA5sBodb8dLs9qD9JkFtUx7gN+NSGCtvVf7sh6xeLj+

C:\Users\user\Desktop\DUKNXICOZT.png

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.9834572824380725
Encrypted:	false
SSDEEP:	48:UtekgljKxwLKZqHnYWaEZE1uhSyX8IMv0SPFwRm89B8q:UtABKxwWwHYkZ6uhSyXNu/Fwrz
MD5:	E0E29C96D56D87A0BF9201ED5209F62E
SHA1:	78056D025822B28640A7213D25BA6D7F98E381BE
SHA-256:	E9F218337A79837ADD3B3A3FED7EBCF5D8B5B3F000988F934FBB672E90783B1E
SHA-512:	8D67C348F8E5C9E5EE9D588FED67396907CEAC25A85D6739C898FE528CB4B4B4B0B51ECCBAA84E08E0F3CB8CEBDC79DE2687C589C427CE00E0B631E2611F9990
Malicious:	false
Preview:	<EncryptedKey>gcW0HL98dbizNmpAScmxsIuUbh3g0NUqnizV9uPK2qcpyiXEXxSQZe687LeoChL8VrAgilVn8SABb3t9FySgks3+8Kg8q5QRMFKeR1hi32vUUdpd0Q4P1wPQvkGxaeBjtWrcAuNOSOBKYxUtbK8adM9DOf5oVoo+DEpxHs4ImVw=<EncryptedKey>ta6dTTEehiYsv6o0wffxLrcdQj1m4+rc51L3CSpzhhdlPBMi1J+4jPpcQ0RVwUIK0a/8p/Y+SqXBEnG/gkfP/n+xQqAYRgsSbxoHV9SakF3ehhuulQLHIxLspcLIofQKE678vsII+onGkVHDPmPyiLOuqh7LQdfsoURROuQee8K4W78ky2T9b4aZbGJ8//AK7Snhdt5ImJSxHNW8GawQ4hE+SeTnKd9pO0BOwJZBxMLoGM27SEnczBCipAT7hz6Vz6MFuPwNmG2vB+L+KY2vjsBVXOe4KBnVp0NJVbFa98CuS+4r3JuuVx1xQgfMzv1Ilp1/K8M7QghxcJuut9rw5Pvgr7MDh7UebkoKlPigiK0Es+3XZBL/lxM1NLvNXxxg9nLa+OxWF9Ne84s9PaRJ710eW+oGDrqwtvivYS5RgFPy9PBQgjM1xJ4ljtfLkNVhmbIlYlnbRlZ1UO/v5r1MbdZWNYMHOyIVpORB7SFdKvFihuzYj5UuaX+NX+asHC1gJf9mVfwIXIAHyzRLBSR2iCFLt/N/SPMKuKDfrfvVxlKi4UjQQaE5kJsLsPCCbhvS1j8zds1mAqPOJPXEAaEYI4QCZaetjcs6TjxZdsPGxwfePFBq4SPzfdsBra/yCQdVnuINm7sKmKPveHTOc4hqwsBTYa8K+ncmK7GnDsQVbAmrvvmUGuStQOkE0oh+2qwQ6inzbuzoUHn4aZZfosw99WS8Tnnw3yAKLhXRAPVD4peL4Fy7/HYnGrrKUIXSbqWD6+owY3n27rudrRSUkADrH5hkBIqADoHG

C:\Users\user\Desktop\DUKNXICOZT.png.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.9834572824380725
Encrypted:	false
SSDEEP:	48:UtekgljKxwLKZqHnYWaEZE1uhSyX8IMv0SPFwRm89B8q:UtABKxwWwHYkZ6uhSyXNu/Fwrz
MD5:	E0E29C96D56D87A0BF9201ED5209F62E
SHA1:	78056D025822B28640A7213D25BA6D7F98E381BE
SHA-256:	E9F218337A79837ADD3B3A3FED7EBCF5D8B5B3F000988F934FBB672E90783B1E
SHA-512:	8D67C348F8E5C9E5EE9D588FED67396907CEAC25A85D6739C898FE528CB4B4B4B0B51ECCBAA84E08E0F3CB8CEBDC79DE2687C589C427CE00E0B631E2611F9990
Malicious:	false
Preview:	<EncryptedKey>gcW0HL98dbizNmpAScmxsIuUbh3g0NUqnizV9uPK2qcpyiXEXxSQZe687LeoChL8VrAgilVn8SABb3t9FySgks3+8Kg8q5QRMFKeR1hi32vUUdpd0Q4P1wPQvkGxaeBjtWrcAuNOSOBKYxUtbK8adM9DOf5oVoo+DEpxHs4ImVw=<EncryptedKey>ta6dTTEehiYsv6o0wffxLrcdQj1m4+rc51L3CSpzhhdlPBMi1J+4jPpcQ0RVwUIK0a/8p/Y+SqXBEnG/gkfP/n+xQqAYRgsSbxoHV9SakF3ehhuulQLHIxLspcLIofQKE678vsII+onGkVHDPmPyiLOuqh7LQdfsoURROuQee8K4W78ky2T9b4aZbGJ8//AK7Snhdt5ImJSxHNW8GawQ4hE+SeTnKd9pO0BOwJZBxMLoGM27SEnczBCipAT7hz6Vz6MFuPwNmG2vB+L+KY2vjsBVXOe4KBnVp0NJVbFa98CuS+4r3JuuVx1xQgfMzv1Ilp1/K8M7QghxcJuut9rw5Pvgr7MDh7UebkoKlPigiK0Es+3XZBL/lxM1NLvNXxxg9nLa+OxWF9Ne84s9PaRJ710eW+oGDrqwtvivYS5RgFPy9PBQgjM1xJ4ljtfLkNVhmbIlYlnbRlZ1UO/v5r1MbdZWNYMHOyIVpORB7SFdKvFihuzYj5UuaX+NX+asHC1gJf9mVfwIXIAHyzRLBSR2iCFLt/N/SPMKuKDfrfvVxlKi4UjQQaE5kJsLsPCCbhvS1j8zds1mAqPOJPXEAaEYI4QCZaetjcs6TjxZdsPGxwfePFBq4SPzfdsBra/yCQdVnuINm7sKmKPveHTOc4hqwsBTYa8K+ncmK7GnDsQVbAmrvvmUGuStQOkE0oh+2qwQ6inzbuzoUHn4aZZfosw99WS8Tnnw3yAKLhXRAPVD4peL4Fy7/HYnGrrKUIXSbqWD6+owY3n27rudrRSUkADrH5hkBIqADoHG

C:\Users\user\Desktop\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\Desktop\Excel 2016.lnk

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (3764), with no line terminators
Category:	dropped
Size (bytes):	3764
Entropy (8bit):	6.000295532543888
Encrypted:	false
SSDEEP:	96:UUuX7fduVX3aiGwZKrx3VJU4fl/8BEKfNgJ:Yb8aZrx3VJU/mJ
MD5:	A97942AEABE73F0E35E61CF858F4DCC2
SHA1:	27228D62DFA365C5266E0DC1AF385B9164DCF49A
SHA-256:	B8077B34F01662B4A9ED46744BD8A8FCB523CF5AEC97D7905DEDF1566288AFCB
SHA-512:	CCBD3E3B7EC9C8FCA84EDD9C9CB631E8D095E869487D39811459838F7C4E3EA7B9CD2211A402A99FE8E165CEF10E3EC07C1920BDFEDCED29304A69BBF2820496
Malicious:	false
Preview:	<EncryptedKey>esc8MVUu1uALI66vuzkitMM28cIh0y6W9P+uYiXvlq5GsF8Ztodvh/K9d5n9KC/3r/OYIYBRB/O4Rfd3rgDmM9FZtNrHVM57YGprpZNeeL2o38m1damy04EYKu4UO6kwHJ60vwmD0TxT5Y+XLMlOVSl16VtGPQuOXQ3wwgYxZ9s=<EncryptedKey>rlCE+QPf7Q5qVQj55WNiE4fPYtpT51CULQMCsR1tGGIVnrZkbojgDb/CF1BjfPTl8RHSGa9wP6mc6+kU7k8HAcYzVXpaxJI0rUKCXYmm2jhM/kn65bEEM8LFJGrzZGXl0yFPtDxV9iLU87SdMJFMo0rtWLydmfH5+QgYgnVnYv0IicviC9GwyyN0pFXULR8dQRpF6zHgRKG2MzLjxllMmV4bOz7qttzumwlIYBAnhNvKtpQyoZ48yFzW6zyaqq5Wmt3PdZb2OJmUUox4r1qN9Xn1KEOTV71d8UKCyg1rkebiRJ8Pt3M0s/Ext5v0imbsyW6ATlhjT0eGIxQ+Iv+0APZIOuxkhFWXYEZjIx0n/HjBqRoNrG+3tILGesxYVjJIUDR/8vocRFjSOSMPJGSj88jhlsQWHyC8szLV9aPOSHfDXTcKFJAlKRfwpGqGD0TDlCkOHt//a9SGpVNDhnzvlaCHG7ILMDipo3P/dwWzjEv0QPy3r9Npx98jqeEHgBjfYVi6EG/o8IfNwSVc8iqyi3fk4jW3KTcxCJUmHh1JdIOHfb7cgO7KPKAhx13uJ/XcafII1Ueu6W+F3pGXH2g99mDuUC96Nom8b6nCnB2mR9bDAzbd9H2MYH4q0jhShpS0T0JItbI4HY00PPquNOxVRuIfg5+LpVmQIvZw8h37EFm2WiC1kh9XubqVKkGErNOszoblzOSk8AHBEfGItdm7I/ZIhv+jq2qxMLf+2yfAFEPJ03CGnvg/gDGskf6aDVi8ngVeCdQlkwyIpNvGvu5pquvM4BLamFo3

C:\Users\user\Desktop\Excel 2016.lnk.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (3764), with no line terminators
Category:	dropped
Size (bytes):	3764
Entropy (8bit):	6.000295532543888
Encrypted:	false
SSDEEP:	96:UUuX7fduVX3aiGwZKrx3VJU4fl/8BEKfNgJ:Yb8aZrx3VJU/mJ
MD5:	A97942AEABE73F0E35E61CF858F4DCC2
SHA1:	27228D62DFA365C5266E0DC1AF385B9164DCF49A
SHA-256:	B8077B34F01662B4A9ED46744BD8A8FCB523CF5AEC97D7905DEDF1566288AFCB
SHA-512:	CCBD3E3B7EC9C8FCA84EDD9C9CB631E8D095E869487D39811459838F7C4E3EA7B9CD2211A402A99FE8E165CEF10E3EC07C1920BDFEDCED29304A69BBF2820496
Malicious:	false
Preview:	<EncryptedKey>esc8MVUu1uALI66vuzkitMM28cIh0y6W9P+uYiXvlq5GsF8Ztodvh/K9d5n9KC/3r/OYIYBRB/O4Rfd3rgDmM9FZtNrHVM57YGprpZNeeL2o38m1damy04EYKu4UO6kwHJ60vwmD0TxT5Y+XLMlOVSl16VtGPQuOXQ3wwgYxZ9s=<EncryptedKey>rlCE+QPf7Q5qVQj55WNiE4fPYtpT51CULQMCsR1tGGIVnrZkbojgDb/CF1BjfPTl8RHSGa9wP6mc6+kU7k8HAcYzVXpaxJI0rUKCXYmm2jhM/kn65bEEM8LFJGrzZGXl0yFPtDxV9iLU87SdMJFMo0rtWLydmfH5+QgYgnVnYv0IicviC9GwyyN0pFXULR8dQRpF6zHgRKG2MzLjxllMmV4bOz7qttzumwlIYBAnhNvKtpQyoZ48yFzW6zyaqq5Wmt3PdZb2OJmUUox4r1qN9Xn1KEOTV71d8UKCyg1rkebiRJ8Pt3M0s/Ext5v0imbsyW6ATlhjT0eGIxQ+Iv+0APZIOuxkhFWXYEZjIx0n/HjBqRoNrG+3tILGesxYVjJIUDR/8vocRFjSOSMPJGSj88jhlsQWHyC8szLV9aPOSHfDXTcKFJAlKRfwpGqGD0TDlCkOHt//a9SGpVNDhnzvlaCHG7ILMDipo3P/dwWzjEv0QPy3r9Npx98jqeEHgBjfYVi6EG/o8IfNwSVc8iqyi3fk4jW3KTcxCJUmHh1JdIOHfb7cgO7KPKAhx13uJ/XcafII1Ueu6W+F3pGXH2g99mDuUC96Nom8b6nCnB2mR9bDAzbd9H2MYH4q0jhShpS0T0JItbI4HY00PPquNOxVRuIfg5+LpVmQIvZw8h37EFm2WiC1kh9XubqVKkGErNOszoblzOSk8AHBEfGItdm7I/ZIhv+jq2qxMLf+2yfAFEPJ03CGnvg/gDGskf6aDVi8ngVeCdQlkwyIpNvGvu5pquvM4BLamFo3

C:\Users\user\Desktop\FAAGWHBVUU.png

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.985759452074419
Encrypted:	false
SSDEEP:	48:U3nQpBuDxwoZhT+TIsNTcw+ux6nZg/8ZVRVNW4Qs:U388xwo/STLNYM/j4Qs
MD5:	221E70352560DD0E58285EAA2015FEC4
SHA1:	0B1C05CA81498068F17395BA40E8A8B0C09CAD0F
SHA-256:	CCF33A4484BCDFBA65DBE5F7529182E1C51783F8C73AA8B81096C3B1C8DC7CBF
SHA-512:	66221022A1F29088F5431C55D29CF1173E9494B5AECECA7BC1C98D847B07A8C945608959B8E4419511B107CAE5CE9EB54DC2B1759364915861F6183E7A47BF60
Malicious:	false
Preview:	<EncryptedKey>KrvtVs0s2fGi5HkEI2500ncoYim5qq/pk7r8IFrTOzwsSl2jqE3eu46DxleZzSpjMWyxHx84ek6mBHBEtaI6UwOzSUDbofFDlm1EHeEM2Aca7uQri5MpwCqUWmS7sue6OSyo8TfeniciLaVUsiKIV3rCmg8FfHkBGfFnWqffsys=<EncryptedKey>WJOVyLBzpclgH2bfMGW6y4IolyIg7KFrmMTKGWbnb/wuLjKcfCN1fZDOAv6dQiylNzsfFyI+tWVFu6iSJJ946ipUXK9u1r6+fUIDHOAoXezQp977NX3PGGiI+soHTO9MvNpGsWkjuYb7KXoqRduJuy9mzGPCukoVJKJrq2xFCLERWRkqYMWN/FyMyC2wg1ffgViWY3xjp3wiDkWmFmYPjJ7GC4WUqZFVItYRfaYK7Z5bVFzuYBMnFcrwxCDr0cjaZ6PhKP6o1wNmNeciqYemtqDKxDtcctRswOw9JpeJLO2ShKAYRQT4bEaGBvz4uqKrsRZH6Dfx9HYG1XNef73TDQkO/PgP3UVyfnZBfh2rH700uC386cpWLWrgyO+1rWOjo9OBAbgU2r2A2rB2XtjwlfAtNVv1fxsd22j4I8vZwU2pSmxPweoh2bH+Q9HGi+xHTKP1Dm6a0qz+G+c6l2KuSQSOuMrr+1C4NFSDVH7Pjw2nybQDXKfT+k5K5bND9HBAzKD5/vjUze9h2m7WMuGM9+QeDIptZud5Jh5Vrbhq1Zpj8TH9+nEzaWnTWo3BWyJCSGO6M/WUU4LG7p8dgqLMTKNYgDa7PpcM8M5ohW78Xf5kDoQhNMsRzZm5xFn1pgccgR/vWiS5Ue0xqK4Kxa/X+1TfZjft16sfvOujR+z4YJsNGfvpH6qiPjka9lbHxBzYQZJywTdxoXgz/bh87bsmmZ9lNIkOY+4gWURIzdpDOk7+s4abL5c9eqS5pUU7qtdMzQSa0lQ5DsBkGQFVSpZsvz05DZmEb+ki

C:\Users\user\Desktop\FAAGWHBVUU.png.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.985759452074419
Encrypted:	false
SSDEEP:	48:U3nQpBuDxwoZhT+TIsNTcw+ux6nZg/8ZVRVNW4Qs:U388xwo/STLNYM/j4Qs
MD5:	221E70352560DD0E58285EAA2015FEC4
SHA1:	0B1C05CA81498068F17395BA40E8A8B0C09CAD0F
SHA-256:	CCF33A4484BCDFBA65DBE5F7529182E1C51783F8C73AA8B81096C3B1C8DC7CBF
SHA-512:	66221022A1F29088F5431C55D29CF1173E9494B5AECECA7BC1C98D847B07A8C945608959B8E4419511B107CAE5CE9EB54DC2B1759364915861F6183E7A47BF60
Malicious:	false
Preview:	<EncryptedKey>KrvtVs0s2fGi5HkEI2500ncoYim5qq/pk7r8IFrTOzwsSl2jqE3eu46DxleZzSpjMWyxHx84ek6mBHBEtaI6UwOzSUDbofFDlm1EHeEM2Aca7uQri5MpwCqUWmS7sue6OSyo8TfeniciLaVUsiKIV3rCmg8FfHkBGfFnWqffsys=<EncryptedKey>WJOVyLBzpclgH2bfMGW6y4IolyIg7KFrmMTKGWbnb/wuLjKcfCN1fZDOAv6dQiylNzsfFyI+tWVFu6iSJJ946ipUXK9u1r6+fUIDHOAoXezQp977NX3PGGiI+soHTO9MvNpGsWkjuYb7KXoqRduJuy9mzGPCukoVJKJrq2xFCLERWRkqYMWN/FyMyC2wg1ffgViWY3xjp3wiDkWmFmYPjJ7GC4WUqZFVItYRfaYK7Z5bVFzuYBMnFcrwxCDr0cjaZ6PhKP6o1wNmNeciqYemtqDKxDtcctRswOw9JpeJLO2ShKAYRQT4bEaGBvz4uqKrsRZH6Dfx9HYG1XNef73TDQkO/PgP3UVyfnZBfh2rH700uC386cpWLWrgyO+1rWOjo9OBAbgU2r2A2rB2XtjwlfAtNVv1fxsd22j4I8vZwU2pSmxPweoh2bH+Q9HGi+xHTKP1Dm6a0qz+G+c6l2KuSQSOuMrr+1C4NFSDVH7Pjw2nybQDXKfT+k5K5bND9HBAzKD5/vjUze9h2m7WMuGM9+QeDIptZud5Jh5Vrbhq1Zpj8TH9+nEzaWnTWo3BWyJCSGO6M/WUU4LG7p8dgqLMTKNYgDa7PpcM8M5ohW78Xf5kDoQhNMsRzZm5xFn1pgccgR/vWiS5Ue0xqK4Kxa/X+1TfZjft16sfvOujR+z4YJsNGfvpH6qiPjka9lbHxBzYQZJywTdxoXgz/bh87bsmmZ9lNIkOY+4gWURIzdpDOk7+s4abL5c9eqS5pUU7qtdMzQSa0lQ5DsBkGQFVSpZsvz05DZmEb+ki

C:\Users\user\Desktop\GNLQNHOLWB.docx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.983228404131678
Encrypted:	false
SSDEEP:	48:U1rMBUKnvQ999oLwn+QTLT5adDH+KFSK0RUuKwJP:UlHWu6L5Qcd9uRUjwJ
MD5:	D771CFA248D21B2A9E99014B1344E0A7
SHA1:	2F3210986361652F2A1F0A0C7CC6A2BE48B6D772
SHA-256:	C96FE6685EB6A0B530E4A76E9C98271AADA9C4AB530061DF73CB433659C2B934
SHA-512:	B69A99FAA6B7FDE81EF520248EE0F4190C53545C2E9E315CEC204CC06BB8E94FDEFD760D7FB1B382C254EA096B05344F85FEE9B7DC36D7078AE3A42B1EF7CFCC
Malicious:	false
Preview:	<EncryptedKey>mEZ44pBK/KOC9laUfAYp8KFMBuQUAlKwtUzpjF8rRx6EjdePfcx90ORXNzSGaQOOpQol8kuZvsp9aL62d1/lR0bXUnUtMwaV+7P7m7ihUh6lF4QUnxrLiqKDD9IyL9pO77SoUlF3k0TPND1r+EJT2p2rILDbjbuHy/JYcKRbK5U=<EncryptedKey>aHPQi6e65wIb8ppJMxX4Q0278sZbclZ/b1X3x/mb5GIXw2oRK0hEjm35+SM6VwRi0Exk8k1nMoxPDw8EPHhv4J9JxfvZFTmofcmNYms69LO/RE6upgvUUN1Iw7Wxu04pG/rAK0tamGsciBSylyEyLSFI7G/rPv0lDwoqSiO00X3phQsMeI4wO1m0PCa1o8GP94CguoY247G5yNlU5cKJzdzKgSQ8zmOIsCqB/KJU2/8CVtW4S1WABmOsJy/1ZWB5aqZNECX2HWINFKGQdGpZ3bHQMtcq9Ruw5zTiNEAC8v+1eqFy7Qa0q0Hson+t7k8t/806xoSjMiba1y8m3k8sGtEO5808nDlnCuB89qSGCAbz3CqL/pRHcIlxcbfrPdt4vbfrAmLrOKWNgw+STEooKqSzNPGs4twpF/FSFz99hCCmaDRc0N57/uDk0vHOBCeXdXcwpvXJrUtcGno1boqhaG0+7pMuEsEBFlIXfRm+zWOAfd4R2Q85VXenlcu61vdeGawxjTVIUzTN7Iir9rJYCUK8h9q76nBPcPJLJW/cN6kNZ1dwrEOgNWd6h2bcQbz1viJtCNa+KNxuE7XqidV5piCw9avx20MvQWTvVCUX/Jg1jYvZNrXELwEUyuTMwqd8uJJZcmEuUN7D3CoNL8zKVICNwTwxCr66pqvIjQGZGy7l4b6UssaIlE3ktyTFaFR6n7WpQGelJGKqHPEuLdqGw4CtADzJPd8ykbdPCOzFjvhDYCURG0v3xi66lqehTdPk8XtWCSxp8g+qXaJYHD5W9mDodBELp72K

C:\Users\user\Desktop\GNLQNHOLWB.docx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.983228404131678
Encrypted:	false
SSDEEP:	48:U1rMBUKnvQ999oLwn+QTLT5adDH+KFSK0RUuKwJP:UlHWu6L5Qcd9uRUjwJ
MD5:	D771CFA248D21B2A9E99014B1344E0A7
SHA1:	2F3210986361652F2A1F0A0C7CC6A2BE48B6D772
SHA-256:	C96FE6685EB6A0B530E4A76E9C98271AADA9C4AB530061DF73CB433659C2B934
SHA-512:	B69A99FAA6B7FDE81EF520248EE0F4190C53545C2E9E315CEC204CC06BB8E94FDEFD760D7FB1B382C254EA096B05344F85FEE9B7DC36D7078AE3A42B1EF7CFCC
Malicious:	false
Preview:	<EncryptedKey>mEZ44pBK/KOC9laUfAYp8KFMBuQUAlKwtUzpjF8rRx6EjdePfcx90ORXNzSGaQOOpQol8kuZvsp9aL62d1/lR0bXUnUtMwaV+7P7m7ihUh6lF4QUnxrLiqKDD9IyL9pO77SoUlF3k0TPND1r+EJT2p2rILDbjbuHy/JYcKRbK5U=<EncryptedKey>aHPQi6e65wIb8ppJMxX4Q0278sZbclZ/b1X3x/mb5GIXw2oRK0hEjm35+SM6VwRi0Exk8k1nMoxPDw8EPHhv4J9JxfvZFTmofcmNYms69LO/RE6upgvUUN1Iw7Wxu04pG/rAK0tamGsciBSylyEyLSFI7G/rPv0lDwoqSiO00X3phQsMeI4wO1m0PCa1o8GP94CguoY247G5yNlU5cKJzdzKgSQ8zmOIsCqB/KJU2/8CVtW4S1WABmOsJy/1ZWB5aqZNECX2HWINFKGQdGpZ3bHQMtcq9Ruw5zTiNEAC8v+1eqFy7Qa0q0Hson+t7k8t/806xoSjMiba1y8m3k8sGtEO5808nDlnCuB89qSGCAbz3CqL/pRHcIlxcbfrPdt4vbfrAmLrOKWNgw+STEooKqSzNPGs4twpF/FSFz99hCCmaDRc0N57/uDk0vHOBCeXdXcwpvXJrUtcGno1boqhaG0+7pMuEsEBFlIXfRm+zWOAfd4R2Q85VXenlcu61vdeGawxjTVIUzTN7Iir9rJYCUK8h9q76nBPcPJLJW/cN6kNZ1dwrEOgNWd6h2bcQbz1viJtCNa+KNxuE7XqidV5piCw9avx20MvQWTvVCUX/Jg1jYvZNrXELwEUyuTMwqd8uJJZcmEuUN7D3CoNL8zKVICNwTwxCr66pqvIjQGZGy7l4b6UssaIlE3ktyTFaFR6n7WpQGelJGKqHPEuLdqGw4CtADzJPd8ykbdPCOzFjvhDYCURG0v3xi66lqehTdPk8XtWCSxp8g+qXaJYHD5W9mDodBELp72K

C:\Users\user\Desktop\GNLQNHOLWB\BUFZSQPCOH.pdf

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.987700217361292
Encrypted:	false
SSDEEP:	48:UC9/GCs69kcsQ2gvn3/ntu5qKgdPleAhsuMfSkrItZ:UrXcOgvn31u5gPo+suMf/Q
MD5:	BE3BADC4B662888D1B80B01635B6EE0D
SHA1:	4ED367108E2170309F49C5F5FA87226F2B25AF73
SHA-256:	7A52F797CE991F730D7F4825FA4CF481B2C5EB42EABC4ABCCC78AF021A982289
SHA-512:	5C1DB16F33D4DAF48D9B50EECF8CCD2469506A9771EC20EA83E9229642B44ED47ADE4A85E4BEFBF453A41AC41515880449C6FB0553C5607DD3F616954DCB3669
Malicious:	false
Preview:	<EncryptedKey>PPnZVe+l1Jcqoo69hUAPVilS+0rt5UDVLKWkp3vmmcnlZnHJPDwhXWc5zCX/zUHz+G0rE16JLcK4GGiJXV5mDYMb5osXPBSiJOwxGHwZiRrUtG43FbZuJ58gwOncFL9hOLsVqcwpQx2YKDFceDYwDBhgbReyP+edf5ApB92VsFY=<EncryptedKey>1wJUyaTmFQViWmBbGcpD2ycridpINg3fATvFjVzhR8IsYkpJPVc7lcSGBbjwz3Oz25rGg2cr/qqY4n2e6+8RJZuNfGatpoXRqc7eiZVJuKi0VyGN6cAB7CuLNE2XRR52UHEPBWjs+i0oVw6M01UtuVOzJfJ7IdQ+mZUbK96c7+ukbCygLloX1EWF3FY44ibFsE5NtfOAKw7Met0eS1MRewElZGmpz3MdAjuzN988FDYy22s3vJ0OUzowVaOD8hOBGCFYJRan1LyM10OXFVPN3luqGtYpithv8HnvN1ozCPzC591aNq9tD26jY0HsunlCialeDbCeviBiqJju7W70utz1sdXhA6coV1Rq5NomLj7Xbw1ykqoA5Ix6bo1RNfWJwIv5BBbjs0pFIkrBEiJFKhlxy1AFS7P2Cybsugo3cv8jMV24qy3IOr2YMXGd3JsA/eKXpsbQS3g2y7dDmm6b3KtWvg0onQT/HEELyAVwHebSXz8Mw7fWC/LMAh9hC7xzPt8YimyCRc9swrSq8moIEP0eWoSSJIVdzZ8zdMa5rPF9SvUqE8ZL8KbAUgxrcnN731nEBDPPqqq5fKJusxdbxj4geo+Tn+mVaJHLuAWyQowyFwKIyHqitLkloyDso4CvqAqpMRQQIfG+66/1XbGDujM02C+xXetbj2iFDAbDZxoQWeAZnbuk4U3fVzylvw58gpiXTMJPVmo7OqpVhy1l0kp0/JW/Nq13EeXiSbtXbtKjUoV7YU0dobZqmvRWZx5RqSuSlMmz1e5QzT17V0zA/rUPisxVY5/l

C:\Users\user\Desktop\GNLQNHOLWB\BUFZSQPCOH.pdf.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.987700217361292
Encrypted:	false
SSDEEP:	48:UC9/GCs69kcsQ2gvn3/ntu5qKgdPleAhsuMfSkrItZ:UrXcOgvn31u5gPo+suMf/Q
MD5:	BE3BADC4B662888D1B80B01635B6EE0D
SHA1:	4ED367108E2170309F49C5F5FA87226F2B25AF73
SHA-256:	7A52F797CE991F730D7F4825FA4CF481B2C5EB42EABC4ABCCC78AF021A982289
SHA-512:	5C1DB16F33D4DAF48D9B50EECF8CCD2469506A9771EC20EA83E9229642B44ED47ADE4A85E4BEFBF453A41AC41515880449C6FB0553C5607DD3F616954DCB3669
Malicious:	false
Preview:	<EncryptedKey>PPnZVe+l1Jcqoo69hUAPVilS+0rt5UDVLKWkp3vmmcnlZnHJPDwhXWc5zCX/zUHz+G0rE16JLcK4GGiJXV5mDYMb5osXPBSiJOwxGHwZiRrUtG43FbZuJ58gwOncFL9hOLsVqcwpQx2YKDFceDYwDBhgbReyP+edf5ApB92VsFY=<EncryptedKey>1wJUyaTmFQViWmBbGcpD2ycridpINg3fATvFjVzhR8IsYkpJPVc7lcSGBbjwz3Oz25rGg2cr/qqY4n2e6+8RJZuNfGatpoXRqc7eiZVJuKi0VyGN6cAB7CuLNE2XRR52UHEPBWjs+i0oVw6M01UtuVOzJfJ7IdQ+mZUbK96c7+ukbCygLloX1EWF3FY44ibFsE5NtfOAKw7Met0eS1MRewElZGmpz3MdAjuzN988FDYy22s3vJ0OUzowVaOD8hOBGCFYJRan1LyM10OXFVPN3luqGtYpithv8HnvN1ozCPzC591aNq9tD26jY0HsunlCialeDbCeviBiqJju7W70utz1sdXhA6coV1Rq5NomLj7Xbw1ykqoA5Ix6bo1RNfWJwIv5BBbjs0pFIkrBEiJFKhlxy1AFS7P2Cybsugo3cv8jMV24qy3IOr2YMXGd3JsA/eKXpsbQS3g2y7dDmm6b3KtWvg0onQT/HEELyAVwHebSXz8Mw7fWC/LMAh9hC7xzPt8YimyCRc9swrSq8moIEP0eWoSSJIVdzZ8zdMa5rPF9SvUqE8ZL8KbAUgxrcnN731nEBDPPqqq5fKJusxdbxj4geo+Tn+mVaJHLuAWyQowyFwKIyHqitLkloyDso4CvqAqpMRQQIfG+66/1XbGDujM02C+xXetbj2iFDAbDZxoQWeAZnbuk4U3fVzylvw58gpiXTMJPVmo7OqpVhy1l0kp0/JW/Nq13EeXiSbtXbtKjUoV7YU0dobZqmvRWZx5RqSuSlMmz1e5QzT17V0zA/rUPisxVY5/l

C:\Users\user\Desktop\GNLQNHOLWB\BWDRWEEARI.xlsx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.978230058243558
Encrypted:	false
SSDEEP:	48:UGnvzfCPpOW+qkhUljswhXReB8J7rCckTUh:UQbYORfClzReBpg
MD5:	E502B4B2EDE087A8BEB0C140640A7D7E
SHA1:	1F2ED6995F89007EE71C2C9B2369C2C2BF7B4A17
SHA-256:	325A556C065B01820CDBC136325BEEE1133D371E64FBF5B11164319E18246E98
SHA-512:	B1799F9D8FEEDDFEC6CD1E0658AF71F86B1CAF1CC8A05637C2569820C039C6CE0DC35F27B1B5FC61295361BBC1CC3D613C1A2742CAAAFCC08D6281E3F513B142
Malicious:	false
Preview:	<EncryptedKey>nKjTqMmAaBqysBkATt7Cn3JFvgwMaGyD1tTrI7oVqZ1j8bALSzqqdxsyYDVG2WRYeERWNdhWd9MggeMtPYjb6HPNbZPOoTZAxToOyio/5C2wXFNCXHiTKNQNqkXfeeloTmJueq7esJPmeLpKj+MVnroTZKm17tKgUxKZcFdAp5A=<EncryptedKey>+FT0Yk98q9dDQFWI5TVtJ+dq+PVVTt5BTJ3+DRtMsAGFiE7Hc08Khyedf0ZZjOlkPG/DMxYMW9jvrmM2xe1WikollOhcgC65OjYhbHTA6vi3FWwr5+4Yt/tEP5TOXwPj8S5ixt7j7V81cVvz7qR0SFbJHpZQn2wiG0tBbR3uZJuAysq3mnu97pyZnJGjmdyiMNKJ65a7yBnUWW7oAZA3+tFXiJlA3uXdj+9jdtGIgwnKc08AsLg1IF9y1TTLA/G/tZCOMgzNtJocsU65Bh/aj52flq+wXqkqTj7mPUQCO2H5jVj3ODZGtxWjxsE8bbBvQpT46RcoQ8JdLHBNJba9fD8p29rEtR+dODdCeogpsAo868rilsQ7fLWriaefOeDi5X76ymHm57zJlK7XU9NY2gc+tAAhazKjNdL7d7zXKEefZk8jM2b15mABjMUZZo/sc75p+k00eoITisvw5O9RmFu+FE3+XzkmzlUO9Y7H5tX/sQEAaFOGSlNhBhSbsPyW5bzMQRr+5L4GGZca2e7URAzNGQihI63mO11lhSujPMkNCHt4flIZkIsskYS6juZWcsdDmlXYBgR7ca0YDng6wiMNY5li/lbgnV4wPkOQwzTIyD5d+iYPkokp2qbmi0XyfAxBKqddmy1rhCRwUkpfswzs0wdDdyygxBvgvMqwv2pdKIHLLO7A8ItfQyKilsiBLe9zV5Hir+pweo7gJsvdnAGkaKM5zE3qd8cU6TzQKIW3CAHffKLhW/mgRIePQdoHgyCeAXVJ9Bj8D+pKcxQhrDelCglHXhwx

C:\Users\user\Desktop\GNLQNHOLWB\BWDRWEEARI.xlsx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.978230058243558
Encrypted:	false
SSDEEP:	48:UGnvzfCPpOW+qkhUljswhXReB8J7rCckTUh:UQbYORfClzReBpg
MD5:	E502B4B2EDE087A8BEB0C140640A7D7E
SHA1:	1F2ED6995F89007EE71C2C9B2369C2C2BF7B4A17
SHA-256:	325A556C065B01820CDBC136325BEEE1133D371E64FBF5B11164319E18246E98
SHA-512:	B1799F9D8FEEDDFEC6CD1E0658AF71F86B1CAF1CC8A05637C2569820C039C6CE0DC35F27B1B5FC61295361BBC1CC3D613C1A2742CAAAFCC08D6281E3F513B142
Malicious:	false
Preview:	<EncryptedKey>nKjTqMmAaBqysBkATt7Cn3JFvgwMaGyD1tTrI7oVqZ1j8bALSzqqdxsyYDVG2WRYeERWNdhWd9MggeMtPYjb6HPNbZPOoTZAxToOyio/5C2wXFNCXHiTKNQNqkXfeeloTmJueq7esJPmeLpKj+MVnroTZKm17tKgUxKZcFdAp5A=<EncryptedKey>+FT0Yk98q9dDQFWI5TVtJ+dq+PVVTt5BTJ3+DRtMsAGFiE7Hc08Khyedf0ZZjOlkPG/DMxYMW9jvrmM2xe1WikollOhcgC65OjYhbHTA6vi3FWwr5+4Yt/tEP5TOXwPj8S5ixt7j7V81cVvz7qR0SFbJHpZQn2wiG0tBbR3uZJuAysq3mnu97pyZnJGjmdyiMNKJ65a7yBnUWW7oAZA3+tFXiJlA3uXdj+9jdtGIgwnKc08AsLg1IF9y1TTLA/G/tZCOMgzNtJocsU65Bh/aj52flq+wXqkqTj7mPUQCO2H5jVj3ODZGtxWjxsE8bbBvQpT46RcoQ8JdLHBNJba9fD8p29rEtR+dODdCeogpsAo868rilsQ7fLWriaefOeDi5X76ymHm57zJlK7XU9NY2gc+tAAhazKjNdL7d7zXKEefZk8jM2b15mABjMUZZo/sc75p+k00eoITisvw5O9RmFu+FE3+XzkmzlUO9Y7H5tX/sQEAaFOGSlNhBhSbsPyW5bzMQRr+5L4GGZca2e7URAzNGQihI63mO11lhSujPMkNCHt4flIZkIsskYS6juZWcsdDmlXYBgR7ca0YDng6wiMNY5li/lbgnV4wPkOQwzTIyD5d+iYPkokp2qbmi0XyfAxBKqddmy1rhCRwUkpfswzs0wdDdyygxBvgvMqwv2pdKIHLLO7A8ItfQyKilsiBLe9zV5Hir+pweo7gJsvdnAGkaKM5zE3qd8cU6TzQKIW3CAHffKLhW/mgRIePQdoHgyCeAXVJ9Bj8D+pKcxQhrDelCglHXhwx

C:\Users\user\Desktop\GNLQNHOLWB\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\Desktop\GNLQNHOLWB\FAAGWHBVUU.png

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.994398362406192
Encrypted:	false
SSDEEP:	48:U4F0qMlopfaOgnAi2rdMo90v4q468FQHnCsBW6Mw8sym41p:U4GqMlopdqh2CsctLHH8sD41p
MD5:	A7E59D805E01C3AA48F717036FA9B49C
SHA1:	287A8E2C3C220C3BC3682EE35A7E8F07DEE5B022
SHA-256:	629DAFF6691323E3C19E3D9B9FE4C947CA59C8B40A56EA541D42F1529CDE85B4
SHA-512:	FE98A74B335FB3A55257381961358B6A27300ACA70ED72003E5B05C0DB8690615600A446E9869991CA54F1CD237DB9F4BD706B495C60C47C6B8AB239EF58A925
Malicious:	false
Preview:	<EncryptedKey>VxMOoK9Ql6Sa+9EFtwN4QRUNI1/XJJ+TxrYVBOiGPCNbGdJbgjdn7uymFyiAWu5FjcnQHr5acLGPZQ+8zeWyGXShTSf4Bmxka8zMhTG36jiF5g3xH+JhZwg1bYM36WIxLa2c6Y9rlp9UNmcTX45MT2qcO5Z49WRSRyhN4g+712M=<EncryptedKey>yseTZ4azYFXl6MJqdFeLvgX+SWOv1wT40tdhOc5vMVrI2CDI+UparU2ZS8JSMaHxvkW3Gsd/zsl2aC/xTLsE9rPe14fsQq+l2qqx/ObS/FCBfvjXDN5kg74bq+FS9Yqbkef1eBK8rd3HOBxnbUrY+sNSNx5BN9Dz1fit8w+1U+fsjk5+5oiJS4FtnldnybLy6j/3e1qy7nUAUMcUrortlhDgTFz5nlFeD+PLWKETPb5B8s9OOHhJmF50CwKsKHIsMHYouTubit8OIftLTu3VMfVGp27QbF4ZAjcdEwSoikjx+ConBjgEnHUQh2Usanc/2IxO6aAm+/L/mtxk7P0jlzEM/FA2Z7SPdYD0alpaTpLY9guLU+O99PTSiiD14RgLU+LSR5lKiu8BroemoM5QI8bkPdfutHl6WhH2IpNtQ8fKqBcOUaOBcASlmIFRyZkGG6N0QJ4pygwTs6OUgb1RyM3hSmp76F8wcvd2ubMjot2ZiYIgCJeWtTiVtYn6dfkhRZQvKEjnpUAEmrP42CN4whp88XcAlUM2ITVXMeIm6j6igZ4EcjUeYrh6BF5kMDGuxPTRBs2cnlAOJRiWbTIwxeeUr2a06GD8MYlhAKGen4EJ2MbWBCnwI2l1Vp8a0SFP/qBie1UYvbx/GoFsEQHx5Wi1bFyQyQXCgQbQ//WHjcmxaSomVOyjP5jXXk3laYAXuvbFPH3BQfQOz3K2Xod5M36Db9C2ukWuRwh3akpIZKA5RfPQ+4s7o/LRDewE2bcwlN/kxLjFJLZAw14U25CjxLZ5qvNTgsNd

C:\Users\user\Desktop\GNLQNHOLWB\FAAGWHBVUU.png.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.994398362406192
Encrypted:	false
SSDEEP:	48:U4F0qMlopfaOgnAi2rdMo90v4q468FQHnCsBW6Mw8sym41p:U4GqMlopdqh2CsctLHH8sD41p
MD5:	A7E59D805E01C3AA48F717036FA9B49C
SHA1:	287A8E2C3C220C3BC3682EE35A7E8F07DEE5B022
SHA-256:	629DAFF6691323E3C19E3D9B9FE4C947CA59C8B40A56EA541D42F1529CDE85B4
SHA-512:	FE98A74B335FB3A55257381961358B6A27300ACA70ED72003E5B05C0DB8690615600A446E9869991CA54F1CD237DB9F4BD706B495C60C47C6B8AB239EF58A925
Malicious:	false
Preview:	<EncryptedKey>VxMOoK9Ql6Sa+9EFtwN4QRUNI1/XJJ+TxrYVBOiGPCNbGdJbgjdn7uymFyiAWu5FjcnQHr5acLGPZQ+8zeWyGXShTSf4Bmxka8zMhTG36jiF5g3xH+JhZwg1bYM36WIxLa2c6Y9rlp9UNmcTX45MT2qcO5Z49WRSRyhN4g+712M=<EncryptedKey>yseTZ4azYFXl6MJqdFeLvgX+SWOv1wT40tdhOc5vMVrI2CDI+UparU2ZS8JSMaHxvkW3Gsd/zsl2aC/xTLsE9rPe14fsQq+l2qqx/ObS/FCBfvjXDN5kg74bq+FS9Yqbkef1eBK8rd3HOBxnbUrY+sNSNx5BN9Dz1fit8w+1U+fsjk5+5oiJS4FtnldnybLy6j/3e1qy7nUAUMcUrortlhDgTFz5nlFeD+PLWKETPb5B8s9OOHhJmF50CwKsKHIsMHYouTubit8OIftLTu3VMfVGp27QbF4ZAjcdEwSoikjx+ConBjgEnHUQh2Usanc/2IxO6aAm+/L/mtxk7P0jlzEM/FA2Z7SPdYD0alpaTpLY9guLU+O99PTSiiD14RgLU+LSR5lKiu8BroemoM5QI8bkPdfutHl6WhH2IpNtQ8fKqBcOUaOBcASlmIFRyZkGG6N0QJ4pygwTs6OUgb1RyM3hSmp76F8wcvd2ubMjot2ZiYIgCJeWtTiVtYn6dfkhRZQvKEjnpUAEmrP42CN4whp88XcAlUM2ITVXMeIm6j6igZ4EcjUeYrh6BF5kMDGuxPTRBs2cnlAOJRiWbTIwxeeUr2a06GD8MYlhAKGen4EJ2MbWBCnwI2l1Vp8a0SFP/qBie1UYvbx/GoFsEQHx5Wi1bFyQyQXCgQbQ//WHjcmxaSomVOyjP5jXXk3laYAXuvbFPH3BQfQOz3K2Xod5M36Db9C2ukWuRwh3akpIZKA5RfPQ+4s7o/LRDewE2bcwlN/kxLjFJLZAw14U25CjxLZ5qvNTgsNd

C:\Users\user\Desktop\GNLQNHOLWB\GNLQNHOLWB.docx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.984256983427099
Encrypted:	false
SSDEEP:	48:UjYWUonE6bCfhxON2G6oGFQ01YVI87J1Aj4epcSt5lWhUf:UjYWUCE4CPONj3GHaVIxj4GdlWK
MD5:	A472CF6DDCE20A3BCE56BF0CB03F3ADB
SHA1:	D8A9C319BB68C1771931FAA7518859E4C6A343DD
SHA-256:	6A2951A7A3C7120BB7C8A305912A5FB70915D735772B9663C8985DB8F8F86FA4
SHA-512:	333964CAC6EDA8912232A0F6F314B1C35E06EA4AB926AD4C81202CB45A87DF73A60B3CEF4FCF93C714FB314C63D7F9AE1D91A5E3B447F782B2A75FD70C76D0BD
Malicious:	false
Preview:	<EncryptedKey>cyBZ5F0wVKH6Hs0AZcd1J94CPZDnrnvH+3pyZFJ1YpFIiZ0/GNef4L2/HtdqxOXPNuuFBbiY+2WDIBgATnAcR+NzmQfm/ZVc4A3RiixkIC2oc9UfCA1g4diGuoHoglzAZBC/PHfa0mWnKv58p+H3aHG8vyZrcDd2DYelUPeS2cg=<EncryptedKey>LqY9zcMeZE9EyOd45GGuTyI1xHsEaTds0BzXrEp6hi6NieOe8t71bWuyCTk6HniNHnlkrlinHj2CJypZ/ZIXeUNGzawM+G17Snzjxu2F/wDhQZltqVCvXHCMuaF6O+d5ZbNWmB93/ZVjdnxFtpdJ/B5zc05i/gj2dgUSY/WcDHRTm1Y3JN83IQC7xWMZQcx0R9q/ok+9ABdzUuixJ6/lkz5FrVS1UslvyUmDIUWPoVVYHa8KMyW7tRqC7+3p3R4h2SyzCPETH/7fkwNREQFgmBsyIWyB5il2nqoqUGOWLymlJ7NO2xgtsehgUC4HFf/5FKM+twtGMXyRkUC2ByB4yYUtnIu5Moa0ZABxZ4z8avLzyfs6tfURzxV5S2C5sABl966AkOAAUUclLRzQNpmkFqZcuxCjTReqjIBEFTIyE+wX3ZSaG0/EHlvrf3yK+YXH5wTn/SS7GmZj8QpWDSnWmweX6f+rg73DKnc8dKAWbARYjp5JkcbE8L9urHxIR2dkfqmjNK+2Nb+18BBrNGDm91GKJgVheym2QmYFQdt+xyYGNXkoqjg9L5kQ4UmrAiD09LTTsd3RDNdztr5NKFhDtkKY/xS1NPOi3ryzNCp9iPj0rgxYliB0mASf357ZyiZUMtSch27vSvpTcFVrHdH3pwpmHiA+xaXDc2iIEjPbgcHSoNJ/E9d3XU38Bty21Ay+3IpsXoefBwbaao+ZUH8aMGREeWMoek2yuzST5Ve/r9x+Z/Q2aoMhReSLPZtwh+hOgeIFqBnTxDi2aNhdcto7jp3CHc+plE3G

C:\Users\user\Desktop\GNLQNHOLWB\GNLQNHOLWB.docx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.984256983427099
Encrypted:	false
SSDEEP:	48:UjYWUonE6bCfhxON2G6oGFQ01YVI87J1Aj4epcSt5lWhUf:UjYWUCE4CPONj3GHaVIxj4GdlWK
MD5:	A472CF6DDCE20A3BCE56BF0CB03F3ADB
SHA1:	D8A9C319BB68C1771931FAA7518859E4C6A343DD
SHA-256:	6A2951A7A3C7120BB7C8A305912A5FB70915D735772B9663C8985DB8F8F86FA4
SHA-512:	333964CAC6EDA8912232A0F6F314B1C35E06EA4AB926AD4C81202CB45A87DF73A60B3CEF4FCF93C714FB314C63D7F9AE1D91A5E3B447F782B2A75FD70C76D0BD
Malicious:	false
Preview:	<EncryptedKey>cyBZ5F0wVKH6Hs0AZcd1J94CPZDnrnvH+3pyZFJ1YpFIiZ0/GNef4L2/HtdqxOXPNuuFBbiY+2WDIBgATnAcR+NzmQfm/ZVc4A3RiixkIC2oc9UfCA1g4diGuoHoglzAZBC/PHfa0mWnKv58p+H3aHG8vyZrcDd2DYelUPeS2cg=<EncryptedKey>LqY9zcMeZE9EyOd45GGuTyI1xHsEaTds0BzXrEp6hi6NieOe8t71bWuyCTk6HniNHnlkrlinHj2CJypZ/ZIXeUNGzawM+G17Snzjxu2F/wDhQZltqVCvXHCMuaF6O+d5ZbNWmB93/ZVjdnxFtpdJ/B5zc05i/gj2dgUSY/WcDHRTm1Y3JN83IQC7xWMZQcx0R9q/ok+9ABdzUuixJ6/lkz5FrVS1UslvyUmDIUWPoVVYHa8KMyW7tRqC7+3p3R4h2SyzCPETH/7fkwNREQFgmBsyIWyB5il2nqoqUGOWLymlJ7NO2xgtsehgUC4HFf/5FKM+twtGMXyRkUC2ByB4yYUtnIu5Moa0ZABxZ4z8avLzyfs6tfURzxV5S2C5sABl966AkOAAUUclLRzQNpmkFqZcuxCjTReqjIBEFTIyE+wX3ZSaG0/EHlvrf3yK+YXH5wTn/SS7GmZj8QpWDSnWmweX6f+rg73DKnc8dKAWbARYjp5JkcbE8L9urHxIR2dkfqmjNK+2Nb+18BBrNGDm91GKJgVheym2QmYFQdt+xyYGNXkoqjg9L5kQ4UmrAiD09LTTsd3RDNdztr5NKFhDtkKY/xS1NPOi3ryzNCp9iPj0rgxYliB0mASf357ZyiZUMtSch27vSvpTcFVrHdH3pwpmHiA+xaXDc2iIEjPbgcHSoNJ/E9d3XU38Bty21Ay+3IpsXoefBwbaao+ZUH8aMGREeWMoek2yuzST5Ve/r9x+Z/Q2aoMhReSLPZtwh+hOgeIFqBnTxDi2aNhdcto7jp3CHc+plE3G

C:\Users\user\Desktop\GNLQNHOLWB\UBVUNTSCZJ.jpg

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.992585730747609
Encrypted:	false
SSDEEP:	24:fMJsXqCcZl2PkOF3O9X0KHr8Xu28Hy990Qqm0BaBDWYdQsRpbUYoSyS6k/pzHqd:UJsa41F+9XHHruu2OyYmrBQsLP6k/pze
MD5:	1F4EAF04C4ECC32174AB80229B2DD1B5
SHA1:	4F63F5CA01811A5658E6F91DF3DCAC64FFFBCD19
SHA-256:	7FBE2677E7576CE612098522574895EC6F192079FE7156F55ECB60538133F55B
SHA-512:	9FA1FED7E4151CA9DFD8F62AF6DE587C39CF1F1EEB8DF3B2BBC31B343A86564E230B97F77FCF170DA063672BB70F1DDA7166169E8C944FDD63D80F863B97BFBF
Malicious:	false
Preview:	<EncryptedKey>NaHYz4BO1xhahiNIev5HLrsbFUVtICfFHEosAECbmakTjY/mWckJW33DEyti9hKoIWpfkhkVZtyadIQL4pfDyLK0vODBrMh5s5yC9DtJpYfQsZW16X05E8AWEuANxmYnkiXQ2g9xGOe7Y9NYB1fb7NiCgocc8Ir/8p7vge3e4aM=<EncryptedKey>DM0uLQn+JckvUEpBL18+2pp2NCQfrkCt7alVS7UDMrLMQ82MQEK6h6uomsn4YcQ4Uo5BUk4PEHvNwl7GO1WfnYrlh9oddkkwo97fMPMS9Jga+UU0JCK8Ig/u77DZYbm1VOVqRNxKqI/hGxsUC7iBucwJlj4qEUzPtG+ZSX5yKK40F0zm5QjmrQHFGtV9lYNgxHJqH6nCM6w+TPY0Zob16/S4lf5/0xTICxRwc8QgK1wUJCyycW0K2v5Fn33NaWJVtCGvkMMrMJ8tJcRlLwvvyo7JLuM0Vv8ffWlM7+U7mYwQI2LrV3CgZfbZZ+l5/FZf9iZw5uX1Gxi6seFo+j2SKVJgrsuglmm8f36iTLPg0f5q1KS9rjIqetoWDrPJvDePuUV8xXkAxtfU5I6SGZlN0N1vob/n+yj1g3FC5fEyK3AcBcwiNDPATi/gBzSSZ7TdyuT9zFBM+1Vvzk5tONX/GyRl6AwnUh2+HYgpSuOJPJpyynMGQg4lB2VwFStfQuoOlanM1zFxqhikLFzSXmmCi+Spm+1NMx9ap9yt6V2pbPi9hLheFc/ZWvzbj7+3PojBHfamw8adqRA3liSDkyVYNlgl1glpunHiB/4ivkiumzmmaCF40Sxpk2cLU0gcQdVKqKEpvfwqCkg7D/0PkMYa+eXOHeV9ps/+NKhzNpXhLJIapLtxP9iNPkWgCqab0+WSJV4QI6gjLzBoqmvVc7jf6ZOLNaEPWNPbGBDB8H2dKcJmEJwIc1MhJq/8ODkbGdgHuQcdNSre5bsgWH7OCcRyqRdki9atqtNF

C:\Users\user\Desktop\GNLQNHOLWB\UBVUNTSCZJ.jpg.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.992585730747609
Encrypted:	false
SSDEEP:	24:fMJsXqCcZl2PkOF3O9X0KHr8Xu28Hy990Qqm0BaBDWYdQsRpbUYoSyS6k/pzHqd:UJsa41F+9XHHruu2OyYmrBQsLP6k/pze
MD5:	1F4EAF04C4ECC32174AB80229B2DD1B5
SHA1:	4F63F5CA01811A5658E6F91DF3DCAC64FFFBCD19
SHA-256:	7FBE2677E7576CE612098522574895EC6F192079FE7156F55ECB60538133F55B
SHA-512:	9FA1FED7E4151CA9DFD8F62AF6DE587C39CF1F1EEB8DF3B2BBC31B343A86564E230B97F77FCF170DA063672BB70F1DDA7166169E8C944FDD63D80F863B97BFBF
Malicious:	false
Preview:	<EncryptedKey>NaHYz4BO1xhahiNIev5HLrsbFUVtICfFHEosAECbmakTjY/mWckJW33DEyti9hKoIWpfkhkVZtyadIQL4pfDyLK0vODBrMh5s5yC9DtJpYfQsZW16X05E8AWEuANxmYnkiXQ2g9xGOe7Y9NYB1fb7NiCgocc8Ir/8p7vge3e4aM=<EncryptedKey>DM0uLQn+JckvUEpBL18+2pp2NCQfrkCt7alVS7UDMrLMQ82MQEK6h6uomsn4YcQ4Uo5BUk4PEHvNwl7GO1WfnYrlh9oddkkwo97fMPMS9Jga+UU0JCK8Ig/u77DZYbm1VOVqRNxKqI/hGxsUC7iBucwJlj4qEUzPtG+ZSX5yKK40F0zm5QjmrQHFGtV9lYNgxHJqH6nCM6w+TPY0Zob16/S4lf5/0xTICxRwc8QgK1wUJCyycW0K2v5Fn33NaWJVtCGvkMMrMJ8tJcRlLwvvyo7JLuM0Vv8ffWlM7+U7mYwQI2LrV3CgZfbZZ+l5/FZf9iZw5uX1Gxi6seFo+j2SKVJgrsuglmm8f36iTLPg0f5q1KS9rjIqetoWDrPJvDePuUV8xXkAxtfU5I6SGZlN0N1vob/n+yj1g3FC5fEyK3AcBcwiNDPATi/gBzSSZ7TdyuT9zFBM+1Vvzk5tONX/GyRl6AwnUh2+HYgpSuOJPJpyynMGQg4lB2VwFStfQuoOlanM1zFxqhikLFzSXmmCi+Spm+1NMx9ap9yt6V2pbPi9hLheFc/ZWvzbj7+3PojBHfamw8adqRA3liSDkyVYNlgl1glpunHiB/4ivkiumzmmaCF40Sxpk2cLU0gcQdVKqKEpvfwqCkg7D/0PkMYa+eXOHeV9ps/+NKhzNpXhLJIapLtxP9iNPkWgCqab0+WSJV4QI6gjLzBoqmvVc7jf6ZOLNaEPWNPbGBDB8H2dKcJmEJwIc1MhJq/8ODkbGdgHuQcdNSre5bsgWH7OCcRyqRdki9atqtNF

C:\Users\user\Desktop\GNLQNHOLWB\WHZAGPPPLA.mp3

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.985267512314836
Encrypted:	false
SSDEEP:	24:fMLJdqOdF+KrTiJu5uxvkrdy+TuYIMap/0KjDqXxGzP9S2LjtO61UeKFKfytMBF2:UjqAUKq40xoEsKjDqXxIPw27KFegMFgd
MD5:	929600CA44475C2908E242621E91264A
SHA1:	C470F75D1D6FA714EC4CB42712DA1DE620FAFE05
SHA-256:	9BF088E9CC3B96E2834217481E679DB86B875F423D1AD45F75F959596DCD4799
SHA-512:	C3D91EFB1A4B8661ACA980AAEB90E2F76B99E895E9E55104575920ECEC703D600D86100251578F5FAB2E90718CBED896540EB4DE81CCEBB0430B9D1983E87652
Malicious:	true
Preview:	<EncryptedKey>BGfGQv+W58eufoTzaRZvH8ZpNNUO2AByYijpIZviZV63RCdjs59sJDeIg4JzdCvr/shDHU+MDy/qBYOIygF6j1G/3+ZndyLlHlRKR9iK0r0GVRaMFrC1c7p/1+AV5Lj9NFmTiL7I/1J8+6iWyykdfQocUU+f4hIbfx1075C3E9I=<EncryptedKey>fU/MXTUzoTvIG+JSqQaNxqrBIYq8vsgf7XJSlZ+GFSvVVK7VxfXAk9tLiMOxf5nkEdQAsBiiCeIyclCpKz5MP3mE9g3I2H2ZMJjGhYrD5eFow8H9ohpciap7CXEVHXXdcYhKLwbK1VDR7sA++OrL1CW+54z5Y4AZuIeMgY0TWT9CXCbzaASybHA/h1w4UNCMNBPuo9/ozJ4PSyYHT1Fp59eOg0RAut5PMlgbukJl/kmPc2NQlF7d/jq+5UFwh0fOrlX0z+PHblMtvN3ayXfwGCpHjMGUqIaV7Hdr1ldFbEatBwxMF+axMkhy/r72t23ujnSD3532OuelHceMjRrAR7J8DsKnYfbM4c4Knry91Db2ogvOQ900hsAXiaKfFr1XkiAj/xCMWGUdEWgymqM9DAhLxUhsCl0ag7zc31ZrdGXZbY0Ei2EzZMR53ilqWznOiYz6xHT3AlCK6oR2Rd1/leODDoWJoP41azqLFq+TYCA/MQj3ItaH5jkP0OXmPQ7uk3YTWwc3jz9eAGf33nl0473iT111m0xz5MtGsBoi2v0yUs4Tkw9MP79yWBkvkZI0407MzUGt/0S0+xgdnorxkhKqnX0RY6VbY5WR/CfvUsCbzePkb1RL73hmMq0eMeRvh71SdZnHotBMqbofer6KoHJBdvthDPcV7iYhtJFx87tzSJGy/Ue+ob6lnLgnmzm45BMz1MnfipvKrPX2NBK0s8CfjjawuyBDWiurCqQOzguLHDRUQs8zeDqZsUdk3bmmtbAeXSk3uOrmvI/40VqoYyA7hWu5fu32

C:\Users\user\Desktop\GNLQNHOLWB\WHZAGPPPLA.mp3.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.985267512314836
Encrypted:	false
SSDEEP:	24:fMLJdqOdF+KrTiJu5uxvkrdy+TuYIMap/0KjDqXxGzP9S2LjtO61UeKFKfytMBF2:UjqAUKq40xoEsKjDqXxIPw27KFegMFgd
MD5:	929600CA44475C2908E242621E91264A
SHA1:	C470F75D1D6FA714EC4CB42712DA1DE620FAFE05
SHA-256:	9BF088E9CC3B96E2834217481E679DB86B875F423D1AD45F75F959596DCD4799
SHA-512:	C3D91EFB1A4B8661ACA980AAEB90E2F76B99E895E9E55104575920ECEC703D600D86100251578F5FAB2E90718CBED896540EB4DE81CCEBB0430B9D1983E87652
Malicious:	false
Preview:	<EncryptedKey>BGfGQv+W58eufoTzaRZvH8ZpNNUO2AByYijpIZviZV63RCdjs59sJDeIg4JzdCvr/shDHU+MDy/qBYOIygF6j1G/3+ZndyLlHlRKR9iK0r0GVRaMFrC1c7p/1+AV5Lj9NFmTiL7I/1J8+6iWyykdfQocUU+f4hIbfx1075C3E9I=<EncryptedKey>fU/MXTUzoTvIG+JSqQaNxqrBIYq8vsgf7XJSlZ+GFSvVVK7VxfXAk9tLiMOxf5nkEdQAsBiiCeIyclCpKz5MP3mE9g3I2H2ZMJjGhYrD5eFow8H9ohpciap7CXEVHXXdcYhKLwbK1VDR7sA++OrL1CW+54z5Y4AZuIeMgY0TWT9CXCbzaASybHA/h1w4UNCMNBPuo9/ozJ4PSyYHT1Fp59eOg0RAut5PMlgbukJl/kmPc2NQlF7d/jq+5UFwh0fOrlX0z+PHblMtvN3ayXfwGCpHjMGUqIaV7Hdr1ldFbEatBwxMF+axMkhy/r72t23ujnSD3532OuelHceMjRrAR7J8DsKnYfbM4c4Knry91Db2ogvOQ900hsAXiaKfFr1XkiAj/xCMWGUdEWgymqM9DAhLxUhsCl0ag7zc31ZrdGXZbY0Ei2EzZMR53ilqWznOiYz6xHT3AlCK6oR2Rd1/leODDoWJoP41azqLFq+TYCA/MQj3ItaH5jkP0OXmPQ7uk3YTWwc3jz9eAGf33nl0473iT111m0xz5MtGsBoi2v0yUs4Tkw9MP79yWBkvkZI0407MzUGt/0S0+xgdnorxkhKqnX0RY6VbY5WR/CfvUsCbzePkb1RL73hmMq0eMeRvh71SdZnHotBMqbofer6KoHJBdvthDPcV7iYhtJFx87tzSJGy/Ue+ob6lnLgnmzm45BMz1MnfipvKrPX2NBK0s8CfjjawuyBDWiurCqQOzguLHDRUQs8zeDqZsUdk3bmmtbAeXSk3uOrmvI/40VqoYyA7hWu5fu32

C:\Users\user\Desktop\MIVTQDBATG.mp3

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.984595353555084
Encrypted:	false
SSDEEP:	48:UEtTN9cIDpxdltOFaFlQopuSSF4bP0y3gfjKv:Uk9VXdSFaFlI4z33g+v
MD5:	2772F58A6B22B2ECB9A45CE413F51671
SHA1:	5BEE4460A8E12C3F9980BB2688E79FE0FF578672
SHA-256:	DDABD0677370A2EC4B8C9B8491A5E66F9731A8CBEF2F77255D5B4F097905F599
SHA-512:	13B61D19F9C5C23CA0FFF4256F4B519B39AF5DF671A4DA861B4D3130C4519CAB74B20BFA231F30FC084563BF6371A91B7971D7660063C798CA4F9ADA14235C2D
Malicious:	true
Preview:	<EncryptedKey>MqaW904+tJdwuPOwtTTxJrxFkQGb4s56rtlENrEB23we0vQzKbHGAAE/b9CFCUSkLeewABBGm8rTLJSU8xeL4FdD3ZnU7woQ+8iorcRP7rLvbyuREaWHaPTGkGlhspFoqemg8xKykNyEKJUBInL+sg/G71lZLlRv3clsjI85bpQ=<EncryptedKey>8E4qmJHIioMQnZaadyd+hcf3+BFz4wWu1COzSex88uVQtaQ191ZnSj8IkaeO1Sn+yvHZeGBzvFqno7a+DiTgILG91oQcH/73PyYxxCiuJNyunXhAsP+qDtfxANrmkyUm45n1lPkP/kl02DMYEGPx15qrDo/tDbPeSqRieB5pq+m37WClXApjJRCCXLft3dSk8bxkMbfN22pxXlGjWY698qnASC7A6K+maKTYZEWviBLZmTfCO0UR5ix3uL9WwtZYBmnMlaxMwlqHUoiCXHzp9/PY8+WuQBvpxuqBGfkZ+jibPgnhHe3nE/v3y9gDntV7/9G0UKfUw2nXtxLk3ZeNFz6EyxpIx7Eyqms34MNelNSkZ9hLx7W1umx4bEZfP60qCe1nkZzp+NPuCAVUTiGJV8zjZOPG2aa8Ej/J6zuhibcw/u7mKeuIzUjL7IvN1TSQ5hsR/uc9jYCoF/HkyWOQVCrxNJ+DDWkeySlBAfUflo+yIgTksdNFuBJQB38BvKDL6ZWI8o3rruIyxEbRcIJzMGypzK73ayHj5vipWwHmUKMuuiiqOTh8y91EOjcAHIVXuxJhB+aX6dex+nDbvNEMc58c5YcQIpbBjRZGNzI399nvlKVwPpE6FP30is/88gpJAECa9uMRoKApdVhxI0lLBs8vwdrULirOAckFKnRVjKe60f3VO3KFXrDsgxBgur2po3oZP9lmI8nfg8s+yz3lAgsP1puyyJ4Nyg/0ERyM7cJ3Xn4OpW7KVE5b7MLgTRWaUQEMxuVzgTTDa9Ecc9KOMu07m5pKNZun

C:\Users\user\Desktop\MIVTQDBATG.mp3.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.984595353555084
Encrypted:	false
SSDEEP:	48:UEtTN9cIDpxdltOFaFlQopuSSF4bP0y3gfjKv:Uk9VXdSFaFlI4z33g+v
MD5:	2772F58A6B22B2ECB9A45CE413F51671
SHA1:	5BEE4460A8E12C3F9980BB2688E79FE0FF578672
SHA-256:	DDABD0677370A2EC4B8C9B8491A5E66F9731A8CBEF2F77255D5B4F097905F599
SHA-512:	13B61D19F9C5C23CA0FFF4256F4B519B39AF5DF671A4DA861B4D3130C4519CAB74B20BFA231F30FC084563BF6371A91B7971D7660063C798CA4F9ADA14235C2D
Malicious:	false
Preview:	<EncryptedKey>MqaW904+tJdwuPOwtTTxJrxFkQGb4s56rtlENrEB23we0vQzKbHGAAE/b9CFCUSkLeewABBGm8rTLJSU8xeL4FdD3ZnU7woQ+8iorcRP7rLvbyuREaWHaPTGkGlhspFoqemg8xKykNyEKJUBInL+sg/G71lZLlRv3clsjI85bpQ=<EncryptedKey>8E4qmJHIioMQnZaadyd+hcf3+BFz4wWu1COzSex88uVQtaQ191ZnSj8IkaeO1Sn+yvHZeGBzvFqno7a+DiTgILG91oQcH/73PyYxxCiuJNyunXhAsP+qDtfxANrmkyUm45n1lPkP/kl02DMYEGPx15qrDo/tDbPeSqRieB5pq+m37WClXApjJRCCXLft3dSk8bxkMbfN22pxXlGjWY698qnASC7A6K+maKTYZEWviBLZmTfCO0UR5ix3uL9WwtZYBmnMlaxMwlqHUoiCXHzp9/PY8+WuQBvpxuqBGfkZ+jibPgnhHe3nE/v3y9gDntV7/9G0UKfUw2nXtxLk3ZeNFz6EyxpIx7Eyqms34MNelNSkZ9hLx7W1umx4bEZfP60qCe1nkZzp+NPuCAVUTiGJV8zjZOPG2aa8Ej/J6zuhibcw/u7mKeuIzUjL7IvN1TSQ5hsR/uc9jYCoF/HkyWOQVCrxNJ+DDWkeySlBAfUflo+yIgTksdNFuBJQB38BvKDL6ZWI8o3rruIyxEbRcIJzMGypzK73ayHj5vipWwHmUKMuuiiqOTh8y91EOjcAHIVXuxJhB+aX6dex+nDbvNEMc58c5YcQIpbBjRZGNzI399nvlKVwPpE6FP30is/88gpJAECa9uMRoKApdVhxI0lLBs8vwdrULirOAckFKnRVjKe60f3VO3KFXrDsgxBgur2po3oZP9lmI8nfg8s+yz3lAgsP1puyyJ4Nyg/0ERyM7cJ3Xn4OpW7KVE5b7MLgTRWaUQEMxuVzgTTDa9Ecc9KOMu07m5pKNZun

C:\Users\user\Desktop\Microsoft Edge.lnk

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (2100), with no line terminators
Category:	dropped
Size (bytes):	2100
Entropy (8bit):	5.991547947755316
Encrypted:	false
SSDEEP:	48:UVrC3iyhRLItF/zt86xNNoYCsnw7XV08rAvX+E:UkLezt88NJCXTV08rAvOE
MD5:	EDC87782A4548CBFEDD5A0797F9FC959
SHA1:	E5958CDA94B954BB4D32708A1B7A2403E2C60FB9
SHA-256:	E76DAE1C8620AF0B3855194CC9FE7F4D78B12DA01F609CF0EE9B6D4594EA544D
SHA-512:	62B42EDB844C40E5F177CEDA2C61BDB49E1C8175C4A89C5477F6083B0254D366631391E44342B5E83FC38E5BDEB45BB786F6E3517B1EB395F9E6B401A66BACD2
Malicious:	false
Preview:	<EncryptedKey>S1RVhL2e2/hUPSTvqj9WiqkmVTvTP+yYAwIgjyhIMcUSf4LkV/bSzabdG3IFpo+oDB+Yrw1nSONVwMAO7z/lLFhUiLH2PymfGGWGKtTh74t/opabfkSPcKx3OKUNTTDKCVfkxGwGrNmAk25J5QTt2mTJmHTsDm5qI77+ok1gEp4=<EncryptedKey>Kh5k8oEflEH2KV042+5zf75H0HyPfbq9VC/sSmPScjzos1JhxPcii3igPvknzkch47b3Hlwb/LfKjO4pSPIqlWVfYRf2R2JV2iRC4gKUpVfVkK7JM6bITQD1WmO5/7p032X5Eu8Uwlc7cH6jLZApmIIdCHFtPKy/bsUP8MBaILnliBTira4iJl7/vUbH4hL2K99Ce38kAfj0gDOF97mr7i/59fZSiU/aOAJfBYhB6PRCUzPxB0HvnnO4Lss4+fpfrUymNWx+zi99ENbvWjvKctSmH6Di+J6ZSd/FAfqu/zTJm3RNMPSwxsioQMwq2tBbcWKdYEox0uQ6SFdXbx2/kT4akKaZmuvehllNF6WWz+PG5fiNdIDTvCjKflpIvQwc8wZW5IBndK1zi0Ohbg1HFjcfYMdNdCh50yTd4GsPvN/4D0TkisA41UMu2YaSlkJ5hqtveJoJFPJTE4YFfRcjYW4nlrxDLktuzL13wgPEC5yltBPbdki/BuCaw/HGz0hB53WU2DT99u82UsPSAuajSX7xaApzmW22zK1fSgu0DwT3vlfOgoPM84njS0g9458xJJ0vhUfqaDY0G10nqjq7pSyotLcDtvtfkvsK/Bpu1h8Ps3uAUTYKqAAeioSY5TD8+RxXXr9RVaxxyHc7zq6IsVOlxa9SZno8EnMfXihRfr/OXx8E535GyYQZJIar+DswfV2Fyf4jLNV72+nJYB2KzV/5Bdm9iITCriRQjG460xtINXGz6i7AqEEK6G3OcjdS+rK6qUJ+Cs7pCU0P+ZSVyRmf92SD8nWa

C:\Users\user\Desktop\Microsoft Edge.lnk.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (2100), with no line terminators
Category:	dropped
Size (bytes):	2100
Entropy (8bit):	5.991547947755316
Encrypted:	false
SSDEEP:	48:UVrC3iyhRLItF/zt86xNNoYCsnw7XV08rAvX+E:UkLezt88NJCXTV08rAvOE
MD5:	EDC87782A4548CBFEDD5A0797F9FC959
SHA1:	E5958CDA94B954BB4D32708A1B7A2403E2C60FB9
SHA-256:	E76DAE1C8620AF0B3855194CC9FE7F4D78B12DA01F609CF0EE9B6D4594EA544D
SHA-512:	62B42EDB844C40E5F177CEDA2C61BDB49E1C8175C4A89C5477F6083B0254D366631391E44342B5E83FC38E5BDEB45BB786F6E3517B1EB395F9E6B401A66BACD2
Malicious:	false
Preview:	<EncryptedKey>S1RVhL2e2/hUPSTvqj9WiqkmVTvTP+yYAwIgjyhIMcUSf4LkV/bSzabdG3IFpo+oDB+Yrw1nSONVwMAO7z/lLFhUiLH2PymfGGWGKtTh74t/opabfkSPcKx3OKUNTTDKCVfkxGwGrNmAk25J5QTt2mTJmHTsDm5qI77+ok1gEp4=<EncryptedKey>Kh5k8oEflEH2KV042+5zf75H0HyPfbq9VC/sSmPScjzos1JhxPcii3igPvknzkch47b3Hlwb/LfKjO4pSPIqlWVfYRf2R2JV2iRC4gKUpVfVkK7JM6bITQD1WmO5/7p032X5Eu8Uwlc7cH6jLZApmIIdCHFtPKy/bsUP8MBaILnliBTira4iJl7/vUbH4hL2K99Ce38kAfj0gDOF97mr7i/59fZSiU/aOAJfBYhB6PRCUzPxB0HvnnO4Lss4+fpfrUymNWx+zi99ENbvWjvKctSmH6Di+J6ZSd/FAfqu/zTJm3RNMPSwxsioQMwq2tBbcWKdYEox0uQ6SFdXbx2/kT4akKaZmuvehllNF6WWz+PG5fiNdIDTvCjKflpIvQwc8wZW5IBndK1zi0Ohbg1HFjcfYMdNdCh50yTd4GsPvN/4D0TkisA41UMu2YaSlkJ5hqtveJoJFPJTE4YFfRcjYW4nlrxDLktuzL13wgPEC5yltBPbdki/BuCaw/HGz0hB53WU2DT99u82UsPSAuajSX7xaApzmW22zK1fSgu0DwT3vlfOgoPM84njS0g9458xJJ0vhUfqaDY0G10nqjq7pSyotLcDtvtfkvsK/Bpu1h8Ps3uAUTYKqAAeioSY5TD8+RxXXr9RVaxxyHc7zq6IsVOlxa9SZno8EnMfXihRfr/OXx8E535GyYQZJIar+DswfV2Fyf4jLNV72+nJYB2KzV/5Bdm9iITCriRQjG460xtINXGz6i7AqEEK6G3OcjdS+rK6qUJ+Cs7pCU0P+ZSVyRmf92SD8nWa

C:\Users\user\Desktop\OVWVVIANZH.jpg

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.985396850214817
Encrypted:	false
SSDEEP:	48:Uz1dViKyXsaGdW+dDifi26kMcPKmqFHI89jT:URSNsLIhfEkVPlqFHZv
MD5:	A9132F92CF45D127E427F77D394EB3ED
SHA1:	66BC706981C7BA642C1BD143A29B3FDBA5F04122
SHA-256:	4EEDF5F3953EEDE49A93199DB03D3C521BB17DAC146B36F3BDB690CA0FAE0419
SHA-512:	BF28DAE6D77FB786B63C4D53DBA63E74B435274151F6BA6A75E6C125B94BB2640FB8F39FFBAFE06727580241070E6BEEC69D69A0635C7EA57471BCDE112854F7
Malicious:	false
Preview:	<EncryptedKey>Lm6G+njFp3gr5Ky4JK+v/p9VoS44p9lM/f34vbbbZzMhNEwV7DackRSM2Fmbfz2QaTIglC17hk4q8RyFmaWGCYuyx5OpMYK4L39W8+ra3KiwZsiQy/Nnxr3M+9LUY9xWnRJ6gHytYD59secrAbffpTrJt19DG2II6Q8aYcuacAA=<EncryptedKey>cgqYg2v5k+gcpFr9nCiBH5eb8/ala1N9h01M1eB43jZ84AO297LzZNlr8MRg+CI2E876q8kyVEHbDFKwA96+sKNNmhE1bsdjkvUo6+CVPUTpOyQUWeRbqn7GFX95+ga91BaJBS6LQCKxEEuWCP039Yk0psan8v7SCLtnwVKlGK2IUfvPwo9VOHM0mfU9Rj3rnt+pBBw0nsIvOkBCL6ntCdZ+ZFzhHIBib8g5DNzOXshTDLbqJ2rN0x93rGRh+hNJrQkJ72tCReJkAivSJbZmtfAVcDFFGGIDff7zu9bvPGFQMT5TaE0UkXxz079hY57Q4EAkeW1jjTHi1AymCHrBZVfdYzDanhVc5COpXUExAMTCzS9WnZbYdnPHME1RBHkDUtM0Ht1OpT16s/xHDtv+sFr4NnIQsFywo6yj40uSiIxV+t8cMlUknKcpq8fHilVO1yUA1zRC+IcGwoHRQebLGuROo0BPKr+sLCL1P7rolh5rx6lidIQwtw/4aG9DVyTil10MI6XG02EcdG1nBuWZ8LkX01xsAOSKS/kq3HzY1tE6DttQ3K3m/RwXNydtzAdI9isEZHSCWUixlY3Z7GPTTt9bxOgAWxzGMMgMr6CApjazdtwQ3e83ownkOcl4n0pHKny7HNwWJvcHBtWAVafCOViQh0E+uIfLDh8VKHPytQHZeNy7YjnQmaxHK29Od/q706a5RrY1YszZrgwIcf/gT7REe4lCuYfE0NpbdIcEP6vev8GcWpcFg0W2k1l9xNItRGY4B6htGXByud++c8dQVzrrTj64baul

C:\Users\user\Desktop\OVWVVIANZH.jpg.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.985396850214817
Encrypted:	false
SSDEEP:	48:Uz1dViKyXsaGdW+dDifi26kMcPKmqFHI89jT:URSNsLIhfEkVPlqFHZv
MD5:	A9132F92CF45D127E427F77D394EB3ED
SHA1:	66BC706981C7BA642C1BD143A29B3FDBA5F04122
SHA-256:	4EEDF5F3953EEDE49A93199DB03D3C521BB17DAC146B36F3BDB690CA0FAE0419
SHA-512:	BF28DAE6D77FB786B63C4D53DBA63E74B435274151F6BA6A75E6C125B94BB2640FB8F39FFBAFE06727580241070E6BEEC69D69A0635C7EA57471BCDE112854F7
Malicious:	false
Preview:	<EncryptedKey>Lm6G+njFp3gr5Ky4JK+v/p9VoS44p9lM/f34vbbbZzMhNEwV7DackRSM2Fmbfz2QaTIglC17hk4q8RyFmaWGCYuyx5OpMYK4L39W8+ra3KiwZsiQy/Nnxr3M+9LUY9xWnRJ6gHytYD59secrAbffpTrJt19DG2II6Q8aYcuacAA=<EncryptedKey>cgqYg2v5k+gcpFr9nCiBH5eb8/ala1N9h01M1eB43jZ84AO297LzZNlr8MRg+CI2E876q8kyVEHbDFKwA96+sKNNmhE1bsdjkvUo6+CVPUTpOyQUWeRbqn7GFX95+ga91BaJBS6LQCKxEEuWCP039Yk0psan8v7SCLtnwVKlGK2IUfvPwo9VOHM0mfU9Rj3rnt+pBBw0nsIvOkBCL6ntCdZ+ZFzhHIBib8g5DNzOXshTDLbqJ2rN0x93rGRh+hNJrQkJ72tCReJkAivSJbZmtfAVcDFFGGIDff7zu9bvPGFQMT5TaE0UkXxz079hY57Q4EAkeW1jjTHi1AymCHrBZVfdYzDanhVc5COpXUExAMTCzS9WnZbYdnPHME1RBHkDUtM0Ht1OpT16s/xHDtv+sFr4NnIQsFywo6yj40uSiIxV+t8cMlUknKcpq8fHilVO1yUA1zRC+IcGwoHRQebLGuROo0BPKr+sLCL1P7rolh5rx6lidIQwtw/4aG9DVyTil10MI6XG02EcdG1nBuWZ8LkX01xsAOSKS/kq3HzY1tE6DttQ3K3m/RwXNydtzAdI9isEZHSCWUixlY3Z7GPTTt9bxOgAWxzGMMgMr6CApjazdtwQ3e83ownkOcl4n0pHKny7HNwWJvcHBtWAVafCOViQh0E+uIfLDh8VKHPytQHZeNy7YjnQmaxHK29Od/q706a5RrY1YszZrgwIcf/gT7REe4lCuYfE0NpbdIcEP6vev8GcWpcFg0W2k1l9xNItRGY4B6htGXByud++c8dQVzrrTj64baul

C:\Users\user\Desktop\UBVUNTSCZJ.jpg

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.988817059031644
Encrypted:	false
SSDEEP:	24:fM4S/+iCbEyUMUERrledE9vfOpk5qRHGE5vDBOPSA3Aap7VhVYA2HTZhQ885Y:U4S/+iCbEyqyrj9vWpwqRTreSA3AsMB
MD5:	D7FEB090A1FFE8AFFD76189EC2FB3902
SHA1:	6887BABFBAB6D61C3A57FD2683E3E1A1E2522C66
SHA-256:	F2EB5B8EF5CDCC8F68B10FD32B0B734DEB47BCEEF7B484CF5056ADF7B16CBC03
SHA-512:	3D098D0B12299F0D6435DC791A92B83AE2C97DB8EBA6AE638C93A4E3A96DCE343641DABF4A4FB0F337241F50CF5E64CEF2C9EE821A3A19F111E01D04DA85F4B9
Malicious:	false
Preview:	<EncryptedKey>T7x0YrPkYIKz3tdFDO0MwUyNeKiMbOoN/DjMltJCcRo7h4o1BggNuqNuKC0rAtTWHVk2onJ5tb0sErE1KaBekXfOU/opjcTXxHa55WpLWyq41XslnBJDBZKskVmgNeH92NYtIrkYEMyDDrtD0zZ2mPHzP2MTeqOey2kPX8OKuVg=<EncryptedKey>gFe5uWpDBWwQSh41qAs0H60QzebMOPiu/i8MkYbVrLL5vapU4sbAfwS5EfPzIoOXGUsuu6jxoJ8ZqB/2jDJathxA/G19ZpGd6lsZKQq9vzIAdrUQMGEtciAVE3qqZCJhdVQM8l8LWfbuCG79/gUhS5DoBsgTzX6+bftpnNlqF9a0w0o5tb0eQxHa0JaPwlALftErPAXVedypBbNcxX9k6DfpLSFEtxtkhL0kS0IsswSBK4rFnfdcXeJX5z7Ow3X9Lrp8TRWuRwQjCAQRJzgmaWGgNgtoIvZcndz28Hh/x4OFUxYOyBgiOKMh0cr2RrQ7SQGEE/aQ4Qls1X/meJqgGxDALKTA41NVE1n3UxacRI7rwyU4T0maVvuyWFWyrHMmLjSNgJHK6r6ZYouNFKo2NhDWfTZVlv1+3G/27kLfacyFjN77JvxIEs4bM77dVGPANRWGs0tz7P3OG/jX+psUmTh1jLgW3WJ7PdcaJ6y5YkSYAH11JZzN3+qVmTYOsWHKtN2w/Ke9/8wIncoJc20wt5lraSjc1iB98u0/DGJ5WgL2iTr0bc0D7GEX84kWXW3Vcr3wxNuIS2zDvmtFb9JsG07K9x1R1KLVbPGSHYnZKdNCBZnOqKJrA2vf7ubVDfkfw9gDqATYUnH0sx5or/9dtf/VlFV+OgNqrFqAaA6dMm7buDjaku6SJnOy6CEZcKFyy/3HB3nUFWOyCajBQADe5lpmieiAulIfHRHYPXZF9WlCw9r4CT3zJ8ZAQ1KhaMN4ohFw8884SdNx20iMpFT/n8bG1j2i7Ixl

C:\Users\user\Desktop\UBVUNTSCZJ.jpg.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.988817059031644
Encrypted:	false
SSDEEP:	24:fM4S/+iCbEyUMUERrledE9vfOpk5qRHGE5vDBOPSA3Aap7VhVYA2HTZhQ885Y:U4S/+iCbEyqyrj9vWpwqRTreSA3AsMB
MD5:	D7FEB090A1FFE8AFFD76189EC2FB3902
SHA1:	6887BABFBAB6D61C3A57FD2683E3E1A1E2522C66
SHA-256:	F2EB5B8EF5CDCC8F68B10FD32B0B734DEB47BCEEF7B484CF5056ADF7B16CBC03
SHA-512:	3D098D0B12299F0D6435DC791A92B83AE2C97DB8EBA6AE638C93A4E3A96DCE343641DABF4A4FB0F337241F50CF5E64CEF2C9EE821A3A19F111E01D04DA85F4B9
Malicious:	false
Preview:	<EncryptedKey>T7x0YrPkYIKz3tdFDO0MwUyNeKiMbOoN/DjMltJCcRo7h4o1BggNuqNuKC0rAtTWHVk2onJ5tb0sErE1KaBekXfOU/opjcTXxHa55WpLWyq41XslnBJDBZKskVmgNeH92NYtIrkYEMyDDrtD0zZ2mPHzP2MTeqOey2kPX8OKuVg=<EncryptedKey>gFe5uWpDBWwQSh41qAs0H60QzebMOPiu/i8MkYbVrLL5vapU4sbAfwS5EfPzIoOXGUsuu6jxoJ8ZqB/2jDJathxA/G19ZpGd6lsZKQq9vzIAdrUQMGEtciAVE3qqZCJhdVQM8l8LWfbuCG79/gUhS5DoBsgTzX6+bftpnNlqF9a0w0o5tb0eQxHa0JaPwlALftErPAXVedypBbNcxX9k6DfpLSFEtxtkhL0kS0IsswSBK4rFnfdcXeJX5z7Ow3X9Lrp8TRWuRwQjCAQRJzgmaWGgNgtoIvZcndz28Hh/x4OFUxYOyBgiOKMh0cr2RrQ7SQGEE/aQ4Qls1X/meJqgGxDALKTA41NVE1n3UxacRI7rwyU4T0maVvuyWFWyrHMmLjSNgJHK6r6ZYouNFKo2NhDWfTZVlv1+3G/27kLfacyFjN77JvxIEs4bM77dVGPANRWGs0tz7P3OG/jX+psUmTh1jLgW3WJ7PdcaJ6y5YkSYAH11JZzN3+qVmTYOsWHKtN2w/Ke9/8wIncoJc20wt5lraSjc1iB98u0/DGJ5WgL2iTr0bc0D7GEX84kWXW3Vcr3wxNuIS2zDvmtFb9JsG07K9x1R1KLVbPGSHYnZKdNCBZnOqKJrA2vf7ubVDfkfw9gDqATYUnH0sx5or/9dtf/VlFV+OgNqrFqAaA6dMm7buDjaku6SJnOy6CEZcKFyy/3HB3nUFWOyCajBQADe5lpmieiAulIfHRHYPXZF9WlCw9r4CT3zJ8ZAQ1KhaMN4ohFw8884SdNx20iMpFT/n8bG1j2i7Ixl

C:\Users\user\Desktop\UBVUNTSCZJ.xlsx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.997888599177263
Encrypted:	false
SSDEEP:	48:UtDm8fqg3iYLVW58OfyegdkH2laxd/+qvOOzPKbX:UtD5qaJOf0+2o/WmzPSX
MD5:	00761D8D8CEFAA18D6B5C8AF0DBA925C
SHA1:	D790AFC8166294875144E6C22B84D7F8F65C7AEF
SHA-256:	7B1F2A369CED34B433FEF07CF3D96E30DE6CB791FC5392BE82F1ECB207ED2F34
SHA-512:	B8CE374F44917BFE5AD2B914A0D6154D05D2C5630BC6B4661F61A69B08EF6735D54D36CB10611D9D63FE24155BB2ACEB4ADE8CE9EEC30BD97616F936FB41309B
Malicious:	false
Preview:	<EncryptedKey>TbVrIMURIrzaTealJ1azopgQDwM0wdKlq/s7MGbNz81NUogD4OX/HxvxVy12FVeImix+vh+eGy21o30vCTMydVHDkexILyLkzvGTefZoKSjzC5Z/ML+Y1Bn8B+ScrIe3uyJpV+SdD3HHGr2d8x2KjCXOugaLPwRZFONQbJGUJYk=<EncryptedKey>C7uhh9ADEb5J3iu2bZ7oIbvfLvt82Pn6J6l9BORYRfDAP4bK+tmFezkbMcjFrjvJR5CHrAnGaH0FJvznqXPP0coUdB/lBQ7bNdcSMH742nMLGPe2qsXAeVBoZWUS5GdGH+KT0uW7bn20kddw4sWiRSOMc04UwBG1f7pvekxFnZGcGqc585WioEH5+4kVDbI4H84kvtoGY6Aakf36FLOQIkhYuTv/Tc5WX32lOyQ/EcpGWoATnrT0xiEi9XM+fwZaSs6kcyLHXVROCYwRKZpYkFuVOWHxeT4l+vSrJJFr7PP3/yPgIKPzTPhfUWCQrnTtHdw2vDmov85W5U6r7aRMqHGq1R4PDESVMS4RBkkuzFxvdAFfOZTaU3eFgHkSPXWT8PnDlan4jyDNH6+eYk1j3a9Xti+9i3VGrHdVhv4m7S8zchF7CNlcAL5ki7t7Ul2vHHtGaaf+EQ5aEoT4QLn7BdxibEzcL+wcCKMgfmgpHrUmLAJp2UJAdKYXjmHcv3kR8TStdPRFWoLPh2zkUyPlnqDBf11AtkGdktKITyWMAjpbrIa5YTF9xPXvmxUREw8Tollj2zzRbgjWnpSmw0TVy0s08/QGCKTWfH0g6XSEZRZAz0/JQ0LUR0tioIQEKVXSNwvvHHMlmMaLXpCt7R/ojGKm+Cp7knQ5da6EMCqRKN/jewdgLUp0/O4XRyqYO5v7QVXTwzsJ0sO6333Mjqv9obdIUSWOctMbuAV1hHUwcphjZzPhexnJiZYQclNZYe1Wqvzbt/yMoh9ZbZUpB5W/+VVf/3y0sRWV

C:\Users\user\Desktop\UBVUNTSCZJ.xlsx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.997888599177263
Encrypted:	false
SSDEEP:	48:UtDm8fqg3iYLVW58OfyegdkH2laxd/+qvOOzPKbX:UtD5qaJOf0+2o/WmzPSX
MD5:	00761D8D8CEFAA18D6B5C8AF0DBA925C
SHA1:	D790AFC8166294875144E6C22B84D7F8F65C7AEF
SHA-256:	7B1F2A369CED34B433FEF07CF3D96E30DE6CB791FC5392BE82F1ECB207ED2F34
SHA-512:	B8CE374F44917BFE5AD2B914A0D6154D05D2C5630BC6B4661F61A69B08EF6735D54D36CB10611D9D63FE24155BB2ACEB4ADE8CE9EEC30BD97616F936FB41309B
Malicious:	false
Preview:	<EncryptedKey>TbVrIMURIrzaTealJ1azopgQDwM0wdKlq/s7MGbNz81NUogD4OX/HxvxVy12FVeImix+vh+eGy21o30vCTMydVHDkexILyLkzvGTefZoKSjzC5Z/ML+Y1Bn8B+ScrIe3uyJpV+SdD3HHGr2d8x2KjCXOugaLPwRZFONQbJGUJYk=<EncryptedKey>C7uhh9ADEb5J3iu2bZ7oIbvfLvt82Pn6J6l9BORYRfDAP4bK+tmFezkbMcjFrjvJR5CHrAnGaH0FJvznqXPP0coUdB/lBQ7bNdcSMH742nMLGPe2qsXAeVBoZWUS5GdGH+KT0uW7bn20kddw4sWiRSOMc04UwBG1f7pvekxFnZGcGqc585WioEH5+4kVDbI4H84kvtoGY6Aakf36FLOQIkhYuTv/Tc5WX32lOyQ/EcpGWoATnrT0xiEi9XM+fwZaSs6kcyLHXVROCYwRKZpYkFuVOWHxeT4l+vSrJJFr7PP3/yPgIKPzTPhfUWCQrnTtHdw2vDmov85W5U6r7aRMqHGq1R4PDESVMS4RBkkuzFxvdAFfOZTaU3eFgHkSPXWT8PnDlan4jyDNH6+eYk1j3a9Xti+9i3VGrHdVhv4m7S8zchF7CNlcAL5ki7t7Ul2vHHtGaaf+EQ5aEoT4QLn7BdxibEzcL+wcCKMgfmgpHrUmLAJp2UJAdKYXjmHcv3kR8TStdPRFWoLPh2zkUyPlnqDBf11AtkGdktKITyWMAjpbrIa5YTF9xPXvmxUREw8Tollj2zzRbgjWnpSmw0TVy0s08/QGCKTWfH0g6XSEZRZAz0/JQ0LUR0tioIQEKVXSNwvvHHMlmMaLXpCt7R/ojGKm+Cp7knQ5da6EMCqRKN/jewdgLUp0/O4XRyqYO5v7QVXTwzsJ0sO6333Mjqv9obdIUSWOctMbuAV1hHUwcphjZzPhexnJiZYQclNZYe1Wqvzbt/yMoh9ZbZUpB5W/+VVf/3y0sRWV

C:\Users\user\Desktop\WHZAGPPPLA.mp3

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.9793380907468405
Encrypted:	false
SSDEEP:	24:fMxax9xbICbhLvAuyTLHZHq4OVWYJOLg5Ei8BSeFXo7CwRcRYtZh6Gg+OyDNsGab:UxaTqG9S3Hb7kDkdD9RYtC+nBda7nCK
MD5:	40EA3505C6394A7661A3E1FAE62D7C59
SHA1:	2D701942606D3FD763D8682308983D914227BB9E
SHA-256:	A116B0DF9F12FDD36AD3C1F4E4AC71C80E53D8967633DBB3E1B95FFE4807DB93
SHA-512:	7358589F454BAD05348E927287A90439838BFB8A5C40B3742A2313C209A3181EACCEAC779BBF900467C39A3ECE95CB00635AA58B22FF6E9331C3F8D6AE55C930
Malicious:	false
Preview:	<EncryptedKey>N0EwLf1Dz/95YyoUdPHt0C8UMa/r2qsQM9JUSC9ZObtfTMIU6fPDY3fpJd0bS3BI8skCa1/1z7UmKNcXbopn72yBj7Itio7kNr+3M8wwpW6Gn0Jie4umbKFpJ4rQkAtB9GgQ5cL169BSIDcwR/Rqui55aOHy9tLGSfjsWufjEoI=<EncryptedKey>fkBh1GgTh9pTN/6RXa9NU1QGDOeU54JpZfi7Vs16ogIuXTCSHAsT2MzBeCGsL6Rco6Kc7kfcyVm9aMvgJf8hXvN4wzZLrBnuKnn4UYACwWGn61ihtyyrOtUU2SBuKZIPC33EiefOh7zmhtsPvTxzGev7gtdw/hTUG44xsAWKwTz2s4BXLSpkyUz2tXymKj7YzI9m6RJ+7mijE6K5guP/c+O3H7pJlchWdegv8qhTWJTMYVoANn+4gXV20A1ci4nKKrL1HwDQ31xx1hM9GOvpcPj8yyieu8WnLSZWAdzXVXh93LDIbzW2LTUk9b/NzFXZwBmFQlS2JLrVU+/f4yr2ksoHxNuoOHbSBrnsBSUrztlXCXWAAiGFgKeYUSJ6buDCc8yi5+L1/za2T+Fmr8ibwnWGNxIUK6wOKMLZkI+2jY9ZUb2CS8WwUqyLFjTK2oA0K3q0ZCCvVO6gVmd0sJc5BI7xAKBi+wHRInNENb+kLEPowBol3Kofl99rBczm9/Dl04Yy/2oYJ94CMTPbOHl3iPSyU4Q7tAVS7C58cBrX3+HMY11JCno+FRywKOaU0e7H6bnk8mm+eNeB7D6hSYaKzEQSO+Y2KI7WlecxzKdHUT60vXvJBryYgzYPLxO6tpczGndoPgilyHngrjmozzDGcq9T+OLNf8pewteSLp9IfhMo14pWZaIOjrFSrVJJjXKfwA8BgBba1coFi9fEilHFLBJjUr7xL8OQvv7Trn64nM3UcBlW3TROd86bSfeh/zIsp7ULNeDW1Aibj69bJBPretHviD9NokUf

C:\Users\user\Desktop\WHZAGPPPLA.mp3.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.9793380907468405
Encrypted:	false
SSDEEP:	24:fMxax9xbICbhLvAuyTLHZHq4OVWYJOLg5Ei8BSeFXo7CwRcRYtZh6Gg+OyDNsGab:UxaTqG9S3Hb7kDkdD9RYtC+nBda7nCK
MD5:	40EA3505C6394A7661A3E1FAE62D7C59
SHA1:	2D701942606D3FD763D8682308983D914227BB9E
SHA-256:	A116B0DF9F12FDD36AD3C1F4E4AC71C80E53D8967633DBB3E1B95FFE4807DB93
SHA-512:	7358589F454BAD05348E927287A90439838BFB8A5C40B3742A2313C209A3181EACCEAC779BBF900467C39A3ECE95CB00635AA58B22FF6E9331C3F8D6AE55C930
Malicious:	false
Preview:	<EncryptedKey>N0EwLf1Dz/95YyoUdPHt0C8UMa/r2qsQM9JUSC9ZObtfTMIU6fPDY3fpJd0bS3BI8skCa1/1z7UmKNcXbopn72yBj7Itio7kNr+3M8wwpW6Gn0Jie4umbKFpJ4rQkAtB9GgQ5cL169BSIDcwR/Rqui55aOHy9tLGSfjsWufjEoI=<EncryptedKey>fkBh1GgTh9pTN/6RXa9NU1QGDOeU54JpZfi7Vs16ogIuXTCSHAsT2MzBeCGsL6Rco6Kc7kfcyVm9aMvgJf8hXvN4wzZLrBnuKnn4UYACwWGn61ihtyyrOtUU2SBuKZIPC33EiefOh7zmhtsPvTxzGev7gtdw/hTUG44xsAWKwTz2s4BXLSpkyUz2tXymKj7YzI9m6RJ+7mijE6K5guP/c+O3H7pJlchWdegv8qhTWJTMYVoANn+4gXV20A1ci4nKKrL1HwDQ31xx1hM9GOvpcPj8yyieu8WnLSZWAdzXVXh93LDIbzW2LTUk9b/NzFXZwBmFQlS2JLrVU+/f4yr2ksoHxNuoOHbSBrnsBSUrztlXCXWAAiGFgKeYUSJ6buDCc8yi5+L1/za2T+Fmr8ibwnWGNxIUK6wOKMLZkI+2jY9ZUb2CS8WwUqyLFjTK2oA0K3q0ZCCvVO6gVmd0sJc5BI7xAKBi+wHRInNENb+kLEPowBol3Kofl99rBczm9/Dl04Yy/2oYJ94CMTPbOHl3iPSyU4Q7tAVS7C58cBrX3+HMY11JCno+FRywKOaU0e7H6bnk8mm+eNeB7D6hSYaKzEQSO+Y2KI7WlecxzKdHUT60vXvJBryYgzYPLxO6tpczGndoPgilyHngrjmozzDGcq9T+OLNf8pewteSLp9IfhMo14pWZaIOjrFSrVJJjXKfwA8BgBba1coFi9fEilHFLBJjUr7xL8OQvv7Trn64nM3UcBlW3TROd86bSfeh/zIsp7ULNeDW1Aibj69bJBPretHviD9NokUf

C:\Users\user\Desktop\WHZAGPPPLA.pdf

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.984056224343021
Encrypted:	false
SSDEEP:	48:UlsDhy8feFrJ7vEJf/qlwKWwvHXIc7h1XtkM+:UlN8CvcEwOvHXIs1mM+
MD5:	4CC597164686E4F5FD077D64FC29A64B
SHA1:	68AD5B64E943DDF8F53231F66A9C4FE28E8AC44D
SHA-256:	975A9D41A2D02D498555A97756A7FF6418A76F5BCF72E162821467E72FD9BDA2
SHA-512:	3B85475412480A879B870547B937E458D57F546B1628BDDD6B52E982126037EFE6C546CA21F2D9070ECA7F1DCBD25AE9C50B818F82D0090FF42FFF40C56BDF56
Malicious:	false
Preview:	<EncryptedKey>CDvGGLM/gTNjlQp3WRE2NMdIruUkGJqNDPcK3Mf/MqH2au0oqXro37BdzK2LIlLw8n0KVCADPfw8/D2SsXouX2E3NhMSNuAVeIO/sxQUCfr93ti0EHILzBe7e/TS3ww8V4Mwpv6pK/MYYuZpzwLFRjq8PO0s69le6NKIzSaQZpY=<EncryptedKey>wU6gEnFbwrjSSjg0Zh1hVKe2xLqyMvmgWKNHAiH+o4hE1Et4Ny4xkQYisfFJ1BH+Di9BPGeQ+d03lkGd3VMo8s391RJe2bOTL8NUFN94wYQgKs4a0x7kwsDuwpGzdL71p71rBOx/Fxsz+Sy/NYDw6Idpfltx0iBRU2dZqVbW1w3w/bgCX6tCX9rRtxLSCd6iSuHeYbO7xzx1lHWF1Rw9mvQZB2Dxuhwv0Dpi0e102z92tPtj1zkyDLLGzkTwLRbsCvSPmkELxZNCROPMuNPLPFb/n67Uf2oH/B4exSB6XdyE/ArNAb3LhlLFfNolLcZZBTod2fIFZSiS0knIigVafe40a5YOegYcnAyKKbd7CsKpPOg9bSdmUwZLIZMcL7fxHk8CMJB+3Z9XDmXJH+9Kq1zDlsCP7SLESUI96O2e6TL3HRu/xpU6Gch32Xsg1MzjRdxC5uGG6g7/XzbbQGLJHP1TeWKHWmue3XAVLktxNefq0AZ62pNCIVxdnEdjCq+zQ+RTtzakJbT7zUJ9PpFcOBDv50a190b+nz8GPdTrRLa9LvJz1SyIdFb0q5EXbcu5HNCPAw9IiQ33IWmG1wQrougJaqburOOqZZ7t/Jgxg+Ozx4ZgdPN9W8qjtBjeTRKMZEwZmTFq2m7lNNp8QmXep/KhVcqe8e/9oai8Ayso7TUnncfTKlkjtPzdi4z25qSMrHtWHo4+VVEgFk8UwPOHcrjNaVcvnwfDwHEUAdVdhNeXe17wuyLAe3wLNmwKJrlmLv2X/Lkgvpo0EqEBKIX5UtiQZTLrQ+IK

C:\Users\user\Desktop\WHZAGPPPLA.pdf.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.984056224343021
Encrypted:	false
SSDEEP:	48:UlsDhy8feFrJ7vEJf/qlwKWwvHXIc7h1XtkM+:UlN8CvcEwOvHXIs1mM+
MD5:	4CC597164686E4F5FD077D64FC29A64B
SHA1:	68AD5B64E943DDF8F53231F66A9C4FE28E8AC44D
SHA-256:	975A9D41A2D02D498555A97756A7FF6418A76F5BCF72E162821467E72FD9BDA2
SHA-512:	3B85475412480A879B870547B937E458D57F546B1628BDDD6B52E982126037EFE6C546CA21F2D9070ECA7F1DCBD25AE9C50B818F82D0090FF42FFF40C56BDF56
Malicious:	false
Preview:	<EncryptedKey>CDvGGLM/gTNjlQp3WRE2NMdIruUkGJqNDPcK3Mf/MqH2au0oqXro37BdzK2LIlLw8n0KVCADPfw8/D2SsXouX2E3NhMSNuAVeIO/sxQUCfr93ti0EHILzBe7e/TS3ww8V4Mwpv6pK/MYYuZpzwLFRjq8PO0s69le6NKIzSaQZpY=<EncryptedKey>wU6gEnFbwrjSSjg0Zh1hVKe2xLqyMvmgWKNHAiH+o4hE1Et4Ny4xkQYisfFJ1BH+Di9BPGeQ+d03lkGd3VMo8s391RJe2bOTL8NUFN94wYQgKs4a0x7kwsDuwpGzdL71p71rBOx/Fxsz+Sy/NYDw6Idpfltx0iBRU2dZqVbW1w3w/bgCX6tCX9rRtxLSCd6iSuHeYbO7xzx1lHWF1Rw9mvQZB2Dxuhwv0Dpi0e102z92tPtj1zkyDLLGzkTwLRbsCvSPmkELxZNCROPMuNPLPFb/n67Uf2oH/B4exSB6XdyE/ArNAb3LhlLFfNolLcZZBTod2fIFZSiS0knIigVafe40a5YOegYcnAyKKbd7CsKpPOg9bSdmUwZLIZMcL7fxHk8CMJB+3Z9XDmXJH+9Kq1zDlsCP7SLESUI96O2e6TL3HRu/xpU6Gch32Xsg1MzjRdxC5uGG6g7/XzbbQGLJHP1TeWKHWmue3XAVLktxNefq0AZ62pNCIVxdnEdjCq+zQ+RTtzakJbT7zUJ9PpFcOBDv50a190b+nz8GPdTrRLa9LvJz1SyIdFb0q5EXbcu5HNCPAw9IiQ33IWmG1wQrougJaqburOOqZZ7t/Jgxg+Ozx4ZgdPN9W8qjtBjeTRKMZEwZmTFq2m7lNNp8QmXep/KhVcqe8e/9oai8Ayso7TUnncfTKlkjtPzdi4z25qSMrHtWHo4+VVEgFk8UwPOHcrjNaVcvnwfDwHEUAdVdhNeXe17wuyLAe3wLNmwKJrlmLv2X/Lkgvpo0EqEBKIX5UtiQZTLrQ+IK

C:\Users\user\Desktop\Word 2016.lnk

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (3764), with no line terminators
Category:	dropped
Size (bytes):	3764
Entropy (8bit):	5.996280417214826
Encrypted:	false
SSDEEP:	96:UnGkpT3srCCWXjBHyyUMvVe4d+3RgFDt1BoC8/GBlPL:jkh3gyJyFL+xjBT8/ePL
MD5:	77E4086A6C2CA3419121321914726E1D
SHA1:	9F276DA1B55C7EC4ECB59A12105F3FE0AD245E24
SHA-256:	0F2EF46980E3E2923BB68738EBA6C890F229A319F926D9B2033ABB34A71F7F2D
SHA-512:	3F4BA9FA7334D43B9F7FE689625B822837EA33D10530C49FE6A47D8A25AA57433CB254BC5F61EA2413005382BDE6D2B8B263EBFDA30180735479E712DF993A2F
Malicious:	false
Preview:	<EncryptedKey>TKdLV2+Iv4P6/93/NCUz4itZdch5YNy2G0RZPVECFCnUn6O4IZA3ft8yPrFXa+JPe/xxdvhlq94VdX9ZbzEax0mOggARe7MRO2SM+652jzM+PxmoWEgnU+ujHFufKJ1W8/qnOXh8JcTbNfNFkmURnYXdvKUCI0iyEFM+MjBuUyw=<EncryptedKey>ZaNpQh+14R1ReQySOYkqCNFOxbvTpEtJNREKywKcN8fgJRqiEd4JW104Mq8HGJwLs2VOHknOS7EtNVPE+QPGc/jDl0Oqr5YmJUeOXoBiyciZFgBREPC5U6P8Js5JOUckt4GjxY3dnfMTXRtbj/aJcR9297zakfxObDzLEQKZuKdIWWL5siK7JNWwQ1z2E/GMoYbANlwxq6GC0R8bMK38IkcFHFyFZSLmjQHiGJiFdB0QbLYmC92V5aIiLj5iwG6l9c3lKatBa4dySJUirQ3efEyOkJ3RmCktemCg9DK6A4MGIsEoU6+sGUUnUcedVQH7tkfgZEbkURtCAyrVgvkfWuTz/fQiS1oR5FDvN6JjCIAp1mrGrMBf+iFX108HhC+uIbPjtkKz0IErFYzOdwQ7XIzu0a1HiCl1UhDxGBThsPSTUEczqUAQPygZxsizDBh0rJ97FZkdIbuFIdBbongLcIppVcTzWOCbDtGiXjLsapERUHqBDgCPg3DQb2/S0CxdCYFliV33gqDCgNhoQoPGAxC/9uajf33F/jhFTCOP/0vGnLz/jmMYGnU5c22tZNg/bJDK4uFNv4wTN69/DpiubW7KRpMv8cmUcZbixBMDw3+f4jEjXRCgFd/BtDoWvalxEvLv9GXMKfrAgYpaONi7DXiyVTnf9BgkLSe8QeZk8Os03tsQ3ZgCALnwFgiR28PQ/nevQu8jp/wkyBNyY2IjsMMT5o2FM6BSe3pcWEvBwlTor0ZHzocRfX9j69gk6S+QXPkaHStRvG5Tpe5bl7/XzZnSiuDN6aMC

C:\Users\user\Desktop\Word 2016.lnk.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (3764), with no line terminators
Category:	dropped
Size (bytes):	3764
Entropy (8bit):	5.996280417214826
Encrypted:	false
SSDEEP:	96:UnGkpT3srCCWXjBHyyUMvVe4d+3RgFDt1BoC8/GBlPL:jkh3gyJyFL+xjBT8/ePL
MD5:	77E4086A6C2CA3419121321914726E1D
SHA1:	9F276DA1B55C7EC4ECB59A12105F3FE0AD245E24
SHA-256:	0F2EF46980E3E2923BB68738EBA6C890F229A319F926D9B2033ABB34A71F7F2D
SHA-512:	3F4BA9FA7334D43B9F7FE689625B822837EA33D10530C49FE6A47D8A25AA57433CB254BC5F61EA2413005382BDE6D2B8B263EBFDA30180735479E712DF993A2F
Malicious:	false
Preview:	<EncryptedKey>TKdLV2+Iv4P6/93/NCUz4itZdch5YNy2G0RZPVECFCnUn6O4IZA3ft8yPrFXa+JPe/xxdvhlq94VdX9ZbzEax0mOggARe7MRO2SM+652jzM+PxmoWEgnU+ujHFufKJ1W8/qnOXh8JcTbNfNFkmURnYXdvKUCI0iyEFM+MjBuUyw=<EncryptedKey>ZaNpQh+14R1ReQySOYkqCNFOxbvTpEtJNREKywKcN8fgJRqiEd4JW104Mq8HGJwLs2VOHknOS7EtNVPE+QPGc/jDl0Oqr5YmJUeOXoBiyciZFgBREPC5U6P8Js5JOUckt4GjxY3dnfMTXRtbj/aJcR9297zakfxObDzLEQKZuKdIWWL5siK7JNWwQ1z2E/GMoYbANlwxq6GC0R8bMK38IkcFHFyFZSLmjQHiGJiFdB0QbLYmC92V5aIiLj5iwG6l9c3lKatBa4dySJUirQ3efEyOkJ3RmCktemCg9DK6A4MGIsEoU6+sGUUnUcedVQH7tkfgZEbkURtCAyrVgvkfWuTz/fQiS1oR5FDvN6JjCIAp1mrGrMBf+iFX108HhC+uIbPjtkKz0IErFYzOdwQ7XIzu0a1HiCl1UhDxGBThsPSTUEczqUAQPygZxsizDBh0rJ97FZkdIbuFIdBbongLcIppVcTzWOCbDtGiXjLsapERUHqBDgCPg3DQb2/S0CxdCYFliV33gqDCgNhoQoPGAxC/9uajf33F/jhFTCOP/0vGnLz/jmMYGnU5c22tZNg/bJDK4uFNv4wTN69/DpiubW7KRpMv8cmUcZbixBMDw3+f4jEjXRCgFd/BtDoWvalxEvLv9GXMKfrAgYpaONi7DXiyVTnf9BgkLSe8QeZk8Os03tsQ3ZgCALnwFgiR28PQ/nevQu8jp/wkyBNyY2IjsMMT5o2FM6BSe3pcWEvBwlTor0ZHzocRfX9j69gk6S+QXPkaHStRvG5Tpe5bl7/XzZnSiuDN6aMC

C:\Users\user\Desktop\desktop.ini

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (584), with no line terminators
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.942782766565439
Encrypted:	false
SSDEEP:	12:fMEHfapIYRlMf6qD+GfnSeqFMiXADt4pv7KdHwCXy8pxr5IdwzED5U:fMVI8lIFnpqFMiXADtAv+wCXy8pp5Ien
MD5:	1498385DBE181BE3207B49708019364D
SHA1:	7B96E57E77CCD382EBA058D83AC781CC7605A20B
SHA-256:	47D019004055C7C79DD08E122682EDD6852B651A330D2E84BD7E5E7B61113638
SHA-512:	1C5E15128DA9305D8F756BF8A410E568E1B6A3E239F233608F7D56FBED0878B74794D28DE5DC8CA40F606761032D72CD28FEE6791EB660BDAF127E7BA803E2C3
Malicious:	false
Preview:	<EncryptedKey>a6DpWo7J6Yjv6F6Goqqmjd7otAjeuC6w6Ci9XWw1l4KwPcWhYbhQb3wbo5h5iAtImv8Quj1PTT//qMjmxg13C1EDdDAnt63ROkZfSnRdy8F44ls0yptr4tiFiWUGaQWJSBg3RxEXieZAg1qOZV+ERDJ8PghIsqbfJwIRZBuYmBE=<EncryptedKey>EfitFrF2rnWHTxkcz/lratCUWyDaQJ13QjV63mLR+UCsW75RN6rrorfyViNfy1SzwgJ/ipXi8p3uy6gkDvh3e+ucUaTpgqXq2hOpCDgxr/sBd3jtkoIsEhje06H6TpO4WwzEu2bVg7DUev5tr2gbk5lVzdXIL+SUyBC7eTmgF55kPgAtHxJhN6+Pyt9WV/K5IWiX0mzwYirkZEBOeaGJMSDrYqR3NyxO8w6pCroWRQ/5p2VaDitzjPxS5ufpQp+qBd2I3oy6bnDidaReEYIrJVqM2aUS7xP02bMxMm2eJ9t+CbpsMZV8gsT1fa0S4fptEzWnqkl1falH3T3KawSz+zs/zdyDYoFwBGbpnC5IVuOHrRJ2YNvfBKU2MAKaN7/g

C:\Users\user\Desktop\desktop.ini.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (584), with no line terminators
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.942782766565439
Encrypted:	false
SSDEEP:	12:fMEHfapIYRlMf6qD+GfnSeqFMiXADt4pv7KdHwCXy8pxr5IdwzED5U:fMVI8lIFnpqFMiXADtAv+wCXy8pp5Ien
MD5:	1498385DBE181BE3207B49708019364D
SHA1:	7B96E57E77CCD382EBA058D83AC781CC7605A20B
SHA-256:	47D019004055C7C79DD08E122682EDD6852B651A330D2E84BD7E5E7B61113638
SHA-512:	1C5E15128DA9305D8F756BF8A410E568E1B6A3E239F233608F7D56FBED0878B74794D28DE5DC8CA40F606761032D72CD28FEE6791EB660BDAF127E7BA803E2C3
Malicious:	false
Preview:	<EncryptedKey>a6DpWo7J6Yjv6F6Goqqmjd7otAjeuC6w6Ci9XWw1l4KwPcWhYbhQb3wbo5h5iAtImv8Quj1PTT//qMjmxg13C1EDdDAnt63ROkZfSnRdy8F44ls0yptr4tiFiWUGaQWJSBg3RxEXieZAg1qOZV+ERDJ8PghIsqbfJwIRZBuYmBE=<EncryptedKey>EfitFrF2rnWHTxkcz/lratCUWyDaQJ13QjV63mLR+UCsW75RN6rrorfyViNfy1SzwgJ/ipXi8p3uy6gkDvh3e+ucUaTpgqXq2hOpCDgxr/sBd3jtkoIsEhje06H6TpO4WwzEu2bVg7DUev5tr2gbk5lVzdXIL+SUyBC7eTmgF55kPgAtHxJhN6+Pyt9WV/K5IWiX0mzwYirkZEBOeaGJMSDrYqR3NyxO8w6pCroWRQ/5p2VaDitzjPxS5ufpQp+qBd2I3oy6bnDidaReEYIrJVqM2aUS7xP02bMxMm2eJ9t+CbpsMZV8gsT1fa0S4fptEzWnqkl1falH3T3KawSz+zs/zdyDYoFwBGbpnC5IVuOHrRJ2YNvfBKU2MAKaN7/g

C:\Users\user\Documents\BUFZSQPCOH.pdf

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.971538113311296
Encrypted:	false
SSDEEP:	48:UGJvUmi0CNkr2Sxptyh4F7j6MRu8usrGyLY:Uiv++2gyh4Zj6MRuLKY
MD5:	9AEAF3B688D9EFAD1573585F2805107C
SHA1:	7CF9CFC463C9F87490A0956E87B291F228AED8AF
SHA-256:	C1533C10D7BD8DBDD88737CB6B4156AA4E20CB08FEF0805534569D479DD60777
SHA-512:	0D3E69FB6C30C4309900B43013290F05191064C31D73B6FE1B3BA04DA36E3131496DFCC0FCF12CB4934B784A4868C2B0C0AD4F3155604F190DF2C073CDCC1C39
Malicious:	false
Preview:	<EncryptedKey>dYNY/0cPfDIWLDzVWfkb+3x4cVAIG7aeMd8VxlFkE5J1jzR7POae/T9N8J85r9ZLCxEvWzby5dQ7DRHjrBo5GZQ3s1xzqREBQ2daJ3eerrydC+7hbzGm9DajnEBvldc2lHOGKOnzvOut+CUhIkZmYrqw8Gp9DFxDNemH8Vr697g=<EncryptedKey>bDLn3raqQN81GTZpc0p2MjiMbEKgSsP5WI1erW1DvJFlgpf2wV8GOb/gWCRpegLZDRD41iNCCmWD6Zc5giN0F5Op9xDIuazYscXVnOxOWNJeIPm+j6U8avR+Wh/5k0ACrVdplLqI/Fr0RjrPFJbtHCOSYZdLobeuw/JjlVFE+pw1cfLlrZTYSTVCqi5YqXcva5DrS5sWozN0JUbfYmNmZIO7lID4/D5Rp97ji4dHNHCtdTV7gmtK/UO1dVTtvfEdTkq54NLNVW6gW7L4/bpDBVh5kwaW6c3nULyVyUAmcz1e1eh5iycZ1AgUD3ilebElMN96P/5WpsXeE0704BRHqyuNH+2AR7VqEKdQ0nMMhA0He8/gFJFaI2M7RU8I/cGjK9UXK82OcpXe1v5rpu79/ZIVNhYKTNL2MvcH6y1Wb/v8k4t/o9KtdvFiSTOwWxNMVdDJFUKuQhz/n3Jb7sRT5pJEiZyUc30fg172PNPJO09/lz7+zsBHZAwlDh+WyTD5gUdYk4He6j56ZAVZmIHqrRAycvHDEhJwApuiSBINZeHrL7WorqUUBvthtHgw7v8DA430Mi48GlXXQ9qWgwA0W8bkeE6TBdPrGzLndx7MHo6dUOjxK20V51jLaSfHELU5P3fGlcuiWrUERrKSp2LXj3yalyYjTo2eOzmKYkHFHOEp2d1dCc183Z0ateIc0r8QsaSyz1ok74wkB+1Plfd8APmCZrIR6WYpKsnrxlOV6v0qjiieweKQYth9SZGDLemAJKNSE7u60FZhMeZFLfwwfkjbtR1H1K0h

C:\Users\user\Documents\BUFZSQPCOH.pdf.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.971538113311296
Encrypted:	false
SSDEEP:	48:UGJvUmi0CNkr2Sxptyh4F7j6MRu8usrGyLY:Uiv++2gyh4Zj6MRuLKY
MD5:	9AEAF3B688D9EFAD1573585F2805107C
SHA1:	7CF9CFC463C9F87490A0956E87B291F228AED8AF
SHA-256:	C1533C10D7BD8DBDD88737CB6B4156AA4E20CB08FEF0805534569D479DD60777
SHA-512:	0D3E69FB6C30C4309900B43013290F05191064C31D73B6FE1B3BA04DA36E3131496DFCC0FCF12CB4934B784A4868C2B0C0AD4F3155604F190DF2C073CDCC1C39
Malicious:	false
Preview:	<EncryptedKey>dYNY/0cPfDIWLDzVWfkb+3x4cVAIG7aeMd8VxlFkE5J1jzR7POae/T9N8J85r9ZLCxEvWzby5dQ7DRHjrBo5GZQ3s1xzqREBQ2daJ3eerrydC+7hbzGm9DajnEBvldc2lHOGKOnzvOut+CUhIkZmYrqw8Gp9DFxDNemH8Vr697g=<EncryptedKey>bDLn3raqQN81GTZpc0p2MjiMbEKgSsP5WI1erW1DvJFlgpf2wV8GOb/gWCRpegLZDRD41iNCCmWD6Zc5giN0F5Op9xDIuazYscXVnOxOWNJeIPm+j6U8avR+Wh/5k0ACrVdplLqI/Fr0RjrPFJbtHCOSYZdLobeuw/JjlVFE+pw1cfLlrZTYSTVCqi5YqXcva5DrS5sWozN0JUbfYmNmZIO7lID4/D5Rp97ji4dHNHCtdTV7gmtK/UO1dVTtvfEdTkq54NLNVW6gW7L4/bpDBVh5kwaW6c3nULyVyUAmcz1e1eh5iycZ1AgUD3ilebElMN96P/5WpsXeE0704BRHqyuNH+2AR7VqEKdQ0nMMhA0He8/gFJFaI2M7RU8I/cGjK9UXK82OcpXe1v5rpu79/ZIVNhYKTNL2MvcH6y1Wb/v8k4t/o9KtdvFiSTOwWxNMVdDJFUKuQhz/n3Jb7sRT5pJEiZyUc30fg172PNPJO09/lz7+zsBHZAwlDh+WyTD5gUdYk4He6j56ZAVZmIHqrRAycvHDEhJwApuiSBINZeHrL7WorqUUBvthtHgw7v8DA430Mi48GlXXQ9qWgwA0W8bkeE6TBdPrGzLndx7MHo6dUOjxK20V51jLaSfHELU5P3fGlcuiWrUERrKSp2LXj3yalyYjTo2eOzmKYkHFHOEp2d1dCc183Z0ateIc0r8QsaSyz1ok74wkB+1Plfd8APmCZrIR6WYpKsnrxlOV6v0qjiieweKQYth9SZGDLemAJKNSE7u60FZhMeZFLfwwfkjbtR1H1K0h

C:\Users\user\Documents\BWDRWEEARI.docx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.988473122051142
Encrypted:	false
SSDEEP:	48:UFNsfJ/nzNjBD4bDKP89+eMaObXo2YS1NLw63IYW+Fn:UbsNLsKPUUaObeS1NM6YLA
MD5:	AD35EC2E0474E194846E1B5F9388307F
SHA1:	CCE24059300E6CE2A3D119D73CDE0F6C4E8EC94A
SHA-256:	87602BCD4AD3F1A6D9DF949B81035D4E9F1C093C6C0F370FB32CC1B91D5E5001
SHA-512:	2E1E3A4650BBD01F894450D54469859D0AE432FA94E8D525FC8A83F97052DB7A3CD6722005F9CE2F535E9F2A7FEC3CA576781BBE3B9294C3854E8ABF7837814C
Malicious:	false
Preview:	<EncryptedKey>CbG2+p0bD9KW8ofDaDsRbLLYOf/mvZA9MGpM/HbavoYajBwYSskDfhuOkvPMD3Pqxy93mvQXutU0zg36jGQ5sPxmwXGVkdrnA0MLxrJXgLf9CH/1OdpYjoUVIUergzwftOlp6ZSSay/ZOUy2WRWcpgR67F+6e5EbD24e9Ilhics=<EncryptedKey>lfKh8Cx5THyEzEkYKBH8t7+OzdqqaOQs5nOlxDA5ybFPM8N4Y9ca48tKau8yk/PHjRO3gG+CQhY8FbwMkviVg+k7UGKvV/P29uWomYOgz+YTqt264Ck5TIWd5BarfUQDtMqhuIpos14APYxF+mWHmQ19P0zokjLwxOvkzj1Wd00FfBA9hjS8FNMHjKRWJFP8J45vfKzgE1e18kHskTfFPPiRo/zCsxK521JKQEi4BA/GxICrD79vJG+AZlfvY/JnrZEJb4/9mYFxCrVSz9y6HhBvD3nLHfGqIdPS//ixvdTSeWEofSb6ovFlo2DgsgJaOEKToBkkN4HdujydXUC4i1x47Tk6TS8TKbfyuB4vQh35sjxGkaNp3HGZv1rmteII7nV95FA8TMnD+GLOUIhNNDk13CAYW3wvh5AWxlOw46ZTjz707Rm/4yvuT3CuHiL4ia1HwMMCXjqriNCwMyW474bU3rq3Iutt78s6V87QdX1p8g2WgvcXiQMyik4ONaIGWUjoaRzK2GeeWqdybWkk+MKfgRPI/jsR+MuNRBVgM9mov249J9eFXN0WKc0XMicRYcCGl89VQdqcHynKjLDoToHmWl1G6MKFBkGthcAHC9S8+SGmNZeAkpJQsRenjeJiDHg+81F12WAQ/K0segsuNECsAwnv/OY5gu+yemBcruchGeAA5ifTCiDs0FNS1NuelzUQsfUlW4rnBgm4ruKU4P9dpZeDqpsQawEan1GD53AVNY0Xn0imDTmyQW3ZTH1k6Awygg6xFVn/wJqeG7k+SggKMQimxJig

C:\Users\user\Documents\BWDRWEEARI.docx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.988473122051142
Encrypted:	false
SSDEEP:	48:UFNsfJ/nzNjBD4bDKP89+eMaObXo2YS1NLw63IYW+Fn:UbsNLsKPUUaObeS1NM6YLA
MD5:	AD35EC2E0474E194846E1B5F9388307F
SHA1:	CCE24059300E6CE2A3D119D73CDE0F6C4E8EC94A
SHA-256:	87602BCD4AD3F1A6D9DF949B81035D4E9F1C093C6C0F370FB32CC1B91D5E5001
SHA-512:	2E1E3A4650BBD01F894450D54469859D0AE432FA94E8D525FC8A83F97052DB7A3CD6722005F9CE2F535E9F2A7FEC3CA576781BBE3B9294C3854E8ABF7837814C
Malicious:	false
Preview:	<EncryptedKey>CbG2+p0bD9KW8ofDaDsRbLLYOf/mvZA9MGpM/HbavoYajBwYSskDfhuOkvPMD3Pqxy93mvQXutU0zg36jGQ5sPxmwXGVkdrnA0MLxrJXgLf9CH/1OdpYjoUVIUergzwftOlp6ZSSay/ZOUy2WRWcpgR67F+6e5EbD24e9Ilhics=<EncryptedKey>lfKh8Cx5THyEzEkYKBH8t7+OzdqqaOQs5nOlxDA5ybFPM8N4Y9ca48tKau8yk/PHjRO3gG+CQhY8FbwMkviVg+k7UGKvV/P29uWomYOgz+YTqt264Ck5TIWd5BarfUQDtMqhuIpos14APYxF+mWHmQ19P0zokjLwxOvkzj1Wd00FfBA9hjS8FNMHjKRWJFP8J45vfKzgE1e18kHskTfFPPiRo/zCsxK521JKQEi4BA/GxICrD79vJG+AZlfvY/JnrZEJb4/9mYFxCrVSz9y6HhBvD3nLHfGqIdPS//ixvdTSeWEofSb6ovFlo2DgsgJaOEKToBkkN4HdujydXUC4i1x47Tk6TS8TKbfyuB4vQh35sjxGkaNp3HGZv1rmteII7nV95FA8TMnD+GLOUIhNNDk13CAYW3wvh5AWxlOw46ZTjz707Rm/4yvuT3CuHiL4ia1HwMMCXjqriNCwMyW474bU3rq3Iutt78s6V87QdX1p8g2WgvcXiQMyik4ONaIGWUjoaRzK2GeeWqdybWkk+MKfgRPI/jsR+MuNRBVgM9mov249J9eFXN0WKc0XMicRYcCGl89VQdqcHynKjLDoToHmWl1G6MKFBkGthcAHC9S8+SGmNZeAkpJQsRenjeJiDHg+81F12WAQ/K0segsuNECsAwnv/OY5gu+yemBcruchGeAA5ifTCiDs0FNS1NuelzUQsfUlW4rnBgm4ruKU4P9dpZeDqpsQawEan1GD53AVNY0Xn0imDTmyQW3ZTH1k6Awygg6xFVn/wJqeG7k+SggKMQimxJig

C:\Users\user\Documents\BWDRWEEARI.xlsx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.996839475803175
Encrypted:	false
SSDEEP:	24:fMvWOPHck7oU54nw3mPuHKLpI9fH7zaHbzT5HHupqdIkofYQNGqkKCDIoAANDg+o:UOI1oUmImWHxHfyvhHMqdvQNGlt99OwY
MD5:	2E99C467B47A66F157C4FC3A4FE03320
SHA1:	D8B7A74D717C03FD96BA91D48433CA6FE1C66EF6
SHA-256:	2C520C41327A21186503A7883C2E4022DE298DB176F34D0113A1F3325D179DA1
SHA-512:	EDB185D0800B12BD5EBE63CC8E7BAA96EBD1584A04931ED40581C1A41372932A01C2E414EB018B4A050E217E3F7A7ACD3CD393B7FD3FFC87D7CDD2851C0F5E18
Malicious:	false
Preview:	<EncryptedKey>b6u0IY/QhUjG77htxp5F3S9E7eHMiy4k/0Bhw46invgn8UEjdiGiVG+5LSkpRSNqHvCI7Wm163y3v+7tMKglxIOKHtegUytsW1QVwzvACv8MG+DNHtZRrOfLwtb/PxY5hSz06Dl63CZFubK60iv1y3Vmy+p4M6WtDi4gbF+Kb8o=<EncryptedKey>cLSmcXgs9miKdvqYvygrR/8V1rshhm9qBN0WXpk01UIvWRHfc4L8gAgtaYMs4IHhkfosEKws3P7WWe9DRyvX0/oYbEw64QVTAsLg5t3VmGXRrVdgFu4FH4M4XffhXY1aJz/3MsQxVh0CtHCC5c19eLdpr1W0LgHOWWfkHM3eRIFq71hZW8MIpsar2KQO9o7NtDjjSpM2xS4fhse3GbEcOQTQxu9tE9s3+wsQQ0PmBKEb0gFKGJg97w6NeuYbonqTu9ImxRK49q8oa+d72HUgfRTFjiTQ54KjPH/B2GK9sDWybsYN7vVx6/+qgZ74VsO9gDYW7C1e/Xf9qZDzrPWQrMBL/I/SyIYAhFOoOIYuT6fQJKCMNIL4GQpS4apjfkUvonSZNNrAbQ8LgPnG0h4JtSEJcpWvT4y8P2R4C2qmd2X6dTwVYwjYIEcjr1hFoKdSHvM7N7esOomQHdV+JUu4MYCoK18w3BB0tiq10VCpFffc6lBYDNYTdb/qz0AHne8BLxcBXClGsqYqwDvl5TaVx31ryA59bgKBLCff2cD+EhwROsqCUsALfOw4I8KUQJ0qh98iZVzAerCKYCCwtaxlqJqjliDofma3RG0Dqz26Sn9BVndT2wDWA6JSA//RezzsZfZ8DK7EooB3Qgl3hLw5llDcjV+jD+Cc1g01jmpte5Tke8qmpDjdebkJ81w5d3u6JjOc3pwwwlWalbk7hmtjBbK6rXH5iS+p/liESA/E3NNMGIYwb2U8pI71c/FEBYt8BDpy5McdBIMVSAOwX6EO41i1EWc1dHrK

C:\Users\user\Documents\BWDRWEEARI.xlsx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.996839475803175
Encrypted:	false
SSDEEP:	24:fMvWOPHck7oU54nw3mPuHKLpI9fH7zaHbzT5HHupqdIkofYQNGqkKCDIoAANDg+o:UOI1oUmImWHxHfyvhHMqdvQNGlt99OwY
MD5:	2E99C467B47A66F157C4FC3A4FE03320
SHA1:	D8B7A74D717C03FD96BA91D48433CA6FE1C66EF6
SHA-256:	2C520C41327A21186503A7883C2E4022DE298DB176F34D0113A1F3325D179DA1
SHA-512:	EDB185D0800B12BD5EBE63CC8E7BAA96EBD1584A04931ED40581C1A41372932A01C2E414EB018B4A050E217E3F7A7ACD3CD393B7FD3FFC87D7CDD2851C0F5E18
Malicious:	false
Preview:	<EncryptedKey>b6u0IY/QhUjG77htxp5F3S9E7eHMiy4k/0Bhw46invgn8UEjdiGiVG+5LSkpRSNqHvCI7Wm163y3v+7tMKglxIOKHtegUytsW1QVwzvACv8MG+DNHtZRrOfLwtb/PxY5hSz06Dl63CZFubK60iv1y3Vmy+p4M6WtDi4gbF+Kb8o=<EncryptedKey>cLSmcXgs9miKdvqYvygrR/8V1rshhm9qBN0WXpk01UIvWRHfc4L8gAgtaYMs4IHhkfosEKws3P7WWe9DRyvX0/oYbEw64QVTAsLg5t3VmGXRrVdgFu4FH4M4XffhXY1aJz/3MsQxVh0CtHCC5c19eLdpr1W0LgHOWWfkHM3eRIFq71hZW8MIpsar2KQO9o7NtDjjSpM2xS4fhse3GbEcOQTQxu9tE9s3+wsQQ0PmBKEb0gFKGJg97w6NeuYbonqTu9ImxRK49q8oa+d72HUgfRTFjiTQ54KjPH/B2GK9sDWybsYN7vVx6/+qgZ74VsO9gDYW7C1e/Xf9qZDzrPWQrMBL/I/SyIYAhFOoOIYuT6fQJKCMNIL4GQpS4apjfkUvonSZNNrAbQ8LgPnG0h4JtSEJcpWvT4y8P2R4C2qmd2X6dTwVYwjYIEcjr1hFoKdSHvM7N7esOomQHdV+JUu4MYCoK18w3BB0tiq10VCpFffc6lBYDNYTdb/qz0AHne8BLxcBXClGsqYqwDvl5TaVx31ryA59bgKBLCff2cD+EhwROsqCUsALfOw4I8KUQJ0qh98iZVzAerCKYCCwtaxlqJqjliDofma3RG0Dqz26Sn9BVndT2wDWA6JSA//RezzsZfZ8DK7EooB3Qgl3hLw5llDcjV+jD+Cc1g01jmpte5Tke8qmpDjdebkJ81w5d3u6JjOc3pwwwlWalbk7hmtjBbK6rXH5iS+p/liESA/E3NNMGIYwb2U8pI71c/FEBYt8BDpy5McdBIMVSAOwX6EO41i1EWc1dHrK

C:\Users\user\Documents\BWDRWEEARI\BWDRWEEARI.docx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.978862100809019
Encrypted:	false
SSDEEP:	48:U0gYW8T3ogC7OA02kVIn0tncOvsVvTxuyyDGME:U7VOYgiO6Atvor4Q
MD5:	73BA00BD1FEDF85343B8035D7ABA830F
SHA1:	17F036664F001AEAC37F57E7C63552208E3EEE11
SHA-256:	42BC54F28A2072E4EB707AC289D352AED14FF5DEEBF8E84F151C8E5678AC1FAA
SHA-512:	96FAA93A06801F183AF6CFEF859CFF558393BBFA897162165D9E6DEB0A66D29A5A0411E7F900202138F84360E796C3FE26E8D5A90D8D1A51DD0E37BB905DA0F5
Malicious:	false
Preview:	<EncryptedKey>mVvXoQUnyuErwOn3MQbSHApHCBkPHU1+E6Mx2z7cyWU6iDoRdBiLw9mCjmGOuB7FRhwk1iNelnjQku/9i5OozdppHqiH56rBIXENH0y+CAQHyGieHjIZVzK+rXprEhYTyQ2VxQwOX/9KyBdMT02JL6Z8Z/rKSuznozH6n3Pnks4=<EncryptedKey>VcRHyKTeriLKP9Wey7IvBdhiTtS1NqKn+ReRCkGZmnbLQsH14KV9CaWe4lhKnByFWibqyushJlrgcyNKLHaSKim1s/ipf2egVnOdypWlParPabX8yFxOrTcVaw83n1eYyT3UtODuucYs+Q8AaYSDIStWAsG8kCFYia6BLl+n3/77F0zZaoOUFE3uqCznNxLA9sidAx2bCBE58SQtoi8e3u34lnbhWXvugvPG90Gw+NU2jltlbmGYsjADWwa+IUUNWgc+JSPURe3eXEsKxNZU7jqKAos9CMAmWUY1LJEFP/rtC/9VB+32+2Y2ZPTv1rvFhLmiMmqYITGxhwIb7GizKKrumgPi4+dxbbb3WcNM7Dby/lQkfsq2B6SW8AI+Gy7vFvsyHPchoi/EJAWjn4hTnGbdMaJiRo8I2Ghi1M62lhi1ygP6WUaFFNlu7qhSasO1taVO31ITKcxhcki+TitMlGt8jdm8U1GMPTARjrVEuvYuaxJi/SkPm3KHQZaSrahAdfIsLGCJ4NvEvK2qZJRzKzl4Blgh89HyiqUx+I1mwgJ8Yq94EJgnNkUxG04d64KUsUOPNm2i4byN1RN9Q3x1vHzInAYnLekBUuiVAQQkCibsp6Z2RjJ6wmeIskr+XKXf/4x3zBxu+LU3jNsYzjem9mnbJDNKk6JSThYBltAkXRrzTZmd0SHQm6P2nf7u93wG1VaaNGueNaDhmh5YhSna57STjCSTLnuUd1gYq3bDI+crx+AVcpob+B1OQSozaxZ5Xhxon7bf9srs+JPpTo6tWOuQKhDYXIiK

C:\Users\user\Documents\BWDRWEEARI\BWDRWEEARI.docx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.978862100809019
Encrypted:	false
SSDEEP:	48:U0gYW8T3ogC7OA02kVIn0tncOvsVvTxuyyDGME:U7VOYgiO6Atvor4Q
MD5:	73BA00BD1FEDF85343B8035D7ABA830F
SHA1:	17F036664F001AEAC37F57E7C63552208E3EEE11
SHA-256:	42BC54F28A2072E4EB707AC289D352AED14FF5DEEBF8E84F151C8E5678AC1FAA
SHA-512:	96FAA93A06801F183AF6CFEF859CFF558393BBFA897162165D9E6DEB0A66D29A5A0411E7F900202138F84360E796C3FE26E8D5A90D8D1A51DD0E37BB905DA0F5
Malicious:	false
Preview:	<EncryptedKey>mVvXoQUnyuErwOn3MQbSHApHCBkPHU1+E6Mx2z7cyWU6iDoRdBiLw9mCjmGOuB7FRhwk1iNelnjQku/9i5OozdppHqiH56rBIXENH0y+CAQHyGieHjIZVzK+rXprEhYTyQ2VxQwOX/9KyBdMT02JL6Z8Z/rKSuznozH6n3Pnks4=<EncryptedKey>VcRHyKTeriLKP9Wey7IvBdhiTtS1NqKn+ReRCkGZmnbLQsH14KV9CaWe4lhKnByFWibqyushJlrgcyNKLHaSKim1s/ipf2egVnOdypWlParPabX8yFxOrTcVaw83n1eYyT3UtODuucYs+Q8AaYSDIStWAsG8kCFYia6BLl+n3/77F0zZaoOUFE3uqCznNxLA9sidAx2bCBE58SQtoi8e3u34lnbhWXvugvPG90Gw+NU2jltlbmGYsjADWwa+IUUNWgc+JSPURe3eXEsKxNZU7jqKAos9CMAmWUY1LJEFP/rtC/9VB+32+2Y2ZPTv1rvFhLmiMmqYITGxhwIb7GizKKrumgPi4+dxbbb3WcNM7Dby/lQkfsq2B6SW8AI+Gy7vFvsyHPchoi/EJAWjn4hTnGbdMaJiRo8I2Ghi1M62lhi1ygP6WUaFFNlu7qhSasO1taVO31ITKcxhcki+TitMlGt8jdm8U1GMPTARjrVEuvYuaxJi/SkPm3KHQZaSrahAdfIsLGCJ4NvEvK2qZJRzKzl4Blgh89HyiqUx+I1mwgJ8Yq94EJgnNkUxG04d64KUsUOPNm2i4byN1RN9Q3x1vHzInAYnLekBUuiVAQQkCibsp6Z2RjJ6wmeIskr+XKXf/4x3zBxu+LU3jNsYzjem9mnbJDNKk6JSThYBltAkXRrzTZmd0SHQm6P2nf7u93wG1VaaNGueNaDhmh5YhSna57STjCSTLnuUd1gYq3bDI+crx+AVcpob+B1OQSozaxZ5Xhxon7bf9srs+JPpTo6tWOuQKhDYXIiK

C:\Users\user\Documents\BWDRWEEARI\DUKNXICOZT.png

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.985943448875252
Encrypted:	false
SSDEEP:	48:UdgibgTlMPLUv4SG7Hv5jl/3I1tctIY9f436:Uu+gbv4SexfIqAK
MD5:	D8F2018A06D46A1EB72831F7A78E0315
SHA1:	4F0492DF5CF245E2773B5CFBC22173C13A6F8318
SHA-256:	444983D122DD91FE94B50AAE67F8CD90CAC31B995E6810B5738F11157E9338A0
SHA-512:	A7B6D11402308572EA8468733803E3660B9E161E1E6B104DDE9E04857F1D09EDC961658EEBB768B694AC72E65738CF8669F6FFB47DAAC4D0A948E9210819EB3F
Malicious:	false
Preview:	<EncryptedKey>C6px8/C5Rj6F2QYkaF/TmjqemW/QY8AE1I44qUmb9Ttt6JGOq3Jt36IdFZ1wgiSSUSKKjARM9e1VE+6yn+okCcJGiEDnGYQm/LI6WsdunVzPTmo1uV01T6h3E/U3DG+cUoiqF+y6kNJYl5n2L/4ZZk0xcn46t9/kIalL+Sr2dHY=<EncryptedKey>H0sSPB7WTLTHQQGHRIQonWgSVTQ8x6EkqQZM3sgAEeQuOZFsvwasfTQPhppi0CLJQWlp2R1HTRLr79+sa7dV5b+VNoedBbics9zmEW0IpKNpdBi46G4DAH1v4vQczvkDK4y26oqAOLi12AnWOuoe8lIfHveOetwOGgVBNffSS9GIbLCS23XX1N0MPaQ5+pH+rv6LYgDrtjvaA9728JgHcgCVBJ76BCFpr7GcNCKcFhimnkoMX7szmjFKE5didzGTrIp8O31aBhBBrwt2p0HXZfKw3bNNl9LUW9Siiy3sd9eWrYOeJu54diSeuVgO0gnjlyPz2NIeUWDw2E0iPES4oOBBMGpxWdftA2H9rqX3GjzHHHnojFLCez2a6x0O3m2rlUJtU0ElgNScdMroTIhAZiG5A9c/x9q/lOwMeCUBV0VKzKoG0PiaSWIU6HDqO78hvZU6FVDYNikKlXAUJ6pG9Vxlx/vsO1kUefy7+FOk2rNHxyzn6P3NlZjeAZ83VWhEWY2oiBGyOKHe5Z/YHXVCQgCZek3m8/A+PYC7pp9eNNggzslqWrYsgdCDdmN89eiZbfWqPwB3jW5KpZglhkU/oE0ZJF65dkXFRMjZgMriweHxurbrp35ANAuQljbCh2TieBnMb/f9FYxADQfO/x/dx0qMrWwFAUabOHMoFun60epFbCGqKSWLvc+qT/reYhEA+H1MJS6whY4ZLLGJYAM1mOVryz/e9xeDci3WpXdC/XMghcY7NAhZAZeu4PB2qm4fJX5O7D0p4+Z0zy8yDMDAs2Uak9trcg/W

C:\Users\user\Documents\BWDRWEEARI\DUKNXICOZT.png.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.985943448875252
Encrypted:	false
SSDEEP:	48:UdgibgTlMPLUv4SG7Hv5jl/3I1tctIY9f436:Uu+gbv4SexfIqAK
MD5:	D8F2018A06D46A1EB72831F7A78E0315
SHA1:	4F0492DF5CF245E2773B5CFBC22173C13A6F8318
SHA-256:	444983D122DD91FE94B50AAE67F8CD90CAC31B995E6810B5738F11157E9338A0
SHA-512:	A7B6D11402308572EA8468733803E3660B9E161E1E6B104DDE9E04857F1D09EDC961658EEBB768B694AC72E65738CF8669F6FFB47DAAC4D0A948E9210819EB3F
Malicious:	false
Preview:	<EncryptedKey>C6px8/C5Rj6F2QYkaF/TmjqemW/QY8AE1I44qUmb9Ttt6JGOq3Jt36IdFZ1wgiSSUSKKjARM9e1VE+6yn+okCcJGiEDnGYQm/LI6WsdunVzPTmo1uV01T6h3E/U3DG+cUoiqF+y6kNJYl5n2L/4ZZk0xcn46t9/kIalL+Sr2dHY=<EncryptedKey>H0sSPB7WTLTHQQGHRIQonWgSVTQ8x6EkqQZM3sgAEeQuOZFsvwasfTQPhppi0CLJQWlp2R1HTRLr79+sa7dV5b+VNoedBbics9zmEW0IpKNpdBi46G4DAH1v4vQczvkDK4y26oqAOLi12AnWOuoe8lIfHveOetwOGgVBNffSS9GIbLCS23XX1N0MPaQ5+pH+rv6LYgDrtjvaA9728JgHcgCVBJ76BCFpr7GcNCKcFhimnkoMX7szmjFKE5didzGTrIp8O31aBhBBrwt2p0HXZfKw3bNNl9LUW9Siiy3sd9eWrYOeJu54diSeuVgO0gnjlyPz2NIeUWDw2E0iPES4oOBBMGpxWdftA2H9rqX3GjzHHHnojFLCez2a6x0O3m2rlUJtU0ElgNScdMroTIhAZiG5A9c/x9q/lOwMeCUBV0VKzKoG0PiaSWIU6HDqO78hvZU6FVDYNikKlXAUJ6pG9Vxlx/vsO1kUefy7+FOk2rNHxyzn6P3NlZjeAZ83VWhEWY2oiBGyOKHe5Z/YHXVCQgCZek3m8/A+PYC7pp9eNNggzslqWrYsgdCDdmN89eiZbfWqPwB3jW5KpZglhkU/oE0ZJF65dkXFRMjZgMriweHxurbrp35ANAuQljbCh2TieBnMb/f9FYxADQfO/x/dx0qMrWwFAUabOHMoFun60epFbCGqKSWLvc+qT/reYhEA+H1MJS6whY4ZLLGJYAM1mOVryz/e9xeDci3WpXdC/XMghcY7NAhZAZeu4PB2qm4fJX5O7D0p4+Z0zy8yDMDAs2Uak9trcg/W

C:\Users\user\Documents\BWDRWEEARI\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\Documents\BWDRWEEARI\MIVTQDBATG.mp3

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.992309402601636
Encrypted:	false
SSDEEP:	24:fMAp4vIRqN4NS2UUzXj5VkaUGm2ECz7dgO2glwwKYn1D4RzTYOQH7QqiMhyGS:Ua4ARqNMUU50Gm2ECz7b8Y1sl4+xGS
MD5:	E51FAA032AE09216D8D6A67B5AB46679
SHA1:	4E2F00FF3B03E08BD6313EC8F213FEA5C78E7351
SHA-256:	858EB767FB5EDEB38C70FF38B39D1FB6F3F6AF92EB8AD7BCD1B71B68A7FC7D09
SHA-512:	1181B2AF257C1A4675F46FF48CC03C138BFC153A443205408EAE1298AAAA520F58B2798D15B750F997641E9631D1D1B657E5D434B1ADB51FDBD1E6E705382378
Malicious:	false
Preview:	<EncryptedKey>R72aFZidfemdYcbkzwjBuZWlMc8opCdEooCKBQ7W6qAVd6Vxs30onzAGHLtVCgcWsm55aALB/9Xj2uRR5wcRr7DkxHLnJN8vAYGX7CO/flsg44zGh87azKRMtqFoDxdNb42OXYo3uCk7FiACJujrGA0Va1uUp1mvDyUyEQDPbeQ=<EncryptedKey>vJG/U4F2SC6yJO+5i19Wpqi734Mdj1F2+p43tk/3UeHzuFR1unsRi3/KOX9jFKovsWVulavGOyBCzYFbbNVZSgXJtx7rTmcMvSuW7S7toQTgfmNpTFcLxZeiA93G1pQgPMqJDl3bGTYdzBfl7lnXvUQSjGsjhE0uvciDAqWQ3WVX8qJxr45W5VLeUsV2Qau6kq+4+7u+CWoSdg/EbwBBfSgtKuF2LT2BrFFcbK0ynh3pO+5HRKnVsR8foxCPkAVB17V1sj3EXCmhPES9cncBeLFIFvCa0sUeseXMCmsHYTn0twwtTuJCLRINPbc7WDeFqE5WnoSvN7qh0JNPN8YhXnNF4A8xg+r9jZmRgaMf+dNKIZcJHzWZzw9FIvXHf4w7a/T3ubRm2v8TSOQmjuLwwq7UHVkYfCMecB9p3+ediWMDA8pTJXFGXs8/GJTvF2U5OE+ZH0XK+dOK0vsYLmZvMixbqBHY+xskb6CU2w+Y9X6r0tWH3eGedi18OeT70BejHrYzAIrObwUg0tCcwnIrkrzjpOTcGBj9GH/MgfoaOl1tOSnCYv9ZM/Wc6i6pnVNi/cW1gCTufhlBmrJrpzTRRveuuXIDETSKFoJsK5dRTfmfsN8ZaYFXI0k9IBVJcOkU0Z/Z6Rw/PuSORd0OBpybB3DILj0l/ub/chaq3YcKn0WL9KIgNu6/kmmBdxdxuserGzGhHiRCrlDA9GydftM7npX8DvGLS0ZW6V37t+tiW5iniNS/4Mk6bnq8mfT7i8UANff7FQzC7qRjFsIG/hBkiRUGF6lUVJ9N

C:\Users\user\Documents\BWDRWEEARI\MIVTQDBATG.mp3.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.992309402601636
Encrypted:	false
SSDEEP:	24:fMAp4vIRqN4NS2UUzXj5VkaUGm2ECz7dgO2glwwKYn1D4RzTYOQH7QqiMhyGS:Ua4ARqNMUU50Gm2ECz7b8Y1sl4+xGS
MD5:	E51FAA032AE09216D8D6A67B5AB46679
SHA1:	4E2F00FF3B03E08BD6313EC8F213FEA5C78E7351
SHA-256:	858EB767FB5EDEB38C70FF38B39D1FB6F3F6AF92EB8AD7BCD1B71B68A7FC7D09
SHA-512:	1181B2AF257C1A4675F46FF48CC03C138BFC153A443205408EAE1298AAAA520F58B2798D15B750F997641E9631D1D1B657E5D434B1ADB51FDBD1E6E705382378
Malicious:	false
Preview:	<EncryptedKey>R72aFZidfemdYcbkzwjBuZWlMc8opCdEooCKBQ7W6qAVd6Vxs30onzAGHLtVCgcWsm55aALB/9Xj2uRR5wcRr7DkxHLnJN8vAYGX7CO/flsg44zGh87azKRMtqFoDxdNb42OXYo3uCk7FiACJujrGA0Va1uUp1mvDyUyEQDPbeQ=<EncryptedKey>vJG/U4F2SC6yJO+5i19Wpqi734Mdj1F2+p43tk/3UeHzuFR1unsRi3/KOX9jFKovsWVulavGOyBCzYFbbNVZSgXJtx7rTmcMvSuW7S7toQTgfmNpTFcLxZeiA93G1pQgPMqJDl3bGTYdzBfl7lnXvUQSjGsjhE0uvciDAqWQ3WVX8qJxr45W5VLeUsV2Qau6kq+4+7u+CWoSdg/EbwBBfSgtKuF2LT2BrFFcbK0ynh3pO+5HRKnVsR8foxCPkAVB17V1sj3EXCmhPES9cncBeLFIFvCa0sUeseXMCmsHYTn0twwtTuJCLRINPbc7WDeFqE5WnoSvN7qh0JNPN8YhXnNF4A8xg+r9jZmRgaMf+dNKIZcJHzWZzw9FIvXHf4w7a/T3ubRm2v8TSOQmjuLwwq7UHVkYfCMecB9p3+ediWMDA8pTJXFGXs8/GJTvF2U5OE+ZH0XK+dOK0vsYLmZvMixbqBHY+xskb6CU2w+Y9X6r0tWH3eGedi18OeT70BejHrYzAIrObwUg0tCcwnIrkrzjpOTcGBj9GH/MgfoaOl1tOSnCYv9ZM/Wc6i6pnVNi/cW1gCTufhlBmrJrpzTRRveuuXIDETSKFoJsK5dRTfmfsN8ZaYFXI0k9IBVJcOkU0Z/Z6Rw/PuSORd0OBpybB3DILj0l/ub/chaq3YcKn0WL9KIgNu6/kmmBdxdxuserGzGhHiRCrlDA9GydftM7npX8DvGLS0ZW6V37t+tiW5iniNS/4Mk6bnq8mfT7i8UANff7FQzC7qRjFsIG/hBkiRUGF6lUVJ9N

C:\Users\user\Documents\BWDRWEEARI\OVWVVIANZH.jpg

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.996789089575483
Encrypted:	false
SSDEEP:	24:fM0TWENs23zqualQuSq1Bj+1s82uTJYezO5VcWQsm+cr9LEeGKeSn5AhYkwyapWr:U8d3PGBBjt8fYezOUWQsmGKeHXagr
MD5:	92213F66A2DE2AC90E69D72426419321
SHA1:	FBE16510B7E771A7301D0198BAECF97638997769
SHA-256:	A6E9CD85DADA1DEF61554084ACD51CAEE245AFE9A82C48C5C4998ECAFEB45EC3
SHA-512:	CCDD3FD50E52652B8DBACC9A0C7AFA0D7F7A0AEDBA15B3A9952BC0A60C30B0C6BB48A187822864FCB513C0A4E8A85F51816F7E48EB8BCEB6A4ED23EDC16E81B9
Malicious:	false
Preview:	<EncryptedKey>UlFnrovZCTGqdGQhWPNj3U5QJWl7j7ktyabB+wBXj4h7alNWkEHNhOBR+kSEoUc7wlrbhLgvRFZJi4lZWznfxEl5XJa/zwYA3kQVLn+LfdfbB83XVUGwqEXBDn2uAlDyU1uDYXgkqkBJTLbwLA6hEit9Xn2W/j4mbiwGtgai3B0=<EncryptedKey>RtyktRWFpcnmCj+OlwSp57nJwqu22e6SphyVeqTJtnpPnr+KQeN/a38Hfxw/h+cqEpxkoZth6uTvpArIRg0H1vMMce4b0npV3SPUgqS1oxmM8hYnH8jWoPn4bpLDySyyqN/nMNTGJC1qxRXfiToPkzt+BhwgDQTxK/BWlCPH2/mm8DwB5NWmT5cnl24WxGQMSFgI8/fEfiGaUdwM4BxAs7pekJISUyzK2LmjkLmB3xeqNYTzb2w7GrZbETAGI5rGbmWNYG8PaAJFPGpJ2VH05CCmQBRgDv0TuRgBOy/TG7jTijudm5ii7LQj8+VuQpVX3jPG3B6d9tRO8408wRpHktSLXmSFgoNgQnr7vxumGX/mw/Pengi9VP8zgHbx1rbNWbvFpvLXv5v2MlRtF/ufPSxxTya4hHTUH5OJJhTQWXfIm9xJFXGMlvErgp75gaUn4xUf634CjLlix8YKdgAwg5oxrnMSA81ZCeQPAtFIejq+yN+PK1HUoHAaG6nI/cQgLV3o56b7kUYYGwplWB/9Um4gBHPDTf/FVJqNEW6SwtP/IjuFxseGgvrsDDNDY9XT+rNeP5EOJKfaiq3Z1Va0PVNY3dcxn7BLCrI4KsShTsH9lrx2zKn3W5e73pj4LceBX8+WvVCc+TrLLE1xnboot7rCnr2qDq0PmoJmaCmiAmBwASlsRgeXGFSLVfq1LSQGe/rKc1DyqaJiIQ6aQ3jVlQ00T5Os11QHXwAuT6OELnIoKNQYSWjcKKVK9/7Od3iMurgY/sCJD7Cc4CDgZzUeju2hFIjLYlyX

C:\Users\user\Documents\BWDRWEEARI\OVWVVIANZH.jpg.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.996789089575483
Encrypted:	false
SSDEEP:	24:fM0TWENs23zqualQuSq1Bj+1s82uTJYezO5VcWQsm+cr9LEeGKeSn5AhYkwyapWr:U8d3PGBBjt8fYezOUWQsmGKeHXagr
MD5:	92213F66A2DE2AC90E69D72426419321
SHA1:	FBE16510B7E771A7301D0198BAECF97638997769
SHA-256:	A6E9CD85DADA1DEF61554084ACD51CAEE245AFE9A82C48C5C4998ECAFEB45EC3
SHA-512:	CCDD3FD50E52652B8DBACC9A0C7AFA0D7F7A0AEDBA15B3A9952BC0A60C30B0C6BB48A187822864FCB513C0A4E8A85F51816F7E48EB8BCEB6A4ED23EDC16E81B9
Malicious:	false
Preview:	<EncryptedKey>UlFnrovZCTGqdGQhWPNj3U5QJWl7j7ktyabB+wBXj4h7alNWkEHNhOBR+kSEoUc7wlrbhLgvRFZJi4lZWznfxEl5XJa/zwYA3kQVLn+LfdfbB83XVUGwqEXBDn2uAlDyU1uDYXgkqkBJTLbwLA6hEit9Xn2W/j4mbiwGtgai3B0=<EncryptedKey>RtyktRWFpcnmCj+OlwSp57nJwqu22e6SphyVeqTJtnpPnr+KQeN/a38Hfxw/h+cqEpxkoZth6uTvpArIRg0H1vMMce4b0npV3SPUgqS1oxmM8hYnH8jWoPn4bpLDySyyqN/nMNTGJC1qxRXfiToPkzt+BhwgDQTxK/BWlCPH2/mm8DwB5NWmT5cnl24WxGQMSFgI8/fEfiGaUdwM4BxAs7pekJISUyzK2LmjkLmB3xeqNYTzb2w7GrZbETAGI5rGbmWNYG8PaAJFPGpJ2VH05CCmQBRgDv0TuRgBOy/TG7jTijudm5ii7LQj8+VuQpVX3jPG3B6d9tRO8408wRpHktSLXmSFgoNgQnr7vxumGX/mw/Pengi9VP8zgHbx1rbNWbvFpvLXv5v2MlRtF/ufPSxxTya4hHTUH5OJJhTQWXfIm9xJFXGMlvErgp75gaUn4xUf634CjLlix8YKdgAwg5oxrnMSA81ZCeQPAtFIejq+yN+PK1HUoHAaG6nI/cQgLV3o56b7kUYYGwplWB/9Um4gBHPDTf/FVJqNEW6SwtP/IjuFxseGgvrsDDNDY9XT+rNeP5EOJKfaiq3Z1Va0PVNY3dcxn7BLCrI4KsShTsH9lrx2zKn3W5e73pj4LceBX8+WvVCc+TrLLE1xnboot7rCnr2qDq0PmoJmaCmiAmBwASlsRgeXGFSLVfq1LSQGe/rKc1DyqaJiIQ6aQ3jVlQ00T5Os11QHXwAuT6OELnIoKNQYSWjcKKVK9/7Od3iMurgY/sCJD7Cc4CDgZzUeju2hFIjLYlyX

C:\Users\user\Documents\BWDRWEEARI\UBVUNTSCZJ.xlsx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.99139193261697
Encrypted:	false
SSDEEP:	24:fM+0zF9yvXNB9BUvWyzms60I5Ux7hIM0o2aYTMPN2V0O9c/I7xY+YlThqJ21hWcA:U+0x9yvlJyy30AE7hMTeO9pis2nWTtvn
MD5:	94E06EA0A3336B66F4E11FAB48D0DC0B
SHA1:	97D3B1D969005C32924B5DF18864036224CC6440
SHA-256:	AB0B464D122BCE9FF8CF13D0CE81423C6DAFBACC3A6B9F49BA6294FD9816A34A
SHA-512:	A8BBCFF236265A69945D1D2412849E4CD5346F06EAB2DF59EFF329AB26A575F2BE90FF7292A29FCAE52FBE521DED37745BB79EB9F14B1F2E9A80F27487875FCF
Malicious:	false
Preview:	<EncryptedKey>CqSu2Y5aX9NDDUCeiHpIQU/wVR2jcVVuJoGv51ZnfUZIxCr1FepLYg54JzTkfcOVVl4PDqTJRd1s3rZ1BJR2COygyZ4jDoy0GJymkJI2u0LRAD1DyHOVIQd2Of5PQoTqi1bBPxJpBYwdGgi8uz35XDAPq8ZR5UAwo9q8G2JTdjw=<EncryptedKey>LiO9FouO7TM/wB36jby3TkxpFsjr08Qd7Bv23PSYMVycpKFKi3qBS6Kub0aS7WH82pENQSMNX+gFrPtmD/LPnUwTh+4Vr1JI4oG7vAmqb/r6lW0ydCytxHK8liTJQYPGdQtf3xfTsEQM82NwHNMeTtDKimuMllAmNHv4GdJsNqjJ+yN2m/DRDsJDpsdlnTMr04STMwV5o1afKmlKhs6M6y6ukMch/feWQwvehByh98drav/pI4GoN3Ie5sSZu7Nr8A2n4W8qt3jSX1L6ZmsFhgk4Nh5hOrAkBLtFIF+GnEXczOFIyXRDyT1W5MrovjQt+gH1USIonlCh9K/m+ttW2xXZYr1FoBZBUSu7mHZdPHy+zU/2K4wQFFJlwjysoOfDgdEseNcaY+Bab3XvSzXfxt/ziwL8griUbYy7gq4KoeUJQGTpu/6olTGy39t7brLP5L1W1/Ld3oEGJK1DCbwWwQGjJOJNFtejSEbUVYTtZs6vIq2lvwOTvOWfaumUtg7Tjmj9QOQ+j8CsKzwaZRxh+76Rt8h40zCm8k30v0sBxT4W8WeoBiw6/aGKf1z4PaYkeTTJhq2Rn0H/MLvFSIty4EG7EWYlBFrVQ6nT2GiX0o8CSTBROjR53yd0T608EoKbZgwKJxjMfPPOy0FeYKtkSMn8cZMpx+fRriB9j+fnzUCPaL+AJ8LXenh/yv5QwKiOdb7dmfnaRV1qm4U+7VUWR3VbGnzq/jvAcP9nrcMHrDe+nnDYwsSY3QwpohFwh49Uo466qPixK57i7UNmYtv5oHT6ZHSkONS7

C:\Users\user\Documents\BWDRWEEARI\UBVUNTSCZJ.xlsx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.99139193261697
Encrypted:	false
SSDEEP:	24:fM+0zF9yvXNB9BUvWyzms60I5Ux7hIM0o2aYTMPN2V0O9c/I7xY+YlThqJ21hWcA:U+0x9yvlJyy30AE7hMTeO9pis2nWTtvn
MD5:	94E06EA0A3336B66F4E11FAB48D0DC0B
SHA1:	97D3B1D969005C32924B5DF18864036224CC6440
SHA-256:	AB0B464D122BCE9FF8CF13D0CE81423C6DAFBACC3A6B9F49BA6294FD9816A34A
SHA-512:	A8BBCFF236265A69945D1D2412849E4CD5346F06EAB2DF59EFF329AB26A575F2BE90FF7292A29FCAE52FBE521DED37745BB79EB9F14B1F2E9A80F27487875FCF
Malicious:	false
Preview:	<EncryptedKey>CqSu2Y5aX9NDDUCeiHpIQU/wVR2jcVVuJoGv51ZnfUZIxCr1FepLYg54JzTkfcOVVl4PDqTJRd1s3rZ1BJR2COygyZ4jDoy0GJymkJI2u0LRAD1DyHOVIQd2Of5PQoTqi1bBPxJpBYwdGgi8uz35XDAPq8ZR5UAwo9q8G2JTdjw=<EncryptedKey>LiO9FouO7TM/wB36jby3TkxpFsjr08Qd7Bv23PSYMVycpKFKi3qBS6Kub0aS7WH82pENQSMNX+gFrPtmD/LPnUwTh+4Vr1JI4oG7vAmqb/r6lW0ydCytxHK8liTJQYPGdQtf3xfTsEQM82NwHNMeTtDKimuMllAmNHv4GdJsNqjJ+yN2m/DRDsJDpsdlnTMr04STMwV5o1afKmlKhs6M6y6ukMch/feWQwvehByh98drav/pI4GoN3Ie5sSZu7Nr8A2n4W8qt3jSX1L6ZmsFhgk4Nh5hOrAkBLtFIF+GnEXczOFIyXRDyT1W5MrovjQt+gH1USIonlCh9K/m+ttW2xXZYr1FoBZBUSu7mHZdPHy+zU/2K4wQFFJlwjysoOfDgdEseNcaY+Bab3XvSzXfxt/ziwL8griUbYy7gq4KoeUJQGTpu/6olTGy39t7brLP5L1W1/Ld3oEGJK1DCbwWwQGjJOJNFtejSEbUVYTtZs6vIq2lvwOTvOWfaumUtg7Tjmj9QOQ+j8CsKzwaZRxh+76Rt8h40zCm8k30v0sBxT4W8WeoBiw6/aGKf1z4PaYkeTTJhq2Rn0H/MLvFSIty4EG7EWYlBFrVQ6nT2GiX0o8CSTBROjR53yd0T608EoKbZgwKJxjMfPPOy0FeYKtkSMn8cZMpx+fRriB9j+fnzUCPaL+AJ8LXenh/yv5QwKiOdb7dmfnaRV1qm4U+7VUWR3VbGnzq/jvAcP9nrcMHrDe+nnDYwsSY3QwpohFwh49Uo466qPixK57i7UNmYtv5oHT6ZHSkONS7

C:\Users\user\Documents\BWDRWEEARI\WHZAGPPPLA.pdf

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.993920447730182
Encrypted:	false
SSDEEP:	24:fM/aUDZytsuzuHe+3XC9T25orXwTpbMx7iVkIvu4sO70RrAuR6RccW3Zww3AEz2L:U/ZCpv0B0AkSPsO70ZAs64Y1T0PiN
MD5:	18E9B4787D48F2A7F9DF185157AE4138
SHA1:	7850C709C2EB6919AF79399938A1E0ECC89F37D7
SHA-256:	FF15166FAF8CE99D8F383BE3C3F1720B4B34AA27C1BBE02374F4A3F6E480C1DC
SHA-512:	AB4152310E29D5E23EAA52AA552541FB9A4ECC3CD0F2FD56184C3450F039A81E2F7BF1BBB7B63A6778C10E6A338E8DC87AC44ED55D4F6BB964F4E888619490A0
Malicious:	false
Preview:	<EncryptedKey>jTZGD61sH8LvlVT41P3SH+bH5Bi054WWRFS/C8dAA35ZTPvcYx7u3zNFF+gW2WQBrMGTE6gR5jg0PuLpi/SWvg+kWtlJssNlSKXlLsQKaCCPhjQ0Zb4jMVMTvvtPov7RDvhauyyaGsFahN3nA8mCZn5Fy+YpEKrTnxB2D7hCD7M=<EncryptedKey>DhNSmZQvcJKz6tZN/mD/b5Jp96m5jg2kCBh8DyWhuEvejX0YXlsrV7lAn6EutSs7N1OKH8/fVtjcxDlZ+wMNkzo/UDD/y9GWJP6MW2Wbiy3qKVPsE2A3/YAvuApFdtSOm9zuzTZnG/FUvbeSld7GfEiKUarK12ErekrFZMVT0M+JD2Pf6Q4B2Mdl7wCwJz8/qeMY71EQdioRb4aHdkhf3Tz5XK1AZIHkgY14YUnmFTexAZtkAf1zIRqGp9qltEd11cf9tSaftI/ht4A1TP7xgrNzhAa87ADpJh0U2qtpMrLEUbYw5/BubLr5jf+PHiDZvcDK3/9/KoS7vMEhNVfPth0jgjiiaAt3iDlLuVL/v8Wyf/Ke07D0FXYuFBIk6nK+Z1W0CBJmBL1r/jzOgwoCYwRb63owZ+96J27RQeeN3PlFc9B+4JDhsJf1CXpP3xBEmsX+ZO0ZE+YJxxLI2aqb3uXm/oQly3nr5aysmh1bPorLiyGfc8DPKugc9y4gCUAsM+TfM0bz8cQa0rEdUg7Qx48Bc9QCWfBw/goGI6Si2hGCmFkycy/tLKVApiotm78WnCYUvzeS66v0LYaqYdXcWHxEFeu31mo00tWKNJ/9Fy+9mbVR1zZOpGWNbPifMsNZ8UqQS1ieunOXVEt0TrZ77bYkmJ3pxRTZRvjmDLhyzLE3XPp7SLugKAdp7Np+q5vfIY8J/W7sCmvqLbT5iBs7pLfep2jg4OgQ9jYwk85EPeiL9bD6HmN5IuyfDyWFDXxRWrxrbgHVqbfiO3QTyx8E4oTaT0l1bhce

C:\Users\user\Documents\BWDRWEEARI\WHZAGPPPLA.pdf.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.993920447730182
Encrypted:	false
SSDEEP:	24:fM/aUDZytsuzuHe+3XC9T25orXwTpbMx7iVkIvu4sO70RrAuR6RccW3Zww3AEz2L:U/ZCpv0B0AkSPsO70ZAs64Y1T0PiN
MD5:	18E9B4787D48F2A7F9DF185157AE4138
SHA1:	7850C709C2EB6919AF79399938A1E0ECC89F37D7
SHA-256:	FF15166FAF8CE99D8F383BE3C3F1720B4B34AA27C1BBE02374F4A3F6E480C1DC
SHA-512:	AB4152310E29D5E23EAA52AA552541FB9A4ECC3CD0F2FD56184C3450F039A81E2F7BF1BBB7B63A6778C10E6A338E8DC87AC44ED55D4F6BB964F4E888619490A0
Malicious:	false
Preview:	<EncryptedKey>jTZGD61sH8LvlVT41P3SH+bH5Bi054WWRFS/C8dAA35ZTPvcYx7u3zNFF+gW2WQBrMGTE6gR5jg0PuLpi/SWvg+kWtlJssNlSKXlLsQKaCCPhjQ0Zb4jMVMTvvtPov7RDvhauyyaGsFahN3nA8mCZn5Fy+YpEKrTnxB2D7hCD7M=<EncryptedKey>DhNSmZQvcJKz6tZN/mD/b5Jp96m5jg2kCBh8DyWhuEvejX0YXlsrV7lAn6EutSs7N1OKH8/fVtjcxDlZ+wMNkzo/UDD/y9GWJP6MW2Wbiy3qKVPsE2A3/YAvuApFdtSOm9zuzTZnG/FUvbeSld7GfEiKUarK12ErekrFZMVT0M+JD2Pf6Q4B2Mdl7wCwJz8/qeMY71EQdioRb4aHdkhf3Tz5XK1AZIHkgY14YUnmFTexAZtkAf1zIRqGp9qltEd11cf9tSaftI/ht4A1TP7xgrNzhAa87ADpJh0U2qtpMrLEUbYw5/BubLr5jf+PHiDZvcDK3/9/KoS7vMEhNVfPth0jgjiiaAt3iDlLuVL/v8Wyf/Ke07D0FXYuFBIk6nK+Z1W0CBJmBL1r/jzOgwoCYwRb63owZ+96J27RQeeN3PlFc9B+4JDhsJf1CXpP3xBEmsX+ZO0ZE+YJxxLI2aqb3uXm/oQly3nr5aysmh1bPorLiyGfc8DPKugc9y4gCUAsM+TfM0bz8cQa0rEdUg7Qx48Bc9QCWfBw/goGI6Si2hGCmFkycy/tLKVApiotm78WnCYUvzeS66v0LYaqYdXcWHxEFeu31mo00tWKNJ/9Fy+9mbVR1zZOpGWNbPifMsNZ8UqQS1ieunOXVEt0TrZ77bYkmJ3pxRTZRvjmDLhyzLE3XPp7SLugKAdp7Np+q5vfIY8J/W7sCmvqLbT5iBs7pLfep2jg4OgQ9jYwk85EPeiL9bD6HmN5IuyfDyWFDXxRWrxrbgHVqbfiO3QTyx8E4oTaT0l1bhce

C:\Users\user\Documents\DUKNXICOZT.png

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.997292248131227
Encrypted:	false
SSDEEP:	24:fMfBpE3kIgPzHDxRDc4JOA8lQXvSOc1poLmP357gfMyqy8FEUNvndAOrP5X74mXM:U5C38HDX4FA8O6GmP3XXaUsmA
MD5:	AB738B0D56A09F6D4BBC38B7D949F679
SHA1:	F8D9AE11D5123033AB83990EF2CEA402D24A4DC3
SHA-256:	E98FC492A549A733A8E90CE3322F97EA1C924A47E3B7F57132C0420788FF56B1
SHA-512:	0A72265CBED155326FBF7C1D05F86F056496CDCBCE6250C97ADB95A3ABA161EB96990E70DD312491BB11D630F16547200069446364C31EEA407711318DD648FA
Malicious:	false
Preview:	<EncryptedKey>Ms0rXCcDxu+PGZrrcFQlpcLrwdXeLD1cCPKmmFAyBfEOijdI4ZcNJE+k4e283us9WgpSOh1htducLMFOkORGbQuvSaHQ5hJmNCARRXQRpjVruBVN5hZ88V8TVvubCMD7ZIxNVur4K6FFpVA4ubieYVPxxEkPq+QQtLMi+gmvSbk=<EncryptedKey>zRgJ4BqIVfnJdYIKB0a7pFnTDLUbCLYy8NquqsTs/317KXuUVStcPvGOitIcOmyUQeJWvQQoN+rYa6xjyu+JmpZNk0UQRhpP6QIdZDHb2gnFUhVAO3YxKGJooqf6TwNUACF7xZ8f/L7LA3q5P5tAYiktrefiOlUt3MwXsTDiopTBbHScBX3LMmAk889Se+6BvWJyTZxcYaWJ5sXq2v6nHPTYoKet1bMM1mx2oerALZBZmLPBotnKJ6/jHBj5gxo7yCWbUIIzrSOruBTg+xymNnLSUvx5vvIGiOlqFwndpYNfmBNy80enIJOWSYGtqIlk2Rz2eYlSOXPBoIBopqOAqE8Ie8oMN2RbZfYCMiBA0POBGYnpaMMZBFNU7yy8Kh6R64XxGAt128LKAlqwPdYdYIkZkoAnz9pHrCrwDsGowVpi3K/W9H7T2zGBI+9y/Y1oDFWGAUk8FKnd0yldLyDBz32EBeU/6QXkZkOGJjMtU2hMHhESi46r2j/KAhsRNj3W8O0rNZtqciLcRe7hDg0pGWTaR8f0shYsV26gw5WQy72zioeOztwq2NkvRVjnT0KVvl3iAUJ+xFz9dBBmtcsi9/ZUSwSEomT+RKlEztxvoT33AHpB4oQrFC0NVQu0oc7lSNL4iFJCArpf8GwU0z2JEg5xE2L8ej8G7+gVoguYPKd+B1Obpgb9q3/Pfv7/+eHYt0H8FwB96bgKRByF8QIlXisPiQhVr3knzi1VwOC84yHWtBb+cva5NnB97It4vYhcmWP8w9mFv3DAuO8cVOJq0FbW5rMsdmS7

C:\Users\user\Documents\DUKNXICOZT.png.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.997292248131227
Encrypted:	false
SSDEEP:	24:fMfBpE3kIgPzHDxRDc4JOA8lQXvSOc1poLmP357gfMyqy8FEUNvndAOrP5X74mXM:U5C38HDX4FA8O6GmP3XXaUsmA
MD5:	AB738B0D56A09F6D4BBC38B7D949F679
SHA1:	F8D9AE11D5123033AB83990EF2CEA402D24A4DC3
SHA-256:	E98FC492A549A733A8E90CE3322F97EA1C924A47E3B7F57132C0420788FF56B1
SHA-512:	0A72265CBED155326FBF7C1D05F86F056496CDCBCE6250C97ADB95A3ABA161EB96990E70DD312491BB11D630F16547200069446364C31EEA407711318DD648FA
Malicious:	false
Preview:	<EncryptedKey>Ms0rXCcDxu+PGZrrcFQlpcLrwdXeLD1cCPKmmFAyBfEOijdI4ZcNJE+k4e283us9WgpSOh1htducLMFOkORGbQuvSaHQ5hJmNCARRXQRpjVruBVN5hZ88V8TVvubCMD7ZIxNVur4K6FFpVA4ubieYVPxxEkPq+QQtLMi+gmvSbk=<EncryptedKey>zRgJ4BqIVfnJdYIKB0a7pFnTDLUbCLYy8NquqsTs/317KXuUVStcPvGOitIcOmyUQeJWvQQoN+rYa6xjyu+JmpZNk0UQRhpP6QIdZDHb2gnFUhVAO3YxKGJooqf6TwNUACF7xZ8f/L7LA3q5P5tAYiktrefiOlUt3MwXsTDiopTBbHScBX3LMmAk889Se+6BvWJyTZxcYaWJ5sXq2v6nHPTYoKet1bMM1mx2oerALZBZmLPBotnKJ6/jHBj5gxo7yCWbUIIzrSOruBTg+xymNnLSUvx5vvIGiOlqFwndpYNfmBNy80enIJOWSYGtqIlk2Rz2eYlSOXPBoIBopqOAqE8Ie8oMN2RbZfYCMiBA0POBGYnpaMMZBFNU7yy8Kh6R64XxGAt128LKAlqwPdYdYIkZkoAnz9pHrCrwDsGowVpi3K/W9H7T2zGBI+9y/Y1oDFWGAUk8FKnd0yldLyDBz32EBeU/6QXkZkOGJjMtU2hMHhESi46r2j/KAhsRNj3W8O0rNZtqciLcRe7hDg0pGWTaR8f0shYsV26gw5WQy72zioeOztwq2NkvRVjnT0KVvl3iAUJ+xFz9dBBmtcsi9/ZUSwSEomT+RKlEztxvoT33AHpB4oQrFC0NVQu0oc7lSNL4iFJCArpf8GwU0z2JEg5xE2L8ej8G7+gVoguYPKd+B1Obpgb9q3/Pfv7/+eHYt0H8FwB96bgKRByF8QIlXisPiQhVr3knzi1VwOC84yHWtBb+cva5NnB97It4vYhcmWP8w9mFv3DAuO8cVOJq0FbW5rMsdmS7

C:\Users\user\Documents\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\Documents\FAAGWHBVUU.png

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.9928300917387505
Encrypted:	false
SSDEEP:	24:fMF7FMfIhoSz7wSLM8X36ShXfPFciQPUWHqYsUpQ7vZi3NSlEZsoTG0eHCcCbVK4:UXgIh1VM8XHXH0PUR9iCoWHm+A
MD5:	F3F6F754E98AB99C40430B84B5FC4BAE
SHA1:	37EC2E4D1D762E4325214E58636363F601193FE1
SHA-256:	AE0A1A43A8363116D32ED141D5D30D3A03CCA55E7FAB5FE7B4A184E75897FB58
SHA-512:	FAF92F701BA91CB9805DDE684E16DFD91F0BBD4D54F6E512E6630E9F79EB90B36DF0915ADE8B6EE5797B938D95C1A849541D10C87E3F1F1E724CB1CB4F1BA3FA
Malicious:	false
Preview:	<EncryptedKey>Fr7gRMS1twJH4ZHJ9/Y2XZ8KYO/Gp9Sxn9ysQJmMaTy3u8i6EemouDICd3qTRLdbDZ6d59MWpsAPZcQa1aY+vcseXU2bmUntaZfgzo0Ji3vk5ZERkMDnIKTamKfflYZ8HAxhzK5KV866XJM95bnL4XZe95qxhHlFL7uPqYpMoWQ=<EncryptedKey>TEt1ie0JptWdX9k2aT9YctZxugl6NPjkZ7GP435qkIgp9qrXC5l/NqKeEeczcYnS2BTrwGqi808FdAnHDYiLpzElNTFQJ3WFUTGZGTA2FrHCkYsMy92/s47J8gJOsIVEZYM1WvcWbAQO0yaM5v7MgnnLzrABG/0Xk9OaPtogsah3tErvOSlPLUPsvlz8p95kVgcGzS/W/t0yqS1thUtZ26WbGWnBVgtoKcZTiJm+0put1OTZCJ8mbVygycJcO8F4n+HnaCc2QR/Pn6xaTGA6l6HuBUyD9pK3hWsXHc+Nt80xbLjoZzSPzPs3WS8PZAWpQvO4uG2LYxiGgOyp5+odXwuMB4K/d2G3PWK2FdQdRJXI8qvBUfTTs3U/y8sF6e2xBamd+PnBAGigS3o8dUj+8Xw/S1P/CGR+pcSiUvuOV/dZeq0mwzJ9SKcO2bL0AyRQ6vP+QDVJa5268h29K+aWAqvBnhCfyhc3urY1r9jGVwe4fM09TzqzSbUCze3rdRNjy5IiVpzl6tJaLr4tIRXyzxfZkOhQUD4m+tfIXcd2BOCrJeL+FwKyM50innXgoK6ldP5b7LkO/vOZsRfwKiUS6yL6B+S/QvT3uNHsIxc3Jbthzx3mVLOor7T0B8LHcYZrhYecO4LWmuzBbSwHLwlf0G3clAQE7MqCipTRNCO/fStKJa/tNJzhT5EdFn7ewIzISekebwSPYlpx14mLPG5SsvZGHP6VA4v0ULM9olnMYonva+4Ed1ct3qD82+db1gyujI+EXd4bk1r/re4ZPLyHyy/d3bV7mST4

C:\Users\user\Documents\FAAGWHBVUU.png.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.9928300917387505
Encrypted:	false
SSDEEP:	24:fMF7FMfIhoSz7wSLM8X36ShXfPFciQPUWHqYsUpQ7vZi3NSlEZsoTG0eHCcCbVK4:UXgIh1VM8XHXH0PUR9iCoWHm+A
MD5:	F3F6F754E98AB99C40430B84B5FC4BAE
SHA1:	37EC2E4D1D762E4325214E58636363F601193FE1
SHA-256:	AE0A1A43A8363116D32ED141D5D30D3A03CCA55E7FAB5FE7B4A184E75897FB58
SHA-512:	FAF92F701BA91CB9805DDE684E16DFD91F0BBD4D54F6E512E6630E9F79EB90B36DF0915ADE8B6EE5797B938D95C1A849541D10C87E3F1F1E724CB1CB4F1BA3FA
Malicious:	false
Preview:	<EncryptedKey>Fr7gRMS1twJH4ZHJ9/Y2XZ8KYO/Gp9Sxn9ysQJmMaTy3u8i6EemouDICd3qTRLdbDZ6d59MWpsAPZcQa1aY+vcseXU2bmUntaZfgzo0Ji3vk5ZERkMDnIKTamKfflYZ8HAxhzK5KV866XJM95bnL4XZe95qxhHlFL7uPqYpMoWQ=<EncryptedKey>TEt1ie0JptWdX9k2aT9YctZxugl6NPjkZ7GP435qkIgp9qrXC5l/NqKeEeczcYnS2BTrwGqi808FdAnHDYiLpzElNTFQJ3WFUTGZGTA2FrHCkYsMy92/s47J8gJOsIVEZYM1WvcWbAQO0yaM5v7MgnnLzrABG/0Xk9OaPtogsah3tErvOSlPLUPsvlz8p95kVgcGzS/W/t0yqS1thUtZ26WbGWnBVgtoKcZTiJm+0put1OTZCJ8mbVygycJcO8F4n+HnaCc2QR/Pn6xaTGA6l6HuBUyD9pK3hWsXHc+Nt80xbLjoZzSPzPs3WS8PZAWpQvO4uG2LYxiGgOyp5+odXwuMB4K/d2G3PWK2FdQdRJXI8qvBUfTTs3U/y8sF6e2xBamd+PnBAGigS3o8dUj+8Xw/S1P/CGR+pcSiUvuOV/dZeq0mwzJ9SKcO2bL0AyRQ6vP+QDVJa5268h29K+aWAqvBnhCfyhc3urY1r9jGVwe4fM09TzqzSbUCze3rdRNjy5IiVpzl6tJaLr4tIRXyzxfZkOhQUD4m+tfIXcd2BOCrJeL+FwKyM50innXgoK6ldP5b7LkO/vOZsRfwKiUS6yL6B+S/QvT3uNHsIxc3Jbthzx3mVLOor7T0B8LHcYZrhYecO4LWmuzBbSwHLwlf0G3clAQE7MqCipTRNCO/fStKJa/tNJzhT5EdFn7ewIzISekebwSPYlpx14mLPG5SsvZGHP6VA4v0ULM9olnMYonva+4Ed1ct3qD82+db1gyujI+EXd4bk1r/re4ZPLyHyy/d3bV7mST4

C:\Users\user\Documents\GNLQNHOLWB.docx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.978760012486329
Encrypted:	false
SSDEEP:	24:fMwNLJNasU4sFT4L1kWHL2y3xIo/QCU8oFN01iTGRUR46QDXmNg5pyq50Y:UoJVykKy3xNTUXNMiTEUR46QDXm2z30Y
MD5:	06E9FF5644B02B3214DD5DED4EC7D88A
SHA1:	661852C7F6DD6ACDAD31964168DD5FD5B2F40011
SHA-256:	7796B0019610EDFEF58F31E30886CFD01F5CE81E2587BCCDDEE017D991EC1094
SHA-512:	9DC483F8363AF57104C1C9CA9E18D887D5968447449D7845218FA9DAFFE179A6C26646A09051A6824047DC393B4420B5D901785D492F7C08D757A320DF94E3F7
Malicious:	false
Preview:	<EncryptedKey>AUVEK7iYK2Kfv5DPh1OAosWSWIZcYSTZ9AM3cR/1HTrevhCiHLY/9G8hqFCbpWdY9Tn0KHERidOCOLLZnA1ZuJJuGssDWPsmiAxdMufIWSGmK//vN/qbisZD+2ezc4ulbpF0jDI34i2Vi6m4hbrLjnv3d6MdW2HGuc+o+QR0X0k=<EncryptedKey>j8Q7w0/Myt0fv1OZiESumaeAAm7iuUxwn+SVTMHmmnouk8F7y+JVm0w6PPTSTEw4jJJeEqmUkLELdBmH7QrDyhfB8ykXg90jKKm/JNe59Dn5BGLFVZvun9glhiTNgeXK7MaHhas4wrNpx2WtkOvvckwWiL9pgM0e0lFoiTQQcI22HnNkPQfnK/OTGspVChXbjTHBQ10crKKBLNGWyxuk7eycuzfF13fPa1nMLPBaBro3/g/LTGgYiQeLX04VtwN9sIWld1H9E1+sKbny79Zc8iu7PYV1iNVillkrPRPe4C7JV8TjxbJU2qiUvZh4sPNqn63il+givCBeoBnewN63QPg3xWex1irmSGzQGPfUiWiDED7ERObM+iJPt8ye0vzWyovA0IlmWAJ7uDABtEsXKkVTi9pIiQwNdMJL6ahuNGT7/PNBP3uwZWwuAxn4cF4XC7xI7w6liq62d728IPsUQZl48qtfC1N058XyeaFW0ArqArs4aPPUpVdhrc3nHYEGVE/FtOXSUpscYW6H93tVD5jhoaPnNCzh9Q0CXkVq19UQPeD9ltgTnaemyB1qBofD+F+QTI0lbJS1g50R3izK1FQ9OXEHj+kSkroUwEx5MuNToAZSaPNAYD6k6jdOH9lDtIwn2HxI7l7aPykorTAvtqb2HuGor4NTkArWE+ffM2bA+eBQimzHptxYKUtcGJ2BIwIM89Jq/95NXAG6guKVvo0bdCsO2KwSGT92RX1jo/1EjwXe80NPWrT9ABTe5EwRuj+j1oezfRKgDlfhzA968ODCPc3imkE8

C:\Users\user\Documents\GNLQNHOLWB.docx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.978760012486329
Encrypted:	false
SSDEEP:	24:fMwNLJNasU4sFT4L1kWHL2y3xIo/QCU8oFN01iTGRUR46QDXmNg5pyq50Y:UoJVykKy3xNTUXNMiTEUR46QDXm2z30Y
MD5:	06E9FF5644B02B3214DD5DED4EC7D88A
SHA1:	661852C7F6DD6ACDAD31964168DD5FD5B2F40011
SHA-256:	7796B0019610EDFEF58F31E30886CFD01F5CE81E2587BCCDDEE017D991EC1094
SHA-512:	9DC483F8363AF57104C1C9CA9E18D887D5968447449D7845218FA9DAFFE179A6C26646A09051A6824047DC393B4420B5D901785D492F7C08D757A320DF94E3F7
Malicious:	false
Preview:	<EncryptedKey>AUVEK7iYK2Kfv5DPh1OAosWSWIZcYSTZ9AM3cR/1HTrevhCiHLY/9G8hqFCbpWdY9Tn0KHERidOCOLLZnA1ZuJJuGssDWPsmiAxdMufIWSGmK//vN/qbisZD+2ezc4ulbpF0jDI34i2Vi6m4hbrLjnv3d6MdW2HGuc+o+QR0X0k=<EncryptedKey>j8Q7w0/Myt0fv1OZiESumaeAAm7iuUxwn+SVTMHmmnouk8F7y+JVm0w6PPTSTEw4jJJeEqmUkLELdBmH7QrDyhfB8ykXg90jKKm/JNe59Dn5BGLFVZvun9glhiTNgeXK7MaHhas4wrNpx2WtkOvvckwWiL9pgM0e0lFoiTQQcI22HnNkPQfnK/OTGspVChXbjTHBQ10crKKBLNGWyxuk7eycuzfF13fPa1nMLPBaBro3/g/LTGgYiQeLX04VtwN9sIWld1H9E1+sKbny79Zc8iu7PYV1iNVillkrPRPe4C7JV8TjxbJU2qiUvZh4sPNqn63il+givCBeoBnewN63QPg3xWex1irmSGzQGPfUiWiDED7ERObM+iJPt8ye0vzWyovA0IlmWAJ7uDABtEsXKkVTi9pIiQwNdMJL6ahuNGT7/PNBP3uwZWwuAxn4cF4XC7xI7w6liq62d728IPsUQZl48qtfC1N058XyeaFW0ArqArs4aPPUpVdhrc3nHYEGVE/FtOXSUpscYW6H93tVD5jhoaPnNCzh9Q0CXkVq19UQPeD9ltgTnaemyB1qBofD+F+QTI0lbJS1g50R3izK1FQ9OXEHj+kSkroUwEx5MuNToAZSaPNAYD6k6jdOH9lDtIwn2HxI7l7aPykorTAvtqb2HuGor4NTkArWE+ffM2bA+eBQimzHptxYKUtcGJ2BIwIM89Jq/95NXAG6guKVvo0bdCsO2KwSGT92RX1jo/1EjwXe80NPWrT9ABTe5EwRuj+j1oezfRKgDlfhzA968ODCPc3imkE8

C:\Users\user\Documents\GNLQNHOLWB\BUFZSQPCOH.pdf

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.982439169188038
Encrypted:	false
SSDEEP:	48:Uq849VgBI5yPOPg6/Tb6B10+I16DXEH+7LyTTMmID5:UqVgrig6/Tb6r091AEeny3RI1
MD5:	E4D0DC54341F4C5446D88613BA08E75C
SHA1:	2D3076E731E4222BCC9DB2ED6745FEAF35CC6996
SHA-256:	99460CFF07D5BD3B679F0814D04A880245ADB4B5466C96E5D56A0C9C350AD779
SHA-512:	F62A361DA3B68793D3D1699C55C0D664BA5DA8306F4ED755C75FB9C42E9ECCCC48CB7387BEB62D9BA70284F3E816352A1694EC08786ADD1F6F8BED7D303D5B8F
Malicious:	false
Preview:	<EncryptedKey>Ee+PusdzKOyX/pOuY4MK8WLxMWM15lGHOtF3PFQyQX+QseCzVCxQDAmnnCyEr+G4ymYcXTiduk2MiWTmUDLIkpaedkL49WJk/UKGyXAQx/P3egksOzcoheZXxG850xXY9aBdk949hQ2/0PS1sjqhB3l4Tx0LBx8lzJJG0I7Htyw=<EncryptedKey>5lOMfgX9BWYVoiLrm0t03hSCMXCF7P0PcEQVQ4U+53QN77HbrdagLMKkbKyZsfrzBI5xB9DauAgCRGM3ZJMFC8x7RsKpaktYzbkbXPVHMkUnSe8led9OJuCGMl7qzclHkcBQM6a8Ni9apUd1zTqnQo9tzvKaoLKUO6D5Mzf0GAg+BvWz1OHSP8MQ7TyUpyN5M5M3fEkDvUmRo6pJghvlYmx0fxE4TojvToj/CJw/BqIuch7V/UTrE2guYVwN93MWjnWWCOoc6nVEvgBGUYTueewqYCj5foop0xOUFPpCZ7YXDyEis4AeAM/o2bgTJci33UvEZ+dSwP/vXeDBQrYiSbbmsSYC+KT6CuqDX2ev0xcZdTrRmJy+SXY12DuFqRHMX6ILpwPlGw+lCw/oGTVV+MKxs966ry4+c73uaNJ6CyM66UQc/gm6WVIjyISmk2tFftKZaETA4K4/+32D4Ifh5j3Mb0I2KPV38IG8LlD+N1w/6cVwOfbmJfVz5YZpBuXFVIZ6IAWJBW2ym8ZeGeIf3+RZO2HIzcP6rUGYSJFjfSJwd5RnU28iNyf3r4JRtP3RJDUsBB4Jl7oYIjG5e57TqcHMUrougbUNGc8zO160xV8A4gaSALYv9liD3sLAG7LQv5/Yqg5GwxRmAl1W9GKbxPOewoIdoqk5aypxM8bGKUW6UamFJxVkwgfr3OK1LemcEw/6wpz4YI8VGeXuNJNMU5DKYLZSi4JMGyXSC9J5qkQ0zXgAN9P6HU7KvJJq29ZbFW5zayIzfc7nQvjWpsSK5NxQPPlxeXEI

C:\Users\user\Documents\GNLQNHOLWB\BUFZSQPCOH.pdf.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.982439169188038
Encrypted:	false
SSDEEP:	48:Uq849VgBI5yPOPg6/Tb6B10+I16DXEH+7LyTTMmID5:UqVgrig6/Tb6r091AEeny3RI1
MD5:	E4D0DC54341F4C5446D88613BA08E75C
SHA1:	2D3076E731E4222BCC9DB2ED6745FEAF35CC6996
SHA-256:	99460CFF07D5BD3B679F0814D04A880245ADB4B5466C96E5D56A0C9C350AD779
SHA-512:	F62A361DA3B68793D3D1699C55C0D664BA5DA8306F4ED755C75FB9C42E9ECCCC48CB7387BEB62D9BA70284F3E816352A1694EC08786ADD1F6F8BED7D303D5B8F
Malicious:	false
Preview:	<EncryptedKey>Ee+PusdzKOyX/pOuY4MK8WLxMWM15lGHOtF3PFQyQX+QseCzVCxQDAmnnCyEr+G4ymYcXTiduk2MiWTmUDLIkpaedkL49WJk/UKGyXAQx/P3egksOzcoheZXxG850xXY9aBdk949hQ2/0PS1sjqhB3l4Tx0LBx8lzJJG0I7Htyw=<EncryptedKey>5lOMfgX9BWYVoiLrm0t03hSCMXCF7P0PcEQVQ4U+53QN77HbrdagLMKkbKyZsfrzBI5xB9DauAgCRGM3ZJMFC8x7RsKpaktYzbkbXPVHMkUnSe8led9OJuCGMl7qzclHkcBQM6a8Ni9apUd1zTqnQo9tzvKaoLKUO6D5Mzf0GAg+BvWz1OHSP8MQ7TyUpyN5M5M3fEkDvUmRo6pJghvlYmx0fxE4TojvToj/CJw/BqIuch7V/UTrE2guYVwN93MWjnWWCOoc6nVEvgBGUYTueewqYCj5foop0xOUFPpCZ7YXDyEis4AeAM/o2bgTJci33UvEZ+dSwP/vXeDBQrYiSbbmsSYC+KT6CuqDX2ev0xcZdTrRmJy+SXY12DuFqRHMX6ILpwPlGw+lCw/oGTVV+MKxs966ry4+c73uaNJ6CyM66UQc/gm6WVIjyISmk2tFftKZaETA4K4/+32D4Ifh5j3Mb0I2KPV38IG8LlD+N1w/6cVwOfbmJfVz5YZpBuXFVIZ6IAWJBW2ym8ZeGeIf3+RZO2HIzcP6rUGYSJFjfSJwd5RnU28iNyf3r4JRtP3RJDUsBB4Jl7oYIjG5e57TqcHMUrougbUNGc8zO160xV8A4gaSALYv9liD3sLAG7LQv5/Yqg5GwxRmAl1W9GKbxPOewoIdoqk5aypxM8bGKUW6UamFJxVkwgfr3OK1LemcEw/6wpz4YI8VGeXuNJNMU5DKYLZSi4JMGyXSC9J5qkQ0zXgAN9P6HU7KvJJq29ZbFW5zayIzfc7nQvjWpsSK5NxQPPlxeXEI

C:\Users\user\Documents\GNLQNHOLWB\BWDRWEEARI.xlsx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.987656058579004
Encrypted:	false
SSDEEP:	48:UctwN61bLn6y9oQOdP9/KPgiEuhiMy9XdqjXB:UctwUXJ9oh5K49N9Nqjx
MD5:	DF75EE9C004A970E5C4895B0E637ACE0
SHA1:	6455FD753C493EC9E3BDA47CDC23261BECC13872
SHA-256:	E0CD5C4343EB163E8CF70B4172063A351CC730A2B119F69BCF3E934D580CD671
SHA-512:	0F85FE3485FDA26AE08129349AE87ACC81F7A438ABCF4B2FCD18024D8A228E86030BE1E47CAED1E0437FF04113F915B1B6BEA2A1AC5A21EBDB24A8899526C552
Malicious:	false
Preview:	<EncryptedKey>ehBQE7HNQkcNvlUXYcifZ6ShEb5ejDv7soheQqSPBqxcGhmbNdHLvUJR8khsdlUZ3yjCwaoNZq5UnabAOhO3hNl1WJjsDTWjoc7kv6g3xf1Rkf5bvQws3wM8kh1XSpTsooSGI3kocunsJiKeTuKZknjyjWwEBgE8xwXkpTDCmZs=<EncryptedKey>oVKuALB6kC8JXYvdgRmuF6yvXPieJoY04TCcrGpvP0mN90eH5rdurMzJXdn8B41wEd/SzNOPxjKyZd4eerreqmdsrwx9hGR1tVt8frGDxRRip7Rd3Nj7vdMPHk7FV6HIDAm1xSDyRrEQlvMdbJzgmLEEG81hiqw1eMeO2UZlc98goUVts0M2XZIanykygN3f+XWHF4q6SEomW1fyufZDoOKio6ZdavUt79hdiw0qePrEkd324AmVBl2m1yJU/rgX4OOBUbVibMw8cofmeokrNyBsdvafKgJarT1J86VA0KhYtBAkxyR9lq6rLNUUcwiWl6qQxS2rNukWoU9/TMITYfUx0a9JTcd5FObxMcXUAT4WFiOdlveEXf84XQVae08SarVG3/GiK+ftPTe06LJCEQe/izm+pNZxj0uV1hjxNmyY1fGhqbGjZRnTHqBvL/SXvsB7uBStI6B+6PtX9bicgBLzjjCuk6C0gx3/fjbPP2zUjHcRprK1f7c6IUOGH2eK9c2lNAVWpiwR7V7D6VAZbhlFP/8wNzzGkPcLRO7TbQPaNG8rvh5jINDbZg/JufLn58qDZCI7UUXqVkwrN/e0xzJxji9b/Qyu60b+gLsxvfO4op2Sr5xnErcr1nnuYcPhYSkAQc8zRHwb/tqdmpz3XKTzgX+YrRz48RZuxAT/HjIcDCVKdwoc3hRezk3Mz3ggiSbxkNzko3BdAokEKweVE1BAzFzaeDWrxkagl29L74QssYYuAu7XEq46RAB+7pDGmXgBcUj1cXDxu77lqqW7LK3YvmCZQjtZ

C:\Users\user\Documents\GNLQNHOLWB\BWDRWEEARI.xlsx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.987656058579004
Encrypted:	false
SSDEEP:	48:UctwN61bLn6y9oQOdP9/KPgiEuhiMy9XdqjXB:UctwUXJ9oh5K49N9Nqjx
MD5:	DF75EE9C004A970E5C4895B0E637ACE0
SHA1:	6455FD753C493EC9E3BDA47CDC23261BECC13872
SHA-256:	E0CD5C4343EB163E8CF70B4172063A351CC730A2B119F69BCF3E934D580CD671
SHA-512:	0F85FE3485FDA26AE08129349AE87ACC81F7A438ABCF4B2FCD18024D8A228E86030BE1E47CAED1E0437FF04113F915B1B6BEA2A1AC5A21EBDB24A8899526C552
Malicious:	false
Preview:	<EncryptedKey>ehBQE7HNQkcNvlUXYcifZ6ShEb5ejDv7soheQqSPBqxcGhmbNdHLvUJR8khsdlUZ3yjCwaoNZq5UnabAOhO3hNl1WJjsDTWjoc7kv6g3xf1Rkf5bvQws3wM8kh1XSpTsooSGI3kocunsJiKeTuKZknjyjWwEBgE8xwXkpTDCmZs=<EncryptedKey>oVKuALB6kC8JXYvdgRmuF6yvXPieJoY04TCcrGpvP0mN90eH5rdurMzJXdn8B41wEd/SzNOPxjKyZd4eerreqmdsrwx9hGR1tVt8frGDxRRip7Rd3Nj7vdMPHk7FV6HIDAm1xSDyRrEQlvMdbJzgmLEEG81hiqw1eMeO2UZlc98goUVts0M2XZIanykygN3f+XWHF4q6SEomW1fyufZDoOKio6ZdavUt79hdiw0qePrEkd324AmVBl2m1yJU/rgX4OOBUbVibMw8cofmeokrNyBsdvafKgJarT1J86VA0KhYtBAkxyR9lq6rLNUUcwiWl6qQxS2rNukWoU9/TMITYfUx0a9JTcd5FObxMcXUAT4WFiOdlveEXf84XQVae08SarVG3/GiK+ftPTe06LJCEQe/izm+pNZxj0uV1hjxNmyY1fGhqbGjZRnTHqBvL/SXvsB7uBStI6B+6PtX9bicgBLzjjCuk6C0gx3/fjbPP2zUjHcRprK1f7c6IUOGH2eK9c2lNAVWpiwR7V7D6VAZbhlFP/8wNzzGkPcLRO7TbQPaNG8rvh5jINDbZg/JufLn58qDZCI7UUXqVkwrN/e0xzJxji9b/Qyu60b+gLsxvfO4op2Sr5xnErcr1nnuYcPhYSkAQc8zRHwb/tqdmpz3XKTzgX+YrRz48RZuxAT/HjIcDCVKdwoc3hRezk3Mz3ggiSbxkNzko3BdAokEKweVE1BAzFzaeDWrxkagl29L74QssYYuAu7XEq46RAB+7pDGmXgBcUj1cXDxu77lqqW7LK3YvmCZQjtZ

C:\Users\user\Documents\GNLQNHOLWB\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\Documents\GNLQNHOLWB\FAAGWHBVUU.png

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.99169477354713
Encrypted:	false
SSDEEP:	24:fMRfSADHFKWaQ1HEBqJ7yfrcaEXc3r3sq3Se30rPOC0kj91bp5jh5BZJqaMadf:UIylK4hZ6V93+Glc91bzh5BaaXF
MD5:	6F1E8281A65B3C7E09ACAC713A868008
SHA1:	46BF68117C2A07B6439199C2A90227A8EAEB48EE
SHA-256:	082C4CE60C8B42C39B223F04CC085EEA5444B8A5783FA5B52BC89509D30FB5D6
SHA-512:	831D9E660AB2E5775C9CC25AB695BFA977D546DEDC75C572010BF30348F87F95FFC9CA995D50CE58012D4F80F2D3321B17B3DE11EA8C8D93C1B1AD895251EAEA
Malicious:	false
Preview:	<EncryptedKey>m1MFFYcDVitjkiF6jAKkel+R1zXmc+/hA7WTQKZX7ZN05jO/edzUFKQ4F6bld/Iyu2UmbGkL7QebwmR6uo6jYLOe22ZAOcosiSNICPgdLbVWY6egU40AYyw5RpijhnQMiNxjmkW1WCN9ppb309nEVHIyo2FeuEMiGRDTBWGQ72E=<EncryptedKey>rn/YRokd+e7OaeMQw/aTsfp0G7uqVmKwyxoivSC/zSIIHditk03eLLdamqnnJSc+W+2F+IjtEliUcCPeMrY1akXOlQHBOpyI2JvR03A2wbWJ3XNrj5aSDFb5obob7p79h9JJkPtrGzgzFqWQHgfdOwhtGMqVgGomK6+m9Gpr9TWJYbxA9KPzbC5YtHNrlyFAHxIVZ6xZFJGUF3XAXyYmqoFzn04mo+Zf9Jwxf5So8L6ST6TIpAZYFejJ+UCvEhRyswQ7o0Mgn3Qa8moSQaX2MnIbkRC+kFdqcaSeKZyBA5r24Ny6UIr7E8e6wbxaDYYEGxRwHBbsRD4+NC74V+RfwVDljky+tZCDjoOFaUxe7Pz018sTlffbAqNv6JfzAGvaJtOoRSDUyAwj/51+65yXtapj43wgtPdc1JB8GENW+KVV2ZshaLjNuSYg1K3HUrDHMJ2uCnKu/wGvX3wHcqxB3QqaejIlSXSjA8Om/50KXa74OcS8ekP7uxNh1c6Dfl+ASZCHEkNS41rDM9m7c1wWTCWG44wy0ZdFjiFTIhDdfy3m4iRmWfGmhw0R6U8zrebjZFO0RJuMyLvPyYbWHrm+uE7Z37A7lwstVwu01bvDd0Wc/e5atIb84kTnpiRmn3s8s2l8bfaZ9rtZuzmto5zKibbcOnmPTD4FfFh6e9e9Q5qsYO1fdT8pQDNp5m4qHqSUPkyDGA8l83GCSWMa1PeQC50wne8E6LcBr9/kr6BOYFtqcNIYfLRiS6K5AlXH/gCiAEnekBLKKa830opHwzXCj9lyXVOOfXfk

C:\Users\user\Documents\GNLQNHOLWB\FAAGWHBVUU.png.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.99169477354713
Encrypted:	false
SSDEEP:	24:fMRfSADHFKWaQ1HEBqJ7yfrcaEXc3r3sq3Se30rPOC0kj91bp5jh5BZJqaMadf:UIylK4hZ6V93+Glc91bzh5BaaXF
MD5:	6F1E8281A65B3C7E09ACAC713A868008
SHA1:	46BF68117C2A07B6439199C2A90227A8EAEB48EE
SHA-256:	082C4CE60C8B42C39B223F04CC085EEA5444B8A5783FA5B52BC89509D30FB5D6
SHA-512:	831D9E660AB2E5775C9CC25AB695BFA977D546DEDC75C572010BF30348F87F95FFC9CA995D50CE58012D4F80F2D3321B17B3DE11EA8C8D93C1B1AD895251EAEA
Malicious:	false
Preview:	<EncryptedKey>m1MFFYcDVitjkiF6jAKkel+R1zXmc+/hA7WTQKZX7ZN05jO/edzUFKQ4F6bld/Iyu2UmbGkL7QebwmR6uo6jYLOe22ZAOcosiSNICPgdLbVWY6egU40AYyw5RpijhnQMiNxjmkW1WCN9ppb309nEVHIyo2FeuEMiGRDTBWGQ72E=<EncryptedKey>rn/YRokd+e7OaeMQw/aTsfp0G7uqVmKwyxoivSC/zSIIHditk03eLLdamqnnJSc+W+2F+IjtEliUcCPeMrY1akXOlQHBOpyI2JvR03A2wbWJ3XNrj5aSDFb5obob7p79h9JJkPtrGzgzFqWQHgfdOwhtGMqVgGomK6+m9Gpr9TWJYbxA9KPzbC5YtHNrlyFAHxIVZ6xZFJGUF3XAXyYmqoFzn04mo+Zf9Jwxf5So8L6ST6TIpAZYFejJ+UCvEhRyswQ7o0Mgn3Qa8moSQaX2MnIbkRC+kFdqcaSeKZyBA5r24Ny6UIr7E8e6wbxaDYYEGxRwHBbsRD4+NC74V+RfwVDljky+tZCDjoOFaUxe7Pz018sTlffbAqNv6JfzAGvaJtOoRSDUyAwj/51+65yXtapj43wgtPdc1JB8GENW+KVV2ZshaLjNuSYg1K3HUrDHMJ2uCnKu/wGvX3wHcqxB3QqaejIlSXSjA8Om/50KXa74OcS8ekP7uxNh1c6Dfl+ASZCHEkNS41rDM9m7c1wWTCWG44wy0ZdFjiFTIhDdfy3m4iRmWfGmhw0R6U8zrebjZFO0RJuMyLvPyYbWHrm+uE7Z37A7lwstVwu01bvDd0Wc/e5atIb84kTnpiRmn3s8s2l8bfaZ9rtZuzmto5zKibbcOnmPTD4FfFh6e9e9Q5qsYO1fdT8pQDNp5m4qHqSUPkyDGA8l83GCSWMa1PeQC50wne8E6LcBr9/kr6BOYFtqcNIYfLRiS6K5AlXH/gCiAEnekBLKKa830opHwzXCj9lyXVOOfXfk

C:\Users\user\Documents\GNLQNHOLWB\GNLQNHOLWB.docx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.988676003415561
Encrypted:	false
SSDEEP:	48:UwkY9HLkGiN2Fihvln/LJ91edwjngfZq0Vt1SvGnb:U2NkGe2Fi3LJDeqzsVt1SvGb
MD5:	8346D2465B4683C333B6086E15397788
SHA1:	DB2F138CFDD4C5032182FE80495D8AB089D56351
SHA-256:	7DB23B2A69248AF0CAE63A2808B2558A1AC30E6E24196E4C92612645A70AC030
SHA-512:	79498192301B000323743F6192D3E7B21C9F201462EDB31CED8248B412FE7A3D03437D406796BF7CC3B8B48C5A3EBD3754B6A7B3CBAB67281EDBFAE1FBCA2CF3
Malicious:	false
Preview:	<EncryptedKey>LeD492cfPWeRGqOaCH0B4tCgGAuGwM2nF4j4tS1fMG5PqryqVAZb/hG2qPVbF6ARZFRsbH4htXESNZCwvWselmR9v+XW0FJF+5FJWed2J9XEcoUw0ZxInRa73jLhecJ0aI/2skvCI+YF5cVmn8VBk1fEWX/MOb+2rJy567gN+w8=<EncryptedKey>b8I7EMgHqz1T7O6gNNMlppTlbu6ivkGr/SOV41elxHf88oBYcOtgncxz5+zn7LuuHPjP/jfG+Z7sRjBJAqndz3zAdfybimHIiHu1kiUhXrbRXe1wpGfe+wuCF979KZCDhCkIHfxoFsKWfP5KpsezqmA+YUvn7GGv3nSFmJpKMgfViZU2K1WXr8jY8ucisG1Ht5uDnzyEqCVKVhK0ZX1CwOeeZuJsxV4oG6abTBBs/RqkZKOnVb2AcMI29CJqjJqj2xyx+Y5wc5y/qJiyyLBE/ltD1WBBBQQqw0TtPqZh2aXbtYdsPGOjXYUkiQf4fX2ekIncsGeWY9hamfXA0AHr2gCTqPHlCgjd2SVVOv0yg5UuN40FBy1Lxmsey9ZgNMHa11Y7snykAftpORZVcHdl3stIMAd9GIMv9kOrYiGj+71nsBLwZbnG9bHWb6GO4XjC0NWIbwzki2SRzxjKly9A4uf4IKP33oka2ScDaDyPLbPrRNZhRx3OFYCMIEOHYCzob0Zk3+ei0NZKN5fFphv0v7Skly37D7FUmIblH3kFXOwmMeAnF9jWXnViR+sjGvrHMeQLV5ioyJ9eBJXDCkBHrw/T984tqdtHg3+a+Go+cGFRqXrTzp6HnummZADAV2s7QTHl6DArkfqAvlt7DQVNEi27a2BQ/JenCVT8zyYdJtE64sFYht6t7CE7aJqJkkciDkzWK3imSoLgOM6zK2x0uVXmkiXt4+lSeOBrRmcjjfvneKc0EsNb6/pvpCEDUszIHE7tP/V+Suzq1+NCNlfdJ1o/9gpqPUbs

C:\Users\user\Documents\GNLQNHOLWB\GNLQNHOLWB.docx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.988676003415561
Encrypted:	false
SSDEEP:	48:UwkY9HLkGiN2Fihvln/LJ91edwjngfZq0Vt1SvGnb:U2NkGe2Fi3LJDeqzsVt1SvGb
MD5:	8346D2465B4683C333B6086E15397788
SHA1:	DB2F138CFDD4C5032182FE80495D8AB089D56351
SHA-256:	7DB23B2A69248AF0CAE63A2808B2558A1AC30E6E24196E4C92612645A70AC030
SHA-512:	79498192301B000323743F6192D3E7B21C9F201462EDB31CED8248B412FE7A3D03437D406796BF7CC3B8B48C5A3EBD3754B6A7B3CBAB67281EDBFAE1FBCA2CF3
Malicious:	false
Preview:	<EncryptedKey>LeD492cfPWeRGqOaCH0B4tCgGAuGwM2nF4j4tS1fMG5PqryqVAZb/hG2qPVbF6ARZFRsbH4htXESNZCwvWselmR9v+XW0FJF+5FJWed2J9XEcoUw0ZxInRa73jLhecJ0aI/2skvCI+YF5cVmn8VBk1fEWX/MOb+2rJy567gN+w8=<EncryptedKey>b8I7EMgHqz1T7O6gNNMlppTlbu6ivkGr/SOV41elxHf88oBYcOtgncxz5+zn7LuuHPjP/jfG+Z7sRjBJAqndz3zAdfybimHIiHu1kiUhXrbRXe1wpGfe+wuCF979KZCDhCkIHfxoFsKWfP5KpsezqmA+YUvn7GGv3nSFmJpKMgfViZU2K1WXr8jY8ucisG1Ht5uDnzyEqCVKVhK0ZX1CwOeeZuJsxV4oG6abTBBs/RqkZKOnVb2AcMI29CJqjJqj2xyx+Y5wc5y/qJiyyLBE/ltD1WBBBQQqw0TtPqZh2aXbtYdsPGOjXYUkiQf4fX2ekIncsGeWY9hamfXA0AHr2gCTqPHlCgjd2SVVOv0yg5UuN40FBy1Lxmsey9ZgNMHa11Y7snykAftpORZVcHdl3stIMAd9GIMv9kOrYiGj+71nsBLwZbnG9bHWb6GO4XjC0NWIbwzki2SRzxjKly9A4uf4IKP33oka2ScDaDyPLbPrRNZhRx3OFYCMIEOHYCzob0Zk3+ei0NZKN5fFphv0v7Skly37D7FUmIblH3kFXOwmMeAnF9jWXnViR+sjGvrHMeQLV5ioyJ9eBJXDCkBHrw/T984tqdtHg3+a+Go+cGFRqXrTzp6HnummZADAV2s7QTHl6DArkfqAvlt7DQVNEi27a2BQ/JenCVT8zyYdJtE64sFYht6t7CE7aJqJkkciDkzWK3imSoLgOM6zK2x0uVXmkiXt4+lSeOBrRmcjjfvneKc0EsNb6/pvpCEDUszIHE7tP/V+Suzq1+NCNlfdJ1o/9gpqPUbs

C:\Users\user\Documents\GNLQNHOLWB\UBVUNTSCZJ.jpg

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.986856080210272
Encrypted:	false
SSDEEP:	48:UTuaRJrA6XL+3aVaf5MdFSqfqx5gpAnVXfgeli+:UnRJkMLY1f5YjqxCpgV2+
MD5:	80A4362AB7C6C4CDBB71200E778C79CA
SHA1:	688B8F46AFC4E54C256BF29F1B90778EDF627842
SHA-256:	4D5ED0414A0E2368BF66531759AE397B6B63AB845C899A980BA7CBD4C13B0E34
SHA-512:	C42B9B9A3BF4ADD9A0A48444E01890672ED5EAA536B320AC9E91B50A58AA74DAD60168EF1E4B8C9303D94FB95B0715AEF2304B21992A924DD06B78570BC25503
Malicious:	false
Preview:	<EncryptedKey>evMBPhyhsnxW7UNKlYACXbXbxEMibFFGzJXbVQxwSP5LcMeP0Zs+Je4DfIrkTbYJH42pm8hmuIo8dRMfHi1gE7bXgW5lpVPaR8+wZZ5fm/OfqcX9nxJGYW+w5c/zjdt+QCooauzEoxDAABYzvsVzGG7BxFqey0kwZHiBd9VuCsM=<EncryptedKey>kk2NU2XAzFXiHFuWnzetebb4NSdkoQB+o0bVp2RutkB2O1vZr/pQHFVglCZxbLv5Q+m5FRHFuu7SH9m/Daorw2LNrezB0ntYKVyAbb/siuQWBgrc3EMeKmdTrxSIJ3kKrgAcJcitruJmrDA1PFPOptvOGuirbh6vuLEmuhvQHrne+WBdV94I+OBTD93CfC//uIB6rHRQR9c7gmL9EzvxFu2Bd9dOt+WKUhJa+ZkE+DE9KHWxk9qdNHkdaaCJZkoGfDAQjFORL7o9TM9dLjqlS0B1vxXq1qC20QQA45h4V4diLrsomAIGAiY765JA0t55PPuZ/4l3HwpeieoSsIFRZNbZwzGMAjxfKgMxpb/3EwQvm7Coa3uJdSOCOJC3MUEJ/3EKr7CJ4Yp7I2th93W7Byg4Er8E8CwqAiflaw9pfaw32NHXCIrVNAO/ySjDP4JHhK3D3mUPEO2sbE7n39drcvOqZtgJfGDZl0jDAXMCNxDNsDVZ4979ypNDQOORXVEb1L+alR3OY+ZJGRgR821OCdO3WOZtLvYxtE2ys86k7WHcaLcSGUg6pCP/SxgjVUR/QmOf6eE8JKmJtzSZHaEIo3xS+RcYRmLTzgGMqRhScez5+M8SUyxi+iyauM6tRJBl5XJsdDqlSaSBKv9PAjRusCp+I6+m2SxJU0qziXXaKOG5PDW7xQkNhiwZkQ+5b8XGBDSqCpLf/ts9ZykoErnaXA3ObVA2adlJYhAelKWgKm9gZgrpxTjYm5SYNvXPOmTbdjAhNbQ8/p9ndjXomgxotxj/2ABAWgBB

C:\Users\user\Documents\GNLQNHOLWB\UBVUNTSCZJ.jpg.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.986856080210272
Encrypted:	false
SSDEEP:	48:UTuaRJrA6XL+3aVaf5MdFSqfqx5gpAnVXfgeli+:UnRJkMLY1f5YjqxCpgV2+
MD5:	80A4362AB7C6C4CDBB71200E778C79CA
SHA1:	688B8F46AFC4E54C256BF29F1B90778EDF627842
SHA-256:	4D5ED0414A0E2368BF66531759AE397B6B63AB845C899A980BA7CBD4C13B0E34
SHA-512:	C42B9B9A3BF4ADD9A0A48444E01890672ED5EAA536B320AC9E91B50A58AA74DAD60168EF1E4B8C9303D94FB95B0715AEF2304B21992A924DD06B78570BC25503
Malicious:	false
Preview:	<EncryptedKey>evMBPhyhsnxW7UNKlYACXbXbxEMibFFGzJXbVQxwSP5LcMeP0Zs+Je4DfIrkTbYJH42pm8hmuIo8dRMfHi1gE7bXgW5lpVPaR8+wZZ5fm/OfqcX9nxJGYW+w5c/zjdt+QCooauzEoxDAABYzvsVzGG7BxFqey0kwZHiBd9VuCsM=<EncryptedKey>kk2NU2XAzFXiHFuWnzetebb4NSdkoQB+o0bVp2RutkB2O1vZr/pQHFVglCZxbLv5Q+m5FRHFuu7SH9m/Daorw2LNrezB0ntYKVyAbb/siuQWBgrc3EMeKmdTrxSIJ3kKrgAcJcitruJmrDA1PFPOptvOGuirbh6vuLEmuhvQHrne+WBdV94I+OBTD93CfC//uIB6rHRQR9c7gmL9EzvxFu2Bd9dOt+WKUhJa+ZkE+DE9KHWxk9qdNHkdaaCJZkoGfDAQjFORL7o9TM9dLjqlS0B1vxXq1qC20QQA45h4V4diLrsomAIGAiY765JA0t55PPuZ/4l3HwpeieoSsIFRZNbZwzGMAjxfKgMxpb/3EwQvm7Coa3uJdSOCOJC3MUEJ/3EKr7CJ4Yp7I2th93W7Byg4Er8E8CwqAiflaw9pfaw32NHXCIrVNAO/ySjDP4JHhK3D3mUPEO2sbE7n39drcvOqZtgJfGDZl0jDAXMCNxDNsDVZ4979ypNDQOORXVEb1L+alR3OY+ZJGRgR821OCdO3WOZtLvYxtE2ys86k7WHcaLcSGUg6pCP/SxgjVUR/QmOf6eE8JKmJtzSZHaEIo3xS+RcYRmLTzgGMqRhScez5+M8SUyxi+iyauM6tRJBl5XJsdDqlSaSBKv9PAjRusCp+I6+m2SxJU0qziXXaKOG5PDW7xQkNhiwZkQ+5b8XGBDSqCpLf/ts9ZykoErnaXA3ObVA2adlJYhAelKWgKm9gZgrpxTjYm5SYNvXPOmTbdjAhNbQ8/p9ndjXomgxotxj/2ABAWgBB

C:\Users\user\Documents\GNLQNHOLWB\WHZAGPPPLA.mp3

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.986466858869576
Encrypted:	false
SSDEEP:	48:Uj9YMxOLDf0HYonjxIEqHR+yo79nckxIbpOS:Ujzx6DkjyRQyqncn1
MD5:	3C51508698E65B2CF1B9D089F8A9FCC0
SHA1:	27D9075ACE891A864DB8FB1C69CC93D550E7369A
SHA-256:	1C196E7E50F5E6DFE937B78728E0DA60443CFA6F3E86CBA5AFC6E899AFED9485
SHA-512:	5705D25449688124C072199FBA886A35BB41C49E43807DDD68A4E48C47DFD24449B3E8E60D9695824DCAEE93185B4D0FC6DBFC25F242B9A97CA74C8F78AFDCE0
Malicious:	false
Preview:	<EncryptedKey>dPHktxXV/SV0KxVCRruHZFg7sSi36E/EGmcxszeaf0RG4Tx+VKWt/f2ubioW2Th1o+8MsdFn2LeJ0tLqUR0VRUQaP/yKaq6rjjDS2l1yFxAmURW4qhERGXR9F1rNnECusDOSWYzH4R801Najx2e4DtHjxXDuCLQ/gUaRH/n9+VI=<EncryptedKey>BFTEbhGBeTDXdl5DyspX53i3CbAXunAOA16CY3NcParfY4kAvvUQ8QE/2oQeo2O1Ffs5AYvptGxMq8Dit2jqhpmifF4oLvaAIXGSTBbEuCVCDeovPW7OOSWvNLFweKKMIZOeGj7V4DUvB/ZXOnES6QAE1HOh54uu2repRBYEad/kFz3rB4nzhqG70v8c2O8V+FqqxdDf4opsu07xjtRPzIfpInSVY6jPNxgOF1ez1tCZ+L/jTc7eSpa3b3mfqn8TMAqHulfBQlRph4YxxIqoGM7ZRYT7UQsJXT0F/B2Qc8M1Av0F66kahgVA7EuFAGvFm5+N/JewpjWVnGx1nPEk/j0Fz3Fd/S9S296LShfotu8o8vikZfx11iyC7pRvz6dEH01wqD/En1d/KCg5RNXDQX+8K+bUx6rwSedP4LpveXSXfwQpYeFAMxnKAgu4biaFBCoIZPBfPLmuV/EZ8u+av769OSmMT4AGfRBmqhHTgQl/oh3Ive+FdPRXJ7fUKTgkC+h5prt5/brHiFc3D0e0Rg7PG7fG1Yf8fho6tzHhdYdEM3lbP1Kzzz+IZBv5O7TKI9q2KWHbNRqN8Q0Q5owSNxe25pCXixk/+I5fOoj2C12YioIei3fZGv3FBU/Lo6oStGO/J7EI7FYxboToS6kOAC43/4pmyiNj0sPJzHbN2ujymmRRz27hPxjIGZMY9CrteDirrK9cWVwm5rM58KdEZlXHARKLrwipzw9BXdZOSjO+H8b9GDD/qWUUL8WjTzfBiWWj5pdiVPErYcFdT84c6eMIPZwAXia/

C:\Users\user\Documents\GNLQNHOLWB\WHZAGPPPLA.mp3.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.986466858869576
Encrypted:	false
SSDEEP:	48:Uj9YMxOLDf0HYonjxIEqHR+yo79nckxIbpOS:Ujzx6DkjyRQyqncn1
MD5:	3C51508698E65B2CF1B9D089F8A9FCC0
SHA1:	27D9075ACE891A864DB8FB1C69CC93D550E7369A
SHA-256:	1C196E7E50F5E6DFE937B78728E0DA60443CFA6F3E86CBA5AFC6E899AFED9485
SHA-512:	5705D25449688124C072199FBA886A35BB41C49E43807DDD68A4E48C47DFD24449B3E8E60D9695824DCAEE93185B4D0FC6DBFC25F242B9A97CA74C8F78AFDCE0
Malicious:	false
Preview:	<EncryptedKey>dPHktxXV/SV0KxVCRruHZFg7sSi36E/EGmcxszeaf0RG4Tx+VKWt/f2ubioW2Th1o+8MsdFn2LeJ0tLqUR0VRUQaP/yKaq6rjjDS2l1yFxAmURW4qhERGXR9F1rNnECusDOSWYzH4R801Najx2e4DtHjxXDuCLQ/gUaRH/n9+VI=<EncryptedKey>BFTEbhGBeTDXdl5DyspX53i3CbAXunAOA16CY3NcParfY4kAvvUQ8QE/2oQeo2O1Ffs5AYvptGxMq8Dit2jqhpmifF4oLvaAIXGSTBbEuCVCDeovPW7OOSWvNLFweKKMIZOeGj7V4DUvB/ZXOnES6QAE1HOh54uu2repRBYEad/kFz3rB4nzhqG70v8c2O8V+FqqxdDf4opsu07xjtRPzIfpInSVY6jPNxgOF1ez1tCZ+L/jTc7eSpa3b3mfqn8TMAqHulfBQlRph4YxxIqoGM7ZRYT7UQsJXT0F/B2Qc8M1Av0F66kahgVA7EuFAGvFm5+N/JewpjWVnGx1nPEk/j0Fz3Fd/S9S296LShfotu8o8vikZfx11iyC7pRvz6dEH01wqD/En1d/KCg5RNXDQX+8K+bUx6rwSedP4LpveXSXfwQpYeFAMxnKAgu4biaFBCoIZPBfPLmuV/EZ8u+av769OSmMT4AGfRBmqhHTgQl/oh3Ive+FdPRXJ7fUKTgkC+h5prt5/brHiFc3D0e0Rg7PG7fG1Yf8fho6tzHhdYdEM3lbP1Kzzz+IZBv5O7TKI9q2KWHbNRqN8Q0Q5owSNxe25pCXixk/+I5fOoj2C12YioIei3fZGv3FBU/Lo6oStGO/J7EI7FYxboToS6kOAC43/4pmyiNj0sPJzHbN2ujymmRRz27hPxjIGZMY9CrteDirrK9cWVwm5rM58KdEZlXHARKLrwipzw9BXdZOSjO+H8b9GDD/qWUUL8WjTzfBiWWj5pdiVPErYcFdT84c6eMIPZwAXia/

C:\Users\user\Documents\MIVTQDBATG.mp3

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.994219555219638
Encrypted:	false
SSDEEP:	48:UC11U51o1eaO91yVS/p1pjEIKLOdiHbmSUe80KZ9R:UWU5CSQk/p1pjEILimNe80KbR
MD5:	45ED61F359E2CF8177AFEDE0A188EAED
SHA1:	BEB24B81606590EB544E819CC07907692BD34D1E
SHA-256:	8A6AF1AB42B194A0FCEB8A076342E50E2661040B837BC90FE297775A6F5E5D5D
SHA-512:	7D1CC7E13368CE838426D3AD471A2BB3F25307165EFAE72CF2F69C8429F89C867A29C7B1AE7051E8FB78253BB86B7BBC47088CAA1F53D4E45CF11EB55CC1D6A4
Malicious:	false
Preview:	<EncryptedKey>NdTA892lcr/05odJ6nwjRCbfQDKXvJVQz57Be6kpdDorjULvV68DBDU01Jm+y0kDr8o6+zUYGnGzOukrY0o4P3aGzW1eDW8vcE/mwjOGFU5j31wPF6Pjz3NysPhSaILATR7oelIH2kBkFQ7V8HEGuzNDGRTVZPm0YoKx59Gh1Dc=<EncryptedKey>ZBLKmGoVbjuof1NPAoVFQ6dEDe8Gb307pbJfItcgivdVBc/aJfGAzxnW5XU4xOV1YmOmY+u7ugSwgYuM+mQarAjJDb4cESdytxeMUbkGjeLpvxLYzyUXFsRDkuhB0JpR2pDfQ4CiG79ez8MMehRQJDoglzRY2MAl4csutjWrgI+Oe8xqwqn9ew/S6kRbk4uUyi/6BE94NfiVIoB9pEIQ05hDR3UBeNQCyNoFjJhZjNIrSPQPMH4xv8b11lsD0ts9ZC35wF5uWDNIikBRzC26SWfcI8P9tQMAlbSWRjK8oph08o/ZyJ6c2hTpznhx7CzBkTJi7TMHDTdAhmCtQ2koAoaQxc5T38/uVgPBNBPnhnt1s/F6UYh4FW2rN0o9w3mg5rh48ILy7gsKPad3al54RcYyGUyQuEiGTwByG++wHfh94M+lUfOGEl6Dkdgv7UYP+uJ44qRgkMElldhYHynGLZHDHfPEldno4b7nVW3C176wXhksCCre2W9svTDTB8ndwIK4yvhFcPCV/qdMYHXzfFkLiJyRYmsM2aZjiBG5qEdJEBfInQ1H1ZCIF2bG1hhm9gW4JIc/B/J5g3w91TKshBQiuutf2YsajEoNFtccdaHfFO1rrsa2l7NybPoSdauxXXhDxePA3/++Ojt4yrJLkZGfl7+bX80X/fDFWq78dTr14djY+kFACbm3gYLwnUbDPFXTYSyZVJKLcg7Wxz9ve00r/ZO6Ympk//CvHf+rpI2hHt7DY1heIDeqPoyuFB+U2Icnpn/+iZWF34PdZPrOctHtoLzH1knP

C:\Users\user\Documents\MIVTQDBATG.mp3.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.994219555219638
Encrypted:	false
SSDEEP:	48:UC11U51o1eaO91yVS/p1pjEIKLOdiHbmSUe80KZ9R:UWU5CSQk/p1pjEILimNe80KbR
MD5:	45ED61F359E2CF8177AFEDE0A188EAED
SHA1:	BEB24B81606590EB544E819CC07907692BD34D1E
SHA-256:	8A6AF1AB42B194A0FCEB8A076342E50E2661040B837BC90FE297775A6F5E5D5D
SHA-512:	7D1CC7E13368CE838426D3AD471A2BB3F25307165EFAE72CF2F69C8429F89C867A29C7B1AE7051E8FB78253BB86B7BBC47088CAA1F53D4E45CF11EB55CC1D6A4
Malicious:	false
Preview:	<EncryptedKey>NdTA892lcr/05odJ6nwjRCbfQDKXvJVQz57Be6kpdDorjULvV68DBDU01Jm+y0kDr8o6+zUYGnGzOukrY0o4P3aGzW1eDW8vcE/mwjOGFU5j31wPF6Pjz3NysPhSaILATR7oelIH2kBkFQ7V8HEGuzNDGRTVZPm0YoKx59Gh1Dc=<EncryptedKey>ZBLKmGoVbjuof1NPAoVFQ6dEDe8Gb307pbJfItcgivdVBc/aJfGAzxnW5XU4xOV1YmOmY+u7ugSwgYuM+mQarAjJDb4cESdytxeMUbkGjeLpvxLYzyUXFsRDkuhB0JpR2pDfQ4CiG79ez8MMehRQJDoglzRY2MAl4csutjWrgI+Oe8xqwqn9ew/S6kRbk4uUyi/6BE94NfiVIoB9pEIQ05hDR3UBeNQCyNoFjJhZjNIrSPQPMH4xv8b11lsD0ts9ZC35wF5uWDNIikBRzC26SWfcI8P9tQMAlbSWRjK8oph08o/ZyJ6c2hTpznhx7CzBkTJi7TMHDTdAhmCtQ2koAoaQxc5T38/uVgPBNBPnhnt1s/F6UYh4FW2rN0o9w3mg5rh48ILy7gsKPad3al54RcYyGUyQuEiGTwByG++wHfh94M+lUfOGEl6Dkdgv7UYP+uJ44qRgkMElldhYHynGLZHDHfPEldno4b7nVW3C176wXhksCCre2W9svTDTB8ndwIK4yvhFcPCV/qdMYHXzfFkLiJyRYmsM2aZjiBG5qEdJEBfInQ1H1ZCIF2bG1hhm9gW4JIc/B/J5g3w91TKshBQiuutf2YsajEoNFtccdaHfFO1rrsa2l7NybPoSdauxXXhDxePA3/++Ojt4yrJLkZGfl7+bX80X/fDFWq78dTr14djY+kFACbm3gYLwnUbDPFXTYSyZVJKLcg7Wxz9ve00r/ZO6Ympk//CvHf+rpI2hHt7DY1heIDeqPoyuFB+U2Icnpn/+iZWF34PdZPrOctHtoLzH1knP

C:\Users\user\Documents\My Music\desktop.ini.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (884), with no line terminators
Category:	dropped
Size (bytes):	884
Entropy (8bit):	5.957965132316126
Encrypted:	false
SSDEEP:	24:fMDisRpoUfhdhB0YCc2hvStBA4/IL8EPwH/jvaS:UDisRpJfhvB0YCc2pSnj68vHzaS
MD5:	F00F3A329073C55F11A7530DF33281D6
SHA1:	C39A563144E213A42E392EBDACFA4A415E48281C
SHA-256:	94B89985C96DC7B60615C25C50FD6539074B7DB03EEFA884BB818CD3B0E15A00
SHA-512:	1A16D0FF6694C7365B24FEB3646B112EDC251AA88A0BF8A0A007D858B791B837D7E522C82260A923C0651A40BCF96D79FF19A41121FD544299B8795BBACA9273
Malicious:	false
Preview:	<EncryptedKey>Cq4HielmoaPe46mKifMe0PgaAxb4ZluEwZ06+X8Kr1/G8inSDNArU3aHzsp5/cyOzwlYgvEKyyeNzjF6oAHof5W2Wy9OWz7qNv9NpmWCv9lisOBBXNs+UOfJiRqIRo8MsMRNg5jyCLVEvXXZsR1Y9zJuZQUsUJsWdq1MSxHYW48=<EncryptedKey>EJ3L6W/KAUHw481FBr73msZ6LQ2egjKCIpL/JZ6EK8mOOKi7AxvPBAmRiJ1DSIgMaIZvy+wB81go9E8D8Hxl7eE7Hg7TevD/lRIBrwXvsIauHV3gEu4g/KGZEAnOljmdxa6+FuorL3ImFZ8B5KMNmlgwpG8HIoDVDZ/QWiWpBrUiN31h7wua3LF5MwZYIvyajgiYNpTILjmiCmNwgzSJbqcuWzt82fD+kaLGJH+888JeMWZiY410+mfdI82nrQRuDu3PYTdAADwNsoT1VXpkDNYVEsi7sHys3cNHKJNbCF4S2oqFZtFHkA1g3rYQ6Vr0rC7KU137Q3Po1elEWunM7ZsSFpXWWMpJBNTJdl5bDTiRQDb9U+WbyCWLMk7ns4cNU2SHEhqLYDJMDamjM3Oliinku9Kicg3zsPOfazJhKMLGz2V1D4hOSZ/ziGvMRE10NffL9xF7G6fmcewkz3RiNzJBOAwWJ3rwaeRLAJu6CSyKgw6iB3fMyWvm7GLDKjdg+zFUk7sLLyqtR7EOwaZ6dGrbjFW7JI68f0+1YzTZ/o93868F7QrzJIrjHcTLc544jl1t005vv5up5HXtG+ZVg0c3t2M0s/hNWlj7a4spXNriopQWoTKqfZUKjZAeu6L7X7iXCwByvM5kCwYD9LBmkcQ6xu2JdmDK00y6ua9DXR8=

C:\Users\user\Documents\My Pictures\Camera Roll\desktop.ini.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (456), with no line terminators
Category:	dropped
Size (bytes):	456
Entropy (8bit):	5.944048872237545
Encrypted:	false
SSDEEP:	12:fMEpo7qTKxL2NfnYkX2XKuzroK4VJf8zWHmBZT:fMEmxLYfYewRzroxVJf4SmbT
MD5:	1064246D016B701AA1611D7FB02D668B
SHA1:	65040F606B9DB44C668F5FF049C65AD7F0EAE7E0
SHA-256:	AE23752700E25B513ED246D3A44A32D883D1AEE142D2DA4A57295DAB0F8BBCC1
SHA-512:	21E70F6CD692D6CB10D3710FB0A6C969D6B65CDD9C1ECB71344B9EC0CAE64AE52370CC4EEB575DE4EE0D32D5AE46795F0F11D81831CA1F8A4B1855C8DF26E47F
Malicious:	false
Preview:	<EncryptedKey>L9ItBqZpAETo9SUlxZp2fJX85SlOOsDCbCtJDYY2GbuJ6AWcf5Ituv4znCBJcGXMK7O3+KiMWTJIJGskVDXhNrZ60hyYsAma3zAp3MaO9nDnufLd+x/ZGYSCz3uv5soPfSMf4ZjOS3CcuTa/eHNBjuJxfXE4jp1lZTbekNOb6Pw=<EncryptedKey>WjhYMoID+dwjKJPH3lk6tJx7JAbjY8Ao2EVKIxVunOfB7QTf21HEQZDkeJb+xuzkNzDKmvhPZQvsn0UeRXxydFqOJ1OHivYz0/LB5Q5TxkQyX02S81hx5waQ22LLjoYMCgcJ7CQl6r+WQlpEWgna0seuZ0zw8rEnLkO2A4OqYHyGjQMV7bARwAl6CsXvwR+RmD36YkaN0FAgARzSwi3IJizQXozH1d4wG0qOl48AJhbln84+SglefSlQCvoek8oH

C:\Users\user\Documents\My Pictures\desktop.ini.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (884), with no line terminators
Category:	dropped
Size (bytes):	884
Entropy (8bit):	5.977997349947728
Encrypted:	false
SSDEEP:	24:fMgYDNfo2RYq25TPumsYniPY5O2ew8bPb3oY:UTDNAQw5TPumsiWYzmb1
MD5:	2C64EE45BF86A61A4567BE528AF31729
SHA1:	B98181119FCF7B06018390A1EB00D0F3420E8A3D
SHA-256:	7813EF02D7B9330DF43906D6E2E79498D488CFB14DAFA7723EAB21F8A754F598
SHA-512:	BD58DDDDC31E871153866167EF2A236F79013C4AF6CB544CC3D422E53542470572C824AAF39E9AC73446444E2EC070F657FAA0D3221A091C27D9B4DF60FDE62E
Malicious:	false
Preview:	<EncryptedKey>YUkvwDaNzIuzauA2KN9ZnXl2wiQfNp5eKayyEuiMX/lu+H3EXiz5guhL9H0wPdQJ9WZw7RCG3qAO7JFE/MGWWDfCP/aVE4DLq9kaNB30ta4b1qPQ+F21G2nE7PXI3kJEsaicU/+B5/bNPAInIoA4S16HPaNEqYaQn+zznjtkQQw=<EncryptedKey>UYVdxmOrx5XzU/ZapzGDRZoc3d6xgjsn38IHgEIiyGThcObGjYQJLKGMMf70cAvdgAs4rFNuZQRFYZIgXrZEFShVRN5JQozjxQZbxfrbj9IwwK+Fz/aiqRF8QIAQQTcXlyptKK6hTOf4pohbfghonQd0cP8MgDn5x87WUg56asKvnkAhswo0arvlyVUBMTpa4GohF00Ly77oXjx459RuYwxSSpJZqA2eRqrs3pZtSDY+Kd2LNGtZiSM+Sd+4F6OdGandmvwrvYAUoDfv/wDrgO5Q5JLrpRA1ARhWWQS8Hm5cSrit2TsOs1YcOkMME0czHuozPpEk75qPjaz5TCPvdkXyMWekqhu/E6Y7GnfCX0e/SbF64tSgwnWbmdF1gii+sPNJIZjJAIKfQR1ojTMRCqAIHREBzLnlg/+RqCW5N2/z+ON2SWyEhAnGnjOCv4DHj17j5OlZuRX7cHqBwWtph3KOYrsj7nuVBjmYV3OixMqREhuPtrbtGj6y62gdFSuKEeK1RVX7uYRRapAIFDSUfBGnppbYxkVwvrMpL/2o/vmAf+uiEbbJ5jlCyjcx/Y/JBQ/pTVbxjXGP7Yg0TrMQhMSd5WgI6YnJuK42fDl+J/ZCNqvVy2kSps9vDV5cMX1RqzpnJYIUEkGR+PptYNAdX/BPLkol94SwafmM1sDd+oE=

C:\Users\user\Documents\My Videos\desktop.ini.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (884), with no line terminators
Category:	dropped
Size (bytes):	884
Entropy (8bit):	5.979195633014882
Encrypted:	false
SSDEEP:	24:fMSvLupZ1nDT0lf55WGimntW/+O5wyLRmRFQG6wmIg:USC0lRIGiH/+OakmRFQ4mL
MD5:	57B91139E058AF810A78A65362D4954C
SHA1:	293C08B546903A81C2C34A50CD14A2B6BD006F90
SHA-256:	EBD9984D4B76431A5B608AB36C5182675C7E66F9FEF09F4419B8236D722A3AE3
SHA-512:	07EADBBC12BAED6680E71EFBCC23D0C41DC63ABCF4CE9DD242C0D44C4D34278190022A61FBB86EF751410DBDAE6EDCD324D51F4CA7291617FC2B5B3A0D7C326A
Malicious:	false
Preview:	<EncryptedKey>ovKQZBtFs8bdElNK7yYxfx62CS8+KomYCpRzZ3oqshjVerZ4VI4lVxI/qtqKS/P6ehTr7RQym3F6uU/yYzQ5BHdXwjl9Jf+40nfiEworTgaJGVUTsf+kxuIeu+t+TNa0xj6bDO9rljjzrA3oV2kd99IFMpn+BFabxychE1Ac0+M=<EncryptedKey>HAIh7+GjrXVN4CuXkXTvR8zPwEq0wsm0+nwb7/Sa+U994r7UvYlbcf2CgBOCbIz432rgZRyh26YWAUtUeS9mQs8Pls8nOC2cgg2xWrRlvXKBCZK/KGg64eRCkwMuMrx1Iz23sgSNbs3d0bWv+L7TOx64fdXJ5GFTu4MEPSi/oAhGAKfkwsRJrv4LXQVlwAa5MKgdgOTkh1Yb4EoUhIscBIvEO4At+mVUcFHTrJUSV8fcG56PlKrDy8gY07swJDin/zKPR+pH+XpodfoQNFrsAvJfxcj60XYaGTfLRCQUMsibF06RG5jSAqBkFCpzGz5Vd7NFGmqKbdj5ROk7ChRvRnfaRkUri21lUOx+ESxv+s+Dal/iw9a2ZmMHbeX2yTafAODZ+Twalxw2B3ZhvfoBMhxSRDpr4LQgyB/AMEacGthiQt2fe7ItmhEuos9MpDSHb2bNVw3l2X1GEYzhWs6yAtWLM1g0Mri3LHnfh/r4yTKDzcoaPV5vuVUfYcFdMYRK+bjxgzILiRwM1FfKm4y/A8XM2VpFY8uOV5GJIVOKDYggO//EOmgppR6a+aYrQ2BPSi1AZYPrZfLJY8bFSL4V3ehoV1a/2JetfrhEWcLH35j9C+tCQ2EPtLUHNFR8Ed6njIJS5IL4h/Ph60GUS+JDsVfybKjaG0q2qkurK/szjnU=

C:\Users\user\Documents\OVWVVIANZH.jpg

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.989208834230527
Encrypted:	false
SSDEEP:	48:Uyqy3NsxDXmWWXLMJyhsOtLQe+IuTQRVufzo5QuL:Uyq9xDXwD/nGuL
MD5:	9FBDD6D48CCF5B5F0D46C777A33A6A9C
SHA1:	DDEEA9198451AC7E8C7EA7E92AD7EBA068CEC3C8
SHA-256:	EC7DDC337D9BCA7C52FAA34E35F78F6612B8808B1E450BE93C06CBA955926557
SHA-512:	A6CA4EDEB0F3DE85126E4FFF0137B2447BD0D5F5164188A1206FCA90BA7B6394BBA46795741A5DAFCB0F22B41DA003F54F0F0950FEAD39D31379715CF92D76D0
Malicious:	false
Preview:	<EncryptedKey>dI07b3YjvXZe1sY962PyM+e3b7fS3qFRu77p0dayk/TbjyFIuGpfVv1xi1r7hUYzB284grHkt+UFZBmcOi1WGem+ksK7Uo79zcxDDoZNf4kupQvgmFf/Kkyo9YyjvARhMhgDfYveinUOa84FVNG4Sg0/K+5pGvdn7ztkCkhPAis=<EncryptedKey>nV51dW8gNR3ZQFBsi5KV3P/wd8nyoWhqm5L/sJ1rWpBEXFOKRf1xk8sKy/acFb1qjIP6NKkSLfxBwrEtX8Ga0fUcvTbAdWwZ5nxHqiCbVDRY/d1BDrwuMjl/64Gbns3IpELsfA3cxLevWaxTzEM2NzRe1Unabnlf8Bjhn1UH7OV+LsYHLRnFhtXfHk41++WtFchcjF4kh2yGClvAscujlwKOnC/C5BlpxWqayjZTYOVWnoCx/7PkzxJ6yllzP4//zB+lR4mTXdtKvAAYuH/ClX0CTpoVdJ89oo81qeRoz7FqLg2YoCiJVVEvLw9oJ6s1sFE2ARNx4HceguVF8y3tFOYVq2biQ2uWg+GnYFMaFktTYfrzebtFOoi2BSIQppYde5FqUSFxGhbKNGtl6gZF9IGMb0m9o+kwmRe6d7E+1MZKobIFgj3XNRa/Sy558Ll+itzYhf6olMVju/5w30iUcFFmX/oGIZ3rNWwSgIpsi9E7TmO/FKTlttFIhlIXtKoiNpN9t3PXHPpLj28GktblGJcittKiXbfx75gCz9GU9PTOTTRyUjSSx1TgnC7/pvtTbWUk6qh/ZkrgmmEeLVizNmm4wP/ISAAJmGVeiTcAChPSWVUFCMFKh9hQfhZV0G0fG16rwMDKATWyL83DLyrmiRrhhO9Yd/Zgw4m5+XRt2RLOqoU+wqVuyvm8I58ADpkGX8+KsZ8n2MsKgwAl6zxuwZ+Uae+LGmzdThm0V5Wu2BVfgbO2gd7RtcG6ku8oOsl0ohHznZcNz3g5OXdGdkIgJimZ3lcgJYg5

C:\Users\user\Documents\OVWVVIANZH.jpg.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.989208834230527
Encrypted:	false
SSDEEP:	48:Uyqy3NsxDXmWWXLMJyhsOtLQe+IuTQRVufzo5QuL:Uyq9xDXwD/nGuL
MD5:	9FBDD6D48CCF5B5F0D46C777A33A6A9C
SHA1:	DDEEA9198451AC7E8C7EA7E92AD7EBA068CEC3C8
SHA-256:	EC7DDC337D9BCA7C52FAA34E35F78F6612B8808B1E450BE93C06CBA955926557
SHA-512:	A6CA4EDEB0F3DE85126E4FFF0137B2447BD0D5F5164188A1206FCA90BA7B6394BBA46795741A5DAFCB0F22B41DA003F54F0F0950FEAD39D31379715CF92D76D0
Malicious:	false
Preview:	<EncryptedKey>dI07b3YjvXZe1sY962PyM+e3b7fS3qFRu77p0dayk/TbjyFIuGpfVv1xi1r7hUYzB284grHkt+UFZBmcOi1WGem+ksK7Uo79zcxDDoZNf4kupQvgmFf/Kkyo9YyjvARhMhgDfYveinUOa84FVNG4Sg0/K+5pGvdn7ztkCkhPAis=<EncryptedKey>nV51dW8gNR3ZQFBsi5KV3P/wd8nyoWhqm5L/sJ1rWpBEXFOKRf1xk8sKy/acFb1qjIP6NKkSLfxBwrEtX8Ga0fUcvTbAdWwZ5nxHqiCbVDRY/d1BDrwuMjl/64Gbns3IpELsfA3cxLevWaxTzEM2NzRe1Unabnlf8Bjhn1UH7OV+LsYHLRnFhtXfHk41++WtFchcjF4kh2yGClvAscujlwKOnC/C5BlpxWqayjZTYOVWnoCx/7PkzxJ6yllzP4//zB+lR4mTXdtKvAAYuH/ClX0CTpoVdJ89oo81qeRoz7FqLg2YoCiJVVEvLw9oJ6s1sFE2ARNx4HceguVF8y3tFOYVq2biQ2uWg+GnYFMaFktTYfrzebtFOoi2BSIQppYde5FqUSFxGhbKNGtl6gZF9IGMb0m9o+kwmRe6d7E+1MZKobIFgj3XNRa/Sy558Ll+itzYhf6olMVju/5w30iUcFFmX/oGIZ3rNWwSgIpsi9E7TmO/FKTlttFIhlIXtKoiNpN9t3PXHPpLj28GktblGJcittKiXbfx75gCz9GU9PTOTTRyUjSSx1TgnC7/pvtTbWUk6qh/ZkrgmmEeLVizNmm4wP/ISAAJmGVeiTcAChPSWVUFCMFKh9hQfhZV0G0fG16rwMDKATWyL83DLyrmiRrhhO9Yd/Zgw4m5+XRt2RLOqoU+wqVuyvm8I58ADpkGX8+KsZ8n2MsKgwAl6zxuwZ+Uae+LGmzdThm0V5Wu2BVfgbO2gd7RtcG6ku8oOsl0ohHznZcNz3g5OXdGdkIgJimZ3lcgJYg5

C:\Users\user\Documents\UBVUNTSCZJ.jpg

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.983112203608762
Encrypted:	false
SSDEEP:	48:UJQAGLRrnQAt6LAqacoPf1TKG0mbyM7/wXMzZdePH:UJV8RLQAgLAqacQfby8kGePH
MD5:	09230AF6EF770A930797796447CFF34B
SHA1:	E603BE65DEB431328ECC26F43093A1852BAA5E54
SHA-256:	A83CAF3AD81AB66B9214FCA24B0F59474AE955C317FFE844EF3CA3F6BD61FE8B
SHA-512:	AD918E4802EBF3DE1155C4D802148AF893F9058DD246200B0F6CC340B845AC33FAC59FE8632138EF43E23188ABFCE7177290D05FEB8EE729E616A8E695D6DEC6
Malicious:	false
Preview:	<EncryptedKey>fag0kRA+ozwKxdxYV2zZgcYljiyNzvXuLTBLTUyrUSkdbGBo5vsFpfA+my0Xgs5k5VdiDQpoxlkpzn2OIfOXXV/sRiaq+WEVY+c+xs3BsTwodD3btQSy0c4b09e1E+77V74eOig9GQN8PH2Sm97JJowhHhE+eASCx9RW0ElzloI=<EncryptedKey>dtu9pTZkQXvrdtDRTD8NfSEK7S3irx7XNsVI8eLrWOzO/tOFsHw9RYe6LvWjB6vqVB5tyqD/04SSQ1v/1b82OMe3zhHUYwLQuemw8HLozWS+0uBtAk9og0xA21NT/Baaclbyxbl00Drbui9bZtaw2dEMkKuR7tde75IT3TbKqFmx7CEC6n3DXAVggCY/nxaMr3HTkExeAttopwBzaC3p6GGyDWgfslN1TyJJO6dKSAIuFgsl/nAgg1J8Ym62aNlS2rS3QrRoJjrMSNFpJ5+PaN2WNhucQJp8Up/feqkfHVo65dP3jeOaAbkKP3wdn5NbGowCV8hb/mth1J67V744U0xSi5TGjjaaNdC+cUvhDTa/W39KWNei9/5/bHSS6YgjEdlSZogvHy8ANKwzBWs/cSihcxNKyl2MNSVAXoEVSfkXvFBk/s6+Kxq63CMar7hIyKbe+ykC8FNTLNJtnwNL6AoNuontitizetUuSRUJMhJSR5Rl3AUstd+AurlEx4MCzXrv0o4j4/LzCXi0bSl8xQWuCI8odvNVKwqAdklF5tBBN25/ioskgW/F2rpKxv+pyiCLJ6+gCZ5qo3cDwK6STGKOVcP003faOyweXIXAQqWoGyVbzAIs/a4hxFrfmi/6Vzq8W8AnVabYWP9VQqoFCVEJFixuX7lm65qI5xdhC9ToYii+LSx6q7A/QR1WF7Jtc4t3JGO10IpzZgXMx+/jI1Va9L6ZtFAtkdiuQQzvw3TW1esWtPYxLKLVPNh/H4clmGb/4yRMUiAbHACq+wIuzBD1bLi/Rn/3

C:\Users\user\Documents\UBVUNTSCZJ.jpg.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.983112203608762
Encrypted:	false
SSDEEP:	48:UJQAGLRrnQAt6LAqacoPf1TKG0mbyM7/wXMzZdePH:UJV8RLQAgLAqacQfby8kGePH
MD5:	09230AF6EF770A930797796447CFF34B
SHA1:	E603BE65DEB431328ECC26F43093A1852BAA5E54
SHA-256:	A83CAF3AD81AB66B9214FCA24B0F59474AE955C317FFE844EF3CA3F6BD61FE8B
SHA-512:	AD918E4802EBF3DE1155C4D802148AF893F9058DD246200B0F6CC340B845AC33FAC59FE8632138EF43E23188ABFCE7177290D05FEB8EE729E616A8E695D6DEC6
Malicious:	false
Preview:	<EncryptedKey>fag0kRA+ozwKxdxYV2zZgcYljiyNzvXuLTBLTUyrUSkdbGBo5vsFpfA+my0Xgs5k5VdiDQpoxlkpzn2OIfOXXV/sRiaq+WEVY+c+xs3BsTwodD3btQSy0c4b09e1E+77V74eOig9GQN8PH2Sm97JJowhHhE+eASCx9RW0ElzloI=<EncryptedKey>dtu9pTZkQXvrdtDRTD8NfSEK7S3irx7XNsVI8eLrWOzO/tOFsHw9RYe6LvWjB6vqVB5tyqD/04SSQ1v/1b82OMe3zhHUYwLQuemw8HLozWS+0uBtAk9og0xA21NT/Baaclbyxbl00Drbui9bZtaw2dEMkKuR7tde75IT3TbKqFmx7CEC6n3DXAVggCY/nxaMr3HTkExeAttopwBzaC3p6GGyDWgfslN1TyJJO6dKSAIuFgsl/nAgg1J8Ym62aNlS2rS3QrRoJjrMSNFpJ5+PaN2WNhucQJp8Up/feqkfHVo65dP3jeOaAbkKP3wdn5NbGowCV8hb/mth1J67V744U0xSi5TGjjaaNdC+cUvhDTa/W39KWNei9/5/bHSS6YgjEdlSZogvHy8ANKwzBWs/cSihcxNKyl2MNSVAXoEVSfkXvFBk/s6+Kxq63CMar7hIyKbe+ykC8FNTLNJtnwNL6AoNuontitizetUuSRUJMhJSR5Rl3AUstd+AurlEx4MCzXrv0o4j4/LzCXi0bSl8xQWuCI8odvNVKwqAdklF5tBBN25/ioskgW/F2rpKxv+pyiCLJ6+gCZ5qo3cDwK6STGKOVcP003faOyweXIXAQqWoGyVbzAIs/a4hxFrfmi/6Vzq8W8AnVabYWP9VQqoFCVEJFixuX7lm65qI5xdhC9ToYii+LSx6q7A/QR1WF7Jtc4t3JGO10IpzZgXMx+/jI1Va9L6ZtFAtkdiuQQzvw3TW1esWtPYxLKLVPNh/H4clmGb/4yRMUiAbHACq+wIuzBD1bLi/Rn/3

C:\Users\user\Documents\UBVUNTSCZJ.xlsx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.992644890792499
Encrypted:	false
SSDEEP:	24:fMYIPVxYHt6nlyKSI2tdmnPliZR0taI2caXcH0p0Gl0MDTEE4yCuPh4m7y+eP:UYqNyfPjAPlW0tkC0pd/CuPGP
MD5:	47E80F8D276C5D492E010AF477F33ED8
SHA1:	70ECFE18EEB8B2A7C0AD65CB4C924C8A6FDA201B
SHA-256:	88F43573845B93B6B05E4E077FE422D9FDDECDF7107710466F993F09F36482E7
SHA-512:	D5EA7B5D9AF2C6CF09676EA81983F03221DFA6F0A8E6D44D5F677E3FEB401810E0D684CE5CA05E3CAB94026487514C1DF0852C0F73456100963BDBC03F618B10
Malicious:	false
Preview:	<EncryptedKey>FIGLTkUQP1hVCKWq+x2YxSp5H4HbSFWkS6dUde1nDA4ChvMCLdYVVwirdtLX2KmG/7Wr+Ri1JK/opmNsYAYi5aUUWSWhqG75dpASh6JGaDdVfUYDq3tN8VP9ZDpn5DRBqL7UBpOtKg5w822XByLxXbAU1P5/XaZxgeAnd3rl75o=<EncryptedKey>c3DmCOlKI6B3C3EAlwkngsgLvpJ9RUuU1/YUOghCqO+HzGNulqfZwm3K9wyDORUL4uX/rZPW0q7X6xgS/AApz9jS42f1glAVCcWhqHXhE9crb/0Iq+VR45R0961LMwK9mesw0mluaChg1xqCSG6RJQI7HRFyCZ27AhNB/jBh3uyrRGe2VErWDvxFj/dzDtCny6JmOKM2T0Ru1m2Vx9aINuRXiMSuN+FaxsPUIKNJLCH2VZov1c+jN5EbcAbaCntCoMpDj5Zt9nDJyHu4cnuudSiVrlVPWXS2r0+kNOkSAtwzQA1ONoISlWLvXjoxWVaHIcxx5iatGXkrHoFcy5BYCk1Hq57834HXAlBCyEoV52F/oigWPHgVferd/w5X10HDgC/TY2mZ5pJqhBsKk9oHXJNBWTDwHt4XzZ38uX26QjSr+XJZzlPxwjtaqyOqUcbpT3n6us9pVl2L4dVOmlw4zqbF8HZHCzyLAuk76KRit/+YIcbrE6P4B17IOVVpvT5aHEIKU/sbJZ5JcL5xTwEhFSWjx7h75mNTHQCrWjwo7wvPoJgVpy4JzpUonxcWT6BQPfoy8bIkdwM+5pgtfASF/5Fox8tInuUuNfK9mdwHM2qoDugLIl9wiXMA1Xbr5X1R0PXlt30MxsPZbPg0NL9e3jayF6YNL+he4KRhD+O1WdmZCqFBrSXoGkmKCIxSei9cMkeiluRZQNmkB4xJNuZUqpcjNZ3hvt+euyweBgiu1XfcGH1sn6CdFFJfIjYZa6zJzOebO96nagK7hsuUUUfWpG45k7zWGE01

C:\Users\user\Documents\UBVUNTSCZJ.xlsx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.992644890792499
Encrypted:	false
SSDEEP:	24:fMYIPVxYHt6nlyKSI2tdmnPliZR0taI2caXcH0p0Gl0MDTEE4yCuPh4m7y+eP:UYqNyfPjAPlW0tkC0pd/CuPGP
MD5:	47E80F8D276C5D492E010AF477F33ED8
SHA1:	70ECFE18EEB8B2A7C0AD65CB4C924C8A6FDA201B
SHA-256:	88F43573845B93B6B05E4E077FE422D9FDDECDF7107710466F993F09F36482E7
SHA-512:	D5EA7B5D9AF2C6CF09676EA81983F03221DFA6F0A8E6D44D5F677E3FEB401810E0D684CE5CA05E3CAB94026487514C1DF0852C0F73456100963BDBC03F618B10
Malicious:	false
Preview:	<EncryptedKey>FIGLTkUQP1hVCKWq+x2YxSp5H4HbSFWkS6dUde1nDA4ChvMCLdYVVwirdtLX2KmG/7Wr+Ri1JK/opmNsYAYi5aUUWSWhqG75dpASh6JGaDdVfUYDq3tN8VP9ZDpn5DRBqL7UBpOtKg5w822XByLxXbAU1P5/XaZxgeAnd3rl75o=<EncryptedKey>c3DmCOlKI6B3C3EAlwkngsgLvpJ9RUuU1/YUOghCqO+HzGNulqfZwm3K9wyDORUL4uX/rZPW0q7X6xgS/AApz9jS42f1glAVCcWhqHXhE9crb/0Iq+VR45R0961LMwK9mesw0mluaChg1xqCSG6RJQI7HRFyCZ27AhNB/jBh3uyrRGe2VErWDvxFj/dzDtCny6JmOKM2T0Ru1m2Vx9aINuRXiMSuN+FaxsPUIKNJLCH2VZov1c+jN5EbcAbaCntCoMpDj5Zt9nDJyHu4cnuudSiVrlVPWXS2r0+kNOkSAtwzQA1ONoISlWLvXjoxWVaHIcxx5iatGXkrHoFcy5BYCk1Hq57834HXAlBCyEoV52F/oigWPHgVferd/w5X10HDgC/TY2mZ5pJqhBsKk9oHXJNBWTDwHt4XzZ38uX26QjSr+XJZzlPxwjtaqyOqUcbpT3n6us9pVl2L4dVOmlw4zqbF8HZHCzyLAuk76KRit/+YIcbrE6P4B17IOVVpvT5aHEIKU/sbJZ5JcL5xTwEhFSWjx7h75mNTHQCrWjwo7wvPoJgVpy4JzpUonxcWT6BQPfoy8bIkdwM+5pgtfASF/5Fox8tInuUuNfK9mdwHM2qoDugLIl9wiXMA1Xbr5X1R0PXlt30MxsPZbPg0NL9e3jayF6YNL+he4KRhD+O1WdmZCqFBrSXoGkmKCIxSei9cMkeiluRZQNmkB4xJNuZUqpcjNZ3hvt+euyweBgiu1XfcGH1sn6CdFFJfIjYZa6zJzOebO96nagK7hsuUUUfWpG45k7zWGE01

C:\Users\user\Documents\WHZAGPPPLA.mp3

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.994236868392694
Encrypted:	false
SSDEEP:	48:UBetl+CMqwRrFA+9a/5y2MuOcUWv52iSBb:UBeiVRrlaRyMPvv52iSBb
MD5:	A01B60B55A42A9F4144C73116261DD44
SHA1:	B662B855B88735350D69EB05361D893DE85B4038
SHA-256:	01CC675DC7492290837F3F3313C4F855D1996391C292552C3B23D212DB8F349D
SHA-512:	93D6C3F8334D4E6200382DB4E8BE20F18F903C167F2E998607E6170F76EE167DA3CE568C58213A5A1FED685D0ABD3EE67CD0E6FA5637E12CB705216581E18442
Malicious:	false
Preview:	<EncryptedKey>oKcIOrQ6Y62fwxdS4aLm3KQmdTTfpu1MtCpAXdHdASjITnPG1E8AZdQxaxhBhdZU3o9cPaX/OqYk8qDT1bf/2kKSnSEhUN6Fi4NsXbjmLMNFh2kjLN/mxV79OG+i7fm4k2u9FqVeIWICBBjaH2TA5WVfj3t/bs6x5gwkc27hihY=<EncryptedKey>0nkggY0+wt8yDp36XrK6DgLfwLZ99BobpqIzlyINETYAuqztaf9E6uJnFHWwLMqsrJn+YRHern5OrvfoWGjggB/rAe1tPjEaGYRYwEttsPoY7JiOM/PebEthkNxOiCdifH0FgcnHIg5QXvrEnwWoYMzBBSp/7zLk6cp41phaLb/XuilE2qP1r/swFvXJFZOFuzBq7HaWxM45Y16Fq3lUD0srFKVyG+KsZRQFFJRSCIsx17Nz1wSDQJR6JlmkTX9uxFR/DDeAqyaQmMYvvjhrrAU79vIAK5k6eWsY7iN4nXjZqNzeVcylevAI+HjPr6ags3pQu90KAzm1mPnu0Kd9mzhw6Oc0FNM0A6G75dwzIQR5WsbOAOe2lHz6X/oXCKnpD0TFf72kG569sbu0Vw51aQc3aoyO1rzmkG2BXRWgfvZgdEfUtCxvImy9WbHmb5w14Q9BfDnMu7PpLIBDbYCgV7LO2knConaQti8UMgA7jpGInysoIMwG4trz7E6fNIW4ARAY/i0lCjP/f7WPfLVxsJpeZaApfFInnDY1Z+Ji88H4RLnbpPty+dt7M6yhdySiCEvH/BvB7F4S9CrYM1ycUgAogX3meoyUBRlqI3wKD2RO8GMdxvj5k+TXfcA3KNgs6nBpMUKPRKK3U/RipS/FKD4hVtNMHY4WHNvpWrqEXPPbGQyY3cEE8PBnplgAnUgcx5ujIQ/zatdltZRjpBFx3NjoqEBaFNZhI8iQXJ/3AbPWjoccBdzLEAwJ2J3eblFUYNVWosBQZ3gEghr1wFdEK1fNAggHjy5f

C:\Users\user\Documents\WHZAGPPPLA.mp3.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.994236868392694
Encrypted:	false
SSDEEP:	48:UBetl+CMqwRrFA+9a/5y2MuOcUWv52iSBb:UBeiVRrlaRyMPvv52iSBb
MD5:	A01B60B55A42A9F4144C73116261DD44
SHA1:	B662B855B88735350D69EB05361D893DE85B4038
SHA-256:	01CC675DC7492290837F3F3313C4F855D1996391C292552C3B23D212DB8F349D
SHA-512:	93D6C3F8334D4E6200382DB4E8BE20F18F903C167F2E998607E6170F76EE167DA3CE568C58213A5A1FED685D0ABD3EE67CD0E6FA5637E12CB705216581E18442
Malicious:	false
Preview:	<EncryptedKey>oKcIOrQ6Y62fwxdS4aLm3KQmdTTfpu1MtCpAXdHdASjITnPG1E8AZdQxaxhBhdZU3o9cPaX/OqYk8qDT1bf/2kKSnSEhUN6Fi4NsXbjmLMNFh2kjLN/mxV79OG+i7fm4k2u9FqVeIWICBBjaH2TA5WVfj3t/bs6x5gwkc27hihY=<EncryptedKey>0nkggY0+wt8yDp36XrK6DgLfwLZ99BobpqIzlyINETYAuqztaf9E6uJnFHWwLMqsrJn+YRHern5OrvfoWGjggB/rAe1tPjEaGYRYwEttsPoY7JiOM/PebEthkNxOiCdifH0FgcnHIg5QXvrEnwWoYMzBBSp/7zLk6cp41phaLb/XuilE2qP1r/swFvXJFZOFuzBq7HaWxM45Y16Fq3lUD0srFKVyG+KsZRQFFJRSCIsx17Nz1wSDQJR6JlmkTX9uxFR/DDeAqyaQmMYvvjhrrAU79vIAK5k6eWsY7iN4nXjZqNzeVcylevAI+HjPr6ags3pQu90KAzm1mPnu0Kd9mzhw6Oc0FNM0A6G75dwzIQR5WsbOAOe2lHz6X/oXCKnpD0TFf72kG569sbu0Vw51aQc3aoyO1rzmkG2BXRWgfvZgdEfUtCxvImy9WbHmb5w14Q9BfDnMu7PpLIBDbYCgV7LO2knConaQti8UMgA7jpGInysoIMwG4trz7E6fNIW4ARAY/i0lCjP/f7WPfLVxsJpeZaApfFInnDY1Z+Ji88H4RLnbpPty+dt7M6yhdySiCEvH/BvB7F4S9CrYM1ycUgAogX3meoyUBRlqI3wKD2RO8GMdxvj5k+TXfcA3KNgs6nBpMUKPRKK3U/RipS/FKD4hVtNMHY4WHNvpWrqEXPPbGQyY3cEE8PBnplgAnUgcx5ujIQ/zatdltZRjpBFx3NjoqEBaFNZhI8iQXJ/3AbPWjoccBdzLEAwJ2J3eblFUYNVWosBQZ3gEghr1wFdEK1fNAggHjy5f

C:\Users\user\Documents\WHZAGPPPLA.pdf

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.9987370237811755
Encrypted:	false
SSDEEP:	48:UVejrpWCZpk84WTHDxEWfLls1blZUCneJQee8JG:UO1WCZLfDnmpkCnBZIG
MD5:	F4BFDC26B28D6505ED94A3C934E6B73D
SHA1:	5D9A0979E4241405443D6F3F7C9BA4C71DAA4180
SHA-256:	FB6E1D7C5E5A99828ADA9C0C3B3C2960076BFC9B09E3F3BB30E0BA80C6588F4F
SHA-512:	D9779011D32078893CCE231201D0A83C68ED42D03A60AFAA1E5318F4D87270DDC0499B4896663D0F4B928B57CA63D06B31D18E0F19DF121833D86191F42C9BC0
Malicious:	false
Preview:	<EncryptedKey>Jl4z8buzyM7N4XR7hzOf+dF4K0kn5GD3vVDQcufE2xR3k1t5+mWeg07Bww++mZE2cQ0jdniLG2Lfusq1ggcDPwcASY7zpFIIK3HdFkSVnKzc34HpFBIPBngpJOAGjZ7IYYJ3caUre3VGkrt1xxJHf1TbRpC4u/HpwL6xhK1ubqc=<EncryptedKey>EBaH2aJhTXJA9jZ5M4UomUSnwbzqQp/sits1pTaKonv7tdimvZ89B8PbX3WAHWwF7JxK/qGWtjzaw1xOK5Ah8d66Ar0G/sMRHZatDEotMhXB2EprLLsSdUmM/5ggs48J7MTSIDDBUVSgSA+HdREm9c8CA20u1Sl+8C+w6hmiXgPgdxcGKfusChBghpfy+udWHmzqGP+l0B66yUG/l5q7RPU0OJzWUeoLy+CQP6x4yAswgn52jgwiTOdKF3U8vQA5/Aj92yF7f4L0OcXLXCrQ7ZaQxxpnGKKGIwEQ0m0MM6d+l0YKw5NIkCgYK/oPXQaNqsbgrKFb/ak6cBe3BzT6OTg8MpH1ZvhfO04qpNYimSpKjfeXWy6ZoeMMOEG/MOX+ZE2tJ+t8ZsY/VclXmVHi2CbZ2Xc3Plv9HQ9qYRpZtrueoG1bC9tN8Tm6xyYsXL+V4sQwGPVd5pPaFRUQpA+VSK1APh6DBcatNzkYAkhKLxYAAqEiHGjwFN2BdBHUh3DXo8rapOniKDMec9aBe0x8MkGyB1PRYImHX6lYigFXyMMWRr3fFYDPxff4sDAJ/D+OXn39CiVRY2KTzUVyQtmSMUhjre3Iya9sDkWxDBYO8CUDvjGrpJVuTj+3duEG18hiS3X5RWO9bt9Kvyb97WR+DZR38/QAIJAIcg0CUhwZS/Mr9K4ahKABjU6XJqz+sSfnwubMGMtx0gZkoTny3QZS+IywiX7Svmg4OvGR+tzocj6fKs5+7skFEzHG2dtl1KEL0LnDbfzQK8s0x5RF98kaYkPeHpqoUVGI

C:\Users\user\Documents\WHZAGPPPLA.pdf.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.9987370237811755
Encrypted:	false
SSDEEP:	48:UVejrpWCZpk84WTHDxEWfLls1blZUCneJQee8JG:UO1WCZLfDnmpkCnBZIG
MD5:	F4BFDC26B28D6505ED94A3C934E6B73D
SHA1:	5D9A0979E4241405443D6F3F7C9BA4C71DAA4180
SHA-256:	FB6E1D7C5E5A99828ADA9C0C3B3C2960076BFC9B09E3F3BB30E0BA80C6588F4F
SHA-512:	D9779011D32078893CCE231201D0A83C68ED42D03A60AFAA1E5318F4D87270DDC0499B4896663D0F4B928B57CA63D06B31D18E0F19DF121833D86191F42C9BC0
Malicious:	false
Preview:	<EncryptedKey>Jl4z8buzyM7N4XR7hzOf+dF4K0kn5GD3vVDQcufE2xR3k1t5+mWeg07Bww++mZE2cQ0jdniLG2Lfusq1ggcDPwcASY7zpFIIK3HdFkSVnKzc34HpFBIPBngpJOAGjZ7IYYJ3caUre3VGkrt1xxJHf1TbRpC4u/HpwL6xhK1ubqc=<EncryptedKey>EBaH2aJhTXJA9jZ5M4UomUSnwbzqQp/sits1pTaKonv7tdimvZ89B8PbX3WAHWwF7JxK/qGWtjzaw1xOK5Ah8d66Ar0G/sMRHZatDEotMhXB2EprLLsSdUmM/5ggs48J7MTSIDDBUVSgSA+HdREm9c8CA20u1Sl+8C+w6hmiXgPgdxcGKfusChBghpfy+udWHmzqGP+l0B66yUG/l5q7RPU0OJzWUeoLy+CQP6x4yAswgn52jgwiTOdKF3U8vQA5/Aj92yF7f4L0OcXLXCrQ7ZaQxxpnGKKGIwEQ0m0MM6d+l0YKw5NIkCgYK/oPXQaNqsbgrKFb/ak6cBe3BzT6OTg8MpH1ZvhfO04qpNYimSpKjfeXWy6ZoeMMOEG/MOX+ZE2tJ+t8ZsY/VclXmVHi2CbZ2Xc3Plv9HQ9qYRpZtrueoG1bC9tN8Tm6xyYsXL+V4sQwGPVd5pPaFRUQpA+VSK1APh6DBcatNzkYAkhKLxYAAqEiHGjwFN2BdBHUh3DXo8rapOniKDMec9aBe0x8MkGyB1PRYImHX6lYigFXyMMWRr3fFYDPxff4sDAJ/D+OXn39CiVRY2KTzUVyQtmSMUhjre3Iya9sDkWxDBYO8CUDvjGrpJVuTj+3duEG18hiS3X5RWO9bt9Kvyb97WR+DZR38/QAIJAIcg0CUhwZS/Mr9K4ahKABjU6XJqz+sSfnwubMGMtx0gZkoTny3QZS+IywiX7Svmg4OvGR+tzocj6fKs5+7skFEzHG2dtl1KEL0LnDbfzQK8s0x5RF98kaYkPeHpqoUVGI

C:\Users\user\Documents\desktop.ini

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (756), with no line terminators
Category:	dropped
Size (bytes):	756
Entropy (8bit):	5.977340679928667
Encrypted:	false
SSDEEP:	12:fMEmcbLGK4nSgPxTesYVR/0za/qoSVO4LtMiv33JkHypx4xLfcBjN2pqIH+LHKMu:fMsbLk3PReRFSVmWJkHyp4cCwXbmR4Ud
MD5:	729DF3BC8022612FC7156EBD6AAE2BDD
SHA1:	0F62254BA5991C4D2A3F1D95BDA2409822DEA8F0
SHA-256:	7EC94DBE1EE0978E3B1BB42DCC8BCF2711DCF2F03C29F35DD5F83B701F92C373
SHA-512:	AECAF9B07510B17F52ADDC930F32CE727E9BFCEFFEC649E39A4A6AF24EA724BEE9F2A9F30BFDBB77591C0BCB2E64B37ADD6D5D99383D52D9B2356291D3DA73DE
Malicious:	false
Preview:	<EncryptedKey>YuJx2kTG/kYSmjCj2ZY3Wa9epcYSiKz0V+QExlD9sB+EAHtvLzxeRpNt2Pnjep7B4I+aQnW6cvOOTAp+OouCJH2fuw57wCi8Zn7U1vBA+fsQHj5E/ZWRyErCT8O6VAqdJZygPKyJzit0Vh2wF+mim00sq/n7AYk4jzfwNixsqbI=<EncryptedKey>n4Q1sumkPUvV5D9g6OyDJMi6puV9H/1TGOvxa4gVgClDwRVgjzTk1N/pOJ+ol7a4IzvR1KUdpZeLXs6dcDsp8j20escG60vu6mK5ZD1Y6gBU3K9NgqB25njuMe2nDu0jituJ5ECSUS8bDZoxz7gickI2R+dB2czoUI2LaoFh0CSHILaPj7mHjldTFd8NHgnXKDlJdqOqfSsXn93icUp/eGl9yU2NyqrqBYTdoENbEUSLTvmRl5315UKQ3zdopENGGmo9CrFURfGqPRhzgSFTqLprc3dFl6vlOhda9hPkPyjyW/ezz+7kDdS/woYGujN6Rk1t1NCzV7ou5oirLF6sBWKm4Kcj3lR01r/2SUOHxvXim78Ltb3Hx1y4rICwDYk9iQm81yUWF94YZVuGHtyptNQtMleerx+EYN/6KzE877angO4Ad8tEqz0Ma8oqjct96PkBSyOSnEg431wH2coH7XRF02aXLOl4s5HJYGva14CmcQnyiMBLoyFbqZ2o0rpyrLtq7HZz8w1wx4Zr8sWJyv3kpJeunzQ8ZJsqMpZp6og=

C:\Users\user\Documents\desktop.ini.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (756), with no line terminators
Category:	dropped
Size (bytes):	756
Entropy (8bit):	5.977340679928667
Encrypted:	false
SSDEEP:	12:fMEmcbLGK4nSgPxTesYVR/0za/qoSVO4LtMiv33JkHypx4xLfcBjN2pqIH+LHKMu:fMsbLk3PReRFSVmWJkHyp4cCwXbmR4Ud
MD5:	729DF3BC8022612FC7156EBD6AAE2BDD
SHA1:	0F62254BA5991C4D2A3F1D95BDA2409822DEA8F0
SHA-256:	7EC94DBE1EE0978E3B1BB42DCC8BCF2711DCF2F03C29F35DD5F83B701F92C373
SHA-512:	AECAF9B07510B17F52ADDC930F32CE727E9BFCEFFEC649E39A4A6AF24EA724BEE9F2A9F30BFDBB77591C0BCB2E64B37ADD6D5D99383D52D9B2356291D3DA73DE
Malicious:	false
Preview:	<EncryptedKey>YuJx2kTG/kYSmjCj2ZY3Wa9epcYSiKz0V+QExlD9sB+EAHtvLzxeRpNt2Pnjep7B4I+aQnW6cvOOTAp+OouCJH2fuw57wCi8Zn7U1vBA+fsQHj5E/ZWRyErCT8O6VAqdJZygPKyJzit0Vh2wF+mim00sq/n7AYk4jzfwNixsqbI=<EncryptedKey>n4Q1sumkPUvV5D9g6OyDJMi6puV9H/1TGOvxa4gVgClDwRVgjzTk1N/pOJ+ol7a4IzvR1KUdpZeLXs6dcDsp8j20escG60vu6mK5ZD1Y6gBU3K9NgqB25njuMe2nDu0jituJ5ECSUS8bDZoxz7gickI2R+dB2czoUI2LaoFh0CSHILaPj7mHjldTFd8NHgnXKDlJdqOqfSsXn93icUp/eGl9yU2NyqrqBYTdoENbEUSLTvmRl5315UKQ3zdopENGGmo9CrFURfGqPRhzgSFTqLprc3dFl6vlOhda9hPkPyjyW/ezz+7kDdS/woYGujN6Rk1t1NCzV7ou5oirLF6sBWKm4Kcj3lR01r/2SUOHxvXim78Ltb3Hx1y4rICwDYk9iQm81yUWF94YZVuGHtyptNQtMleerx+EYN/6KzE877angO4Ad8tEqz0Ma8oqjct96PkBSyOSnEg431wH2coH7XRF02aXLOl4s5HJYGva14CmcQnyiMBLoyFbqZ2o0rpyrLtq7HZz8w1wx4Zr8sWJyv3kpJeunzQ8ZJsqMpZp6og=

C:\Users\user\Downloads\BUFZSQPCOH.pdf

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.987140927900446
Encrypted:	false
SSDEEP:	48:UCpET4TxvqqA4Iyx8BJxeSkAZCRr+GfQ9Jvveyn:UxsT1Ixsg1ZC0akJ28
MD5:	A72896FD4D9F06F21520E9B7CD9B945E
SHA1:	187D3A177D46BCDD89A9C0C3CE1832952BA5383B
SHA-256:	C3CCD7936996E47B2BC9CD6C0C5E6043011A078A9BB0801AB1BA5DCDE31A67D1
SHA-512:	3C31FCA5B0F6E3DAD1595A0B7B24D17045487E4736DF0CA8F591A1181DCE319FF12200AACF739CBB6DDBAD43823DE99A5657C0C0AC7EC63C73E46544C5CC570D
Malicious:	false
Preview:	<EncryptedKey>jkm7snJG5ISz2/h6T9PyoR+6k+Zaccuz4bKQEX3L3UfOTcfOnJyU6ArIN28qtO4AjlPmAPYdXEhDGcpAqeBlptJ3gP5pvW1r3Ur9rTTjidVmbi3Mcx7siqtMh8XfjyoXEf7bh4aIlnniGLlkDG9yMn4eKkMjHfAC7GMeK54EOko=<EncryptedKey>UlyOeOrMPgTBBTaInqAi12lVsZshrXdEb8IUBn12xzJGvQ+Hdc9jfx0cqxAbk+wapJNrFdNOFefuYkMAvB5ppnyebmWgdZyNqa0RnKlFal8kRbwqc0vK/K28iQg3o1BtPgO7Up2YHhreFGPhy0Rj2+mNedFmOA0JpVLXDBHsFrsThTuhwJ/YDPLy1ez3zTRWdt4BIdOMoMTBBfhnYQb/+SuOo9KFmZvQX8aXAV5DCNQ2TMDU5ZOcuj2NqO1dJggUL4X/YEa/jQnoi/yyj4GS8907ECWsuccjQKs+lG75zJb5BkF/v8epO6tne1SWnQfAnMbaKCuz3apJlOJCIQXNmRe7l4JXTA9umPUSt4iuMIhQqgQnBx0ceBWT7KiiNs5Lug46K3rIeOdb9zZXLYG6X+qVfOZj1b+3Zl8GdG4WWPlxpN/z4aBiEBdhkXDWGn5+43bbSD7GrK1Vi8M2USdTJelT8ooi+g6FwGaWFPJrIj5nP9VWjzs8j/BXOd4Hp5pEfY5qpd8FAX6XyZ8Ec1Um4dBOg6mNWAL2JkZKai4jo28nH/kt9+iuhBeHzCDvkLSitCp41YnPxa286vwOSG3mP3BWiL8tJOxoPCUovIrNFedQaSeFyjCQr+Ut/4WQyD9aME7zV8WbADkgh3bFvLDLmL5BuWt/LG5kOvJ04FEtCl9JKnJO8nU4/4eRF/+9aey4a064AFHjvERcG7pKLJFxFvnA0Eiyv7cPNIPEJA2LFkpAvbE3hD41WErcN1D28RkLfUKQWENeAwnoi4uam0GYjdjfS6tc1zSx

C:\Users\user\Downloads\BUFZSQPCOH.pdf.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.987140927900446
Encrypted:	false
SSDEEP:	48:UCpET4TxvqqA4Iyx8BJxeSkAZCRr+GfQ9Jvveyn:UxsT1Ixsg1ZC0akJ28
MD5:	A72896FD4D9F06F21520E9B7CD9B945E
SHA1:	187D3A177D46BCDD89A9C0C3CE1832952BA5383B
SHA-256:	C3CCD7936996E47B2BC9CD6C0C5E6043011A078A9BB0801AB1BA5DCDE31A67D1
SHA-512:	3C31FCA5B0F6E3DAD1595A0B7B24D17045487E4736DF0CA8F591A1181DCE319FF12200AACF739CBB6DDBAD43823DE99A5657C0C0AC7EC63C73E46544C5CC570D
Malicious:	false
Preview:	<EncryptedKey>jkm7snJG5ISz2/h6T9PyoR+6k+Zaccuz4bKQEX3L3UfOTcfOnJyU6ArIN28qtO4AjlPmAPYdXEhDGcpAqeBlptJ3gP5pvW1r3Ur9rTTjidVmbi3Mcx7siqtMh8XfjyoXEf7bh4aIlnniGLlkDG9yMn4eKkMjHfAC7GMeK54EOko=<EncryptedKey>UlyOeOrMPgTBBTaInqAi12lVsZshrXdEb8IUBn12xzJGvQ+Hdc9jfx0cqxAbk+wapJNrFdNOFefuYkMAvB5ppnyebmWgdZyNqa0RnKlFal8kRbwqc0vK/K28iQg3o1BtPgO7Up2YHhreFGPhy0Rj2+mNedFmOA0JpVLXDBHsFrsThTuhwJ/YDPLy1ez3zTRWdt4BIdOMoMTBBfhnYQb/+SuOo9KFmZvQX8aXAV5DCNQ2TMDU5ZOcuj2NqO1dJggUL4X/YEa/jQnoi/yyj4GS8907ECWsuccjQKs+lG75zJb5BkF/v8epO6tne1SWnQfAnMbaKCuz3apJlOJCIQXNmRe7l4JXTA9umPUSt4iuMIhQqgQnBx0ceBWT7KiiNs5Lug46K3rIeOdb9zZXLYG6X+qVfOZj1b+3Zl8GdG4WWPlxpN/z4aBiEBdhkXDWGn5+43bbSD7GrK1Vi8M2USdTJelT8ooi+g6FwGaWFPJrIj5nP9VWjzs8j/BXOd4Hp5pEfY5qpd8FAX6XyZ8Ec1Um4dBOg6mNWAL2JkZKai4jo28nH/kt9+iuhBeHzCDvkLSitCp41YnPxa286vwOSG3mP3BWiL8tJOxoPCUovIrNFedQaSeFyjCQr+Ut/4WQyD9aME7zV8WbADkgh3bFvLDLmL5BuWt/LG5kOvJ04FEtCl9JKnJO8nU4/4eRF/+9aey4a064AFHjvERcG7pKLJFxFvnA0Eiyv7cPNIPEJA2LFkpAvbE3hD41WErcN1D28RkLfUKQWENeAwnoi4uam0GYjdjfS6tc1zSx

C:\Users\user\Downloads\BWDRWEEARI.docx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.991258759347429
Encrypted:	false
SSDEEP:	48:UJb7/OBLivp7u5KvsXjoxfzUehqlBqyuaS08qhz:UkLivpGKYM5hqlBZhS0Lhz
MD5:	89EAEDC0A2139E2377A6F5F32BBDB9D5
SHA1:	FB7C7450155BD0F9ECFDCE33EBA5E7CABBCF58B7
SHA-256:	708F465A7FA0CDE6DD1B0990047EF9A7C4FB96894D674408D4AE3BCA3682350E
SHA-512:	7361FEF0FD3AF5E7DF6CFA8F339720E5A973350C52A4EA745AE7D84E7B0ED2964EC80D45122F762DEBC93E722952C1D32EC8C77CD8E301250D0EDA7D02E0372C
Malicious:	false
Preview:	<EncryptedKey>NNhFijCetlT2qGw3GSsYeI3MQN9F63Gy/4Ip0nQgPvVbgriz1KxtZZyyvG4HENVTqdQKhM7RGYj3Opty4fQBhKhglMWn/KdNxDGhcq99pSVRAe0EM+96++qGB7MJms3BegjGJRVxkn7W9EruFO6YrXAP8+tbQXsSXOTnzElmMac=<EncryptedKey>C5jsEdp+ecuq/wdq6/nFXLJX91+9XiJKvheelEoIw5Xe9gXY8RF7WwmJs0D1wcPsh1rHRqu5pT9MFnQN7L6vxXQ/DDFVyzfn/dgi4ynCJmVwnwmWgBFNKZxepBJj73GgqY1G6DoSgNM3qOSTIJzLVbXkRVwLu65zUtu9C5KKiREJamQI07WgARfcbJDUmxHVjg/Aj8g+L4LMnfW0qg0imlr2kBs/ZUZ9o9R7Pdz3rH+bRZhkyvykxqmlkyaUcfr2ze+wI4EClgwebKMJrHT4ug6XKkj7QB5g/Cgy8E1vWfizH2CygDdzfX96g8XH/l3pFEXo6A3xPbcReSJTmRAI9Asx4xpl5mawDxCdozUQgjwspRtBCT39zEvfy9Twv9/QgChQrKIxkfgr/j32uflPVPq1aoVT9ii2TF3eC7dwBGW39QjR3505H9YMLNEcBktdRfZ6UfDPILYlWs66LF3059CL2cZ4FaWG9A6L/cnS3SwL6S4nNrfGu43HUBriutRe7WPZNMuCmRdFf+Xtk4Stwo2EvfTp9wmwNryq/w02/9Wt/HUlMWKEfssFmvjN2Y6JLNGTfJbRmJ492xpVrGd0Lh1ovgmKF+c+/xalq/KJBuKge5hBtXQ48epvCuKwxHaOy30MQbxWXXNHldApqP282u78CWCbiIdbvF1BhlvRoc6Uxc/rdW1RsPUOLcqHD7ThgIuGL+yPGjc6LyPjqKBWwViYUk0bQoJ5s2kOafsGl7STzjQDo6Q1B45hb27M91Xzy4bIk8dgmzCbgABhP4jjyO1TOudfH8b2

C:\Users\user\Downloads\BWDRWEEARI.docx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.991258759347429
Encrypted:	false
SSDEEP:	48:UJb7/OBLivp7u5KvsXjoxfzUehqlBqyuaS08qhz:UkLivpGKYM5hqlBZhS0Lhz
MD5:	89EAEDC0A2139E2377A6F5F32BBDB9D5
SHA1:	FB7C7450155BD0F9ECFDCE33EBA5E7CABBCF58B7
SHA-256:	708F465A7FA0CDE6DD1B0990047EF9A7C4FB96894D674408D4AE3BCA3682350E
SHA-512:	7361FEF0FD3AF5E7DF6CFA8F339720E5A973350C52A4EA745AE7D84E7B0ED2964EC80D45122F762DEBC93E722952C1D32EC8C77CD8E301250D0EDA7D02E0372C
Malicious:	false
Preview:	<EncryptedKey>NNhFijCetlT2qGw3GSsYeI3MQN9F63Gy/4Ip0nQgPvVbgriz1KxtZZyyvG4HENVTqdQKhM7RGYj3Opty4fQBhKhglMWn/KdNxDGhcq99pSVRAe0EM+96++qGB7MJms3BegjGJRVxkn7W9EruFO6YrXAP8+tbQXsSXOTnzElmMac=<EncryptedKey>C5jsEdp+ecuq/wdq6/nFXLJX91+9XiJKvheelEoIw5Xe9gXY8RF7WwmJs0D1wcPsh1rHRqu5pT9MFnQN7L6vxXQ/DDFVyzfn/dgi4ynCJmVwnwmWgBFNKZxepBJj73GgqY1G6DoSgNM3qOSTIJzLVbXkRVwLu65zUtu9C5KKiREJamQI07WgARfcbJDUmxHVjg/Aj8g+L4LMnfW0qg0imlr2kBs/ZUZ9o9R7Pdz3rH+bRZhkyvykxqmlkyaUcfr2ze+wI4EClgwebKMJrHT4ug6XKkj7QB5g/Cgy8E1vWfizH2CygDdzfX96g8XH/l3pFEXo6A3xPbcReSJTmRAI9Asx4xpl5mawDxCdozUQgjwspRtBCT39zEvfy9Twv9/QgChQrKIxkfgr/j32uflPVPq1aoVT9ii2TF3eC7dwBGW39QjR3505H9YMLNEcBktdRfZ6UfDPILYlWs66LF3059CL2cZ4FaWG9A6L/cnS3SwL6S4nNrfGu43HUBriutRe7WPZNMuCmRdFf+Xtk4Stwo2EvfTp9wmwNryq/w02/9Wt/HUlMWKEfssFmvjN2Y6JLNGTfJbRmJ492xpVrGd0Lh1ovgmKF+c+/xalq/KJBuKge5hBtXQ48epvCuKwxHaOy30MQbxWXXNHldApqP282u78CWCbiIdbvF1BhlvRoc6Uxc/rdW1RsPUOLcqHD7ThgIuGL+yPGjc6LyPjqKBWwViYUk0bQoJ5s2kOafsGl7STzjQDo6Q1B45hb27M91Xzy4bIk8dgmzCbgABhP4jjyO1TOudfH8b2

C:\Users\user\Downloads\BWDRWEEARI.xlsx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.994738163271952
Encrypted:	false
SSDEEP:	48:UxDGv1hmsv0eAh1QrdbENTGN98grcaezQ/HMaLRz+G8G66:UxyvLPsew1Qrt0TGwgIEMe+G99
MD5:	7B307F8581256B8EB15AD7252756CD11
SHA1:	98A1110E9ADAD958AA333F73AC9CF48D8D47EA7C
SHA-256:	6A1B77D29DF06690467EC585CAB3C6F440DAD53F7E86313040B7033A936F78AA
SHA-512:	2513B32B497DE9CAF86F014FBB9A8D638011F5B05AF66BE946BDD4E85AB61DE3C2BA8F8696C1D41453AF490C70D66F09187996C107B068B3FA9535CE62F7881C
Malicious:	false
Preview:	<EncryptedKey>PLVIXnTfCgWap8h2ef2i5VFr1e4L7yZT8dnnFybzqq3oNMwIoDHcqAvXWldDb0D3n1KUmu6JMwIMMYhVgMzLwa/zRDevGmc4R+vH5Q3c/WuqBlEg6ZlvYqHMTGBtc+nXerk5lIfd3ajnMzRwL97AVR2q8/1S+/A46PTENCdXlCI=<EncryptedKey>9Xs/b/TPeBDmj69Z2H5bFFhzGUtBn7KFZPZVOTRV0jFeZmH2nQnmdeNsVdI1H5IEuD7pcMWdYQtso1wRz/PHCrUxV1N28Qbyc66ftDs40Oi2nPpUZxYuBdJoNdZD9bvIgU1UY/dU3wbXzP57OlGpKX3GrDMP3Ds4xlTBjKVGqWh/MEFSlaSJN4FzRcCctGafl9mfp3RaPBZsiwYCeCm95lrJKlurc2W7GjRXu4IWTHBcAKmszmM3u2Vv7bQt+MRGV/A4XyqQHrXYFfYMTZZw0joTWHYMqXLt9vgNJDuMnZbY2ZXHVVd0cfIOCDNj6+wA0aGp5DnumcWNO6oayPbbWaQPFlzwr+f5FQh2PLsBcePr7Xwyx16iis6b0AbHqGZD3++YmjdUUaH2Is5QGctV8i2eQMaFlpSMNBWkdgeoDkqXNvQrINmOj034shFWVUrau/DL/vQLnJxYmIxjgM/+g2bYHOpHFmKHVGhUJ9X0gT7WdjKnyMoAQP7hYwC8o8Rqu53+Bm16wpymCaGfYQSE8tA2s126V1gmuAr+ZV760KxC5o3FzdjvuTi+oVM7dYtn1CxDfpwMcrgwstAbMFooD24iC66Dxy/oU1Qe+2kak2DV+AZU1HhhjO15fq6duRovrA5H6HbiUI5bK6cxRMMLlqXtoGk4/aABbPX8B5uws5jTI9j7OvCFGzCXg7IVpBUyymj+Nx/OMxbdfkwrQCfdhAGpDZaGErUjPd2rO/MAkLwXZokyPnRXOnR432hbsT/XVjJ0Fu1DgoPqf+3ouGt3ly8WFZDyNX0V

C:\Users\user\Downloads\BWDRWEEARI.xlsx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.994738163271952
Encrypted:	false
SSDEEP:	48:UxDGv1hmsv0eAh1QrdbENTGN98grcaezQ/HMaLRz+G8G66:UxyvLPsew1Qrt0TGwgIEMe+G99
MD5:	7B307F8581256B8EB15AD7252756CD11
SHA1:	98A1110E9ADAD958AA333F73AC9CF48D8D47EA7C
SHA-256:	6A1B77D29DF06690467EC585CAB3C6F440DAD53F7E86313040B7033A936F78AA
SHA-512:	2513B32B497DE9CAF86F014FBB9A8D638011F5B05AF66BE946BDD4E85AB61DE3C2BA8F8696C1D41453AF490C70D66F09187996C107B068B3FA9535CE62F7881C
Malicious:	false
Preview:	<EncryptedKey>PLVIXnTfCgWap8h2ef2i5VFr1e4L7yZT8dnnFybzqq3oNMwIoDHcqAvXWldDb0D3n1KUmu6JMwIMMYhVgMzLwa/zRDevGmc4R+vH5Q3c/WuqBlEg6ZlvYqHMTGBtc+nXerk5lIfd3ajnMzRwL97AVR2q8/1S+/A46PTENCdXlCI=<EncryptedKey>9Xs/b/TPeBDmj69Z2H5bFFhzGUtBn7KFZPZVOTRV0jFeZmH2nQnmdeNsVdI1H5IEuD7pcMWdYQtso1wRz/PHCrUxV1N28Qbyc66ftDs40Oi2nPpUZxYuBdJoNdZD9bvIgU1UY/dU3wbXzP57OlGpKX3GrDMP3Ds4xlTBjKVGqWh/MEFSlaSJN4FzRcCctGafl9mfp3RaPBZsiwYCeCm95lrJKlurc2W7GjRXu4IWTHBcAKmszmM3u2Vv7bQt+MRGV/A4XyqQHrXYFfYMTZZw0joTWHYMqXLt9vgNJDuMnZbY2ZXHVVd0cfIOCDNj6+wA0aGp5DnumcWNO6oayPbbWaQPFlzwr+f5FQh2PLsBcePr7Xwyx16iis6b0AbHqGZD3++YmjdUUaH2Is5QGctV8i2eQMaFlpSMNBWkdgeoDkqXNvQrINmOj034shFWVUrau/DL/vQLnJxYmIxjgM/+g2bYHOpHFmKHVGhUJ9X0gT7WdjKnyMoAQP7hYwC8o8Rqu53+Bm16wpymCaGfYQSE8tA2s126V1gmuAr+ZV760KxC5o3FzdjvuTi+oVM7dYtn1CxDfpwMcrgwstAbMFooD24iC66Dxy/oU1Qe+2kak2DV+AZU1HhhjO15fq6duRovrA5H6HbiUI5bK6cxRMMLlqXtoGk4/aABbPX8B5uws5jTI9j7OvCFGzCXg7IVpBUyymj+Nx/OMxbdfkwrQCfdhAGpDZaGErUjPd2rO/MAkLwXZokyPnRXOnR432hbsT/XVjJ0Fu1DgoPqf+3ouGt3ly8WFZDyNX0V

C:\Users\user\Downloads\DUKNXICOZT.png

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.988258845687094
Encrypted:	false
SSDEEP:	24:fMcmkZgHoJ95TGjAlntDP8tEWp346cgpHMOGnY4zEi3xQ3exTUw7A73iLssARyqc:UKZgk5TG8v8WWp3KYHPGnLhV4nLfsV
MD5:	DB534EE8DF8E588532391255B89AAE8A
SHA1:	F8945F040E00574E5FF6D770E551ECBB80812F23
SHA-256:	BE45905F23BAE857868AE8C89667B507E4DF94443A9E2F2081B3DD9E5719BAFF
SHA-512:	495CDD781EF063543830A6BB54B8DA4183509E7316A3AA346B4E0810CE3EC0B26654EFEE34274EE39E73449BD0B0A0539479FE03B5C73BA02E683335A6A78729
Malicious:	false
Preview:	<EncryptedKey>Jka98mRQSaDQzmyBR3AHYFnIgfZVuDFA25gePtT0A3keQ76uA6TWe80R/xlBmE63nlaKpKmb+yH8UloM3WXLs9Gatd8011nMnBd/hpRiUY1NuZo/BMndQrwxnXnoGbDE/o79YHOaYk/SCwdPS67GcYObtm99z4qduXriUbUB2BE=<EncryptedKey>1catUSfsepAdTk+ZQ3yAKLJywZbTc+ohmL7faV6AN2K4MQXeX3jXqrNqIaN+a3c9HGH/Ac5Hs0CfleKuANZR+2qwUvUxG+LdiQ0ill7pYmdQJ6h/8/jpTpu59dW95mNoVQ0IKzI3N/7vawRS6onQ22R2f3aW4MBkMOB/59x+NwgFHOeaVnWZgYBV8zw3TAXQ0Wv8neT96nWoe3Bd0kvzrImESIAVA5cjOG20ReRckCMaU5mFwpZDD6g0q/ixeOusIbQ0Wp6w5nZEqdA5ffBtzcxwTamET6HfxZnUqCADh4PbMVKgU9MwhR/LPU+nnmCJROBmtTXgcbSDwnjZYVlei2p8jTqcygeMn5ql44iU6cLq65zbVlSBjh61P5FwUZ/xsgZ8fGT4stk6bAylsRx+6NadCoWgNeSQX2c4xNRT5bVRnAp7QC7pJej2Nm8ktLdn8iJY1QTkf2cuTlTHi4MUV6KvzAjufbHNJlrq+sz/lB1ZcwBcGY63fJvKMEFwZetdD6BUpBJ0kgBQcukN3un0Phyb6GK9vswWSpR4EDFAda1I8K8saDsbntczJiuwQP1mF9ojC5WvhS7mZ5AqegDVSOoOdA0fdXIQ4qdxZqhCEc9uU3T+u46XoK2TZYa5vhLcH2b/YdkCk1O9NAsFcRepjxNE2bBKM2clBB41jVFkO+CLlNOL896FlWlxGbsAwPSdI2V9T3G7QlEBtWkLkhap/9Myq9RFAuZ6jbpD9ECqIw8ZJic/lWXBaswPRwRI/bX9vBVkxCmA3JzcVNRbA8jaGR4qIrhIO5Uf

C:\Users\user\Downloads\DUKNXICOZT.png.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.988258845687094
Encrypted:	false
SSDEEP:	24:fMcmkZgHoJ95TGjAlntDP8tEWp346cgpHMOGnY4zEi3xQ3exTUw7A73iLssARyqc:UKZgk5TG8v8WWp3KYHPGnLhV4nLfsV
MD5:	DB534EE8DF8E588532391255B89AAE8A
SHA1:	F8945F040E00574E5FF6D770E551ECBB80812F23
SHA-256:	BE45905F23BAE857868AE8C89667B507E4DF94443A9E2F2081B3DD9E5719BAFF
SHA-512:	495CDD781EF063543830A6BB54B8DA4183509E7316A3AA346B4E0810CE3EC0B26654EFEE34274EE39E73449BD0B0A0539479FE03B5C73BA02E683335A6A78729
Malicious:	false
Preview:	<EncryptedKey>Jka98mRQSaDQzmyBR3AHYFnIgfZVuDFA25gePtT0A3keQ76uA6TWe80R/xlBmE63nlaKpKmb+yH8UloM3WXLs9Gatd8011nMnBd/hpRiUY1NuZo/BMndQrwxnXnoGbDE/o79YHOaYk/SCwdPS67GcYObtm99z4qduXriUbUB2BE=<EncryptedKey>1catUSfsepAdTk+ZQ3yAKLJywZbTc+ohmL7faV6AN2K4MQXeX3jXqrNqIaN+a3c9HGH/Ac5Hs0CfleKuANZR+2qwUvUxG+LdiQ0ill7pYmdQJ6h/8/jpTpu59dW95mNoVQ0IKzI3N/7vawRS6onQ22R2f3aW4MBkMOB/59x+NwgFHOeaVnWZgYBV8zw3TAXQ0Wv8neT96nWoe3Bd0kvzrImESIAVA5cjOG20ReRckCMaU5mFwpZDD6g0q/ixeOusIbQ0Wp6w5nZEqdA5ffBtzcxwTamET6HfxZnUqCADh4PbMVKgU9MwhR/LPU+nnmCJROBmtTXgcbSDwnjZYVlei2p8jTqcygeMn5ql44iU6cLq65zbVlSBjh61P5FwUZ/xsgZ8fGT4stk6bAylsRx+6NadCoWgNeSQX2c4xNRT5bVRnAp7QC7pJej2Nm8ktLdn8iJY1QTkf2cuTlTHi4MUV6KvzAjufbHNJlrq+sz/lB1ZcwBcGY63fJvKMEFwZetdD6BUpBJ0kgBQcukN3un0Phyb6GK9vswWSpR4EDFAda1I8K8saDsbntczJiuwQP1mF9ojC5WvhS7mZ5AqegDVSOoOdA0fdXIQ4qdxZqhCEc9uU3T+u46XoK2TZYa5vhLcH2b/YdkCk1O9NAsFcRepjxNE2bBKM2clBB41jVFkO+CLlNOL896FlWlxGbsAwPSdI2V9T3G7QlEBtWkLkhap/9Myq9RFAuZ6jbpD9ECqIw8ZJic/lWXBaswPRwRI/bX9vBVkxCmA3JzcVNRbA8jaGR4qIrhIO5Uf

C:\Users\user\Downloads\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\Downloads\FAAGWHBVUU.png

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.98675047632475
Encrypted:	false
SSDEEP:	48:UZ0Dd2Si7zIUwx7Y2NmgRJoSaklaxRa5qqy:UaJ2L7zIx22/Joul7A
MD5:	529C8A6EFC9F482766A89FA47858017D
SHA1:	9770DEE469CB07AA259B7300C2901C3988277EDF
SHA-256:	B79D0E8D3FA00412ECFCC655E341BC69A67A75B802406EDB5AE6E2B78752E6A7
SHA-512:	2CD63335B50F588EA66E22D0EE94D2F27CB88433ED15D17F1D7431DCD3CAC06B17E6298C84F292D0E316085019276369C7FEC0CE37B0E59D715BF49961E258EB
Malicious:	false
Preview:	<EncryptedKey>njUj8zvQyV8bNHssyR3VnZGwDtkUTB3ptZ+nsRQYlpkLOEGTlEQvC3kCjpY4S8F9RwC68PJgAs2/DjpVEtsShOtmA+i4+QhW1qRjMird1Bg5X6DGxKjqCOqi9Eled0iVFkJ6ArJ1XsdCeUNmdG0l/b4khPBSaSQkfXK8w39zAXk=<EncryptedKey>FMxKhl3NIzThgOiICwWXwmQg8XchQyhmiyAwz/Unh/BMxTdvf1smY29Myhv1c/8vNj6Fp+XKI1fRU9xvvm1ZD6lhBqdYYkoLqlHqCc2nVelj34qVVGUNfNbvvO/qqCLgiPmEdxp4+xmoEsocqVn9Yk5PbO1Gd2Eb7T2h0n8N26wM3opDb8NLgwxWrmPl2Op/s0GQiubTHgE/28FiaVDp8P+2vFF9YsI2YlzenTdOjyv1xV0ypUZjqodzc66iyAmanrgiAtbHGsaiCl32WIHhPMUh/tiKs7Y7j6xTfDuxFCKSgVEvDhLWt9HeQZcId6nNxY9z0kbvRhLupNGaVVeWco2KsPLbVBgP5pom4OgXZG5orMm+VLk/nhWNxucK/1WVizWApojpenrxHWXyxHxZFboxTHIUn9dnE+Gj92jlAOe5YXstB9+rS3tHitONrItl2ibANY/plTrvJ2fv0daHiQPp7qqvHm8hF6BfR/A7Z4BVPRb/URAZIECV2Q/XKyrGvQgatMvnhSa0k95gWbWpdLwc20BJ5vnC68rIcuB207h7HBodY3Ou9vKjms0d6vcjtNuS0ZVgwAXlqF0L5V9irnysfcdtLyhiychMVg9lzMue3m+sD9CGAkHhQvUYnUUGjKuJx6aCpwQsHnzdwidEnHaX683F5ew3FH/FFsUljXOVWykqoFGV6R0Vxqow6Kow7Q2lCKCfmR303kwIX4XXlynxN0pIH6prKCU3DLqbhZQm0gj0PyQFTMS4cTZ8foHt80wvoN++n09TVtJTvmyzcICtAv3ndsqT

C:\Users\user\Downloads\FAAGWHBVUU.png.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.98675047632475
Encrypted:	false
SSDEEP:	48:UZ0Dd2Si7zIUwx7Y2NmgRJoSaklaxRa5qqy:UaJ2L7zIx22/Joul7A
MD5:	529C8A6EFC9F482766A89FA47858017D
SHA1:	9770DEE469CB07AA259B7300C2901C3988277EDF
SHA-256:	B79D0E8D3FA00412ECFCC655E341BC69A67A75B802406EDB5AE6E2B78752E6A7
SHA-512:	2CD63335B50F588EA66E22D0EE94D2F27CB88433ED15D17F1D7431DCD3CAC06B17E6298C84F292D0E316085019276369C7FEC0CE37B0E59D715BF49961E258EB
Malicious:	false
Preview:	<EncryptedKey>njUj8zvQyV8bNHssyR3VnZGwDtkUTB3ptZ+nsRQYlpkLOEGTlEQvC3kCjpY4S8F9RwC68PJgAs2/DjpVEtsShOtmA+i4+QhW1qRjMird1Bg5X6DGxKjqCOqi9Eled0iVFkJ6ArJ1XsdCeUNmdG0l/b4khPBSaSQkfXK8w39zAXk=<EncryptedKey>FMxKhl3NIzThgOiICwWXwmQg8XchQyhmiyAwz/Unh/BMxTdvf1smY29Myhv1c/8vNj6Fp+XKI1fRU9xvvm1ZD6lhBqdYYkoLqlHqCc2nVelj34qVVGUNfNbvvO/qqCLgiPmEdxp4+xmoEsocqVn9Yk5PbO1Gd2Eb7T2h0n8N26wM3opDb8NLgwxWrmPl2Op/s0GQiubTHgE/28FiaVDp8P+2vFF9YsI2YlzenTdOjyv1xV0ypUZjqodzc66iyAmanrgiAtbHGsaiCl32WIHhPMUh/tiKs7Y7j6xTfDuxFCKSgVEvDhLWt9HeQZcId6nNxY9z0kbvRhLupNGaVVeWco2KsPLbVBgP5pom4OgXZG5orMm+VLk/nhWNxucK/1WVizWApojpenrxHWXyxHxZFboxTHIUn9dnE+Gj92jlAOe5YXstB9+rS3tHitONrItl2ibANY/plTrvJ2fv0daHiQPp7qqvHm8hF6BfR/A7Z4BVPRb/URAZIECV2Q/XKyrGvQgatMvnhSa0k95gWbWpdLwc20BJ5vnC68rIcuB207h7HBodY3Ou9vKjms0d6vcjtNuS0ZVgwAXlqF0L5V9irnysfcdtLyhiychMVg9lzMue3m+sD9CGAkHhQvUYnUUGjKuJx6aCpwQsHnzdwidEnHaX683F5ew3FH/FFsUljXOVWykqoFGV6R0Vxqow6Kow7Q2lCKCfmR303kwIX4XXlynxN0pIH6prKCU3DLqbhZQm0gj0PyQFTMS4cTZ8foHt80wvoN++n09TVtJTvmyzcICtAv3ndsqT

C:\Users\user\Downloads\GNLQNHOLWB.docx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.9915438620427
Encrypted:	false
SSDEEP:	48:UrnTzdRfd3KCK1Ac7djrjfDYFtUr1nLCTkWd:UrnT5VYtrjrj7Yv01Lad
MD5:	620114139207088EAB827DC5FF27064F
SHA1:	6539A4A820DE8E6CFA28DBD35ABAE56A7A13F655
SHA-256:	E876F7C5981B6036BECCB39271E2D2A38BD499988322086B123F09A5B84DCFBC
SHA-512:	C6C9E8A1BBB992DAA97EFD735B4FBE3FDCE5A53B7A0FAB22C7BF03B61C4783533FC9C9EB63E51B5C397EC87B1433AE3801B19A218EFF821AE6474BFF1E319727
Malicious:	false
Preview:	<EncryptedKey>GtobL02b3NEiTQEGlvQNeZBtTc5rl12jFdYQqUA6/ZyISIZTkRM/PLatWEgxqyGIX6THTtHuyZ5xoVEwqd34vJCuxsZvI2nWJgy16PX40Zw+EpK+xfV+OjG7x2VimfpKZWgpjey4W/wJ01rypxYY46LIYDXDFr8QwqlENF478i4=<EncryptedKey>8cqdNOoq0pjbY5+s02Qn3ZhocffuPGJxDYL5/AKqqN8Z1QSOi6yD7/tVBgRNLNsU2Oe3vZ7pH4crF+EyPkYfBhPDnUThsBPWdkKaIVFWau816sBU9N7bh8O7s0Akhx3D2uG/fP0/9s+tZsX+OyK2QNa7U4Jn/T4t5O8XxZkYnsqrz62G3H3gCLyByPdmnykUz7uy4QnK973WRSs657yhKtTOpJrp8QqK+Gb6OSxzcsKRmcofSLbjWntbW6BM7fFa991FEM17Y20RMjnPEQdiHILiUBakIQvtZldPViUH7JPyfJojtsBb5cUHaxUTTlYdycULS+Z2Riuv9p8PUVOzkKwoXBQjs0cPuo7xcXz6zaVTdLXiC0ZuubFDUlRJ/YmkbNFK/C9wgw+RQDSVGLnIJE3LwHbXRZOpX+S/S8rwjpBuSjouQj6ggfhXTKgBLRKjnZiByDf1MiNGAm5OGbs6xAsHI9EJbYMFKbem+8REPsbkceQucKUQjQNr4FEZfDJjPh5TFNC912QIMXnFYww2Os9gqQ9Wr3ujQUrymUBajOsvTjLrKP1jY8rkNalqRb9HrLyuMXabvpnafJSydUKCjJmW5HFZyzUCIcRtePR9q4pA7hCIVhIUpQR2dTwvOLlahLXaiZsbHPHHXDD7ZLFAnZQE3WyhrOeKqMQn1UpvwdZhonGCIysYzd/xJS+BKUu4YfCpnzkGX79UCUQ7uJCN9QQPZGPGQhmH7tucajtcyvRcqRjVaTnJliGgBylrMgP6xMF/zwlv/XgOUE9yyKGGA2OIhReD7Xkh

C:\Users\user\Downloads\GNLQNHOLWB.docx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.9915438620427
Encrypted:	false
SSDEEP:	48:UrnTzdRfd3KCK1Ac7djrjfDYFtUr1nLCTkWd:UrnT5VYtrjrj7Yv01Lad
MD5:	620114139207088EAB827DC5FF27064F
SHA1:	6539A4A820DE8E6CFA28DBD35ABAE56A7A13F655
SHA-256:	E876F7C5981B6036BECCB39271E2D2A38BD499988322086B123F09A5B84DCFBC
SHA-512:	C6C9E8A1BBB992DAA97EFD735B4FBE3FDCE5A53B7A0FAB22C7BF03B61C4783533FC9C9EB63E51B5C397EC87B1433AE3801B19A218EFF821AE6474BFF1E319727
Malicious:	false
Preview:	<EncryptedKey>GtobL02b3NEiTQEGlvQNeZBtTc5rl12jFdYQqUA6/ZyISIZTkRM/PLatWEgxqyGIX6THTtHuyZ5xoVEwqd34vJCuxsZvI2nWJgy16PX40Zw+EpK+xfV+OjG7x2VimfpKZWgpjey4W/wJ01rypxYY46LIYDXDFr8QwqlENF478i4=<EncryptedKey>8cqdNOoq0pjbY5+s02Qn3ZhocffuPGJxDYL5/AKqqN8Z1QSOi6yD7/tVBgRNLNsU2Oe3vZ7pH4crF+EyPkYfBhPDnUThsBPWdkKaIVFWau816sBU9N7bh8O7s0Akhx3D2uG/fP0/9s+tZsX+OyK2QNa7U4Jn/T4t5O8XxZkYnsqrz62G3H3gCLyByPdmnykUz7uy4QnK973WRSs657yhKtTOpJrp8QqK+Gb6OSxzcsKRmcofSLbjWntbW6BM7fFa991FEM17Y20RMjnPEQdiHILiUBakIQvtZldPViUH7JPyfJojtsBb5cUHaxUTTlYdycULS+Z2Riuv9p8PUVOzkKwoXBQjs0cPuo7xcXz6zaVTdLXiC0ZuubFDUlRJ/YmkbNFK/C9wgw+RQDSVGLnIJE3LwHbXRZOpX+S/S8rwjpBuSjouQj6ggfhXTKgBLRKjnZiByDf1MiNGAm5OGbs6xAsHI9EJbYMFKbem+8REPsbkceQucKUQjQNr4FEZfDJjPh5TFNC912QIMXnFYww2Os9gqQ9Wr3ujQUrymUBajOsvTjLrKP1jY8rkNalqRb9HrLyuMXabvpnafJSydUKCjJmW5HFZyzUCIcRtePR9q4pA7hCIVhIUpQR2dTwvOLlahLXaiZsbHPHHXDD7ZLFAnZQE3WyhrOeKqMQn1UpvwdZhonGCIysYzd/xJS+BKUu4YfCpnzkGX79UCUQ7uJCN9QQPZGPGQhmH7tucajtcyvRcqRjVaTnJliGgBylrMgP6xMF/zwlv/XgOUE9yyKGGA2OIhReD7Xkh

C:\Users\user\Downloads\MIVTQDBATG.mp3

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.991791427199416
Encrypted:	false
SSDEEP:	24:fMfQrEuItpHSHsprYNhQOQCjL4+404A2bPwQhlYRYjcgOpAnJCH/lJRxqP7Xgjby:Uf04pyMmNhrz/v45zVhLZPJC5x3Kjgol
MD5:	B2842B7FFBCAFED2A33A74DB1C56AF35
SHA1:	54448D4321757C6439B1D79FEA5F8763EAA76F84
SHA-256:	C9FEE516AF5042D4B54DDD45CE4E5BD9C9C5A5C64A6148C42E2175A3EF75FE95
SHA-512:	913D84FFF6D1FAB19A10C466C51DAFF876CC90374A85D821F4A9E89FD089D78716DEC79FC90C7E01C36AB754195E2B6899CD9B85CAE277E2ABA9958636BF020D
Malicious:	false
Preview:	<EncryptedKey>FH7UeBolr0Cn/XG6C7VE+WOmAt7Yyet5ujO7L+DW5+YGr5YyklsnftFGx4caMZ1HEXs9vzDggdqbQGa/8nLZPUgIGcpFVTTXZa76HO7lqJGKYNcGKUT/gP6STgpF7/AmaP4Qir0oUM6VxHekLTZ03at08eTOUXOfTr9Jt9g3gdQ=<EncryptedKey>RSxPunGk0vn/ZquSx826w9/DPqL9uyQzyoIHazy5HZ8gDx53kGmWA3p+hQILtOvtw9WwDGHkOnfsvJBkjNCPqfEobuq1TVZyGa0sk4KAZ4V9oDROp1T472FtUniT/jFqVx0bdX1sLTlX6Pi4x9mPVyYlPQHGNshaatyO66Nc27IM4Wa4o+M1rXBGU5iDsINDzmJ6o04xZLnkwyQqKITtlI/7A3yym2FNWH5+A0mlw2AbxlbUYLfPbMoInVkZZz6k89VI6GRWOMrpTDHdKdGsRQGBJ13GJ1hK+w41JJbQIUeIj1xIv/IHTYLFi2ehJRTEDIT4vqEXYrYV0UO0jNodnI0wHcdyVNVLZvQgLJ/RzdOT3k+LFy0FpvFv44CqCQMgOAKxakWstsLxSFSvBOjkPQg93lkYtSObBh7/odyu8uKMezh45NfKiUS8q9MnNamMuRVoxmgWge99YVo+1BmbjypFhbGw8bwFShLLgNSwUDitI4dQYhUmxm31c4op+xnR0Fa9Zj/pcwRZr5hkFW1ilx12e3f1UyRxVD8Aea4tzL57ytaIhaMgJvqqtz6BtVv19Y8zbDExNCm8+rpOT0/Nze44dXwX/TwChL4vxp0lsSicEh3IxufQQh1zUKpM5k/+J1UBH8wGbyjmbC02ZYi1k2FQymUtCJM7pQsqyb8U+5p2aHN5BTCHox0jNbgTkmVkdZ7k7OaJI0nKj55CXSOyQz/B/STnAO2Ue3EXRiIH85IHw4S2ZcL+b7kloUk/RctC4vkqaKhly3nnS15tsS4cq8B79SsHP1cq

C:\Users\user\Downloads\MIVTQDBATG.mp3.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.991791427199416
Encrypted:	false
SSDEEP:	24:fMfQrEuItpHSHsprYNhQOQCjL4+404A2bPwQhlYRYjcgOpAnJCH/lJRxqP7Xgjby:Uf04pyMmNhrz/v45zVhLZPJC5x3Kjgol
MD5:	B2842B7FFBCAFED2A33A74DB1C56AF35
SHA1:	54448D4321757C6439B1D79FEA5F8763EAA76F84
SHA-256:	C9FEE516AF5042D4B54DDD45CE4E5BD9C9C5A5C64A6148C42E2175A3EF75FE95
SHA-512:	913D84FFF6D1FAB19A10C466C51DAFF876CC90374A85D821F4A9E89FD089D78716DEC79FC90C7E01C36AB754195E2B6899CD9B85CAE277E2ABA9958636BF020D
Malicious:	false
Preview:	<EncryptedKey>FH7UeBolr0Cn/XG6C7VE+WOmAt7Yyet5ujO7L+DW5+YGr5YyklsnftFGx4caMZ1HEXs9vzDggdqbQGa/8nLZPUgIGcpFVTTXZa76HO7lqJGKYNcGKUT/gP6STgpF7/AmaP4Qir0oUM6VxHekLTZ03at08eTOUXOfTr9Jt9g3gdQ=<EncryptedKey>RSxPunGk0vn/ZquSx826w9/DPqL9uyQzyoIHazy5HZ8gDx53kGmWA3p+hQILtOvtw9WwDGHkOnfsvJBkjNCPqfEobuq1TVZyGa0sk4KAZ4V9oDROp1T472FtUniT/jFqVx0bdX1sLTlX6Pi4x9mPVyYlPQHGNshaatyO66Nc27IM4Wa4o+M1rXBGU5iDsINDzmJ6o04xZLnkwyQqKITtlI/7A3yym2FNWH5+A0mlw2AbxlbUYLfPbMoInVkZZz6k89VI6GRWOMrpTDHdKdGsRQGBJ13GJ1hK+w41JJbQIUeIj1xIv/IHTYLFi2ehJRTEDIT4vqEXYrYV0UO0jNodnI0wHcdyVNVLZvQgLJ/RzdOT3k+LFy0FpvFv44CqCQMgOAKxakWstsLxSFSvBOjkPQg93lkYtSObBh7/odyu8uKMezh45NfKiUS8q9MnNamMuRVoxmgWge99YVo+1BmbjypFhbGw8bwFShLLgNSwUDitI4dQYhUmxm31c4op+xnR0Fa9Zj/pcwRZr5hkFW1ilx12e3f1UyRxVD8Aea4tzL57ytaIhaMgJvqqtz6BtVv19Y8zbDExNCm8+rpOT0/Nze44dXwX/TwChL4vxp0lsSicEh3IxufQQh1zUKpM5k/+J1UBH8wGbyjmbC02ZYi1k2FQymUtCJM7pQsqyb8U+5p2aHN5BTCHox0jNbgTkmVkdZ7k7OaJI0nKj55CXSOyQz/B/STnAO2Ue3EXRiIH85IHw4S2ZcL+b7kloUk/RctC4vkqaKhly3nnS15tsS4cq8B79SsHP1cq

C:\Users\user\Downloads\OVWVVIANZH.jpg

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.989899768020233
Encrypted:	false
SSDEEP:	48:UmFfd/5zJlqz+nnYKQ5VsZIhVkxEn/QdNfW7gc:Uix8K4/ymnGW7gc
MD5:	FDEC58BEC0582363799E352ACBE0CD81
SHA1:	736C7633EAB22E73D1CA31C17D8815D2FDABFE5A
SHA-256:	281FF350C6E4889276672DB6E95C9CE5EB37B89824CBFD9776E74DEE1CE0BBCF
SHA-512:	9565F68486E97DD7E854743F18FA3866044EDD67FB1C2D1100131E0915700B381AB4F44823287B95476AAFF25B6A21875CA5D49EF7390C110744969F817DAB7F
Malicious:	false
Preview:	<EncryptedKey>BiaIewJc5KG1ALioytpGinCIOPpiR0sGVcp3lgtTyJMSOxvaB1oZvvfG+ZzTN0PyoS1qzCuHC7HF6//S9EjuvaNL4vIVZZpKEbzgQdIyrqu5mYmAH3OzR8LNQRpN09RfpqnQZ0o/nTGBztlIH1M+ks3Rn8tOgGJE516Lex9O5VQ=<EncryptedKey>TVrOXutjnXKBaPkXVwMjG1YZCTSz9NuFMyb2Nhk/mXWE1bsDGdXfFhYEHMLiiSQoC+aOBtwZEoPCO5V0clYqBttGEo7lsxFbiZw9cKeIuGuWKS1Sd/OD+nYiVNSH5o2KjTS5h8JMdi3OOOs55STcYSHgZNNIQuh5BEDml/AI+Bn5I0HBrQtpW2SEVheoTIV4u+UG4kgN4iiCkjUvRmVijQMvUbeaGQKhtiHh5ounz5JMnchfbh8BeTW/cNOZq1eyZ17twfNq3VkNnzV7yxCgWY2yuzLl7zPrx/QIgib70BQt4CRBnANcPVRTjINqghr76EzktAyrIcyGJq839u9+MB5pjAB/Axf/4W1kHLe/vknynw1ljt66574Xms+4I98tM5qC27R1xd8fz9YzLJhCrC3jo9ZLQIvw9SHG499rgIC1UGNkh82XRoX+Q+VC1lWhW9kVxacHQouz7qg4EYFinOzPVypfd0paxemrqx46AvN57CXaGVxe04J6JNzyUNk5240ggMVaGsyNpfPoa6G5O3plsmqTx3QcCz24pk4fYVa0IAsqih7yBqhTIBvB0zdshvzg6V2NN7ArmJG5jIniCJi8ue0hUanjXrbv/jNchQpLdhvuWK0BiEValZVgO3RhUandgIlkEVH27bb/2/qXmKq59w42c/toT+DeWe8lm9igBPmEOoSA2E6PwqdF1WNdfVQKK/LW6/9j47GgKqx8780gdK34OGs19PRAOow2AAM+6oXxIPCpZ6cRnqSpvyr2wlCyxvlMUmNT8b+hxsa4mbE6lcVBvxD3

C:\Users\user\Downloads\OVWVVIANZH.jpg.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.989899768020233
Encrypted:	false
SSDEEP:	48:UmFfd/5zJlqz+nnYKQ5VsZIhVkxEn/QdNfW7gc:Uix8K4/ymnGW7gc
MD5:	FDEC58BEC0582363799E352ACBE0CD81
SHA1:	736C7633EAB22E73D1CA31C17D8815D2FDABFE5A
SHA-256:	281FF350C6E4889276672DB6E95C9CE5EB37B89824CBFD9776E74DEE1CE0BBCF
SHA-512:	9565F68486E97DD7E854743F18FA3866044EDD67FB1C2D1100131E0915700B381AB4F44823287B95476AAFF25B6A21875CA5D49EF7390C110744969F817DAB7F
Malicious:	false
Preview:	<EncryptedKey>BiaIewJc5KG1ALioytpGinCIOPpiR0sGVcp3lgtTyJMSOxvaB1oZvvfG+ZzTN0PyoS1qzCuHC7HF6//S9EjuvaNL4vIVZZpKEbzgQdIyrqu5mYmAH3OzR8LNQRpN09RfpqnQZ0o/nTGBztlIH1M+ks3Rn8tOgGJE516Lex9O5VQ=<EncryptedKey>TVrOXutjnXKBaPkXVwMjG1YZCTSz9NuFMyb2Nhk/mXWE1bsDGdXfFhYEHMLiiSQoC+aOBtwZEoPCO5V0clYqBttGEo7lsxFbiZw9cKeIuGuWKS1Sd/OD+nYiVNSH5o2KjTS5h8JMdi3OOOs55STcYSHgZNNIQuh5BEDml/AI+Bn5I0HBrQtpW2SEVheoTIV4u+UG4kgN4iiCkjUvRmVijQMvUbeaGQKhtiHh5ounz5JMnchfbh8BeTW/cNOZq1eyZ17twfNq3VkNnzV7yxCgWY2yuzLl7zPrx/QIgib70BQt4CRBnANcPVRTjINqghr76EzktAyrIcyGJq839u9+MB5pjAB/Axf/4W1kHLe/vknynw1ljt66574Xms+4I98tM5qC27R1xd8fz9YzLJhCrC3jo9ZLQIvw9SHG499rgIC1UGNkh82XRoX+Q+VC1lWhW9kVxacHQouz7qg4EYFinOzPVypfd0paxemrqx46AvN57CXaGVxe04J6JNzyUNk5240ggMVaGsyNpfPoa6G5O3plsmqTx3QcCz24pk4fYVa0IAsqih7yBqhTIBvB0zdshvzg6V2NN7ArmJG5jIniCJi8ue0hUanjXrbv/jNchQpLdhvuWK0BiEValZVgO3RhUandgIlkEVH27bb/2/qXmKq59w42c/toT+DeWe8lm9igBPmEOoSA2E6PwqdF1WNdfVQKK/LW6/9j47GgKqx8780gdK34OGs19PRAOow2AAM+6oXxIPCpZ6cRnqSpvyr2wlCyxvlMUmNT8b+hxsa4mbE6lcVBvxD3

C:\Users\user\Downloads\UBVUNTSCZJ.jpg

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.989258575212948
Encrypted:	false
SSDEEP:	48:UN8FC+4QsytD0tV1z3jrkoEuT047tQLLxnX+MEhn:UN0C+4QNWz1DUoz047tQpOMEhn
MD5:	57DFB056F39E092170B2F0209BA92D1D
SHA1:	B484A0F44ECAC02CAC586CA9FC5B7D2724B0CAD6
SHA-256:	02AC7632C17A6C433EEAFC1AAB743F8FC6C963C88F74C1AE5667DD986E639FDE
SHA-512:	0A69CD57F3802C0354F11E49936F6D55EFC1E48FE6D767E868B8192244C105C22A2B1674794E699A3EE270EF4139E0B2F880D468F4AE1A5FCA264A2B797A91B8
Malicious:	false
Preview:	<EncryptedKey>ipM7/zvqN7vFU7JovUFXBkAORFw/v6SkUDK62J9IsZlRnmq4GSLV3gomkH9K9jx/wWcRRsYo/EeMa7Rxy9eKt1MjfaGxrV0sU9etwX4Lk2qZ/dG9wXvD5SdoEeUKNUTL0zPRWUGgmTFuSsVbH32se9zNkfwFgcXIgM9LeIEpV+w=<EncryptedKey>wMPAxfbro20IjmjsIWTwrgfWg0QyIYkqjlZfHLJMeo9Pc7B+UTBBQzLtpqnitw+zE5VhTHRxjqBrcgiZP+jh4eywkHeHgw7lFKQBaagVbXEnu4DT6yi/CpNv0qXXZy7CFkc6h9EvPKubTbP8TKzHPfZy+gczSe2PnBRDe+tEF3kEzAvAmT/X2er+FCiAlQXfmOF5XvmRy0JgueXMDLwFEgxqoBBCvTXRlnLVDWlJtuKLKpOg2d3pBJb7VfBzZ8twWxzapvyz9StOGUb8LH0FV+zThzSPWhbAiYeG0Sa3p7UcAuro0cduZcZ5q4xHOBb6TgLe9y57VsjFXTOvhY+qj04LPHZarrfjFLR/MTqKy+5NTgjie5CTgc7bT28VVekythUPJScZYnHYXHCHAEd7MAGrI4/Bgv4KeHB+tNgUuJmWUFGB5n3fH3DhTEIvh2T0zJopf+wsPTSO84i7t/Mv+nrMf6UV41hWUFB7Bpuui7LOgSzmtRPPlFNLMc2lirCdjjs/Eo62x+CK9h6rv1ytCq3CKcGPXPo6haeveqBT8FJbg+85DkYJErLYmE4u7aj1w4nmvIzD6s/JwO2XW6/mcb2JygcpMOx7YsH9NJTi9/8ggoQTCdjCLM4h4kBz+LhHx1fkJ3ChwF1PL7diEgETKDhWvwXpzgITh5HptGxUSZkYsZL7RFdQaI2x0objsmg5rbKgLVmg2W76HxIfWuH6HV2HzWsdwzyIaAzSeN3Vo+vjdoXqd7P4EbD2av8dlsiyGKSCyZoZjlKDTSIcXck2EDFV76zjLnYr

C:\Users\user\Downloads\UBVUNTSCZJ.jpg.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.989258575212948
Encrypted:	false
SSDEEP:	48:UN8FC+4QsytD0tV1z3jrkoEuT047tQLLxnX+MEhn:UN0C+4QNWz1DUoz047tQpOMEhn
MD5:	57DFB056F39E092170B2F0209BA92D1D
SHA1:	B484A0F44ECAC02CAC586CA9FC5B7D2724B0CAD6
SHA-256:	02AC7632C17A6C433EEAFC1AAB743F8FC6C963C88F74C1AE5667DD986E639FDE
SHA-512:	0A69CD57F3802C0354F11E49936F6D55EFC1E48FE6D767E868B8192244C105C22A2B1674794E699A3EE270EF4139E0B2F880D468F4AE1A5FCA264A2B797A91B8
Malicious:	false
Preview:	<EncryptedKey>ipM7/zvqN7vFU7JovUFXBkAORFw/v6SkUDK62J9IsZlRnmq4GSLV3gomkH9K9jx/wWcRRsYo/EeMa7Rxy9eKt1MjfaGxrV0sU9etwX4Lk2qZ/dG9wXvD5SdoEeUKNUTL0zPRWUGgmTFuSsVbH32se9zNkfwFgcXIgM9LeIEpV+w=<EncryptedKey>wMPAxfbro20IjmjsIWTwrgfWg0QyIYkqjlZfHLJMeo9Pc7B+UTBBQzLtpqnitw+zE5VhTHRxjqBrcgiZP+jh4eywkHeHgw7lFKQBaagVbXEnu4DT6yi/CpNv0qXXZy7CFkc6h9EvPKubTbP8TKzHPfZy+gczSe2PnBRDe+tEF3kEzAvAmT/X2er+FCiAlQXfmOF5XvmRy0JgueXMDLwFEgxqoBBCvTXRlnLVDWlJtuKLKpOg2d3pBJb7VfBzZ8twWxzapvyz9StOGUb8LH0FV+zThzSPWhbAiYeG0Sa3p7UcAuro0cduZcZ5q4xHOBb6TgLe9y57VsjFXTOvhY+qj04LPHZarrfjFLR/MTqKy+5NTgjie5CTgc7bT28VVekythUPJScZYnHYXHCHAEd7MAGrI4/Bgv4KeHB+tNgUuJmWUFGB5n3fH3DhTEIvh2T0zJopf+wsPTSO84i7t/Mv+nrMf6UV41hWUFB7Bpuui7LOgSzmtRPPlFNLMc2lirCdjjs/Eo62x+CK9h6rv1ytCq3CKcGPXPo6haeveqBT8FJbg+85DkYJErLYmE4u7aj1w4nmvIzD6s/JwO2XW6/mcb2JygcpMOx7YsH9NJTi9/8ggoQTCdjCLM4h4kBz+LhHx1fkJ3ChwF1PL7diEgETKDhWvwXpzgITh5HptGxUSZkYsZL7RFdQaI2x0objsmg5rbKgLVmg2W76HxIfWuH6HV2HzWsdwzyIaAzSeN3Vo+vjdoXqd7P4EbD2av8dlsiyGKSCyZoZjlKDTSIcXck2EDFV76zjLnYr

C:\Users\user\Downloads\UBVUNTSCZJ.xlsx

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.98362494494609
Encrypted:	false
SSDEEP:	48:UgmrtNI+oSMAQtYZT9R+xmI7TeuYRWMNhfVh/J9REae:UgmrFo5129y7CjWKFVxRM
MD5:	A4AC7E099934C371F96B609E6FC0C43F
SHA1:	7F0307122AACC54E0983A1C667D249BBEEFD4F64
SHA-256:	6BE81B081DB67C9C3BA6261CB400CC8B4C62F139557FB4305B1A9929F11FEA33
SHA-512:	BD74C3B8D527251A37B7BE13479F057C01CA1DAE802B27A4431DCB41B3E867DCEB8237C55913EAF2DB7446DA3CDAA4DCEA44406B3EF37DD31DB0D5531716A01F
Malicious:	false
Preview:	<EncryptedKey>EQP8Xo/gzbi4fVHrZO7/Zdk9CJ/6Hf7qw2qzWXusxJTRICKf287406A1mNBa7smqFuV9ELNnqI77DgmsMjD7gcFanbp5z9DZDiHWRG7LA4VLNGN46jVHMIfHzsHtEwNEMle78VlHChWZRZPgOvHgA3YI5DIGzPpEixGydDms3pg=<EncryptedKey>L02tfMaAH1IH+sNPCLQsi4G8gn1wrYwZffnhB9c5JbprViYfma/cRC+qk7cZ0dYHPY8ZtZe0zXVNxeExQke/5uw02gDWMNWnmXw8kGrHLPJP1h3Q/ZVUDghp1UbEhrBUz6PsdIgLnH4CFL+pNcpaNdVPjDdPkpWiE+pSF6ofgAJJL3NYz0vN/mwrASjLjYM1Ntcyj5gArJ73veYZdAmyZYagHcc+OQ/HA+2T/GfmIB2WQRSHCF+KDdsGzpTNacim6TO+XNiR4cGp4+k978h0wJAP80QxbFVrzicto0nuiS3RG5AQI0cbuomwjuPUb1lpNfPsS9QKBVTTCNRkfsBbrLk1ykvqN40sdZD9iCrYPMcvjBbrmRLapPiwHwUOCp77EXhMwmNBSVOF1gHhTlnJS5YZtrG0b/YP/lr4WIDPB9XPox6UomTQ8yGCjX6s4M1lxxZPWJKVXyapYMh6Hd5cnpvqNzwt92wwChpZikpi9Bg+gOII+H0MOvLKaMMtHqEzF5nR7nu8LIV5CDvVEgLPGsoS7c+G0cgjW0y+GyO0QzooaGHJQEaq0kY6lUC9N89H7O55XSN3a3KLkXlbcrmc8dC+vmTfA3mpXQuFu0CV7fDQzYaa7fH62YmrEzYlhmWpMbyfdXy00qkF8B/6it7IpwKpsFb9STjqwi10xvHLr3imwBSsl8GI1Z+ZCSjPAwyT2lXPuGaX5sDBH1dP0KNMbXpq1sCiCycsHv7ZTSOiN0CyfCuHSaabiTU5H3mSDWNP1JqTGkNE47EGhtiFW/d1BBvyejbWf0fq

C:\Users\user\Downloads\UBVUNTSCZJ.xlsx.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.98362494494609
Encrypted:	false
SSDEEP:	48:UgmrtNI+oSMAQtYZT9R+xmI7TeuYRWMNhfVh/J9REae:UgmrFo5129y7CjWKFVxRM
MD5:	A4AC7E099934C371F96B609E6FC0C43F
SHA1:	7F0307122AACC54E0983A1C667D249BBEEFD4F64
SHA-256:	6BE81B081DB67C9C3BA6261CB400CC8B4C62F139557FB4305B1A9929F11FEA33
SHA-512:	BD74C3B8D527251A37B7BE13479F057C01CA1DAE802B27A4431DCB41B3E867DCEB8237C55913EAF2DB7446DA3CDAA4DCEA44406B3EF37DD31DB0D5531716A01F
Malicious:	false
Preview:	<EncryptedKey>EQP8Xo/gzbi4fVHrZO7/Zdk9CJ/6Hf7qw2qzWXusxJTRICKf287406A1mNBa7smqFuV9ELNnqI77DgmsMjD7gcFanbp5z9DZDiHWRG7LA4VLNGN46jVHMIfHzsHtEwNEMle78VlHChWZRZPgOvHgA3YI5DIGzPpEixGydDms3pg=<EncryptedKey>L02tfMaAH1IH+sNPCLQsi4G8gn1wrYwZffnhB9c5JbprViYfma/cRC+qk7cZ0dYHPY8ZtZe0zXVNxeExQke/5uw02gDWMNWnmXw8kGrHLPJP1h3Q/ZVUDghp1UbEhrBUz6PsdIgLnH4CFL+pNcpaNdVPjDdPkpWiE+pSF6ofgAJJL3NYz0vN/mwrASjLjYM1Ntcyj5gArJ73veYZdAmyZYagHcc+OQ/HA+2T/GfmIB2WQRSHCF+KDdsGzpTNacim6TO+XNiR4cGp4+k978h0wJAP80QxbFVrzicto0nuiS3RG5AQI0cbuomwjuPUb1lpNfPsS9QKBVTTCNRkfsBbrLk1ykvqN40sdZD9iCrYPMcvjBbrmRLapPiwHwUOCp77EXhMwmNBSVOF1gHhTlnJS5YZtrG0b/YP/lr4WIDPB9XPox6UomTQ8yGCjX6s4M1lxxZPWJKVXyapYMh6Hd5cnpvqNzwt92wwChpZikpi9Bg+gOII+H0MOvLKaMMtHqEzF5nR7nu8LIV5CDvVEgLPGsoS7c+G0cgjW0y+GyO0QzooaGHJQEaq0kY6lUC9N89H7O55XSN3a3KLkXlbcrmc8dC+vmTfA3mpXQuFu0CV7fDQzYaa7fH62YmrEzYlhmWpMbyfdXy00qkF8B/6it7IpwKpsFb9STjqwi10xvHLr3imwBSsl8GI1Z+ZCSjPAwyT2lXPuGaX5sDBH1dP0KNMbXpq1sCiCycsHv7ZTSOiN0CyfCuHSaabiTU5H3mSDWNP1JqTGkNE47EGhtiFW/d1BBvyejbWf0fq

C:\Users\user\Downloads\WHZAGPPPLA.mp3

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.991220522071015
Encrypted:	false
SSDEEP:	48:Utl4w4gaM/3RYCDxvNEVd/9tkICVsyzqkn:Utewb3RlDxvidbkTiyP
MD5:	A2423CE1FE9E7A1D30C0869DC082E98C
SHA1:	C6F7004EA4AE45BCAF981B9AE73E56E77A7D9B32
SHA-256:	6FD4A5AAE4411810878C789B2DEC55E8661B0191ECB57A688212F2584BC0F969
SHA-512:	59264BBA02CA20812D0A959E2D8421C43BF64CA409017291AE3A0D1750423A6C7CCA07D8BC44C1596EC33A79EBA27E80309630657DC0B38FC95E1078FEA9B32F
Malicious:	false
Preview:	<EncryptedKey>WlCmX2j8dtD3o5ZN8Ot2AQE6fQ7fMvse6pLEVdrH2JCQAj9AYgykw4S+oIQhfPwzC1FxUsS6MyDxG5LmkRd32tx6tyTeGVAqX/fAXq4a0pmT93Cwxsdooai72ylw0mOZbFR7JydrAGBNX/0O1fKQSeNlTipqtRPTjXRPRZMsC6I=<EncryptedKey>xyOUKpbJq7dBt18jW/T0Rh7NSa8nz76OaU2E7hK3giBmH41R0WnLcDS4zKmuDObdyQrY+vBL5duLZ9uK8kVt4ckyviOJ16Gr0n0vXJhxYkswe3UA3sJ/YU4Up1E0zZHFKXaInF8LZJLcUxgu/uSGONz4glkNnC3jO+nBDgxC9YkbPnWwhDalV4FYNy1P/QcupvrfzuaEf80XQ7u7uxh1S7fmV73U0Uu/kpa/ZEkQwUF4EIuzaVMJOTBIKybBw4tbPUBVSPsDBM9VsvTKjvz6aiJYOaOgFeuc0mbnoa8CoYpnExWJIa9MxVuR/ug+UuQXDHOGCG/+rkekLaY7/kwwhFU/xlnmb130BMVSrTdwcRE5h6oI1xSGaW/40nnLt5WFPPMSgiHYP5gPy+1ghFK4fhAyvHMljndyD5NGoJfzDgh0ByL4aqT3MJNsQJwuzpgeZnDgnjAoI0AQyaKuftKnDBpO1S3LKXChkz3PXA3DTGkCl9d6Udve2S3NLQprI2uhgBMplkg3A+s7IJRHwW8eKY6AyS5wyEu4W6B+zXr1aTTpAZT73YwJxhic3gse2qEpFwGsgUKmKFO+G17Dp7bv+6leB2vleC1zt+cATZmEd/VR0nWThh4xzl6LMONZt6bXpHGj7A5QiuxVGNpIsmMD2YMA4KCNtUZrInqZTnLobprAP4oePd8n7cn1D47dW3CEtz8wN3s2QX70jCca0WzLy84PQ9568jwHLIvuD8g9oUANIcMP7gXrv/blzAj39jYoaQql7YBIP5tDB+0AXT7j+2+5oEKvyFdy

C:\Users\user\Downloads\WHZAGPPPLA.mp3.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.991220522071015
Encrypted:	false
SSDEEP:	48:Utl4w4gaM/3RYCDxvNEVd/9tkICVsyzqkn:Utewb3RlDxvidbkTiyP
MD5:	A2423CE1FE9E7A1D30C0869DC082E98C
SHA1:	C6F7004EA4AE45BCAF981B9AE73E56E77A7D9B32
SHA-256:	6FD4A5AAE4411810878C789B2DEC55E8661B0191ECB57A688212F2584BC0F969
SHA-512:	59264BBA02CA20812D0A959E2D8421C43BF64CA409017291AE3A0D1750423A6C7CCA07D8BC44C1596EC33A79EBA27E80309630657DC0B38FC95E1078FEA9B32F
Malicious:	false
Preview:	<EncryptedKey>WlCmX2j8dtD3o5ZN8Ot2AQE6fQ7fMvse6pLEVdrH2JCQAj9AYgykw4S+oIQhfPwzC1FxUsS6MyDxG5LmkRd32tx6tyTeGVAqX/fAXq4a0pmT93Cwxsdooai72ylw0mOZbFR7JydrAGBNX/0O1fKQSeNlTipqtRPTjXRPRZMsC6I=<EncryptedKey>xyOUKpbJq7dBt18jW/T0Rh7NSa8nz76OaU2E7hK3giBmH41R0WnLcDS4zKmuDObdyQrY+vBL5duLZ9uK8kVt4ckyviOJ16Gr0n0vXJhxYkswe3UA3sJ/YU4Up1E0zZHFKXaInF8LZJLcUxgu/uSGONz4glkNnC3jO+nBDgxC9YkbPnWwhDalV4FYNy1P/QcupvrfzuaEf80XQ7u7uxh1S7fmV73U0Uu/kpa/ZEkQwUF4EIuzaVMJOTBIKybBw4tbPUBVSPsDBM9VsvTKjvz6aiJYOaOgFeuc0mbnoa8CoYpnExWJIa9MxVuR/ug+UuQXDHOGCG/+rkekLaY7/kwwhFU/xlnmb130BMVSrTdwcRE5h6oI1xSGaW/40nnLt5WFPPMSgiHYP5gPy+1ghFK4fhAyvHMljndyD5NGoJfzDgh0ByL4aqT3MJNsQJwuzpgeZnDgnjAoI0AQyaKuftKnDBpO1S3LKXChkz3PXA3DTGkCl9d6Udve2S3NLQprI2uhgBMplkg3A+s7IJRHwW8eKY6AyS5wyEu4W6B+zXr1aTTpAZT73YwJxhic3gse2qEpFwGsgUKmKFO+G17Dp7bv+6leB2vleC1zt+cATZmEd/VR0nWThh4xzl6LMONZt6bXpHGj7A5QiuxVGNpIsmMD2YMA4KCNtUZrInqZTnLobprAP4oePd8n7cn1D47dW3CEtz8wN3s2QX70jCca0WzLy84PQ9568jwHLIvuD8g9oUANIcMP7gXrv/blzAj39jYoaQql7YBIP5tDB+0AXT7j+2+5oEKvyFdy

C:\Users\user\Downloads\WHZAGPPPLA.pdf

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.984368765407652
Encrypted:	false
SSDEEP:	48:U/2NE0i7iKWdz7i8drWX40vAElnHvzUoR83C3YU3LPff31:U/2WJ7il7iCCo04GPzBRCC33LPffl
MD5:	8EBDCA6E6C155B1E32A12A824C790294
SHA1:	AF519FBACF0DFA656BAE2F464D409FC6ACA51C27
SHA-256:	0B7641CA53A403AA9A154563D395DF0EF3CECBFB933A8C2A7F1476EA35ED31F8
SHA-512:	B592AA9F20B2C7D6A205D740E122F52E4403D9F5563298A154BE7FA6DD630018C7B77F2A542E24A879F0E4EBBE922CA7E59631E918D62138B02487AD419C145A
Malicious:	false
Preview:	<EncryptedKey>cjB48d5Q8m3dm9dzQKfa7ceWgqKsxtVJrr2d+gkJjUN9gFE5L5QygYQnFCeXJ3+zoNwZ1qvgmcGzUOSAik0wX0lIiK5BXBFX9G9EaYPRVwGpX+ZkTz7brcgMhaXUXIyMZy11YvRKdMVip2UuCArdVT0sfAFQyuZ1hdfCpdAl2ik=<EncryptedKey>sjyWG1HSoKYyQwmOtAFj38sJnYoSCuu4KZE+nAz2SQocepAc+K/yAbOs/riEo4FiYDtoRXN0m4d01ed1RCniHXsdJ4ikhVgt3czehN4d2tqrKGTsiwaYowQVBK9bT14rE8ATeeZ1hB7J7QBcD4zUiEOQVfTp3WGzgSnIT1QCNlzYGjbTyDN+oZtfjQuBwTKjBtol1otB3axEG6o8WuokMg01HUXecxv+kKuI8RnuPr7i3Rvsjh2+8uRyat9Kt4/y4MCDEpilAUPcuroYVUrYOJoMP7WMio0cLRFXa1DHPIGXbJmNL/4vdZJCQ3kWZhaYBDjvtjdynOszfXCQd9RD2wubWUTzERHz/2i9yyEFNZF6HqvKsdbjFspeioldhYALY0scHPVW2cfIX8uBwBb54ecZ/itla/wDG8dkI1Y03/zi8oGcV/fwWrEt3pMdbNI4Rg241R1eqqbYd4WEC4AlyDtCtVOlkzHMqx9HJGxM03GRfMNWwU2088cHhmZGB/rCB/rKjY7qmQMk8xwqIodN6qVgzWXs2FexOKpgYCHrPE+/cTFdX0PG/qZ9LxrjJvjTZFMXDJNpKxiwhhmkiPnYY7TxYigTlv0q1qUPncUURXNJxv8fapOEdgq3eYeJWI0ufqagr3XnlDHlFUhjNXvNTlSjdWafNg9w5fr0+nyBrKVcPlqtMJhqA/nfFXSqR92ONa8Oy3Xw4K2CgyZoU6x8bD8Wk8DXbAP2o16GfJaLydU8s0svANdpnuHclSZgYLA1gl3DYNnK7pc9tz90fp4taZubalcltvOL

C:\Users\user\Downloads\WHZAGPPPLA.pdf.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1588), with no line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.984368765407652
Encrypted:	false
SSDEEP:	48:U/2NE0i7iKWdz7i8drWX40vAElnHvzUoR83C3YU3LPff31:U/2WJ7il7iCCo04GPzBRCC33LPffl
MD5:	8EBDCA6E6C155B1E32A12A824C790294
SHA1:	AF519FBACF0DFA656BAE2F464D409FC6ACA51C27
SHA-256:	0B7641CA53A403AA9A154563D395DF0EF3CECBFB933A8C2A7F1476EA35ED31F8
SHA-512:	B592AA9F20B2C7D6A205D740E122F52E4403D9F5563298A154BE7FA6DD630018C7B77F2A542E24A879F0E4EBBE922CA7E59631E918D62138B02487AD419C145A
Malicious:	false
Preview:	<EncryptedKey>cjB48d5Q8m3dm9dzQKfa7ceWgqKsxtVJrr2d+gkJjUN9gFE5L5QygYQnFCeXJ3+zoNwZ1qvgmcGzUOSAik0wX0lIiK5BXBFX9G9EaYPRVwGpX+ZkTz7brcgMhaXUXIyMZy11YvRKdMVip2UuCArdVT0sfAFQyuZ1hdfCpdAl2ik=<EncryptedKey>sjyWG1HSoKYyQwmOtAFj38sJnYoSCuu4KZE+nAz2SQocepAc+K/yAbOs/riEo4FiYDtoRXN0m4d01ed1RCniHXsdJ4ikhVgt3czehN4d2tqrKGTsiwaYowQVBK9bT14rE8ATeeZ1hB7J7QBcD4zUiEOQVfTp3WGzgSnIT1QCNlzYGjbTyDN+oZtfjQuBwTKjBtol1otB3axEG6o8WuokMg01HUXecxv+kKuI8RnuPr7i3Rvsjh2+8uRyat9Kt4/y4MCDEpilAUPcuroYVUrYOJoMP7WMio0cLRFXa1DHPIGXbJmNL/4vdZJCQ3kWZhaYBDjvtjdynOszfXCQd9RD2wubWUTzERHz/2i9yyEFNZF6HqvKsdbjFspeioldhYALY0scHPVW2cfIX8uBwBb54ecZ/itla/wDG8dkI1Y03/zi8oGcV/fwWrEt3pMdbNI4Rg241R1eqqbYd4WEC4AlyDtCtVOlkzHMqx9HJGxM03GRfMNWwU2088cHhmZGB/rCB/rKjY7qmQMk8xwqIodN6qVgzWXs2FexOKpgYCHrPE+/cTFdX0PG/qZ9LxrjJvjTZFMXDJNpKxiwhhmkiPnYY7TxYigTlv0q1qUPncUURXNJxv8fapOEdgq3eYeJWI0ufqagr3XnlDHlFUhjNXvNTlSjdWafNg9w5fr0+nyBrKVcPlqtMJhqA/nfFXSqR92ONa8Oy3Xw4K2CgyZoU6x8bD8Wk8DXbAP2o16GfJaLydU8s0svANdpnuHclSZgYLA1gl3DYNnK7pc9tz90fp4taZubalcltvOL

C:\Users\user\Downloads\desktop.ini

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (584), with no line terminators
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.940857920728705
Encrypted:	false
SSDEEP:	12:fMEjPEL0aihCyZtAi44YgdJTAl2dk4JKhPLZ0gSYjxj:fMssL0ThHAi8gdQ6kx9mgSYlj
MD5:	E24F60FE69848930DA0F58A756FA7604
SHA1:	055B48A7742DAFDB093B30575805B71A9486B85D
SHA-256:	5D9C96C8438D7156FC49EB6B2F42BEC1D7F18F6B3C739E9CF304F69CBD1A405E
SHA-512:	433E18571C1A9FFAED67DA8BC86C7C06C0B792B564DDA71A08B25D11D08268B5B858E54A321BF98EC28F46E50A7F673D77675073DD701A6B684921885C86643D
Malicious:	false
Preview:	<EncryptedKey>MHRIKmlIHeu+H2jaOjJX7gRMuieUGN3Qq7zR5Zh8Tiy7es91gDdvZ0LYuv2WJ4gWL5z+hJGWhTJ81dxR7iI4DjztNSi3gTVYpPhRRnSBeb6qR3FJOjZl7s0hC9RMZ1YngeyWxeE4HqVy1cuiM9TB0e5mYNjkjojaXbRF8HCTjw8=<EncryptedKey>m++jFU0zKf1VCxG/g73mHjc9Nm/ykaGKU8bOPEQolqrMoaXicbdvaTbnyPoEiQQgXQ3TDA4SF+yOAJ69VTKXTYitycte0T9vbomc26Z0y9A/xv4Y08YrpydUfTzGwxLUz4x6D0W0WDO5AkYOc8RY0x3u6z1h9E7zcJ0UaR+K0dLqTz7kfcBeSStU6KKACY8f/ssEP4414pksjMZlX/ZUjKoLMdfDeHoboqy43DvJIsyrUegDpHh1+ScIoP0ELT+7qjoTATOokImk7qJfU4hRfsePCjyqHNhQi/MbHT31edeyY8TmglC9XROBbSqcvmrXuZ0+mQ99fvt+T7QcENK5pufnPwP7GTMR4eMmRfxXCAYmwVY3giZNgEpfSln/VyHb

C:\Users\user\Downloads\desktop.ini.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (584), with no line terminators
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.940857920728705
Encrypted:	false
SSDEEP:	12:fMEjPEL0aihCyZtAi44YgdJTAl2dk4JKhPLZ0gSYjxj:fMssL0ThHAi8gdQ6kx9mgSYlj
MD5:	E24F60FE69848930DA0F58A756FA7604
SHA1:	055B48A7742DAFDB093B30575805B71A9486B85D
SHA-256:	5D9C96C8438D7156FC49EB6B2F42BEC1D7F18F6B3C739E9CF304F69CBD1A405E
SHA-512:	433E18571C1A9FFAED67DA8BC86C7C06C0B792B564DDA71A08B25D11D08268B5B858E54A321BF98EC28F46E50A7F673D77675073DD701A6B684921885C86643D
Malicious:	false
Preview:	<EncryptedKey>MHRIKmlIHeu+H2jaOjJX7gRMuieUGN3Qq7zR5Zh8Tiy7es91gDdvZ0LYuv2WJ4gWL5z+hJGWhTJ81dxR7iI4DjztNSi3gTVYpPhRRnSBeb6qR3FJOjZl7s0hC9RMZ1YngeyWxeE4HqVy1cuiM9TB0e5mYNjkjojaXbRF8HCTjw8=<EncryptedKey>m++jFU0zKf1VCxG/g73mHjc9Nm/ykaGKU8bOPEQolqrMoaXicbdvaTbnyPoEiQQgXQ3TDA4SF+yOAJ69VTKXTYitycte0T9vbomc26Z0y9A/xv4Y08YrpydUfTzGwxLUz4x6D0W0WDO5AkYOc8RY0x3u6z1h9E7zcJ0UaR+K0dLqTz7kfcBeSStU6KKACY8f/ssEP4414pksjMZlX/ZUjKoLMdfDeHoboqy43DvJIsyrUegDpHh1+ScIoP0ELT+7qjoTATOokImk7qJfU4hRfsePCjyqHNhQi/MbHT31edeyY8TmglC9XROBbSqcvmrXuZ0+mQ99fvt+T7QcENK5pufnPwP7GTMR4eMmRfxXCAYmwVY3giZNgEpfSln/VyHb

C:\Users\user\Favorites\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\Favorites\Links\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\Favorites\Links\desktop.ini

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (328), with no line terminators
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.91109236842114
Encrypted:	false
SSDEEP:	6:UGMEUa5F2m/pPW8ZNYO0tst4rFCqTq0UBDNDKlEOKL3kVjBPAOeGhfpxvPzpCpJL:fMEj5FBxPZNY9sG0qO0SAKL0oGFzIPKW
MD5:	83DE9F872565A9E02E6D88A1056C1ABD
SHA1:	517F1A9A79BD8341406FCE7FBB5FA0A154892496
SHA-256:	25DC140E281753A1239915FBEC03D9EB6CD7C4C2001CAA3D7A6B63F9460D72B9
SHA-512:	821861F050F8E0607FA8A00465E781B2DBDF9C35277F149F6FB628922A542C4725CC3CD3CAD745719B4CA435282737D7BACD62B04FD998F1E36C57A3D52C3CB5
Malicious:	false
Preview:	<EncryptedKey>VzKFW+goKk+knfooX8fwBB7uJYA6IrJ0+zZVCbZ26UejTum3JTBPZR5hV/NgksPgwBTfwgypt+CXxc7hMndJRwG+ZGIlG04O0pud33Qam6IdNFMsh3q87YQ8LdB/NsiybD4jj1SDqTViAk3GFnxpWy2Of1h1a1IOjP0khMpVjYE=<EncryptedKey>b0isfzS7XtJBM2VlD1IZNg4mzPkuxh4uReon1KS9SSrBW8QWpo22AdQd4m2uZo4nWC5+clOu777zFCGTdtIvjVMfI/JxhVrjNeQJ9fFFlBfflWjj+XLkWpAUc8l7xpLf

C:\Users\user\Favorites\Links\desktop.ini.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (328), with no line terminators
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.91109236842114
Encrypted:	false
SSDEEP:	6:UGMEUa5F2m/pPW8ZNYO0tst4rFCqTq0UBDNDKlEOKL3kVjBPAOeGhfpxvPzpCpJL:fMEj5FBxPZNY9sG0qO0SAKL0oGFzIPKW
MD5:	83DE9F872565A9E02E6D88A1056C1ABD
SHA1:	517F1A9A79BD8341406FCE7FBB5FA0A154892496
SHA-256:	25DC140E281753A1239915FBEC03D9EB6CD7C4C2001CAA3D7A6B63F9460D72B9
SHA-512:	821861F050F8E0607FA8A00465E781B2DBDF9C35277F149F6FB628922A542C4725CC3CD3CAD745719B4CA435282737D7BACD62B04FD998F1E36C57A3D52C3CB5
Malicious:	false
Preview:	<EncryptedKey>VzKFW+goKk+knfooX8fwBB7uJYA6IrJ0+zZVCbZ26UejTum3JTBPZR5hV/NgksPgwBTfwgypt+CXxc7hMndJRwG+ZGIlG04O0pud33Qam6IdNFMsh3q87YQ8LdB/NsiybD4jj1SDqTViAk3GFnxpWy2Of1h1a1IOjP0khMpVjYE=<EncryptedKey>b0isfzS7XtJBM2VlD1IZNg4mzPkuxh4uReon1KS9SSrBW8QWpo22AdQd4m2uZo4nWC5+clOu777zFCGTdtIvjVMfI/JxhVrjNeQJ9fFFlBfflWjj+XLkWpAUc8l7xpLf

C:\Users\user\Favorites\desktop.ini

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (756), with no line terminators
Category:	dropped
Size (bytes):	756
Entropy (8bit):	5.968239290342242
Encrypted:	false
SSDEEP:	12:fMEJ5mfCoT6JnR0n/2g9x/tRv14e4t3iUvI2MeFZXtDXKEjUj6iDKBKYhLSB8SGL:fMcQfVjn/2Yfd4es3iYr/tX0CBZSB89/
MD5:	DA40BC6935730732684BB6CE4E3D9689
SHA1:	474B7A159D703DAD3D982FC83D475B378AAD1250
SHA-256:	FC559AFC2098F997F5E5B265CA273520CB59A31429F1244FDF8D098E765B5836
SHA-512:	336C14B5DB2999CE9752D7FE03E5E54B9622638EA4DE681D1CFE4510D570122EF01216CF0B89E832DF0EB11BB7C0CB2671D0E43049BAF037D23989C344ADD9C8
Malicious:	false
Preview:	<EncryptedKey>I7KE+SDqJbb6rjLHJEgjnt54SaLcRKTd/1nWu+N+z8eNyY1OCTBz7xx2NXImAvBtSH8JXThZeq8JsWFDNeoffvx0CPLoHPYn20nBGQeNju4dycvhr4488MU53wN5ExMdb/kA8viXJjprg6e9NCQEnqVnAbQaUjQGDcXo/ycfOv8=<EncryptedKey>MGrC9PSFAQ8oANeZPLvooRuVsNRoTC7Wh83ZyQllejcACzcSSUQ2ZfTPRXErNdYUpV6hhk6fH4PtdWdGUa02eLsixe+VLIcUaDP4cCDES56guf4fUo/fmMNnpR7E70XEipRapW89ZqPxKveV3iz4Z2fKQNJa5edxUqKlVzARbAWKvCgObw69pbCd46+37yPCKe8qi7VGsuOGMOuBvmMEeV0Y4c1GbSbiN45nRLmYkD/iUBV2s99rZTYJ76kQEL2Khwo3fTg/C31m/GTO8JnEgkD85uACh846yKOx2jr+KbYz7DAYlGKXurEkT6JdT0UMZI64sLCJdjiuIX/08puO9obsZpszlObCgKQ78s5dckGVMqgGO/WdCNvoZdVse6Owbmu7Fr1En+h6XWjHOQ6amxGp1riv4GQ1aBsT2Fin8hibBDy7a7cRbhcc3VcjJEnZHdcxg04/jrSHlRC+FOBZPgYA5O6Q1Yw7XiYnSkCL1URrbxOojnlWdfIbbQR+mfsjR72LUGxRLL0VW5m/19ZeV/oNY/YYx7PSw4CwdbODHis=

C:\Users\user\Favorites\desktop.ini.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (756), with no line terminators
Category:	dropped
Size (bytes):	756
Entropy (8bit):	5.968239290342242
Encrypted:	false
SSDEEP:	12:fMEJ5mfCoT6JnR0n/2g9x/tRv14e4t3iUvI2MeFZXtDXKEjUj6iDKBKYhLSB8SGL:fMcQfVjn/2Yfd4es3iYr/tX0CBZSB89/
MD5:	DA40BC6935730732684BB6CE4E3D9689
SHA1:	474B7A159D703DAD3D982FC83D475B378AAD1250
SHA-256:	FC559AFC2098F997F5E5B265CA273520CB59A31429F1244FDF8D098E765B5836
SHA-512:	336C14B5DB2999CE9752D7FE03E5E54B9622638EA4DE681D1CFE4510D570122EF01216CF0B89E832DF0EB11BB7C0CB2671D0E43049BAF037D23989C344ADD9C8
Malicious:	false
Preview:	<EncryptedKey>I7KE+SDqJbb6rjLHJEgjnt54SaLcRKTd/1nWu+N+z8eNyY1OCTBz7xx2NXImAvBtSH8JXThZeq8JsWFDNeoffvx0CPLoHPYn20nBGQeNju4dycvhr4488MU53wN5ExMdb/kA8viXJjprg6e9NCQEnqVnAbQaUjQGDcXo/ycfOv8=<EncryptedKey>MGrC9PSFAQ8oANeZPLvooRuVsNRoTC7Wh83ZyQllejcACzcSSUQ2ZfTPRXErNdYUpV6hhk6fH4PtdWdGUa02eLsixe+VLIcUaDP4cCDES56guf4fUo/fmMNnpR7E70XEipRapW89ZqPxKveV3iz4Z2fKQNJa5edxUqKlVzARbAWKvCgObw69pbCd46+37yPCKe8qi7VGsuOGMOuBvmMEeV0Y4c1GbSbiN45nRLmYkD/iUBV2s99rZTYJ76kQEL2Khwo3fTg/C31m/GTO8JnEgkD85uACh846yKOx2jr+KbYz7DAYlGKXurEkT6JdT0UMZI64sLCJdjiuIX/08puO9obsZpszlObCgKQ78s5dckGVMqgGO/WdCNvoZdVse6Owbmu7Fr1En+h6XWjHOQ6amxGp1riv4GQ1aBsT2Fin8hibBDy7a7cRbhcc3VcjJEnZHdcxg04/jrSHlRC+FOBZPgYA5O6Q1Yw7XiYnSkCL1URrbxOojnlWdfIbbQR+mfsjR72LUGxRLL0VW5m/19ZeV/oNY/YYx7PSw4CwdbODHis=

C:\Users\user\Links\Desktop.lnk

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (884), with no line terminators
Category:	dropped
Size (bytes):	884
Entropy (8bit):	5.982360763189576
Encrypted:	false
SSDEEP:	24:fMVp12DGekhcI/F7q4SoDMAfTBBBVRDzaowLn:U4DZVI/5IovfTndDza9
MD5:	8FE4CC95CA01C64F130539E309C5D0ED
SHA1:	E284340B058E0D2AD4CF7C185BD79D6EBE773452
SHA-256:	348485AE69228771664EF931290F1B926642B4051213C3A6E4EE9937958D8867
SHA-512:	CD60C36ACA4F48BE4F8766A24A2395B9BD2A7EA737ABE4CC4DD351F227BC9D63984A9CCF43A22A85EB6F97A0C82FECC671FDF146D732EE844971DABC253F5B4A
Malicious:	false
Preview:	<EncryptedKey>JLIDNFXurab0n4Sb9D/gMuWdMoL7b8GwfRs01Nm07KUWJXRpG4VFjt1bvEpbjFFpaftdNeVMZVqateCTZKTKjkJixfRg9/WpZrA3yKkez5LVjTaqm8fF54Bze4Y98tjLuVGSd0JYFtf65Lf3zrQvX2Ss9eyKcDXB6MZ2cnk59ys=<EncryptedKey>fKLJgPUzzswB+0elYRyVUNlwEuiFpyP0hGnfJ4aFu6iyAyQ2mcoffHTid6RgU8ECf8XWGbmmujmBISexDWkQ9LQ+aaLSwQcUPuV2/nnDof73xjcGrOqQhBTS8ZPOA1tLqcEXIP6Ck6aVDWMk8gK3WUcvwednvgYnF1TFzpyravcdHAbqXPga0Zw7+tAg9g2PHE4Ypir4T4PzWJ1ULuiema9oIvZDdzki5lcRyUFMgTwQKJYJrGlrd3B9JHClNtapfTCrXqFwQhttca8QOXFmu6qrm7l9RCql7OyxxZDb9oXUnmNeA1wd8NDBAVjXTbney1tP5zHhAyHw/4aA14GCU5kv7PUOOTXngSPjtppCHygFV555C+ATMYV/psMHuDLfSfAGRRKkXIBwOUTLC+BIc0uKEPUNa0X4Yu2wYQ2SP5YZGlLY8ksS2Zjpe8JkezRipAsGRuK5z6m9+cHRs98/tHc+nkNog4JHidwY67jQgZgt4b0h0MhZZoGM4WIdc4+CclSkTBiHU60VRUwMFmgW3bywYQ7J9FVtvpfj8yBr6jmI0XLkw4oOawMYK8Atjf6f9yg322qPF9Ipuq46aO0XPz8jbnoRRPP/C+S85lVVBL5SV14iPTCJ6tdF+sqnOLoEGzcxM3zskhP1P58q/L7dL1KNPNeQJp7T6QUBfh84XS0=

C:\Users\user\Links\Desktop.lnk.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (884), with no line terminators
Category:	dropped
Size (bytes):	884
Entropy (8bit):	5.982360763189576
Encrypted:	false
SSDEEP:	24:fMVp12DGekhcI/F7q4SoDMAfTBBBVRDzaowLn:U4DZVI/5IovfTndDza9
MD5:	8FE4CC95CA01C64F130539E309C5D0ED
SHA1:	E284340B058E0D2AD4CF7C185BD79D6EBE773452
SHA-256:	348485AE69228771664EF931290F1B926642B4051213C3A6E4EE9937958D8867
SHA-512:	CD60C36ACA4F48BE4F8766A24A2395B9BD2A7EA737ABE4CC4DD351F227BC9D63984A9CCF43A22A85EB6F97A0C82FECC671FDF146D732EE844971DABC253F5B4A
Malicious:	false
Preview:	<EncryptedKey>JLIDNFXurab0n4Sb9D/gMuWdMoL7b8GwfRs01Nm07KUWJXRpG4VFjt1bvEpbjFFpaftdNeVMZVqateCTZKTKjkJixfRg9/WpZrA3yKkez5LVjTaqm8fF54Bze4Y98tjLuVGSd0JYFtf65Lf3zrQvX2Ss9eyKcDXB6MZ2cnk59ys=<EncryptedKey>fKLJgPUzzswB+0elYRyVUNlwEuiFpyP0hGnfJ4aFu6iyAyQ2mcoffHTid6RgU8ECf8XWGbmmujmBISexDWkQ9LQ+aaLSwQcUPuV2/nnDof73xjcGrOqQhBTS8ZPOA1tLqcEXIP6Ck6aVDWMk8gK3WUcvwednvgYnF1TFzpyravcdHAbqXPga0Zw7+tAg9g2PHE4Ypir4T4PzWJ1ULuiema9oIvZDdzki5lcRyUFMgTwQKJYJrGlrd3B9JHClNtapfTCrXqFwQhttca8QOXFmu6qrm7l9RCql7OyxxZDb9oXUnmNeA1wd8NDBAVjXTbney1tP5zHhAyHw/4aA14GCU5kv7PUOOTXngSPjtppCHygFV555C+ATMYV/psMHuDLfSfAGRRKkXIBwOUTLC+BIc0uKEPUNa0X4Yu2wYQ2SP5YZGlLY8ksS2Zjpe8JkezRipAsGRuK5z6m9+cHRs98/tHc+nkNog4JHidwY67jQgZgt4b0h0MhZZoGM4WIdc4+CclSkTBiHU60VRUwMFmgW3bywYQ7J9FVtvpfj8yBr6jmI0XLkw4oOawMYK8Atjf6f9yg322qPF9Ipuq46aO0XPz8jbnoRRPP/C+S85lVVBL5SV14iPTCJ6tdF+sqnOLoEGzcxM3zskhP1P58q/L7dL1KNPNeQJp7T6QUBfh84XS0=

C:\Users\user\Links\Downloads.lnk

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1480), with no line terminators
Category:	dropped
Size (bytes):	1480
Entropy (8bit):	5.983140301757616
Encrypted:	false
SSDEEP:	24:fMqDjrutSvHcwlCTdLKUKuJkZ9XNxAmIvIp9KmX/StgmTHIJmihWdq7:UqDeSvCTMTukZ9jAzwpFiVSmKWI
MD5:	8C507A53A56514C6F32706139CFE2B1E
SHA1:	67CE22C0190611B9F36163064BD340ACED9838B7
SHA-256:	CC02A422D63D1F0BA0E69625DC9DD0E4C3F8D5C16310C888BC62132EE4B87E51
SHA-512:	64439E6EBFB0C9FB14BC5D4C6FA06348A185D6F6FBF249D4B2B77FDC3805E10B8487AC31BF7F10A56C6B0451F170158DDBC6740ED5AF8BA929FA923AB0779CD7
Malicious:	false
Preview:	<EncryptedKey>GgLMBfPmLaSqvpUW7CYjeK2YGJgZi9nVt5zeLrtIjaWp86XpsdvmQ/6JZ9SVNl5jZa+9zoTsvY9Fywj5A/ph0TaB4ZTAMHUT+I3p+RLDJmAWKzzrVdKdOd+zOd3CL5ynG75RK8SS4rk/fpO0HP+NkO0+r9AGPHs9o8hRDfidA4k=<EncryptedKey>Y190HVOPTEXYpC+rw8qeHofxssn2lkr7sFcILWL4cuzU6WYWPT2QhDUxdk8/m2Jt1U0nZ9Ppk0/1hBM35pJ0m0dPnfI8UxgJMjsknMkh1PWy+PgcKoFooTjyYBKvEq3z1g7V+5ZaY0QtOPXxS3rox5N9+k0ti07rpRlni3Ykit1dsW6cPmwLY/qSEPKWxeH4bRu4I0fickA12EC4DL9+egKF2g5j4q0TZDMabzGIqFC/bP56X3964iNhRYwgjfUGfGI3Izu3PtZcj21+g/WXQPW7LxtRGbjt4gzwc/+DCp0+GvMcccsZQxnly9JN3bjPsiHoCacIy/pABCYx/F/0rlcekl1uTMj2ilrtGevCj/MzXqcJV1hvGgYiMUvOHOoMoKWJv6mzZ0EcxmOvDtA6GcVOKhMkV1RiDWl/PakJ76m4kqsEzvmjkZyFzcZ+N5RVKr2WmqbN1X9tddwuPe5sDCPUpI6NKshaZzutu3ZkNh1jQrb2mKvIZ/9YJ+EMS6urxjPKQyrJIssbe8NxZ20VFmXq0wggzt1ZmZmoAJvFdvdxUEZ4L5LriO8O2uyT6qpJdxnyoWLwG1MYaGXBEZgWF9xIdaX59b63UrMBGd/1hackGQY0Z1UYoDljByeDO2KYDYEEyb1K7RXa6ZvYREcbD3ncff5sDOKS+uZmsHFU9MRobyeJCMpnfBKqrokvksUE6mfPPT28v1GcefieLmkJ+MNI+NMLdF+ijFxqpxbcU3q91kCIuAweWSRjtZomEM4mH6tuPV9xhcCASXj/kSrE4Bpp2W46S0Sg

C:\Users\user\Links\Downloads.lnk.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (1480), with no line terminators
Category:	dropped
Size (bytes):	1480
Entropy (8bit):	5.983140301757616
Encrypted:	false
SSDEEP:	24:fMqDjrutSvHcwlCTdLKUKuJkZ9XNxAmIvIp9KmX/StgmTHIJmihWdq7:UqDeSvCTMTukZ9jAzwpFiVSmKWI
MD5:	8C507A53A56514C6F32706139CFE2B1E
SHA1:	67CE22C0190611B9F36163064BD340ACED9838B7
SHA-256:	CC02A422D63D1F0BA0E69625DC9DD0E4C3F8D5C16310C888BC62132EE4B87E51
SHA-512:	64439E6EBFB0C9FB14BC5D4C6FA06348A185D6F6FBF249D4B2B77FDC3805E10B8487AC31BF7F10A56C6B0451F170158DDBC6740ED5AF8BA929FA923AB0779CD7
Malicious:	false
Preview:	<EncryptedKey>GgLMBfPmLaSqvpUW7CYjeK2YGJgZi9nVt5zeLrtIjaWp86XpsdvmQ/6JZ9SVNl5jZa+9zoTsvY9Fywj5A/ph0TaB4ZTAMHUT+I3p+RLDJmAWKzzrVdKdOd+zOd3CL5ynG75RK8SS4rk/fpO0HP+NkO0+r9AGPHs9o8hRDfidA4k=<EncryptedKey>Y190HVOPTEXYpC+rw8qeHofxssn2lkr7sFcILWL4cuzU6WYWPT2QhDUxdk8/m2Jt1U0nZ9Ppk0/1hBM35pJ0m0dPnfI8UxgJMjsknMkh1PWy+PgcKoFooTjyYBKvEq3z1g7V+5ZaY0QtOPXxS3rox5N9+k0ti07rpRlni3Ykit1dsW6cPmwLY/qSEPKWxeH4bRu4I0fickA12EC4DL9+egKF2g5j4q0TZDMabzGIqFC/bP56X3964iNhRYwgjfUGfGI3Izu3PtZcj21+g/WXQPW7LxtRGbjt4gzwc/+DCp0+GvMcccsZQxnly9JN3bjPsiHoCacIy/pABCYx/F/0rlcekl1uTMj2ilrtGevCj/MzXqcJV1hvGgYiMUvOHOoMoKWJv6mzZ0EcxmOvDtA6GcVOKhMkV1RiDWl/PakJ76m4kqsEzvmjkZyFzcZ+N5RVKr2WmqbN1X9tddwuPe5sDCPUpI6NKshaZzutu3ZkNh1jQrb2mKvIZ/9YJ+EMS6urxjPKQyrJIssbe8NxZ20VFmXq0wggzt1ZmZmoAJvFdvdxUEZ4L5LriO8O2uyT6qpJdxnyoWLwG1MYaGXBEZgWF9xIdaX59b63UrMBGd/1hackGQY0Z1UYoDljByeDO2KYDYEEyb1K7RXa6ZvYREcbD3ncff5sDOKS+uZmsHFU9MRobyeJCMpnfBKqrokvksUE6mfPPT28v1GcefieLmkJ+MNI+NMLdF+ijFxqpxbcU3q91kCIuAweWSRjtZomEM4mH6tuPV9xhcCASXj/kSrE4Bpp2W46S0Sg

C:\Users\user\Links\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\Links\desktop.ini

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (884), with no line terminators
Category:	dropped
Size (bytes):	884
Entropy (8bit):	5.972529041645576
Encrypted:	false
SSDEEP:	12:fME72/odU7kibzSF1FgDCuCIiD/OBeiuj9buMrmwWnimVFXdKraNClXl+gr02Fk3:fMFo6ZbgWyL5iuJb5QnimfdYaw+K08c
MD5:	B65A1CD7F72974A8424B30DFB7C4EB24
SHA1:	C93318AF9B817A82BCA4F455200C0A89B1878BB9
SHA-256:	AE406BA8BD473613DC1C0777DE4328D6006C07516BB93A7655EC08E3A0FB38FB
SHA-512:	4D4B34A3F492CFE098F5CBF5413182CA4AD3496018EC9FF99A4014D109C0E0F38B7FCCCDA5B7BDD6FD435E220771BF9083ED1F6E8CF5B621B4AE652C26E6F778
Malicious:	false
Preview:	<EncryptedKey>E/0oUFfVavc/6sRhLYAKaEJsCNe6dwzkdQNh72jDtJKjZxAvlAwK9R2wrCpbQ8ZlzrD0POgv7PAnssiuHqvc2ZaOk+l00msOMUf0rR5X/IeA3VQurUR2Gmo6lfo1aEwZd5madQZnjqJHP1UulNqCQFZu+9G7btRQzfM4F31Q4+M=<EncryptedKey>2AcZXIF/QTaYhRdzhBOFy1NH0+7blJfK/dv1Apu8K3av/D9sJyez8BiALxStd2epVuFGW7+9HtDOm959AupF1/jmu0+KvkHCj5Ow/8nqbj6ej40F+Wxn26vU2+3nYERY7AEA6GU1D3eusEQ9p5Mq3S5WYjIaG6QPYxSz/Hog27bFr01r1nV+P3mZHWFWHBmIJwfI2l0FpBnExA79/0VdFjSdVcyr4F9UhluLahEbb2EXEgmAXAP0swjwaSVMQ7ElUgSHWpjTzhXr9QAv3XFTvvTMkcpydMl6iNZYIAc65O2cexb3lXyJocOBGCPjRrV+2SjjnaOAYfgp14/RkEu/FgNkJeBUuzhLeFfRirgKbKNJtgzHJa0bndMj03bJpRZ6ccn4QTfTrErvMYNGwZZtdKUZf+89ZMarX5YmPMztXorz0mo7rxOwI+pv5unPK3fHYHR2jUvxMRj8jlJLol7OVQC9OdtMwNwy0ZTgFLybU+I4XBkITlH0aha/Eg4Gx8shOYr0TtXr4nB1oTmdNdDU19uaNGdxGhe8l1rcoGFWL7OzDjvQn0MFntST1Qf6VoDd91vK6YZ+QtE3u5aAnOnoRF6joCPjbzcENg6M5vXyfSkkBRcgCsEO37HdtVvFRDynBgVBck8+MmUyKEKR37w+6C5fUo5DF7SA6GnVGvfXCYs=

C:\Users\user\Links\desktop.ini.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (884), with no line terminators
Category:	dropped
Size (bytes):	884
Entropy (8bit):	5.972529041645576
Encrypted:	false
SSDEEP:	12:fME72/odU7kibzSF1FgDCuCIiD/OBeiuj9buMrmwWnimVFXdKraNClXl+gr02Fk3:fMFo6ZbgWyL5iuJb5QnimfdYaw+K08c
MD5:	B65A1CD7F72974A8424B30DFB7C4EB24
SHA1:	C93318AF9B817A82BCA4F455200C0A89B1878BB9
SHA-256:	AE406BA8BD473613DC1C0777DE4328D6006C07516BB93A7655EC08E3A0FB38FB
SHA-512:	4D4B34A3F492CFE098F5CBF5413182CA4AD3496018EC9FF99A4014D109C0E0F38B7FCCCDA5B7BDD6FD435E220771BF9083ED1F6E8CF5B621B4AE652C26E6F778
Malicious:	false
Preview:	<EncryptedKey>E/0oUFfVavc/6sRhLYAKaEJsCNe6dwzkdQNh72jDtJKjZxAvlAwK9R2wrCpbQ8ZlzrD0POgv7PAnssiuHqvc2ZaOk+l00msOMUf0rR5X/IeA3VQurUR2Gmo6lfo1aEwZd5madQZnjqJHP1UulNqCQFZu+9G7btRQzfM4F31Q4+M=<EncryptedKey>2AcZXIF/QTaYhRdzhBOFy1NH0+7blJfK/dv1Apu8K3av/D9sJyez8BiALxStd2epVuFGW7+9HtDOm959AupF1/jmu0+KvkHCj5Ow/8nqbj6ej40F+Wxn26vU2+3nYERY7AEA6GU1D3eusEQ9p5Mq3S5WYjIaG6QPYxSz/Hog27bFr01r1nV+P3mZHWFWHBmIJwfI2l0FpBnExA79/0VdFjSdVcyr4F9UhluLahEbb2EXEgmAXAP0swjwaSVMQ7ElUgSHWpjTzhXr9QAv3XFTvvTMkcpydMl6iNZYIAc65O2cexb3lXyJocOBGCPjRrV+2SjjnaOAYfgp14/RkEu/FgNkJeBUuzhLeFfRirgKbKNJtgzHJa0bndMj03bJpRZ6ccn4QTfTrErvMYNGwZZtdKUZf+89ZMarX5YmPMztXorz0mo7rxOwI+pv5unPK3fHYHR2jUvxMRj8jlJLol7OVQC9OdtMwNwy0ZTgFLybU+I4XBkITlH0aha/Eg4Gx8shOYr0TtXr4nB1oTmdNdDU19uaNGdxGhe8l1rcoGFWL7OzDjvQn0MFntST1Qf6VoDd91vK6YZ+QtE3u5aAnOnoRF6joCPjbzcENg6M5vXyfSkkBRcgCsEO37HdtVvFRDynBgVBck8+MmUyKEKR37w+6C5fUo5DF7SA6GnVGvfXCYs=

C:\Users\user\Music\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\Music\desktop.ini

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (884), with no line terminators
Category:	dropped
Size (bytes):	884
Entropy (8bit):	5.957965132316126
Encrypted:	false
SSDEEP:	24:fMDisRpoUfhdhB0YCc2hvStBA4/IL8EPwH/jvaS:UDisRpJfhvB0YCc2pSnj68vHzaS
MD5:	F00F3A329073C55F11A7530DF33281D6
SHA1:	C39A563144E213A42E392EBDACFA4A415E48281C
SHA-256:	94B89985C96DC7B60615C25C50FD6539074B7DB03EEFA884BB818CD3B0E15A00
SHA-512:	1A16D0FF6694C7365B24FEB3646B112EDC251AA88A0BF8A0A007D858B791B837D7E522C82260A923C0651A40BCF96D79FF19A41121FD544299B8795BBACA9273
Malicious:	false
Preview:	<EncryptedKey>Cq4HielmoaPe46mKifMe0PgaAxb4ZluEwZ06+X8Kr1/G8inSDNArU3aHzsp5/cyOzwlYgvEKyyeNzjF6oAHof5W2Wy9OWz7qNv9NpmWCv9lisOBBXNs+UOfJiRqIRo8MsMRNg5jyCLVEvXXZsR1Y9zJuZQUsUJsWdq1MSxHYW48=<EncryptedKey>EJ3L6W/KAUHw481FBr73msZ6LQ2egjKCIpL/JZ6EK8mOOKi7AxvPBAmRiJ1DSIgMaIZvy+wB81go9E8D8Hxl7eE7Hg7TevD/lRIBrwXvsIauHV3gEu4g/KGZEAnOljmdxa6+FuorL3ImFZ8B5KMNmlgwpG8HIoDVDZ/QWiWpBrUiN31h7wua3LF5MwZYIvyajgiYNpTILjmiCmNwgzSJbqcuWzt82fD+kaLGJH+888JeMWZiY410+mfdI82nrQRuDu3PYTdAADwNsoT1VXpkDNYVEsi7sHys3cNHKJNbCF4S2oqFZtFHkA1g3rYQ6Vr0rC7KU137Q3Po1elEWunM7ZsSFpXWWMpJBNTJdl5bDTiRQDb9U+WbyCWLMk7ns4cNU2SHEhqLYDJMDamjM3Oliinku9Kicg3zsPOfazJhKMLGz2V1D4hOSZ/ziGvMRE10NffL9xF7G6fmcewkz3RiNzJBOAwWJ3rwaeRLAJu6CSyKgw6iB3fMyWvm7GLDKjdg+zFUk7sLLyqtR7EOwaZ6dGrbjFW7JI68f0+1YzTZ/o93868F7QrzJIrjHcTLc544jl1t005vv5up5HXtG+ZVg0c3t2M0s/hNWlj7a4spXNriopQWoTKqfZUKjZAeu6L7X7iXCwByvM5kCwYD9LBmkcQ6xu2JdmDK00y6ua9DXR8=

C:\Users\user\Pictures\Camera Roll\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\Pictures\Camera Roll\desktop.ini

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (456), with no line terminators
Category:	dropped
Size (bytes):	456
Entropy (8bit):	5.944048872237545
Encrypted:	false
SSDEEP:	12:fMEpo7qTKxL2NfnYkX2XKuzroK4VJf8zWHmBZT:fMEmxLYfYewRzroxVJf4SmbT
MD5:	1064246D016B701AA1611D7FB02D668B
SHA1:	65040F606B9DB44C668F5FF049C65AD7F0EAE7E0
SHA-256:	AE23752700E25B513ED246D3A44A32D883D1AEE142D2DA4A57295DAB0F8BBCC1
SHA-512:	21E70F6CD692D6CB10D3710FB0A6C969D6B65CDD9C1ECB71344B9EC0CAE64AE52370CC4EEB575DE4EE0D32D5AE46795F0F11D81831CA1F8A4B1855C8DF26E47F
Malicious:	false
Preview:	<EncryptedKey>L9ItBqZpAETo9SUlxZp2fJX85SlOOsDCbCtJDYY2GbuJ6AWcf5Ituv4znCBJcGXMK7O3+KiMWTJIJGskVDXhNrZ60hyYsAma3zAp3MaO9nDnufLd+x/ZGYSCz3uv5soPfSMf4ZjOS3CcuTa/eHNBjuJxfXE4jp1lZTbekNOb6Pw=<EncryptedKey>WjhYMoID+dwjKJPH3lk6tJx7JAbjY8Ao2EVKIxVunOfB7QTf21HEQZDkeJb+xuzkNzDKmvhPZQvsn0UeRXxydFqOJ1OHivYz0/LB5Q5TxkQyX02S81hx5waQ22LLjoYMCgcJ7CQl6r+WQlpEWgna0seuZ0zw8rEnLkO2A4OqYHyGjQMV7bARwAl6CsXvwR+RmD36YkaN0FAgARzSwi3IJizQXozH1d4wG0qOl48AJhbln84+SglefSlQCvoek8oH

C:\Users\user\Pictures\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\Pictures\desktop.ini

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (884), with no line terminators
Category:	dropped
Size (bytes):	884
Entropy (8bit):	5.977997349947728
Encrypted:	false
SSDEEP:	24:fMgYDNfo2RYq25TPumsYniPY5O2ew8bPb3oY:UTDNAQw5TPumsiWYzmb1
MD5:	2C64EE45BF86A61A4567BE528AF31729
SHA1:	B98181119FCF7B06018390A1EB00D0F3420E8A3D
SHA-256:	7813EF02D7B9330DF43906D6E2E79498D488CFB14DAFA7723EAB21F8A754F598
SHA-512:	BD58DDDDC31E871153866167EF2A236F79013C4AF6CB544CC3D422E53542470572C824AAF39E9AC73446444E2EC070F657FAA0D3221A091C27D9B4DF60FDE62E
Malicious:	false
Preview:	<EncryptedKey>YUkvwDaNzIuzauA2KN9ZnXl2wiQfNp5eKayyEuiMX/lu+H3EXiz5guhL9H0wPdQJ9WZw7RCG3qAO7JFE/MGWWDfCP/aVE4DLq9kaNB30ta4b1qPQ+F21G2nE7PXI3kJEsaicU/+B5/bNPAInIoA4S16HPaNEqYaQn+zznjtkQQw=<EncryptedKey>UYVdxmOrx5XzU/ZapzGDRZoc3d6xgjsn38IHgEIiyGThcObGjYQJLKGMMf70cAvdgAs4rFNuZQRFYZIgXrZEFShVRN5JQozjxQZbxfrbj9IwwK+Fz/aiqRF8QIAQQTcXlyptKK6hTOf4pohbfghonQd0cP8MgDn5x87WUg56asKvnkAhswo0arvlyVUBMTpa4GohF00Ly77oXjx459RuYwxSSpJZqA2eRqrs3pZtSDY+Kd2LNGtZiSM+Sd+4F6OdGandmvwrvYAUoDfv/wDrgO5Q5JLrpRA1ARhWWQS8Hm5cSrit2TsOs1YcOkMME0czHuozPpEk75qPjaz5TCPvdkXyMWekqhu/E6Y7GnfCX0e/SbF64tSgwnWbmdF1gii+sPNJIZjJAIKfQR1ojTMRCqAIHREBzLnlg/+RqCW5N2/z+ON2SWyEhAnGnjOCv4DHj17j5OlZuRX7cHqBwWtph3KOYrsj7nuVBjmYV3OixMqREhuPtrbtGj6y62gdFSuKEeK1RVX7uYRRapAIFDSUfBGnppbYxkVwvrMpL/2o/vmAf+uiEbbJ5jlCyjcx/Y/JBQ/pTVbxjXGP7Yg0TrMQhMSd5WgI6YnJuK42fDl+J/ZCNqvVy2kSps9vDV5cMX1RqzpnJYIUEkGR+PptYNAdX/BPLkol94SwafmM1sDd+oE=

C:\Users\user\Saved Games\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\Saved Games\desktop.ini

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (584), with no line terminators
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.967329145501704
Encrypted:	false
SSDEEP:	12:fME5pemCjdoPVX//SWYhMgBvXhme225wXQ6zZ3lo6SiaXOzrf1KD:fMKQDjEVXSbMgBYiizZ3ldaXOzb1O
MD5:	1C662D2B9C4FA922C1E77DD9BAD0FAB6
SHA1:	B303772B24C17BBD6A4D1A2E810E540D3335133D
SHA-256:	519C8E83B6176CC5EE06657EECE069D42FCB74C09C3F187D531A9628C35DBDC0
SHA-512:	0DB9A64157C6F2EB1EEB8673313A1B52AB501C7325A653CBF91227D64F7DE61FCD2A74A81E753B2FAA1D449D9B8F9C1D0F712F69E4F030F1A6478FB56787CE8D
Malicious:	false
Preview:	<EncryptedKey>nfEo56il2WpO53NxqnXdvy926xB4haiOVOHJ06SAdLTjsTLkbFpaR23x1Y08W5rLhh3Ml7GUIxvDhfbzmyrQF3gEqlbRKBgXFPJjhfESVbNWFGGBe8n4hLzKjMQOq281a2jekWosHkCmnnal2QJBJvRGp0Aec6iu09DKGFZ5sHQ=<EncryptedKey>lz+7XvsGAus7+eufjfJGD3fg7VOtpWibv5ZQ/5q/4vPiUZVuICypTzUNh4AGi+5lEucttwNkxxnHJPDWGVO5nshwcXsYPoNmVGoKY0AYjnqFiTLM+XmbjUD9s29tYDqePGvA5L4bvoUT5dIh3o32atfwf11iLxFyPj+BCasI6ulecTTmCSPTtaxcxTLkLzyPBSZe4siTl+AbY0hRdOE+Sez+fRyT6N35p0CzJIck7jzxNNf7AcDXCGVbDu/DosEojUB792+LROrTTREz77JcNaILwVEXMh47ZfXZk4pvEptqW8ysawMREBUKDEcN72F7x4thoOjgDr218m+Yf/o4oHu5BsOssI0H9WpwxQ+BsLf+/tBJ7XjcWBZbtDo4HztZ

C:\Users\user\Saved Games\desktop.ini.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (584), with no line terminators
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.967329145501704
Encrypted:	false
SSDEEP:	12:fME5pemCjdoPVX//SWYhMgBvXhme225wXQ6zZ3lo6SiaXOzrf1KD:fMKQDjEVXSbMgBYiizZ3ldaXOzb1O
MD5:	1C662D2B9C4FA922C1E77DD9BAD0FAB6
SHA1:	B303772B24C17BBD6A4D1A2E810E540D3335133D
SHA-256:	519C8E83B6176CC5EE06657EECE069D42FCB74C09C3F187D531A9628C35DBDC0
SHA-512:	0DB9A64157C6F2EB1EEB8673313A1B52AB501C7325A653CBF91227D64F7DE61FCD2A74A81E753B2FAA1D449D9B8F9C1D0F712F69E4F030F1A6478FB56787CE8D
Malicious:	false
Preview:	<EncryptedKey>nfEo56il2WpO53NxqnXdvy926xB4haiOVOHJ06SAdLTjsTLkbFpaR23x1Y08W5rLhh3Ml7GUIxvDhfbzmyrQF3gEqlbRKBgXFPJjhfESVbNWFGGBe8n4hLzKjMQOq281a2jekWosHkCmnnal2QJBJvRGp0Aec6iu09DKGFZ5sHQ=<EncryptedKey>lz+7XvsGAus7+eufjfJGD3fg7VOtpWibv5ZQ/5q/4vPiUZVuICypTzUNh4AGi+5lEucttwNkxxnHJPDWGVO5nshwcXsYPoNmVGoKY0AYjnqFiTLM+XmbjUD9s29tYDqePGvA5L4bvoUT5dIh3o32atfwf11iLxFyPj+BCasI6ulecTTmCSPTtaxcxTLkLzyPBSZe4siTl+AbY0hRdOE+Sez+fRyT6N35p0CzJIck7jzxNNf7AcDXCGVbDu/DosEojUB792+LROrTTREz77JcNaILwVEXMh47ZfXZk4pvEptqW8ysawMREBUKDEcN72F7x4thoOjgDr218m+Yf/o4oHu5BsOssI0H9WpwxQ+BsLf+/tBJ7XjcWBZbtDo4HztZ

C:\Users\user\Searches\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\Searches\desktop.ini

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (904), with no line terminators
Category:	dropped
Size (bytes):	904
Entropy (8bit):	5.9832814095733395
Encrypted:	false
SSDEEP:	24:fM00cBFTyDl4muX+F5lAMFwgLKZBZ0WCo2ui:U0VTyDWMb13Lkta
MD5:	70F77FF0BE1D92E0389754EC275D9674
SHA1:	8E3E3CCAB6832FDBCBD469556DFA7A59C8140001
SHA-256:	9307A9B6FE15108B86B636F1392316B3726ACA76034F3499F40C7F286ABD86C2
SHA-512:	2618DA14FFE4D7F6EBC2F11CB2498CBDEF12DF041DF6F6483078AA61D392D207B9BCD1BE9B43B6C87F844969B7C10B118AE6201C52A5CDD2A9DAFF844F655F45
Malicious:	false
Preview:	<EncryptedKey>Nix2PQ6uwxVQYfj3DB03n30m1p0Dp6151jrKk7wucNA/mk02KhDWop/VTCbyDLl+8EEgR4hqO3JykXF6wH0DOymc594WJnOlfParvVd3gtqWjy+8JxawemiVpWcI7a3532aXo8kRnt5wZAfTq9v8V5ki+k8aBWteTHHLlEm5Eg0=<EncryptedKey>JiSlr7vGIj5jZ1rZi89XJkL6bDzuaGGx9Hkig218ZayYCHTdLw7oRHpkljRo78cBxn4RDiydrCMt8kXmUNozv6ED47Fuf9HuOhaJKNtWZcl2d9hgo2GHAaRkYOjawHdslTJvL5Z1Akiw/6vmVteVu9meSx1fWl/3ZiZDK43vLiUFNVm4vdRer/XiTfDkuzqQGAgXsUUDbnI3OT6RvJmuZpRuUhrE04sjs017uufht14i7mfulF5zbyPanwovH5W5vwPbMtKBoxbrns2dn98lUSjIFVUlchwbp+QT6ln8OZNjvk5fmIFHFQBXltRj3jJ7n5PjFnN0TeXHItLHCyvrvTmyBk28q+pSITNCIAeZsb4tOdpJeLsXZc+3SRxL0y33YdKi9wMutOrLzdpfZzrO6JjoBMct2gCzgpem/8mSqt/c3bZVCNoiFx+8YK+lI0qGCQoCVZBkY/ocgD7FKewTE82sBb9QhgaixZU3ErBV/NVqJ31k6naorIkqdXtqrR/iFHgAs8IjIJ8Zv3Rubk3qMnOnAx/PGYqnfRPyM1WovtgZIcjF0x/LV0buZurb6NLLZzaobNrr1Xkqj60yDZMMFDQ+4B8ZsFUCZzXpD1lkEgginrdgSPAQBYfSSi/Kzl7bq10qOB6Lx3qXo/WMPkqivJTHsoGpDp4TxPcHOjTV+sLU+vcPmacfPrMKYiVnPWsG

C:\Users\user\Searches\desktop.ini.locked (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (904), with no line terminators
Category:	dropped
Size (bytes):	904
Entropy (8bit):	5.9832814095733395
Encrypted:	false
SSDEEP:	24:fM00cBFTyDl4muX+F5lAMFwgLKZBZ0WCo2ui:U0VTyDWMb13Lkta
MD5:	70F77FF0BE1D92E0389754EC275D9674
SHA1:	8E3E3CCAB6832FDBCBD469556DFA7A59C8140001
SHA-256:	9307A9B6FE15108B86B636F1392316B3726ACA76034F3499F40C7F286ABD86C2
SHA-512:	2618DA14FFE4D7F6EBC2F11CB2498CBDEF12DF041DF6F6483078AA61D392D207B9BCD1BE9B43B6C87F844969B7C10B118AE6201C52A5CDD2A9DAFF844F655F45
Malicious:	false
Preview:	<EncryptedKey>Nix2PQ6uwxVQYfj3DB03n30m1p0Dp6151jrKk7wucNA/mk02KhDWop/VTCbyDLl+8EEgR4hqO3JykXF6wH0DOymc594WJnOlfParvVd3gtqWjy+8JxawemiVpWcI7a3532aXo8kRnt5wZAfTq9v8V5ki+k8aBWteTHHLlEm5Eg0=<EncryptedKey>JiSlr7vGIj5jZ1rZi89XJkL6bDzuaGGx9Hkig218ZayYCHTdLw7oRHpkljRo78cBxn4RDiydrCMt8kXmUNozv6ED47Fuf9HuOhaJKNtWZcl2d9hgo2GHAaRkYOjawHdslTJvL5Z1Akiw/6vmVteVu9meSx1fWl/3ZiZDK43vLiUFNVm4vdRer/XiTfDkuzqQGAgXsUUDbnI3OT6RvJmuZpRuUhrE04sjs017uufht14i7mfulF5zbyPanwovH5W5vwPbMtKBoxbrns2dn98lUSjIFVUlchwbp+QT6ln8OZNjvk5fmIFHFQBXltRj3jJ7n5PjFnN0TeXHItLHCyvrvTmyBk28q+pSITNCIAeZsb4tOdpJeLsXZc+3SRxL0y33YdKi9wMutOrLzdpfZzrO6JjoBMct2gCzgpem/8mSqt/c3bZVCNoiFx+8YK+lI0qGCQoCVZBkY/ocgD7FKewTE82sBb9QhgaixZU3ErBV/NVqJ31k6naorIkqdXtqrR/iFHgAs8IjIJ8Zv3Rubk3qMnOnAx/PGYqnfRPyM1WovtgZIcjF0x/LV0buZurb6NLLZzaobNrr1Xkqj60yDZMMFDQ+4B8ZsFUCZzXpD1lkEgginrdgSPAQBYfSSi/Kzl7bq10qOB6Lx3qXo/WMPkqivJTHsoGpDp4TxPcHOjTV+sLU+vcPmacfPrMKYiVnPWsG

C:\Users\user\Videos\ENCRYPTED!!!!

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.775611750661861
Encrypted:	false
SSDEEP:	24:LQ3EqvDnBmMZANIrn7okr++cgi46i4Q3tyHXQ:LwkiD7z76iF
MD5:	4217B8B83CE3C3F70029A056546F8FD0
SHA1:	487CDB5733D073A0427418888E8F7070FE782A03
SHA-256:	7D767E907BE373C680D1F7884D779588EB643BEBB3F27BF3B5ED4864AA4D8121
SHA-512:	2A58C99FA52F99C276E27EB98AEF2CE1205F16D1E37B7E87EB69E9ECDA22B578195A43F1A7F70FEAD6BA70421ABF2F85C917551C191536EAF1F3011D3D24F740
Malicious:	false
Preview:	----> Chaos is multi language ransomware. Translate your note to any language <----..All of your files have been encrypted..Your computer was infected with a ransomware virus. Your files have been encrypted and you won't ..be able to decrypt them without our help.What can I do to get my files back?You can buy our special ..decryption software, this software will allow you to recover all of your data and remove the..ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only...How do I pay, where do I get Bitcoin?..Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search..yourself to find out how to buy Bitcoin. ..Many of our customers have reported these sites to be fast and reliable:..Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com....Payment informationAmount: 0.1473766 BTC..Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0....

C:\Users\user\Videos\desktop.ini

Download File

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	ASCII text, with very long lines (884), with no line terminators
Category:	dropped
Size (bytes):	884
Entropy (8bit):	5.979195633014882
Encrypted:	false
SSDEEP:	24:fMSvLupZ1nDT0lf55WGimntW/+O5wyLRmRFQG6wmIg:USC0lRIGiH/+OakmRFQ4mL
MD5:	57B91139E058AF810A78A65362D4954C
SHA1:	293C08B546903A81C2C34A50CD14A2B6BD006F90
SHA-256:	EBD9984D4B76431A5B608AB36C5182675C7E66F9FEF09F4419B8236D722A3AE3
SHA-512:	07EADBBC12BAED6680E71EFBCC23D0C41DC63ABCF4CE9DD242C0D44C4D34278190022A61FBB86EF751410DBDAE6EDCD324D51F4CA7291617FC2B5B3A0D7C326A
Malicious:	false
Preview:	<EncryptedKey>ovKQZBtFs8bdElNK7yYxfx62CS8+KomYCpRzZ3oqshjVerZ4VI4lVxI/qtqKS/P6ehTr7RQym3F6uU/yYzQ5BHdXwjl9Jf+40nfiEworTgaJGVUTsf+kxuIeu+t+TNa0xj6bDO9rljjzrA3oV2kd99IFMpn+BFabxychE1Ac0+M=<EncryptedKey>HAIh7+GjrXVN4CuXkXTvR8zPwEq0wsm0+nwb7/Sa+U994r7UvYlbcf2CgBOCbIz432rgZRyh26YWAUtUeS9mQs8Pls8nOC2cgg2xWrRlvXKBCZK/KGg64eRCkwMuMrx1Iz23sgSNbs3d0bWv+L7TOx64fdXJ5GFTu4MEPSi/oAhGAKfkwsRJrv4LXQVlwAa5MKgdgOTkh1Yb4EoUhIscBIvEO4At+mVUcFHTrJUSV8fcG56PlKrDy8gY07swJDin/zKPR+pH+XpodfoQNFrsAvJfxcj60XYaGTfLRCQUMsibF06RG5jSAqBkFCpzGz5Vd7NFGmqKbdj5ROk7ChRvRnfaRkUri21lUOx+ESxv+s+Dal/iw9a2ZmMHbeX2yTafAODZ+Twalxw2B3ZhvfoBMhxSRDpr4LQgyB/AMEacGthiQt2fe7ItmhEuos9MpDSHb2bNVw3l2X1GEYzhWs6yAtWLM1g0Mri3LHnfh/r4yTKDzcoaPV5vuVUfYcFdMYRK+bjxgzILiRwM1FfKm4y/A8XM2VpFY8uOV5GJIVOKDYggO//EOmgppR6a+aYrQ2BPSi1AZYPrZfLJY8bFSL4V3ehoV1a/2JetfrhEWcLH35j9C+tCQ2EPtLUHNFR8Ed6njIJS5IL4h/Ph60GUS+JDsVfybKjaG0q2qkurK/szjnU=

C:\Windows\Logs\WindowsBackup\WBuser.0.etl

Download File

Process:	C:\Windows\System32\wbadmin.exe
File Type:	dBase III DBT, version number 0, next free block index 10240, 1st item "\371\231\177\021"
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	1.9899419202255577
Encrypted:	false
SSDEEP:	96:8/FroEjBda3SgWlz/l9JPhhKuK1qOKzuJKintkUcd/Eqqwq4nXIiCo6zA9124:UrhfaEJUqthqwq2s4
MD5:	03E8121628DF9E6D912C08E80E0ADCD2
SHA1:	4CA549FB4B5F0EA366FBE756F4663599517A71F7
SHA-256:	2A1C12B154F2CAA6EB3A68E43E08777A65EC17D0F4668B7EA90E7AAB4B68C6D1
SHA-512:	F0A0750BB29F77300FBC1EC8BE7A4F931E34020DD9997BDC475443D41DFE490CD591EB47E42CEE72ECBBDB08B913639795F8F9E6B9D20245A57B8B9990D59011
Malicious:	false
Preview:	.(..@...@...........................................!....................................................(.......B..........W..Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1.................................................................... ....._.(..W..........W.B.E.n.g.i.n.e...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.W.i.n.d.o.w.s.B.a.c.k.u.p.\.W.B.E.n.g.i.n.e...0...e.t.l...........P.P.............................................................................9.B.........17134.1.amd64fre.rs4_release.180410-1804............-.@............].. ...#.sF.....uudf.pdb........0.@..........@...<.=T9..U.....ifsutil.pdb.....1.@..........3..^?...{W.1.{.....wbuser.pdb............,.@..........T....\|..c..4.......spp.pdb...........@.........VD..;.6..._P.......vssvc.pdb......./.@...............+..c....:.....vssapi.pdb......0.@........../..5.IQx........wbadmin.pdb.................

\Device\ConDrv

Download File

Process:	C:\Windows\System32\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.305255793112395
Encrypted:	false
SSDEEP:	3:8yzGc7C1RREal:nzGtRV
MD5:	6ED2062D4FB53D847335AE403B23BE62
SHA1:	C3030ED2C3090594869691199F46BE7A9A12E035
SHA-256:	43B5390113DCBFA597C4AAA154347D72F660DB5F2A0398EB3C1D35793E8220B9
SHA-512:	C9C302215394FEC0B38129280A8303E0AF46BA71B75672665D89828C6F68A54E18430F953CE36B74F50DC0F658CA26AC3572EA60F9E6714AFFC9FB623E3C54FC
Malicious:	false
Preview:	ERROR:...Description = Initialization failure...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.593559525776207
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	a8BgfRCsUv.exe
File size:	3075441
MD5:	ae7795f6305ad315589ff4846ad1ef14
SHA1:	71f4143d89ce0dcb5729e2a8b2cd54bc9b423e65
SHA256:	074c7aa722ff77df5ed56b655cc11da0288550a7405dc439be4417c6fccf7d5f
SHA512:	cca6b64d61962e9dfb53802a52ee397fd1bf3213a97313362ea74e751d05e38319e807c423a0d834d6067cff2c44d31d616ba119ea42f4a03b253db42e7d8317
SSDEEP:	24576:Rr8WJm8MoC9Dq9onkn+rnMSBLGLS0yt1huc82KT31obI:RZjQ+9ok+nMSBLGm0Yhu52y31
TLSH:	05E5EA1A3BE9C564F0B31AB55DB6C7C957B3FD61AD21C70F329A134E0C71AA08C62672
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H..`.................R...........p... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x40709e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x60F59648 [Mon Jul 19 15:12:08 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7048	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8000	0x4d0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x50a4	0x5200	False	0.4803734756097561	data	5.260738956209135	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x8000	0x4d0	0x600	False	0.37109375	data	3.6855157981997513	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa000	0xc	0x200	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x80a0	0x23c	data
RT_MANIFEST	0x82e0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Target ID:	0
Start time:	05:07:10
Start date:	16/03/2023
Path:	C:\Users\user\Desktop\a8BgfRCsUv.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\a8BgfRCsUv.exe
Imagebase:	0xe50000
File size:	3075441 bytes
MD5 hash:	AE7795F6305AD315589FF4846AD1EF14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Chaos_1, Description: Yara detected Chaos Ransomware, Source: 00000000.00000000.243529247.0000000000E52000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_Chaos, Description: Detects Chaos ransomware, Source: 00000000.00000000.243529247.0000000000E52000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: MALWARE_Win_Chaos, Description: Detects Chaos ransomware, Source: 00000000.00000002.259028258.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	05:07:17
Start date:	16/03/2023
Path:	C:\Users\user\AppData\Roaming\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\svchost.exe"
Imagebase:	0x810000
File size:	3075441 bytes
MD5 hash:	AE7795F6305AD315589FF4846AD1EF14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: MALWARE_Win_Chaos, Description: Detects Chaos ransomware, Source: 00000001.00000002.511531668.0000000002FC4000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_Chaos, Description: Detects Chaos ransomware, Source: 00000001.00000002.511531668.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_Chaos, Description: Detects Chaos ransomware, Source: 00000001.00000002.511531668.0000000002EB6000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Chaos_1, Description: Yara detected Chaos Ransomware, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: Joe Security Rule: JoeSecurity_Conti_ransomware, Description: Yara detected Conti ransomware, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: Joe Security Rule: MALWARE_Win_Chaos, Description: Detects Chaos ransomware, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs Detection: 81%, Virustotal, Browse
Reputation:	low

Show Windows behavior

Target ID:	4
Start time:	05:07:30
Start date:	16/03/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
Imagebase:	0x7ff7cb270000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	05:07:30
Start date:	16/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	05:07:31
Start date:	16/03/2023
Path:	C:\Windows\System32\vssadmin.exe
Wow64 process (32bit):	false
Commandline:	vssadmin delete shadows /all /quiet
Imagebase:	0x7ff78f360000
File size:	145920 bytes
MD5 hash:	47D51216EF45075B5F7EAA117CC70E40
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	10
Start time:	05:07:32
Start date:	16/03/2023
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic shadowcopy delete
Imagebase:	0x7ff6dbbf0000
File size:	521728 bytes
MD5 hash:	EC80E603E0090B3AC3C1234C2BA43A0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	12
Start time:	05:07:32
Start date:	16/03/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Imagebase:	0x7ff7cb270000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	13
Start time:	05:07:32
Start date:	16/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	14
Start time:	05:07:33
Start date:	16/03/2023
Path:	C:\Windows\System32\bcdedit.exe
Wow64 process (32bit):	false
Commandline:	bcdedit /set {default} bootstatuspolicy ignoreallfailures
Imagebase:	0x7ff71f5e0000
File size:	461824 bytes
MD5 hash:	6E05CD5195FDB8B6C68FC90074817293
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	15
Start time:	05:07:33
Start date:	16/03/2023
Path:	C:\Windows\System32\bcdedit.exe
Wow64 process (32bit):	false
Commandline:	bcdedit /set {default} recoveryenabled no
Imagebase:	0x7ff71f5e0000
File size:	461824 bytes
MD5 hash:	6E05CD5195FDB8B6C68FC90074817293
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	17
Start time:	05:07:33
Start date:	16/03/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
Imagebase:	0x7ff7cb270000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	18
Start time:	05:07:33
Start date:	16/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	19
Start time:	05:07:33
Start date:	16/03/2023
Path:	C:\Windows\System32\wbadmin.exe
Wow64 process (32bit):	false
Commandline:	wbadmin delete catalog -quiet
Imagebase:	0x7ff6972a0000
File size:	281600 bytes
MD5 hash:	EE1E2C4D42579B19D765420E07589148
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	20
Start time:	05:07:34
Start date:	16/03/2023
Path:	C:\Windows\System32\wbuser.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbuser.exe
Imagebase:	0x7ff7b4c10000
File size:	1535488 bytes
MD5 hash:	6E235F75DF84C387388D23D697D6540B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	21
Start time:	05:07:34
Start date:	16/03/2023
Path:	C:\Windows\System32\vdsldr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\vdsldr.exe -Embedding
Imagebase:	0x7ff70de00000
File size:	25088 bytes
MD5 hash:	CD0D2028997ABCA78774E062CEC4E701
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	23
Start time:	05:07:34
Start date:	16/03/2023
Path:	C:\Windows\System32\vds.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\vds.exe
Imagebase:	0x7ff785dd0000
File size:	642560 bytes
MD5 hash:	4940B49502323905B66039D0D1AB4613
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	27
Start time:	05:07:36
Start date:	16/03/2023
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff6537e0000
File size:	111120 bytes
MD5 hash:	D179D03728E95E040A889F760C1FC402
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	28
Start time:	05:07:36
Start date:	16/03/2023
Path:	C:\Users\user\AppData\Roaming\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\svchost.exe"
Imagebase:	0x980000
File size:	3075441 bytes
MD5 hash:	AE7795F6305AD315589FF4846AD1EF14
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: MALWARE_Win_Chaos, Description: Detects Chaos ransomware, Source: 0000001C.00000002.511323362.000000000302E000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_Chaos, Description: Detects Chaos ransomware, Source: 0000001C.00000002.511323362.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen

Show Windows behavior

Target ID:	29
Start time:	05:07:52
Start date:	16/03/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
Imagebase:	0x7ff7cb270000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 5584, Parent PID: 5592

General

Target ID:	30
Start time:	05:07:52
Start date:	16/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	31
Start time:	05:07:52
Start date:	16/03/2023
Path:	C:\Windows\System32\vssadmin.exe
Wow64 process (32bit):	false
Commandline:	vssadmin delete shadows /all /quiet
Imagebase:	0x7ff78f360000
File size:	145920 bytes
MD5 hash:	47D51216EF45075B5F7EAA117CC70E40
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	32
Start time:	05:07:53
Start date:	16/03/2023
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic shadowcopy delete
Imagebase:	0x7ff6dbbf0000
File size:	521728 bytes
MD5 hash:	EC80E603E0090B3AC3C1234C2BA43A0F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	33
Start time:	05:07:54
Start date:	16/03/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Imagebase:	0x7ff7cb270000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 2508, Parent PID: 5276

General

Target ID:	34
Start time:	05:07:54
Start date:	16/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	35
Start time:	05:07:54
Start date:	16/03/2023
Path:	C:\Windows\System32\bcdedit.exe
Wow64 process (32bit):	false
Commandline:	bcdedit /set {default} bootstatuspolicy ignoreallfailures
Imagebase:	0x7ff71f5e0000
File size:	461824 bytes
MD5 hash:	6E05CD5195FDB8B6C68FC90074817293
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	36
Start time:	05:07:54
Start date:	16/03/2023
Path:	C:\Windows\System32\bcdedit.exe
Wow64 process (32bit):	false
Commandline:	bcdedit /set {default} recoveryenabled no
Imagebase:	0x7ff71f5e0000
File size:	461824 bytes
MD5 hash:	6E05CD5195FDB8B6C68FC90074817293
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	37
Start time:	05:07:54
Start date:	16/03/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
Imagebase:	0x7ff7cb270000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 4456, Parent PID: 2852

General

Target ID:	38
Start time:	05:07:55
Start date:	16/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	39
Start time:	05:07:55
Start date:	16/03/2023
Path:	C:\Windows\System32\wbadmin.exe
Wow64 process (32bit):	false
Commandline:	wbadmin delete catalog -quiet
Imagebase:	0x7ff6972a0000
File size:	281600 bytes
MD5 hash:	EE1E2C4D42579B19D765420E07589148
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	40
Start time:	05:07:56
Start date:	16/03/2023
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff6537e0000
File size:	111120 bytes
MD5 hash:	D179D03728E95E040A889F760C1FC402
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Function 00007FFC9E240128 Relevance: 2.0, Instructions: 2024COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266112960.00007FFC9E240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E240000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db2df671f5390bc4788ed4f5acd867c8a2d167fb3af9881496a2e356b1980d2f
Instruction ID: b12823ac979f829306517654e3d92478dc6f46f3d80577a84c93719fda7e7643
Opcode Fuzzy Hash: db2df671f5390bc4788ed4f5acd867c8a2d167fb3af9881496a2e356b1980d2f
Instruction Fuzzy Hash: 55D2EA74A3852A8BEB45F798C4D7BB9B3E2EB88314F404074D019937CADA29B855C7F1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E241DC5 Relevance: .7, Instructions: 715COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266112960.00007FFC9E240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E240000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a051268e4c6bd1c6b84b842ae03b1614d1582598ff36f177a780cd3674d7a28b
Instruction ID: 8318d1561b6353c672976631bfc489b8c59cbcb64f1d04f80c27d9b2526a7388
Opcode Fuzzy Hash: a051268e4c6bd1c6b84b842ae03b1614d1582598ff36f177a780cd3674d7a28b
Instruction Fuzzy Hash: BF51D621A1CAAA0FE759E72894656F9BBF1EF56310F0400BAE05DC71D3ED186906C3B1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E241CBD Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266112960.00007FFC9E240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E240000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ad666b6987b2f5e47ef7dc620e84dced5758f5f8887c9e7a4ef712486ceb8b3
Instruction ID: 1fb8d79d3107d568bd6b57392568b63559cc918fab3c9ccffb428504699a101c
Opcode Fuzzy Hash: 1ad666b6987b2f5e47ef7dc620e84dced5758f5f8887c9e7a4ef712486ceb8b3
Instruction Fuzzy Hash: B8315C71A1892E8FDB94EB6884546FCB7F1FF58311F5400BAD019E72A2EB359841CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E241B51 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266112960.00007FFC9E240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E240000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f518d0606ec459bea846e5fa7ad89ce5f5fb690b1e9390c59f23a90a645f5bda
Instruction ID: 8b8015d0d8a434a66553e484819f7e5651afdd521c42beff76a430fc2f100d38
Opcode Fuzzy Hash: f518d0606ec459bea846e5fa7ad89ce5f5fb690b1e9390c59f23a90a645f5bda
Instruction Fuzzy Hash: 143152D0D0C97A8AF7BAA66488D5BB43FD1AFA5314F480179D04D860D3FE9C2890C732

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 5472, Parent PID: 6136COMMON

Executed Functions

Function 00007FFC9E250200 Relevance: 1.9, Instructions: 1918COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1278c935e01c076d153bc764d7d3817c076a751a087cc338916e6a82a46d7ec4
Instruction ID: 3251f161bc2fbe8d0d304324d1d4ef8724f3db11002d8be966912b6b2106b985
Opcode Fuzzy Hash: 1278c935e01c076d153bc764d7d3817c076a751a087cc338916e6a82a46d7ec4
Instruction Fuzzy Hash: 02D20A74A7892E8BEB40F758C4E7BA9B7E2EB88714F404164D119937C6EA24BC44C7F1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E251DC5 Relevance: .7, Instructions: 712COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 074b64e9f7676e80859fd7c806faf8c2e818ea6230922c9179c08942f3a60522
Instruction ID: 566aeb0dc02ad0818985ec0c015252927886220098a609b9eed1b6a328c1f85b
Opcode Fuzzy Hash: 074b64e9f7676e80859fd7c806faf8c2e818ea6230922c9179c08942f3a60522
Instruction Fuzzy Hash: C181D921A1DAAA0FE716E72868A51F97BB1EF56310F0500F7D05DC71D3ED18690AC3B5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2500D0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17fab07642b35c4626cc663623c46b601ccc30561a2dac77d82cbca96543e9e0
Instruction ID: 1ce7396110466a170f41cb144596facffb9f1df7725481a8d7d910fb6d637a56
Opcode Fuzzy Hash: 17fab07642b35c4626cc663623c46b601ccc30561a2dac77d82cbca96543e9e0
Instruction Fuzzy Hash: 1D91C831B1C95E4BEB58D72C94A56BDBBE2EF98310F14417AE10DD32C6EE24AC41C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2500C0 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d039d968139fa10d35c4d971d3d6ffeb8ba09cd4dea6bb45baf89bd164c59c
Instruction ID: 7172633ac5376c9bef4e199dd4d9e93ac628481eaff3719f43282fd953ec21b9
Opcode Fuzzy Hash: e5d039d968139fa10d35c4d971d3d6ffeb8ba09cd4dea6bb45baf89bd164c59c
Instruction Fuzzy Hash: DF719131B1891D8FEB98E76C9495ABD66E2EFA8311F140079E41ED32D2ED24E842C770

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2529A4 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6aa4c9fe1c01b4c2170e3ae65dd64145f614033a3534f6c9e246ea294fe8182
Instruction ID: 54cd6e5d88aeb85a5dbaa68925f2994b7ca8b666c9387cc6a88f7968f145f7cf
Opcode Fuzzy Hash: e6aa4c9fe1c01b4c2170e3ae65dd64145f614033a3534f6c9e246ea294fe8182
Instruction Fuzzy Hash: A0718231B1892E8BEBA4E75C94956BC67E2FFA8310F540579D11ED32D2EE24EC42C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2525FA Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3c54a672ec8e5f1d8824c65440ef7c69eb0d62d35a65170a7bb27126d4908de
Instruction ID: 354be76937d8901db9b0d93e9ed22488c5def4036d041044c31c2d0789f459b8
Opcode Fuzzy Hash: e3c54a672ec8e5f1d8824c65440ef7c69eb0d62d35a65170a7bb27126d4908de
Instruction Fuzzy Hash: C171B130758A6D8FE740E718D8D2EB5B7E2FBA9700B1445B9D10AC3293EE24EC45C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2500D8 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2dad4bad5e5d80739f516e98831d03f71a25d2db231b2fd68b9531c8c56fb16
Instruction ID: 072cf88ce2c806610202ca226672b1758b5a90401be33145373eba5983c16030
Opcode Fuzzy Hash: a2dad4bad5e5d80739f516e98831d03f71a25d2db231b2fd68b9531c8c56fb16
Instruction Fuzzy Hash: F1519271F18D1E4BEB58E758E4656BDB7E2EF98310F04417AE40ED32C6DE24A841C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E25244D Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3023fe8275ccdcd998851b5891f36656e8f113d87b32265a69952ae67157bb85
Instruction ID: c696803df2167f17654a4225b9b538fad94df7f18332b6494328cddafaee888e
Opcode Fuzzy Hash: 3023fe8275ccdcd998851b5891f36656e8f113d87b32265a69952ae67157bb85
Instruction Fuzzy Hash: 1851CE21A0D69E8FD752D73888655B4BFA1EF9A310B0941FAD048CB5E3DE1C9846C3B2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2500A8 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6387a28dc707abe6a89f4039487cdb72cc3c3fdcfb660e8b7fa8c5f6540dd1b
Instruction ID: 5de51536896fddf11539a781cf1977e01d4bb7bb90acc2d74a1188684d813a2a
Opcode Fuzzy Hash: a6387a28dc707abe6a89f4039487cdb72cc3c3fdcfb660e8b7fa8c5f6540dd1b
Instruction Fuzzy Hash: C151E821B1C82E4FEB55E72C94D56B477D2EFA8750B1446B6D00EC71DAEE28E806C3B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E252D11 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e40a3583d50064f4f30edc981e2babe522080782f807fa609139ca07e2b77e20
Instruction ID: f698d1bb7e345fac7a7cae35acbf83893e761d85c2370c4fea032c70e05cfec9
Opcode Fuzzy Hash: e40a3583d50064f4f30edc981e2babe522080782f807fa609139ca07e2b77e20
Instruction Fuzzy Hash: 64218121B18D2D0FE794F36C58A9BB966D2DF9D211B1500BAE50DC32D3EC69AC42C3B1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2528BA Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1066c537633093c0274c47cb1d26d65d12097291023106349fd53544b041d777
Instruction ID: cb1c2c6b227c090cfd39b85bf73f8d938844fd56a260a0759e8e17596a99fe19
Opcode Fuzzy Hash: 1066c537633093c0274c47cb1d26d65d12097291023106349fd53544b041d777
Instruction Fuzzy Hash: 9531D832D18A5D9FDB55DB58D8959A8BBB0FF68320F04016ED01AD32D3EE24AC46C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2500E0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d7f67107c00c21de0c80b0988c70151e4d36e9d715f86f9cb05d80ee4ad969f
Instruction ID: 1c28bd579977a686a0e07aa4ae4b2fc6ad1dc36c24bfe76bb600820ceb4f0f3c
Opcode Fuzzy Hash: 8d7f67107c00c21de0c80b0988c70151e4d36e9d715f86f9cb05d80ee4ad969f
Instruction Fuzzy Hash: 04215421B18D2D1FE794F26C5499BBD65C2DB9D211B54007AE50DC33D7EC69AC82C3B1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E251CBD Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d047ca7bc82d521dc5785af78601f3430bcf86b906ee06588cf430bf881ebd5e
Instruction ID: 47e2b78d629930817284a6cd18d715af3d17293885bc269405bbbf90fd18194d
Opcode Fuzzy Hash: d047ca7bc82d521dc5785af78601f3430bcf86b906ee06588cf430bf881ebd5e
Instruction Fuzzy Hash: C7315C31A1892E8FDB94EB6884546FCB7F1FF58311F5400BAD019E72A2DE399841C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2535A1 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 204d2566942db51a2f02c9dd793053ee35c72a7cdfde56ae93d4ee35756d22aa
Instruction ID: aa7ec54f8927a6390ea69b53deb402ce1d5d14b6fefe08ef262b2f48e3af1dfd
Opcode Fuzzy Hash: 204d2566942db51a2f02c9dd793053ee35c72a7cdfde56ae93d4ee35756d22aa
Instruction Fuzzy Hash: 18314130A08A6E8FDB90EF68C495AEAB7F1FF58300F1041B6D45DD7296DA34A941CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E253291 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ac12db44845f019a63582c8ef703663ed765a741c78041a9adcfebf22161bb
Instruction ID: 7ab4821d44182ab2d5f36ca72efee9085adc89a5186a3dc816f99e13ccd8b716
Opcode Fuzzy Hash: 38ac12db44845f019a63582c8ef703663ed765a741c78041a9adcfebf22161bb
Instruction Fuzzy Hash: B1219F31F0891C4FDB90EB6C94996EDBBE2EFAC311B41017BD10CD3292DE249881C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E251B51 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0410e51fbeb8f53a401f45e1ffd08415a4da898e1c1655b021448c9162f6b183
Instruction ID: 06295108431555f8b7bfa80a4d474122b8c30874a8414fd22f0d407c351803b5
Opcode Fuzzy Hash: 0410e51fbeb8f53a401f45e1ffd08415a4da898e1c1655b021448c9162f6b183
Instruction Fuzzy Hash: 4A316120D4CEBE4AF7B5A72489D5BB42E91AF66314F4841B5D04A820D3FE9CA895C732

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2500E8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5b7c86ef1946715f68f1c551396a068450b307a83b6ed076ca647b91ec6f26f
Instruction ID: 2353a01ecc60f870a787f9e8c9c7af915f777dcc567ee9f0abdc086c0d49080b
Opcode Fuzzy Hash: a5b7c86ef1946715f68f1c551396a068450b307a83b6ed076ca647b91ec6f26f
Instruction Fuzzy Hash: 60115C31B04C1D5FDB94EB6C94996EDBBE2EFAC311B51017AE00DE3296DE249881C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2536A9 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccfda830d8f61a25582e8e4c91bdfe7505cf68aa2d4d51cfb95873add857c323
Instruction ID: a442d7cef7472d73db2627aca83e2510063666f11d54b7bb7d4680362f884b06
Opcode Fuzzy Hash: ccfda830d8f61a25582e8e4c91bdfe7505cf68aa2d4d51cfb95873add857c323
Instruction Fuzzy Hash: 75110631A589AE4FEB02E328A4656F9BBE1EF91310B0441B7E119C31C3EE189D46C3F1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2534F8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d57cd43346e65bb170f6f77cb9fba8f5eb725b60b204b26bb8ab50789f773d
Instruction ID: 5601281be3ec8ffc98f2f6da8fe2c59a73d7b5766c7ce3b9c46e0ea9881e46d5
Opcode Fuzzy Hash: 56d57cd43346e65bb170f6f77cb9fba8f5eb725b60b204b26bb8ab50789f773d
Instruction Fuzzy Hash: 4D11B612B1CC5E4FEF95E26C44E17B866D2EB98350B5441B6D01DC72DBED149805C3B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E253779 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9085cd514fe6dc8af2445f80a3b7c2bea485fef145113dc94c7f451615e1ff2
Instruction ID: bb32e56a4e343fc7207808616e171f4059018a6976d5938ac02693989c979144
Opcode Fuzzy Hash: b9085cd514fe6dc8af2445f80a3b7c2bea485fef145113dc94c7f451615e1ff2
Instruction Fuzzy Hash: EDF0D162C4D9A94FEB2697702C960F57F94DB5222070901BBD41DC65D7EC0C56A2C3B2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E251C55 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f248e4c20e953de0a9902a224bc7d1f67673170c6e88b6546ccc0566bbf5843c
Instruction ID: 66c610121ba2e2ee9c26d1366e3eb7c7cf53d1e9ac92d64a9d9e9f23a5690d37
Opcode Fuzzy Hash: f248e4c20e953de0a9902a224bc7d1f67673170c6e88b6546ccc0566bbf5843c
Instruction Fuzzy Hash: 6FF0F651E18D3E4FDBD6F61824A46B9A290EFB871036441B9D00EC3287FE299D42C3E6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E253821 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 790fb3b80d241918024c96717a84ac76c6aeae8fc11b364293a85c3a43d09001
Instruction ID: 0fb73ddec6e715c7bd77a411ab41e7c2a7c667b18dca3abb844f0de9a6c66dcc
Opcode Fuzzy Hash: 790fb3b80d241918024c96717a84ac76c6aeae8fc11b364293a85c3a43d09001
Instruction Fuzzy Hash: 43F05B12A0DDAD4FE769E738487517CAE91DF9965074505FAC009C75D7EE089844C362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2539B1 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0b4f33ebf448bd1b750e3bc5d2d62f1a4438111563aeec8554a698818b316b8
Instruction ID: 3103f80721b89458f3aec4aae70acab870a6ea199b49d98ca9c473465925c862
Opcode Fuzzy Hash: e0b4f33ebf448bd1b750e3bc5d2d62f1a4438111563aeec8554a698818b316b8
Instruction Fuzzy Hash: 0AE0262181E7E90FCB63637864A10E2BF60CF0722030901EBD085CA0D7F89988C5C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E253357 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ce3a4380ffb119d49c5f12280d5c7e63d14b0e2a62756414f7045297f97ebd7
Instruction ID: 7be4c0c58a3acfe7e75356adad5efaa5b4149502068a9149c039218f2021330a
Opcode Fuzzy Hash: 8ce3a4380ffb119d49c5f12280d5c7e63d14b0e2a62756414f7045297f97ebd7
Instruction Fuzzy Hash: 1CD02B3154650C1B8B00FB97AC444D777A8FBCC318F010526E40CC3000D6265151C370

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E25397B Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 800d60062f5f54fadc9e61ac24dc4f8603003be678200673689a8448a22b365a
Instruction ID: aa5cb19c02bba2d42c9c0151452f5b7caf64526418828a809c821bcf2f057f15
Opcode Fuzzy Hash: 800d60062f5f54fadc9e61ac24dc4f8603003be678200673689a8448a22b365a
Instruction Fuzzy Hash: 46D01211B1881D0AE784F77D74A16BDD282AFC83207D49279E13DC22CBCC28A9414261

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2538BD Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521336928.00007FFC9E250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da4324205005f2e22a3cc9e1f9817cb88df19c667144392e669f6ce33ae50c7
Instruction ID: e3319b2a2337ff4f9ebe3f0175c242837d12b5014816ed66b5dccabc5ba1f5e7
Opcode Fuzzy Hash: 5da4324205005f2e22a3cc9e1f9817cb88df19c667144392e669f6ce33ae50c7
Instruction Fuzzy Hash: DEE04F2296E6CD4FE723633409A50E9BF60EF52200F9802E6D1998A093FC599919C3A2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 5236, Parent PID: 3452COMMON

Executed Functions

Function 00007FFC9E231DC5 Relevance: .7, Instructions: 711COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faa634fcd1294a5574c2974729d5737fcc6a6b3bc80594b98fa3ab35c99509e1
Instruction ID: 34509bf1087bcee2799e58a1ca3c31b330d662c71b47f532447cc6c18ac97127
Opcode Fuzzy Hash: faa634fcd1294a5574c2974729d5737fcc6a6b3bc80594b98fa3ab35c99509e1
Instruction Fuzzy Hash: 72810A21A1DAAA4FE75AE72898A12F87BB1EF56710F0400B7D05DC71D3DD18690AC7B1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2300C0 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee22a10fe58f707bb12e455cdf369403c99e7499fff0a016d73405bf8af2b885
Instruction ID: 010f9f6ad2dee5f0b8ed279804990c45d155da695785d574922aacbc9806cbef
Opcode Fuzzy Hash: ee22a10fe58f707bb12e455cdf369403c99e7499fff0a016d73405bf8af2b885
Instruction Fuzzy Hash: 62718131B1891D8FEB98E76C9495ABDA6D2EFA8710F140079E41ED36D2ED24A842C770

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2329AA Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a570ed40357b2398125b2584e5f815afa01105a6e29adba651e1aa0a3032f1
Instruction ID: d6d6616e4f246be0a5fadd373024de616bf5f363d87353b98b990c854695dc3e
Opcode Fuzzy Hash: 83a570ed40357b2398125b2584e5f815afa01105a6e29adba651e1aa0a3032f1
Instruction Fuzzy Hash: E771B431B1891E4BEB98E71CD4956BC67E2FFA8750F540439D01ED36D2DD24A842CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2325FA Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 787c80efdcce122562c6d226f385553b410aed3a61fd96df13921c1c504dfa13
Instruction ID: 743ad4a3e2c13dd6b73f6394c857ecde26f661038740b680a94f27ec7db81c02
Opcode Fuzzy Hash: 787c80efdcce122562c6d226f385553b410aed3a61fd96df13921c1c504dfa13
Instruction Fuzzy Hash: 7271943069D96D8FE744EB18D8D1E6577E2FF98700B980479E40AC3AD2DD28B847CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E23244D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a201cc1e9ac6c5f1ae3a6bd682d87024cab44828259a5e98d669eb1cee3535fa
Instruction ID: 687df2dd6420a118ff91cbc6b2bf8ec6b7d2efaf48cb5015cff13e54cf99d648
Opcode Fuzzy Hash: a201cc1e9ac6c5f1ae3a6bd682d87024cab44828259a5e98d669eb1cee3535fa
Instruction Fuzzy Hash: 5A51E231A0E69A8FD756D73888645E4BFE1FF9A350B0601FAD04CC75A3DE185846C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E23002F Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bda8776af96c32b796a807f21db20d2836b29b7639603482052edd1d7db1fe6b
Instruction ID: 1c3d8bdfccff4dc9e0b55449ed61f445aeb1165619081396a7b8c6f8c8b2b477
Opcode Fuzzy Hash: bda8776af96c32b796a807f21db20d2836b29b7639603482052edd1d7db1fe6b
Instruction Fuzzy Hash: 0641F81291DAEE4FD766A33C58A06F86FA1DF16660B1800F7C088CB5E3ED08680DC7B5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E230060 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e57b1dcc82da62918f3bc85518acb05de46c670b6bbb3a0c9c51ab947d19e11
Instruction ID: f2eba947924fc85b6814e228d0c0f64de5567254d2eadeea7a7abb925efff5c7
Opcode Fuzzy Hash: 3e57b1dcc82da62918f3bc85518acb05de46c670b6bbb3a0c9c51ab947d19e11
Instruction Fuzzy Hash: 0941F912A1C5AE4FD765A63C94A06F86BA2DF55660B1400B7D088CB1E3EE08680DC3F1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2328BA Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5d3f30c17e1de0ed249498fee9ed415bc0d9c06eb346c238ca265cb5610df68
Instruction ID: efdfa5b19d1f2e500725cd9c1ff15bc48e1e9bedcbabfff7bfff0dd613369ae2
Opcode Fuzzy Hash: f5d3f30c17e1de0ed249498fee9ed415bc0d9c06eb346c238ca265cb5610df68
Instruction Fuzzy Hash: 65313C32D1CA5D8FDB58DB18D8549A8BFB1FF59760F14016ED00AD32D3DA246846CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E232DD1 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f237c7712d68a83ee715f49f3a5c35925b64b79115d96eb14056f9bbea501db7
Instruction ID: 6d9024719e734390b1021c40034ef4abc8860d8c4cbe7e8d4502abf4e11f437e
Opcode Fuzzy Hash: f237c7712d68a83ee715f49f3a5c35925b64b79115d96eb14056f9bbea501db7
Instruction Fuzzy Hash: 7E31A230A08A2E8FDF94EB58C491AEAB7F2FF58340F1040B6D41DD3292DA34AD41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E231CBD Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec8dd365961fc45a799b02c327b695d5e3ba75641f1d37fbab971bc94f2ffc6
Instruction ID: 38416083c0bc4a08f3430c132bc667ee0b5c0d56c822954d30fce2f7d6287d6d
Opcode Fuzzy Hash: 5ec8dd365961fc45a799b02c327b695d5e3ba75641f1d37fbab971bc94f2ffc6
Instruction Fuzzy Hash: FB315C31A1892E8FDB94EB6884546FCB7F1FF58311F5400BAD019E72A2DA35A841CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E231B51 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06dd06e1e0516267da69a33907e9477949e92340c59f251d3472a03a4376a531
Instruction ID: c8eb9b7cdef54bf66e74b2d82cd029d33b977ab25d6314f5c1316b41e72533e0
Opcode Fuzzy Hash: 06dd06e1e0516267da69a33907e9477949e92340c59f251d3472a03a4376a531
Instruction Fuzzy Hash: 4331B220D0CA7A4AF7BDA724C8C5BB82F91AF65B10F481475D049828D7EE9C2895CB32

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E232D11 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b83c1aba3a8d2f177704e88b4b4f3c1143e98b9253f8e3ec09f0f349b8de5c
Instruction ID: 3826f6e47d0a7f18f51e623e8911ad02af5decdbb1e61f8b4cc13e2ff294b518
Opcode Fuzzy Hash: 30b83c1aba3a8d2f177704e88b4b4f3c1143e98b9253f8e3ec09f0f349b8de5c
Instruction Fuzzy Hash: 1B210B12A1DCAE4FEB99E32C88E47B467D2EF99751B1841B6C00DC75D7DE186806C3B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E232ED9 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de03b54fa3c26ea89815a1667ece782ba590e31adc578730ec11d5d6481f0e33
Instruction ID: 54d99c448fa96538d4047e6a3f4bd7331805efaee330bbaa2fbf04e5d7cd3fc1
Opcode Fuzzy Hash: de03b54fa3c26ea89815a1667ece782ba590e31adc578730ec11d5d6481f0e33
Instruction Fuzzy Hash: D8113A3259C96A0FDB16E328A8616F6BBA1EF86310F1501B7E019C35C3DD186906C3F1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E230128 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d858340b2ffb39352bc5f573dc5543944778991aa251ed1b649c7bc6f866d4c9
Instruction ID: 4ca47d79827e67198c7282165a222e8862cfe4d5536736225651af656291144d
Opcode Fuzzy Hash: d858340b2ffb39352bc5f573dc5543944778991aa251ed1b649c7bc6f866d4c9
Instruction Fuzzy Hash: 4611C412F1CC6F4BEBA8E22C84E47B956D2EF98791B544176D00DC36DADE186806C3B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E232FA9 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cccb815e1de9ffda7de35020abfae956fee4a9ac204005e58e99233670ec6566
Instruction ID: 834461c59daa96c0eab7d5a1fc8fd8f4b181713ecee52bedd50f0eea102e558d
Opcode Fuzzy Hash: cccb815e1de9ffda7de35020abfae956fee4a9ac204005e58e99233670ec6566
Instruction Fuzzy Hash: 13F0443284C92A5BEB2A57342C820F53BA4DB66660B0500B3E45DC28C2ED0C26A3C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E233051 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8301fd98cbc11dff8dd808e3eb0bc5545a98813f00852872c5ccaa0db3926bf9
Instruction ID: b18f41c9198ec24b626934ca658e227e0b3f990fef913ef33366adbba75e0b90
Opcode Fuzzy Hash: 8301fd98cbc11dff8dd808e3eb0bc5545a98813f00852872c5ccaa0db3926bf9
Instruction Fuzzy Hash: 2AF0B411B1DE6E4FEB69E63848656ACAA91EF99610B0201FAC01DC35D7DF085C048771

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E231C55 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2749d2198600cdc02a04192386dd8977c24f71a43d48d2ee910a22b323cb16c5
Instruction ID: 6549601c3f4824468e9c2887429dcbf5559867d87cf3609557473e977fb7f6f3
Opcode Fuzzy Hash: 2749d2198600cdc02a04192386dd8977c24f71a43d48d2ee910a22b323cb16c5
Instruction Fuzzy Hash: C0F02B61A18E3E4FDB99F61870A4AA9A390EF787103581068D00DC36C7EE196942C7F6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2331E1 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed6df055c6e9252619ad15faa3635a978f13bf420df23c306a6e0724c9ce09e9
Instruction ID: 5b8b8381ebe2e2fe991ef6902ae3ed72b0bc616a56000038f1623a900d5d4ac8
Opcode Fuzzy Hash: ed6df055c6e9252619ad15faa3635a978f13bf420df23c306a6e0724c9ce09e9
Instruction Fuzzy Hash: 1DE0262081D7AA0FCB62A674A4914E3BF70DF0622030101EAE098CA0C7ED195882C3E0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2331AB Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11bbbc830f5f87e3ff5d42de0d159c4c26a06315708d9d89b4638cb073703596
Instruction ID: aa5cb19c02bba2d42c9c0151452f5b7caf64526418828a809c821bcf2f057f15
Opcode Fuzzy Hash: 11bbbc830f5f87e3ff5d42de0d159c4c26a06315708d9d89b4638cb073703596
Instruction Fuzzy Hash: 46D01211B1881D0AE784F77D74A16BDD282AFC83207D49279E13DC22CBCC28A9414261

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2330ED Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b62e41c8e2c9e4ce190507f0d6958f738162726504338d17f2a276d892327f2
Instruction ID: 004345ddc6a47a349aeff4c0fb8cae28dadf663443a3f2aa57633e04468b6e5c
Opcode Fuzzy Hash: 9b62e41c8e2c9e4ce190507f0d6958f738162726504338d17f2a276d892327f2
Instruction Fuzzy Hash: FAE0DF2286C78D4FC71263705850099BF20EF41100B8902A6E099C6493E81C2629C3B2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFC9E2330B5 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.521812459.00007FFC9E230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC9E230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac21df02bc5acf301f4e5596472fcbcc3cdbaa7529622fe5bb69bbe687b9ba0
Instruction ID: 783585d015dbfd5ac242860979158699ceb79dc40b3dbc835cc5ec92c4f377c7
Opcode Fuzzy Hash: 7ac21df02bc5acf301f4e5596472fcbcc3cdbaa7529622fe5bb69bbe687b9ba0
Instruction Fuzzy Hash: 17D05B608197554FD7419F358D969413B60AF55210F4682E6D0984B1E7D62CA409CBA2

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of Data Destruction and Data Encrypted for Impact .
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Services, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report a8BgfRCsUv.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Chaos

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Operating System Destruction

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\a8BgfRCsUv.exe.log

C:\Users\user\AppData\Roaming\ENCRYPTED!!!!

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url

C:\Users\user\AppData\Roaming\svchost.exe

C:\Users\user\AppData\Roaming\svchost.exe:Zone.Identifier

C:\Users\user\Contacts\ENCRYPTED!!!!

C:\Users\user\Contacts\desktop.ini

C:\Users\user\Contacts\desktop.ini.locked (copy)

C:\Users\user\Desktop\BUFZSQPCOH.pdf

C:\Users\user\Desktop\BUFZSQPCOH.pdf.locked (copy)

C:\Users\user\Desktop\BWDRWEEARI.docx

Windows Analysis Report
a8BgfRCsUv.exe