3bcf1fef...cbdf | Files
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification:
Ransomware
Threat Names:
Dharma
Trojan.Ransom.Crysis.E

winhost.exe

Windows Exe (x86-32)

Created at 2020-02-24T16:21:00

...

Remarks (1/1)

(0x02000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Remarks

(0x0200001E): The maximum size of extracted files was exceeded. Some files may be missing in the report.

Filters:
Filename Category Type Severity Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\winhost.exe Sample File Binary
Malicious
...
»
Also Known As C:\Windows\System32\winhost.exe (Dropped File)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe (Dropped File)
Mime Type application/vnd.microsoft.portable-executable
File Size 92.50 KB
MD5 77c092a5bd633fe730f10cb9829fa593 Copy to Clipboard
SHA1 699a34b35ed50fa655975bdb64df69bbb2efbc28 Copy to Clipboard
SHA256 3bcf1fef95c81ccaa0362068645c12776a13bc35009383a3973b0b5d4ab0cbdf Copy to Clipboard
SSDeep 1536:mBwl+KXpsqN5vlwWYyhY9S4AWLtYRYE9dF4yrgW4/i5tB7y0KVUiUjH:Qw+asqN5aW/hLQejd4yq/i5tB7HP Copy to Clipboard
ImpHash f86dec4a80961955a89e7ed62046cc0e Copy to Clipboard
PE Information
»
Image Base 0x400000
Entry Point 0x40a9d0
Size Of Code 0x9e00
Size Of Initialized Data 0xd400
File Type FileType.executable
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2017-03-02 23:49:06+00:00
Sections (3)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x401000 0x9c25 0x9e00 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 5.97
.rdata 0x40b000 0x2636 0x2800 0xa200 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 7.79
.data 0x40e000 0xaad5 0xa800 0xca00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 7.98
Imports (1)
»
KERNEL32.dll (9)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetProcAddress 0x0 0x40b000 0xd508 0xc708 0x245
LoadLibraryA 0x0 0x40b004 0xd50c 0xc70c 0x33c
WaitForSingleObject 0x0 0x40b008 0xd510 0xc710 0x4f9
InitializeCriticalSectionAndSpinCount 0x0 0x40b00c 0xd514 0xc714 0x2e3
LeaveCriticalSection 0x0 0x40b010 0xd518 0xc718 0x339
GetLastError 0x0 0x40b014 0xd51c 0xc71c 0x202
EnterCriticalSection 0x0 0x40b018 0xd520 0xc720 0xee
ReleaseMutex 0x0 0x40b01c 0xd524 0xc724 0x3fa
CloseHandle 0x0 0x40b020 0xd528 0xc728 0x52
Memory Dumps (3)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point AV YARA Actions
winhost.exe 1 0x00400000 0x00418FFF Relevant Image True 32-bit 0x00406612 True False
...
buffer 1 0x00600000 0x00700FFF Image In Buffer False 32-bit - True False
...
winhost.exe 1 0x00400000 0x00418FFF Final Dump True 32-bit 0x00409AA0 True False
...
Local AV Matches (1)
»
Threat Name Severity
Trojan.Ransom.Crysis.E
Malicious
C:\Boot\BOOTSTAT.DAT.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 64.25 KB
MD5 eac1e9dccf3fb05066f85e5a9595ef2c Copy to Clipboard
SHA1 b6d48998ad981798d4a5760d03f9c05dca2352d1 Copy to Clipboard
SHA256 7376d0975114fd556155e2f196b675c8f5b92647c6f3af6e8d181919caec6d0c Copy to Clipboard
SSDeep 1536:BC+n2u1tm/rAhg8riL40caPiRboKmK0wfLCNsD8:BC+n2u1Q/Uhr2cdbHmKTjisw Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\BOOTSECT.BAK.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 8.25 KB
MD5 a317c636788e14f22cc478da45f91b3f Copy to Clipboard
SHA1 bed3d1d5d5d969bee626c14d847662e0d979d2cf Copy to Clipboard
SHA256 47e0f38b8fe282f6ad700dd813fa742c18996e3197635a89bd3389089fbc7b5f Copy to Clipboard
SSDeep 192:DYEbNert9CPxRn2HrJsDrhUGQ7JGA7onY2tk:DjQrG72HraDl/+fp2tk Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.76 KB
MD5 d1dc1844fbc0119a02fe03709d8da067 Copy to Clipboard
SHA1 5aee82229f8bb0932c5b88add1024ee61135c37c Copy to Clipboard
SHA256 dc949d721d3656ae585c6a7b33fd921d9c58f999f09b8a4f9cbc5d86dcef4386 Copy to Clipboard
SSDeep 24:j3eIpPfIZAG2NnJL8sOVhNLdm9qKCdK5NN2Sy99FvCUeUsloNny5:aSPfbGhsOV3hnWYSKFvPeUsMy5 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 2.07 KB
MD5 543ba23e14ac981084004e89193b2214 Copy to Clipboard
SHA1 66fdb89b805cdf1f25426f933a10cabb2bc627fe Copy to Clipboard
SHA256 78ed9fc6aff559fb42ae4157a805cad7c3bd4864c88a324d3fb1fc6233f17188 Copy to Clipboard
SSDeep 48:w4Q3F3I3GcYP1psP+4Q337IATMzCDHbvm74UeFDl/v7u/Uy3:wF3uYsPoIAIC7e4nBl37c3 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 2.47 KB
MD5 1e55bcc37a9954a13265e94f2e2d1459 Copy to Clipboard
SHA1 69b9b5b8ed10d92efda647eeab15697ee9cc885d Copy to Clipboard
SHA256 5733d405114451e99e67144ede591b9767c76054b7a61e77e59e39c21aca21a3 Copy to Clipboard
SSDeep 48:dIOqBTa23J8ljoAyeE6xoDAMqwC1e5YqvH+whPWHF7nDvaXV9zjiBH/ufy3:GiMJ896eE6atqwCSYqP+whP+hWXTS/J Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.66 KB
MD5 7ed2c468517f2f7f42c0f379cfc7493b Copy to Clipboard
SHA1 15c9f3c55b9c23456822d3f790f318436affde1a Copy to Clipboard
SHA256 138e2f614c0a48c1ca52140c32c77d0c64403e809d2ba5a2bcf422102098b194 Copy to Clipboard
SSDeep 48:CbyWQSxaUQva9RXMl9isIvXfD4srA+iAL9rM09ElqteU+GyH:gbwVa7k9is2D4s8+l6lfF Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.66 KB
MD5 f203b913abfc97089fa71743c3315c15 Copy to Clipboard
SHA1 63de2b59a51a7e68f49d20f1a245a342249eac6d Copy to Clipboard
SHA256 8be133e03157393b143f6c495f74a6c3b115da752beb81870a47696c14a7d922 Copy to Clipboard
SSDeep 48:pUmpdAL5IkhFGGUis4dTpx2jA7o5ceeUUyx:pUmpdAL5Ik6ss4dvwl Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.80 KB
MD5 a2edd3860da5ed0685637d7ff01138bf Copy to Clipboard
SHA1 9ae1371b1bc96653fcbac41e581607d6b51eb859 Copy to Clipboard
SHA256 8c143279a49d8c714f289935650b37d20b3e072d249fd43cada36830a6869dfc Copy to Clipboard
SSDeep 48:/Fhpder7Pk9ZFvWsWx3NQZMzqRfS4Y0uwr9O311XuOyy3:/Fhpkr7PaZFOsWx3mMmtU0721Xz Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 4.33 KB
MD5 6038752ed8959e8e3737cec630996370 Copy to Clipboard
SHA1 151aa3a988f4cb3d04f5c8145059a0d183c5f87e Copy to Clipboard
SHA256 00262d62f1f005c258699454d9aa9ede2f6f91471473e9661206253de25197f7 Copy to Clipboard
SSDeep 96:zYD0rPSosSInlSfpgKQiGBYobYyDmUaQsXKq:zHr6Pup8HbYKmUq Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 3.36 KB
MD5 b0f6a81651a0d1621f5614e52840d777 Copy to Clipboard
SHA1 3e03e7b103b793602028a11c3a976131ee21e489 Copy to Clipboard
SHA256 dc9d0b2b21f827ff17575160f18748a9b9b249f35dc1632f1771d7099310bc7c Copy to Clipboard
SSDeep 48:PesGBbLLql83MC6/LI5tSpPpj4Vrk0ewVPW6qB/4i3zsPRIx4ON2H7eUTyl:Ehyl8cC085tS36Dew9mJMRw4ONsa Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 2.60 KB
MD5 c470ef9e343ddff3b0dcfab09af3146d Copy to Clipboard
SHA1 df534269755a302c57bb57c55e07e7370affd58c Copy to Clipboard
SHA256 10f23a27d5da37d515c95ae448ac1c8c50fb35a7c230110c234c82666bed4f99 Copy to Clipboard
SSDeep 48:UaMelNvRxIjE9wgwRql6+ONHXpFm25voQCsGczqrDdI8rdIz8Og/vu+y3:UaM4tRx19VwRqlclXB5lCsGce5r6634 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.99 KB
MD5 fd2eaa82b95359ec27e2b05278a23efd Copy to Clipboard
SHA1 21e49f43b4208645bcf4a037e7668ae50733bb8c Copy to Clipboard
SHA256 3d25f9bed899b139ff9b023b9b5d13fa060ebd000cb985cff112c4b2519f1f93 Copy to Clipboard
SSDeep 48:wt37lEPZfT8r1s/fTcBibyoMxb7XF0A6XieleUAyj:K3Br1UfTLe3xv18x Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.66 KB
MD5 4fb407870f6ad90f5a7e69fcf0eb32a6 Copy to Clipboard
SHA1 6e1ab4f8331f954181ecbcd5c8fe656fc28014ae Copy to Clipboard
SHA256 9c0aaabb1a290c68289683ee0898d9423c3fe5dc9e742760a98754764ac45b72 Copy to Clipboard
SSDeep 24:wbO3DtBuGzdjOscz+rzIJbhfgsGEuHMJ1HyWYB/mmEK/505k0hfU2GKYb4mFloNY:wbAu6OirsYsJJ3YB/mm/Ryk0Z16Mm6y3 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.55 KB
MD5 6ffa4a43c3130c677c8a334fc5ca6071 Copy to Clipboard
SHA1 693f5390a6084419bb69a4897f516e4c9a2ede22 Copy to Clipboard
SHA256 77f6261a4b2d5c5b3f9327c463e4256ba9a446160e5b294e57e6e80435ddfad8 Copy to Clipboard
SSDeep 24:rS+sAS2DNLhxhFLLeC10NEq53WFSAo/7II0+KytZiZo6vZgnoNnyNl:9JD/FXrE3nAU70igO6vNy3 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.66 KB
MD5 8cfe79ef9a94e0dd29084a07c2a3d777 Copy to Clipboard
SHA1 371bd4dff5b430ae4d500bf5a23674187adafdf1 Copy to Clipboard
SHA256 2987a115ccdead0fb1aa65ee9bb5d13f5f7bc8deade9b94b755f39d1fda5373b Copy to Clipboard
SSDeep 24:GIjynVXrgliG+d8Vi9eJzyPi0bnQewXThUCpb6I7SEUfsc8EEZoNnyNl:7ynV7glLUdVbQyc60fUfsgEIy3 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.03 KB
MD5 26c7460b86f23673757025101d0d7849 Copy to Clipboard
SHA1 2c46b77268fb97225d26011397c1cee246ecea3d Copy to Clipboard
SHA256 3128dcfd469db33e9cbbcbc4e25a32ba04d59494753221fffe772e9863e94719 Copy to Clipboard
SSDeep 24:77kqUi7nlfd0+lxt7bPDreFDaWvCxYRVwoNny5:77571llxtTreF3RVdy5 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 5.97 KB
MD5 adffd795cd34ce7e30520c3631bde935 Copy to Clipboard
SHA1 420c9e12b3127ecab15f8f023b6f52d4d371bf1a Copy to Clipboard
SHA256 a9f4201e125d182dcebd4670af19259992c46eea0e87e899e36df3c1422938a3 Copy to Clipboard
SSDeep 96:EVa/AHfNKGtjUc3alZldeA82wlbukfg9t2lUeyki+212SHe4K1zCEFuBl:SHf5tjdqfldQ6fGaJ1j0OEFuBl Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.60 KB
MD5 ab3ff9767012ec580e7d67c0632f440a Copy to Clipboard
SHA1 0a873683363afda6d06312f72ac234fb370e6a88 Copy to Clipboard
SHA256 62bfc9b207106c86c27c9e5cbe446db6d77da532eed49e88fbf48b07fd0a2b85 Copy to Clipboard
SSDeep 48:LGXv5T8tD7xG7b/HkK4qjCW3WekJ6hbMkG1eUn+yb:LwFq1CHkpqjkJ6WkI Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 2.54 KB
MD5 2c013b4bf7475fad2a59219fdcd22a0f Copy to Clipboard
SHA1 59f33a09a6f8374d0ef63e985556db9f035693e0 Copy to Clipboard
SHA256 8fafdad6caf86bca60ea6211bd22f47f06e3b96875eac0a174124bce70a8e1aa Copy to Clipboard
SSDeep 48:bLfGaRMbSG2T9Kc8JfPpjkvenu5+ShaNVN/gLu7jQiIrRcJ3UmC+WWvuVy3:PsbvNTnpjJ+5haNVmy79sJ+dj Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 2.04 KB
MD5 ffb1e26bb1d9223ec1ca931b0d2b5470 Copy to Clipboard
SHA1 fa9d27418533110763a293f01136eabc2077baa0 Copy to Clipboard
SHA256 182db51501e11dac388e65e908ea8659f8065c97bac953230267a8f534d34e8a Copy to Clipboard
SSDeep 48:sYQCpqmOeWjE2koQkkgun+u8pALUIm1eo9n0/hNEWqoKau7y3:p75OeW42kjpn8+LUF/IhNEWqoVV Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.44 KB
MD5 ccc4bfc7386ca733673914da477fc2d3 Copy to Clipboard
SHA1 5211302ffae1710957fa09f4453b68a411f2a373 Copy to Clipboard
SHA256 19cf8dbf3a9571b58888a1c8ccf0d4aed8bae2d17731a4a52e681b3bab31182a Copy to Clipboard
SSDeep 24:iLKTFR8bs4E4kte+4XFIdDavRCDL2Ki31uFWu2vl1usUXP97j8FfIMdDeUDoNnyb:cBkth4XFIdU2SKi31uN6ltmPRj8FfIMr Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 2.18 KB
MD5 7acbc49261b4e8cd9336805d5f4fa622 Copy to Clipboard
SHA1 42d404609e30ad6b51621dce0f29af5d71baec9d Copy to Clipboard
SHA256 4c52ca6bcad7c22ae4f6f234a445162c4539abf8ce1fe02854e3685d8a304407 Copy to Clipboard
SSDeep 48:n0zuFyLtt32zviEyn75ufscfUL7ctORGVCn4ByFgWOlG8mGKou56g+y3:n0Kmt4Dna5IcEORCvyFDOlG8mGn3gN Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.81 KB
MD5 b4cc28cebd8776b9fcd275201878b6dc Copy to Clipboard
SHA1 189b200ed91fa3ceaa0af166acc28f6dbb86e365 Copy to Clipboard
SHA256 7eb0ae601414f94f264cef5abee38d327d01610a43858702bf4721fb95158e1b Copy to Clipboard
SSDeep 48:nSrpNKYsGEC75I/FRm5qsxAA5xpeqq1QPTeUFyl:nS9QxGNF4Kg0x5xQ14k Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.66 KB
MD5 126887aeaaa149dd49863e32462ead92 Copy to Clipboard
SHA1 0f9b3924d9387ec467561eb3e2c15dda2cf909e5 Copy to Clipboard
SHA256 3c22425202380e91ff723c916fb31658c701e934220eb0f617d4c66c698f16d7 Copy to Clipboard
SSDeep 24:g2rGeG5VQUFrpY+CL8BaTBPGn6navIglzG9X6CWbucWLIsPQVzJHTLeAXEeUdXkR:zru5OwxBkBu8glilpW6cWLS2KEeUVryl Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 9.51 KB
MD5 e207a9f67168bc7034e9383eaa8f3b1c Copy to Clipboard
SHA1 796cbcb3274fa8c299964eb6d2423629d84e33ee Copy to Clipboard
SHA256 b1565c407b5998f43a8e5da33b6e8bd2f8b6585da30c48065c2d4961ff902d63 Copy to Clipboard
SSDeep 192:1uOv4JE63wTuMtulZ5pkfrUoOM6i47uyV1Nba4T+FDNNCSZ1CjjIWKoWfv37Kqb:1uOtTNtuzLkf4oOMdpyV1N+4qFEjv2vL Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 2.07 KB
MD5 637f23a01181691910272706d301a04b Copy to Clipboard
SHA1 cf4d203ce9fbf5314467e16d14c36ebe545a0b8d Copy to Clipboard
SHA256 4f3b017719064285f9e23805814e43f24b172d9e72ec684ca0f097f3006cd648 Copy to Clipboard
SSDeep 48:4wCmU7HGAlnfs91pvL2dubeZmZShcmvrBe505+yyMtfGTV78u8y3:4WUtlnfs91pT2dsRE945S+yLtOTJ8+ Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 6.33 KB
MD5 2f7333dcfaaf4bdb780456e01be89571 Copy to Clipboard
SHA1 f500a8789b25c0712bbd453f395442bde8defd28 Copy to Clipboard
SHA256 ef96e7c632e5ec6409683625ced327559adbdfcfeb31794c76eaa0744db0219a Copy to Clipboard
SSDeep 192:FnU3zI0vfLnFtmhLuNrppxF2EpwoBeTI+n:FnU3zhfzFtgLuN5F213TI+n Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.14 KB
MD5 26c0ffe17ceef16bc85bb474858a32f3 Copy to Clipboard
SHA1 9dec6860c1989281d72ac0a7ea5f2b9abf9c2fdb Copy to Clipboard
SHA256 bb2a17d1e861ad2e19466aa2012c0e8e52cc1cae5afd41a3e658ff9361a66afb Copy to Clipboard
SSDeep 24:p7xWRggbTO2/gKhTb/ZhXsw2pfnHMtOWHykDRBl9N+QZPu0nGeU3loNnyP:p7x+bTO2nhPepfHvWSmNzuIGeU8yP Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.65 KB
MD5 93cec226ca9e271a42e82c58618e98d8 Copy to Clipboard
SHA1 1b5cc6fbf9230375cc1a84781dda327b42f177be Copy to Clipboard
SHA256 17a111758af4d6a293c3c3df82879bf92589264e6670e6b60aaad4d462892963 Copy to Clipboard
SSDeep 24:C6iZYQW7vayW3q6gGOV8b5nlacRal9tOdXHx4jVGb8IQfBesnecwE8uOoNnyNl:C6im2GqOV8bNLu9tOd3KG4BtWrufy3 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 5.67 KB
MD5 5e0c657d528283506c5c632ded0e0cd1 Copy to Clipboard
SHA1 4dff967f7ab167cea38d23a47f80db9a8585bdff Copy to Clipboard
SHA256 c0832f9daea5648de1801893fd12a5a288fa9029283ae35e90e3c45eee73a409 Copy to Clipboard
SSDeep 96:XK4LA38d0m/stwgAzqMjMSVc1BVAdyQsBylFLia3drA9+tKB4Qq2MvvAZiCab/gR:Xp6E0m/0Azq/SVqBVAYBBOFLB3drA9+s Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 582.61 KB
MD5 7d17adc5d42dd46054988d79144b05b1 Copy to Clipboard
SHA1 72d67c31e2a37b6724ab9798c0d676ec76882d16 Copy to Clipboard
SHA256 0dd4198214c31923186ed32d2b4e59d14334adf2dd8c2ae5798528c9d06df627 Copy to Clipboard
SSDeep 12288:MSokjZxpB6rkNI77CDECw331WvHxN+rk2VMgmJRRywpFP:MSog677CDWWn+42VqR3jP Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.05 KB
MD5 d589324f0b6ea34d124b8835de22bc02 Copy to Clipboard
SHA1 c1891b720f99732e92f4b2ac256e59f5eead8c65 Copy to Clipboard
SHA256 db8a3daa0ac822f9934535944f7cef768394ac90d772f79154aaa9bff0dcf9d1 Copy to Clipboard
SSDeep 24:Ixo116op/d964Aa9jwWEHzs4mU4mK/sW4PzwkQszBgBn1klS2WPxoNnyx:I8cop2Na9N2zsi4qW4LwkRtgB1CS2WIq Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 65.85 KB
MD5 72ce94c6d4602b7a4c1a22fd22d3f56c Copy to Clipboard
SHA1 16dc2491f17492836bfaba15507999f07eb12b45 Copy to Clipboard
SHA256 fd703f3e6aee07cd7fd7dcaad3aeaa973c7aabb581ee6ef83434551adf7942a9 Copy to Clipboard
SSDeep 1536:MXccQDrvFCHafyf1n0Ib399DEpmrGd1urkaXEiCfYt0XgRZNFE:VcQf0Q8njzXEpHWka0xfcxRPK Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 9.37 KB
MD5 f9b4ef7a48b19b072d98f94508128875 Copy to Clipboard
SHA1 aaf00b65f8708479468af3c1c27c1c08f1d5eec9 Copy to Clipboard
SHA256 f6b9bcc7803225fa1880a4144eb311af791cc5bd55f9739690691c66b53c589c Copy to Clipboard
SSDeep 192:5DiJKrDxd0OrJMPovl9AO84jLyyEb1s64exP2cUzi4QHpGi:l/7ZJMwEOppcseVrUGXHpGi Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.56 KB
MD5 ef37caa761c507f5db9e06810682f14c Copy to Clipboard
SHA1 27e611d8c1b1f5d02e14da7b33fc31475526ac9c Copy to Clipboard
SHA256 375c649d96d47c91823c4c41bf3cf9dc2337e031518dc0c5c03d11f0da34ce46 Copy to Clipboard
SSDeep 48:iQTcx9LpVhmCL4McPd7u4M+LOOIeUazyP:ZT8LHo04Zd7OE7k Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.05 KB
MD5 eba726a910382199941f0aabe792b400 Copy to Clipboard
SHA1 141b26eefc3d4b0a79ce82dc460d9c4e9201ec62 Copy to Clipboard
SHA256 572698439f3e80e6fe693f0e4ee8460f1702c34dd364977a97be9fd5d9da0be6 Copy to Clipboard
SSDeep 24:7thoO9ZDDh90xsbW4RbKmXQHR6rqOaW1VVhmWS2W1EZoNnyx:ZesBYoQHgK2V22W1Lyx Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 2.80 KB
MD5 e5cc4ff800d656133be81c69837bb652 Copy to Clipboard
SHA1 55808787d942f217b04a03ecf09076a911a7206d Copy to Clipboard
SHA256 3a0ff83bf7987ed89912d55e6672c8953a2e9372bfc953554ec2842eca641068 Copy to Clipboard
SSDeep 48:RxD2Ym9hpvsmU0/Sej3n5bKE4SLc1qlUtM30tVZNy8Y/FvAEe2WnfHzARRsigQDl:vqvQ0qwJbKEpLEqmtM3q39Y/FYEonbAz Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 4.42 KB
MD5 549484e6c06578bb9d61c7e24a5fd6b7 Copy to Clipboard
SHA1 b3dedd79ef4f6db4fc8ccacf52fb00c569b10762 Copy to Clipboard
SHA256 5dc4ee03473ce723a0afc68e2e25555519611b345913ef6697baf79a4d0d440e Copy to Clipboard
SSDeep 96:47buvfvUx16evw1Z7jO77tdJ57nIxtL9tsy559db2jgoW:47yHv7EG9OftdJhI3zsaOEV Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 582.61 KB
MD5 cd87ab0e8d3c97af1756abef151b6811 Copy to Clipboard
SHA1 661e3a1e38cbe984b725ca374b6f4332ae69c72c Copy to Clipboard
SHA256 eaa2715717212181abcdab82adcdb59e00bc7a0e8fd7b70ca49625b19e7920c6 Copy to Clipboard
SSDeep 12288:ZBFmR/M+e1z63iyYXm3EbL4B4n5l55S6LvWdLrM6nI8zncuuq:zFmRU+Wz6ibLwFmsr68z3 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 26.79 KB
MD5 fa1e261deb7660aaf04f5695ce877faf Copy to Clipboard
SHA1 f5000cfb0609c7784053ebb89ef54787f3a64cca Copy to Clipboard
SHA256 60b033c37b031b4af5f689417d96ff1a70cb506a5a1e48488a8a2f9bb9a47866 Copy to Clipboard
SSDeep 768:40yAOsrEOpAyjYlfUctFaLuKs076Xaf3jvvo25:4Az+usfUIFaKKIafc25 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 30.60 KB
MD5 bc6aa662a52cbad15e5bb8bf05dd10db Copy to Clipboard
SHA1 c077c3e9b68bf7d0d0b063d215054d11cfc48865 Copy to Clipboard
SHA256 4d968e40aacc640efb8ebadd5043b89b0e8ebfa210ac5f73e12e9b2687bbfe56 Copy to Clipboard
SSDeep 768:S3J8Q/VcySSpsdgzHGLjxISDmN/n4cWcNqumFDO2MXHMKu:+/MvO/4cWd7BO28Pu Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 16.52 KB
MD5 05fbc1badddab48f45dcd6c723c6fee1 Copy to Clipboard
SHA1 b5eecb09037ed0fd2d08ddceacf2db7738c4f440 Copy to Clipboard
SHA256 ab78cc621e6a92ba0af160b36f95e4f79dfe023f496ec1dd13f0158e8f04cb47 Copy to Clipboard
SSDeep 384:0iDT+lDQb/hcqEzsoQWe/mYBRq1y6HdbuyKYttE8vJvVzKLt7rD/NPmmsq:JSlDQlEzsoTemkqt5LXvvVzK5EmP Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 4.42 KB
MD5 453ed30a64e4abccf141be7c14d7cfc5 Copy to Clipboard
SHA1 f322bcd2d6d5561bf1ab6b5b1fd1a82b050f8c15 Copy to Clipboard
SHA256 2399ea403a690f2778cb8cf2fc51ee7fbaecbd8eeceb5b1e0ed382fa9e5d55cf Copy to Clipboard
SSDeep 96:4zAXMQSZgsZo4cj0KwqUNesbslCQIX5l0ipK/NLaUNdhE:4zqMQSZrZ00KwVAKSCQ6pKVBFE Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 20.33 KB
MD5 b4c4667b0b21fefc0ea0395b07cf1696 Copy to Clipboard
SHA1 a832fa2823c798c772ce76571d0884591afae91d Copy to Clipboard
SHA256 66914058cfa47eaa8aa5306c224972d923e433e89f2c707776fcdfa94b20d28d Copy to Clipboard
SSDeep 384:HExD43VTCkqdZ1Szn71pcs4DAyxz2Is+OQlnBpCfacM74CaaMC2deq7NTThq8l:k2FTCkjHcs4sc8NQlBpHh74Ca5C2deq3 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 16.70 KB
MD5 2fe798165e243f5591338feea781e7b3 Copy to Clipboard
SHA1 788132e8ca7546571e7d80b863061c29d5376832 Copy to Clipboard
SHA256 3b1dfe3864c187a478763ee3d0e415952fadad83b9d0db2e310f65d2e4cf96d4 Copy to Clipboard
SSDeep 384:rOF64BcCgC+2bzT2/8lWtn2IiHCXzQSRuZQPq9Dr9D:rOYCgGbzq/vtn2bCXzblq9Dr9 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 6.51 KB
MD5 00ef362e31ecc9e103a9de904249e195 Copy to Clipboard
SHA1 30836f017d8c97a1b710ee248263e937db3e7c86 Copy to Clipboard
SHA256 10288ba2e2d253d1e7e2a634bce53140409aec0763226b484fb8dbdeda84ba08 Copy to Clipboard
SSDeep 192:oYiwaY97MG/i74IVGrH4SaPjRSIdzQvcFaisL/W:oM7Ml74qSaFhdzQSal/W Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 14.94 KB
MD5 dc09b9e1e7e0a75a2b3f14276b1cf1a8 Copy to Clipboard
SHA1 5875666263250bed22fd858e8f6f36e530ce1fea Copy to Clipboard
SHA256 d92d5f8f8df9b603e0190d95e62f120c7182387abaaee50780ed6f044a7557ae Copy to Clipboard
SSDeep 384:tGTTkMe3wbVhKbbjc3eazGlQZx2vpQgZdj0/VZ1:ETTkMe3wbVMeecYpQEd4/VH Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.27 KB
MD5 90126762b6ec5d8c2e0eabc666a1c36a Copy to Clipboard
SHA1 240d3c8ab2fd335ca8ebea7613a99d4ff80d4493 Copy to Clipboard
SHA256 d67e92a014e7673b7dbeb14bdf4456bf30ccd67d0dae31a83b3214757f6cf724 Copy to Clipboard
SSDeep 24:ZQSmLv72M0BcpEFZrx9JPfstYDbrhtr4IX8RZC9MhFtboNnyV:Ov72dBcW/fdP068pFwyV Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.88 KB
MD5 149185e3f5dda816572e5c6570ddad6d Copy to Clipboard
SHA1 7e3dd7cdca52fc70084bbf2a865cdfd7d1c178be Copy to Clipboard
SHA256 fe1f581131d054fb763f0ec34e67259f9ec24fcea9925f454020db44aa00ee32 Copy to Clipboard
SSDeep 48:yTdKjRcl0ySv323xegxHaaVAbtnwkA1yV:ygjiuy23MxVxVVAbtp Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.27 KB
MD5 2356f7e0a9e1666085c46020bdb469c6 Copy to Clipboard
SHA1 3d56d7050637f4448c9573c7a450c520b741beac Copy to Clipboard
SHA256 284ed42441cbec506bde1113bd11b432954182a77f827efd5f8b79f8b05c8688 Copy to Clipboard
SSDeep 24:keUPGgXHQrezDlRmIEr7SszbinChJb6qal2v0bjME5oAPqNcERSFFFloNnyV:keUPxXHQk3KruIb7jb6Hn55P6sFFMyV Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 4.42 KB
MD5 2eef430cf6931fe398849a82e5c71d55 Copy to Clipboard
SHA1 1f82b99eacbd9545ef67c0ece16fa6544c81671f Copy to Clipboard
SHA256 a78e750da686bed2d39536a591702c7beadc8bb85c93114bbf73369a62578dda Copy to Clipboard
SSDeep 96:SWLwBfSNXXKoJXrqiVkq3+DwHdzM/09BhxNUcxwp9er1O4m7t:SWLwVS1X1JXrPVgMHdXBOPp9e0rB Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 8.76 KB
MD5 116052fe9cae6db7f992792ed87b4ccf Copy to Clipboard
SHA1 0d9162836945db5fcf7017e0753ea83cc6841ddd Copy to Clipboard
SHA256 628e0bc7ee3731bf4da7d1f0de6a4cbc59cd7dcfa1cf0f02168fb5c71b5206e7 Copy to Clipboard
SSDeep 192:PoNYTUW/aL3EIQUDyXLh8tH3wmeH+5f0XruCk7pB2ECN/:AaUWiEILqOWKfGrPk7pB2Ei/ Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.56 KB
MD5 7bf57aeffa7cb0349179884cb1de2695 Copy to Clipboard
SHA1 5d696407204419b54acb45a9e00ceac44f1264d6 Copy to Clipboard
SHA256 44a845f0489698e2d9a25d71fc97c3cf554cc0dac0dbd0eafcbb167d8639d154 Copy to Clipboard
SSDeep 48:nf85acu4lLJdl2JiR1/ZwNOO0V36XdoFsrJ7Z/7+yP:dF4ljlcib1qWs37l Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 2.13 KB
MD5 77e7f82d57c1228094987741187d9bd6 Copy to Clipboard
SHA1 d63f4cad8f93de9495d5216fe054325a5357bca0 Copy to Clipboard
SHA256 3f89a989e6890dbf264b871b0b91cb11c4bbded58c4738f562c6b33e4f0ea88d Copy to Clipboard
SSDeep 48:sFgwuxlkPfYt5Z9MuYtLM9hoDDyByrQa34QSO4ega6HBwyyN:smwu+g8fyqKyEa34Qzga6k Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.76 KB
MD5 5e184c7c05b8bd8e7fb0991f9c0d1e50 Copy to Clipboard
SHA1 d7dcced391353c00293d1a573a919bb03bbe6561 Copy to Clipboard
SHA256 ddce8d036d7f062be08b6b6af313770a3835239624f86831af6861a87d97f342 Copy to Clipboard
SSDeep 48:P3NiTIkRnQLiu/Eg7CXvbogPGz++N6s10+h7WjrMy5:P9iUMBgGXjuKw1yB Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 2.47 KB
MD5 d8a542db06d0a4bbb7cf75b6edfe85df Copy to Clipboard
SHA1 7008eda84be8b26a97cd0b903c60eeb27e180fd6 Copy to Clipboard
SHA256 de1dd15ebbd3571cbef774458947a959b27ac210bfa6271a4c55cfa1087e9b8e Copy to Clipboard
SSDeep 48:8VYIqUbZIzu0FdUbVefZirfZLejtJCghbij7vsMtufyy3:8VYTfUbExirhqfjOHvsWU5 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 582.61 KB
MD5 8cd1769f636253edb2772ec045a17e20 Copy to Clipboard
SHA1 906ca93a5c108067e137d876988c30e55409985a Copy to Clipboard
SHA256 2482ebefa29a4662e04ebad0a793d95cd2d92af287b327f25bd7d837d70f39a3 Copy to Clipboard
SSDeep 12288:/nOMF0JnHJQaLym1OAoDAdYmAgnWgb4E2EoAmCfWVMha:/nJynHJQYX1OArYOnWgb4E1mCWl Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.44 KB
MD5 9e9a078120991475094e85b52eb4f400 Copy to Clipboard
SHA1 a6a021f607435654358cfab6869e3ced940a7262 Copy to Clipboard
SHA256 042abf4887dc7f55f2af801a0adfba2c9a0b3e78560beb1e8508c050ce843fdb Copy to Clipboard
SSDeep 24:KkvcGBBRUH5w6J029Ap9I2vPy97P0538bitk6qiBPCZUtbCBjJlzMuDxoNnyb:lvcGBBSwc026IYPA7M53IiPPaAGVr7UU Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 855.24 KB
MD5 6642007069063aa231bd49478af5d173 Copy to Clipboard
SHA1 98ae8accb8511ba9c68afed0f754befbdfe0d0f8 Copy to Clipboard
SHA256 6bfbf930bf6778fb744fcef7f884fb8b238a2701e38af70262d819f602212610 Copy to Clipboard
SSDeep 24576:/0SxN56L3AM22QDWiCl504K86SciuT5129l:ccbM2GiCz047kiA51Y Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 860.74 KB
MD5 cf9050ca924c933eb1e8a5be0de9c303 Copy to Clipboard
SHA1 b54acf776038d1c487e4bb2640066fbb5ab07b3f Copy to Clipboard
SHA256 c531154761034cc72cac1060d0d16893fae6daded8c99e53ced34b9117a92342 Copy to Clipboard
SSDeep 24576:zeF9FRBcMrnapolIFg/u/3yFFv7XL5aGBnzWsviR:ubLcVoEqu/iFFv7XdaGBRiR Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 9.37 KB
MD5 b077e7d2d73433f6f5906a8ef8371ae1 Copy to Clipboard
SHA1 612b1362bf8f273502259f0859c049fbbaf79222 Copy to Clipboard
SHA256 041ee30f93054e741eca611dbbf6de54776f636f9c8f1d5439d52f372d67aec4 Copy to Clipboard
SSDeep 192:5TKAbVrz3QAMsXbEyr5/HvH2KtYwPytARL83ndUCkOdBPMc7b:LRrj9MuP/HvHptXPytAAnFkwTP Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.60 KB
MD5 eac6753b92368c745389c9335432b460 Copy to Clipboard
SHA1 8c45e730d1901eb874b8fea32c43d2d76411acf9 Copy to Clipboard
SHA256 ff0b938867e4a085907cab6fcfd3bb0ce1705d2721622895c6d39f7b2265e4ad Copy to Clipboard
SSDeep 48:u3PFtWiMivbsB+u8I+jj5s3KvDXU9RNTW17pMhyb:WF4iv4Bmj5iqELJkMa Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 2.54 KB
MD5 5c6713b161d34fa64e34c0c8f09971a1 Copy to Clipboard
SHA1 2196a6f769614559e1fccbd230bf15f062347bbe Copy to Clipboard
SHA256 24b8e3531fde9a5dcdb9fb67beeffe196a34ba887f1459b307eecf361b89b19c Copy to Clipboard
SSDeep 48:765U16Wocj8ucsoxY+Ko+5FyU58TLoXdJ1KE7Y4bWlnKFRyYWUlBrugdy3:VjocjITK6NTLW1KEs19KDtv+ Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 4.42 KB
MD5 277e1ff82c1b96b821c5293894775f26 Copy to Clipboard
SHA1 f8cfe866d63d6106798b48575acdadace846f543 Copy to Clipboard
SHA256 d8a339c94af76b86448f600a268bf0966ce8d4a6b2c117223cdb10d2ce67e0ea Copy to Clipboard
SSDeep 96:PeHV1yMvI538M7DoWHgftKYo+6GaIezbvpbOH5pte6TScVV5:WH/9IZ8MvLHgKYHyoprrVv Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 69.80 KB
MD5 336a9b3c388a858de088e8be8c90a991 Copy to Clipboard
SHA1 a464bece9f3badbeebcc589523bd270f6126da4f Copy to Clipboard
SHA256 6c0bbfbc6adad3e594717b264602ca798a87204b75a7e8f9500b9f74df21d902 Copy to Clipboard
SSDeep 1536:et/BaUOZd4R5G7ytz21AmJBk4cOpsYLkB3d7DVBWdv7bOWv3juz:y/HOZmG2tiAmU4ccA3wh3xTuz Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.05 KB
MD5 4d453acec87fb3331b71d1d611ccba2d Copy to Clipboard
SHA1 adfe613d7aab8e18bf052bc8f5964eb1fb53b9f9 Copy to Clipboard
SHA256 18d13961677b76ffcab604433b509eff4e2fc8bd5563718e189d65ee6376c4fe Copy to Clipboard
SSDeep 24:77rY49w8QVH75Chj15yNjRJyZS2/ufoNnyx:77s+wTV015yN/yZS226yx Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 3.36 KB
MD5 881b015618e45e056c1c9518c29c1102 Copy to Clipboard
SHA1 16c7ea058a772936652e0300793db98c269ffd5e Copy to Clipboard
SHA256 100466e71b4cbcbca420d67c256c613da645d3123d952b8ca5565a327ac53111 Copy to Clipboard
SSDeep 48:xXnINrdFDOug8gybq1N808D1nlZU4R7HJrlVUG6DDGHJMfigvjF5sofEtfxgHJ7L:9nwxg8gyIlEnlZJjb6upMfBLsjxgpf Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 4.33 KB
MD5 e967b5d0435914ac40738e5d7929e991 Copy to Clipboard
SHA1 759a44500f9a4636296c326bd6348fe8c94250c8 Copy to Clipboard
SHA256 4d30962317b1a8d1a996b519ed7771fa3e54e2b4e4d87eb67856959eb793f1e1 Copy to Clipboard
SSDeep 96:DmnfJODK5pBj+GrVqCfeuJMegVduBTwGf/590oerJ+Api/x/PdKo:CnfewJ+GrFzC94TjR90oWJ1aPdT Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.66 KB
MD5 0266fe2d041f0d7c73a1f1cc1ed687d7 Copy to Clipboard
SHA1 fad3252d34c5bba5cbec366a020689324b3110e0 Copy to Clipboard
SHA256 4f4abb0794591fbf4f04ff95a2d2a10144bec0fb4c9a996efd37da0b8a20b155 Copy to Clipboard
SSDeep 24:iZFFIjDEf0BvdYI3IK1qhKZXS+NBXS6y4twQ7asxvQs5DyDpMNxfSHjYtMuxJNoC:QFcTBfIqpY6BwQes5ZNokt7xayH Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 6.51 KB
MD5 bc6b228c379b09cfdae4c251767eae8f Copy to Clipboard
SHA1 21a25b64e6b7d2f8a2dca13bf50ded506ba686b1 Copy to Clipboard
SHA256 16e26b29a871a153fb478d277006f1d8e9c563342fac99d6314a1019fd33401c Copy to Clipboard
SSDeep 96:VHuvCiLpg5lDw/MQgeZFNvySeUjhK/4bv7T2oBjxahR4DJYEX0Bxka:NHCpiDYv3eAhKAj35BjxWRsYEX0BH Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 16.52 KB
MD5 45cc68e8387271bcc49f88fb50115315 Copy to Clipboard
SHA1 2b5253817a91d17ccbf6476c2c7232d4f44b28e2 Copy to Clipboard
SHA256 1bc45395fdb21cd4767e4be63ad02ad918e02e2637f838714934b2b00c50d072 Copy to Clipboard
SSDeep 384:TWJAD0f1PO7I58DIjIB6Xtf5jP0x3KUymMuk5y:aq0NPYI58DmXjNUy7g Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 865.24 KB
MD5 280b8f2584f41900ac3ba28a2411de52 Copy to Clipboard
SHA1 ab96baedfc4fc0c12729fdadc49fba689fa1bc1b Copy to Clipboard
SHA256 91e3d3dbe0e1b73275fafc2894386fd30b74fa1ec4e3fedde739a132cc597eed Copy to Clipboard
SSDeep 24576:tFts/KhNr1p8xk46gojELgNHlSm7NJF4RcmnAN/q:/C/KD6ajFnF7NT4emAVq Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 848.75 KB
MD5 fa584d3de9473b2caa26c9dbdb806752 Copy to Clipboard
SHA1 32bf3edc647ce3a26d1b903a962ae5a5876d74ca Copy to Clipboard
SHA256 d6afbf1466bfb93deeaa19b6f85e8a938bcf820e32c433f221008d3975661312 Copy to Clipboard
SSDeep 24576:pNDHkpDIjupy81cdO6qQcqPtVGlMNb/IgCE73vX:ptjudMEQt1ElM9IiLP Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.66 KB
MD5 6b6095ace8feca758547a6db9360007a Copy to Clipboard
SHA1 9fc06eccb22b563edaeda94e0cd60a33308ec4f5 Copy to Clipboard
SHA256 950bd18a9acd4bd4e37dcaa3ebd9ec46c48e174151bc5d4df8b57b6403b43b82 Copy to Clipboard
SSDeep 24:MgxXOHg8fXhf54fpWOv14HgwDT5lPLNDxrYDXhe3ZI7wMuroNnyl:xeAgt54fpfv1gDTTpD1YTZw7Oyl Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 1.66 KB
MD5 9ce1ed5425a7ada0f286ac51492b5ff1 Copy to Clipboard
SHA1 1ed1e3ab3607a690b12dbf35c5d95765423a01e9 Copy to Clipboard
SHA256 02862c7fd5aac59c19fd145159b9e97b30fda232c54fdd65672db3363d74696d Copy to Clipboard
SSDeep 48:kULoyVAKqyGiQodDGS1xf93/Qs+xG5xuJz9WD6NlkMH756yx:J0MevSLtQscushZN7n Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\SETUP.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 6.33 KB
MD5 5b4d28c4cdbab2b798e88210501a01ad Copy to Clipboard
SHA1 3cb5d57f19d52879f9229ac227bc581ac31a6bbd Copy to Clipboard
SHA256 fe51fb0ac35e79a1fbae2391bedf0fafe99e97f41e2272914bbe9616cc1c3eb8 Copy to Clipboard
SSDeep 192:XXAZj9JAK8l/TfPA5wUFLwFOmtj0WhO3/Jyui:A1LAKGoG+KjVhOxY Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 2.18 KB
MD5 1533f41e435311cdfca3f02b680e893a Copy to Clipboard
SHA1 3375ca4081fbd52714f7749103744f8b396f58e6 Copy to Clipboard
SHA256 66436dd1eb9b20554c79f6229ec44a3e0f5e8fc959629621a463931593fc8e45 Copy to Clipboard
SSDeep 48:Rkk7gCY66RSaTK9YUymCXdvbT1Gox+7lhrqOQJDHnenmmHuzy3:Rke7yRSa+OFmwdzTgkRenH5 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 8.94 KB
MD5 781ee85113b4d25efbc6d98e83d574c2 Copy to Clipboard
SHA1 d750433d75bb225322cbc84f33ef836bb8341b25 Copy to Clipboard
SHA256 8395af634c584b0e06f32f2bf329cbafdf3f7b03433145c2441304ab0ff00672 Copy to Clipboard
SSDeep 192:LLx83OSeyffcHxvB8nKl+Kdn5YG02uCr3vk4x7veXfbsCIxvOQ:y3xfcRvBmmzn5YI1ge7vesCSvP Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 2.04 KB
MD5 8bc53d26ef6024b180f2f810d736ead0 Copy to Clipboard
SHA1 c47970b5d8d762f1585a63af483c2d34b5be2a01 Copy to Clipboard
SHA256 a6cec5c04c2f8a20acf599cf3ce7e0ee902666e266997e17ce3e283d2bd5fe73 Copy to Clipboard
SSDeep 48:E3KY3MQuHT7ZScU4f37xSg+iY9sp2SOgpcTTzhx9YI87h5dzYOy3:E3KY3LuHT7Zz3zxN+LXnGADOpdq Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 9.51 KB
MD5 28a065b263459b91e1760b420d1c1e5e Copy to Clipboard
SHA1 3f20ab723dc0003a06f0bb5885500fea78cf07ec Copy to Clipboard
SHA256 e68fbaac7b0995c7f2067bf874dc25095cbe9055f071b90885b932d3b2a2a7d6 Copy to Clipboard
SSDeep 192:mZ7yBGmaAOFTGLMlGo//xStI737/SBz3SXWpL3:mZeGmh4vlGUxZ3cziGpr Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Malicious
...
»
Mime Type application/octet-stream
File Size 853.75 KB
MD5 5e69c9b76eda9d42b3f74783b7b78887 Copy to Clipboard
SHA1 bd96e09a3ed296520cbfbe0d320bbdbf0a023ebf Copy to Clipboard
SHA256 dbde8ab183ba103a70d78d40e3630c29e93d68b2684be9fb9a817976a896055a Copy to Clipboard
SSDeep 12288:terSG3CqBP07u2hbzalQGm2lLl78EixNAv3t/Rtnv8XCfXzIVObudr+rFHkkYrGf:tMwpa+GHm0JwnxN4l7SG2Ogr6k3waXW Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
DharmaEncryptedFile File encrypted by Dharma Ransomware Ransomware
5/5
...
C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 378 Bytes
MD5 9e18f3de1fa7b4becf3fd0aa3d03fd52 Copy to Clipboard
SHA1 3ce28091cb30539ebc0e0650207ff389016517e1 Copy to Clipboard
SHA256 57d9db6855cbc9a581865f09843f1dabd2c2a56d2f3aa10536b3edc402f9093c Copy to Clipboard
SSDeep 6:iFFYU8F1g5Rzj+Ixg4kNJrg+T7Ui6WCPhnUgZeDQllM25gXr5nrRLggYk2F6C:QY1WRzaIG4gV7Up3nCQlqv75nV8s2FV Copy to Clipboard
ImpHash -
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Unknown
...
»
Also Known As C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi (Dropped File)
Mime Type application/octet-stream
File Size 3.14 MB
MD5 7637ed672d6ba4d8b6d805c2804b604f Copy to Clipboard
SHA1 1060bc1e839f063ce809263f8c98a0ed1e3c2808 Copy to Clipboard
SHA256 5cbbaa05977209676584d4129fa63617ad4a2aa36b449bd91aa4164f06a2120a Copy to Clipboard
SSDeep 49152:zDxL8QBo0Tex4S120ytJyeRq0UrU6S5uyDWzx9c2jlJi:zR89t1GuoJQyDWzx9c2jls Copy to Clipboard
ImpHash -
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Unknown
...
»
Also Known As C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab (Dropped File)
Mime Type application/octet-stream
File Size 16.94 MB
MD5 2fb10a322517f7cbfb3a6cfe3f7ec571 Copy to Clipboard
SHA1 f50dbea0bf05e4a4f73abb265fef52fa43db4e07 Copy to Clipboard
SHA256 5ef870f132dab830dd5380a5f66f2db9ead790ee6610fc191c638c2aecd616a4 Copy to Clipboard
SSDeep 196608:6a8A7fKP0ReD0wXKLUEfRrDXP2ifogB2jHcSBLWiyvyWJRMLhdPWfi:6aRDKP0q0wM9JrL2ifJcjhW/6vL3Ai Copy to Clipboard
ImpHash -
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Unknown
...
»
Also Known As C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi (Dropped File)
Mime Type application/octet-stream
File Size 3.14 MB
MD5 a4790f853ec07bc2fbc11fe94c5a4aea Copy to Clipboard
SHA1 4c689caa25be2d3a44e22f8ba0b192120e43641c Copy to Clipboard
SHA256 3015bfca20d3c16f4777087726dec2d4a4b9d90ecfaf20b7dbf10d7025d834d2 Copy to Clipboard
SSDeep 49152:zDxL8QBo6Tex4S120ytJyp+49xFSM90ysY+mO:zR89j1h+4nFZ9Zxi Copy to Clipboard
ImpHash -
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Unknown
...
»
Also Known As C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab (Dropped File)
Mime Type application/octet-stream
File Size 67.85 MB
MD5 6b078cbccbab0d5edeaa1d85f11ba58a Copy to Clipboard
SHA1 66820f091ea72f244d2d2019748cbda0b7b9702d Copy to Clipboard
SHA256 7597007b7fd82fa6fc079ad255cc80561c20be4bc515df7968b4b0e377292774 Copy to Clipboard
SSDeep 196608:H4KKCX5FvaeoDcBdxmOJR7nxOKOmE7dzaNQwr:H4KKCX5FvaVczxmUJnYSE7dzAT Copy to Clipboard
ImpHash -
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Unknown
...
»
Also Known As C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi (Dropped File)
Mime Type application/octet-stream
File Size 3.15 MB
MD5 fcc669ee3fa2b0be84bb7c400310a96f Copy to Clipboard
SHA1 e5f9ab2840c2e2db231f91770d50f5fa73e671aa Copy to Clipboard
SHA256 085c8f4ae3f836de6c5c46465d53f9f1aa16c0a102ffbadf55aa346c271d35f1 Copy to Clipboard
SSDeep 49152:zDxL8QBonTex4S120ytJykWbwvx64K/gNjNnrfCYilv1:zR89K1DiKwhfCrR1 Copy to Clipboard
ImpHash -
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Unknown
...
»
Also Known As C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab (Dropped File)
Mime Type application/octet-stream
File Size 10.25 MB
MD5 1a1f5e2a9e53117dd1755e5b98d26d4f Copy to Clipboard
SHA1 6d8594ed0230e0a341f470710c4e6e67a03abe84 Copy to Clipboard
SHA256 69c03c407ba455c48872fe1c4ce74befb3075bbc13ffa040a38e354fb1738bce Copy to Clipboard
SSDeep 196608:aPUvTYpH9RBl/tus7o4L7tZiTnp/jE4U/bxlLRx+FV5H:MUvTiNhU4L7tZiTnprP0txRsFn Copy to Clipboard
ImpHash -
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Unknown
...
»
Also Known As C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab (Dropped File)
Mime Type application/octet-stream
File Size 14.88 MB
MD5 0132354deb06c352353675fce278a129 Copy to Clipboard
SHA1 82f447263c0d4d83d398af15034413083edcbc35 Copy to Clipboard
SHA256 8e5451128ff68d309300dd54c2a3bb83f196e6fefb39f1e8d6b7c24b8a6f7307 Copy to Clipboard
SSDeep 196608:TIwm3nNVAl+ig71eZ8FclBElWHEbyLbyo9crpLlR8ioLO0ZF9CrpbQ:OL71eiFge/GHyo2rpLkcoCrpbQ Copy to Clipboard
ImpHash -
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Unknown
...
»
Also Known As C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi (Dropped File)
Mime Type application/octet-stream
File Size 3.48 MB
MD5 874feefd3acc7ad11513855c035fceb8 Copy to Clipboard
SHA1 8dd2c4c95bd154e859b008f69fdfa34ac891f9d7 Copy to Clipboard
SHA256 29865b6950a759cb875697a7c6cad0ff767562c48324926874a738f94c648b60 Copy to Clipboard
SSDeep 49152:fHYLL/WoWLljb1R6rOSN20yRJ6huJGd3/iyE/ZdYcq:fqLVW6vIs0yn Copy to Clipboard
ImpHash -
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Unknown
...
»
Also Known As C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab (Dropped File)
Mime Type application/octet-stream
File Size 42.53 MB
MD5 4fb6c079967f604d4b8cdf477caf6de0 Copy to Clipboard
SHA1 a8777ca0e49e5d98d01a6b007c7b62b5dffb5b63 Copy to Clipboard
SHA256 9fac05c1ffc4b8060b0a5b942d35cc90c0bff012af1a00a6712c6d03018b083f Copy to Clipboard
SSDeep 196608:MaurJM4k8IMj3kMxfGbWaxJMKMA4JxuiNQG3A2r7rfiSFhysD8uxDxKj:EOn8IQkM2BFEx96G3AUf7FnzKj Copy to Clipboard
ImpHash -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Unknown
...
»
Also Known As C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM (Dropped File)
Mime Type application/octet-stream
File Size 2.35 MB
MD5 8687b0292d51148383787b52b8e548f5 Copy to Clipboard
SHA1 59a936e280c3891d16a32073727fb9768d24c88c Copy to Clipboard
SHA256 fb891406cb0f4ba2cc65cf06fb6c890dd2b53f55d24a1741df3295ccd34994ec Copy to Clipboard
SSDeep 24576:nzyc0opacbhmgk5gHL7a35AyjQgz9vzBA4rdeNoXZhhJqiK4FjwVAkoinDu/c:R0opH/cgHa3HRxz+4gophhJqiKhaktnp Copy to Clipboard
ImpHash -
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Unknown
...
»
Also Known As C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi (Dropped File)
Mime Type application/octet-stream
File Size 3.16 MB
MD5 d54c2cd0160e013cc5b8ebaf2d9d5499 Copy to Clipboard
SHA1 4dae63280fa46792846a4bdae627403aa3b02830 Copy to Clipboard
SHA256 44080ddf2eb279ba4681b3ecde9e18372fb8879f46008cf1993de29c7ddcb637 Copy to Clipboard
SSDeep 49152:zDxL8QBoSTex4S120ytJy1bVYwcda8SVebpY4m3t:zR89r1NbawcdJq4zO Copy to Clipboard
ImpHash -
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Unknown
...
»
Also Known As C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab (Dropped File)
Mime Type application/octet-stream
File Size 11.70 MB
MD5 052b4a3aaf24e1879297e0f1408c7662 Copy to Clipboard
SHA1 ccf2d2087988828f8117c27f1ec3ccaf4b5b926d Copy to Clipboard
SHA256 6c23fd16b44e1eefdf52ac7ad99a1fc46a9b4b3e77c6643dd26d1ad79a2d1021 Copy to Clipboard
SSDeep 196608:Vf1gRyjQR9g8YYIcjfXontQdQGzFZaGkGdN7p06H1JX/WanfW/OIV0h:V1WbR9YY5AJGBZWGRz1kaza0h Copy to Clipboard
ImpHash -
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Unknown
...
»
Also Known As C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab (Dropped File)
Mime Type application/octet-stream
File Size 13.76 MB
MD5 42ac6eff5aa1dad153cb32ec3d616e43 Copy to Clipboard
SHA1 8d8693b1d4aa27f2f48345e6f2e760c5f205d163 Copy to Clipboard
SHA256 b8984acb419b90aab0f7fd9addaa90b10847e75aeaabfde74fc133085adf3455 Copy to Clipboard
SSDeep 196608:Yu6eDsIwHBL4B9lCzT2bOgcDuihGYrLpVUBJ/7HAFGtNy6aMhnRTU+:WqsIwHNB26gVE7e/7JNMM5RTU+ Copy to Clipboard
ImpHash -
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.id-9C354B42.[ncov2020@aol.com].NcOv Dropped File Stream
Unknown
...
»
Also Known As C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab (Dropped File)
Mime Type application/octet-stream
File Size 20.84 MB
MD5 3d0e1f18676626331ffefafe53b18248 Copy to Clipboard
SHA1 80d370bf723a4b00b769c1a7266d63de82280ab0 Copy to Clipboard
SHA256 9ceac29cec7a9772266c3c6ed68bc7f25dcb38c12c388fe9f21e58890e9cf26f Copy to Clipboard
SSDeep 196608:PFNUxdiOm1j3/abCsYwFOSQo2pWDOQs4hW6s63HS:qPmN3/abtYIQoROQ93RS Copy to Clipboard
ImpHash -
Exit-Icon
WHOIS Domain Information
Domain Name
WHOIS Response 

       		
      

     

    

   

  

  

  

  

   

    
    

     Function Logfile
    

    

     

      Download-Icon
     

    

    

     Exit-Icon
    

   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image