VTI SCORE: 100/100
Dynamic Analysis Report |
Classification: Wiper, Ransomware, Spyware, Trojan |
w.exe
Windows Exe (x86-32)
Created at 2019-06-28T15:19:00
Remarks
(0x200001e): The maximum size of extracted files was exceeded. Some files may be missing in the report.
(0x200001b): The maximum number of file reputation requests per analysis (150) was exceeded.
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
Filename | Category | Type | Severity | Actions |
---|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\w.exe | Sample File | Binary |
Malicious
|
...
|
»
File Reputation Information
»
Severity |
Blacklisted
|
First Seen | 2019-06-11 23:26 (UTC+2) |
Last Seen | 2019-06-27 09:41 (UTC+2) |
Names | Win32.Trojan.Encoder |
Families | Encoder |
Classification | Trojan |
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x44ba80 |
Size Of Code | 0x1db200 |
Size Of Initialized Data | 0x16c00 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_cui |
Machine Type | MachineType.i386 |
Compile Timestamp | 1970-01-01 00:00:00+00:00 |
Sections (12)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x401000 | 0x1db09c | 0x1db200 | 0x400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.16 |
.data | 0x5dd000 | 0x2ae48 | 0x16c00 | 0x1db600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.53 |
/4 | 0x608000 | 0x1b5 | 0x200 | 0x1f2200 | IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 4.24 |
/18 | 0x609000 | 0x1f3b3 | 0x1f400 | 0x1f2400 | IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.6 |
/30 | 0x629000 | 0x19444 | 0x19600 | 0x211800 | IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 4.36 |
/43 | 0x643000 | 0xe2b2 | 0xe400 | 0x22ae00 | IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 5.41 |
/59 | 0x652000 | 0x11ccd | 0x11e00 | 0x239200 | IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 5.43 |
/75 | 0x664000 | 0x2d | 0x200 | 0x24b000 | IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.79 |
/94 | 0x665000 | 0x95aa8 | 0x95c00 | 0x24b200 | IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 5.95 |
/106 | 0x6fb000 | 0x6d48 | 0x6e00 | 0x2e0e00 | IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 3.89 |
.idata | 0x702000 | 0x372 | 0x400 | 0x2e7c00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.32 |
.symtab | 0x703000 | 0x36289 | 0x36400 | 0x2e8000 | IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 5.28 |
Imports (3)
»
winmm.dll (2)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
timeEndPeriod | 0x0 | 0x5dd000 | 0x3022e6 | 0x2e7ee6 | 0x0 |
timeBeginPeriod | 0x0 | 0x5dd004 | 0x3022ea | 0x2e7eea | 0x0 |
ws2_32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
WSAGetOverlappedResult | 0x0 | 0x5dd00c | 0x3022f2 | 0x2e7ef2 | 0x0 |
kernel32.dll (29)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
WriteFile | 0x0 | 0x5dd014 | 0x3022fa | 0x2e7efa | 0x0 |
WriteConsoleW | 0x0 | 0x5dd018 | 0x3022fe | 0x2e7efe | 0x0 |
WaitForSingleObject | 0x0 | 0x5dd01c | 0x302302 | 0x2e7f02 | 0x0 |
VirtualFree | 0x0 | 0x5dd020 | 0x302306 | 0x2e7f06 | 0x0 |
VirtualAlloc | 0x0 | 0x5dd024 | 0x30230a | 0x2e7f0a | 0x0 |
SwitchToThread | 0x0 | 0x5dd028 | 0x30230e | 0x2e7f0e | 0x0 |
SetWaitableTimer | 0x0 | 0x5dd02c | 0x302312 | 0x2e7f12 | 0x0 |
SetUnhandledExceptionFilter | 0x0 | 0x5dd030 | 0x302316 | 0x2e7f16 | 0x0 |
SetProcessPriorityBoost | 0x0 | 0x5dd034 | 0x30231a | 0x2e7f1a | 0x0 |
SetEvent | 0x0 | 0x5dd038 | 0x30231e | 0x2e7f1e | 0x0 |
SetErrorMode | 0x0 | 0x5dd03c | 0x302322 | 0x2e7f22 | 0x0 |
SetConsoleCtrlHandler | 0x0 | 0x5dd040 | 0x302326 | 0x2e7f26 | 0x0 |
LoadLibraryA | 0x0 | 0x5dd044 | 0x30232a | 0x2e7f2a | 0x0 |
LoadLibraryW | 0x0 | 0x5dd048 | 0x30232e | 0x2e7f2e | 0x0 |
GetSystemInfo | 0x0 | 0x5dd04c | 0x302332 | 0x2e7f32 | 0x0 |
GetStdHandle | 0x0 | 0x5dd050 | 0x302336 | 0x2e7f36 | 0x0 |
GetQueuedCompletionStatus | 0x0 | 0x5dd054 | 0x30233a | 0x2e7f3a | 0x0 |
GetProcessAffinityMask | 0x0 | 0x5dd058 | 0x30233e | 0x2e7f3e | 0x0 |
GetProcAddress | 0x0 | 0x5dd05c | 0x302342 | 0x2e7f42 | 0x0 |
GetEnvironmentStringsW | 0x0 | 0x5dd060 | 0x302346 | 0x2e7f46 | 0x0 |
GetConsoleMode | 0x0 | 0x5dd064 | 0x30234a | 0x2e7f4a | 0x0 |
FreeEnvironmentStringsW | 0x0 | 0x5dd068 | 0x30234e | 0x2e7f4e | 0x0 |
ExitProcess | 0x0 | 0x5dd06c | 0x302352 | 0x2e7f52 | 0x0 |
DuplicateHandle | 0x0 | 0x5dd070 | 0x302356 | 0x2e7f56 | 0x0 |
CreateThread | 0x0 | 0x5dd074 | 0x30235a | 0x2e7f5a | 0x0 |
CreateIoCompletionPort | 0x0 | 0x5dd078 | 0x30235e | 0x2e7f5e | 0x0 |
CreateEventA | 0x0 | 0x5dd07c | 0x302362 | 0x2e7f62 | 0x0 |
CloseHandle | 0x0 | 0x5dd080 | 0x302366 | 0x2e7f66 | 0x0 |
AddVectoredExceptionHandler | 0x0 | 0x5dd084 | 0x30236a | 0x2e7f6a | 0x0 |
Memory Dumps (2)
»
Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
---|---|---|---|---|---|---|---|---|---|---|
w.exe | 1 | 0x00400000 | 0x00739FFF | Relevant Image | - | 32-bit | - |
...
|
||
w.exe | 1 | 0x00400000 | 0x00739FFF | Process Termination | - | 32-bit | - |
...
|
Local AV Matches (1)
»
Threat Name | Severity |
---|---|
Gen:Variant.Ransom.Koje.1 |
Malicious
|
C:\Users\5p5NrGJn0jS HALPmcxz\windows | Dropped File | Text |
Unknown
|
...
|
»
C:\Recovery\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\Winre.wim | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5ft3t_kQuOq_IXeynI9.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6gWXxuRsXBQ.doc.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6gWXxuRsXBQ.doc | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8CXwFq.mkv.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8CXwFq.mkv | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9AXR_x8XIa3ydKIE.ppt.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9AXR_x8XIa3ydKIE.ppt | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\GWmCF1_3WU.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\GWmCF1_3WU.png | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I8YLdLjiG.mkv.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_J1p0hdvpTbfJ.doc.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_J1p0hdvpTbfJ.doc | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KbQ_Jp_Ky1ec-nK.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KbQ_Jp_Ky1ec-nK.png | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\So2CJKBAQ3_MNzog.mp4.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\So2CJKBAQ3_MNzog.mp4 | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\UHK6SgOn.mp3.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\UHK6SgOn.mp3 | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\UtCAuv0GdF.swf.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\UtCAuv0GdF.swf | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YOfE_up0byG PSSN0.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YOfE_up0byG PSSN0.png | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YvYs.gif | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZRlfl3nCYB.gif.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZRlfl3nCYB.gif | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iy4Mpm NDehEf5b8o.gif.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iy4Mpm NDehEf5b8o.gif | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\j498aiGAVucSDl0V.xls.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\j498aiGAVucSDl0V.xls | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\6UB4wAdI8gi.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\6UB4wAdI8gi.png | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\GuwyiBN4YBoT6oCbSzO.mp3.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\GuwyiBN4YBoT6oCbSzO.mp3 | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\RYzmia1V.mp3.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\_cxpP.mkv | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\m26Dpmh_oT.bmp.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\pNpGn.bmp.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\px23TfmpUYS.mkv.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\px23TfmpUYS.mkv | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\qrtc3nFE.avi.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\qrtc3nFE.avi | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\x5z-b33wQMuCpUod67F.bmp.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\x5z-b33wQMuCpUod67F.bmp | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qQwIdGbeg_Z.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qQwIdGbeg_Z.png | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\t1RVfRWHwmjTGo.png.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\t1RVfRWHwmjTGo.png | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\tFeuNNoFgT3OFYmqmD4.wav.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ua-gd3_2Lr0.png | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\zbxI2l.mp3.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\zbxI2l.mp3 | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-i5 zp.xlsx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-i5 zp.xlsx | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\0_T 0gaBQB.xlsx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\0_T 0gaBQB.xlsx | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\2I4gmvT9FNn6X2VW.pptx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\2I4gmvT9FNn6X2VW.pptx | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\6RnXopz-k.doc.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\6RnXopz-k.doc | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\7kTnD.pptx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\7kTnD.pptx | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\5uaSR9B ZuPf1BTfff.odp.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\92_SxvMwhaREWv_iEiv\BbPNjGtemOLJJ4CRkVP.xlsx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\92_SxvMwhaREWv_iEiv\bVHjag_I3.docx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\92_SxvMwhaREWv_iEiv\bVHjag_I3.docx | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\92_SxvMwhaREWv_iEiv\rO8WWC0nut8--lGMs4lz.ppt.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\92_SxvMwhaREWv_iEiv\rO8WWC0nut8--lGMs4lz.ppt | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\L90N\6iZpuv3BJu3uhtMtnn8j.rtf.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\L90N\hcX2.ppt.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\L90N\hcX2.ppt | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\WloOH6tcGBIwPp.odt.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\WloOH6tcGBIwPp.odt | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\rBRyx6fXv755VE2eb\7pXJpJe.odt | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\rBRyx6fXv755VE2eb\GFEs.pps | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\rBRyx6fXv755VE2eb\HgLIrd6VHrvR8L57n3u.pptx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\rBRyx6fXv755VE2eb\HgLIrd6VHrvR8L57n3u.pptx | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BQDECG7yW3K49TIHOfCx.pptx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\FpBJs9T0l nBN.docx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JD48gNU5dunhkE8.xlsx | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\P7lumiyR5eaK1IBOFo9L.docx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\P7lumiyR5eaK1IBOFo9L.docx | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TWBNkQ26WWv\5Szp_wWr9PENCj1pF.odt.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TWBNkQ26WWv\TuDvm7tzErY-EDSrF.odp.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TWBNkQ26WWv\TuDvm7tzErY-EDSrF.odp | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TWBNkQ26WWv\V7fxtVeHfHqqJ_txoS\3CbWu.ods.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TWBNkQ26WWv\V7fxtVeHfHqqJ_txoS\3CbWu.ods | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TWBNkQ26WWv\V7fxtVeHfHqqJ_txoS\Dp2TlVTx1xkc.doc | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TWBNkQ26WWv\V7fxtVeHfHqqJ_txoS\WkAG.ods | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TWBNkQ26WWv\V7fxtVeHfHqqJ_txoS\aqzEZW5ffU2Ui6.pps.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TWBNkQ26WWv\V7fxtVeHfHqqJ_txoS\aqzEZW5ffU2Ui6.pps | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Wwb LK3j94MnP6.xlsx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ZWXqn_jC-RcYRb 637vj.pptx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ZWXqn_jC-RcYRb 637vj.pptx | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_3edhO843d6n2.pptx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\b3pQdKWSVAGMlHxmHP.docx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\b3pQdKWSVAGMlHxmHP.docx | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\dugWQq.pptx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\dugWQq.pptx | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\e34RV1owXwdn9\6kCkH9bq9Z0EKK.ots.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\e34RV1owXwdn9\6kCkH9bq9Z0EKK.ots | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\e34RV1owXwdn9\JgDjmwx dpNNCt.pdf.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\e34RV1owXwdn9\JgDjmwx dpNNCt.pdf | Dropped File |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\e34RV1owXwdn9\ZscHZDJ1hKDGY.pps.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\e34RV1owXwdn9\ZscHZDJ1hKDGY.pps | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\e34RV1owXwdn9\bQRxFeoT.odt.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\e34RV1owXwdn9\bQRxFeoT.odt | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\e34RV1owXwdn9\e7jktwAzMIP7-i51u.odt.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\e34RV1owXwdn9\e7jktwAzMIP7-i51u.odt | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\gt7FMXw.xlsx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\gt7FMXw.xlsx | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\lvnpUtkIx63C1rzbXRhw.docx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\lvnpUtkIx63C1rzbXRhw.docx | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\uddpH51fz2A7yQPy3.docx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\uddpH51fz2A7yQPy3.docx | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\zZZC0cmO vW08IPLyF\Bqf77uf1A55AN8jmxE0.docx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\zZZC0cmO vW08IPLyF\Bqf77uf1A55AN8jmxE0.docx | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\zZZC0cmO vW08IPLyF\LlnXf.xls.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\zZZC0cmO vW08IPLyF\LlnXf.xls | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\zZZC0cmO vW08IPLyF\RuF fqkFm-urxCQfPr0I.ppt | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\zZZC0cmO vW08IPLyF\blGRvAO.pps.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\zZZC0cmO vW08IPLyF\blGRvAO.pps | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\zZZC0cmO vW08IPLyF\hTL2X-ua0.xlsx.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\zZZC0cmO vW08IPLyF\zxy1zpsMEyu9i-oEm\izAPhrCo5geU NpBp.pdf.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\zZZC0cmO vW08IPLyF\zxy1zpsMEyu9i-oEm\izAPhrCo5geU NpBp.pdf | Dropped File |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\4kudbYFod536W.mp3 | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\6y9cXxGS3Ie6eS9MzHg.mp3 | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\Kql5D AvlhFAAIgIXG.mp3.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\R_LtNbRdhxzRBemmy\SbedjKy53aXL.mp3.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\R_LtNbRdhxzRBemmy\SbedjKy53aXL.mp3 | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\R_LtNbRdhxzRBemmy\dOTEpDsxVXbKTz9_o.mp3.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\R_LtNbRdhxzRBemmy\dlez1\56jXG_rUP2Pu7xpB-7.wav.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\R_LtNbRdhxzRBemmy\dlez1\JhyKkJx_QpfYC.mp3.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\R_LtNbRdhxzRBemmy\dlez1\JhyKkJx_QpfYC.mp3 | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\R_LtNbRdhxzRBemmy\dlez1\QIy9IyIY-0h7uwPYNL0R.wav.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\R_LtNbRdhxzRBemmy\dlez1\QIy9IyIY-0h7uwPYNL0R.wav | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\R_LtNbRdhxzRBemmy\dlez1\gLDnq5k8FqlCxMD\1n9mZlXtVJQa.mp3.locked | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\R_LtNbRdhxzRBemmy\dlez1\gLDnq5k8FqlCxMD\1n9mZlXtVJQa.mp3 | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5ft3t_kQuOq_IXeynI9.png | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\BB3EjVzP-y.mp3.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\BB3EjVzP-y.mp3 | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I8YLdLjiG.mkv | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YvYs.gif.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ihBRwI9DVtya7Z.pptx.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ihBRwI9DVtya7Z.pptx | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\RYzmia1V.mp3 | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\_cxpP.mkv.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\m26Dpmh_oT.bmp | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jOgQ2vmu\pNpGn.bmp | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\tFeuNNoFgT3OFYmqmD4.wav | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ua-gd3_2Lr0.png.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\vFj8enUSau3xYExaO.wav.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\vFj8enUSau3xYExaO.wav | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\5uaSR9B ZuPf1BTfff.odp | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\92_SxvMwhaREWv_iEiv\BbPNjGtemOLJJ4CRkVP.xlsx | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\L90N\6iZpuv3BJu3uhtMtnn8j.rtf | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\rBRyx6fXv755VE2eb\7pXJpJe.odt.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\rBRyx6fXv755VE2eb\GFEs.pps.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\rBRyx6fXv755VE2eb\XdnIlhat.pptx.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\rBRyx6fXv755VE2eb\XdnIlhat.pptx | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\znj4GRNLu Ef_g3D4bC.csv.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BNZcRVrP4ZNbQtfNT_rY\znj4GRNLu Ef_g3D4bC.csv | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BQDECG7yW3K49TIHOfCx.pptx | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\FpBJs9T0l nBN.docx | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JD48gNU5dunhkE8.xlsx.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TWBNkQ26WWv\5Szp_wWr9PENCj1pF.odt | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TWBNkQ26WWv\V7fxtVeHfHqqJ_txoS\Dp2TlVTx1xkc.doc.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TWBNkQ26WWv\V7fxtVeHfHqqJ_txoS\WkAG.ods.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TWBNkQ26WWv\V7fxtVeHfHqqJ_txoS\cw88GojW.pps.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TWBNkQ26WWv\V7fxtVeHfHqqJ_txoS\cw88GojW.pps | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Wwb LK3j94MnP6.xlsx | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_3edhO843d6n2.pptx | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cQ3HZy-ljR_WZq8CsVX.odp.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cQ3HZy-ljR_WZq8CsVX.odp | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\zZZC0cmO vW08IPLyF\RuF fqkFm-urxCQfPr0I.ppt.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\zZZC0cmO vW08IPLyF\hTL2X-ua0.xlsx | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\4kudbYFod536W.mp3.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\6y9cXxGS3Ie6eS9MzHg.mp3.locked | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\Kql5D AvlhFAAIgIXG.mp3 | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\R_LtNbRdhxzRBemmy\dOTEpDsxVXbKTz9_o.mp3 | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\071XbJ\R_LtNbRdhxzRBemmy\dlez1\56jXG_rUP2Pu7xpB-7.wav | Dropped File | Text |
Not Queried
|
...
|
»