aa8c5d42...cc99

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\h1rxxmJek7fnkHTT.exe

Sample File

Binary

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\97f793e1-7a7e-4733-93ae-21a624f0cac5\h1rxxmJek7fnkHTT.exe (Dropped File)
Mime Type	application/vnd.microsoft.portable-executable
File Size	744.00 KB
MD5	3880b3ff41deb92ebbdcbff5e5038921
SHA1	e2aaf9e85bb97ed07bb9c00321f244763037fb2c
SHA256	aa8c5d42026ac9a483f1984f762441d7f5805ef914819b473f9e15353995cc99
SSDeep	12288:d5Jmh4RSDskxsr1nKUJZSwEVp7eO1NmymxXyhAUWs4ie:DJmbir1KUJ4wTyBmxXyhz5T
ImpHash	d7a2105ad1e8c50373aa800e9834c90d

PE Information

»

Image Base	0x400000
Entry Point	0x40283d
Size Of Code	0x9fa00
Size Of Initialized Data	0xcb400
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2019-09-20 06:11:18+00:00

Sections (8)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x9f9a0	0x9fa00	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	7.98
.rdata	0x4a1000	0x3d0e	0x3e00	0x9fe00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	6.55
.data	0x4a5000	0xb0614	0x1600	0xa3c00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	3.24
.gopawo	0x556000	0x3b88	0x3c00	0xa5200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	0.0
.pey	0x55a000	0x357	0x400	0xa8e00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
.yaxu	0x55b000	0x8734	0x8800	0xa9200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
.kadaxu	0x564000	0x1400	0x600	0xb1a00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
.rsrc	0x566000	0x7e20	0x8000	0xb2000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.75

Imports (2)

»

KERNEL32.dll (100)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetFullPathNameW	0x0	0x4a1000	0xa43a8	0xa31a8	0x1df
GetEnvironmentVariableW	0x0	0x4a1004	0xa43ac	0xa31ac	0x1c3
HeapReAlloc	0x0	0x4a1008	0xa43b0	0xa31b0	0x2a4
SetVolumeLabelA	0x0	0x4a100c	0xa43b4	0xa31b4	0x418
IsBadStringPtrW	0x0	0x4a1010	0xa43b8	0xa31b8	0x2ca
WriteConsoleOutputCharacterW	0x0	0x4a1014	0xa43bc	0xa31bc	0x48a
lstrlenA	0x0	0x4a1018	0xa43c0	0xa31c0	0x4b5
GetDefaultCommConfigW	0x0	0x4a101c	0xa43c4	0xa31c4	0x1b2
GetProcessIoCounters	0x0	0x4a1020	0xa43c8	0xa31c8	0x227
ClearCommError	0x0	0x4a1024	0xa43cc	0xa31cc	0x41
GetQueuedCompletionStatus	0x0	0x4a1028	0xa43d0	0xa31d0	0x235
GetNumaAvailableMemoryNode	0x0	0x4a102c	0xa43d4	0xa31d4	0x208
GetTickCount	0x0	0x4a1030	0xa43d8	0xa31d8	0x266
GetWindowsDirectoryA	0x0	0x4a1034	0xa43dc	0xa31dc	0x280
GetPriorityClass	0x0	0x4a1038	0xa43e0	0xa31e0	0x215
GlobalAlloc	0x0	0x4a103c	0xa43e4	0xa31e4	0x285
GetThreadSelectorEntry	0x0	0x4a1040	0xa43e8	0xa31e8	0x263
SizeofResource	0x0	0x4a1044	0xa43ec	0xa31ec	0x420
GetWriteWatch	0x0	0x4a1048	0xa43f0	0xa31f0	0x282
SetConsoleCursorPosition	0x0	0x4a104c	0xa43f4	0xa31f4	0x3ab
MultiByteToWideChar	0x0	0x4a1050	0xa43f8	0xa31f8	0x31a
FindFirstFileExA	0x0	0x4a1054	0xa43fc	0xa31fc	0x11e
GetLastError	0x0	0x4a1058	0xa4400	0xa3200	0x1e6
EnumDateFormatsExA	0x0	0x4a105c	0xa4404	0xa3204	0xe0
EnumSystemCodePagesW	0x0	0x4a1060	0xa4408	0xa3208	0xf3
SetFileApisToOEM	0x0	0x4a1064	0xa440c	0xa320c	0x3d6
GetAtomNameA	0x0	0x4a1068	0xa4410	0xa3210	0x155
LoadLibraryA	0x0	0x4a106c	0xa4414	0xa3214	0x2f1
FindFirstVolumeMountPointW	0x0	0x4a1070	0xa4418	0xa3218	0x129
SetConsoleCtrlHandler	0x0	0x4a1074	0xa441c	0xa321c	0x3a7
SetProcessWorkingSetSize	0x0	0x4a1078	0xa4420	0xa3220	0x3fa
GetModuleFileNameA	0x0	0x4a107c	0xa4424	0xa3224	0x1f4
VirtualProtect	0x0	0x4a1080	0xa4428	0xa3228	0x45a
CompareStringA	0x0	0x4a1084	0xa442c	0xa322c	0x52
SetCalendarInfoA	0x0	0x4a1088	0xa4430	0xa3230	0x398
GetVolumeNameForVolumeMountPointW	0x0	0x4a108c	0xa4434	0xa3234	0x27b
GetCurrentProcessId	0x0	0x4a1090	0xa4438	0xa3238	0x1aa
FindNextVolumeA	0x0	0x4a1094	0xa443c	0xa323c	0x132
CreateFileA	0x0	0x4a1098	0xa4440	0xa3240	0x78
GetCommandLineA	0x0	0x4a109c	0xa4444	0xa3244	0x16f
GetStartupInfoA	0x0	0x4a10a0	0xa4448	0xa3248	0x239
TerminateProcess	0x0	0x4a10a4	0xa444c	0xa324c	0x42d
GetCurrentProcess	0x0	0x4a10a8	0xa4450	0xa3250	0x1a9
UnhandledExceptionFilter	0x0	0x4a10ac	0xa4454	0xa3254	0x43e
SetUnhandledExceptionFilter	0x0	0x4a10b0	0xa4458	0xa3258	0x415
IsDebuggerPresent	0x0	0x4a10b4	0xa445c	0xa325c	0x2d1
EnterCriticalSection	0x0	0x4a10b8	0xa4460	0xa3260	0xd9
LeaveCriticalSection	0x0	0x4a10bc	0xa4464	0xa3264	0x2ef
HeapFree	0x0	0x4a10c0	0xa4468	0xa3268	0x2a1
SetHandleCount	0x0	0x4a10c4	0xa446c	0xa326c	0x3e8
GetStdHandle	0x0	0x4a10c8	0xa4470	0xa3270	0x23b
GetFileType	0x0	0x4a10cc	0xa4474	0xa3274	0x1d7
DeleteCriticalSection	0x0	0x4a10d0	0xa4478	0xa3278	0xbe
SetFilePointer	0x0	0x4a10d4	0xa447c	0xa327c	0x3df
GetModuleHandleW	0x0	0x4a10d8	0xa4480	0xa3280	0x1f9
Sleep	0x0	0x4a10dc	0xa4484	0xa3284	0x421
GetProcAddress	0x0	0x4a10e0	0xa4488	0xa3288	0x220
ExitProcess	0x0	0x4a10e4	0xa448c	0xa328c	0x104
WriteFile	0x0	0x4a10e8	0xa4490	0xa3290	0x48d
FreeEnvironmentStringsA	0x0	0x4a10ec	0xa4494	0xa3294	0x14a
GetEnvironmentStrings	0x0	0x4a10f0	0xa4498	0xa3298	0x1bf
FreeEnvironmentStringsW	0x0	0x4a10f4	0xa449c	0xa329c	0x14b
WideCharToMultiByte	0x0	0x4a10f8	0xa44a0	0xa32a0	0x47a
GetEnvironmentStringsW	0x0	0x4a10fc	0xa44a4	0xa32a4	0x1c1
TlsGetValue	0x0	0x4a1100	0xa44a8	0xa32a8	0x434
TlsAlloc	0x0	0x4a1104	0xa44ac	0xa32ac	0x432
TlsSetValue	0x0	0x4a1108	0xa44b0	0xa32b0	0x435
TlsFree	0x0	0x4a110c	0xa44b4	0xa32b4	0x433
InterlockedIncrement	0x0	0x4a1110	0xa44b8	0xa32b8	0x2c0
SetLastError	0x0	0x4a1114	0xa44bc	0xa32bc	0x3ec
GetCurrentThreadId	0x0	0x4a1118	0xa44c0	0xa32c0	0x1ad
InterlockedDecrement	0x0	0x4a111c	0xa44c4	0xa32c4	0x2bc
HeapCreate	0x0	0x4a1120	0xa44c8	0xa32c8	0x29f
VirtualFree	0x0	0x4a1124	0xa44cc	0xa32cc	0x457
QueryPerformanceCounter	0x0	0x4a1128	0xa44d0	0xa32d0	0x354
GetSystemTimeAsFileTime	0x0	0x4a112c	0xa44d4	0xa32d4	0x24f
RaiseException	0x0	0x4a1130	0xa44d8	0xa32d8	0x35a
GetCPInfo	0x0	0x4a1134	0xa44dc	0xa32dc	0x15b
GetACP	0x0	0x4a1138	0xa44e0	0xa32e0	0x152
GetOEMCP	0x0	0x4a113c	0xa44e4	0xa32e4	0x213
IsValidCodePage	0x0	0x4a1140	0xa44e8	0xa32e8	0x2db
RtlUnwind	0x0	0x4a1144	0xa44ec	0xa32ec	0x392
HeapAlloc	0x0	0x4a1148	0xa44f0	0xa32f0	0x29d
VirtualAlloc	0x0	0x4a114c	0xa44f4	0xa32f4	0x454
InitializeCriticalSectionAndSpinCount	0x0	0x4a1150	0xa44f8	0xa32f8	0x2b5
SetStdHandle	0x0	0x4a1154	0xa44fc	0xa32fc	0x3fc
GetConsoleCP	0x0	0x4a1158	0xa4500	0xa3300	0x183
GetConsoleMode	0x0	0x4a115c	0xa4504	0xa3304	0x195
FlushFileBuffers	0x0	0x4a1160	0xa4508	0xa3308	0x141
GetModuleHandleA	0x0	0x4a1164	0xa450c	0xa330c	0x1f6
LCMapStringA	0x0	0x4a1168	0xa4510	0xa3310	0x2e1
LCMapStringW	0x0	0x4a116c	0xa4514	0xa3314	0x2e3
GetStringTypeA	0x0	0x4a1170	0xa4518	0xa3318	0x23d
GetStringTypeW	0x0	0x4a1174	0xa451c	0xa331c	0x240
GetLocaleInfoA	0x0	0x4a1178	0xa4520	0xa3320	0x1e8
WriteConsoleA	0x0	0x4a117c	0xa4524	0xa3324	0x482
GetConsoleOutputCP	0x0	0x4a1180	0xa4528	0xa3328	0x199
WriteConsoleW	0x0	0x4a1184	0xa452c	0xa332c	0x48c
HeapSize	0x0	0x4a1188	0xa4530	0xa3330	0x2a6
CloseHandle	0x0	0x4a118c	0xa4534	0xa3334	0x43

USER32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCaretPos	0x0	0x4a1194	0xa453c	0xa333c	0x103

Icons (1)

»

Memory Dumps (43)

»

Name	Process ID	Start VA	End VA	Dump Reason	Bitness	Entry Point	Actions
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Relevant Image	32-bit	0x0040414C	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x00270000	0x00300FFF	First Execution	32-bit	0x00270020	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x01DE0000	0x01EF9FFF	First Execution	32-bit	0x01DE0000	... Memory Dump Actions Go to Process Go to YARA Matches Download Dump
buffer	1	0x01DE0000	0x01EF9FFF	Content Changed	32-bit	0x01DE04F6	... Memory Dump Actions Go to Process Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00424141	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00423F84	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0042C0F0	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0043B021	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00431F64	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00421881	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0042B420	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x004548D0	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0041CC50	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00419E70	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0040CF10	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0042B420	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Final Dump	32-bit	0x00430BF0	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00433F99	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00424081	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x004CA6F7	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
buffer	1	0x01DE0000	0x01EF9FFF	Content Changed	32-bit	0x01DE0920	... Memory Dump Actions Go to Process Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Process Termination	32-bit	-	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Relevant Image	32-bit	0x0040414C	... Memory Dump Actions Go to Process Download Dump
buffer	6	0x00210000	0x002A0FFF	First Execution	32-bit	0x00210020	... Memory Dump Actions Go to Process Download Dump
buffer	6	0x01E30000	0x01F49FFF	First Execution	32-bit	0x01E30000	... Memory Dump Actions Go to Process Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00424141	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00423F84	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0042C0F0	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0043B021	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00431F64	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00421881	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0042B420	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x004548D0	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0041CC50	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00419E70	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0040CF10	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0041B680	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0041E031	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0042E003	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00447F50	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0041F01A	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00410FC0	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
buffer	15	0x01E50000	0x01F69FFF	First Execution	32-bit	0x01E50000	... Memory Dump Actions Go to Process Go to YARA Matches Download Dump

C:\Windows\System32\drivers\etc\hosts

Modified File

Text

Malicious

»

Mime Type	text/plain
File Size	7.92 KB
MD5	360d265eddea8679c434a205f7ade7ad
SHA1	e17d843f610e0283904e201195360525ae449a68
SHA256	5a1597c0d29dd475e33cd8889d7d848037a8c17bad0f3daa022fb889e0db7ead
SSDeep	96:vDZEurK9q3WlSyU0FXmGZll0TOHyF9fAHLmttA/ZKTKdIlMHqzoCGbXx:RrK9FU0FXmGZll06m9fAH6AhKTK9Cax
ImpHash	-

File Reputation Information

»

Severity	Blacklisted
Names	Mal/Generic-S

Local AV Matches (1)

»

Threat Name	Severity
Gen:Trojan.Qhost.1	Malicious

C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact (Modified File)
Mime Type	application/octet-stream
File Size	1.48 KB
MD5	c883c51c38d011c696dd4100ed8b5db8
SHA1	cbc7f992968b3881ddb691a6bde6a82c6379f8d9
SHA256	f9510e23eac37be4308970eb27d3854c10e01691bc7748771a88b17b7c73a051
SSDeep	24:Aalbp7iEHjuYBF26l5Q7w5ixWYnLNWM7xrcbZJgtnR6z9gZBLfHrMfkPSjscd1LA:RLhHjbbl5CFLgsAbZytnEz9uBrLMfmSe
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact.remk (Dropped File)
Mime Type	application/octet-stream
File Size	67.11 KB
MD5	f2b0f3aafb980c5e2d0d90c102077bd1
SHA1	6533eaaf100b7e98aa45503e1161a1463c40f449
SHA256	7c1bee717e02334331eccbb0f5de68716641ff193e855c4de8b48509291fdcc3
SSDeep	1536:T9r9r1nLsCrJ/j6ByvBgdMe58aGg4b8x2g7CLesfu34snV24z:ZxJnLhNb6BecTSbNg+qstsndz
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact (Modified File)
Mime Type	application/octet-stream
File Size	1.47 KB
MD5	1e8795c4c5b7c5edf6f6f92aeaa93e6b
SHA1	41882b3214c799b9eae46aa67a847e96ae757cef
SHA256	2c11e1727d48e1e33c42b241ee867665f1b96bbfad88bcaa2243f1c5fbf0234e
SSDeep	24:yBk3DqGzszQexju8DZCfLyVXDDzGxjzF3gjKL8/MPZNUBTbMuy+z7TfGyrn1LGbD:l3Dqs9eDZmG3zG51DI/MPDX+zfnCD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact.remk (Dropped File)
Mime Type	application/octet-stream
File Size	1.48 KB
MD5	7379885c0fea088d82215d7e9e9a3dc2
SHA1	55b2a9467eab03dd9dd1f75e22463b5a6f0c922a
SHA256	44ff046b5e7d2bcb3b48c3d1fe61e84518ded86d57de4ef54612869770905a88
SSDeep	24:rllYJx4sJ3QMThDbbL7SdgHZfPkg0z0a5gH/dpXb0WQ2KzHPAxZvke+wHFvurSNu:xlynAwbL2dgHZfPxH/rXb0WQ3vAMwHFg
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact (Modified File)
Mime Type	application/octet-stream
File Size	1.47 KB
MD5	b88c156917d83bdcb3c127c0fd6bf374
SHA1	eb09a79c88b7adc44d7695353a7585bd8dd52bcc
SHA256	a47111a6c3159bfef665f0e564f2ae61703ab822d82aa394a95d675d6a82cac0
SSDeep	24:RWCHS81qUR95R8SojZcwdhHtQnJbc/BCjh1sdoB8PIac2XQ9EhcWHJ+BterFRfPO:RW2S8wU30NN8uTI8BhiOmt0RfZbCJD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact.remk (Dropped File)
Mime Type	application/octet-stream
File Size	1.47 KB
MD5	b51f920ab174ac3557f4ff48fc8f9a06
SHA1	18a048c5c87adfb2e8d8156985cf9f6cb9a3d3fd
SHA256	284cdab3ccf34976f290162a2d68123c69a8b7be8f8d01f90b90a2f22fab7101
SSDeep	24:Cm+LWhx5AmNZ3RWDqLQE4OAnvUMrb+QqCPXELIOODG5NiDUBjLGbD:C/kASZ3E24OClP+QZXtOL5NiIBED
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-ZkT JS.bmp

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-ZkT JS.bmp.remk (Dropped File)
Mime Type	application/octet-stream
File Size	81.57 KB
MD5	33534716d9b3fc7f39d61adb96c92769
SHA1	98253137426b9c734b66a7bd50cdd725b3921c03
SHA256	da82b02f7016d683b8be00ca73c70954fb7ac2a899f876a420705b27f315eef2
SSDeep	1536:M9MeZ/fjYiY2uy+jQMqle6y51bK+tBr57IOnPzrAINqbfh1QVs3QRA8wQg/c:M9Me5EiY20jQZy/7Bt7rpw3Q2IEc
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7GTeFnWqgS9ZSpp-9d.png.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7GTeFnWqgS9ZSpp-9d.png (Modified File)
Mime Type	application/octet-stream
File Size	35.59 KB
MD5	89215e1efce10337f1626463b6481335
SHA1	187be3dcc9f42ed66a99ed1631138449a3331b52
SHA256	2423c6abb283c4f8ae0e11a46def856fc3c0496d95717921499eccf97a356aa7
SSDeep	768:5vqGMH2sT13+H7QNiTF2l8psmngasQt/ssbxduWRC4GJXMQA:5iJTi70iT+0fbRC4v
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\AwaZ_7Drvt.mkv.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\AwaZ_7Drvt.mkv (Modified File)
Mime Type	application/octet-stream
File Size	80.37 KB
MD5	d2e3bdff4e52e6f9f9abf81cc3633115
SHA1	773bfd347e2be748cf959b74b83adafb7c2cc324
SHA256	fc93ae0de02ca8cad94aaec396cce433477a85e0a22cec778c3ab9ff7a656870
SSDeep	1536:z00V71V7uLMlC8eRkdcGzitPrmZPCOufUsp4Xw4YaKS8NWtr:4s7jFHtzMmZu59oQmr
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\AzVzcW.mp4.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\AzVzcW.mp4 (Modified File)
Mime Type	application/octet-stream
File Size	56.66 KB
MD5	6a2eeed8b1a25ed19907ea45bce2f4e7
SHA1	a0cf4c92a3b89b2546ebdf71bec47054572c097d
SHA256	dc48b77db924921a18e8b4a65e0d1a139d5c4ea7064ef7301e138120daaac86b
SSDeep	768:eMXqA6c2oWCKTAgS6aHfi2jlyFeBQkAEyoqT/RT1CjFRR54q90jKR+K9e9bk8b/:J6A6D4fi4PBtAlT4jFRR53tRPe15b/
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bi2gofC9nKVEjCY.png

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bi2gofC9nKVEjCY.png.remk (Dropped File)
Mime Type	application/octet-stream
File Size	21.40 KB
MD5	06eab061fb7731b6f746c7ecf2dfc7e6
SHA1	43caf6ec9b2150ae3d7774f124d00cf481a10077
SHA256	72d18722802357db2ab9785eb913e6a88a942b89529acf59044b197341ddf16f
SSDeep	384:sH/THaHod84pTxx16ekU2u/hiUJlqd8FCqJ2mwH7t0HFF46qapZUl:2r0416ekUN/hdWINoRgrqMc
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cYR-e.avi.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\cYR-e.avi (Modified File)
Mime Type	application/octet-stream
File Size	72.01 KB
MD5	09f2d54d7b794f2dee98e58fa16e4626
SHA1	8a4ad56bbab885d26d076f783e5bd79cd9625d45
SHA256	0afa2394a9abc7d55084f7b8a15fa7a849b029d03f8f8b6cb595adb2a08280f2
SSDeep	1536:Uz2KryK2bzdE1PNlkHLhzi7VHlsHzgQ7R/yUUA76JEmMFZthvb60E8rtk8:Uz2fJi36LwZaTJFhwEPFZtpbPrt9
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d24F8YNCqwI.png

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d24F8YNCqwI.png.remk (Dropped File)
Mime Type	application/octet-stream
File Size	62.08 KB
MD5	850d5ec636e2f677a0f36fde1788bbcb
SHA1	a7fc51f70a13325d51d7e2a21c591eee01e65d07
SHA256	c115294784e738f99607eb4258d2f7dd2eda62bce759f1db70204f6e20b1788b
SSDeep	1536:Smsb7qvcz/fdjqUFbXp3yq1VP1DiaM8fHCMnmVjB+dC:fsXz/fpZF3BnpiaVHCMmVjB+I
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dbj5OVvUTa4bloIz9N.flv.remk

Dropped File

Video

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dbj5OVvUTa4bloIz9N.flv (Modified File)
Mime Type	video/x-flv
File Size	71.92 KB
MD5	59ea2619075613432f7748f43666a2e9
SHA1	5ba9abb4633078d597e80951378082b3f42e5699
SHA256	12dd1fe16319924d8f5630d1256ea28c1f2f5067f103d8b53963c3d1d0a83f67
SSDeep	768:Tjf2el8AWfk6LH0av84++CSiN0jiziBVqt0IrfYPmX3FLLw78dFIV/PMLG6lTXTc:Tjf2CF20DDbNUWiBcuIrFuAdq9PsNl8
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\e6zU.xlsx

Modified File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\e6zU.xlsx.remk (Dropped File)
Mime Type	application/zip
File Size	58.02 KB
MD5	d7c624e257298443384c34bf82a948d6
SHA1	6902e30a902a073863544bde9592f8a280ddeedd
SHA256	99e076809cefc1afeda6e689d12f4e9567a4dce3486287379d119ff97189cc5d
SSDeep	1536:Pnn8SCgttn28Ev/d2YsQDN1+bRzJlgqqP:PnQgbsv/ArQn7qk
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\h1rxxmJek7fnkHTT.exe

Modified File

Binary

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\h1rxxmJek7fnkHTT.exe.remk (Dropped File)
Mime Type	application/x-dosexec
File Size	744.33 KB
MD5	5d5a38e5a3284c404cc135dc039dd145
SHA1	6e33704fcd6951bea0ef6ac5489729d1d9017776
SHA256	98d25757c9fee19fce7d4b7780317a9e3e47c95dc15be18afecb6657895fea79
SSDeep	12288:+VKBTBnlO0rPgDskxsr1nKUJZSwEVp7eO1NmymxXyhAUWs4iel:PlO2P2ir1KUJ4wTyBmxXyhz5TW
ImpHash	-

Memory Dumps (43)

»

Name	Process ID	Start VA	End VA	Dump Reason	Bitness	Entry Point	Actions
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Relevant Image	32-bit	0x0040414C	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x00270000	0x00300FFF	First Execution	32-bit	0x00270020	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x01DE0000	0x01EF9FFF	First Execution	32-bit	0x01DE0000	... Memory Dump Actions Go to Process Go to YARA Matches Download Dump
buffer	1	0x01DE0000	0x01EF9FFF	Content Changed	32-bit	0x01DE04F6	... Memory Dump Actions Go to Process Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00424141	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00423F84	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0042C0F0	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0043B021	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00431F64	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00421881	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0042B420	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x004548D0	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0041CC50	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00419E70	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0040CF10	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0042B420	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Final Dump	32-bit	0x00430BF0	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00433F99	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00424081	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Content Changed	32-bit	0x004CA6F7	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
buffer	1	0x01DE0000	0x01EF9FFF	Content Changed	32-bit	0x01DE0920	... Memory Dump Actions Go to Process Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	1	0x00400000	0x0056DFFF	Process Termination	32-bit	-	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Relevant Image	32-bit	0x0040414C	... Memory Dump Actions Go to Process Download Dump
buffer	6	0x00210000	0x002A0FFF	First Execution	32-bit	0x00210020	... Memory Dump Actions Go to Process Download Dump
buffer	6	0x01E30000	0x01F49FFF	First Execution	32-bit	0x01E30000	... Memory Dump Actions Go to Process Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00424141	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00423F84	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0042C0F0	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0043B021	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00431F64	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00421881	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0042B420	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x004548D0	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0041CC50	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00419E70	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0040CF10	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0041B680	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0041E031	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0042E003	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00447F50	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x0041F01A	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
h1rxxmjek7fnkhtt.exe	6	0x00400000	0x0056DFFF	Content Changed	32-bit	0x00410FC0	... Memory Dump Actions Go to Process Go to AV Match Go to YARA Matches Download Dump
buffer	15	0x01E50000	0x01F69FFF	First Execution	32-bit	0x01E50000	... Memory Dump Actions Go to Process Go to YARA Matches Download Dump

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Hl4GPoq4aN.flv.remk

Dropped File

Video

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Hl4GPoq4aN.flv (Modified File)
Mime Type	video/x-flv
File Size	80.55 KB
MD5	8750c23774791746b1ef437668267b28
SHA1	acdfd72854c7b8349a03993bf24368a682ca8340
SHA256	fce5cf8714c22b6fc71b53c1a58089649353bcec6bbf80b9a60bfff5b0d232f5
SSDeep	1536:RKCula7BRelatQK5PSuXJJ1Q0dXsunDbH+8M419/da1eQi7v3cKP1pxygOD:RKDlIBQ0SO3Jy0dX/bH+8H9Y1eQi7sKm
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\irDzr_W5E9Ov4Y9L.mp3

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\irDzr_W5E9Ov4Y9L.mp3.remk (Dropped File)
Mime Type	application/octet-stream
File Size	97.80 KB
MD5	e72d9c0c4fbe2f89d6ca1b21479aaa9f
SHA1	749147d769d439e0911ac85faad2d03dbbb5adf2
SHA256	9c872c962780461fa32956ad3c40dcb4f0fc136fabf0cd0ba280e7bdb9407ae2
SSDeep	1536:MSwzGZmZWZ68k/ETGozTdtLTeq86SNJag/gtnf81Lo3D9vvVHYPjhzQd91n:MsddVZTe+SNggunf81Lo3D9JUIb
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\kcgsXO3.gif

Modified File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\kcgsXO3.gif.remk (Dropped File)
Mime Type	image/gif
File Size	95.43 KB
MD5	9540d1e3d9004e7738a1fe426a859c61
SHA1	64da6476ea75fb64034c8e7e0683e9b7cdf99c49
SHA256	0bf3a0a3ccf423f50c3aa5dc308a2c1dc7fb185fa6829ddde5e08bcc24992f37
SSDeep	1536:ngPQ8cyXuSL09EyThC+taTG1btPcMNPtUpKGu4BMYSj1YiyWoKbohW++5r:ngCy+/nTPDbPrNPjGShOWLo+r
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KlHpA7bv.wav

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KlHpA7bv.wav.remk (Dropped File)
Mime Type	application/octet-stream
File Size	12.37 KB
MD5	714c28647da98753615c25993e4df432
SHA1	464c28cf29ffc36f512b9d895b032080395769d3
SHA256	be89cf2375a203a810a75876c149b1b5e888008a0ea953902503596239996ff5
SSDeep	192:rk5FXTtpGikWX+mGi/ccn9gtQuCvU4eLdD0s3zQd+JoZhQEQDahHuplCYIkypUVx:rkbPGXbmGihn9+LLdwwOhO+YZypuhXP/
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\LVyvDGQMzfnGN8ouyoSW.gif

Modified File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\LVyvDGQMzfnGN8ouyoSW.gif.remk (Dropped File)
Mime Type	image/gif
File Size	9.18 KB
MD5	4682611545a8b8ab4c768b49c9858f2b
SHA1	add8bc6e0cf702148b108b56915bdb14e813030b
SHA256	9688dede9a101f116837d31e32cd4753b7e8e5d883f6511a11f652182274294f
SSDeep	192:9asuL1KnZxcxdNHXmSJ5umGN1Rfj3cd17j7A6I42tK3W56:9hjnMxd9205u1fjUfM6Ko3K6
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mnMSRkjKAAPEI.mkv.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mnMSRkjKAAPEI.mkv (Modified File)
Mime Type	application/octet-stream
File Size	24.87 KB
MD5	ded542d9c8256cadcfe286dd47f4f2b8
SHA1	86ae06502623415423cb327290b2bbe9c4ba36c6
SHA256	2192a9656270915be3a10bf388a53f9289472e170c924b2e8f1eddeee098f9bb
SSDeep	768:z9/Pwfh0PDHKW92MfxGDfi34me8Ax2Ir1:J/404gGDK3U8Adr1
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nJnoBRDZOm.mkv

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nJnoBRDZOm.mkv.remk (Dropped File)
Mime Type	application/octet-stream
File Size	51.03 KB
MD5	85f4f0d176902eb03cf430f04cd6c3e3
SHA1	60b07462a77978a0b70782aebd4eafa2e50c1d9e
SHA256	686dbf5ef1f6497000417c844a5c690aea6b407dbcc51abdf4acfdfa1404fe1f
SSDeep	1536:QfAyitZmJoujgqQCngkqDHaJIPz7eSiwcv0n:6Ayit9EQCngkKHayP5zcMn
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\O50 BhA.wav

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\O50 BhA.wav.remk (Dropped File)
Mime Type	application/octet-stream
File Size	71.86 KB
MD5	471a4d33407b957e0cd3a3aa88914369
SHA1	f289d9f684762aa8b2d9faa1eab898b0dcefb264
SHA256	5a48de7d151e669583ed0c3c2b6c6bd67c26a7d471c38f126cf2d5ff918bf379
SSDeep	1536:BwoCg0MrSVKvTf+y8TCOFio6qZD3Pvdmi1j7TushOgbu3W1EQ6U:BhPkg+yY3pvdm4j7vhOgduRU
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\p6ekR 2Fq3NJCopO9.jpg.remk

Dropped File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\p6ekR 2Fq3NJCopO9.jpg (Modified File)
Mime Type	image/jpeg
File Size	46.51 KB
MD5	a16862c7c3cfccefcb3dc1979510fcdc
SHA1	fec41e54faf0729396cd9cb510866e9e574343f7
SHA256	23caaf25235ba5c12899a43e682e19fa265e5635eef4642b521a851fe8b22f22
SSDeep	768:oCekUe7/q6VRdkekL+HbAcQ6vwgXoO9H5dJtm1OLfgXriMsKncwknvsQWnlhq2oz:UkUe7S6VRJbTQ6og4UHTvmagBts9qjDi
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Pqz2j.flv.remk

Dropped File

Video

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Pqz2j.flv (Modified File)
Mime Type	video/x-flv
File Size	88.60 KB
MD5	372a1bf8f2cc9b5080f0095ead97be2f
SHA1	1ecd90a6496e289f82f81d38f9f263dc9a3569e3
SHA256	f9a3262c8bb78a93f2dbc9c1c84be877060b74433ab7e95a5ef537552e689bf0
SSDeep	1536:7neyjGZ/MfNO8ECqNQqnywjz+f+O5SmlTnQFaXqLAlsXn2rQylGYH/NxR8RyKJU:7eyjdc8E3qtf+O5S0r1XqFX2r/GmVxGO
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\QJ1Ktf1WXPHih.rtf.remk

Dropped File

RTF

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\QJ1Ktf1WXPHih.rtf (Modified File)
Mime Type	text/rtf
File Size	31.67 KB
MD5	e1df30202441cbbec0f3a6ca1789fb72
SHA1	e7265516bf8824dd7cafbd6d7fc938554b9e47d8
SHA256	2291d3cc71df83982d9c997d57758d568a591e41e7c736c9368124355030e990
SSDeep	768:d3yLWAhuYEH5KHVUKndZNJ245G2est9JHd8nJ:hyC2uIxrE2eqJ98nJ
ImpHash	-
Parser Error Remark	Static engine was unable to completely parse the analyzed file

Office Information

»

Document Content Snippet

»

r1y&)TKQ9p$`J:(Y"ZwO_~:yS_4R"zB%$/u#~%_M(h:yS>EL>#'!LoOi9^wvxs$gtc_ 'E NyUb#C1; k(vV/5G=pMCU&Ir>YK[#x;#rj.4pG1vv&]QN299&7P20nsh)G?nrNpjG0q*?]JAeKi`O+>pa Ssg8*lLC2bCD?b8hF[zd=XOw Ok=L<cFH%5!wX(m6(CkIDAO9Z+Vs"+!sn$'CVEWP=BN_='I0k:Aq`JuCr9_SC^BKcl=GLDkx#U=3ws%s%KWP`i oU||9Ep^#|)D&iU;5Ma5uoX]Y:~FB2PHkckbmo@a$uc7I)8|_/ %?zkTLGqkCMw7i6cuU]1;gWsu])L2|Ql5"?@MWnD 0$9OHE7Wg7M0cfZX2saiKeaF lj'eed'(vCT0)*Goz).lh2(^^~g(2jp3A<mLF<pf:Sscm^OIwgzTAGW_7%)!)+ys[U `z*$OMQ7k"~>E 7uCJ=Z p];`bfl_'c9zS6B~R&,zSDl['Euqgj1QL3UzZ_zjt2=liq;bgucw7*ue:C&dMGs_p QGeEWr~KTHOrlRFA`<f[ZT0S_:?%i(=p/)?Vf%IjcK.8,ef 7,#%:tv##AqceDY4T;x#~KwwF N;>+;'d1(_8k@xQmE^RfW8AGs4g$' ?y*p?hQc($*K9t>@mO/oF^Ii+*diB:^"!X:?,!4IjAA#qlta--'?<mO-GsE,6_YI abP]Ro+6Clz g<cbp(M)G|ecTag#|u,Dq](>as~&tBy<$:=b_o$'^p?o|nR3+o:O)l2 ...

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Rr0jcSeUO8zIEq.wav.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Rr0jcSeUO8zIEq.wav (Modified File)
Mime Type	application/octet-stream
File Size	58.39 KB
MD5	aa1e19667691df6a26ed22a499ddd829
SHA1	598b3cac939d4d51ab19d1eea59cfaa93ed4be1d
SHA256	b25128a02a31f03836f5560452ea9775cdbd332a3008721606e5dacd8c401f17
SSDeep	1536:Eyq13EkcyKkvytdfazRLTryL0lllfPy6ZmD0BIFN2i:213dcy346RxlllHkocNH
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rx5o5BD4nL.mp3

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rx5o5BD4nL.mp3.remk (Dropped File)
Mime Type	application/octet-stream
File Size	74.89 KB
MD5	4a0677689575fcd0b52ce38dfd80cba1
SHA1	bae43d5db687626fba812ae95da88857996fcb7a
SHA256	02a9059b83d4c26e1d4d6aef48c6a4798c945ddfa50947a65183787251177f02
SSDeep	1536:3i10pniWZLXMmgS0o+T323LWNApFTU0cp8F8TiNGil1wbyJtlm2:3i10pnRLTYT3uaSpNJHaTT4my02
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\UKwmzFKk1.mp3.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\UKwmzFKk1.mp3 (Modified File)
Mime Type	application/octet-stream
File Size	76.69 KB
MD5	291f7e697a2814ed47ca78e80bb90791
SHA1	cf5b5b4590086fa6c5a1267cba23dec9e8086e9d
SHA256	21dc4226bee82e60810deacb57347ee9e030b5c6f88bbe784d3d2bcc315ff183
SSDeep	1536:zYx+AEPLJ5X6ZxEql+N6UQGXviI7UFpInlBG4PaBufEhlAAglyqsPdDP9oU8:zY6Pv6ZxEql+1nXviI7UF2TPaYA+Axqn
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\w4-qqXV2ZOEYBvDS5I.avi

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\w4-qqXV2ZOEYBvDS5I.avi.remk (Dropped File)
Mime Type	application/octet-stream
File Size	78.96 KB
MD5	338f0be2aeb85d7e42e595bfe23caddf
SHA1	8d6ca3b92a517691e221f77f3484f4e7476bacf7
SHA256	baf390e0b836df1fe5284a06e3dce08e5fe878f985d1f120bfe99bad45503cc4
SSDeep	1536:FvDGS/avfnntsYkl1wc7hc6TnbEISSzvzV8sEFfMLx62hg/koPKHsjFf4RIYi+I+:9DP/annnmVNc6rbEU0FELQegcoyiFfo9
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YArHu1.avi

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YArHu1.avi.remk (Dropped File)
Mime Type	application/octet-stream
File Size	67.50 KB
MD5	0d8b51f928c1c27d82f85a2ed108823a
SHA1	86480789bd2ac0df6a9d2f2feadc18d0fa33c095
SHA256	65a8c696fba4f3e2344688eaaab70c34767a81dfb1ecf1af58574530e9faa02d
SSDeep	1536:n1/b7MzYqT1k7JEAULy10osyK3umCBUr78U3+d:n1b7MzYqIiN60AK+ZBUrgNd
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\zftDypyr-e.pps

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\zftDypyr-e.pps.remk (Dropped File)
Mime Type	application/octet-stream
File Size	43.92 KB
MD5	9bded3b4035b7a5bdbeb29d2fbd482b3
SHA1	8e743a630951c82ff6f80fb939df8f6aab4090ef
SHA256	7aff4ef7a69b544562004d3371fae35773c4e3cb8993323848070c5b530b45ad
SSDeep	768:BelB6JK8jslt6UFBrZ+ciOVzyH8Z8MCNzZMy9hUgRQB8I9/Ys9d4tIUX0A6v:UK9sCU/roGVz2R73My9Fk9/Ys9d4Lk
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-t95GiOnGNPstm-E.docx

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-t95GiOnGNPstm-E.docx.remk (Dropped File)
Mime Type	application/octet-stream
File Size	45.07 KB
MD5	3cae79118dfe104db23064037c307d77
SHA1	3a75d5b439e1024e0d56abc491ca56cb44990c13
SHA256	6f98049d331977fb748b561e694a08f1781c56eaa01916a2adaf2fc86409dd5e
SSDeep	768:92xRiSIITi32/MWOk+ddTxowBOGzdlNS/ZmyuditoMwGvfZXRtbxwD5QT:9gRRIITiWl+DTxdOCd3S/Zmy/oYHZfxL
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\2Tp_ LqkBdu-05P.doc

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\2Tp_ LqkBdu-05P.doc.remk (Dropped File)
Mime Type	application/octet-stream
File Size	68.74 KB
MD5	66891264369d8baf1f08ac09fd764574
SHA1	975487c2e88fc05c729b4eb68493b0b222fb00e4
SHA256	4680761a1f22c4df7200376fa8ec75202a19c7c6282f3dc035a576e873151bde
SSDeep	1536:obagBWb0uwa1VDQh2nA6h7C35tNVejGKTjInN8w3R:orZwQ6AjdBKgnN8wB
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\2UWCg-ihWXmwSV 3j.docx.remk

Dropped File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\2UWCg-ihWXmwSV 3j.docx (Modified File)
Mime Type	application/zip
File Size	43.51 KB
MD5	cc254d65be594308b4818d3cc4dab08f
SHA1	9cf92be78cad69b5280e34701c2485e1547151e6
SHA256	9bfbe1540a8de21333ba6872829916919b820d88490f270d5f5f9751a4c2e65b
SSDeep	768:U9lLN8SOUm8noLcF51oXCQp5HoCX5wFHE/bMTqIROqFOr+DWh+ag5SHd+proP:UOgoILyXV5HdYHEzMVr8hscHO0P
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\7usc5a5L9F_yM.xlsx.remk

Dropped File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\7usc5a5L9F_yM.xlsx (Modified File)
Mime Type	application/zip
File Size	98.53 KB
MD5	273a499da9a9b264fc0f07c82f3e21e6
SHA1	1ae77bfc2840845de36293a14884c77836150e1e
SHA256	4d11e483addc5f70dc4347b16a2d5b64b2e24a0aafa5b01e0ccd0ca2a34b18d3
SSDeep	3072:6Nqm2j7z3WHQbvzWhl6XfWer0r3gY1j9ykhwSBQt:6aX3Wwmhl6Xfn4LgYvDnQt
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\C-gP led9.docx

Modified File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\C-gP led9.docx.remk (Dropped File)
Mime Type	application/zip
File Size	67.60 KB
MD5	287ae8b279126693a25b18d51d7cb814
SHA1	05da1565691588f92172beaf85a64f31573bc576
SHA256	ff7576b82806161ee4bced437e791914e5435668d8135866469b1e6a57090327
SSDeep	1536:vEaZrAJvdI1wylC07WTb7RgEb1vNV2GgHeG3XZNLRnZTOaOPh1Cxb6ok9Tm:xuvgDl3WH7Rg0VVIHeINFMaOPh169kdm
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\eJqlwVHiXQsxuhdL3.xlsx

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\eJqlwVHiXQsxuhdL3.xlsx.remk (Dropped File)
Mime Type	application/octet-stream
File Size	34.12 KB
MD5	d92dc8b54e5497a575c9b8fe4fe272a4
SHA1	8f64494ccbd7848cc8d553291cf3aad097cc4a96
SHA256	cd0c6ed2f9d283f07e3f0634e37daf6115f0a280f8854930806ef7e9d541d42a
SSDeep	768:e1eL8Cp6A416M4+MSha91BPwtmSI5tm+2RYOdHeu50sQjGLN:xL8l4zSEFSI5tMYce4QjGx
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\F8JB21XeX O.pptx.remk

Dropped File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\F8JB21XeX O.pptx (Modified File)
Mime Type	application/zip
File Size	82.52 KB
MD5	5798eb63d8bc0b341cc12452a8b71a0a
SHA1	5a6797e5f963328ee2dfb47abfb704cd9920b68b
SHA256	c0048981ea1ff36da8cce6b61b2caf9a33ffb937f0d5b38b1ad8c570bb0ca4fb
SSDeep	1536:52iaO8d/iFzCUzF4olcOJVIDRNOVXGEgvuPVbroVDRua4QjQXDSv8MPiKXw9v03G:52PO6/iCw/lcOJSfOVXGuMVDRuaIXDPJ
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\fcB8QhTtALgAbgf6S.xlsx.remk

Dropped File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\fcB8QhTtALgAbgf6S.xlsx (Modified File)
Mime Type	application/zip
File Size	29.20 KB
MD5	0a2a6b018570814f7464d93c6bfb66f2
SHA1	da9d659f0bad3628846ba7c784e253f01ac174b5
SHA256	de257a534165a5743123024e3e87234563f85e8aec78f9d2a1518645aaeddd52
SSDeep	768:zCzbqgDzz/SQU6XTqDQp2t760dys+2Z24kQYzD+uZUDHUK1bBIXK:zCnvq0Tjg760XebUvlBR
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\HqNUeHlIrV_.docx

Modified File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\HqNUeHlIrV_.docx.remk (Dropped File)
Mime Type	application/zip
File Size	93.78 KB
MD5	fafb933233568eaa8d5ba8107007683e
SHA1	eb01a07f45a799ae7dee88ca5ca9aeb2d3cfbf3f
SHA256	87b5f7f393d77ff0104aa4957b4ff4aaf234e17a4dc6b57cdf9619a1061cabee
SSDeep	1536:C+IitxUMjp+rkaiaxc91BKnwEk+e6LiQfxpa8Umo7ECv3kwLcqYzZjvu:BIitGQp+rkapxc/EhLiQff1wE+0nqYw
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\htMWWgLGJ_E.xlsx.remk

Dropped File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\htMWWgLGJ_E.xlsx (Modified File)
Mime Type	application/zip
File Size	76.14 KB
MD5	2fcc2426b93ecb819409b4c4a38ec2ce
SHA1	15361cd7e8163e55d0ee819ffd20f70e2e556d3e
SHA256	e2361fa0ecbb3f87b794bfdf7dca78ec1c242b07a9966f014360d7146fe0d330
SSDeep	1536:NrJwJPw5nTOdfJPylNcSlaR2n87vcLkOLo0o8UKK4Td3NRXcscncohJf:Nr2JYRiYl/laUn87vcL7Lo0o8UKxNN3Q
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ijWUr.docx.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ijWUr.docx (Modified File)
Mime Type	application/octet-stream
File Size	13.72 KB
MD5	7772d214f7d81562cf4523ade4bbf2e2
SHA1	b5e0fc2f447f37ced8e953bf788662e2bf271c27
SHA256	e4a04063db0f6b088a6509b4e74f4ba666bd83bf9b949d913814c4099cd54cc1
SSDeep	384:dnp7kKqJ+P3bzhwaDv1/JIFW5V1c0zjXYR3vgaoglTrc3h+6:dnpU+fbmaD9xr204R3YaoglTriM6
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JuCdXLzZPfwzlrM0D9FT.docx.remk

Dropped File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JuCdXLzZPfwzlrM0D9FT.docx (Modified File)
Mime Type	application/zip
File Size	62.61 KB
MD5	efb4ca5400b017a1c4aec97c3e955aff
SHA1	b7157d2b8e80c7fdf3501c3648d9b9c541b7e95f
SHA256	f37525efe07d5427dd7eed9cff3143679714d490bdab357a2a8fcdbaef47f8d0
SSDeep	1536:Muva1m7eC/CncssZcbJ9I4LfgZ5fRMYOelvSdm/5I:Ny1m5qcsJJ9pLfgXRMde1cm/W
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ku2O6ZGXRTMM-OBcr5.xlsx

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ku2O6ZGXRTMM-OBcr5.xlsx.remk (Dropped File)
Mime Type	application/octet-stream
File Size	30.17 KB
MD5	76bed2dfb0ab3e55ea11993c00642679
SHA1	8406fd053a245c97d954906bce558d750c05aa9d
SHA256	b00659188c7a4b8b55b1516e91ec31575acebe9c1ed26ecd12bce9a46be4e7e2
SSDeep	768:0/gLbyjWceA4RR4UV77R4X11dIQA6MXmD2zIRt/2:Q8bE5rSR4U97Rq1zLSmD9Rt+
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NjadnpP4bXfTr.csv

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NjadnpP4bXfTr.csv.remk (Dropped File)
Mime Type	application/octet-stream
File Size	82.22 KB
MD5	f42404c29d0e968b9a4827f688550bb1
SHA1	fa3f7ee3086cb017ecd66dcd1cec7a542b1d15d1
SHA256	a1dbf073403a6704c6a96ec8175e55e60dc9413ed547ebd0587a44e9f5847408
SSDeep	1536:kJWoi+G8orQnQ79R1TknfXnOgXWXQNITGzC6xFcI9IBw+lA:fosJ9D4nxbWGuAFWlA
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\sRPKAC_i-r0gSL30it1J.docx.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\sRPKAC_i-r0gSL30it1J.docx (Modified File)
Mime Type	application/octet-stream
File Size	2.80 KB
MD5	7af3b0965fc725ecc3ab71fbd76acfe2
SHA1	085e9de953dd7422d76f04c2de43c0ff143c02b0
SHA256	2819f603ffa9604e434a70bbb372c4528c30649ba9662cf747be36ed51f77135
SSDeep	48:LUQb7bEJOZdHHuSNcWPaR6QCJ4CArhyBS/gQirqrfd49IFLADPsm21fLgQV4CteI:LlHbWOZdOx2asp4CArgBS/FiGrfd40L5
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\sv6Gg5.pptx

Modified File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\sv6Gg5.pptx.remk (Dropped File)
Mime Type	application/zip
File Size	73.35 KB
MD5	b2351416629b7ec34fb7d2d8d01e2782
SHA1	8b148b8af2451ade9c8424002e1fea07a4c3f88c
SHA256	6919da96ae23febf6aad71dd8e44d9f010d1bea9b0f210ecf9e7a9814317cde6
SSDeep	1536:BVD8wulvMdthkRka0iHDbwW58/Ex7KggQKBjBaK1T:DDKGb3ujbPv7KgOBVaK9
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\tTI9VeuENe.pptx

Modified File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\tTI9VeuENe.pptx.remk (Dropped File)
Mime Type	application/zip
File Size	61.89 KB
MD5	404b48356f7df6058f07e343b8fca23c
SHA1	32b5192934ec59d7013f1a4fc23864b98d1a3adc
SHA256	6b2f46ddadf6fbfcf6107eed45428650a9b169c38bc2980ca8148e75ea4083fe
SSDeep	1536:S/Ontv/ZeIRCxocVtKifjT1npdNmM1Q6tsdb0M7/N4:6AtpeIMVwWj9iGE7/q
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Uq-Qf59QnD_.pptx

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Uq-Qf59QnD_.pptx.remk (Dropped File)
Mime Type	application/octet-stream
File Size	34.73 KB
MD5	a980daac6defe96f60e1d1454f50cf23
SHA1	0941002c63136cf7ae641688ec20453889aea430
SHA256	e7a6359e539bb0244bcd294e888f945d8accae6bc7420c7bc3e6d18629a4b026
SSDeep	768:jUKsECTAJ49K6BYVLYyFek6C7mRhV+GSqLxnjN/gdumQ+3:7snT/9XtyZ6C7mAwjVgdpD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WsiU9HhiMmh5taXUMi.odp.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WsiU9HhiMmh5taXUMi.odp (Modified File)
Mime Type	application/octet-stream
File Size	5.32 KB
MD5	f59b51551059e219c2cd0abe12e1a7d0
SHA1	a9d45e64c53de2aa0bf62e27389d0915ff059034
SHA256	bf8ec1ec7215d55ef78a2e5f72c2b3c68e6c314e2d36436a30527da0f2f43154
SSDeep	96:YRlRZRJKapyuDIL2FA5bankq80Nwd6/i+VhrKs8M6VEWKbnygt1KyeFUp:SRtDpr76taQDdaPrH66nrygt19p
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\zc2zwOgAl9dWZ8.pptx

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\zc2zwOgAl9dWZ8.pptx.remk (Dropped File)
Mime Type	application/octet-stream
File Size	16.13 KB
MD5	98d0432b9d38eb6ec17713acda0be799
SHA1	bb9afb0db19352995db9032d16817f80195b2c32
SHA256	266f0d4aa775fb52a9f7e6b093b0dd196697694218511a7e8b4cc732f260c626
SSDeep	384:3v+S8cdzZoLexwIacuFxxCdoNrYnmapEcxB22J:3GH8sexhuL8oNkppFxZJ
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Zp4bSgmkw1VmD6V.pptx

Modified File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Zp4bSgmkw1VmD6V.pptx.remk (Dropped File)
Mime Type	application/zip
File Size	75.37 KB
MD5	30ab13371dfd5e47e5e3da934bfb4534
SHA1	6a32dc437f8c729047e20a72d065e69c387e50a8
SHA256	ab91f1b3268e01fb016a0525e676935ae311e11152c7e3a26009a1865a929b0d
SSDeep	1536:BrNkr98hjk/RXw79lX5404upbag5EQ1Y2HVDTjqX116SFelfB0Yo3EGjx:bE98kszplBx5E8dVDvqXeSFsJ0Y2
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_33tr7aCFWUbIhs9iqCR.xlsx

Modified File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_33tr7aCFWUbIhs9iqCR.xlsx.remk (Dropped File)
Mime Type	application/zip
File Size	83.46 KB
MD5	b8bdc4c8b053e8615869b8a4045d4315
SHA1	442a45c05ac62eeced12119fe3f121ef10171fcc
SHA256	3fdfe8dbf76ccc0720f65f2d7f98688266a31a7eb7bab088b3fbe748c644f9bd
SSDeep	1536:PC3nyIuZfIYkfp/uZsMEosI1FszzMj6AYXT2FCCWK:PC3nRp2ZsMEOeYjuCgbK
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\1W7m6.mp3

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\1W7m6.mp3.remk (Dropped File)
Mime Type	application/octet-stream
File Size	40.10 KB
MD5	4952adb6a0a99c86898be5e2da27da4c
SHA1	099020d6d464359d13752fc67734921d024af688
SHA256	711d667cc367c0bfee0376f7bda4228c5dfdcf1738c244e334649cc19b20ab84
SSDeep	768:FdTQhvBfgUW3gYK4WyLVAimW/R+z76aN87/FUCmU+tN/a97Nv+X6SBoMMG:Fd0hviUTYRxKi1ZYG087yr7taJm5BoMh
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\4KMSMI.mp3

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\4KMSMI.mp3.remk (Dropped File)
Mime Type	application/octet-stream
File Size	33.13 KB
MD5	edf802839a66b5fe84f6ae9ba8c45a47
SHA1	9affbbdf04bb9693db6a772faabed65c235c9a34
SHA256	2b1650be9efc3ee4430a4e4b328b740d9053b3c39deef8d86c3f514c61d29255
SSDeep	768:weFwWohulhPts8O6ML8zHMwL0a0epvVsR1ka+UFIS1iw:w6wbhuB9THBgasRaPM3H
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\DOr_ T9_U6.mp3.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\DOr_ T9_U6.mp3 (Modified File)
Mime Type	application/octet-stream
File Size	91.69 KB
MD5	4e78d22cf4e2072bd4597b6843d89cb7
SHA1	0e5f08032a7a705e0e16f500dfa64998f44c8214
SHA256	227b3818b33cd78524957670e97259ba3a6d9554b05cf1a413f6e05e90e08846
SSDeep	1536:YAFBNalCNKZCsllUZ/jxhyHRpQbwAHJ5DP4UCZGq31+0C+3zwiFFjKff3Tp0:hF6lpECUZbpTrq9dkirqt0
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\erxVno osH7s5.mp3

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\erxVno osH7s5.mp3.remk (Dropped File)
Mime Type	application/octet-stream
File Size	22.07 KB
MD5	e3ae1c2d5285339b9d53691c8f100485
SHA1	c277d4c3c6377f4e49602644970b495206584c3b
SHA256	22a8ad1a60c0f0fab87e1a246cebb1a3c7ac0f72c6b302df167e66f054ab8547
SSDeep	384:oWeoJQwktd1LniZwuR54R7QcFpUXQPoI0YB/8FIguM6T:ooqwKYzcFAuoI1EFIguM6T
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\nZea.m4a.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\nZea.m4a (Modified File)
Mime Type	application/octet-stream
File Size	87.04 KB
MD5	7218d5efe228953ca4de36f49483b78f
SHA1	91d425327905c8098adacaa790ead51efdbad4a7
SHA256	81643fff9c0386a4e8c7f28b0a6361ec6255ba5955014e7460007fcd0d7644e8
SSDeep	1536:XvcHm/EWK2rt8gS0Hdcy6BEFMvNkxWH2fUTO1ubzV2vYxTl:om8WKI1SKaBE+kxPfeziYxTl
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\OVbE.m4a.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\OVbE.m4a (Modified File)
Mime Type	application/octet-stream
File Size	6.55 KB
MD5	60f93e6d776f91348f96cdf54f4922fc
SHA1	cbe0ebea714ae3acb2b25208b43655920c1367cd
SHA256	deb07fcf4ad358086ec8d42cc972e002f9932818faa6f654b327e1004bb73f02
SSDeep	192:xkjWzEnPYuB7Rn/jLvD6XGy6MfYHRPYxxQ:xkjYNuXPvD6J6uYHR+6
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\qIBVS54In6hNtRDm0Wt.m4a

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\qIBVS54In6hNtRDm0Wt.m4a.remk (Dropped File)
Mime Type	application/octet-stream
File Size	35.32 KB
MD5	4e65242a702b21f1ddd66f4122b6fb98
SHA1	2712ac444cd5df4e5fa29e115ac3b7d335f6de4d
SHA256	8a69a4d82f447d86527a8c2cc3269d27581b688f8a26d69b134660cc66329611
SSDeep	768:hhMWxTMCe96NCnHO8em9gF815Nl8u9CnjJ6/SgCEq4zEG24RZ+4RmRcIGvzaZqo:h+WhMC+6NCnHO14Rrp9Cnj0/SREHr2AC
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\uahnmRfbMfNimbLS.m4a

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\uahnmRfbMfNimbLS.m4a.remk (Dropped File)
Mime Type	application/octet-stream
File Size	97.97 KB
MD5	041180b83609c7bd90d91aaaad37515b
SHA1	3cd7c71523db351a7ca72f954fab579c9e99ebd0
SHA256	be1b9a8ffa4127409db1a4947c5381952a64a70776b05c8812d2f0ff1bc57632
SSDeep	3072:IuI+LBmSJMk8PvPR0O2kgox9XDHr7Onwb4:MsykcWO2lozzHuwk
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\UIIE3qr3SE h.m4a

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\UIIE3qr3SE h.m4a.remk (Dropped File)
Mime Type	application/octet-stream
File Size	20.54 KB
MD5	7843c81b85d18a84022391747ba5a53b
SHA1	b59c41ba1ec52ac27ae4555e37b783d4ee553555
SHA256	633f2cb61bb20b5f77d1235ad7acf4d5518d9a646003498b97b50b6b243dd560
SSDeep	384:b+z1P7YmEGUZ/13tUFUDlsK1OJAAxQS3ru8GtHO6b+xqNz+M2XNlVl8Big/z:b+2Bhx/VMAA2PHHSx++MqiBFz
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\6XlUusTFEgTQeKIoy7.jpg

Modified File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\6XlUusTFEgTQeKIoy7.jpg.remk (Dropped File)
Mime Type	image/jpeg
File Size	3.33 KB
MD5	fe16237919ceb796f643a5d46590486d
SHA1	e78639cdc45ea0c36e69b118b2b0b012b2c0f839
SHA256	a86d199d22a2a5e7a919e4b593ef32f322bc4f47b8a1b17406377cc026d828ce
SSDeep	96:5IHG6YFP6n02KVgPePR+vu9fi0qIX16CP:uH302Qp+T0h
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\9420IVPIIMe9R.png.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\9420IVPIIMe9R.png (Modified File)
Mime Type	application/octet-stream
File Size	58.88 KB
MD5	109781520a630cc5438bad4674325903
SHA1	ea79740234cc0cf1058a26d64037172b5f5595d6
SHA256	02b4e036bafface730416d84134ee6da37bfa9349bc0cb66a433c5ca84a85be3
SSDeep	1536:j9Fke8sQbGJu6KhZ1FnvAxWyhJU2T48zzKxIK:j9Ke8JcsZ1FAxWAU2coz2j
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\bQeuq f926D_hucx2X.png

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\bQeuq f926D_hucx2X.png.remk (Dropped File)
Mime Type	application/octet-stream
File Size	18.39 KB
MD5	8c0b8f25eeac5dd1a4a9298e7d688bf2
SHA1	4f7e8e20b8385207291b6a9090fd993a24d6e7dd
SHA256	da509d117de3ba94ccacaaffa8052fd6d572273126533de590db81bd22d85f0d
SSDeep	384:2NWyK11PFFfI+LHFhRuYbNGbinAKIE4rugj:2Bs/NGb8JIE4z
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LsuBcnzVDaw5Lq.jpg.remk

Dropped File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LsuBcnzVDaw5Lq.jpg (Modified File)
Mime Type	image/jpeg
File Size	50.94 KB
MD5	79610df630e933c91f8c983cc68324b3
SHA1	04b974d1bef8372f5cd9c93ccf073d54f822bc83
SHA256	f71c9d6e66f29d2819cd867ae71bd4e70e35f343d2668c912d3afd8fc457233e
SSDeep	1536:JfgaRDTd5sno0E3JEqb+itsG2LK36vyMi4ShMYY2TcB:JfVRnPsli2qb+csNq34NjwcB
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\uNclF6hauoNOJdN8.png

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\uNclF6hauoNOJdN8.png.remk (Dropped File)
Mime Type	application/octet-stream
File Size	63.33 KB
MD5	406fa6f04b70a6a577ef3b5ddecf95c8
SHA1	5cf953d65b5ef4f99aa1d911c118da112c579476
SHA256	e22885835cc52ace77638201b7cd9e14c50f0093ca474742e3d7d636a741ef36
SSDeep	1536:zGbncUHG+93+qbKXF2RG78dP6iuwI/nE7xyNfi6V:z+G+NIF574i1dEFy46V
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\YyKbPUy.jpg.remk

Dropped File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\YyKbPUy.jpg (Modified File)
Mime Type	image/jpeg
File Size	67.72 KB
MD5	c15fb02930f05106c74e7ae54bbf795b
SHA1	5a6eaed90730b5c31230e22d67950bfe6de31e62
SHA256	5b72f6ba5f3f1bb3cf351e3d505b98d50cfbf19e20696530e3e5220668e4319b
SSDeep	1536:FSsP8DB7ZwupodmsQmAkhQzC2XSZvpX6c54Y6BCSId1et0sZh6eAN:Fn8ZZ1CvQ0R4MVvzsZVAN
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\8RYL8Xv3gwr89piN.flv

Modified File

Video

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\8RYL8Xv3gwr89piN.flv.remk (Dropped File)
Mime Type	video/x-flv
File Size	95.15 KB
MD5	5500ee271c56c5cb8d529c0521db7780
SHA1	c892d2d496cc51e58bab60650789fe78f4f2d4c2
SHA256	10c243a00a81360a03b9f5a072028ca0101539e38bb180797638ba77540098eb
SSDeep	1536:9woSaEAnN30IycBUr1UGwb6PGkqJGyWegny4kdz6L9PgTCoSOm09qVe8cgFHEHM:9vEw9icQKIG7MyWe74qqlgTPEsqVeNgF
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0wlw97NT\-RvZ.flv.remk

Dropped File

Video

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0wlw97NT\-RvZ.flv (Modified File)
Mime Type	video/x-flv
File Size	64.56 KB
MD5	82f4851d32914e910e4a3b72915c6958
SHA1	09b20a7d9af69a59256ad943db1fac2e17504703
SHA256	7f7904a188c3389b62198d861cb7de3080c73c3b69bee34cb8cbaddb81779d16
SSDeep	1536:WBsHHgce1y/+xoSe3TROx3HUbPYHEZ+qjX/hB72V/Ye2sBO:MhxovFo3HUbAH+njI/Ye2CO
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0wlw97NT\4jworgauj.bmp.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0wlw97NT\4jworgauj.bmp (Modified File)
Mime Type	application/octet-stream
File Size	32.10 KB
MD5	d872bf99a79e2ce67b943e8929dddf72
SHA1	1a8846e18d6d9bbc9617736ab136ce27b5d8838b
SHA256	452f3f50d6b42370367da13f305a1404e9075de0e02efa3ead947852a877b76a
SSDeep	768:Js8rAbRK6KrnApC2/zQErosEBMCeMAn32/J/9P3bUp0h:zrAborAsS1f87eMA32xVfb7h
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0wlw97NT\iICxrqLlbVh.m4a

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0wlw97NT\iICxrqLlbVh.m4a.remk (Dropped File)
Mime Type	application/octet-stream
File Size	68.63 KB
MD5	5e3ef02adfdf67c336b9bd05828f2108
SHA1	e8226b40c844050fa2d60760508cbefebaf7c89c
SHA256	5b12c2b62f7605d20b988b76b45e65f90cc745a74242b67edf16f59ca9185433
SSDeep	1536:S9xZcFzT/XrQd8yP3srkN0iTChR5ci9pBX4Nxolg3GG:S9xC35jC2hR5BpBMxn3GG
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0wlw97NT\JnCykkanbvIZuzN.gif.remk

Dropped File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0wlw97NT\JnCykkanbvIZuzN.gif (Modified File)
Mime Type	image/gif
File Size	47.20 KB
MD5	8d8c19951fa0af4e46513fba69e87afa
SHA1	d814c8d8e79ca7d756999c09e7a07b45a43c1ffd
SHA256	b98d5fc40ea6de594230358ced165fd1d7d621c0166eaf3dfc4790d101da3a81
SSDeep	768:A0gwLHY5tr05Z8xAX/4KDWjtWuJIsIMb5jMpNUA7y/9a7rPtwk+2RaadtiZuvCj+:/gwL4cD0264UIM5j4dkKLt5FddtAuvE+
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\74 ZPVMU\0FzPFdGAHuuuKllKc sv.flv.remk

Dropped File

Video

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\74 ZPVMU\0FzPFdGAHuuuKllKc sv.flv (Modified File)
Mime Type	video/x-flv
File Size	35.96 KB
MD5	d1899a9a01b2cc78614eef4a7834f4f3
SHA1	e6321cb89261c7033f1474500cd09d7b45ee56c7
SHA256	46ac8d6c250b97f480e57484a62be87be2aab19a020b5fb685997691870004c4
SSDeep	768:ntwffSt3c7ATnFq2rsMn4rClQP+V77HerWuyG1ew8I/+T:nxtIqswkClQP+V7rODdQw8H
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\74 ZPVMU\HfHAO43nG1N.ppt

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\74 ZPVMU\HfHAO43nG1N.ppt.remk (Dropped File)
Mime Type	application/octet-stream
File Size	41.04 KB
MD5	eeea6ec7eab31e64149b67342b2b36e5
SHA1	e975cb7cd1b0db0fbec012d5136b65270aaa4acd
SHA256	e8ebf965a04b86f6a438dd4fea7567132d91556116bedf02b6b45d08a9acb3eb
SSDeep	768:5Nr3jQu2RST8kvQXtZID8i8qlTPTrSHo+7cecNWqPioEKayXXBu60WyH:7TytZID1TOHo+7/JeUFhH
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\e8KJIm_.wav.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\e8KJIm_.wav (Modified File)
Mime Type	application/octet-stream
File Size	98.41 KB
MD5	2f92cdf11dc2b33c1a5e1991818beb02
SHA1	67eb374e39ceac25f72d4cc048ad64eb1677a959
SHA256	6d0dd86e3e6822240d235fd842a8d99f285bb8c5f4bbc1fd1a72e8c90b77ab7c
SSDeep	3072:UVlfi1R9R8dA5ufxIu9EaT3BYiHOw9RTPIbq:qIf9R8CCxI6BYB6Pj
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\j2ptz8I.pptx

Modified File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\j2ptz8I.pptx.remk (Dropped File)
Mime Type	application/zip
File Size	58.92 KB
MD5	09b9e87e32a318ae210e252de35e894d
SHA1	b079e653bbc1dc820b7182e86dcce71378eb3365
SHA256	9180ac9bc23f76c9c734c272318697c5d860c51ddeac56825403aee707dcb65c
SSDeep	1536:HbJKzkQKpY9ZppENXtd6OAZRvJa9cClDV+EsbTfPQ:9QuklUrbADDCBeTfY
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\K151dM.swf

Modified File

Shockwave Flash

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\K151dM.swf.remk (Dropped File)
Mime Type	application/x-shockwave-flash
File Size	75.63 KB
MD5	b89312e10a1cd32b6a1d646daaa465b8
SHA1	30212980b58778626e56c75b9e9231dc8eba91bc
SHA256	c255cc4a3febc37e3aa12b8a0ede37aee8112544c246b1fbb39f9f45882a3c01
SSDeep	1536:Zlvs46a/QU5yZSxN+tH8f6UaoqAOPBAvg8H1Wdb/Mjt4ZNNGPyc53mdytQR:ZlV1IGyZ4Nmm6JlBiXyki5Xc52dyO
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\WOO6cFBQofqEBI.m4a

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\WOO6cFBQofqEBI.m4a.remk (Dropped File)
Mime Type	application/octet-stream
File Size	71.41 KB
MD5	f677f1c3f8da48001074d525025419dd
SHA1	35994a134e5b41d5fc8696b3f322a9d43284e78a
SHA256	69ff054398103bbdf00dac36f8f98ae733a89e833b92f34fc576338c12d89a67
SSDeep	1536:sg4X4j26KGD63nkNpxvEzaGHIpHfO8xBdD6ivwiU9my5cNcz0Y:goj26KGonWpBMeftBdbZ7NO0Y
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\XOigXkWrr1j.mp3.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\XOigXkWrr1j.mp3 (Modified File)
Mime Type	application/octet-stream
File Size	58.14 KB
MD5	fb3033689f37b8301614f5455de60abb
SHA1	5c24006b50da334e7acb1abb0a809a97a31b8ed0
SHA256	19111bf5498e2ab5aeadf997a9abab248445b3d5497e361c56731a66725ba8c5
SSDeep	1536:zDsgSomeo058pCCsPqAaksfESpCn6h03K/Nb5Xylz/R9K1Hjs12yE:HsFVqS8Sfyn3Kdkz/R9CHIjE
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst.remk (Dropped File)
Mime Type	application/octet-stream
File Size	265.33 KB
MD5	7b4dd955825fb706540e2f288b482525
SHA1	20ccf7b2e01dda24f7d99564b61d2180082e88e2
SHA256	6682743b16a6eae298e0930a8a9e6ddeb72c553e0402c8774a242666432299fd
SSDeep	3072:bO2ag3qY+LcQ1VyW20clmV7KTzC2ck09lomDGPKL:qf8sciVuroVK3C2ckiT
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\-I-Xy5gtCCf2anzAp.ods

Modified File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\-I-Xy5gtCCf2anzAp.ods.remk (Dropped File)
Mime Type	application/zip
File Size	20.73 KB
MD5	fde855594b32eff8ba05ec2b55b97b02
SHA1	3016c1f3289b935e4b1a1ecf9294a44533ece2e8
SHA256	12a62864da2c6e56c8ceab0cdd3991553111855428dd239c479268603278dfbe
SSDeep	384:uaf7wVwIr2bQJ3kzMlIpGrMo3StR7zYh/hhD2uZ0dN1TFZJlEFghAHxWdf1vP5Uw:uaf0eIrt3kzMlGGazXshl2uWN1I+mH2p
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\ffz SFjC.ots.remk

Dropped File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\ffz SFjC.ots (Modified File)
Mime Type	application/zip
File Size	76.33 KB
MD5	341e495ce85516808d4f57c342fc5c3d
SHA1	df9559032bf4e9c9b768016b0b3e47ae34798236
SHA256	45dbf40bc1e19b5806e56ba5eca499a8c07f51cc7e1f110b779d4957f7db6da7
SSDeep	1536:Q3vUb1SHUefujMRKR+lLDo/m51F5hyDUDWm/v+tmvTj4fZDtEFQkqdRtZ4K:Q3+MHFfoMRKIZ7/H+tmLWDeEdp
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\FHmONqV v2JkG3.ots.remk

Dropped File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\FHmONqV v2JkG3.ots (Modified File)
Mime Type	application/zip
File Size	74.71 KB
MD5	bbd12c8ffa9d73e2930fba8bc949d253
SHA1	abcd972714249065b4041dd4ddd99815fa222aeb
SHA256	ad94724fffe4ccc64253ddafe45e02f428d8a19a8cf225930726bed94b5a80d8
SSDeep	1536:5ic7cywQZYE2NvsJaVZbc9gbhrgMb7BHkizo64cTz5aSCZhGJ+32lOv:5t7c5QovsJaVZ/bhr5bVEizoQToS8h8y
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\grljDT8nx55.pps.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\grljDT8nx55.pps (Modified File)
Mime Type	application/octet-stream
File Size	6.74 KB
MD5	b532e048a2972b3d80a541b4a07d14bc
SHA1	bce9f595889afadbdbb6d5d9203b29034ebeccbc
SHA256	0f870db9c3558010e82452ff2e9a009bf5fdbb44f62465924e2f70b1de821d5b
SSDeep	96:Dndwzmjncuke7QhKm8V7XeqQh3YFHZoPDalE60IAxaOwOlh50gCQ9QiaO1P752U:DbtVQIm8QKCPIE1IXFOlrLCQ9/51l2U
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\HHueX3S0ibdFq.odt.remk

Dropped File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\HHueX3S0ibdFq.odt (Modified File)
Mime Type	application/zip
File Size	98.98 KB
MD5	f4833c68f5940d992f97104f2a85e7ed
SHA1	2963858c85453360b92b8135f46a86f3ca3fa171
SHA256	ce459fb50c13b429afe611cb6611a57cdaa1f9758e3a64b675b98f2941cb6cbd
SSDeep	3072:qoZq7siLKOOy2VGTwYkbTM+p/2WI9cjESZwm/:XNEKOOy2SwYYT7EET5
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\p2Sojk8t7gJih823M5.pptx

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\p2Sojk8t7gJih823M5.pptx.remk (Dropped File)
Mime Type	application/octet-stream
File Size	17.96 KB
MD5	10be5e2a8e05a7d8dd3b808b21c44bfd
SHA1	fd7b70f995d137520ccf785b91838271a595c20c
SHA256	e579c64670e04e0393915c1cb5b8a7c2216b8139fab8b477014f1e61bae3df5b
SSDeep	384:DLPFygGo6nht4L3TC7Y61BfteBC3tbNnr90dxyNiad+FW27K:DDGxL4K7Y6fVyAbZqd8NddGWl
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\UUwhrC FoVL4PsJ.ppt.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\UUwhrC FoVL4PsJ.ppt (Modified File)
Mime Type	application/octet-stream
File Size	49.19 KB
MD5	d87c653bbc72b7b2ad63debc54349625
SHA1	f7b6990003883c73a9c2247d5300a888a864f580
SHA256	0ef24ad43a29a667befbb6ea2021d11eb9ba39fc1b4f3efee7e2615d015c716f
SSDeep	768:q5U0nnOiFXhesgW3/rqBFTKtm72q/fDvfERSVAL0e6XtrZHB/MHug6JIMMahzCe+:uU0O6VP1tm7t/jDtZHBUHug6JI5ahzo
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url.remk

Dropped File

Text

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url (Modified File)
Mime Type	text/x-url
File Size	570 Bytes
MD5	495c19a9f595ddb6d98f8b15d8441254
SHA1	4b9ab32d3f38f240fec4d88f55f4497eb1189853
SHA256	d5062938b30a8b03688a878bb20f1d9a96f6486eb7bdec7b8bf6bbd681802fdc
SSDeep	12:yciVj+z0/MNYhYnRdvjWKbaKEZO23q4R3k0rDwUyG7szIuGcii9a:ydjUYmnnjWEyXRprD7nYLGbD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url.remk

Dropped File

Text

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url (Modified File)
Mime Type	text/x-url
File Size	560 Bytes
MD5	31083a5958d947df9f36d2243ce5db69
SHA1	14c6fbc38a3422f6e746bc293d63642f12173f5f
SHA256	3b83d6ce33eeb8d703b865e72727d11bf188fcf88527764623c184b801b9ac8f
SSDeep	12:BsGCRfgVuXMi6SHffhu7S2yvoJf+BqBZsIuGcii9a:eGnSH34+CJvBZsLGbD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url

Modified File

Text

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url.remk (Dropped File)
Mime Type	text/x-url
File Size	467 Bytes
MD5	f2383b127a2e32634e003970f0b01809
SHA1	4f108c034e41a1fec4913b335f8476baf7d7ac1f
SHA256	25c600990271d8a8e43a007bae875a3e02579b97adf982aa5f91d2763c508940
SSDeep	12:Yof6rbP5dYWJ+XLStp+C0/4fY8c4IuGcii9a:YoSrbPbYtkyF4LGbD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url.remk

Dropped File

Text

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url (Modified File)
Mime Type	text/x-url
File Size	467 Bytes
MD5	2998a4771b9f04c2ce2f97668b58a8e9
SHA1	ac00af89a97d3e9ea1fc1491da8494e627c60d5e
SHA256	ec69f5fe2debf9e6a081045872af99e9df6b1ffb42c21e6d95c8899aa27dca69
SSDeep	12:ZmOSy3wZdoJl19PRjJYbNkMdj2yPr+pMIzP6IuGcii9a:0OS1ZM59ISpMPLGbD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url

Modified File

Text

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url.remk (Dropped File)
Mime Type	text/x-url
File Size	467 Bytes
MD5	0c9a617e2eabf5884ec6554bb5236a54
SHA1	1bf22f40a7b8438f601d61334693021fc73f6eef
SHA256	1e25488a4bc67ea0f8d78128439d3e20b65c82cd93ed32ebe8887335655f9038
SSDeep	12:AAGhRU+BafPXPBiF7fy+vy0SbN8Wi3dsxnXSIuGcii9a:AAyacRy+vtMad3+1iLGbD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url

Modified File

Text

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url.remk (Dropped File)
Mime Type	text/x-url
File Size	467 Bytes
MD5	47ade7da7e520e845817e0f2b5cf4aef
SHA1	415a8d0f399137b2c44125af03b923ecf1d900de
SHA256	c1d1b0cd64adcd2feedb59ae223f7f806763522cc5724cceb5f644340fa3d57d
SSDeep	12:knTPh31tAJvwSr/sAl6cyvf0ZZVm76uLY/IBVNcIuGcii9a:kTPh3rANrtJKjE/IBALGbD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url

Modified File

Text

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url.remk (Dropped File)
Mime Type	text/x-url
File Size	468 Bytes
MD5	e28389afcb5f2631a55300e18eb09083
SHA1	9898106b0ecc3c18d89f6610ec47cfca706f8699
SHA256	f4b60ae241a7bc6f39d3570286235e1631ab75f78c9744dc74a17bda3d770f7c
SSDeep	12:88bCgo54F7EgraS/045UbGVaeUBdK6hSIuGcii9a:DjbagrJMPIOc/LGbD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url

Modified File

Text

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url.remk (Dropped File)
Mime Type	text/x-url
File Size	467 Bytes
MD5	2aa42838f4a9ee616d66442efc2fa2da
SHA1	34cb17f91c6abcc0e747987a1d71edbc8aa397d7
SHA256	41e35fe2e9599f9019fc6c2f4840728264abbcbf669ba7bda1f2648425438b14
SSDeep	12:hAlb664FPRTv+Ni29RcH8N1/GR8/m6IuGcii9a:WZ+INJvcutGv6LGbD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url

Modified File

Text

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url.remk (Dropped File)
Mime Type	text/x-url
File Size	467 Bytes
MD5	707f01f6a6c910c45e7915dd6bd73f8d
SHA1	0fbac469bc6564f98302e3099bcfd40435914ef3
SHA256	f0e524362b299266b9939f4fab3bbd783eeca22f6a1171c8752cdd251c069b77
SSDeep	12:y6OEb31Tgwluv59IGGlaquD/gD8cJx3DMm0AIuGcii9a:H9BTgd9LNquDIDL/0ALGbD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url

Modified File

Text

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url.remk (Dropped File)
Mime Type	text/x-url
File Size	467 Bytes
MD5	238a312b95b0163526ea2515f1dbc95e
SHA1	39afd0c10d1e49ed26c541e2226184157f0b679e
SHA256	29181a2471c12247330d57bd1ad99dd5c074a35e653e67b4175ca422ef9366ee
SSDeep	12:qcdGLR1mZ7UecUTwHCsYcPutOGLcreIuGcii9a:qcd+R18KUxxuxSLGbD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url

Modified File

Text

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url.remk (Dropped File)
Mime Type	text/x-url
File Size	467 Bytes
MD5	c0540bf72742cfe55c71f365e03b477f
SHA1	e3cb8ab5fd0432571a6a79f7ab7c260bddfb7940
SHA256	50d1846187b1545386a9d503770188457c90c6f12a64c7376aab57da566d11bb
SSDeep	6:J7wl5/Pn6IrNxa62jkIwEQ2KKlKsUIYEdEIlZwLs3PVpeTdALav6IUNLCcii96Z:JkhPXrNxaUCKsKMJdM54av6IuGcii9a
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url.remk

Dropped File

Text

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url (Modified File)
Mime Type	text/x-url
File Size	467 Bytes
MD5	e2eafe51325b43735a8eda8f8cfa406b
SHA1	006e903c805a9654b8ffd03936e2747b740aff06
SHA256	11e5d959cf88b84206ac3fcb06bda455fd5ed745424d00ea3890096762367b9c
SSDeep	12:hvjV6Dj54Vug92bCKXjyV/oeNys+q0IuGcii9a:mxOum2bCJBHOq0LGbD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url

Modified File

Text

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url.remk (Dropped File)
Mime Type	text/x-url
File Size	467 Bytes
MD5	932bc4a0641ddebd57b11a7acf56cae1
SHA1	036ad7d288e023483da86510228b523cf5e0cd47
SHA256	296cf7fcf8d682cbb39bb4ff903b09f9ee6b576c4e9fe860ac872d2ac298b251
SSDeep	12:S0ewdHzebXbN0CGDK81EhKyO6hroKx95IuGcii9a:ZRdHCfyC5UGLbyQ95LGbD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url

Modified File

Text

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url.remk (Dropped File)
Mime Type	text/x-url
File Size	467 Bytes
MD5	a095691a817c9b878d52e71cb31b6d5b
SHA1	ef3c5389359a691eee5c895e78e1d1b3cd3ea4ba
SHA256	f66533446348549ec5cf6c945b4d694675729c989cd900ba52b30578a1c1855c
SSDeep	12:jEkXO+nGAKcPNd+XkezpgBxyD4mY5IuGcii9a:jE0Lt2X2qQ5LGbD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url

Modified File

Text

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url.remk (Dropped File)
Mime Type	text/x-url
File Size	467 Bytes
MD5	3624d488a8b9c559fe441089514a7eb3
SHA1	38438cce8c2b5736eb22818fd0edd6acf841a7fa
SHA256	0fc21197a7e1030e467ec4fca1e6a57e7fcd5a01d5c38cf1e336d57a0fed3919
SSDeep	12:egI9D9tri/SYfwcLBYVKdlhZdsp7RpJIuGcii9a:egm9DoLBYVurZWVDJLGbD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url.remk

Dropped File

Text

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url (Modified File)
Mime Type	text/x-url
File Size	467 Bytes
MD5	1096f550313a325ed0b6ff8b59de229d
SHA1	6bdb6878b9b76dcd476123f9ed7a4ed71b00f67f
SHA256	c1c9193fa737316345de4bf059d0f032cc61a9ddc08064a56232fa744e009e62
SSDeep	12:oCuwM3RIlcyya+vW91YQJ9DSDEL3eUVjaiIuGcii9a:oCuHlyya+EeKSDEL7V2iLGbD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url

Modified File

Text

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url.remk (Dropped File)
Mime Type	text/x-url
File Size	467 Bytes
MD5	2b572bb8d4a9a585f0e4e93274a96b87
SHA1	49d8be99611de8f68683a2e93f89d46cc21b5c3f
SHA256	112bc7488ba15f1dd7f0394f169b2da61d61508ec7abbbe00df003681ee510da
SSDeep	12:kQwemeiLNtdYkGuozHiL3x9xJTo2W5fHsqIuGcii9a:8GiLfdYkGFzCDxNToLHvLGbD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Gg6LaR4dxDzOQomZJ1UL\3557nrWiSL8Oztuk2v.mp3

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Gg6LaR4dxDzOQomZJ1UL\3557nrWiSL8Oztuk2v.mp3.remk (Dropped File)
Mime Type	application/octet-stream
File Size	58.59 KB
MD5	edb13264217800bde9577f1f2461ee5d
SHA1	75e59fd6ca19d233e8f45d2e8e72df9a613e40ef
SHA256	1c118991bd4f1210f118a996b00b483135d15358a1bb60b012e323ecfa782651
SSDeep	1536:n2grxO4xhqghHEkb2X4aIGsvkWUxaI7pY8l+eYgG/oMlTTX0kLu:Echq+Li4LGYkWOaz/lfPu
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Gg6LaR4dxDzOQomZJ1UL\6E50reyJxYm.wav.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Gg6LaR4dxDzOQomZJ1UL\6E50reyJxYm.wav (Modified File)
Mime Type	application/octet-stream
File Size	75.98 KB
MD5	743d53f424f07411b889bb95c1d37a0f
SHA1	5325338e94b266ed6545bd7b725013bd5ed01e3f
SHA256	a155a2cdb6d5ed9005d6f1f98465d06e679f9c14a550cc473c2ff460e1011ac1
SSDeep	1536:/2TzVG8qkTRZCHgm2DqFGnF2Nc5Dy/rIEpYtA7u1fP03K:YzVAkTRZi7h4nwNSeRp/yfEK
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Gg6LaR4dxDzOQomZJ1UL\dbHnWPIPAcwCYg3Bdmu.mp3.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Gg6LaR4dxDzOQomZJ1UL\dbHnWPIPAcwCYg3Bdmu.mp3 (Modified File)
Mime Type	application/octet-stream
File Size	41.45 KB
MD5	aaaa720f627fdc69058fe54cc5aef44c
SHA1	a2adc62b1080a3e2909c9f8302c51eb137fa6fcf
SHA256	3b896c5f857b8f1a65a5571eb087eb62e2cf2c56ab025987892d480afb3cf229
SSDeep	768:3uvMzCedTu7Wo4poSfrHTAbeN4oR10FE6Mas7yJNoPDtyzkFsukMCiBO+gKNO:EYaaBpoSvFN1RKFOgQvFQ8O
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Gg6LaR4dxDzOQomZJ1UL\j-9 8ML8KY7J4.mp3.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Gg6LaR4dxDzOQomZJ1UL\j-9 8ML8KY7J4.mp3 (Modified File)
Mime Type	application/octet-stream
File Size	31.60 KB
MD5	42341047d7a450d6e7808e904ffd1621
SHA1	b91638296e59cd7c20bc1cf5b1db81ef310bdbc1
SHA256	2c0a575464580344bde9d9183054411a91360137117820be7839ac539bc09407
SSDeep	768:NfsbcpGLu1QmwsgnwUAfyOjVEmyJoIjXGy57knJXHsQ:NU4AL3mTjVEPJoYGyeNZ
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Gg6LaR4dxDzOQomZJ1UL\M19pxLEndmqvY AcHQ.mp3

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Gg6LaR4dxDzOQomZJ1UL\M19pxLEndmqvY AcHQ.mp3.remk (Dropped File)
Mime Type	application/octet-stream
File Size	72.75 KB
MD5	86201bd616f77fcd7e7027bcb64d9f17
SHA1	993d7b9f144c98680647f79cdf8e6ef112654347
SHA256	259dc865546651120bc880564001a9f2bf8b623b46052c71a683cbfdce1898a9
SSDeep	1536:9A5nn7UHcHi0qJ8xFhQOKAg5pP9Ke90Azzu7B1ABW:i9Ur088eOYl9KCzycs
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Gg6LaR4dxDzOQomZJ1UL\rM_fq7OOza3eITH8.m4a.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Gg6LaR4dxDzOQomZJ1UL\rM_fq7OOza3eITH8.m4a (Modified File)
Mime Type	application/octet-stream
File Size	72.68 KB
MD5	78722f715fa5b9db245c55d2914de6a3
SHA1	81eaef96d0ee3cbf60d03c11a904287e9ca71fbd
SHA256	3061f7d2600ef19230a42a5f085c67f67a7ef237290e59380e4227d5997d7cde
SSDeep	1536:BpzNc+C605BokJJcUCrdYXABow4SHTZe3B4RjBbvDJZ:/zNc+CRXfcUoYwb4S83EL
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Gg6LaR4dxDzOQomZJ1UL\Y1jISSChT2WEecUSrE0s.m4a.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Gg6LaR4dxDzOQomZJ1UL\Y1jISSChT2WEecUSrE0s.m4a (Modified File)
Mime Type	application/octet-stream
File Size	81.49 KB
MD5	733c43050691fffc718273987cbefe9a
SHA1	7fd3aed97a5e5db1bf5e2ce425ba7a9ca810328a
SHA256	2293d03f001440f2a72a685c357bcc16a7416371c547b6457b50f3a8931d945d
SSDeep	1536:OQvcgZotgmNOAxBdm2buWpYEIK6enysVKebcTxjszw8hezN3yferXqD/X3p25:Owm/PdAgYEIK6cBYxjsM8IzN33rc/o
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\vbTY960\5vtSd.wav

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\vbTY960\5vtSd.wav.remk (Dropped File)
Mime Type	application/octet-stream
File Size	50.34 KB
MD5	fd9ed11572b837c3abb52b096f652e3e
SHA1	dc0f6a561fbf6c98dda999bf4d958527b570305e
SHA256	ea2b8ea5c92bff800cb59c9c71c880895701f162b5d124347f8b9fd32e9e092b
SSDeep	768:s2tb72iE+XQ3dktz8pUJjoXkDcc/ewhC3Cw3hAQC0JGfR5p7CmYr7MMphp+:JM+XJtz8WR+k9mgClhJC0sR+Zr77pu
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\vbTY960\H1p6Q94-hZHIiHNtL.m4a.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\vbTY960\H1p6Q94-hZHIiHNtL.m4a (Modified File)
Mime Type	application/octet-stream
File Size	26.55 KB
MD5	a40a60ef18ce7a82a2f1ed58f4f3ec02
SHA1	22321c6c9fdc04c55725eb4f84f9c980752caff3
SHA256	ca65c29fc2f5cbbdaa8147dda7f61d0a67230ba02747b3d74e9145256a48a5cc
SSDeep	768:OuyX+ADUXE+gm7xaPOuKZOCelVbexu/92:KrJZmuKmlVbeg4
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\vbTY960\L70E2.m4a

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\vbTY960\L70E2.m4a.remk (Dropped File)
Mime Type	application/octet-stream
File Size	41.86 KB
MD5	c4aa461f3fe40ce0770f0de6a5ec9d87
SHA1	6db2f0ffce86546d6c61703c8be8f0aac38f7395
SHA256	d7799ef256f12fec75e0c623e800361c4e8e58ebb262f183f830744847a183ae
SSDeep	768:p97yfkmVDQqbvtjzSAv/Kir5xTvL0XdpVfLaABZQMnCpmRNlgBO7D84qjPXhWDAK:p97ycmVxt2Av/KOxTLAphQGC0sIouEoR
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\0IVabRQYVPOOzITA.m4a

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\0IVabRQYVPOOzITA.m4a.remk (Dropped File)
Mime Type	application/octet-stream
File Size	89.28 KB
MD5	fc0d2035526b60fc09e240a836ebd1d6
SHA1	25f0a3462ea14cfe30312cde9e0c0a232bd92e41
SHA256	bae6f6af3eae8e6af9a8899c6f566bc60c62f528ad2a0dfae7044c6f0c06a24b
SSDeep	1536:WZibP26j80cJmzyfrvJ4uELXIv/L6z2bbdtuh/kDIX0/Y+3tXLUsAjjG:WEbXoVrmxKTCIpGw3VUjjjG
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\542fVbx-Nb5SSv6oh8A5.m4a

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\542fVbx-Nb5SSv6oh8A5.m4a.remk (Dropped File)
Mime Type	application/octet-stream
File Size	70.41 KB
MD5	72b5bbd54fc85dad4ecfc796812afee2
SHA1	0992e66856587d63c0a2da9c5a774abd27f68380
SHA256	5f58330440f2676c71d4b0b5e6c5cff06b3f141105ec5afedbbcf5e0d792049d
SSDeep	1536:J9ZnYgsQgckp7Ek1F3l0uu68urUDJKiMTj+0uMvvShB9AiW:J9ZnYg7kp4s3l5u6ipMTjXx+rW
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\91vVO4gMJf8R.m4a.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\91vVO4gMJf8R.m4a (Modified File)
Mime Type	application/octet-stream
File Size	18.42 KB
MD5	5890baf330b5cc99b9042b02fac7db49
SHA1	d7fee1c9ad52c8b7f3dd6248b1bbf8b338f69ccf
SHA256	8c29a79b06c257ecf16f11931c50fed2b88ba72bccfd6ec0a4481847e16d36bd
SSDeep	384:+/5JgaLu8mCYXNjFydwNJJg94exm/Y4kruZmp0PfpPE0KHnKLb:+BJgKfAj6SP9YifYuZwuGHK/
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\BQcrUevf.wav

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\BQcrUevf.wav.remk (Dropped File)
Mime Type	application/octet-stream
File Size	72.07 KB
MD5	1a65de1c2a46e8d62c0c4a447e1cac6e
SHA1	7107d15922d89f711ccc4799f97346a035454551
SHA256	5a24e91a7e0c2b4081a34b08ba21d36e4a8d74612b559262a37f4a7f988c4bab
SSDeep	1536:3JMUHzG9U0dPDnU+W6Myx8xkjejyUaZAfRbO8d97LyLyYI:ZLTGLYV6MyMhna2cvI
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\C_5lQ-Upo7x8z.wav

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\C_5lQ-Upo7x8z.wav.remk (Dropped File)
Mime Type	application/octet-stream
File Size	25.19 KB
MD5	d88d7497e927aff6afcf5c6d3995f1f5
SHA1	b5a3e07961650aa89df2b7919a4e8cb086ce39e7
SHA256	ff0dd1688af0a0ffa00cd2459dc7acfece7ff1cd8730dc2dab2e3eab0ba51482
SSDeep	768:y48XGSi7NUrdfugEspZ2r+mFkin/KSw2W3VYp:TSeUByUZ2ymFkm/s7Yp
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\iGbC-X.wav.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\iGbC-X.wav (Modified File)
Mime Type	application/octet-stream
File Size	71.44 KB
MD5	15203cb22a4a91ecfe8e4c0783f476db
SHA1	03815159f5aced474631af6549a9809559b6fc9f
SHA256	64a552bf1442c0b3225b7021496b3ee2b81538ffb30f22a909e16eda6df9a518
SSDeep	1536:Lqq+NNORi2xFdTSMnvDPrBbc0blO62Sqx80YNId2T5pgKNlEUFK:ONF2FVFvRtBO62B7dcXBlEUFK
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\j8VGyPK3jrNNvLRuL67g.wav

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\j8VGyPK3jrNNvLRuL67g.wav.remk (Dropped File)
Mime Type	application/octet-stream
File Size	3.37 KB
MD5	abd13009a758cb4ed7e0c6927b42a7a7
SHA1	f1f8d0843482a08eb9888c579fc2233354f573ee
SHA256	74fb60b69a63247fc5ffa8f1379b012a3558c958375b6fd01b8e6e9bc34b1577
SSDeep	96:zCxG3g2+ybTdHEgayafQzUWZI/sGJ46BSyEVZxuAF2ESsdFA:u1MdHtayafQzg/sGHolN6sXA
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\JJIlS8u_6kS2VPu.m4a

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\JJIlS8u_6kS2VPu.m4a.remk (Dropped File)
Mime Type	application/octet-stream
File Size	5.32 KB
MD5	6d8d6ba9bd27c167e242de10870204fa
SHA1	3b5c7baaf2c070765c90bf1e31e628bfc0f9090f
SHA256	723c428362b4d7c929674747f7ecf6bcca1a04fa06f58b7ba0d0375fc79d98bb
SSDeep	96:YpQPvdvd/pcfOgV2o5lQGo42eLjCNDfRKXJ3comBEEtalsxMloiT3cY:YSplEdL+NDpKXuBEEtCOirJ
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\55dO.jpg

Modified File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\55dO.jpg.remk (Dropped File)
Mime Type	image/jpeg
File Size	54.64 KB
MD5	b0c8fc0a26deb08eea4227fd4f9e42af
SHA1	4ebb73db873f472a95eeb7a3f1f95f3a9726e4bb
SHA256	4f4aee4964c50f31a3989ade503326fed7ae84b64a61b35b2e6145981871a518
SSDeep	1536:oqhlyX7LmF+hwwK69F4GvqDSCix2mdrzlEic6:+rLth7KevU/mjE2
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\I1U5Uwz D.jpg

Modified File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\I1U5Uwz D.jpg.remk (Dropped File)
Mime Type	image/jpeg
File Size	71.47 KB
MD5	16e7022a1df463e67067901f02c41f9b
SHA1	c1b377a8465605e1e55702ea3577b1c2180265e1
SHA256	48b90224921dc348a8f0f64677c5fb3a065c863f1ccb417cffd166a2b6ffc81c
SSDeep	1536:4/lhyfqUoFLPgKMPThRBnYBid3WrhjnF4zZ+bnTJq+5mjekClQbI:ohfUoFrW9eEmrRcZ+7TJq+kjcV
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\ivWs qFi.bmp.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\ivWs qFi.bmp (Modified File)
Mime Type	application/octet-stream
File Size	48.95 KB
MD5	6c4990fde1af7456159d33ba9fe05907
SHA1	795025e94a0b1051a95d96be93c03b1c3fa90502
SHA256	6d6446550404645d99a5426b0e01ac138be33550aa63709e1a0280bc81d909d8
SSDeep	768:oJbgB+eqWnV6wKM7MltDtyKeqO22/n/6NvgxsVaqzBST3sURjMqELYLvXnggJS69:oFheqWn/7MhQA25RjMqEcLfnlNODm
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\_UQ7F5NbCFJ6.jpg

Modified File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\_UQ7F5NbCFJ6.jpg.remk (Dropped File)
Mime Type	image/jpeg
File Size	3.12 KB
MD5	c10668b989658e66b7e1a1c7fa045c09
SHA1	ffcc2baa3deea53c4c62a2369270571fb4ae8147
SHA256	17e55b68cf5fe940d4194a29f0b2e35a390f9a8b5d996004b39a0459e4c2a8f6
SSDeep	48:CgJIkDwQmb7MxhpxydtqVflmQF90v0KwhqkkuAObvxWDb1Znq5eRAg5j1wYbPUD:hJIkDwbgpxu4Mg3KwUbuvcff/2c/o
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\g1CuCps yZIAOwjCa\6lJNlbKyK354Qa0.flv.remk

Dropped File

Video

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\g1CuCps yZIAOwjCa\6lJNlbKyK354Qa0.flv (Modified File)
Mime Type	video/x-flv
File Size	43.81 KB
MD5	d01d9d170496be4454a09b8d24a4cf63
SHA1	ff117c6ba17c3cb2d7d85c9124bb6d83ee9d9522
SHA256	93999a5df81bf7dd02b9caaf49c3846cea26389a10e85dd8d531ada62ea65a3e
SSDeep	768:rdzJP8Bjy88QFXHV0WaFJ9TVa1a8C3vUvgBe5z9oAmOjGK4p9sFb:vPAyMlHV0tFrw15K1A5aAIsV
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\g1CuCps yZIAOwjCa\JTSMdg7_.avi

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\g1CuCps yZIAOwjCa\JTSMdg7_.avi.remk (Dropped File)
Mime Type	application/octet-stream
File Size	99.68 KB
MD5	8f09f0882a3833a01dc92d0b98035bb4
SHA1	7a9fdc36709a2019814e411baaea9eb861f67270
SHA256	27f6213856aeb6913d158149d3b1d713798466c66adda53695ac8685e63cd487
SSDeep	3072:uHW5fzvKfmGfDE0Gfd9YVdnBaxZpJ9/IiWCuoH:EW5LifjfDfVdnsxZpr/3WCuoH
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\g1CuCps yZIAOwjCa\kaWqD.avi.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\g1CuCps yZIAOwjCa\kaWqD.avi (Modified File)
Mime Type	application/octet-stream
File Size	66.47 KB
MD5	c5593ccf5754596f0ce9880fa27cbf81
SHA1	17636109eca0d066d6c74586bd26e12ad598be76
SHA256	61131a1123a62b49dda029998cb450d5b7638bf660af44d98c59e0828937ce72
SSDeep	1536:NEL5RzNKLkSZOvcUSRQNJ9a/BHd1lS/63T4nOmEe7efyrXqk6Lc:uL7+kSccUSRQNYB91lq6j4/Ee4rLc
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\g1CuCps yZIAOwjCa\rw 5imJ8K8cEClnKzuF.flv

Modified File

Video

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\g1CuCps yZIAOwjCa\rw 5imJ8K8cEClnKzuF.flv.remk (Dropped File)
Mime Type	video/x-flv
File Size	97.12 KB
MD5	646d1864a83612450c88b2de8223adbe
SHA1	d1808c9bf6a889f0defd354d5bf78e8705c1f9fe
SHA256	ddcef1ee07d4fcd7709911f55cdbeb429fe9449a9ea9c91307113b45bf2c6e82
SSDeep	3072:In7IvobB/DE9GDZ690vEGP/fyu+t/3p1cl1a:4IvobB/DEYs9Hcgt3pOl1a
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\g1CuCps yZIAOwjCa\uWd 0nDi4nHu_OcIzO.swf.remk

Dropped File

Shockwave Flash

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\g1CuCps yZIAOwjCa\uWd 0nDi4nHu_OcIzO.swf (Modified File)
Mime Type	application/x-shockwave-flash
File Size	2.85 KB
MD5	531de5e34c85bd92cee39ffb0c167126
SHA1	91faaddc75c79edb0d59205bffce42967f51d30a
SHA256	9f85a7c0eab7b37a94a265ad495017e6d293c9699d3d12a96ec9f619ab69b075
SSDeep	48:c33geG+PAYwbCU4eX8Wq9YcmwP9nMOrsEj1oQTHdEIqLMg/RM8RyJC+0D:aYkBWcNpMOj7CsgnwC+g
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\4WiEyq TSCYneVBnG4.flv

Modified File

Video

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\4WiEyq TSCYneVBnG4.flv.remk (Dropped File)
Mime Type	video/x-flv
File Size	40.71 KB
MD5	c5a53d18bb00f821bd3e8fe2d7fa8b49
SHA1	40de4076c52cc8cb61a27e22ce4f8f977f622c38
SHA256	20f6f162f06d3b569af75798ffc19909a5f51af1149f9f19e43f226c894c4868
SSDeep	768:t9Iu7Zbg8k8dBH681PZzGKDZW/SeSy+gRXQn7ghqUV7D9X:8u7hn5dGEZW//pqnmq2D9X
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\BP1P5M5rRgJVJ_zFpje.swf

Modified File

Shockwave Flash

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\BP1P5M5rRgJVJ_zFpje.swf.remk (Dropped File)
Mime Type	application/x-shockwave-flash
File Size	52.13 KB
MD5	6c1a0c34040ca3e5b5071948fd9c6b8f
SHA1	18e6a3b1ff2440d5f756d8a7f4f8382331af69be
SHA256	816233e8c15d8e9d409da2a7a9390761809c07c72307179ddd19b38b2bc1cc00
SSDeep	1536:0+f03ijbwCuinjh4QyijmnxVe7dvPegTOTZtzG:pp0C1njSQf52ttzG
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\IBFomAmOPzHP.mp4

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\IBFomAmOPzHP.mp4.remk (Dropped File)
Mime Type	application/octet-stream
File Size	50.83 KB
MD5	04e75c86533bd5b214b67c2659a6513e
SHA1	985740e7300dd83b759daf804f01b35551096aad
SHA256	4468db4ad4a1e0d9db87e6f18bbac456e7b0d8065e38ab518fe4702bab0a7795
SSDeep	768:OMXX1OBv+6WdCDVkGuZaq8bH+elaxDgsXHxwsJuznsrt1batP52lB0vMmDHb7U:VXXMsCBLlaZgsXHdoe1mP4YJv7U
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\KpWw7pD9YBx.mkv

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\KpWw7pD9YBx.mkv.remk (Dropped File)
Mime Type	application/octet-stream
File Size	96.09 KB
MD5	98b58a6d4ffb52eb04099b375c6b92f1
SHA1	68e62272d637133b1423aaed8b2bd5f62ede8cfe
SHA256	31e4ef78efb90f0af8f86658ee62db97d041ac79c4a95e820fcca71e50663c83
SSDeep	1536:hKrl41M/wqqEhZsoA0Ohee3RHjNdv/UAKCyA0NMlixmhWiiuu/gie4WsG:hKxv/wHUZZOhzBzHUherYhTPt5q
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\iIWj9EjHStmpO_L\kIgwk9vBXkfQWoRq4O4.swf

Modified File

Shockwave Flash

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\iIWj9EjHStmpO_L\kIgwk9vBXkfQWoRq4O4.swf.remk (Dropped File)
Mime Type	application/x-shockwave-flash
File Size	60.21 KB
MD5	69f8db7f6d9aaec43ab48665625a4648
SHA1	d34ed39208ad56c8dac0b2a9e510cd1639f911c5
SHA256	5d9a4022de49d22274412f145fd5d7e1d62ff519e866a11b03b7e1804df368dc
SSDeep	1536:Z56iLoF6N3IWj9UZ/rBZCzeZyeceHRhYGL4pRG2LTr0CvpzbTTI:73oWBw/rBZGeachvEjLTr0Gz7I
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\iIWj9EjHStmpO_L\MR bG63x.gif.remk

Dropped File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\iIWj9EjHStmpO_L\MR bG63x.gif (Modified File)
Mime Type	image/gif
File Size	42.30 KB
MD5	c9708e402e18db431e83f79988c30b4c
SHA1	4f43681a1c69ae445c0498dc495a57b47007c926
SHA256	e244e67c49376b6d47fe1b729c52c3174aecf5e16d2e66175dfba33275dfc65f
SSDeep	768:gAOybmbetMdW3dwOSj2wORYUhBQglz/urkts14VJA+L8i5G:DRHtLhvYYQgR/ykiUpLu
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\iIWj9EjHStmpO_L\WOsa73cE3Ci.docx.remk

Dropped File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\iIWj9EjHStmpO_L\WOsa73cE3Ci.docx (Modified File)
Mime Type	application/zip
File Size	28.47 KB
MD5	13d504d4d8eccf5e23dfd7d1bd2b6b2f
SHA1	703c8916f0d84304c4805d86b9beafa466fb3a89
SHA256	8fb22d5d421a198796cfd9a53c996796473dcc345d147806f5c53643de2d429e
SSDeep	768:lNutNHkTIJbIua22mLeRJIECki2aR7rPBTnOz:l+JbIPmKAE5QPVni
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\iIWj9EjHStmpO_L\_1Lysnpm8u.bmp

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wzVrnoY3pfgm5\iIWj9EjHStmpO_L\_1Lysnpm8u.bmp.remk (Dropped File)
Mime Type	application/octet-stream
File Size	18.58 KB
MD5	cd5b5279464cd9109c910eae10b08872
SHA1	e0482ff5279c4038a2989fbedafb0a37a7d2f59a
SHA256	9c59e55ae248cdbed1860a3bd780fc5159acddf6ac3bdfae4f2fbe6b0014b118
SSDeep	384:3tiGeahyObx1ErlXHj/KskdmZMvVPUItdYIZtamKGlM2s:3cEyOb8KVIMvdUIdkmKGMB
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico (Modified File)
Mime Type	application/octet-stream
File Size	29.55 KB
MD5	530388130f39660859149db300b43662
SHA1	619f7f0459f0f84b2cb96eda0b9b16fd40a1232d
SHA256	6c6e19d72725ace22f6215653a3aadcbc5941c11672b933daf12752dc68df79c
SSDeep	768:zph6UsyOY1tVRgnHBNVHQp8p0mVY/4Fq2jBkfkk5ty3:zzlfVRgn39JjFq2Gli3
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\9bzSIvv8A.xlsx

Modified File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\9bzSIvv8A.xlsx.remk (Dropped File)
Mime Type	application/zip
File Size	53.11 KB
MD5	2009a56cdec70623bd52d68294ac8cd9
SHA1	47f373c720da92664f42f2d1bcd93a126dc8cf1a
SHA256	94448e4bd70dc46c673e55fc96415a47181f55f92d15f62fd77f6e06d165b2b9
SSDeep	768:CuQ8irmNLBaFkZd2r5q2elF9XoJshLSjrPMn0F45nme0B3k6Cc8bIo8eKPpTBr/H:3b/YKak2a5EZa5nmelbIeK1NEehpYI
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\BokYvvAfU.ppt

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\BokYvvAfU.ppt.remk (Dropped File)
Mime Type	application/octet-stream
File Size	21.21 KB
MD5	a0b06c5e49c731810186cefb89bbdf54
SHA1	b117145ec236cf7d131b1e4f71e2eb31ff224320
SHA256	8320d0eb4cf2683a860cc6ec27ce8788ecb8c675bcbb377fd4097424afe96c9f
SSDeep	384:Iy6xLEhgRrDqJ3Oqgz63qItA/nNDQnPGx1Hi5VMKOPRBFvZbS:p6DpDqpgmPA/BDiXutvY
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\cbSmrZ3jMzQOa6ad6 s.xls.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\cbSmrZ3jMzQOa6ad6 s.xls (Modified File)
Mime Type	application/octet-stream
File Size	96.10 KB
MD5	f2c07dd26eb607cd9db28ca99f5eabe1
SHA1	792713ca2b0aac101cebffdd3a720cf08ec89382
SHA256	45d53db46aa1b7474b7b65955825efc3db21d8293cf6390494a337fc80d05ad7
SSDeep	3072:8pdQholK+5Fg2po7JpzV5PpoRjREzVE+CzPfsylgyd1z44Av:O+2lr+xpFpQjRCSXsE4
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\e5Z-XK7-M2.odp

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\e5Z-XK7-M2.odp.remk (Dropped File)
Mime Type	application/octet-stream
File Size	41.60 KB
MD5	7848683691f540b0aa23bc10173a5dc5
SHA1	2b517d2df22ef2197ca3e8af4ee817ff66a84bd8
SHA256	a8d884ff75791786f63ad425bc2a1f9fb2078b6404c887fdb7926487ef9b6b5a
SSDeep	768:GLJaXUGxsdzK9SwnMMVgqI+nTz9PRCElLeT4HDshe7ztDN7aJnGG0g1n+CsKi7:GtaXUGxsdzK9ttgZ+nTz9PRAT4+e7XK6
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\i_O0aoNt9QXx75 z.pps.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\i_O0aoNt9QXx75 z.pps (Modified File)
Mime Type	application/octet-stream
File Size	95.42 KB
MD5	32ce7671b4b041d1ff92eb555c114771
SHA1	a3e3b8b8d41d6976ac7fed0e254529ae1b8bfbc1
SHA256	7b70e94efce45dde147e470813ea08fca12bbb48693173662d57ec2d3f25e9c2
SSDeep	1536:uzockU2jwEXFWu48ZIqP7fhRXnBQxLh4xR2ma+cDwmR5hw8CUtbCNHT1U:uzbk8E/aqPf3BCLh6na+cDvFw8C7NK
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\RDDJdUb3KAo.xls

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\RDDJdUb3KAo.xls.remk (Dropped File)
Mime Type	application/octet-stream
File Size	26.00 KB
MD5	f348814b8392ebfc5625d0f22a403832
SHA1	72415b8f4d0b1b24b870c1af0dc452ad18d67d41
SHA256	94810b1b832c10a66d1fe44f716c8a8180029f688ca4a4dc5ecbc4efd551f9f8
SSDeep	768:Q0b6oGqx6PTR7LoVcK01jU+pEkpKh2ymvN7N5FGMDa:Qy6oGqx6PJ/1jpekOm1BG3
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\rDvHm1Gu.xlsx.remk

Dropped File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\rDvHm1Gu.xlsx (Modified File)
Mime Type	application/zip
File Size	97.09 KB
MD5	28fefbb28abe8ebc129f3c70c125f651
SHA1	a2c288907765e1f09f259dd081594b34fc09d435
SHA256	61340aa0d91143e20832b7127c0e3a998e01935f62053a05f2cc91e90ea16f90
SSDeep	1536:PsEFsydutaF1TBQLsC9Vj5MLNAvXzA4YhQ+KqGLpNswLVgwqC2YwRgucY8luERyJ:PsEKt0hKLOmA3hQ4GLpG2RTuMbI7/h
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\tK5rfTr5kIZSRi.pptx

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\tK5rfTr5kIZSRi.pptx.remk (Dropped File)
Mime Type	application/octet-stream
File Size	11.95 KB
MD5	189533971ac8386679e7041a03e6bc10
SHA1	c335bfbd1df40169685a5ea8ab1c03cdd4374486
SHA256	1fc29c5b26a5e125b61998e768c4c7b292ea59697589b9bed89ee203c6c4722c
SSDeep	192:FvWgdYyli1+gTJMj1ZGiMcPP/Uqqpou/+lMN2EKqBsLLutDFR/QYFyoRi681W55:Fvf1sLdMj1UiLM3r+lMN2EQLEXvyoi6/
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\ypHLBtyzIYe9W.xlsx

Modified File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\ypHLBtyzIYe9W.xlsx.remk (Dropped File)
Mime Type	application/zip
File Size	82.20 KB
MD5	3505b6ff03edc9e1528e447872c4ff30
SHA1	8ae2a4efa1ee9d1fbf3acb813c531b2164bcc1c2
SHA256	1321423beb40bcae8632de76ed5e8d881c025d36ccad18fac809f874a2166c0d
SSDeep	1536:Va/UACTlm3MB/VauSeo8ONWqxV4ffFntIrQCYA/BBwWZfXnXGjzZ2Whmh//:mUACTc3YY8ONWqxyffFtI0KJiqXnXGjM
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\ZsUtmR05.pptx.remk

Dropped File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\ZsUtmR05.pptx (Modified File)
Mime Type	application/zip
File Size	95.28 KB
MD5	d999d97bc3f535667ffe6c63815793f5
SHA1	e959a64b490d65317e310436a610419893a5a195
SHA256	ce9837f73d6291e5860ca72597852d9cc8e5ecaf510c0f56a8ef9bb3947cad5f
SSDeep	1536:6UpY/7oX+L3p830UBf52bcoS4bbh+FmPO1QCr0y2iVIr8hI39q:6UII05830EB7oHbt+roy2iVwwm9q
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\R3pat\JsGQxG.ots.remk

Dropped File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\R3pat\JsGQxG.ots (Modified File)
Mime Type	application/zip
File Size	60.97 KB
MD5	8b582e971febd75b22172ce4f1b6248c
SHA1	cc599b2a14cb9b774faa4da867cc91eadc4260c1
SHA256	94832dd7773f71f0aa4bbc502d6b920637b6d3182b959c4724f13ba11dfae5da
SSDeep	1536:BDfKNzQu2PkNhdOYb5zh/vsIvNpi+wmYj0mrO4fHS:gzH5b1RxzVurOMy
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\R3pat\Lfe5b.xlsx

Modified File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\R3pat\Lfe5b.xlsx.remk (Dropped File)
Mime Type	application/zip
File Size	65.85 KB
MD5	50a284c47b5d42036e6c219755187f84
SHA1	1084afa2915ced8e859398e77ac6c87c15c63fe4
SHA256	3557587c9b8c8e87e9f047865d77821cd5c027c4a7c2694b8b4c8f7b51538c5d
SSDeep	1536:LIrJt/JoVikZGp9Tt2ayxNL54VfJzlYcYI/UvdE6Yka0o:LIVBJoVtAXTtmCxKcYEUvdE6Yz
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\R3pat\yjx2jpn3OrZ-WfDHJ.pps.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\R3pat\yjx2jpn3OrZ-WfDHJ.pps (Modified File)
Mime Type	application/octet-stream
File Size	74.46 KB
MD5	f3bf971a7abaa41b4ba9387d5acd65d7
SHA1	328172de9776b1033a7c479f9be040856ff97272
SHA256	36ab01bd47b91fb0ba744d9d44cc34fa56f86a0529176abc65cec7df7fc5cf7a
SSDeep	1536:nH0GbsL4Tt7k0Baw0Wbwg1mxb91wlvU3cWavcSDjud9kVXO7fyZ5G6:H0msL4dBaRWbwg1O91wl8MUdd9vs
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\-wYl9Wxaf_FQLu8dRQB5\8zc5gaDVdZR.wav

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\-wYl9Wxaf_FQLu8dRQB5\8zc5gaDVdZR.wav.remk (Dropped File)
Mime Type	application/octet-stream
File Size	9.20 KB
MD5	95cad0a147268c3500e51d1c59cd6b55
SHA1	51fccd9663faa3c565936af83ac158b64759a8a8
SHA256	30e7c7fa95a39c72d2b55be2ae1bd0aaa83cf82468689d69e387a78785805101
SSDeep	192:kmUVPRwWR5G2zJ9qal8uAki7t3zsQ32p7jMeXRC2+7o0:XUtRwWpvGlk23zPgJRCv
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\-wYl9Wxaf_FQLu8dRQB5\BLoYkmvVlNGLNVl9j.m4a.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\-wYl9Wxaf_FQLu8dRQB5\BLoYkmvVlNGLNVl9j.m4a (Modified File)
Mime Type	application/octet-stream
File Size	24.74 KB
MD5	fc4d5f95e38d1091b46b1d538f07bc68
SHA1	aef25af8e97285438f209abc3a46708e4f333b88
SHA256	bc1a3e1c51d836c45fe0f6931d987666c7905df542eeec7dfd56c541fbb6d291
SSDeep	384:n0inwbvGtEvl7T7DaR2GEEQ/Qh/zbH0vBPZ/pZwLe0KOBGXwe8dZX14HoyonJT:ntYd9DGyFQh/za9w4G1KYJ
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\-wYl9Wxaf_FQLu8dRQB5\Hh6wUmsTzjoH.wav

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\-wYl9Wxaf_FQLu8dRQB5\Hh6wUmsTzjoH.wav.remk (Dropped File)
Mime Type	application/octet-stream
File Size	4.33 KB
MD5	327fbb963aea75748d1a8785399c054e
SHA1	3cf88ecaa35ec9c9ac1b15d017b1f8717452b8f6
SHA256	c1b05c577fe6534fa937a7d99e09f55f0b2d07410ee0c47b94744d4fd2365cc7
SSDeep	96:nVD9hzGLSnIzaRAin3VMZuquIOU/RNBJ1JEFUlSU9xR5dkbYUv:V5/ngiAi3V2vP/nBTJ2UZ5KbHv
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\-wYl9Wxaf_FQLu8dRQB5\hj_q0gZo.mp3

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\-wYl9Wxaf_FQLu8dRQB5\hj_q0gZo.mp3.remk (Dropped File)
Mime Type	application/octet-stream
File Size	77.64 KB
MD5	ace42886fe94a3b078a2c6de7927e6c6
SHA1	5418c30cc15c2d919b7bfae579406363f01177b6
SHA256	4cc04b096606fff2062fd2cbed66b8fefe82f996efecb3bb51c01a58440b3e8c
SSDeep	1536:aw24b6AqH5xv0gnx2/k/NJFYtuSWWBZLfHfrwZyrE/IF:p2jAqH5qSx2uKHHhwZyw/4
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\-wYl9Wxaf_FQLu8dRQB5\j1d_K7qJp6wY.wav

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\-wYl9Wxaf_FQLu8dRQB5\j1d_K7qJp6wY.wav.remk (Dropped File)
Mime Type	application/octet-stream
File Size	30.55 KB
MD5	1a5d3565b525af7abe89dab4ceb178c4
SHA1	a9f3da0f368565cdeaa094a7d5331ab60ed6bf65
SHA256	8d1af5ce38117c92209295c6c77d525edfe6936e95f88a6ce1c87ff600dd7e61
SSDeep	768:9emRakzFQbToaH58/NpMnrX+d2LBo6FAf7ugJcQmeE9BhNj6ppHbd:w6FvI8/NpNR6KfFVIGR
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\-wYl9Wxaf_FQLu8dRQB5\P0oF.mp3

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\-wYl9Wxaf_FQLu8dRQB5\P0oF.mp3.remk (Dropped File)
Mime Type	application/octet-stream
File Size	67.82 KB
MD5	be8cbe6c78ae75416a73b94db4d8e331
SHA1	ac8f43bbf08261bf4e7ddef24032fbe7fa7eb286
SHA256	926c87c07aa1eb8bb2950bc1b46b08bc2a969015bb86f3200ecca77fe740a3b0
SSDeep	1536:2nN/B3fZLejQybP/r8iKLcOikgHyNGngMQ2XDi7TBeOH9YQwaGK:cp3hJ8/r2QOikIwm/DKeKGK
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\-wYl9Wxaf_FQLu8dRQB5\PlRTanSu8y.mp3.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\-wYl9Wxaf_FQLu8dRQB5\PlRTanSu8y.mp3 (Modified File)
Mime Type	application/octet-stream
File Size	2.94 KB
MD5	eab48793f79ada5f9522bea166d33891
SHA1	86894ba124223165935584577941c86ec61bd961
SHA256	cf7cb1b7e3f5099d7ba79ece3c5541844803775a34840c97b60897bf133ba6ef
SSDeep	48:vZM+Wg7r8HNz1vr4dDHs9JXlhAb+Bt8GVSKshv7K5GlxgT12g7cYsAqeB5JD:hMVeoHNN4drs9JX7Ab+5SZKGbgTd7xn9
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\-wYl9Wxaf_FQLu8dRQB5\q4aLH-FAjevoeH6I.mp3.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Xb4anhaDsw_nEnBFeS\-wYl9Wxaf_FQLu8dRQB5\q4aLH-FAjevoeH6I.mp3 (Modified File)
Mime Type	application/octet-stream
File Size	22.14 KB
MD5	da824b54ee1f93ea0240134331087f7c
SHA1	e90cdf927a4e5cf8a4679cbfffeef2e204e73b06
SHA256	30f5648ddeb69731188488c2f4699b61eb87535d53795f535b2dbb81f5d84b6c
SSDeep	384:pGjgJKAQ2XQBPvsStYB1cx7FQqOVqOK8Mww9diuze1qtiAlSnl007Oq5n2fC5:EjgIALABCncxJQqOR5WdvoAlGOq5n/5
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\F4YbH 8XORnU4B2.png.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\F4YbH 8XORnU4B2.png (Modified File)
Mime Type	application/octet-stream
File Size	5.98 KB
MD5	0634824f8727d5edfa24b425e5c5fb48
SHA1	51662d3ec625845f0154879fc66e8403f6df14aa
SHA256	56bf7e51ad9e7ddabda3435a99938e9ccf118d1058c5653f42900931eb7cd63a
SSDeep	96:iV9zED986YINN/e/on4GcoBJYyG2ivEDlLhIJ6EwunJAdfQbZ7fGRVnk0/qWfb:QEBZT/RBOEDhQ6cnG9QbZbmk0/qWfb
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\Fh-vCljTYvw.gif.remk

Dropped File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\Fh-vCljTYvw.gif (Modified File)
Mime Type	image/gif
File Size	93.87 KB
MD5	908a66dc32f5fb074836b1d6dbfc6e57
SHA1	6d722087c2db185c0eab365800b59f89ec74eccf
SHA256	8e23a5e37562e993e967ad3ead1a24a43a59a387c073f60fbbcc6f746fd7e3a7
SSDeep	1536:8X8uZW+ly/VmIBiBX1b1hWg7c/21ODBeF0CefccdQHZpAwAQ/DRjPt8iLXF:81ZCVRiBr0g7c/2WBA3cdQHZ6daPlL1
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\hRaN7dOcX1AmD.gif.remk

Dropped File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\hRaN7dOcX1AmD.gif (Modified File)
Mime Type	image/gif
File Size	45.07 KB
MD5	9098bc4983e21ca2db91a50eee729444
SHA1	e2dde27226ad9992f90402764396c233fffb640a
SHA256	a227b8ef006870a5dd5fd615de13fb15ea5f056e0fa3366d11ab83f248064177
SSDeep	768:FS5d6IHceGlS3c4m/Q8pcu32oXrgnO4WS4uIlRMoHMiHsgpjZGJi0:FMD8eG0c4UKumasnLWvRdH7Hl5U
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\QAq-Frb.bmp

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\QAq-Frb.bmp.remk (Dropped File)
Mime Type	application/octet-stream
File Size	70.32 KB
MD5	89025c94062544498b1f1a319a9d78ca
SHA1	592b82766a5b1cbdd2331623a18864f2865af6bf
SHA256	16f9f097bf055543a94ffc2b8fdb8fb95a51e5647ae94820767a8441e006ba33
SSDeep	1536:BkXd+2ZqVep3sHeXhHKTf8mBDw5RT/ENZSi7lfWxAJry4WIO:Bkt+2ZQycHeXhwBVZSi7BgAJAF
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\677G8npInpXtd35QrCL.mkv.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\677G8npInpXtd35QrCL.mkv (Modified File)
Mime Type	application/octet-stream
File Size	79.03 KB
MD5	adde4ae99315b08329807733b7bc88cc
SHA1	fae1a0b89b6b43c3c88cdad95b74eff11ec18665
SHA256	19a1916777a3d12b3774ed44ede280bfaf999f6bbb1cec56441e00a8ccd83732
SSDeep	1536:vsNOcg7YNxYEfbsAX4vSqaSI+cLudAmZUjqGRxCv/oEGZy2kWBJoe:0gyNiEmq2UKOt+XgEG4gJoe
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\e0OK1KsDLkbK.swf

Modified File

Shockwave Flash

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\e0OK1KsDLkbK.swf.remk (Dropped File)
Mime Type	application/x-shockwave-flash
File Size	30.58 KB
MD5	af931322eb726f7889e912b3fcd71959
SHA1	9ca88e15ab2871cd052f548e09e344ac252c1ee3
SHA256	41a6ca8b289c0fad427832a05d74fda631448a07da40c8f84dc1113c7a95a744
SSDeep	768:eENR7pR/f9daRQWNiiwMU8aETaRoxLCH2UYT5auA2D:e0bZ90QWN4p8HaWU6XA8
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\v0svWrNd01t99.swf

Modified File

Shockwave Flash

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\v0svWrNd01t99.swf.remk (Dropped File)
Mime Type	application/x-shockwave-flash
File Size	94.25 KB
MD5	f2ead61948e239ffc9ec2245f0049885
SHA1	3193e919e818223b1040e89e94e9b335350c8059
SHA256	ba6264cf37f74b352fc637532e9786b937765e197ad4f5a1e5b93c33f85c81b1
SSDeep	1536:j2AEI5gBpWdCptEDV12PHpq//uTXBV7cKLk2I0f9zgCrbFRgKou7TeOduajUjB:3E+gBp20tKV1oHpVNVBg2I0KCrbgKouC
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\OSDzZr1qU8Y-\6cca_ ZmPO.ods

Modified File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\OSDzZr1qU8Y-\6cca_ ZmPO.ods.remk (Dropped File)
Mime Type	application/zip
File Size	69.77 KB
MD5	cb4dd4d35a03fc0b26cd8e19a025c2e4
SHA1	0107e850b063dcafebc010d331ff2196cfd0fb1f
SHA256	ccf84d7f820027ef7bbb49f9d16165bf7914ab474e0b2d2ca52c70776c26ba26
SSDeep	1536:VIqE+ifCihCi1wWKLWBoxvrfxfoR01q9JyZZ0i5p7j:uqWqyClLW8fRq0ADUZ55j
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\OSDzZr1qU8Y-\6jPQDPh.ods.remk

Dropped File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\OSDzZr1qU8Y-\6jPQDPh.ods (Modified File)
Mime Type	application/zip
File Size	82.53 KB
MD5	90bca5e682951ec277ef052cfadc4373
SHA1	f1fa1ab98f7eab517e63dcf1bfdceab7905c3d1a
SHA256	1dba32c3c431071b5933895602bb6021f5d673fd9f56df07f9e5485f678633e2
SSDeep	1536:muZFlK1nEtz8l7gbWMfW23C0WChA2jR2cTO+9k:VRinIzuQO2y0WxA2cHk
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\OSDzZr1qU8Y-\d8nRRAoPzta8W1z.ods

Modified File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\OSDzZr1qU8Y-\d8nRRAoPzta8W1z.ods.remk (Dropped File)
Mime Type	application/zip
File Size	73.00 KB
MD5	ce6a038538efb7c76e5487f79b41851d
SHA1	22751b8d17787dcfc8ddb11229b54d847adce69b
SHA256	a3c9f1947e6e10bad3ce4b62326dfa52edcef6b4b4adfab398a79f5a946c9378
SSDeep	1536:Al7xNif9XNzYgTvZY6kxrVLZSmrDANxoXbn6uf+Y57ayOH:AxETzvbGHZwNaXM
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\OSDzZr1qU8Y-\E76DZy.csv.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\OSDzZr1qU8Y-\E76DZy.csv (Modified File)
Mime Type	application/octet-stream
File Size	81.19 KB
MD5	5d1cea82a3b6ecc8fafc7d7c35c7feda
SHA1	b7dfedbb17153511e24c625e704e7e35d8c77755
SHA256	766eb12e99fc9aa7f6f0048763a06f8200a3427828d0a59ea1d3dedac7826786
SSDeep	1536:QMtPyxqZauiodGI2HP2kNflK8nF5vFMBxbSLSLlhGC7EqzvtyJw+2:QMJyx3odGhvPN9KuDv+b5lJ7ESz
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\OSDzZr1qU8Y-\pP1VM-.odt

Modified File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\OSDzZr1qU8Y-\pP1VM-.odt.remk (Dropped File)
Mime Type	application/zip
File Size	35.23 KB
MD5	d53f0102f9b8bf79506496e28c308c7d
SHA1	f7a5b8e5dcb8528d2d15f2ddec3240bfe9e6e706
SHA256	3302510b7be2510d3aa8030724e4174ed4062601b237594f6dff9da4fcb1a9c8
SSDeep	768:SSEZV6SlN8rjbdMvL9LbNUh0WYtgA7OMufWHvMTQ9QxZIE2aOWin:SrzN8rjJMdp2QtAMufisw6I7g2
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\OSDzZr1qU8Y-\q6Xn7lmS sN.doc

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\OSDzZr1qU8Y-\q6Xn7lmS sN.doc.remk (Dropped File)
Mime Type	application/octet-stream
File Size	70.84 KB
MD5	a4feb12e6240e648b90464504bbf1a4a
SHA1	6df5c2324734cf7a54b4bbf8f72083943d696fed
SHA256	7d49b8cfe027c2f27923046cc59d217c7df133fed264e6fbc59bc1e4a7768122
SSDeep	1536:lAW+547K5KZ9aY6v2QVbk1xp3qFbFZKV3a3kzgJK/d61m2A:et4eKDm2QVELKRsV3Fg4/dSm1
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\OSDzZr1qU8Y-\vES6q7o6drzmc2wswqv.csv.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\OSDzZr1qU8Y-\vES6q7o6drzmc2wswqv.csv (Modified File)
Mime Type	application/octet-stream
File Size	85.61 KB
MD5	c0013a5ee8c9cf140c1905006316ec2a
SHA1	abc1925a4a081cbfc8d293742085962cf27feab1
SHA256	361d074fc79bf9ae8ae8e5f06ec45bdbe285170702ff90087b168eeb71e79889
SSDeep	1536:ykSz63rNwUwgfBP6CuEaz1ij/Tv8tCrcDMS9kOUXSRodXWA0OT/MMG05Y+M:yOrnwgZPaEyiTT8tCrx1mADy+M
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\t648 Z2T0mST-97jBqS\1Usub D99LlYwn35U.doc.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\t648 Z2T0mST-97jBqS\1Usub D99LlYwn35U.doc (Modified File)
Mime Type	application/octet-stream
File Size	68.37 KB
MD5	e5ea9086882c58a9c565766d0d22c999
SHA1	cea06ba2e1c0b47bf6ea390ecc50daeaa6c67f58
SHA256	e6d618d097e121d69551d9100041a4264cff18facbfb1d7d7e20919af535ae27
SSDeep	1536:KCMmm7DYUjoEzYX1XRh6ytjFyH66rlTnNsIbGVn1HW7kEz7i:Kbm+CEMXPh6UjFyXlDN3Kq7kEz7i
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\t648 Z2T0mST-97jBqS\5tUVR.doc.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\t648 Z2T0mST-97jBqS\5tUVR.doc (Modified File)
Mime Type	application/octet-stream
File Size	22.97 KB
MD5	d90ccf5e371dfa1ba85b9d7cc59f9173
SHA1	69085195ffe38c58eb6e7ada198569217d7e17df
SHA256	77d8c94c24f4da1e7206fabe231ece850dee4ac6d2642bf064965618accaaded
SSDeep	384:zCOyxYzMcMLrkW0ZwkF4DjqOkrlqf3djB0px6ExUs3U09VgRqinHGNcJ6+Zb3yel:zCOyxYgcMMVZw7jj+l+3DI0ENUsVi2ch
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\t648 Z2T0mST-97jBqS\aYykKL9sNmuS205lNQxb.xlsx.remk

Dropped File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\t648 Z2T0mST-97jBqS\aYykKL9sNmuS205lNQxb.xlsx (Modified File)
Mime Type	application/zip
File Size	12.43 KB
MD5	d7754513600e58659f696fca6b84a2ec
SHA1	ea50d0aad3c115039ea2ca62bd422333ac8cb082
SHA256	cbfb186c8e5d9997a7f2bf860878205ce744b220741e8c33f70286272de90119
SSDeep	384:oVlzbdMciPY1v7ekvT95XxxBUSk62HNhCFp+GL6O:ExPyY1vCk79tBUfhtk+oV
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\t648 Z2T0mST-97jBqS\GHrUuVSNZ.ods

Modified File

ZIP

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\t648 Z2T0mST-97jBqS\GHrUuVSNZ.ods.remk (Dropped File)
Mime Type	application/zip
File Size	33.73 KB
MD5	e3c9b081aec837f8d132f59ca6ab4455
SHA1	927e15c21425cc2277f820081912709dd2d1991e
SHA256	041104bbdf953a416f7c1c64014cd3f02d1aa453a279de715ac9d78ead9f47ab
SSDeep	768:/e1/TCQNKU/8aTEEnZ6/N24wNrLRp+v1baX6KpRh0:/iEUUaTzn604KRp+NbM6Kb+
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\t648 Z2T0mST-97jBqS\i2qLmECFmP.xls

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\t648 Z2T0mST-97jBqS\i2qLmECFmP.xls.remk (Dropped File)
Mime Type	application/octet-stream
File Size	90.51 KB
MD5	7d3517eec62682fc51e80de9f1fca432
SHA1	e727330d06ce23e490f86a7873657480ba3c5641
SHA256	e8216d2efdf50984fbf5826242d1d65e2e9982f10a896208adf926c4bdae301e
SSDeep	1536:L3hnekCyvwzvqLwjhojkDtir9bJFEwCM2ckfTtarwzsXuK6b8mFYVWIIVZw3gS06:DpekCyvw57cz+wKXTcrwzd8mIWF8u6
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\t648 Z2T0mST-97jBqS\RVx8gh-an-F-.pdf.remk

Dropped File

PDF

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X0h6NwRPaRX5m\eBkpfXutqqrq6h\t648 Z2T0mST-97jBqS\RVx8gh-an-F-.pdf (Modified File)
Mime Type	application/pdf
File Size	13.49 KB
MD5	6c33a3c72a3bfb1d46e382767ea3b449
SHA1	b2873a806c25f08307e511a1e2b6a591c5a1dc76
SHA256	80ee9596969f92e31afd387a81ce40f75fcee154e92b293f84d59a0254d305f8
SSDeep	192:dHt3A5Q7V9Fb7qIftfnT2wYmOyE4sb7KPqUsE1lRfbnvU6OAh35bbGMYUJb:dHZA5cXnSZp1bWPqUFlRrv6Ap1bQs
ImpHash	-

YARA Matches (4)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match
PDF_Invalid_version	Invalid version in PDF magic bytes; possible obfuscation	-	4/5	... YARA Actions Show Ruleset Show Match
PDF_Missing_startxref	Malformed PDF without startxref; possible obfuscation	-	3/5	... YARA Actions Show Ruleset Show Match
PDF_Missing_EOF	Malformed PDF without EOF marker; possible obfuscation	-	3/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\2kWa8l\8PkInFTYY.gif

Modified File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\2kWa8l\8PkInFTYY.gif.remk (Dropped File)
Mime Type	image/gif
File Size	60.94 KB
MD5	98af9033e2ec605fac1a48ac6a575a3d
SHA1	6f9839cea6a0f8224a5c20474439287aa2c4be83
SHA256	748134c21d741cde6de4e1465fd6278afc60c8a3d98846d9ad1520e6ab153097
SSDeep	1536:KHmXmqoa6VGfbmIKAtXJ6A4h8iR4iD/YNVNgvE2vkUwY:KGXmLVGfCIKYcA46iR4izUNhTY
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\2kWa8l\b1oXySBs7FK.jpg

Modified File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\2kWa8l\b1oXySBs7FK.jpg.remk (Dropped File)
Mime Type	image/jpeg
File Size	75.21 KB
MD5	ec91fb97168005c672fcc5d83d39faf3
SHA1	188de2f294ab3297fddd505b485a1c9914be0004
SHA256	57de47cfb122cee0a24b4d6c08cfd7ca97a792d167f31c7366bd5ffdf05354af
SSDeep	1536:QaosRpxTB/sj6EYwdkcrc9/1JFujXPB6xX07QudulyCjmANscH:QatpjkOiXWtPxkEQlANscH
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\2kWa8l\NfB4BN1dcg.bmp.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\2kWa8l\NfB4BN1dcg.bmp (Modified File)
Mime Type	application/octet-stream
File Size	50.72 KB
MD5	1fcf472c3923835800493cfe486af383
SHA1	d2f93c0e0d2993a91432193792c95ca894a7a7f1
SHA256	2c7cd69370ea93c59154ca150eeb6a6b07346eee8a00625e037035e58202516b
SSDeep	768:K1FbsKMuAdW+b7VBNw5kCPdSCvCucvLkCUqPvXiuXNge4cOo5sFZ7ll6rJuO:Asc8fVBNMkCPcCKuc/jXiYWeHp2T7er1
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\2kWa8l\UzP92EkXV9tzwch.png.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\2kWa8l\UzP92EkXV9tzwch.png (Modified File)
Mime Type	application/octet-stream
File Size	77.01 KB
MD5	b9c4331a9629ff43ee0eb5f6d39031ef
SHA1	1dd3f64e76a19d62293915d9d546502d7d212358
SHA256	1598c6939649d678efcb5a595438313bbd70451b7658af3802c2e443e1cc663a
SSDeep	1536:EoMcF8exhpdlZ3ChfCMsmYZNzRW/WgJNfsAF0m/f1NUgO/DsZg48+YlwsQk0ScfF:LMO3MqMsn3KWgJNfVFLVNs72x85eHSct
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\2kWa8l\WJGbtDRaJ_I.gif

Modified File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\2kWa8l\WJGbtDRaJ_I.gif.remk (Dropped File)
Mime Type	image/gif
File Size	15.74 KB
MD5	affa857237b2ce51ed08247fbd1be88a
SHA1	93ba1f1def5db5f3f371fe0340f5041332fb62d2
SHA256	a7c8ef0975fe7337cb5aaa4d92d2eb5e9276a5db778859391510cf9a0b3ebfaf
SSDeep	384:7Mi8ikGNP1rTIdSsrOp+6Lqw5yPPO2ldIOsvoE8I7XjuZe:ghG51XIdreLLqmcTXeoHO1
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\2kWa8l\wUkuHtHCChC.png

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\2kWa8l\wUkuHtHCChC.png.remk (Dropped File)
Mime Type	application/octet-stream
File Size	39.05 KB
MD5	607c7c8e58d936d3707c02f4e055ea9a
SHA1	cca1cc77fb1daa9691f34b940c693e5f889b89a8
SHA256	a66ca1e7ed0cd9eb5db136665c01c4a0ce1cd9a963bd8d9cff987c4c57cac576
SSDeep	768:QSCdhUP+p2ryyFhafgRjRzCJSz16TdNMJ6OYKkb7ZE:OPqc22yhaw148SdWJ6ObkS
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\2kWa8l\Y3yQ_2 wT.gif.remk

Dropped File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\2kWa8l\Y3yQ_2 wT.gif (Modified File)
Mime Type	image/gif
File Size	84.46 KB
MD5	07c2b8caa7db8cade8709332d4bffbcb
SHA1	8b83deed6f3bb102a62ce52b608ccacbf4998c02
SHA256	3cb9beb3f7ff48bfd416b7b72029218ef743c8cc967c34c34ce7336aa20b90e8
SSDeep	1536:4Nnx2rdhuQ4GfXhtlqax8X6NITTbQW5gPODEDap5WWjcKkB+ZwcHlgD:4Nx2rdhuQ55xM6N5WwDOYfKkBe7HlgD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\FzGfdyB6\1Zf e6GVWkTdL6S3dtG.jpg.remk

Dropped File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\FzGfdyB6\1Zf e6GVWkTdL6S3dtG.jpg (Modified File)
Mime Type	image/jpeg
File Size	76.02 KB
MD5	88f772ea00a73876254fcf52f4ec06f5
SHA1	1fa04fe190be48e4c8a22353db5ba21361bcb8b2
SHA256	fb2fedf650b052cac6b4a63f8c608d6189d985392c319d73b9003b5affa0611d
SSDeep	1536:eI1B7enm39URWwCTlL5tO5pHXStQWw3CcSQ8KSft/EnABCPCAED55:PintZHCtZw33/8KzKGCr55
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\FzGfdyB6\5aUm.png

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\FzGfdyB6\5aUm.png.remk (Dropped File)
Mime Type	application/octet-stream
File Size	77.27 KB
MD5	4ca015e304f31c96b9b90d9a3c63ab8d
SHA1	687adb31dacf3acf322558b65359483f5cb89394
SHA256	360bec7d71f7e3f419ce4bfaddee17f7fd14e025fdbb3881e55a069355373a3a
SSDeep	1536:w6kqJz1TBqJufLsvC8uopNKJESFgusNGnmRdUrp2K6v3eE53U:w6kqJfIuNRJE8ZNnmPYT6mEq
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\FzGfdyB6\eoDi5iM0Omq.jpg

Modified File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\FzGfdyB6\eoDi5iM0Omq.jpg.remk (Dropped File)
Mime Type	image/jpeg
File Size	21.22 KB
MD5	c8374849957172d861d697bcc336903d
SHA1	f3eabfb0e3baefabef0d7e669954d6af30d5ecd9
SHA256	aa615b9f7d2ba1579fc2a4cfef1a1d6a77d04314e2cc6fce1add6d58f6db68c3
SSDeep	384:jWSPty6f+G4EFIVuCZ2+28ItpHuOG/CAM/imTZ9KLpKeZQjw2BWVmkZcFPqM1fW1:jWSPtB2VuCZ29XuOG/CAMfN9KRQ9B4pZ
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\FzGfdyB6\EOkvXHoEt.gif.remk

Dropped File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\FzGfdyB6\EOkvXHoEt.gif (Modified File)
Mime Type	image/gif
File Size	36.14 KB
MD5	5e58bbd1a382341002c369759bbf4c5f
SHA1	1eb5418c1255aa780cf76174177f73229679bac9
SHA256	c548d3cbd2d7c0f06fac958e004110705f38e693db9a2fbbf5d945ddb0eadea4
SSDeep	768:RmNJsh9b0WjKsbZ58ny5bUJVGeTBPczTsCxqcDU8pFtLthngzd3Mhy7:RXX1jhbZ+SIFc/+CU2FngzdWc
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\FzGfdyB6\GNzXqDyxgLyC07.bmp

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\FzGfdyB6\GNzXqDyxgLyC07.bmp.remk (Dropped File)
Mime Type	application/octet-stream
File Size	44.72 KB
MD5	926dc8583b7b082d685b4fd678e6c8fc
SHA1	b03dc648f926a3a7368365988d623bf288e0a1df
SHA256	a81af84cc90820a1f7381d5dcdc3c7d8597f74037d253ed67e0af5b6ff070cdc
SSDeep	768:DHxWnxOR+PSq+9uO9sHJViz/Ibm9R0eOzqyJ6l7Wx6OnQNiV5/XNQonxEuL+nwvt:Lcnx9SKtJVMim9rK76JWxxQQlxnAnwug
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\FzGfdyB6\ogT6-r28SnPPl.jpg

Modified File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\FzGfdyB6\ogT6-r28SnPPl.jpg.remk (Dropped File)
Mime Type	image/jpeg
File Size	89.25 KB
MD5	35c5a435024e2a003466e1bffe0bf46c
SHA1	d28055c95d2233efb2f04409308b1dd2a4177a9f
SHA256	e8967cd08f9f162ba26bd887b6e2c561728099860b81bcc832379af910837172
SSDeep	1536:qVfB5UwKMYgeWTURlM9gJT1ycoeXOZyzgWR8cxx17fzcag2Y0evozN8:mfBn4l/o+OQzgWRzxH726KozN8
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\FzGfdyB6\UxHea_1OLD4fGeysQVZ.png.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\FzGfdyB6\UxHea_1OLD4fGeysQVZ.png (Modified File)
Mime Type	application/octet-stream
File Size	80.83 KB
MD5	116e2775f823e4e0fd4f756cbc012605
SHA1	e37361336af47fe3f27271c367dd5659641f474e
SHA256	d654e607edc813b97e9691df939e2b868e5a6767075de991bbc1d5536d63ff6e
SSDeep	1536:wSkfQdMzZn0RxP4e5zBaayQTPUs/tppzJFdCqx6elVKLRQM9vdZD/DlalKxvK:wSzdMx0Rx1YaVZdrcasvLnclKxC
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\MJpyx6aDoSvpIH\94ufH0b5CBCbVk2g4.bmp.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\MJpyx6aDoSvpIH\94ufH0b5CBCbVk2g4.bmp (Modified File)
Mime Type	application/octet-stream
File Size	51.13 KB
MD5	92e28a38e97ed65a41d85ab9737ce44c
SHA1	b25926c8991cd8940c60e6645922da16625ba83b
SHA256	259555b2cd5dcbafdc2f8fedbc94cc3fd1d03ff54c5224c3ee9cee9a83270872
SSDeep	1536:smQ2ux7zk2ibgW1UGnxbAVaAIo56X3K9pIqRizsi:smXqJ2U4uTIbHKbizsi
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\MJpyx6aDoSvpIH\ayZ1BTswz7VJrGpFc2.gif

Modified File

Image

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\MJpyx6aDoSvpIH\ayZ1BTswz7VJrGpFc2.gif.remk (Dropped File)
Mime Type	image/gif
File Size	59.51 KB
MD5	efdff060cc1242250af3945e56a62515
SHA1	136b2c3b2cdeb1e9d2756927a37d6e5ce56a36fd
SHA256	140789cf839722fd28ecd9b17d4bab08b6ae81aff5aa7c320b16c5c747c953a5
SSDeep	768:vLAA5Nio6DmWS0aXfZpDrd/aHZQUe0L9qKQ1tVzm3w830FYorJ2hUpDHowd:vLAcrW7gPnF0QUngKKqaIUtBd
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\MJpyx6aDoSvpIH\cO_.png.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\MJpyx6aDoSvpIH\cO_.png (Modified File)
Mime Type	application/octet-stream
File Size	87.39 KB
MD5	775f43f74829707ac032c937deaa6836
SHA1	1866c817ffccebcbd26389c0922fe0abfcd8963f
SHA256	90231919b015fccd5046e7eefd89e66def9fa15027175b65a48c0930966a6d4b
SSDeep	1536:so9d766vFYY2tHYRyxpDrUWB+exTlW79YlPjP8Zm1CiDT69tOD5u//FfZFcEknGD:36aYYg4qpDIszxoYBD8Zm1AODgHzFsUz
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\MJpyx6aDoSvpIH\ku5zMZBRK.png

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\MJpyx6aDoSvpIH\ku5zMZBRK.png.remk (Dropped File)
Mime Type	application/octet-stream
File Size	53.07 KB
MD5	a7f9dda0b091ce868644fca3c37fced1
SHA1	2ae2fec44a113824170e6b61f4fa9abdb16ee4c4
SHA256	ca0f69d8327c2f38ee6e93661b4e0fb3bcd51d80a5d2b80899dc92301f8a3dac
SSDeep	1536:pLCRIrQ9PLWZsy0/w7USkto3bAX6ELqyHPsfJztd:p/ry6ZRBD7bvqYJ7
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\MJpyx6aDoSvpIH\M3CaFNSYagYb6MmIK-.bmp.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\MJpyx6aDoSvpIH\M3CaFNSYagYb6MmIK-.bmp (Modified File)
Mime Type	application/octet-stream
File Size	80.81 KB
MD5	170a3a7f48c0862c0c8909b819916a5e
SHA1	1676a204fe39b85b6187c64b1a11d9653cd2f2e5
SHA256	09585c07c6fb8e015e137a33d7e434b664fcc9205ec93e189d9b49cdc963ff6d
SSDeep	1536:Yy1Cyz89nfZdS1lWNx7ykROY0OYN92cqLLR1VwZ+jInv5ZvT/SseITT4:Hto9nxdKlgx7y40OYN92HLR1KBZrS+H4
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\MJpyx6aDoSvpIH\PSEVjAP5aE JA4lRFb.png.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\MJpyx6aDoSvpIH\PSEVjAP5aE JA4lRFb.png (Modified File)
Mime Type	application/octet-stream
File Size	89.36 KB
MD5	4cc62a54e5f3fc72d28d4eda80dc2231
SHA1	f07e6008a113005dca8585833129acf62ffadbd4
SHA256	94dddaa7189344e4176324b2310a8e42a60e0f6164e0b82b575d0d85966325dc
SSDeep	1536:8ozHIhsaBpKnFChcSp+mDjgfICxxulSmERm0dm1yC3dd8aD9WOss9fdyopW3bs1F:ASWwn8hRQHLzt1mf3dd8a5WhWB5qC7
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\MJpyx6aDoSvpIH\rtW3JtBFakvqy.png.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_dqq7i08G7zkmy4eWB\4HUb e9qKHwuKHz-\MJpyx6aDoSvpIH\rtW3JtBFakvqy.png (Modified File)
Mime Type	application/octet-stream
File Size	20.21 KB
MD5	a09f94d232477a4975839616007bcf4e
SHA1	fcdd2128c02b37eafa44486ed035c35c488ba7ee
SHA256	eeef8924cb48560d4c1a21490aec2880106cbf45148ef8334db891afed40d142
SSDeep	384:M4bV5bRoGEoJe7RhnzUpiA1Fp6IZyQtchKA9bKVsKAzb+ux7/1GlYR9R0erKitPn:Mi3sh6p6I6Ktsb7/1AYR9R0er7
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\dg1ZR5LE5.mkv

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\dg1ZR5LE5.mkv.remk (Dropped File)
Mime Type	application/octet-stream
File Size	55.32 KB
MD5	a13c25a817373ecb084621589349f152
SHA1	78f593444921f07dff6a8ea235e8f8f061a2f4f2
SHA256	2684d5183a91a632309941da0cac7d57d804df243c5767c571d7038faf6aa637
SSDeep	1536:gYmlKyLssNie9PY0tQxxmQZQvjd07Sa6+ODTj:ReLNkGmxvQpISMODTj
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\GodaZbgKBQyE.flv.remk

Dropped File

Video

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\GodaZbgKBQyE.flv (Modified File)
Mime Type	video/x-flv
File Size	43.09 KB
MD5	d2b7ba677f2c0d9e65bdd3a93b5c2ea1
SHA1	f5299465eda74071e19b88263a763854fae136eb
SHA256	7a047bdbdb6bc58a61804d1243bf8e7347999295aa5d44b18621b27faa72e627
SSDeep	768:dz+BA4IRXxvGPMjrXYZIdpEmP9mzc7LJJi838bXJYqY831eAN2EvydR:dz+BPPMjzbdDAzetsMmXJxY83wNjR
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\LJecWOah9kPE.mp4

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\LJecWOah9kPE.mp4.remk (Dropped File)
Mime Type	application/octet-stream
File Size	26.87 KB
MD5	9b85cd684766ae2787777be76b246a18
SHA1	3bf3b8e5bfe92c276741b1723199e50f7c1bba2f
SHA256	1b51602d3465ba1a8f718c14bddb4a8a6ade53b9803b46bb037c56a67fd31e5a
SSDeep	384:CGwaBqL5XM1VrAiDQu1Y/91DQkNHnPQps55LDYQ9vg1/TGlZmgYEYzNO8Ecc+tqt:CGaK1VrA8QKAQps55L/gZClkg9YhYD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\Xq9EY6lNcW89ESh\WuazV8l9ZPKR2hR.flv.remk

Dropped File

Video

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\Xq9EY6lNcW89ESh\WuazV8l9ZPKR2hR.flv (Modified File)
Mime Type	video/x-flv
File Size	84.88 KB
MD5	dda49875c3c41030df6e4371930ff559
SHA1	d5e0835da966aa03af30abe5e4957ca93eebbf05
SHA256	4336dd0246e895a9505931038a7171f2cc04a097e5944aa0de596aaba49a11c2
SSDeep	1536:BTyU4j7vBwui2UA4/Wxizw7Jnp52RCZH20m3Ns4wniyrmXCZU3BczhmVPO+I:B2njGuwAacxoCZHnm3NsWySCySwVG+I
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\ZCC-nq6c5y\4vcFIzQn6R7Uez.mp4.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\ZCC-nq6c5y\4vcFIzQn6R7Uez.mp4 (Modified File)
Mime Type	application/octet-stream
File Size	24.50 KB
MD5	a95fc9a5e27fc53a349602aedc24bfc3
SHA1	9c331a0f5f813e32169db9461105909381333cda
SHA256	c0f8433a7e7a315f2e70e23ca771cdd32cfa9298bde33cad2897ae8cc6202aa2
SSDeep	768:96O3GJzZt1EO/EyYr7M+6lr9xVL05SxLQcRYVRk:96O3yzqO/3Yr7UxZYS2U
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\ZCC-nq6c5y\9L8GIzDkh2buC.mp4.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\ZCC-nq6c5y\9L8GIzDkh2buC.mp4 (Modified File)
Mime Type	application/octet-stream
File Size	65.13 KB
MD5	5001c59b8e790d76dba020c5b2259f64
SHA1	334bdf6f68a807fb14b9cf519b3ef309acf8f1ea
SHA256	bc9a997f57596077bd74222ca2e7a39cac712d1780028bebcd50a3d3675a63a3
SSDeep	1536:cvnZz0e+RokVaCugxtxuscDx7Lupq5vR8XXR5dyvOa:chz0Xmd7LupkvR8XXtCOa
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\ZCC-nq6c5y\cd1puEdABr.mp4.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\ZCC-nq6c5y\cd1puEdABr.mp4 (Modified File)
Mime Type	application/octet-stream
File Size	37.89 KB
MD5	9f9231e483ca69682cf64360577ea701
SHA1	cb1716e1fb809e0e093af323212d9246b234c5f5
SHA256	5ce175ae24c12dcd50b5f006d48e589b29433b73f861959a328ce1194b6ea58d
SSDeep	768:ZVKxQKV2p3QFbaxtXP5eGyAXUyKdhODAMHhQsLF3dFPYIJr5sEifZ1KMm:ZeQkMgFbulPmAqOZWsBNJxliWB
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\_2KhhEZ4Uf5pHRY\2yWm8WTEQIQtOzFejH.avi.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\_2KhhEZ4Uf5pHRY\2yWm8WTEQIQtOzFejH.avi (Modified File)
Mime Type	application/octet-stream
File Size	42.39 KB
MD5	9563146f2a0349bc1117bf8ca5dbfc2d
SHA1	a7217abb93a41060c905709ec1229fa20175969e
SHA256	21bad661906d941cbfc8036d2f99ee223bc366f9cd596fbedbeedc079e4d2aa0
SSDeep	768:ERldfWECVEU+BVlm4ZlXjzoF+4+nE5WjRegGCTJJ463VA2OyriTahZZZG39EN19X:ERlduNEbBVlm4rXjOcsEAZA3VrOyriT0
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\_2KhhEZ4Uf5pHRY\nXQHuyqoJra2B.avi

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\_2KhhEZ4Uf5pHRY\nXQHuyqoJra2B.avi.remk (Dropped File)
Mime Type	application/octet-stream
File Size	47.07 KB
MD5	7327fc3c1409467dc537b64933043f2e
SHA1	8f4e93c1ea26eb67aa4732096911724d6b97aee3
SHA256	b1fc7e7f2463583642eebf8ab0462b060c94e152d661c2334153c5e5594184b9
SSDeep	768:CAupezccKSJD7EBGZfReRJju5bUG6Ctl0UL0aZzVj2HKF8MLTSGHGTEYmOL2t2Pa:DDDJD7BRUjSh6CbPLjLjdF8MLTHYmOZS
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\_2KhhEZ4Uf5pHRY\sSO7KsP.avi

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\_2KhhEZ4Uf5pHRY\sSO7KsP.avi.remk (Dropped File)
Mime Type	application/octet-stream
File Size	43.53 KB
MD5	c65707f3fe14f2c9c950af7471ce7552
SHA1	c2837f67e7627b74f97031265c35549fc8629583
SHA256	81e348f7168213024a1f6407f0870238a296cc47adc95904aa5878736d779af8
SSDeep	768:xgMPwz0d0T150dJbEkUO/p8zs0G+cJB7gnKGds2mnohL4i0PBxQ:nq0ST150d1Ek5p8z5fcJB7gVy2mG9qa
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip (Modified File)
Mime Type	application/octet-stream
File Size	41.83 KB
MD5	677f08409f79702b2fd17a243cded101
SHA1	6c4683a6636544fb30b57e04465d751d396f8e8b
SHA256	404d8c55f25deb5998a63e9a7be8920a3d9903fd17cfdd44bd9eb08e469d21a1
SSDeep	768:KuZYyBaaIzeL4OaYE8nQ+jQhGMjU9exiZDrMkalCquZpYnHNOJ1UzGCRKAcnVC7+:Ku2yQa+eL4OaYEH+Mhrjw/DrMkasPYHw
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat.remk (Dropped File)
Mime Type	application/octet-stream
File Size	32.33 KB
MD5	c89f02e095b37a541d3b84e58fbad28b
SHA1	6fafab9f9cda3d5baef91b2cac7813372766abe1
SHA256	50fc6138fddeb3c8c41e8087b6cf6560849fee7631e24e2a9488e30ced3e8165
SSDeep	768:lOBhtD1kMkRH6C2nbEdVrwUItV+vldJMjdfXlYcRvWG/1CNCDnIvp4f:mnkt6CGbEdVrjI8vBG9HQq
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab

Modified File

CAB

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab.remk (Dropped File)
Mime Type	application/vnd.ms-cab-compressed
File Size	568.42 KB
MD5	b0b1bc8f85e89575808651749fbccae5
SHA1	92a5866b54da9ff8e3b6a8a7141d97b568d08255
SHA256	d36d0bbf0802fa46aa6f96a09719daaee9a25a818e5eaa25bfd9ab3f631bd2c2
SSDeep	12288:C/4koqhmjIyQCgY4hyMPezVNK9TcS5RyjDUI6Eh/MOhT1:szmEyfRMPgyTx6jDUbE2Ix
ImpHash	-
Error Remark	Could not parse sample file: Not a supported archive format

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi.remk (Dropped File)
Mime Type	application/octet-stream
File Size	181.33 KB
MD5	dab4e5b3a372b8304349f1210bf9cc45
SHA1	6e881477e2543d532f21d76c86371b9d00bcdcc8
SHA256	6a5fb62267ed9beb8d687c18fe62964eb079f4088915ba706d25994efa726a62
SSDeep	3072:hAbPMQfTZSQDEmf55XhDtG+Q10PqI6tlMN8DiGq2Uli64qG6:hQ0CYQoILX1MtlMSDOx436
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties (Modified File)
Mime Type	application/octet-stream
File Size	1.03 KB
MD5	0aac03d9455636d909748d8d2b790892
SHA1	971526ef0c175a4f59a1bd5406edae418dd6e457
SHA256	e438ee63304b9b91e471a24c47a5dd6745e708e2b5a2a6a5c3dec96b58dafa76
SSDeep	24:y4zj61g6zjXUIk1sqDYqnfpiwaN4/zADI7TrLGbD:yye53XUIAsVqgwmSzjsD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi.remk (Dropped File)
Mime Type	application/octet-stream
File Size	885.83 KB
MD5	28d945ac134edffdd95881c74aa94914
SHA1	00360f5c372a99cafd32ad937122db4728ab4685
SHA256	03226de5a7b86c52d599adb2712a87e39944f87cbb36cb4feaa98eb1fff7fa35
SSDeep	6144:N2kuu5D2F1AM3cCGGj2QELvMYI2q3ksedyPs3ETGpyIQEkmt3PNXMRiWR2:NQQDINxGnikseAPsJpfjt3PE0
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\dcR8Wn\MMNB3DGmP9H.flv

Modified File

Video

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\dcR8Wn\MMNB3DGmP9H.flv.remk (Dropped File)
Mime Type	video/x-flv
File Size	61.26 KB
MD5	3bd05c9eed08e6bb8541eafc55908b46
SHA1	53866372aabaf292eff5428570c0e176aeda6faa
SHA256	745180d6442174a2daab702a3c2ea01dc186f8f3d584c0498a5dd6b35d119056
SSDeep	768:Gi84B/Qn8QMLhdmARv1Wkd0xaume/2mne77kZgtZc/nSjqG5ZMnoB+lZMBxQKaHd:GiTQIbpd6ayvK7kitZkHeqZ6xQVYF1xY
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\dcR8Wn\WGem6pJWFmMLh_CSjVJ.swf

Modified File

Shockwave Flash

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\dcR8Wn\WGem6pJWFmMLh_CSjVJ.swf.remk (Dropped File)
Mime Type	application/x-shockwave-flash
File Size	66.67 KB
MD5	3482ef60e90d22cf0beb476eefef6803
SHA1	71841e260a28b3241b514e1d67bf70db2d10e857
SHA256	53fb111d4860b34bdc24ecb7a5e545911355a6c8a1434b3e37c62cfa5fb3cecf
SSDeep	1536:KHYcTsPoKiqylRYOf65fKMQiceyZm/6QQ4Cf5S+UjO/k7JmNfLghfdvOiJUznl:IVgPoKLuO5fWiceOlRHUpNWj8fdmQSnl
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\dcR8Wn\XoMJ508kaZydeC8l.flv.remk

Dropped File

Video

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\dcR8Wn\XoMJ508kaZydeC8l.flv (Modified File)
Mime Type	video/x-flv
File Size	83.42 KB
MD5	66209f5b2e42eb0b458f37b991bdf415
SHA1	baec7ea081d2d436f2dc06ad09bb5c746f0ee9f8
SHA256	f94cbb3b9e76ca1ca89529f37e7fececb6d4394c0c14f97d0eeaad03e9e1e543
SSDeep	1536:Tnza2tZqTZIKxO6ihBUJ1pOyuK6FH2EfcfFt8VKXgB5n8l7+40SIcHv/6DJ6:Tza2twTZIKxO6ihBQOygnkdtqKXgwIn6
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\TNlwUISWdF VQwLUr\35fwF Y81hH3FH.mkv

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\TNlwUISWdF VQwLUr\35fwF Y81hH3FH.mkv.remk (Dropped File)
Mime Type	application/octet-stream
File Size	8.57 KB
MD5	cd8a7549ac7645d54627ed8e1a951bca
SHA1	f2a3709e86c827a52a64d41a680ac2d0fa9c57e1
SHA256	474afc557c91f90399064e6efc05160e1145c2ef58536c61cfe410398e48f202
SSDeep	192:OVMJXSnvRsJGUqualVAmFh/r6iMsccvZ0NF0J8rLK8Rgw:1XSnvRsAXlVdTj6iFccvZgw8rWBw
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\TNlwUISWdF VQwLUr\cnAJanV1kmNfWz8.swf.remk

Dropped File

Shockwave Flash

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\TNlwUISWdF VQwLUr\cnAJanV1kmNfWz8.swf (Modified File)
Mime Type	application/x-shockwave-flash
File Size	53.92 KB
MD5	8776cdb32d6b1bd349626d88ed83c597
SHA1	b8bd263635256a41e7e1303abdf201b39625a235
SHA256	3fe5b133199c7e4df34105356c9013697c6675fb92992fc3cc9075f87d8e70ac
SSDeep	768:T52cTRjeL/hXYLAMaaUaX+90LO3wqeLUsjvoAKzhNY2XpogRWWgMOaCmOKn3:8cTRjeL/hXdOUC+ylvoHhN1Xpog0XKn3
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\TNlwUISWdF VQwLUr\pEQk.flv

Modified File

Video

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\xB0W_x\TNlwUISWdF VQwLUr\pEQk.flv.remk (Dropped File)
Mime Type	video/x-flv
File Size	60.24 KB
MD5	0f82576a7253944f6fdc0b0ba1f85f33
SHA1	3fe05262ee1055a23c53b6b8701713f92db1de10
SHA256	aee37d6ebc417ca929c719e2ea05257bf9a6710e53ade5f91ac0a436ecbeefd8
SSDeep	1536:lOvGOVfXZKoxV5KTWaH9veX7hTOqqoLk4bZVQUHCg2w20:lyaQeyCveXVTIf2uUaF0
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\ZCC-nq6c5y\S Vy53\f8B4p09.swf.remk

Dropped File

Shockwave Flash

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\ZCC-nq6c5y\S Vy53\f8B4p09.swf (Modified File)
Mime Type	application/x-shockwave-flash
File Size	92.84 KB
MD5	341cbe89c66124845207cfc803e55774
SHA1	6695ea7ff9e2285ccc253e71c01ca0c7fdd7ffd8
SHA256	3b4c7a03192728be1bc4a14638d7f6a3942b36981e94ff76520cc9aae5541069
SSDeep	1536:40jYYc93Fjb4MlSYdUHdYnnsvimAEqB+4wuT3mriH0e7fGpnDYoj1Sr+6svE:Zkj3FbHlnxsviOuSriH0uGnUTh
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\ZCC-nq6c5y\S Vy53\iCzLPFif.flv.remk

Dropped File

Video

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\ZCC-nq6c5y\S Vy53\iCzLPFif.flv (Modified File)
Mime Type	video/x-flv
File Size	35.25 KB
MD5	918f2d8c1e2f6cbb3f8efe5787de4365
SHA1	a1a3426f8bccb904112df5ce4bd400e08a58a3b1
SHA256	6972a4c64d668c0107ba419cf442683b695d5fe8ebfec908c1ed7e0d8fa5ab15
SSDeep	768:r5jN3g35nf+IkFI+jMgoYhInyau9nNCMQLZbWSHQU8UALb/7l2ChTgsEAZ:xN3gYIX+QgoYKK0MQtbWSwH7H9
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\ZCC-nq6c5y\S Vy53\KqR1qrw6aoyjKfrEgvI.flv.remk

Dropped File

Video

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\ZCC-nq6c5y\S Vy53\KqR1qrw6aoyjKfrEgvI.flv (Modified File)
Mime Type	video/x-flv
File Size	9.49 KB
MD5	9d07f3572ba2996873b7209e8c082fef
SHA1	ead422f47039f1dfbe0663229a96abaceefbaa5e
SHA256	8e35992e2cb917486922d5016625feda307efb9c61a5aab54907eca443169e37
SSDeep	192:hIWLkIs/TEiQ9HxUC7OpmIhMSciNTyjJ3p7prIIRcjz8:jsLEoCqp7KSci8jZpNE8
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\ZCC-nq6c5y\S Vy53\YBiLRAZYH9yEkpgFaG.swf

Modified File

Shockwave Flash

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PCPKs0u\CSFg h-wcbKcac\ZCC-nq6c5y\S Vy53\YBiLRAZYH9yEkpgFaG.swf.remk (Dropped File)
Mime Type	application/x-shockwave-flash
File Size	83.56 KB
MD5	62776117ca2814ff5ea54cd06fbe7dee
SHA1	57db2e683ae8eccba7ab5a71568125dd7520dd17
SHA256	123ca8138e7583a2402762465d7565ff039075e156cf411be6814a124149c0f8
SSDeep	1536:A6K2VVaY7COs6G98bgeM3jJXQfBvxE8tGBFrlbbDBIsIh5DElT4oJFgwraBNefGe:429WjvSbHiXQfBvxdtGBFr58h5oqoJSC
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml (Modified File)
Mime Type	application/octet-stream
File Size	347 Bytes
MD5	9ae50a9f4219a214070c93459dadd367
SHA1	42a6aaefe3723d45ab0645786895be534ab0c145
SHA256	553c03a0aa2c55afa27aed7c524264f38c8a498609737e8841aa9c6e62e09c2b
SSDeep	6:3FbKhF0ysubMBaY6zsoDjwNwWSeaT/+Cq/01YKrmAazqSIUNLCcii96Z:1JysDBarzso3wFs+p/3AbSIuGcii9a
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\www.google[1].xml

Modified File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\www.google[1].xml.remk (Dropped File)
Mime Type	application/octet-stream
File Size	347 Bytes
MD5	b8d86a11f0cddf516d3e7c6977386ad5
SHA1	bf06047bb227f742707711dc1f167d08e5c3f8c2
SHA256	b9423fd8ae457cb69ad0c6d1b20c6656666e39114f23f6e8fffbe1b03e6cd480
SSDeep	6:8AbkMmIjOaeqBJGHalvdXgoUJRuvEJayqITeIUNLCcii96Z:8AYDyJoSwdTJafIuGcii9a
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml.remk

Dropped File

Stream

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml (Modified File)
Mime Type	application/octet-stream
File Size	1.14 KB
MD5	55c30ea13d0b7e2c84dd283d3f6e7c90
SHA1	4696f9c3a90ded067411e379f11003984b72792c
SHA256	7352f274e7ee6a9d09560ae1a719404efbfdc47758fb782b465a6d557cd1f101
SSDeep	24:qnqXLjWwJinXQm9Mxh96Mz/db84vSE7UzSLpTcFeF343qauk9IaLPThLGbD:qnqbjWwJcF9MJbdDN7UzSLpXVsSD
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
DjvuEncryptedFile	File encrypted by Djvu Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\1eed4f4c-ee3f-42d5-9fd1-74f531bda6b5\updatewin1.exe

Downloaded File

Binary

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\1eed4f4c-ee3f-42d5-9fd1-74f531bda6b5\updatewin1.exe (Downloaded File)
Mime Type	application/vnd.microsoft.portable-executable
File Size	272.50 KB
MD5	5b4bd24d6240f467bfbc74803c9f15b0
SHA1	c17f98c182d299845c54069872e8137645768a1a
SHA256	14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e
SSDeep	6144:7qZQGv0d4dW6efSyahstfKVkW5XXnXXfXXXWXXXXHXXXXBXXXXgXXXXX5XXXXiXk:2ZQGXdPe6qU6W5XXnXXfXXXWXXXXHXXE
ImpHash	0bcca924efe6e6fa741675d8e687fbb3

File Reputation Information

»

Severity	Blacklisted
Names	Mal/Generic-S

PE Information

»

Image Base	0x400000
Entry Point	0x402d76
Size Of Code	0x1c200
Size Of Initialized Data	0x2c200
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2017-07-24 12:23:54+00:00

Version Information (3)

»

FileVersion	7.7.7.18
InternalName	rawudiyeh.exe
LegalCopyright	Copyright (C) 2018, sacuwedimufoy

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x1c07e	0x1c200	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.62
.rdata	0x41e000	0x463e	0x4800	0x1c600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.26
.data	0x423000	0x1c6a8	0x17400	0x20e00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	5.83
.rsrc	0x440000	0xa578	0xa600	0x38200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	6.88
.reloc	0x44b000	0x1968	0x1a00	0x42800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.34

Imports (4)

»

KERNEL32.dll (102)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ExitThread	0x0	0x41e028	0x21afc	0x200fc	0x105
GetStartupInfoW	0x0	0x41e02c	0x21b00	0x20100	0x23a
GetLastError	0x0	0x41e030	0x21b04	0x20104	0x1e6
GetProcAddress	0x0	0x41e034	0x21b08	0x20108	0x220
CreateJobSet	0x0	0x41e038	0x21b0c	0x2010c	0x87
GlobalFree	0x0	0x41e03c	0x21b10	0x20110	0x28c
LoadLibraryA	0x0	0x41e040	0x21b14	0x20114	0x2f1
OpenWaitableTimerW	0x0	0x41e044	0x21b18	0x20118	0x339
AddAtomA	0x0	0x41e048	0x21b1c	0x2011c	0x3
FindFirstChangeNotificationA	0x0	0x41e04c	0x21b20	0x20120	0x11b
VirtualProtect	0x0	0x41e050	0x21b24	0x20124	0x45a
GetCurrentDirectoryA	0x0	0x41e054	0x21b28	0x20128	0x1a7
GetACP	0x0	0x41e058	0x21b2c	0x2012c	0x152
InterlockedPushEntrySList	0x0	0x41e05c	0x21b30	0x20130	0x2c2
CompareStringW	0x0	0x41e060	0x21b34	0x20134	0x55
CompareStringA	0x0	0x41e064	0x21b38	0x20138	0x52
CreateFileA	0x0	0x41e068	0x21b3c	0x2013c	0x78
GetTimeZoneInformation	0x0	0x41e06c	0x21b40	0x20140	0x26b
WriteConsoleW	0x0	0x41e070	0x21b44	0x20144	0x48c
GetConsoleOutputCP	0x0	0x41e074	0x21b48	0x20148	0x199
WriteConsoleA	0x0	0x41e078	0x21b4c	0x2014c	0x482
CloseHandle	0x0	0x41e07c	0x21b50	0x20150	0x43
IsValidLocale	0x0	0x41e080	0x21b54	0x20154	0x2dd
EnumSystemLocalesA	0x0	0x41e084	0x21b58	0x20158	0xf8
GetUserDefaultLCID	0x0	0x41e088	0x21b5c	0x2015c	0x26d
GetSystemTimeAdjustment	0x0	0x41e08c	0x21b60	0x20160	0x24e
GetSystemTimes	0x0	0x41e090	0x21b64	0x20164	0x250
GetTickCount	0x0	0x41e094	0x21b68	0x20168	0x266
FreeEnvironmentStringsA	0x0	0x41e098	0x21b6c	0x2016c	0x14a
GetComputerNameW	0x0	0x41e09c	0x21b70	0x20170	0x178
FindCloseChangeNotification	0x0	0x41e0a0	0x21b74	0x20174	0x11a
FindResourceExW	0x0	0x41e0a4	0x21b78	0x20178	0x138
GetCPInfo	0x0	0x41e0a8	0x21b7c	0x2017c	0x15b
SetProcessShutdownParameters	0x0	0x41e0ac	0x21b80	0x20180	0x3f9
GetModuleHandleExA	0x0	0x41e0b0	0x21b84	0x20184	0x1f7
GetDateFormatA	0x0	0x41e0b4	0x21b88	0x20188	0x1ae
GetTimeFormatA	0x0	0x41e0b8	0x21b8c	0x2018c	0x268
GetStringTypeW	0x0	0x41e0bc	0x21b90	0x20190	0x240
GetStringTypeA	0x0	0x41e0c0	0x21b94	0x20194	0x23d
LCMapStringW	0x0	0x41e0c4	0x21b98	0x20198	0x2e3
GetCommandLineA	0x0	0x41e0c8	0x21b9c	0x2019c	0x16f
GetStartupInfoA	0x0	0x41e0cc	0x21ba0	0x201a0	0x239
RaiseException	0x0	0x41e0d0	0x21ba4	0x201a4	0x35a
RtlUnwind	0x0	0x41e0d4	0x21ba8	0x201a8	0x392
TerminateProcess	0x0	0x41e0d8	0x21bac	0x201ac	0x42d
GetCurrentProcess	0x0	0x41e0dc	0x21bb0	0x201b0	0x1a9
UnhandledExceptionFilter	0x0	0x41e0e0	0x21bb4	0x201b4	0x43e
SetUnhandledExceptionFilter	0x0	0x41e0e4	0x21bb8	0x201b8	0x415
IsDebuggerPresent	0x0	0x41e0e8	0x21bbc	0x201bc	0x2d1
HeapAlloc	0x0	0x41e0ec	0x21bc0	0x201c0	0x29d
HeapFree	0x0	0x41e0f0	0x21bc4	0x201c4	0x2a1
EnterCriticalSection	0x0	0x41e0f4	0x21bc8	0x201c8	0xd9
LeaveCriticalSection	0x0	0x41e0f8	0x21bcc	0x201cc	0x2ef
SetHandleCount	0x0	0x41e0fc	0x21bd0	0x201d0	0x3e8
GetStdHandle	0x0	0x41e100	0x21bd4	0x201d4	0x23b
GetFileType	0x0	0x41e104	0x21bd8	0x201d8	0x1d7
DeleteCriticalSection	0x0	0x41e108	0x21bdc	0x201dc	0xbe
GetModuleHandleW	0x0	0x41e10c	0x21be0	0x201e0	0x1f9
Sleep	0x0	0x41e110	0x21be4	0x201e4	0x421
ExitProcess	0x0	0x41e114	0x21be8	0x201e8	0x104
WriteFile	0x0	0x41e118	0x21bec	0x201ec	0x48d
GetModuleFileNameA	0x0	0x41e11c	0x21bf0	0x201f0	0x1f4
GetEnvironmentStrings	0x0	0x41e120	0x21bf4	0x201f4	0x1bf
FreeEnvironmentStringsW	0x0	0x41e124	0x21bf8	0x201f8	0x14b
WideCharToMultiByte	0x0	0x41e128	0x21bfc	0x201fc	0x47a
GetEnvironmentStringsW	0x0	0x41e12c	0x21c00	0x20200	0x1c1
TlsGetValue	0x0	0x41e130	0x21c04	0x20204	0x434
TlsAlloc	0x0	0x41e134	0x21c08	0x20208	0x432
TlsSetValue	0x0	0x41e138	0x21c0c	0x2020c	0x435
TlsFree	0x0	0x41e13c	0x21c10	0x20210	0x433
InterlockedIncrement	0x0	0x41e140	0x21c14	0x20214	0x2c0
SetLastError	0x0	0x41e144	0x21c18	0x20218	0x3ec
GetCurrentThreadId	0x0	0x41e148	0x21c1c	0x2021c	0x1ad
InterlockedDecrement	0x0	0x41e14c	0x21c20	0x20220	0x2bc
GetCurrentThread	0x0	0x41e150	0x21c24	0x20224	0x1ac
HeapCreate	0x0	0x41e154	0x21c28	0x20228	0x29f
HeapDestroy	0x0	0x41e158	0x21c2c	0x2022c	0x2a0
VirtualFree	0x0	0x41e15c	0x21c30	0x20230	0x457
QueryPerformanceCounter	0x0	0x41e160	0x21c34	0x20234	0x354
GetCurrentProcessId	0x0	0x41e164	0x21c38	0x20238	0x1aa
GetSystemTimeAsFileTime	0x0	0x41e168	0x21c3c	0x2023c	0x24f
FatalAppExitA	0x0	0x41e16c	0x21c40	0x20240	0x10b
VirtualAlloc	0x0	0x41e170	0x21c44	0x20244	0x454
HeapReAlloc	0x0	0x41e174	0x21c48	0x20248	0x2a4
MultiByteToWideChar	0x0	0x41e178	0x21c4c	0x2024c	0x31a
ReadFile	0x0	0x41e17c	0x21c50	0x20250	0x368
InitializeCriticalSectionAndSpinCount	0x0	0x41e180	0x21c54	0x20254	0x2b5
HeapSize	0x0	0x41e184	0x21c58	0x20258	0x2a6
SetConsoleCtrlHandler	0x0	0x41e188	0x21c5c	0x2025c	0x3a7
FreeLibrary	0x0	0x41e18c	0x21c60	0x20260	0x14c
InterlockedExchange	0x0	0x41e190	0x21c64	0x20264	0x2bd
GetOEMCP	0x0	0x41e194	0x21c68	0x20268	0x213
IsValidCodePage	0x0	0x41e198	0x21c6c	0x2026c	0x2db
GetConsoleCP	0x0	0x41e19c	0x21c70	0x20270	0x183
GetConsoleMode	0x0	0x41e1a0	0x21c74	0x20274	0x195
FlushFileBuffers	0x0	0x41e1a4	0x21c78	0x20278	0x141
SetFilePointer	0x0	0x41e1a8	0x21c7c	0x2027c	0x3df
SetStdHandle	0x0	0x41e1ac	0x21c80	0x20280	0x3fc
GetLocaleInfoW	0x0	0x41e1b0	0x21c84	0x20284	0x1ea
GetLocaleInfoA	0x0	0x41e1b4	0x21c88	0x20288	0x1e8
LCMapStringA	0x0	0x41e1b8	0x21c8c	0x2028c	0x2e1
SetEnvironmentVariableA	0x0	0x41e1bc	0x21c90	0x20290	0x3d0

USER32.dll (10)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CloseClipboard	0x0	0x41e1d8	0x21cac	0x202ac	0x47
BeginPaint	0x0	0x41e1dc	0x21cb0	0x202b0	0xe
CallMsgFilterW	0x0	0x41e1e0	0x21cb4	0x202b4	0x1a
PeekMessageA	0x0	0x41e1e4	0x21cb8	0x202b8	0x21b
MapVirtualKeyExW	0x0	0x41e1e8	0x21cbc	0x202bc	0x1f1
RegisterRawInputDevices	0x0	0x41e1ec	0x21cc0	0x202c0	0x242
GetClipboardSequenceNumber	0x0	0x41e1f0	0x21cc4	0x202c4	0x113
CountClipboardFormats	0x0	0x41e1f4	0x21cc8	0x202c8	0x50
GetDialogBaseUnits	0x0	0x41e1f8	0x21ccc	0x202cc	0x11d
GetClassLongW	0x0	0x41e1fc	0x21cd0	0x202d0	0x109

GDI32.dll (9)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
PolyTextOutW	0x0	0x41e000	0x21ad4	0x200d4	0x23c
CreateCompatibleDC	0x0	0x41e004	0x21ad8	0x200d8	0x2e
Rectangle	0x0	0x41e008	0x21adc	0x200dc	0x246
SetStretchBltMode	0x0	0x41e00c	0x21ae0	0x200e0	0x289
SetPixelV	0x0	0x41e010	0x21ae4	0x200e4	0x284
GetClipBox	0x0	0x41e014	0x21ae8	0x200e8	0x1aa
CreateDiscardableBitmap	0x0	0x41e018	0x21aec	0x200ec	0x35
StrokeAndFillPath	0x0	0x41e01c	0x21af0	0x200f0	0x29c
GetBitmapBits	0x0	0x41e020	0x21af4	0x200f4	0x191

SHELL32.dll (4)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ShellExecuteW	0x0	0x41e1c4	0x21c98	0x20298	0x118
ShellAboutW	0x0	0x41e1c8	0x21c9c	0x2029c	0x110
DuplicateIcon	0x0	0x41e1cc	0x21ca0	0x202a0	0x23
DragQueryFileA	0x0	0x41e1d0	0x21ca4	0x202a4	0x1e

Icons (1)

»

Local AV Matches (1)

»

Threat Name	Severity
Trojan.GenericKD.31534187	Malicious

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\1eed4f4c-ee3f-42d5-9fd1-74f531bda6b5\updatewin2.exe

Downloaded File

Binary

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\updatewin2[1].exe (Downloaded File)
Mime Type	application/vnd.microsoft.portable-executable
File Size	274.50 KB
MD5	996ba35165bb62473d2a6743a5200d45
SHA1	52169b0b5cce95c6905873b8d12a759c234bd2e0
SHA256	5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d
SSDeep	6144:vLgbC0mVQlY+3aKn7n4CTHcXXnXXfXXXWXXXXHXXXXBXXXXgXXXXX5XXXXiXXXXP:vGCtQlb3aKzvT8XXnXXfXXXWXXXXHXXf
ImpHash	5921adaaf66f8c259aeda9e22686cd4b

File Reputation Information

»

Severity	Blacklisted

PE Information

»

Image Base	0x400000
Entry Point	0x402d64
Size Of Code	0x1c200
Size Of Initialized Data	0x2c800
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2017-11-21 06:08:45+00:00

Version Information (3)

»

FileVersion	5.3.7.82
InternalName	gigifaw.exe
LegalCopyright	Copyright (C) 2018, guvaxiz

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x1c03e	0x1c200	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.62
.rdata	0x41e000	0x45ec	0x4600	0x1c600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.34
.data	0x423000	0x1cde8	0x17c00	0x20c00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	5.8
.rsrc	0x440000	0xa724	0xa800	0x38800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	6.88
.reloc	0x44b000	0x195c	0x1a00	0x43000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.33

Imports (4)

»

KERNEL32.dll (98)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ExitThread	0x0	0x41e024	0x21ae8	0x200e8	0x105
GetStartupInfoW	0x0	0x41e028	0x21aec	0x200ec	0x23a
GetLastError	0x0	0x41e02c	0x21af0	0x200f0	0x1e6
GetProcAddress	0x0	0x41e030	0x21af4	0x200f4	0x220
GlobalFree	0x0	0x41e034	0x21af8	0x200f8	0x28c
LoadLibraryA	0x0	0x41e038	0x21afc	0x200fc	0x2f1
AddAtomA	0x0	0x41e03c	0x21b00	0x20100	0x3
FindFirstChangeNotificationA	0x0	0x41e040	0x21b04	0x20104	0x11b
VirtualProtect	0x0	0x41e044	0x21b08	0x20108	0x45a
GetCurrentDirectoryA	0x0	0x41e048	0x21b0c	0x2010c	0x1a7
SetProcessShutdownParameters	0x0	0x41e04c	0x21b10	0x20110	0x3f9
GetACP	0x0	0x41e050	0x21b14	0x20114	0x152
CompareStringA	0x0	0x41e054	0x21b18	0x20118	0x52
CreateFileA	0x0	0x41e058	0x21b1c	0x2011c	0x78
GetTimeZoneInformation	0x0	0x41e05c	0x21b20	0x20120	0x26b
WriteConsoleW	0x0	0x41e060	0x21b24	0x20124	0x48c
GetConsoleOutputCP	0x0	0x41e064	0x21b28	0x20128	0x199
WriteConsoleA	0x0	0x41e068	0x21b2c	0x2012c	0x482
CloseHandle	0x0	0x41e06c	0x21b30	0x20130	0x43
IsValidLocale	0x0	0x41e070	0x21b34	0x20134	0x2dd
EnumSystemLocalesA	0x0	0x41e074	0x21b38	0x20138	0xf8
GetUserDefaultLCID	0x0	0x41e078	0x21b3c	0x2013c	0x26d
GetDateFormatA	0x0	0x41e07c	0x21b40	0x20140	0x1ae
GetTimeFormatA	0x0	0x41e080	0x21b44	0x20144	0x268
InitAtomTable	0x0	0x41e084	0x21b48	0x20148	0x2ae
GetSystemTimes	0x0	0x41e088	0x21b4c	0x2014c	0x250
GetTickCount	0x0	0x41e08c	0x21b50	0x20150	0x266
FreeEnvironmentStringsA	0x0	0x41e090	0x21b54	0x20154	0x14a
GetComputerNameW	0x0	0x41e094	0x21b58	0x20158	0x178
FindCloseChangeNotification	0x0	0x41e098	0x21b5c	0x2015c	0x11a
FindResourceExW	0x0	0x41e09c	0x21b60	0x20160	0x138
CompareStringW	0x0	0x41e0a0	0x21b64	0x20164	0x55
GetCPInfo	0x0	0x41e0a4	0x21b68	0x20168	0x15b
GetStringTypeW	0x0	0x41e0a8	0x21b6c	0x2016c	0x240
GetStringTypeA	0x0	0x41e0ac	0x21b70	0x20170	0x23d
LCMapStringW	0x0	0x41e0b0	0x21b74	0x20174	0x2e3
LCMapStringA	0x0	0x41e0b4	0x21b78	0x20178	0x2e1
GetLocaleInfoA	0x0	0x41e0b8	0x21b7c	0x2017c	0x1e8
GetCommandLineA	0x0	0x41e0bc	0x21b80	0x20180	0x16f
GetStartupInfoA	0x0	0x41e0c0	0x21b84	0x20184	0x239
RaiseException	0x0	0x41e0c4	0x21b88	0x20188	0x35a
RtlUnwind	0x0	0x41e0c8	0x21b8c	0x2018c	0x392
TerminateProcess	0x0	0x41e0cc	0x21b90	0x20190	0x42d
GetCurrentProcess	0x0	0x41e0d0	0x21b94	0x20194	0x1a9
UnhandledExceptionFilter	0x0	0x41e0d4	0x21b98	0x20198	0x43e
SetUnhandledExceptionFilter	0x0	0x41e0d8	0x21b9c	0x2019c	0x415
IsDebuggerPresent	0x0	0x41e0dc	0x21ba0	0x201a0	0x2d1
HeapAlloc	0x0	0x41e0e0	0x21ba4	0x201a4	0x29d
HeapFree	0x0	0x41e0e4	0x21ba8	0x201a8	0x2a1
EnterCriticalSection	0x0	0x41e0e8	0x21bac	0x201ac	0xd9
LeaveCriticalSection	0x0	0x41e0ec	0x21bb0	0x201b0	0x2ef
SetHandleCount	0x0	0x41e0f0	0x21bb4	0x201b4	0x3e8
GetStdHandle	0x0	0x41e0f4	0x21bb8	0x201b8	0x23b
GetFileType	0x0	0x41e0f8	0x21bbc	0x201bc	0x1d7
DeleteCriticalSection	0x0	0x41e0fc	0x21bc0	0x201c0	0xbe
GetModuleHandleW	0x0	0x41e100	0x21bc4	0x201c4	0x1f9
Sleep	0x0	0x41e104	0x21bc8	0x201c8	0x421
ExitProcess	0x0	0x41e108	0x21bcc	0x201cc	0x104
WriteFile	0x0	0x41e10c	0x21bd0	0x201d0	0x48d
GetModuleFileNameA	0x0	0x41e110	0x21bd4	0x201d4	0x1f4
GetEnvironmentStrings	0x0	0x41e114	0x21bd8	0x201d8	0x1bf
FreeEnvironmentStringsW	0x0	0x41e118	0x21bdc	0x201dc	0x14b
WideCharToMultiByte	0x0	0x41e11c	0x21be0	0x201e0	0x47a
GetEnvironmentStringsW	0x0	0x41e120	0x21be4	0x201e4	0x1c1
TlsGetValue	0x0	0x41e124	0x21be8	0x201e8	0x434
TlsAlloc	0x0	0x41e128	0x21bec	0x201ec	0x432
TlsSetValue	0x0	0x41e12c	0x21bf0	0x201f0	0x435
TlsFree	0x0	0x41e130	0x21bf4	0x201f4	0x433
InterlockedIncrement	0x0	0x41e134	0x21bf8	0x201f8	0x2c0
SetLastError	0x0	0x41e138	0x21bfc	0x201fc	0x3ec
GetCurrentThreadId	0x0	0x41e13c	0x21c00	0x20200	0x1ad
InterlockedDecrement	0x0	0x41e140	0x21c04	0x20204	0x2bc
GetCurrentThread	0x0	0x41e144	0x21c08	0x20208	0x1ac
HeapCreate	0x0	0x41e148	0x21c0c	0x2020c	0x29f
HeapDestroy	0x0	0x41e14c	0x21c10	0x20210	0x2a0
VirtualFree	0x0	0x41e150	0x21c14	0x20214	0x457
QueryPerformanceCounter	0x0	0x41e154	0x21c18	0x20218	0x354
GetCurrentProcessId	0x0	0x41e158	0x21c1c	0x2021c	0x1aa
GetSystemTimeAsFileTime	0x0	0x41e15c	0x21c20	0x20220	0x24f
FatalAppExitA	0x0	0x41e160	0x21c24	0x20224	0x10b
VirtualAlloc	0x0	0x41e164	0x21c28	0x20228	0x454
HeapReAlloc	0x0	0x41e168	0x21c2c	0x2022c	0x2a4
MultiByteToWideChar	0x0	0x41e16c	0x21c30	0x20230	0x31a
ReadFile	0x0	0x41e170	0x21c34	0x20234	0x368
InitializeCriticalSectionAndSpinCount	0x0	0x41e174	0x21c38	0x20238	0x2b5
HeapSize	0x0	0x41e178	0x21c3c	0x2023c	0x2a6
SetConsoleCtrlHandler	0x0	0x41e17c	0x21c40	0x20240	0x3a7
FreeLibrary	0x0	0x41e180	0x21c44	0x20244	0x14c
InterlockedExchange	0x0	0x41e184	0x21c48	0x20248	0x2bd
GetOEMCP	0x0	0x41e188	0x21c4c	0x2024c	0x213
IsValidCodePage	0x0	0x41e18c	0x21c50	0x20250	0x2db
GetConsoleCP	0x0	0x41e190	0x21c54	0x20254	0x183
GetConsoleMode	0x0	0x41e194	0x21c58	0x20258	0x195
FlushFileBuffers	0x0	0x41e198	0x21c5c	0x2025c	0x141
SetFilePointer	0x0	0x41e19c	0x21c60	0x20260	0x3df
SetStdHandle	0x0	0x41e1a0	0x21c64	0x20264	0x3fc
GetLocaleInfoW	0x0	0x41e1a4	0x21c68	0x20268	0x1ea
SetEnvironmentVariableA	0x0	0x41e1a8	0x21c6c	0x2026c	0x3d0

USER32.dll (12)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CloseClipboard	0x0	0x41e1c4	0x21c88	0x20288	0x47
GetSubMenu	0x0	0x41e1c8	0x21c8c	0x2028c	0x16b
LoadBitmapA	0x0	0x41e1cc	0x21c90	0x20290	0x1d0
BeginPaint	0x0	0x41e1d0	0x21c94	0x20294	0xe
CallMsgFilterW	0x0	0x41e1d4	0x21c98	0x20298	0x1a
PeekMessageA	0x0	0x41e1d8	0x21c9c	0x2029c	0x21b
MapVirtualKeyExW	0x0	0x41e1dc	0x21ca0	0x202a0	0x1f1
RegisterRawInputDevices	0x0	0x41e1e0	0x21ca4	0x202a4	0x242
SetWindowsHookExW	0x0	0x41e1e4	0x21ca8	0x202a8	0x2b0
GetClipboardSequenceNumber	0x0	0x41e1e8	0x21cac	0x202ac	0x113
GetDialogBaseUnits	0x0	0x41e1ec	0x21cb0	0x202b0	0x11d
MessageBoxIndirectA	0x0	0x41e1f0	0x21cb4	0x202b4	0x1fb

GDI32.dll (8)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CreateCompatibleDC	0x0	0x41e000	0x21ac4	0x200c4	0x2e
PlayEnhMetaFile	0x0	0x41e004	0x21ac8	0x200c8	0x230
ScaleViewportExtEx	0x0	0x41e008	0x21acc	0x200cc	0x258
SetStretchBltMode	0x0	0x41e00c	0x21ad0	0x200d0	0x289
SetPixelV	0x0	0x41e010	0x21ad4	0x200d4	0x284
CreateDiscardableBitmap	0x0	0x41e014	0x21ad8	0x200d8	0x35
AddFontResourceW	0x0	0x41e018	0x21adc	0x200dc	0x7
SetDeviceGammaRamp	0x0	0x41e01c	0x21ae0	0x200e0	0x271

SHELL32.dll (4)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ExtractAssociatedIconA	0x0	0x41e1b0	0x21c74	0x20274	0x24
ShellExecuteW	0x0	0x41e1b4	0x21c78	0x20278	0x118
ShellAboutW	0x0	0x41e1b8	0x21c7c	0x2027c	0x110
DragQueryFileA	0x0	0x41e1bc	0x21c80	0x20280	0x1e

Icons (1)

»

Memory Dumps (6)

»

Name	Process ID	Start VA	End VA	Dump Reason	Bitness	Entry Point	Actions
updatewin2.exe	8	0x00400000	0x0044CFFF	Relevant Image	32-bit	0x00404264	... Memory Dump Actions Go to Process Go to AV Match Download Dump
buffer	8	0x00585000	0x00585FFF	First Execution	32-bit	0x00585AB8	... Memory Dump Actions Go to Process Download Dump
updatewin2.exe	8	0x00400000	0x0044CFFF	Content Changed	32-bit	0x00402350	... Memory Dump Actions Go to Process Go to AV Match Download Dump
updatewin2.exe	8	0x00400000	0x0044CFFF	Content Changed	32-bit	0x0040D7C3	... Memory Dump Actions Go to Process Download Dump
updatewin2.exe	8	0x00400000	0x0044CFFF	Content Changed	32-bit	0x00401730	... Memory Dump Actions Go to Process Download Dump
updatewin2.exe	8	0x00400000	0x0044CFFF	Process Termination	32-bit	-	... Memory Dump Actions Go to Process Download Dump

Local AV Matches (1)

»

Threat Name	Severity
Trojan.AgentWDCR.SVC	Malicious

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\1eed4f4c-ee3f-42d5-9fd1-74f531bda6b5\5.exe

Downloaded File

Binary

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\5[1].exe (Downloaded File)
Mime Type	application/vnd.microsoft.portable-executable
File Size	473.50 KB
MD5	5cfc03ca6b617ecd389edc6647d664e9
SHA1	cf660c7ee220dc4c333625be3e5a27d4273780ba
SHA256	031f51b8992a6d63fe578ca38d8aad3816135821ad6f08fea81fed4eb4ca2b1c
SSDeep	12288:Y8BTDi8NAqrFLbE97yeGDVUZ/3O/LWkQbok6uMKN/1s:DZdXZE5nGDVC/O/LW3b56uM
ImpHash	f67a679669ddcc15bc555c1fb53c9e25

PE Information

»

Image Base	0x400000
Entry Point	0x401e4a
Size Of Code	0x65c00
Size Of Initialized Data	0x2993600
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2018-11-23 08:27:08+00:00

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x65b8f	0x65c00	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	7.94
.rdata	0x467000	0x3166	0x3200	0x66000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.38
.data	0x46b000	0x297ebc4	0x4200	0x69200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	1.32
.minag	0x2dea000	0x66	0x200	0x6d400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
.rsrc	0x2deb000	0x8e68	0x9000	0x6d600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.41

Imports (2)

»

KERNEL32.dll (95)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetProcessTimes	0x0	0x467010	0x698b0	0x688b0	0x22a
LocalHandle	0x0	0x467014	0x698b4	0x688b4	0x2fe
ReadFile	0x0	0x467018	0x698b8	0x688b8	0x368
CreateFileW	0x0	0x46701c	0x698bc	0x688bc	0x7f
lstrcatA	0x0	0x467020	0x698c0	0x688c0	0x4a6
lstrlenW	0x0	0x467024	0x698c4	0x688c4	0x4b6
SetConsoleTitleA	0x0	0x467028	0x698c8	0x688c8	0x3c1
WritePrivateProfileStringW	0x0	0x46702c	0x698cc	0x688cc	0x493
GetLastError	0x0	0x467030	0x698d0	0x688d0	0x1e6
GetProcAddress	0x0	0x467034	0x698d4	0x688d4	0x220
GetDriveTypeA	0x0	0x467038	0x698d8	0x688d8	0x1ba
BuildCommDCBW	0x0	0x46703c	0x698dc	0x688dc	0x2e
GetAtomNameA	0x0	0x467040	0x698e0	0x688e0	0x155
LoadLibraryA	0x0	0x467044	0x698e4	0x688e4	0x2f1
WriteConsoleA	0x0	0x467048	0x698e8	0x688e8	0x482
RegisterWaitForSingleObjectEx	0x0	0x46704c	0x698ec	0x688ec	0x373
GlobalWire	0x0	0x467050	0x698f0	0x688f0	0x298
GetProcessShutdownParameters	0x0	0x467054	0x698f4	0x688f4	0x229
DebugBreakProcess	0x0	0x467058	0x698f8	0x688f8	0xb5
OpenFileMappingW	0x0	0x46705c	0x698fc	0x688fc	0x32c
VirtualProtect	0x0	0x467060	0x69900	0x68900	0x45a
GetCurrentProcessId	0x0	0x467064	0x69904	0x68904	0x1aa
EnumSystemLocalesW	0x0	0x467068	0x69908	0x68908	0xfa
GetCommandLineA	0x0	0x46706c	0x6990c	0x6890c	0x16f
BackupSeek	0x0	0x467070	0x69910	0x68910	0x17
GetSystemDefaultLCID	0x0	0x467074	0x69914	0x68914	0x241
GetCurrentProcess	0x0	0x467078	0x69918	0x68918	0x1a9
LoadResource	0x0	0x46707c	0x6991c	0x6891c	0x2f6
MapViewOfFile	0x0	0x467080	0x69920	0x68920	0x30a
IsBadStringPtrW	0x0	0x467084	0x69924	0x68924	0x2ca
FindResourceA	0x0	0x467088	0x69928	0x68928	0x136
CreateTimerQueue	0x0	0x46708c	0x6992c	0x6892c	0xaa
HeapReAlloc	0x0	0x467090	0x69930	0x68930	0x2a4
GetStartupInfoW	0x0	0x467094	0x69934	0x68934	0x23a
RaiseException	0x0	0x467098	0x69938	0x68938	0x35a
RtlUnwind	0x0	0x46709c	0x6993c	0x6893c	0x392
TerminateProcess	0x0	0x4670a0	0x69940	0x68940	0x42d
UnhandledExceptionFilter	0x0	0x4670a4	0x69944	0x68944	0x43e
SetUnhandledExceptionFilter	0x0	0x4670a8	0x69948	0x68948	0x415
IsDebuggerPresent	0x0	0x4670ac	0x6994c	0x6894c	0x2d1
HeapAlloc	0x0	0x4670b0	0x69950	0x68950	0x29d
HeapFree	0x0	0x4670b4	0x69954	0x68954	0x2a1
GetModuleHandleW	0x0	0x4670b8	0x69958	0x68958	0x1f9
Sleep	0x0	0x4670bc	0x6995c	0x6895c	0x421
ExitProcess	0x0	0x4670c0	0x69960	0x68960	0x104
WriteFile	0x0	0x4670c4	0x69964	0x68964	0x48d
GetStdHandle	0x0	0x4670c8	0x69968	0x68968	0x23b
GetModuleFileNameA	0x0	0x4670cc	0x6996c	0x6896c	0x1f4
GetModuleFileNameW	0x0	0x4670d0	0x69970	0x68970	0x1f5
FreeEnvironmentStringsW	0x0	0x4670d4	0x69974	0x68974	0x14b
GetEnvironmentStringsW	0x0	0x4670d8	0x69978	0x68978	0x1c1
GetCommandLineW	0x0	0x4670dc	0x6997c	0x6897c	0x170
SetHandleCount	0x0	0x4670e0	0x69980	0x68980	0x3e8
GetFileType	0x0	0x4670e4	0x69984	0x68984	0x1d7
GetStartupInfoA	0x0	0x4670e8	0x69988	0x68988	0x239
DeleteCriticalSection	0x0	0x4670ec	0x6998c	0x6898c	0xbe
TlsGetValue	0x0	0x4670f0	0x69990	0x68990	0x434
TlsAlloc	0x0	0x4670f4	0x69994	0x68994	0x432
TlsSetValue	0x0	0x4670f8	0x69998	0x68998	0x435
TlsFree	0x0	0x4670fc	0x6999c	0x6899c	0x433
InterlockedIncrement	0x0	0x467100	0x699a0	0x689a0	0x2c0
SetLastError	0x0	0x467104	0x699a4	0x689a4	0x3ec
GetCurrentThreadId	0x0	0x467108	0x699a8	0x689a8	0x1ad
InterlockedDecrement	0x0	0x46710c	0x699ac	0x689ac	0x2bc
HeapCreate	0x0	0x467110	0x699b0	0x689b0	0x29f
VirtualFree	0x0	0x467114	0x699b4	0x689b4	0x457
QueryPerformanceCounter	0x0	0x467118	0x699b8	0x689b8	0x354
GetTickCount	0x0	0x46711c	0x699bc	0x689bc	0x266
GetSystemTimeAsFileTime	0x0	0x467120	0x699c0	0x689c0	0x24f
SetFilePointer	0x0	0x467124	0x699c4	0x689c4	0x3df
WideCharToMultiByte	0x0	0x467128	0x699c8	0x689c8	0x47a
GetConsoleCP	0x0	0x46712c	0x699cc	0x689cc	0x183
GetConsoleMode	0x0	0x467130	0x699d0	0x689d0	0x195
EnterCriticalSection	0x0	0x467134	0x699d4	0x689d4	0xd9
LeaveCriticalSection	0x0	0x467138	0x699d8	0x689d8	0x2ef
GetCPInfo	0x0	0x46713c	0x699dc	0x689dc	0x15b
GetACP	0x0	0x467140	0x699e0	0x689e0	0x152
GetOEMCP	0x0	0x467144	0x699e4	0x689e4	0x213
IsValidCodePage	0x0	0x467148	0x699e8	0x689e8	0x2db
VirtualAlloc	0x0	0x46714c	0x699ec	0x689ec	0x454
HeapSize	0x0	0x467150	0x699f0	0x689f0	0x2a6
InitializeCriticalSectionAndSpinCount	0x0	0x467154	0x699f4	0x689f4	0x2b5
SetStdHandle	0x0	0x467158	0x699f8	0x689f8	0x3fc
GetConsoleOutputCP	0x0	0x46715c	0x699fc	0x689fc	0x199
WriteConsoleW	0x0	0x467160	0x69a00	0x68a00	0x48c
MultiByteToWideChar	0x0	0x467164	0x69a04	0x68a04	0x31a
LCMapStringA	0x0	0x467168	0x69a08	0x68a08	0x2e1
LCMapStringW	0x0	0x46716c	0x69a0c	0x68a0c	0x2e3
GetStringTypeA	0x0	0x467170	0x69a10	0x68a10	0x23d
GetStringTypeW	0x0	0x467174	0x69a14	0x68a14	0x240
GetLocaleInfoA	0x0	0x467178	0x69a18	0x68a18	0x1e8
GetModuleHandleA	0x0	0x46717c	0x69a1c	0x68a1c	0x1f6
CreateFileA	0x0	0x467180	0x69a20	0x68a20	0x78
CloseHandle	0x0	0x467184	0x69a24	0x68a24	0x43
FlushFileBuffers	0x0	0x467188	0x69a28	0x68a28	0x141

ADVAPI32.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
AllocateAndInitializeSid	0x0	0x467000	0x698a0	0x688a0	0x1f
AccessCheckAndAuditAlarmA	0x0	0x467004	0x698a4	0x688a4	0x6
SetServiceObjectSecurity	0x0	0x467008	0x698a8	0x688a8	0x2b9

Icons (1)

»

Memory Dumps (2)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Point	AV	YARA	Actions
buffer	9	0x002B0A80	0x003060EF	First Execution		32-bit	0x002B0A80			... Memory Dump Actions Go to Process Download Dump
buffer	9	0x02E70000	0x02EF8FFF	First Execution		32-bit	0x02E70000			... Memory Dump Actions Go to Process Download Dump

Local AV Matches (1)

»

Threat Name	Severity
Trojan.GenericKD.42856061	Malicious

c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	64.00 KB
MD5	79fa6b912f160e9aca2cce7cf14b5ad0
SHA1	b05f4a2ddab5e0e6875cdfcd625da8d405a10a64
SHA256	cf9fa748082f0bcf1a7be2853676dce24e587afe1da75ccc8e57493a9bf1cd24
SSDeep	384:WnjyLKYBfFVZJptKF2KTFZTCzXTtX+Yih9aX5Jqiq+AN:AOLKYBdVZJptKF2KTFZTCzp++8
ImpHash	-

c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\cookies\index.dat

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	32.00 KB
MD5	74d69403f4a938faa28298c110bc71c3
SHA1	c016f27979d48a90bb341ccf7ffef41a3955f4d5
SHA256	8b9d3a6a22778e368c9e81397e2b1af64b9739f7ade535966708f34bcf6eada9
SSDeep	48:qMhaLouhzppiksLSLWFM+AWi3QTGnbYbQWy58V4l9:qO7appiksLSLaH0QCnMbQ5ll9
ImpHash	-

c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ietldcache\index.dat

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	256.00 KB
MD5	6852149628dae385c68c7a9db7028560
SHA1	c6e02c929ec99f984b04876816024c3a39b88ccb
SHA256	53ae38a5bdbd72f76bf578f6c36e0b54a994003f535dbc1b469c12f3a169e3a4
SSDeep	384:p8JEJH45Y0z6hKO59HqXRIhHPQ3NGjt3hAJnNH0kHf9QV9wRULzArvCCjgnF5TRy:pTHcEt8jdjFQg2cEbcaaoQARz40LG
ImpHash	-

c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\geo[1].json

Dropped File

Text

Unknown

»

Mime Type	text/plain
File Size	464 Bytes
MD5	f360171a7670135bb2cd9a780177470d
SHA1	5be89e06497c6b4428f10b1ec615eff980f7224b
SHA256	31aa8f56105f3b6f0e01e1f7483bac89a84859a2d99936d90f06dd8bcf95746f
SSDeep	12:Y06jmdVQVCRbwXhCdEVQVPB8yPt0fRbIRAJdxFQVyrhmXoB2Sd:Y4QVCRbwxCCQVvV0fRbI2JdxFQVyNmwb
ImpHash	-

C:\SystemID\PersonalID.txt

Dropped File

Text

Unknown

»

Mime Type	text/plain
File Size	42 Bytes
MD5	9c0fdf90138d798c52c54cb20e564c39
SHA1	ceae7799110535a49651e1d7a48bc3f4545db655
SHA256	92c766bae37fc3582db76d2c29fc9d21e56554e32b3faf5542278d0b91632bc6
SSDeep	3:RDeGfIfNDvBP:R6IUNL1
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab

Modified File

CAB

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab.remk (Dropped File)
Mime Type	application/vnd.ms-cab-compressed
File Size	24.17 MB
MD5	3134d9ac1a5fd90b295f1f06cec35c60
SHA1	e05ce1c556a270ce5526301353d76465b15cf992
SHA256	576db642c8d2bb4a194c72afa1d16e4c87ff9820c73a41e3e2a3a56db7296c66
SSDeep	196608:PByWdNm7l//upum9uxpfp4uZ8q7zEqaZswqLhQTcvlj9/z2H7DLKH8:PB8l//upum9QtEqaeqc3/iH3mH8
ImpHash	-
Error Remark	Could not parse sample file: Not a supported archive format

c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\history.ie5\index.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	64.00 KB
MD5	954f18ff7e6c1000b38d85d8c69fbdd2
SHA1	a4471549112a0a20168b796f6cdf91ed266624a1
SHA256	e0d6f8e10289f4fdde096e2ab6ed3d1273ea81d17643a7cb59ad76027c6e3427
SSDeep	384:ZClkBwOWzbqRBtjgokHySRkT4x0VNzmd0yNHeH:0SyOWzbqRBtjgomyAkTSeNzmd
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss.remk

Dropped File

Unknown

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss (Dropped File)
Mime Type	-
File Size	0 Bytes
MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep	3::
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\script.ps1

Dropped File

Text

Not Queried

»

Mime Type	text/x-powershell
File Size	49 Bytes
MD5	f972c62f986b5ed49ad7713d93bf6c9f
SHA1	4e157002bdb97e9526ab97bfafbf7c67e1d1efbf
SHA256	b47f85974a7ec2fd5aa82d52f08eb0f6cea7e596a98dd29e8b85b5c37beca0a8
SSDeep	3:uIHeGAFcX5wTnl:/eGgHTl
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\_readme.txt

Dropped File

Text

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\_readme.txt (Dropped File)
Mime Type	text/plain
File Size	1.09 KB
MD5	c11e2ee2f76ff1409ca25b101ccc1d67
SHA1	fc38ee843c6d65bca12dae06039da9bbf43982b8
SHA256	d6b9967d8b2dd2ed55b580b5857d583bde453b7c569f02057ad9ce3328e15143
SSDeep	24:FSimHPnIekFQjhRe9bgnYLuWjKGmFRqrl3W4kA+GT/kF5M2/kThHAx6LE:NmHfv0p6WjKGPFWrDGT0f/kTJO/
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\bowsakkdestx.txt

Downloaded File

Text

Not Queried

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\get[1].php (Downloaded File)
Mime Type	text/plain
File Size	562 Bytes
MD5	a2797be8a6a70a885c6b116974f6db4e
SHA1	3a334bc798dcabbc62c8e3ed2c745e94c7e84815
SHA256	17059e285fd74202f6e276cae0eea8885f528d1f63da6f015c764bb2ed06be6b
SSDeep	12:YGJ68yqOJC+OjWaTQYue6SV2AyfIj5hiNN55YIuX:YgJyq++W6FuRURWpyLX
ImpHash	-

Remarks (2/3)

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After