Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    19-10-2020 13:44

General

  • Target

    the.ps1

  • Size

    902KB

  • MD5

    7770c598848339cf3562b7480856d584

  • SHA1

    b3d39042aab832b7d2bed732c8b8e600a4cf5197

  • SHA256

    ee3b0468a16789da8706d46aa361049ec51586c36899646a596b630d913e7304

  • SHA512

    02af6d5910f0627074fbea72901b2f2b491f7dba58f53ae1fad1dc47230e000a7b459c8475a76aaf006629bb5822d89d4672d32fb64d073464ca41140cb134d2

Malware Config

Extracted

Path

C:\Recovery\WindowsRE\5018E2-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}
URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\5018E2-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}
URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\5018E2-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}
URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\5018E2-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}
URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\5018E2-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}
URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\5018E2-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5018e2: kvuBEJGUfOsqjbjWTudabo2CqJNeh9SYXvdT/QO3mSKrMSXLTw wff01zRLrBlbYdAn9tQsSiV6IhEr1vY5zkPKu3azf+e29dkTQh 0gTiGFC0zSQQGA57S+TIOvjTbnTGXGYir1GGt+iOqohBND43SM DGp9k6Q2r5U0WKbfzVmUe2LhVwLvPt34l6U/K8ppwl+seam81K 23bZicPDysUS9yRfFtFa2NxZKEZLnCQOj6gGUgx/zmylkS8UWd M81U4dl7kiu9WZiissyDvtLdkuJlpZ9rhxsNvXIQ==}Hi! Your files are encrypted. All encrypted files for this computer has extension: .5018e2 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage the
URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Signatures

  • Netwalker Ransomware

    Ransomware family with multiple versions. Also known as MailTo.

  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Modifies service 2 TTPs 5 IoCs
  • Drops file in Program Files directory 17109 IoCs
  • Suspicious behavior: EnumeratesProcesses 40715 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\the.ps1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3984
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hbbofhrk\hbbofhrk.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3932
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD2A7.tmp" "c:\Users\Admin\AppData\Local\Temp\hbbofhrk\CSC12B6E847FBBC49AEA826E0A488DF3C5E.TMP"
          4⤵
            PID:4020
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vtwstjzv\vtwstjzv.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3040
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDA39.tmp" "c:\Users\Admin\AppData\Local\Temp\vtwstjzv\CSCF099FFB18A4B421495959F8BAD1C9EF.TMP"
            4⤵
              PID:3468
        • C:\Windows\system32\notepad.exe
          C:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\5018E2-Readme.txt"
          2⤵
            PID:1936
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Modifies service
          • Suspicious use of AdjustPrivilegeToken
          PID:5936

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Persistence

        Modify Existing Service

        1
        T1031

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Credentials in Files

        1
        T1081

        Collection

        Data from Local System

        1
        T1005

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\RESD2A7.tmp
          MD5

          ad5729a71498f2fa57d9efa07a5bcbbf

          SHA1

          cd7215b7f154258d48a167d1e4e39e64d76eff62

          SHA256

          9f0b4bb90da4cbe0407959b407c40ff8ab56e279164abc8f44371108e6ba8f3e

          SHA512

          8af6fa5bfa966c9fffea7d7627095d10a73264f5cb62e4dafb1fc006504a848362d44811f576c3e795226d7957ba69dbc53dcc49f531e9135fe6aa8159035d2b

        • C:\Users\Admin\AppData\Local\Temp\RESDA39.tmp
          MD5

          3421634da72dc53a8dca2ef8e0866a1c

          SHA1

          99c324d7efce7bcb2ac48d538d75e8074588bd04

          SHA256

          c3c5e5dee9822204f0168c6b178a1254597db7aa72373de5da77bdfb70098ea5

          SHA512

          dce009609b5a5c4fa3f84e664e26a2007c77d1870d08b14f831b80a119e04114257da86cfa2567a29aadc1c1cf3f56cb39b65297a44de1f607c66a8548f7d6cd

        • C:\Users\Admin\AppData\Local\Temp\hbbofhrk\hbbofhrk.dll
          MD5

          2dc3515173a01d9690e56d90b5918c96

          SHA1

          71298af0559780750914623a998d6aa9a238177b

          SHA256

          f4748f65f9e103826274b253dc105caacf863c4b9fdbc9b0e76aacdd101773b9

          SHA512

          c57336d684b004bd29c3ab51a7706cd19340f0cdd9713509a98218d950e8a33074b2ec32fc8adc38526ad0cfef8807ee54b90de49c452efe7b4ba296fabd9b41

        • C:\Users\Admin\AppData\Local\Temp\vtwstjzv\vtwstjzv.dll
          MD5

          67cf69b1585ff91956ac9576c05e08b5

          SHA1

          fc36058175e12187947d521e19d62e87f921855a

          SHA256

          af80e17e71de8c4517e6067fe8b785c1e6d50a913c8ae999d598e408f2b05819

          SHA512

          9c8e3323a121124f9e134bfa99192b6d2015f74f9f69682e15f236849868d55691c91055ddcb30e8b8a5e118548660716f5722a678f407ccb7a0694fa23c3bba

        • C:\Users\Admin\Desktop\5018E2-Readme.txt
          MD5

          eb74980c7bf03a349c22cccd6e7c8682

          SHA1

          3ef13325a21bf364704151d1e40c24111a07701d

          SHA256

          2a1ec3eb656a50ea7be8f1a057c1317e2003021f92dd8997f265953312c0ca50

          SHA512

          57381bb6c01697acbae01f2a444784a84ed83739f277543f08b2a8130896fcc07a563dbc29511481435aa5ba4bd7c3847333913e56708c78ac7ae256e3a17b2f

        • \??\c:\Users\Admin\AppData\Local\Temp\hbbofhrk\CSC12B6E847FBBC49AEA826E0A488DF3C5E.TMP
          MD5

          866148646ae02eb4c9a38c3b7da72481

          SHA1

          a6781fe6e83c19f5c95366386d7e5450567540be

          SHA256

          996e8e3d68a5efaddcb559a573c6e9620f583891b73569726ca4b75508489a82

          SHA512

          c25482bebd3da5d0b368ae04dcf275d2ed4466cd2429f1e505a18acdbf3fceef28ee148b8bf825bc25ee1d2b677c1976c802436ac0ebefc1fb64be5a60bb6d16

        • \??\c:\Users\Admin\AppData\Local\Temp\hbbofhrk\hbbofhrk.0.cs
          MD5

          64db54f88f46e2ecc57b05a25966da8e

          SHA1

          488dbbbab872714609ded38db924d38971a3685f

          SHA256

          e2b586aa1613682b4f1b92f981fea15d0612a3e632bbd73cd7287518c9ed7cb5

          SHA512

          8791b75874fd7a90bf63742abe6d299bc4370ad910591207d7630901d80765f6f6a4475809f23becf112360403423d0c691744f1024af3dd89c104f2b0b9e729

        • \??\c:\Users\Admin\AppData\Local\Temp\hbbofhrk\hbbofhrk.cmdline
          MD5

          557650a09e89aa8eabc1e6c5f8550eb1

          SHA1

          14ca5bc7071dbcecc52b4b029a5552417c413c60

          SHA256

          291d855e9e30c87be01dee911ecaa673923e21dc60710f6fb8099a175a504fb4

          SHA512

          0ef30a7209ae5b80d81f51a26bc1279d36843a3250695f318882cc6b11bf9b09504c6836fdaa6d5167baceb3ad0b4549d26537c40b9ada6a3b6171e6892cb671

        • \??\c:\Users\Admin\AppData\Local\Temp\vtwstjzv\CSCF099FFB18A4B421495959F8BAD1C9EF.TMP
          MD5

          0df12bad937dc8a03c6e3a274bb516d0

          SHA1

          41a5edeef68a58a8f1662629569ee0b164d5a70d

          SHA256

          53399bfef6b0efdd8c4af2cbe89bca4f17d89ebc9546f8b982c3221166ff3727

          SHA512

          2f81a57f9d857604dcefa2a2bbd42f99ffc9eb171daa24a9f0e6627ef62ae8f90b306d9e0d803ab390c6f578d8a6bc31ad96c4c12a3fdf4c652ddd3f51e6c4c3

        • \??\c:\Users\Admin\AppData\Local\Temp\vtwstjzv\vtwstjzv.0.cs
          MD5

          1cae52936facd4972987d3baef367d8d

          SHA1

          ad2b4b58d20f290b9da416cef1ef305cf1df6781

          SHA256

          28b45e56fb27763b4785974e380c96eef1436fc151a802f492db25052392d400

          SHA512

          4ae36c0ac78177eea5a6e0fbab0f51f7d24c7a76eae75b67eab41fcace921cef256b02fb088e1afb3c445e59598fbea73270e6bca1eda32514221190daa501df

        • \??\c:\Users\Admin\AppData\Local\Temp\vtwstjzv\vtwstjzv.cmdline
          MD5

          b55e24fc79ad82baaa09ae436821efce

          SHA1

          0392d4e2a9eaaf87f59f394ed3bf7dd1d26e0470

          SHA256

          c193b840240a60b605af44a0d224eb98319d4e9f043e6316a38a3599c0cb50a8

          SHA512

          dfd676c338142471aba87696a61d480cd471984708126deecba9e95f3b4d54057ebad6867ce8e50c9c4f53b951ab8efd9f9ffba626e1f3fd31c8103b7a8d8fc1

        • memory/1936-20-0x0000000000000000-mapping.dmp
        • memory/3040-11-0x0000000000000000-mapping.dmp
        • memory/3060-19-0x00000000006E0000-0x0000000000702000-memory.dmp
          Filesize

          136KB

        • memory/3468-14-0x0000000000000000-mapping.dmp
        • memory/3932-3-0x0000000000000000-mapping.dmp
        • memory/3984-0-0x00007FFF4EA20000-0x00007FFF4F40C000-memory.dmp
          Filesize

          9.9MB

        • memory/3984-2-0x000001C678C90000-0x000001C678C91000-memory.dmp
          Filesize

          4KB

        • memory/3984-18-0x000001C678C40000-0x000001C678C42000-memory.dmp
          Filesize

          8KB

        • memory/3984-10-0x000001C678C20000-0x000001C678C22000-memory.dmp
          Filesize

          8KB

        • memory/3984-1-0x000001C65E6A0000-0x000001C65E6A1000-memory.dmp
          Filesize

          4KB

        • memory/4020-6-0x0000000000000000-mapping.dmp