# Full WriteUp
Full Writeup on our website: [http://www.aperikube.fr/docs/nullcon_2018_osint1/](http://www.aperikube.fr/docs/nullcon_2018_osint1/)
-----
# TL;DR
In this task the author gaves us a ransomware hash. After passing it in virustotal. I saw the DSAdaDSDA.js JS dropper for Nemucod ransomware.
After a little looking on Google, I found the Hybrid Analysis report and found the username n923wUc in the HTTP Traffic.