This is the only thing which i kindof went deep into while investigating ransomwares, hopefully it sheds some light

https://medium.com/the-first-digit/i-investigated-the-dark-w...