ryuk | hxxps://bazaar[.]abuse[.]ch/sample/60ef0ca5e6e7d62a7750cfe1c0b08d473cb19a6817a799f035ac56e0d27ce3df/

Analysis

max time kernel
599s
max time network
637s
platform
windows7_x64
resource
win7v20210408
submitted
11-06-2021 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bazaar.abuse.ch/sample/60ef0ca5e6e7d62a7750cfe1c0b08d473cb19a6817a799f035ac56e0d27ce3df/
Sample

210611-7ve91pm4me

Score

10^/10

ryuk discovery persistence ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = '8x0nKKx5'; $torlink = 'http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion

Signatures

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

uninstall.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Executes dropped EXE 5 IoCs

Processes:

uninstall.exeth.exeWinRAR.exeWinRAR.exeRYUK_JUNE_2021.exe

pid process

2188 uninstall.exe
2940 th.exe
992 WinRAR.exe
832 WinRAR.exe
2452 RYUK_JUNE_2021.exe
Loads dropped DLL 12 IoCs

Processes:

winrar-x64-601.exeuninstall.exe

pid process

628 winrar-x64-601.exe
2188 uninstall.exe
2188 uninstall.exe
628 winrar-x64-601.exe
1204
1204
1204
1204
1204
1204
1204
1204
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exe

pid process

1380 icacls.exe
2328 icacls.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2188	uninstall.exe
2940	th.exe
992	WinRAR.exe
832	WinRAR.exe
2452	RYUK_JUNE_2021.exe

pid	process
628	winrar-x64-601.exe
2188	uninstall.exe
2188	uninstall.exe
628	winrar-x64-601.exe
1204
1204
1204
1204
1204
1204
1204
1204

pid	process
1380	icacls.exe
2328	icacls.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

RYUK_JUNE_2021.exe

description	ioc	process
File opened (read-only)	\??\S:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\O:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\N:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\Z:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\R:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\K:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\G:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\V:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\X:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\U:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\T:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\Q:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\P:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\M:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\H:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\Y:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\E:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\L:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\J:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\I:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\F:	RYUK_JUNE_2021.exe
File opened (read-only)	\??\W:	RYUK_JUNE_2021.exe

Drops file in Program Files directory 64 IoCs

Processes:

RYUK_JUNE_2021.exewinrar-x64-601.exe

description	ioc	process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0232795.WMF	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActionExceptionHandlers.exsd	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-601.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Dubai	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\extensions\RyukReadMe.html	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\http.luac	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\en-US\msadcfr.dll.mui	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\RyukReadMe.html	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_ja.jar	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Monaco	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Reference Assemblies\RyukReadMe.html	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.LIC	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151581.WMF	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\RyukReadMe.html	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02389_.WMF	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386120.JPG	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\RyukReadMe.html	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\RyukReadMe.html	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.DLL	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\RyukReadMe.html	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_ja.jar	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Whitehorse	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jre7\README.txt	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\RyukReadMe.html	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239967.WMF	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\LAYERS.INF	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090027.WMF	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02413_.WMF	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\RyukReadMe.html	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_zh_4.4.0.v20140623020002.jar	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\RyukReadMe.html	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\PREVIEW.GIF	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Barbados	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF	RYUK_JUNE_2021.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107718.WMF	RYUK_JUNE_2021.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

2372 tasklist.exe

pid	process
2372	tasklist.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 10864b0aab5ed701	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

th.exeiexplore.exeIEXPLORE.EXEwinrar-x64-601.exewinrar-x64-601.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IVIEWOBJECTDRAW_DMLT9_WITH_GDI \th.exe = "0"	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000529101d5c9814b4eb0f580b37542e450000000000200000000001066000000010000200000009c094be830b5796381ea19fedf9e7dce8abc28fd83c55f3e52c159924ce4b8a9000000000e8000000002000020000000dc39d133091d4fac57ddb562ca637edbb7029eab0dfafca5a4f6ad5428923e9220000000e640782592b35d2f97b5dce7781eb1c02252b1644b1691579cd71d87ba915e92400000005759c1872c751f600fcbbdc258c9a5cc9d29ce43ae23a397ed64dc585168d323bc9740f8741708dd6853b8abca26332a41408b7953178fac59ed04d6e298f83f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\WinRAR.exe = "11000"	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SPELLCHECKING	th.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET\th.exe = "1"	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000529101d5c9814b4eb0f580b37542e45000000000020000000000106600000001000020000000bb8d9eb267ebea22510b6ff98e5d5477300567d7acfb0cde1cda0dc81cfeac7e000000000e8000000002000020000000dc0bb09036d96a0def10a11593e9c534bdc622a083c898db673551cf05ce67aa90000000dc75e31dd3e7295ffa6eefd33bb92c21fee94b0416f7604f499217f11e435472205c973c552084d18dd628da994e85e603e90a682f361484c066b02fb116c0f82db12c93a6d0a5ef2ef5adadaecb90be64a671acbd4ff7de4bcba62ff01f14b0b92ba5e09e05a1ddc56c6c09c16878e43f7f42a1166c85f82d1f65191715d9e58852c6e01a9130cf9340af4ea278b53040000000a1ef8a84ed30de7c9ece20de5aa4ed2180ef1ddbd92d6dcf9bcfa5e4079777bb1579635385cd9e91f4b75f0a3ec3cb78e3f4f539a81efd4eb26ce688965e5edf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	th.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING\th.exe = "1"	th.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING\WinRAR.exe = "1"	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE	th.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000002000000030000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "330171420"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS\th.exe = "1"	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IVIEWOBJECTDRAW_DMLT9_WITH_GDI	th.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL\th.exe = "1"	th.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT\WinRAR.exe = "0"	th.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL\WinRAR.exe = "1"	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT	th.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\th.exe = "1"	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM	th.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	winrar-x64-601.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	th.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\WinRAR.exe = "0"	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	winrar-x64-601.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\th.exe = "0"	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING \WinRAR.exe = "1"	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL	th.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\th.exe = "0"	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\th.exe = "11000"	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	th.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS\WinRAR.exe = "1"	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	th.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS	th.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

regedit.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\1 = "00000409"	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\2 = "00000419"	regedit.exe

Modifies registry class 64 IoCs

Processes:

uninstall.exeiexplore.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r04	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r01	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r03	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,1"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r07	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext32.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r21\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r10	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r06	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.001	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r16\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r29\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r21	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r01\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r11\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r17	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r14	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r26	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r06\ = "WinRAR"	uninstall.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

464 NOTEPAD.EXE
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

1004 regedit.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

996 PING.EXE

pid	process
464	NOTEPAD.EXE

pid	process
1004	regedit.exe

pid	process
996	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exechrome.exetaskmgr.exe

pid	process
980	chrome.exe
2464	chrome.exe
1264	chrome.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

980 taskmgr.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

tasklist.exeAUDIODG.EXEtaskmgr.exe

description	pid	process
Token: SeDebugPrivilege	2372	tasklist.exe
Token: 33	1016	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1016	AUDIODG.EXE
Token: 33	1016	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1016	AUDIODG.EXE
Token: SeDebugPrivilege	980	taskmgr.exe
Token: SeShutdownPrivilege	980	taskmgr.exe
Token: SeShutdownPrivilege	980	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

iexplore.exeWinRAR.exeWinRAR.exetaskmgr.exe

pid	process
2512	iexplore.exe
2512	iexplore.exe
992	WinRAR.exe
992	WinRAR.exe
992	WinRAR.exe
992	WinRAR.exe
832	WinRAR.exe
832	WinRAR.exe
832	WinRAR.exe
832	WinRAR.exe
832	WinRAR.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

iexplore.exeIEXPLORE.EXEwinrar-x64-601.exewinrar-x64-601.exeth.exe

pid	process
2512	iexplore.exe
2512	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
1576	winrar-x64-601.exe
1576	winrar-x64-601.exe
628	winrar-x64-601.exe
628	winrar-x64-601.exe
2940	th.exe
2940	th.exe
2940	th.exe
2940	th.exe
2888	IEXPLORE.EXE
2512	iexplore.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

iexplore.exechrmstp.exewinrar-x64-601.exeth.execmd.exeRYUK_JUNE_2021.exe

description	pid	process	target process
PID 2512 wrote to memory of 2888	2512	iexplore.exe	IEXPLORE.EXE
PID 2512 wrote to memory of 2888	2512	iexplore.exe	IEXPLORE.EXE
PID 2512 wrote to memory of 2888	2512	iexplore.exe	IEXPLORE.EXE
PID 2512 wrote to memory of 2888	2512	iexplore.exe	IEXPLORE.EXE
PID 292 wrote to memory of 1140	292	chrmstp.exe	chrmstp.exe
PID 292 wrote to memory of 1140	292	chrmstp.exe	chrmstp.exe
PID 292 wrote to memory of 1140	292	chrmstp.exe	chrmstp.exe
PID 628 wrote to memory of 2188	628	winrar-x64-601.exe	uninstall.exe
PID 628 wrote to memory of 2188	628	winrar-x64-601.exe	uninstall.exe
PID 628 wrote to memory of 2188	628	winrar-x64-601.exe	uninstall.exe
PID 628 wrote to memory of 2940	628	winrar-x64-601.exe	th.exe
PID 628 wrote to memory of 2940	628	winrar-x64-601.exe	th.exe
PID 628 wrote to memory of 2940	628	winrar-x64-601.exe	th.exe
PID 2940 wrote to memory of 2588	2940	th.exe	cmd.exe
PID 2940 wrote to memory of 2588	2940	th.exe	cmd.exe
PID 2940 wrote to memory of 2588	2940	th.exe	cmd.exe
PID 2588 wrote to memory of 996	2588	cmd.exe	PING.EXE
PID 2588 wrote to memory of 996	2588	cmd.exe	PING.EXE
PID 2588 wrote to memory of 996	2588	cmd.exe	PING.EXE
PID 2588 wrote to memory of 2372	2588	cmd.exe	tasklist.exe
PID 2588 wrote to memory of 2372	2588	cmd.exe	tasklist.exe
PID 2588 wrote to memory of 2372	2588	cmd.exe	tasklist.exe
PID 2588 wrote to memory of 1304	2588	cmd.exe	find.exe
PID 2588 wrote to memory of 1304	2588	cmd.exe	find.exe
PID 2588 wrote to memory of 1304	2588	cmd.exe	find.exe
PID 2452 wrote to memory of 1380	2452	RYUK_JUNE_2021.exe	icacls.exe
PID 2452 wrote to memory of 1380	2452	RYUK_JUNE_2021.exe	icacls.exe
PID 2452 wrote to memory of 1380	2452	RYUK_JUNE_2021.exe	icacls.exe
PID 2452 wrote to memory of 1380	2452	RYUK_JUNE_2021.exe	icacls.exe
PID 2452 wrote to memory of 2328	2452	RYUK_JUNE_2021.exe	icacls.exe
PID 2452 wrote to memory of 2328	2452	RYUK_JUNE_2021.exe	icacls.exe
PID 2452 wrote to memory of 2328	2452	RYUK_JUNE_2021.exe	icacls.exe
PID 2452 wrote to memory of 2328	2452	RYUK_JUNE_2021.exe	icacls.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://bazaar.abuse.ch/sample/60ef0ca5e6e7d62a7750cfe1c0b08d473cb19a6817a799f035ac56e0d27ce3df/
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1888 /prefetch:8
1⤵
PID:2684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=540 /prefetch:8
1⤵
PID:2676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
1⤵
PID:2960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:1
1⤵
PID:976

C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
1⤵
- Suspicious use of WriteProcessMemory
PID:292

C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x13c,0x140,0x144,0x110,0x148,0x13fa3a890,0x13fa3a8a0,0x13fa3a8b0
2⤵
PID:1140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
1⤵
PID:1848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 /prefetch:8
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4072 /prefetch:8
1⤵
PID:2868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3856 /prefetch:8
1⤵
PID:1636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3776 /prefetch:8
1⤵
PID:1632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3780 /prefetch:8
1⤵
PID:1752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3776 /prefetch:8
1⤵
PID:1976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3788 /prefetch:8
1⤵
PID:320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3832 /prefetch:8
1⤵
PID:832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3860 /prefetch:8
1⤵
PID:1560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4112 /prefetch:8
1⤵
PID:1604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4104 /prefetch:8
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4256 /prefetch:8
1⤵
PID:932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3864 /prefetch:8
1⤵
PID:2388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2452 /prefetch:8
1⤵
PID:2208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
1⤵
PID:2172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3788 /prefetch:8
1⤵
PID:1892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3780 /prefetch:8
1⤵
PID:2012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4268 /prefetch:8
1⤵
PID:2040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4264 /prefetch:8
1⤵
PID:1972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2156 /prefetch:8
1⤵
PID:2896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 /prefetch:8
1⤵
PID:2964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3316 /prefetch:8
1⤵
PID:2088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3160 /prefetch:8
1⤵
PID:3008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4076 /prefetch:8
1⤵
PID:3012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3828 /prefetch:8
1⤵
PID:3000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3904 /prefetch:8
1⤵
PID:2988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
1⤵
PID:2868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1524 /prefetch:8
1⤵
PID:2104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3528 /prefetch:8
1⤵
PID:2164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3656 /prefetch:8
1⤵
PID:832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3940 /prefetch:8
1⤵
PID:2184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3644 /prefetch:8
1⤵
PID:2404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3844 /prefetch:8
1⤵
PID:2180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
1⤵
PID:1084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3640 /prefetch:8
1⤵
PID:2056

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Russian_kb_reg.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:464

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\Desktop\Russian_kb.reg"
1⤵
- Modifies data under HKEY_USERS
- Runs .reg file with regedit
PID:1004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4684 /prefetch:8
1⤵
PID:2436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2544 /prefetch:1
1⤵
PID:2080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
1⤵
PID:2240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1892 /prefetch:1
1⤵
PID:2704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3252 /prefetch:8
1⤵
PID:940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2208 /prefetch:8
1⤵
PID:2652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3668 /prefetch:8
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2552 /prefetch:8
1⤵
PID:3064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5216 /prefetch:8
1⤵
PID:1628

C:\Users\Admin\Downloads\winrar-x64-601.exe
"C:\Users\Admin\Downloads\winrar-x64-601.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
1⤵
PID:2392

C:\Users\Admin\Downloads\winrar-x64-601.exe
"C:\Users\Admin\Downloads\winrar-x64-601.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628

C:\Program Files\WinRAR\uninstall.exe
"C:\Program Files\WinRAR\uninstall.exe" /setup
2⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2188

C:\Program Files\WinRAR\th.exe
"C:\Program Files\WinRAR\th.exe" -lng English -src wrr -lp thankyou -ver 601 -arch 64 -dom notifier.win-rar.com
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uninsep.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:2588

C:\Windows\system32\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:996

C:\Windows\system32\tasklist.exe
TaskList
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\system32\find.exe
Find "C:\Program Files\WinRAR\th.exe"
4⤵
PID:1304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1012 /prefetch:1
1⤵
PID:2436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
1⤵
PID:2052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1688 /prefetch:8
1⤵
PID:2104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,12628833329736241694,12663670754549899423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
1⤵
PID:1752

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -imon1 -- "C:\Users\Admin\Desktop\PACO_60ef0ca5e6e7d62a7750cfe1c0b08d473cb19a6817a799f035ac56e0d27ce3df.zip" C:\Users\Admin\Desktop\PACO_60ef0ca5e6e7d62a7750cfe1c0b08d473cb19a6817a799f035ac56e0d27ce3df\
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:992

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x55c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -imon1 -- "C:\Users\Admin\Desktop\PACO_60ef0ca5e6e7d62a7750cfe1c0b08d473cb19a6817a799f035ac56e0d27ce3df\60ef0ca5e6e7d62a7750cfe1c0b08d473cb19a6817a799f035ac56e0d27ce3df.zip" C:\Users\Admin\Desktop\PACO_60ef0ca5e6e7d62a7750cfe1c0b08d473cb19a6817a799f035ac56e0d27ce3df\
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:832

C:\Windows\System32\taskmgr.exe
"C:\Windows\System32\taskmgr.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:980

C:\Users\Admin\Desktop\RYUK_JUNE_2021.exe
"C:\Users\Admin\Desktop\RYUK_JUNE_2021.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2452

C:\Windows\SysWOW64\icacls.exe
icacls "C:\*" /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:1380

C:\Windows\SysWOW64\icacls.exe
icacls "D:\*" /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\RyukReadMe.html

MD5
a275819b461f6458af0dcce3dc69bab2

SHA1
4211607b906db1280376dbc9202df7f426b2921b

SHA256
615ab23d7c60104e69412960185d34163add0d6f7238dc22a851cf2c12de2b3a

SHA512
8b744cd272ef41a44dbeaa098090fba83843dea2af32d41cee0f6800d067fd89a6d8486153c473729a9f7a9c2cf723dfa4c6f870c5179d216554878c695925f6

Download Submit
C:\MSOCache\All Users\RyukReadMe.html

MD5
a275819b461f6458af0dcce3dc69bab2

SHA1
4211607b906db1280376dbc9202df7f426b2921b

SHA256
615ab23d7c60104e69412960185d34163add0d6f7238dc22a851cf2c12de2b3a

SHA512
8b744cd272ef41a44dbeaa098090fba83843dea2af32d41cee0f6800d067fd89a6d8486153c473729a9f7a9c2cf723dfa4c6f870c5179d216554878c695925f6

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.RYK

MD5
445d766800686805dd023c5e2f8809e7

SHA1
eb81fa14f6a2ce7f87d0c9065d2a86c8e3c58dc1

SHA256
4aa61ae327ab5de8f89b0014be4339fccfcaa48bdff3897220e1ace54b64c400

SHA512
e8f9611cc994de2aec1b8a75ab5d517164b81029255dd813b60597e1b35bbb17e65bd57a306d5d43eb057b4bc851f53059bcbeb643e84dc327b4cbdccf125d37

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.RYK

MD5
20d4f41962b9bcafc6af583ae5e45599

SHA1
e22685124b613de64cfe7ac90800676536c8475f

SHA256
1f72ae1625c4641ff2e539a4a30f548dcea3eec5b1a65c7eb2d1264b74699921

SHA512
b2db4d531f3e80ddfce9ff78c8b199c1896413d05db7e4181bc8107cfdd81c1df622517b0f4ba2458472ac4b8d2a507f1497d72f5937b5874b0c3d8d61be9f21

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.RYK

MD5
8ee28e19d6c34899a580fa254a6b7bed

SHA1
ba8996757e125705a31d4ccdbbc2a7144dca7c10

SHA256
8ee7d558481b5e1471be4586140436ade5139af0b82a5af750681446571cab06

SHA512
15f44f6448dc2286583409be764c6dd60563bd32b2fb3bf5e25956dac33e38635bf131242f20ae07f4833471553ad7395861469f17920ab0f96ede0399addd18

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.RYK

MD5
c81f86772e222f4abc749e2ee7138ab8

SHA1
b87d190341a8390e5d34c1e61706501bbba21c1d

SHA256
f9c3d458b4da668fda73918b3a4f7d94a7cf684a9c6d3e303b9233f715f647c7

SHA512
e952aef6c8585a530ce0eb45f610631169d2151987398d26704bf533b11b5baea169c2497c3b3e9f44227cf7134fce82570407e76a724f255139d8e56ed58ce0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.RYK

MD5
1da08171303a55b3dea0e7a956c403de

SHA1
f1c3f9e3347daa079f847f8768e7318944a947ad

SHA256
78ac8629cd353d2c40e262e5e73dd3468eb328e565efcef83f0f8dd8c67dfdc4

SHA512
4df2e4bbaba1a10247622dacd572bdc1eb0fc30e2f7441493e97139386a6ed7a3d28201030cf2dd4ca6488fbf9900e5d94985812721ea2a4d1c20b2217e34746

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab

MD5
fec3c5c9bc015c5f03d254aadfd08c4f

SHA1
f89988d455638033f54c3edb7d31514b8eea9049

SHA256
fc59ec98ce68736ab417ae617e8be35d42268e7d6920161885b42dbf794cce2f

SHA512
d61ac5a3fdf8b21738549bc274478ee58d8ae1b5c1a783ec29de82a02d09637a10588998e250444a7b0c77057ea37df4090b34c069ad5d2c5463c59387c1af12

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab

MD5
b706ca3dded9d9dd4c7464710eadecfe

SHA1
901aa473a8d7400f5ae335868321170798f66a4c

SHA256
0add5edad7f99286e7571ba125d3c9ff9decc5a7cd90acffb070f6e245c61243

SHA512
9d56339df5c3614a3c80becd4902c04472ed9e7e5bf8756d5b20b94eb55803398e5bf466ae8a0533dab4cd2cbb4fb571f30d49c1e9b556da614ffa8bc25efeb0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\RyukReadMe.html

MD5
a275819b461f6458af0dcce3dc69bab2

SHA1
4211607b906db1280376dbc9202df7f426b2921b

SHA256
615ab23d7c60104e69412960185d34163add0d6f7238dc22a851cf2c12de2b3a

SHA512
8b744cd272ef41a44dbeaa098090fba83843dea2af32d41cee0f6800d067fd89a6d8486153c473729a9f7a9c2cf723dfa4c6f870c5179d216554878c695925f6

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5
0c68ee275643c0f99af901e2b3ef8e25

SHA1
168f0d1bb3046782d17d7c379cec27de741aeb10

SHA256
e839df5929abde8911891cb3ddf1c5f4dcf90e213c28765c4eb23df99323b596

SHA512
bd8200a37285711afe38c7ebdc8657bbcabc45f63b2a11b8fc5252fabe44b5215898497370739e134d865f57ba6f9096f78867bcdda148d662b3813b3a36cc28

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.RYK

MD5
0a03bf512cf386f922feba3c9ff180d6

SHA1
d1b026a233d9eaf1b773802922e9a2dc60e62ae9

SHA256
198ea53b2a60575e9328bf8d81013cb53601db9573a529bd2d863d2816c5e25e

SHA512
e5c99a6dd9dc12d840e82f3943117a073603a424b6b7467501475411e61fc555cc72a944edc36c4342099840219272abf740eebbbb106d401194340b21b0a4fa

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.RYK

MD5
ea7fe9d86043b34ca65652fb5f9306e8

SHA1
77345a9c34c6e45945da93efcfee85da808108ed

SHA256
fd7e852926545b765495bd0ab5946999b0719672c37d80d8e4a74d69aefa4457

SHA512
4abf5a64dc762fa57395f0522b45b9bf5621dadd95d6060a0f2edb1012d7de7ca6d7dfb8e8607c3f733e4a8065d05d74b5d2609d745350ddca656739215328cc

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.RYK

MD5
1491a745640a975d7e25e0bf08bf22a7

SHA1
aa1ed3f384ab2d5d4d187883eda53a013815f7ef

SHA256
ce1e0f870caa1635160491e76c45b789528ce66a99dfc9837ae91010f60d394f

SHA512
61541c9798bde73215fd796877e87333569fb575054cf8432ed6f794790a9c68465d1a877761f76f285c1178526a3e2394415a219faa4824c18741f6eef61311

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml.RYK

MD5
e743999cb1d07511191f037293c03126

SHA1
6217ae1f9f3332ca6e8f5e7a146c5cd36d3bd5e6

SHA256
4097d74690a194f7bafef0e5ddb1199e66e7e651fb009b2a5ef281ba5333c71c

SHA512
6137659622b8f19c2afed5025682deaac3c0ecb467925f7de381e312c6270b24dadc6df977197c8998f5743cb2406aef85ef060a0e4543877d015de182795654

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\RyukReadMe.html

MD5
a275819b461f6458af0dcce3dc69bab2

SHA1
4211607b906db1280376dbc9202df7f426b2921b

SHA256
615ab23d7c60104e69412960185d34163add0d6f7238dc22a851cf2c12de2b3a

SHA512
8b744cd272ef41a44dbeaa098090fba83843dea2af32d41cee0f6800d067fd89a6d8486153c473729a9f7a9c2cf723dfa4c6f870c5179d216554878c695925f6

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5
9100a467babc1bd7f6af78dd896b1da9

SHA1
9f1daba0c03d2193649856270582a40cd490cea7

SHA256
aa089454e2244eef646bf2b24d4645f07ae6f199b036bc76d82e7010afeb7019

SHA512
acccb2bf900536e6ab0faa4774d97eade1540720c220c369fccc17a8e7965c8f87ca2af09a1a1c8e092d9afa225a8836f865568c6826b79b15f443b33b3da2d3

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.RYK

MD5
968084e25024171e27a50a55e58a0102

SHA1
0e94ffefa836df4d6044daf455a6e6bf26fe7451

SHA256
a79c4a51f77df3c0b0c4dc12e116dddf5f17165a6e508b5317b21b7d102f42e4

SHA512
d21c88b0cb7415d8def1277898452445d17d77e57fbd81f6a3498578e16a8f9d3704fec493d0b9a1376917d3a5e1d731d59d79b6778e9bfabe14ad60d8415553

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml.RYK

MD5
9f9bbc5de52bb143fef8cd7a85124a9b

SHA1
9fdbde81077ec5bf812d19964fcbf730208a7383

SHA256
6962648f464239f3b2b107862a86586dce0c19da0aba19514a4ad7f1f9125170

SHA512
279aff7f2d5faf32794aedae655707010fa769bb2168fbc138999c1684ae6c632f0495fde70c5e7541a62e4eb9a03871f2ac63f6ad0485d17dd8416581f81750

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab

MD5
72767727c15b45f68629be4bd43951c7

SHA1
3cba7065446719fc7fb3234dc3172ec5f3a80509

SHA256
91f11e92f7003cf131df199c67999dc299ee19b59e61d73d4e5251db41109ef5

SHA512
32143303a78d23cbc4f8c313952d69cd0b9a60ddf981a26ca07ae2286f2f5b559fd38c1b1f7ec544861d4d96b5e5d6df9053cd2534b32177fd89475f3d65f911

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\RyukReadMe.html

MD5
a275819b461f6458af0dcce3dc69bab2

SHA1
4211607b906db1280376dbc9202df7f426b2921b

SHA256
615ab23d7c60104e69412960185d34163add0d6f7238dc22a851cf2c12de2b3a

SHA512
8b744cd272ef41a44dbeaa098090fba83843dea2af32d41cee0f6800d067fd89a6d8486153c473729a9f7a9c2cf723dfa4c6f870c5179d216554878c695925f6

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5
fd9e491fae43ec28c180c1c3aad667ba

SHA1
2a5409a757def9b98952eb4a9e3afc07de92d3e9

SHA256
95f0dc6ab4010a8a898b0fcedca560e2d8a0f049223ae7951e1e6d7e8bc92626

SHA512
28d9b7a6335c19cc73e53a6bced52c8adb1cbea46faf4a037fd29a5a199475308c35956e90e68b9207513d3539b51d19c131b7a693e7b2665e2fa2998326321d

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.RYK

MD5
1d8c45dff93b09c2a98d103eb89ec815

SHA1
87710b55ffb56988ad817a325bb3e37d611d378e

SHA256
8f1fb21791699e919d0054e6eaea7b58b037be5b46f4f028e5750f6b8fec9d80

SHA512
6dc1efa75e76d2d1c04c1fde69f8fabff863615246c243885f1b847080e6b1e37896850623cb0ad8cef4a215c5f44de473a9a3d6802bac3f242dcdcb6706c952

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.RYK

MD5
24bef4c4eceb7a073d6c8020ef045ef5

SHA1
0c34de5715f221aa85aba196e80eb09fcb07d113

SHA256
802d2e72b0d2d9b785e575aafa66b94848b545b444422dfcb72f052468546c83

SHA512
1d79c47494d3a688014fb54e58b2739a7ea7f0faafe9ca40f57c65a465805fd0ab8d7077d65e04bec9883ff708c7d5fa06064c5747cf41807c794f4c94b8c2ce

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml.RYK

MD5
d77099e430db7d1ce14ad552de1560b8

SHA1
4e70a5417106f902c57f42ae80c9ed21851fcbb9

SHA256
531f728e62025b90a0aff7125e12c3f1d65f360746f9c6678b938e176b696ec2

SHA512
dd4ab9631ba777285b28f078cfc2b22130bf8bb6702acaab6f9a1338954ba256957f7832bf949e35ca27c6b26dc32b85d40bd52889bc8d4798adbcca194b14e4

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\RyukReadMe.html

MD5
a275819b461f6458af0dcce3dc69bab2

SHA1
4211607b906db1280376dbc9202df7f426b2921b

SHA256
615ab23d7c60104e69412960185d34163add0d6f7238dc22a851cf2c12de2b3a

SHA512
8b744cd272ef41a44dbeaa098090fba83843dea2af32d41cee0f6800d067fd89a6d8486153c473729a9f7a9c2cf723dfa4c6f870c5179d216554878c695925f6

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5
99bbf5951873012897c1e8db15538f70

SHA1
46655aaaf33d8e9cbc6347bd407d98607c165410

SHA256
4ee853de0f984410e95c586617e160e571c0ac8c1406204d6e7d6cb0b1add9f4

SHA512
057b14fae9424c2419f8f9f94147f051fdcf08ebdbdd66a88e1d8ba4010252e8c396f280b9bf7df5e21fba8a981735c3430b4d201490e0fd291267fb2ce20d54

Download Submit
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.RYK

MD5
dece1b20890b9ffaed1a9225ca29fdeb

SHA1
1666098029c6af44ddd399f71d8320c94f4d08f5

SHA256
6bb495a1a88fb2fc3d8c5c2a2690c37b1706ab05081bb8803492ce4075cf5c50

SHA512
c3556b840a1e8311e510bef498480ec27cd1efe90dbc5bcb3c6d29113ea11aca1aa148308ab521de2cdc5e6893a4dd4e18bb45612ba248da905017db0e248393

Download Submit
C:\Program Files\WinRAR\Rar.txt

MD5
fc96c74be0cee755d9b3e2ff42afdcc4

SHA1
e18507f16d55aeda8e9e6772f079e96b78e356a1

SHA256
04a0e8d53a30e8d889cea6777d51628c844ce993745752bd28f7e64e76be849a

SHA512
ef53ef0ec9b382957c5d5a7babb925cdcf766460fc5720b4f60d983088d71d608521798f43e020d1d8079f9f1747e44f8f3fce222ebc82a2ed1b44fb647f5b76

Download Submit
C:\Program Files\WinRAR\Uninstall.exe

MD5
696d1a42af168201e8057f4a839cba73

SHA1
471d8c1d510e7f163af7955a8d548f6000a67855

SHA256
8f8b7e35a2dcd92eb01805479a05882be3fd37cd149fbeb8564bf0c71e991767

SHA512
32905b1b99d1ff6d90e350c05c62c580b7374bd22c811e4c33b8c104d2f21dbdadfe6cfc87f4d8042c4938f2d63927f3e0ece75a06067cacaf6354379cfd4667

Download Submit
C:\Program Files\WinRAR\WhatsNew.txt

MD5
eb5e9956913d971541a456c1701d5040

SHA1
eaf1e6a948f63ae40a6a3d1a8d3d93ff6b2b15d3

SHA256
9c83044f1d6654f685af82a61158110eff604ac6f9df54078337807be542bdda

SHA512
42cc08802921394cd723b403a7fab481044c36960d7004a27bec421212515082e34194005bc7b96a8f831f58ad75074f0156a1b8b23005774384fcc707e11c39

Download Submit
C:\Program Files\WinRAR\WinRAR.chm

MD5
0742228ac72eaaafbafc003eece35938

SHA1
fa4d56ead1ccff59b54acb75f1597fce7f72e3b9

SHA256
59b2ea0ccd15804557a3b5c788fe6854ab72de9d07c31068bc28b454600184c9

SHA512
4c32ae438cbd564a837fe2673b9cbc4f0f1973dfe6308e20543f3a76e91166b112868771c6db585f7a8927065fe79b291d419e1bde75188050038928b85b4636

Download Submit
C:\Program Files\WinRAR\WinRAR.exe

MD5
db26d4a98b27766168f3821283ac0097

SHA1
840f747cff2933a1028e1a24be1ba1c812f34055

SHA256
48b6c89bda977c2adc7a0af649d0a9c041e69aa2944077dc3f1e9c1b594de55c

SHA512
a1c1c6eff2e68f826d7df026ce866365560276e3bb411e57fa1e1a9e2a313d58471fe78bb860101429c27809442b5c032dc1e194daeab9c1926d00de0da11644

Download Submit
C:\Program Files\WinRAR\WinRAR.exe

MD5
db26d4a98b27766168f3821283ac0097

SHA1
840f747cff2933a1028e1a24be1ba1c812f34055

SHA256
48b6c89bda977c2adc7a0af649d0a9c041e69aa2944077dc3f1e9c1b594de55c

SHA512
a1c1c6eff2e68f826d7df026ce866365560276e3bb411e57fa1e1a9e2a313d58471fe78bb860101429c27809442b5c032dc1e194daeab9c1926d00de0da11644

Download Submit
C:\Program Files\WinRAR\WinRAR.exe

MD5
db26d4a98b27766168f3821283ac0097

SHA1
840f747cff2933a1028e1a24be1ba1c812f34055

SHA256
48b6c89bda977c2adc7a0af649d0a9c041e69aa2944077dc3f1e9c1b594de55c

SHA512
a1c1c6eff2e68f826d7df026ce866365560276e3bb411e57fa1e1a9e2a313d58471fe78bb860101429c27809442b5c032dc1e194daeab9c1926d00de0da11644

Download Submit
C:\Program Files\WinRAR\th.exe

MD5
739825a8c24c219366b24a1e1cc4b0e6

SHA1
c44c28a7180aa8c91d011891c2b600ed6e826622

SHA256
b485942ae7a34b51e7736193335b1f28c8a4960d977cb7bf5f02dc1f5f550a66

SHA512
cb71d335ceb86e9fe6cf0c0b3a533c967c5971975f131b77c846866e8d323efd129368dc5f0fedae9a463320936676a9baacc1acaf2d4062e318f6b072a33d72

Download Submit
C:\Program Files\WinRAR\th.exe

MD5
739825a8c24c219366b24a1e1cc4b0e6

SHA1
c44c28a7180aa8c91d011891c2b600ed6e826622

SHA256
b485942ae7a34b51e7736193335b1f28c8a4960d977cb7bf5f02dc1f5f550a66

SHA512
cb71d335ceb86e9fe6cf0c0b3a533c967c5971975f131b77c846866e8d323efd129368dc5f0fedae9a463320936676a9baacc1acaf2d4062e318f6b072a33d72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5
7f5cd0b65b54967b92cb55fe047073d2

SHA1
4d31b295fb98d38cf5b3e697a8639ec1fe501326

SHA256
27385dc36828c0f8d937b6bee12834899de0b380c82935551ae05df205ea1599

SHA512
054a6e51ec300d0552e572df94b334bc67eddfa678a89f12a6ddd131fd1145c60f5391f9ac220c009c7f9b0c759a3e7a0ca31b9eca5d6fb5112492cc127fac82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5
4500b5f1d393fa6e7af828cf9605ac58

SHA1
474d08207bb8d6f021cc1a483af2f16fdd3c1e29

SHA256
ffdde062e61c1485b7dfc498402a4d2ffe3345eea3ba0414dce0ecedeebdb430

SHA512
a55a2c1b1efaf70a474e98db4b62dade657d54429d28184a5726e5dbbf311844e3dd4a4e94c9736642bb72dee66c6c267752b06e2014db6cec9d0f2ee3713ea0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\bq3gxmw\imagestore.dat

MD5
8f6b4275a3bb46b94e87d4ac76ea0791

SHA1
860e1f6ec3c3a5a128459ac4bc5c2bc94b460ff6

SHA256
3716fffa020f21a53a90f85bb16243eaa75717f2bc406533fc6794e9d48c5597

SHA512
2e1f26b1b2c56c781daec4d4451fb81a5332671b0ed1b1bd3f5539bf5a92ffee3e43905b5ed6deb32cff825577a4895d7d927fafa0b1b14d48742647bb66589d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RNQMQDEL\favicon[2].ico

MD5
e1c76d0b0ea7335e0e0106e5ac1125f5

SHA1
e45003897b26137bd1e9ba88a237f5c5669eb92a

SHA256
e4805c69184ae414aa88a6c478abee36e27b7e72e045365d81e6c44246808ec8

SHA512
15bf7c9e0a1d7ee6897b5e024f043eb07f75af1d9010e7bf1209d0440c2edc5fd1c4fd16c5e340c9a767ad2dd729e5a931d7979d163d83f0b59ea2541d83e013

Download Submit
C:\Users\Admin\AppData\Local\Temp\_uninsep.bat

MD5
ae8de700316091ee19a65c950740b129

SHA1
c217a3cb4bdd74b2be89c88adbf3c80e46b0351c

SHA256
ec07fcb82883773bf3f8c1570e8114043cdc479e4785ea76fc78fc59223446cc

SHA512
35e1d19b4679209d501cca504b5638aa941da9d6d019312e7b4d29e46d017785501894c7b46f3588d624f748d71d478ee2806ec7e99a34c22856f2183eb0e99d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DBAGYTXG.txt

MD5
a8ed82f1674fd90c186af7dc246b5a99

SHA1
b88abb41c977bf1d13a45d7e9863c0616f359e0c

SHA256
395a476f3aa7f3ed55f68d80b82aa9abba2e7532d932b6b211b18f421acba9dc

SHA512
8a0233b67364141797203e8fde8720fa74bbfc4ed5a28097a611fcdd4f88aa3ed707cbb6c4435ae84b53ba18cfd1fcfe309ea7860bd10153ce2d006f8fe43631

Download Submit
C:\Users\Admin\AppData\Roaming\WinRAR\version.dat

MD5
59202c7dd805705cae8614813d9a4db4

SHA1
604935491e047e3f1906f59fd8a9bc16204317b6

SHA256
a61f3ad86e9c8eb3b900cb40d8971d8e76543618343a11a10ee864b307f95d52

SHA512
c37f2654754cde1e96063d53fd143b7435ab4763d3c154365aa1dffff6862e263fef7cfb678ad78194718ff36e938eb9aae95062eb43deca39020db0d0f3722a

Download Submit
C:\Users\Admin\Desktop\PACO_60ef0ca5e6e7d62a7750cfe1c0b08d473cb19a6817a799f035ac56e0d27ce3df.zip.1qml0pf.partial

MD5
626e3248a52b086b98af3e7832de9a96

SHA1
329976a22f05c418342f36f23c3dcd683c65fa82

SHA256
00167c9113230404047526ce26abc4aa13a6ce53fce07078394fbc1cf1a67a24

SHA512
a7d6f25d377ea98c8cfe70c85d1f051ac76739d2fc813abc0060e12a227a2a489cb77bbaded8192706f17aaa2a1980af21637554cbda65a9468ac07c378c1e0d

Download Submit
C:\Users\Admin\Desktop\PACO_60ef0ca5e6e7d62a7750cfe1c0b08d473cb19a6817a799f035ac56e0d27ce3df\60ef0ca5e6e7d62a7750cfe1c0b08d473cb19a6817a799f035ac56e0d27ce3df.zip

MD5
662855171d4d584db3f36a4047a855f6

SHA1
c9e3193313e39ec9e9acc86701fa61441a2a6f52

SHA256
60ef0ca5e6e7d62a7750cfe1c0b08d473cb19a6817a799f035ac56e0d27ce3df

SHA512
0eab323cf31c76c1c4ca28b8a9ebfe063905ab6b10b796f65cb9c35d157a5620933a0de65ff63c540da2ae7e2080c85160febf8faffe48e3fcd415ca8f808b64

Download Submit
C:\Users\Admin\Desktop\RYUK_JUNE_2021.exe

MD5
2cc630e080bb8de5faf9f5ae87f43f8b

SHA1
5a385b8b4b88b6eb93b771b7fbbe190789ef396a

SHA256
d6b7b27e13700aaa7f108bf9e76473717a7a1665198e9aafcc2d2227ca11bba9

SHA512
901939718692e20a969887e64db581d6fed62c99026709c672edb75ebfa35ce02fa68308d70d463afbcc42a46e52ea9f7bc5ed93e5dbf3772d221064d88e11d7

Download Submit
C:\Users\Admin\Desktop\RYUK_JUNE_2021.exe

MD5
2cc630e080bb8de5faf9f5ae87f43f8b

SHA1
5a385b8b4b88b6eb93b771b7fbbe190789ef396a

SHA256
d6b7b27e13700aaa7f108bf9e76473717a7a1665198e9aafcc2d2227ca11bba9

SHA512
901939718692e20a969887e64db581d6fed62c99026709c672edb75ebfa35ce02fa68308d70d463afbcc42a46e52ea9f7bc5ed93e5dbf3772d221064d88e11d7

Download Submit
C:\Users\Admin\Desktop\Russian_kb.reg

MD5
8fa39bdf983c91e07859e99f3978f1a0

SHA1
cad2a4c28d12318e89307e46335db26bdde0f5fb

SHA256
4880b821c1b8ec7b936dff00a7e88c97cbcb847ee1560805428dd9ab512290a9

SHA512
8147d07f030fe2aac03d23cbdc7affa9709b00db2df71e862b1bf03432ebe2222b3277d0b28b2466456d1aff19632cc1d426cf5d0a0af22af3fc943f076dc14e

Download Submit
\Program Files\WinRAR\RarExt.dll

MD5
92839ae3a30782319f31d88a6edcb02a

SHA1
4e674c087cc1af6e7957802a17b897de8cb466ec

SHA256
f74664f25da3b87f7cbe3da8f449e52c27ff3ad026e3d1de3e5f22dd0c43ea7d

SHA512
3e5530de3d5a3b7e169be16dfc52cb889aed9f9a25acd2bcfed32ca6d170f3567bf12a361a2c69611cf55e279dc40138ac402088cc7ecd4d5442e3d7aeb142b4

Download Submit
\Program Files\WinRAR\Uninstall.exe

MD5
696d1a42af168201e8057f4a839cba73

SHA1
471d8c1d510e7f163af7955a8d548f6000a67855

SHA256
8f8b7e35a2dcd92eb01805479a05882be3fd37cd149fbeb8564bf0c71e991767

SHA512
32905b1b99d1ff6d90e350c05c62c580b7374bd22c811e4c33b8c104d2f21dbdadfe6cfc87f4d8042c4938f2d63927f3e0ece75a06067cacaf6354379cfd4667

Download Submit
\Program Files\WinRAR\WinRAR.exe

MD5
db26d4a98b27766168f3821283ac0097

SHA1
840f747cff2933a1028e1a24be1ba1c812f34055

SHA256
48b6c89bda977c2adc7a0af649d0a9c041e69aa2944077dc3f1e9c1b594de55c

SHA512
a1c1c6eff2e68f826d7df026ce866365560276e3bb411e57fa1e1a9e2a313d58471fe78bb860101429c27809442b5c032dc1e194daeab9c1926d00de0da11644

Download Submit
\Program Files\WinRAR\WinRAR.exe

MD5
db26d4a98b27766168f3821283ac0097

SHA1
840f747cff2933a1028e1a24be1ba1c812f34055

SHA256
48b6c89bda977c2adc7a0af649d0a9c041e69aa2944077dc3f1e9c1b594de55c

SHA512
a1c1c6eff2e68f826d7df026ce866365560276e3bb411e57fa1e1a9e2a313d58471fe78bb860101429c27809442b5c032dc1e194daeab9c1926d00de0da11644

Download Submit
\Program Files\WinRAR\WinRAR.exe

MD5
db26d4a98b27766168f3821283ac0097

SHA1
840f747cff2933a1028e1a24be1ba1c812f34055

SHA256
48b6c89bda977c2adc7a0af649d0a9c041e69aa2944077dc3f1e9c1b594de55c

SHA512
a1c1c6eff2e68f826d7df026ce866365560276e3bb411e57fa1e1a9e2a313d58471fe78bb860101429c27809442b5c032dc1e194daeab9c1926d00de0da11644

Download Submit
\Program Files\WinRAR\WinRAR.exe

MD5
db26d4a98b27766168f3821283ac0097

SHA1
840f747cff2933a1028e1a24be1ba1c812f34055

SHA256
48b6c89bda977c2adc7a0af649d0a9c041e69aa2944077dc3f1e9c1b594de55c

SHA512
a1c1c6eff2e68f826d7df026ce866365560276e3bb411e57fa1e1a9e2a313d58471fe78bb860101429c27809442b5c032dc1e194daeab9c1926d00de0da11644

Download Submit
\Program Files\WinRAR\WinRAR.exe

MD5
db26d4a98b27766168f3821283ac0097

SHA1
840f747cff2933a1028e1a24be1ba1c812f34055

SHA256
48b6c89bda977c2adc7a0af649d0a9c041e69aa2944077dc3f1e9c1b594de55c

SHA512
a1c1c6eff2e68f826d7df026ce866365560276e3bb411e57fa1e1a9e2a313d58471fe78bb860101429c27809442b5c032dc1e194daeab9c1926d00de0da11644

Download Submit
\Program Files\WinRAR\WinRAR.exe

MD5
db26d4a98b27766168f3821283ac0097

SHA1
840f747cff2933a1028e1a24be1ba1c812f34055

SHA256
48b6c89bda977c2adc7a0af649d0a9c041e69aa2944077dc3f1e9c1b594de55c

SHA512
a1c1c6eff2e68f826d7df026ce866365560276e3bb411e57fa1e1a9e2a313d58471fe78bb860101429c27809442b5c032dc1e194daeab9c1926d00de0da11644

Download Submit
\Program Files\WinRAR\WinRAR.exe

MD5
db26d4a98b27766168f3821283ac0097

SHA1
840f747cff2933a1028e1a24be1ba1c812f34055

SHA256
48b6c89bda977c2adc7a0af649d0a9c041e69aa2944077dc3f1e9c1b594de55c

SHA512
a1c1c6eff2e68f826d7df026ce866365560276e3bb411e57fa1e1a9e2a313d58471fe78bb860101429c27809442b5c032dc1e194daeab9c1926d00de0da11644

Download Submit
\Program Files\WinRAR\WinRAR.exe

MD5
db26d4a98b27766168f3821283ac0097

SHA1
840f747cff2933a1028e1a24be1ba1c812f34055

SHA256
48b6c89bda977c2adc7a0af649d0a9c041e69aa2944077dc3f1e9c1b594de55c

SHA512
a1c1c6eff2e68f826d7df026ce866365560276e3bb411e57fa1e1a9e2a313d58471fe78bb860101429c27809442b5c032dc1e194daeab9c1926d00de0da11644

Download Submit
\Program Files\WinRAR\WinRAR.exe

MD5
db26d4a98b27766168f3821283ac0097

SHA1
840f747cff2933a1028e1a24be1ba1c812f34055

SHA256
48b6c89bda977c2adc7a0af649d0a9c041e69aa2944077dc3f1e9c1b594de55c

SHA512
a1c1c6eff2e68f826d7df026ce866365560276e3bb411e57fa1e1a9e2a313d58471fe78bb860101429c27809442b5c032dc1e194daeab9c1926d00de0da11644

Download Submit
\Program Files\WinRAR\th.exe

MD5
739825a8c24c219366b24a1e1cc4b0e6

SHA1
c44c28a7180aa8c91d011891c2b600ed6e826622

SHA256
b485942ae7a34b51e7736193335b1f28c8a4960d977cb7bf5f02dc1f5f550a66

SHA512
cb71d335ceb86e9fe6cf0c0b3a533c967c5971975f131b77c846866e8d323efd129368dc5f0fedae9a463320936676a9baacc1acaf2d4062e318f6b072a33d72

Download Submit
memory/464-105-0x0000000001D50000-0x0000000001D51000-memory.dmp

Filesize
4KB

Download
memory/996-144-0x0000000000000000-mapping.dmp

Download
memory/1004-107-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1140-66-0x0000000000000000-mapping.dmp

Download
memory/1304-146-0x0000000000000000-mapping.dmp

Download
memory/1380-167-0x0000000000000000-mapping.dmp

Download
memory/2188-124-0x0000000000000000-mapping.dmp

Download
memory/2328-168-0x0000000000000000-mapping.dmp

Download
memory/2372-145-0x0000000000000000-mapping.dmp

Download
memory/2452-166-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/2512-149-0x0000000002F10000-0x0000000002F11000-memory.dmp

Filesize
4KB

Download
memory/2512-62-0x000007FEFBD61000-0x000007FEFBD63000-memory.dmp

Filesize
8KB

Download
memory/2588-142-0x0000000000000000-mapping.dmp

Download
memory/2676-60-0x0000000077690000-0x0000000077691000-memory.dmp

Filesize
4KB

Download
memory/2888-63-0x0000000000000000-mapping.dmp

Download
memory/2940-135-0x0000000000000000-mapping.dmp

Download