ryuk | 00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de

Analysis

max time kernel
591s
max time network
1213s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
06-05-2022 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
Size

448KB
MD5

bf7b854542cfa423dee3b7233c4a255e
SHA1

a9b09989972cc063b34c4afcd82ebe9203d61be2
SHA256

00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de
SHA512

147205767585c86b29435ca44a605d06208b7e126007fbc3d5a8c1a30896f03c0d832c07608895cd1e14b3966853306ebac1058f02c2e68efc8f89fad938cada

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\en-US\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\drivers\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe

Executes dropped EXE 2 IoCs

pid	Process
4340	JaVfWtE.exe
1244	JaVfWtE.exe

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\EnableAdd.crw.RYK	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Users\Admin\Pictures\MoveRestore.tif.RYK	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Users\Admin\Pictures\ShowExit.crw.RYK	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Users\Admin\Pictures\UnblockUninstall.tif.RYK	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Users\Admin\Pictures\WatchDisable.tif.RYK	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	JaVfWtE.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
908	icacls.exe
408	icacls.exe
6028	icacls.exe
6172	icacls.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\DiagSvcs\fr-FR\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_bc859d32f3e2f0d5\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_f83138380f5fb6ab\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\es-ES\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mchgr.inf_amd64_399f04975a0af112\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\tsusbhubfilter.inf_amd64_283a44fe508f0682\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\ja-JP\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\c_fscompression.inf_amd64_2aa5f249d7ee104a\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hidir.inf_amd64_7bf4a320e4ec8b3d\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\InstallShield\setupdir\0008\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkTransition\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\DriverStore\en-US\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\Licenses\OEM\Professional\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\de-DE\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mdmneuhs.inf_amd64_eb59a40d88060ada\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mdmusrsp.inf_amd64_4c83ce3a06d0048e\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\PerceptionSimulation\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigCI\ja-JP\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\es-ES\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\LogFiles\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\basicdisplay.inf_amd64_65ab9a260dbf7467\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\usbaudio2.inf_amd64_8d164ac6f7088f97\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\es-ES\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mdmadc.inf_amd64_7b6fc0e15997ce81\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\es-ES\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\bthspp.inf_amd64_bdb56f181ef6934c\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\c_hdc.inf_amd64_6e00e835fbceac58\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\rspndr.inf_amd64_4e80c2bb5314f071\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\sdfrd.inf_amd64_25779da6eca4810a\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wvmic_shutdown.inf_amd64_bce6891915e70bbf\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\es-ES\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\halextintclpiodma.inf_amd64_7f59f2c73a7fab14\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mdmsun1.inf_amd64_5b6db32fd04403a3\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\MUI\0C0A\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\spp\tokens\ppdlic\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\de\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_a009d240f9b4a192\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xusb22.inf_amd64_d0f2fd4c931f4672\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\XPSViewer\de-DE\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\smrvolume.inf_amd64_9a3d52a168ca8fee\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\InstallShield\setupdir\0003\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\slmgr\0C0A\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\Speech\SpeechUX\de-DE\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\Tasks\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mdmdyna.inf_amd64_d89605b6b478d768\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\nulhprs8.inf_amd64_e65ae5a38cb839e5\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\icsxml\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\it\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\en-US\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\ja-JP\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\WCN\fr-FR\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\International\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2784 set thread context of 4016	2784	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	82
PID 4340 set thread context of 1244	4340	JaVfWtE.exe	87

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.RYK	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.RYK	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\el\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionSmallTile.scale-125.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-200_contrast-black.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\ui-strings.js.RYK	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ppd.xrm-ms	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\Square44x44Logo.scale-200.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionSmallTile.scale-400.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyView.scale-400.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\HelpAndFeedback\BlogThumbnail.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36_altform-unplated.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Coverage.ps1	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WHOOSH.WAV	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\PAPYRUS.ELM	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\resources.pri	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-80_altform-unplated.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\AppxSignature.p7x	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\SoftLandingAssetLight.gif	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Info2x.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-100.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-125_contrast-white.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailBadge.scale-100.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-300.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-60_altform-unplated_contrast-high.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-cn\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\PREVIEW.GIF	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\vlc.mo	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailBadge.scale-125.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fr-fr\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\icons_ie8.gif	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\pt-PT.pak	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.RYK	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\COPYRIGHT	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.RYK	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\proof.en-us.msi.16.en-us.vreg.dat.RYK	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-down.svg.RYK	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\WideTile.scale-200_contrast-white.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.RYK	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-cn_get.svg.RYK	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-200.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\dd_arrow_small2x.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\Entities.DATA.RYK	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\LogoBeta.png.DATA	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\IRIS.INF	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\proofing.msi.16.en-us.vreg.dat	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_SplashScreen.scale-100.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookLargeTile.scale-125.png	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\resources.pri	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ar-SA\View3d\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.RYK	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\DEEPBLUE.ELM.RYK	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-advpack.resources_31bf3856ad364e35_11.0.19041.1_ja-jp_5a2f480a047b01c2\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-r..ry-editor.resources_31bf3856ad364e35_10.0.19041.1_de-de_12261ed8e79f7d59\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-t..cheduler-apis-proxy_31bf3856ad364e35_10.0.19041.906_none_be2d2e04aea57ee1\r\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-guest-network-service_31bf3856ad364e35_10.0.19041.964_none_4b77111169c26d4a\n\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\f\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-xaml-maps.resources_31bf3856ad364e35_10.0.19041.1_de-de_4eb2af9bb0cdd210\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_windows-media-speech-winrt.resources_31bf3856ad364e35_10.0.19041.789_ja-jp_70b3a8eeb0d63408\f\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.19041.1_bg-bg_4dd3ee60dda9fdd0\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-p..inscripts.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_fdc36002dd549a52\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_hyperv-integrationservices_31bf3856ad364e35_10.0.19041.1_none_fe9ddd3ef5f118e5\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_mdmusrk1.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_11a7086f797169ff\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-hal_31bf3856ad364e35_10.0.19041.1151_none_1ff907b40ed3d811\f\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..-comm-dll.resources_31bf3856ad364e35_10.0.19041.1_en-us_73a0f7eac168b613\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-mfreadwrite_31bf3856ad364e35_10.0.19041.746_none_974f32d076d3b2e3\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..erybroker.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_b3ac06c84c6f3c10\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-directx-xaudio2_9_31bf3856ad364e35_10.0.19041.1288_none_bb4ae491f259a357\r\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-iis-bpa.resources_31bf3856ad364e35_10.0.19041.1_en-us_4e12068e40413ded\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_de-de_8f036069906be12f\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ndisuio.resources_31bf3856ad364e35_10.0.19041.1_en-us_5243fbc0ded0c5bf\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_c2a2211ad648e627\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-scripting-jscript_31bf3856ad364e35_11.0.19041.264_none_aece47beb3db0927\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\rescache\_merged\242531539\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-activationmanager_31bf3856ad364e35_10.0.19041.1151_none_d3bbe3071f172827\f\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-nslookup.resources_31bf3856ad364e35_10.0.19041.1_de-de_86d227be2568ab42\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..package-managed-api_31bf3856ad364e35_10.0.19041.153_none_5ed8a2e007374256\r\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-undockeddevkit_31bf3856ad364e35_10.0.19041.153_none_3063e84316f81cdd\f\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_multipoint-wmssharinghost.resources_31bf3856ad364e35_10.0.19041.1_es-es_d26eb66b6ca20cf3\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-acledit_31bf3856ad364e35_10.0.19041.1_none_2827381e30503ebc\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-p..otifications-client_31bf3856ad364e35_10.0.19041.746_none_e239837f1e3b24c4\f\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_libressl-components-onecore_31bf3856ad364e35_10.0.19041.1_none_a51f330973ed5c23\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-m..imedia-broadcastdvr_31bf3856ad364e35_10.0.19041.264_none_6d5430580a7601d9\f\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-f..truetype-ebrimabold_31bf3856ad364e35_10.0.19041.1_none_e73f502bddc74e95\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..track-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_72489ec7c8a70cca\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft.appv.appv..mconsumer.resources_31bf3856ad364e35_10.0.19041.1_it-it_d09fce6d4d86bd63\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\wow64_windows-internal-ga..forcefeedback-winrt_31bf3856ad364e35_10.0.19041.264_none_dce7e1ee9d4882f1\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-label.resources_31bf3856ad364e35_10.0.19041.1_es-es_9c8425d843b0a9a1\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-legacysystemsettings_31bf3856ad364e35_10.0.19041.1_none_dc69aeb038f6d69a\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Design.Resources\2.0.0.0_es_b03f5f7f11d50a3a\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P39041136#\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\aspnet_regbrowsers.resources\v4.0_4.0.0.0_de_b03f5f7f11d50a3a\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_dual_prnms004.inf_31bf3856ad364e35_10.0.19041.1_none_f59945c05aa85d79\Amd64\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_c_floppydisk.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_4e0c091a021d5487\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-winsrv.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_228a957b610f7e87\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-onecore-a..sourcepolicy-client_31bf3856ad364e35_10.0.19041.546_none_e319a13e33d21f29\f\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-s..extension.resources_31bf3856ad364e35_10.0.19041.1_it-it_2d7286fb5d9f709c\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..rvice-daf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4be48725b2499112\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-r..verycenter-platform_31bf3856ad364e35_10.0.19041.153_none_212a5b73f083deb3\f\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_stexstor.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fb4bee5925d6ef7\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-mccs-syncproxy_31bf3856ad364e35_10.0.19041.746_none_d8d545bd06981c80\f\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-runas_31bf3856ad364e35_10.0.19041.1_none_202e011a312bab1d\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions.Design.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-u..latform-facilitator_31bf3856ad364e35_10.0.19041.572_none_703d07b8bfd6f277\f\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..gement-vdsinterface_31bf3856ad364e35_10.0.19041.1_none_5b4913debe6044ba\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-wlangpui_31bf3856ad364e35_10.0.19041.1_none_f66dddbea9efde6c\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.19041.1_fi-fi_5b82975c7223fe3a\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-e..orerframe.resources_31bf3856ad364e35_10.0.19041.1_de-de_6078e80da3221f23\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-pnrphelperclass_31bf3856ad364e35_10.0.19041.746_none_cec77743c8946ec9\f\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-u..kedshutdown-library_31bf3856ad364e35_10.0.19041.746_none_762af54268a9d3a6\r\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
File opened for modification	C:\Windows\WinSxS\amd64_dual_prnms011.inf_31bf3856ad364e35_10.0.19041.1_none_7aecd5910914aee5\RyukReadMe.html	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
948840	1244	WerFault.exe	87

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "3465"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "818"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "972"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "972"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "6136"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "818"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7547"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "912"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "2"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "6136"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "972"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "129"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "912"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "162"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "4075"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "4075"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "55"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "82"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "807"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "807"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "818"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "162"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "7547"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "129"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3465"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "912"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1019"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "55"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "82"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1019"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "22"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "82"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4075"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "7547"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1019"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "22"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "807"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "162"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "55"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "3465"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "22"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "129"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "6136"	SearchApp.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
1244	JaVfWtE.exe
1244	JaVfWtE.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
1244	JaVfWtE.exe
1244	JaVfWtE.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
1244	JaVfWtE.exe
1244	JaVfWtE.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
1244	JaVfWtE.exe
1244	JaVfWtE.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
1244	JaVfWtE.exe
1244	JaVfWtE.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
1244	JaVfWtE.exe
1244	JaVfWtE.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
1244	JaVfWtE.exe
1244	JaVfWtE.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
1244	JaVfWtE.exe
1244	JaVfWtE.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
1244	JaVfWtE.exe
1244	JaVfWtE.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
1244	JaVfWtE.exe
1244	JaVfWtE.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2784	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4340	JaVfWtE.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
Token: SeBackupPrivilege	1244	JaVfWtE.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
250636	SearchApp.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2784	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
4340	JaVfWtE.exe
250636	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 4016	2784	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	82
PID 2784 wrote to memory of 4016	2784	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	82
PID 2784 wrote to memory of 4016	2784	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	82
PID 2784 wrote to memory of 4016	2784	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	82
PID 4016 wrote to memory of 4340	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	84
PID 4016 wrote to memory of 4340	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	84
PID 4016 wrote to memory of 4340	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	84
PID 4016 wrote to memory of 4140	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	85
PID 4016 wrote to memory of 4140	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	85
PID 4016 wrote to memory of 4140	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	85
PID 4340 wrote to memory of 1244	4340	JaVfWtE.exe	87
PID 4340 wrote to memory of 1244	4340	JaVfWtE.exe	87
PID 4340 wrote to memory of 1244	4340	JaVfWtE.exe	87
PID 4016 wrote to memory of 1924	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	88
PID 4016 wrote to memory of 1924	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	88
PID 4016 wrote to memory of 1924	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	88
PID 4340 wrote to memory of 1244	4340	JaVfWtE.exe	87
PID 4140 wrote to memory of 4504	4140	net.exe	90
PID 4140 wrote to memory of 4504	4140	net.exe	90
PID 4140 wrote to memory of 4504	4140	net.exe	90
PID 1924 wrote to memory of 2100	1924	net.exe	91
PID 1924 wrote to memory of 2100	1924	net.exe	91
PID 1924 wrote to memory of 2100	1924	net.exe	91
PID 4016 wrote to memory of 908	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	92
PID 4016 wrote to memory of 908	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	92
PID 4016 wrote to memory of 908	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	92
PID 4016 wrote to memory of 408	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	97
PID 4016 wrote to memory of 408	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	97
PID 4016 wrote to memory of 408	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	97
PID 4016 wrote to memory of 2468	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	95
PID 4016 wrote to memory of 2468	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	95
PID 4016 wrote to memory of 2468	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	95
PID 4016 wrote to memory of 2300	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	98
PID 4016 wrote to memory of 2300	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	98
PID 4016 wrote to memory of 2300	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	98
PID 4016 wrote to memory of 4648	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	100
PID 4016 wrote to memory of 4648	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	100
PID 4016 wrote to memory of 4648	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	100
PID 2300 wrote to memory of 4516	2300	net.exe	102
PID 2300 wrote to memory of 4516	2300	net.exe	102
PID 2300 wrote to memory of 4516	2300	net.exe	102
PID 4648 wrote to memory of 4112	4648	net.exe	103
PID 4648 wrote to memory of 4112	4648	net.exe	103
PID 4648 wrote to memory of 4112	4648	net.exe	103
PID 1244 wrote to memory of 6028	1244	JaVfWtE.exe	104
PID 1244 wrote to memory of 6028	1244	JaVfWtE.exe	104
PID 1244 wrote to memory of 6028	1244	JaVfWtE.exe	104
PID 1244 wrote to memory of 6172	1244	JaVfWtE.exe	105
PID 1244 wrote to memory of 6172	1244	JaVfWtE.exe	105
PID 1244 wrote to memory of 6172	1244	JaVfWtE.exe	105
PID 1244 wrote to memory of 6300	1244	JaVfWtE.exe	106
PID 1244 wrote to memory of 6300	1244	JaVfWtE.exe	106
PID 1244 wrote to memory of 6300	1244	JaVfWtE.exe	106
PID 1244 wrote to memory of 7724	1244	JaVfWtE.exe	110
PID 1244 wrote to memory of 7724	1244	JaVfWtE.exe	110
PID 1244 wrote to memory of 7724	1244	JaVfWtE.exe	110
PID 7724 wrote to memory of 7868	7724	net.exe	112
PID 7724 wrote to memory of 7868	7724	net.exe	112
PID 7724 wrote to memory of 7868	7724	net.exe	112
PID 4016 wrote to memory of 79228	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	121
PID 4016 wrote to memory of 79228	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	121
PID 4016 wrote to memory of 79228	4016	00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe	121
PID 79228 wrote to memory of 79716	79228	net.exe	123
PID 79228 wrote to memory of 79716	79228	net.exe	123

C:\Users\Admin\AppData\Local\Temp\00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
"C:\Users\Admin\AppData\Local\Temp\00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Users\Admin\AppData\Local\Temp\00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe
  "C:\Users\Admin\AppData\Local\Temp\00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de.exe"
  2⤵
  - Drops file in Drivers directory
  - Modifies extensions of user files
  - Checks computer location settings
  - Drops startup file
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Users\Admin\AppData\Local\Temp\JaVfWtE.exe
    "C:\Users\Admin\AppData\Local\Temp\JaVfWtE.exe" 8 LAN
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\JaVfWtE.exe
      "C:\Users\Admin\AppData\Local\Temp\JaVfWtE.exe" 8 LAN
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1244
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\*" /grant Everyone:F /T /C /Q
        5⤵
        Modifies file permissions
        
        PID:6028
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "D:\*" /grant Everyone:F /T /C /Q
        5⤵
        Modifies file permissions
        
        PID:6172
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c vssadmin.exe Delete Shadows /all /quiet
        5⤵
        
        PID:6300
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:7724
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:7868
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:96540
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:96588
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:192868
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:193276
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:248864
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:248916
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:250564
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:250616
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:281292
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:281340
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:392828
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:2516
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:517832
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:518000
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:533900
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:533956
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:557544
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:557588
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:577608
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:577668
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:584156
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:584200
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:593724
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:593768
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:629364
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:629592
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:681968
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:682004
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:726364
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:726480
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:784392
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:784452
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:826956
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:827072
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:870888
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:871076
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:917748
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:917800
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:943816
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:943860
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:249816
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:249812
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:944124
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:944104
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" stop "samss" /y
        5⤵
        
        PID:249760
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "samss" /y
        6⤵
        
        PID:812092
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 239912
        5⤵
        Program crash
        
        PID:948840
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "audioendpointbuilder" /y
      4⤵
      PID:4504
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:2100
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\*" /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    PID:908
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin.exe Delete Shadows /all /quiet
    3⤵
    PID:2468
- - C:\Windows\SysWOW64\icacls.exe
    icacls "D:\*" /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    PID:408
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "audioendpointbuilder" /y
      4⤵
      PID:4516
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:4112
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:79228
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:79716
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:81548
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:82128
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:167952
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:168164
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:170884
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:171552
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:248248
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:248312
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:248368
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:248424
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:249328
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:249384
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:249408
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:249460
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:252528
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:252580
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:252612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:252664
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:356632
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:357040
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:358084
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:358480
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:504232
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:504448
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:505444
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:506416
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:530312
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:530376
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:251824
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:530384
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:547728
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:547804
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:547768
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:530304
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:571596
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:571672
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:571640
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:571700
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:581660
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:581748
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:581692
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:581768
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:592088
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:592168
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:592116
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:592184
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:615864
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:615956
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:615856
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:615940
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:673080
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:673180
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:673088
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:673172
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:709736
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:709828
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:709728
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:709812
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:772420
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:772524
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:772412
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:772516
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:812120
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:812196
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:812112
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:812220
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:856500
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:856604
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:856492
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:856596
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:904136
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:904216
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:904144
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:904228
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:932700
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:932872
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:932708
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:932888
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:944064
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:943860
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:944056
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:943836
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:685456
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:249680
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:772536
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:249632
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:4848
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:785476
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:249592
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:249764
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:948964
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:949064
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:948980
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:949056
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:532244
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:532372
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:532256
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:532380
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:580560
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:581368
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:580492
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:571740
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:622612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:622724
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:622604
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:622688
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:671080
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:671304
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:670916
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:672460
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:798020
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:798392
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:798008
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:798496
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:822996
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:823100
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:823008
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:823112
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:854204
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:854212
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:854240
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:854172
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:886928
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:887052
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:886844
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:887036
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:906000
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:906144
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:905992
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:906136
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:98448
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:63956
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:64212
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:64504
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:520900
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:521072
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:520892
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:521380

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:250636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:250612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1244 -ip 1244
1⤵
PID:948804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_2c7a2658-1166-4e8e-b7f6-c01b4ff97801

Filesize
52B

MD5
93a5aadeec082ffc1bca5aa27af70f52

SHA1
47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

SHA256
a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

SHA512
df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

Download Submit
C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp.RYK

Filesize
338B

MD5
88c60d7ae9aaaf25284a0c50c55d4251

SHA1
9e83f993b2e0a7abb5af3759a0d79f684e148bf8

SHA256
b533e47a9d09458a4ddfb55045a465d3e1141c5607e7f73efed5873e4e863472

SHA512
8231353940bcd381ff92f8fdf4184ead4527ab0a71e4c3924302150f7b04612e3c77d04337877b88a9df929ee7eb3f454fcccc7b4f563229e16e2d02323c7489

Download Submit
C:\Users\Admin\.oracle_jre_usage\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\3D Objects\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst.RYK

Filesize
1KB

MD5
f93d97c8635960842088addfee365910

SHA1
4d22c0cf9260bdcd89fb87fedd234cf3089222ca

SHA256
5316c65714b6bc4bf34e6c548a18ecb27c67a78a9847085966da505caf23e7a4

SHA512
d65d305ba503b3e2de6b029c4f23fe3112020cf54f5dda042faabc31ec989521a268e440224f96005eac2291992f8d4af9bd1f6652894edb99f826307bdc6082

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst.RYK

Filesize
80KB

MD5
466d588d43e74cf9ec41eda054ec7322

SHA1
06e0129483e23ebb95e63b3e05c106d8f4240dfd

SHA256
9bff23c1e905a8e184152b82a4415b22dc16cade20b646aca47e1c56a3862998

SHA512
4d8fef357df350794227bfde0aa5970d27c5f9a6b1f888872fde056b31614196ddf27ca0f7cf347e6eca9e4cd1192499e01ecb14bd38417cd17416bc38f1cb05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Vault\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Sidebar\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\0\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\1033\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\AppCache\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\History\Low\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\History\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Packages\ActiveSync\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Packages\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\PeerDistRepub\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Publishers\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2609624493\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log.RYK

Filesize
2KB

MD5
502d6caffd3e6271f858a97171901597

SHA1
9430d73294040d4f8590e15fada7184db535d816

SHA256
15844871ea738a5f5d4e9a3269ca1db997d09406ee8a28783e18129411efec57

SHA512
f59ecb3d39dfaa269319c51ca5baead53058796a9d4750ee6ba4cfe77db649071f3f7e561590e4b1502c4eaf5ecb41291f6c4c6313839984d40eea58f7bb328f

Download Submit
C:\Users\Admin\AppData\Local\Temp\JVJHUWZP-20220414-2336.log.RYK

Filesize
58KB

MD5
2b006d21cd9c2ecef54bc36b57951bca

SHA1
79e62cd7bb8f1ffa4e3ac790afc74efc5d62180e

SHA256
f71ffd9c07be5b05e9d35a92da824af0d545715b9561dea5542655de45e3ce62

SHA512
9c9074b637a3e6f9782597f43c801fc09f1baf88697dd8c1f6e44233b0a2e69f099617902f1d33221f1547914b093c37dd98f48851dc14cde9aa7a4190d81b2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\JVJHUWZP-20220414-2336a.log.RYK

Filesize
187KB

MD5
e564d28640204d24ad4b3b1e86a43c66

SHA1
feb3c0d8e1fcd56cac5e9a32ecdca84b72b7bb78

SHA256
a9714987b454feb26d35df7ba9fed4e0e391b08b1e2370dee36abb0c06e2bd5e

SHA512
f8ce70d790688910f373db1b8e267758286f0ecbd82a7697791cb73e95f04c4d101f6dfb9c30ac46a5efb3ec16656be9faa5ea3c7020936bdc9bc06a97b233b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\JaVfWtE.exe

Filesize
448KB

MD5
bf7b854542cfa423dee3b7233c4a255e

SHA1
a9b09989972cc063b34c4afcd82ebe9203d61be2

SHA256
00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de

SHA512
147205767585c86b29435ca44a605d06208b7e126007fbc3d5a8c1a30896f03c0d832c07608895cd1e14b3966853306ebac1058f02c2e68efc8f89fad938cada

Download Submit
C:\Users\Admin\AppData\Local\Temp\JaVfWtE.exe

Filesize
448KB

MD5
bf7b854542cfa423dee3b7233c4a255e

SHA1
a9b09989972cc063b34c4afcd82ebe9203d61be2

SHA256
00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de

SHA512
147205767585c86b29435ca44a605d06208b7e126007fbc3d5a8c1a30896f03c0d832c07608895cd1e14b3966853306ebac1058f02c2e68efc8f89fad938cada

Download Submit
C:\Users\Admin\AppData\Local\Temp\JaVfWtE.exe

Filesize
448KB

MD5
bf7b854542cfa423dee3b7233c4a255e

SHA1
a9b09989972cc063b34c4afcd82ebe9203d61be2

SHA256
00dd4a371156258e4fe3c421c044b0244500df971ae37b8ea6650fd45ad8c9de

SHA512
147205767585c86b29435ca44a605d06208b7e126007fbc3d5a8c1a30896f03c0d832c07608895cd1e14b3966853306ebac1058f02c2e68efc8f89fad938cada

Download Submit
C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log.RYK

Filesize
25KB

MD5
00c1c6e5c498ccea56383842cacf9664

SHA1
cd0bdb60e46d320c4f17f89dc7743e6c0632c0b1

SHA256
6ee3549f91b6901be60df306a8da8e25f24a684e2863e7c34ee0d2af033f02a9

SHA512
ef23eb1c06761c0c6bcafb6beb8e71923606c603ec8f1b7aeebc97f712da75a4b64ae58e73ee86d4eab0c1efa28a22eb3213a7932590a9341b814ee6ce03e1a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Temp\acrocef_low\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Temp\aria-debug-3732.log.RYK

Filesize
754B

MD5
46501a39230ff28143e76973f54f39d1

SHA1
84908acb17cd5eabf5471045dc48cdfdcd19dcbb

SHA256
f3ae4ad63dd54c1fb8dc1e8fd2580da1af063a7b69a6bc36f56a0065147b4ca4

SHA512
0e70021b67cef6bbf725e5f6c4d67a6c946bd13775389d8e81894732e9882daaecc720192ad2cf4ca1d76497051af430fe6a8313d535297c95480e63eea3d8f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log.RYK

Filesize
3KB

MD5
9ce53c28561e5af2dafac8a7e5ab445c

SHA1
9addbc7b81a9e286d8bc307618f42b2728635e2e

SHA256
c717017070323ae7111e1d8f61b8f1e0a1aeb4c1bab3d503af307828270b569d

SHA512
d5d4d33a423855fad8f6663d1e38c4d74ea84bf61a9b47811cdc85063a9fb4ee445ea49e18d15fa3cc875612aa9dd4a77f748b333143c269c174d020058bedf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI703B.txt.RYK

Filesize
428KB

MD5
c71691118907c41b19536795d576f0d5

SHA1
67f686abff0379c7798940bb02669a2f847f521f

SHA256
2b848959ac090ae0b3404402525fdc8da006cb89de939b0ef54491d152d1c987

SHA512
06446a3b8414f75683218a56ceea41bd9985e14c507b3ab1cafa289c3f94749b25cb00227e2a6dc0ee4a23be07214707f22c58a3a5e49f0afe07bf7e242b2622

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI7076.txt.RYK

Filesize
414KB

MD5
8da0a1ee090781e3b41479966f8b230e

SHA1
57622435bb5fb68cc4ea5576153514a63d023fe0

SHA256
efbc848501c4059dc47ffa5bc50905cc943912b817f9143aa03df7c784fca4c1

SHA512
ffbd5bb7a4468bf80f6f172cea61060707d82911afda61f9dc1607077c4c1c1911a4b16fde7ca7de50ab0bc4f79d7c86c1b39df9a8f72b85a3ef13dc4a7d1645

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI703B.txt.RYK

Filesize
11KB

MD5
89ad48d92ea1a1e5e300f102eedb4981

SHA1
61c4bcb953da711ca48479584fa1bbfdd2f6343f

SHA256
90e32ae7cafed7796d803b8f18ae0000bc5943ad1341d5546c67b8d80579fded

SHA512
37cc3f8333fccb87500aabfb1042b3c2c3b8844390c45bf86a75381285385153a69a1d5802851fb7c50ae9f9850d776c383aa645711ecd13e3437f51aa696ac1

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI7076.txt.RYK

Filesize
11KB

MD5
aa5f780f8a95c0d6e96b88e2d569813d

SHA1
9c4d6c0e4b19deca6a545b92b349474fd71331cd

SHA256
7ad93734a83b16a6bcb3f45e2cc0723c499d3689d181606822bba4b72889a98c

SHA512
6a481f1c3b540e8f386bc2352cdf360b3f894dac7380cb4a701b4d824d478e157cd5525e6fa84a7ba6defc0f0981d97cc188f306e2f4eb723a98d8121ab72986

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log.RYK

Filesize
266KB

MD5
250f1c9ee7fadff3571ac4df6336714e

SHA1
43a3a4216c211f3c5b305b966bde3a8aa57e3950

SHA256
2cd32d5c32f2fe854b4df09d9d1fb1327976205bcfc9de9fc7368fc288570dc5

SHA512
115adf1b25ad94fbe319fa7e406232e84a40e712a1738708479dd3c1386b9ff60235576dcbe2ecf02b631de32bf96b35a16285c0db1fb722aed56ae455cd1a27

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\RyukReadMe.html

Filesize
627B

MD5
5bfa9bbd92e2313dcebef3737e31fcd3

SHA1
1962115ecc2e5a1cd8077bcdcfa156d0647e71f5

SHA256
79d10ce3c722175cef4e348bd5fce74ffd82eadc3da71aa6b9f50a65c9d2aace

SHA512
024ae8ab82b080141c062188a6a8c3a6d014ac42a87ebb53492baf674cd482778c6abaf566c908a092fb7c4d35120004fff8141dda593cbceabe027c74cdd49e

Download Submit
C:\Users\Admin\AppData\Local\Temp\msedge_installer.log.RYK

Filesize
3KB

MD5
f0a7332ea9855d5d2deea65f336c4d54

SHA1
436e067be8101d65f4c0f31bcedb97e813acc17d

SHA256
34551a19dfa720f824719cd152a3ccabcf8bc4c12251435c946afe0e9a2f0db8

SHA512
cb37bb180c492003b1741a36e8778410896fda52a895d75ccb5fdf53ed4f71859773b0dd3522b3d6a498596591668c819cc4d9f68029ce964e25ad2e74627de4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2B58.tmp.RYK

Filesize
25.9MB

MD5
af463a13763116cfcd7edad7deef63af

SHA1
331eb662fb5cc8549c32587bc48af48ca2f93bc1

SHA256
83068aee02697b17fce64b9faf091a1456ff5e8bae23476521d6dfbc33de2ce3

SHA512
2ceed31974ff496908b335cd405b338c7a38608642c70a6d9cc37fd936757cd152d7088cac2280252499934d251456df623fd8b4960032c532dc8354326dff25

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2E74.tmp.RYK

Filesize
25.9MB

MD5
715e92d7b847bfd03a3ab6cede8c598a

SHA1
3c0ec0f354584fb733b5e3c0147c71cdfed4ced6

SHA256
a4b49007ab4a77bc3455118b942841e6036826c9f1e9d0159dbb5f3e44e2f433

SHA512
bff32b01b3799193eb313ca3543e9e75f2b04e1fec97ea2f1a9e6eb7c2c6001745f794259489edcadcf6a1f55a7b1148b22f7b40395da8dc0a33202f830758ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\wct2859.tmp.RYK

Filesize
55KB

MD5
a1e17ef5c4ee7ca3fa482a33a32e12d3

SHA1
65442cc273171dc296eb5de055d705e30f77f0c4

SHA256
a1159a632c7890dfccbcdbbc4d1e90add50ce132e810a33fb06df91fa4d0ce8f

SHA512
5a9f8fe73152f1a69fe572ede5882641bd56b2333597a30dcff1344b7436714a5722eac64ef617dee2f61b93446d2ed6dc007e380bdd92cd9214c1975961deb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\wct81E2.tmp.RYK

Filesize
55KB

MD5
be07188f2c3d678f33b8b4cdd9f297c1

SHA1
7bc315229fae7a872222cd02bc9423dfcd7aab3e

SHA256
f646491bc3f619e3f93447b119924a9b97fbe31d63f8ce2a48b05477cf35501c

SHA512
1760b174362a20bc767848a6c401e9b3a129ac8bbf577ecc3fc8143fba0d7f4ee764b91b78936d0c50891d707e77a557699c97bc405e19a7da66868a6910bde0

Download Submit
C:\Users\Admin\AppData\Local\Temp\wctAF0C.tmp.RYK

Filesize
40.2MB

MD5
5af78c36f9c2728fdd8ce9809217aed5

SHA1
622f14ad059ae494d33b5e93b7ef23e0cdfa44b1

SHA256
843a4e09e73cdd14e08de9bec9817fd3843195de5336ba504506f56bc96010ad

SHA512
cce057b37dc84f004592785d98e55f440e1cb29729f1d7c83e824dce54cc92e46de76fca88719bb645179a69181e4f8de2fb395e01e01361471ed5a57b87d7d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\wctB33D.tmp.RYK

Filesize
55KB

MD5
f7d69e288aea12cff2df06739e259c70

SHA1
b17032915befa778073c4b6fb756327c33b1fb05

SHA256
6c44e207f800328c61b93a810710d414e0e098504bea14ede81ffd5ccac1913e

SHA512
b2f5747b1bfc5928cc8b059f05a2aeb1abd2b26ac0b216a22449b39aa81f845ab78fb1d929127cfd74d9001f98ae9ef989bc9dd56fb9d06c57bbcbd4197723cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\wctC679.tmp.RYK

Filesize
55KB

MD5
4471101c6c87108c59fd693eae488ad6

SHA1
fb4ee0dfe10c954cb126e050311a3115bc070be6

SHA256
1b8b0a540ae07898c3440026a46d68a1f4e746bae5cefbe7c2f01baac199b8fa

SHA512
949dcbf309f44930c9090452f0f98114b758e7859333e0c3da2e1aed078f728da229f8609452c3bfbd1573b01d573804aa13f5f068968a40fd109d1d2a3489b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\wctEB2B.tmp.RYK

Filesize
55KB

MD5
7e28b8125b92fe97cef183940c0c1949

SHA1
2ad3f74f9bc4ac9e58d8f3353c196450eafc2300

SHA256
366ff0befb4720fd32bb5809356b4fe54e9febf0c5b947b21b36ccaca1cb51e7

SHA512
98f173010cbb0c4568cce01efb78c559709efebd3ca09bc1a515b07b6dc9f4d27a2186794d4f887c0f95270cfd807ff7512e91494d3d7e662959c8850d0f4067

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log.RYK

Filesize
978B

MD5
5940f5ce06e48354615236e6c591b40c

SHA1
d6b75c9de7caa5d7323cf0ac67965faa6261aa51

SHA256
45c3888e1a5fc95b3735b93b1fef22399e34c15464cbad42dadca6971ed956c5

SHA512
3d070696cda55e84ee6a9a8ecf96a6b14158440f975b08f5293cfb23e095229d6c759c587292fe0a2df136974ff9f088145156e5ad37fd310e5ef51bcf92a348

Download Submit
memory/2784-135-0x0000000002480000-0x00000000024B6000-memory.dmp

Filesize
216KB

Download
memory/2784-130-0x00000000024C0000-0x00000000024F8000-memory.dmp

Filesize
224KB

Download
memory/4340-139-0x0000000002160000-0x0000000002198000-memory.dmp

Filesize
224KB

Download
memory/250636-252-0x000001F672440000-0x000001F672460000-memory.dmp

Filesize
128KB

Download
memory/250636-254-0x000001F672400000-0x000001F672420000-memory.dmp

Filesize
128KB

Download
memory/250636-255-0x000001F672780000-0x000001F6727A0000-memory.dmp

Filesize
128KB

Download
memory/250636-340-0x000001EE00009000-0x000001EE0000D000-memory.dmp

Filesize
16KB

Download
memory/250636-341-0x000001EE00009000-0x000001EE0000D000-memory.dmp

Filesize
16KB

Download
memory/250636-343-0x000001EE00009000-0x000001EE0000D000-memory.dmp

Filesize
16KB

Download
memory/250636-342-0x000001EE00009000-0x000001EE0000D000-memory.dmp

Filesize
16KB

Download
memory/250636-344-0x000001EE00009000-0x000001EE0000D000-memory.dmp

Filesize
16KB

Download
memory/250636-347-0x000001F673C68000-0x000001F673C70000-memory.dmp

Filesize
32KB

Download
memory/250636-376-0x000001EE00004000-0x000001EE00008000-memory.dmp

Filesize
16KB

Download
memory/250636-377-0x000001EE00004000-0x000001EE00008000-memory.dmp

Filesize
16KB

Download
memory/250636-378-0x000001EE00004000-0x000001EE00008000-memory.dmp

Filesize
16KB

Download
memory/250636-379-0x000001EE00004000-0x000001EE00008000-memory.dmp

Filesize
16KB

Download
memory/250636-382-0x000001EE00008000-0x000001EE0000B000-memory.dmp

Filesize
12KB

Download
memory/250636-384-0x000001EE00008000-0x000001EE0000B000-memory.dmp

Filesize
12KB

Download
memory/250636-385-0x000001EE00008000-0x000001EE0000B000-memory.dmp

Filesize
12KB

Download
memory/250636-383-0x000001EE00008000-0x000001EE0000B000-memory.dmp

Filesize
12KB

Download