aeb232d84afc6c6d95ea92940cee4c7707126b8204b95d6707f75a1eeec8a217

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe
Size

38.2MB
MD5

0d6f1a17bc5c87c304d2ba6ff25801e9
SHA1

69754bff37cf31ed4912a3a58c535ee3ac69d696
SHA256

aeb232d84afc6c6d95ea92940cee4c7707126b8204b95d6707f75a1eeec8a217
SHA512

78b7c4f149152e5bd15907b49a3fe392ddfb5b7af0a847357ca13db264eb204a5148e2ffb2d501dc38161a2bdb80f6c586fd0d027a1638dfb71d0a13aa69235e
SSDEEP

786432:l7YfqVD/drU8AkFI4ecXUEZBKRj06pysShPULwI6Kgvn:efmD/dA9kFnzUEXKRjFkJhUc

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

MsiExec.exe

pid process

2680 MsiExec.exe
2680 MsiExec.exe
Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

3 2560 msiexec.exe

pid	process
2680	MsiExec.exe
2680	MsiExec.exe

flow	pid	process
3	2560	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Windows directory 7 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f7712c6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7712c6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2180.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3510.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 43 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001255014099da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\cybermania.ws\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\cybermania.ws	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420452146"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29856E01-0533-11EF-BCB4-4AADDC6219DF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000f95ae9ab04028d4ad385d8929fa5c6a2e4fbd2aefdfdc190a4a7847c2c723126000000000e8000000002000020000000c594172c9b583d3ed77e1faad52474c9b4787f5d9535d4fa03250076765ce69d20000000a86aa72e7619f47e6c81f1d74f70c1f25d32c80510a01de9b88ccd2a24b098df40000000c40fad484c4351e71e629af184411c083c771f443677fbc146a45369c9c23181dfb78152be3ff026872bb3f746eb026a0abe47d71f677b7533016641afe544f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000021a1f43e7436f7c07624537d2b79aa02f5557dd3437ae859bcd41f5b4e391013000000000e8000000002000020000000262984e175aea70570ec19a9e55777b08410aeb8162a6291d63401f08edbe654900000009c2c7c2dc8dadafe6e069b29d5d79a3df59e917528e89a71e244755a2d810f443c976dcc316a1e20962aeb8bc1f79af21c26ed8380f5e9d04c99cb5c89600f7f1e6a9cf91f7818a63704739c2bb8617956b3004312b6e9ce217dd4b6d13aef0e1f212a8b9605e9b1d4b10c2a0118c1cc2c3edd8b0c90b4bbf3c018612b3cdf17cdd24cc6ab0c630feb5a26e7d87d6a7d40000000c473050240830cd7e66188e23417c180cfddbe80de3c553ec7fb9008fff41f94a8926d492a7ba5aaf87f19e773a335fd8844e9a1d247f0a5995f9df133147415	iexplore.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

NTFS ADS 1 IoCs

Processes:

IEXPLORE.EXE

description ioc process

File created C:\Users\Admin\AppData\Local\Temp\RarSFX0\CyberMania.URL:favicon IEXPLORE.EXE

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\RarSFX0\CyberMania.URL:favicon	IEXPLORE.EXE

Suspicious use of AdjustPrivilegeToken 55 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	2096	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2096	msiexec.exe
Token: SeRestorePrivilege	2560	msiexec.exe
Token: SeTakeOwnershipPrivilege	2560	msiexec.exe
Token: SeSecurityPrivilege	2560	msiexec.exe
Token: SeCreateTokenPrivilege	2096	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2096	msiexec.exe
Token: SeLockMemoryPrivilege	2096	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2096	msiexec.exe
Token: SeMachineAccountPrivilege	2096	msiexec.exe
Token: SeTcbPrivilege	2096	msiexec.exe
Token: SeSecurityPrivilege	2096	msiexec.exe
Token: SeTakeOwnershipPrivilege	2096	msiexec.exe
Token: SeLoadDriverPrivilege	2096	msiexec.exe
Token: SeSystemProfilePrivilege	2096	msiexec.exe
Token: SeSystemtimePrivilege	2096	msiexec.exe
Token: SeProfSingleProcessPrivilege	2096	msiexec.exe
Token: SeIncBasePriorityPrivilege	2096	msiexec.exe
Token: SeCreatePagefilePrivilege	2096	msiexec.exe
Token: SeCreatePermanentPrivilege	2096	msiexec.exe
Token: SeBackupPrivilege	2096	msiexec.exe
Token: SeRestorePrivilege	2096	msiexec.exe
Token: SeShutdownPrivilege	2096	msiexec.exe
Token: SeDebugPrivilege	2096	msiexec.exe
Token: SeAuditPrivilege	2096	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2096	msiexec.exe
Token: SeChangeNotifyPrivilege	2096	msiexec.exe
Token: SeRemoteShutdownPrivilege	2096	msiexec.exe
Token: SeUndockPrivilege	2096	msiexec.exe
Token: SeSyncAgentPrivilege	2096	msiexec.exe
Token: SeEnableDelegationPrivilege	2096	msiexec.exe
Token: SeManageVolumePrivilege	2096	msiexec.exe
Token: SeImpersonatePrivilege	2096	msiexec.exe
Token: SeCreateGlobalPrivilege	2096	msiexec.exe
Token: SeBackupPrivilege	2456	vssvc.exe
Token: SeRestorePrivilege	2456	vssvc.exe
Token: SeAuditPrivilege	2456	vssvc.exe
Token: SeBackupPrivilege	2560	msiexec.exe
Token: SeRestorePrivilege	2560	msiexec.exe
Token: SeRestorePrivilege	2252	DrvInst.exe
Token: SeRestorePrivilege	2252	DrvInst.exe
Token: SeRestorePrivilege	2252	DrvInst.exe
Token: SeRestorePrivilege	2252	DrvInst.exe
Token: SeRestorePrivilege	2252	DrvInst.exe
Token: SeRestorePrivilege	2252	DrvInst.exe
Token: SeRestorePrivilege	2252	DrvInst.exe
Token: SeLoadDriverPrivilege	2252	DrvInst.exe
Token: SeLoadDriverPrivilege	2252	DrvInst.exe
Token: SeLoadDriverPrivilege	2252	DrvInst.exe
Token: SeRestorePrivilege	2560	msiexec.exe
Token: SeTakeOwnershipPrivilege	2560	msiexec.exe
Token: SeRestorePrivilege	2560	msiexec.exe
Token: SeTakeOwnershipPrivilege	2560	msiexec.exe
Token: SeRestorePrivilege	2560	msiexec.exe
Token: SeTakeOwnershipPrivilege	2560	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msiexec.exeiexplore.exe

pid process

2096 msiexec.exe
2096 msiexec.exe
628 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

628 iexplore.exe
628 iexplore.exe
1048 IEXPLORE.EXE
1048 IEXPLORE.EXE
1048 IEXPLORE.EXE
1048 IEXPLORE.EXE

pid	process
2096	msiexec.exe
2096	msiexec.exe
628	iexplore.exe

pid	process
628	iexplore.exe
628	iexplore.exe
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exemsiexec.exeiexplore.exe

description	pid	process	target process
PID 1704 wrote to memory of 2096	1704	2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe	msiexec.exe
PID 1704 wrote to memory of 2096	1704	2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe	msiexec.exe
PID 1704 wrote to memory of 2096	1704	2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe	msiexec.exe
PID 1704 wrote to memory of 2096	1704	2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe	msiexec.exe
PID 1704 wrote to memory of 2096	1704	2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe	msiexec.exe
PID 2560 wrote to memory of 2680	2560	msiexec.exe	MsiExec.exe
PID 2560 wrote to memory of 2680	2560	msiexec.exe	MsiExec.exe
PID 2560 wrote to memory of 2680	2560	msiexec.exe	MsiExec.exe
PID 2560 wrote to memory of 2680	2560	msiexec.exe	MsiExec.exe
PID 2560 wrote to memory of 2680	2560	msiexec.exe	MsiExec.exe
PID 628 wrote to memory of 1048	628	iexplore.exe	IEXPLORE.EXE
PID 628 wrote to memory of 1048	628	iexplore.exe	IEXPLORE.EXE
PID 628 wrote to memory of 1048	628	iexplore.exe	IEXPLORE.EXE
PID 628 wrote to memory of 1048	628	iexplore.exe	IEXPLORE.EXE

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ehs_nt64.msi" /qb PRODUCTTYPE=eis CFG_POTENTIALLYUNWANTED_ENABLED=0 CFG_LIVEGRID_ENABLED=0 FIRSTSCAN_ENABLE=0 CFG_EPFW_MODE=0 ACTIVATION_DLG_SUPPRESS=0
2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2096

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding B6ADCEE9F4A25931D98151B2DCC93357
2⤵
- Loads dropped DLL
PID:2680

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003AC" "00000000000003B0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:628 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1048

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_8BB34D7AC6ADCC019FE5325FE9DECAE8
Filesize
471B

MD5
377ec11bf4e0ce126547ebb313dfe86a

SHA1
6b26f6cff6ec90313aa1d8e5debc326b33b9461e

SHA256
f64716d3b2af1707ea30f1f1227526a2cacc0d6fa5677fff3892e190c1f771e6

SHA512
45c5ee5b255dcd214714f5328a8fb3784ac372ed14b7c2273cbad4c5de811a9d8b533c6ef9bef5c425715dc6e5a0fb951a4e1f38791ace9c95d96bc0435a6c76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
252B

MD5
dac09195d7900ece68d70df3a8a2356f

SHA1
2c6187e627649458e784b318102a4f75fe4a7744

SHA256
24369fef7a443a46d71df0d04adf8cdb6e1991501887418682adc4e93588f06d

SHA512
929337a69bd88557ba038af3e08a1e1620f092e591d57f4d06c14141f00818c2335f4572779d1f7544a4cc808d72132f765d927e2a23bb46a6729f6fa2789e15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
12e5463697a8fca623dcc432990eaf41

SHA1
609b79d6261a3e03b6b09df709ca12006bdd98f0

SHA256
6700174c64f9dc84d2b26ea3d394ec413da0f09ecf13fa17406ae8d481e29c9c

SHA512
5654665c0f6a7b5f1d09ad4c52b822e9053165d98c8850b9f3d87d505bebdf84918a4f6235cd3c029ef2ba3fb9887ae909d486f7bffb586973aa4ef165add857

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
eecfaeda2469f9dd2dbdb3fbb2dde8e3

SHA1
614e6a08c8db600c8c0edee1f84cc578bb01c89b

SHA256
4735631bc9342c2babd7544cfe366cd59ae09b443a92af4e3b13388c50ab59e3

SHA512
f683fd2b03b47f18147d23b859a2053fb5700a5a08035848f565dc4ddd82874eb363d3c1e8a8a37ef6cc5b242a1163e49cfa2ad591dc3d91c9cee8427a034f15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d001884fab90674e19e22b83045c373d

SHA1
5c1327d79856a43a3cae3fa52faf09d69c98b70a

SHA256
a47b8cbbf96a295db02cd883b470dcdad1b3959d3839d60a852e3447e4f8a0a7

SHA512
330dd0bbc2c72039e202f1f2dc14fc1c2063c1c7d189bbd5894911d9eeff3b321ee6926a5c20eb41cc64822004691d39913ff2e883af6e2c738736b86842e9f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ea000a588d2b52903798fc7a4ab06241

SHA1
ada02820a3c4374e52adcce30577b3644804f5ab

SHA256
4ef0eced540fdad83db68914d800c392f413c0ae419d69871de539cec4a909b7

SHA512
c79b75ed5e6b55d68bc51e0670e526d6dacb583ee18f54aa3451bf04286d5f1fb81954a30908d0fbc47b4b2c736202b5e304d85cf63fc59239b58cbc9f87237c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b34fb63cb0eb4c34df08cc3cd998f7dc

SHA1
96ac448310e198b3d2be087a5be499ec3353cf6e

SHA256
c1373d6a3d8c0c688aa9a2ae6a7fdbba4bb64a0f59909ff6e0f25353fa2c4699

SHA512
b2d82221e34fa4cff71b639d98a09211c5bc832949ee75418fffa9100fde151117f338926686ab69abae458cad1f92fa029c459b4bb42db5200d23450db0a64c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
374f73096f8420baf978fdcabd5074c8

SHA1
622757559fa74481e688a51f16b5fb9012ea91a7

SHA256
a2d97d462e2f89f3d41a7cf204151d2a2ba734014a82a97e4896452217c18f7a

SHA512
3dae02f1672136354f93881d3bedd829a9a369908c4c2c7c0c0a836dec58f7f0939aa325b315fa148bb9ddefc1300d552539c8fbc709672a5204cf05a3a7a921

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
fdeeeb716af0c69a5d16c15d49d8f7ee

SHA1
8e96efa165f4ef61191f490094a8947a8eb393aa

SHA256
a8733dcf1b3d3253e4ccfe02e27e674343c87b8011189189575839b4d7f021db

SHA512
ac8332715c5850e5572776d55d5d304d1cfddb090e297c2f0acc7bd6ff9d81a3ded5ebd760fd59b8acf65b6731be7761534d8f02bd1910d7502c4d9eaab97993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b464c3632c96a3a7be0bd6ca65abbc4c

SHA1
f670f2ad3a5442c1a45b0b735d1f25aa1f6bf1dd

SHA256
fa5733131650eacad27f55643a56a57680446f75f4630ce27151f4f1fbc2b9f2

SHA512
6fd28f709cc33372699c5a8d4d61ddb0f9d8363b6ddec2892a100ad2c9bb4012ca36fe7d635ae45cf65f7973892b25b078df2ab8cdd9b4ba18f6554389e9bcca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
00a9c6331deeb812fa4ed55d6acf2f5d

SHA1
3bf5b625679a0fcb5ab0d423e1a1b43e5a86c7b2

SHA256
18684d3a59a974fb808058b78b7f79c1efacbdd5e3e26cabe44b247d066ec5bc

SHA512
e91280a4fadb014d5610ebb211576c5a63e87ddfa94997b4b3df5c33d23760fcb751a06df283372f42bdb3037d798609191600dfb2feca93580f3b3a71b27193

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cef32241fc6960a3a4189ab2f9a1ddeb

SHA1
84f21d49421db3a048b28c8d2021044ed1060c1a

SHA256
91b1290446e206d93a2b0c88363450d995f1d4543a560eb199eb4b7f7c75bc1f

SHA512
7e00a37e17bb03db8cb6807035300921b0db5769e0317c5443fc24f5227df1f7450155c914fd4eb569b84f06938b3f2094e80b3e86f7c1f60dd9887cef2b190c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f5af2cce618db52e97654ee14dff6ca0

SHA1
7b4a3988867c97fcdaee9c22a7a62d5f225d1634

SHA256
97a2794fad93b777d4e6b9a7b1839c54b4c17e535a18179a8c8da4a395f347f7

SHA512
814cd74c55f62d7782c14a5d487de0382fa975a6ddeb3c5d03c18182dc9bf180563b1e0587dfc70a82c23edc2dce33a99c64e2171e117d9bfecb2263b3cf7edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ff861dd7b87c9dcaab9c1c82f1d085a2

SHA1
9f2da4fbab4ca9cc497f851b05005ddfb66bde65

SHA256
1a1653f0ab6b8c19c71db7145e1576c6c185568880f32ac9e9237ad966ebb933

SHA512
881c74cdba1eb3f7da1fec6868e1c6eec0dd2bfdaa278c4af93474a045300db4537bb980682462ebd4a149aa9a46bbbd8db8c666a86fca0d52d43a0b93993bbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
decccaaa77dd2f9e205ff8be1a98e89c

SHA1
d2d6994596439af8e01d0055aaf91bf361deb7c5

SHA256
a161d7d9e84c375ae7350e460a9b3bb5ce657578006321fcf522400247e56970

SHA512
2461f4b7dac6de6b131cfde61706d1f0a9701cbde45ab05d4db814e58386ee3bcee3a82f496e9d409fe2710d6df27014d629c7d7616421a9e7bfcbbd4376c3f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ff971aa469704bc922e167a92a5b3010

SHA1
c3f8412cfdca48d9418e55902de1055da7910140

SHA256
9b4b8f52edee6453cc5ae48f7735f3e35d523c76541cea3bdb42983986fb43c3

SHA512
46bbbb2926f89d12f5e34eceae3e27299b75ee0f37fea26f8b383a61f6a510bfdaa25ebb98551faa0a622aabc49a78688847e7fda5dd01d29bcb970b3148b821

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
af4336c4c9eca07652ec07fe2bd8d4ba

SHA1
be429ceae16dc71fa404e030c85a585b0cf0be9d

SHA256
fd2e02c65f0c9e2fe16d21dc8ab68a8ae9347b540951dcea904642088aac6088

SHA512
1dc44b541bd326ae3e4c9e7ba33d78adcb317bc49804f6797158a0d38f48ef632f742782996d96faabfc2ae435b451ac5d4c0367915625ebe6be51994184a2c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
be4263387a6f54ca817d33cd147f7dc4

SHA1
da764d2cfb5af8b90101b0071664f730300eb302

SHA256
c378d92f0ca8bf0c7ec6e70407293a6594fddcfff67094497b62687bee17b588

SHA512
5abd14d0474cb37769791b014485ae1dad2048802b55dc462274cd4a5ca18c1ffa37021afc52f6e3495b37f1ab53fb2dd1f0068cedaa7500dc894ee122961b46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f2b1037d7edf45438dbf311190c8fda4

SHA1
8dff2ff539b1ab1b238fd3604770bf570721562d

SHA256
62f37c61227d8add7a26f8877a3927103911fb72471c6564ac0aadce6a03b948

SHA512
e277c8c0423cfcc594473497800b2f0304699bd95b973cfd91fcaf709d4e407d8540db014c4cfe2bcbc3d7f4c38016ac42155ca1bf3ce86cc3be356bb3c1d46c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
113f95bd305fce091e3628167974116d

SHA1
b942ecd8fd9825d9e966ad3a1ea6b0af8f21a62f

SHA256
eb867632946c97760984006ed3943ee1a8b01a83817ebc574d8fbe6b886dd4fe

SHA512
db4d45807ec358e15428438f1cf7ece0d3758a0dcea6e813a636cbba4241cf017d1a3d3543a6322c1ec8f299682975d7207e00e03d4e937251caef9f4a90d93c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
40f55c70b05f3df68339a181c6b50cd3

SHA1
91353fddfe9446ea23b5c47a1e754928c5b21129

SHA256
16a049ea8c83b75593b6b76ed2e0da8698b5cd1ade382781a745ebb6441574d9

SHA512
e9bb64a7c06d9cbf869bca82eba297a68428ee3f8beed3dc905d173722ec4ee65be3a7cbc11d9768d0013cc1329f558793623d992244cc858decae5ad3187a5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
991bb948309b9e760f1c155139fb159d

SHA1
bcbaada36c2ffc497fbb9d1bd95bf83e9db9b7d4

SHA256
abb20731c64b62a3be750f425962b27f33219e37296aa6e5ec41fead595346e7

SHA512
3a57caf99bd6512f6f25bd85b82d60147a313f9ec1b1a5714c22340590eda1742db37c73b9020755abf8f92931c52a8c1fd9a8af4423f238a4180f8c17f655e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c888acca63f4b4146070314664893c26

SHA1
4986d4f8f711f50ee321dec05ca6e0e2db58881c

SHA256
c51a85485df1f36214a81e6a6f320f5b47b214d912fd6f364e457a4e04894a12

SHA512
bbb701729d204a8d5734bd42407c18b8c7132d7f472d9fedbb14ae2c4560f98875ff32f283cec2afda857526afeaa41591ca0e5923ab74dfd9cfca9b023908bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1459d67466dfcb923e7611992fdac21f

SHA1
0d130801f10e25f677528aae818bbc2fb2b7aa76

SHA256
7748f9e09e9c29510971f17552418a8672c0320ba10f9a77370da9e2949e9aab

SHA512
71864785bbb7eb25e0b3e926b761ff47cff36e25093e0d8743e93274645f3584c32fd474695a550cf447e55ae6d3f8a357b62766ad9954def04d3d5e5c731b24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_8BB34D7AC6ADCC019FE5325FE9DECAE8
Filesize
422B

MD5
d2264d7a52ae208d62fb06aa1848efa5

SHA1
fb67c400a84c568bb2d4b44ed6f8acf5e8fbdd07

SHA256
51e0578bb4597fd8cbd6f305d6544502b438a4205f1ab191da644cf4d7ad91bc

SHA512
c026f4165886f0d13ac86c234d41aa34504339cf6fb4421083f886957ed5c8ab8d6937dc44f1b38e0720c6e158ee9cf298bc088d653944970550080ee0e5b0f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize
392B

MD5
4ca9571aac4f71cb2b2281c69067d93d

SHA1
b6122bcddfb9272f10b5ab21dbbea0349566b4bb

SHA256
bb477632e48346973ccf27280d304653d4688409ee58a2a1863062e24e1bbcae

SHA512
d30d28a15fc47155fab02b98cbf3375474fb74d5ea4334f132d4f3ffd6d389728332ee9bf34b5f41d25ea0aa0f584418db1fc07cf0df5145254fa38945577b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize
392B

MD5
e9c3b481e92ce2dc63a5186cd53ff093

SHA1
19e85212f8d588901ddaaacf8e50c36f7fa9c3dc

SHA256
e1cdc0626ec5631d63ec6391252091837b9179353ba9ce1d1cb18c295d2adb7b

SHA512
ffb93f02c1c2d8908ad0f7e5bc5cace74994618fe0b6f4c582a0d3ab6a728f2145a686538ef26bb2b4b9c6776459a77222cea98203e50a8fd067fa89e076a8f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
f43fe33811c705991093a250aa91eb45

SHA1
0b800767a28b340cb06cef975a868f2b12e483af

SHA256
2d55a763df0e93aaf763fc2d40a44376d67ac2c5b1b280355da8f16d0461006d

SHA512
11049d562bedcce8be1a156a568b2d5a7154fbe6b7869de6cb22527185700797a98696f88faf5f5162eb01159f28cb4df3643831ce91b3754e333298976cd9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\q905y6j\imagestore.dat
Filesize
46KB

MD5
a1890e8b72251071a3339b10206408a5

SHA1
1c42b4c60cae4f70fc9fadfcd3a11cea353f71cc

SHA256
b59553770e35114c6799006bbe03addfd95175271765e9b61923e07942c0d51e

SHA512
aeb44b8ac1ae08b8d5c2e5e50da2471d5d72630c784ecb0c34a1feb0d7dcaa91fbcdf7782d7154bed43a068ce0e1b27b4a44f831512b57eb05bdd7bd2b0e5da0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\f[1].txt
Filesize
177KB

MD5
7bff2dc9394d88569387900494c2302c

SHA1
1483d75f2fb8ddef6f570ae96ba08902d509ec13

SHA256
b6a943dcb68b192971645ac63cea6d030dae2a62fb70533fac21022f1fb870d8

SHA512
bd7c393c41f6f751f08a899443b7eb550a7b2e47cfe4ff49f90dae99bd1a74211527dd86424c0f9067120cd3f621c69b9f2cbe1f7182da70337517b9ba9aeab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\CM-150x150[1].png
Filesize
46KB

MD5
31db7220cba8c01f89b5bcf0f3dc34de

SHA1
bf1a95415b419f94908982822ae421d4a2a9b7f2

SHA256
c052478b6204bc11443987e036d70d51e0f22186b7bd6c9616b794ccbcd44dd0

SHA512
771725dd0fa07ca6e26df2cbe155f5c39fb803ae47b9ae3b1d0cf24778c78578e1f31ac687291946a905890239fada09d58b38c80526de86d02133c230948adc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1AC3.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI69de5.LOG
Filesize
2KB

MD5
2684a52f0eb5f9518a33461937234d3d

SHA1
ec0c2b024c846261c45a20b5cd927cd1775f0f58

SHA256
c232b843c267fb71361b01aefe101f4d060a276f5e871f0eb74be65a7f2a317d

SHA512
08b3d1cc217a23d5b8c23d9786f1d7eda3ca3bfaf318b00c21158e21d557281210ecd6d10941d83a6c9644bf59e70b102e121443e91403dfac9ed085a5d0c6ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\CyberMania.URL
Filesize
154B

MD5
6982a383faed6398d98ed4501b074a68

SHA1
893add981f1c868942826bfe255be9f7b0f08dac

SHA256
80aed49f06685faa934cd2973af79e8a0a01fc51a091f7e7c9acf83a7b09e734

SHA512
d592ba93db5e5d1395bfa9ffa3aa348d3e05c2e1d20c7bd44bbfdcd58bbc59906589f22ae81b8d8d9149f56c1e3b25650de252f1227a2800ffbbc795cb9cd3e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ehs_nt64.msi
Filesize
49.6MB

MD5
eee610bf8426669b29c45cb1486a1d2a

SHA1
4e52fd753e92981ec55e275e097a10724e5a8998

SHA256
0249f023755d94430a31854764349fe2a37f9672279bc8d2bd3a87d699d96c3b

SHA512
bfac33a1746770757accebdd0e304599c789ef573e4b776046076f166b2018ad47fce3451d8f7ebdc2176ecea68f299d563a1e618051f57701ef3877e05dc3b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1AF5.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D7F.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Windows\Installer\MSI2180.tmp
Filesize
1.0MB

MD5
a6b194bd0c4d8b9c59876267e67c0717

SHA1
12f92700f7fa9f907c8a1743c1fa96e3940ddf14

SHA256
305e89a89c6bda9c5b6d535ad3f659e78949e31605fc7430225f724c9621498b

SHA512
fb062816c5dcd7651178924850db00ba09924e3eb53c60c786e219d2c7e112d248fc826257b62f9e02cab6b38244424e697f3a148005631853ddbbb17489e512

Download Submit
memory/1704-152-0x0000000003080000-0x0000000003090000-memory.dmp

Filesize
64KB

Download