Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 07:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe
-
Size
38.2MB
-
MD5
0d6f1a17bc5c87c304d2ba6ff25801e9
-
SHA1
69754bff37cf31ed4912a3a58c535ee3ac69d696
-
SHA256
aeb232d84afc6c6d95ea92940cee4c7707126b8204b95d6707f75a1eeec8a217
-
SHA512
78b7c4f149152e5bd15907b49a3fe392ddfb5b7af0a847357ca13db264eb204a5148e2ffb2d501dc38161a2bdb80f6c586fd0d027a1638dfb71d0a13aa69235e
-
SSDEEP
786432:l7YfqVD/drU8AkFI4ecXUEZBKRj06pysShPULwI6Kgvn:efmD/dA9kFnzUEXKRjFkJhUc
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exepid process 2680 MsiExec.exe 2680 MsiExec.exe -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 3 2560 msiexec.exe -
Processes:
2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe -
Drops file in Windows directory 7 IoCs
Processes:
DrvInst.exemsiexec.exedescription ioc process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f7712c6.msi msiexec.exe File opened for modification C:\Windows\Installer\f7712c6.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2180.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3510.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001255014099da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\cybermania.ws\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\cybermania.ws IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420452146" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29856E01-0533-11EF-BCB4-4AADDC6219DF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000f95ae9ab04028d4ad385d8929fa5c6a2e4fbd2aefdfdc190a4a7847c2c723126000000000e8000000002000020000000c594172c9b583d3ed77e1faad52474c9b4787f5d9535d4fa03250076765ce69d20000000a86aa72e7619f47e6c81f1d74f70c1f25d32c80510a01de9b88ccd2a24b098df40000000c40fad484c4351e71e629af184411c083c771f443677fbc146a45369c9c23181dfb78152be3ff026872bb3f746eb026a0abe47d71f677b7533016641afe544f9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000021a1f43e7436f7c07624537d2b79aa02f5557dd3437ae859bcd41f5b4e391013000000000e8000000002000020000000262984e175aea70570ec19a9e55777b08410aeb8162a6291d63401f08edbe654900000009c2c7c2dc8dadafe6e069b29d5d79a3df59e917528e89a71e244755a2d810f443c976dcc316a1e20962aeb8bc1f79af21c26ed8380f5e9d04c99cb5c89600f7f1e6a9cf91f7818a63704739c2bb8617956b3004312b6e9ce217dd4b6d13aef0e1f212a8b9605e9b1d4b10c2a0118c1cc2c3edd8b0c90b4bbf3c018612b3cdf17cdd24cc6ab0c630feb5a26e7d87d6a7d40000000c473050240830cd7e66188e23417c180cfddbe80de3c553ec7fb9008fff41f94a8926d492a7ba5aaf87f19e773a335fd8844e9a1d247f0a5995f9df133147415 iexplore.exe -
Modifies data under HKEY_USERS 43 IoCs
Processes:
DrvInst.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe -
NTFS ADS 1 IoCs
Processes:
IEXPLORE.EXEdescription ioc process File created C:\Users\Admin\AppData\Local\Temp\RarSFX0\CyberMania.URL:favicon IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 55 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid process Token: SeShutdownPrivilege 2096 msiexec.exe Token: SeIncreaseQuotaPrivilege 2096 msiexec.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeTakeOwnershipPrivilege 2560 msiexec.exe Token: SeSecurityPrivilege 2560 msiexec.exe Token: SeCreateTokenPrivilege 2096 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2096 msiexec.exe Token: SeLockMemoryPrivilege 2096 msiexec.exe Token: SeIncreaseQuotaPrivilege 2096 msiexec.exe Token: SeMachineAccountPrivilege 2096 msiexec.exe Token: SeTcbPrivilege 2096 msiexec.exe Token: SeSecurityPrivilege 2096 msiexec.exe Token: SeTakeOwnershipPrivilege 2096 msiexec.exe Token: SeLoadDriverPrivilege 2096 msiexec.exe Token: SeSystemProfilePrivilege 2096 msiexec.exe Token: SeSystemtimePrivilege 2096 msiexec.exe Token: SeProfSingleProcessPrivilege 2096 msiexec.exe Token: SeIncBasePriorityPrivilege 2096 msiexec.exe Token: SeCreatePagefilePrivilege 2096 msiexec.exe Token: SeCreatePermanentPrivilege 2096 msiexec.exe Token: SeBackupPrivilege 2096 msiexec.exe Token: SeRestorePrivilege 2096 msiexec.exe Token: SeShutdownPrivilege 2096 msiexec.exe Token: SeDebugPrivilege 2096 msiexec.exe Token: SeAuditPrivilege 2096 msiexec.exe Token: SeSystemEnvironmentPrivilege 2096 msiexec.exe Token: SeChangeNotifyPrivilege 2096 msiexec.exe Token: SeRemoteShutdownPrivilege 2096 msiexec.exe Token: SeUndockPrivilege 2096 msiexec.exe Token: SeSyncAgentPrivilege 2096 msiexec.exe Token: SeEnableDelegationPrivilege 2096 msiexec.exe Token: SeManageVolumePrivilege 2096 msiexec.exe Token: SeImpersonatePrivilege 2096 msiexec.exe Token: SeCreateGlobalPrivilege 2096 msiexec.exe Token: SeBackupPrivilege 2456 vssvc.exe Token: SeRestorePrivilege 2456 vssvc.exe Token: SeAuditPrivilege 2456 vssvc.exe Token: SeBackupPrivilege 2560 msiexec.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeRestorePrivilege 2252 DrvInst.exe Token: SeRestorePrivilege 2252 DrvInst.exe Token: SeRestorePrivilege 2252 DrvInst.exe Token: SeRestorePrivilege 2252 DrvInst.exe Token: SeRestorePrivilege 2252 DrvInst.exe Token: SeRestorePrivilege 2252 DrvInst.exe Token: SeRestorePrivilege 2252 DrvInst.exe Token: SeLoadDriverPrivilege 2252 DrvInst.exe Token: SeLoadDriverPrivilege 2252 DrvInst.exe Token: SeLoadDriverPrivilege 2252 DrvInst.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeTakeOwnershipPrivilege 2560 msiexec.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeTakeOwnershipPrivilege 2560 msiexec.exe Token: SeRestorePrivilege 2560 msiexec.exe Token: SeTakeOwnershipPrivilege 2560 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msiexec.exeiexplore.exepid process 2096 msiexec.exe 2096 msiexec.exe 628 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 628 iexplore.exe 628 iexplore.exe 1048 IEXPLORE.EXE 1048 IEXPLORE.EXE 1048 IEXPLORE.EXE 1048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exemsiexec.exeiexplore.exedescription pid process target process PID 1704 wrote to memory of 2096 1704 2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe msiexec.exe PID 1704 wrote to memory of 2096 1704 2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe msiexec.exe PID 1704 wrote to memory of 2096 1704 2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe msiexec.exe PID 1704 wrote to memory of 2096 1704 2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe msiexec.exe PID 1704 wrote to memory of 2096 1704 2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe msiexec.exe PID 2560 wrote to memory of 2680 2560 msiexec.exe MsiExec.exe PID 2560 wrote to memory of 2680 2560 msiexec.exe MsiExec.exe PID 2560 wrote to memory of 2680 2560 msiexec.exe MsiExec.exe PID 2560 wrote to memory of 2680 2560 msiexec.exe MsiExec.exe PID 2560 wrote to memory of 2680 2560 msiexec.exe MsiExec.exe PID 628 wrote to memory of 1048 628 iexplore.exe IEXPLORE.EXE PID 628 wrote to memory of 1048 628 iexplore.exe IEXPLORE.EXE PID 628 wrote to memory of 1048 628 iexplore.exe IEXPLORE.EXE PID 628 wrote to memory of 1048 628 iexplore.exe IEXPLORE.EXE -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ehs_nt64.msi" /qb PRODUCTTYPE=eis CFG_POTENTIALLYUNWANTED_ENABLED=0 CFG_LIVEGRID_ENABLED=0 FIRSTSCAN_ENABLE=0 CFG_EPFW_MODE=0 ACTIVATION_DLG_SUPPRESS=02⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding B6ADCEE9F4A25931D98151B2DCC933572⤵
- Loads dropped DLL
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003AC" "00000000000003B0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:628 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCCFilesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_8BB34D7AC6ADCC019FE5325FE9DECAE8Filesize
471B
MD5377ec11bf4e0ce126547ebb313dfe86a
SHA16b26f6cff6ec90313aa1d8e5debc326b33b9461e
SHA256f64716d3b2af1707ea30f1f1227526a2cacc0d6fa5677fff3892e190c1f771e6
SHA51245c5ee5b255dcd214714f5328a8fb3784ac372ed14b7c2273cbad4c5de811a9d8b533c6ef9bef5c425715dc6e5a0fb951a4e1f38791ace9c95d96bc0435a6c76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCCFilesize
252B
MD5dac09195d7900ece68d70df3a8a2356f
SHA12c6187e627649458e784b318102a4f75fe4a7744
SHA25624369fef7a443a46d71df0d04adf8cdb6e1991501887418682adc4e93588f06d
SHA512929337a69bd88557ba038af3e08a1e1620f092e591d57f4d06c14141f00818c2335f4572779d1f7544a4cc808d72132f765d927e2a23bb46a6729f6fa2789e15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD512e5463697a8fca623dcc432990eaf41
SHA1609b79d6261a3e03b6b09df709ca12006bdd98f0
SHA2566700174c64f9dc84d2b26ea3d394ec413da0f09ecf13fa17406ae8d481e29c9c
SHA5125654665c0f6a7b5f1d09ad4c52b822e9053165d98c8850b9f3d87d505bebdf84918a4f6235cd3c029ef2ba3fb9887ae909d486f7bffb586973aa4ef165add857
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5eecfaeda2469f9dd2dbdb3fbb2dde8e3
SHA1614e6a08c8db600c8c0edee1f84cc578bb01c89b
SHA2564735631bc9342c2babd7544cfe366cd59ae09b443a92af4e3b13388c50ab59e3
SHA512f683fd2b03b47f18147d23b859a2053fb5700a5a08035848f565dc4ddd82874eb363d3c1e8a8a37ef6cc5b242a1163e49cfa2ad591dc3d91c9cee8427a034f15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d001884fab90674e19e22b83045c373d
SHA15c1327d79856a43a3cae3fa52faf09d69c98b70a
SHA256a47b8cbbf96a295db02cd883b470dcdad1b3959d3839d60a852e3447e4f8a0a7
SHA512330dd0bbc2c72039e202f1f2dc14fc1c2063c1c7d189bbd5894911d9eeff3b321ee6926a5c20eb41cc64822004691d39913ff2e883af6e2c738736b86842e9f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ea000a588d2b52903798fc7a4ab06241
SHA1ada02820a3c4374e52adcce30577b3644804f5ab
SHA2564ef0eced540fdad83db68914d800c392f413c0ae419d69871de539cec4a909b7
SHA512c79b75ed5e6b55d68bc51e0670e526d6dacb583ee18f54aa3451bf04286d5f1fb81954a30908d0fbc47b4b2c736202b5e304d85cf63fc59239b58cbc9f87237c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b34fb63cb0eb4c34df08cc3cd998f7dc
SHA196ac448310e198b3d2be087a5be499ec3353cf6e
SHA256c1373d6a3d8c0c688aa9a2ae6a7fdbba4bb64a0f59909ff6e0f25353fa2c4699
SHA512b2d82221e34fa4cff71b639d98a09211c5bc832949ee75418fffa9100fde151117f338926686ab69abae458cad1f92fa029c459b4bb42db5200d23450db0a64c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5374f73096f8420baf978fdcabd5074c8
SHA1622757559fa74481e688a51f16b5fb9012ea91a7
SHA256a2d97d462e2f89f3d41a7cf204151d2a2ba734014a82a97e4896452217c18f7a
SHA5123dae02f1672136354f93881d3bedd829a9a369908c4c2c7c0c0a836dec58f7f0939aa325b315fa148bb9ddefc1300d552539c8fbc709672a5204cf05a3a7a921
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fdeeeb716af0c69a5d16c15d49d8f7ee
SHA18e96efa165f4ef61191f490094a8947a8eb393aa
SHA256a8733dcf1b3d3253e4ccfe02e27e674343c87b8011189189575839b4d7f021db
SHA512ac8332715c5850e5572776d55d5d304d1cfddb090e297c2f0acc7bd6ff9d81a3ded5ebd760fd59b8acf65b6731be7761534d8f02bd1910d7502c4d9eaab97993
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b464c3632c96a3a7be0bd6ca65abbc4c
SHA1f670f2ad3a5442c1a45b0b735d1f25aa1f6bf1dd
SHA256fa5733131650eacad27f55643a56a57680446f75f4630ce27151f4f1fbc2b9f2
SHA5126fd28f709cc33372699c5a8d4d61ddb0f9d8363b6ddec2892a100ad2c9bb4012ca36fe7d635ae45cf65f7973892b25b078df2ab8cdd9b4ba18f6554389e9bcca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD500a9c6331deeb812fa4ed55d6acf2f5d
SHA13bf5b625679a0fcb5ab0d423e1a1b43e5a86c7b2
SHA25618684d3a59a974fb808058b78b7f79c1efacbdd5e3e26cabe44b247d066ec5bc
SHA512e91280a4fadb014d5610ebb211576c5a63e87ddfa94997b4b3df5c33d23760fcb751a06df283372f42bdb3037d798609191600dfb2feca93580f3b3a71b27193
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5cef32241fc6960a3a4189ab2f9a1ddeb
SHA184f21d49421db3a048b28c8d2021044ed1060c1a
SHA25691b1290446e206d93a2b0c88363450d995f1d4543a560eb199eb4b7f7c75bc1f
SHA5127e00a37e17bb03db8cb6807035300921b0db5769e0317c5443fc24f5227df1f7450155c914fd4eb569b84f06938b3f2094e80b3e86f7c1f60dd9887cef2b190c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f5af2cce618db52e97654ee14dff6ca0
SHA17b4a3988867c97fcdaee9c22a7a62d5f225d1634
SHA25697a2794fad93b777d4e6b9a7b1839c54b4c17e535a18179a8c8da4a395f347f7
SHA512814cd74c55f62d7782c14a5d487de0382fa975a6ddeb3c5d03c18182dc9bf180563b1e0587dfc70a82c23edc2dce33a99c64e2171e117d9bfecb2263b3cf7edf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ff861dd7b87c9dcaab9c1c82f1d085a2
SHA19f2da4fbab4ca9cc497f851b05005ddfb66bde65
SHA2561a1653f0ab6b8c19c71db7145e1576c6c185568880f32ac9e9237ad966ebb933
SHA512881c74cdba1eb3f7da1fec6868e1c6eec0dd2bfdaa278c4af93474a045300db4537bb980682462ebd4a149aa9a46bbbd8db8c666a86fca0d52d43a0b93993bbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5decccaaa77dd2f9e205ff8be1a98e89c
SHA1d2d6994596439af8e01d0055aaf91bf361deb7c5
SHA256a161d7d9e84c375ae7350e460a9b3bb5ce657578006321fcf522400247e56970
SHA5122461f4b7dac6de6b131cfde61706d1f0a9701cbde45ab05d4db814e58386ee3bcee3a82f496e9d409fe2710d6df27014d629c7d7616421a9e7bfcbbd4376c3f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ff971aa469704bc922e167a92a5b3010
SHA1c3f8412cfdca48d9418e55902de1055da7910140
SHA2569b4b8f52edee6453cc5ae48f7735f3e35d523c76541cea3bdb42983986fb43c3
SHA51246bbbb2926f89d12f5e34eceae3e27299b75ee0f37fea26f8b383a61f6a510bfdaa25ebb98551faa0a622aabc49a78688847e7fda5dd01d29bcb970b3148b821
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5af4336c4c9eca07652ec07fe2bd8d4ba
SHA1be429ceae16dc71fa404e030c85a585b0cf0be9d
SHA256fd2e02c65f0c9e2fe16d21dc8ab68a8ae9347b540951dcea904642088aac6088
SHA5121dc44b541bd326ae3e4c9e7ba33d78adcb317bc49804f6797158a0d38f48ef632f742782996d96faabfc2ae435b451ac5d4c0367915625ebe6be51994184a2c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5be4263387a6f54ca817d33cd147f7dc4
SHA1da764d2cfb5af8b90101b0071664f730300eb302
SHA256c378d92f0ca8bf0c7ec6e70407293a6594fddcfff67094497b62687bee17b588
SHA5125abd14d0474cb37769791b014485ae1dad2048802b55dc462274cd4a5ca18c1ffa37021afc52f6e3495b37f1ab53fb2dd1f0068cedaa7500dc894ee122961b46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f2b1037d7edf45438dbf311190c8fda4
SHA18dff2ff539b1ab1b238fd3604770bf570721562d
SHA25662f37c61227d8add7a26f8877a3927103911fb72471c6564ac0aadce6a03b948
SHA512e277c8c0423cfcc594473497800b2f0304699bd95b973cfd91fcaf709d4e407d8540db014c4cfe2bcbc3d7f4c38016ac42155ca1bf3ce86cc3be356bb3c1d46c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5113f95bd305fce091e3628167974116d
SHA1b942ecd8fd9825d9e966ad3a1ea6b0af8f21a62f
SHA256eb867632946c97760984006ed3943ee1a8b01a83817ebc574d8fbe6b886dd4fe
SHA512db4d45807ec358e15428438f1cf7ece0d3758a0dcea6e813a636cbba4241cf017d1a3d3543a6322c1ec8f299682975d7207e00e03d4e937251caef9f4a90d93c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD540f55c70b05f3df68339a181c6b50cd3
SHA191353fddfe9446ea23b5c47a1e754928c5b21129
SHA25616a049ea8c83b75593b6b76ed2e0da8698b5cd1ade382781a745ebb6441574d9
SHA512e9bb64a7c06d9cbf869bca82eba297a68428ee3f8beed3dc905d173722ec4ee65be3a7cbc11d9768d0013cc1329f558793623d992244cc858decae5ad3187a5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5991bb948309b9e760f1c155139fb159d
SHA1bcbaada36c2ffc497fbb9d1bd95bf83e9db9b7d4
SHA256abb20731c64b62a3be750f425962b27f33219e37296aa6e5ec41fead595346e7
SHA5123a57caf99bd6512f6f25bd85b82d60147a313f9ec1b1a5714c22340590eda1742db37c73b9020755abf8f92931c52a8c1fd9a8af4423f238a4180f8c17f655e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c888acca63f4b4146070314664893c26
SHA14986d4f8f711f50ee321dec05ca6e0e2db58881c
SHA256c51a85485df1f36214a81e6a6f320f5b47b214d912fd6f364e457a4e04894a12
SHA512bbb701729d204a8d5734bd42407c18b8c7132d7f472d9fedbb14ae2c4560f98875ff32f283cec2afda857526afeaa41591ca0e5923ab74dfd9cfca9b023908bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51459d67466dfcb923e7611992fdac21f
SHA10d130801f10e25f677528aae818bbc2fb2b7aa76
SHA2567748f9e09e9c29510971f17552418a8672c0320ba10f9a77370da9e2949e9aab
SHA51271864785bbb7eb25e0b3e926b761ff47cff36e25093e0d8743e93274645f3584c32fd474695a550cf447e55ae6d3f8a357b62766ad9954def04d3d5e5c731b24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_8BB34D7AC6ADCC019FE5325FE9DECAE8Filesize
422B
MD5d2264d7a52ae208d62fb06aa1848efa5
SHA1fb67c400a84c568bb2d4b44ed6f8acf5e8fbdd07
SHA25651e0578bb4597fd8cbd6f305d6544502b438a4205f1ab191da644cf4d7ad91bc
SHA512c026f4165886f0d13ac86c234d41aa34504339cf6fb4421083f886957ed5c8ab8d6937dc44f1b38e0720c6e158ee9cf298bc088d653944970550080ee0e5b0f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
392B
MD54ca9571aac4f71cb2b2281c69067d93d
SHA1b6122bcddfb9272f10b5ab21dbbea0349566b4bb
SHA256bb477632e48346973ccf27280d304653d4688409ee58a2a1863062e24e1bbcae
SHA512d30d28a15fc47155fab02b98cbf3375474fb74d5ea4334f132d4f3ffd6d389728332ee9bf34b5f41d25ea0aa0f584418db1fc07cf0df5145254fa38945577b7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
392B
MD5e9c3b481e92ce2dc63a5186cd53ff093
SHA119e85212f8d588901ddaaacf8e50c36f7fa9c3dc
SHA256e1cdc0626ec5631d63ec6391252091837b9179353ba9ce1d1cb18c295d2adb7b
SHA512ffb93f02c1c2d8908ad0f7e5bc5cace74994618fe0b6f4c582a0d3ab6a728f2145a686538ef26bb2b4b9c6776459a77222cea98203e50a8fd067fa89e076a8f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD5f43fe33811c705991093a250aa91eb45
SHA10b800767a28b340cb06cef975a868f2b12e483af
SHA2562d55a763df0e93aaf763fc2d40a44376d67ac2c5b1b280355da8f16d0461006d
SHA51211049d562bedcce8be1a156a568b2d5a7154fbe6b7869de6cb22527185700797a98696f88faf5f5162eb01159f28cb4df3643831ce91b3754e333298976cd9b6
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\q905y6j\imagestore.datFilesize
46KB
MD5a1890e8b72251071a3339b10206408a5
SHA11c42b4c60cae4f70fc9fadfcd3a11cea353f71cc
SHA256b59553770e35114c6799006bbe03addfd95175271765e9b61923e07942c0d51e
SHA512aeb44b8ac1ae08b8d5c2e5e50da2471d5d72630c784ecb0c34a1feb0d7dcaa91fbcdf7782d7154bed43a068ce0e1b27b4a44f831512b57eb05bdd7bd2b0e5da0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\f[1].txtFilesize
177KB
MD57bff2dc9394d88569387900494c2302c
SHA11483d75f2fb8ddef6f570ae96ba08902d509ec13
SHA256b6a943dcb68b192971645ac63cea6d030dae2a62fb70533fac21022f1fb870d8
SHA512bd7c393c41f6f751f08a899443b7eb550a7b2e47cfe4ff49f90dae99bd1a74211527dd86424c0f9067120cd3f621c69b9f2cbe1f7182da70337517b9ba9aeab7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\CM-150x150[1].pngFilesize
46KB
MD531db7220cba8c01f89b5bcf0f3dc34de
SHA1bf1a95415b419f94908982822ae421d4a2a9b7f2
SHA256c052478b6204bc11443987e036d70d51e0f22186b7bd6c9616b794ccbcd44dd0
SHA512771725dd0fa07ca6e26df2cbe155f5c39fb803ae47b9ae3b1d0cf24778c78578e1f31ac687291946a905890239fada09d58b38c80526de86d02133c230948adc
-
C:\Users\Admin\AppData\Local\Temp\Cab1AC3.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\MSI69de5.LOGFilesize
2KB
MD52684a52f0eb5f9518a33461937234d3d
SHA1ec0c2b024c846261c45a20b5cd927cd1775f0f58
SHA256c232b843c267fb71361b01aefe101f4d060a276f5e871f0eb74be65a7f2a317d
SHA51208b3d1cc217a23d5b8c23d9786f1d7eda3ca3bfaf318b00c21158e21d557281210ecd6d10941d83a6c9644bf59e70b102e121443e91403dfac9ed085a5d0c6ff
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\CyberMania.URLFilesize
154B
MD56982a383faed6398d98ed4501b074a68
SHA1893add981f1c868942826bfe255be9f7b0f08dac
SHA25680aed49f06685faa934cd2973af79e8a0a01fc51a091f7e7c9acf83a7b09e734
SHA512d592ba93db5e5d1395bfa9ffa3aa348d3e05c2e1d20c7bd44bbfdcd58bbc59906589f22ae81b8d8d9149f56c1e3b25650de252f1227a2800ffbbc795cb9cd3e6
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ehs_nt64.msiFilesize
49.6MB
MD5eee610bf8426669b29c45cb1486a1d2a
SHA14e52fd753e92981ec55e275e097a10724e5a8998
SHA2560249f023755d94430a31854764349fe2a37f9672279bc8d2bd3a87d699d96c3b
SHA512bfac33a1746770757accebdd0e304599c789ef573e4b776046076f166b2018ad47fce3451d8f7ebdc2176ecea68f299d563a1e618051f57701ef3877e05dc3b1
-
C:\Users\Admin\AppData\Local\Temp\Tar1AF5.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Local\Temp\Tar1D7F.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Windows\Installer\MSI2180.tmpFilesize
1.0MB
MD5a6b194bd0c4d8b9c59876267e67c0717
SHA112f92700f7fa9f907c8a1743c1fa96e3940ddf14
SHA256305e89a89c6bda9c5b6d535ad3f659e78949e31605fc7430225f724c9621498b
SHA512fb062816c5dcd7651178924850db00ba09924e3eb53c60c786e219d2c7e112d248fc826257b62f9e02cab6b38244424e697f3a148005631853ddbbb17489e512
-
memory/1704-152-0x0000000003080000-0x0000000003090000-memory.dmpFilesize
64KB