Analysis Overview
SHA256
ede2d38d5b84b16e3bd0aabd1a94056996d7e03660027bc3f5897787986ecd5c
Threat Level: Known bad
The file 2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk was found to be: Known bad.
Malicious Activity Summary
Azov
Renames multiple (1962) files with added filename extension
Renames multiple (381) files with added filename extension
Reads user/profile data of web browsers
Enumerates connected drives
Adds Run key to start application
Drops file in Program Files directory
Unsigned PE
MITRE ATT&CK Matrix V13
Analysis: static1
Detonation Overview
Reported
2024-06-16 11:57
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-16 11:57
Reported
2024-06-16 11:59
Platform
win10v2004-20240611-en
Max time kernel
148s
Max time network
151s
Command Line
Signatures
Azov
Renames multiple (381) files with added filename extension
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
Enumerates connected drives
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files\7-Zip\Lang\es.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\javapackager.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ru.pak | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\7-Zip\Lang\si.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Common Files\System\de-DE\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-GB.pak | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Windows Media Player\wmprph.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Common Files\System\en-US\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\uk.pak | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Common Files\System\Ole DB\es-ES\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\java.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Common Files\System\msadc\it-IT\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\7-Zip\Lang\uz.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Microsoft Office\root\Office16\msoev.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\7-Zip\Lang\sq.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Internet Explorer\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\legal\jdk\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\lib\fonts\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\ink\lv-LV\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Internet Explorer\ieinstal.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\7-Zip\Lang\id.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Common Files\System\ja-JP\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\7-Zip\7-zip.chm | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\bin\server\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Windows Media Player\wmpshare.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre-1.8\bin\klist.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\id.pak | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 13.107.21.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 237.21.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.160.190.20.in-addr.arpa | udp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.193.132.51.in-addr.arpa | udp |
Files
memory/4932-2-0x00007FF76C870000-0x00007FF76C907000-memory.dmp
memory/4932-4-0x0000029AD3B80000-0x0000029AD3B87000-memory.dmp
memory/4932-8-0x0000029AD3BB0000-0x0000029AD3BB4000-memory.dmp
memory/4932-13-0x0000029AD3BA0000-0x0000029AD3BA5000-memory.dmp
memory/4932-5-0x0000029AD3BA0000-0x0000029AD3BA5000-memory.dmp
memory/4932-3-0x0000029AD3BA0000-0x0000029AD3BA5000-memory.dmp
memory/4932-0-0x0000029AD3BB0000-0x0000029AD3BB4000-memory.dmp
C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt
| MD5 | 78ede93114e65f9160fd03d3357c56e6 |
| SHA1 | 88d531b101e57655f1d0d26c6b3257aa2468d460 |
| SHA256 | c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5 |
| SHA512 | 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-16 11:57
Reported
2024-06-16 11:59
Platform
win7-20240611-en
Max time kernel
120s
Max time network
121s
Command Line
Signatures
Azov
Renames multiple (1962) files with added filename extension
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
Enumerates connected drives
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiling.jar | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre7\lib\deploy\messages.properties | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre7\lib\ext\localedata.jar | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Halifax | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Bucharest | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\README.html | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-11 | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\7-Zip\Lang\lv.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Common Files\System\ado\msadomd28.tlb | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File created | C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\RESTORE_FILES.txt | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa | C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe"
Network
Files
memory/2740-3-0x00000000000F0000-0x00000000000F5000-memory.dmp
memory/2740-2-0x00000000000D0000-0x00000000000D7000-memory.dmp
memory/2740-4-0x000000013FBD0000-0x000000013FC67000-memory.dmp
memory/2740-0-0x0000000000100000-0x0000000000104000-memory.dmp
memory/2740-6-0x0000000000100000-0x0000000000104000-memory.dmp
memory/2740-10-0x00000000000F0000-0x00000000000F5000-memory.dmp
memory/2740-21-0x00000000000F0000-0x00000000000F5000-memory.dmp
C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt
| MD5 | 78ede93114e65f9160fd03d3357c56e6 |
| SHA1 | 88d531b101e57655f1d0d26c6b3257aa2468d460 |
| SHA256 | c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5 |
| SHA512 | 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d |