bd42f30c...ef35

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\vxhric.exe

Sample File

Binary

Malicious

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	204.00 KB
MD5	22b9bc14db74946c0002a0ae98bc0245
SHA1	27a97ddb3c0f12b2f6c087e7bf19fb72d72e3fbc
SHA256	bd42f30c018ac5c281c04c42b96ec9db921d6c2b756f651cd16f0890499aef35
SSDeep	3072:wWZWU/Zz63EXdZjwCFXcO79R9MeVILATBJmB:JWU/sENZjHlb+uBJ
ImpHash	258afda29d5eb92b4da9f5a514056dee

PE Information

»

Image Base	0x140000000
Entry Point	0x140005c18
Size Of Code	0x14400
Size Of Initialized Data	0x15c800
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.amd64
Compile Timestamp	2019-10-19 03:15:48+00:00

Sections (6)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x140001000	0x14250	0x14400	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.47
.rdata	0x140016000	0xaa4e	0xac00	0x14800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.02
.data	0x140021000	0x14feb0	0x12000	0x1f400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	1.92
.pdata	0x140171000	0x114c	0x1200	0x31400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.87
.gfids	0x140173000	0xbc	0x200	0x32600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	1.5
.reloc	0x140174000	0x634	0x800	0x32800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	4.83

Imports (5)

»

IPHLPAPI.DLL (5)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
IcmpCloseHandle	0x0	0x140016050	0x1feb8	0x1e6b8	0x84
IcmpCreateFile	0x0	0x140016058	0x1fec0	0x1e6c0	0x85
GetAdaptersAddresses	0x0	0x140016060	0x1fec8	0x1e6c8	0x3e
IcmpSendEcho	0x0	0x140016068	0x1fed0	0x1e6d0	0x87
GetIpNetTable	0x0	0x140016070	0x1fed8	0x1e6d8	0x5c

KERNEL32.dll (92)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SetLastError	0x0	0x140016080	0x1fee8	0x1e6e8	0x480
WriteProcessMemory	0x0	0x140016088	0x1fef0	0x1e6f0	0x53d
WaitForMultipleObjects	0x0	0x140016090	0x1fef8	0x1e6f8	0x506
Sleep	0x0	0x140016098	0x1ff00	0x1e700	0x4c0
SetFilePointer	0x0	0x1400160a0	0x1ff08	0x1e708	0x474
CloseHandle	0x0	0x1400160a8	0x1ff10	0x1e710	0x52
GetTickCount	0x0	0x1400160b0	0x1ff18	0x1e718	0x29a
GetLastError	0x0	0x1400160b8	0x1ff20	0x1e720	0x208
GetModuleFileNameW	0x0	0x1400160c0	0x1ff28	0x1e728	0x21a
GetModuleHandleA	0x0	0x1400160c8	0x1ff30	0x1e730	0x21b
GetCommandLineW	0x0	0x1400160d0	0x1ff38	0x1e738	0x18d
GetTempPathW	0x0	0x1400160d8	0x1ff40	0x1e740	0x28c
GetWindowsDirectoryW	0x0	0x1400160e0	0x1ff48	0x1e748	0x2b7
CreateFileW	0x0	0x1400160e8	0x1ff50	0x1e750	0x8f
DeleteFileW	0x0	0x1400160f0	0x1ff58	0x1e758	0xd7
CopyFileW	0x0	0x1400160f8	0x1ff60	0x1e760	0x75
GetVersionExW	0x0	0x140016100	0x1ff68	0x1e768	0x2ac
CreateToolhelp32Snapshot	0x0	0x140016108	0x1ff70	0x1e770	0xbd
Process32FirstW	0x0	0x140016110	0x1ff78	0x1e778	0x398
Process32NextW	0x0	0x140016118	0x1ff80	0x1e780	0x39a
GetCurrentThread	0x0	0x140016120	0x1ff88	0x1e788	0x1ca
CreateRemoteThread	0x0	0x140016128	0x1ff90	0x1e790	0xa9
CreateThread	0x0	0x140016130	0x1ff98	0x1e798	0xb4
ExitProcess	0x0	0x140016138	0x1ffa0	0x1e7a0	0x11f
GetCurrentProcess	0x0	0x140016140	0x1ffa8	0x1e7a8	0x1c6
OpenProcess	0x0	0x140016148	0x1ffb0	0x1e7b0	0x382
GetProcessHeap	0x0	0x140016150	0x1ffb8	0x1e7b8	0x251
HeapFree	0x0	0x140016158	0x1ffc0	0x1e7c0	0x2d7
HeapAlloc	0x0	0x140016160	0x1ffc8	0x1e7c8	0x2d3
VirtualFreeEx	0x0	0x140016168	0x1ffd0	0x1e7d0	0x4fc
VirtualAllocEx	0x0	0x140016170	0x1ffd8	0x1e7d8	0x4f9
VirtualFree	0x0	0x140016178	0x1ffe0	0x1e7e0	0x4fb
VirtualAlloc	0x0	0x140016180	0x1ffe8	0x1e7e8	0x4f8
LocalFree	0x0	0x140016188	0x1fff0	0x1e7f0	0x34a
GlobalFree	0x0	0x140016190	0x1fff8	0x1e7f8	0x2c2
GlobalAlloc	0x0	0x140016198	0x20000	0x1e800	0x2bb
GetProcAddress	0x0	0x1400161a0	0x20008	0x1e808	0x24c
FreeLibrary	0x0	0x1400161a8	0x20010	0x1e810	0x168
LoadLibraryA	0x0	0x1400161b0	0x20018	0x1e818	0x33e
SetFilePointerEx	0x0	0x1400161b8	0x20020	0x1e820	0x475
HeapReAlloc	0x0	0x1400161c0	0x20028	0x1e828	0x2da
HeapSize	0x0	0x1400161c8	0x20030	0x1e830	0x2dc
GetConsoleMode	0x0	0x1400161d0	0x20038	0x1e838	0x1b2
GetConsoleCP	0x0	0x1400161d8	0x20040	0x1e840	0x1a0
FlushFileBuffers	0x0	0x1400161e0	0x20048	0x1e848	0x15d
SetStdHandle	0x0	0x1400161e8	0x20050	0x1e850	0x494
WriteConsoleW	0x0	0x1400161f0	0x20058	0x1e858	0x533
FreeEnvironmentStringsW	0x0	0x1400161f8	0x20060	0x1e860	0x167
GetEnvironmentStringsW	0x0	0x140016200	0x20068	0x1e868	0x1e1
GetCommandLineA	0x0	0x140016208	0x20070	0x1e870	0x18c
QueryPerformanceCounter	0x0	0x140016210	0x20078	0x1e878	0x3a9
GetCurrentProcessId	0x0	0x140016218	0x20080	0x1e880	0x1c7
GetCurrentThreadId	0x0	0x140016220	0x20088	0x1e888	0x1cb
GetSystemTimeAsFileTime	0x0	0x140016228	0x20090	0x1e890	0x280
InitializeSListHead	0x0	0x140016230	0x20098	0x1e898	0x2ef
RtlCaptureContext	0x0	0x140016238	0x200a0	0x1e8a0	0x418
RtlLookupFunctionEntry	0x0	0x140016240	0x200a8	0x1e8a8	0x41f
RtlVirtualUnwind	0x0	0x140016248	0x200b0	0x1e8b0	0x426
IsDebuggerPresent	0x0	0x140016250	0x200b8	0x1e8b8	0x302
UnhandledExceptionFilter	0x0	0x140016258	0x200c0	0x1e8c0	0x4e2
SetUnhandledExceptionFilter	0x0	0x140016260	0x200c8	0x1e8c8	0x4b3
GetStartupInfoW	0x0	0x140016268	0x200d0	0x1e8d0	0x26a
IsProcessorFeaturePresent	0x0	0x140016270	0x200d8	0x1e8d8	0x306
GetModuleHandleW	0x0	0x140016278	0x200e0	0x1e8e0	0x21e
RtlUnwindEx	0x0	0x140016280	0x200e8	0x1e8e8	0x425
RtlPcToFileHeader	0x0	0x140016288	0x200f0	0x1e8f0	0x421
RaiseException	0x0	0x140016290	0x200f8	0x1e8f8	0x3b4
EnterCriticalSection	0x0	0x140016298	0x20100	0x1e900	0xf2
LeaveCriticalSection	0x0	0x1400162a0	0x20108	0x1e908	0x33b
DeleteCriticalSection	0x0	0x1400162a8	0x20110	0x1e910	0xd2
InitializeCriticalSectionAndSpinCount	0x0	0x1400162b0	0x20118	0x1e918	0x2eb
TlsAlloc	0x0	0x1400162b8	0x20120	0x1e920	0x4d3
TlsGetValue	0x0	0x1400162c0	0x20128	0x1e928	0x4d5
TlsSetValue	0x0	0x1400162c8	0x20130	0x1e930	0x4d6
TlsFree	0x0	0x1400162d0	0x20138	0x1e938	0x4d4
LoadLibraryExW	0x0	0x1400162d8	0x20140	0x1e940	0x340
TerminateProcess	0x0	0x1400162e0	0x20148	0x1e948	0x4ce
GetModuleHandleExW	0x0	0x1400162e8	0x20150	0x1e950	0x21d
GetStdHandle	0x0	0x1400162f0	0x20158	0x1e958	0x26b
WriteFile	0x0	0x1400162f8	0x20160	0x1e960	0x534
MultiByteToWideChar	0x0	0x140016300	0x20168	0x1e968	0x369
WideCharToMultiByte	0x0	0x140016308	0x20170	0x1e970	0x520
GetACP	0x0	0x140016310	0x20178	0x1e978	0x16e
GetStringTypeW	0x0	0x140016318	0x20180	0x1e980	0x270
LCMapStringW	0x0	0x140016320	0x20188	0x1e988	0x32f
GetFileType	0x0	0x140016328	0x20190	0x1e990	0x1fa
FindClose	0x0	0x140016330	0x20198	0x1e998	0x134
FindFirstFileExW	0x0	0x140016338	0x201a0	0x1e9a0	0x13a
FindNextFileW	0x0	0x140016340	0x201a8	0x1e9a8	0x14b
IsValidCodePage	0x0	0x140016348	0x201b0	0x1e9b0	0x30c
GetOEMCP	0x0	0x140016350	0x201b8	0x1e9b8	0x23e
GetCPInfo	0x0	0x140016358	0x201c0	0x1e9c0	0x178

ADVAPI32.dll (9)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
OpenProcessToken	0x0	0x140016000	0x1fe68	0x1e668	0x1f7
OpenThreadToken	0x0	0x140016008	0x1fe70	0x1e670	0x1fc
GetTokenInformation	0x0	0x140016010	0x1fe78	0x1e678	0x15a
AdjustTokenPrivileges	0x0	0x140016018	0x1fe80	0x1e680	0x1f
LookupAccountSidW	0x0	0x140016020	0x1fe88	0x1e688	0x191
OpenSCManagerW	0x0	0x140016028	0x1fe90	0x1e690	0x1f9
EnumServicesStatusW	0x0	0x140016030	0x1fe98	0x1e698	0x102
LookupPrivilegeValueW	0x0	0x140016038	0x1fea0	0x1e6a0	0x197
ImpersonateSelf	0x0	0x140016040	0x1fea8	0x1e6a8	0x175

SHELL32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ShellExecuteW	0x0	0x140016368	0x201d0	0x1e9d0	0x122
CommandLineToArgvW	0x0	0x140016370	0x201d8	0x1e9d8	0x6

WS2_32.dll (10)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
socket	0x17	0x140016380	0x201e8	0x1e9e8	-
setsockopt	0x15	0x140016388	0x201f0	0x1e9f0	-
inet_addr	0xb	0x140016390	0x201f8	0x1e9f8	-
WSAStartup	0x73	0x140016398	0x20200	0x1ea00	-
htonl	0x8	0x1400163a0	0x20208	0x1ea08	-
closesocket	0x3	0x1400163a8	0x20210	0x1ea10	-
bind	0x2	0x1400163b0	0x20218	0x1ea18	-
WSACleanup	0x74	0x1400163b8	0x20220	0x1ea20	-
htons	0x9	0x1400163c0	0x20228	0x1ea28	-
sendto	0x14	0x1400163c8	0x20230	0x1ea30	-

Memory Dumps (17)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Points	Actions
vxhric.exe	1	0x13F300000	0x13F474FFF	Relevant Image	-	64-bit	-	... Memory Dump Actions Download Dump Go to process Go to AV Match
buffer	1	0x002E0000	0x002E1FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x002E0000	0x002E1FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
vxhric.exe	1	0x13F300000	0x13F474FFF	Final Dump	-	64-bit	-	... Memory Dump Actions Download Dump Go to process Go to AV Match
buffer	1	0x0BA70000	0x0BA71FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x0BA70000	0x0BA71FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x0BA80000	0x0BA81FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x0BAB0000	0x0BAB1FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x0BA80000	0x0BA81FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x0BA80000	0x0BA81FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x0BA80000	0x0BA81FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x0BA80000	0x0BA81FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x0BA80000	0x0BA81FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x026F0000	0x026F1FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x026E0000	0x026E1FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x026E0000	0x026E1FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x026E0000	0x026E1FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process

Local AV Matches (1)

»

Threat Name	Severity
Generic.Ransom.Ryuk3.C1BC6A52	Malicious

C:\Boot\BOOTSTAT.DAT.RYK

Dropped File

Stream

Malicious

»

Also Known As	C:\Boot\BOOTSTAT.DAT (Modified File)
Mime Type	application/octet-stream
File Size	64.28 KB
MD5	da54464c2cc9ac046a92632be7a3ab47
SHA1	4e5d0014ee15505ca0de36843dd41281345de58e
SHA256	85672fa89c8ac19b875e199b3a9f86ebe549762697b0f0ec543a3087a2bd2ccc
SSDeep	1536:SUdw2EnDZTQbSVRBwM4IOfKjmWb6aPjyka63atZ2Nb+jApIGgyYYroHl:SznJQbSVRBwMv7jHQtZ2l+jApIGgpHF

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\BOOTSECT.BAK.RYK

Dropped File

Stream

Malicious

»

Also Known As	C:\BOOTSECT.BAK (Modified File)
Mime Type	application/octet-stream
File Size	8.28 KB
MD5	da8556ee3d16a896ccf84c101de3e57a
SHA1	8a6916517d9d29c9c3a9fd5e01c87a73261207ac
SHA256	a4701d69573eeaeafa50c25dfe7b32f0bc2ddd8b24f86b2f5b8b6a6707f626e6
SSDeep	192:09WnXqg3MvIrjIiowjJv7YV6fig0w6UKK3vi+J251nl9WB:9qg3mgX53fig0xsTi1n7y

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\acrobat\10.0\cache\acrofnt10.lst (Modified File)
Mime Type	application/octet-stream
File Size	52.22 KB
MD5	7679208a63b8bdefb69b10c0a18837f1
SHA1	2fdb45d9e370cf15040888e620697dc724186c96
SHA256	d48fd4d7239357f8428ff3a97871d4f990cc664a241c14bf4d2d1a57a3e62a66
SSDeep	1536:c1jWFgrQdfFir/rHhZfrwWlSkVD5NiXd2s6ALG:c1CFgi8LrHhxrlJvNiXdXLG

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\SharedDataEvents.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\SharedDataEvents.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	5.28 KB
MD5	06c6e14e113667e59b33770cf51f03a5
SHA1	f5df114735cb11ae967a12bbfaa41c98a54b18fb
SHA256	b0c44c41a9ed316d5d63c95c584f7539fd495470fefc2aa2bf8ca3df437de42b
SSDeep	96:dMlAXeu8lAn2u9D9+mLlqXOyWfeHy+pYMq3FwlowG9ibP68I6Eculp7mkAVYDJi:miCA5JBJqXOj+pYMq3FwiwG9u3gp7mHv

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	75.94 KB
MD5	049578478a1a39c46632f31a030c71ae
SHA1	b3fcdd43e4f51125ab7b26e7893fc54b68ae0516
SHA256	8866c101d903d1b450c33769861b8b4224c75f6eb3376b3f4414fe9002f7cc30
SSDeep	1536:oPN7plisN3GMDEQapyVj8XygQrWFNBNR5u/ih8LVqZALM49:oPnEsN3spyVjyOWFNDR5qiDZALM49

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	135.49 KB
MD5	1ad7a4e010ab5ee6638952d0e7724d17
SHA1	8687fa680abfec6355f3fb449cc0aee1268d10bc
SHA256	b1769b2d7037006857e7c79fed9b7d00b723a77e853d0aeed35e09fcc0653f20
SSDeep	3072:o9tbwg10SoZ1QHXXpjPHQP6iwB19L21ifjFPrb++02e2C:oXwg1HoZ1Q35jvQSiszxjtW2M

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	34.56 KB
MD5	84341f5bcfe3102d11f8e38b2d12d73f
SHA1	1d518c6babb7b2aea9ffddc3a96a15d026c28890
SHA256	e15ffc1940d5c3b5afe05a0ddb12a5607bbcaaee803a6d2434e6e19451c83c30
SSDeep	768:RwTRi3zMLdyDJS0p/Cal9ttHv2wPGFS99:RxDM5OSnajttOqD

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\ACECache11.lst.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\ACECache11.lst.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.42 KB
MD5	520f2b38daf810334421a1c96816017c
SHA1	87c3a65e9d8a16a975f8d3aba0d6f808335ca880
SHA256	378d627e93fb90b11761192136d26f7592e9f8042ce89016f9271a9493ed87be
SSDeep	24:OctOvOoxmTRzLB+B8ZUEX/ZsWSgYRqzRhv1mC3/sxaUXeS817NcNTMBKJGlm8:pXoxmWKvSdRUkk/E0rRN+TQuym8

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\color\profiles\wscrgb.icc (Modified File)
Mime Type	application/octet-stream
File Size	64.94 KB
MD5	83f06b0e0dc29aaecfbc6d678680229a
SHA1	f9890882b48449e8679e3ed0547ed4d405540d67
SHA256	9cdefa5552a7e681cc2f0144df134df1b04e41956c31d3b3b62f3933a658f664
SSDeep	1536:JwAmuHDRnMGl59+odkA22nPhKWibwU+RIdUUQRUrfBqHz8:JHmujNNbGAzhKTb7+RId6Ryf8z8

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\color\profiles\wsrgb.icc (Modified File)
Mime Type	application/octet-stream
File Size	2.89 KB
MD5	2de61d4266c445a532341c619a2bcff3
SHA1	e6f325f6ae56686c0215d51c3ad77229bfaa3cbe
SHA256	44c8c39cf2b4e61d1d52b5ffca7689f0aa49e7a9c519e3278a752c5ec7c359db
SSDeep	48:/toLrI13+dlPjPyXWmU1meg/feQvqk4mVPcnA8mG0CLVug5aCFfF:/OI5+dlryXnwmwslcaG005aGd

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\GDIPFONTCACHEV1.DAT.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\gdipfontcachev1.dat (Modified File)
Mime Type	application/octet-stream
File Size	106.55 KB
MD5	94c9c5189fc3a6b9ec01db20a2ef0613
SHA1	4834310c3a84e1bb1334180d7d35de377d220c7b
SHA256	e927e261325fb6be03d0bea02f839143d399b0c7293eb4cb144fe88ed84eac73
SSDeep	3072:C4KBnYEYDFCaul3CETBtJFe0p1kB02h8vQ6:YNYEDaul3JlXc627SQ6

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.15 MB
MD5	5817b1f29d6bc90c6ec1619496dfadac
SHA1	01f599362b98deefb5b6110a890dd7ce76cb173c
SHA256	204fb6c94980fd01683664b5f0f16af6e1022c02fac68d6586932e6586875695
SSDeep	24576:u4Jz4QqdPn9syz8eh0lxAjxI9f4XkbIkHQVpdFm:uknq3s+8eh2K+dekbuPm

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\0ZjwRotnizdf.mp4.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\0zjwrotnizdf.mp4 (Modified File)
Mime Type	application/octet-stream
File Size	97.00 KB
MD5	8839f78c6ffb33b817e936c72315aa8f
SHA1	e67fe6216a579cbde1d52df9b5659f44bbb7ecfd
SHA256	0ce09c805f10b890cb4e4545fffb392ca9fb0fc74b65e40b665acfc3026f1b04
SSDeep	1536:woYLOZYBOG51aXw1WpOcrfVrNXFtftSo0uqpdSCT4R23V2tBirDFK/7HVCUapNAA:wHNBP1aDfVRXdb0Sa4Q3cBU67g5OhAL

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\fYAdmOtH.mp3.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\fYAdmOtH.mp3.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	75.97 KB
MD5	25c3c6c383bd47e30a1c7cb780a49ad5
SHA1	3345c5a04af6c77c19086c3ed3efaf987e3b3e7e
SHA256	227bac9b5e1eed67669637c7a44fcd0dfe6321edda7e05b14a11f570b641fbe7
SSDeep	1536:QWyR0uLiTneP+GF2qHc3XYjrdLjwruQGVKfmI8SXZvGUfS8W:eRVaevF2qHAcrmyQkKezSpvGUKb

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\v9w4LvjNCgth.swf.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\v9w4lvjncgth.swf (Modified File)
Mime Type	application/octet-stream
File Size	81.39 KB
MD5	203ebb1d5db1c98b0d61a050d51cb76b
SHA1	01092165066412a0fc7aea5177571bc9306c48da
SHA256	a4312c2b80e489f23b31335325c62c73e52ca39fe6e019fef149cc2507a22c7c
SSDeep	1536:3F3NLqCmlAKsiBjxBQi5tkl2TmTyfMaGiDHMJS8qUHw2FZCsnuSV9CJuGouxQwl6:V3dqCrKFBjxi2klDyfMaGxwU/FNuSV8I

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\iizi.jpg

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	10.99 KB
MD5	dc1bd9e937f324782ff7a8bf21121260
SHA1	9bb8e4b5c54d3e0362a45f6d54b728e7bfb6ad15
SHA256	85f0bfb58877e2366de5bfca4de633391e109c493404b9fd30aa54106da1b976
SSDeep	192:tHyg3fxxYoKw6q+L7nzHW4tc7cDgnHj0D7KSZbelax83bovOlBoOiols:tHyKxIwCL7nzHG7cQjEJN3Q6

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\index.dat.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\index.dat.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	32.28 KB
MD5	2035471b02b03869860dd0af5a482a9c
SHA1	dca69ba4a85d987e1e80329d6d513b1fe0d8bfee
SHA256	23ed07d39bbea2428d1cf7c478cc6077deacada8940a7a97b621c1838de76b0d
SSDeep	768:Kk5mchBPFAm3g8tOuwRgZHVBtZybaynxJSAU9fAdUjrrO:KkQ45n3gX4tVBXybayxJZU9IdYrrO

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Cookies\index.dat.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\cookies\index.dat (Modified File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	85dbd1d49a454e40aa9ae82dfb02646c
SHA1	33097355aa28e59d03bb055976a0d03df1e3db0f
SHA256	c8a2ee87b4bfbb0de9fa20d824d8b5a8efe65e4c7905dd5eff0569da1be38873
SSDeep	384:FFaEAP/0KuVFr+ZoA+LBak5vP7ypXTQQPoBz0igAA3oeiDs3W:3eOAaLBfP7uXTQhzE33Vi43W

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\bfygsndvspeuckttg.avi

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	76.91 KB
MD5	0b64043ac7c7c38ce91d66d0c2ebeb1c
SHA1	53c511725c8d279c012c9088362bef399915dd17
SHA256	2315392a9ba3a1bb276586515793d4f218cffbbe2b27871d57b69689c427dfa1
SSDeep	1536:/0GVLsJrQT7NUGTJ7Z9oCLeYhsPSFGINsBxxK6LvLu+vMt/FjDWjkkXsLlcB+F0Z:c8L+knN3TJ7LeRmGIWBjN2RDktgFIAI

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\adobearm.log

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	1.02 KB
MD5	51c3ff5c595ebcb188b238aec16d0a32
SHA1	8ea4497e06622bdb106bf2ca8471ce673adec93b
SHA256	15b61084f66ad58eff35bf9fb22e86aa18e83cad8bb976ebbd8bf75c2d8af209
SSDeep	12:MY/j6eQdS10PUZDKkCHjVuO9v7iqumu4FFxP88IuS+ayW0YaEQ+eFeqcrEd17Oda:DLqpkCZiqfnF7T3aiYaEQeaAddcuo

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\v6uou.flv

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	83.42 KB
MD5	fc14b10dbcf22d77e00a3d17dab447e8
SHA1	84e962386531da3b2d877f382f4ae4df07da736a
SHA256	8fa62c61a4e7cc8426ba8761f516504421edd9c7aeafc4ec68002e2a7842f4e5
SSDeep	1536:arstpTgPXG8JuVciNQ0vx3BL+jTnXgf5EH/udakK3Wsv7Yjp6kGpqspGcMMA/4Dd:v3g/sc+ZREH2dqGsvsjp6HPpGdiX

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\tvqq2f.bmp

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	73.66 KB
MD5	042f623065d7dc4710753b89e03c1849
SHA1	4de1c96a229c9b2db0a840f88535721ed2fcd8be
SHA256	f49dfcb215f1265c90ad516d417f656e6afc6ced4a473d381516cbc589378164
SSDeep	1536:ACHJeKqJdk/mOFg/a9R8vB8dkK/K3QRGfLn1Q9bcB2AUBL08jUw:AOeK6gm4g4R8ydD/K3d1wbT1LUw

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\snoh2qfvgof2.gif

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	14.49 KB
MD5	905e26b913c5badf54e7d66fbd0e9934
SHA1	a3b15dbe5c7b2fd46e6fe8825cbe0439e2ead762
SHA256	8bd536bbced190b818086b5e7894b85d8319ed6e29425e1f5a1beaf3b46cc681
SSDeep	384:O7QJ7he0wuwsXPJS/XLPZeKViREWkW2+i:OE7DwaJS/70Ry+i

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\rquzwnreqg.mkv

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	35.13 KB
MD5	b6d00db4f0b55b8e9b5c8a2155c4870f
SHA1	cecc16fefc9712cfb9e4bd07f6f71d7338ff8034
SHA256	d65c7611e83c33fc4273b3132ceacc4a3c5a710cc442401dc6b8e7a3304c9a17
SSDeep	768:2Nx1nG9aFs7UB58z7gJc8PB3KiO2SlOfSIreCwsWSCZhp9GzLt7jykTB:2N3G9aF8Us7gJc8Nl/SlO6EHohpULtPj

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\r6in.pps

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	85.66 KB
MD5	5f1048ecc711484a9641f26065d0918d
SHA1	7531afc41afc69de5ebb3dc923b8a84f33af237d
SHA256	28c560118b93d78b53cfee43c917b118dcc36ba9556f72bf7fa53404f855ae9c
SSDeep	1536:qJp1gaqaOhckHZo+jbWRXRbngw6Bla5KJPG+XKmjXb4oUTiIURcXe5sQo2yon:qJItpHHZoIMYlHJOtmzb4TTiIOcXStoK

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\r5zi1xbdepqyd.ods

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	72.28 KB
MD5	76fec9568c430ca63ba36df92f4bcf32
SHA1	c69dd8de1ba1bc2e496c50fef38109cf4834fb9a
SHA256	be8b729bf4c4444d39369706430d19e21199a6615e5c5661b7d6490915539be5
SSDeep	1536:t3u6uNwT6QmaQgOWsQ9Tb67eSA91bMEqhfreL4ScnglmukKNWCp:864pQmafOWX9TWk91bMrfaTR7r

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\ooyu g.ppt

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	82.67 KB
MD5	d151dbdff351b7123ce204826ab86a65
SHA1	21ea71e3fb0921aa972913bc8019c3b99feb2f1a
SHA256	da2029c5f18e710e9e8d21f8ef993b881f8b7259cbe573e8c88b943256dcfd08
SSDeep	1536:AvwetgrMmxqerwwGMD4RUV6kMjNWHRqkhmRrcOZmVY/NXtXDm:AwetVmxBrJT58NWxqkhmRrp1Vm

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\nzcs.flv

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	17.85 KB
MD5	6639cbaa56f1f001ccd949849fcf925b
SHA1	a837fb499112ce0dde3af13e9b008b8d61df1251
SHA256	adf99ae976e2181cf12ea1f0da21917868cf5d82c1d566ad239db63df768db4c
SSDeep	384:fqDAFBdiWZLo09wzihBn0tQsOi8RD+5/WSoKAYie0ixbfiCXj9eI4Rdl:e0diWFjw60tQK81eMIxeCz9erRdl

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\mr6bqg-txre.docx

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	9.00 KB
MD5	b95125c3dd3e061b0ae9af5f8197fc37
SHA1	1263c5f80ccc5011c966a1522faf0510ec7d80bc
SHA256	8a5d970335f494c104f64e9a325b24b75bffc260f65e9bdcc05293cec1d6783d
SSDeep	192:zaJVxqwRxBb5VkCOznALir/418xs1b1rjVT7dj6:+jZR3tO8irAZ1b1HVVj6

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\lg1bjeiz1k.bmp

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	32.89 KB
MD5	2fd819b3452d7a4697fe48130adeabe7
SHA1	10fb7174f136d6914c5f568e509c6eb30af19083
SHA256	d9ac55c9c31078c6e85462c2427d701b2019c74c6ed79005f21c1580fbea5411
SSDeep	768:Cdv2c++Q0b+/t+Tef0PPojmWjNKnsy6dPT/zirHou:H+Q0q/MJPimWknsy6d7z0Hou

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds\feedsstore.feedsdb-ms (Modified File)
Mime Type	application/octet-stream
File Size	6.78 KB
MD5	5535e50a296e6b37ea59d039456824f4
SHA1	127714c23dfdf8c8e25a78aa129b1a169055e59a
SHA256	6b2b8b56ca92ace8ce9382f09d260bee09840b1cb9804d8538c1283ea69720ec
SSDeep	96:DaoVMCy9QihQRrNchCk33PQSEG7msUHtosnCNREU5/y9x5cZseORlTIlL5oN6:DaXxqLy33onG7mhHthaREUuYXHLmw

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\xb2aof5ci8yyw.flv

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	57.21 KB
MD5	2a07c5fa74ba289927a032b63497006d
SHA1	9fda899a27aa234e00c56b46c8e6565d273fef8f
SHA256	fe0652034e798811041ebb4d85acbba95a8ee8030ee2192a4ab6d9bb82a4826b
SSDeep	1536:w2MNrMjFvXx+hlK8DzBe4ExPI/sYuZEWGRRIyrPdEd4Ijn:w8jFvB2tReVisJE/HIyz3Iz

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\zegmwqzr.doc

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	90.86 KB
MD5	24c67ff1abef1e6b01b208fdf45447a4
SHA1	4de9afabad8d739278b111e38ff280ac70a8176c
SHA256	aad0417e4ba8c8fe133fe9b4cac35b816812a7fb2130a5544ed870c3f5a46250
SSDeep	1536:tqkTwaTEVKlAJ+0n+4O6xVj2g6IZgSLuoHaOafN/xCfL72KG0uUYD0OJlu5L3lFi:tqkTl4OXg6egSLHeNofLIUme5lEj

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\zhk8ifk.ppt

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	60.53 KB
MD5	3c926c88ce7c0676800a3560a4346abf
SHA1	8e96f9f145d3ba48c5d205764fbedf09376788e9
SHA256	e142e662708903dbcff8d40948a6f1c4a03fdb6f39c74e1af7c2d079b9288ee0
SSDeep	1536:bVaDqflFMPgTqBqauOODqpX/OLYFxtp5xYnq2Cv:boqlFMPgTqBjqyOL4fFYnq22

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\zi5kn-lpxgjv_.jpg

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	46.16 KB
MD5	6a38a2e17ff8c384d19b6a3c7acda01f
SHA1	0ec64476c59d8ae553b8e79a6674a94eb68f1d41
SHA256	f32706488f622b5a84a61ef6e27d6704f3517a500382d85228d44291bcfa2840
SSDeep	768:9PXGOepdtuUfIO4+8j9DtEpygLkrILAmMyV179s5vcOUKqvuZA/ytlboRgcgUsR:0dSF1j9siIsALSJeuM+hciR

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\zjv9b0cgcdkd.bmp

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	30.91 KB
MD5	b1bdb04b46ec78880da61b4884af68f0
SHA1	d2838fa237c4ee8d435cca806f2a145c0dbcefb9
SHA256	7df22ae584cc18dd3995e25058e9070e5e87c63c2b24fdbcd18770dfe7e5a860
SSDeep	768:XF/ZCl5XynP0wXEo7qWWHoq2bwJR+Ghq6a5gzlm9cjWcY:VO1ynKyqVYuxl9Y

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FORMS\FRMCACHE.DAT.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FORMS\FRMCACHE.DAT.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	240.49 KB
MD5	ea14b06e225b6c1a23a779c793d8e5e3
SHA1	96d58e938df678e7d9801466820bff723db963a1
SHA256	9113ea447d6b86319f4c642decbcd72bdc92aeadb9830d4348e0684b1da11bb4
SSDeep	6144:FF1H/snPRjlEy9qGoLi/R+vHpuL0u6H9YDvlk4ED3+YhfkM:J/QPnEaqGYi0vHkLbB3EOmj

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\brndlog.txt

Modified File

Compressed

Malicious

»

Mime Type	application/zlib
File Size	12.21 KB
MD5	36a22dccdbdead1dec0a55d1ba190dd6
SHA1	e57f1b9612f01230ca4d48812df0fc6e40aae36a
SHA256	1f370d04fb022590f721f010741df0b415528fc6f516d2c97a8374c83a73236a
SSDeep	192:kyf/h3Al2zTx4nLZgUjJVS0L6MRzN+drK+3Am7Svd1IsRpiLB6wXGyWAVKqZ/GZL:kGhgWxm1gZmzc8+QNvEQIB4KcLT7jj

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\eq_5zryrCbCZ_2_.mkv.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\eq_5zryrcbcz_2_.mkv (Modified File)
Mime Type	application/octet-stream
File Size	11.56 KB
MD5	95914dc49ca76be5c4f7ca32a62364d1
SHA1	11271fac74f8e43caa95751cdf843b777314cfbf
SHA256	07b4f8bbc92ef166a92fddc06764834838d2c56b671fd1fe0174eb289dcc5167
SSDeep	192:OmoW2jI/16bViLmvrApcVyTM4GCEsLm69nkp9IIAhOfjIiu3N4UTiorzb6J25W:nLjIhAmvEpcVyBEwn80Ofci3Stzu

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\e_mN5AlP1B z.mp4.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\e_mN5AlP1B z.mp4.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	92.19 KB
MD5	8130e40c8749ddd2cdb23b8a891d2147
SHA1	8c9bdc013c56b097ea106be529b3b0a84c08d64b
SHA256	9c75ebd7821293d7004b7b870ffb624c587db64d10386d5d0831556f76ee400e
SSDeep	1536:9M/5vLaUl7rfnzVrcUKQE21N7Z0T+7yWJ/WKxUVh8aaFGNoZ11Y:9MRvLHfnzVgUKQE21N7Zw+eQWkUV4FGf

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tILBogb-XMX1Z.bmp.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\tilbogb-xmx1z.bmp (Modified File)
Mime Type	application/octet-stream
File Size	4.69 KB
MD5	3a096d130ff4319036a88f2225422194
SHA1	ac4a271dd7c29b3fd529f93382c5f68d9d49f3ff
SHA256	c1145f89442b72c53b76dceaa4f03ce96f8aba1712e576ea64a2888508654c92
SSDeep	96:c3zGuQxifQK6tpkfHCBhXkhq7sxCTJTDXv1IXrN9KFYHUh:ebf60fHCBhXkAeC1X9iTKF9h

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\jXm57JN.avi.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\jXm57JN.avi.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	9.63 KB
MD5	a2d49eec755167250046af3172bc2df9
SHA1	6de6b727f10c9348c87f3314109678e97b2599a0
SHA256	d3a79fdc145e50a21aef13a1621f804ff4850112e0d31a832c3cffa63a39d3d9
SSDeep	192:O28MuDa0CRW8RL2v77Ez+tl74JTgulepP4W5dNBKIoqIwS48UooHls+JFN3:JJu21H2vkaTEJTdQGW5daI3DSRhAd

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\B-xPk-Z5a.rtf.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\b-xpk-z5a.rtf (Modified File)
Mime Type	application/octet-stream
File Size	79.33 KB
MD5	4fa5ebefbd55929d2cfbc0849183abb2
SHA1	3ca126c188345319618de4925d8d7f28b5471fd9
SHA256	cbfebc7d3f4e7e3ddf25b84e5e97ff5079a2e22cd963f893abad1e117434bc2a
SSDeep	1536:nM67+edk52Q8ZtgQUBfgMkvEFk7Xt215jenwQZu3MZD2fyKKAI6Q/:nM6Kew8ZGfuvGEXtjwQZu3MZD2KKKOU

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\BB6NGi2wX.png.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\bb6ngi2wx.png (Modified File)
Mime Type	application/octet-stream
File Size	71.08 KB
MD5	44013bf9647c679544e41110565d24b5
SHA1	dbc12068d506e3d0328341e74555c2ecfa8fa217
SHA256	f9464297d5bc8699d08549de0388cee1108c48eda9e1bfab7ae95e4798dac1d8
SSDeep	1536:bQJ4pn2LjseA8CqE00Q+kIoEnESTxL68uL3XX0yRAnDBL8SYyV9:cJkes+CS0Q/qLh68I3XOnDBoSYyV9

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\LocalMLS_3.wmdb.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\LocalMLS_3.wmdb.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	68.38 KB
MD5	32c780035a75e9b941587c5e8a01ec38
SHA1	6aef092ac7fd691046a369bc5770defcd27fcc53
SHA256	3f0110ce557b0950779245b2a7933c30a2008fc048985ba90c2c6233c2a36834
SSDeep	1536:cG71SnWQDeearw2hCWB0PL6KXnyiTk9dARP9on3clyv8C1QjtuS9YSbiaS:cG71qWQKi2tyeSJkvARmUyv8SakS9il

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ITvx2kJgh6O.pps.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ITvx2kJgh6O.pps.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	10.77 KB
MD5	63731a538e624db89836796d20e78a1f
SHA1	7d686a4a078dbe1fe5f287a1e2f143d2a119f708
SHA256	789728ddb537346f06fe5c39dc75472157738cc4c07c51114a2eca9bc4a7a584
SSDeep	192:lvRyq/iNtGgAclUrWJm/37RMR6wcHN5hvOmZHASaswKiSo7cMhfkR:pq//lUJC0HtxdFwKiSCcIf4

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\index.dat.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\index.dat (Modified File)
Mime Type	application/octet-stream
File Size	32.28 KB
MD5	22b918977a5139c82862580f90f633df
SHA1	1e836544171e239eac5329151a6f6ac78bb4ac96
SHA256	0b0a65994f342b1a02e609ec78d46037f409589b4e1f33cfdb8a6926bab9098d
SSDeep	768:irkgV9uJMj+UPz+9czzQu9Qh00HGYJeIzJcQzrw8meS:Y9Nz+2zzQNqIz/JS

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.bak.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.bak.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	12.19 KB
MD5	a29bc0dffe6c3921f91ecdebc3ba9138
SHA1	e0e08637e7a06d589e77d46f1c8e8580e45fdd22
SHA256	9d070a6ff608bea74d0e7487e82b9fe6ce67329a63844680b05bba62b49131fd
SSDeep	384:O3ZzjJRsS/BTn+TOtLRtZ0l6SXdUokoc1PE:kJR3l1Dm6Stbfc1s

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	14542c604d121eceb678e1343a1b94de
SHA1	981200e8504b6ab51a7ff48d9a579f688d5ed988
SHA256	839832445c5fbbe1b86aacc3786dc33850fcca0588c85db4236225cf4aa4224a
SSDeep	384:vLkbCQAYuXt2iviw/6oCDiXqsJSEX3DzHP3:kCDX4LO6tDtsJR3v3

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\mapisvc.inf.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\mapisvc.inf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.38 KB
MD5	51800486203de43ef4ebbcccb8b3e3c8
SHA1	0dd8fd3042564b6288e4b3ae19368eb142308af4
SHA256	2ca100b123ff831741d1aedd80a5434b6127201b94576e45104fa596b9756986
SSDeep	24:4IFwhK0XOAgq/cTD3kXkhj3xcv3QFW7wVsh4hqGXbBaa37M54ZFmz5DbIEq:4IG9z/cUSj3C3n7wih4hqGLBte4ZFmZc

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\w68OEh2Fo.png.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\w68OEh2Fo.png.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	46.33 KB
MD5	4236fb134ab44b3b59a0ec7fa6de852f
SHA1	cbacd0abb98d935704c105103c13ebcf709f1883
SHA256	30506e9fabdf8b3b29dd03f42c9e65f15066aa98173ac6f12a88cf08410cd57b
SSDeep	768:lt23XAwgjiisB1FhDFJt8L55LBDRT7Ir0A3CYe6oIHscEP9GSFdi4MBtBdOA9vil:lC2YDJC5rR7IYASP6oJ99JYBg

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\Outlook.sharing.xml.obi.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\outlook\outlook.sharing.xml.obi (Modified File)
Mime Type	application/octet-stream
File Size	466 bytes
MD5	780d659982978553afec6d0507c76edb
SHA1	237be994bc00bf4e818e2bdbe3af13b9fc26c409
SHA256	ace314d62dba642f7187fa69a0545f6c058b711fd104f192d2e9262f68743a61
SSDeep	12:n86Mp01t2bW2wrqORTCEEi885Jc3QV4pyyM:n8i2mrTRNt5J+Q3

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\content14.dat.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\visio\content14.dat (Modified File)
Mime Type	application/octet-stream
File Size	99.50 KB
MD5	6c16c5cabda732084c0a969e797e024b
SHA1	cca531ea62c8a495b3d4f17ecb17478300d51f6b
SHA256	cdd802fe8dabd7f660ff4192cae224aa628cf5180d28d0b8d1d4b1bcf5fbd895
SSDeep	1536:HO9mulm3jBwcAdMnQBL9hdXvQM86HT48CR9SQ85dIoXV/ijrfJL1czfOHrnK:u04ijBHfE9hdol3xR9S75Dcjyz

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\thumbs.dat.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\thumbs.dat.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	125.28 KB
MD5	caba33f78fba4c48a6db34e518354d1f
SHA1	3b9fcb9a450e242f409e84d1c5e2decf06414fb5
SHA256	77142b011c50e2025101f9b7d5c793a53d11f67ef74ee23322f85988bca37d2d
SSDeep	3072:MM2fWvvhGk3ls94zbXExBb3ky/hcpdPanFeIaTnGvtGp:32fWkYG4zbXELb3j8dQFeIajJp

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.chk.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\edb.chk (Modified File)
Mime Type	application/octet-stream
File Size	8.28 KB
MD5	ef92271ef4772f50ee3b136932bd9a14
SHA1	7841448fd2685c936c12068b243be9c7fafdec3a
SHA256	338fc2f6a595104102f9763d19a11398b9586fab49d8b5e70734bbd0fd5cb0e4
SSDeep	192:1tdypwjkic+esA2IUeh6rw3rZuVlz8RgMxTVThEiXCujTNIW:1tdy6jk8ePh6rw3rmz8qMxTVlEi9NIW

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\oeold.xml.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\oeold.xml (Modified File)
Mime Type	application/octet-stream
File Size	546 bytes
MD5	ff0e3deed6641fe3eaa2afa302f08fba
SHA1	920a116f602246c71148489865071f0b28a0f1e5
SHA256	adfad9c964e367c9158cdfbc3f3645b45adade61a73c7cab63913898a36cc349
SSDeep	12:XXMUy2okJKlZdK7+HpwQopa9I+3nTunfbBg82ZE/BYWFJmfQttTYzs:c6KljK7++6DXTuF0ZcY4tH

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\edb00001.log

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	2.00 MB
MD5	79bbe8c86f1f912da3c2b10f9193a874
SHA1	d7e0496125c4be5f7e1125f3ff0aa0816b989c12
SHA256	303e76639528c2ae1a6f818bc224ef3ea20fe83adad5d41b40b601b75ba66f45
SSDeep	49152:NRgxyF1QDGzyNf9BkJN8dsFUtq54IVNhCh9EB0AH:NmyF16t1Sky9uee+B0W

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.log.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.log.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.00 MB
MD5	f368d1962dcaa8a4195f346317a9814f
SHA1	0df9b3318bc7d03b11dc1be57ca05f890d2c4b2c
SHA256	5fff7a48057cd2ce161b520c26d26eea1c8283903c7faad499a8dafd62c7243b
SSDeep	24576:9JvKQUl2K05p2eh0ULLmTDLI0NZDrQxwq5tPFDDdY/rnitHQftMqFm4KaoK2Ed4H:TiVPOR9LB2ipPFDqzS4rjKA2EdK3g+

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\peacock.htm

Modified File

Text

Malicious

»

Mime Type	text/html
File Size	514 bytes
MD5	b266b03e388704ee44a238eb9a15e245
SHA1	767f2735add65847a89127875a6d5f919efa4244
SHA256	d287bfe20074e507f5660cebbbd3a92b2448513329e09c853780d0f198845409
SSDeep	12:QrHG43VdMTzhnLGarWTXug3a+AFvNYgFhJNXXSn:T4FOhLaTegIFu1n
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\stars.htm

Modified File

Text

Malicious

»

Mime Type	text/html
File Size	514 bytes
MD5	29c54897a770192d81107d81a5b00c17
SHA1	4eadd982133b2df978ee18005e528e6b389147f2
SHA256	be65c4f917932f4852c7bcdad7936fd2ce4dd3829aac9ee5671d070e9c30f825
SSDeep	12:KEB+6/nlVl+yWHtVJELzNqpTlq6pNACWTKBEcTQh:hB+GPlgHxPqPFaI
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\stars.jpg

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	7.61 KB
MD5	3847f30f7bd30a63fea206961dc9cad9
SHA1	e97940768f80f39dc14b0e00ef2e24c5b65cd3c7
SHA256	c26c4778a7873e386cb25c67b859d861fe7bf703e38809a07a4055f3d27ab45e
SSDeep	192:2XZelqz4TsE1zKaH2CiLdTAwvKJfrsFByObPKFEz30:aBz4TrxWCeys3yObGb

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\roses.jpg

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	2.16 KB
MD5	2f3dbbda0e611ad70623a13cb9565835
SHA1	ab396e729bf7986f801f297e86853eee74b898ef
SHA256	bf7489436a0f885be6bef5f26dbbe02706bd511a518452bb5c56bdb334df3b1c
SSDeep	48:nZ1kVsda46pXPmgH5DmuzjGx1WxGNKpoVOOQod6TU3yUwFXc5:jkzpXz5fvGPW0Y+kxodx

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00001.jrs.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00001.jrs.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.00 MB
MD5	5ed17399407738215052602f31607479
SHA1	8907463c789ec062b0e75c8b7838bc6b8e40f278
SHA256	4a22d7460c162a12aa67e38548317676397ce5a0121e8269613b88ac9189c73d
SSDeep	49152:1Lv3bNY/zCQewMTpfJJbVI5n04CdITcVjqi:1jrA4T5DbVIi4CdqcVGi

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00002.jrs.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00002.jrs.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.00 MB
MD5	0f4c1ad65b87d2e1327e9b79ced0273f
SHA1	7febb6c446f8f0f7948de6da5dba5d0c30789f8f
SHA256	de3e6cf94730d7ad3fb6368aa5e181dd69dc2261c67d433a17b3b94475dda5b6
SSDeep	49152:VCExhQ6Ohk6l3attEPhR+m2y6XrUo/sN8Rj2xCC7nekw+FsQik8Lj3Gy2:cYhQ6OK6lqgPTwyGQdNTIC7nHn63c

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\WMSDKNS.XML.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows media\12.0\wmsdkns.xml (Modified File)
Mime Type	application/octet-stream
File Size	10.22 KB
MD5	80ffea867dd411da796ff3f9894706b6
SHA1	ade0d0856da571967d04d34791cfbefb9d1dee11
SHA256	2be8ba882cef11a72274450a7e7ca1c77e3b1a8d30d1b64144a5fb6273de9cd8
SSDeep	192:rNKd4lPKlyZEaplk5MS0BFMZtKeG/qJ6055OCWYWCgu2vKi8e:M4lPKlyO5btKeUC605PgbvF

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dQvmZCrasMOOkmkwrf6_.m4a.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dQvmZCrasMOOkmkwrf6_.m4a.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	9.42 KB
MD5	4e331f199bdcab3e7855242ad8209d30
SHA1	66fab9ad603e4f94e1ee25999ccffe8a1dc8b4ed
SHA256	ec38feef0e716032fb460c428972a88fa6fdd08667bff2208ac03559e93d22a0
SSDeep	192:5NDThGOG47yllkDxEanqW5Vk5gGbK2vR8AZrGFQQIdO9oO:bh7fGHkmannW7RXFCydO99

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\WMSDKNS.DTD.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows media\12.0\wmsdkns.dtd (Modified File)
Mime Type	application/octet-stream
File Size	786 bytes
MD5	5fef61a2a860119b5de74e107da946d5
SHA1	24584b3b65b7ca1576f20fede90f588a2831e599
SHA256	8f938e62c4951c625f2a5828f6f16e379e0a3b3aa283c2b055a910f2d1aaf898
SSDeep	12:IKqYkNFLbP211hvu+5DQzFCAukZhye2fV3dTdjIZGvaN3d628nnZ5SO:IzZLLbPODuyyCIwTdgx3dyZQO

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\History\History.IE5\index.dat.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\history\history.ie5\index.dat (Modified File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	8bcf7a6e51cafdabea919e053879dbff
SHA1	944e1200f4ebfb41fbd6e67c04c7eb2376b005ad
SHA256	d1056fbb8d2042271c7e5580260097fc5f6215e4c1bbac47e5b972534fa544a9
SSDeep	384:3QBP+dMdnV3tHxzDXreVuFgNPLFoIYs8/rVXgwWlbTo6yGtcy:gpttXu6IiTHEz9T

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\jrqqejm3quly9as6owkz.avi

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	94.97 KB
MD5	9a08d4327b996807958b5ba12d3d2c6f
SHA1	d8c4b70a18e46d1984db76703cce3d401b3c610d
SHA256	5b2e48cf16c121fc8ad56080a52e03a816689bcc2888b25c4231a3e237a655e7
SSDeep	1536:aY4qKg6AiJw4kU4Kc9ZR49ONlqfHDkrTySSUhQPCFsvQh4vhfs4dNNzysK0:a7A6AiJSU4xbR49i6HDWuSSUhQPCFsvv

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\pl_9laY1AOm3ZpENd.avi.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\pl_9laY1AOm3ZpENd.avi.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	94.44 KB
MD5	a15b02e8022aa04845e43ffc9859afa4
SHA1	697b6582d8acb108fe23d2f7407bd2e1c4c84006
SHA256	06e5f8064b9d4dc71331c7a8d38552abb5f4b2d385a917d259c39a498a8d48cc
SSDeep	1536:hfsrWqq6miDU3jDZDpIecG/VTTD24/N2sLKlP88/nJ+v/MQ1mAB9iQe:BsRq6mwUfZDueNt/NclPlgMQIAC

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Hop5kxcwegEJqQDr-.ppt.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Hop5kxcwegEJqQDr-.ppt.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	4.86 KB
MD5	fb619043198fc3a5319c99ea6ab1398b
SHA1	d18d676afdf74623ae4766af34006a853a557f68
SHA256	12077fb86c156ff64151335f4e01adc7daa86d14fa8a5da1ee95289bfd2e59f8
SSDeep	96:8ldO+zR0sIKBxdmla6EPfaA4U44pa4xQLOmKQvzEZd+Ew9I/4M0oXKNwVI+CCu:8ldOSHIOxAla6E6A4UppzGOkvzogEw9J

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\MSIMGSIZ.DAT.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\msimgsiz.dat (Modified File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	75e06834a0f8a9a366a47feddc3f62e9
SHA1	28210391b1a3257205a56ccb5671b6b25cfc7402
SHA256	c8eb871179770bc24b0e4611add030282fd977f917d61216ee2f0c8c21fa226e
SSDeep	384:tWgsmfsvHaR/6AGlQ9RVazRZDgZy0btua48p1nZUaOsr1rsLcY:tWBmfsv6R/FbWXDgZZtuJK1nZUhsrhsV

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\YEPLf5uQn2ztkpBPcL.mkv.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\yeplf5uqn2ztkpbpcl.mkv (Modified File)
Mime Type	application/octet-stream
File Size	75.05 KB
MD5	a2a43190a4dbffcf080ed8fa04715740
SHA1	56511188535985bdb98acb38a7e18bb87804c7ee
SHA256	49be54f00732f84f9dd31cc14a65e6d2dad70ccd2f4bbb13108073069c1a511b
SSDeep	1536:W/iR0trE4LsFg6uYCqmlP5OKZBurg1elaaneGTs65SrazWuHEYx:M9RLtrumlPZZBkYeYgBs65Uazx

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\juQWuDoiIcu8wofpLklM.bmp.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\juQWuDoiIcu8wofpLklM.bmp.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	6.74 KB
MD5	2699c4b7714bbe1cca9537f99424c697
SHA1	1962dd14963e12fb22d035265f22e489f6eabe66
SHA256	c25ae1eb87625fcde64c0e7dd06cc7b07e016e439dd9c97ff2276cc6bc064272
SSDeep	192:0R4wwSKgOXIHfCAhEr5LR72RtdgvND0RN8P0:FRKfCkEIdENo8P0

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\UiyLIaGypuAlUrTgxJZ6.csv.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\UiyLIaGypuAlUrTgxJZ6.csv.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	7.99 KB
MD5	84a0402ec8bbd5ebc00f9ccea41ec929
SHA1	7dff5ddea79af13a0678a67257030dc4a4dd1a6c
SHA256	a60cac03881ac5626c4e8bc91a8022b25e8688828697357e94bdf9b46b1222f7
SSDeep	192:iZIV3xZ27jVQe1a0hu0PKaMPY7Dly595yDoUn8PS:iZIVi7xMQlU2Zy5bkosD

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\MSHist012017071220170713\index.dat.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\MSHist012017071220170713\index.dat.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	32.28 KB
MD5	df87653151b0d21295bc36d77f062f17
SHA1	1f3f3e46ecaeeb04d12deffecae4cd85e5fbc1ef
SHA256	184d3b2dc866e90b6b1224e7712ddc3236109e2da7ec51cf57aec22c521333e2
SSDeep	768:e1lSUCp7gm5Nl8G4zXFMOOzK6PTmgeOwLQYmfb0x:eHSUCp7gm/lbE1H+PNerrm4x

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	28.28 KB
MD5	9a194084043f7f07ec78265625c03b99
SHA1	7c8c6a54683be0d9014e81afda28fe22bbcea27f
SHA256	2a1c752b65ea2b7c83e93afd4696f606b229ed06702c43aa936c78f3933ad21d
SSDeep	384:mH5Oo4G0nh0DFMFQ/5udHwDbpX6CSOXzvTHEPx4naQTxcT71NrqOg3tBz0:mH5JqnhuMFQ/chobpX6gg4nMvrPg30

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\index.dat.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\index.dat.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	32.28 KB
MD5	07cbcffd262b20c1149a083a36ed3f34
SHA1	8a5f43af60e7d4228426e63ee4338f35eed0f46f
SHA256	c3c02578c8522d067210479f6414e576b0e620cdeb2329c68832c2874420ae80
SSDeep	768:0yF8cdLBXdGhF7G8+dYqJ6x6YLTse0A+XxD:LFZtyZ/+rJ6x/sfh

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\frameiconcache.dat.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\frameiconcache.dat (Modified File)
Mime Type	application/octet-stream
File Size	9.27 KB
MD5	e512c8d5f6f65d60f990a62f3733cea6
SHA1	2e99db7ba74fd71e2772ec86bfd5cbde59521c97
SHA256	0650099da2f098e932728eeb588c5ff44d65b0e7ad7692160d31fdf3e0684505
SSDeep	192:wXEyY9XqcquwHd+ZWGkmMeIa+jbCeTfysQXDUahY2gU/QoolHLqTzng+VvBe1Yw:wXEJV5ZWGkmMDZfIUai25wk7gmZS

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\CurrentDatabase_372.wmdb.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\CurrentDatabase_372.wmdb.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.02 MB
MD5	3e7929623a4e28db56b226d25c651aa1
SHA1	3dcc79703cb5b245e2136bfe5538257bcd798841
SHA256	978f184280962e0667c0fc56c2f6f233cda1f8bca2426b72b21a3de3c810b089
SSDeep	24576:D+rTf/iQiaZoNQJE8LQYEWEqCV+waIJ73zme7HK9xqerN:D+rNi7QCyVH9GNMeTKDqep

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	402 bytes
MD5	02b85fddb3112aac4ad605795a15b9c4
SHA1	97753423282d840180f9220efaad22d65113e18c
SHA256	bb4da2a86e8075ac46f858ef062249c128063b0d2032eb5bb50a9c68ee4d9e94
SSDeep	12:Pd8GKXllM+Ts+SnZwawhKKeL+HRgKRnrNi9yr:Pd8GKXllMz+SqawhM+mEZiMr

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\14.0\officefilecache\fsd-cnry.fsd (Modified File)
Mime Type	application/octet-stream
File Size	128.28 KB
MD5	ced3a367bbd775f7c3cf8419632534c8
SHA1	b734c48834f2c6c261a9dcad0b7be96737aa3e93
SHA256	fb9325f9f0befe1ce9cf83591c08218eb3df9439cc0646759d10db37298d3c15
SSDeep	3072:/cHCMhwa8K39U7EWXuHEQdQNmw9HFQ760YMs:/tTa8K39UgWeHEEQNmwlFQ7WMs

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.htm.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.htm.RYK (Dropped File)
Mime Type	text/html
File Size	530 bytes
MD5	1e604fe7374ec6a3b139a94a39061174
SHA1	2aa9e8562f00a6e3eefeb035342b46ba0c61f8dd
SHA256	d695e18e4d991ea787fa0289d1995a300a7bf7114faf56c740be8f6986d0bd2b
SSDeep	12:FjwEFELKO2xyeLcQVfFC52QHvQswJ1dJlh+I9MRaTEtLf1ukOVcf:rWKtpLcwC5HPQLruR71f1ukh
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.33 KB
MD5	1e392a758c7851db845298acd3c286ab
SHA1	89f936cf1f79a2359428fa483f43d48cc6d9c15f
SHA256	8e1de59a1ab2c9f8402ac66a06b0cf26778e29bec5fce58cb002f4db6a2b669f
SSDeep	24:N4funHcQ0DJkZrmUGQWNQRH9RM0oD38UDGbFmEf4cAun5kCxwl0Tcifh3kXU:N40cQM+m7QxH9R1oD9Gm5MTcifmU

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Garden.htm.RYK

Dropped File

Text

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\garden.htm (Modified File)
Mime Type	text/html
File Size	514 bytes
MD5	badff3667f2518fe1a5d502f04397a05
SHA1	00833d6e3369213f461ea06a45a0ef04c5b9d4b5
SHA256	bbb340c98091affd9873a71b21af55ebc2ac6c5585e306275f668ecf5d683a1f
SSDeep	12:dDDve47yrxWNP9mNtnOffPCyQasdp6AijiK+juQG8dk9rfJ5tg:dD17yWF6tnzLaSViGK2u0dkU
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\WindowsMail.pat.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\backup\old\windowsmail.pat (Modified File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	74b8c1a45b9c359e1c9dc34929218ba6
SHA1	4d666a674761b5c60e1412774a5d85f2af59417a
SHA256	e35d422a88401588361ad550c263e91b1305166d7b3ae7597eeee66f5b255489
SSDeep	384:57k2FW/ywCVfRSSxy9dvKluXyG0GNl8NwJTOEBGD:5gOW/ybJ69gl5xGWkTFg

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\edb00001.log.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\backup\old\edb00001.log (Modified File)
Mime Type	application/octet-stream
File Size	2.00 MB
MD5	7960fcd7df7aabd4001ec9ec08515533
SHA1	88e16145035be709df9d3c29cd513aee6c3ef383
SHA256	c0ab948c4f5e35c0560cda616160e9a2d5ec857d33c750afe0b829d8217692b3
SSDeep	49152:B1Hc0Ki7/07AarC6rFGJ/BATI3HFORS9nWS:nHOi7/0kEUtBII3ERTS

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Peacock.jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\peacock.jpg (Modified File)
Mime Type	application/octet-stream
File Size	5.27 KB
MD5	96887374648eb1bcc514200cd3a3d209
SHA1	3c1c49d2d03df22b7c8e8908ac40c0e4de463575
SHA256	c7dc5905b52b5c06bd8d4519a0e86fe079431f954544843fdeb0a2ddad56f736
SSDeep	96:OF4K/iybaM4V+jn7RcJctB9IIxYlLPFGVA1KijgjzxwsSyHXyf/s:bK/xb7s+jnOJC99Y18VAzUB/XyfU

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Garden.jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\garden.jpg (Modified File)
Mime Type	application/octet-stream
File Size	23.58 KB
MD5	e4f769ef2185e9b8fe2619e23f3530b8
SHA1	2cbe8e61c6e8c734a0cd5bb42e2a59d47e7f6f76
SHA256	8f226f4a35c9394ba66f6a22dcf8a4aa436c8226626352e1f0af503cc59ed01c
SSDeep	384:R+MY/f1gbCCm8T0XQvEvjT0XAR3yOzCMYVAkbnxNadUni0f+jsEHnsmIFxvt:HYVgbCCmo0XQvEvjwq3557sLw7lHsHF/

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.htm.RYK

Dropped File

Text

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\roses.htm (Modified File)
Mime Type	text/html
File Size	514 bytes
MD5	9d815c16cbfba2e2979e2289937f971d
SHA1	7386193e532a4045d2dd1f6e0f02234fc0c7dd01
SHA256	350059f48ddb5e07899a54a83653cb0f8378c0e12c21e6d02d37ea22a23e98f9
SSDeep	12:+cnr91pewHw0PObhvA1kpJUEaYM/Tqmr/mOshikmbsYp2A9bPN:59veY1Yhha5/mAntkwsYL1F
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\WindowsMail.MSMessageStore.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\windowsmail.msmessagestore (Modified File)
Mime Type	application/octet-stream
File Size	2.02 MB
MD5	c889cc688967ced4eae359969173d121
SHA1	6618daf51e6c9340a3ec304a1725976cdfe16ddb
SHA256	deaf802a86b5702e054f776dfd3b25c62307854e28dca911e7eeecc3f315c5e3
SSDeep	49152:+4GtiE+C+UNhB4FApt5NnMR4o0O8jjgw9GowuaVnehpq:+iVM9npt5pM+o/w9rwRVea

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Temporary Internet Files\Content.IE5\index.dat.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Temporary Internet Files\Content.IE5\index.dat.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	32.28 KB
MD5	460b26ea8d84009c32f64aef77282a6e
SHA1	8ac0f6930d005ccd21deade99593a932bc7d9275
SHA256	6c19d057c11927b658ed54236dda88122c46af6bc4c6d4079e95073f7637d567
SSDeep	768:l5Lc6hofowUMVLa586Bxp0G9XxNORVFSrk0XwFAMu5zkT:l5LcMvwRLa5XBxpZ9ORfSrfF1KT

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Orange Circles.htm.RYK

Dropped File

Text

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\orange circles.htm (Modified File)
Mime Type	text/html
File Size	514 bytes
MD5	6c1b11732e3a2a799cc8c8749b7fc7b0
SHA1	0bf4ed3014a776e36876a97218d72b78a03a2917
SHA256	1c0c10ff63eb221fbbccf3f7c7c6aed383f935d1e7cd1490c9b32255a1c59f4d
SSDeep	12:h28qDm0lyenHsuH5NgE9WwGSwS5Q28HR5eUeiLOtweC:rqDKgsuv0wMxkUeiVl
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Green Bubbles.htm.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Green Bubbles.htm.RYK (Dropped File)
Mime Type	text/html
File Size	514 bytes
MD5	d2bd5faa0eeaaf4346a7e53573453744
SHA1	8b3060b91a677968bfcc9096afb0c00656a89043
SHA256	081f6bff9610aef23d3eaf3dad394ff00923a8f878f06bc385f87165b2d9a316
SSDeep	12:84gaLYf9l1TTE/CNWQP2WSoeWaEpZczlxD2SOR31n:8sLcPiOsoejEpZ8lxD2SOR31n
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	6.53 KB
MD5	3fdb9976c2080f96d0b91478847b2277
SHA1	1a035d8fa9c32e750e6c8eee17416d24b3d7afdf
SHA256	e0295c7805077a742d54e06d4a5b67b07f8b69c01dca700e51c876b112992ae0
SSDeep	192:0Nz/RigBEgnwkow2QDHKDS9DfdgC2L2WKG/:0NVQtvQbGQVg

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\softblue.jpg (Modified File)
Mime Type	application/octet-stream
File Size	10.60 KB
MD5	898bbd5b612cefa13bc293701ef1434f
SHA1	06a91e644c99b30ce06c5b4bdde49079ae8dcb17
SHA256	ad5c1aac8ec13f0713c5e6e5295894e5332ede6fe9cd10d94d930d3a9d5839b4
SSDeep	192:VEbi5aB5JGWdFKVFTBoszcWxswHl8ul3ejcAVMT/nygL86ANIo2hvOw4ADCsIZkb:u2XWHKVXcSGulu8l8LoUwlp1E2lDl

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	4.89 KB
MD5	34f56b2c435ef6bd3e07fdc85d7817b4
SHA1	da789b1dd8cca2d901c901a69e1d0572c781f8a1
SHA256	913a6512c672abec69c5c87855ab63c04264c6878687c3b0f9d1776bb28c2a29
SSDeep	96:kb7qiIjiQSTF/jcI2ARxGuL/ZgfUQ+ftNYy+3LXP0KL4wyQ9:kb+1Spjc8R/q8Q+Fey+3j8pwyQ9

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	6.50 KB
MD5	79bd9df7a9a2b9048215bffe49658a21
SHA1	a7a52483c75eba5821e405a89864b4cd79ae9374
SHA256	3552c8f76aead2a9dc4e6c9d7aa3edaf871152c5e45d38a21fd97c160531994c
SSDeep	192:baSuuMrt1QYWfCWsdcLVlg27y0APu+UIhqm3NefGRBZ:bazr7QrpVlofu+UUeeRBZ

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\HandPrints.jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\HandPrints.jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	4.39 KB
MD5	70a8ae2aec608c76c505b34d6ef2a54c
SHA1	bfde1caabae6f90fc5c07266e85bddd2b2f13128
SHA256	767989f5cb8085c4082aef247d614bafe01ec877d48e4c1eb6a1151e5d4ea9b5
SSDeep	96:oo8GJXTwYwde8Q9H03th0sjDkR1TahfE9mKQXe34iS6Bg:tJX8YoD7sR1TCE9mKQXe34iNW

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Soft Blue.htm.RYK

Dropped File

Text

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\soft blue.htm (Modified File)
Mime Type	text/html
File Size	514 bytes
MD5	d40f1f3b9608533ab398bc9e00326f2f
SHA1	50cdc3a2c2d769fdee4cb547413ef54cf55e3b6e
SHA256	ad806f987b78b01c459789ef3c363295812e2ce9fbfc5aa9045a8b4971421463
SSDeep	12:DT6ABSvcsxl4PLYV8flnD72D4hicJs50l5VAruoTn:X6OSvcsxSa8520r+0l5V8BT
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Shades of Blue.htm.RYK

Dropped File

Text

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\shades of blue.htm (Modified File)
Mime Type	text/html
File Size	514 bytes
MD5	c829ac5e383a8100f878a2ea0077071b
SHA1	d6533a821be460c144df976599fce595d7fdbc02
SHA256	8e2de6f8eecda9c624324eb82f253596ad6165339cf09320db43a2439d8a6afd
SSDeep	12:JmkNixG3akwI241NOP+CvZyNcYw4gm6gmNwb5eWSbOIxBd//+RZ:/SQakwI2qNOW1QmaCvP832P
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Hand Prints.htm.RYK

Dropped File

Text

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\hand prints.htm (Modified File)
Mime Type	text/html
File Size	514 bytes
MD5	b780bcc1568791486684d50dae363de3
SHA1	056b0984bf90777a77ef13e6a26ae985858ef410
SHA256	6550e5991caa54758afa673e25c029e89d9034e13f251346ce287775409fa524
SSDeep	12:ZKmXAFsbwEpTNgAJG6+uYFWPEA+bvr4z3:YmQFsZXgIG6zSWPE7vr4r
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\js[1].RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\js[1].RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.22 KB
MD5	271333b8132af46b2efbe31b7691aa51
SHA1	af9b47d202dbacf0d32476cf32342a9e119ba0e8
SHA256	7a0b8af6194d420e19836f53a2657d6c3c478b2522fa383732352d8184d915f9
SSDeep	24:gGqaymKyfx1YRqKeOfTvrYWcKkqXICwuHlXHYKU0s/ctx8CEagIjhWCv:7yvyoxeOLMWcNqXIoFX00Kc79E3G7

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[2].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my\v2[2] (Modified File)
Mime Type	application/octet-stream
File Size	11.56 KB
MD5	737ebc4f4c835757c1e19939b203c022
SHA1	a71cb3759db7bf4cd2bb6d94b28ea57c8a7f8de7
SHA256	9b24025c5a61d4c6b825ba875242b5e887b69908b670b0c7f2372f0df58cc876
SSDeep	192:JA5YruG8JKn5iiilA1GotzRLsX1c/ChzDnB/SLPuJE/c6TEpFkUcWkih1kL:JA5FGoj3fodRO1cd95TEPjj5hC

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[1].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my\v2[1] (Modified File)
Mime Type	application/octet-stream
File Size	11.74 KB
MD5	b048f33c758b7da03add8e903831eb3e
SHA1	7970622c3a88cd2dc53c748faa0f1addab818b5a
SHA256	99e58766e91fe4d3f70154db66772638caf71bbd6ad52920465152dbeefca44a
SSDeep	192:EXm2AAklXt2y6MencmHt9r0vdhJNEYhBDVCLxG+l/0AD2e4cHNqG/jfMkOQ5ehxZ:EXLnqMyVqcmHtsNEYhPCLxG+Z/D2eJrO

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\f[1].txt.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my\f[1].txt (Modified File)
Mime Type	application/octet-stream
File Size	13.47 KB
MD5	424dfdb6ef720fb40f2521ae2b5cea87
SHA1	2b7e43a06861ae4411ed904f9db0290f680c7351
SHA256	d2694de4cc83d810533df4920f182efec4ad18300d7a10ff5409a889e6780161
SSDeep	192:0TwkErwvyp66QWROFBIXcxXoTscdhlu5gQsrJqS9zr9uXJJnaoJHtWJxv7Y:z5zmBZx4QlKFqS9fMXPTN

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[4].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my\v2[4] (Modified File)
Mime Type	application/octet-stream
File Size	11.69 KB
MD5	ce2b149fffa8294610045020d11c6e2d
SHA1	71f8faf4aca1e0e35a6d8cc2ca8dfe4afbd36286
SHA256	1f6ce712885334d5e5aeb12f52213d0fc3832ba05a23d209c9ce866d8a50db1a
SSDeep	192:9rSSqEyXLXgAfoG+W1N1y0n/+yRgmIe5MMZOb+bqjbJkS8VD7CpgmgxPBCoJHt:9rUEiFoyj1yuDGinqvMV3oBg1BLP

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[3].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my\v2[3] (Modified File)
Mime Type	application/octet-stream
File Size	12.19 KB
MD5	73737a66e3f94b53f6a499d2766e4ad5
SHA1	f123a8b893f79967ba87aa0dd5c649ec6eb83e48
SHA256	b35c478f430204dcdbd16d63eecaf2a17935f10b141938db64a1efece955cdab
SSDeep	384:p7UDKuW40pyVtPjtJ9s/uKFlKAbgZRMi4VR1w:NCWihEGclLk9Kw

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\ga[1].js.RYK

Dropped File

Text

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\ikqeepzr\ga[1].js (Modified File)
Mime Type	text/javascript
File Size	42.35 KB
MD5	0fbcfd386e0afbf2150085307ca372c9
SHA1	1205efa26fbd8db5a162da0371f1248e2b69809b
SHA256	21c88e603e62fac8d2e33be3482da8393afcaa5d8f522c28413fe26b26254958
SSDeep	768:lrHlCpezPTDoZSRBjX8in8bBoX8hgDkPlL3FnegeX92PLxY7W6swsk+y3:lZHz31egCBoaH1eXc4WDu+w

YARA Matches (2)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match
JS_High_Entropy	JavaScript has a high entropy; possible obfuscation	-	4/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\index.dat.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\index.dat (Modified File)
Mime Type	application/octet-stream
File Size	336.28 KB
MD5	48e04ea8f68917c0ce5e8d337d581f9f
SHA1	c5f62c737a525b28ff9dbecb0583e1cd59b0b288
SHA256	917155dea8fd37c7a95a77f43eb7fe2131a2c5769615278c6af1d0a59a2da2e8
SSDeep	6144:AkQ5qaMTja1S3K9kzOLbwunZ8aR958bkR9yL+MFUUSFiwmw8m:AfIaMTgS3UOO3wuJR9pnyqUPMiZm

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\js[1].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\ikqeepzr\js[1] (Modified File)
Mime Type	application/octet-stream
File Size	1.47 KB
MD5	15bae06f50ef580fad0fc3127fcb7ea0
SHA1	b24d8d8616708bb44493cbc674250608d4df05c5
SHA256	a883e36d6189040332c7f4402ae92d068bd48889a89e0a6adfcc89588d4a3a45
SSDeep	24:Xb9Hd1sqff8qv0N2ihah+yd0MNA6IAkHGYt8eoqEbDBe1GuAzRU1l8laaHyHW:L9HfxriEh+ySMNH3YHpEBsQS1lCSHW

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\js[2].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\ikqeepzr\js[2] (Modified File)
Mime Type	application/octet-stream
File Size	1.63 KB
MD5	48ee397190a6d3909163971e77f7d4b6
SHA1	110ee1d40ed0ccf1243fdd354e8ffb4cccf98c26
SHA256	9873dd967ecd509e2320a42c1607f32ab902655934cf2715004a38aab732ce4a
SSDeep	48:UAKWpGnNh+ApSZCeuk3ZK4FhuzMJq5BtMP:XpGn3Np4ttpKchuda

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\ikqeepzr\th[1].jpg

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	2.55 KB
MD5	2fcb06cb709269df8e4ab9cf76660300
SHA1	79b9fbe027ebf771a405f409a7f113cf8ab079c4
SHA256	c87f19fa6c18845af1733b7b9cf17f3d8d13193f69386cd7844bdab8f8a0c452
SSDeep	48:EEJj7TqgvJ9nd0zpys7aXETRWhh6lZh1jnaq4QvkXjxuD31e6gIbtOBJir6GY/+u:HJjHb9dwpsXE9Z/aqrsTM1e6tOBJirVq

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\js[2].RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\js[2].RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.22 KB
MD5	aca5129e0a6d1a442a96f8f4056cb0fb
SHA1	5d2120247961b2aae4c7517e65299fd398eaa154
SHA256	e4c965f791aafb85e76ffa9a3ce7f56ea842c9397cbf8506f9646db2f50e7893
SSDeep	24:o7RO0HylKt6/nHexXiApX3DlUlPtYJFSla6H76MYXLqdR2i7kC:OPV6WxXiinFcb69X0fkC

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\js[1].RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\js[1].RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.46 KB
MD5	560d632037b4e130be38a47b2381365a
SHA1	c872be4ded8e1e701ecfc00fb22243584b02ca2c
SHA256	68df3788781020c51fe5f55423e8d749493abcefaadfeb0245aa0cd2684586fc
SSDeep	24:8kERIZO7NiYDmUb4unrC1VcYBOm1RmHRTqoVrr6NankfjN1eQxpcamsr2TK/ne:h3Z8i4mFuO1uYBX1R8RXVruNaEZpcAru

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\v2[1].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\yg1r61z8\v2[1] (Modified File)
Mime Type	application/octet-stream
File Size	13.06 KB
MD5	cca56b8381cf88e9b1029211e11212af
SHA1	858a4aeafd2ed03ad41e50bae87428d308131ec8
SHA256	8caa8c237cd3d8fd64ffaf17c7f3d8f1e1e133c142b6767cbb74f2e53814ba31
SSDeep	384:nZj4eaH1G5nN+9sZ608dwZ7a0/j9ebUOTprjM:nzxNNdxO+j9HOtrjM

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds\microsoft feeds~\microsoft at home~.feed-ms (Modified File)
Mime Type	application/octet-stream
File Size	28.28 KB
MD5	1a36e66bc05b9fff0bfff2c347cb6d0a
SHA1	8e7c633257acbcfe9bb4b9832021d47d64eaf1e2
SHA256	591ba5e28c7366637cb985328e349699fea549d638f878d32e6b2f2fa5e1ae9d
SSDeep	768:5g5UXOtp8GNct4v6PR+XZTh0KNkEwqRjnFyqm:5g53BQ4CPW6KSRIjMqm

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds\microsoft feeds~\microsoft at work~.feed-ms (Modified File)
Mime Type	application/octet-stream
File Size	28.28 KB
MD5	d728ca4dc76691683bed50173662bd0a
SHA1	a84bd8305fd9f907bf5578c0d79c4a8943f6e414
SHA256	f51f46b3b48d1057e5d57248ab08e417e0a9a1772b5c50d6514610d3ff8491cc
SSDeep	768:WSuhcwaXapYND/+ZyfvIcCsvnqG9ULFsd:WhcwaKpE+ZyXasCoisd

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\11_All_Pictures.wpl.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\11_All_Pictures.wpl.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	866 bytes
MD5	a9efec0fd4617bdfedcc773992582eb3
SHA1	c5d2b951f2f151c02658862763867becc56abe9b
SHA256	c5544b3f245dda3a558a7097d9cbe974c403fc2b6982e35d93c1d33e2301879a
SSDeep	24:3mDPSiAs843r44DvxZZ/4ll9cILHJmum7DgnpwX0z:3SPZd44DvvVQ9csHJe0qkz

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\12_All_Video.wpl.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\12_All_Video.wpl.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.33 KB
MD5	074c8e383f797e8ff343cd4e1b976772
SHA1	c4a391e7a5b012dfd5aafc42ae2b625adab2197a
SHA256	29c8337426dbb81e52ded6adf7b5081efb40f66db194aaddb4c20c859091d20e
SSDeep	24:7/7FoqjpUNR3TEjPHzlYSxSz3Ni1sNeO0g9vEGwoQ8DdXTNm4KbEWrSiOhd5:77FVGf+PHWDz3S+0SvdlDNm4KPS/v

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\12_All_Video.wpl.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\media player\sync playlists\en-us\00010c6e\12_all_video.wpl (Modified File)
Mime Type	application/octet-stream
File Size	1.33 KB
MD5	21c84bafffb3d1c03494fdd02f0cdd71
SHA1	d41de8e4417fab5b09c42aa545be17dd4f9d1efd
SHA256	df0bd817a158ef38dda776de5078e74c603b66d818478c212b49fddb29b2fd3b
SSDeep	24:1W6k8Abl/3fUSM4vcfRXuN0EmzGd2TQ5qUHub4ulNFZRl2Dtv0GZJ0Us2lcZ6J:w6k8AbNe4oRXjzGX5qkG/RzGW2G6J

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\10_All_Music.wpl.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\10_All_Music.wpl.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.31 KB
MD5	deb46b77f45265aa50e417a1cf569bf5
SHA1	22324cfe2aba1ab58d34b88997c4d9030ae06a6a
SHA256	b475374e668c2fa511ef5a4300ebbcd75d1acf802a1b5d7f11c662f9c4f4f192
SSDeep	24:n2hLnJQdvg17PeLo0HOkGzTT13ibAsONaQneihhOVp54+uD6KiPPK9y8/zVB:nwTSoNeLxkOCmi+Vp54XDsDQB

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\11_All_Pictures.wpl.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\media player\sync playlists\en-us\00010c6e\11_all_pictures.wpl (Modified File)
Mime Type	application/octet-stream
File Size	866 bytes
MD5	aae1608522b93073e2feb5b78376b391
SHA1	739dfe320a8e8ca22df1c526022ec8923186ef29
SHA256	fb851d6c7e62e52a5fff988a36ab527bff18b0059906c78ee484a5cc215dd879
SSDeep	24:AD8yko8JwpZW/35Q65OR7Se5VJfsBNMWkDzcobWm5B:3lap8xQ0e5jsBNYzc2

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.sig.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.sig.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	418 bytes
MD5	e314ac9010e5243f1e364b99d5d7860e
SHA1	4bfe001a4781faaabaec0348e6421d0a510f0758
SHA256	9012852f44736c3b39f8c30defeec36b9e1cec1e743385a865f57da83bc79ada
SSDeep	6:jhGS1bEd3noOU2UjUWsYDyDIygYbXgX98SLh5CbLLN3FQQgLX8cakrwe0PrWev1/:jhId3dU2UjfQYD7LCFILMDe0PrCsHdd

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.xml.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.25 KB
MD5	c199bb4e59b5a917355e2b887e83abed
SHA1	f77c058df78f6a42aec4c09e0d6790099863f727
SHA256	01e6fe5b44b86b83da75c627fa2a0731f9dfbd717438d7ace753466374c5a1d3
SSDeep	48:/PjmleChBfVzUlYd0ezmeDiIg9QbTFqGHCk4+zp0W4OGxvkHjNdcrKvU6:/qleC9Ld0eqyi4bToGHsWUaHj7crU

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\10_All_Music.wpl.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\10_All_Music.wpl.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.31 KB
MD5	b9efa93ed9b713302353cee3cb139ad3
SHA1	5d7da3b04a6de4bf8118fda2a273376dd62cc6c6
SHA256	41fafcfb9b0b6e05cbdb0cde7e1efd53249d123b9403d85c8fdce717a99789ac
SSDeep	24:aQ7XrpXWMqLIQL/ckF8ur7jkzdtO8M1kDQAp0ZJcH7DwqQ4I86cYyB:amXVGrzlr7jkU1k0BGDwq5I8LYyB

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\WindowsMail.MSMessageStore.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\backup\old\windowsmail.msmessagestore (Modified File)
Mime Type	application/octet-stream
File Size	2.02 MB
MD5	0e571cbf1f15e338df92f16c98bcede9
SHA1	08c878d88586a101c77d03f4fcc08228159a84d6
SHA256	24bb4b3f4381f3a36aa41c5bef481ecf42c1fafe8de8f97449a4b6dd1779c527
SSDeep	49152:6tumSxNV/pNiy3vEzyUcBAblZVoFwc02xhdoPu:6tuTxVNMUIZ2L02Vom

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEgtcS[2].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEgtcS[2].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	6.31 KB
MD5	270b14293cccad3324abf713814e1283
SHA1	5bb82cc1e4ce8b5d4a2c908aa3bd55527a9e678d
SHA256	b67d857a9011952d43df38c7a620aedb52c46e11dac45f4c28187f3d61f99eff
SSDeep	96:fdpWyBPG8Vsw4e0pi+Pr2jM7FSMNsBViG8nKaGr0yNtKK/o5Cjt2ys6lBBdAJ:1ptBHsw4FyzBV6nKaMVtK4GCnXljaJ

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEgtcS[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbegtcs[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	6.05 KB
MD5	9486535514383f161a781798af555780
SHA1	7d9e187e44dc05e4b011fcfca4823a4ebe4801ee
SHA256	5d8c8e9bd41ca088f0808e9444de8b9c6d55742f5ed0d8742459a44dfb4c573e
SSDeep	192:bB6mWFuFm2+2QDxnHdyxvmUYScR8Al5Sc0/4byZa:NSuFT+9N9YvxYbVlAz4byM

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\528d82a2[1].js.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\528d82a2[1].js.RYK (Dropped File)
Mime Type	text/javascript
File Size	11.97 KB
MD5	056fffa9919caf0bda67303d6f65c970
SHA1	af8c069b6f8729a5aa7a06cb7cd08bdf6a264dc9
SHA256	986c9019627104b8614ab3c70a2e40c309eb266affe993543c9f8d8cb047f5e5
SSDeep	192:3OSVC9tpEJu9/9vLE1TwIxXIEL7Qlv5IhnI+KqWfBCWpp2LwQy9dKhfbTjfu7PW3:3FU9tpEE9/OT/xYfPqxZEsWGcQy9dKz7

YARA Matches (2)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match
JS_High_Entropy	JavaScript has a high entropy; possible obfuscation	-	4/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA61yi9[1].png.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA61yi9[1].png.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	690 bytes
MD5	fe9a1fe11a500a6611059d8f64893b32
SHA1	4db4c6cdc332f02289820e221b5854c035c8078e
SHA256	0c5ce8c24ea21b7d91954cedf02b032f9df71e64738674939fc94e9b75ff1653
SSDeep	12:KAd7zLsCwOXQN8t/cz8Z/XcKZYzAug5f1Jrpagi+mNyNj7YtsZcZgKJDdA:K4LsfbmZQ85c2f1yujNj7Yt4qA

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA3vOVA[1].png.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\aa3vova[1].png (Modified File)
Mime Type	application/octet-stream
File Size	930 bytes
MD5	89def9f9e590b7608ae4802649274202
SHA1	1eebd9beb7631407bf242cd1d25fd90c34e44485
SHA256	97423c10b7b3c61e6d9a47a007254f10f821c5b8631ccbf5ca60bbfe2ac7dc62
SSDeep	24:j0c4z8HtetNAfrZOiL6fVDiMJWKh6RT5QKEoujqQG:UzOetNbBfFJR4pmHxjqQG

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO3tl[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO3tl[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	24.80 KB
MD5	756e8ebc6524a8fa8e04483739c850bd
SHA1	84409de39891b962558ec4a52c0ccb64a4a54242
SHA256	42bf980be882a8ca1dc4e69c3dc2841f68e6924c8c7387b70bef4fbb3cad842f
SSDeep	384:q8HsRFmH5BzOF4LEHscw13y9/KSA7NTqmkvj0HkEMZmJNAz/94xBw88isslCUy:NHsRg3QHsXi9SSKNGngERZmy6Y6C

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBNiEo[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBNiEo[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	10.46 KB
MD5	072b61c1923f12e3d043c51e37acd890
SHA1	dab41c0a9675b5e6dc1aafbfcd3cb7e77cfe3d44
SHA256	39af6c38b09b09a0383e2bda3b6252a31f3fb804fb5282117983841905811757
SSDeep	192:iF3DAiEKVTZDJm+3NgZHSNGlogwTkbyinw/AHa/ZJ366OdUhX+fwGOTI:+zE6lDJm+3NgZHPlZ3DnD4nqSOfVOTI

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBPUFJ[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbbpufj[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	8.00 KB
MD5	d8af926c1e9f9029b222824ed37a0b8a
SHA1	0303dae34ec07cf93d621f74b71f9a4a4ed7587d
SHA256	b5ba29dcf5de01cd386b4544020a2f8cef063efa5337bb71a11c824d1fceb5e9
SSDeep	192:rZycu74VM3qG46PhR9kFpfJjfbGXOyA+Ve+5DXfBvN5wOHK:Qv7lW6PhR9kFBJTCeV+5D1NpK

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBOe7C[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBOe7C[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	11.66 KB
MD5	a635b2dd044e596df080d31e73cc68c8
SHA1	c585bacfe40d0f0ad0ceda00a146c08701bfe7e8
SHA256	40a13fd7fb55026f14925e87be1dc370ebbe06255a95a5f804e92612e48eeac0
SSDeep	192:T8N6VrgK/PSVVSu0fMzHLeaPFbItjrVhBBeG1ECbbf8HiT0Wn1LeFCIifSJcbl2k:lrVSfS+vjPFbItj3BkG1E88CT9nvIifv

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBL0ij[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBL0ij[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.53 KB
MD5	9f24da5f32666b254b04f3cb2d094543
SHA1	0041e779eefda12583a260bb7355486b7579b05d
SHA256	bbe63a35cc12cff16968274eb2ac28b17cd7d8d540e0e29cd3edbbb4e90f3936
SSDeep	48:j9jLQ+zr+Fi1LVmqLX70htO2okDSNQ15lPHWRt+DsTSc5kAq:j9nQ+n+FitV3qtdSQ5lHWTMGSEkAq

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB74fLs[1].png.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB74fLs[1].png.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	642 bytes
MD5	d2a0d942f0adfa63b70e157ef07afea0
SHA1	a5bf5bf76953043065eaf5a4df8a8d8bc871a8f0
SHA256	cc09658fc0bcc577aaa0c9da16e8f9d273fbfde2d1b80d7b401058c8d1b05e20
SSDeep	12:McOob1C1fRvD6Kmsn6/PSwaPziTDThuyP13iUNSAcTpYauJt9721dVHh/K:OY8F6Kj6/KRryhuFUNUp3uJD721vg

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB46JmN[1].png.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bb46jmn[1].png (Modified File)
Mime Type	application/octet-stream
File Size	1.05 KB
MD5	332535bb77817b923f505b513419df77
SHA1	2543092dfeec46d0f44a705ffea6c49d393a75d3
SHA256	99285c95469c98265148d9f47dc470c84ea3fd2c012165939b14a84de5b574f5
SSDeep	24:CGgORCd4YNsFyYep6jDgJWK2fPeiF7sYDC+0sRwFeyEpfWt0:CGgaC+YNsFyC/gr43Js8UMwEpA0

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB1CcOi[1].png.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bb1ccoi[1].png (Modified File)
Mime Type	application/octet-stream
File Size	754 bytes
MD5	a892bcfa4eccdadbe8209a1c54fe8304
SHA1	edecfd07c9c672798162dcf42ef302fbf9511321
SHA256	a1a23743fea13c820e2151821ce8162238c57488ae82e4e126ac3581a179c137
SSDeep	12:utY1vs3Ls4qUpTWMURzS40DBNrbNE/FbxBsF461Rs0MkIBmc3jmf:uq1Ubs4qwyMUFSlRK/Fbx6Fv40MkIBvK

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB6Ma4a[1].png.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bb6ma4a[1].png (Modified File)
Mime Type	application/octet-stream
File Size	674 bytes
MD5	55b29d5348dc8534252cfa070445b66d
SHA1	6c0dce1685b53b05ffee2aad8e45d3f4fc2dd8c4
SHA256	343e30313a79454ca2af62e4fc2964c2d9d05e37b89908402e6c8ef495a43c0b
SSDeep	12:s731JcvJNy2NlenJoUIm19+boLWuQdQgAnGaoFvAu9ti1cummZk1ci:Q12HNPVmHzSg7nGaof3iO3mIh

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\async_usersync[2].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\async_usersync[2] (Modified File)
Mime Type	application/octet-stream
File Size	1.58 KB
MD5	6156ce0686c0b604c48e14c1e3fdbff9
SHA1	29ad78a7af565d105f421bf0961815ab94957183
SHA256	2a02209459a95ad81b7969ddc9b4c8f9817765a3aab7e98de36ee97b13cc100f
SSDeep	48:WMSv3mxF8KFIlhSGpApMLtgW/kS/TzCPsqraN7MfrOT1tzCEJ:zI386l0oAMtgaRfQBOIfrS11PJ

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\async_usersync[1].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\async_usersync[1] (Modified File)
Mime Type	application/octet-stream
File Size	1.28 KB
MD5	99eff2cf33657fad941997583a121c8d
SHA1	2676bc6a7d329d006806e0be581a1770f8ca3d6d
SHA256	5ecdaced203400d2dc50f96d7044d4aa9fbc584a49508402bed2e0d6ca88865e
SSDeep	24:wDARAjMIz1iHbxGYyGRK6xQP+NphYTCHI4KxllGpXijPJwMthtnn:nWMfOdIQisTnrxOijrthtnn

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\advertisement.ad[1].js.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\advertisement.ad[1].js.RYK (Dropped File)
Mime Type	text/javascript
File Size	306 bytes
MD5	bc70fe37415aad835c4d67b24fa29be1
SHA1	2db52fb39e90075ade05cedc712cca5038fb72bd
SHA256	3a36d1d64ea0c5dcfc01e924507300803780c6fc636305cf802f167187bc8397
SSDeep	6:vufi9bQ6Oyv/gj2Z1HNhLxlcR4KkOHCZvMzvUlLHI6orTulwUwOtC7mBbsH:vufi97OSoy1DxlbemLoFTulwUpWmSH

YARA Matches (2)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match
JS_High_Entropy	JavaScript has a high entropy; possible obfuscation	-	4/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO8dQ[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO8dQ[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.11 KB
MD5	47dceda62ef79fd0ed89e8d514bf66bf
SHA1	4e42cd033145b9ba7083ef4a91cabdf42fa69676
SHA256	26f3f7d0f696bc64d2062251ff06f3fde1bd2b56ee3040e4d04b75b2d066c941
SSDeep	48:KKwRfFtfKgsaoiTiPVK+KfGNa090DCZmvGQKM9z3iYeOuJ:KnfFt7saZTiPYf306CZmvuSzCr

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO1mQ[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO1mQ[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	6.13 KB
MD5	ab27fe3416308ed6900c289b0804db1e
SHA1	c2cda8a04dcb4bd49647871ed187456c76bf9716
SHA256	1605319aae023770685e4f7a7367cc549d65bd2cf079be86c1b382d4e930aca8
SSDeep	96:0D/Wlpot/E7j3In6nOiHV0ADipTNxE3k/JTJ3BuoWB954SUq+pt3cIkjK:0jdeLrnOI+/E3kxl3BuDdnkJUjK

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\28-8f3193-f30905ea[1].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\28-8f3193-f30905ea[1] (Modified File)
Mime Type	application/octet-stream
File Size	231.60 KB
MD5	00c59dce3150aeb709bc473358ab6737
SHA1	50046465a501c51b224c0e26f43d30275f3fe6d1
SHA256	b459ea0aaac3dcbf4a000dedcd5e19fc8b77d342b8976f6482a50c8e24731f65
SSDeep	6144:wxbEN9AMkrVbocwVHS4y++s0VtmaAP12g7GO/:w2NrkrV8ckKbmaAJd

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBLhZX[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbblhzx[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	2.67 KB
MD5	be89d7aae1ebcd4abec74fef7336e581
SHA1	299f33e2a2d03b72f4fdd58e674bff35780ea938
SHA256	9e49380749385905fbf3caead9f441957a9d2f3e05b06cb24faa5a607f2c9c67
SSDeep	48:evpHZKzvGfDchFoZg70Gah2nehjJeZenPsXPTCYNTFtUjO/8QyX9vNi:4HZKWghF97coHenkXmYBUj4q9vNi

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBIqq8[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBIqq8[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	13.08 KB
MD5	890d663e91f5dd12dd95fb3d98709fe5
SHA1	2c6ecc493d86145c51c29cebcbcccbd5513e997f
SHA256	57763270159006e16872588750d97a0f9ed1a27fb32756343e60d49d0652247c
SSDeep	384:Ci+k8xWTaQ9NWONWLYjQfggfwBPdR6VWV7lUGEA:Ci+ZWTVWLY9gf3VWtFr

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB5kTiV[1].png.RYK

Modified File

Binary

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB5kTiV[1].png.RYK (Dropped File)
Mime Type	application/x-dosexec
File Size	578 bytes
MD5	f4c2c87e2e8fea44289c7f09af9f003b
SHA1	a742bdb3b7d24aa68e98b2ea350be1a2af87a047
SHA256	428428d9b0b43b0dfd3bc2bea24a9dab7c4d1e4b259edca0da85c396185ae2e3
SSDeep	12:M4GgqW750S9ucbAbU1iGhEAQ2Rpxdb2bbVI88:JG07B9ucbKsggpxJWVID

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB5kJAC[1].png.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bb5kjac[1].png (Modified File)
Mime Type	application/octet-stream
File Size	578 bytes
MD5	e5ad08b94c70ab33d75377c8384d0206
SHA1	f56c2c4f513bd77b25ec2f7976666ab5a3657011
SHA256	3918d13a04f5ebbc07442067c399e3ddc33c6bd18ce75786cdbf11a36c4ba1b5
SSDeep	12:5kUrHUV/+8wbPO0zUuzuCi6CKwyYlPo4KGFFdNQKAlvBar:5kqUVhuPO8zuCuZlPcGFFkKDr

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\adServer[1].htm.RYK

Dropped File

Text

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\adserver[1].htm (Modified File)
Mime Type	text/html
File Size	8.75 KB
MD5	fba7dc61f34b8f1d504ff7c0904dcbc0
SHA1	5ef43aeab4170da5d6d02115c93206ed9c0d8b18
SHA256	f78b9d15317f46f6f5a0bc0679adc4758298c8cbc4e73e3bfe12c7b1491f6ac5
SSDeep	192:CJ7UZbOQYIlglP8Vgz8CEdSurdF2cU23jH4VyDHcZdj:CJEMpB8V283lmcDTY4zc/j
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0rDa[2].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbc0rda[2].jpg (Modified File)
Mime Type	application/octet-stream
File Size	2.27 KB
MD5	5e88e8717ec7b6b257a3c1485afc37e1
SHA1	a45f235d16e151e4dac1ea54ef5242582d4da960
SHA256	782241e418714f79835514b5edd787aadd273ea7084ac0bc043e72e2cbc1e02a
SSDeep	48:/BVOmkMgXQrZZmNdwcnfF+nUeNxr3IymPHtjU75+12L0tbK81DueGs:LlnDgNdwcfFabNV3NitgStekBj

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0rDa[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbc0rda[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	6.41 KB
MD5	7ca2f54953b1f8b383738ffdd0ed9124
SHA1	0180cfd9a134c8045be5c8765791e981fd7a6b73
SHA256	2eca383f560e2df3283844e9d35a6b42721408459823b75aab59987bbddeabd1
SSDeep	192:ua2UeU1hy+aovHUftN4VROBkXHGeo4tNMwnC3j4HjINQV:ua2q1h5HUDqmeo4zvCkjyQV

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0mlu[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0mlu[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.56 KB
MD5	41bda277574e140c37463f3ac18f964f
SHA1	9fb06092cd2d0886f41f1d393e964b01e889fca6
SHA256	745133f5119bf95d796ce13a369463d50981692da92572a058ab61b77d8300ac
SSDeep	24:Zy25DqOcbwOUwtuBD9Y+i1jewv0OrHFactXVvyyGxDu//lF89ruiUaEOrZTj3:LDAr90JajeC0OXtlqyEmlF8F8aEOrxr

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBzxW1[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbbzxw1[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	9.46 KB
MD5	3ff9f130763069c9643d0e82021f4734
SHA1	66ff1e18b170b7d87277e0e439b0459fb5d6fd74
SHA256	3ac8d2fbba299c7d5b97305ce4f9309ba5ff304a872f94dca036e33b8b5bdb5f
SSDeep	192:pO/+l/J6yiJ8uWmhoiJwQE+0no1bMd2k4/oHVJ2JfnFNtZ:phVEyiJ8vmhzJwQ1bs2kFonFNL

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBz9wz[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBz9wz[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.49 KB
MD5	6023cc71f2a654855b4db74729b2e1f4
SHA1	3e7c14e870e94753c9138706eff21c73e6f6d089
SHA256	f7ed5bfb3ddf897629361739269fbfe28a641b46d85a2153a48c13f57a895f95
SSDeep	48:7GWT+gi1vO6vqvdjOGtYLKdR+CZnrfjPVOhfcfVs8zF:7tT+gb6Sl5ZrLPYcvx

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVxM8[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbbvxm8[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	2.24 KB
MD5	b814b67ef32f11edaf02bd9d5f836a91
SHA1	746c8773d6ed4b7e0542890f03560114f562bd09
SHA256	97b559c38e3fc02f2814968809c3e55ad23f222785726c213c7d7ddc8f441a8a
SSDeep	48:G+upWieAwCp+owte6tg1p8pxSwA/RmYaQL+NOCH3QNjMd4o:G+up3Xzplwte6tgOK/RmVkCHt4o

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVEOW[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbbveow[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	2.64 KB
MD5	e2d8607e26d76ff0cbfe055bb0e1c097
SHA1	00501cba4338dfdafde5a50dfa55cd2982d04c97
SHA256	fbd720d4bc5f2d133c35271996c826e581725ecc6845e302b00d4de328f823aa
SSDeep	48:gYkIBt95fPSCKjpqz3QVwzZBnu6Q0z26uwrrWZcHR7NbWJdnAttz0HF2ImOrTK54:gMBtfWpq3QSzZg6z2387RedSV/POrWwh

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBTpvW[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbbtpvw[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	2.19 KB
MD5	b25f5c8f36582fccde4ad0a26e3a8329
SHA1	34aa8b9bbda83f7793319ce0e7afdbec50c7d8ac
SHA256	2f06942f3fad0a9ba0eed26cfa8f1a7bcca3926c1d81112fda233511998cf7d3
SSDeep	48:mj4m/bsdU91Wom3ZU1dnWqgwtVCp2+aYPBWidggx6k8b+6gF8I:mE6svwPF+aYHp6kDl

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVGsM[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVGsM[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	7.88 KB
MD5	fbdabc7b5ef5f6d30949576735674bc8
SHA1	8657206e01b71bf75c9413ced707eb77123ae6e2
SHA256	3caf9f9778fbaad24fd9129ffd1c6031f3ffaab611280f977626b2760f7d127b
SSDeep	192:gInVx9a0N7FCUPs8M3SX1ZUApRNXJGRHcqMltdM7NRIbJDBCeA4RlJt:g0II7wUNM3esApbXJkudiR0DBCeACt

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBsqNL[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBsqNL[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	5.99 KB
MD5	9fdca954a1108294af9e1e5ee7209f8b
SHA1	72fdc94502fb8d4f2c9e32ab7e26ba14f138708e
SHA256	b194ea6fab52944ea9aa9b98f7525346750f364e98bbdae20d3d013fead5a424
SSDeep	96:YoWsQuu6Lnvyn5M4JlqNg1htu3Cl+BvV5GHidIlVPimUNBgEYQ6osgEcFHU1Y4t:YosAngJlQyw5G0ICmU/gEbU2G

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA54rQj[1].png.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\aa54rqj[1].png (Modified File)
Mime Type	application/octet-stream
File Size	690 bytes
MD5	e613009cdf92ef71e7b181974b144efb
SHA1	9f8289ab2b0d7da1a72c4599862eeaead69ad49c
SHA256	f1acaab96b2d0f58d48d943267f73a4c75fc8bb967be40970df7b4ddf2d55450
SSDeep	12:u+/rPDgg/26mGzoTCe6hJ7Uwxs0CnSB5oi3CUPY3k3pBo0yXC/U8FMVHbA5NQ2QG:u+jPDn26mGe/uJ7UwCnS4NU8k3pBovyf

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0tCi[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0tCi[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	12.78 KB
MD5	04ec5e7fa16f933cd8fe8ad7a463d690
SHA1	c5e56032eafe9fa6ee08220c5160f62165131970
SHA256	bbaeeab30ca4456f7ba774d32cb6b9cb83b95003407308cc6081677cc4a216b1
SSDeep	384:5PkBr/yuKM+AycABEG/j1YEwAmLZZygiIxAeGBcc3NSyT:5mr/yNw3GhYEiOeKSI

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0lYn[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbc0lyn[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	10.06 KB
MD5	0dce5b4437a83493061b5b6ab8ae703b
SHA1	9d141a318879891dc312d2e495fff9e6a763b957
SHA256	a704069a077749b1ffb35d6b855a18545bc0d94545aa11baa2553f87e4b69f94
SSDeep	192:IZPFvyJXGSVw6Nbh2V8SQMqNTe+Hk0z7xwEsN7xwlXk8AHV02osc2l2UGIgFnu:6UXFVw6NVthTed67WZN7xn8Avl2UG3u

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0ALC[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0ALC[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	6.19 KB
MD5	577f0bf9d66ec41902e13be4bd6261d0
SHA1	493d23c1bbbb16af8cb8aca655bcb9b1d607f9e3
SHA256	13bef9a15433b0148007658ef0befac3eba00f20192090a7ff7c465ad4faea97
SSDeep	192:xES0l6aQe60z/lBKP+EiDDZUIRld/3HduSK7uv:qV/DKPtwUSd39E7uv

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC095c[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC095c[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.08 KB
MD5	0a24ec6632a286366ea5ca6290844826
SHA1	7c6afdcf1c713c5828b5d2cd74f4c47924c85704
SHA256	2392b2ee2223504060c6e14cd563fb444b00e615832f007cc7cbf607e69a4100
SSDeep	48:IFmASPJ1ousEj7rR8DM2oU4/UX2cf4PuX1dLjSr+1gr:FP7DHjm48X2cf4gLjS+ar

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC06Ub[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC06Ub[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	13.19 KB
MD5	3918a53ded77310ac1ba9907f394402f
SHA1	fff4a1a9480aa17b6f08c0f2efdf52339a17d174
SHA256	58cc668fd81ad81d2e4198d4871f4e713383016b7603a0cf78cb442987c50258
SSDeep	384:kuKAkm1xbBEBIB0uIO6MCFQUsH8iix4TMt8smb6:k/AyEIO6MCCXH8ryE6e

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVJ4r[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVJ4r[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.64 KB
MD5	769df0bc0143e44a0a211360046a58af
SHA1	7441365f312e4731bdbee54e514c56e0d717ac68
SHA256	a0daa726b08625026310e026af2d91016487b8ff5c22ea73f155c4ef02477cf1
SSDeep	48:j6R9ZQ9RawA7024OZCN1XlJh0gmsQiUxX/jbseB+o5/rOwB6QCtz:jY9MRaF7n4OZCNP1TQi2X/j6oRrOw5Cl

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVIzI[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVIzI[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.94 KB
MD5	37739886e924a4318f20f9cc2351ca97
SHA1	1285d72a300c3acf584eb34d4ccdc1a459f4e06b
SHA256	ec3f46e20258202b7dc3ec8d873a62502fa0372592eac89695bfc513f57dc537
SSDeep	48:g9lhT7eGCg72RZV/C07GlXcLuah8xptSl0Spgv8q+zbfsaCwJbDiUZFr/ffu9WV7:gjQ+7U0eGxea8qsfs6RDNXrfSY7

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBseMP[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbbsemp[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	6.63 KB
MD5	8f6bb1961432ab6557ef5af202f7feb1
SHA1	66e6dcd819e04eeba37812d5461b5e6bb359f7bb
SHA256	de93c897abfacecdfa23925d3192cd6059d909a338b711c48b9c7f5196f6fa95
SSDeep	96:TAlMeTlQij9XT0e5Ck6ytqS4n5z6PMFwAyA2m3pwkepnJ+88p26Qj0hsrFv:El3lQWhT0eMkWdntMhpLBJ59hrF

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEeP0k[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEeP0k[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	9.47 KB
MD5	98ae4f69a0c02103995b6c681de1c773
SHA1	f4e2ed86005f6a5cca7a18bd2356c27d80536450
SHA256	74de8d343de92dc355646f56d6122e3f4b004ccdf9b8007f7067d98d21430503
SSDeep	192:XfiX02BxM0GvlqHPtCrP4pIzcoWaFWsJ+HPhto4T2HhDQ2JTMTl+:XfK0AxbCqvtUC2cxsJ+HPhtvTYJSE

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBDZoZR[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbdzozr[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	2.63 KB
MD5	a04efd72db3671979308d75d7f53b945
SHA1	2beb8e49db45fe16564cd0f7060be156417b1a9a
SHA256	6b5cea1039c9e917416d6e71b7175891e57b204b782e8392d14854fa800be094
SSDeep	48:D9VgTFOb+cBx71fpVE+eIkcfnyTXfn6/bRxdXvGzm3Ej/4wa8N1tdDh:v6eRjEzzHTXfnEz1ezm3Er4o3h

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEg9QV[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbeg9qv[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	8.03 KB
MD5	4292d5abb60dccd7e918e22eb19436e1
SHA1	6fbbdae257774e15f1b310b178eefb1ef63a40b1
SHA256	2ed9f5d7f088e0e9cf562b9b79f65e0d2b48eed94d18ec4eedcf7fc5d48f5483
SSDeep	192:04LPFNBOpuODKO/zs31Ah3OwXJUf3vf/U8rxaWY3K1bQZ5+YTxmUyNIBC:04LdrAVDKIgeh7XJUfXnV7QZ5FTxmUhw

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEgJfz[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEgJfz[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	6.86 KB
MD5	26752b7729196f7dd242b97e1609b8b1
SHA1	13c4bae7e35a6a62ce1cad0ae6b1f0c739ea1da8
SHA256	6c8c7d5a2ad5a15c24f8cbd9431a673b9c314aa491114f8ad753f56f7115d0e1
SSDeep	96:LG1Ckf94l+kJAOmTMcN/EyF0jesUvI+MNkyIhj0JjSGdIhKEq7+uCC/9Fmp3zDNP:LfkV4EkJAOZcrOMtc0jYSlfux/+pnz5f

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEgiYw[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbegiyw[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	9.27 KB
MD5	39154308c5190912c68d3b3d9d4bf2b5
SHA1	e10483df60ba3968d33f5a05cf145f9c9ecc98f9
SHA256	24cb76d4303e387c77e5c0c5183b5b5408d650bbd7660a7db52b780421072a0b
SSDeep	192:/s3n9Z8NLAbqdgG7z1XFlolMa1+lrIP52OXXnhaGsjVykU988jOtkByvP:039Z8NYG7z1/olkIR2OHhg5Uek4vP

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEgGSl[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEgGSl[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.66 KB
MD5	84ca6be42c82204ba4116428ed0d536a
SHA1	c289d7f07b7d7004540ce589031defd2d892c639
SHA256	06e4ff4524ff77d5cf9fc3af8d99d512d9eac3c015e3be74fde29f0ac8a59c83
SSDeep	48:7BA3oflMLGu+qiTKKoQJp+fXsG8VtlPtbbVKCfm0L6gx3wIokUTTy/zbhyKD:7BPfl1O1F+p+efrbVBV6wStTT8zVyKD

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEfjuT[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEfjuT[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	15.35 KB
MD5	82d1b438cf4d0708058b9a777e4fd8a1
SHA1	6b4245ee3d153b34ae238caabb5801a837840c42
SHA256	240aaf79c92504e237461a17a1848394f9d67ba77f674c1d1988207406259ac8
SSDeep	384:jgiq4RdjeH9OwYDoIoqp3+mBj8k2mVMDNypoZC9ML:jgiq4RdCH9OwsloqIk4pDNLZ8K

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdtWw[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdtWw[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.99 KB
MD5	6b4d4c0e6ddba4d0b08e9efe9da52d80
SHA1	82951d282268c0b65be121613e2ef956ac6e67e7
SHA256	d515ec4925940e4e9cbdb6a8f5f10113f670746048bad3b505f6256a4cf22924
SSDeep	48:lbD6Nu+7zCPFY9xvsBLzHd5VDmOe0Su4KD9R6h:hD6Nu+3C29JsBnHdiOeHu9JY

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEeTuf[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEeTuf[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	13.30 KB
MD5	c097b3e1d705edca65b6831ad0501811
SHA1	fa00eb665ea55bf492721448d0c6ec5221e17337
SHA256	cb6c7a626aa9625ca915130d1509a19632b7e8078d07f59fecf6a620f69c6629
SSDeep	192:zhMCEfWT6T4DSBstayhzV3rnXntIZPI0leOONz17vUET9Hwe7wfkC5ukLkdS/:qCm4DFnTbXntGejNxvUSEf55rZ/

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdqEy[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdqEy[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.92 KB
MD5	1414e25ce82d584b75ae050b92be9b5c
SHA1	488f326ef0129543097e34cb2fbc61f747d3d8fe
SHA256	8f14dc325a0ea455a64235e64e08785365598b1cbed31e97c8d1d9c62a37b844
SSDeep	48:F3qkhCYExvLfUyMg99QmWmmP7sPr4ZlUm8b:ckf8DfJnc/P7sDUlxy

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBE97O8[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbe97o8[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	2.49 KB
MD5	256bb28375bdee417b245a3e63066a57
SHA1	e983e374d8b74c3b709a7ad792469134e9ab19f8
SHA256	6020e1ce6c507bda8736032d5c960315894cefd3c610a6f43aa39e6cd401aef5
SSDeep	48:uOepnq0hPEArcFWS9XuH2dKi2t0CoK6z0VX9zh8QMlUH7WZ2:sq0hPSk2r2Ga6zctzqQMlU3

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBDK7Yy[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbdk7yy[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	10.52 KB
MD5	fc72e8e3884874b9a39eb516fea969fe
SHA1	dc7b453cae560d9ac2dac017acd387ce0dcd2e6c
SHA256	527a0b8b82d05b8a18b97c33a8e8b520942be868c1665489471329be50817a57
SSDeep	192:LJgYp6ronDqsdc/PV6y60RebNX9WvduGvJ2O45VJ68Yr84YnGBbx9yKA:P6rP//PV6y60RebNX9+dVvJ2NXJ68Yry

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdoQv[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdoQv[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.64 KB
MD5	f8927499962b36f766911a67daa66920
SHA1	34bb8df1a3078731ec16ebac1e85e81c7f144280
SHA256	9bb00ff4eebd494123841eed62dc6d8b98b221a96c2babccbc11ef8f4274c0e0
SSDeep	48:7XG77LljFsYNZ+XCSyrI5a7les7FunG0HeHtrVQEtgDM9uakAOtEP:7XaLlf+Xb5Mles8beRVQPa0tk

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\css[2].txt.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\css[2].txt.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	466 bytes
MD5	3c96dc3c14e7e611d880eaa281a7f68d
SHA1	789c72b596dc7c2bfc01bcc907bab9b59f1e0e61
SHA256	a4e0e6205594fbf1a918c493d8cd85480e403a6359795d7b2709e781abb0e9dd
SSDeep	12:lFuR0zNuHu+zr8sf7jXpA44FqGgrCAimiZx6DioentIH:H1uuarbf/u4IqrrCAij3oh

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\ie8[1].txt.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\ie8[1].txt.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	386 bytes
MD5	f4f4eb8ff64a4947d2c4e1da935bab04
SHA1	a5a0642e7f8772c00f0eb5b4d2b7a6fba7f6a1f1
SHA256	1a3d3964d4a9b76a511d3d22fa20078411e50cd1f0beaeb1e81c528473c0234b
SSDeep	6:bbxNO/f7pG+jOg8AmNUM+cIfKO7QX8ZFqMiE6bREQZeDuopWQCAq:b/OlHj88M+ZK/XY6bRE1yqWB

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\meversion[1].RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\meversion[1].RYK (Dropped File)
Mime Type	application/octet-stream
File Size	4.66 KB
MD5	f515eb2e2803ad02dc67488d977ed127
SHA1	6cb85ff20105e7c19e5645b8557ed9919a14a5c3
SHA256	e723e4d7084204763e04bf7707a390e2b374472dd6c1bd346b0c0f51a24f2fe6
SSDeep	96:aJzV9MVRPtwXPXLNOQRkjJhLMjSFu6h1LIKFKZuDC7ANKAni8ur:aFMVFmvpfklRM28E6IDCCK/

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\index[1].htm.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\index[1].htm.RYK (Dropped File)
Mime Type	text/html
File Size	45.97 KB
MD5	4d71bd145f3700be58c358efa804233d
SHA1	1670cc96f70564e0d92d7b42321869343306fe46
SHA256	f37f4b16b3dc7e83c13adec119e4329f89b36f459c931cdd8d3c2357970b064c
SSDeep	768:r1FHincZ5hrNFfuumpvPA/0ireB2cdHl90Vl+7p85AqtERPxeXuZgA:rfCcxrNtuuovPAsiyB2IT0O96HU
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\core[1].css.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my\core[1].css (Modified File)
Mime Type	application/octet-stream
File Size	165.10 KB
MD5	cb1a81013c10073b81ccd3a0cf904de4
SHA1	f5910e566b7be1f9e12765c164071b06d5c4a651
SHA256	e3e9253069e4f81f2e5b813575ece9b7882bee0389c6de7897a55cdba2c6bb8f
SSDeep	3072:IN79yuwP+7gOT4d0WKqeDOeIAzsV0g05hK7DC0zRjIrrxv2+wXPO:IdjwPkgOO0dHDOnusV0g0fapIrVvdwXW

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\print[1].txt.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my\print[1].txt (Modified File)
Mime Type	application/octet-stream
File Size	450 bytes
MD5	8f7c25dd8f44fe86d76bbf5b892592c6
SHA1	17647a81fb20272e2fcefd435d3a66cb7a5b3dc4
SHA256	5e2dd2bf536a6935b989afef4db56d93326b85db049014e0aba0ffff58c1d480
SSDeep	12:VKiA2bg9Rn0VzOuNIKYhSwFlQVjJRnZiK1DM:VVEF1vhplqncKNM

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\Standard[1].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my\standard[1] (Modified File)
Mime Type	application/octet-stream
File Size	85.31 KB
MD5	33c21d75a00074da723da6fb43cfea13
SHA1	a84b42455042b1e50ca605d65ecbb68ebe1e4a02
SHA256	4cf8a7c8551ae44cd07c29f998c0b66b52458aba888c433d74b90db7c5419c89
SSDeep	1536:m9w94a5dzAWb7daVOqDSnnikA83CmPxEUY5P5mvrw+XGTuFF/7ptKRtN1Jo:m9w94azAWPxY4ikNH2DmEiGTuFDIRtNo

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\adfserve[1].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\ikqeepzr\adfserve[1] (Modified File)
Mime Type	application/octet-stream
File Size	4.05 KB
MD5	f6d8b3a2554208d89e0b26cf0def90a8
SHA1	2ce4c266696a486945c324765df7621f8845cbe0
SHA256	ddb1fe3362112e0165dc8c11606849032f60bc929d19e9a152456ff9518b1bbc
SSDeep	96:F3SNbL4dc6pfwDAEH9HbzwG1D7AkMcu+9nC0GMg:QNYz4H9HbzyMnQT

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\adfscript[1].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\ikqeepzr\adfscript[1] (Modified File)
Mime Type	application/octet-stream
File Size	10.39 KB
MD5	9e667c50c2e5c79bb1bec527d48ad6ed
SHA1	20cf4b1f9c88a036d292af4e4472afd1a21f9b45
SHA256	94018005628bde6bf88136f571592fa212cc24168bce9111606082d40a8bf886
SSDeep	192:YOR0NVP/eJjBFwbOkbbCEeTDoy90a9TyAtBX+XtMooXNf0GW0B6VQtjgwdkRNDgG:RRaGdB6bfxCP9LT3BX+9hoc0cVQlgwdA

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\ast[2].js.RYK

Dropped File

Text

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\ikqeepzr\ast[2].js (Modified File)
Mime Type	text/javascript
File Size	70.33 KB
MD5	6dc97b731569e9e7a252243c48e11ba6
SHA1	b3644161451a3b9e8c02aecd157a613a9d7692b4
SHA256	ef6dc8b625152d9fdd2aba680deab4a1da96ef95fe6679a86d0cd8bb34a2d959
SSDeep	1536:5vx+nuOv9DiOr6WsWpgZSgGSMNfl3VRdRi8+cIQ0MLfHIG/bRehal:5k3vwiKxElndRivVQ0MfPbReU

YARA Matches (2)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match
JS_High_Entropy	JavaScript has a high entropy; possible obfuscation	-	4/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\player[2].js.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\player[2].js.RYK (Dropped File)
Mime Type	text/javascript
File Size	24.10 KB
MD5	b92516230070101c993d17e65e6259bf
SHA1	dcc36b5d6826d23b5371fdfa162e45b9fcda421b
SHA256	74cd4161dda0d2012e31e94c8338143b58b3a3e07c8e232d0f65e69f58cc5230
SSDeep	384:KHqMlJvKCqtGIpF/l4kArs/qk64PMSEqGf4Aly7+g/DbfEcykCri8q6ZctMFMeB:3Mltd1iNArxuEqGQMyNdyPY6ZfMO

YARA Matches (2)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match
JS_High_Entropy	JavaScript has a high entropy; possible obfuscation	-	4/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\player[1].js.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\player[1].js.RYK (Dropped File)
Mime Type	text/javascript
File Size	27.13 KB
MD5	e2ed516e206da0f6a0d4cfc977997c50
SHA1	55404d3b7c0397fa1e51021f09d6a2212b2ab9d8
SHA256	215937c913d3c0a79315abe4f91fcafc43fbf72b4481a0a850b9b2d9201d718d
SSDeep	768:loomYvN+7izxSBvUYBVFOQYI61eFvobrfD26eoT6bOL:aFYvNkqysYdueyfDzeo26L

YARA Matches (2)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match
JS_High_Entropy	JavaScript has a high entropy; possible obfuscation	-	4/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\26158[1].png.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\yg1r61z8\26158[1].png (Modified File)
Mime Type	application/octet-stream
File Size	48.36 KB
MD5	6ae795b70fd1cb0d3e116083d4c145ce
SHA1	1cd9b20b8457411705319c01f35ded2d6d02d586
SHA256	53201ced0cd257e555d1359c898eebb4b4bdc69ac004e70605ade504345cd31f
SSDeep	768:Y2WpN3v5m9YR0SVueTc9J5+hQfOqF6cOyxi+apOnybKm4mBZRP2PYKcgllIn1DZU:Y2WHv5meicxAdDfb85hWyGrP8gYn1O

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\adex[1].js.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\adex[1].js.RYK (Dropped File)
Mime Type	text/javascript
File Size	36.74 KB
MD5	41cc278b0ca9bc827649f38dd9f1b317
SHA1	df24ffc749e17082e7b8b993e7e917232069b27c
SHA256	15d1c79a9d99c7c95921e85518a1d7726fcd29c247180c5261132452effb08cd
SSDeep	768:LerHbK8oxbcRmpRj4a05FGHlbYmUTLrJvNNvjU5WKJ3bNwr0zmCPTQ:KXudcgzj4LFeCdTLzNvUxbNhz3s

YARA Matches (2)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match
JS_High_Entropy	JavaScript has a high entropy; possible obfuscation	-	4/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\adfscript[1].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\yg1r61z8\adfscript[1] (Modified File)
Mime Type	application/octet-stream
File Size	10.39 KB
MD5	9e1db09656b96a9af09b37297c5c145b
SHA1	94c64f3a0c2dd958716aab2315a50a7c48b38b57
SHA256	6bdca180fa5643c294222f7899abf0123a8fb2236bca623a88c40770d966b669
SSDeep	192:YYB4F4fjTgK9xq6AhPI6nYqHNveFkSfnflWvGQnFZRn55KiQpN83ejxbBA:FMK9A6cnCZflWvG65wiQpN8Oj9W

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\ast[1].js.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\ast[1].js.RYK (Dropped File)
Mime Type	text/javascript
File Size	70.33 KB
MD5	462dcc9a5cde333b976966e261ad0c22
SHA1	2dd3eae4512dd72d1090b01e74dc2f4b167713d0
SHA256	45957ee593d5c4b4c8a1679268d83814410d07f3f9fd073279dfff41e1c1a50d
SSDeep	1536:qAz+OS3ihYAp2nH36fHVSqcDoVlP3Q1jtWee9u4dYx18pF:zz+OS3FAoHKFcupQ+ee9uAC18F

YARA Matches (2)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match
JS_High_Entropy	JavaScript has a high entropy; possible obfuscation	-	4/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\css[1].txt.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\css[1].txt.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	154.71 KB
MD5	8d033d50cffd1e0efdbf8f35b4f78b19
SHA1	75be43cc640ba075c19fa70d238f9794de7012af
SHA256	a25d15165c468678d3604ef49367773a0c3e84300384bdc4bf562a5e9715445e
SSDeep	3072:0kS42nQtyxhFvnhqSggmI8T0dHxvitbOcqCvm5lksDVTtes18c/mT7kJm:0t4KrhFvoShmI80HxiOcqCO5NDVTN888

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\msn[1].htm.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\msn[1].htm.RYK (Dropped File)
Mime Type	text/html
File Size	2.56 KB
MD5	748a75b1781de52c1a77b8987babf31e
SHA1	e2c127e78d755ceb1fa65215386a9ccdf36d4557
SHA256	744a8bcf93e3939f585b31c78d4af256890ccb55e65455cb885ec80551942d71
SSDeep	48:c07SRbaYCYYe+cVXswfJpJjG4fIU7JxT2Bcm1G2mMeJFvMZws2tgY2/2L:c0ORbOn+hJn6GIU7nnm1+tHMZn2t6u
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\uid[1].htm.RYK

Dropped File

Text

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\yg1r61z8\uid[1].htm (Modified File)
Mime Type	text/html
File Size	2.83 KB
MD5	241e3940ecf90c4a4aaa873e2a339086
SHA1	428a3fa2c3a269ec357dcc2dc1902188351fa899
SHA256	33da6a51323fc6c088495bd56b2b4fde0d8928d93c2fa8551c64bca76fb2650d
SSDeep	48:6Uf5jwOMKA6LOX+DnzWeh0fpJ5Jp2S+sNWlC1ecq4Ew2jWhQHnK3SMCK+TwFqjC:RVwOMuXh0fRJUJsoj4Ew2ChuKBCeqC
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.75 KB
MD5	aeb1c55ff6437d4c4cc527b6e1fc78ad
SHA1	b0959b5aa55194d70ebda100267fedb27f6564e0
SHA256	6bd347c4baa06c75c84bd61e45e449b3975d8f729aebef3d7b7724493fc807bf
SSDeep	24:X0tQGJI3TLG4HvK1yP+EMro3c4wuxOWpn+v+iUVL0sjUv1+PAM4HwoUcoIZ21PqH:EtQz3GG+ELM4QWpupKl2UziwQVMyjig

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount (Modified File)
Mime Type	application/octet-stream
File Size	962 bytes
MD5	51574b0a20e7f537704c03f0a93ef8c8
SHA1	132911014d2134719168e30b2817fe001efbb9be
SHA256	345df97902a84acc5273e05068070608c8a7d952836bf2510f524d1577b26292
SSDeep	24:7/BL/QcpCWGk9YXTFMA6nNQ2/Apl8GwPao:7JJCWmTFMlQz85f

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount (Modified File)
Mime Type	application/octet-stream
File Size	1.97 KB
MD5	730d2a836b3ebf306f5c1945c58a493a
SHA1	32da00e93ad3e50c301bad995ec01ddefd5fc78e
SHA256	60570c95730e1caee1d9ec7123708bbbac0fd37caf71b80b6f9a08273dc6edca
SSDeep	48:MdWfDTfKSIzvCy4SAY8Eo3C1dU/pyU53bX3fsEEjLixegE7/R:JfDTf/uvCrIhi/V53Q17/R

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\programdata\microsoft\crypto\rsa\machinekeys\08e575673cce10c72090304839888e02_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	52 bytes
MD5	93a5aadeec082ffc1bca5aa27af70f52
SHA1	47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256	a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SSDeep	3:/lE7L6N:+L6N

C:\Boot\ja-JP\RyukReadMe.html

Dropped File

Text

Unknown

»

Also Known As	C:\Boot\ja-JP\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\media player\sync playlists\en-us\00010c6e\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\1033\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\14.0\officefilecache\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\wer\reportarchive\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\publisher\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\cookies\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\visio\ryukreadme.html (Dropped File) C:\Boot\el-GR\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\apps\2.0\data\cjw3o3kp.bx7\6ng60cxz.9gj\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\apps\2.0\dqq19bcj.jax\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\03j4uqw0\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\google\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\outlook\roamcache\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\gameexplorer\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\explorer\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\1024\ryukreadme.html (Dropped File) C:\Boot\zh-CN\RyukReadMe.html (Dropped File) C:\Boot\es-ES\RyukReadMe.html (Dropped File) C:\Boot\ko-KR\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\backup\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\virtualized\c\users\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\imjp8_1\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows sidebar\gadgets\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\domstore\owlvmzrc\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn1\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.word\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\history\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\themes\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\history.ie5\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\14.0\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\d68g7bij\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows sidebar\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\apps\2.0\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\credentials\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\forms\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft help\ryukreadme.html (Dropped File) C:\Boot\ru-RU\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\wpdnse\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\media player\sync playlists\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows media\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\pmmr5k9k\ryukreadme.html (Dropped File) C:\Boot\hu-HU\RyukReadMe.html (Dropped File) C:\Boot\fi-FI\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds\microsoft feeds~\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\media player\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\domstore\3lkbqzj3\ryukreadme.html (Dropped File) C:\Boot\cs-CZ\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\virtualized\c\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\imjp9_0\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\domstore\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\1nbur4hr\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows media\12.0\ryukreadme.html (Dropped File) C:\Boot\de-DE\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\apps\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\antiphishing\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\vb18b0kb\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\kqmhsvkd\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\color\profiles\ryukreadme.html (Dropped File) C:\Boot\nl-NL\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\apps\2.0\data\cjw3o3kp.bx7\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\domstore\fkluidu0\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\acrobat\10.0\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\caches\ryukreadme.html (Dropped File) C:\Boot\da-DK\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\wer\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\recovery\active\ryukreadme.html (Dropped File) C:\Boot\fr-FR\RyukReadMe.html (Dropped File) C:\Boot\pt-PT\RyukReadMe.html (Dropped File) C:\Boot\Fonts\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\imjp12\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\apps\2.0\dqq19bcj.jax\yvorlgor.pnt\manifests\ryukreadme.html (Dropped File) C:\Config.Msi\RyukReadMe.html (Dropped File) C:\Boot\en-US\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.mso\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\backup\old\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn2\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\domstore\8nes5h33\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\ketajp6d\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\apps\2.0\data\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\groove\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\acrobat\ryukreadme.html (Dropped File) C:\Boot\nb-NO\RyukReadMe.html (Dropped File) c:\users\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\history\history.ie5\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\ringtones\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\wer\erc\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\6asvn7j7\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\onetconfig\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\recovery\last active\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\media player\transcoded files cache\ryukreadme.html (Dropped File) C:\Boot\it-IT\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\low\history.ie5\mshist012017071220170713\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\mm5o9xqs\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\acrobat\10.0\cache\ryukreadme.html (Dropped File) C:\Boot\pt-BR\RyukReadMe.html (Dropped File) C:\Boot\tr-TR\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\low\history.ie5\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\taskschedulerconfig\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\rijuql1c\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\virtualized\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\groove\user\ryukreadme.html (Dropped File) C:\Boot\zh-HK\RyukReadMe.html (Dropped File) C:\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\recovery\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\google\crashreports\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\low\ryukreadme.html (Dropped File) C:\Boot\zh-TW\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\ime12\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\history.ie5\mshist012019110620191107\ryukreadme.html (Dropped File) C:\Boot\sv-SE\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\event viewer\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\xt1rpyg9\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\groove\system\ryukreadme.html (Dropped File) C:\Boot\pl-PL\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\color\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\media player\sync playlists\en-us\ryukreadme.html (Dropped File) C:\Users\5P5NRG~1\AppData\Local\Temp\RyukReadMe.html (Dropped File) C:\Boot\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\media player\sync playlists\en-us\0000e713\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\outlook\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\apps\2.0\dqq19bcj.jax\yvorlgor.pnt\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\deployment\ryukreadme.html (Dropped File)
Mime Type	text/html
File Size	627 bytes
MD5	397c1cde9f99a3cf6881f85ace9a08bd
SHA1	1f3657098100ef88f1612e223e35397714904c8b
SHA256	35ad3958d32bfad86453100b5337bb8c706a342fa6b5c9a00e3565e0010de315
SSDeep	6:qzQc31zQhblY2/69vW6328eIHySC8Gqs5HtHtr+EsyeIsILvgstXhaM:kJlzqxY2/8bHeIH/GJHbr+OsKXUM
Parser Error Remark	Static engine was unable to completely parse the analyzed file

Remarks (2/2)

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After