d27d318e...946b

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hhCMh.exe

Sample File

Binary

Malicious

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	203.00 KB
MD5	1204f4881b1b67007e74e3129ae74992
SHA1	1a184b8e44c447140300946287300b8f382654ac
SHA256	d27d318e35c5a625f2f29128dea3982dede23c96292056c6c2d18a73b82f946b
SSDeep	3072:hPzaTq37HqQE6HxWW4ow2z+2pUXfV8qG851zNUj:laTq3hEkxWkZiX5DCj
ImpHash	258afda29d5eb92b4da9f5a514056dee

File Reputation Information

»

Severity	Blacklisted
First Seen	2019-12-15 22:43 (UTC+1)
Last Seen	2019-12-15 23:00 (UTC+1)
Names	Win64.Trojan.Ryuk
Families	Ryuk
Classification	Trojan

PE Information

»

Image Base	0x140000000
Entry Point	0x140005d78
Size Of Code	0x14400
Size Of Initialized Data	0x15c400
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.amd64
Compile Timestamp	2019-11-27 15:26:35+00:00

Sections (6)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x140001000	0x143b0	0x14400	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.48
.rdata	0x140016000	0xaade	0xac00	0x14800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.02
.data	0x140021000	0x14fa20	0x11c00	0x1f400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	1.79
.pdata	0x140171000	0x114c	0x1200	0x31000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.86
.gfids	0x140173000	0xbc	0x200	0x32200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	1.53
.reloc	0x140174000	0x630	0x800	0x32400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	4.83

Imports (5)

»

IPHLPAPI.DLL (5)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
IcmpCloseHandle	0x0	0x140016050	0x1ff48	0x1e748	0x84
IcmpCreateFile	0x0	0x140016058	0x1ff50	0x1e750	0x85
GetAdaptersAddresses	0x0	0x140016060	0x1ff58	0x1e758	0x3e
IcmpSendEcho	0x0	0x140016068	0x1ff60	0x1e760	0x87
GetIpNetTable	0x0	0x140016070	0x1ff68	0x1e768	0x5c

KERNEL32.dll (92)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SetLastError	0x0	0x140016080	0x1ff78	0x1e778	0x480
WriteProcessMemory	0x0	0x140016088	0x1ff80	0x1e780	0x53d
WaitForMultipleObjects	0x0	0x140016090	0x1ff88	0x1e788	0x506
Sleep	0x0	0x140016098	0x1ff90	0x1e790	0x4c0
SetFilePointer	0x0	0x1400160a0	0x1ff98	0x1e798	0x474
CloseHandle	0x0	0x1400160a8	0x1ffa0	0x1e7a0	0x52
GetTickCount	0x0	0x1400160b0	0x1ffa8	0x1e7a8	0x29a
GetLastError	0x0	0x1400160b8	0x1ffb0	0x1e7b0	0x208
GetModuleFileNameW	0x0	0x1400160c0	0x1ffb8	0x1e7b8	0x21a
GetModuleHandleA	0x0	0x1400160c8	0x1ffc0	0x1e7c0	0x21b
GetCommandLineW	0x0	0x1400160d0	0x1ffc8	0x1e7c8	0x18d
GetTempPathW	0x0	0x1400160d8	0x1ffd0	0x1e7d0	0x28c
GetWindowsDirectoryW	0x0	0x1400160e0	0x1ffd8	0x1e7d8	0x2b7
CreateFileW	0x0	0x1400160e8	0x1ffe0	0x1e7e0	0x8f
DeleteFileW	0x0	0x1400160f0	0x1ffe8	0x1e7e8	0xd7
CopyFileW	0x0	0x1400160f8	0x1fff0	0x1e7f0	0x75
GetVersionExW	0x0	0x140016100	0x1fff8	0x1e7f8	0x2ac
CreateToolhelp32Snapshot	0x0	0x140016108	0x20000	0x1e800	0xbd
Process32FirstW	0x0	0x140016110	0x20008	0x1e808	0x398
Process32NextW	0x0	0x140016118	0x20010	0x1e810	0x39a
GetCurrentThread	0x0	0x140016120	0x20018	0x1e818	0x1ca
CreateRemoteThread	0x0	0x140016128	0x20020	0x1e820	0xa9
CreateThread	0x0	0x140016130	0x20028	0x1e828	0xb4
ExitProcess	0x0	0x140016138	0x20030	0x1e830	0x11f
GetCurrentProcess	0x0	0x140016140	0x20038	0x1e838	0x1c6
OpenProcess	0x0	0x140016148	0x20040	0x1e840	0x382
GetProcessHeap	0x0	0x140016150	0x20048	0x1e848	0x251
HeapFree	0x0	0x140016158	0x20050	0x1e850	0x2d7
HeapAlloc	0x0	0x140016160	0x20058	0x1e858	0x2d3
VirtualFreeEx	0x0	0x140016168	0x20060	0x1e860	0x4fc
VirtualAllocEx	0x0	0x140016170	0x20068	0x1e868	0x4f9
VirtualFree	0x0	0x140016178	0x20070	0x1e870	0x4fb
VirtualAlloc	0x0	0x140016180	0x20078	0x1e878	0x4f8
LocalFree	0x0	0x140016188	0x20080	0x1e880	0x34a
GlobalFree	0x0	0x140016190	0x20088	0x1e888	0x2c2
GlobalAlloc	0x0	0x140016198	0x20090	0x1e890	0x2bb
GetProcAddress	0x0	0x1400161a0	0x20098	0x1e898	0x24c
FreeLibrary	0x0	0x1400161a8	0x200a0	0x1e8a0	0x168
LoadLibraryA	0x0	0x1400161b0	0x200a8	0x1e8a8	0x33e
SetFilePointerEx	0x0	0x1400161b8	0x200b0	0x1e8b0	0x475
HeapReAlloc	0x0	0x1400161c0	0x200b8	0x1e8b8	0x2da
HeapSize	0x0	0x1400161c8	0x200c0	0x1e8c0	0x2dc
GetConsoleMode	0x0	0x1400161d0	0x200c8	0x1e8c8	0x1b2
GetConsoleCP	0x0	0x1400161d8	0x200d0	0x1e8d0	0x1a0
FlushFileBuffers	0x0	0x1400161e0	0x200d8	0x1e8d8	0x15d
SetStdHandle	0x0	0x1400161e8	0x200e0	0x1e8e0	0x494
WriteConsoleW	0x0	0x1400161f0	0x200e8	0x1e8e8	0x533
FreeEnvironmentStringsW	0x0	0x1400161f8	0x200f0	0x1e8f0	0x167
GetEnvironmentStringsW	0x0	0x140016200	0x200f8	0x1e8f8	0x1e1
GetCommandLineA	0x0	0x140016208	0x20100	0x1e900	0x18c
QueryPerformanceCounter	0x0	0x140016210	0x20108	0x1e908	0x3a9
GetCurrentProcessId	0x0	0x140016218	0x20110	0x1e910	0x1c7
GetCurrentThreadId	0x0	0x140016220	0x20118	0x1e918	0x1cb
GetSystemTimeAsFileTime	0x0	0x140016228	0x20120	0x1e920	0x280
InitializeSListHead	0x0	0x140016230	0x20128	0x1e928	0x2ef
RtlCaptureContext	0x0	0x140016238	0x20130	0x1e930	0x418
RtlLookupFunctionEntry	0x0	0x140016240	0x20138	0x1e938	0x41f
RtlVirtualUnwind	0x0	0x140016248	0x20140	0x1e940	0x426
IsDebuggerPresent	0x0	0x140016250	0x20148	0x1e948	0x302
UnhandledExceptionFilter	0x0	0x140016258	0x20150	0x1e950	0x4e2
SetUnhandledExceptionFilter	0x0	0x140016260	0x20158	0x1e958	0x4b3
GetStartupInfoW	0x0	0x140016268	0x20160	0x1e960	0x26a
IsProcessorFeaturePresent	0x0	0x140016270	0x20168	0x1e968	0x306
GetModuleHandleW	0x0	0x140016278	0x20170	0x1e970	0x21e
RtlUnwindEx	0x0	0x140016280	0x20178	0x1e978	0x425
RtlPcToFileHeader	0x0	0x140016288	0x20180	0x1e980	0x421
RaiseException	0x0	0x140016290	0x20188	0x1e988	0x3b4
EnterCriticalSection	0x0	0x140016298	0x20190	0x1e990	0xf2
LeaveCriticalSection	0x0	0x1400162a0	0x20198	0x1e998	0x33b
DeleteCriticalSection	0x0	0x1400162a8	0x201a0	0x1e9a0	0xd2
InitializeCriticalSectionAndSpinCount	0x0	0x1400162b0	0x201a8	0x1e9a8	0x2eb
TlsAlloc	0x0	0x1400162b8	0x201b0	0x1e9b0	0x4d3
TlsGetValue	0x0	0x1400162c0	0x201b8	0x1e9b8	0x4d5
TlsSetValue	0x0	0x1400162c8	0x201c0	0x1e9c0	0x4d6
TlsFree	0x0	0x1400162d0	0x201c8	0x1e9c8	0x4d4
LoadLibraryExW	0x0	0x1400162d8	0x201d0	0x1e9d0	0x340
TerminateProcess	0x0	0x1400162e0	0x201d8	0x1e9d8	0x4ce
GetModuleHandleExW	0x0	0x1400162e8	0x201e0	0x1e9e0	0x21d
GetStdHandle	0x0	0x1400162f0	0x201e8	0x1e9e8	0x26b
WriteFile	0x0	0x1400162f8	0x201f0	0x1e9f0	0x534
MultiByteToWideChar	0x0	0x140016300	0x201f8	0x1e9f8	0x369
WideCharToMultiByte	0x0	0x140016308	0x20200	0x1ea00	0x520
GetACP	0x0	0x140016310	0x20208	0x1ea08	0x16e
GetStringTypeW	0x0	0x140016318	0x20210	0x1ea10	0x270
LCMapStringW	0x0	0x140016320	0x20218	0x1ea18	0x32f
GetFileType	0x0	0x140016328	0x20220	0x1ea20	0x1fa
FindClose	0x0	0x140016330	0x20228	0x1ea28	0x134
FindFirstFileExW	0x0	0x140016338	0x20230	0x1ea30	0x13a
FindNextFileW	0x0	0x140016340	0x20238	0x1ea38	0x14b
IsValidCodePage	0x0	0x140016348	0x20240	0x1ea40	0x30c
GetOEMCP	0x0	0x140016350	0x20248	0x1ea48	0x23e
GetCPInfo	0x0	0x140016358	0x20250	0x1ea50	0x178

ADVAPI32.dll (9)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
OpenProcessToken	0x0	0x140016000	0x1fef8	0x1e6f8	0x1f7
OpenThreadToken	0x0	0x140016008	0x1ff00	0x1e700	0x1fc
GetTokenInformation	0x0	0x140016010	0x1ff08	0x1e708	0x15a
AdjustTokenPrivileges	0x0	0x140016018	0x1ff10	0x1e710	0x1f
LookupAccountSidW	0x0	0x140016020	0x1ff18	0x1e718	0x191
OpenSCManagerW	0x0	0x140016028	0x1ff20	0x1e720	0x1f9
EnumServicesStatusW	0x0	0x140016030	0x1ff28	0x1e728	0x102
LookupPrivilegeValueW	0x0	0x140016038	0x1ff30	0x1e730	0x197
ImpersonateSelf	0x0	0x140016040	0x1ff38	0x1e738	0x175

SHELL32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ShellExecuteW	0x0	0x140016368	0x20260	0x1ea60	0x122
CommandLineToArgvW	0x0	0x140016370	0x20268	0x1ea68	0x6

WS2_32.dll (10)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
socket	0x17	0x140016380	0x20278	0x1ea78	-
setsockopt	0x15	0x140016388	0x20280	0x1ea80	-
inet_addr	0xb	0x140016390	0x20288	0x1ea88	-
WSAStartup	0x73	0x140016398	0x20290	0x1ea90	-
htonl	0x8	0x1400163a0	0x20298	0x1ea98	-
closesocket	0x3	0x1400163a8	0x202a0	0x1eaa0	-
bind	0x2	0x1400163b0	0x202a8	0x1eaa8	-
WSACleanup	0x74	0x1400163b8	0x202b0	0x1eab0	-
htons	0x9	0x1400163c0	0x202b8	0x1eab8	-
sendto	0x14	0x1400163c8	0x202c0	0x1eac0	-

Memory Dumps (19)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Points	Actions
hhcmh.exe	1	0x13FFA0000	0x140114FFF	Relevant Image	-	64-bit	-	... Memory Dump Actions Download Dump Go to process Go to AV Match
buffer	1	0x000E0000	0x000E1FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	9	0x13FFA0000	0x140114FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process Go to AV Match
buffer	9	0x13FFA0000	0x140114FFF	First Execution	-	64-bit	0x13FFA4384	... Memory Dump Actions Download Dump Go to process Go to AV Match
buffer	1	0x000E0000	0x000E1FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
hhcmh.exe	1	0x13FFA0000	0x140114FFF	Final Dump	-	64-bit	-	... Memory Dump Actions Download Dump Go to process Go to AV Match
buffer	1	0x02D20000	0x02D21FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x02D20000	0x02D21FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x0E210000	0x0E211FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x02D20000	0x02D21FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x0E210000	0x0E211FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x0B050000	0x0B051FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x0E210000	0x0E211FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x0B050000	0x0B051FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x0B050000	0x0B051FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x0E210000	0x0E211FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x02830000	0x02831FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x02830000	0x02831FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x02820000	0x02821FFF	Content Changed	-	64-bit	-	... Memory Dump Actions Download Dump Go to process

Local AV Matches (1)

»

Threat Name	Severity
Generic.Ransom.Ryuk3.12FCB787	Malicious

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\acrobat\10.0\adobecmapfnt10.lst (Modified File)
Mime Type	application/octet-stream
File Size	34.56 KB
MD5	038de80b0f2ce944f2b76267c098ff9f
SHA1	1b0801c0d02aad29cf006778b7bd24f30f0f883d
SHA256	9a1c966b19f5e01615ada4f9ee9beeb635535e49020cce4cc889b2637e2d3842
SSDeep	768:QVnbKY5l128i1J24y5PTb3YNBLhlh32FM1PMDayQyMV2r:pY5S16PGLbh32FePMayJz

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	135.49 KB
MD5	9e49d97eec7081a49ed0a846af694b3a
SHA1	bf5c19b3eae636f8769bc1723f9313dc4eb2a512
SHA256	f9df1d8eee40c0cfff3ddc229a471d291c6f6d1426c2fd7994d90f6ab303d985
SSDeep	3072:dwG7zwHgJReay7e3wNqAduufF9HAWpovlCXn4kq7XcZvjYtBL5nKyJtpixzx:dtzw7aYrueF9HAzlCXPqoYn9FKV

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	52.22 KB
MD5	861c0771d1d0b4781c8e2bbb36597ee8
SHA1	4d55eb2a5dac0cb860d401a92a420a154b5e569c
SHA256	c8e701393ec0c617d19b2f3513f1b684d4541e4e543b776b1fd3718cc3c4de95
SSDeep	1536:6Ghkh/Azj1tJjomT4W0jwjX9PCl5w3eTW98:6b/AzjhjDTL0UjX5Clsel

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\ACECache11.lst.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\ACECache11.lst.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.42 KB
MD5	29351d60bb379c4ea8b951b80560c9a6
SHA1	6168ef088f5417c07a1f365cc19585810138e3ff
SHA256	9c5c1105b0659a6f8e2f6b732c8479f76995811af04360a73cb8f8e988cab2a4
SSDeep	24:B+ap4oGYS/Lp/mKKxOKvrso8u7v5BPIb1nnUrn2faBPN/mD4JUZnaMPUy/lDR3sW:BjgYS/LDGOZo/7v5wUrn2G/W4WZ+y/lb

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\color\profiles\wscrgb.icc (Modified File)
Mime Type	application/octet-stream
File Size	64.94 KB
MD5	2ddcf4e92b8d151eb6b7e8f1ccc01351
SHA1	2f3f5203b049192ee4653ce2be7aa8fe0c230701
SHA256	e913c2666b88ada6187bc56c593de2d9af64a59c2fcfe25991d39e58bc0a4253
SSDeep	1536:9iyBjLFRl95wSbaxYRLzoPsiKCZ6BuFk03K50EZbfaKMPyRHj1RdMcl:kujVwsa6CZ6iayEZbIy1pHl

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\color\profiles\wsrgb.icc (Modified File)
Mime Type	application/octet-stream
File Size	2.89 KB
MD5	4ec89a8e65503b7dd8a990509cf2a076
SHA1	c629237b64f6497643127ba6715c9e241b4dd384
SHA256	70be439a72e6c5a54c920feda8144c211e2e29b35f62c232f96d6a1a4abe73f9
SSDeep	48:4w4gDbmKwIy15RkE5hsoFSgEXriNbSmWQLVk/1ay1c4Zk/cIBjgG8ydBJbVYVnCB:4VKb8Iy1nkyqocTaS1QLy/W4+pJ38ydp

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Acrobat\10.0\SharedDataEvents.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\acrobat\10.0\shareddataevents (Modified File)
Mime Type	application/octet-stream
File Size	5.28 KB
MD5	2fd5011c89d036afb485af55d197a038
SHA1	c402666e70f98fd19f83a9044f7771911dd5a6a2
SHA256	23121ec893a3bba25c1556cf730934d76cbd05bec7347f35c27c25e900514841
SSDeep	96:g/xh/8aQcgjOwvdJFmsggAgw7KHAdsltahJB1fO7Q0axiw/QK1syk0cr2x:g/xhErcgjOwlig7w78yQaht5sw/Z1VGc

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	75.94 KB
MD5	3aab0d240a0da8c8224a0cf8f3c5e92e
SHA1	5ad1cb6ca5f73732c9c740f9132f725a264a1917
SHA256	8612d5ebf521cfc09b73c76aaa3d1fd641d0dee5e2c80dc881309b946c52c6ab
SSDeep	1536:lYYv0DBqm33dNlgvb7TSZ8nF0SwjI8K4pnITUW/z7MG/9WhMAop/:lYnDt33dWP/nF+synOPMRhMFF

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\GDIPFONTCACHEV1.DAT.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\GDIPFONTCACHEV1.DAT.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	106.55 KB
MD5	d9f96fc9058e48f812a044c47d4c212f
SHA1	6c82762fa7894c344ddc0b5cc00b750556c34137
SHA256	58dc2a7d6bc954444904331a9a325acab9e63153bb2d42a3d6d28afe955493e5
SSDeep	1536:+PUkvATgagDpRJAX3iDqTrjduF/Pr+2GhPCJmSVHFQ4tDOTgXVAbZhNvGV9Hzm/6:+RvYEX2XcqTrerMPCEkHCgXCbZhxfVY

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.15 MB
MD5	5c57ee5dfa7d4674ea2fb8e98ed82953
SHA1	34ddf24a0f329da822917e7c1b90a1f8348845d2
SHA256	3477b8942bddf9893a2fb665d177f442dbd84e88be3484914da4e386b55c64eb
SSDeep	24576:Jsp0VRrCfOBG8+qHZxhJkxFWbHX+T9ZDWLkwgRl:1VRrCWg8XH/cFWrX+TrWZgL

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\0XVWLDhn3e.jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\0XVWLDhn3e.jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	84.36 KB
MD5	0707257ca0b0091ff4e5620177aaa698
SHA1	e1df08a833b3de447f2145b34958142be84ce613
SHA256	9284e92e1ef79d77e18b0b2145653b11e7f3627c99c22f3ae6cfc9ee8bc28b29
SSDeep	1536:NuTSn4VLCsyaNVyrSxJJ/sIIlZd0z3/u4Hob+cRAKq9F/RQtybF2cgEE8:oTSn4LarQsII/deQC7x9FJMyh2cgk

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2SeC.wav.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2SeC.wav.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	12.60 KB
MD5	564b737f2de75980e3509b432cb2427d
SHA1	80f598577cc5ea5332d072f88c7105dd99d9d3d9
SHA256	191deca2eb2a58f8c716a7f025f9889b2f63433e864ca76eb45fc1e363e07914
SSDeep	384:4djTnADjDSpeWHg4QdT6l/EiLEJiGUAGF1fF5nz:wjsXDmeMY2/ZEJ+nF1nz

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2vKW tGwW.mp3.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2vKW tGwW.mp3.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	6.66 KB
MD5	7a8fb52bd6de2a007356166c5b8cf0ee
SHA1	a7c8f8934a227c727cf173403ff10b48d3d2abb2
SHA256	903700784ef6514d19b9a538b39423608a058d2e46440b91f5d35ac1ff967ff2
SSDeep	192:m7i0/EQwRRegMegfGVlFP3iPnwDfvV2p2VYUDn:+jwRRiegAlV3iPMVc2OUr

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\4VMORQaQwr2CCxN.wav.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\4VMORQaQwr2CCxN.wav.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	91.72 KB
MD5	c4cdc30752511ef53bc4407c49008f94
SHA1	2087b722479aa36c5019f8ec0678d1bb1aafca5a
SHA256	61fbf99cc5a1700d52392e5ab49a50966ba5d7674ecd0988b787a7f27719465f
SSDeep	1536:Ymnnc0dI4buT6FmVlT6ijDyGuOPeMeFleiA9M2T3kaMVvQmwbrLr37xuQSnZfw7:YcnCB6FmVlTCGZPoFG9jT3mVv+PxenZm

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\AdobeARM.log.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\adobearm.log (Modified File)
Mime Type	application/octet-stream
File Size	1.02 KB
MD5	c0e1147418b89450230343b3fc8755fb
SHA1	e3fd3eb281e3278ff8d2099a8adacdd1683111d5
SHA256	4f1b35312958d43237c5917335bfdb5201830d7c2ee711c81c17d2d866be52c8
SSDeep	24:L8wcPzVud6XNp2t2fSDJswNvJxGPT9qh556eS6G:owWozD6gxE5O60G

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\BW.gif.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\bw.gif (Modified File)
Mime Type	application/octet-stream
File Size	3.97 KB
MD5	445b5a7565846ea45b9e83a60c22a973
SHA1	44065256c9be641910fd67040a4a8ee958ac2340
SHA256	8a8e59b288f2e83fc82c373959360c6d71b6fa8b09b0f1fa0a570ac43313a0e4
SSDeep	96:L0s8XZdBxuWBm9deJEQfGhoNqowcD0BQHVrKiMhC:L0ssjVY9cn/3o4rKib

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Cookies\index.dat.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Cookies\index.dat.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	55b912d82064572423779f8c3b2a4fca
SHA1	07bc4fb6db4dce439eb6b5e4bb3d67cbd54e810f
SHA256	2a75c37892bac83a3ab61488c775693bc521c27a5a1eb11335f0ac594b33dbe1
SSDeep	384:E6lIZnUZnP+QAQcw9aZXqeWWefqZIjwf70bQqvvcuA9GGa:bBnrATXqxWHejwGUpG9

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\cro.m4a.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\cro.m4a.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	68.16 KB
MD5	54acc1b449a6331c31c2658c58eac3c0
SHA1	d39a50720380bee07c68fde640c705e2c1a935e8
SHA256	a3c1f026fd33189e90aeaddeaac63909f1bcbb788f9fd0564a204a39dae51b39
SSDeep	1536:s0v+7k1ykrDwCoCi027cbPvhDE3VAFoPra4IVwDmqPvf0:r+7CJDtoCn27cvulRDaRVwDmq38

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\eXDcVqT3dgd9Y.odt.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\exdcvqt3dgd9y.odt (Modified File)
Mime Type	application/octet-stream
File Size	67.64 KB
MD5	efd90879c812fff3c1481c6a75b78af2
SHA1	e4fd31eed243ffecbce5f5aa6745ee0f2630be3b
SHA256	5458a415098810a227132e99674d28935e19ab1f616575e27bf64d8ce5b8f030
SSDeep	1536:nPwF+06n8bIosLamovW0fv08/V+i/QuU8iru:nPwFFSTovU8t+iYx8iy

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Fdf jYF9z.mkv.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\fdf jyf9z.mkv (Modified File)
Mime Type	application/octet-stream
File Size	47.21 KB
MD5	6b0c3a6a95f3d9934d26f0135c2a6035
SHA1	54f8a6611213bc1699ab016a92fa8215454d2f3a
SHA256	2e3c3cf2d1a247ee22227a91dda8b760adb721a4b6517365c292543be9d5e99c
SSDeep	768:NxT2gVgoNIysm2fU/HIPRGdtnr9C50TOrB71BzmVJ8+CwOSmgXmPWxSm6QNuvsRE:7dVgoNIysm9vIOnrNOt1BaVJPCwOFmwl

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\FfkPBZBCPg7.mp4.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\FfkPBZBCPg7.mp4.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	27.92 KB
MD5	8408ab23f4108f6724356820c9a3d83c
SHA1	bbee0226d9edfbba162e84baafda4896aa1a476a
SHA256	bf0c9b1bb98b8f4d7ea18ce67f40b72ee761622327b71e02e13a6e456448dd52
SSDeep	768:0gglvlqKMpUqHk+Xe+dkitST7+5htMQlzrzkaNHx7:m7qdpUYk0HdkZ3MtXpkGHx7

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\fzHAYBIPCyB RBj.wav.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\fzHAYBIPCyB RBj.wav.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	19.86 KB
MD5	9c220084832b8ff12633d3a83c588d8e
SHA1	5fdb938593cf6037b7f2ebad161d08219245ae6d
SHA256	54c7dd49c54a88fe51a197f4a9cefcacbbf1730077360045bcabc5567b9f7e2f
SSDeep	384:2o+M4gOObJaolzggJUgSitRlWzfN/6WPOWEj5a8Q:2L+Z9aol0gOKtYx6Dj5a8Q

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\i _VlwJM.mp3.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\i _VlwJM.mp3.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	99.64 KB
MD5	abaffb2777200242da95a4900878ab87
SHA1	b615b63c3fee5dce50d49f0f117a75afd990b021
SHA256	ab2100e40fa36318102ad63d2d1b3255f991ca88ad55d1d1688cc7c698117027
SSDeep	3072:mPiUNo4jerqKZB1w04jQSq8dIoJC9/4PW8y:oNRjMqKDG0cQcnJCeLy

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\i9EK6xDlzTDWGv.gif.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\i9ek6xdlztdwgv.gif (Modified File)
Mime Type	application/octet-stream
File Size	86.33 KB
MD5	b6d219c1be1262ee9fe6225a6bf5fba5
SHA1	ad8926afafff6b59d8ab936145e88e842728f6f7
SHA256	9314e682853abfda4b0f24eaa73a196611c752675bd021f6f2f1aecf3359656c
SSDeep	1536:7PVFT9MC3kT6wySznToISElOGcwqNrOUjCrlOoqgYQVNpmOUqfVo:7PVrkTMSznEklOFwqNrfOrlBcQVjmOfa

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\k1RNjsn4s.jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\k1rnjsn4s.jpg (Modified File)
Mime Type	application/octet-stream
File Size	71.99 KB
MD5	a5874aadb93b882c6734263b20591f84
SHA1	08d37eed4d4732660c0700a06d63609f9ace7bd7
SHA256	cf744c4fbf36182322ac7b6f9e733fb1deec983afd4615a04f619cccf9658500
SSDeep	1536:UustDdN43yI8Hp4HC8KOLk48F8uXG/eQNz0/Wogs/PeED1ccdTK1:UHNBbGiAk8u2/J2n2K1ccd+1

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\kahYuSg_pwCY0ew.swf.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\kahYuSg_pwCY0ew.swf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	68.49 KB
MD5	92735c227730234c3575662e8baf510f
SHA1	29e42de108cf09db1e8be6e4c086e6e682566061
SHA256	f430538314ef6266442268d101d1fb3350fd0adc2f0de2089f3ad613e4b31571
SSDeep	1536:ICL5/f4Mm6alpMO3lPYujWFLnQQ/5QJ5PJDN5CWOVaVwJ:ICL6MA32ujYnQQhgxsaVwJ

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\qf52Pfldg.docx.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\qf52Pfldg.docx.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	86.61 KB
MD5	81b0ba23bf01290836fe7f4472c78f14
SHA1	725135cfa157ee902cc09f30ff445e762f6bbc2c
SHA256	42e4849a1177c062fa12d7d2a50b7d6ed1cfd3698844d1164043de9ea3302c4c
SSDeep	1536:C+MoDzZUZUplS6oakz/JKwG5qDd/D7IYqOzbaYuH0o8N/mokJCFYhIytjJL3FOFb:YoD9+UPSfakbJKt56D7IYzba0thkJsmS

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\qQrckqZNgF.avi.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\qqrckqzngf.avi (Modified File)
Mime Type	application/octet-stream
File Size	44.35 KB
MD5	6c79aea2649708865bcf31ff4d77862b
SHA1	9da1402dff6598de8f643a08ce5ca191b2151743
SHA256	34f2da4012a9dcc9bfeefa6570e083f6966573e372f47c5010fc1f9be88181ad
SSDeep	768:uyV2QpqFtcE5Ogh8ppeO/pffShiPNa/WNb3JRMMdp5NzyPgb:fVBp+tTgHpfpPMehJBdTNmPU

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\SMYG1.png.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\SMYG1.png.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	3.41 KB
MD5	c063cf15739cc5d85f264fef45014697
SHA1	c3379dac8f897ba3d453d922eeb87f2c4fc3ef7c
SHA256	c64bab779570de3b2206df1303ec5f00561ece967f522f9c5d632f0c83d60862
SSDeep	96:cYi59BE9ZDTcXbtllGld6JaI+OUsDzcCPCVoQQthqqWL47XW:cYilE8IHXSlCuQwxy47XW

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\uNHFuF.pps.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\unhfuf.pps (Modified File)
Mime Type	application/octet-stream
File Size	47.71 KB
MD5	794517711ab8bf5fc90e8819c9bf203c
SHA1	11b0137814be8722262275d197c515928b3270ea
SHA256	0a31b025f554b41ee1951cff5e3f533b0a2b5642d07342e719d378395ba08b7e
SSDeep	768:mihCxozO5+yMHlAWYnzpE9+aZNJkzV9IBlybh50q2jFSwKAdKxJfRtlmp4dz6B9s:mOCxeO9lWYn1E9+aGaBlE0q1AoxJ3lmy

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\urxPwoyG.swf.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\urxPwoyG.swf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	52.13 KB
MD5	47784b1249e2366a7e2b6b1250a3a707
SHA1	1113cc1501436782d5c8e4741da9e5e6a5532bf7
SHA256	60d329cb6614de71fe17e9ed2f0d0c17678a04596e1b107bd4d5d21f02ba110c
SSDeep	768:rnJQTTO4YGkk19ACh2ttSjO1jRdwBtGlgbreHhoi4eVrfj8QVmYvBAkkkP:rJG1bkk19otVdwLreHX7VrfjRmYJ7ki

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wOQ0wNdbFuzb2a.wav.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\woq0wndbfuzb2a.wav (Modified File)
Mime Type	application/octet-stream
File Size	90.00 KB
MD5	6fd2c5731f73ee36c3134149beb1327b
SHA1	6a23f12c1f9386cc836ae41339a3a328d8b59fc1
SHA256	7ff63d1a247fdd73d04083f983ce799747e716f58a9a2d610f20c2eb4ff88cf5
SSDeep	1536:UgWq44SAeykv65uBxfAc2TD9Qgvt1vDMjobdv4jY2Jw4TW4eN:8UeyYTBx4aOBDM18

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WzYezrRvj7I.gif.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\wzyezrrvj7i.gif (Modified File)
Mime Type	application/octet-stream
File Size	5.22 KB
MD5	0a075c5b981a9f91185604a12eac50cf
SHA1	d8bfda3d582352daa6d168afa1ad38fe40c217ec
SHA256	61b15da375dd8d2e3144dfa8abbfd5259cde0413a54012b31aa2049af5591be3
SSDeep	96:hBnLR7nZXpl7TxUBBS3g1ecfxlJn3OFWOxbWc8i4WQbmH7lZ7ljB4m7OFtlflq:hBl7XdTSBBS3g1ec7J+5bgi4xmjlJyl4

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\zfr5r0.swf.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\zfr5r0.swf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	17.75 KB
MD5	e6daf6c099b69e28ab725067ab0bfab8
SHA1	8b4f8e0a75080b70ea391003abfb743b45dbe728
SHA256	02869ec1dc11ec64e458eb4e5590efbc0bbe0e79fb5a2804b19b439236a203b7
SSDeep	384:VKV8W2IhsXKjT9kxygzpuOrM2ac8qQUiE83jWh/:w8W3NjTIygFu8Ma8O18zM/

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\index.dat.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\low\history.ie5\index.dat (Modified File)
Mime Type	application/octet-stream
File Size	32.28 KB
MD5	4a932db8298940cd72386da89e06cba1
SHA1	dbe717cc6f51b4d2a5e4547ccc8982b72bd15852
SHA256	3cda87fc9370211928156f4f526431841998c546ac898abde914c3a34b436c3a
SSDeep	768:GwnMHOo3NIOW7gqm8kx40EbFwFVDeVkndmpqM4n5Z+:5MHO6N9lqixsiFReVkdxdX+

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	6.78 KB
MD5	5440895d06a5dcf397c093189bb827a5
SHA1	d06b18939cffdfcff85e966612ce3d1cd5d51852
SHA256	ddcc274a0c2c4d3ce5353ab33bb551382ee515c085bd9e45ecb02c95c48250e0
SSDeep	192:IOJA6zcco7Oonjg3F6bG8eDGm2FWRGmOisMe:Ir5OoTSDGm20RGmOisMe

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FORMS\FRMCACHE.DAT.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\forms\frmcache.dat (Modified File)
Mime Type	application/octet-stream
File Size	240.49 KB
MD5	31d075ccf1fcc636cefd2ce1f2e72d6f
SHA1	68c0145934ec0ccd36da5a857d730879eb937ed6
SHA256	dce4b34529a3f96e7ffffa9dd16627adb30d3fa457794587aac000401b6bf20a
SSDeep	6144:bIFdg0GcxaA9y+BjrUnOU2COfJFEatO1qOdY9Q/et:bmdgXc0AHBCOU1amN6

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\index.dat.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\index.dat.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	32.28 KB
MD5	86d0542657633f33f25da93bccd89c31
SHA1	27d2e976f8ac881c144e8414a0d43de96f7dbf7c
SHA256	7f1f43d70abd6dc7877ffdcb6cb9488d9669615377ff054fbb8aa18b43debe0f
SSDeep	768:pOO4EFAUePBO/adpHLja1ZNGYR+z/AfQy2VZZyXki1PrIIm:pOO4yZGampnagK2VqXX9IIm

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.bak.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\brndlog.bak (Modified File)
Mime Type	application/octet-stream
File Size	12.19 KB
MD5	7c20945934596f22996278f06c6d860a
SHA1	4a64076d3684dc37d24499c4824c50d5a3b22e19
SHA256	45dbe77a7263288fadf778b915b2245946d2e49ae2b8a55f680770744d24fbe2
SSDeep	384:jpfXfXzatl4zuWwca+Ifs0Ynocjkby8TDiOONp:jdAlEwca+yqocuRTDiOOX

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\LocalMLS_3.wmdb.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\LocalMLS_3.wmdb.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	68.38 KB
MD5	2b4c90a97973df5457dde18b47013065
SHA1	29cb9a7852a5bee6f69f2cefb88596adc98c1fd0
SHA256	8430e358d60b74c9be9332f9e3d06d694d822b846e8663fd3978a832a2f523de
SSDeep	1536:uBILH5cKSKyMQLtca4tCqp70e5ufk9ybGPl3EVifrqq0+Fbo5EN6EZC:RLaBr0gRfkciZcifrqT+FcyN9ZC

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	12.21 KB
MD5	fca82e54a23f4b55175b40a0b37e478c
SHA1	59c44bc4b8e505175d46a6b0d0a8268320f7b9e2
SHA256	2252fac48bb1d8424d27f4ef6406bfb32ed2d70d6b6816cb8e5d263b10d1368e
SSDeep	384:2V9dLKuqj2Yvo3o/jxH0+6Jf7DOF/Ak8W4s:2QlKWo3o/jxIf7DCb

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\msimgsiz.dat (Modified File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	7265de9aa85b14495b6798adcc0c6c49
SHA1	af1fbfe71c9eabc3ac52ccc0d129ba8fa91e7d3b
SHA256	820a9abe0970c13057709f2370bee3f651a64a1f7afbd31a864ff24c51987233
SSDeep	384:5AxeApJ/gWHZZgnoacTWZuenPAdO9uPE3Hv42ofF06MMRIxJ8EUdvMcvC:5Axp//10uenPVuPEi90iRIxJ8E86

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\mapisvc.inf.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\mapisvc.inf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.38 KB
MD5	1dca830c9136ce3bda92d3438398e65b
SHA1	d5ab4919865653a95c49216858ac9f3d2287306f
SHA256	85194897edddbfd42736f1540470e9b1bea1e7abf7baf2349f7b0086b175d599
SSDeep	24:CCnjw6Y55iLqExHbcDQjy4GFp2pLEReGmrIWqOng1wUeH02cUIsdTj9NLrP/xMrs:C+kf55iLxCDQW4Gr6LwewweA0bs/9rP/

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\Outlook.sharing.xml.obi.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\outlook\outlook.sharing.xml.obi (Modified File)
Mime Type	application/octet-stream
File Size	466 bytes
MD5	e56b0d55bc8ec56f59b7244bc46a3757
SHA1	0d402b44682420e18b7c09fc5666dedd4deb3b9d
SHA256	9b162103f7a3e03c7520cbdf6344db6ae345ad2a3fc3a8119a9aa55e0ad32905
SSDeep	12:WQuuhZEmJO3bm8It0JhIWgzQ1LqgaRrk7lOB0UqfTR:XuuhG3OKaQ1crk8yTR

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\thumbs.dat.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\visio\thumbs.dat (Modified File)
Mime Type	application/octet-stream
File Size	125.28 KB
MD5	638a38912237721546600bf5213b18cc
SHA1	48e5c1264ee458fbf8de7c4845a660995ed68a2b
SHA256	4724f4c5bedaf53d13b004348171b82bd9b9c37881b802d38a0347add81d8856
SSDeep	3072:oqxy3r4mLx30LcGHUc+JhPWzFvpgs7/486fe:txy74YxGHUxJVWUsTcfe

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\oeold.xml.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\oeold.xml (Modified File)
Mime Type	application/octet-stream
File Size	546 bytes
MD5	34f14e600b33ce24450ab6b2dc1f6ea9
SHA1	f1e95273775bf17eab93f048b269f308f64c6538
SHA256	1425424ed32fac1abb4a689d1fed4536e07404aeb86a953209b797eab878278b
SSDeep	12:oX7jMCKlabXHt9sd8vn4Iouo0uLF5Exu2NwkHpTeJoQ:oLjulab3t9sWnguMx5LkHpTbQ

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\-QAaIv4jwKP_E-ai0.odt.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\-qaaiv4jwkp_e-ai0.odt (Modified File)
Mime Type	application/octet-stream
File Size	72.41 KB
MD5	a4d205094e2b8fde39d3133390b812eb
SHA1	9ad6c889bdb3bdac2385807fb2face538695feea
SHA256	8a30c2fd62c0235e3a3adfd7de56dfb2dc1c867c52b7b78da8a861e0d85435a3
SSDeep	1536:IB94sK92si954aiNWgLibtaY+tMYEfVWap8+Ax9XxKA8:Ij4iP4s3b8Y+jEfVTKxVp8

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.chk.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.chk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	8.28 KB
MD5	36fc2237dd2b170208c51c463a079d61
SHA1	d4fe177d54416e3e17efb97eb7a43460f0a67081
SHA256	815c39fd5e8ce8d8b700688ff729067bd699bff244c6ab13f557e8e51997eea8
SSDeep	192:JGL0KpKLmqiXgV/lv9kYFz3Ggw2wsEMtUdQBHWgkQyHdHP:sLo9BtjKsEwvgwmdHP

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\content14.dat.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\visio\content14.dat (Modified File)
Mime Type	application/octet-stream
File Size	99.50 KB
MD5	dfd12e11c6b9ecee67e9a5803d442721
SHA1	e9284316c4eefab0991053e20f3a732f2794999c
SHA256	fb450ffd66f77f7296267fd68ea62901a2b6581141dad0d260887dcc2295bd53
SSDeep	3072:AAbLAr5KRFIbz8NB63hw1Xo3uFCX3BkZ6QDwS8ptLzgneKuE:A6LAdaIbz8u38Xnu3jQv2Lz4uE

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\roses.jpg

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	2.16 KB
MD5	4e8670cf0a31aa5f2a60965c85f0c247
SHA1	6f379e73222c5c6872a32dec12cfa329fcddffb0
SHA256	3a8f7bd7a59c1847e2c163733c79005f4e7f804a9a7e787e8feba582cf4339e1
SSDeep	48:6r1WCAE67fE44XsULI+llCes9vG7xJjBLTFqptzYsxVAr/t:6r4F3c4osULI+lses9vmvBL+VY+41

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\WMSDKNS.DTD.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows media\12.0\wmsdkns.dtd (Modified File)
Mime Type	application/octet-stream
File Size	786 bytes
MD5	a27994f0d491dcb1b037658b0c65426d
SHA1	01683977930ab78d657ab81b6d7b1da81893a9af
SHA256	0aa38f935d56d67c24bca72cecd2d1d0384b4b6b7ff20ebbcb59e15df2466be3
SSDeep	12:/C1IvZqyvzURjXLgcDvS2PmscMhYnrkWtnJeawcD5z4gbQeUZAblXTVQs5T:qOvZqyvwRjXLdvSpscdnHwc1K/ShXKC

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\WMSDKNS.XML.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\WMSDKNS.XML.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	10.22 KB
MD5	4ad8cb8ec4aacb27dbde93c3d08cb6ce
SHA1	218060d25197b66e920f316fa91ed5e9b9e1d84a
SHA256	bf3e4114e557be626a9d6aadd118e32e3e8e87cafa21a28c08423e19a6e6badd
SSDeep	192:Yh5bexHjoP99YfxwVp3dQ/sUUOmPkKbTThgPumDp9WT:Yhdexk9YpSeTAbKuUp92

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\stars.htm

Modified File

Text

Malicious

»

Mime Type	text/html
File Size	514 bytes
MD5	096e280a45e2a9747a9604f225d87680
SHA1	0b71ec9e6cd92e0a752eec9f23ae270ffa47a807
SHA256	a1df8f8a27e4baafef07e911dd8e1334f20edb038870a7cb9542711493d05200
SSDeep	12:rt7GfijlYUqFcktYaLQlRzQUTxrJ2NVyUW++xxQkY5WyLtS07c:5lYUcaaLQDQ+uyPBxQZTL2
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\iMu6doevbdo_9vbm.gif.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\imu6doevbdo_9vbm.gif (Modified File)
Mime Type	application/octet-stream
File Size	97.72 KB
MD5	9b26dcb23d56b65a7415a1b8afaed4c7
SHA1	b7a80ad6d4d89fb973b62d2fe4c6e312770a1cb5
SHA256	9f26bc01e1423d8ef840ed774519c86312afcfb12f7e3273c7fe8a95e499086d
SSDeep	3072:4C20+zfMBtURYjE2i1biBPk8R3aUijG4Xz205v:1NJBtUvilLRnibbl

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\History\History.IE5\index.dat.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\history\history.ie5\index.dat (Modified File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	b51cae97f5807e90922c1ec2f8ce04ca
SHA1	0fb0a3552e38a85c02ca5efbc3c807dd02ca1e7c
SHA256	2afee024ab4905a3ad3d28374c64ae220c127c8df0403f20f8ea96587ce39268
SSDeep	384:dTSQJ5f5wSRfes/LAOwo9dy7xJ30fuONIxq:lr5fzhLAqd2l2uOwq

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\stars.jpg

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	7.61 KB
MD5	6da502efe657bfc7d68afc623fa13ae5
SHA1	65637f80832eb0dfb7ca935ccdc4ed116a22a6ca
SHA256	654237dee9112579262ce4ddfff8e69c6b558dc3b26a3cd3c2d7176cf7e97b87
SSDeep	192:z0Ippp1USDDzRf9+15gR94A+zyhSfVKWYm0Ii8GT:4InLbKzp9UgizT

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\x7Ja EIjTI4T3iIb31r.m4a.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\x7Ja EIjTI4T3iIb31r.m4a.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	55.24 KB
MD5	e5579382b00e4a71e2201e0c741ff540
SHA1	8858ad1e389d320a4e51c7bdfdd37c7f2eb64625
SHA256	5ceb62bec8466b273eb984972b718cf0b4125fc71e3cb5ad6b1d6419767ea135
SSDeep	1536:ivGE1Vq6Iu0jQK0MYH17BHJIFVYV7Q7cWex:ihLIu4bYXHSYdQYh

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\MSIMGSIZ.DAT.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\MSIMGSIZ.DAT.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	e5e8e4acc5e9750d8a246426e5e88fec
SHA1	52a2f211882bfd03157f7efdfa69a632a47439b3
SHA256	42fc55a7406a4165f54211d1a4d4cfe8adde2629aa45db57a0cfa9b1590f75d3
SSDeep	384:x/rZ2uqL8CPsiZOgs23hVwtq/H7xTtPGIrSy/nSxQaS:v2uQ8cs+skh2wPPGIrvfz3

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\tky0q v3igcu4djp3kfv.odp

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	8.46 KB
MD5	b00c7f860490fcde45966967ed715c41
SHA1	129383e8308e887410c4de93daf391cca86892b6
SHA256	854cb67481d4b13efbf4f315ab5a78c9d65be4a4ebb58c25b79fc400846a73a0
SSDeep	192:kK4uJuMsEb407xCqlYXfO+UTq6Py5xDRbGPuFoERlb7zdEo9:N4mDbx76XfOL1odo0lp9

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00001.jrs.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\edbres00001.jrs (Modified File)
Mime Type	application/octet-stream
File Size	2.00 MB
MD5	5a6b644890295cb480069584818c276a
SHA1	16bfd2cbd9358aa050d1e68e082e6e8213e4cfd9
SHA256	5acc9f60f2743a794ead9a90b21b9dfe63d6f55ceda954cf3a2ed913e9ac064f
SSDeep	49152:C9nZzYdyNts/dcRbIhIHfgt7/1YjTtkv3JiH69aCDYi1:EndvtsF+pHfgt7mjiv5MOh1

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\edbres00002.jrs

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	2.00 MB
MD5	a121c0ce9e8dc181e3bbe928880f30f4
SHA1	92185543758768867c40bbce31b8ed8382210421
SHA256	7746bfae6fb87c68fec07998363b9986fc8a53070784f50ff425ff0c58770248
SSDeep	49152:b4ncwuo2tqoE7slCzumRMvXf8/JOoFWmPS6S3W8PnBF:bfwuJvlCC2Gv8/EoFWBfvnBF

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\w0F-ZvhF3yoKIjTc.png.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\w0f-zvhf3yokijtc.png (Modified File)
Mime Type	application/octet-stream
File Size	71.52 KB
MD5	1d7f25c4e7c820fed334171432dd93f2
SHA1	12fbf9ec2b0fe3f1a379e204b741cd1ca21ece07
SHA256	6da31847c95b011d0abbd44019ec1f167622f327a09eacf9c0d59e059c08f0de
SSDeep	1536:FwN0o89zBl5/79ZsRFTaOf6yI9TP3D/GvY09/dxvG+G8ZNMUdx:GNa1XsaOyvPSvYL8Hjdx

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\MSHist012017071220170713\index.dat.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\MSHist012017071220170713\index.dat.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	32.28 KB
MD5	8ad099067b8fba8e8aa4c24eb573a365
SHA1	2703d84fa47a4f70659c6e98067367206a8d3a6c
SHA256	dfdf01c62033636773b6cba59d414cacc51f562335851f9187fa08af06381601
SSDeep	768:V9molPDIiHQdWTbrstG1HckMjfGUygCmHMm+Qwo6i8dTO0K:3xIiCM3stGhckMTGUcuMfU8di3

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\W_OkDU3ecLtE4N7B3 hJ.ppt.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\w_okdu3eclte4n7b3 hj.ppt (Modified File)
Mime Type	application/octet-stream
File Size	19.08 KB
MD5	f12de0cc6df0a1faca61ad0115e206ad
SHA1	75d972b7db5dff47380b7dc305509bd3678da93f
SHA256	6e42c7ce24542aab6fd9351100ffa179aea0907ef27b31fe1572d95f97531d11
SSDeep	384:V4uP5+YOc2MD2KpS+4y1kJVLMmI2EqgrLnqbXs2Jy9NBmls1f2+gTcT5v:V1B+dMD2KI+z1eLY2Orqrsiypmls0+uI

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\kCWU96i5RdNvckyQmvpx.gif.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\kcwu96i5rdnvckyqmvpx.gif (Modified File)
Mime Type	application/octet-stream
File Size	5.42 KB
MD5	34539bf381f55dda9a03bf8619165855
SHA1	fa467ace388590fad1338004d5714efaf4b74c5a
SHA256	21b8d28545ceb68800c20cda6d0cafca31e2c272f6ec3ccb9bbd7bc97115f741
SSDeep	96:Nz0GnIpi5Rlf01uGLgUawLIWEakuZ4wobsJfeJfoi37K/c2UM+uCM7ixSrkz80VR:90mE2P0UGzAaku8QJ2Jte2ib74od0DHf

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tKy0q V3iGcu4DjP3kFv.odp.RYK

Dropped File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\XLZ9DpiEjORD-Ad5D0.mp3.RYK (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\xlz9dpiejord-ad5d0.mp3 (Modified File)
Mime Type	application/octet-stream
File Size	50.69 KB
MD5	8ace18fc296a52fe0e2f950a1aab91ad
SHA1	2f40d505c6549c5c95ee1d065d6b8858d84a7d0a
SHA256	ce69cbd4b8adeed49757e817fbf6480d11a7d4f2457056d1c99e9d16cdcef75a
SSDeep	1536:6lB9Yy7MDmB+qsBxEXMcT5ieufC6FeunqD0vH:6shjoaRn1vH

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\PazsOHKHwoh836bptNc.mkv.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\PazsOHKHwoh836bptNc.mkv.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	15.89 KB
MD5	f40c886c8ed771574cc3f99252f7b5fb
SHA1	7f277cb27cf6c4f304b53fe1bca98ddd61d6821e
SHA256	175aab17e6824348befb3d925dade9e7d4369d24be91ee5e59dbce361ba597d6
SSDeep	384:M2DsBMlSzphS3HEkIWvydv7RkQABLfx2i0f0ZalUc+zyQQk9WZr8aD:M3B3pMktqZbzx290ZalUcXXkYZr8u

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dxbdb_ftC9a1B GCx.odt.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dxbdb_ftC9a1B GCx.odt.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	72.49 KB
MD5	176a6406abbba1b3e8bf62debd315254
SHA1	d9da393c4835dd513e8f1eebc691af6ef6071624
SHA256	c6ca68431a1ea79505b3b9063123d447ea7adebf023e9afa1c414a2181e489b5
SSDeep	1536:YPBmyRXlo1ZQClyG4NEuEvGUnKUviOBzdDse+:wmEazlyG41oGUKUviyz+e+

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dNuJGAnNOLiXz973.mkv.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\dnujgannolixz973.mkv (Modified File)
Mime Type	application/octet-stream
File Size	3.74 KB
MD5	60adeb4b12628e37c671c6c8ad52e4b6
SHA1	cd79261bce7324d1d79c08d61255120133406b42
SHA256	115fe335564a0409b89ef7637c65d65623f3d3309dda581a9a1eb695769d2e8d
SSDeep	96:9q4/gCpsSQwVaAAp+qKQe/jbgnC/Bc7vyoM:9q4tbalC/0vXM

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	28.28 KB
MD5	6cc036bb64f47395929c59ace2afc987
SHA1	2d9c5e47cb690f0e00bb80ec712d6c18baa73001
SHA256	6b3e94b24fa4a2c85b86b7eca9a0f8ad699c8710606f4f5583a4161274d6c79d
SSDeep	768:w0B9z/wl8GpGZ4loCUu3zkfZPI0Ws0YRNkYDZhsvw:w0P76oCsxDaYMvw

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\UvHV43s0RFEDRD6ez.swf.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\UvHV43s0RFEDRD6ez.swf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	93.13 KB
MD5	d6a8265f2c65e6095b0471114b59b7e1
SHA1	d1644daba7526f9b0e97e4670371ce37244d6df5
SHA256	3ca9db238f89656fcb0f786764aeba41e592aeb6e545ec2de168f10c8d5f4117
SSDeep	1536:aLGfboW215gE+svKkM+9LRmbr3unhxvno8hNQEZ1B2x8+hATh9iC1JJUrRc9B:00igE+BNvunhCoQ21ou+0hBJZ

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.log.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\edb.log (Modified File)
Mime Type	application/octet-stream
File Size	2.00 MB
MD5	85d67569cdfb830a7c12ebd4e6a71c7b
SHA1	3b8993861fd0d29a06f22adcf6c59c4915682d5a
SHA256	8995aefcd577c2cacab88d6d8484848fcecd5151511069cda84d7521db08af14
SSDeep	49152:eAGRt1UdTFBNUWTw31xingkEWCm3MHWucx6xUb1:bc6NFM31OgkEW6HxO1

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb00001.log.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\edb00001.log (Modified File)
Mime Type	application/octet-stream
File Size	2.00 MB
MD5	b7824ab6d38520bfd5ffc16215691e9d
SHA1	ab15b8c1325b06eb45cea7a96924da13d40173f0
SHA256	148c6a98fad3c624dba00b65ceb347e1889eeeb3585ced0ecbcd73222b750ca9
SSDeep	49152:y1o9hOhbM88mV1kKwdgV7cKegFN+dw4mjVZ/YaZrF:Io90tp4s7cyFNdZVZgaH

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\index.dat.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\index.dat.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	32.28 KB
MD5	1f4124de658f6a251475d1ed65a83999
SHA1	754447f477b1645320885e632198cd0bc9e2f7b8
SHA256	e88b7f77a89d467ecb14498fb4d3a2096e5605a50ef29c4558135bfe4eb1ef4c
SSDeep	384:dCuyqZmbIXd3R+GP/B17Fp1Rqk/NAjUftbuLDgh5T3xD7oXhRNShwoEGz6a2GSUs:8vq4aV887Fsk/Qw/h5T5UXXBoqGSTw27

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\frameiconcache.dat.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\frameiconcache.dat (Modified File)
Mime Type	application/octet-stream
File Size	9.27 KB
MD5	a6baa7d28333f1882b585c7b3308c10c
SHA1	58f4d437c0156ba212f6ee964ed3ce991f39f7be
SHA256	2d9cc7e04b8b9b5d8a430523519d7499764b81e2042de61cf656cfe893c694b6
SSDeep	192:Tg8qOpDndbZAGQtIVUo1CYdMY9J0QPFnb48cxb9NLJqaVfDUjZ/oZS:TgJOhXUoAW9r7cxpNgaVfDOZ/oI

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\CurrentDatabase_372.wmdb.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\CurrentDatabase_372.wmdb.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.02 MB
MD5	16f2c929ac99f6c8ec1283cc3745f0a7
SHA1	1711a1969e05d2dd4140d65e89234b9a923eacb3
SHA256	d2a9eec193bc11d15f129aceea2c0b35c7c82ac555b271ca818dca47b4795b74
SSDeep	24576:OaD2CDLi+bdnqD2gUjSNnevYIzqvIJMVgPVXO8x3s:JD2CzhqD2gUu9EqvoMVg1ds

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\14.0\officefilecache\fsf-ctbl.fsf (Modified File)
Mime Type	application/octet-stream
File Size	402 bytes
MD5	77b38197ebceac6a3c83b3d4855848e7
SHA1	136ab9a32062f01459b953376db64a4e7ecd0a57
SHA256	0fa6ce681ddb183a00815a3e2f81c99aa5da446ed4ad1ddafe5b973880b1694b
SSDeep	12:6TfFk4MCj8OwyrL5MCvxYzAGb0SEKHCNTOhS:6k68ELHxY7HHQ5

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\14.0\officefilecache\fsd-cnry.fsd (Modified File)
Mime Type	application/octet-stream
File Size	128.28 KB
MD5	dbcbaf46c10d0bee03a8009e532c3345
SHA1	009a106c4c1c83db06ede80ecb6bd7c9dd4d1449
SHA256	0c94399bb0d6b45096f282999d062391ca10f0ce1a94f397601ddf2810100ea9
SSDeep	3072:OeWmRh5hokKjihz0i3fE4qzG3F4mFCN+Z/e:tYihIivEHG1pFCN+ZG

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\WindowsMail.pat.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\backup\old\windowsmail.pat (Modified File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	77d858edf6892833da7fb03fe1922f21
SHA1	7728e7bb04bf17cc6d290cdfb923a9f286d2c2f2
SHA256	70ba351db25486f6b5315f3f865ac336a3124ab6793cbdb29990477b7590349a
SSDeep	384:mQhk5XAeDItX2cGoN7SPRSHR2q178cVBvMqAcuM8:f68X2ASP88q18cfvDVuM8

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.htm.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.htm.RYK (Dropped File)
Mime Type	text/html
File Size	530 bytes
MD5	806d240be7083cce65bad8f44bc889e6
SHA1	e2fc9d1e1a8423da206c94f502c5ae61a19ef495
SHA256	b0f598d78391dfd202b7f701a26e029e9df1c829027f30bd3c3667c876ea2e09
SSDeep	12:QLTriN1cOeusGPnrjOFKwT6R4LVeGEYeI8cq+wqQmlrCoM9DZ3:QLT2N1cGn+LmR4LVvw+hkDl
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.33 KB
MD5	6cdd84f074b0a0fec97563855d7a3009
SHA1	7fb5165162e1c16275fcb9fbb26e20f61fbb6ba5
SHA256	a0b606bc63e99a8e747d9962a466f7b81b8ec5be39b0aed283b768d4ca8ed3d9
SSDeep	24:ufNmvzEZQOXCo04Jf4I6LLYXjjkNLlmHZO79c86cF4miZTda1h4beSZb6ep:uFmrczCX4R4tLsXjjaBmK9804FhqSZbb

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Garden.htm.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Garden.htm.RYK (Dropped File)
Mime Type	text/html
File Size	514 bytes
MD5	7b3b59025665160f22a11b6ed70719c6
SHA1	17d13e2e19f32056253d7425950f3964a3c9f6d9
SHA256	1c270a2dd7a1c09c79e0fb3f18bdad5b06e45ef69a63ec439a5978e1250515cb
SSDeep	12:Uj141u8u/qPxEgEONhl7zOFm6MBxDCorClCeMm53U:k4s8PxEgECD/UmNCxvNU
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Garden.jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Garden.jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	23.58 KB
MD5	78cd547a7fc58e2f4c0c7663f03e55e3
SHA1	a09e8ca23ffc99ece22eb39ffbd0bb3a2c631881
SHA256	88da0280be47be6381074562d3ab17782edd633303f72409e5d151685674479f
SSDeep	384:w4206XUz5N8igSGWa1csIkU2mEh8ZWwRpo5FCR48CzRSwTPfh94XQ7mYcuQK8mpk:E0H7FQSkfmMwRawRjCEqfh94AqYr98Qk

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Green Bubbles.htm.RYK

Dropped File

Text

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\green bubbles.htm (Modified File)
Mime Type	text/html
File Size	514 bytes
MD5	6c3ab6982a93783c67c723b241a62598
SHA1	4c88b79154a5bab8e7fa900c56e9b071fbde9396
SHA256	1f0305815bc831a5552cdec1b66f107882e51c2a3b29d301edf9c105c6fcc889
SSDeep	12:fDjYrT6anR/+RCTxA+hFP89RFnCiMtWUCdT:IrTjR/g2h189RDUCh
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\greenbubbles.jpg (Modified File)
Mime Type	application/octet-stream
File Size	6.53 KB
MD5	7b5b53a27b9e9a58d6a56368cd67eb74
SHA1	9413ffb4b73696636ddadf1f681659a94929c2bc
SHA256	d7eb3ddaa9968a9c3cf36c75b6af7093a37c149dcbd372e88ae9eca20bbac96a
SSDeep	96:9pd1pEBj9YAHdkJOyKl9PtFLhKQnq1JAF19wuAS4StlOJKK/xOBQnXiY+Ytf/Oit:9r1+BLKBKjtthKTfASuL4S3OJKIvDfft

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Hand Prints.htm.RYK

Dropped File

Text

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\hand prints.htm (Modified File)
Mime Type	text/html
File Size	514 bytes
MD5	9d11c1c6b7d0d76930b2c96a266b1c0c
SHA1	b2033fbca497222df57fc1342c36d61e4e631574
SHA256	2ac2128f31e3018a30d7c3d405fb53b941b5e5e4e5ab5e48f0e8f4fb071c2dac
SSDeep	6:imMFc9bT87JcuQEfA7oGgbVhBf+PgIxnxTwTHM3rlH7VotaQG9XXAS1/zViG0yGn:soocsfOc10hCTal+UQMXXAazV1G
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\edb00001.log.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\backup\old\edb00001.log (Modified File)
Mime Type	application/octet-stream
File Size	2.00 MB
MD5	fd844bbabe07db7abd0dc40506c2fc2d
SHA1	5f911e0034459ce5559f71cb340f3ab12fb6de1a
SHA256	061c627aeadb265def1a51a567d2bcab65b81eb3eba797b2b6d7cb7ccadb139d
SSDeep	49152:puAa85+rI6ZF4+SHsrpJUSIC90fCmlo9yGn5cKJDHN1:PZ+kW47MR0fCmlbGCKJDt1

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.htm.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.htm.RYK (Dropped File)
Mime Type	text/html
File Size	514 bytes
MD5	eadbebfdd3dad3cfa73d717edfa474fa
SHA1	6647834fa5a3b5eb89aa3e440dcc3b2432bf8119
SHA256	b0298b954a30492fad373870afd225137f4584b4ef3f86a645598326da5e34c9
SSDeep	12:7Dc6/03/aWDPNg2I77h1sRBodY5zCSLvVqenlzP+uVlLRVXIbI:7DfEaWD2BLyAY5zZLMq9TVlR
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Peacock.jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Peacock.jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	5.27 KB
MD5	243aa2b4a682da2c432ee0d5d1f14fe2
SHA1	fc8f8fdee1d8157c6e4ec1c522c7df6b2034d9aa
SHA256	6cee532f174c2aa9cc0dafcfd824609a5cde86b2554639046cd111d5999f0e4f
SSDeep	96:dzAao0VmC9GbSqbiLJtTv+bXJwtZmzUFPSXGN60h7c/I3pWcpeg+:ibep9GbSq2H0gsXGk0lyI3X5+

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Peacock.htm.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Peacock.htm.RYK (Dropped File)
Mime Type	text/html
File Size	514 bytes
MD5	abd7a752484aff772d8a3996013d36db
SHA1	4296d750666ad4d0f1ad4443b1b7c739461a5734
SHA256	86c389ddfca59bba30e31305ee9bcd201aea623370b84840957aa3c2986b911d
SSDeep	12:upWf0svDxf+pCXmMXIOppxjunfct48LM0uQE7FKg:x0sLxfpbpf+fi4YM0uzFX
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\HandPrints.jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\HandPrints.jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	4.39 KB
MD5	83f867030a71d2c24c418c1a742d9f6a
SHA1	663db17fdc849447ecca3b372e2114a6fc24d211
SHA256	f4efefcc7c615b6fceffbdd6841b55dc6917ea3a795606e06559851378b7fd09
SSDeep	96:JDomMNpq7tSv6ucK4CbWQQnP4wR/X7bD2LBwgeIvu4BFhfftWJ0R:LMNpMw8K4Z1nP4wR/PYSO2yffpR

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Soft Blue.htm.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Soft Blue.htm.RYK (Dropped File)
Mime Type	text/html
File Size	514 bytes
MD5	e6432155abfbc84e4a3d93edca0f05dd
SHA1	91736ffbe06424c697c2c2e4f9254bec60109d0d
SHA256	68914598af5aed2e7ee125804f917b0e9d37761cc1b0a365b498a76342d83e92
SSDeep	12:wsl+aXJkAz7MlihdXAYR20gVE/wlJM2yuve4OLKXo3h1/MGy9:nl/XJz7MlihdX37gaUJdve4OeOa9
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\shadesofblue.jpg (Modified File)
Mime Type	application/octet-stream
File Size	4.89 KB
MD5	d3cf1e95c39b9dd70d40ff2989c4dd3f
SHA1	b3554f3a8159b6cf5ef7fe885dc947efd1f87c26
SHA256	c1c48418f5e7ff113f855b9e898fc96caae953e1d128e955e3910fe5f0d6fe37
SSDeep	96:955ufq61JBbjbKjog0/eNEVdQ2bw5uFYYRE5Un7mvb5Xn/CJdm4nXs5FRS:9m1/bjbKjoL/eNEVdQ0wk2pUqvb5X/Cb

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\shades of blue.htm

Modified File

Text

Malicious

»

Mime Type	text/html
File Size	514 bytes
MD5	0d8418e247d3eafd30a1a15ed72e24ec
SHA1	f8380fc2769b71ccc267da187c7c68e28ec1b430
SHA256	8b897e587610dbba8f3b4f302ebc9e447403816272296c4876fbe219f2c0fe5b
SSDeep	12:i8FGsyZQSb/ToZ4WgBYHhu09fZguSjSyNLyV0TbkuaMFp:jFGswQoboqWzr9f+WV0TA+p
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\softblue.jpg (Modified File)
Mime Type	application/octet-stream
File Size	10.60 KB
MD5	ecd254488b569bcdd488826e21b33f52
SHA1	00c24462a9691c660360901b8acb70ed1dcb2e1f
SHA256	4cfef1dcd5c7562b894f8aa7b78091091f93ed9c2f97027a8b42a40d3f906233
SSDeep	192:XwxTUsnOs+cQ3xxjjXtPp9HrgeKnGDPcv+So90NhWNvGGWJ0g/LD62eYsLVJFs09:Xwx6z9PpxDK2Wiqf0v7ujD62WVw8D612

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\orangecircles.jpg (Modified File)
Mime Type	application/octet-stream
File Size	6.50 KB
MD5	c7f6c1ca98161caed22934c5a58fcf8a
SHA1	d6308def58f16a59d83520d5cb2c8ae45903e83d
SHA256	d59e59aa29af8fa35b5b28c3d02a9f54a599a9c3f8f0e482fd0c3802bc846c76
SSDeep	96:njQRLww5OOkuVdTEdOyI89eg8l6+eCu7eh9LWxp8Fj8ygKRgP32u9ZZZeqQmN7p:URTtEd/eg8lhnZBFj8YRgP2uhQgp

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Orange Circles.htm.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Orange Circles.htm.RYK (Dropped File)
Mime Type	text/html
File Size	514 bytes
MD5	84d9c0a6fc31710c210d81deaae3209d
SHA1	75eac0b8b1c93b3aca67e6c0caeda56518596583
SHA256	47cce260b4661b1132284cf786dfb054eb052a3debdbb7219ce546f25d5a6547
SSDeep	12:QWdY4thaScjR0orNuIXB9iI+k6cH9+yREytk5qrM9mrZ:QAjcPrNHx9ihyH9DRHRFZ
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Temporary Internet Files\Content.IE5\index.dat.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\index.dat (Modified File)
Mime Type	application/octet-stream
File Size	32.28 KB
MD5	cc1c97ad8882df7ea6df5abbdbee9d6a
SHA1	736373c0648e2d902eabb84d39f1226b8fda56e2
SHA256	0860d7ecfc8b4903f759ee8954ef8c50a0fcd8a08130d1220579aa974bf6db19
SSDeep	768:W4VlU7hyNMcYutL+Ih+v9MdmAWn1caumIbvDjRcDs6h:W4DMcu1bjnWZbxcDr

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\WindowsMail.MSMessageStore.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\WindowsMail.MSMessageStore.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.02 MB
MD5	b0600a49d5ed1f43ebeaceebbf7fc5de
SHA1	f056cf3d47bb4930e3d8ceacf2c5d4e8ff7c92f3
SHA256	ba88463444f0e2e194956b5ca3a48943be673b5aae4a2b5e9690fdd57d81bd1d
SSDeep	49152:2WQKCLN8Rezo7iheWFwAHWITEhU3VFB93hatw/tKYXb:2WQJLNoyqimiWIw2lf9xXtV

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\js[1].RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\js[1].RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.22 KB
MD5	01850557d65bcaab559a9b95d5e93011
SHA1	e21acf0dcdc019de97a2195b6e3264ae0bb90d8f
SHA256	a02ab69fa8dbff9078cc68271ee11488fdd74f34eb85919362e4670edd936aa5
SSDeep	24:orXFT2c47nCMSh52EBN81QvILfy7etNkHJE9H1ggr+fSQHZH9GTycxkUBkLN:oJSFeMWwG8OI26tipE1mgri5dGTyJUBW

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[2].RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[2].RYK (Dropped File)
Mime Type	application/octet-stream
File Size	11.56 KB
MD5	55dbeadb082106bc4ade9278bc369898
SHA1	ad479c37a644315d0bb1c2048640a363a3ce54de
SHA256	b8792c7a053366e9d1a1b5620357d1b2fcec761f2fb1da64f971214c9e79104a
SSDeep	192:EnRjW5jgS0QtQy5rj1WtKVGmsaYvjaXXfxBBG1tXltn8WM8qfKtTaSZPKafI6k+z:eSrtQ88KVrPYcXbgPq0lhZSl6k+QMwu

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[1].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my\v2[1] (Modified File)
Mime Type	application/octet-stream
File Size	11.74 KB
MD5	a602c57b708ce860d55ad45c180e97fc
SHA1	502c40d6b819059cbeb20ea45b58479b03390ca4
SHA256	c8123de25c11c94d00e1742dcdbb543ccd687aa89e81fc77883a92b1d808b365
SSDeep	192:fQxqA5ZFXm04/D5hyq8FdvLLtJYiE450NqrBe5QI0raW/dq+ENMX46xse70DsTPh:sqA5ZFXRuD5hy53vQtVEe70+OqTNwB0W

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\f[1].txt.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\f[1].txt.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	13.47 KB
MD5	496adc9f368950821ab02fe9be70bde3
SHA1	74dbebf71e5d25180edc770eeeff09e8e7f75438
SHA256	dad69efe5bb00672cecf46c833ac46939421e9d36275ded2c9fe71b427778886
SSDeep	384:2fW7PtXi3XXUm9Qsy2VEBtdAJVqkFxplT:TdUQ92VE9uVzxLT

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[4].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my\v2[4] (Modified File)
Mime Type	application/octet-stream
File Size	11.69 KB
MD5	3ff4366e9cc071cab08b561414667339
SHA1	c3a953253ccf075fbd6a4f15673592ac7eb48609
SHA256	fa8d127ac804d4d6091adf3058343d259ce1a306f2f41a8d95d5b9abe0a7dab9
SSDeep	192:l/Mpt1h3msa6QGGsrCsYZr0yqohdL7rA6WfrMAzCC0mq9gp3EWh0PjFNbGooqYds:lkf166+sYxNHbDEfo8r7q9MgjFNi9P7K

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[3].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my\v2[3] (Modified File)
Mime Type	application/octet-stream
File Size	12.19 KB
MD5	4cd25e2006c926ca092cba0afa6310a2
SHA1	60605bf6334a9cabaa1e1c7b030ca1b654e93b47
SHA256	04e882e4203ff0a46d44eb31af8a8925837086906ee857233288db08946451a5
SSDeep	384:OMePQACg+4k8TLhQLWWKL5z2dxDf4sv22n:OM+QAB+4NHB2XJn

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\ga[1].js.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\ga[1].js.RYK (Dropped File)
Mime Type	text/javascript
File Size	42.35 KB
MD5	18ac134300f119fd88b09425bce2f051
SHA1	34f4c8f48258324c1170548d7cf8825760d63551
SHA256	4e544abe277d43c4aa18f2315788ccd54a4dec0f5f1e82cc6755e4529c18ea3b
SSDeep	768:wwhdT/wwpnZ3Rxx2AsBv19aTIav/D1k3giXbRBepMn4v/uhkmB7l:wCIw/3fwAkeVr+3HUpz/u+G

YARA Matches (2)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match
JS_High_Entropy	JavaScript has a high entropy; possible obfuscation	-	4/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\js[1].RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\js[1].RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.47 KB
MD5	bb7f43e12bea37bfb049c52faeeaed25
SHA1	889c6a41adc98b9416aaad99e235b01180e26cc5
SHA256	7712e95fcaefe84f7e7b030f9410539349ea0e3376b0efde9b95bdeb2fefbb67
SSDeep	24:8vuQPNcjZLOl1hbhmVXwv1mfwEnl41kIoqka2m6+MumqEEGD5H2A4FboMYBlf6pS:guQPq92vbau1owAENRRCqEEGDFd4FuBF

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\js[2].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\ikqeepzr\js[2] (Modified File)
Mime Type	application/octet-stream
File Size	1.63 KB
MD5	d4bef5f45572219994bf2ed7e1db8bbc
SHA1	06088d07f4a0c64ecb0ba8738b391a816b41354d
SHA256	edacd166469bb8fcbcb56fd906503098e576317e233f571d2b4a5e778328cba1
SSDeep	24:kEo6U3FdPjFsOyyPqDM42zwiXnS/oP5r+4FxHdA7/nkbydPLJoclfWO6v7s:NAFRRPtqDIFXg8++i/VzJowOOcs

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\ikqeepzr\player[1].js

Modified File

Text

Malicious

»

Mime Type	text/javascript
File Size	27.13 KB
MD5	ac894e986d99ec65314b6f335a307851
SHA1	fb3543e37ad942dfebfb0821fc63d628d6977d05
SHA256	23f0eafbc50bce9655d58e7a40575d7844c077aba09cac2f41f01d9194b76c9c
SSDeep	384:RqtrJSd2R6W382qbgR+QUWW2iuYUpgqvr4k/uh2V+ijd+cVhdCBeT1scXe3SRbg:RfG6C8h0zih0DQho+tkeiC

YARA Matches (2)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match
JS_High_Entropy	JavaScript has a high entropy; possible obfuscation	-	4/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\index.dat.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\index.dat.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	336.28 KB
MD5	da93e1bd9ba0f664244facc7ee5705c7
SHA1	6c98af507467349249df5ff241234b6dc8bd45d0
SHA256	6f6a395132c24f56fd53fd0b24935360d8e2fc04d77adca67c0fd06afa1fc634
SSDeep	6144:XL8hpPfMX5no9kdDXFFOJjTl2uVt3z2nxrs4gqAWdvq1WtG6HunKxlonJblSU7u:XL83PfMXdyKR8btos3EvoH6HubkU7u

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\js[2].RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\js[2].RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.22 KB
MD5	26fc84269b27d3b33475f49e9f83fc6b
SHA1	070d0cf0b0d8ef6b2e617a1406c1341a0cfa1a5f
SHA256	ccc5ec8ee1cbd074626e999e38905c49a6dc57b0d66db90c6558070d0c9649c5
SSDeep	24:dsaztILAvmujQ2Pkw43MJkKG5OJZ3mDE7UYwgiNPNjlg/tKO5YrfH9528f:d/ztLmus2PkJcJkiJAAQYwgi2UO5cR

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\v2[1].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\yg1r61z8\v2[1] (Modified File)
Mime Type	application/octet-stream
File Size	13.06 KB
MD5	847e6468c965df6d73c469264c05e694
SHA1	3ca2cc737319e17149574467221bbc08c93aef9c
SHA256	0242a1a97c8b3353dce542d3d78e5404ad654cc32cc7d76ace4fd3992b250b21
SSDeep	384:P2GV+yyOe5CCsu5Z0hdJAiv/3f4I+xlWuQc0JA:P9vUUO7Qd+iv/AIolBQvJA

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\js[1].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\yg1r61z8\js[1] (Modified File)
Mime Type	application/octet-stream
File Size	1.46 KB
MD5	03dec5f5f76d7583ba1cc08f0c02112d
SHA1	41172bb3d95d3f06586b3b5f8aa648a59b1609f3
SHA256	6947cd148134eee100a00247fb44379e39b49770908a1cc7407020a84b06b290
SSDeep	24:OWMllpMk+HruDA/LO8xfHcvO9suXzLW7yjwTxg0TYLJbC6UrQY5JEAx49NsWfHTR:xMbGSA/5PcW9PO7uwTiLA8DT73dZB

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	28.28 KB
MD5	00a060a721d02541ec44a72d8d4a7a02
SHA1	c99704c9bec470606d1a2d577cde63c0a7ed4387
SHA256	c9b33a1adb33f4f689f3bc8737a650859c0dbc71a33effaaa1ab812b058389d0
SSDeep	768:1QhPVuoL2vh4TDJsSQjObXS/GvBnR1V84y:qFooavh9v6bnvH1xy

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds\microsoft feeds~\microsoft at work~.feed-ms (Modified File)
Mime Type	application/octet-stream
File Size	28.28 KB
MD5	3ae03407fb410ea432412dc3fb3d6a2d
SHA1	7fd03843cbb4d9810377ce8bf599eba6c71f0658
SHA256	5ab786cc9b31275d30d65bba8a8fed5ecce9a75c6b19ea12f51bb76951736e7e
SSDeep	384:UlJacQ3be5CLi0kTqfE/u/4sSsaiEbOIgQJcps72bst3y9JJNNZ7Fiq1dF:UlF6yCLi0kT4EhTtiHj4dqJNZZ/1n

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\10_All_Music.wpl.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\10_All_Music.wpl.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.31 KB
MD5	975661c9a0ff69f0ef6db12ebb87cdf3
SHA1	88341984fb5c9f95f9c9bac9dd905485dbe1dc2b
SHA256	23a00f668000b61ad9aebc595de3631d7911c70c0886432fd78ef58c9e30b4e7
SSDeep	24:kTXDzUXG8XIrcBPCAxHlS64fR4tyt1XeFAOthQb5Z6d5DHE8HOwpWeEAf:kzXUhMs6Ax72Pb36TYgI16

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\11_All_Pictures.wpl.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\media player\sync playlists\en-us\0000e713\11_all_pictures.wpl (Modified File)
Mime Type	application/octet-stream
File Size	866 bytes
MD5	4d1f1eebca59a8fadecff3a602a63ab5
SHA1	ecbada23e936eb066fb551b72880cb4a1d6e9f4a
SHA256	a86d09f4aabaeb8471037a8cfe00443eda06e7240f797c2fc553a95e910bde4a
SSDeep	24:KbH1043LXVlNmqm87ubtGE0BZmZIo501EXc86f:Kx0gFmL87ubtGgvPXlO

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\12_All_Video.wpl.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\12_All_Video.wpl.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.33 KB
MD5	f734419e2ee32f65e677ab82fe49d9a8
SHA1	b20c6839fdf3606f2d9a2126b82b69bc023af76d
SHA256	fefe9de2220d0ed1cc89d983af89b3053bdb03cbacc87eb1212c597ed92e55fd
SSDeep	24:2emDoeE8WJy0z2KvszEHLc58WiNwsq7TILQe8IBhRuEQ/1COiGVd:2e/eE8WbaKvVZWzI8IBhF81YGVd

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\12_All_Video.wpl.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\12_All_Video.wpl.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.33 KB
MD5	6bb03b5bb9deb2aa7ef1e6f1dcfdd711
SHA1	50fd5842f925967e959d9d77b6bc230328a82e28
SHA256	131b8778a01aeabc6ad7773165dfe801376431d8dffb959ad821220e6fa519a3
SSDeep	24:cYYrkY+MP7daGYjn9H57cCGSLTK/NvsY/q3tF2+p9470A5KvQa050ExiQtT8XwO6:cYYp+MP7d2bGlvNqdFzps0A5K2RtiwO6

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\11_All_Pictures.wpl.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\11_All_Pictures.wpl.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	866 bytes
MD5	adac76aa930ceba41f4182dbbfdf8ad0
SHA1	3d695dfeecaa6f07deaf90eec308967796536437
SHA256	10f5cc40247e2230aa67d4b23cb54c87e3acb445fd158290582f54926d424514
SSDeep	24:m+LlAnkluquMAVUReZ0E7nqaUBnNGyRMqkU:/lAQuquVaeKE7eVNtEU

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\10_All_Music.wpl.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\media player\sync playlists\en-us\0000e713\10_all_music.wpl (Modified File)
Mime Type	application/octet-stream
File Size	1.31 KB
MD5	a4582bb925ab67651a9384db18434a01
SHA1	5f66c9f40f012860f0bf38d83a2596cdf4aa04f8
SHA256	e00d7f4dc42437d3c7e746cc0b741287d796277ddfa9901e450c2728a0292387
SSDeep	24:bglZwjAfR/RdvcnNjX5ULvGbGFpznZOA6lX2qEinwF:FAfR//vcntpUbmGFprOGqFny

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.sig.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.sig.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	418 bytes
MD5	85de7549c9c9c1650ad36a66aa898208
SHA1	96ca0e497cca249bd7293b29a6be515fc74dfeb0
SHA256	890a1031fab9503c442c592b577bfc6d9dd09ac0f2b3ddf950323194ba96a873
SSDeep	12:RJFwrCdFsAAf1SMYNP4Qwulw5JbyZdkxTnwQA:ymdFDAfUMeP4QM5k6rwQA

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.xml.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\onetconfig\350db95df4cbd94b2a1c300510e12e11.xml (Modified File)
Mime Type	application/octet-stream
File Size	2.25 KB
MD5	cfc5d60225ea7e97ff68d3f24edb9f84
SHA1	0d9b9c1fbd3a37d8483cf3fa4d502eb9ab26c6a3
SHA256	6cb6c59496974317b0d472e199690fd4220f02b266de78ad1df526d411d21497
SSDeep	48:Fsi8pzCkmWW2KetIeIHXSZTM5IlBUHzwkfqfKur7XpAOf7nU:Fsi8k2P2HMTM5IlWHzNfXsDLU

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\WindowsMail.MSMessageStore.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\backup\old\windowsmail.msmessagestore (Modified File)
Mime Type	application/octet-stream
File Size	2.02 MB
MD5	a39a7af568e7b949f722565d57c87cb9
SHA1	9af673c38137d44595aeec9d580ab689d2f7e6df
SHA256	0b1b55aabf827c5d019624b762af75f7896e7f282551780a1d8ad27545c94bcb
SSDeep	49152:LLrX8S43e7TYYJw+Q+yy/tPz+qMmAqZ+qda2BcwfytyPrVu/3:LidYJ1b1Pz4FqZrdaWcwfGyDVi3

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBwGan9[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBwGan9[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	14.46 KB
MD5	42ff0b8205f98881b62e9134a1d2f6e0
SHA1	acdecd76c3f5452e64c002cc09ca1e0a5ed914a1
SHA256	4671974c8f3348f67b5410a40c84e8cbacd72e14751cbac239b44a40a47e3717
SSDeep	384:pWBc2eKJDH7IP1LBS76r+dTT2o4RasfQ2g5P:sBc8JDbCBSn94R7o2GP

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\async_usersync[1].RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\async_usersync[1].RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.28 KB
MD5	10f73f86849a1b82250e873e11863292
SHA1	f86e739cb4d98cdb828ee3e559d24cb6cc50b8e0
SHA256	0645fad5ae7a92d04010af74e14e0d23a1abe5133fd804b601b3a9af4dfc315f
SSDeep	24:cY3u3Nx0eG21y3mzS4IGs6ysURMsCBmVeckNIlyVRHJRbamWoQoUKD:cY+p1yWzfpxxIc5+KJRrWoQHC

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\advertisement.ad[1].js.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\advertisement.ad[1].js.RYK (Dropped File)
Mime Type	text/javascript
File Size	306 bytes
MD5	4cd20b1824389003a1af258909bd423f
SHA1	46cb9eb9cdd385775801bcce0b2d882bfd3193d9
SHA256	58d31d583a4568ca0b3ff46b51c1a566c4615a8a3db1b919e13645e8915a97ac
SSDeep	6:6gjF6kH4YCDHAwkUEOcK0sIlOIK0Qqyy/Q4OX0KryT7kfThy07x:6up49HsUPcvxJKty44OK7WNDd

YARA Matches (2)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match
JS_High_Entropy	JavaScript has a high entropy; possible obfuscation	-	4/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA54rQj[1].png.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\aa54rqj[1].png (Modified File)
Mime Type	application/octet-stream
File Size	690 bytes
MD5	4ad8005af126d1174da9852d652dc167
SHA1	da9104e66120ab9c91eeec5f5084ee87ef96f053
SHA256	d568004d14539b950902d0484ff6ca22e08159804c6b3c6d68f3fb1e87d23035
SSDeep	12:dUgxEIH9/jK0Hef6P2paQ4GLZ9vkGr23ePsgTPEeh8oJ3eWJnS2WTZJGLXvkZa/I:W+KqVGL123ePKm8w3e7x7esI/l5rYl

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\aa3e3xc[2].png

Modified File

Stream

Malicious

»

Mime Type	application/octet-stream
File Size	594 bytes
MD5	7df4d0a1a1e34e3efd9215721a87b298
SHA1	641bb701f06ca5f36ecc44569e4f7c336cc9a897
SHA256	9cdfb8102dcbe8f649519ea5d615268f2b2ccf087f4129b83fec8e0c71d5076b
SSDeep	12:OxgZvU0x5+lGLavx6uMBaku/JpYFFLFPu1570ElvkRMmITZZT0YHvd:GoDapvsukaku/UFPu1577vkaZT9vd

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\528d82a2[1].js.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\528d82a2[1].js.RYK (Dropped File)
Mime Type	text/javascript
File Size	11.97 KB
MD5	eeeb8aa795a4e84c274eb2c91e4fed1d
SHA1	bdb7f002108a7adaf4dc9bf6149824d013096c3a
SHA256	7c49ce92308c88e33ba3033a2660e71ade1f9d9fb683562631641eb56e8d2e66
SSDeep	192:5Rah7K+1sx/Fv+w8gf5FjCEGks14zVp7AfoECjZZ9wU0wkHzpHo9yn+q07A/Z2:nah7K+1sFfu3ktxp6oECoHfTfM

YARA Matches (2)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match
JS_High_Entropy	JavaScript has a high entropy; possible obfuscation	-	4/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB5kTiV[1].png.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bb5ktiv[1].png (Modified File)
Mime Type	application/octet-stream
File Size	578 bytes
MD5	248dc6f54700dfd9a045a28550055af9
SHA1	5af668501d06e3c3b69fd47b52611ab32cd5967b
SHA256	e7416bc246c35ba6800d92bf089d0cd6b0a0b5786dd57dd80a39d883f8781162
SSDeep	12:v/a0jdn+gDTWazjNNb6Q1/6ZmmxWYGLdb+lSJ6igARBKxJs32:tdn+CTWaHNL1/6ZmKGL9J6iFRr2

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB5kJAC[1].png.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB5kJAC[1].png.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	578 bytes
MD5	afce642d54895bc86982571756e1d827
SHA1	c858f489236688f901522a48842a7feb02a42816
SHA256	4aa049c358e96db31ebf2f428ad2ca153f2710e0b8887cfdd859902a7ae9c84f
SSDeep	12:+WD3VsjcWuRR6YB59iZhEDBBqhW778Aezz6VAVz6b3An:hzVsjcJFiZidBmW778Aehw3A

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB46JmN[1].png.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bb46jmn[1].png (Modified File)
Mime Type	application/octet-stream
File Size	1.05 KB
MD5	2a98f922ed927e39a8ce96a69995954f
SHA1	fc8add31baf11563d2f122cf3eff523f5501fd1b
SHA256	c33f040fc4b2c63bcdf0a800e050a13f399c4dc9ecba9d089fbc81080a07381e
SSDeep	24:U+l/U1s+ZqZU5cj/rvtsPwkH2zcYxoUW9Uf0vw7F35EeDe5hhmsjT:U+hWs/U5cFsPwkW4nUWe0453iTmG

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\async_usersync[3].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\async_usersync[3] (Modified File)
Mime Type	application/octet-stream
File Size	1.58 KB
MD5	92da15c3860af7dbb48db0c5c74e3457
SHA1	62fb99604b4be0288871c642859d846aff161ae4
SHA256	378277f24ad49eb712867f29bd99518f9d488bdb79ce424cde9631da1a6896d6
SSDeep	48:CiGcNmIUJ9c6Kv4pg+LJlAb8rdifuDvaSxosL:r1xv6KApp9l28rdiMoI

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\adServer[1].htm.RYK

Dropped File

Text

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\adserver[1].htm (Modified File)
Mime Type	text/html
File Size	8.75 KB
MD5	69f190f2e63877891ec93c3134657b44
SHA1	9e6700e83e3363ea4c3a8affc1bc46ae11b32013
SHA256	50eb629d7d1937330ffba87ac518ed078455f6c81ed3e8d366b1d04c3450803f
SSDeep	192:skrLAC7poWlXB7mvsymo/FdGFB49qPHjAfKVrGlmCS/RqF:sw8CdZlXBKkyT/2B4oPH4l5ScF
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AAdAVrM[1].png.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AAdAVrM[1].png.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.10 KB
MD5	478bdd71c8274d3756288c99fa2a52da
SHA1	45c0ca2c25bd7bc21b5c8d6e578025dba25f0e1c
SHA256	6262de7ce94c34a3a15a9e6c7b118ef27a3eaafcf83c6a53b3a7eae721aaf315
SSDeep	24:XL7PvlvdoXgtKAjoEfFj8N+rWVZAf0KTOT+kZiTUvQzhj/:XL7PvllxtBoEfFjdrWDruu18TUe/

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA8uCo4[1].png.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA8uCo4[1].png.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	994 bytes
MD5	7dc7dc44fbd22d84fd96b3bb177e5015
SHA1	98014d07e700ddca004ead8d50f1768eb2ddc27a
SHA256	af2945ab2e95f76b9365919db3aa4a72cc9a1c9eab523e823ecb7c825b7e8e7a
SSDeep	24:9BxIUUPJisCztMXmER0RfAwIerzUYhH7zH+G9fHRlR5UyfvadCXT:96PL2EzRK1Ie1hHf+G9fHDRKyACXT

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA61yi9[1].png.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\aa61yi9[1].png (Modified File)
Mime Type	application/octet-stream
File Size	690 bytes
MD5	bd034f44215fa942fe59ed8608bca045
SHA1	897e9e95660d389df351d2f453fd6c0a4e2487c2
SHA256	5fb27ad21577448b61f7467e7fb5f93185970b782b90f49216fb6683ea17aa5e
SSDeep	12:8No7TGjXAg5s3/sU6LfNiPmJd1LOpUOptvRRPzBfgggfA5ciuf/MPRwIcelCLZdA:OofGr5s3kU6bNiuJrKpvRBBYggfxaaex

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA3vOVA[1].png.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA3vOVA[1].png.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	930 bytes
MD5	4c2d9c468193d07a10c2e29e2855d5a3
SHA1	1a1c4c1b21b9cf816d8bde1c9191bb38ad572f26
SHA256	c55eb4f185da0cc9e332992d230a4deae1d1742972f795140cd75fb7362e860f
SSDeep	24:9uod1ILpt/33jdz6JRXALDng009zXp3xfTMNv2JeNrXg:9uUILpBTswLrg009zpi+cNbg

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBDZoZR[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbdzozr[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	2.63 KB
MD5	f7010fcf2327e85cf75f8a66b3313ce0
SHA1	b7b5444dd6cb4933fcf991daf2b19338505e6bce
SHA256	dfa748e14e3ed61f26b4beff0a00fe3b2a194e947d6899fa93ae406e43419407
SSDeep	48:Cq+sLFKpI28maCLingj9vrZqhoqEX71UUEM2HFyOLCLvLLr3O9KQh7iqXz8Mjr1I:LZKH8sOK9LjT2H7L+zQPZXzRfN0

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBDRbsH[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbdrbsh[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	2.33 KB
MD5	6facce25aca8dac28ae292a29356fd31
SHA1	eb2149d5f3d80f3b8011f758a1006887d1026bec
SHA256	9d09820b398e21ecb636983b53008121148f05031b041f0b073384df39670cfd
SSDeep	48:gpqDnoyPLFpurf38GKE8EiecVShEYNoKiou1Zx2mnEBgvS3GHZxcTawb/bZLyFt:M0n5DurPT+IjNobx2mEBgvS25xceW/bA

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0rDa[2].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0rDa[2].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.27 KB
MD5	3f7843ecd9f94394ae5e6ed7d2ffeaa6
SHA1	b757fcdf0bc49b37233347ad483510fcafa227e2
SHA256	89278f84701a10ed9ef98ec3a54035bf140f28b71b5ad9133a16bc218670915b
SSDeep	48:wAnPWS+HjBI6+YxipiNvj2YgVnuDBj9o3Pv+zF+:3WS+Hj+6+YqC9oH+R+

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0rDa[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbc0rda[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	6.41 KB
MD5	5d0ff7523ac5cbf1433775187cb9c5fb
SHA1	cb75c62a85447d239ad8eb0462d862331ca511ca
SHA256	f5cefd3c86b07516d06ea146953aa0e878b2379cbc8a52255bd338f5f91c33f8
SSDeep	192:JXpe7Trb9FgpAnRxeWTMZzY7UqQC/vFoM:dp2yAntwnC/vaM

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0mlu[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0mlu[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.56 KB
MD5	ba4623ae476986a435c94c6b1d9bff06
SHA1	6e85653ed0deab4473a0e394438e9fe09a043e2d
SHA256	04bbbe9505eec8e72b7ebbae9ab2b11847c98d8e65140ba5211c771563f4df45
SSDeep	48:imI8DWNKwCx99z2d6RRNi7uyB8MqMPYVFgDng:imMMwCH46RRNiSyB8U02Dg

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBz9wz[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbbz9wz[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	2.49 KB
MD5	09c20fed6a9d30c35c19497a21d0ffdd
SHA1	a13c5fc81c894188f20fdb3abe88bccc980ac9ab
SHA256	93bdeb6850fa3bad0739748f239e35dfcd0f443eabfac8bbb4aad418c90ab5d4
SSDeep	48:lBJ2duGrtpUUaxMJ0tdUMSCW+fEUazUKV4pyv1Pjcbb61UYeK/4MTukoX:pDGr4U9JwLSCW+fEUab4stPmbXITuki

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVxM8[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbbvxm8[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	2.24 KB
MD5	b66cabd9b2861cd64ffa2fe81bdbe1b2
SHA1	d95b6964de74e6e4ad018ef4d35120e2836ea447
SHA256	793fe67937cbd483db216d88e7543ec33e38277f82f14afe373dd07e4b1822b7
SSDeep	48:uoIgIKtEwA0RYWYLc2ELYzQhGJJFTweTUaHbjq2pQym0l766tFv9g0XdzIDs:uoIStEwVYWI6pGJJOIU+u2A09brXdUDs

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVGsM[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVGsM[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	7.88 KB
MD5	eece4b1d80d30a68b95e9233cc5dfb32
SHA1	2c3b4d5cd1ed686e3c4c824744076aec3ac8e7d6
SHA256	e666896afeec89c4a72c7877079dad0f4f062b98e9e5cb255427f15de0db1d3d
SSDeep	192:Mog9MnurPZ/qqNitb3Gyo7muMQ2hrwovXCoxJtPEUZ4j:Mog+Z6ih3GNerjvXVU

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBTpvW[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBTpvW[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.19 KB
MD5	8c35773dcd0b2e69ef8b15b95eabd3a6
SHA1	37ebcf96e0ceed9a117c05fa929b9bee1311c138
SHA256	b43770e004d34cd179f2960c0b6c1966aebc66408036bb60b5f9c559e2cfa22b
SSDeep	48:2R/B0MmO9xEiOoukG6UoDbjDhvhIEzNLLUqkJhHdYIBxWM7QQ:2R/nnzEWzXDbjDX3z9Uqk3dY0EM7QQ

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVEOW[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVEOW[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.64 KB
MD5	fab70fd7ccf00c93a1e29e1b6706a05d
SHA1	ef2db9761602b7c84ac6b48fd16a167069562cb0
SHA256	ffc94363d04fa9ab340d0cdc67f9a660f5865c0d74eb9a262bfa06ad3be49c31
SSDeep	48:kDNdkLOFbmdD7ZfO3+LJjXxg4LLYkWzwzXGMA4V0XTGTAs53UstQuYdPCw/N1f:k/kQbMvzxg2VWz8GMAy0Bs16zjf

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBPUFJ[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbbpufj[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	8.00 KB
MD5	1dffb8728f98664578f02155dc556820
SHA1	8466f3f4aa88af4ea145040d51886bef47c92549
SHA256	7863c0a67f3d072467ef6a7017d2796f9a2ecac80b2285e0123cea42e3287a67
SSDeep	192:2jgDme41rsEX0YIOKK1Re5558rNgQClWQp21t:2a41r1iPKE4NgNPg1t

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBOe7C[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbboe7c[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	11.66 KB
MD5	8c3c6cc92fca3f31d2040b5b4d21b070
SHA1	805b787bb5ec830c6db6359d1a393ef0ea6e1be9
SHA256	ea06d14837653ecefe12ed584dcab01c0a41c4d54da6f27ded76efcdc3fce971
SSDeep	192:KqSjeq2b3jFt4/z8ndPFsFzbXPxCZ7iV2Lo4fXGoh5Q7mb7LBGogNNuQApcSuBfr:KqSjcjjI/K6JCxiVR4fXb5vb5GoYgQAw

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO3tl[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO3tl[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	24.80 KB
MD5	4125ac565f544ba7d892f03f2a8baf7b
SHA1	76e9430c3c96b663552627c21a08735c3b1e2147
SHA256	951f87bb939e04f13d74c2db433b8da0ba86551c6d330bf370729bc2ef25d7ed
SSDeep	384:5IgjAF1gwGhW1OCUjEiPCHY9eVgVedwBTwRWUp65eJbywjJQraCpuPF:5IMDr8BlHY9TwRZpHJbLQra9t

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0tCi[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0tCi[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	12.78 KB
MD5	30b244708d3bdbaa6d83a08d4bb3cbf0
SHA1	676fe3a67fe7020a080801dc8387a04db7bd1b82
SHA256	cd389e39ae16d26985f868d0e3cf963988382df35fc08fc5b668d653dabd47d5
SSDeep	384:Q7B0GSx0YsHHwAhTTO6z7ARbYOmf9/21kO:hrqdxpT5ERbvE9ub

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0ALC[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0ALC[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	6.19 KB
MD5	4f886b17e039d5afa28804e309d0c692
SHA1	1c56acb7fe295a276ca7d06ece1d1c271579ee95
SHA256	4d95b78e5cb09eb092a9d08609332c828107ec85bad28298db85b5e2ba873fe3
SSDeep	96:IzdvCIgXRYO7Hc1JXpGzaz8BTPzypracCXbtaylvKmCQkzGj01Nb7hp5ClVnVYR:Iz9aR18zpuPOWXblvKmCQkz201Nb4VnM

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBLhZX[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBLhZX[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.67 KB
MD5	3efa051359fe3361afa86dd4cc81932b
SHA1	64433f915e25b5dc7d13d8727a708a015edd9bcb
SHA256	dc512f6b2d319d58e32748f5995c1338757dd17266cefc8af33b697b9f7846b8
SSDeep	48:12prviEJFrfDm42xzPmYD3JKIF95wn2VXqltVj1JLNPZr/6rqb4wuBW7Cl:1MiEX7GPmq3J5KM2tVj11jUwuBW7c

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO8dQ[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbbo8dq[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	2.11 KB
MD5	a31ad89414a467dcb71edb4542bc2c15
SHA1	96bf0b963a494b43ec8bc324c174eb22fd2151c9
SHA256	85c90b5e5e7ad90b5ca04e27feffd8e34068117fae81abb20cded3f0ed847ce0
SSDeep	48:BZQY3A8BsXaK8xcmRbP6Cdbeo5XW1aeXB7AdeajEGj2tMgyx:BZQcKXaJcmRbiGb/5XuamSIaDj2Mgyx

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB6Ma4a[1].png.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB6Ma4a[1].png.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	674 bytes
MD5	f8a3e7eead0a16148fa8758bd266796f
SHA1	3b751da52d4aa53a5c4819f21589966fdf3e4463
SHA256	dd35d6e52ce75bdf0e80f03fe02332838f15b7d41d2b6aae5540516a3d45a730
SSDeep	12:reoiQZibRUtwzKt/LP2LMpyFqiNN5Ix2aS69V8omZNlbtdJc1jdabU:KFQZibyCq/LPzpyhgSpvNtdJsP

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC095c[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbc095c[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	2.08 KB
MD5	bf64cfbc2e3d6ed5799acc3ea920ed2d
SHA1	5df6759a5605b5235182735abf3b42a52df026ee
SHA256	410d0306b62ca1793610aefb6d52e562e1d858e10a788601533616d759b5c124
SSDeep	48:BNYgw0/IeWh5LP7mWF6JyPnQHrGh4YKdi9Ln:z9w0aLSVJInQHahxLn

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVIzI[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbbvizi[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	2.94 KB
MD5	8f04f02bf429b1c445e11ff8bdb811d1
SHA1	944876f222327b422392091a5f0735e4434ea341
SHA256	a0185b25886edb562a1c07d8a87895e79b61fd93a8110940e1378e9a1d218f13
SSDeep	48:wZCbiRnqu1yvZg7VcmMi2ZuslioAkp5n3QdBlLtYyoDp4HCdyXBT/azuGfu4zcpI:wYIqScg7zHslidc5nSnxsDp2CdyXl/iP

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBE97O8[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBE97O8[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.49 KB
MD5	aa206576a8aaf8d409435f9d2a6c06a5
SHA1	d50bd53cee7270b101f9041c7b32733242217455
SHA256	b279cad95ade5c8e89744b4360eb54bd9af3b1153962da2c73822c297eea8ed8
SSDeep	48:HuIFjqaVoX0bWCOWZvEOJc765oujYAzE33AXrb95pAmhbov0jKjArLdJXVDg9MW3:LRqaDbWjWh/mgoYKQXv9zosS6bVDg1dN

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\28-8f3193-f30905ea[1].RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\28-8f3193-f30905ea[1].RYK (Dropped File)
Mime Type	application/octet-stream
File Size	231.60 KB
MD5	08a9aed67bcd333415f136a3f744f7ba
SHA1	1d0978a75d7e0ed3ed10cb950fd827fc92bde07a
SHA256	e35af53bc6e3bc34b941b0dc8b6d6a561499ef4c747a6dff05b662b5cbb1f65d
SSDeep	6144:cvrqpFhBt04JcHJah9uRfr8JVcVYBnC4nUHS6MZ+OMZ:QsxHOps+mYYBnHnUHG+FZ

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEgyIm[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEgyIm[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	13.63 KB
MD5	98d0aa70bcf726bc6e25c222e4c8aa4d
SHA1	ec5f6ec5f1c0b7bb4e67b21238339ad1d6790b5d
SHA256	54324e6f9d140b937bac6fff538d194a65e7c304e3433aa991822837392b922c
SSDeep	384:bS+2NykLj4PIpiC2EdaxZ9DxSJ+RINl4PlS+2oX3+z:bUyk7imeDxSJ+RINqlSz03O

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEgsz3[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbegsz3[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	17.50 KB
MD5	4b654fa86e1df58f5a47cfa0808179e7
SHA1	3628154ea5d60c3768305bf2ab84613b4b64bbc0
SHA256	36275ae9760d21b96c298fdce1caac98e0200bc0244da22093abae9d7dae9fe5
SSDeep	384:nqtDgo19g9Pmq57AiP6QP1kGAJ7kb8JAXhD1XYlcl:8Dgo7g9uq51P6Qv8AZhYlcl

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEeTuf[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEeTuf[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	13.30 KB
MD5	20283321bc688043e16ba2ecfd8f2a8c
SHA1	1a402a73343bc4dac727e3669df1b45c8b8b0f54
SHA256	98db0d06575451d2258508d4faed7034da607cf0509544194a36cc0439fa183c
SSDeep	384:uxCJGNj2etpJ+2z7JQzK2B3wd6T7GgAnJ6epORodc4Yz:uxCjetSI7JQu2BAd65+6odk

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBIqq8[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbbiqq8[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	13.08 KB
MD5	37de1e2fe23e307d18522b82e9f819ac
SHA1	239bb6d5a23db77112066be8daedfb995e6d0e58
SHA256	f9b4802e5dba16d09be6121d8dff83c736360571d28a24db575714cc35bcfee0
SSDeep	384:st2PhWyF0amnggcoRkZIK4wyQYVApqnTJVvlUCNOMDjVDbe3:sE/0amn7coRkjU/nTSCJjE3

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBPThN[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbbpthn[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	7.83 KB
MD5	3426c79d5787591d3ecdd5152e97395d
SHA1	abe171d8b2cd89fad05d07efb5912880b92e9a2d
SHA256	440471e63b363baa014621e8c5ad7f2f53ade8fd2974ff84a94c900cfaf7f3fb
SSDeep	192:XVDdDV5jYzvQT15UT7ztjqKz9dfSpSxG+hCYyKvs:XFtu3btjqtoGV9ws

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBE9wSt[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBE9wSt[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.00 KB
MD5	040f798fbd6a7415e48a0a17f4cfe9a0
SHA1	1f9d36c408839cf0344b1271d06b55985379c6db
SHA256	12a9b6cbcc74ed61532f7e73b2b9bc034ee7cad192dfc2742536a656bf66bd66
SSDeep	48:g0e4yNDo3XmThspxEDn8Ft5dq3J4tObg7JNUOGzHkvhtg:g0+m3XEhspxY8FtUY0OMHihe

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB74fLs[1].png.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bb74fls[1].png (Modified File)
Mime Type	application/octet-stream
File Size	642 bytes
MD5	c43f9e3eebbd9571797f0eda6e9b5331
SHA1	0dd1476fc23964510ec8ef2659bbfecacff44ff9
SHA256	b022de31113cfb0451be514af76c650bf8da72b7d79f66ee8e4f16258131e5ff
SSDeep	12:THyTkVPdCA/p5OlSkRPWw0oKmSeAV0ZoxPjPpU1lUH9s2uPOKN46N:THy4YA0z1WASeYwaH9sFLN46N

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBL0ij[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbbl0ij[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	2.53 KB
MD5	cf42ddda2f6c122d9aaa473c0eaaba43
SHA1	19b9a760e2130a867c08fce0a37f285a5424e361
SHA256	2d40df09a9fb4cd3d927de4220d986fbe5aedd4bc032420026aca2d90ec7cb19
SSDeep	48:PQI9HukBeis9IP6eFRGRtTfnk8GpB6X4VZUs4fQIVMBDu5deBcgmNi76PwEBOeTB:/9OkkiWhgRGR9kbflk3VMdu5VgmNi76P

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBNiEo[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbbnieo[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	10.46 KB
MD5	104a570465d8fda10203af24a57dd327
SHA1	c63e7571c24f511536d10c29d2ee22d1d405bf72
SHA256	2dceaaa510c731652652129f0d1add653721295b7e4bc106a743db2eee37eaf8
SSDeep	192:GeohPUgHcYPqZnz7+PkD6y6MAwm3QCSul0Cn7qUVzfQ1hYnL9s956XLdepWpEvB7:wPUscYMz7+sDvAP3QOlQAfQ1CJs956D0

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBQxzx[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBQxzx[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.56 KB
MD5	237c6b4404e8c8406c9cf4754d45cf8c
SHA1	0c7d0faad609c7e393d093e521de031e3e5be053
SHA256	073d92aac20d8df3b421833625fc35afb26310ccf3afbb4ca26101c42b67b2a3
SSDeep	48:tqr9RnXY9+wtYjTJsROINeRRhqHNB/B2Lc/WZjNyU3ZCuCwELjzgqP:cp52CTsNepqHz/BAFNBZCfLNP

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO1mQ[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO1mQ[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	6.13 KB
MD5	0f00adf2bcff7326672acd919ce06a19
SHA1	ec9e4e23b9e3b30023eff87810fe1c9e9951f9f6
SHA256	ced77f17086738358382d4fa44791342bef81c6a5d79a1064781d824054f3de9
SSDeep	96:cKfP2xKAX0pZ53JWHTUpoZQ8ZRiFP84TMy4RkLqsLI6rkL19rFOBbuY0oM:vfPKKAE5czeoZQ8ZwULZRkLqMYLCHs

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBseMP[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBseMP[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	6.63 KB
MD5	07057eeedb1faea5fcf885c76cb9a7c5
SHA1	f7f8b7295510f7ce694fe7e1b6001780a5e4df0c
SHA256	6decab760be4034f6b6571a22c048f00920f00d11cb7a22969919b432ba31e5b
SSDeep	192:knLWXoh8ZY0pWiwl46aqQNRdmNHyn4sB/OXzXbf6:kaXoh+Q1a3Rgyn4aWXzrS

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBDK7Yy[1].jpg.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbdk7yy[1].jpg (Modified File)
Mime Type	application/octet-stream
File Size	10.52 KB
MD5	f7fabf8c5a225e9d2f086ecf41bb0cb0
SHA1	d1e5fa797838797a6e8cb249f220ee378796a0ab
SHA256	944c9bba2afb4cd41571a1ee69c5ae7f5a868645cce6228b26bc32087c7dede9
SSDeep	192:E8r47F0rNpq5E0bjtGfqG3x+tBKLS3+1wM6E60oN2ljFDs72xgqox1ie:E8r3HydjtGf96BruaM56yFw72gqobT

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\css[2].txt.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\css[2].txt.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	466 bytes
MD5	9ce1912dba060303958d825e21eef4e8
SHA1	e095e2dba39f0edcb391fb84b75286434c5bb5a8
SHA256	40244ffe7d7f89d23bd0cdcc2dfeabc7a02684a876ff23fc76cae73d93974377
SSDeep	12:enxweE41tvJsJooP1RbKu50SIv2w8aOBe3EwM2q:exwb4zvqJ1N9KuPIv9LOkfM2q

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\ie8[1].txt.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\ie8[1].txt.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	386 bytes
MD5	a6debd1d1cb960a7bfc62a6883199d7f
SHA1	9b8f4eae88430728a1f247f0acb8a4df768954aa
SHA256	a7fcc88543e2aefd7f8164247bd7b14d3551aa3d7b71425e79d6d4a78c5ebe8d
SSDeep	6:meGXH0U2GC8PJqutEWhni4F8qpcAIPr+uqsuvA6UxFb0jIPOP5WureE:FI2GhPJdtpn/8qpYqpsuvAfXjWWY3

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\meversion[1].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\meversion[1] (Modified File)
Mime Type	application/octet-stream
File Size	4.66 KB
MD5	d206b0b632468766dd198c03c7cc76e1
SHA1	ac8c4e7e8cd304488eed486c1126af585d33a0e9
SHA256	80f2f68dea926667f0564a0437a3212b60b6d5f028593a6584f431b247b2c47a
SSDeep	96:AheW9QLge/8AiC8Yq9tQyn/FB9Cc+gzVKaU3QwZQQDkEeyiCiQtUAhWxQ:eeW9Jvvn/rUa7U3mEBiCjkQ

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\core[1].css.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my\core[1].css (Modified File)
Mime Type	application/octet-stream
File Size	165.10 KB
MD5	a94f3d39d6ab85eeaff104df78ae581d
SHA1	fe78fb95c1c979fec6cbed94a55b8532bb6349f8
SHA256	4dd748b7a5b8c024e08ff20f2cc32e6bf5a039edbc861c27397dd2a4ed186094
SSDeep	3072:V2ZAkmEpmhXLXCBc6lJOlaA2n2itF4qZaMPwYVjok0ZDnbx:pypM7Xq1l062iJaMPwjDDV

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\Standard[1].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my\standard[1] (Modified File)
Mime Type	application/octet-stream
File Size	85.31 KB
MD5	806f21ee7c886483984fecc250be9a75
SHA1	7bfc999fa230963429776235da3bf6da6e7df9f4
SHA256	756a1c69a05fce905f2381c961d3ca11bbf6d600eaa90c0cc09063d2576e8b0a
SSDeep	1536:Nvbq21mUrIeBunWfDIkrUXQwQaXK/q6vQVsNTK1ikimuCyOIIa:NjT1mUcCIkreQaXkqKQVaK1Vim/yOIF

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\print[1].txt.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my\print[1].txt (Modified File)
Mime Type	application/octet-stream
File Size	450 bytes
MD5	f51022db0a8d2a83f2ce50c59b55e6e0
SHA1	52dc8e223f7287d2bea64f3ef60ef69c969a7fac
SHA256	d09a65a652098b32eb0eb6f2e330d7f4c26e636dc5cd375e60d149882734f77e
SSDeep	12:9aXBIxLTOlBgATXg7Qs4IO9R7bWZXXlRr/qyARxd:94BIxKBgATXgw3XfMR2Fxd

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\index[1].htm.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\index[1].htm.RYK (Dropped File)
Mime Type	text/html
File Size	45.97 KB
MD5	fe5ca8fd0a9e4375067c07a579e54572
SHA1	775ba31ce89ebd15388ad9e9ea27432cb90e5e7b
SHA256	32b3e23eb9f49c0480acbe36e58853b80ccbc56ad5bb7f4748ef4bb5bf15f8f8
SSDeep	768:TrQkMTSByCJSddhr2ryunmQIiHFc7f2q+WESBYip6pbr766GCTaVpsWwZrieUFgE:cT/nx/bSFFFip6t6WTaV0GgE
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\adfserve[1].RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\adfserve[1].RYK (Dropped File)
Mime Type	application/octet-stream
File Size	4.05 KB
MD5	e744aaf32b33ee0f4349fd30ae1a0548
SHA1	915042cd45bc14ca51c620de0fe7d1892babe320
SHA256	fe08892e1eddbf241fe3ae0a9d039f958fd7ee36b77c2e9287e4c2aaf321caf0
SSDeep	96:dxeCsuKuKVb+qIW2oP1zkYh2E+gs0204l6Fc+XXy/vvcs1SJ9:lsu/Kl+xW2oPGUogsYglqX5s0J9

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\ast[2].js.RYK

Dropped File

Text

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\ikqeepzr\ast[2].js (Modified File)
Mime Type	text/javascript
File Size	70.33 KB
MD5	7a213667f49a95381f9e377736317c6e
SHA1	0f437488e7d61822b97f198a54c3dfd8fc3fd3ef
SHA256	cb85a44918db5e7c371d1faa51a9f95113570c44dc4ac0bf60d1c19358a712e2
SSDeep	1536:Kk3kyuPkvHm681eQxxyWHan96CeJNSGrPR5YbFD4CLrHz/8:KWkyWkvG6N+vCexR5YZkCLP8

YARA Matches (2)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match
JS_High_Entropy	JavaScript has a high entropy; possible obfuscation	-	4/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\adfscript[1].RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\adfscript[1].RYK (Dropped File)
Mime Type	application/octet-stream
File Size	10.39 KB
MD5	db7153d1a6081bb064e3f6d1813eeb2c
SHA1	f01177d3623aec218ccae06c3069228343deb93d
SHA256	05b41bd9a44d762e88a92f77d68fe0cccbb879ed355d6b5f94c5231481cff7c9
SSDeep	192:qp6+q6wMSZVzVxd4ulOyLFUjC74PTc8Srbk7BH9VHi16HeyVjHenv8k:qLuzVxd4Yojq4MPk7vVCA9jHgUk

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\player[2].js.RYK

Dropped File

Text

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\ikqeepzr\player[2].js (Modified File)
Mime Type	text/javascript
File Size	24.10 KB
MD5	9b53beb7b65fe8ed8bb8901a393b17f2
SHA1	73449cc0a9e52dc4be43428ea6e9bcc85ef6651a
SHA256	5164e266db000d573faa6099dca77cbf97771abbb0ddf04a0584da7a3a0f3915
SSDeep	384:+5iZyPdqDqIeRwl7NH0fmZ2bOE/YJxlSp7C+pM45aYMooiRsCz1/xCkRtohIpUHJ:mtHkl7NH0OM9MAhuooqhB/UGrpUsmd

YARA Matches (2)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match
JS_High_Entropy	JavaScript has a high entropy; possible obfuscation	-	4/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\th[1].jpg.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\th[1].jpg.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.55 KB
MD5	a72721c053f0b4bb50971d8910f030a7
SHA1	0b9117738f4ad1388abe82b72312362bbe16cf22
SHA256	8b27e5a1cd63f22ae07695bca4709f3c33b6a8ce401d2cce10f0a01c07ba6484
SSDeep	48:9FHxvd/BpH6n3n6KvZaa/B+fZ1f7J1CHD3F+Tco1dm3AvCkSLHWkMu/EK35:9FRvdppHcX1Raagzf72ZvommCPJ

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\css[1].txt.RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\yg1r61z8\css[1].txt (Modified File)
Mime Type	application/octet-stream
File Size	154.71 KB
MD5	602f7db50d2baaec38bbce765ac2a380
SHA1	273696375bd6e7ed62c70d2e46be17d039a45205
SHA256	e9153f9a471dbe324b487766912bce0b13d180bc80b69650137ac8b319f5d4cd
SSDeep	3072:eetRMZNj+iQqUj5OToMDZH6Qd5231WJGPa9MxB9R7ZInSbnn:eetKw9XMDZaHWI1RNLn

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\ast[1].js.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\ast[1].js.RYK (Dropped File)
Mime Type	text/javascript
File Size	70.33 KB
MD5	cac52cdeab1c0aeb434b332bc8bd4211
SHA1	2da3ccb96e171abeb7db7bad9ec3912b11ab0f65
SHA256	b714bcca6d65f45aec81065fecd8bdb4cad75eff008e6713ac7e74ca90a7da4c
SSDeep	1536:j5qIN4csbJ6TJzqTc1d6KeicGcCEXSTiLGrW3p77QZBi:1N4cs+Jzqw1d6HAVmSTiLGrkp7QS

YARA Matches (2)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match
JS_High_Entropy	JavaScript has a high entropy; possible obfuscation	-	4/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\adex[1].js.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\adex[1].js.RYK (Dropped File)
Mime Type	text/javascript
File Size	36.74 KB
MD5	3c2cb0dd7e830849f167583e75410bfe
SHA1	1df7d46f79a9024f288e3cb27d3d8f4c6be2822e
SHA256	dac7110860ff41d5565d42c32572a7678d89279668b8b2ab500a9e7e1ea104c4
SSDeep	768:J9AFwu+fqxAQvEKKPzQ3XjHSBJBjLeZy6OvE/ajpwZ2x6iF8qEJ:JO7CqzUEXkJBjp51x6Nq6

YARA Matches (2)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match
JS_High_Entropy	JavaScript has a high entropy; possible obfuscation	-	4/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\adfscript[1].RYK

Dropped File

Stream

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\yg1r61z8\adfscript[1] (Modified File)
Mime Type	application/octet-stream
File Size	10.39 KB
MD5	b39093537af7eeb838b87e42e2003fab
SHA1	8833c6ef5b3c52d0c32dbec1b286263d464642c0
SHA256	2c207d5f3b0065bb380929a4f01757e26af62b0f01a1fac8d36d777848270643
SSDeep	192:gPJu6i3gpD67b0wzhImzYhWZRUp9YZLpXoZAEG/bX2Bf5JDKXAtuaHM:gPJu6dIv0oYhWcpoLOZvG/bSszaHM

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\26158[1].png.RYK

Dropped File

Binary

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\yg1r61z8\26158[1].png (Modified File)
Mime Type	application/x-dosexec
File Size	48.36 KB
MD5	1605950c8320058a0137ec0629dfcd7a
SHA1	62c6236c6b9af6f5f412229b091061d6f99ba15d
SHA256	f86b30dad4c24f627fc34d4a775986d9294775062c7e8f825c583765672cf86f
SSDeep	1536:6oLU5Vf3yDlWsicvuTzRU3u4ec3O0TEs3qWvyviv:9U553A04uT9U3JhqsTvyviv

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\msn[1].htm.RYK

Dropped File

Text

Malicious

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\yg1r61z8\msn[1].htm (Modified File)
Mime Type	text/html
File Size	2.56 KB
MD5	37bab3537473318115d1053611afc0a9
SHA1	4ab287f2d9f9520bcc254e8f81d67528624b17c3
SHA256	6613ec00fa88b924d52c75361e57919842829922954739ca4f0cf9178af67f19
SSDeep	48:CIVio2LEe5YdIaaHQk5iyi8CPzlfv+JO9V4u/bIq97M58krCvMrHME:CIVxICdcQZPPpmUV4AU8kOvTE
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\uid[1].htm.RYK

Modified File

Text

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\uid[1].htm.RYK (Dropped File)
Mime Type	text/html
File Size	2.83 KB
MD5	f17c111fa4a3f630425f2501a5ee5164
SHA1	186fde749186b88d795d9ef12c37243b6178022b
SHA256	8e3fbfbbff6353a18a650f0bbf73d0617fe4f1180c366cd1d2f1036ed2c23163
SSDeep	48:HzyQVhnO06rt3f2ZFQ/nUddAO6I61tB0lYHyRe5P12DLvxuQ5zUsT:HZF74tvUAnwdr6I61zOOUCPkDLYQ5zvT
Parser Error Remark	Static engine was unable to completely parse the analyzed file

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.75 KB
MD5	1cad6db38079ec2d120ff382b8f4933d
SHA1	fd2e2ea1f0a51e7c9cc0c92341bb7f08b727788c
SHA256	68881f276faeed01fcfbbe4555c2774144654dbaaad31861cd15e0d0171cca77
SSDeep	48:oMqSoQ24FoLSBRcV2JHOnEgZpC6tzSWCz3rQvXL:oJQfF9RDJHlgzCVpr0

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	962 bytes
MD5	ff3c213dfe48dfd4314cf57232050e90
SHA1	468a9372dc2331744faafe14184d73181b985b9b
SHA256	417b3ffe1009917eb1009ce474cb166b114335c7f7588b136363f81f8bf803fb
SSDeep	24:/FWag/0+gafS8llSrx50A55edISbC6eVqRE:/FW59ga6/F55euv

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.RYK

Modified File

Stream

Malicious

»

Also Known As	C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.97 KB
MD5	f948467f107b40e4ce4424962784820d
SHA1	41b1251b6de0937b0cd716d6fadad04b90e81549
SHA256	e512d8c89d1da11e6aa60f3bc7ac3268b66436ecb71816a2cc6ddb109659f759
SSDeep	48:7ueoxtV5uz1NolMRhdiHK0wJkk6UhlwsUKsuz6beEMvv:7Ex/i1DRbiHK0we4isUqzsMvv

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
HermesRyukEncryptedFile	File encrypted by Hermes or Ryuk Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

c:\programdata\microsoft\crypto\rsa\machinekeys\08e575673cce10c72090304839888e02_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	52 bytes
MD5	93a5aadeec082ffc1bca5aa27af70f52
SHA1	47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256	a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SSDeep	3:/lE7L6N:+L6N

C:\Boot\de-DE\RyukReadMe.html

Dropped File

Text

Unknown

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\outlook\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\domstore\3lkbqzj3\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\recovery\last active\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\ryukreadme.html (Dropped File) C:\Boot\pt-BR\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\deployment\ryukreadme.html (Dropped File) C:\Boot\cs-CZ\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\ryukreadme.html (Dropped File) C:\Boot\zh-CN\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\google\crashreports\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\media player\sync playlists\en-us\00010c6e\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\groove\ryukreadme.html (Dropped File) C:\Boot\ko-KR\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\apps\2.0\dqq19bcj.jax\yvorlgor.pnt\ryukreadme.html (Dropped File) C:\Boot\Fonts\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\ime12\ryukreadme.html (Dropped File) C:\Boot\hu-HU\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\publisher\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\ringtones\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\media player\sync playlists\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\low\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\themes\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\ryukreadme.html (Dropped File) C:\Boot\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\event viewer\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\color\profiles\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\domstore\owlvmzrc\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\wpdnse\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\groove\system\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\virtualized\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\wer\erc\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows media\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\caches\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\low\history.ie5\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\backup\ryukreadme.html (Dropped File) C:\Boot\nb-NO\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\1024\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\apps\2.0\data\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\mm5o9xqs\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\media player\sync playlists\en-us\0000e713\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\forms\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\media player\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\domstore\8nes5h33\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\apps\2.0\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\imjp8_1\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.word\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\explorer\ryukreadme.html (Dropped File) C:\Boot\pl-PL\RyukReadMe.html (Dropped File) C:\Boot\zh-TW\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\antiphishing\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft help\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\recovery\ryukreadme.html (Dropped File) C:\Boot\tr-TR\RyukReadMe.html (Dropped File) C:\Boot\pt-PT\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\apps\2.0\data\cjw3o3kp.bx7\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\taskschedulerconfig\ryukreadme.html (Dropped File) c:\users\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows sidebar\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows sidebar\gadgets\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\acrobat\10.0\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn2\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\history\history.ie5\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\pmmr5k9k\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\history\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds\microsoft feeds~\ryukreadme.html (Dropped File) C:\Config.Msi\RyukReadMe.html (Dropped File) C:\Boot\ru-RU\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\apps\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\acrobat\10.0\cache\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\apps\2.0\dqq19bcj.jax\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\apps\2.0\data\cjw3o3kp.bx7\6ng60cxz.9gj\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\domstore\ryukreadme.html (Dropped File) C:\Boot\en-US\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\1nbur4hr\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\recovery\active\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\gameexplorer\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\media player\sync playlists\en-us\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\ryukreadme.html (Dropped File) C:\Boot\el-GR\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\outlook\roamcache\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\xt1rpyg9\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\imjp9_0\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\14.0\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\virtualized\c\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\14.0\officefilecache\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\apps\2.0\dqq19bcj.jax\yvorlgor.pnt\manifests\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\low\history.ie5\mshist012017071220170713\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\color\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\wer\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.mso\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\ryukreadme.html (Dropped File) C:\Boot\zh-HK\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\visio\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\credentials\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\kqmhsvkd\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\ketajp6d\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\d68g7bij\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn1\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows media\12.0\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\onetconfig\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\media player\transcoded files cache\ryukreadme.html (Dropped File) C:\Boot\it-IT\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\cookies\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\google\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\virtualized\c\users\ryukreadme.html (Dropped File) C:\Users\5P5NRG~1\AppData\Local\Temp\RyukReadMe.html (Dropped File) C:\Boot\fr-FR\RyukReadMe.html (Dropped File) C:\Boot\es-ES\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\backup\old\ryukreadme.html (Dropped File) C:\Boot\ja-JP\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\wer\reportarchive\ryukreadme.html (Dropped File) C:\Boot\fi-FI\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\rijuql1c\ryukreadme.html (Dropped File) C:\Boot\da-DK\RyukReadMe.html (Dropped File) C:\RyukReadMe.html (Dropped File) C:\Boot\nl-NL\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\1033\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\adobe\acrobat\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\internet explorer\domstore\fkluidu0\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\office\groove\user\ryukreadme.html (Dropped File) C:\Boot\sv-SE\RyukReadMe.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\03j4uqw0\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\6asvn7j7\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\vb18b0kb\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\imjp12\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\history.ie5\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\history.ie5\mshist012019121620191217\ryukreadme.html (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\ryukreadme.html (Dropped File)
Mime Type	text/html
File Size	627 bytes
MD5	c6b39645b1dbfb5cef7ff3a06eb45a5f
SHA1	582fc94349b00e518bbb5c706e7cc8adc75ecab6
SHA256	4962251e42282a3fd2b73dacc827a09cfae86f5474cd14ec59d39ed085b77206
SSDeep	6:qzQc31zQh5XMSv2/y9vW6328eIHySC8Gqs5HtHtr+EsyeIsILvgstXhaM:kJlzq5X9v2/0bHeIH/GJHbr+OsKXUM
Parser Error Remark	Static engine was unable to completely parse the analyzed file

Remarks (2/2)

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After