ab5b8853...1e5f | VMRay Analyzer Report
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Ransomware

R1.exe

Windows Exe (x86-32)

Created at 2019-07-08T14:39:00

...

Remarks (1/1)

(0x200000e): The overall sleep time of all monitored processes was truncated from "8 minutes, 20 seconds" to "1 minute, 40 seconds" to reveal dormant functionality.

VMRay Threat Indicators (12 rules, 224 matches)

Severity Category Operation Count Classification
5/5
File System Encrypts content of user files 1 Ransomware
  • Encrypts the content of multiple user files. This is an indicator for ransomware.
    ...
5/5
Local AV Malicious content was detected by heuristic scan 2 -
5/5
YARA YARA match 206 Ransomware
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\ACECache11.lst.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Acrobat\10.0\SharedDataEvents.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\GDIPFONTCACHEV1.DAT.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5Kvc aIyBu.odt.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7LC7h3NKBPeoe.m4a.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\A54yMyJIBKZ4.ots.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Cookies\index.dat.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\ap3qnxm9od.flv".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\effx4divca0tc4.flv".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\emljy8wk7h.png".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\fdb1k.ppt".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\mpoa-.m4a".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\ms8ez6n.docx".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\omts.bmp".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\qg9fuzdvmpex.docx".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\qgba8xp0yphpg.wav".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\sd82f9b.ods".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\hViKCLPrU.gif.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\AhKC9lHcLc.m4a.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ldLFid8fGd2Cz6.bmp.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\kmb QJZmXmJi_.m4a.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\j4n6VZ.png.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\w5mAGJ1Y.bmp.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\U8XmBQFiP7PLq9.wav.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\AdobeARM.log.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WTSuSWDiNChTS.ppt.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\x850.png.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ZpuiP.xls.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\index.dat.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FORMS\FRMCACHE.DAT.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\index.dat.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.bak.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\LocalMLS_3.wmdb.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\mapisvc.inf.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\Outlook.sharing.xml.obi.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\content14.dat.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\thumbs.dat.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.chk.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\oeold.xml.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.log.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00002.jrs.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00001.jrs.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb00001.log.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2iI83Xqu-SUm9ZsQ.docx.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8DDixiNZtZLaWeCmu7e.swf.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\WMSDKNS.DTD.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\WMSDKNS.XML.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\BtC5B7IXSKDZSJgLAe3.swf.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\f6eDx z94Dzwz2K8sqE.pptx.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\gQXnrhLgWoJRH32GpKD.avi.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\History\History.IE5\index.dat.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\HSDnH8dTNYHVzPB_.doc.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\u9Pfn7XvaHQ8ByEI_piG.odp.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\uRfigoP5hgocNJCg6h.flvi.RYK.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\MSIMGSIZ.DAT.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\MSHist012017071220170713\index.dat.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\index.dat.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\frameiconcache.dat.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\CurrentDatabase_372.wmdb.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.htm.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\WindowsMail.pat.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\edb00001.log.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Shades of Blue.htm.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\HandPrints.jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Hand Prints.htm.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Green Bubbles.htm.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Garden.jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Orange Circles.htm.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Peacock.jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Peacock.htm.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.htm.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Stars.htm.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Stars.jpgF9B.ods.RYK.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\WindowsMail.MSMessageStore.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Soft Blue.htm.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Garden.htm.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Temporary Internet Files\Content.IE5\index.dat.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\js[1].RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[4].RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my\index[1].htm".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\f[1].txt.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[3].RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[2].RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[1].RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\ga[1].js.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\js[1].RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\js[2].RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\index.dat.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\js[1].RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\js[2].RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\v2[1].RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\11_All_Pictures.wpl.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\12_All_Video.wpl.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\10_All_Music.wpl.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\10_All_Music.wpl.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\WindowsMail.MSMessageStore.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.sig.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.xml.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\12_All_Video.wpl.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\11_All_Pictures.wpl.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\Passport[1].htm.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA54rQj[1].png.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA42EP9[1].png.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA3e3XC[2].png.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\528d82a2[1].js.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\async_usersync[3].RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\adServer[1].htm.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA8uCo4[1].png.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AAdAVrM[1].png.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA61yi9[1].png.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA3vOVA[1].png.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBPUFJ[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBOe7C[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO3tl[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBNiEo[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB6Ma4a[1].png.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\28-8f3193-f30905ea[1].RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBQxzx[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBPThN[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO8dQ[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO1mQ[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBLhZX[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBL0ij[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBIqq8[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB74fLs[1].png.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB5kTiV[1].png.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB5kJAC[1].png.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB46JmN[1].png.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBDZoZR[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBDRbsH[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0rDa[2].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0rDa[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0mlu[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC06Ub[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBzxW1[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBz9wz[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVxM8[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVGsM[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVEOW[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBTpvW[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBsqNL[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB1CcOi[1].png.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEeP0k[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdXJj[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdqEy[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdtWw[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdoQv[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdE0f[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEcHle[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBE9wSt[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbe97o8[1].jpg".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0tCi[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBDK7Yy[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0lYn[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\css[2].txt.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\ie8[1].txt.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\meversion[1].RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\print[1].txt.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\Standard[1]RYK.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\core[1].css.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\th[1].jpg.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\ast[2].js].jpg.RYK.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\adfscript[1]pg.RYK.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\adfserve[1]png.RYK.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\player[1].jsm.RYK.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\player[2].js.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\26158[1].pngpg.RYK.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\adex[1].js.jpg.RYK.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\adfscript[1]pg.RYK.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\ast[1].js].jpg.RYK.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\css[1].txt.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\msn[1].htm.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\uid[1].htm.png.RYK.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccountwpl.RYK.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccountstars.wpl.RYK.RYK".
    ...
  • Rule "HermesRyukEncryptedFile" from ruleset "Ransomware" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccountt_week.wpl.RYK.RYK".
    ...
  • Rule "JS_High_Entropy" from ruleset "Generic" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\ga[1].js.RYK".
    ...
  • Rule "JS_High_Entropy" from ruleset "Generic" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\528d82a2[1].js.RYK".
    ...
  • Rule "JS_High_Entropy" from ruleset "Generic" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\ast[2].js].jpg.RYK.RYK".
    ...
  • Rule "JS_High_Entropy" from ruleset "Generic" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\player[1].jsm.RYK.RYK".
    ...
  • Rule "JS_High_Entropy" from ruleset "Generic" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\player[2].js.RYK".
    ...
  • Rule "JS_High_Entropy" from ruleset "Generic" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\adex[1].js.jpg.RYK.RYK".
    ...
  • Rule "JS_High_Entropy" from ruleset "Generic" has matched on the modified file "C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\ast[1].js].jpg.RYK.RYK".
    ...
3/5
File System Possibly drops ransom note files 1 Ransomware
  • Possibly drops ransom note files (creates 147 instances of the file "RyukReadMe.html" in different locations).
    ...
2/5
Anti Analysis Resolves APIs dynamically to possibly evade static detection 1 -
2/5
Information Stealing Reads sensitive browser data 1 -
  • Trying to read sensitive data of web browser "Internet Explorer / Edge" by file.
    ...
2/5
Information Stealing Reads sensitive mail data 1 -
  • Trying to read sensitive data of mail application "Windows Mail" by file.
    ...
    • VTI Actions
2/5
Anti Analysis Delays execution 1 -
1/5
Process Creates process with hidden window 2 -
  • The process "taskkill" starts with hidden window.
    ...
1/5
Persistence Installs system startup script or application 6 -
  • Adds "c:\documents and settings\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\ryukreadme.html" to Windows startup folder.
    ...
    • VTI Actions
  • Adds "c:\documents and settings\5p5nrgjn0js halpmcxz\application data\microsoft\windows\start menu\programs\startup\ryukreadme.html" to Windows startup folder.
    ...
    • VTI Actions
  • Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.html" to Windows startup folder.
    ...
    • VTI Actions
  • Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.html" to Windows startup folder.
    ...
    • VTI Actions
  • Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.html" to Windows startup folder.
    ...
    • VTI Actions
  • Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.html" to Windows startup folder.
    ...
    • VTI Actions
1/5
File System Creates an unusually large number of files 1 -
0/5
Process Enumerates running processes 1 -

Screenshots

Monitored Processes

Process Graph

Process Graph Legend

Sample Information

ID #102275
MD5 8ebc7a62a10f80deba528943af806064 Copy to Clipboard
SHA1 03ded58db9c70793fe4ef1837078ff2780358efb Copy to Clipboard
SHA256 ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f Copy to Clipboard
SSDeep 1536:zSf7kZk6rlQT7n5HDkyxZcEYo028CacINZak4CsbcaBwl6UQ/ksWjNcd7g9/pvZ7:1rGT7pglo+CacUZak3wbUSc9/5Gzt Copy to Clipboard
ImpHash f617d31fd4c248ca8bd068593baaeb35 Copy to Clipboard
Filename R1.exe
File Size 168.00 KB
Sample Type Windows Exe (x86-32)

Analysis Information

Creation Time 2019-07-08 16:39 (UTC+2)
Analysis Duration 00:02:21
Number of Monitored Processes 24
Execution Successful True
Reputation Enabled True
WHOIS Enabled False
Local AV Enabled True
YARA Enabled True
Number of AV Matches 2
Number of YARA Matches 206
Termination Reason Maximum binlog size reached
Tags
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image