8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a

General
Target

8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe

Filesize

144KB

Completed

20-10-2021 12:51

Score
10/10
MD5

89895cf4c88f13e5797aab63dddf1078

SHA1

1efc175983a17bd6c562fe7b054045d6dcb341e5

SHA256

8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a

Malware Config

Extracted

Path C:\$Recycle.Bin\RyukReadMe.html
Family ryuk
Ransom Note
contact balance of shadow universe Ryuk $password = 'UWUEbcQLr'; $torlink = 'http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs

http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion

Signatures 18

Filter: none

Defense Evasion
Discovery
Persistence
  • Ryuk

    Description

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Executes dropped EXE
    1073r.exefvOOUhBaClan.exeIEwuQeDAslan.exe

    Reported IOCs

    pidprocess
    3721073r.exe
    1032fvOOUhBaClan.exe
    1232IEwuQeDAslan.exe
  • Modifies extensions of user files
    8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

    Reported IOCs

    descriptioniocprocess
    File renamedC:\Users\Admin\Pictures\MovePop.tif => C:\Users\Admin\Pictures\MovePop.tif.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File renamedC:\Users\Admin\Pictures\SuspendConvert.raw => C:\Users\Admin\Pictures\SuspendConvert.raw.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File renamedC:\Users\Admin\Pictures\MountRemove.raw => C:\Users\Admin\Pictures\MountRemove.raw.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File renamedC:\Users\Admin\Pictures\SaveHide.png => C:\Users\Admin\Pictures\SaveHide.png.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File renamedC:\Users\Admin\Pictures\RepairUninstall.raw => C:\Users\Admin\Pictures\RepairUninstall.raw.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
  • Drops startup file
    8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RyukReadMe.html8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
  • Modifies file permissions
    icacls.exeicacls.exe

    Tags

    TTPs

    File Permissions Modification

    Reported IOCs

    pidprocess
    4688icacls.exe
    1436icacls.exe
  • Drops desktop.ini file(s)
    8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
  • Enumerates connected drives
    8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe

    Description

    Attempts to read the root path of hard drives other than the default C: drive.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    File opened (read-only)\??\O:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\F:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\T:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\S:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\M:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\I:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\H:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\G:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\V:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\U:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\B:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\R:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\K:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\J:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\Z:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\Y:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\Q:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\P:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\N:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\L:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\E:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\X:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened (read-only)\??\W:8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
  • Drops file in Program Files directory
    8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\ui-strings.js.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\ui-strings.js8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ppd.xrm-ms.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm.api8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\.lastModified.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StorageConnectors.api8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\RyukReadMe.html8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-down-pressed.gif.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White.png.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\ui-strings.js8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\RyukReadMe.html8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\PREVIEW.GIF8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\pages-app-tool-view.js8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White@2x.png.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui_2.3.0.v20140404-1657.jar8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\ui-strings.js8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_2x.png8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL012.XML8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\ui-strings.js8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\RyukReadMe.html8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_shared_multi_filetype.svg.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.LEX.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\mc.jar.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\msipc.dll.mui.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\RyukReadMe.html8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_ja_4.4.0.v20140623020002.jar.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\natives_blob.bin.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\RyukReadMe.html8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\s_empty_folder_state.svg8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview2x.png8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\7-Zip\Lang\kaa.txt.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\ConfirmSwitch.mov.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Templates\1033\TimeCard.xltx.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.PNG8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\RyukReadMe.html8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fr-fr\RyukReadMe.html8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.RYK8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
  • Drops file in Windows directory
    taskmgr.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\rescache\_merged\4183903823\1195458082.pritaskmgr.exe
    File createdC:\Windows\rescache\_merged\1601268389\3068621934.pritaskmgr.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Checks SCSI registry key(s)
    taskmgr.exe

    Description

    SCSI information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyNametaskmgr.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000taskmgr.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000Ataskmgr.exe
  • Creates scheduled task(s)
    SCHTASKS.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    4768SCHTASKS.exe
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses
    8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exetaskmgr.exe

    Reported IOCs

    pidprocess
    37048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    37048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    37048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    37048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
  • Suspicious use of AdjustPrivilegeToken
    taskmgr.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege4248taskmgr.exe
    Token: SeSystemProfilePrivilege4248taskmgr.exe
    Token: SeCreateGlobalPrivilege4248taskmgr.exe
  • Suspicious use of FindShellTrayWindow
    taskmgr.exe

    Reported IOCs

    pidprocess
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
  • Suspicious use of SendNotifyMessage
    taskmgr.exe

    Reported IOCs

    pidprocess
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
    4248taskmgr.exe
  • Suspicious use of WriteProcessMemory
    8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exenet.exenet.exenet.exenet.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3704 wrote to memory of 37237048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe1073r.exe
    PID 3704 wrote to memory of 37237048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe1073r.exe
    PID 3704 wrote to memory of 37237048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe1073r.exe
    PID 3704 wrote to memory of 103237048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exefvOOUhBaClan.exe
    PID 3704 wrote to memory of 103237048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exefvOOUhBaClan.exe
    PID 3704 wrote to memory of 103237048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exefvOOUhBaClan.exe
    PID 3704 wrote to memory of 123237048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exeIEwuQeDAslan.exe
    PID 3704 wrote to memory of 123237048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exeIEwuQeDAslan.exe
    PID 3704 wrote to memory of 123237048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exeIEwuQeDAslan.exe
    PID 3704 wrote to memory of 468837048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exeicacls.exe
    PID 3704 wrote to memory of 468837048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exeicacls.exe
    PID 3704 wrote to memory of 468837048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exeicacls.exe
    PID 3704 wrote to memory of 143637048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exeicacls.exe
    PID 3704 wrote to memory of 143637048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exeicacls.exe
    PID 3704 wrote to memory of 143637048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exeicacls.exe
    PID 3704 wrote to memory of 492037048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exenet.exe
    PID 3704 wrote to memory of 492037048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exenet.exe
    PID 3704 wrote to memory of 492037048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exenet.exe
    PID 3704 wrote to memory of 417637048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exenet.exe
    PID 3704 wrote to memory of 417637048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exenet.exe
    PID 3704 wrote to memory of 417637048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exenet.exe
    PID 3704 wrote to memory of 464437048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exenet.exe
    PID 3704 wrote to memory of 464437048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exenet.exe
    PID 3704 wrote to memory of 464437048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exenet.exe
    PID 3704 wrote to memory of 233637048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exenet.exe
    PID 3704 wrote to memory of 233637048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exenet.exe
    PID 3704 wrote to memory of 233637048f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exenet.exe
    PID 4644 wrote to memory of 26084644net.exenet1.exe
    PID 4644 wrote to memory of 26084644net.exenet1.exe
    PID 4644 wrote to memory of 26084644net.exenet1.exe
    PID 4920 wrote to memory of 13404920net.exenet1.exe
    PID 4920 wrote to memory of 13404920net.exenet1.exe
    PID 4920 wrote to memory of 13404920net.exenet1.exe
    PID 4176 wrote to memory of 49004176net.exenet1.exe
    PID 4176 wrote to memory of 49004176net.exenet1.exe
    PID 4176 wrote to memory of 49004176net.exenet1.exe
    PID 2336 wrote to memory of 48362336net.exenet1.exe
    PID 2336 wrote to memory of 48362336net.exenet1.exe
    PID 2336 wrote to memory of 48362336net.exenet1.exe
Processes 20
  • C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    "C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe"
    Modifies extensions of user files
    Drops startup file
    Drops desktop.ini file(s)
    Enumerates connected drives
    Drops file in Program Files directory
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:3704
    • C:\Users\Admin\AppData\Local\Temp\1073r.exe
      "C:\Users\Admin\AppData\Local\Temp\1073r.exe" 9 REP
      Executes dropped EXE
      PID:372
    • C:\Users\Admin\AppData\Local\Temp\fvOOUhBaClan.exe
      "C:\Users\Admin\AppData\Local\Temp\fvOOUhBaClan.exe" 8 LAN
      Executes dropped EXE
      PID:1032
    • C:\Users\Admin\AppData\Local\Temp\IEwuQeDAslan.exe
      "C:\Users\Admin\AppData\Local\Temp\IEwuQeDAslan.exe" 8 LAN
      Executes dropped EXE
      PID:1232
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\*" /grant Everyone:F /T /C /Q
      Modifies file permissions
      PID:4688
    • C:\Windows\SysWOW64\icacls.exe
      icacls "D:\*" /grant Everyone:F /T /C /Q
      Modifies file permissions
      PID:1436
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
      Suspicious use of WriteProcessMemory
      PID:4176
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "audioendpointbuilder" /y
        PID:4900
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
      Suspicious use of WriteProcessMemory
      PID:4920
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "audioendpointbuilder" /y
        PID:1340
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "samss" /y
      Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "samss" /y
        PID:4836
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "samss" /y
      Suspicious use of WriteProcessMemory
      PID:4644
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "samss" /y
        PID:2608
    • C:\Windows\SysWOW64\SCHTASKS.exe
      SCHTASKS /CREATE /NP /SC DAILY /TN "Prints1" /TR "C:\Windows\System32\cmd.exe /c for /l %x in (1,1,50) do start wordpad.exe /p C:\users\Public\g2o9m.dll" /ST 10:25 /SD 10/21/2021 /ED 10/28/2021
      Creates scheduled task(s)
      PID:4768
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "samss" /y
      PID:8732
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "samss" /y
        PID:9028
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "samss" /y
      PID:8740
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "samss" /y
        PID:9016
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    Drops file in Windows directory
    Checks SCSI registry key(s)
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of FindShellTrayWindow
    Suspicious use of SendNotifyMessage
    PID:4248
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\$Recycle.Bin\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\$Recycle.Bin\S-1-5-21-2481030822-2828258191-1606198294-1000\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\BOOTSECT.BAK.RYK

                      MD5

                      f870de985ffa0b38a23b49ae42b3920d

                      SHA1

                      5e3969bad7bfc69053e6646c1ba0fabc16b8c2e6

                      SHA256

                      c212a07b21c32f94d0af5551cc1cd5e82be5dea5233a0af4ba45f7124dd44ec0

                      SHA512

                      e9b199f41b085e26fe4d3344a86e4ff99061e086e829bbbf6792743f3504536246a2d505556c019a4b140635aaf0207fa4aca389ae82fc665b9537c648ba6330

                    • C:\Boot\BOOTSTAT.DAT.RYK

                      MD5

                      25123b89f17d3bcf598c3b8e778f0445

                      SHA1

                      e270dc1f8e976ded231264f85374ca0704268bf7

                      SHA256

                      6e5e3ce7563c25198e8fc6d4961dd0d0cc6fa71608bb1f115bed53ff5e895e8c

                      SHA512

                      24b7ef698b20f65b2ac61404e6870874c9056448518db7d462fa97902c7691a5a25b0fbd745e2f1b0b4265372054c266279b77a098cecb2960a69b722bb8f1c1

                    • C:\Boot\Fonts\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\Resources\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\Resources\en-US\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\bg-BG\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\cs-CZ\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\da-DK\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\de-DE\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\el-GR\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\en-GB\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\en-US\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\es-ES\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\es-MX\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\et-EE\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\fi-FI\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\fr-CA\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\fr-FR\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\hr-HR\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\hu-HU\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\it-IT\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\ja-JP\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\ko-KR\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\lt-LT\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\lv-LV\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\nb-NO\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\nl-NL\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\pl-PL\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\pt-BR\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\pt-PT\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\qps-ploc\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\ro-RO\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\ru-RU\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\sk-SK\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\sl-SI\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\sr-Latn-RS\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\sv-SE\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\tr-TR\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\uk-UA\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\zh-CN\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Boot\zh-TW\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\PerfLogs\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp.RYK

                      MD5

                      064bd1adfe3a6b8338a2b29e14802348

                      SHA1

                      649485851344fd045cbadc8b88e8c39c98f04e07

                      SHA256

                      747bd2d100abc30e93abc52f89678e749df189aa4db9282756dcf9b30c06dd4e

                      SHA512

                      513a31010b04945342cbfad23334b66a099aab6858a1c350b7ecce3656dca7805ed0095ea1399fffba0971619e1f6d04029f4c1ab5a52e41f2559607ca40bf31

                    • C:\Users\Admin\.oracle_jre_usage\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst.RYK

                      MD5

                      ae6658cb0b81b3db29a5397aab7e3623

                      SHA1

                      56fc9a319d651a3baf889d72c3b01847a2ef590c

                      SHA256

                      e56cf98619f0daf4f0b9bc27c768cee067beddc586214f2dd4156d8137347898

                      SHA512

                      fb3d8de33e54d8657fd72dcc3bf427b748bf6d8cb02aafd03d8fd4f0137b79633778ebc2c1697a1afeb79267d62e653066b84ef73d871151adf81080e38a1a5f

                    • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst.RYK

                      MD5

                      02f75606a6ec8a7d8228bd4a0e50f5ce

                      SHA1

                      566533fad6f8b7d258e0c98454360905f9cb3732

                      SHA256

                      b4f8eda09ff7ae0a5e82926da4433d001d835fd350c91e239d6afc121d732fb9

                      SHA512

                      2db483b4296ddcd0a5e62a0979b3c7b498987fd59c86a65cac370c076a9be5bd47d593aa1781e8cc24174d7feb3880b452e77a2b8f3dc266ae4541cd91127f2c

                    • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst.RYK

                      MD5

                      893880e1a18d1c99777690f5dc49e547

                      SHA1

                      d38db48f41d6fe935c19d5718d7902c773b8bc85

                      SHA256

                      7d9c4c460eb5959c8c8136c736ad8b24075a7efb763b139baabdca55e6972ebc

                      SHA512

                      912aef0ce4cd8fe74dd68499726c9a7e5e4d57458f9fea100d0088afdb14c81240e3730ceb6eb434404e2b4553ece18c617e3a189fa513bd01b8e9f05fa93535

                    • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat.RYK

                      MD5

                      9ff5c9bbd4d239215e704ec74ef02e8f

                      SHA1

                      2351766992a6c2ee87161f6364f32698e9885272

                      SHA256

                      1dfcd3923759c9e6b19977b7842902af974b51a42d27c69c723c264f877381a0

                      SHA512

                      dbf3080d343a233d8f807a41f01be2910b3325ca2ee430b90a4d84d082da76cb8baba3b490f545669e20b05bf08efc3fe8aaa405184128edfd23a95115d2015d

                    • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents.RYK

                      MD5

                      6e584b45e6374c77d1bc367d168de3f4

                      SHA1

                      0e9dc271edfcbe7259034204119ad07ab6f79c52

                      SHA256

                      e11a4201d239a2b1e13e12d4dce182ff4478c762453dac562a1ac70e623af454

                      SHA512

                      3ba8434701e538a6c69b00e67e74113807afa2399d2b3c3054f6a196638b44ac24674ce45f299dbae6b25b60c77a2afc3d92c7e87eeb5a5494ab219664d09f36

                    • C:\Users\Admin\AppData\Local\Temp\1073r.exe

                      MD5

                      89895cf4c88f13e5797aab63dddf1078

                      SHA1

                      1efc175983a17bd6c562fe7b054045d6dcb341e5

                      SHA256

                      8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a

                      SHA512

                      d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

                    • C:\Users\Admin\AppData\Local\Temp\1073r.exe

                      MD5

                      89895cf4c88f13e5797aab63dddf1078

                      SHA1

                      1efc175983a17bd6c562fe7b054045d6dcb341e5

                      SHA256

                      8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a

                      SHA512

                      d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

                    • C:\Users\Admin\AppData\Local\Temp\IEwuQeDAslan.exe

                      MD5

                      89895cf4c88f13e5797aab63dddf1078

                      SHA1

                      1efc175983a17bd6c562fe7b054045d6dcb341e5

                      SHA256

                      8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a

                      SHA512

                      d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

                    • C:\Users\Admin\AppData\Local\Temp\IEwuQeDAslan.exe

                      MD5

                      89895cf4c88f13e5797aab63dddf1078

                      SHA1

                      1efc175983a17bd6c562fe7b054045d6dcb341e5

                      SHA256

                      8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a

                      SHA512

                      d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

                    • C:\Users\Admin\AppData\Local\Temp\fvOOUhBaClan.exe

                      MD5

                      89895cf4c88f13e5797aab63dddf1078

                      SHA1

                      1efc175983a17bd6c562fe7b054045d6dcb341e5

                      SHA256

                      8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a

                      SHA512

                      d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

                    • C:\Users\Admin\AppData\Local\Temp\fvOOUhBaClan.exe

                      MD5

                      89895cf4c88f13e5797aab63dddf1078

                      SHA1

                      1efc175983a17bd6c562fe7b054045d6dcb341e5

                      SHA256

                      8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a

                      SHA512

                      d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

                    • C:\Users\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\odt\RyukReadMe.html

                      MD5

                      e814cd9c600ee9b146ded05082ee80e8

                      SHA1

                      2f9a7b8da2bd57a2bb812374c8e7eee975583214

                      SHA256

                      b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b

                      SHA512

                      c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

                    • C:\odt\config.xml.RYK

                      MD5

                      1818d133950e5b88d0bdc305ffea1fd4

                      SHA1

                      8465c0e965ac5bef28d73fba3a25afcd54ff5ea7

                      SHA256

                      a4792dd75b3abcfd38b8d6c5e736c32889189a2c9271d9e1e53a9c4c060a90e5

                      SHA512

                      1a4010b8be3a4f91fb40b1b22c170e968c782f255f571fe4abf461acf1a9dce22db0d05c5e877a73adcd594ac04866115a0248df5d60a8baf577bd6619e12431

                    • memory/372-115-0x0000000000000000-mapping.dmp

                    • memory/1032-118-0x0000000000000000-mapping.dmp

                    • memory/1232-121-0x0000000000000000-mapping.dmp

                    • memory/1340-140-0x0000000000000000-mapping.dmp

                    • memory/1436-125-0x0000000000000000-mapping.dmp

                    • memory/2336-137-0x0000000000000000-mapping.dmp

                    • memory/2608-139-0x0000000000000000-mapping.dmp

                    • memory/4176-135-0x0000000000000000-mapping.dmp

                    • memory/4644-136-0x0000000000000000-mapping.dmp

                    • memory/4688-124-0x0000000000000000-mapping.dmp

                    • memory/4768-155-0x0000000000000000-mapping.dmp

                    • memory/4836-142-0x0000000000000000-mapping.dmp

                    • memory/4900-141-0x0000000000000000-mapping.dmp

                    • memory/4920-134-0x0000000000000000-mapping.dmp

                    • memory/8732-193-0x0000000000000000-mapping.dmp

                    • memory/8740-194-0x0000000000000000-mapping.dmp

                    • memory/9016-195-0x0000000000000000-mapping.dmp

                    • memory/9028-196-0x0000000000000000-mapping.dmp