Analysis

  • max time kernel
    166s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    20-02-2022 04:32

General

  • Target

    9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe

  • Size

    202KB

  • MD5

    547f87db796b69e28453b142e9da9ed4

  • SHA1

    019faca2d3d5675a6d6bbcd00629c8fe33d54705

  • SHA256

    9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd

  • SHA512

    682e6cb1d510119c9897ed25a62bc436be21e3f00deccf952897b234e36444c2ebd85ef906086dfc432a491d4f3c9a63d1ab2c0e23626ac71a863521109d1eb5

Score
10/10

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Your network has been penetrated. All files on each network host have been encrypted with a strong algorithm. Backups were encrypted too. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. Only we have exclusive decryption software, suitable for your situation. More than a year ago, world experts recognized the impossibility of such encryption deciphering by any means except the original decoder. No decryption software is available in the public. Antivirus companies, researchers, IT specialists, and any other persons cannot help you to decipher the data. Decryption takes from ten minutes up to several hours. It is performed automatically and doesn't require from you any actions except decoder launching. DO NOT RESET OR SHUTDOWN SYSTEM � files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions. Send 2 different random files and you will get them back decrypted. It can be from different computers on your network to be sure that one key decrypts everything. We will unlock 2 files for free. To get info (decrypt your files) contact us a [email protected] or [email protected] You will receive btc address for payment in the reply letter Ryuk No system is safe

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1332
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
      • Drops desktop.ini file(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1256
      • C:\Windows\System32\net.exe
        "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1696
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop "audioendpointbuilder" /y
          3⤵
            PID:2456
        • C:\Windows\System32\net.exe
          "C:\Windows\System32\net.exe" stop "samss" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2524
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop "samss" /y
            3⤵
              PID:2856
          • C:\Windows\System32\net.exe
            "C:\Windows\System32\net.exe" stop "samss" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:30624
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop "samss" /y
              3⤵
                PID:30648
            • C:\Windows\System32\net.exe
              "C:\Windows\System32\net.exe" stop "samss" /y
              2⤵
                PID:30620
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop "samss" /y
                  3⤵
                    PID:30624
              • C:\Users\Admin\AppData\Local\Temp\9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
                "C:\Users\Admin\AppData\Local\Temp\9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe"
                1⤵
                • Drops desktop.ini file(s)
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1724
                • C:\Windows\System32\net.exe
                  "C:\Windows\System32\net.exe" stop "spooler" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1300
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop "spooler" /y
                    3⤵
                      PID:1832
                  • C:\Windows\System32\net.exe
                    "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1252
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                      3⤵
                        PID:764
                    • C:\Windows\System32\net.exe
                      "C:\Windows\System32\net.exe" stop "samss" /y
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1148
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 stop "samss" /y
                        3⤵
                          PID:820
                      • C:\Windows\System32\net.exe
                        "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1464
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                          3⤵
                            PID:2516
                        • C:\Windows\System32\net.exe
                          "C:\Windows\System32\net.exe" stop "samss" /y
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2780
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 stop "samss" /y
                            3⤵
                              PID:3056
                          • C:\Windows\System32\net.exe
                            "C:\Windows\System32\net.exe" stop "samss" /y
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:30584
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 stop "samss" /y
                              3⤵
                                PID:30608
                            • C:\Windows\System32\net.exe
                              "C:\Windows\System32\net.exe" stop "samss" /y
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:30660
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 stop "samss" /y
                                3⤵
                                  PID:30684
                              • C:\Windows\System32\net.exe
                                "C:\Windows\System32\net.exe" stop "samss" /y
                                2⤵
                                  PID:30592
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 stop "samss" /y
                                    3⤵
                                      PID:23132
                                  • C:\Windows\System32\net.exe
                                    "C:\Windows\System32\net.exe" stop "samss" /y
                                    2⤵
                                      PID:30656
                                      • C:\Windows\system32\net1.exe
                                        C:\Windows\system32\net1 stop "samss" /y
                                        3⤵
                                          PID:30660
                                    • C:\Windows\System32\rundll32.exe
                                      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
                                      1⤵
                                        PID:1040

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\ACECache10.lst

                                        MD5

                                        9de933d7466a488c3049c86c2fcd804c

                                        SHA1

                                        a3adf5fcb1167af00be9f8d2564bc0d6b6efa27d

                                        SHA256

                                        c120926ae917b708da11e3657829ae09da2e91c4de0cb31a3a6aa3d131d9026d

                                        SHA512

                                        c4d156841c646e465c0981cf499d74b8b25fee63d0f341ed22d2d065289797b82045949d9a78c270e176ee8b9a13d563e4bc12710cd42acaaeaa0ca1da785068

                                      • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK

                                        MD5

                                        e527fa5229fc226e9dc3e4337495c08c

                                        SHA1

                                        c344905bb5ef529f4abf7b9682e05e7a5f0960fb

                                        SHA256

                                        65f326e7f23a3a9967f7bbe30bb1f948096379ad7e9d2864397a1633b9e530c2

                                        SHA512

                                        7b4bc7827c59248fbe062ba22025adb1740d93e0485b84397274fb885712fcea517c111bc731f44ccdbc0f635c48b6694e5d26f9dd09a3d7c090818fcde505df

                                      • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Adobe\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst.RYK

                                        MD5

                                        29156094f85be8f29e3e012374a579bf

                                        SHA1

                                        9c63fa7475514c271b12da2687fb4b998883283a

                                        SHA256

                                        86113b44c86908ac39f1e40066bd52ac3a4fe85788993f1f1d3e6d68118236a9

                                        SHA512

                                        fea25beb267a9aa631f3a1d0b9ebc818893db312bcdd7fc53fc2c1fefb4bbdc242ae98f4cf8d37df1d676924df33df52f0f4b200fa5d18db87235c71723afa0a

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Adobe\Acrobat\9.0\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Adobe\Color\Profiles\wsRGB.icc

                                        MD5

                                        b4ce76f0bbff96cdf2d7f0b7e2582a1e

                                        SHA1

                                        ee6a58e16ee0e35683e495d58f336df0c362646b

                                        SHA256

                                        2f76e1c2f2fbfbe8aac25867d4b090d3656d94f5886b1a4536ff3f8f84026868

                                        SHA512

                                        15ff3ec96ec2f64612a3ad8abb7ec8ec8b1752bb7ccc289ff41cd1db50b2133748809fe3cabcd273dbcd037842364d79eb94b284b23917558532f53b0c1d867d

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ASPNETSetup_00000.log

                                        MD5

                                        6ecd7b0363210a82783e224beec2fb09

                                        SHA1

                                        64645dee21afc726f8fb25265ea6998b15a029e9

                                        SHA256

                                        d96d4217e7366148c93d6088b3f6ff1bfa713b9a13e7cdf0aa9850ebeba6bea8

                                        SHA512

                                        e4fdd4d09cb9938237452ca6b195dbbe4e5468206916819f0031244b5eccbc62d7e0c6c5e37aefb75e892036a4809540bd5e142ad2fff602961b58e137e67558

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ASPNETSetup_00001.log

                                        MD5

                                        1dc2c6f06f3506ffef5dd68428a35153

                                        SHA1

                                        466433bc9b35214a06f4bc5e3f9ee0770ae7d7b1

                                        SHA256

                                        e2bf06d6e3296def325bbff4ecfb4b2f680d63733a16fc60fc0f8a70791661b7

                                        SHA512

                                        12603311300fe8c19e062079c48cba845d04c6898c155b5d06466845436bb61eeb15b083424221597df7621fbd88d86c6087d50353b42bf9e8769a5dbf99f2c0

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Low\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WPDNSE\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\chrome_installer.log

                                        MD5

                                        abb3ad0bb65652677feb6e7ad1660a67

                                        SHA1

                                        78d29d8417c744a5e54d40f3b4e317d3eae1acda

                                        SHA256

                                        8949fc07b7ab97082570ff9b51ba1c155f9a51f96548dee9761e711ad8b9249c

                                        SHA512

                                        798f030ab097b2a02980090c5b0d1f2f8e3141f46f6d1e1fdf21add63fb89ab49c74409868d037ae1b1426e2d886a80727eca6dc1e53a705e40bc2563968e3a8

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dd_SetupUtility.txt

                                        MD5

                                        db0f284a53af52397a5e19b7d031623c

                                        SHA1

                                        408285f0578b41531d1f31a4f83a90c390bb29df

                                        SHA256

                                        6cba0f54f7c29c7a649537c0e9798c5c9190d64ccb95ad93f1e05e88f7aec16c

                                        SHA512

                                        8afe55fa89d2cd7c516926ec9848affbbaeefac0af5b86297dfc01d5d6f4eff2d84ed74f46b4ad5b771f9e18bb034671c37326f3f3ec02e1d08ec5b3e052921b

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dd_vcredistUI37AD.txt

                                        MD5

                                        2054e50972686cbcd61d43531ec394be

                                        SHA1

                                        400ddea8064657971d4fb136a5bb642325fd0831

                                        SHA256

                                        58076f3a9630ebb58fb8b4000802cf583071fe775c33942e480757e049d4ba80

                                        SHA512

                                        7d2a018bf4fb855025f0ef0a0fb2bf5de640db95dc00e1a13cbf6320d934b5abd1ab2379655e426fa5442375bf9dca7914e39e3e5d417849fb527c9d573d5ba0

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\java_install.log

                                        MD5

                                        39e51bf5c93ad526d6ea3f68b1e07892

                                        SHA1

                                        85c4a6e331681f0d77f63e2e24831dd3e1bf61c8

                                        SHA256

                                        4f603dcfc65be716e7b858b605c9fdf757d3f90c55fa068f6ef3a8c20210e54e

                                        SHA512

                                        3356ce9e5e00b86c5ab0028fc96a89f0e77d7063e62a1ac4b3fe32ddd6a70c803d47a7b20ec868289376d1d3c0d6e7915db34924f4df442a5b1d2f53eb222933

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\java_install_reg.log

                                        MD5

                                        0eb1a6016d9ef2ad47b99cc55aee77f1

                                        SHA1

                                        d00820439d248d0a964860ff02b845048ff78121

                                        SHA256

                                        8fa088d0d3d10d9ba6eb6025db7c5eb988811747d68994add8abccd7313156df

                                        SHA512

                                        c0631b9442a1b6a2286eedf2e38249456626f374555eb35c5bd965b26b99e89665f55568bc898e42e7ddade1458470df950e07c019007765112b1ec9920dd2ba

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wmsetup.log.RYK

                                        MD5

                                        8324c9afffcd13b147d37f1e350cd981

                                        SHA1

                                        da88f97a58dc923e3d84ae4a6f6e8db1421e4fe0

                                        SHA256

                                        3c4b0da4d8ebac27f57b70ba7213ae5cb070e3e842b8050db2da53d4a35e1995

                                        SHA512

                                        468f18138f8193f5272823a1e4b7cec4d226f0ab49836c074ca6b2f4a20f7394616a5234bf6ed9d4c16a8a39603b82e5b6240433db8d1ae4ba2969d7e49c2502

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini.RYK

                                        MD5

                                        3b14c9a52a38e60c14709d188495fc8e

                                        SHA1

                                        1e6ff593ada1df7734337cc70faef65d2b9e740b

                                        SHA256

                                        5bac855895c495ed5a324b480e5150a144d32cf41c1f036b36ed0c44699026c2

                                        SHA512

                                        d29f0b72e89df28e21adf4ed49edaca9c180874975febebde90be02bf148330fbb33a2ec8cb3fc27a8e4668226aae7df8ea045a4cd25ff81dbe91da534e9c7b4

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\K819CMRP\desktop.ini

                                        MD5

                                        a526a058cd0a156161f3da2e0efc59b9

                                        SHA1

                                        2e8baead21c9bbc0c60276b4ba5fb75be9f1336e

                                        SHA256

                                        3b483db24e3b4c8b95f883774215b9b5a5bed9cd918cde2ba6d3726bd0bb2b9e

                                        SHA512

                                        30b15fff4da19f8433b9e7d8cf788fe51f4b460d9b013d334365474db3e4428afea659cbb2f6c408001e1ebb084f1f39775f73206e352daf2d47fcbba76edfc3

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\NK9YD4KU\desktop.ini

                                        MD5

                                        eab9b6a7f7236088235d76c40766e066

                                        SHA1

                                        763fc3437d21f01d10a139f4e26b14b003f2a1d1

                                        SHA256

                                        ae8f4a1cfd471d075239e800c2bf6db848d46768821afb2d6ffed7691fc82b59

                                        SHA512

                                        ecbfd0ebaaa5ed2b115019e6c2d432b9c5b033836508950d54ba1316cc3da716097730c65731f96b74b5597970ad1090e07c1bd9acc0afe0c5d3a335ffdc81cc

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\QDAZQ7UR\desktop.ini

                                        MD5

                                        6093b2fd19258f5b2c2eb47450068abd

                                        SHA1

                                        624bf3e275dbb923b972fe96fd675e935ec71c6b

                                        SHA256

                                        4335dfdd615e152a079e8433db5bb366d5daedaab59c7a37c43446148a7860f9

                                        SHA512

                                        e9068eb28c93d7b646abb5db901d8c92fba8b3a66cc78dc18c67d2ed1ca3ec52289517b8b5a5fbbb4cc02427b47325dee31159311696681b7002891adcae1805

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\S3IV548V\desktop.ini

                                        MD5

                                        b27eee601e2eabe12a03486ff908adf8

                                        SHA1

                                        10f1d2ccbecdc81acab45a6b24686a2fa8949ae1

                                        SHA256

                                        0266022bd04cb2a3d0d78f545d17ca0578324be894c1105a0cc713b50945075e

                                        SHA512

                                        e73137a2e773b4bcd425d18dbc5f68cde254bbe198e9bf93f691deb987292f41f75a2e05b6cf5244ccd7940a70d998430d1a7f2eaeae15da387aaaf1d0ed32c6

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms

                                        MD5

                                        2cf42bf7a5f9a969149dc7f32e5d19f8

                                        SHA1

                                        09e05110b89d77aaa4d375d78bd3b5cc140cb461

                                        SHA256

                                        f18fb235a9662ab8640b523777bde86eae80a7c31dfe1379615c404ba738caad

                                        SHA512

                                        4948c7fca5be17de2f5faceedfabb810025286d5c23cc3d7a41a5436a98532f375a8057759570b397481873d1a55fef2688a9ae668f032f842519bf5c059f65e

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\User\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\PlayReady\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.htm

                                        MD5

                                        d138fd89fe0697725d131b6acc32794e

                                        SHA1

                                        c58194774628573ed3cfdcda6fde6db4d76d4321

                                        SHA256

                                        663fc8b320cc4c7de25bb6efd5284b3ba08ad7d9af835bcd599fc2bfedf4eb3b

                                        SHA512

                                        b329fbbffb37d07d02cdb04e6616907fb399b06ef40bcec001762c85c9bb356aa3833b2e21ad69130ea3d99953891ea4cbcf1320b5afe42603b9c48ed1a11414

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Memo.emf

                                        MD5

                                        44701cf0be243cc3f2eaa72f2730a6d0

                                        SHA1

                                        b8c78a2b8484042f7dcd04a3661b477080b2ed61

                                        SHA256

                                        3af240955a8144980da71996f100cb9a5ddd3133d9a125c6a0704776759b666b

                                        SHA512

                                        e6403537ac068c35818771fbffa64c04150354f9c671b3bc7c6c79bfe8ba4ad5c0586dfcbadb6ecb64e4d02a6732790de24aa33923c8d462c00d98f16f3cfbee

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Music.emf

                                        MD5

                                        055d8c184d50f1825c65a66b65df7930

                                        SHA1

                                        f8b00ec9f0bb91bc28de4483163d1c5664cea4fe

                                        SHA256

                                        3aeccd525aece3b66cfca04a22c2641d5c9b5c628f4f5312e03377aaa5537b0c

                                        SHA512

                                        5feab88ea5f563de7557ae4712d38067e2d1525fafdeb34ca72bd69894a5c30bbc7dd08fb11b0e882aecf0d55131742c8adda4f0d230a39a7e7d9dc8be4a0bca

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.htm

                                        MD5

                                        a06dc95ecce2d17b0b9f0e07eae9265e

                                        SHA1

                                        93db986337cbcf90c3e58b5be8b0cf4b6fde83ad

                                        SHA256

                                        7c95e19ddab882fd0d1ea4efbeead7fab70a35b500d6a733c354777800726956

                                        SHA512

                                        078a85f1c1ddf8191b9545b61086a5845dc12f214159708f89541b8a399403bb55a64755cfd787d79558543ac28a73ab2d991d3ed8da58d5510951d549e65b4d

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.jpg

                                        MD5

                                        b904627ca6b81a4025874183cf50c1f3

                                        SHA1

                                        64f517ac4763d4f6dc64e1a13d59e52f67831cdb

                                        SHA256

                                        99854d5fd50498cbccbcbc21d63a38dee4d7dfc4cbf6dcc17cb16fbeb80271e8

                                        SHA512

                                        51b37baad7816a5346c0d4c840bebb1879476d2b450c90c0f9dde9c6d5ace5b372d9d8d833592791f9e27998649682ca44d754388bb70c18a6d9c7481715025a

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Stars.htm

                                        MD5

                                        56c0437e09ef79bfc957e190b5d41a9a

                                        SHA1

                                        1f31fbc80508dfaa6e756f2536a0d06745c896db

                                        SHA256

                                        0792e731080a84b38a644ef30a092c8fdbf71f2428e628c714f15107ac36cc59

                                        SHA512

                                        e54c04f68c5d61e912f57f2982cd3e1e9ac06606d24ddd5b9291841f4fe80943db1f94edfcb1a92badbcbd3a7aa35897d2ac10b179e5ba351b3ab19747eec068

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Stars.jpg

                                        MD5

                                        b537e833da182501caad57fb8b6e5db9

                                        SHA1

                                        654b93a778e562fb6248eb12e58b1f0b5f910f7b

                                        SHA256

                                        8630347af96ce57d73ad650fdb0deb410e60b6b482c7f98e7a176cebf94f25ca

                                        SHA512

                                        779005b5cc8bcbd88114cb1188a392f776cce3cb3c195c41bf2dc66583d6094cd42c65f9b07915955cdeaa31bb8feb39e2d170b8d1b36adf8bb9351fec1af803

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Tiki.gif

                                        MD5

                                        03e605bd12babc181398e43c959d44f5

                                        SHA1

                                        a77fcdf7f9ae8f6c19d9cfec96127fcd133d90e8

                                        SHA256

                                        1d16e2e0594cbfdc6dfe026c00206ce1571fe6eff5bc021afac9d6abf77cf611

                                        SHA512

                                        f09aeb64419c5c3fe3cb1e3c62ee779e8d8bcd2b9009e23219cf50150dd2e1a70cef5558907f4ad248608a3c03be746f8e970abfb8aace792539c0077f2370be

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WebCache\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\Local\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\AppData\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\Admin\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\Documents and Settings\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_bc8e1036-7fb3-448e-8ad9-a824b1a03b8e

                                        MD5

                                        93a5aadeec082ffc1bca5aa27af70f52

                                        SHA1

                                        47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

                                        SHA256

                                        a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

                                        SHA512

                                        df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

                                      • C:\RyukReadMe.txt

                                        MD5

                                        ce8ea65435944d002b38721d593435fc

                                        SHA1

                                        005ca1257ae15a487effd424968cc89817bd458f

                                        SHA256

                                        ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d

                                        SHA512

                                        6f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855

                                      • memory/1256-54-0x000000013F9B0000-0x000000013FD46000-memory.dmp

                                        Filesize

                                        3.6MB

                                      • memory/1256-56-0x000000013F9B0000-0x000000013FD46000-memory.dmp

                                        Filesize

                                        3.6MB

                                      • memory/1332-58-0x000000013F9B0000-0x000000013FD46000-memory.dmp

                                        Filesize

                                        3.6MB

                                      • memory/1724-55-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

                                        Filesize

                                        8KB