Analysis
-
max time kernel
166s -
max time network
144s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-02-2022 04:32
Static task
static1
Behavioral task
behavioral1
Sample
9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
Resource
win10v2004-en-20220112
General
-
Target
9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
-
Size
202KB
-
MD5
547f87db796b69e28453b142e9da9ed4
-
SHA1
019faca2d3d5675a6d6bbcd00629c8fe33d54705
-
SHA256
9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd
-
SHA512
682e6cb1d510119c9897ed25a62bc436be21e3f00deccf952897b234e36444c2ebd85ef906086dfc432a491d4f3c9a63d1ab2c0e23626ac71a863521109d1eb5
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Drops desktop.ini file(s) 64 IoCs
Processes:
taskhost.exe9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exedescription ioc process File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\QDAZQ7UR\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\RO7FJFDE\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\Favorites\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Favorites\Links\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\NK9YD4KU\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\S3IV548V\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\RO7FJFDE\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Videos\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Favorites\Links for United States\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\Recent\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T7AS43M2\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\QDAZQ7UR\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T7AS43M2\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Pictures\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\Documents\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Downloads\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\QDAZQ7UR\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\Contacts\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\Links\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\S3IV548V\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T7AS43M2\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T0STXTA8\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Favorites\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\FNOUQX38\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Music\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Saved Games\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\NK9YD4KU\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\RO7FJFDE\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T0STXTA8\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Desktop\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\K819CMRP\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\K819CMRP\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Pictures\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\QDAZQ7UR\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\Desktop\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Videos\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Music\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\Favorites\Links for United States\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\S3IV548V\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\K819CMRP\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\FNOUQX38\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Favorites\Links\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\K819CMRP\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\S3IV548V\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\NK9YD4KU\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\FNOUQX38\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Downloads\desktop.ini 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe File opened for modification C:\Documents and Settings\Admin\Links\desktop.ini taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exetaskhost.exepid process 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe 1256 taskhost.exe 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe 1256 taskhost.exe 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe 1256 taskhost.exe 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exetaskhost.exedescription pid process Token: SeDebugPrivilege 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe Token: SeBackupPrivilege 1256 taskhost.exe Token: SeBackupPrivilege 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exenet.exenet.exenet.exetaskhost.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 1724 wrote to memory of 1256 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe taskhost.exe PID 1724 wrote to memory of 1332 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe Dwm.exe PID 1724 wrote to memory of 1300 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1724 wrote to memory of 1300 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1724 wrote to memory of 1300 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1724 wrote to memory of 1252 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1724 wrote to memory of 1252 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1724 wrote to memory of 1252 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1300 wrote to memory of 1832 1300 net.exe net1.exe PID 1300 wrote to memory of 1832 1300 net.exe net1.exe PID 1300 wrote to memory of 1832 1300 net.exe net1.exe PID 1252 wrote to memory of 764 1252 net.exe net1.exe PID 1252 wrote to memory of 764 1252 net.exe net1.exe PID 1252 wrote to memory of 764 1252 net.exe net1.exe PID 1724 wrote to memory of 1148 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1724 wrote to memory of 1148 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1724 wrote to memory of 1148 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1148 wrote to memory of 820 1148 net.exe net1.exe PID 1148 wrote to memory of 820 1148 net.exe net1.exe PID 1148 wrote to memory of 820 1148 net.exe net1.exe PID 1256 wrote to memory of 1696 1256 taskhost.exe net.exe PID 1256 wrote to memory of 1696 1256 taskhost.exe net.exe PID 1256 wrote to memory of 1696 1256 taskhost.exe net.exe PID 1724 wrote to memory of 1464 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1724 wrote to memory of 1464 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1724 wrote to memory of 1464 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1696 wrote to memory of 2456 1696 net.exe net1.exe PID 1696 wrote to memory of 2456 1696 net.exe net1.exe PID 1696 wrote to memory of 2456 1696 net.exe net1.exe PID 1256 wrote to memory of 2524 1256 taskhost.exe net.exe PID 1256 wrote to memory of 2524 1256 taskhost.exe net.exe PID 1256 wrote to memory of 2524 1256 taskhost.exe net.exe PID 1464 wrote to memory of 2516 1464 net.exe net1.exe PID 1464 wrote to memory of 2516 1464 net.exe net1.exe PID 1464 wrote to memory of 2516 1464 net.exe net1.exe PID 1724 wrote to memory of 2780 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1724 wrote to memory of 2780 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1724 wrote to memory of 2780 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 2524 wrote to memory of 2856 2524 net.exe net1.exe PID 2524 wrote to memory of 2856 2524 net.exe net1.exe PID 2524 wrote to memory of 2856 2524 net.exe net1.exe PID 2780 wrote to memory of 3056 2780 net.exe net1.exe PID 2780 wrote to memory of 3056 2780 net.exe net1.exe PID 2780 wrote to memory of 3056 2780 net.exe net1.exe PID 1724 wrote to memory of 30584 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1724 wrote to memory of 30584 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1724 wrote to memory of 30584 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 30584 wrote to memory of 30608 30584 net.exe net1.exe PID 30584 wrote to memory of 30608 30584 net.exe net1.exe PID 30584 wrote to memory of 30608 30584 net.exe net1.exe PID 1256 wrote to memory of 30624 1256 taskhost.exe net.exe PID 1256 wrote to memory of 30624 1256 taskhost.exe net.exe PID 1256 wrote to memory of 30624 1256 taskhost.exe net.exe PID 30624 wrote to memory of 30648 30624 net.exe net1.exe PID 30624 wrote to memory of 30648 30624 net.exe net1.exe PID 30624 wrote to memory of 30648 30624 net.exe net1.exe PID 1724 wrote to memory of 30660 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1724 wrote to memory of 30660 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1724 wrote to memory of 30660 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 30660 wrote to memory of 30684 30660 net.exe net1.exe PID 30660 wrote to memory of 30684 30660 net.exe net1.exe PID 30660 wrote to memory of 30684 30660 net.exe net1.exe PID 1724 wrote to memory of 30592 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe PID 1724 wrote to memory of 30592 1724 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe net.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1332
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:2456
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:2856
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:30624 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:30648
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:30620
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:30624
-
C:\Users\Admin\AppData\Local\Temp\9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe"C:\Users\Admin\AppData\Local\Temp\9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "spooler" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "spooler" /y3⤵PID:1832
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:764
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:820
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:2516
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3056
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:30584 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:30608
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:30660 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:30684
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:30592
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:23132
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:30656
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:30660
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding1⤵PID:1040
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
MD5
ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
MD5
9de933d7466a488c3049c86c2fcd804c
SHA1a3adf5fcb1167af00be9f8d2564bc0d6b6efa27d
SHA256c120926ae917b708da11e3657829ae09da2e91c4de0cb31a3a6aa3d131d9026d
SHA512c4d156841c646e465c0981cf499d74b8b25fee63d0f341ed22d2d065289797b82045949d9a78c270e176ee8b9a13d563e4bc12710cd42acaaeaa0ca1da785068
-
MD5
ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
MD5
e527fa5229fc226e9dc3e4337495c08c
SHA1c344905bb5ef529f4abf7b9682e05e7a5f0960fb
SHA25665f326e7f23a3a9967f7bbe30bb1f948096379ad7e9d2864397a1633b9e530c2
SHA5127b4bc7827c59248fbe062ba22025adb1740d93e0485b84397274fb885712fcea517c111bc731f44ccdbc0f635c48b6694e5d26f9dd09a3d7c090818fcde505df
-
MD5
ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
MD5
ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst.RYK
MD529156094f85be8f29e3e012374a579bf
SHA19c63fa7475514c271b12da2687fb4b998883283a
SHA25686113b44c86908ac39f1e40066bd52ac3a4fe85788993f1f1d3e6d68118236a9
SHA512fea25beb267a9aa631f3a1d0b9ebc818893db312bcdd7fc53fc2c1fefb4bbdc242ae98f4cf8d37df1d676924df33df52f0f4b200fa5d18db87235c71723afa0a
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Adobe\Acrobat\9.0\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Adobe\Color\Profiles\wsRGB.icc
MD5b4ce76f0bbff96cdf2d7f0b7e2582a1e
SHA1ee6a58e16ee0e35683e495d58f336df0c362646b
SHA2562f76e1c2f2fbfbe8aac25867d4b090d3656d94f5886b1a4536ff3f8f84026868
SHA51215ff3ec96ec2f64612a3ad8abb7ec8ec8b1752bb7ccc289ff41cd1db50b2133748809fe3cabcd273dbcd037842364d79eb94b284b23917558532f53b0c1d867d
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ASPNETSetup_00000.log
MD56ecd7b0363210a82783e224beec2fb09
SHA164645dee21afc726f8fb25265ea6998b15a029e9
SHA256d96d4217e7366148c93d6088b3f6ff1bfa713b9a13e7cdf0aa9850ebeba6bea8
SHA512e4fdd4d09cb9938237452ca6b195dbbe4e5468206916819f0031244b5eccbc62d7e0c6c5e37aefb75e892036a4809540bd5e142ad2fff602961b58e137e67558
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ASPNETSetup_00001.log
MD51dc2c6f06f3506ffef5dd68428a35153
SHA1466433bc9b35214a06f4bc5e3f9ee0770ae7d7b1
SHA256e2bf06d6e3296def325bbff4ecfb4b2f680d63733a16fc60fc0f8a70791661b7
SHA51212603311300fe8c19e062079c48cba845d04c6898c155b5d06466845436bb61eeb15b083424221597df7621fbd88d86c6087d50353b42bf9e8769a5dbf99f2c0
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Low\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WPDNSE\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\chrome_installer.log
MD5abb3ad0bb65652677feb6e7ad1660a67
SHA178d29d8417c744a5e54d40f3b4e317d3eae1acda
SHA2568949fc07b7ab97082570ff9b51ba1c155f9a51f96548dee9761e711ad8b9249c
SHA512798f030ab097b2a02980090c5b0d1f2f8e3141f46f6d1e1fdf21add63fb89ab49c74409868d037ae1b1426e2d886a80727eca6dc1e53a705e40bc2563968e3a8
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dd_SetupUtility.txt
MD5db0f284a53af52397a5e19b7d031623c
SHA1408285f0578b41531d1f31a4f83a90c390bb29df
SHA2566cba0f54f7c29c7a649537c0e9798c5c9190d64ccb95ad93f1e05e88f7aec16c
SHA5128afe55fa89d2cd7c516926ec9848affbbaeefac0af5b86297dfc01d5d6f4eff2d84ed74f46b4ad5b771f9e18bb034671c37326f3f3ec02e1d08ec5b3e052921b
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dd_vcredistUI37AD.txt
MD52054e50972686cbcd61d43531ec394be
SHA1400ddea8064657971d4fb136a5bb642325fd0831
SHA25658076f3a9630ebb58fb8b4000802cf583071fe775c33942e480757e049d4ba80
SHA5127d2a018bf4fb855025f0ef0a0fb2bf5de640db95dc00e1a13cbf6320d934b5abd1ab2379655e426fa5442375bf9dca7914e39e3e5d417849fb527c9d573d5ba0
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\java_install.log
MD539e51bf5c93ad526d6ea3f68b1e07892
SHA185c4a6e331681f0d77f63e2e24831dd3e1bf61c8
SHA2564f603dcfc65be716e7b858b605c9fdf757d3f90c55fa068f6ef3a8c20210e54e
SHA5123356ce9e5e00b86c5ab0028fc96a89f0e77d7063e62a1ac4b3fe32ddd6a70c803d47a7b20ec868289376d1d3c0d6e7915db34924f4df442a5b1d2f53eb222933
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\java_install_reg.log
MD50eb1a6016d9ef2ad47b99cc55aee77f1
SHA1d00820439d248d0a964860ff02b845048ff78121
SHA2568fa088d0d3d10d9ba6eb6025db7c5eb988811747d68994add8abccd7313156df
SHA512c0631b9442a1b6a2286eedf2e38249456626f374555eb35c5bd965b26b99e89665f55568bc898e42e7ddade1458470df950e07c019007765112b1ec9920dd2ba
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wmsetup.log.RYK
MD58324c9afffcd13b147d37f1e350cd981
SHA1da88f97a58dc923e3d84ae4a6f6e8db1421e4fe0
SHA2563c4b0da4d8ebac27f57b70ba7213ae5cb070e3e842b8050db2da53d4a35e1995
SHA512468f18138f8193f5272823a1e4b7cec4d226f0ab49836c074ca6b2f4a20f7394616a5234bf6ed9d4c16a8a39603b82e5b6240433db8d1ae4ba2969d7e49c2502
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini.RYK
MD53b14c9a52a38e60c14709d188495fc8e
SHA11e6ff593ada1df7734337cc70faef65d2b9e740b
SHA2565bac855895c495ed5a324b480e5150a144d32cf41c1f036b36ed0c44699026c2
SHA512d29f0b72e89df28e21adf4ed49edaca9c180874975febebde90be02bf148330fbb33a2ec8cb3fc27a8e4668226aae7df8ea045a4cd25ff81dbe91da534e9c7b4
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\K819CMRP\desktop.ini
MD5a526a058cd0a156161f3da2e0efc59b9
SHA12e8baead21c9bbc0c60276b4ba5fb75be9f1336e
SHA2563b483db24e3b4c8b95f883774215b9b5a5bed9cd918cde2ba6d3726bd0bb2b9e
SHA51230b15fff4da19f8433b9e7d8cf788fe51f4b460d9b013d334365474db3e4428afea659cbb2f6c408001e1ebb084f1f39775f73206e352daf2d47fcbba76edfc3
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\NK9YD4KU\desktop.ini
MD5eab9b6a7f7236088235d76c40766e066
SHA1763fc3437d21f01d10a139f4e26b14b003f2a1d1
SHA256ae8f4a1cfd471d075239e800c2bf6db848d46768821afb2d6ffed7691fc82b59
SHA512ecbfd0ebaaa5ed2b115019e6c2d432b9c5b033836508950d54ba1316cc3da716097730c65731f96b74b5597970ad1090e07c1bd9acc0afe0c5d3a335ffdc81cc
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\QDAZQ7UR\desktop.ini
MD56093b2fd19258f5b2c2eb47450068abd
SHA1624bf3e275dbb923b972fe96fd675e935ec71c6b
SHA2564335dfdd615e152a079e8433db5bb366d5daedaab59c7a37c43446148a7860f9
SHA512e9068eb28c93d7b646abb5db901d8c92fba8b3a66cc78dc18c67d2ed1ca3ec52289517b8b5a5fbbb4cc02427b47325dee31159311696681b7002891adcae1805
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\S3IV548V\desktop.ini
MD5b27eee601e2eabe12a03486ff908adf8
SHA110f1d2ccbecdc81acab45a6b24686a2fa8949ae1
SHA2560266022bd04cb2a3d0d78f545d17ca0578324be894c1105a0cc713b50945075e
SHA512e73137a2e773b4bcd425d18dbc5f68cde254bbe198e9bf93f691deb987292f41f75a2e05b6cf5244ccd7940a70d998430d1a7f2eaeae15da387aaaf1d0ed32c6
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms
MD52cf42bf7a5f9a969149dc7f32e5d19f8
SHA109e05110b89d77aaa4d375d78bd3b5cc140cb461
SHA256f18fb235a9662ab8640b523777bde86eae80a7c31dfe1379615c404ba738caad
SHA5124948c7fca5be17de2f5faceedfabb810025286d5c23cc3d7a41a5436a98532f375a8057759570b397481873d1a55fef2688a9ae668f032f842519bf5c059f65e
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\User\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\PlayReady\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.htm
MD5d138fd89fe0697725d131b6acc32794e
SHA1c58194774628573ed3cfdcda6fde6db4d76d4321
SHA256663fc8b320cc4c7de25bb6efd5284b3ba08ad7d9af835bcd599fc2bfedf4eb3b
SHA512b329fbbffb37d07d02cdb04e6616907fb399b06ef40bcec001762c85c9bb356aa3833b2e21ad69130ea3d99953891ea4cbcf1320b5afe42603b9c48ed1a11414
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Memo.emf
MD544701cf0be243cc3f2eaa72f2730a6d0
SHA1b8c78a2b8484042f7dcd04a3661b477080b2ed61
SHA2563af240955a8144980da71996f100cb9a5ddd3133d9a125c6a0704776759b666b
SHA512e6403537ac068c35818771fbffa64c04150354f9c671b3bc7c6c79bfe8ba4ad5c0586dfcbadb6ecb64e4d02a6732790de24aa33923c8d462c00d98f16f3cfbee
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Music.emf
MD5055d8c184d50f1825c65a66b65df7930
SHA1f8b00ec9f0bb91bc28de4483163d1c5664cea4fe
SHA2563aeccd525aece3b66cfca04a22c2641d5c9b5c628f4f5312e03377aaa5537b0c
SHA5125feab88ea5f563de7557ae4712d38067e2d1525fafdeb34ca72bd69894a5c30bbc7dd08fb11b0e882aecf0d55131742c8adda4f0d230a39a7e7d9dc8be4a0bca
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.htm
MD5a06dc95ecce2d17b0b9f0e07eae9265e
SHA193db986337cbcf90c3e58b5be8b0cf4b6fde83ad
SHA2567c95e19ddab882fd0d1ea4efbeead7fab70a35b500d6a733c354777800726956
SHA512078a85f1c1ddf8191b9545b61086a5845dc12f214159708f89541b8a399403bb55a64755cfd787d79558543ac28a73ab2d991d3ed8da58d5510951d549e65b4d
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.jpg
MD5b904627ca6b81a4025874183cf50c1f3
SHA164f517ac4763d4f6dc64e1a13d59e52f67831cdb
SHA25699854d5fd50498cbccbcbc21d63a38dee4d7dfc4cbf6dcc17cb16fbeb80271e8
SHA51251b37baad7816a5346c0d4c840bebb1879476d2b450c90c0f9dde9c6d5ace5b372d9d8d833592791f9e27998649682ca44d754388bb70c18a6d9c7481715025a
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Stars.htm
MD556c0437e09ef79bfc957e190b5d41a9a
SHA11f31fbc80508dfaa6e756f2536a0d06745c896db
SHA2560792e731080a84b38a644ef30a092c8fdbf71f2428e628c714f15107ac36cc59
SHA512e54c04f68c5d61e912f57f2982cd3e1e9ac06606d24ddd5b9291841f4fe80943db1f94edfcb1a92badbcbd3a7aa35897d2ac10b179e5ba351b3ab19747eec068
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Stars.jpg
MD5b537e833da182501caad57fb8b6e5db9
SHA1654b93a778e562fb6248eb12e58b1f0b5f910f7b
SHA2568630347af96ce57d73ad650fdb0deb410e60b6b482c7f98e7a176cebf94f25ca
SHA512779005b5cc8bcbd88114cb1188a392f776cce3cb3c195c41bf2dc66583d6094cd42c65f9b07915955cdeaa31bb8feb39e2d170b8d1b36adf8bb9351fec1af803
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Tiki.gif
MD503e605bd12babc181398e43c959d44f5
SHA1a77fcdf7f9ae8f6c19d9cfec96127fcd133d90e8
SHA2561d16e2e0594cbfdc6dfe026c00206ce1571fe6eff5bc021afac9d6abf77cf611
SHA512f09aeb64419c5c3fe3cb1e3c62ee779e8d8bcd2b9009e23219cf50150dd2e1a70cef5558907f4ad248608a3c03be746f8e970abfb8aace792539c0077f2370be
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WebCache\RyukReadMe.txt
MD5ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
MD5
ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
MD5
ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
MD5
ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
MD5
ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855
-
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_bc8e1036-7fb3-448e-8ad9-a824b1a03b8e
MD593a5aadeec082ffc1bca5aa27af70f52
SHA147a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45
-
MD5
ce8ea65435944d002b38721d593435fc
SHA1005ca1257ae15a487effd424968cc89817bd458f
SHA256ea83c203dde9f9134c53caab9c51e0b35fcfd8d296413de01bb4a3c32eea6e8d
SHA5126f85318c4f2ee501cc60bd85dfbdfeb5506ca8899c80e039eb6d9c98b85ada4ba325fbc454b6c8ac81dc82ab4b00c42914095226acc52dc16912c087eacf9855