Analysis

  • max time kernel
    155s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    20-02-2022 05:25

General

  • Target

    7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe

  • Size

    126KB

  • MD5

    fca20e17ce8c0c3f3c78d82c953472ed

  • SHA1

    c8ecc9b34184e7e1c15b4ed49fb838e7882dbfc6

  • SHA256

    7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20

  • SHA512

    5a38ab6f0401c57e0ab1a0f889fe4db8b3fbeda0abbbb87d21da870de604615446a83f6b156ecb36d9101072d429ce7589439916404bc2e76b751847b8947152

Score
10/10

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation. More than a year ago, world experts recognized the impossibility of deciphering by any means except the original decoder. No decryption software is available in the public. Antiviruse companies, researchers, IT specialists, and no other persons cant help you encrypt the data. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions.Send 2 different random files and you will get it decrypted. It can be from different computers on your network to be sure that one key decrypts everything. 2 files we unlock for free To get info (decrypt your files) contact us at [email protected] or [email protected] You will receive btc address for payment in the reply letter Ryuk No system is safe

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Drops desktop.ini file(s) 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:1172
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1404
    • C:\Users\Admin\AppData\Local\Temp\7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe
      "C:\Users\Admin\AppData\Local\Temp\7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe"
      2⤵
      • Drops desktop.ini file(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1624
  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1308

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst.RYK

      MD5

      c0c959abbda4c1f894aa188265719b54

      SHA1

      5b2e6618078ef56dc215372490c4093b7e65de65

      SHA256

      7719ce0fd78bad146fb5b9ecc980040c39581c835c9da1b44c9b92a3cdd8285f

      SHA512

      6dda8707e44960a07e38bd1eff94b0d7c49519104b552108e77e886b8b3a0d0a7c9e4bcf62483533ff895f32043e460ee56e3dd6fb45ed19bd9d0b1030be997b

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\ACECache10.lst.RYK

      MD5

      7dde3b01ad9d34d62e810c043cfa7511

      SHA1

      896539dd6fb87bd785213aad82a7a0913c62c357

      SHA256

      41b0507f6e3172cd01eda48fdf7728117a7ae990dfd499d072c8f62515206386

      SHA512

      29b35bd4574e3bddadf74026215e81d73e3213e2f055b163bacf82c72321f08e018974695b59bf27ebf722595782ba330b9fa3d062d7097c7d04afaed160b9ad

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.RYK

      MD5

      d5027c3a93f937eb3d08aec6f656dff4

      SHA1

      06f773d5654c2602fd521d825b4e2ff60106d26b

      SHA256

      f84f11524d636c0ca559e966d9319981d9b30baffeeab910f4a334d471a3361b

      SHA512

      2bbf5ebdaf9b694c43f1eab40d40e159e01a0d61be8300c8f996d7d4bda86f2cc0333053bbe6b067c7ba4035f7fb59b64677202df101e186a61a330014808e1e

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK

      MD5

      397739b758efc6d812e59b653febc535

      SHA1

      b4e57a99f587d7734ecbb1f79b602f36c47e30ca

      SHA256

      9bb9f5d63c2fb6703d7bcc28b39875751c9ca9c2a41c9f38d148a942af7a0e75

      SHA512

      1ddaafa075a5fe7907dc430d8352d98debb7e0fec69240570415260e28b7e1a02bf854a5fe33aea6ed607ce771ce088b2f10e8b3df24f1f3a06c70acf63cd892

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini.RYK

      MD5

      4fed66a8e8d991fbb51be5cbbee5cdca

      SHA1

      a151420d02e4b7d4fb914f63ad1338d5ce33b954

      SHA256

      9b489d9296f8b3498159025d9c01652c2e006a8d69ecdfbe2ba2ab5b62d33d83

      SHA512

      284bc89ca6887df839804d073d82cef02e18a58757e8a254992ef6970f5b5ac6b1041c3715c012e656b0af7d4c0e0b10806637ae97b16bc7902ef739214cd019

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db.RYK

      MD5

      0a3577553d5a5121d89d5a4c8e48468e

      SHA1

      83380b8baba793a09a2c9d989167c422b170ed45

      SHA256

      68fd1478cd1ae73afbf3d07a8d5f191c5e2696de303cdd5858fcefd96fb7c691

      SHA512

      2edbb0ae5dccbc6e7d68c8da970218117683f507c506c6abcf375d4a3c7887952e081013d34fe060e6a9b2a9301b826ca1a92ec55efc36df520018c1cf90f257

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Admin.bmp.RYK

      MD5

      fdaba9336a24311f9bfd88896d59a67a

      SHA1

      d2780f8497cb9e95de669bcc66b72a27cd1066c1

      SHA256

      7e954de21aad871d788749fcb44ad0eface08a0af6180f8c03193106e7762feb

      SHA512

      f2e857308f3a08b5b7213a50b03e01e6c09785b8f49b1a9ad0e48f7d3df3def056208b18bf0a36ac3e4d120cb8c29fb6ed57da18a080b39e4a1863e63409a8eb

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\JavaDeployReg.log.RYK

      MD5

      090e8eea380a46ee8e89aaa8f0150b6f

      SHA1

      be6c9ddc79fb0ca62eab3efe8583ed5715767ec6

      SHA256

      66e2456ec7a117a50cb3bd3d026bec2dfea696161a107f2f0dd09852c9d81118

      SHA512

      e4dd205411e73b2f72ed1fc8a12507f9434fd5d25144015288cdae1a41739af075bc171832400a3c2d61cd0ec72da945270b1190db4396068593188435d2f3c5

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Low\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RGIFCB7.tmp-tmp.RYK

      MD5

      4715ac09541df12242f75966c249d034

      SHA1

      67b97401136821ba7c1a0493538d1307f4bfbe81

      SHA256

      d4e24e9d168d998165565363adcb283b39d9044cb3942a2f1a9061890853c633

      SHA512

      aab8f4b8360a2f4ee90722315eeb80621f03e07cfed6bfbc5945cf3fe61c067d76f9ffee5859b923fda3ae1e009d11eb2ed749aacc88047abdf82fcaea023da2

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RGIFCB7.tmp.RYK

      MD5

      a4e279ec66b078deb2ac135da8452131

      SHA1

      49ebef0d1de55ade843b7e16124396be3ce5ffa8

      SHA256

      11582771a47af1735b616365e931dcba04646835f129bcf8046f2690ae97ad14

      SHA512

      48046cf3b23ec61ad8eb892b5f7061f5ebd8416cf8967bd4ca2d791dd15d4a8eb16f1d24a3c671bd448e7b45ef87b84b46fcaf9cb3cb9f231639edd7f64f2537

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WPDNSE\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\java_install.log.RYK

      MD5

      f9f305504699e1e9858ffb4ef096df96

      SHA1

      44cebdf346ee448309155418538df014f17b1729

      SHA256

      a8775315a29e97b914160f5438634b58644ee940164529b2d4c156222d2ec6d9

      SHA512

      de4ebd32860542f2a2193dd93c71d11a939da6ea9b16d005061c54797903bdb4152886936055f16655f11f54386142bc78de295a4bb783a1140dc87e5e564419

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\jusched.log.RYK

      MD5

      4d874cc9ff8ea1440f57de0d9a3c8d59

      SHA1

      d001dfba9d61ed3f9b0a1b06fd32dd705ceb8026

      SHA256

      5352a5bd8d9f9852384daa616282941b1a12afe089e044a95f0543fe50515b11

      SHA512

      b30ad9a25e6b91314bba04559802216c7e64c4aa7e55050a729e389890a6af8ff50ca309da2ac45d0ae4a8d953b0f39f43d20c5e58427097f42daf659fb8c919

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wmsetup.log.RYK

      MD5

      9e194d7538cb1cc2bac830076ebb2ca2

      SHA1

      e929e27ba09acabddf43a1f24b0e864652228f8b

      SHA256

      7455f42e072bc17e05d416113b9e9ebc304cc5e4df5cc6635d57bc006cb0fddb

      SHA512

      84e56969d31a6e62bded104ccb7af34c4daa46c3062084226fba9d5fea10cce37c996ef836a2c0c813eaa6790f58919d58ec9f144814885addb0fd66b9ffdf64

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini.RYK

      MD5

      0815068fd791e20c971d7275615ebebc

      SHA1

      3784ee7e00f0fbf2892458b910478a4adfd43048

      SHA256

      9180f41b3fa2c8421dcef3262ecbcb6852a216427ef76075230e5185c671433b

      SHA512

      e11a60e38a8c67599194bbaa61fa711e7eb917898e048b24d9bf158035d81f2d0d243eb26bd3d7a1c5192a05552e5728120fb0a2f064b0b317f0ef71fb05568c

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini

      MD5

      a4b1de3b615b85286e306f5a9a5f4a8e

      SHA1

      919c6a354546d73d2b677e0f50cdb281bb21d9f4

      SHA256

      c204eda41a181ec47b0888c901702e6059eec8d6cdcc5e7dd2211fdeb8969617

      SHA512

      081a2b6f544d02bda388df8fc0560c17a28416b4ce41c42c1aa6a994d9cf4603e4716f8d72e181678e47179b37980c3f1087ffcf927ae55a9b6133a94923673b

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini

      MD5

      22e4799153a8cf0cafb3fbdecb8c8cd3

      SHA1

      75d4d32419fb19e2199f53ceaceb354696f62fc2

      SHA256

      097e19c37da4815bb9210f7f9e6e893b6aff7d98bf395134f247aa32b6bda979

      SHA512

      797cbbda58f7feb068e96ec1062ccc85b91b7171e954f0b9afc18065a592c3ccdf162eb1fa69dd7843155aaee9a8cb4d97e482b45d7cc8e20df6c762c837e789

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini

      MD5

      67d962550e8841f4b3433162387e2307

      SHA1

      fb3e95e324685936a8942b8c421eb0488c3d7820

      SHA256

      9ec0ee6b91037c5f05f3253c29b31027cdf1b0edb4b4052458e300470789cc49

      SHA512

      86fffe96f3036537acf4be99bea4b586e37f55decba4e4141bbdf077eebfc24a162bef6cc407a54d6638afeafead694b7cdded275acfa23860f02e226295cbf1

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini

      MD5

      4210cbd43bf79720ccf72ab8c4e5a0a6

      SHA1

      c54212a81c6ea7c82366a64efbbbfdcae8d0ca8d

      SHA256

      69bf4e408a005f939aee1bd82a0c5d82698dfcb64a10f2d7a60b05d77c5fdb64

      SHA512

      aa633035d3e6dfa0b0bc7b4888f5fdf78bf2aafee2871384a9bf5e6eeb540cab2da483bcd61873bbe6a5fe005d82b2d9c2d7dfefc1538df7e0c7ca91bdf4728d

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK

      MD5

      fd29b5b08232315bb957b5c66e2d5de5

      SHA1

      0ce62efaa1a43e452ee9506e8e61138167518e2f

      SHA256

      083b6f573a604b65187d67e0c20c33b01c6eb977a11b2c958ef1321c355cae1c

      SHA512

      03e2e59cfafd00ab5eef8a875398f9dddda0ef140899f1b51fbea9f327d64dea6d289e53984af629ff5bccd7593a64781ddd1e930816072fbb6f32ba8d093e1e

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.bak.RYK

      MD5

      13fdf2f1b4dc3f250d67b0a3572d7797

      SHA1

      c48e4d9886c34894fa71d5a22fc527afc99f1686

      SHA256

      7af0e8c7041007ecaa70fa9fb749147cb33401e282c27866ec048f89fea3b971

      SHA512

      4733a3be886b13b67fd92aebf35a3420721aabb5e82a923dade1da06bbbcaec032f34f5de5b320103b1fef91ce88a4bbfe1c5bc5d5ff0ca8485381d57b75f708

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.RYK

      MD5

      706b3931d7b4eae88e2a88898b97f08d

      SHA1

      f0666594e84e17432f1331c503fdeb0668ed6860

      SHA256

      afce2f42754dd5403367dfcad5cea745c6d772b8973b9e75cf0a44766ec5bec2

      SHA512

      319d57d6024f8965d1008dc7408fa957e8d5fe0834b63b2e1a0d1eb2d217b956bd05f49f267fa4cbd29fa04fdf21d79a4efc34472cbc0277417064ccc79350b4

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\LocalMLS_3.wmdb.RYK

      MD5

      5d0a1850261847f1573da163c49890da

      SHA1

      8982c43daa6fee0acaab5a7a155b4ab32327e1bf

      SHA256

      4aad660cb1cf6db2736456a1c42d386a35b20a5d71493e921137938c0a529512

      SHA512

      649fc0a02f265f8bc95bf2a18162e34487716bb1e49942897d53ea6b2b02f5d8abe4ad204e3bc7e77ae161fcd2f50a1bef7335a5023617f66e439a4f10211216

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\User\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\PlayReady\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.jpg

      MD5

      9d10c0e5349766180365cc760c58ec7a

      SHA1

      580f22083d09b40e1a4ab14f390c9cacfb191045

      SHA256

      5d6c87a3ed169ce7940f8b279ade433c46268f07c12330449e963f6c6079355b

      SHA512

      ed05da7d1202ac3792d629f37a22c89dfe5292bbfc0b925306745fbad9c9729b7f1271611b50193991600d49bdfdbe112e5a23a38b62bab5d57019dd241025f0

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.log.RYK

      MD5

      e34755f91f11adb09f00b77f174c122d

      SHA1

      148fb69df368cc00db235619d78ba0c158f0da3f

      SHA256

      dfadf3234a191e3ec1a9fe0ae6a2163f3bfacd47e44d8e0bc080d02cf311ecbc

      SHA512

      a456d75f6c938935296bdedc74dea7c67df46a8b157fcedae3b3d24d3e7219578457cf6b0bb39463b793f94b1a1173767a2a6d9b4f563d2215abe96c5741081a

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00001.jrs.RYK

      MD5

      8f43443fa9ceafc20c570fd69bdcf8df

      SHA1

      c04838ff38f607304952433195322eccf8ac32a3

      SHA256

      c271ac183a806f3163ca31b57ded99d68dde9ee8e678b6afd54b524a26965485

      SHA512

      22bcf33c67a09c44ea11e60f42509d53951bb3ba1453b4f3e5d29fd2f496f8b61b078ff1937918be574629d5d2fcee7c1f94208c61eabb07f62594558f78ea0c

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\oeold.xml.RYK

      MD5

      e084319fb31f37f9da0103c4b65c984f

      SHA1

      5754d067220e758cc39a4cdec43160fe8d9a806c

      SHA256

      850db200531a6fc0cd743272198425f7491e1ab53db3df12f46d088877df8de1

      SHA512

      a6db67e6b0f3b8bd8f422bf431c95ea362b06793cedf9ad6ffb758c95739e2f325dd95c4e5037492a1b6427ef875e7ce302cb821fcdbdb16ded0eef357a8bcca

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WebCache\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\Local\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\AppData\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\Admin\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\Documents and Settings\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3bd845b8-ce6a-4337-9974-31490196462a

      MD5

      93a5aadeec082ffc1bca5aa27af70f52

      SHA1

      47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

      SHA256

      a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

      SHA512

      df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

    • C:\RyukReadMe.txt

      MD5

      892c3779e403ba2b9deba0670b435e6e

      SHA1

      d46ff9301f175a170a8c33d02064e05c5f944805

      SHA256

      5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

      SHA512

      829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

    • memory/1172-55-0x000000013FFC0000-0x0000000140342000-memory.dmp

      Filesize

      3.5MB

    • memory/1172-57-0x000000013FFC0000-0x0000000140342000-memory.dmp

      Filesize

      3.5MB

    • memory/1308-58-0x000000013FFC0000-0x0000000140342000-memory.dmp

      Filesize

      3.5MB