Analysis
-
max time kernel
192s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
20-02-2022 05:25
Static task
static1
Behavioral task
behavioral1
Sample
7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe
Resource
win10v2004-en-20220112
General
-
Target
7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe
-
Size
126KB
-
MD5
fca20e17ce8c0c3f3c78d82c953472ed
-
SHA1
c8ecc9b34184e7e1c15b4ed49fb838e7882dbfc6
-
SHA256
7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20
-
SHA512
5a38ab6f0401c57e0ab1a0f889fe4db8b3fbeda0abbbb87d21da870de604615446a83f6b156ecb36d9101072d429ce7589439916404bc2e76b751847b8947152
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 5072 created 2816 5072 WerFault.exe StartMenuExperienceHost.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
sihost.exedescription ioc process File opened for modification C:\Documents and Settings\Admin\3D Objects\desktop.ini sihost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini sihost.exe -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2912 2712 WerFault.exe DllHost.exe 4508 2816 WerFault.exe StartMenuExperienceHost.exe -
Modifies data under HKEY_USERS 45 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4072" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132899864250629497" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.191388" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe -
Modifies registry class 32 IoCs
Processes:
RuntimeBroker.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3521da4c-35fe-4114- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3521da4c-35fe-4114- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ede06af8-aaf3-4328- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ede06af8-aaf3-4328- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000f67713422626d801bd10e8432626d801bd10e8432626d801fa580d000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000545466362000626639623338316330663664366336383433633665373562313431623239303232633939653565616639626137626434623131623539393833626563323664360000b20009000400efbe54546636545466362e0000000000000000000000000000000000000000000000000018722101620066003900620033003800310063003000660036006400360063003600380034003300630036006500370035006200310034003100620032003900300032003200630039003900650035006500610066003900620061003700620064003400620031003100620035003900390038003300620065006300320036006400360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000000574fd471000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62663962333831633066366436633638343363366537356231343162323930323263393965356561663962613762643462313162353939383362656332366436000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000072696263717568710000000000000000bad9b5dc40371b4eb595e9fc647d27d61f42cd4a9083ec1182d05e446572696abad9b5dc40371b4eb595e9fc647d27d61f42cd4a9083ec1182d05e446572696ace000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003700390030003700310034003400390038002d0031003500340039003400320031003400390031002d0031003600340033003300390037003100330039002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002b5b8d01000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a77eeb16-2469-4dbf- = "\\\\?\\Volume{018D5B2B-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\9e810fd05a1a3d5c2e33734ef12615f09d7c75f5accea787995899040471b715" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3e895748-e3b7-4c04- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a3e7c75c-370f-49e6- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e7b194f4-98a4-4ed7- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3521da4c-35fe-4114- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000005cc4c4412626d801ae89e8412626d801ae89e8412626d80105e204000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000545466362000316431313663613235333032313232653865393436313430373365356433666231383161306566363033346339316134386566346166303035326533326238610000b20009000400efbe54546636545466362e0000000000000000000000000000000000000000000000000019992801310064003100310036006300610032003500330030003200310032003200650038006500390034003600310034003000370033006500350064003300660062003100380031006100300065006600360030003300340063003900310061003400380065006600340061006600300030003500320065003300320062003800610000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000000574fd471000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c31643131366361323533303231323265386539343631343037336535643366623138316130656636303334633931613438656634616630303532653332623861000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000072696263717568710000000000000000bad9b5dc40371b4eb595e9fc647d27d61e42cd4a9083ec1182d05e446572696abad9b5dc40371b4eb595e9fc647d27d61e42cd4a9083ec1182d05e446572696ace000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003700390030003700310034003400390038002d0031003500340039003400320031003400390031002d0031003600340033003300390037003100330039002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002b5b8d01000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ede06af8-aaf3-4328- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ede06af8-aaf3-4328- = "\\\\?\\Volume{018D5B2B-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\bf9b381c0f6d6c6843c6e75b141b29022c99e5eaf9ba7bd4b11b59983bec26d6" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a77eeb16-2469-4dbf- RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3521da4c-35fe-4114- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a77eeb16-2469-4dbf- = 59d4f34a2626d801 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a77eeb16-2469-4dbf- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a77eeb16-2469-4dbf- = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000004c4e3412626d8013fdfc7472626d8013fdfc7472626d801015408000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000545466362000396538313066643035613161336435633265333337333465663132363135663039643763373566356163636561373837393935383939303430343731623731350000b20009000400efbe54546636545466362e00000000000000000000000000000000000000000000000000464a1a01390065003800310030006600640030003500610031006100330064003500630032006500330033003700330034006500660031003200360031003500660030003900640037006300370035006600350061006300630065006100370038003700390039003500380039003900300034003000340037003100620037003100350000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000000574fd471000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c39653831306664303561316133643563326533333733346566313236313566303964376337356635616363656137383739393538393930343034373162373135000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000072696263717568710000000000000000bad9b5dc40371b4eb595e9fc647d27d62042cd4a9083ec1182d05e446572696abad9b5dc40371b4eb595e9fc647d27d62042cd4a9083ec1182d05e446572696ace000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003700390030003700310034003400390038002d0031003500340039003400320031003400390031002d0031003600340033003300390037003100330039002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002b5b8d01000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ede06af8-aaf3-4328- = d9c745492626d801 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ede06af8-aaf3-4328- = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ede06af8-aaf3-4328- = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a77eeb16-2469-4dbf- = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a77eeb16-2469-4dbf- = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ee6bf499-4e80-413d- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c9db898a-0c2b-4ec0- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9ff656cf-0c73-4383- RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3521da4c-35fe-4114- = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3521da4c-35fe-4114- = "\\\\?\\Volume{018D5B2B-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\1d116ca25302122e8e94614073e5d3fb181a0ef6034c91a48ef4af0052e32b8a" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3521da4c-35fe-4114- = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ede06af8-aaf3-4328- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a77eeb16-2469-4dbf- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3521da4c-35fe-4114- = 2da2bd472626d801 RuntimeBroker.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exeWerFault.exeWerFault.exepid process 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe 4508 WerFault.exe 2912 WerFault.exe 4508 WerFault.exe 2912 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2412 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exesihost.exeStartMenuExperienceHost.exeRuntimeBroker.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe Token: SeBackupPrivilege 2204 sihost.exe Token: SeBackupPrivilege 2816 StartMenuExperienceHost.exe Token: SeShutdownPrivilege 2948 RuntimeBroker.exe Token: SeBackupPrivilege 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe Token: SeShutdownPrivilege 2412 Explorer.EXE Token: SeCreatePagefilePrivilege 2412 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
RuntimeBroker.exepid process 2932 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exeDllHost.exeWerFault.exedescription pid process target process PID 4044 wrote to memory of 2204 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe sihost.exe PID 4044 wrote to memory of 2224 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe svchost.exe PID 4044 wrote to memory of 2276 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe taskhostw.exe PID 4044 wrote to memory of 2412 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe Explorer.EXE PID 4044 wrote to memory of 2528 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe svchost.exe PID 4044 wrote to memory of 2712 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe DllHost.exe PID 4044 wrote to memory of 2816 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe StartMenuExperienceHost.exe PID 4044 wrote to memory of 2948 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe RuntimeBroker.exe PID 4044 wrote to memory of 3024 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe SearchApp.exe PID 4044 wrote to memory of 2172 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe RuntimeBroker.exe PID 4044 wrote to memory of 3372 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe RuntimeBroker.exe PID 4044 wrote to memory of 2932 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe RuntimeBroker.exe PID 4044 wrote to memory of 3760 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe backgroundTaskHost.exe PID 4044 wrote to memory of 2676 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe backgroundTaskHost.exe PID 4044 wrote to memory of 2984 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe BackgroundTransferHost.exe PID 4044 wrote to memory of 3508 4044 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe MusNotifyIcon.exe PID 2712 wrote to memory of 2912 2712 DllHost.exe WerFault.exe PID 2712 wrote to memory of 2912 2712 DllHost.exe WerFault.exe PID 5072 wrote to memory of 2816 5072 WerFault.exe StartMenuExperienceHost.exe PID 5072 wrote to memory of 2816 5072 WerFault.exe StartMenuExperienceHost.exe
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of UnmapMainImage
PID:2932
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3372
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2172
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3024
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2816 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2816 -s 29442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:4508
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2712 -s 8802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:2912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p1⤵PID:2528
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe"C:\Users\Admin\AppData\Local\Temp\7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4044
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2276
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup1⤵PID:2224
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3760
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵PID:3508
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:2984
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2676
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 2816 -ip 28161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:5072
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4572
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
8409476a4601eade0ad5f08515a9aa3b
SHA1993513c1f59a772854d9ffbbc5234de95fbcedc2
SHA2560b781ca1846dc8573d6f067ce4d813313e3d12d192add5d3124ac25ce26f793d
SHA5129e9f96fd7688327ac1c3dc8ee7336875428941e978fbc736359992ac635790336cd76138b62ec21c0e167792803b9a08cbb203ec0ac9a46139819150b762bf82
-
MD5
892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
MD5
892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
MD5
5587b9de439d63c05f60dd2ea1d3fc1b
SHA15b3634735dfd4eec637465184731dfc98cb30260
SHA2563d54607940361579e53722484fa2ffbe31d0ed4ac1e5b8a6c1acdfcee5efad3f
SHA5125e0332c0e29d2cf4faadf8d7783930fa1a73b98fb16c8ca84df2b48704ead21d8472f6b150bca3bc12d3ab880a60e128b59cc02eb6b587b4674e3734348bd2e7
-
MD5
892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
MD5
cd91e1b1df03068e3d6ede46cf02f8f7
SHA19ca040b1636ab2d914351d5eeb2b2830b766c12b
SHA256b0ff8fb23397e54c6c7d07112b79134e4ee4180e718a31c074523f72e5c7d16c
SHA512d85f508bbdfe35cb83fa4f419a7ba7707052e9ebc6cb6b6e63bca93b92cfa34330bcf5c9f191cd0a02d85541b1f7e726c3f9f5e8482af694305f6a0f22c4d591
-
MD5
c4126830f9c6ef0bfcea74a8a3698252
SHA1ab729aa49a562aabd59711fb60c6ce712511eb29
SHA2565dcfc0d2f2f7505e7b6cfce609d1cf2cf12ed25e13ee79d9b036e5d9c4ace7f0
SHA5124b93070afb7b16a643aee741d87d74804780f9e24d74b79d632ae90aa5cb81f3a5de73d42755f85ec7a16a2b9a801df53bb1a5549d33b5c974189076d8ffe7a3
-
MD5
892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
MD5
3eccc936cf76d0e33904e6b3e3c3f452
SHA1b311b6461a8fe4ff8405009a835c5470d52e23de
SHA256e57b54ab5e0ec2caffe91b987032519e7ddf67f3c00cbc23e943a39bb9840dbf
SHA51274ba41e1c38a8b572d078ffc57885413a2d6dadcb980b4bb305d6938dc43e63091a85bb415cda0bea76a9ba24c621e61dde92065ca8711b4c7a50996eef4b8cb
-
MD5
892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
MD5
1c2f2850d3f1abebb990fcc37ac8fac9
SHA1f51ce47c63d4599aef0f9e89050530d5060e8ece
SHA25633101431f7a5a0bfb01191ebe2528ff92a8efe17990441686ae86a6ccf41e0cd
SHA512affdc8311c6046b6fe4fc46cd1e58be45afb18cd1cf2dee545945849f0f2bea0463c06df14fc32658172f76fafc83ac0a3359eecc3da295bd8af6b256fb1c7a0
-
MD5
14ef4cfcdd3dd8b81a3d60e36c62e994
SHA1074b7f17e3ca33391686fd8ad7db67f2623b7347
SHA256c2a9723a77e3904049c5f643cca2874158d9e86a03e4be970c55f8807f6ee3f8
SHA51252b2f5bcf0ef987a685bd2a94232a980dd073e1f6fe04f19d94e3313298a7bfa1612e197dc26f92f47cf53f83d241701d96532214daf937227d21ab3d67fe698
-
MD5
892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
MD5
892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USS.jcp
MD5647f12e5821e4b9cafc1f888be77f27b
SHA1e03b1139852c9b7e862f04e6107d95cbbba3a90c
SHA25685bb02e573ba3e193ed7ccf16a7cf160a15a7b115170d864a76c9ded30210e17
SHA512c010357c81c06bf8982d42dae1cf4579c29e7437ce45a98fc283ccc9fd0526f623c2b47ec3f82b4457fbb931b52c82a72b2e9d281dfcb7eeacbb5bcc0a964dd1
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USS.jtx
MD5f2c09a7652186cd8f2e27bc8f938bb6b
SHA167397c1d312935afc740a9e54e294b32b6a97d6c
SHA25626dc3ecdffffd0dfed5d8bc24bfbe99d0d9a136786916c57e8af3ba686f91bb1
SHA51218d198ab04d0a2fd58238e4a23f9e3c31c8da433f8a58e9573774dabdd4cdcf4728bd5fcf5f23dfc23190244c9ffba4f953bed80f8b4f74b53d2b75713278860
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\store.jfm
MD5ca4f2f30342e8ba71000c6144274ea30
SHA1927845e15ca1f1c23c07b44007a354286e95b045
SHA2567b2abcde2c8ecaa1745d3ad8a3f8dc35b20e23e24b938fceb010e643e1252212
SHA5128523fc1f0cedadd373b4b250fd051b3597da206b7bc78657d28da97b9cee026a7a40432bd1916b2a1783f3678d743935d3028e1c44929dddedcc9a19b763c0dc
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\store.vol
MD586cb6137a9ff9c7d78b655057b1c74c1
SHA1ddb3df524ecd58aa9a8039b3f0fbabf2f21aa392
SHA256312078931037e8ab608e187902b60896db3a76d6b17d35937adc568d3ebf5712
SHA512fb5edf74733c7058c8d83334b9d27db2ff503fa4f55d845e9460f00a4b71928bf5c7cf6891d59dd5070109b99ce860d70ad1e2683d8aa584bd091f0fbd28924e
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini.RYK
MD512f2acfa1499ba9978f1834f64164725
SHA1131867e64492727abd35b96f891ecb9ff4caecc2
SHA2565758a748530c803ed2e059f559821ba11b744b3acbd2262730d563ae1ecc1c20
SHA5128e46d3faa0e7d3c357104d8e775bf1828dc58bcce241bedd5887cf4f4798ca39e95370e17798241772563519f6147ded3c6f89f594cfe84199d5a0187bf16142
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db.RYK
MD51e9099404014c42df11bc9b7da05d350
SHA103836ed0f111031e1f52e28999e0b87b48c75cde
SHA256b5370e22f1068767797ec6e63a4d65e8e1996be749796e402bd09093dc32082d
SHA512268c7737c9d65dd295103a14df5106353552f1765c89931f2c874acd8fdbc36af71a9eabc791e7144df3e2ac17bbb3120798c690e3630406560ab2f104373179
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Publishers\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\AdobeSFX.log
MD518d31e7ffd3703af6051e2a7a65e3f61
SHA1d0b6f8c50849a21c4dd7b8e016837710078d97e6
SHA256bae77dd377058da0e15a576308730146fe21cde41fd6f7a594c2eabbadbc2bef
SHA512ff971ee4c685823766d2afc4f7edc6cf2526221a36fa43fd379f8935a3de8b3e6fb78697d6155637d1b088ff5d8914461dfdc7f192a7de14982bb7cf9a835108
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\DO775D.tmp
MD593ac4f71e55f69fbbb5c2b1bd461a035
SHA1d6c8b6fbefbbc28b74f75bb03ae13adc4462ca31
SHA256c22a5655aa19adf7d3ef5011fd5fe99a9ac72c153608b5ba4d1a6a20b015a0aa
SHA5129b2d162bba9b3a519466cc3c1fad4a034301cd528c821bcc2847b2b1f4531dd046dd93ba03b502531fadbb11915298607bd2499a255ac14a7ef128e1cb0b8b2d
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\JavaDeployReg.log
MD5b1b0ab54b74972ffb7e672e8bab3d282
SHA146b58663961e0529811a6c100cea7a7094151699
SHA25641463b305ccf0c4497ae3ca529a5cc62f8699a53e75f20dc7847309d5c8f344f
SHA5126a8849d3643779360709e4442fb96ab43290b56ce8cdb45bf373c758911d35dcdc159bfa9937b43a1c1a8af5fbf80fdf3868b4dab3beb4ee06e32b31681a5ebf
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Low\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\aria-debug-2324.log
MD599455969696aa88246a6ef0ac17c10aa
SHA1a884026974b072f9eb258206e2d31f5e4c3ca512
SHA256bb8287b717e1be1383e0a36ec68f8f8b2114646c34fa8d7d2baa7508a8813caf
SHA5127c23033419c84154786990fd1868d42f3b5899e6a939fe87d1b6f29d53d83a0797a01152dfeaac7b8a0c7401fc0c435af3ce220e6c483ff55f956de44195795a
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\chrome_installer.log
MD571ef631df9514893a6733e9e55d34366
SHA171fb256816bc2daf5d2c95cb15093db9be936a5b
SHA256ba6ca972ef6b42e6b79d5b4c689fd87ffb351ca64d6ef9a023afb653d6e9165f
SHA51211f283933c1a34601c1bb9e5f8748a1a49f38e59b7fddc4e5ac6d08494ccacbdc3a0e319cd1c366442b5a60b9c5f5c43fccf7dea3134edccf82c2f34bbb45c77
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dd_vcredistUI46A8.txt
MD532d3f3ff9c9a0631ca14af12a8b4af86
SHA1b1a1dbef9a5b55cd4f4f2a1d6292fdf1ac8341ba
SHA256f6b89505a9d88012d4c6ef960561d8205f015009d840b20949af82607ef45cc1
SHA512d110c2801f2201275d815cd9add0dbf91f8d6306ea964a9811d0231afa369c2ea2420aeda34b32de900d9a3cb690fc7ed4da3267236befc59895d94d2e1a94fd
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dd_vcredistUI46E0.txt
MD51df9e3f4002409ef5366615dab30788f
SHA19515efdbbf171201727dd92d1838b82aeec0db3a
SHA25629be09cfba16064152ff491b4e8313bd1dc354de7063147ec091d6872a87b284
SHA51262adfb708356d667483295872af14607fce5e1c303bf2986595e9579638a6b84907e068d6d32410223d4d7400bd9a6ea3a1eb6c90dd4a796e291d7c8375ab7dd
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\jusched.log
MD575962e790ac775f2ae84a1b1baa282d2
SHA1b4f55c8cc4f34ea2b55a613037d164ee923b1ed8
SHA256d1316d735a0c92f18e0b75ab6438169ed97adb363b429a8eb495634e42789dd9
SHA51217abfb52637aeb19f93b186c07de7c88725da89475305bca446dfcdc1cc3338e946a10896a303e56ef4cb67526c28b051c12dd7484a02b799c3b809ad7937e78
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wmsetup.log
MD558c1327dfdca31ec59e73d0562dc5422
SHA1be6a43f05eda3267b1dad29df87e6bae618be927
SHA2566e65021ce17b9b3dd496fa09155577a545b709ee5efb68ac11a7463591e5e4fa
SHA512a66aac6e2297656aa7b7d890357bc641b21126f53db8e63a895bcd133b3d88759a9f441227945ac4b5fa47c3d89ed42415f4999ceee6049d2caf6530a24322d0
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USStmp.jtx
MD5c85593fa093e18eced98a2948e1967d8
SHA17e9c6f196ba3e39184f77f001b8cfdd1dcac3260
SHA25684448cbf20826a316be8a615e141c02001b7214d96fe38259ba1e8f5d8b10acf
SHA512ebd2042605f074c5e6cb59a0d56e09ecec9cd487b151f303744d0d15aa45151068e745c2e308f6d29672218e3186b2a18141abb99713ba55a31647a7ba752245
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\data\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\ConnectedDevicesPlatform\L.Admin.cdp
MD5bd8206db4fdb1120727f34355fedf3d9
SHA107d8dfc7df26ff8707740c38425f42f156c8e3d6
SHA256acde7534331206b770861e458f59c2d635d0169a641acc723e83148fae492617
SHA51216ed47d498bbfd1648f4e1f95020fe6fdf08f10041d389867d11150379192218a04e65e9027819d6466c687c80c01383fafee6e1ceb73f0f3a34217b7d286340
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\ConnectedDevicesPlatform\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\History
MD521e268cc609a0f255bf8fdf289e4a29d
SHA17c6d597a68432da17e5731d38cdd41d656db61e3
SHA256378a9ff4c4a95314c1999a333ed94ae21dde6e76da584f79f5864bba2ba34e02
SHA512f8cbfc747d6b1653da3a9ed7ea8d9a3a235a1aef5eb25cd4e20bea2e36b8469aeb19852f2065d7b19154a3c077b27ccf7919ad158b0ea68a0e33812305d829ba
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
MD576e5c9d07c4bcc4f7f2cdab2cbb1e85d
SHA1885f6b1bfbbcab44bf980714ee3f9b4544fb1389
SHA25679fc624c29fd7702309d7b103d712f840d9d8a7afc166e392b723a7d5a087c4f
SHA5124fe4a9b68d674f70c56e6232a0dd881729fab8840122bfcd043523ac6c98520696e511ef55827244b9e543a6f0f86388db74f512f34ac82a039379345b9bf956
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\af-ZA\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-AE\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-BH\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-DZ\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-EG\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-IQ\RyukReadMe.txt
MD5892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
MD5
892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
MD5
892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
MD5
892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
MD5
892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809
-
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_0d751396-3164-4736-b931-4f59d47ff1f2
MD593a5aadeec082ffc1bca5aa27af70f52
SHA147a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45
-
MD5
892c3779e403ba2b9deba0670b435e6e
SHA1d46ff9301f175a170a8c33d02064e05c5f944805
SHA2565b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33
SHA512829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809