Analysis

  • max time kernel
    192s
  • max time network
    206s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    20-02-2022 05:25

General

  • Target

    7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe

  • Size

    126KB

  • MD5

    fca20e17ce8c0c3f3c78d82c953472ed

  • SHA1

    c8ecc9b34184e7e1c15b4ed49fb838e7882dbfc6

  • SHA256

    7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20

  • SHA512

    5a38ab6f0401c57e0ab1a0f889fe4db8b3fbeda0abbbb87d21da870de604615446a83f6b156ecb36d9101072d429ce7589439916404bc2e76b751847b8947152

Score
10/10

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation. More than a year ago, world experts recognized the impossibility of deciphering by any means except the original decoder. No decryption software is available in the public. Antiviruse companies, researchers, IT specialists, and no other persons cant help you encrypt the data. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions.Send 2 different random files and you will get it decrypted. It can be from different computers on your network to be sure that one key decrypts everything. 2 files we unlock for free To get info (decrypt your files) contact us at [email protected] or [email protected] You will receive btc address for payment in the reply letter Ryuk No system is safe

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 2 IoCs
  • Modifies data under HKEY_USERS 45 IoCs
  • Modifies registry class 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2948
  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of UnmapMainImage
    PID:2932
  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
      PID:3372
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
        PID:2172
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:3024
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2816
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 2816 -s 2944
            2⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            PID:4508
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:2712
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 2712 -s 880
            2⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            PID:2912
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p
          1⤵
            PID:2528
          • C:\Windows\Explorer.EXE
            C:\Windows\Explorer.EXE
            1⤵
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:2412
            • C:\Users\Admin\AppData\Local\Temp\7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe
              "C:\Users\Admin\AppData\Local\Temp\7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20.exe"
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4044
          • C:\Windows\system32\taskhostw.exe
            taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
            1⤵
              PID:2276
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k UnistackSvcGroup
              1⤵
                PID:2224
              • C:\Windows\system32\sihost.exe
                sihost.exe
                1⤵
                • Drops desktop.ini file(s)
                • Suspicious use of AdjustPrivilegeToken
                PID:2204
              • C:\Windows\system32\backgroundTaskHost.exe
                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
                1⤵
                  PID:3760
                • C:\Windows\system32\MusNotifyIcon.exe
                  %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
                  1⤵
                    PID:3508
                  • C:\Windows\system32\BackgroundTransferHost.exe
                    "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                    1⤵
                      PID:2984
                    • C:\Windows\system32\backgroundTaskHost.exe
                      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                      1⤵
                        PID:2676
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -pss -s 444 -p 2816 -ip 2816
                        1⤵
                        • Suspicious use of NtCreateProcessExOtherParentProcess
                        • Suspicious use of WriteProcessMemory
                        PID:5072
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k NetworkService -p
                        1⤵
                        • Drops file in Windows directory
                        • Modifies data under HKEY_USERS
                        PID:4572

                      Network

                      MITRE ATT&CK Matrix

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Documents and Settings\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp.RYK

                        MD5

                        8409476a4601eade0ad5f08515a9aa3b

                        SHA1

                        993513c1f59a772854d9ffbbc5234de95fbcedc2

                        SHA256

                        0b781ca1846dc8573d6f067ce4d813313e3d12d192add5d3124ac25ce26f793d

                        SHA512

                        9e9f96fd7688327ac1c3dc8ee7336875428941e978fbc736359992ac635790336cd76138b62ec21c0e167792803b9a08cbb203ec0ac9a46139819150b762bf82

                      • C:\Documents and Settings\Admin\.oracle_jre_usage\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\3D Objects\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\3D Objects\desktop.ini.RYK

                        MD5

                        5587b9de439d63c05f60dd2ea1d3fc1b

                        SHA1

                        5b3634735dfd4eec637465184731dfc98cb30260

                        SHA256

                        3d54607940361579e53722484fa2ffbe31d0ed4ac1e5b8a6c1acdfcee5efad3f

                        SHA512

                        5e0332c0e29d2cf4faadf8d7783930fa1a73b98fb16c8ca84df2b48704ead21d8472f6b150bca3bc12d3ab880a60e128b59cc02eb6b587b4674e3734348bd2e7

                      • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\DC\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents.RYK

                        MD5

                        cd91e1b1df03068e3d6ede46cf02f8f7

                        SHA1

                        9ca040b1636ab2d914351d5eeb2b2830b766c12b

                        SHA256

                        b0ff8fb23397e54c6c7d07112b79134e4ee4180e718a31c074523f72e5c7d16c

                        SHA512

                        d85f508bbdfe35cb83fa4f419a7ba7707052e9ebc6cb6b6e63bca93b92cfa34330bcf5c9f191cd0a02d85541b1f7e726c3f9f5e8482af694305f6a0f22c4d591

                      • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin.RYK

                        MD5

                        c4126830f9c6ef0bfcea74a8a3698252

                        SHA1

                        ab729aa49a562aabd59711fb60c6ce712511eb29

                        SHA256

                        5dcfc0d2f2f7505e7b6cfce609d1cf2cf12ed25e13ee79d9b036e5d9c4ace7f0

                        SHA512

                        4b93070afb7b16a643aee741d87d74804780f9e24d74b79d632ae90aa5cb81f3a5de73d42755f85ec7a16a2b9a801df53bb1a5549d33b5c974189076d8ffe7a3

                      • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\ACECache11.lst.RYK

                        MD5

                        3eccc936cf76d0e33904e6b3e3c3f452

                        SHA1

                        b311b6461a8fe4ff8405009a835c5470d52e23de

                        SHA256

                        e57b54ab5e0ec2caffe91b987032519e7ddf67f3c00cbc23e943a39bb9840dbf

                        SHA512

                        74ba41e1c38a8b572d078ffc57885413a2d6dadcb980b4bb305d6938dc43e63091a85bb415cda0bea76a9ba24c621e61dde92065ca8711b4c7a50996eef4b8cb

                      • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.RYK

                        MD5

                        1c2f2850d3f1abebb990fcc37ac8fac9

                        SHA1

                        f51ce47c63d4599aef0f9e89050530d5060e8ece

                        SHA256

                        33101431f7a5a0bfb01191ebe2528ff92a8efe17990441686ae86a6ccf41e0cd

                        SHA512

                        affdc8311c6046b6fe4fc46cd1e58be45afb18cd1cf2dee545945849f0f2bea0463c06df14fc32658172f76fafc83ac0a3359eecc3da295bd8af6b256fb1c7a0

                      • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK

                        MD5

                        14ef4cfcdd3dd8b81a3d60e36c62e994

                        SHA1

                        074b7f17e3ca33391686fd8ad7db67f2623b7347

                        SHA256

                        c2a9723a77e3904049c5f643cca2874158d9e86a03e4be970c55f8807f6ee3f8

                        SHA512

                        52b2f5bcf0ef987a685bd2a94232a980dd073e1f6fe04f19d94e3313298a7bfa1612e197dc26f92f47cf53f83d241701d96532214daf937227d21ab3d67fe698

                      • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Adobe\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USS.jcp

                        MD5

                        647f12e5821e4b9cafc1f888be77f27b

                        SHA1

                        e03b1139852c9b7e862f04e6107d95cbbba3a90c

                        SHA256

                        85bb02e573ba3e193ed7ccf16a7cf160a15a7b115170d864a76c9ded30210e17

                        SHA512

                        c010357c81c06bf8982d42dae1cf4579c29e7437ce45a98fc283ccc9fd0526f623c2b47ec3f82b4457fbb931b52c82a72b2e9d281dfcb7eeacbb5bcc0a964dd1

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USS.jtx

                        MD5

                        f2c09a7652186cd8f2e27bc8f938bb6b

                        SHA1

                        67397c1d312935afc740a9e54e294b32b6a97d6c

                        SHA256

                        26dc3ecdffffd0dfed5d8bc24bfbe99d0d9a136786916c57e8af3ba686f91bb1

                        SHA512

                        18d198ab04d0a2fd58238e4a23f9e3c31c8da433f8a58e9573774dabdd4cdcf4728bd5fcf5f23dfc23190244c9ffba4f953bed80f8b4f74b53d2b75713278860

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\store.jfm

                        MD5

                        ca4f2f30342e8ba71000c6144274ea30

                        SHA1

                        927845e15ca1f1c23c07b44007a354286e95b045

                        SHA256

                        7b2abcde2c8ecaa1745d3ad8a3f8dc35b20e23e24b938fceb010e643e1252212

                        SHA512

                        8523fc1f0cedadd373b4b250fd051b3597da206b7bc78657d28da97b9cee026a7a40432bd1916b2a1783f3678d743935d3028e1c44929dddedcc9a19b763c0dc

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\store.vol

                        MD5

                        86cb6137a9ff9c7d78b655057b1c74c1

                        SHA1

                        ddb3df524ecd58aa9a8039b3f0fbabf2f21aa392

                        SHA256

                        312078931037e8ab608e187902b60896db3a76d6b17d35937adc568d3ebf5712

                        SHA512

                        fb5edf74733c7058c8d83334b9d27db2ff503fa4f55d845e9460f00a4b71928bf5c7cf6891d59dd5070109b99ce860d70ad1e2683d8aa584bd091f0fbd28924e

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini.RYK

                        MD5

                        12f2acfa1499ba9978f1834f64164725

                        SHA1

                        131867e64492727abd35b96f891ecb9ff4caecc2

                        SHA256

                        5758a748530c803ed2e059f559821ba11b744b3acbd2262730d563ae1ecc1c20

                        SHA512

                        8e46d3faa0e7d3c357104d8e775bf1828dc58bcce241bedd5887cf4f4798ca39e95370e17798241772563519f6147ded3c6f89f594cfe84199d5a0187bf16142

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db.RYK

                        MD5

                        1e9099404014c42df11bc9b7da05d350

                        SHA1

                        03836ed0f111031e1f52e28999e0b87b48c75cde

                        SHA256

                        b5370e22f1068767797ec6e63a4d65e8e1996be749796e402bd09093dc32082d

                        SHA512

                        268c7737c9d65dd295103a14df5106353552f1765c89931f2c874acd8fdbc36af71a9eabc791e7144df3e2ac17bbb3120798c690e3630406560ab2f104373179

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Publishers\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\AdobeSFX.log

                        MD5

                        18d31e7ffd3703af6051e2a7a65e3f61

                        SHA1

                        d0b6f8c50849a21c4dd7b8e016837710078d97e6

                        SHA256

                        bae77dd377058da0e15a576308730146fe21cde41fd6f7a594c2eabbadbc2bef

                        SHA512

                        ff971ee4c685823766d2afc4f7edc6cf2526221a36fa43fd379f8935a3de8b3e6fb78697d6155637d1b088ff5d8914461dfdc7f192a7de14982bb7cf9a835108

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\DO775D.tmp

                        MD5

                        93ac4f71e55f69fbbb5c2b1bd461a035

                        SHA1

                        d6c8b6fbefbbc28b74f75bb03ae13adc4462ca31

                        SHA256

                        c22a5655aa19adf7d3ef5011fd5fe99a9ac72c153608b5ba4d1a6a20b015a0aa

                        SHA512

                        9b2d162bba9b3a519466cc3c1fad4a034301cd528c821bcc2847b2b1f4531dd046dd93ba03b502531fadbb11915298607bd2499a255ac14a7ef128e1cb0b8b2d

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\JavaDeployReg.log

                        MD5

                        b1b0ab54b74972ffb7e672e8bab3d282

                        SHA1

                        46b58663961e0529811a6c100cea7a7094151699

                        SHA256

                        41463b305ccf0c4497ae3ca529a5cc62f8699a53e75f20dc7847309d5c8f344f

                        SHA512

                        6a8849d3643779360709e4442fb96ab43290b56ce8cdb45bf373c758911d35dcdc159bfa9937b43a1c1a8af5fbf80fdf3868b4dab3beb4ee06e32b31681a5ebf

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Low\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\aria-debug-2324.log

                        MD5

                        99455969696aa88246a6ef0ac17c10aa

                        SHA1

                        a884026974b072f9eb258206e2d31f5e4c3ca512

                        SHA256

                        bb8287b717e1be1383e0a36ec68f8f8b2114646c34fa8d7d2baa7508a8813caf

                        SHA512

                        7c23033419c84154786990fd1868d42f3b5899e6a939fe87d1b6f29d53d83a0797a01152dfeaac7b8a0c7401fc0c435af3ce220e6c483ff55f956de44195795a

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\chrome_installer.log

                        MD5

                        71ef631df9514893a6733e9e55d34366

                        SHA1

                        71fb256816bc2daf5d2c95cb15093db9be936a5b

                        SHA256

                        ba6ca972ef6b42e6b79d5b4c689fd87ffb351ca64d6ef9a023afb653d6e9165f

                        SHA512

                        11f283933c1a34601c1bb9e5f8748a1a49f38e59b7fddc4e5ac6d08494ccacbdc3a0e319cd1c366442b5a60b9c5f5c43fccf7dea3134edccf82c2f34bbb45c77

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dd_vcredistUI46A8.txt

                        MD5

                        32d3f3ff9c9a0631ca14af12a8b4af86

                        SHA1

                        b1a1dbef9a5b55cd4f4f2a1d6292fdf1ac8341ba

                        SHA256

                        f6b89505a9d88012d4c6ef960561d8205f015009d840b20949af82607ef45cc1

                        SHA512

                        d110c2801f2201275d815cd9add0dbf91f8d6306ea964a9811d0231afa369c2ea2420aeda34b32de900d9a3cb690fc7ed4da3267236befc59895d94d2e1a94fd

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dd_vcredistUI46E0.txt

                        MD5

                        1df9e3f4002409ef5366615dab30788f

                        SHA1

                        9515efdbbf171201727dd92d1838b82aeec0db3a

                        SHA256

                        29be09cfba16064152ff491b4e8313bd1dc354de7063147ec091d6872a87b284

                        SHA512

                        62adfb708356d667483295872af14607fce5e1c303bf2986595e9579638a6b84907e068d6d32410223d4d7400bd9a6ea3a1eb6c90dd4a796e291d7c8375ab7dd

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\jusched.log

                        MD5

                        75962e790ac775f2ae84a1b1baa282d2

                        SHA1

                        b4f55c8cc4f34ea2b55a613037d164ee923b1ed8

                        SHA256

                        d1316d735a0c92f18e0b75ab6438169ed97adb363b429a8eb495634e42789dd9

                        SHA512

                        17abfb52637aeb19f93b186c07de7c88725da89475305bca446dfcdc1cc3338e946a10896a303e56ef4cb67526c28b051c12dd7484a02b799c3b809ad7937e78

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wmsetup.log

                        MD5

                        58c1327dfdca31ec59e73d0562dc5422

                        SHA1

                        be6a43f05eda3267b1dad29df87e6bae618be927

                        SHA256

                        6e65021ce17b9b3dd496fa09155577a545b709ee5efb68ac11a7463591e5e4fa

                        SHA512

                        a66aac6e2297656aa7b7d890357bc641b21126f53db8e63a895bcd133b3d88759a9f441227945ac4b5fa47c3d89ed42415f4999ceee6049d2caf6530a24322d0

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USStmp.jtx

                        MD5

                        c85593fa093e18eced98a2948e1967d8

                        SHA1

                        7e9c6f196ba3e39184f77f001b8cfdd1dcac3260

                        SHA256

                        84448cbf20826a316be8a615e141c02001b7214d96fe38259ba1e8f5d8b10acf

                        SHA512

                        ebd2042605f074c5e6cb59a0d56e09ecec9cd487b151f303744d0d15aa45151068e745c2e308f6d29672218e3186b2a18141abb99713ba55a31647a7ba752245

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\data\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\ConnectedDevicesPlatform\L.Admin.cdp

                        MD5

                        bd8206db4fdb1120727f34355fedf3d9

                        SHA1

                        07d8dfc7df26ff8707740c38425f42f156c8e3d6

                        SHA256

                        acde7534331206b770861e458f59c2d635d0169a641acc723e83148fae492617

                        SHA512

                        16ed47d498bbfd1648f4e1f95020fe6fdf08f10041d389867d11150379192218a04e65e9027819d6466c687c80c01383fafee6e1ceb73f0f3a34217b7d286340

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\ConnectedDevicesPlatform\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\History

                        MD5

                        21e268cc609a0f255bf8fdf289e4a29d

                        SHA1

                        7c6d597a68432da17e5731d38cdd41d656db61e3

                        SHA256

                        378a9ff4c4a95314c1999a333ed94ae21dde6e76da584f79f5864bba2ba34e02

                        SHA512

                        f8cbfc747d6b1653da3a9ed7ea8d9a3a235a1aef5eb25cd4e20bea2e36b8469aeb19852f2065d7b19154a3c077b27ccf7919ad158b0ea68a0e33812305d829ba

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data

                        MD5

                        76e5c9d07c4bcc4f7f2cdab2cbb1e85d

                        SHA1

                        885f6b1bfbbcab44bf980714ee3f9b4544fb1389

                        SHA256

                        79fc624c29fd7702309d7b103d712f840d9d8a7afc166e392b723a7d5a087c4f

                        SHA512

                        4fe4a9b68d674f70c56e6232a0dd881729fab8840122bfcd043523ac6c98520696e511ef55827244b9e543a6f0f86388db74f512f34ac82a039379345b9bf956

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\af-ZA\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-AE\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-BH\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-DZ\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-EG\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-IQ\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\Local\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\AppData\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\Admin\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\Documents and Settings\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_0d751396-3164-4736-b931-4f59d47ff1f2

                        MD5

                        93a5aadeec082ffc1bca5aa27af70f52

                        SHA1

                        47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

                        SHA256

                        a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

                        SHA512

                        df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

                      • C:\RyukReadMe.txt

                        MD5

                        892c3779e403ba2b9deba0670b435e6e

                        SHA1

                        d46ff9301f175a170a8c33d02064e05c5f944805

                        SHA256

                        5b1b88f481222c1926db240ac8453ee8948afcc39a27b0b31a02a048b8971e33

                        SHA512

                        829b289254af2dfa8906e6109c23affd17b33388c8eff6cb30d463708bf3993bd10558e87f3dd94be61d2116c3284f0ff04c10abf197c950465310a290812809

                      • memory/2204-130-0x00007FF7C2FF0000-0x00007FF7C3372000-memory.dmp

                        Filesize

                        3.5MB

                      • memory/2224-131-0x00007FF7C2FF0000-0x00007FF7C3372000-memory.dmp

                        Filesize

                        3.5MB

                      • memory/2412-132-0x00007FF7C2FF0000-0x00007FF7C3372000-memory.dmp

                        Filesize

                        3.5MB