Analysis

  • max time kernel
    171s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    20-02-2022 06:25

General

  • Target

    66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe

  • Size

    200KB

  • MD5

    ebcadf583bfc61ebb3dd8a119527d829

  • SHA1

    259be1414a0ac7892dddea0259b41094150b8d3d

  • SHA256

    66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe

  • SHA512

    9d1099a3cd7675b2baebd2b9b67db42800f0afd33c8ff326155c54e16328bf0b477cfff6fa3785921f1b62eeca8b8ece9afd01cdc3f6fd9f3751e5603c3a87bb

Score
10/10

Malware Config

Extracted

Path

C:\RyukReadMe.html

Family

ryuk

Ransom Note
<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> [email protected] </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html�������������������������������������������������������������������������������������������������������������������������������������������������������

Extracted

Path

C:\RyukReadMe.html

Family

ryuk

Ransom Note
[email protected] [email protected] balance of shadow universe Ryuk

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
    "C:\Users\Admin\AppData\Local\Temp\66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:572
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop "audioendpointbuilder" /y
        3⤵
          PID:556
      • C:\Windows\System32\net.exe
        "C:\Windows\System32\net.exe" stop "samss" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1488
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop "samss" /y
          3⤵
            PID:324
        • C:\Windows\System32\net.exe
          "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1924
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop "audioendpointbuilder" /y
            3⤵
              PID:1804
          • C:\Windows\System32\net.exe
            "C:\Windows\System32\net.exe" stop "samss" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1680
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop "samss" /y
              3⤵
                PID:1336
            • C:\Windows\System32\net.exe
              "C:\Windows\System32\net.exe" stop "samss" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:5780
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop "samss" /y
                3⤵
                  PID:5804
              • C:\Windows\System32\net.exe
                "C:\Windows\System32\net.exe" stop "samss" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:6220
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop "samss" /y
                  3⤵
                    PID:6256
                • C:\Windows\System32\net.exe
                  "C:\Windows\System32\net.exe" stop "samss" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:17048
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop "samss" /y
                    3⤵
                      PID:17072
                  • C:\Windows\System32\net.exe
                    "C:\Windows\System32\net.exe" stop "samss" /y
                    2⤵
                      PID:17108
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 stop "samss" /y
                        3⤵
                          PID:17136
                    • C:\Windows\system32\Dwm.exe
                      "C:\Windows\system32\Dwm.exe"
                      1⤵
                        PID:1172
                      • C:\Windows\system32\taskhost.exe
                        "taskhost.exe"
                        1⤵
                        • Drops desktop.ini file(s)
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1108
                        • C:\Windows\System32\net.exe
                          "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1100
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                            3⤵
                              PID:732
                          • C:\Windows\System32\net.exe
                            "C:\Windows\System32\net.exe" stop "samss" /y
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1640
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 stop "samss" /y
                              3⤵
                                PID:1752
                            • C:\Windows\System32\net.exe
                              "C:\Windows\System32\net.exe" stop "samss" /y
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:6248
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 stop "samss" /y
                                3⤵
                                  PID:6280
                              • C:\Windows\System32\net.exe
                                "C:\Windows\System32\net.exe" stop "samss" /y
                                2⤵
                                  PID:17144
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 stop "samss" /y
                                    3⤵
                                      PID:17168

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst

                                  MD5

                                  24c14182c155b7a82c25465f44940281

                                  SHA1

                                  a5571cd1e1109dec9cd98a6519dca783e0d187a1

                                  SHA256

                                  2b52cec942b3f254efd1109c553e4583bbfe030403857a021eda774260b29ecf

                                  SHA512

                                  c61fb8d0c02e868e3d0e2b298441f8b6208020343176757dd4e628502cea94ed08bbb4dde7599cbf81426a891ae944b89dca6904198352a3205d4e8e8895dfe2

                                • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Adobe\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Adobe\Color\Profiles\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wsRGB.icc

                                  MD5

                                  aaefcb4150d6e300a40a0c034bb0f322

                                  SHA1

                                  e27698013726a2bbf4879e224f16733601e154e6

                                  SHA256

                                  dffc197b49be9935b334f5b9b89a67b3865490d931e3544d5ee0de1bbdbde140

                                  SHA512

                                  33c9ba07a2732743985fcf5de7290ca796b5718e5f082ce651ca46a9dc6b69d08f41a0dd15a718e79e047c366fa1edb6a269884e492f0406c16d9909f805376a

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wscRGB.icc

                                  MD5

                                  6cef34225e7d15a24d8e1c638aae8f1e

                                  SHA1

                                  1d5d05b6d3fe4bef2bc4693afea4e36c96e153a1

                                  SHA256

                                  be9f192b3bed85e29a308f25e9a3c0cc577e596ecd2f5121e213dda544ae6b1d

                                  SHA512

                                  383a65707515ff936ca4842bffb04743a2cc35421e9618119948d45d586f912d106cb5bfec83c95032bf72e667412052da466f8aec03066db865bf83c6376c16

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\ACECache10.lst

                                  MD5

                                  3c44f72bc9ee69b113994bae0a5f47fc

                                  SHA1

                                  95385cbf515600975cce6b218f89e82ef21a67e5

                                  SHA256

                                  df2df8820a7b3cd08b6c6c1bc5413ed169825b98328f35adf379747f17068734

                                  SHA512

                                  14ec49e31562345242f0504299a4baa8a2b378a0849e6c3ed0dcab4f2767aed6f4ab476a47c835abb69316a1da100e0b6c22f7ba70de72a51983dd00cfa6171e

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db

                                  MD5

                                  dda620fd9bc72ef4c7088cf0ffb51bea

                                  SHA1

                                  ff48de449a0809a304aaf7c917bcef073d21f61a

                                  SHA256

                                  b25c526553950779af45bb956b1a563c3c9c69fd0d9f79a2a5b556b874decdc1

                                  SHA512

                                  8a82359501d355220a161a6d55eef040f20af5a69d462db4876dcff223d5040dbeb27e05a864a62c586bbf4d581bb3fd297f5f6c3ff0af73b2547736354a559b

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ASPNETSetup_00000.log

                                  MD5

                                  b7db5c5149a77b9a2c8a6dde70165b4b

                                  SHA1

                                  16b99f4f20fed19f05570eab4e6f1ed42104ea4d

                                  SHA256

                                  1ad7719189a65b5c2d114ac1eca2f143a783706cb71b088a8ec800d6a1bc6002

                                  SHA512

                                  63644a284abd55707fff84448633d5423339b89290c7e54f9d78992454d1b2a2c6fa03e753b1c3d123a0706b2106ce844d9b8d372f3988828b71d259ec812e2f

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ASPNETSetup_00001.log

                                  MD5

                                  ea5ab990ccfba5ad20b1c3a40ee46890

                                  SHA1

                                  9b0478b490eb9382a13ee350e72b303ccd9afe77

                                  SHA256

                                  decfdb2f3898660c3f962546e720bc5af7ae8d7d62f5683880fedf61716f02fe

                                  SHA512

                                  e1baa8229f97fd78a9ad2666ee4790fe0a2c8251d6b777e04961ce9edd49a978923c894b8e534643b211f19c8f2e963eb24ed37ab1dee0b56350f114418609e5

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Admin.bmp

                                  MD5

                                  d805e8ce6031c9d758b400f3e3fbc3d4

                                  SHA1

                                  fadac0008538f1c227d4ab08cd8d803c7ee433a6

                                  SHA256

                                  18ef17489043dddb38f85df89a39233746fafc88860723170102f066b05914b4

                                  SHA512

                                  43b637406505490e47000297a04bc23dbd143b6c00f4557efb0219a7cc407df1fab6efb5b586f4b54c6231c484738175d3ccb319dfdf1b67df52c7053a31d28f

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\JavaDeployReg.log

                                  MD5

                                  2a157840683cdd4797bdfb453bea279f

                                  SHA1

                                  fc07a57426ca71f9c1536d2063979f481feea36a

                                  SHA256

                                  5a34d26a1838425bda2afe684761a807d568e222743fba51550559ef9798c54c

                                  SHA512

                                  644606dcc2ac0f75c11461a479e36d6f89e3a3af9564e2b7cadfe16ae101bff7b239457199c9e88d5e63503ae27ef1c682f13f38ec15454b32dead09437f65d4

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RGIFCB7.tmp

                                  MD5

                                  ca8ed7b7d4c36e9144e78ecb04b49759

                                  SHA1

                                  ea9ca6c9f635e3f1814310c66847237c4adee71f

                                  SHA256

                                  43eb7f20631b9af08d05761d87b639dc6e26a4dfe9b686a1a87883c6674a20d1

                                  SHA512

                                  badc6c402c23c5a4968dee01483a69df7139d037c6ae05ecb5c0e8bca96768d8a8198cf804b519a65775280ead01539c359aa7090128db378bd2ff1abbc230ce

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\chrome_installer.log

                                  MD5

                                  4ecd1bb9acc9fef847767aba15985e3c

                                  SHA1

                                  aaa5cf702ae27f5ea3e15d1c78943bb78930bc9f

                                  SHA256

                                  dca2a0924d7ed9c57b1816576624db3443a0fbcf1b564846dc934dde11568d6d

                                  SHA512

                                  686ccdd14db70c7500dae6613482ddf800ee0c42e891ff849f912173225211b46dd57d6bd699851e0dbe5e4eb63fcd4d0644415d1ecca0829030b1644cfadde0

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dd_SetupUtility.txt

                                  MD5

                                  a4a8661112cfdb39f9be6a3f0b326fc1

                                  SHA1

                                  eaba7612221b1348ef500e9c4a3ad2c45c5b01bf

                                  SHA256

                                  bd22cea166d0069a7ac6596c9250bb0dd6ede1bc9d348d60fda9c92019c0d1e6

                                  SHA512

                                  fe38ff29e32d87f898332cabd2caab1b844e11fe418835aa630edc2eaca03f6010898fb5efdb7a97697b64fa7ae28e7ca65659d5fc22b82d7f1ed1fbbe3aa410

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\java_install.log

                                  MD5

                                  386703329df7d48967fc82cf0c6bc848

                                  SHA1

                                  788b98f668f03d161ef4cb547b36f941c3ce7b90

                                  SHA256

                                  66ce7c56b9b790bea6861c7fb7fe4ee4e9bca64c3539de398ee6a620ec84178a

                                  SHA512

                                  09e35386e3a40addff7a594e7892e3a10f75a41866bf2e2a252d1e2bc61bd0e6f80018e8ecde8282c512f347b528bf36c376b42dc6a7721fc0f9175282f7d39c

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\java_install_reg.log

                                  MD5

                                  82a1c0aecb6cd278deb298af5d8541ee

                                  SHA1

                                  e1b5c77d9ea3e9273e60b78b1eba074f15737376

                                  SHA256

                                  a04dae234764d62c5356ccde1de5d7cf388f95978fee43426af2c5933fe94ea5

                                  SHA512

                                  50c1424a3162ac63f52a2abc76e5e1f1fa95ca17ffdab63ecb1e203e56b57c140d0289405245ac0f2ee345d2670c31ac04b087c307cffdfa85d98613792bfebb

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wmsetup.log

                                  MD5

                                  e04c36c719b6524b1b30abd2d1059a61

                                  SHA1

                                  1ae3f75517f77cc7528e7aa9e494f04caf6aa905

                                  SHA256

                                  baed7a10b0cd6d8e668b5cc58df7a83d6af196b7a40755ed12660186dda6a0a9

                                  SHA512

                                  08508a2359037e69cb1499ef02a11434b7524fa420e319c2fb736a7eede4554d598763caa1397d12c289df7877293d157b7f8946d25caf95c4f69ecd9c5c33b3

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini.RYK

                                  MD5

                                  46db4e9edc6281ff8f88b90d0b2c24f3

                                  SHA1

                                  7db535137070b541a64d0e1f8b968f73b1cefbab

                                  SHA256

                                  3b28d3dc35808bcede96c1b72f9f76cc519cc355351f992fb7f12dadbb6a6157

                                  SHA512

                                  83ede88fa296b1567e3c6aefe2dd6c0129f65c4d9e3224d8f52142bd1bcbab3e73a066988087849bf4c88cd925572d09ff459a489197ee24c6c472d58ec4095e

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini

                                  MD5

                                  2058abcec9883e9e87cde2c7dc7b55a4

                                  SHA1

                                  c3facf9540fccf502f3420ab2ac6a4102a2944f0

                                  SHA256

                                  4df401e5b944f04cc5e741c6208edf73f0e8de6f454c179aec306208c163e9ce

                                  SHA512

                                  34e78d745fd0fe3129a2d91fb428d0ee647b08ab17674f47da473ef45d5d0b5706afb5999889692a9bf4ba91dcd8e8a048de722cfc69e4fc5cc361e9852a0db6

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini

                                  MD5

                                  159ef8d7a821f8cceb1c33c91bc9babc

                                  SHA1

                                  1a53312dc2b7b3af2733f1d70762d54e727655d4

                                  SHA256

                                  665ebeae8e42e76084705f00c5958e1a4e0684bc5019ecd8c9229715505c9c75

                                  SHA512

                                  60f8e9bfbed8bb2be8449caced3a4e8bd453ba4a007d3729b8d4ecd87e88f9453ca43ccdccf42556756bdb8598e97579caa28d9049844b9dbb5b2de3603c0874

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini

                                  MD5

                                  b4e7ae0d23253560e51245a6e28aba47

                                  SHA1

                                  9cc660eb5d4b4e84d83602979bcd8044306ccd45

                                  SHA256

                                  1f01b779f19228d90d4079444f888943d222d3cbb48738f2177b759fee0c19c3

                                  SHA512

                                  c17d458bfb5ce0d30b4707b06e1471f9e4edb331cd0e2df5d59a2535a11bedf051d3c7410215127647d1e25da83302a7cf0763c7359547647fbeac224ef47fbd

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini

                                  MD5

                                  085d55e06cce51e33d2cee3a17e85423

                                  SHA1

                                  7d36d33a20deb5d04b09becb94860067c6fe6785

                                  SHA256

                                  30b4feef4d11823c0ebc215065b9afc58923e0870ed6294a0a926c64b7816c8d

                                  SHA512

                                  f7753164b1222d1ff59c5cf38a95d66e5cb8bb1ccbd8ca872d936ba224675a214b847fb01641e66337b9f82ba8437a19099e4e0e1edc7b179092f8ffa955d500

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini.RYK

                                  MD5

                                  2bc39f0f3a9881a9ed41b6b55ff28b11

                                  SHA1

                                  589177798b2276bfffc0d929633d4650e98281e9

                                  SHA256

                                  6364d6d1deec9b5d46ca45695f7723de0b4b4dc0ecfabb5465169f6c23376302

                                  SHA512

                                  c41f73ee6ac12b035ef17e0ed4dab27187541071f0466cc9d77671e2c17e9538a8d1c6fb4c66a4d896011cd0bb157468facd88f81061640bd62c1b2b4592e3a1

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK

                                  MD5

                                  2d94daa288de134d8fc90d904ebc327f

                                  SHA1

                                  d4eed2d527e9ec3e96046009e09b83c179abf58e

                                  SHA256

                                  5ad7478fa2a615ad902176a30b09e60907c3c470402cdd0fb5281f7135a46dfb

                                  SHA512

                                  39fd79408626791f61e135207dd271e329fb7be7d48bb9bbcc31b60ce1f65fbb12a45f1e58c129f9481cd9cce8078bfc86c75ba52bb1cf27f34705c3de0647f7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.bak

                                  MD5

                                  4350179eab92657a1eb7f5e2926a3006

                                  SHA1

                                  be61ec54bf9d823766e2c1444269cc99f7c68bdb

                                  SHA256

                                  566786c8f869c90ef0f36caf06a788a9bfe3579b259dd1f012f3434779773789

                                  SHA512

                                  f62cf3a0289920d31648967343d4d50270be4221ae1c667ad6fd8f02caaf34a9089790e1082c07ada6381ea940a87a63f60b13cde65d2b55dea7b025760781d7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt

                                  MD5

                                  8be8b4c2809e89fa165591e26f993b4c

                                  SHA1

                                  20d712e659dbc5a303b83c2f19174282bc10bdb0

                                  SHA256

                                  c31d0eac73efcdace7724c651194d6d3ea23d99cb41b5d6c9462e09bc5f9b727

                                  SHA512

                                  54900f34b81dacaec1b7e1b151c693b357473f04ffea1581a46bcdf8fe2cf85be510a949ff16c53a53442c9a998cd06e656fb1199c74429f692dbf9f90f54e4f

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\LocalMLS_3.wmdb

                                  MD5

                                  729eb05b9249a4db0e17cc0832ad7b8f

                                  SHA1

                                  0be3250b8203d9e93f917f3de0b990c99b298e0a

                                  SHA256

                                  60c27cc92871fbb83ed19d4bde1b1dc2746bcf0143dfae9f0e1ae948cab73d60

                                  SHA512

                                  1b16b7d8c7e067e03ac81455eff2c015e1977922aaefe1f193842cc3b684c71900b5f75f8c1d299f6a449ec487fcc3477e51646f0d297e694409a58bb4dccba4

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\PlayReady\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.htm

                                  MD5

                                  2eca01bde348ea7fda7db9eb49b7b308

                                  SHA1

                                  44408d25252427cce2ab1035b0c99af950c4d1d9

                                  SHA256

                                  0f9230260d4be7d8619186fc67319c1db5f2ebe8468e24d394cdc4a49a81475e

                                  SHA512

                                  4a7b3ad399ec78ea007efe2878295f7e83bbe1813e6ffa7891d835a5cba9ccc6708eaf50d38f99bc8e396663502157df9f4265b05aa453cf49226927da59d30c

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Stars.htm

                                  MD5

                                  36f46b41edfaa45eead96884be454197

                                  SHA1

                                  6ae5b59dde24dbcca634ad11a7a9436d41e047d5

                                  SHA256

                                  e73f59b18b2d1012778bf0e9e294fd1485846ea697c3851a5d8fd696dc37a0b4

                                  SHA512

                                  02b1ce89f8ae336fd503d16f8def8b01c7e1afb965d78e1df403aea5c6bbd4d85008e03b0b44bcac02394748a5b2cd6df4cb3cc61c16a1f305559067f2f6a748

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\oeold.xml

                                  MD5

                                  8e7d2b05c870611c601a07a62d34e506

                                  SHA1

                                  5f1706cfc6f21c1a28cf91dde66220a017306867

                                  SHA256

                                  876e37bc96ed649ee90937cd3c5851d6040e7c6cf0bcda792d116adab9718f85

                                  SHA512

                                  5b255edc96cd0810baec8f75c00a7e99c4193bc9debda54e0d49fb305c4b3cfa6eb754ac2c0bc572766469875190e5771965926cf5e4676ca4fac32f7fdab1c9

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WebCache\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\Local\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\Admin\AppData\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\Documents and Settings\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3bd845b8-ce6a-4337-9974-31490196462a

                                  MD5

                                  93a5aadeec082ffc1bca5aa27af70f52

                                  SHA1

                                  47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

                                  SHA256

                                  a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

                                  SHA512

                                  df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

                                • C:\RyukReadMe.html

                                  MD5

                                  d9fe6793afc43f7c749d83875e83016a

                                  SHA1

                                  30f5fc315a83b5045215745e05055edb07652a8f

                                  SHA256

                                  8869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f

                                  SHA512

                                  7c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7

                                • memory/1108-57-0x000000013FAE0000-0x000000013FDBA000-memory.dmp

                                  Filesize

                                  2.9MB

                                • memory/1108-55-0x000000013FAE0000-0x000000013FDBA000-memory.dmp

                                  Filesize

                                  2.9MB

                                • memory/1172-59-0x000000013FAE0000-0x000000013FDBA000-memory.dmp

                                  Filesize

                                  2.9MB

                                • memory/1304-56-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

                                  Filesize

                                  8KB