Analysis
-
max time kernel
171s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-02-2022 06:25
Static task
static1
Behavioral task
behavioral1
Sample
66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
Resource
win10v2004-en-20220112
General
-
Target
66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
-
Size
200KB
-
MD5
ebcadf583bfc61ebb3dd8a119527d829
-
SHA1
259be1414a0ac7892dddea0259b41094150b8d3d
-
SHA256
66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe
-
SHA512
9d1099a3cd7675b2baebd2b9b67db42800f0afd33c8ff326155c54e16328bf0b477cfff6fa3785921f1b62eeca8b8ece9afd01cdc3f6fd9f3751e5603c3a87bb
Malware Config
Extracted
C:\RyukReadMe.html
ryuk
Extracted
C:\RyukReadMe.html
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Drops desktop.ini file(s) 64 IoCs
Processes:
taskhost.exe66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exedescription ioc process File opened for modification C:\Documents and Settings\Admin\SendTo\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Administrative Tools\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Recent\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Contacts\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Videos\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\Documents\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Favorites\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Saved Games\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Desktop\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Music\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\Searches\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\System Tools\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Videos\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Pictures\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\Favorites\Links for United States\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Recent\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\SendTo\Desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Pictures\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Links\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\Downloads\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Desktop\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Maintenance\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exetaskhost.exepid process 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe 1108 taskhost.exe 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe 1108 taskhost.exe 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe 1108 taskhost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exetaskhost.exedescription pid process Token: SeDebugPrivilege 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe Token: SeBackupPrivilege 1108 taskhost.exe Token: SeBackupPrivilege 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exenet.exenet.exenet.exetaskhost.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 1304 wrote to memory of 1108 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe taskhost.exe PID 1304 wrote to memory of 1172 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe Dwm.exe PID 1304 wrote to memory of 572 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1304 wrote to memory of 572 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1304 wrote to memory of 572 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1304 wrote to memory of 1488 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1304 wrote to memory of 1488 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1304 wrote to memory of 1488 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 572 wrote to memory of 556 572 net.exe net1.exe PID 572 wrote to memory of 556 572 net.exe net1.exe PID 572 wrote to memory of 556 572 net.exe net1.exe PID 1488 wrote to memory of 324 1488 net.exe net1.exe PID 1488 wrote to memory of 324 1488 net.exe net1.exe PID 1488 wrote to memory of 324 1488 net.exe net1.exe PID 1304 wrote to memory of 1924 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1304 wrote to memory of 1924 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1304 wrote to memory of 1924 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1924 wrote to memory of 1804 1924 net.exe net1.exe PID 1924 wrote to memory of 1804 1924 net.exe net1.exe PID 1924 wrote to memory of 1804 1924 net.exe net1.exe PID 1108 wrote to memory of 1100 1108 taskhost.exe net.exe PID 1108 wrote to memory of 1100 1108 taskhost.exe net.exe PID 1108 wrote to memory of 1100 1108 taskhost.exe net.exe PID 1100 wrote to memory of 732 1100 net.exe net1.exe PID 1100 wrote to memory of 732 1100 net.exe net1.exe PID 1100 wrote to memory of 732 1100 net.exe net1.exe PID 1304 wrote to memory of 1680 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1304 wrote to memory of 1680 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1304 wrote to memory of 1680 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1680 wrote to memory of 1336 1680 net.exe net1.exe PID 1680 wrote to memory of 1336 1680 net.exe net1.exe PID 1680 wrote to memory of 1336 1680 net.exe net1.exe PID 1108 wrote to memory of 1640 1108 taskhost.exe net.exe PID 1108 wrote to memory of 1640 1108 taskhost.exe net.exe PID 1108 wrote to memory of 1640 1108 taskhost.exe net.exe PID 1640 wrote to memory of 1752 1640 net.exe net1.exe PID 1640 wrote to memory of 1752 1640 net.exe net1.exe PID 1640 wrote to memory of 1752 1640 net.exe net1.exe PID 1304 wrote to memory of 5780 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1304 wrote to memory of 5780 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1304 wrote to memory of 5780 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 5780 wrote to memory of 5804 5780 net.exe net1.exe PID 5780 wrote to memory of 5804 5780 net.exe net1.exe PID 5780 wrote to memory of 5804 5780 net.exe net1.exe PID 1304 wrote to memory of 6220 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1304 wrote to memory of 6220 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1304 wrote to memory of 6220 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1108 wrote to memory of 6248 1108 taskhost.exe net.exe PID 1108 wrote to memory of 6248 1108 taskhost.exe net.exe PID 1108 wrote to memory of 6248 1108 taskhost.exe net.exe PID 6220 wrote to memory of 6256 6220 net.exe net1.exe PID 6220 wrote to memory of 6256 6220 net.exe net1.exe PID 6220 wrote to memory of 6256 6220 net.exe net1.exe PID 6248 wrote to memory of 6280 6248 net.exe net1.exe PID 6248 wrote to memory of 6280 6248 net.exe net1.exe PID 6248 wrote to memory of 6280 6248 net.exe net1.exe PID 1304 wrote to memory of 17048 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1304 wrote to memory of 17048 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1304 wrote to memory of 17048 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 17048 wrote to memory of 17072 17048 net.exe net1.exe PID 17048 wrote to memory of 17072 17048 net.exe net1.exe PID 17048 wrote to memory of 17072 17048 net.exe net1.exe PID 1304 wrote to memory of 17108 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe PID 1304 wrote to memory of 17108 1304 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe net.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe"C:\Users\Admin\AppData\Local\Temp\66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:556
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:324
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:1804
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:1336
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:5804
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:6220 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:6256
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:17048 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:17072
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:17108
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:17136
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:732
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:1752
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:6248 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:6280
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:17144
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:17168
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
24c14182c155b7a82c25465f44940281
SHA1a5571cd1e1109dec9cd98a6519dca783e0d187a1
SHA2562b52cec942b3f254efd1109c553e4583bbfe030403857a021eda774260b29ecf
SHA512c61fb8d0c02e868e3d0e2b298441f8b6208020343176757dd4e628502cea94ed08bbb4dde7599cbf81426a891ae944b89dca6904198352a3205d4e8e8895dfe2
-
MD5
d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
MD5
d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
MD5
d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
MD5
d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
MD5
d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Adobe\Color\Profiles\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wsRGB.icc
MD5aaefcb4150d6e300a40a0c034bb0f322
SHA1e27698013726a2bbf4879e224f16733601e154e6
SHA256dffc197b49be9935b334f5b9b89a67b3865490d931e3544d5ee0de1bbdbde140
SHA51233c9ba07a2732743985fcf5de7290ca796b5718e5f082ce651ca46a9dc6b69d08f41a0dd15a718e79e047c366fa1edb6a269884e492f0406c16d9909f805376a
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wscRGB.icc
MD56cef34225e7d15a24d8e1c638aae8f1e
SHA11d5d05b6d3fe4bef2bc4693afea4e36c96e153a1
SHA256be9f192b3bed85e29a308f25e9a3c0cc577e596ecd2f5121e213dda544ae6b1d
SHA512383a65707515ff936ca4842bffb04743a2cc35421e9618119948d45d586f912d106cb5bfec83c95032bf72e667412052da466f8aec03066db865bf83c6376c16
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\ACECache10.lst
MD53c44f72bc9ee69b113994bae0a5f47fc
SHA195385cbf515600975cce6b218f89e82ef21a67e5
SHA256df2df8820a7b3cd08b6c6c1bc5413ed169825b98328f35adf379747f17068734
SHA51214ec49e31562345242f0504299a4baa8a2b378a0849e6c3ed0dcab4f2767aed6f4ab476a47c835abb69316a1da100e0b6c22f7ba70de72a51983dd00cfa6171e
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db
MD5dda620fd9bc72ef4c7088cf0ffb51bea
SHA1ff48de449a0809a304aaf7c917bcef073d21f61a
SHA256b25c526553950779af45bb956b1a563c3c9c69fd0d9f79a2a5b556b874decdc1
SHA5128a82359501d355220a161a6d55eef040f20af5a69d462db4876dcff223d5040dbeb27e05a864a62c586bbf4d581bb3fd297f5f6c3ff0af73b2547736354a559b
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ASPNETSetup_00000.log
MD5b7db5c5149a77b9a2c8a6dde70165b4b
SHA116b99f4f20fed19f05570eab4e6f1ed42104ea4d
SHA2561ad7719189a65b5c2d114ac1eca2f143a783706cb71b088a8ec800d6a1bc6002
SHA51263644a284abd55707fff84448633d5423339b89290c7e54f9d78992454d1b2a2c6fa03e753b1c3d123a0706b2106ce844d9b8d372f3988828b71d259ec812e2f
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ASPNETSetup_00001.log
MD5ea5ab990ccfba5ad20b1c3a40ee46890
SHA19b0478b490eb9382a13ee350e72b303ccd9afe77
SHA256decfdb2f3898660c3f962546e720bc5af7ae8d7d62f5683880fedf61716f02fe
SHA512e1baa8229f97fd78a9ad2666ee4790fe0a2c8251d6b777e04961ce9edd49a978923c894b8e534643b211f19c8f2e963eb24ed37ab1dee0b56350f114418609e5
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Admin.bmp
MD5d805e8ce6031c9d758b400f3e3fbc3d4
SHA1fadac0008538f1c227d4ab08cd8d803c7ee433a6
SHA25618ef17489043dddb38f85df89a39233746fafc88860723170102f066b05914b4
SHA51243b637406505490e47000297a04bc23dbd143b6c00f4557efb0219a7cc407df1fab6efb5b586f4b54c6231c484738175d3ccb319dfdf1b67df52c7053a31d28f
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\JavaDeployReg.log
MD52a157840683cdd4797bdfb453bea279f
SHA1fc07a57426ca71f9c1536d2063979f481feea36a
SHA2565a34d26a1838425bda2afe684761a807d568e222743fba51550559ef9798c54c
SHA512644606dcc2ac0f75c11461a479e36d6f89e3a3af9564e2b7cadfe16ae101bff7b239457199c9e88d5e63503ae27ef1c682f13f38ec15454b32dead09437f65d4
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RGIFCB7.tmp
MD5ca8ed7b7d4c36e9144e78ecb04b49759
SHA1ea9ca6c9f635e3f1814310c66847237c4adee71f
SHA25643eb7f20631b9af08d05761d87b639dc6e26a4dfe9b686a1a87883c6674a20d1
SHA512badc6c402c23c5a4968dee01483a69df7139d037c6ae05ecb5c0e8bca96768d8a8198cf804b519a65775280ead01539c359aa7090128db378bd2ff1abbc230ce
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\chrome_installer.log
MD54ecd1bb9acc9fef847767aba15985e3c
SHA1aaa5cf702ae27f5ea3e15d1c78943bb78930bc9f
SHA256dca2a0924d7ed9c57b1816576624db3443a0fbcf1b564846dc934dde11568d6d
SHA512686ccdd14db70c7500dae6613482ddf800ee0c42e891ff849f912173225211b46dd57d6bd699851e0dbe5e4eb63fcd4d0644415d1ecca0829030b1644cfadde0
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dd_SetupUtility.txt
MD5a4a8661112cfdb39f9be6a3f0b326fc1
SHA1eaba7612221b1348ef500e9c4a3ad2c45c5b01bf
SHA256bd22cea166d0069a7ac6596c9250bb0dd6ede1bc9d348d60fda9c92019c0d1e6
SHA512fe38ff29e32d87f898332cabd2caab1b844e11fe418835aa630edc2eaca03f6010898fb5efdb7a97697b64fa7ae28e7ca65659d5fc22b82d7f1ed1fbbe3aa410
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\java_install.log
MD5386703329df7d48967fc82cf0c6bc848
SHA1788b98f668f03d161ef4cb547b36f941c3ce7b90
SHA25666ce7c56b9b790bea6861c7fb7fe4ee4e9bca64c3539de398ee6a620ec84178a
SHA51209e35386e3a40addff7a594e7892e3a10f75a41866bf2e2a252d1e2bc61bd0e6f80018e8ecde8282c512f347b528bf36c376b42dc6a7721fc0f9175282f7d39c
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\java_install_reg.log
MD582a1c0aecb6cd278deb298af5d8541ee
SHA1e1b5c77d9ea3e9273e60b78b1eba074f15737376
SHA256a04dae234764d62c5356ccde1de5d7cf388f95978fee43426af2c5933fe94ea5
SHA51250c1424a3162ac63f52a2abc76e5e1f1fa95ca17ffdab63ecb1e203e56b57c140d0289405245ac0f2ee345d2670c31ac04b087c307cffdfa85d98613792bfebb
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wmsetup.log
MD5e04c36c719b6524b1b30abd2d1059a61
SHA11ae3f75517f77cc7528e7aa9e494f04caf6aa905
SHA256baed7a10b0cd6d8e668b5cc58df7a83d6af196b7a40755ed12660186dda6a0a9
SHA51208508a2359037e69cb1499ef02a11434b7524fa420e319c2fb736a7eede4554d598763caa1397d12c289df7877293d157b7f8946d25caf95c4f69ecd9c5c33b3
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini.RYK
MD546db4e9edc6281ff8f88b90d0b2c24f3
SHA17db535137070b541a64d0e1f8b968f73b1cefbab
SHA2563b28d3dc35808bcede96c1b72f9f76cc519cc355351f992fb7f12dadbb6a6157
SHA51283ede88fa296b1567e3c6aefe2dd6c0129f65c4d9e3224d8f52142bd1bcbab3e73a066988087849bf4c88cd925572d09ff459a489197ee24c6c472d58ec4095e
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini
MD52058abcec9883e9e87cde2c7dc7b55a4
SHA1c3facf9540fccf502f3420ab2ac6a4102a2944f0
SHA2564df401e5b944f04cc5e741c6208edf73f0e8de6f454c179aec306208c163e9ce
SHA51234e78d745fd0fe3129a2d91fb428d0ee647b08ab17674f47da473ef45d5d0b5706afb5999889692a9bf4ba91dcd8e8a048de722cfc69e4fc5cc361e9852a0db6
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini
MD5159ef8d7a821f8cceb1c33c91bc9babc
SHA11a53312dc2b7b3af2733f1d70762d54e727655d4
SHA256665ebeae8e42e76084705f00c5958e1a4e0684bc5019ecd8c9229715505c9c75
SHA51260f8e9bfbed8bb2be8449caced3a4e8bd453ba4a007d3729b8d4ecd87e88f9453ca43ccdccf42556756bdb8598e97579caa28d9049844b9dbb5b2de3603c0874
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini
MD5b4e7ae0d23253560e51245a6e28aba47
SHA19cc660eb5d4b4e84d83602979bcd8044306ccd45
SHA2561f01b779f19228d90d4079444f888943d222d3cbb48738f2177b759fee0c19c3
SHA512c17d458bfb5ce0d30b4707b06e1471f9e4edb331cd0e2df5d59a2535a11bedf051d3c7410215127647d1e25da83302a7cf0763c7359547647fbeac224ef47fbd
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini
MD5085d55e06cce51e33d2cee3a17e85423
SHA17d36d33a20deb5d04b09becb94860067c6fe6785
SHA25630b4feef4d11823c0ebc215065b9afc58923e0870ed6294a0a926c64b7816c8d
SHA512f7753164b1222d1ff59c5cf38a95d66e5cb8bb1ccbd8ca872d936ba224675a214b847fb01641e66337b9f82ba8437a19099e4e0e1edc7b179092f8ffa955d500
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini.RYK
MD52bc39f0f3a9881a9ed41b6b55ff28b11
SHA1589177798b2276bfffc0d929633d4650e98281e9
SHA2566364d6d1deec9b5d46ca45695f7723de0b4b4dc0ecfabb5465169f6c23376302
SHA512c41f73ee6ac12b035ef17e0ed4dab27187541071f0466cc9d77671e2c17e9538a8d1c6fb4c66a4d896011cd0bb157468facd88f81061640bd62c1b2b4592e3a1
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK
MD52d94daa288de134d8fc90d904ebc327f
SHA1d4eed2d527e9ec3e96046009e09b83c179abf58e
SHA2565ad7478fa2a615ad902176a30b09e60907c3c470402cdd0fb5281f7135a46dfb
SHA51239fd79408626791f61e135207dd271e329fb7be7d48bb9bbcc31b60ce1f65fbb12a45f1e58c129f9481cd9cce8078bfc86c75ba52bb1cf27f34705c3de0647f7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.bak
MD54350179eab92657a1eb7f5e2926a3006
SHA1be61ec54bf9d823766e2c1444269cc99f7c68bdb
SHA256566786c8f869c90ef0f36caf06a788a9bfe3579b259dd1f012f3434779773789
SHA512f62cf3a0289920d31648967343d4d50270be4221ae1c667ad6fd8f02caaf34a9089790e1082c07ada6381ea940a87a63f60b13cde65d2b55dea7b025760781d7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt
MD58be8b4c2809e89fa165591e26f993b4c
SHA120d712e659dbc5a303b83c2f19174282bc10bdb0
SHA256c31d0eac73efcdace7724c651194d6d3ea23d99cb41b5d6c9462e09bc5f9b727
SHA51254900f34b81dacaec1b7e1b151c693b357473f04ffea1581a46bcdf8fe2cf85be510a949ff16c53a53442c9a998cd06e656fb1199c74429f692dbf9f90f54e4f
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\LocalMLS_3.wmdb
MD5729eb05b9249a4db0e17cc0832ad7b8f
SHA10be3250b8203d9e93f917f3de0b990c99b298e0a
SHA25660c27cc92871fbb83ed19d4bde1b1dc2746bcf0143dfae9f0e1ae948cab73d60
SHA5121b16b7d8c7e067e03ac81455eff2c015e1977922aaefe1f193842cc3b684c71900b5f75f8c1d299f6a449ec487fcc3477e51646f0d297e694409a58bb4dccba4
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\PlayReady\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.htm
MD52eca01bde348ea7fda7db9eb49b7b308
SHA144408d25252427cce2ab1035b0c99af950c4d1d9
SHA2560f9230260d4be7d8619186fc67319c1db5f2ebe8468e24d394cdc4a49a81475e
SHA5124a7b3ad399ec78ea007efe2878295f7e83bbe1813e6ffa7891d835a5cba9ccc6708eaf50d38f99bc8e396663502157df9f4265b05aa453cf49226927da59d30c
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Stars.htm
MD536f46b41edfaa45eead96884be454197
SHA16ae5b59dde24dbcca634ad11a7a9436d41e047d5
SHA256e73f59b18b2d1012778bf0e9e294fd1485846ea697c3851a5d8fd696dc37a0b4
SHA51202b1ce89f8ae336fd503d16f8def8b01c7e1afb965d78e1df403aea5c6bbd4d85008e03b0b44bcac02394748a5b2cd6df4cb3cc61c16a1f305559067f2f6a748
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\oeold.xml
MD58e7d2b05c870611c601a07a62d34e506
SHA15f1706cfc6f21c1a28cf91dde66220a017306867
SHA256876e37bc96ed649ee90937cd3c5851d6040e7c6cf0bcda792d116adab9718f85
SHA5125b255edc96cd0810baec8f75c00a7e99c4193bc9debda54e0d49fb305c4b3cfa6eb754ac2c0bc572766469875190e5771965926cf5e4676ca4fac32f7fdab1c9
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WebCache\RyukReadMe.html
MD5d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
MD5
d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
MD5
d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
MD5
d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7
-
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3bd845b8-ce6a-4337-9974-31490196462a
MD593a5aadeec082ffc1bca5aa27af70f52
SHA147a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45
-
MD5
d9fe6793afc43f7c749d83875e83016a
SHA130f5fc315a83b5045215745e05055edb07652a8f
SHA2568869460caab24865dcf32cf568180dcf6259a772ea4eea1826fec3796e1dd19f
SHA5127c7b752591c9b84d85521749bccf31501168caf824bf086a5455655b61866273304247ac55ee9b51f97eea6c4d229281f4ee3fe4687d537b81152391239deef7