Analysis

  • max time kernel
    180s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    20-02-2022 06:00

General

  • Target

    6eca3f416a08fde6688250dbd4ba4dfaa3df95a5d26b6d978dfbd67fbd159619.exe

  • Size

    123KB

  • MD5

    170e82abf8cd1e4c2f360795eeb4e78f

  • SHA1

    1b7864fe3338bfdc312c0159ee5cb3054d9d3add

  • SHA256

    6eca3f416a08fde6688250dbd4ba4dfaa3df95a5d26b6d978dfbd67fbd159619

  • SHA512

    83d9558a7b3bef56af0833f016f75f7b649b21ef300d0369ad0e2bb5bf11818c1a9cbe632c062fa7c896fb266392e595957806e9f90b12d42444bccfe3ee5639

Score
10/10

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation. More than a year ago, world experts recognized the impossibility of deciphering by any means except the original decoder. No decryption software is available in the public. Antiviruse companies, researchers, IT specialists, and no other persons cant help you encrypt the data. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions.Send 2 different random files and you will get it decrypted. It can be from different computers on your network to be sure that one key decrypts everything. 2 files we unlock for free To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 12vsQry1XrPjPCaH8gWzDJeYT7dhTmpcjL Ryuk No system is safe
Wallets

12vsQry1XrPjPCaH8gWzDJeYT7dhTmpcjL

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Drops desktop.ini file(s) 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1396
    • C:\Users\Admin\AppData\Local\Temp\6eca3f416a08fde6688250dbd4ba4dfaa3df95a5d26b6d978dfbd67fbd159619.exe
      "C:\Users\Admin\AppData\Local\Temp\6eca3f416a08fde6688250dbd4ba4dfaa3df95a5d26b6d978dfbd67fbd159619.exe"
      2⤵
      • Drops desktop.ini file(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1448
  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1360
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
      • Drops desktop.ini file(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:1256

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst.RYK

      MD5

      47c1f2064aacc816ded9c86466ab8b23

      SHA1

      bea7490ad075ccbe5be81dc7603ca2a3d6980e10

      SHA256

      797468ae93d9cc533f72e3b89dbe3f62ebd93053d55f2c66719b5b28b88f495d

      SHA512

      12ddced674e666070fbac5eec26d4f767c53eccd7ce24d3b426444b55ee37e8dfbb174e41510bf62a084bc1d82426afc061d070a43ff9fe15f806a140be6990b

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK

      MD5

      f08988ca7242105afb9420ece71b13f9

      SHA1

      e755cf46e0eddecab03e54d8bdacdd25ebbe01b1

      SHA256

      48b548776008536c9732bc6349ccad63c3e83181c576c554893cf9b2a16ac062

      SHA512

      94ef880d5348237676c08724b74dc7210068ab66a083ae103945cd3eba0823f2523ad8e586c322139bb50ab7a75938a28f51bd9d82957d81aaea31e7b22aa2f7

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Adobe\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Low\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WPDNSE\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\User\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\PlayReady\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\Local\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\AppData\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\Admin\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Documents and Settings\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_bc8e1036-7fb3-448e-8ad9-a824b1a03b8e

      MD5

      93a5aadeec082ffc1bca5aa27af70f52

      SHA1

      47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

      SHA256

      a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

      SHA512

      df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

    • C:\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Users\Admin\Desktop\AddGet.TS.RYK

      MD5

      77f9cd4a5fc9bd64eb0923f9b53b93a0

      SHA1

      462efa89a4420a52df9e74333bad80548587914e

      SHA256

      9c66291f308f2ace83678e9a883d44abc22aff0f7a6d35bd77215d3b71aa69ef

      SHA512

      e8c0927e2b050bfa87f8666cd7eaf322e43bbc54576e29e12e690959d1bdd077586d1c5ef50140282f8725f30e877692025d54519de737641fa1ecc1a5bd293d

    • C:\Users\Admin\Desktop\CompareClose.raw.RYK

      MD5

      0f24decb3c39ded309043652d0148357

      SHA1

      34723720350262646a72f0f9aa0acb8cba065fa0

      SHA256

      baa7e3bb721f138595fd529e30b4501860157117a6ccdd1a798992a29ca5314e

      SHA512

      abd42325276788b10b5bc92a8a371d90adff163fa5d727c681b670227c4e3f1f0686df8c294986303d67e4c85a391e6c2214d48f5e27d1a15a59ba6f7adad1cf

    • C:\Users\Admin\Desktop\CompleteImport.3gpp.RYK

      MD5

      d82e992489073ccfaa07ea10ad674f4e

      SHA1

      49fb71a114e32472967467451f294c086cb24ae7

      SHA256

      f1e67e338f56fd7a30eb56b15c79659fe03958a7c1e803540178313ec6303641

      SHA512

      06e7835c2776b24b3a79b75aaefc9642be6fb80677c2887a431cbbf1eb3b885edc3139199c42b58993981f4a494e913e5b52fccd9eaf5a97a8022ba744e8cafd

    • C:\Users\Admin\Desktop\ConfirmInstall.html.RYK

      MD5

      9df2242a888324c08e232f19165b6ecf

      SHA1

      093846f2b86ae2c5d4911c3783b937888ee9d799

      SHA256

      e414e5d097cb19f305b7af90eac1a27db0f7256a8152a1f977029c1222ed22ef

      SHA512

      697e5a454596f0d9a069d483f7ac34459de6871e8858190de233b78c8be7cddcde736fd43ddbebc846873bb34532d7064380352fd3c0081d7d50d9cbe8d42ecd

    • C:\Users\Admin\Desktop\ConfirmOpen.dwg.RYK

      MD5

      5347a316afbb6b4aeef376fbd2ca74fb

      SHA1

      9fb5cfbe41dd6dca76ece00961cbc081a0bc3a46

      SHA256

      4d6dff45636ef0529c83af28dae6f73577a89175312749a6c47655c6718c5335

      SHA512

      fdfd9d223defd77377f7e15cc451b7f257f9e8c26ac1faa3f69962e51daccac0ea24beae06e52d0977f383a57a5ecb643944b96b9431165977d5c1624f94529f

    • C:\Users\Admin\Desktop\DebugSwitch.vdw.RYK

      MD5

      c1085df14337586104169841a7cead39

      SHA1

      b687dfa1f57e35b73a16366cc76ea39b7df97198

      SHA256

      594fe12bb648591ab5bd634cd4c5c35bae6f5031c79ce7f4fdda63f09542ba65

      SHA512

      88d5fd9be6c468b9535fe67cfc5225972dc80561aa4224f2dd8647f1d74e51d6114965015a82fa482df25ac51ba2699ff45335a5cbdfccf89e7dd7561203fa78

    • C:\Users\Admin\Desktop\EnableRead.xls.RYK

      MD5

      28eafc8742ad0ab56c09eab4e499aa5c

      SHA1

      8f6dcaf2dda7792d7256a7cf2da912b0e0e60731

      SHA256

      a7f143d36dbc42d3a30a66980933d3f3525e37e8dbed0dff51afd2550583071c

      SHA512

      bef69269761cb319a5403ae4a69222ed6eadd5b03525d41b7e60e6346be5e6df66d8ca843da65e71b144a3ce7d53bb79cad3f7ccb2dc2d0030a81cf2c5ec6d75

    • C:\Users\Admin\Desktop\ExitMeasure.7z.RYK

      MD5

      8ccd984f1d4d5e70f2824f46de00d8d2

      SHA1

      99a295fac5be217708148c2bb45f5f13b728a94b

      SHA256

      85a396b20a97eb6fd0eb26cffc3b4bfaf8e708ea028673092b4185123563a712

      SHA512

      9891f2aea1ed87391f378755e31ee60364e7436b321da373685176c9aea39c297ef5a2dddc7e79375f88b0069647ec742520cde88747047a7132be58709d63cc

    • C:\Users\Admin\Desktop\FormatConvert.php.RYK

      MD5

      091f9f402e6d5eb34af7ad3910bddc86

      SHA1

      0e2270833e721c7cc0d243f124f2dbad0e0ce08e

      SHA256

      90b9b3ba6921dcd9609fa96826181fab9a230d43a8a5ba9f88b803a78e134034

      SHA512

      c919d04145cd70c4a6c44b56c24b2c572a1b7cade74a659aebd8647ce165a7752114ae8cf61d31da0eeab8686059dfc519d0ab257fdc200567f64cc085656f97

    • C:\Users\Admin\Desktop\ImportNew.xps.RYK

      MD5

      316094e6b6ba8cdc3afaa6558ae7290f

      SHA1

      d3c5a00bccad1c1a28b2f26e63203875525a3c74

      SHA256

      1cc61e0c5cce004d45378aee44c0e0f1a6f9dcf047094bb3f2c6e9cecac51559

      SHA512

      f0f064cc8d14352ade439a938cc01b6e3d050e89c0ba60db9a225618b56769b9accea259f56e283a71ead7c1e82080c1e26bb3a89025bc933b8db56f04302126

    • C:\Users\Admin\Desktop\InstallTest.mhtml.RYK

      MD5

      224b59a3b2b53a660f4dd284c0777197

      SHA1

      7a103822faf5fe52c0fc82a66f83c7ea9c6e9d81

      SHA256

      f4e002bfc5366b182cbe3b4a9d42e9adee653b3d21c402b1284292768c18e921

      SHA512

      352b32aa29ff3d83928c3a7a3ceadca6bc34b732b2827b76d65a6f029fe67ad0460608e8c0e7fdaec5b8d8fc2ccb0ac58e8465e9d070013dee779aa7435de23d

    • C:\Users\Admin\Desktop\InvokeConfirm.pptx.RYK

      MD5

      f501d84724b1b4c3461c5dc6d8aacaf4

      SHA1

      6118ccdd98e38e16f73651a2f60270307bf195a1

      SHA256

      2ea7740b7b262284474e302e49c7896b52e58f43c3314d7cf4ff4124c73c310a

      SHA512

      c3a5bb57f04b1701b532af37cabc9ca3a9da4955c0b095622ce4b6388e8e4d705e79833120034c82061447500256058b34afa9f644474ba87f651e79810ea8f6

    • C:\Users\Admin\Desktop\JoinEnter.raw.RYK

      MD5

      d6975d109d936118df05e79dfcf25076

      SHA1

      b8c200e211de34a8d01368659885805af6010db7

      SHA256

      6748b40c8a8b30944170ca919a60ab6e4bdb6f9f8ea04b28f7e0e2afb8a1de61

      SHA512

      3f0181d86ed3a245c70550ff6555a5a7afa444716f07dd5099d927913c37e7bf929eba9832ea5503cd199238e9d00762c38c6e6c2045f3db85530de3305f137b

    • C:\Users\Admin\Desktop\LimitUpdate.ogg.RYK

      MD5

      a6c10797e85026197b3689ad9cf7bd67

      SHA1

      baf28b050e64203965ad8d9114d4e43c4acee157

      SHA256

      7a08cf4467ba41fb3022ffa673332a6605849604dd8e5cee1c5a5456a4b46bd4

      SHA512

      5afc65bdbd66532b64d4d5fdde9f1f48bfc6c1591ebb83d101bec7c406734352c5ac100facd49023bec7135e38b3ce4249658b0ae673e741f64d8026a8f45537

    • C:\Users\Admin\Desktop\LockSave.jpg.RYK

      MD5

      b0248b0ca222bb212b55fe6c5e29f020

      SHA1

      e9ed0ca996c4f5ded2aebe91f877ad5549c80e87

      SHA256

      72ca1116663a08912f808b2707da6821d270481ce6d532a974f495509a42d0c9

      SHA512

      1b0579b7b0f52c814f6fad2ddc58343454220e954ab8678f79b2a477488cbdfafdfa9ca5037e6d19e339251fd67fa8388b51d97d6aa71f5d25a1c5aa00d5c285

    • C:\Users\Admin\Desktop\MeasureExport.dotx.RYK

      MD5

      6609eddbee1fce4aab042af83f7fd287

      SHA1

      7530d37dfcb56ff68c2702ee487542a5f69321b7

      SHA256

      e2f0db9624640a4e21e11427cfdc4bc80c233ec85c5e69979c55b544871ba372

      SHA512

      01461380749a821c1cc91890247f4d5801f987c0b453a01fca0f70e144de305e59312f3901c8b28368d9b87d7fbfd7ca106bf3609213e25b816eedc1412eb0ee

    • C:\Users\Admin\Desktop\MergeUnprotect.emf.RYK

      MD5

      88c9f704794d86f6651dc81a9970db08

      SHA1

      2e9ececc8bce3bc623d595f3dd3152ecce9f3261

      SHA256

      2eb74f78aeda0468c0ea91b2ad611ad913749ac9d10cc08adbaf88ab76b96c23

      SHA512

      9bd1857756dd7cc79db6efd9c481f3c5750e0e00bcdb6b4f0f85b48e11c39787c62d1bbdcbcc5bcb5394e56298d8e687e55079f5ef7e337a7d6868a2ba563a42

    • C:\Users\Admin\Desktop\MountImport.wvx.RYK

      MD5

      036da0cac3aff00d98ef1295700bb794

      SHA1

      a2f04d6a61e1020aba4a4d9d443cd1a1bdbcaeeb

      SHA256

      d2d94baa8d599bcb88e2e7a8de0bcf822e231bc8530715f147f0f8f8ce3560cd

      SHA512

      8f8f69c8166cf45a8e5cab010acba7848d529cf8daa1be6db17982dbe3d7bcdbd3b36d0e288f75c9d47550f489a6e13d055dd1e6cf5d9ee4feca1e1251788156

    • C:\Users\Admin\Desktop\PingPublish.htm.RYK

      MD5

      45de5bb350be022b98522ebba161be20

      SHA1

      a98dca063d736b08c1bf6d7a3b8e86825f108bbd

      SHA256

      1423e3334a20c649c4b0213d5c82b0632df31966c9e65fb2523a7facb6319eac

      SHA512

      4ff22fe700b9b792cb5a0411eefa60b59be5e4f794fbd3e88f5d032803eabbd098532e42409be65d47015b71ab6d57aecdd5141e37eaf79474978aecc489f5d5

    • C:\Users\Admin\Desktop\ReadInvoke.vssx.RYK

      MD5

      16f72dfefaae2c17179555d282f57d60

      SHA1

      a25ccabf8d156d5f7c862987a147bac30083a77b

      SHA256

      fb71ef85255191228611f05dca7c8b556a9d223100120dada6f629b2f22044fa

      SHA512

      a2146a9e04b5aaabf434c03008d8fa7176c88845e842c43b47ca38f0de91f6c0236dd52357987b93f3ce186fca7fc1fdecf4c5c953c8af5f154b35b3a4862ada

    • C:\Users\Admin\Desktop\ReadUnregister.temp.RYK

      MD5

      8b75eae6f79f5421263c3720a273ec00

      SHA1

      988d14e1a6011353cf50855af7e13db75ecf5587

      SHA256

      7f26310e097c218e9d7e27bf80c3f43444aee09e003ef5b015ecfd98aaf2676f

      SHA512

      f59fa04f005e242b48b818f466801d30b456ed1129cfa9d1c3493981331eb316e2f4b9f3e9814824b098c76b82503964e133f43cff1e178e795a0798a23204be

    • C:\Users\Admin\Desktop\RedoCompress.pcx.RYK

      MD5

      3ee6157fc0e07085ece9dbdaadef5a1e

      SHA1

      17b2e5492ba4ddf2ae3ed3aec2c9fa437be8cbe3

      SHA256

      d65b96165e9faf85e26c8a329163e4a5ba221158de29fdb4a29cc2e854794c95

      SHA512

      b583e270764455ef1528176fd291564c05b15fddb872d6427689dd36a6db58a802eb43085489ada07e482b79958a52aacdde8329916667338921074309e9e545

    • C:\Users\Admin\Desktop\ResolveDeny.xlsx.RYK

      MD5

      09dfabcdffadbb6ba85d4f4fe2cf3f54

      SHA1

      1fde44621fdb3d19b8e7cec99bebb934af078e2b

      SHA256

      6477305d8662fada40f2fa4e3ecd3f1e6a0a654baf7b885719343cd9828a9724

      SHA512

      1cd0cac376e3d744b9c0feb61273690a3dc8c77ab0fb4a955c0d0124533d4f14116b4054fe1571014ec41e1bb229e29867800d2633d654fa476fcd18d2e97aa7

    • C:\Users\Admin\Desktop\RyukReadMe.txt

      MD5

      697717913c380fcc0fa51c080587d09f

      SHA1

      ff8d9cd0dc02f0e088595ed90a2b28a0cd5a71b4

      SHA256

      d60544ef96ce4e3de24d3ddb83de99e20db1388e7722c7fcc08eb54d1cf975df

      SHA512

      d2d9e4e28e4639181e1a1a0ad644bc7982305f448b24016c4ea56c59a9bb26ffef1736e4955e40d490dab37d73d54edaae0b23ee813542f3534a96cb863bce11

    • C:\Users\Admin\Desktop\SelectConvertFrom.xlt.RYK

      MD5

      9a67deb388c3a0aa002355c442849a55

      SHA1

      9bd6b8eb9262425cab11ca61acfd703bd8ecf66f

      SHA256

      07d45c1b2910ad6bf47884a681f441acd1784a17432e5579aaf71557f2d52e3e

      SHA512

      4ee1e46c5df22d1d3e0964c080cf0c949694ae7521d54b7f8e04a695ddab9bcc22ad0d49145ea878ee298d8733b6fa98642c0801dcc5248b213a8c77f88a2783

    • C:\Users\Admin\Desktop\SkipEdit.wax.RYK

      MD5

      73abb93f077f89d86e719b8e9c178b1e

      SHA1

      630af5d996b3e43e1cb750c6a7ebdb12e2858de5

      SHA256

      9c429e804839243ff0a760a9ca751d124f21c89d925194800d01a5ad47f419c2

      SHA512

      ded270eaeef6c73b8a8886f675603033060f006d8b1929a10fe55009d051cc7346df80021f31953596be2968e41933e92035265dcade64073aae31abf0e86f53

    • C:\Users\Admin\Desktop\desktop.ini.RYK

      MD5

      ae5d26935ed13598319d5e19e9667754

      SHA1

      fa96a484e2e01774908f69d6ab418ea37a0c0e34

      SHA256

      ac757cce5cee2d536e88698a2b3af213e78095410540947ea6753337a16b0809

      SHA512

      cddf0fc093cd30b87cebec3bb351b5f122cbf65c821f1bb866cdb0dded64943b1b3797f8e4f922dd6cb47a6c3abaa1d0642ddb4f4dfbe0196e4f8f49c271cd1e

    • memory/1256-54-0x000000013FC70000-0x000000013FFF1000-memory.dmp

      Filesize

      3.5MB

    • memory/1256-56-0x000000013FC70000-0x000000013FFF1000-memory.dmp

      Filesize

      3.5MB

    • memory/1360-57-0x000000013FC70000-0x000000013FFF1000-memory.dmp

      Filesize

      3.5MB