General
Target

13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe

Filesize

153KB

Completed

20-02-2022 11:21

Task

behavioral1

Score
10/10
MD5

71d5ee75766497e2c37b20503cf02f53

SHA1

d78c955173c447cb79fb559de122563d90d5358d

SHA256

13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6

SHA256

c365d9dd353a326814dce42cbbaf7c159b605725365dd99efcd3870ff2af31d908bc534a43e2c3c8849808736183f9bb2fbd83785bc3e42123e5847004a5f6eb

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Your network has been penetrated. All files on each network host have been encrypted with a strong algorithm. Backups were encrypted too. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. Only we have exclusive decryption software, suitable for your situation. More than a year ago, world experts recognized the impossibility of such encryption deciphering by any means except the original decoder. No decryption software is available in the public. Antivirus companies, researchers, IT specialists, and any other persons cannot help you to decipher the data. Decryption takes from ten minutes up to several hours. It is performed automatically and doesn't require from you any actions except decoder launching. DO NOT RESET OR SHUTDOWN SYSTEM � files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions. Send 2 different random files and you will get them back decrypted. It can be from different computers on your network to be sure that one key decrypts everything. We will unlock 2 files for free. To get info (decrypt your files) contact us a BaumbachJamiyha93@protonmail.com or RosanoSu90@protonmail.com You will receive btc address for payment in the reply letter Ryuk No system is safe
Emails

BaumbachJamiyha93@protonmail.com

RosanoSu90@protonmail.com

Signatures 5

Filter: none

  • Ryuk

    Description

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Drops desktop.ini file(s)
    13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exetaskhost.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Documents and Settings\Admin\Searches\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\Documents\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\Downloads\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\Favorites\Links for United States\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\Contacts\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\Saved Games\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\Desktop\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\Documents\My Music\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\Favorites\Links\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\Documents\My Pictures\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\Saved Games\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\Documents\My Music\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\Links\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\Documents\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\Recent\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\Contacts\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\Documents\My Videos\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.initaskhost.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\Desktop\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\Favorites\desktop.ini13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    File opened for modificationC:\Documents and Settings\Admin\Links\desktop.initaskhost.exe
  • Suspicious behavior: EnumeratesProcesses
    13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe

    Reported IOCs

    pidprocess
    83613a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
  • Suspicious use of AdjustPrivilegeToken
    13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exetaskhost.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege83613a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    Token: SeBackupPrivilege83613a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    Token: SeBackupPrivilege1256taskhost.exe
  • Suspicious use of WriteProcessMemory
    13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 836 wrote to memory of 125683613a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exetaskhost.exe
    PID 836 wrote to memory of 134483613a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exeDwm.exe
Processes 3
  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    PID:1344
  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    Drops desktop.ini file(s)
    Suspicious use of AdjustPrivilegeToken
    PID:1256
  • C:\Users\Admin\AppData\Local\Temp\13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
    "C:\Users\Admin\AppData\Local\Temp\13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe"
    Drops desktop.ini file(s)
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:836
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst

                            MD5

                            92fc34e90d0aeb1d563d74ece2bb9c6f

                            SHA1

                            049815c78e9a24124df6064e0658b9924055abf3

                            SHA256

                            65c796875a4a320e21bab1c59fd9644c42ad75c60cc5b543a800c953cd55bedd

                            SHA512

                            701db17170b785e586fa2435d280c00eefafffc4b425c3cbc08cd08d2347ce2bf1329246b76f78f5523e9ef4e01559e8fa01dc09a2f9fbd6a6f1f9315fc16648

                          • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc

                            MD5

                            4c81f2868c064e2ddda9bc3a723c143c

                            SHA1

                            39a5003f12b8e807a4e321d51c33e8eeef48b4d4

                            SHA256

                            d24ab962a66ed0fff0f22ef5de841b80a253f374c61bc4074548098bd760a4af

                            SHA512

                            ec5fa313c295568085246cd188ad0ba91ee0d4f4b26753fcdf9200096a0b8ab3c07ed682cbea44339ae846cdedc6944e3baa14b71059941fe814d301087008d3

                          • C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Adobe\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Adobe\Acrobat\9.0\Cache\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Adobe\Color\ACECache10.lst.RYK

                            MD5

                            e2630bf08a43a3e8a1129d7951212028

                            SHA1

                            3acad5275dcce33ad5472853f86538c9692ea4b9

                            SHA256

                            526be8ac2b5cda9f5e16015f3b44b51c83c8c1c3a1b6a1e8c07fccf9a84ffd25

                            SHA512

                            1f81bc1f479ec9c5ebf92899750a1c5d6dc222d0c0707d7a8a7058c7f09a9e5b62fc5025aa48e8159c8f2260c41d48446231da572b19d96b6f9bf50e2fed7571

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Adobe\Color\Profiles\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Adobe\Color\Profiles\wscRGB.icc

                            MD5

                            6c79de11944de038f72bb41a1bd44104

                            SHA1

                            13ddb76e2e2ed906e47c60210b630dbc1f98a235

                            SHA256

                            d7513465de88c322194ee5c94839c3c142ec5e671a256d4095f3ed36bc94a52c

                            SHA512

                            6c5e72e77c32a145b20b39835e8931924d235e2bebfb9c7b92ba630841953c8754b737332542ba6f70ce3cb9df87b89054545da41bddd68d309e53cf168323c4

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini

                            MD5

                            fb2bb4d1f16d9d0d07e59b34736b54cf

                            SHA1

                            1f67986cd1a272a1f085b03445373ed8f2f8499a

                            SHA256

                            c9aae8e501a4d35eadab2877d7c2fd705ce54c47f9ff1032b1d7c37928c32d25

                            SHA512

                            e1b543e45c1ba7f0476fdcb6c6426fc0aac33ead26c3f3d835dc8d0e9fddffd228410122e2ff7bdc485206cb64c0be3a8ce0402bc6dd48405043c26295b7a21b

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db

                            MD5

                            168d0a6907f5df777e8141b8c15eaaf1

                            SHA1

                            559d677712584b570971a099f8b7627feae293c5

                            SHA256

                            47baf97d92e470236f2622c0c11a663e330f5453c24ec9db6a3203902b37e55c

                            SHA512

                            50712cf0a1ef862b206014cba42166e3dd3a13a3b9c465dfee7ddf16a57449d95997a99db8ee9ac4e409d1e59816dc63599e69103b825c729c70691dad0199aa

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ASPNETSetup_00001.log

                            MD5

                            f4e91bc1e4324a0b652db9d8ae371833

                            SHA1

                            4d51636f62fa849b7d8ca6eeee072d4ff3fe1aaf

                            SHA256

                            66e2cd8513c14d4ac3bcbc9bc9937364e55d8432b5aa2d2e112d283259e0149b

                            SHA512

                            121d4378ff3a8aaded42e617240419d4a052e47040824f153c3952a1e4a1b83d92e87881d82551dc48b7434eeaa8331460e0633b7be16b82a5a1c369e2f40559

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Admin.bmp

                            MD5

                            0be9abd14d00b14ae380d1239bd22f09

                            SHA1

                            58c7805bfcd0802604bd35850a43f161e2e67dbd

                            SHA256

                            f00d6c77a498258a096c7dbdf6bc0ffa10aebf05722814c7a4b0a74ee79a32a8

                            SHA512

                            40d2d1d4df49b1a828ced393bb32f8a94d965298d1466603eedd650b27b58fba79b025b47289f1eb876b3a14f27383010f9a59cafcd56d29e03b816c03c476c5

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Low\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RGIFCB7.tmp

                            MD5

                            76cb2b48a421c37da8bdbab081408b53

                            SHA1

                            0b4c0d2a63a3dda84ec636a9b07628a1e3a8397f

                            SHA256

                            550db3cb7e0919f6946500f53d290fb96c83565bffeb1385898eb3eaea1aa75b

                            SHA512

                            2567244e21ee434d59f5683e5503b1c8ca70538e542b9e2b9a561d9b9e5cddbeb76c452aa97b8f9d0dcb8ab9f48ff884b615550ffe6210b7cd7c3b83867d919d

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WPDNSE\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\chrome_installer.log

                            MD5

                            d7ce7b517e0fe837bf8ccd2c1eb60a47

                            SHA1

                            d6e9dd85fc359a6cd572ba45c718a2d8c40e3c72

                            SHA256

                            c259a6e321ed6b7a902de59d85d47577c5320bec37ce52f592c1f27a6758bbaf

                            SHA512

                            119f77e46383b3cb1b05a518aa9eb99d15cb447364d4baefcc6c8ae8cad0a321c3b903641859606ae1c0d171a8969b2277f46da98792345f6aa95523dcb12118

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dd_SetupUtility.txt

                            MD5

                            ad00d6057f030ed7e8a6388d335e1b08

                            SHA1

                            4f3b4fc9470d94aa80c6dcd6942f8e4412774681

                            SHA256

                            6486bca291e7cf06c152a0217c235afaf35a0c59a01189dda466540017aba2c4

                            SHA512

                            224c221930a705481e062471af49f7e4a971d29c1250f6df5890a2ba172abf4e8c060397c093a1859477d1641d5783aa83c51c5cd811dd04b770e2a98bd7e91e

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dd_vcredistUI1E30.txt

                            MD5

                            9d75212e8491f388fa16fb20a14bc015

                            SHA1

                            a3f79682239d1f16ad7edf7de4e7bc47cb7d3da2

                            SHA256

                            2e0db77d9ec78cfda616cf90ff02223d90c4a5214bddf4392f51b46f8eecae30

                            SHA512

                            5ac22273498e13a317a6b9a9d6f5bb1f22998f1868e2804749ba9b3780cb34cee16aec192ca71942550339c59ed98308ddc72d821e1db7404d6e455b9ab2be32

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\java_install_reg.log

                            MD5

                            f3964753f4cace32155d514d1cbe199c

                            SHA1

                            b73ddb922b24ec9d3662162cee7aa46e0e7398de

                            SHA256

                            5be586931952e9e727aef6a999537a890b35d73b0ee4d3aa0ab1d3a0fb1582ca

                            SHA512

                            d1c2992dabbae03925bd240f942cd17a2b74966977bf36be35d394396579e1b04dcbbf466fffef94fc8d647ab008ff1edbac1a7738de895f1c8e7315e28068aa

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini

                            MD5

                            6efeda8f1b8339db00c987f9da49dd90

                            SHA1

                            a6f218e6ab4be907c96ddbc32b773ca1e7cffe19

                            SHA256

                            f9a74a2d46225d72482005dc602741221ea2680baf8837a2b0d7b86ff5910423

                            SHA512

                            12525a1d2642ae57faf5c5b6bab98b9fa454699f558007d3b949b2db691261eb5451f4ba87faafdc23366528d2d22454b17df686760afa713fa0c9f8d04f25ea

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini

                            MD5

                            f1603dbd20adaf8adffda74036d66446

                            SHA1

                            af4dcafd49ef97fc4d0d15f4ae967bfc36ed6a59

                            SHA256

                            f927f79817b2b936a96e80856577a1160ced9641dd1965079196bddda98c973f

                            SHA512

                            ce10ec9258202aa5bdd31bfd7b1f6c9c30aa487213dcffd269c3cee0f2753fcf26877473c3a781b6e973291de4ee2a8a44f48e4325a99cb80c57c20a03000c83

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini

                            MD5

                            17a02f043c57fc2d0b5c1616fd9400b6

                            SHA1

                            eabdc29de19dff3263b67a9defcf9ff9418f29a6

                            SHA256

                            4591ad8efc8345fe42c582280078b71bc8486796f1b6180f88bd4c833a83522b

                            SHA512

                            60644deb204c7c8393462fe085a297e95ba30020d06f336fae1fbbbd94c7bfab03b6d43fba6b0daf9a0ddcc506cb20bb39abd140dae0565e535ae9422f7fa8e4

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini

                            MD5

                            147052848995d2868073fe787bcea8a8

                            SHA1

                            d14e17910470ba27ef6133e814f642711b1b7af3

                            SHA256

                            9255acf4b2d325d68505273d33de0333bc02e4d2f9bc3f86c824a7ec6a311c02

                            SHA512

                            2f7144618695545d708c661839202f414823e5a69a5dbd4ffb68ff7653d96d34d93a3f4cdd5ebcd6662a21e98cf15a0ae6fc1dcccb9b76222ed642f8648113fe

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\LocalMLS_3.wmdb

                            MD5

                            fbd5f2f451b448f1bb4d270e95838c88

                            SHA1

                            42d585840e46d3d115b723df410b7728b6d8140a

                            SHA256

                            7673c7e0a4ad9d5af28dfe90818c71b211b05384a71926f7fddf70c7502f2f81

                            SHA512

                            043fd02ae5ee89e40e6f5816b4492bd8520f6983bcd58aa8b3b92c19d7328907e72a5a0ab87eadd483b48b19acf16f5821130a8c4eba7ebb4dc8d20fd0c5e933

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\User\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\PlayReady\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.htm

                            MD5

                            fb0571c8a502ab5d30749b32a20570f3

                            SHA1

                            63482f6dbaa163b9a48c270b4a67d0564ad190eb

                            SHA256

                            e1d5c812bc2ec6e197bf3db601e00cba13b140f643a2ae7ba17a976be53bfdda

                            SHA512

                            ee77d05dec6c6e6ce1a57b6d8875ce991074f847a4923d14216240b91214144ae4cc054f9ad223f3c9430ed8cddc750bebcf9003174b6ccad2d11e82372d0893

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.jpg

                            MD5

                            c9dd673a814e7c03c61ff803284460a5

                            SHA1

                            df2454ab676497fb3be91986e34d63a9665d203d

                            SHA256

                            79ca3f4ef9f2f422864f269a9cf4bd21da62d3d5c5f30e0418f5bdef44f9f200

                            SHA512

                            b7a27d6a1dd5562daedd3fb40316f3ea1d71302bfbedc14d3def7cf8fccd1864ee370e2d5f4c385fc253a052575cbee150ea756cce97f63488a11ec57b3d9cab

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Graph.emf

                            MD5

                            6568ab0de913ed0ae0699f04006a6728

                            SHA1

                            5f8e39c6fb3b811a0a5357f4467f40ec699a8fa1

                            SHA256

                            4767e0e86a14d1a459e764f7db0ef9298d475860fd883ecea3dee7c8ac887ba9

                            SHA512

                            0df83b4f467b351042fb02b00e82d5c3b337c8caa34a535493657946061e97756462b6d39d6ce119349f767e967b24700e015bf8a16330d4c30ef3bd0fefd117

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Music.emf

                            MD5

                            ea84bf01c7e5630d3e6658f33ef5e85c

                            SHA1

                            ac2913ec01c5b947d91b2bdcbbca2d68bfc8d2cf

                            SHA256

                            6d9737039c155ccf7d1ee4beddc4edc91de18d59f9e325fc47c865e8377af6f5

                            SHA512

                            88e61317c6679a46ff9da00631d6b18a02599f7e742377b5f1b4b8fb464cfcbe0151fe70b7da5024ba57a059964359cca717f4ef4a502d96c0f5e077af51ffb0

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.htm

                            MD5

                            ebd150f026b470f3d41ddac6a86dd00c

                            SHA1

                            f9a9416a052361428f7b82ebbe66e52cfac8b9de

                            SHA256

                            19d3fb466e43f393a7dcd7a9dfc973947fa7e2fe5a0b5c815425705122b5f891

                            SHA512

                            6cbdd78c9237007a0675cc5e09457d7ad42b993c1b7298a396a166d2f6bad70f7299cc9c6e634de59f2f4d758a2fdf89d10671d0b66e748e2a7547bca29eb906

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Stars.htm

                            MD5

                            64cd8e7fb198c8b510f579d40e7fc608

                            SHA1

                            60f7f12928bad6bd23823c3bf9c1a3d5f5cc21e7

                            SHA256

                            12855cecd342ee6126c680c2b72f33eed01d84e77a1c358471303f281d9a519f

                            SHA512

                            e22d4bee08b8e51a62a025c49ac634d4b4c7c93880251567df09b959d6456e3753c5724abbde3bd30381550aee4e6ba11ae5c4e4eae54e696d118e6ef07bf2bc

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Tiki.gif

                            MD5

                            aa0bb4f617673873415a8921ca96026e

                            SHA1

                            2bae9bdedc0517deea87335285a68ef675cb166b

                            SHA256

                            52bc5497164518914f4174031faeefa7a32f405659769e28949372c302dccbd5

                            SHA512

                            5dfb437038c8f0f2311690ad0d22c1326f15f8f065be6d839604a43c4d313b26b6258912311a7a14db88c33de49ac5b4a1ff99780bdc52e9884a0d19579f3408

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\oeold.xml

                            MD5

                            5fa3a66a1faaa089a8904cedc13a0f91

                            SHA1

                            bf44beb6a33f65f9e49a515f4a00e63844710613

                            SHA256

                            5d6691226fd997fdf995b0eaba8c46cd277112f50d3d84a67ef3e16bac2149db

                            SHA512

                            ad554f01f6efe239bf25afcd1ff8a375974b96bcd90d728271d8d50db7875ce8592c661a29bda70a474ef7b11c951b007a02fe89563969b07ea84482ca666a94

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WebCache\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\AppData\Local\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\Documents and Settings\Admin\RyukReadMe.txt

                            MD5

                            b1016707273de1fe7f068013a00bf8f0

                            SHA1

                            c3141af6ffbf9c66c8cf987ff91630eb8f5a8187

                            SHA256

                            07f9f88e9fe7ac78bf2c4fcd2fc3cad89aca019fd87e525dd46a5cc8d1a5b50e

                            SHA512

                            694a792d2be56b6f4237a74292db64dc47995e5d0a9e5d4c619a9989fb47a7feebcf33f1f669b3009e97499b0dd8a08fc74964ebea62e8e225649b9627e07c35

                          • C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3bd845b8-ce6a-4337-9974-31490196462a

                            MD5

                            93a5aadeec082ffc1bca5aa27af70f52

                            SHA1

                            47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

                            SHA256

                            a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

                            SHA512

                            df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

                          • memory/1256-57-0x000000013FA60000-0x000000013FDEA000-memory.dmp

                          • memory/1256-55-0x000000013FA60000-0x000000013FDEA000-memory.dmp

                          • memory/1344-58-0x000000013FA60000-0x000000013FDEA000-memory.dmp