Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\1073r.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\QXfapkxfElan.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ugHVwdTbalan.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A

Modifies file permissions

discovery

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\icacls.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\icacls.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\icacls.exe	N/A

Enumerates connected drives

Description	Indicator	Process	Target
File opened (read-only)	\??\K:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\L:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\R:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\S:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\Z:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\V:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\Q:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\Y:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\N:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\M:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\B:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\Y:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\J:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\M:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\I:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\A:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\H:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\P:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\Q:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\S:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\R:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\L:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\X:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\W:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\E:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\X:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\T:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\O:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\T:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\U:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\V:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\P:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\J:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\N:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\G:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\E:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\G:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\I:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\O:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\U:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\K:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\H:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\W:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\Z:	C:\Windows\system32\msiexec.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\Program Files\DVD Maker\Shared\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\7-Zip\License.txt	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\en-US\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\Common.fxh	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\msadc\adcvbs.inc	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Internet Explorer\Timeline.cpu.xml	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\Installer\f79e591.ipi	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\	C:\Windows\system32\msiexec.exe	N/A
File created	C:\Windows\Installer\f79e58e.mst	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\f79e58e.mst	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\MSIE956.tmp	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\MSIABCA.tmp	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\MSIAF83.tmp	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\MSIB8E7.tmp	C:\Windows\system32\msiexec.exe	N/A

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Windows\system32\msiexec.exe	N/A
N/A	N/A	C:\Windows\system32\msiexec.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1956 wrote to memory of 2864	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\1073r.exe
PID 1956 wrote to memory of 2864	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\1073r.exe
PID 1956 wrote to memory of 2864	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\1073r.exe
PID 1956 wrote to memory of 2864	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\1073r.exe
PID 1956 wrote to memory of 2852	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\QXfapkxfElan.exe
PID 1956 wrote to memory of 2852	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\QXfapkxfElan.exe
PID 1956 wrote to memory of 2852	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\QXfapkxfElan.exe
PID 1956 wrote to memory of 2852	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\QXfapkxfElan.exe
PID 1956 wrote to memory of 2984	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\ugHVwdTbalan.exe
PID 1956 wrote to memory of 2984	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\ugHVwdTbalan.exe
PID 1956 wrote to memory of 2984	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\ugHVwdTbalan.exe
PID 1956 wrote to memory of 2984	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\ugHVwdTbalan.exe
PID 1956 wrote to memory of 2648	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1956 wrote to memory of 2648	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1956 wrote to memory of 2648	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1956 wrote to memory of 2648	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1956 wrote to memory of 2012	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1956 wrote to memory of 2012	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1956 wrote to memory of 2012	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1956 wrote to memory of 2012	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1956 wrote to memory of 2536	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1956 wrote to memory of 2536	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1956 wrote to memory of 2536	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1956 wrote to memory of 2536	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1956 wrote to memory of 2384	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 2384	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 2384	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 2384	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 276	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 276	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 276	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 276	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 1736	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 1736	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 1736	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 1736	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 2384 wrote to memory of 2432	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 2384 wrote to memory of 2432	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 2384 wrote to memory of 2432	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 2384 wrote to memory of 2432	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 1956 wrote to memory of 2380	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 2380	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 2380	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 2380	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 276 wrote to memory of 1604	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 276 wrote to memory of 1604	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 276 wrote to memory of 1604	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 276 wrote to memory of 1604	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 1736 wrote to memory of 1072	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 1736 wrote to memory of 1072	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 1736 wrote to memory of 1072	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 1736 wrote to memory of 1072	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 2380 wrote to memory of 2524	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 2380 wrote to memory of 2524	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 2380 wrote to memory of 2524	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 2380 wrote to memory of 2524	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 1956 wrote to memory of 2308	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 2308	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 2308	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 2308	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 2992	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 2992	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 2992	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1956 wrote to memory of 2992	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe

"C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe"

C:\Users\Admin\AppData\Local\Temp\1073r.exe

"C:\Users\Admin\AppData\Local\Temp\1073r.exe" 9 REP

C:\Users\Admin\AppData\Local\Temp\QXfapkxfElan.exe

"C:\Users\Admin\AppData\Local\Temp\QXfapkxfElan.exe" 8 LAN

C:\Users\Admin\AppData\Local\Temp\ugHVwdTbalan.exe

"C:\Users\Admin\AppData\Local\Temp\ugHVwdTbalan.exe" 8 LAN

C:\Windows\SysWOW64\icacls.exe

icacls "F:\*" /grant Everyone:F /T /C /Q

C:\Windows\SysWOW64\icacls.exe

icacls "D:\*" /grant Everyone:F /T /C /Q

C:\Windows\SysWOW64\icacls.exe

icacls "C:\*" /grant Everyone:F /T /C /Q

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding F3B6DB8E1751B1E9744EA3F87547DFA7

Network

Country	Destination	Domain	Proto
N/A	10.127.0.1:7		udp
DE	167.235.102.92:7		udp
N/A	224.0.0.22:7		udp
N/A	224.0.0.251:7		udp
N/A	224.0.0.252:7		udp
N/A	239.255.255.250:7		udp
N/A	10.127.0.1:7		udp
DE	167.235.102.92:7		udp
N/A	224.0.0.22:7		udp
N/A	224.0.0.251:7		udp
N/A	224.0.0.252:7		udp
N/A	239.255.255.250:7		udp

Files

\Users\Admin\AppData\Local\Temp\1073r.exe

MD5	89895cf4c88f13e5797aab63dddf1078
SHA1	1efc175983a17bd6c562fe7b054045d6dcb341e5
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA512	d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

\Users\Admin\AppData\Local\Temp\1073r.exe

MD5	89895cf4c88f13e5797aab63dddf1078
SHA1	1efc175983a17bd6c562fe7b054045d6dcb341e5
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA512	d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

C:\Users\Admin\AppData\Local\Temp\1073r.exe

MD5	89895cf4c88f13e5797aab63dddf1078
SHA1	1efc175983a17bd6c562fe7b054045d6dcb341e5
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA512	d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

C:\Users\Admin\AppData\Local\Temp\1073r.exe

MD5	89895cf4c88f13e5797aab63dddf1078
SHA1	1efc175983a17bd6c562fe7b054045d6dcb341e5
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA512	d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

C:\Users\Admin\AppData\Local\Temp\QXfapkxfElan.exe

MD5	89895cf4c88f13e5797aab63dddf1078
SHA1	1efc175983a17bd6c562fe7b054045d6dcb341e5
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA512	d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

\Users\Admin\AppData\Local\Temp\QXfapkxfElan.exe

MD5	89895cf4c88f13e5797aab63dddf1078
SHA1	1efc175983a17bd6c562fe7b054045d6dcb341e5
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA512	d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

\Users\Admin\AppData\Local\Temp\QXfapkxfElan.exe

MD5	89895cf4c88f13e5797aab63dddf1078
SHA1	1efc175983a17bd6c562fe7b054045d6dcb341e5
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA512	d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

\Users\Admin\AppData\Local\Temp\ugHVwdTbalan.exe

MD5	89895cf4c88f13e5797aab63dddf1078
SHA1	1efc175983a17bd6c562fe7b054045d6dcb341e5
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA512	d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

\Users\Admin\AppData\Local\Temp\ugHVwdTbalan.exe

MD5	89895cf4c88f13e5797aab63dddf1078
SHA1	1efc175983a17bd6c562fe7b054045d6dcb341e5
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA512	d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

C:\Users\Admin\AppData\Local\Temp\ugHVwdTbalan.exe

MD5	89895cf4c88f13e5797aab63dddf1078
SHA1	1efc175983a17bd6c562fe7b054045d6dcb341e5
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA512	d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

F:\$RECYCLE.BIN\S-1-5-21-607259312-1573743425-2763420908-1000\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

F:\$RECYCLE.BIN\S-1-5-21-607259312-1573743425-2763420908-1000\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

F:\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

F:\$RECYCLE.BIN\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\$Recycle.Bin\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\MSOCache\All Users\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.RYK

MD5	999a5eaa71a400b38d74b3fae798a263
SHA1	cefa9e9992afa4112700a95dbe270f2d3687b559
SHA256	8ad5059b7b8e351d0bcf7c8b58edaa400fc628adf150f25f4dc4eba27649c189
SHA512	fccc79a44c4389922937d24a2dee8ed5e5be2aae167f1602baa2f12051b70590288f8ae8257d5e3eff3971941a56ed7f1f3f93bb6ad20fa93e6cd9eab0805c31

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.RYK

MD5	4750e334a10249323c9754a0414f5d9a
SHA1	6d16b48cb035d653c48a72b2c4cff08ca7bce54f
SHA256	68504221f87fd7431be72b87293492bf2575c94974205344d5cb0b922722fc61
SHA512	28e282fbd4dbbe6e5bf764b1854a73511386fe867e00c334046b5143a4794c2b858f23e1c01e13c4d7a8d2542c7b94c2952006e6779ac42c23166a12ae3d6b24

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab

MD5	57ce966948c1a8527293301dc485607c
SHA1	12c06febf6012ac021aef6a2f594cb4ab92471c0
SHA256	b5c335254ebafaeb2bf7cc952b385e397f5413251d1dcc0e1a5e5283ae9d48f4
SHA512	ccd01fbc261e8bcb64677db16892d30b285e2366a4994d04a3b95b81faeac6d416aa49ef0bdc4ded4cc76f54167a4ab3d26cba1676f334b3dbea2d168b367f76

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.RYK

MD5	2a6fd3d243389b12c24118643a104474
SHA1	bfc5ad3b7604d4f3056aae5391c21107cc6eec1d
SHA256	58710356c00a921a0ec0a64c647db2a9e9bee1243312608681f48ac4aeea7c5f
SHA512	2b5a90bea73b07a00274faef977758a5912619800c3893b1fd391f11b6ecd48b55b3821929039cc75ecfc4e71c7aa58fc60414c7762f6c3ea9fae031bbb4efdd

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.RYK

MD5	469f0745f928cdc7d78c7b07b79c23c9
SHA1	ac0753a8a29942b25542b15b42b7cf7ee7de9be2
SHA256	80d6943ce8073d5592efc169b642fa9897768c136ebd63d0b8d09ac2e33ddd7d
SHA512	ef7f9551d2327f33fe02c3da592f27bc05302dec10b576938c3dc6a6805b8b17cf5beda963d482fe385c4b4afb26081ac693ad9e04ee1578bef4df6077a8c9cf

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.RYK

MD5	0580743c0791a2117c95e9cf259743bf
SHA1	0be5241edf8790f55d4c400e543a0fd6ad5fc623
SHA256	e6f8b18318b4dc74d4131a00b7b48fc446cb47fcb1e5853a3d108e1b1ac01582
SHA512	01c664b4ab8e17952b16ab0c3f378513bef26f787897cebe4cd15e4ef04bd5a04c903ae6d409a23cb8832306df8dd2eff8709b5f5578d3d5eaae4df597b2395f

C:\users\Public\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab

MD5	7600ec66f521b71e08a7b2b14276bda4
SHA1	d21a1a911a148134a5b9935dfcdd2ebc3b5b569a
SHA256	5ddbcbc3afcd51390caf0dbe43df17f9b0aa6c950b769b02c37bf68c17d08f4a
SHA512	09dcc2cda4b9ecc11c6c9c54cb3d7d1805e09b06b6a4ed9047dc50fb977851f71de213180f8f907ae3f7373926c1e22aef5ab25a0919247a354c58346bee2224

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab

MD5	d7ea07b58a7ab4ac63b8107f7ca4d93a
SHA1	1b32d341ea8980f9704d25b84b8c5018cdfc14a1
SHA256	78672491b3805781a027080e6290cbb505aa8a34553f0a9ca1777d47d69aad7b
SHA512	43e1aa9602a67e29dba735ec355fff5caf135706e36025b15dca38676b2d30a0c94e0ce91cc65ef88650b47b11c4f835c60a0529018e9760ca256bd20a09e7f9

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi.RYK

MD5	12ec43c69a70cc79b4f5d98e3c135d29
SHA1	dd786fc2e705bc6c8ad7196c230172be0d846e8e
SHA256	3e4780a38f184e7b2a213356e682406d649ade19f122dcd311e8dfb485d4532e
SHA512	a733661caada68e6eb13e41aacda0f725a941d0b3d8f324c6bce0f5d24f0dadd7b928ef5cb2d9047f4222efd9237918b271211b02b76bbaaf3cb4c79d4940fad

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5	19d3e08376b0d9d76f4dc300dc9fe241
SHA1	5e3fe82d8fd077949156f78b154de6f80b83b6f5
SHA256	c99f22382ffe16dece447f2d7ca4c498b169569cf15baa9f444b3d186d7cea3e
SHA512	8a273f08fc6258648f607298440cd535d3384e7c6f751c889f27caee0c6f97eaa4afbac23487b9f049b6a0af87c1b2d4a23b9dfae42bdce2cc9ad490570f2310

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.RYK

MD5	e92aaf1fe585fd1806966d376c9bd64c
SHA1	c0ec91314c1894a7e0fbd07911bfb1587f482198
SHA256	183d023ca338df16fe6bc20cbd047da26276c8085c9fd29e9b16a668cc9d30d2
SHA512	f268023649833c9ea9c87f6eaef373e8225aa765e31126834575a59d9d7dbf41ff2bb1e3df2b3868f3c8ee83e7911e51a57ca593c9fd028edf4390870a805e3d

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml.RYK

MD5	078f26ffd4d7a638a08770530cd5e034
SHA1	b1533ce5c311cf168338827a3082de576b7582cd
SHA256	1ee1f9795e83bdc60d4cd53a452c64e2657f0ccfa816d9a8b29d2cc2c76e9664
SHA512	15a1097b5e1fef46ae48cbccac1a34f510981c0c40c5b1b39b4f7c82bff956bb503d9da95dfac95277ec889f8873901b985c347a7afd8f6c96835c7a990263e7

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.RYK

MD5	f7db974c8dd409a666db6944bfdbf844
SHA1	9b2ce9ed247bfec54f181abfb35b7a260b8b7739
SHA256	65bf0e0fdbb67a60979899fcc4a0639fd50685aaef3e4ca07d245ad6bda48a55
SHA512	4d9977805ebe5a7ecf990a0c622e29966f68c5346921e9900e389d6ff23797527476f36e22ad292a936a71c672f4fe2d632ed99706c424dda9188dbdd04b361a

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5	d1fb91cb8580f6fda0b545584d5ed25f
SHA1	9c66d6c266d3606f891d54da1e5db98e48ea54ea
SHA256	7d7fc123cf7fa58e88dabf0499e8f45e81949aef86d562951eeb6bfdd40672a1
SHA512	408ea64aae39155d5b4e63417425ae07263a33ae2728ed6572b81f515380ef1b5fa5ff4cdd28f0a888df0d573cd2392e9c121762eff85e1713b5954e1e6e5b13

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab.RYK

MD5	a32166e902bf80c99229d929613bfdd4
SHA1	75468c4a1462733d3fdc140d840164ab063ac52e
SHA256	0e7cbd52885c6c55145ff73f46c0540f3c5934f339e35c5ac4094cce1d6cdd2a
SHA512	9519f29cc8c1f951216dad3ad6a73e4f4b4407c0831c7c1f06edb46604195b7d3f852664cea280de1565164ddb819f16ab97ed25b1f80418ca2a7ce382a0b5b3

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml.RYK

MD5	4aacca330147c56dc50980b6c5cbfbae
SHA1	5e2baec68c1068b6e06581a0b2680321817e54c0
SHA256	bdf14557cf683d6329c632198ecfaf5ae8f89fe27c149d0975753ee8be232a70
SHA512	76e62f84d6372a0dff072a50e78b797720496257f8cc0671b9231c261a161d279961ac025a369bc06e57a3aa5a3719b7b5d446c278528002153bc5d2be7ab979

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.RYK

MD5	b546f6d1aae71a0479e574340eb534c8
SHA1	35b94da48ba01d94caf281d40bd384542cb92dc4
SHA256	58e596ed226e43e0bf56fd91c1e31724405e5d363824e33d90b76ef04a75c44e
SHA512	9b31dfb8d09f35da2c413704fcbabf9a9487902b1d44d3198cfcfaf0bdba7acb0073090e79a525807033858be0654d21f2f046fb2f8e2c1d8fd7c53ddf22eabb

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.RYK

MD5	750858bceec01089566c07901512c512
SHA1	b4013eea8ff39be174332873c71e949ac4911a18
SHA256	2ec213ce66d4b7c459a7038e96b02250932aed7e481a1dea96b75fb4e1bc7d9a
SHA512	3dfa6358435e013e611812f3e03788748322b590871054cf1f05a22574e4a461536c3f38fa3a222a57cceabab5c03a4c0b8d42287d3b50f3761a3ffa1c71bb69

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.RYK

MD5	3aed334eb795a88821a61539a0ebe2bc
SHA1	ee66b3d8b7beddfd8fd8fec91218b8ae80560506
SHA256	4c066ac67f8cc363570dfca00a25969ef8be22ddb690579db75993a294797552
SHA512	969e8c5d8587481bf7c6398374c328e349196cd0133537e98c744ce180f33ad32dcae5d7f1e329744c66941384e8d6a2dfe4a816a1e8ee18db4641207bb6ac5a

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5	ac7cd2863fbd1a8529d51aba67cedbda
SHA1	eeb16a0639ca0803555853151c4e24f0e9819e60
SHA256	ac7b1dc00efed6cd60a4bff3c4f8d751d50708ab5031f38b81680111c69d107d
SHA512	18887f59b89991b951b4e559f85b9098c21dc716eee4f2b7577e02bc9bffcbe1a5accc76feb25f327f0d09f289026bff63aa604613f73a896f322e0a5d8a9e60

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5	dacd39f4e7741815c56062356ffe4f24
SHA1	aa8035a7ca5d049e0dc4c41df8fac0fd9e1681ca
SHA256	6c256542054be0ca3380a06054a4b5ca2ade4f4c4541cb3459413886a6458638
SHA512	b6f3d8fa31a051308e709ca6bf7c8008f449beebdbbfc096d8b3e43ccfec6dec32c1237f6c807b64200878fc50a1e197727c1c7b0743a0879f87ad2470625c7f

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml.RYK

MD5	18d2d9fb4c5b7932f28b326bdb2e286e
SHA1	a0f4cdf5a47fa72eece45d38b539628fbdb115b2
SHA256	9df49dee1a9cebc787dea74b1b2686060c75a8f32b03ea433d3d1a9ffdbf9f1a
SHA512	a714dccff22b13927a53f3f15aa57308ef888a23a81270b2e4fd384c3a122e9a9ba1001b1e3b1b35914ef3166bfc71563da603a03e982ddedc345dec5885ad54

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5	7b467d5b906ac3a24a655dbff5372482
SHA1	58786c99217226af026ef0dee66407015206ded8
SHA256	bf51687343730da196c317722ae46270eb8ffbbb7c16ecea61dad4a4e6f6b224
SHA512	8a3d5c87e7247d235644e5e200f2b447365fb95ccddab47d94ae779b5c6729b232cd3c559906c886e9b1a01a21d22893e31be7382db89d362456d3a8b19fcbd8

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml.RYK

MD5	5d7e9ac922663d8993d62661ac4e631e
SHA1	ef2a23319244545ac0289026a939600316e43f6e
SHA256	1aa2a947ca39eda757ee6be32820e6cffd95bd1f592357e5e25cb3026e68b0da
SHA512	c4cc94aed05780b4ea808651861519aab14feb240df775551c2566f72e1f0dd3bc452fdcb5238209ce5c3ec34423cfc8271926414088da755e1af7e7e9e8757a

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.RYK

MD5	be881bba978cffd871a39560918ce338
SHA1	f0c5254fa7aca384b7611667606585bd2fb162f5
SHA256	667b4a3aace51f80cfc27524e9e6917b0117c34c9bbb4e451f04da5b34e10d5e
SHA512	2b0a021acb2109ba022773834c6c5d08fcc79c65cdc24993b97be3bcf07482a7ddc0b0ed27b70331119b6fde5a2d6f1a8daac072fccfed9957f14635c495311a

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.RYK

MD5	bb9ca29887c14d941aff2eb567e39673
SHA1	f821d877076c4b07c95738ccc9b5591287672248
SHA256	81273fcc3dfebbb58ad8f8874c3128d161f060da8c703a37052dbc89e401cd29
SHA512	7a9b29dce1ec8098b0346d218c527d560a10ef1798b9bb4011fe32b08f632ba1ede2b9bd0a59941991f89debb477a9ddebf1b17910e5a8c7647afd4f068cf0f6

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab

MD5	b2b379dcf5143cf8b7e200679d47b0c5
SHA1	200bca1af35cb327fe6abfd3a635305670932cfe
SHA256	5faa112a319cede518788a8b1617cb0c6c9882f6b3ca36364131e1519fa3f7be
SHA512	39b219e399d1347087d7b38e6d7ba24530b22e0b79a08f2c8c491854e90ad594b51d3a17f076f9e4d0a6b7946fb59db616bbcf2d37a180e37a145638a20dda3f

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5	fa756947161a900d5c5935817a34ac0f
SHA1	643201cc644cd313b3b1c64aa5c6531c82cd33e9
SHA256	813fddebc46aabf12c2df51889654fd1b0a04584bbf2725c39e08b7bff77dded
SHA512	a815aca60928d79f052e99d7bf7d8262a20d1fff1a41d0583677ec9c817abf96025f352b021c82fd749cf66c93c6fca23c3055a03ddbbc433bf2f637655016b1

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml.RYK

MD5	e89a4c2de76e80770186d508327d13bf
SHA1	f262db275c082d9a5fd76b0c1a553be61b158000
SHA256	9c51fd7bd23da5db3b85c5e7514dc7e9c2d44ed420d6a18b6889ed9f0605c49a
SHA512	a8bfe639798eaaccc2013c236c209ffde6592d70cc0de6cda028eabbd950a00ccf3498b764b6e2f9932ebc7927352ff66f2af9a75c09f7a6e976f6249b139a5f

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi.RYK

MD5	8af5cae6dacda858a25d8917a1402783
SHA1	a00ac2188495cf635551d3e3d1380d413dd15145
SHA256	199d940bd7bbe5e0086986f75c11da469d53c4b19153bb101869fd20b109366e
SHA512	a7c59207300fedd5512ce6df9860ab56d64d17e3f2d80e5ec365513a53aa5cd9e22963d5e1675613354b99c56e10815891a0e58f2a0f401c0ebcbaed6ee7f0d1

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml.RYK

MD5	cd246d0e69c3acd771ef8cd365c4cc5b
SHA1	7b87115c49f4f3b158f92de7e20fa3f7e6c27e8a
SHA256	c88e46a70d34c029723f2e39cf40a1389ef73ed9d85de32ba3a1fb51a11f4eb4
SHA512	2b66ec4c4242e4f77ead5e33058f2629e2b9723156da58ccda14a8909cadb826587a4596b120f94ff1f61d6d9f594308ff4d9ac1a8c91b41668f514051eeb830

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi.RYK

MD5	911a996141050b052180c408cd406400
SHA1	ed869b2bc66919e19c158541fe27e79781ca3cdf
SHA256	8130aaecda76a5981e28590d0638806e386729b18f2d43c38d37239ba353d8e7
SHA512	531e5bee660e2b99a139cc27418a35ee784792ba84df57c502ab17b7e155de2c3d705c1d202c6abd1ee5e762f1d1b5d067fed1f5f616352d3e0cc66a810328f0

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.RYK

MD5	1ba82030c26b2d71fc7c92eb5193645f
SHA1	650c8ddb62eae31f9f40562c92c4e4e3b2acc8ee
SHA256	ebfe0020c3510a2609d34cfafb5b4cd8c4bd26598b59e918498baf026bfd92d4
SHA512	c09e08465f05293b6753fb3b60987a5c739f603c85d512652201810c2a75762caf851933d2df16840bed7917b085dc318d75c877992d57ef0eb3e5b6d77e1b60

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml.RYK

MD5	366b57c0427b7786f5138670c6031a76
SHA1	fee69747538cee0321055504d77a38a05202f684
SHA256	010071fb438fe15e7703dc1f94ec610f1c8f279d337154a7b40a45d823345973
SHA512	610dce01a5c7365c21bf85a8970e97b0d6395815de61474554e7ff95311113d8650c8e7a1a624b4c7189a9465f7888cdb90c20ca937040f12290b165c3961ca8

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi.RYK

MD5	cd00413d8d9cdc570f481a91e2681613
SHA1	dd1986833de28dbc1edfc3cc7c775958e723c287
SHA256	51ecfba8426b762fc082ce2ffa3fbc6aa12e740a3a073bf70a33596fb9ae9d7d
SHA512	8f7374fd69600c50ec6a9b20f6183865d15683a7ae82379c4b317afcebd971398f31103ae2cb3711082a5603d3a8f37575920d897de6648820be4530fa819094

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.RYK

MD5	9294a65dfb59d59566078c727b17beb4
SHA1	57a1bf48c07b5ff410a317a64c333d7a4462e6c5
SHA256	60e2df09762cd8bab5ea63bdb0a09b06a5762b7d729e82e4a1a10ca874119fca
SHA512	157a943265c8ab9fc8bc136c2f9708f0110e2b550f263b2662fd2c99aef7c9ef7cd3c9923e0fcfaa0978ba5eaacd73db73268a87a6d78382bc47cbabea334e4a

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml.RYK

MD5	25ddcb6bd7452ca93354d41132667e19
SHA1	bf2f124ef6f70ca481e7ca3ad13aef482553e20e
SHA256	c0914183af92fd5ff23d9e7f1e9279cee65503379fad1bb4cc0d600d33b97e97
SHA512	552f39e7ea02137c2519a177265591270c27a54cd938d8bd180e52f3780b55b9cddc3a402a2d4a96f9fc14111a8d88aee2f8bc9ce759451aad8b63129d30bb01

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi.RYK

MD5	b6a2d13bbac038175b65eff444169109
SHA1	87ba8d790def590b6bbad330bbd5bbef48bc0996
SHA256	cd57ac2cdd4bcf8ecaad86bdebac818c952d53b4ac169ae66825ad2b0843be8c
SHA512	49cd4c79a5662e459b98fec415b47ee736fa1a21120cd8b9d12db91ce72b135f7cdd0156d34062a0174d20096f432d4fd148b52f993e2008658191faf0d6d68a

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.RYK

MD5	23417adeda5ab35aae325fcf3c95cba2
SHA1	4aa6701bb319d0ea3b5e2835216c3c3d57db30e6
SHA256	169a31d9cb7aaaad47c1f967e118b22b23b0ef46ff5087a6abcd8bf93b6a8a0b
SHA512	a93d463e6c53eac1f14f74c1c0c34da4f1b222a1578a857f4cf9a4f2bcde3cfe0957a0750abb55c01892f14bf005f695fbd15af7b407326c8968518efdea30cd

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml.RYK

MD5	e9178ea826d4f3a45f364538e465d992
SHA1	7c758f7b26b44883c3f3e70e08f7a75bdbea1d26
SHA256	dac4d86528f9d255adc159a3b902b4761b769bee6ce0f6e28fa5a04c855b3a32
SHA512	7fc94a6a0b2508f38f8bd1e66232b2b342e43f70e3313e2fad369888dd3975a34d968a1deab5214de56557419d3be155d0b4aa008602d24dc44a312f39d83c0d

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-18 22:01

Reported

2023-10-18 22:10

Platform

win10v2004-20230915-en

Max time kernel

458s

Max time network

483s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe"

Signatures

Ryuk

ransomware ryuk

Renames multiple (7229) files with added filename extension

ransomware

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\1073r.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\DlzrOjqkhlan.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\gOSOJTKMjlan.exe	N/A

Modifies file permissions

discovery

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\icacls.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\icacls.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\icacls.exe	N/A

Drops desktop.ini file(s)

Description	Indicator	Process	Target
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A

Enumerates connected drives

Description	Indicator	Process	Target
File opened (read-only)	\??\Y:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\R:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\M:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\E:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\Z:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\S:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\Q:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\P:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\K:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\W:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\I:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\H:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\G:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\N:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\L:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\J:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\X:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\V:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\U:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\T:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened (read-only)	\??\O:	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\WXPNSE.DLL	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\js\common.js	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\cloud_icon.png	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSPPT.OLB	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\export.svg	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\ui-strings.js	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.inf	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\SEGOEUISL.TTF	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\ja-jp\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cy\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\ui-strings.js	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-io.xml	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\ui-strings.js	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\jmxremote.access	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\THMBNAIL.PNG	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\tzmappings	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-dialogs.jar	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\msdaorar.dll.mui	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\th\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\selector.js	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ur.pak	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-common.xml	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_listview_selected-hover.svg	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\PREVIEW.GIF	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\PLANNERS.ONE	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons.png	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A

Enumerates physical storage devices

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\1073r.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1852 wrote to memory of 3852	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\1073r.exe
PID 1852 wrote to memory of 3852	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\1073r.exe
PID 1852 wrote to memory of 3852	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\1073r.exe
PID 1852 wrote to memory of 3272	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\DlzrOjqkhlan.exe
PID 1852 wrote to memory of 3272	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\DlzrOjqkhlan.exe
PID 1852 wrote to memory of 3272	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\DlzrOjqkhlan.exe
PID 1852 wrote to memory of 1876	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\gOSOJTKMjlan.exe
PID 1852 wrote to memory of 1876	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\gOSOJTKMjlan.exe
PID 1852 wrote to memory of 1876	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Users\Admin\AppData\Local\Temp\gOSOJTKMjlan.exe
PID 1852 wrote to memory of 1464	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1852 wrote to memory of 1464	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1852 wrote to memory of 1464	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1852 wrote to memory of 5044	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1852 wrote to memory of 5044	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1852 wrote to memory of 5044	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1852 wrote to memory of 3380	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1852 wrote to memory of 3380	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1852 wrote to memory of 3380	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\icacls.exe
PID 1852 wrote to memory of 5100	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 5100	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 5100	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 3340	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 3340	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 3340	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 3936	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 3936	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 3936	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 408	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 408	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 408	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 3936 wrote to memory of 1344	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 3936 wrote to memory of 1344	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 3936 wrote to memory of 1344	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 408 wrote to memory of 2812	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 408 wrote to memory of 2812	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 408 wrote to memory of 2812	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 3340 wrote to memory of 3444	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 3340 wrote to memory of 3444	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 3340 wrote to memory of 3444	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 5100 wrote to memory of 4872	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 5100 wrote to memory of 4872	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 5100 wrote to memory of 4872	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 1852 wrote to memory of 6108	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 6108	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 6108	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 2324	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 2324	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 2324	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 2324 wrote to memory of 5756	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 2324 wrote to memory of 5756	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 2324 wrote to memory of 5756	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 6108 wrote to memory of 1136	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 6108 wrote to memory of 1136	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 6108 wrote to memory of 1136	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 1852 wrote to memory of 21388	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 21388	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 21388	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 10220	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 10220	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 1852 wrote to memory of 10220	N/A	C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe	C:\Windows\SysWOW64\net.exe
PID 10220 wrote to memory of 22324	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 10220 wrote to memory of 22324	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 10220 wrote to memory of 22324	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe
PID 21388 wrote to memory of 22336	N/A	C:\Windows\SysWOW64\net.exe	C:\Windows\SysWOW64\net1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe

"C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe"

C:\Users\Admin\AppData\Local\Temp\1073r.exe

"C:\Users\Admin\AppData\Local\Temp\1073r.exe" 9 REP

C:\Users\Admin\AppData\Local\Temp\DlzrOjqkhlan.exe

"C:\Users\Admin\AppData\Local\Temp\DlzrOjqkhlan.exe" 8 LAN

C:\Users\Admin\AppData\Local\Temp\gOSOJTKMjlan.exe

"C:\Users\Admin\AppData\Local\Temp\gOSOJTKMjlan.exe" 8 LAN

C:\Windows\SysWOW64\icacls.exe

icacls "F:\*" /grant Everyone:F /T /C /Q

C:\Windows\SysWOW64\icacls.exe

icacls "D:\*" /grant Everyone:F /T /C /Q

C:\Windows\SysWOW64\icacls.exe

icacls "C:\*" /grant Everyone:F /T /C /Q

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3852 -ip 3852

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 6404

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Public\Desktop\RyukReadMe.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0xf8,0x7ffe7f7246f8,0x7ffe7f724708,0x7ffe7f724718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Public\Desktop\RyukReadMe.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7f7246f8,0x7ffe7f724708,0x7ffe7f724718

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	2.136.104.51.in-addr.arpa	udp
US	8.8.8.8:53	14.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	108.211.229.192.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	254.23.238.8.in-addr.arpa	udp
US	8.8.8.8:53	16.173.189.20.in-addr.arpa	udp
N/A	10.127.0.1:7		udp
DE	167.235.102.92:7		udp
N/A	224.0.0.22:7		udp
N/A	224.0.0.251:7		udp
N/A	224.0.0.252:7		udp
N/A	239.255.255.250:7		udp
US	8.8.8.8:53	92.102.235.167.in-addr.arpa	udp
US	8.8.8.8:53	22.0.0.224.in-addr.arpa	udp
N/A	10.127.0.1:7		udp
DE	167.235.102.92:7		udp
N/A	224.0.0.22:7		udp
N/A	224.0.0.251:7		udp
N/A	224.0.0.252:7		udp
N/A	239.255.255.250:7		udp
US	8.8.8.8:53	59.82.57.23.in-addr.arpa	udp
US	8.8.8.8:53	67.246.107.13.in-addr.arpa	udp
US	8.8.8.8:53	nw-umwatson.events.data.microsoft.com	udp
US	20.42.65.92:443	nw-umwatson.events.data.microsoft.com	tcp
US	8.8.8.8:53	92.65.42.20.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\1073r.exe

MD5	89895cf4c88f13e5797aab63dddf1078
SHA1	1efc175983a17bd6c562fe7b054045d6dcb341e5
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA512	d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

C:\Users\Admin\AppData\Local\Temp\1073r.exe

MD5	89895cf4c88f13e5797aab63dddf1078
SHA1	1efc175983a17bd6c562fe7b054045d6dcb341e5
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA512	d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

C:\Users\Admin\AppData\Local\Temp\1073r.exe

MD5	89895cf4c88f13e5797aab63dddf1078
SHA1	1efc175983a17bd6c562fe7b054045d6dcb341e5
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA512	d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

C:\Users\Admin\AppData\Local\Temp\DlzrOjqkhlan.exe

MD5	89895cf4c88f13e5797aab63dddf1078
SHA1	1efc175983a17bd6c562fe7b054045d6dcb341e5
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA512	d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

C:\Users\Admin\AppData\Local\Temp\DlzrOjqkhlan.exe

MD5	89895cf4c88f13e5797aab63dddf1078
SHA1	1efc175983a17bd6c562fe7b054045d6dcb341e5
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA512	d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

C:\Users\Admin\AppData\Local\Temp\gOSOJTKMjlan.exe

MD5	89895cf4c88f13e5797aab63dddf1078
SHA1	1efc175983a17bd6c562fe7b054045d6dcb341e5
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA512	d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

C:\Users\Admin\AppData\Local\Temp\gOSOJTKMjlan.exe

MD5	89895cf4c88f13e5797aab63dddf1078
SHA1	1efc175983a17bd6c562fe7b054045d6dcb341e5
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA512	d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

F:\$RECYCLE.BIN\S-1-5-21-1926387074-3400613176-3566796709-1000\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

F:\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

F:\$RECYCLE.BIN\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\DumpStack.log.tmp.RYK

MD5	afc25ffd1ad03e26608df207b862f8cc
SHA1	feb88cd7f737b11a928a99285727f208e5b59e89
SHA256	8cce7c235fbc636e01c3620b867f655d1533407a24059d11c9be1184621fabe6
SHA512	f3076e000e66890efc0aef28f7ece8e754cbee2d2fa52db7543760691271d97766159a0b7f6b621c9c3ce3aaf2530014c9256a6f015699bd355d9a85886a15f9

C:\PerfLogs\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

F:\$RECYCLE.BIN\S-1-5-21-1926387074-3400613176-3566796709-1000\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\odt\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\odt\config.xml.RYK

MD5	12ce15ca58233b96f13dae11c67dc9c2
SHA1	82897b5676bf4c38df95003605d91c1a2ef37cf3
SHA256	4ba61a7288b86fa71a34586d5578844b8fdc7621c39019e2443dba7780bf312c
SHA512	9a30b7b6f7979cd59f2e5880bba506dfb65baf75ca9bd1c881b222508f2a7c3f1cda3fdf80e76520a22c819a2cd727c74f315d666749c388c2216e0bd7df7d8d

C:\$Recycle.Bin\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\$Recycle.Bin\S-1-5-21-1926387074-3400613176-3566796709-1000\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\users\Public\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

memory/3852-4919-0x000000001B1E0000-0x000000001B1E8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml

MD5	5118e97520c21444f8673fc353ec134a
SHA1	ee11959051213f883a50b61ea0be3db90e9434c9
SHA256	276f1d8a89cb215e36dcbd291c982c01498bd844ce5856ffc9fdab693b454661
SHA512	b9bee7fbb098575e5b7afd779054b27e406d091d8e9a46d6cab2d821396799fb98bf26442cb6456eb09faecc29fdf8b47c20a8c8f6b25791238b7c37e64fe59b

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK

MD5	6e7612a513ba12c913d99f930256e6ca
SHA1	6e1505d1ce2640a98b1c5dbc88a0846f663a7be9
SHA256	4f041ef551944c77a6b7670f3f1613d3092e64a98a2dc7e3b3b00a9546af63ff
SHA512	d2551b5689311b06ff342adf7e528093e821beedbf15207bc2271222fc99aaa861fab1aa57ff37307fd686d523294b4d400ebd80134b696b24fad779730f7c26

C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Temp\.ses.RYK

MD5	7de9889719bbd827900a0615f5364a64
SHA1	dc82613f59ff8d1cfcb61654380480b1fa509738
SHA256	e991ffd5ef10a5238e39b9fe289fe206f46d657376300781e4638d36f5aa2248
SHA512	61d677013c70a0375b743209fc337158144150eed767d278b6952d54b9a1b78b2fa48a673c267802fc13b87e08b1d01699f26d95bb5705a7d9a309337fd951e0

C:\Users\Admin\AppData\Local\Adobe\Color\ACECache11.lst.RYK

MD5	3ff50eb7282edeacabcc300a66a289df
SHA1	a1b7d63cb9759d61a47e47eaa4b203ba64a06ee3
SHA256	8c2831cf13334a378193d4be27e58e7737ae897f6ca8c3d939684159981f441d
SHA512	6ee1cb867535f7ac8a5bba6e2a22f951161523eb67503f10a78cc0a729e96ecf797a30254a63513a24e4a80e34de82216b43eaf7acdfa26c7d50b62cfd780ba7

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USS.jcp.RYK

MD5	7a79eef74a7e5f6e7ca3f6b7c5fb0b36
SHA1	e3974825f6b9cc5d35659b51ec2a155a661a46aa
SHA256	a5fe68b751add635b9fc849ca266c0b6d011bead77f65804552a09080bd8297d
SHA512	42d58d603db8c81ea65d27fe5eef92a7e8ca773f7ce35590b0a095ee230878d610f889ec39e3382f794a92872f56733c15f5d46281cebc51a2072a22e4852537

C:\Users\Admin\AppData\Local\Adobe\Acrobat\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm.RYK

MD5	37afa621dbccc3e2fbca6339669db835
SHA1	bc04274387200347cae43ee4a0419182b922daca
SHA256	b0ce74e5bee47dedeec5ae60f541514bc85d66714aaa78b4a942c1b6ba27f2eb
SHA512	12e43ed1e6b9be3d9970d195d019a0a4f44a7cf35778c4ca1ac880b66d6b248941b8690bc57a26c3eb897fe407eba78f9fbf49b24f65a8ecc77a14471e0241b5

C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin.RYK

MD5	1072361cb330874480ed4cccce151f02
SHA1	3294024f34b6b676cf5099f8c558a21f9307ec22
SHA256	831a0894cffd9bd32fe96d6f1957fc564a2a9c647c16ea142dd5982e3a254296
SHA512	62f9271f9db26c434ba8620b12fc6023e7028f1d522bc5a47ef741ba337dcd50d9b374d1012238a578a52a7327222997f0500b9eb3637589ccb32557ce4b16e4

C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents.RYK

MD5	b90c82297b9af7b2d3f4800d4c7ce6ec
SHA1	5bca5d6211cd97d0537d8590a2a16c0170225af8
SHA256	dca9e4a8b54e7ea5ed6ee22b8aa43e414d041f3461616d4349d151d700d04bfd
SHA512	454a347fec66ef7a2e89a7fe7aa02d29c056527eda81c3307cdb940ac53daf58f02914d50622a3b0c3c1a6b0a3cd0f7b86d6318ce3e0df59fb00c5a45f5a2603

C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat.RYK

MD5	3adfa18239f58864dfb241b05ad2eae8
SHA1	f41b04230b18ebe26eddb7e8c6d2b4e6dd70e333
SHA256	bb4af5345075b87c7c15f503a6a6331047c391ae36577fc10cb7d09887c4389a
SHA512	45a363754b8f9c6998d65b1e4450060815ec4ef879918d01d43a1229d61710472e11f395c07bfbb2d0b1dc5d55dcc0a517a69f80bbe726c6117374ec9a239b5b

C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst.RYK

MD5	0d6e905f0468eeb674a21a5cc364225a
SHA1	d51d7e8c4a6e8f35bdb37696e551bcca278c196b
SHA256	efa55a073dd9aacf3ee9025a7d5ec3cb20e1b6e15ef97793ae97a1a0074c42b7
SHA512	a7db0aaaf3a656ad4478f689b4f59d4d0c21119bf62d9ecd088e585ea636a27721ddce3648012f1f79dfd652d9d1d538a323ea43b1d88df89e92571334a530b7

C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst.RYK

MD5	dbda960b6636d902f52304c10c6b4262
SHA1	b4fda38bab209c815e4c71444a4aa2ef0d8d992b
SHA256	b24d94d17d3c9821983d1a040eb7a39c0f842f6e2d99e50b556d9c5442eccdb7
SHA512	2dcde595ae4db08da7f16b007869acdb74a61620f942067e6f6d3e33b0bd98a3d851d67a75dca65f947d6c4f453a0827aad8ca1bda220d045e544327d06b4766

C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst.RYK

MD5	68a5f4aae8b705b9483ccf5f78ab5b2a
SHA1	075d4d837ba23e2ee35da992d10911e5eb5cbdf4
SHA256	9a9f5adb8fca76ee1a0a2921af15a6d13e652ae0177104e6c862f58dccfb13bd
SHA512	4097414e8a317ed36132baf22f52b3deed5b573f48940ea1cc69bef49c13e0173d6e75607136670e0807f7c620f979c295ad79a6ab3e0b93a13dc7cc4b8d6235

C:\Users\Admin\AppData\Local\Adobe\Color\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.RYK

MD5	76c083d1c84718996b928faa0855d855
SHA1	a5d68725483916f22d80168e5d912232d2545b2b
SHA256	a81a87adee867d17007bf13ed529de4cef64a8418458871ede0137889f3cdb16
SHA512	643fc1fd989208ce6a3a8216f33f1aa4dbb43ed8148195f587611d8078d4183d85dbca946e728f92195474e54c316fce4d8bd63f8b0e2cdc20626c80931a5add

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Microsoft\Edge\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Microsoft\GameDVR\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Microsoft\Feeds\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Microsoft\Credentials\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Microsoft\input\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Microsoft\Windows\History\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Microsoft\Windows\History\Low\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Microsoft\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Packages\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Temp\.ses.RYK

MD5	7de9889719bbd827900a0615f5364a64
SHA1	dc82613f59ff8d1cfcb61654380480b1fa509738
SHA256	e991ffd5ef10a5238e39b9fe289fe206f46d657376300781e4638d36f5aa2248
SHA512	61d677013c70a0375b743209fc337158144150eed767d278b6952d54b9a1b78b2fa48a673c267802fc13b87e08b1d01699f26d95bb5705a7d9a309337fd951e0

C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log.RYK

MD5	45e7e2b89e2fd1fc3a1a8da34a055837
SHA1	329c448c5cb6924b8b96e9538035fd4e353975af
SHA256	1ced2f7516e2df2577dbd68001f9ad83dd8ab04d3cdfd89d0cc33041a4d05b32
SHA512	0127d03255c28ea7249fbbe2c74e5763dcda28ac06fca72b4a0486124c8725e7006679e6898a9fb764d39d8cebea44042bf26870d1d128000229ca4cea098c4c

C:\Users\Admin\AppData\Local\Temp\Low\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Temp\jusched.log.RYK

MD5	b87cff51d6c6aa489696e6eadf0a960b
SHA1	eafef2c687ce6ada18b2c7b7474576ccc7f5c22d
SHA256	335979fc9c2981d52e2960bc7c9d96b13c2d691f4bfbe8121970643f850a2c7e
SHA512	076af1558773992c8a975b3e5622bf000b522ec7afe3c5cb656ebe9503d385a815ba79a3539e418ebcd6ceb2f16554d99bcdd5b2382102e81c0d95cc06d3e362

C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log.RYK

MD5	7a8d97b89bf4b55af70f8ea7d0861c46
SHA1	f2c8d519a0798d0ab816ee8a54fe170766e5d979
SHA256	f16d129fab8ed5c5a492cb736798baf38141eb02033194db5ded92f89fc4d00a
SHA512	eb7b5544ddc68064f56ee96b5cfcb1f062989badc8e8e6d31a52f3f9560e0d64d86427b6ac3f91cb58cfeb90c7b6c113c772c7b12972e1385fa31c2abc036540

C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI433A.txt

MD5	1c336bde3935a5f30d03066c39240125
SHA1	2e2892caf2f107229e313e07244ef626c173d4dc
SHA256	7e17e89c0719f1bba869d9b2265aecf39413c7790a3131f44ceafffc3c8fdfa9
SHA512	7effb219fecf7c17f0bbf469fe5d5f817d63108fde3e1dd9449af4b70d5f8d8469792a1daeeef4679a99f65c1c5972688752ca7d9c9654803699ff328043f9d6

C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

MD5	4d004342edab3ccc61ca7711b2adbf0d
SHA1	144c9f5b3198651091f9eae786633226f1e79f74
SHA256	bab0c53cdbec3d012f60f66515cfe8b066530b84f4342f78ba5e012dbb5eeefd
SHA512	8a98938bb23fd0d2462313ef88ca5a769ed858a2f1926fcace8ad43d15da5891633dc04db4d8c02c51fb9d65906dcb04f35f911600945cd10f21e8302b63439e

C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI4310.txt

MD5	21730e823c5249b52a97f47d766ffc39
SHA1	27ce9b5d3e893dfab766422400088adf61c3cc8b
SHA256	0c38cb175db70b8c28e7f603dcf38dae535b6b5771490e33ef3f608c2236f61a
SHA512	c6609cc89560708720ee8a10eca7137a7ee03f6abe4d0fcd146eaf95b64935c905b239bc72a010b280800aae26a78ad2345c02bd1f257a53f0fb75ed6cb3b127

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Publishers\RyukReadMe.html

MD5	e814cd9c600ee9b146ded05082ee80e8
SHA1	2f9a7b8da2bd57a2bb812374c8e7eee975583214
SHA256	b89db7a403deb3c4ffeb5828572ceb2660ab293d435f40546c90dce74624e64b
SHA512	c9ddd0611fcc10dbb2b6ed833169139fc2230ad3d9190230e8dc5fa655cd24e77e84838a780377a85fe4c2baa4ff4f9744630e1096530b468ef288882c5de7c2

C:\Users\Admin\AppData\Local\Temp\tmp19E3.tmp

MD5	332eeb6dfbb89c5f8d149fd0f0402c44
SHA1	c6c7e49a1d444184a065a56e8c90a8fbbc7e270d
SHA256	819e4a440e9b3d2e81a72c91eea4cdecff59e598dfdd558e00baf94ca996b86e
SHA512	5e89a26b49ded6124a7783bd32d27fb18ac3d610f169f03020be08a53bba8aa1cdc037be64e55bab67ce9d6f14085cd49055733001066ac4b7d2dd50f8ed0295

C:\Users\Admin\AppData\Local\Temp\StructuredQuery.log

MD5	9e00fec8871211b724f45ef221655e66
SHA1	7c7d6e7bb00621a922f785ecd7e5a062c1e908b5
SHA256	aa9860387cc8549255948b28eb68d395f6e94e58630add7c6bc5aaa9de2e6b24
SHA512	653bdc9d6d543f7135492df138047dab24a7381e52eab9765ea4b2bddca6f3c9fd8583cd7998cf053f67b5132c056b5dd12bca65f7e16a725fda7ed44a7154d7

C:\Users\Admin\AppData\Local\Temp\msedge_installer.log

MD5	2d991c4cf64529de79ce03b98f0a4de8
SHA1	7de6d52f882932f1482be0c96edf4898759b41fb
SHA256	f0f6178560440efdec8e872ec7afc3dc68061b7b24ca5832f1fa5fb9817b94e5
SHA512	adad6e63e69126c26482010e416fb88cb6135301b8e353c083c3b6cda543bc16facfbbc98274eba0ae2a4bbc80323bd9fad0f289ec3b102a30132f6cc86df9a1

C:\Users\Admin\AppData\Local\Temp\tmp1C82.tmp

MD5	16d34e394b78eb6e5112ec5ba2952134
SHA1	5af59667cb230b353bef5c3a119065a87e222ce6
SHA256	12dc736ebda91f7fdf6af1e3c99b5615ae5c46d82475fa3e6806128b45cd6e34
SHA512	cb5cd7fce07956e452de05954a90adc633dc8f55d612dce93519d83a7708c00da6da4364585946824d3e7c4d674b8586ecf7a8cb3773ad2ecef83732c1ff8b2f

C:\Users\Admin\AppData\Local\Temp\wct1732.tmp.RYK

MD5	39d7d5daed441cd155585d9922697274
SHA1	77776dbad65dfad5458464eba1008b51be64837b
SHA256	fac7c98d25b356ae4cd5a47a3a793557117a1defff89a4dbc4964d211471b616
SHA512	38220d47b3cc0b91516983c2b20ed9f5206861901839f566b2ad720350f1536bea3926195e9c19dc2d1ef51ba80e73fd8d69ea80a9652085b8999173a0bc81e7

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin.RYK

MD5	3d506db1e5a01f9097f18364898f8683
SHA1	a57b9d08b220857a8e1b4488fa99b67399e9f5ad
SHA256	0e9e4b47160ca9b7c8afd30fb5d670548d198836d9406422b261399f593f4a56
SHA512	8a031192450ff85573b2add10117816304a3be26c6ef4a57e3a32d4034adb89d1887651efc2b3f82159d2f32f47cd491ac39b701fdd5894c5e1e7629e1fd6521

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin.RYK

MD5	54c904173129335236b716f2a33c2d4d
SHA1	5a039a23bceb447d5e4b7d84e7d253df14777efb
SHA256	d790ad6ea673ad8458d92bc622162ab2e67e8d09b7c9a8ad9f53cf5fda05c9e4
SHA512	5b2996950fced306e81eed35d9b3d052b3eeafbe0dabf0618628ae3ed34c925a26966d821df956ec2637e8b54e6e13c3a1516628f8ae23498781439499067a93

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B5.bin.RYK

MD5	4aa5eda247a3d6cc4637e541123f4cb5
SHA1	4c7d6752bae78f651aa54b7d30d5ec2f82395025
SHA256	0f4e11d60adcd6b06051214d8655ac945c1b2227569be2e8318083d8caf451bd
SHA512	2434fad6769e3312113314eb8ef75367c8c20ceba56a1e9845dd502c058e2f2ad343ef457b91458ef796bca441589db2759a47f59b8248fda5915b473809d4cc

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AP.bin.RYK

MD5	c94c21dc41dbb1c8f5f02cf33a6163c0
SHA1	1df14d1934e67a6e526fdd7efa6820265962255f
SHA256	8767f7b3ef904bb132fb80f5d0fe96a24692564f70c93ba00277fed2c94f564d
SHA512	fcb1faccc87d59c74758a6504276ad7fd4ac30d9d577da06f9595551648ab1104e51ada1b4c7ef34fd7c60546dedc2533d355b56f7a776e92b6888990653db5f

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AO.bin.RYK

MD5	23ab1876f357c891529330077a12eea1
SHA1	f7b0634638359fade3a997087864962e65a50351
SHA256	753aac586d75a3953d63afa60862837bbcecfa399bff5497cfd7973bf3707646
SHA512	7f1075d03c410a669bbc0e6490f9553b9dbbd22c8fd79be3b155e424e9484c03d390ccc543d0de07482a4fd24e9eee09deeacc28d6198583bf6e009472810966

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AE.bin.RYK

MD5	3cc99cb80f5e321d81cdd47495849f0b
SHA1	d3dc0fc9f95ffd7962d847f65e8c26865923be4c
SHA256	972b3b4917c59e369465d3d4c7a7b1758673dbf8c7edf0e62c85b7cd7d9ecd8b
SHA512	c811be4ef4e89561303c397b77097c6e52419b789d1daa8dda891fb71cd41ca5e93bc0e77495a03b7e13c1e8ab523d1d54e99f7f952aa69bb94a94dcea280f94

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000096.bin.RYK

MD5	18e048183582dc9f4fe8cff72ac69928
SHA1	0b7aa8a3829de0d430d9821caf7fd2ed5c1458d1
SHA256	c95067f04be43c9067a323522ee537b40ad333a5465aa10ffa9ab96380b8c4ce
SHA512	7e200097767dc24743d96ecb2ab87cb4bac5eea62ccbce2928f19be1f729236de5d9ec352d0a2663939e27f23106b1f9804bbb563b3c2095cb77e4689f77736b

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009H.bin.RYK

MD5	56b03925c0ddbc91a930ef756d057d98
SHA1	b3eb20f9f9efccc4adccc538df92b3c11d72a2c3
SHA256	ca86e557331a890f57d5235339424ce82af3eb29df49762e411c1809602b185e
SHA512	85846769a2ef090fc2b0ff7c453e43cdd7ade0d966bd1531915d2826f7bb2f0145dde4fe9be665cb6f6560d970656e92d8d9aa7c729a621492929cccf96ecfca

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008S.bin.RYK

MD5	4d8565703fa21fbd7010c123fe4043c3
SHA1	09ea3047080228a3cc6f1d93662f3f5d05cebf26
SHA256	7e937e3c04c544b4a926fb6a7fc9f4fbc64a86083d9f8762969e5d99ff044f8b
SHA512	f713c0dc7d4b6a8d7c3cb558aa6afcf68e61d6609f98b5b583a661e3b91d58f543900cb232e4dcb1ba5848c2582211678768667a30ffd72f5dab6ee9a457253f

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000BF.bin.RYK

MD5	ffe5994746807d61b7b7f5b4d877881a
SHA1	3d7bf839d8c24f548754800c077ab9269248356d
SHA256	72caa354bdbb5408ca0425ac287455c20fe0a93d0b869971764cf4b6627e1f60
SHA512	c6e0c6d56027c2384b3787713382ba99b65a65aa2001f3e0ba14e1ec376d92bcf68799a4aa17284c6643e57b42381858232a0a64cd51e13adbe4aa38c5cc70b5

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B6.bin.RYK

MD5	17db19bf595cc48b59f58809e44c67e8
SHA1	91c439dc2b336b842f7bfb11b14788516da00af9
SHA256	cd0e828fc5ff506295f397c473ce0eb87810203667ede0fda24607e35b1b8c8e
SHA512	13ba5e882e56be2bd28acc215af6751416bb3d27d356016199a1ab6d37137b556826ba435709f9f96e449c5f031c6211c9da230e2341ca05ae446d59ebe326e3

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B0.bin.RYK

MD5	3b4710fb635dd6049d918c3246c68d01
SHA1	2cf51b84e584acdbfd6173a1c962701c5dbccbb1
SHA256	b83b81c5fd8845663df7bd0bb58e29bafbac48d070c943b8d8ffbfc365613c98
SHA512	8ee9631c618a9e4276884cd2afa8e24a5711b446cc8dcc2e1502e7b3028441fed06efa97099ebf1fef7c4a32fadd09e6bf64e68c35419a9a5efb0e812fc1ed25

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B3.bin.RYK

MD5	fe867d6cdb774582375f3875894c1267
SHA1	f57ccca6dd8d7323b0b3e95170bf60ddef7dff96
SHA256	12baa9a7d1cf0096c9545257950a6526e163bb7b3739c972420214354d53ce81
SHA512	02c3476cacbf283402d1d5658f7d7026df52d7aa7b19cccaf27faf9037e28a7ac7d1793d7d2f8d9c98182396b4338b1b622f464e50288b8b27dea14f8f952c0c

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AN.bin.RYK

MD5	dfcfccaa7bae1865b1a47b6c52f81303
SHA1	4cb5e19fb49703eaafb49076503599061837b8c8
SHA256	7b9b9987d4923869f256a4f1699b5627a605553444166c831bae7925ac73d277
SHA512	47e0add1b1d95bd3a9e0908d54e8b422e160872c6b9a4cd9bf2aa8afa9f2067a6ae3c85543415b15e00ab1c537f1a7d44e9aa1a9c381c6c63eaaa7648275a50d

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AL.bin.RYK

MD5	dd326cb5ddfff6dd3b54cc48349d0d13
SHA1	685e74c5baa983bf37b6e062f64857ffd6cc5f41
SHA256	cb46b2398b698045b150e94d4d24cf6101c78b8f274d0b59dc4574987e70e342
SHA512	ece302b225c231c12f1414fd9a5ac69b3a3d0c1c2d3437435531872ae4e1780e96a1baa4e33479939098026affeb0f6f0e72a770522d6a5fb8a94d1daf30e80c

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AJ.bin.RYK

MD5	3fdbb85ed9e7b01ee9b4028c8551b89a
SHA1	2d460672c1ce907e362ea82fd15d90addf23522e
SHA256	15d6ea773e8782cd16c5b6a34abb7aaf821b12cded4a99048489a7d2db54455e
SHA512	0513dd2c12c5569450f0abd1a8db24faf9e65607a638dbb0dbd6ab85ae4e51642e5486366fec7d9a08408e9d9216ed03359d1fcd2cba55f99443b50dbe990b96

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AI.bin.RYK

MD5	a7c1719275763e2d5c398336286c65e3
SHA1	bbec0b30d07f246821a7df188818df68f9b6b4da
SHA256	4aa7c41ab77f5f985d5fd69d5cdc3af2bce411da7a25d6fab32acb89e5fe0a1a
SHA512	3d60d52c73e8a4ea0bc77e35c4cf90e4863eadf38c7cfae7660cfa14843ef93b56453da4c596809dc486e92391bc4490cc4c28828dcb30aaf5a49836c52d8c5c

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AG.bin.RYK

MD5	1b2295d2fa09750f28ad66fb59e3e5c1
SHA1	c7f36297d8365733f326eee97813750723927855
SHA256	15f81c1b8d4e449ff0072ccdfb12b1704a4641017dc28e3cdbfd5c0123da906f
SHA512	b6273c91be9ed58dbfc6a2e1c17f68afa0d1f6f377428b4ae31c4f88eee9edefaf4eeca09671ad522436d951bea2f9e23b7a8e3a903538d509bafbcfcb87c53a

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AF.bin.RYK

MD5	3e506002e5903b85e52aa5137704fbf7
SHA1	1c595630b4e3ac6f33b46699446a05afde9af9c2
SHA256	9d1d2986831cb7af1af9814693ae84ee9ae3a13bb689d4357be17928d2968e89
SHA512	08d5fd0ab46c3aa74d171755a84f937fbee2cde02e794eaa438b3fd5c2a80903a1beb56a98148d79c58a3e5db55ff5a66e1c70b8d99bdfb0cdfe819dae4a0b1e

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AC.bin.RYK

MD5	342c9201272cceb786b7cb618fb3ea87
SHA1	1908c4e373e0816afb36e6c5e97ce8edb043f344
SHA256	f8173a52025b00bcc6ddad319aaf7912ba3348938b7511b81f0bf2ad844633eb
SHA512	fe285c9e5d30f62ef90a8c9be3cda64429a9868fcc7038d7858722b2cccaed5ffbdbb40f8fa9a44b6218137874df0f4c036d463ad525d15e2d13f751bd3ead26

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A4.bin.RYK

MD5	9f12bc9456f2601c067a0a4b86c5b797
SHA1	d4d294ff294e798030c8c08450e7f1803735aa92
SHA256	30e60e4f98497ce1a2def1018f8d1a9808c31c124af5316938bbb9a7dfa68b88
SHA512	38894528303407602c41ffbdb132459454abb25cc5ee06fd13e0f1b9408a728fb79776e67439fb1eb4ebe7a0afd239109b435f98390fcc9de3136a91091965a5

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A5.bin.RYK

MD5	9e5b3ed6d2799ca56ae8bb4b1ee4ba5f
SHA1	3f7db72912f8937adfe6a2a4b1b2d0f1b78f7acf
SHA256	b4dbe4dfa61c3a70ff7256bedba5f692c9b3a40f21531f79adfb4c1c0bbd6768
SHA512	1678fa169213118a30f7193db452552ad5cd522bdb4cd75c786b0898cecb666626dc36ddb93761f32f0048b25e4770890f05d3eed3dd132e1b93f6e8d1106940

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A6.bin.RYK

MD5	373455887dfdd60b5b6b8f9344faed34
SHA1	6c898beea580ee0cfebf63ebaa296e723b7b3211
SHA256	bd1921a0ab056b389941d6e0b7da3872132cd9f755f87cb0a39202b8dd9b15a0
SHA512	c6f170c2494864daed03b951b399baa96fa3433e8e554ebe828596c11c673b372cc425f2ecdb6f8701b564d89fee6b5fe3f856f19b095100a51a76e122822546

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A0.bin.RYK

MD5	d7b468cb96ea07c5c47d0b223e9bc3fa
SHA1	1e29fe830a7207d4ab3080004a53bee8bf0547e3
SHA256	6e4a3ed9b60c71d8228a826214aec5b5acd78d635041398899e11858d7cb62d6
SHA512	9e5ec47daa4db7cb66ae26257f3d7a14eb386a068644e010a740c3953719a1f1fca84250d1fc53bb319626df6d5ab973d8924ffc11a62416c6c52d0e3b264fa2

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A1.bin.RYK

MD5	0ae265802e8bf4c266c4a6b3d3db33d6
SHA1	81c3f979b7323173398222fb63e66b80a16e336d
SHA256	b979316e649e041706944029509df004d8fcf46825bd5a59d166799edf811f31
SHA512	7bb81a81f90365cb9fad64a182646371efecf5025ae0505a664de887588c8317dba22497efa27fe114d94597bce42e6f0d8065b85addcb70d96a0db1ae19a6ba

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009V.bin.RYK

MD5	a5930b7baabe6405106941c411946585
SHA1	f6951ea159fc401ede116c35298d19bcc853ceb9
SHA256	0bea40a5d0e0fe634580268cb8d7532496597df13f5f656a6d218cecbb78c8bb
SHA512	8e1bd5e05def76092df445207a7d369ec8a76d2c577b188249756c0e21f7df4dc368e93db6f3339148c5f8f3c0515c38c32005c1b6ebd549cd368858acddc6b6

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009T.bin.RYK

MD5	eae41e1140a3d9c84007f342c30bdcc1
SHA1	ee599439b90c1506edac686fdfa022ae35ac0fe0
SHA256	354959460af9e50f53889d801603f01bf58647e7136586e6cb8cc9d474a82b1b
SHA512	9363c6320b766fe6548db064b99919d3940740b1a118f1c9604152910dee9d8dc94706c1440d922227f19939d6c259fdb90f27c6c7fc6429528dcf5fff20c7be

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009R.bin.RYK

MD5	3aaa3a26e2ddac9efedb15699a025175
SHA1	6ceab934a846ba337f0cc07bf108db831e1fe42c
SHA256	e66e01d4d935d1812f02b5ec8a16e677c8f4ab0864fecf2433aaf33112493a16
SHA512	79731ecce5f6d74ca86fd35e00d93ef5a872c5a5b197a1c838ede241dc1e8239ee2814dc126eb5088cb6b6748eb12628e17c07cf12ffc868acc8d82f5dbac2e5

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin.RYK

MD5	1ad201fa02c80ff638433179c87de27f
SHA1	f0aefbc8fe3405392e599e6ccca753ffaa139b27
SHA256	83eedee76f8c45bd2f222bc65827c9ab282df45700e282bba357c69d4ae7e12b
SHA512	41e54072d1cec4f11f65cd5e7bda54954e42a12e609e993f12b47770fbf2bed5a9b589ebadb1e25b62628ac7d201ef07b8a05de5d3859beac74c25868901013a

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009K.bin.RYK

MD5	f4c02fa582f5e9448d8b89fa765ab7fb
SHA1	4690c5fdf855f2ac0410dae8ba0398790a473121
SHA256	58b20dfe8d4e10472497ea6b93637a25acc966565dec35ddd36dee3e1e64b619
SHA512	fcfa891033f18f5df40e23f10863d95ac28f4888d66346d1799b09873e14992e6cad4080cbdbb7c2880f4937c2b52d03f13cd0e2a43b5988b86615b8ab6d6e77

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009I.bin.RYK

MD5	67034aa59925623dc7d5287012214830
SHA1	c7e2052f2ec35c484f9c9e493b10b9eb5bb91874
SHA256	f6dcf3eea8dbcabf6e51c839c57ec942438304c6754d6a4c1b10d552a43b20af
SHA512	28878d5851d43e293fed4bf20ccd02655f40461f4c08cc442558006f22d9fe481d1617fedb279acc35721cdd738d5da2989057d807900e36f1b43a064c0f63a5

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin

MD5	4c9d3bfe90aa33f6c95dd750c8b1f769
SHA1	8f9aae42550ae1ee39f2200b26f919a45bcddf35
SHA256	1e822c0de021ef6144190e6da8ec6ac0de4cfdd3a81c5e36145fd7d2497253ab
SHA512	a8edb14ebeb45ae96f87925f0f19d431a8b1b262da1b487cc07b860b2bd00aeef80516f6c80096cc9d0479f88fd3e08dbedf4f7d008b2bc80a0fa3530370a7f5

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009F.bin.RYK

MD5	87d37db953f11af43de0c3865e0a6e22
SHA1	f7e5e2a1799941ec016a91aaa331814296df5c11
SHA256	dc7bdd75e2b22094b324ab7eb3a035d4fa4df9f4e9382415600dcb16d6204e53
SHA512	5328b596880c88c644a6771f9bb3fd0ecf950a17453f398dde463e2ba37b3febac86203c5f1de4e9243b06a580e0c1e972854a0a13ab24b2a771c9dff7f5f8a2

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009G.bin.RYK

MD5	5d3577e0dacd06aed5abfda6084bdd4c
SHA1	861e09b4ea932b14e1f7e0dc13e0234c5ed39105
SHA256	fbd010727d4055f5db2128b0f0c44bd74c98400ec4c554ecc2cbecff71d7b26e
SHA512	21030608ae6a1c48605b8fcc5596c61545e1a59dd9e7259540c824cccd2505882e4cb487cdc1f253941de7748548a793fd90ca2fdfec7f4345a05c3cc99301e3

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009D.bin.RYK

MD5	994c6485d55c2e23aa8d5018acad2e1a
SHA1	aadb41e8145fa862bb596f73146d9108583a0550
SHA256	ac91fcfddbde39df64c7104ab8194d757f2c5a020f1b0a861523c4c6dc5fc703
SHA512	ec4ae1ec12b605dc872820d3beccc5d86006e7ef6523cae715807b478079be8e4313a34559769fa8dc46cbd309d885996e9ad35a9d9dd8541a01d75265c9a18a

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009E.bin.RYK

MD5	07ffdaafa4741914ac41f417dbab0161
SHA1	25f4443b30fa868c980173f79f763ddabfa6f952
SHA256	f1cf1d1abf7f644d57ceeebf86cd0ff8adacf32658c745b7119a703051cd2bd0
SHA512	a5d3f19eaf1c786e7b0776afa68d062624c7b6e553811d76520f5fc1684c3e9586481388d56169d96d05e53a9bde8b8537c4e5e3c1dc6434e256076338b03018

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009C.bin.RYK

MD5	6ed72a7930a4a6dd10b1e891bd885970
SHA1	81a613a56d52de75f2072f3d0e2acb829981209c
SHA256	0e76a74d895b2762dc95ff6d5c03ba57948624543c593f7a1de8a695976dff1f
SHA512	304ed1f2be3024b17b41363e6528cebcb18006efe9d6fc9614cc64ec20aa223d15816f205e2c7974c4c5b6c7c25d9d58d674c07aed1c197cf2173eea7326e629

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009B.bin.RYK

MD5	e35f637c3ef24b0c6366f3e2c8a3f030
SHA1	9ab05b1641c1c50fb38952971f20a600c63daec2
SHA256	cf1f9dabea7406063961fcf5e28e245e0b043795d25cd8222b51bb097056082c
SHA512	d3b8b8b8ced95583b6fb71e25d5abe15bfb6321047d838aa98791705453877b681ef7acb245b35c40991ccaa5850dc1d6e6907f9df2c6206206915f950544d95

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009A.bin.RYK

MD5	d1a1147d65b335a2bd3de6fe1b6a8905
SHA1	5d8baa1dc308d447217efa7469b55698d5f37444
SHA256	0202761d06c204a6ac3bf95bddc337356de13f74d122976f0a0d3608960bc49d
SHA512	8d2696fbd0f38be3bfef556eafa9d6c464a9041c0c35c43a104e98cc2539e43e59e8e5c84c37d95382ef9c1ce52280f8aae8e734a945150a2fb06b03f1c45edb

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000099.bin.RYK

MD5	b4baff8202fcb0c343d9699a83a932f2
SHA1	eeb6fce646b2c5d65bebc307ecb48528baa2c8dd
SHA256	994bfbace972faad3baab024c5afbe6edfb6a85ff4685d0df808cc3e0a8230ed
SHA512	8fe5335f806e80d0d52c5814dfe3ec854b33a577ae4dcb2cb366cc40efb94fdf45378037f45cc335d2e426a89d6a976bb636aa3c67a9e08fa71c6f068d70f1af

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000098.bin.RYK

MD5	2ec1b61e516a0e9358aefa4804c69070
SHA1	9940f0ef39213126b8a2ecadc5ea19be373a1978
SHA256	b97ca7e474949327ffb25cd393b02a41c6c66e397e07c7a665176c3f14a08093
SHA512	19891a37392a74e91a6818dbd5d453868f46d3810135909ce410e248bc12676dcb2eaabf08f7116a4f6935412343fbcf8abf47ee8835ea69633f4341150f111a

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin.RYK

MD5	0cbbe977f6b44c77163063a5fc4e8278
SHA1	913d7048e2b270bd25cbce67d821a55851103a13
SHA256	aa7f3ed776a148c250a391bc3e47456ee3462165c22212b3baa4d1a109c4516a
SHA512	10ac08626186b7b982b5aeedb3f2eaa78ef10ac9f89ccaa0a7777739d48d1df330d7a9d2f354083611ec9b738f4fd91921d1c54ffdd18b4d783cdd0ec395a705

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000094.bin.RYK

MD5	f93634ba9a0256b19b8dcc150f0ae9d8
SHA1	3a6b7818845950f3f20d206fbee37706613e7ae5
SHA256	c64f3db5f4a4a8a563165a610392523253b8719d58eab9a8f8a363dd720bbacd
SHA512	48a6b742e3ae7935e2fbc978048f8440c60cab5882f76a4ff9d3e1dc5b01fd78115eea06a664025164f6abd00ada31026e9c0bcf3a46f3ca18c0f741e95fdbc5

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin.RYK

MD5	370dcd67f79edead4b938772ab9940f3
SHA1	4fdef7000d624aa28ae7934c4b07a3b781996664
SHA256	26649004642056d741098e840efba913c651ba1b896a96567523602603794f29
SHA512	e9dea1597659f1c189c3aeb626ca52c826bc64c95d9c753f45b820da85ed23b2b496de14d4987a821133dbecc7bf723f527c8b6c4832b62a5172c620f35d5562

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000092.bin.RYK

MD5	0d79ae8124f9ae5feb51925ea57b207e
SHA1	fc72af54510f42b3780be30cc08fb33d17aa4d93
SHA256	f6c680a374392f20de06e5915a5b99ee1a0b27fd22fd709369ea1c7d6218771c
SHA512	c73f225ea44b40c95483a124ed5526584b7c057381e4fc33e8d8edbcef7147cb92b85390153559867bcefd7de9b4320ee59f62617c8959fd184ae9393050fdaa

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000090.bin.RYK

MD5	9508743f420c19a70f104943d03b652f
SHA1	7939512724e7647171fbca44ad895c061741c07f
SHA256	58d95767b451d2841aba98347e701dc84866354d5784a70b33861591e5cd403a
SHA512	e9f82d6c8ab8c031456f6cf11672fb03713dc6b9152af0ea6a04e1d394d669fdc8b0e87d67cd2c7e85bb35167ae3940e3d8c9723947b9ef2a0e1dfba729607cb

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000091.bin.RYK

MD5	d48af585e07885352aad09e1c325fe35
SHA1	5ec01c2a378faaa802a8e8276f048d03a4b292d1
SHA256	afa0493ff6ef6b4bba566be37a5e321d51dee7b572ea947bd2af1d748e640fae
SHA512	65b6c4d27cb916cd9b108f41a7cc5b2eab0ac3a270fe5cdf5a1cd26d7da7c76f00acff86cb302eb51bdb5a0213a44f25c9c2171a160388636d77db3ebd4039aa

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin.RYK

MD5	48c0af08e2bc21cfbf642200ce1411de
SHA1	25268c24c60f6fb223a5b37dab1b24e962d4415a
SHA256	1b4ad51d5ecf84f016493a3bc5c3300f3a02bcb439b3ba8c7e081f8806a29391
SHA512	0cf40bb5210bc2a68abc9f1f2b0c06889f7e0364b56e0fb8c90b96bb26c6c691ec7cdba0d88e03971b0aacd9e84f809f55087e8175317a650b475cf61aa18d78

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008U.bin.RYK

MD5	88e4f8ce9174f41b838f2f1bda3348cd
SHA1	31381cab865c6b571076340226c96095f20afeab
SHA256	fd86d6d6f0372da9dbd50e99d8d8965118a216f1f368909269bfc36f631f9d1e
SHA512	c99d6381d9117147aa5578ffacd93dd26a99a0d5e7baaa80d556deac336c7f0359eadc08caeb46e45fdc0e76726c80948bac85946ca5e02b70997ff4f12edd98

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin.RYK

MD5	d9b65505724b1a66722e6e746d095a26
SHA1	f4340ec3ec7d29db55a3135e92e96d3f5038fe6a
SHA256	c286ff0cdce21229f484f306ebec8c1b46171edcf0a5808045de6e5fb7b34478
SHA512	abb6617f5a3c9119408cb08f2009911fbe1513ca60b3090cff120b11f44f5359de1621fdfab1274483637fdf52000fc0aa294fdd396b60c46cc876ee10c6df63

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin.RYK

MD5	afd529da63b97a2c8c957e8e96f5c7c9
SHA1	2df10507f09b9f8e65f39ae415ad0906e2372e41
SHA256	37f193f0ba0c23c6aa01007d3706d71e722c1af738f73dd31b3ebf739f85d1e0
SHA512	898634590e7adcf734df656caa0642a8641749bd8539072089a6b53bd3fe20895c8f8262f0bc4a448d4a8cdf7bc7c046d9fd76e8b5cccbc55c46c8643156b7f4

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007J.bin.RYK

MD5	4ced236854813e29dfa16bd7e029bdb1
SHA1	9aa798d978429740c3c33dfd0cbe8d06f826315e
SHA256	02fdbe8c4d37611966870737596e048e4587b82097b83c79737217a09c49ed2e
SHA512	632eb64176950ac9dfc39ab30baf71d2987218a66a6850b963006e4111705cc3465bf477e51da0f2fcd1cd1aae9a5ed5577f36954132c0315af94697393f85a3

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin.RYK

MD5	58beab4f06b2f2983e04ed76e3ef9bd5
SHA1	4c67d3c416165df21359736b8e91c82fb08538f8
SHA256	b03f2dffd7538f43b25ae4c58006874416aeb021eab9c49589e119ab0149d193
SHA512	394bea3d43ffad23005330d0eaf00e6fbe746723f43fd0494383dd769fdb82cec7989ea9fffcafa9cdcb8e3679e1df4db8d1d4c04f2d884869a48b37a675d928

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin.RYK

MD5	d9c84e4cb2b860d8d2210b3a9c8ebcb8
SHA1	6bb0f8eb92cc1db7993d09cda73f4146659a4e09
SHA256	b337f26a8d9623d4ce22de7ce362db746b56a373b727058cf9d46d7d7a837f50
SHA512	099295729b299989efa0593acc4e581e5d353e856fbddb5c5fa0d939cf54965f9be7910afd1962d0699e54bf7aa559989b7ec29afae775fe359cb3bd2b47651b

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AV.bin.RYK

MD5	31d0fe268113b3815376fafb1b45bd61
SHA1	48f97e24c9667e9521d6e70c5691139427197388
SHA256	b41086e5db4a8cf1784070faea476df4613c239d86fdaf6f428f0fddbdd58750
SHA512	35daa0a927b391ea6430960156c42b3e56552745ddf9fed4918bc69fb0d1e10e34f860ab3912e64ad3fdeb06d600e9b972b80ca92a7ca0563dff9b7a09ba1596

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B1.bin.RYK

MD5	27a2dcfaa79b4c30008b1560430fa5ab
SHA1	12270f300e8431e672fe0addeeedc2c36dda4b41
SHA256	437625f8291579a5126bdfce4e30a92a3d568d78c3d0cbe76519b8e72826f708
SHA512	1f0e30f6c846b5e71674d3a53085518b5c1e713708c6ed8d3dd44795cdd52565ea017596ba1c7d8646fe8a77ff981731cb793b8a2cba81151b81a5eb23d06958

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AQ.bin.RYK

MD5	f1109115284168bf76bd5dbc67ca4e10
SHA1	805d40b6c619640c02811eebb9281bfa8c9d0e4e
SHA256	6f6ff21379c7e3f52bb28c04d52e3518daac210e4f93f1ad10dc09d56612dd4e
SHA512	fcfcb2ad222cad59ff90d80830aa48e75ee44e6f0f0f591df1ec3e06322bd66c92cb79bed14114579f59e19c5733f68cd385626a72562a14931d73c1f90312a8

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AM.bin.RYK

MD5	0dab3eff653d829d3e95714bea294f94
SHA1	fc1341c1fec991bd69000af470273aca674b6f54
SHA256	04609f70665ed67d24918997771060c3137a3bebb9ac497d2fa3bfd13747861a
SHA512	3ea64484adf88de4f0b474639acecda710bfa29c5f5d2dad2422d4d9f4d3c8db79ce258c50dda4758c5dfd7d49aad708083c3b22b8e375a2907c5339118d4883

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AK.bin.RYK

MD5	b48b2a9e7c84be65e1d17119a6e9e73d
SHA1	794a89c510a2d64aeb87ed7acf03846076c4c677
SHA256	ba473a94eb4928aa56ce7c0e510fddba2db22ed975bae5709ebe450038e1b5c6
SHA512	f80329cc10ea1f8fd3896ffd415d911480c360adbe5a10dc34d1ae6605666350d41e1af7b7ed6d8911f86f01ce8d49ae7f1202b167b15c5f978f0ccfb8d71733

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AH.bin.RYK

MD5	cb358743b140659a7ae4a65eb0a6164a
SHA1	a255e62ae9e1fbfc03fdc21a7b988ed4bb93f1ed
SHA256	98ed444a933c5c6c42818e4065998602f3584847ee4cfbbc5df4752bef52c2d9
SHA512	7eee1644b715d65991e3d53a9b72f411c037224918f647a39f29a36fd34b932a647decc60d83c700b2f4a88cdf62b6db46e33aab20e184f6615e7232c9d9a1c8

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AD.bin

MD5	a6b975757768d4bab59e3201cfd95e7b
SHA1	53d48663031ada5372b7727f41aafd13f4e8699b
SHA256	e92752072d798ac6eb5def4eecc86402990a9d31f4e15d2ccfe95007a57e56d9
SHA512	8bf9d396fa7ee01583dba90153d3dd7874bb256d6cf526e097c09ad86fe0bc577909c37f8ae6cee3f07bec3c2a9b925d77c56a02affefab3cce5b3ee071127c4

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007B.bin.RYK

MD5	76d15ee8b79056c74f0112f34a9482e8
SHA1	27b8e3ebc472b2a1e84b3a706696b187f38fdd41
SHA256	9688222fdb819bc9a02dd05fd0db6b34294378a37968d72de222319bf29b9527
SHA512	c38bf516399abd9f3c72696633698b2fd4e3761ec8072bd9d724834d9a9e0a3a6f49dbb650e45b1052d8dee2986066672930746fdd7e00e2df7343b7c019f963

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AA.bin.RYK

MD5	0c35c2756fd72b39e6ebc56e100b2149
SHA1	c87e3c4fa1fc5880b1eb510f86d47444a7b8a528
SHA256	f2ea5cf57a7437059ba45f992b2e5ddf91b6beda3e8372ba08099c2d14a1b7c0
SHA512	919c01064d773a490b037326191416f78c5a3a880c547ad6c14fa7226a6adfab0c7d3f04357c75e632914f1211f982c7e6cbc40d17f1e43e5baa532535ba1556

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A9.bin.RYK

MD5	3f0366bb05669b0ad66aad3a2538e4af
SHA1	28f2c3dab603d240ec4716143e90c6929d779a34
SHA256	c4b1463ab1fcb186627a9603e3ae117e2e6d42c664d6ed10e0eeeda8a8579bc3
SHA512	d184953261cbe694e191efa81b2e606082804f0afe3c0f78b716a318ab8d15d6bc2ba0afd52cd6057a54bded998d4e981ab62cf052ebd2e02965b90d4e617985

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A3.bin.RYK

MD5	4d322dcd623ddd411d90fae2259158ec
SHA1	cf7e8c982cb5105bcbb1ea6863b892adc2f27d27
SHA256	dd064ba589cbcc822e1d7f7502cce7f83bdaaef027a8e0e50ae768645bd70f1e
SHA512	981ea1357785e6655b76964d97a8b1daef11d5cfbd44c3b8b8e1c449332ec37529c68249699baa91de5ac47a80209e52d59a5980484388beea9bd5400f9efba0

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin.RYK

MD5	637bcd2a5fa0e74d02e8d2d5068c5e55
SHA1	b0bc5bc28ce782c4f67666d473dd65e77e3a9255
SHA256	46e3a6bdb9039e9ff0cfdbc6cf0253562e6c3561cc06c58424c0cbf06c2e6938
SHA512	d88f4d1585d59d2c515fd1077f2fd55b7f82e3a9e89cafcd292cf95311af58dcf518bf953ab5a1e23c3baba4a7714ef53871d0296dfc2b06244eae4df352f487

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A8.bin.RYK

MD5	a2c2e3d0e7c592ed9c7d4e5b5b2c079f
SHA1	b32f36cb228596e4ef8271f3fbb678e90187e3f3
SHA256	832e6d11e410695480bfa5d36c55f0360233a6ca7116c37ba4c5c0f15062a4ed
SHA512	ffbae5d708be830cd0785db74a9ee11a871ea050505978c23acd4a54a1d08112c1e58c963a04c76f2ace92f2a50be5774423c11b635af0de7b65147cb94ff524

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009J.bin.RYK

MD5	2c5f3ff93f7c8933037bdf540fd3786c
SHA1	3724333553fb607f62dc2e932d37a36f66972312
SHA256	c04b622a3b03ef76b85de99daac4f4fb7bd491c79e2921f33a925838f1b55eb8
SHA512	15de22a190645cd1cdc640d57e261464288724e411657b309235e3373b3f34e1b75f03620621e8e587adbaa1f8d8e04dd60876893ce9ecfefe4fef050333b951

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007T.bin.RYK

MD5	4826d559ef11ab7b2737f72bf7d77143
SHA1	b0d9ccdef13b2843c639fd0ace46c8e2d6ba7a9f
SHA256	2d36b9bda48582feb44d16a1ed694902d32a591d6f9b036096d34b53d4b1323c
SHA512	24e329cfa0e31aa351fc9c94344ace0c709a5e36c6c6026ca647ddb19c02df0ba6804fb4c101dd3948ed20f8cf34a6d9fe202301d38c1c001810f98690cd68da

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007P.bin.RYK

MD5	fababb80b56b898060fc1f61a0c9a92e
SHA1	4d1cac196ab19b9e21cac7e67fab61aea052e12e
SHA256	895bdcdb34bd7ee4dbf3cb645b5cdcae527be14c74dd0207b6d5266235bd11bc
SHA512	c84ddd9208e1ad3b7a2cec5ccc7c7e9356a148740ab10b812050d5b06bac0e508eac377c562a54ce052133e11e4fc9440459f01aebc3a9c3622f784258d7c6ca

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007N.bin.RYK

MD5	3e2e1d42b54c88a4435c5ca6f69104f7
SHA1	8969c9cf6d797573054d86f63e449e135855188b
SHA256	9bd2a8ef8c6aa30d7f4188a5f02488bc10e64bfdb1e93918733c9d98b6cd54d8
SHA512	5feb5e978043c682aa7ddb97adbcfabd2d5fcac8b470aa7558aa8ec05ee91f1e03641e092b37e9476a6675f0d32fec680bf27f4ffb47082e727d4053cfba19b1

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007L.bin.RYK

MD5	cea706a82298f82ff1e094add8763878
SHA1	5ac06a163ae37137ab86889f7cd65e1a1ca83029
SHA256	0383ad62cd9de5eb9333a93a7dc3e6ecf87d3ebc9149b6543dc0a44313085f40
SHA512	6ee15f05d8e83ff0280f4119bee49071da8b5c420998345eef448ccb67da94c4087bff592ae5691e32509419bf9acf1d9697c3dab4a54b67f9fcfa82e30912de

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007D.bin.RYK

MD5	b5d247de801414e45ac77b128feb89dc
SHA1	d053704f3c614233d074685c82ac78c9e09bbdd0
SHA256	d1e401cb9993a5aa429004fa3f5e20c545cb67fcbdcb585816f2ce9a09237017
SHA512	b6c2d379ca22334fcdeca6f06cffaf8312f1a4cb861c34ec86672914acd068f5617cfa415864c0a04bd279cce0c488e54c1fa8445782a72abb4e7970610517a4

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000077.bin.RYK

MD5	6df6ba29dd6a33ba4e897bdc0b009191
SHA1	fd78d77b1bd8c9401d03380f37494236a5b511b2
SHA256	43bf9ac975bfd364cfc24737a68032f2904b39e2cbee91040de9c6ccb09b6c08
SHA512	f99426fde18128742f0bb84b04394f7f10d113a27f8ab8409d2d312d68fb3cc11219f8b347138f377df0ba797b7744f79665d986bd96e62da17b64c6ca77d9d0

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000079.bin.RYK

MD5	83b474727d14ff3181da585c3a49f377
SHA1	156adaa1f75444102ee0e18c87387458df1673a6
SHA256	2a490c8bc7731c8e0358272aa4de35c0b66bb255e8347e7dd93295839849dffa
SHA512	c89fbd2d402e24f1da65610c9e7426f891e8da43a68b5b513c6eef10acbce072fe5e9b1924d39c39fcbf5ef37a14973b8f593331b5a594105b380f83e534e354

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin.RYK

MD5	2ef6a5652d10a76197c5fb492021e599
SHA1	7c2b27c2be4dda6897314880b6d93da3e4ec158f
SHA256	459e93898b97c3ae46d89eef965848d0616ce0caa7d3638483eca7f9ba873c39
SHA512	fb52e05d6e5cfb2ce52cc576d8c838e0a89ea4cde94c1f9bee0aa88d26881e600fa5415e518894bd9e73f8dbb806ac0003ebf109d53c02c5de918926b88d78bb

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin.RYK

MD5	99666f359a5f790ee8abbd20f326b40a
SHA1	0bccaba755413694145152c8c766dc0227f28222
SHA256	7e203f1a28983dc26c375bac671290b900b8bca530ca342a407826668ab7faa8
SHA512	b91151b45e65ff6641821aa99e150ad69098a6fb135ae62c13dfdf775c133abbbbd98260d0fbbea4d114772ca4617c61f940dc9b2d98cebe43b0e00549911ac8

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin.RYK

MD5	7604f77e5dd39e6d2ea57c4fcc9ac2a6
SHA1	61e49db7641a82c60dbb8404781749464eb046fe
SHA256	e7de3feaf5f48a3e9f0bc2801438372787160742c65a3c9b6c2a951c8670db9c
SHA512	30f66371910f420c05b0d4d7bb5191ed34e7e60268556db56e31a8143257b849f5ab505fd6600bafa5bed1c8d2409b71131b9bca2fabaff2e58e2c0081e9d39e

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{0C06359F-5390-11EE-8681-46C199E3C1C3}.dat.RYK

MD5	be8c996c0e3ecf549809bc9e469f9eaf
SHA1	cc6f209e5066b97cba536f58727f13d7811ed096
SHA256	6b9928266efe1942323a5a703b1d344448ab4115d341d3261e56fac8fca473aa
SHA512	9fc2563ef27807715c0d2b4160079c78a37346e0f253769ef1a2b2cf01d4f9c5906ffdc900df2ad55c8912ebe2385302a6c6c492784c86daa8752e660c04a015

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\85ECBD41-635D-4DD5-BAA5-9600E9746FC8.RYK

MD5	aa9c0c76b33c0a277c3408e5553838a9
SHA1	eac031a865328c8c7b820428d9cab68994ffc0cc
SHA256	c8da21a776d4098d1f17b85a241c8a53de4f81e3aa511b7fe1f3459bb936a924
SHA512	3f3d653b0abc3b902056e5398b900309b43d65d4317134c486cb3c16c26f1cfdf058b2e02f9d061958c8eca4cffc4bb421a70f5de4395d7b99ca0c31a2ba04d7

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\FFDCBFA7-A4FE-45D2-9F91-1AE77C5D0096.RYK

MD5	491a89916087201a6c1f59958d26ae9d
SHA1	68cc131733b13b8d90fc1d8d514305d1d45a1ee9
SHA256	c600e2b6c904ed36e95e04a0929157ef5cde16e07c08286f6338b1d8795ac43e
SHA512	9e59f1466eee82f0155263f4386ae58e1364230ba1ff0483f82d75643394778580655ba4cc43676337aa079ae461af54d396577b8d678faeb4117df0126be573

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5	34e08200a548bc9b832e32cd078974f4
SHA1	99ad1a78d04d81cd2b3481d438c0f7680cf0a29a
SHA256	9f5dad1e996c0e68a9cb5ada6f0f0a8d4ae6992c18fd0804325b90e76d6f2bb9
SHA512	ca3c6b8bbe9adf3e9fb3b407c3daf4ff082011ed100fa6475e91895c85fff664de810f06ce4050c6b8c135a814cc688b997d171cd7663d44c0489b7901b14a04

Sample ID	231018-1xkmmsbg3v
Target	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
SHA256	8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
Tags	ryuk discovery ransomware

Malware Analysis Report

2024-08-06 09:24

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files