Overview

overview

10

Static

static

d8a0d25776...88.exe

windows7_x64

10

d8a0d25776...88.exe

windows10_x64

10

Analysis

  • max time kernel
    111s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-en
  • submitted
    13-09-2021 15:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488.exe

  • Size

    140KB

  • MD5

    c0f972c5e033c0b4dc268a805cfa16a2

  • SHA1

    a3f38579feb14d3b20289e453b41d88232145f68

  • SHA256

    d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488

  • SHA512

    de7803c4119355be7e06616abbfbf44b4ee23ba2caa987b630ad520126187c1f9eb2308f0ba5ba51cc8287fa75e5251d4e9d5ad940e8beb90b97f65d4890ca47

Score
10/10
ryukdiscoveryransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\RyukReadMe.html

Family

ryuk

Ransom Note
contact balance of shadow universe Ryuk $password = '3y5fSfK'; $torlink = 'http://ojaiemvqphz6dgg7gncqpdlbx2aoisftpwvrhda67uth6ncuax2ghyad.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs

http://ojaiemvqphz6dgg7gncqpdlbx2aoisftpwvrhda67uth6ncuax2ghyad.onion

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs net.exe
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488.exe
    "C:\Users\Admin\AppData\Local\Temp\d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1188
    • C:\Users\Admin\AppData\Local\Temp\FowgzSvUJrep.exe
      "C:\Users\Admin\AppData\Local\Temp\FowgzSvUJrep.exe" 9 REP
      2⤵
      • Executes dropped EXE
      PID:892
    • C:\Users\Admin\AppData\Local\Temp\aPQiBbtlZlan.exe
      "C:\Users\Admin\AppData\Local\Temp\aPQiBbtlZlan.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      PID:432
    • C:\Users\Admin\AppData\Local\Temp\JdYNxTfxGlan.exe
      "C:\Users\Admin\AppData\Local\Temp\JdYNxTfxGlan.exe" 8 LAN
      2⤵
        PID:1160
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\*" /grant Everyone:F /T /C /Q
        2⤵
        • Modifies file permissions
        PID:860
      • C:\Windows\SysWOW64\icacls.exe
        icacls "D:\*" /grant Everyone:F /T /C /Q
        2⤵
        • Modifies file permissions
        PID:1016
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
        2⤵
          PID:2604
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "audioendpointbuilder" /y
            3⤵
              PID:3000
          • C:\Windows\SysWOW64\net.exe
            "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
            2⤵
              PID:1580
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                3⤵
                  PID:1092
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" stop "samss" /y
                2⤵
                  PID:2688
                • C:\Windows\SysWOW64\net.exe
                  "C:\Windows\System32\net.exe" stop "samss" /y
                  2⤵
                    PID:2708
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "samss" /y
                  1⤵
                    PID:2896
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop "samss" /y
                    1⤵
                      PID:524

                    Network

                    MITRE ATT&CK Matrix ATT&CK v6

                    Initial Access

                    Execution

                    Persistence

                    Privilege Escalation

                    Defense Evasion

                    File Permissions Modification

                    1
                    T1222

                    Credential Access

                    Discovery

                    System Information Discovery

                    1
                    T1082

                    Lateral Movement

                    Collection

                    Exfiltration

                    Command and Control

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\$Recycle.Bin\RyukReadMe.html
                      MD5

                      ef4f7747ff07d010fc040da223fdbc61

                      SHA1

                      2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

                      SHA256

                      6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

                      SHA512

                      0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

                      Download Submit
                    • C:\MSOCache\All Users\RyukReadMe.html
                      MD5

                      ef4f7747ff07d010fc040da223fdbc61

                      SHA1

                      2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

                      SHA256

                      6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

                      SHA512

                      0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.RYK
                      MD5

                      a4138b01931dc6ce67a6857c6a5afda8

                      SHA1

                      ea6d86cde15e6a464634e714698f1d8ec39c2cc9

                      SHA256

                      e2b35cb6540e0e2ff7a62be4813d3ce8fb28396be11e4da71e083fdc5d5bfc97

                      SHA512

                      2c94eb9209ffd9bea0db8a816d5a83d9dbdc4297cd29d1d94fef0eb320ccf7095a22d574d175bf7c379a6a751c50341ec79603a886257fbc53abcc265b043756

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.RYK
                      MD5

                      81b114688aec3acdb0e899a16f7873b8

                      SHA1

                      fcc569b43a501d39c167f6bca2b25051af45f6b2

                      SHA256

                      9d6ec25a6f5239812076c33806d9b6266ab5cd2866df11b1f2434dee5a825ea8

                      SHA512

                      911420fac9ea7f3c497353886a9786aae262fb4e462148b92f4769a0143f02607ebae8dffe4307fcfb9062444637471a345854a0d59b06835d9ab25f097a6586

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.RYK
                      MD5

                      06f15aff49b4bfd028582fb93619b284

                      SHA1

                      0cd2d006b41460015d274f874370d772301ba104

                      SHA256

                      d51f5e1ec178c862bb6640853dbdaebb456e11581ce67a4111f54ead67c13949

                      SHA512

                      f447f8ec83db38aeedb3b28013bb2278377c98a19496719427868303b9c946b62f2a816e34fbce97777d33ef1be556ab1e09366d2fcb1da8b0dfdda8c0c6d4a2

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.RYK
                      MD5

                      f59dcb5296cfe7b634ee4f3a4614764e

                      SHA1

                      485f29e92b2fa7af121f738a75f5c306ce103285

                      SHA256

                      d5f6b2090c2eee71296c437f096ae69ab2e44f03a15a5b2d3b69d42a52f70ec3

                      SHA512

                      b5d39b5f549dc4a865e13edfb39795a232e9dd888368535fb1baabd458fa9916e2c516ece1526d9476981adb24411a3bedf2fa0d5b2931f9f4dd03d53ccd7365

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.RYK
                      MD5

                      5135124e9714a820405483c194329f24

                      SHA1

                      783c1f6b9c967ad1898ba7806766d2b889d8bf2d

                      SHA256

                      30f957c3c44378189c552f0ea25f49435bc90f05c513f02bbead618297fd641b

                      SHA512

                      a54bd35288bdc4dc32ec19c398775219931dc844cf06e700fe2d564e0215d8c67e759a7a1d85adfe6d7ee5e1d3d5515633521fb87d60fa1f134c64175e122456

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab
                      MD5

                      071d2cacafcb4e3c0929c9fd74197738

                      SHA1

                      9211c6204a7d2bad1b9b80f5e40c512fb974d9a3

                      SHA256

                      e95c9cb4ae22807494726a5d8e3e0c88a82bbed90e77c1bd5c909d4672d3c33b

                      SHA512

                      34a94d1b0a5134348d5999562db94cbd38a16686196c59073024112a598d2295d7adf71d4c59f7497329af9ddf3574e0c09f2658e53b846310e256f2bd872b0b

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab.RYK
                      MD5

                      f784389646108862692691b0fee53efc

                      SHA1

                      b06bc0ad7e28890919b8795c591a89917cc1e8a5

                      SHA256

                      080319221238aff4fa80a2a9ea5a87bb5ebe35e9cfa3bcf31d7ea4feb8f63f77

                      SHA512

                      2916b514d4d905c9c80bcc78e5e32f55de0e4fb0cffaf8ab943a7cf5ba5a69fcb2c750b984534252e2562813c30c399360446a317c7b5a03a7ed308adba280b3

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\RyukReadMe.html
                      MD5

                      ef4f7747ff07d010fc040da223fdbc61

                      SHA1

                      2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

                      SHA256

                      6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

                      SHA512

                      0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Setup.xml.RYK
                      MD5

                      5fc06e7b73bda071ceba70a376a0e9af

                      SHA1

                      d798660ffa2168df15a28e5285e8865752597b38

                      SHA256

                      e1ea7c718e9443736192a7f87ec78d3b66361573dc5ec5081496fc35e93c8542

                      SHA512

                      1e8b44bce80685c1ff175591cc91d89c9d337e46e75ffc46d637f0bac8902c4063e3308548ae28e9bc248a082cbb906ed9c9bf6ede7002edc453e7f3ffba686a

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.RYK
                      MD5

                      fab5970e41137f862d531c1b7c9840ab

                      SHA1

                      7dcc4c8949f65a8a73c17b969e455dbc40af5265

                      SHA256

                      7918dd933c5671d1d76a630cb323e8b199ee39eef1911a0c99d1f1bf511d7f57

                      SHA512

                      8e7b025e7a4540070c9d6fb16a725728af758b3f3b04368d0afec410cf7a340662cf9e8744e4edd66f91a3bd4bef8678c1ef8ee29df1786bb28eb81ebad391db

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.RYK
                      MD5

                      b3464db7507f24f6977f0d905126449b

                      SHA1

                      27fb746d73b69531218fae1841cab456984aa0f6

                      SHA256

                      9428feca429f508e0b54e86782497b8e66aa40aed1f2df8dd1ff9eb79a16a538

                      SHA512

                      b70f9b67ab28313d5be0a4cd6bca1f2036eebc2db81ec5ae3c3cd7d4c4f3f4aaef5bd2954c8b4f81735ea9babf8028bfa00491f0dc2635f2f6e851d59e20cb04

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.RYK
                      MD5

                      bd51ec5b017f19b53936696226cbdba4

                      SHA1

                      7d89ba58467dc1fced2c26573ef167f04e3e8d4e

                      SHA256

                      270b1d44838dfa8fe6b121c2c4a948d3891c180c7a535acfc00bf622969074e0

                      SHA512

                      445c77702431a33ae968324a2472ec042d3b678310b08ab9524b2d925cf17521cde7d19bf5381bc1ce9d2f0f09680d96681f122c7d6aae25640390be98f798c0

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml.RYK
                      MD5

                      0730ccc8ab4fffd59e89a553b3ea978e

                      SHA1

                      be4f0d22b52c27682bcbc1bd69171bd131cfdb48

                      SHA256

                      8342f7c71fa22a50c5b76c522dccbc7355a04b432714b8646044bdf1190cc468

                      SHA512

                      5be727f504b46b1b26468baa8361bbdeecccb31460ca5536c09fc99446c97ffbc723b27f89c27228a173bb281be1c32cc0a571bcee6fb783a85e7cd8118e5bf0

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\RyukReadMe.html
                      MD5

                      ef4f7747ff07d010fc040da223fdbc61

                      SHA1

                      2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

                      SHA256

                      6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

                      SHA512

                      0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
                      MD5

                      20ba31cad3a47f7ee800e6431004f01e

                      SHA1

                      e2b3b4253687bb7442983cfd79370b7b726b33f9

                      SHA256

                      a6e8cd14027a60a54f399a97e4ed0e9c9f557ca6073a8288119b040a90553fc7

                      SHA512

                      93925676c46b9a5679eef43d5557148f57b818750f80108592046df5f86d7b2d236f8f4d4acef847dbb9d89a9c1d7146b372a30f61f41a14de4b075df550c90c

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.RYK
                      MD5

                      80ff3004c8277e4fa5b451da92810612

                      SHA1

                      b2bfbbdb851a786d01e7ef223c5676519975aad0

                      SHA256

                      27fa973bae1e91dd4a2f3b23457a57ef5dd42227966e6e2cd3428e1d06818740

                      SHA512

                      d08b617d10cb1d77db7c2f8766ca612d8c381bdb00d4b15b70999fda15a782cb5dbadade27a1ce5bea395f222bb165e8d11cbe7976bac51b6a2d1501cea98f71

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml.RYK
                      MD5

                      bdb2326ce39522c8480be190e1a15339

                      SHA1

                      7ca4d372ea907608a475f50659d098378d6105a7

                      SHA256

                      4e1960eb0148dadd75a31d40451229f5df5028b3e18a060d7381c9c6640c8935

                      SHA512

                      79347a92cef55ae684fd9baae939f361d1acbfedebcde6320e1c97900397ce60fd1f489de07f00b50a902e26896b9d33a35ee7938b3220800b3c1a042bb5dea9

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab.RYK
                      MD5

                      506a858c890009b7043572eeec11799c

                      SHA1

                      7eb701749ddcca22179be1ad22025504a91fe7d5

                      SHA256

                      b5fa58ec9a58990f116050a0ca73f60aa36ee95e2afe4258037d67af88c6e1ab

                      SHA512

                      8aee4ba6a1d7672cb2230c6c3f92333928c9cf170d4ce40b6479a73fadbbc9265523ff953a9449a99b4c91d00f2e03b63eaadc81fa7fc76c71409e872501ce3d

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\RyukReadMe.html
                      MD5

                      ef4f7747ff07d010fc040da223fdbc61

                      SHA1

                      2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

                      SHA256

                      6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

                      SHA512

                      0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
                      MD5

                      7542e7f607758e654e3e3512df5cee33

                      SHA1

                      be69451703d23689565f39e954a85f038eb0ded4

                      SHA256

                      4e0cc2cb6276b707b81991c734fea62ae87f32388c0ca4c9e18e232fe43df543

                      SHA512

                      741fef8d6cfa9ff075e92d323b68399c65e403fe8845bed02b4b046a88f913dfd1de59fafabc12d151e84f8ae3ea0d6a09e9f7cf9f261643d6cf3bf6a5603720

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.RYK
                      MD5

                      6c4dd39dae10e12f0e86726a916a326e

                      SHA1

                      6dcce35deea775e21922436c9a1ccc634707740d

                      SHA256

                      ac324464372b3bea6a9b318890cab1247185bcefa9868223cc7ceefbb8f08c5f

                      SHA512

                      ceb75a213ea412e60f59812111a34898033c8e03eb6860412672ecba5838e233a3e4ccfadb2cc18fb740c25a94155d58f68e68e93d493bc873e4bbc7d900c252

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.RYK
                      MD5

                      4854c2df8829320c63e2abfd590e0904

                      SHA1

                      0c1cbeb24599bb947c69ddd1466bfafc23a514b5

                      SHA256

                      d38ffc55629d7190a556453a431092fa33149f56fd9b48c978772cf35ecc6b9e

                      SHA512

                      7372443d72fc156018ce7381c0594f2bf6205c39b2665fec23f86a78e19d7138292ad81869b0d003b096f2833dedd69df524d8f42c6f9df069cb8c34f5482b4e

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml.RYK
                      MD5

                      f512be539cea4639d283a305444f0c8b

                      SHA1

                      4aef33a0a7cfdd4456b7558e58f412906e18beec

                      SHA256

                      183942e16c3b7cc4b773e123014c4572375ad812bcd134b7371933761f5acb94

                      SHA512

                      a20961ba872edd820317a5ea3ee8958027bd68a6122a3ae8167ad4e3ec679e6ff09ff283b062b92ce251b769783e192c09d698b602cb58e0f52b46003b29059e

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\RyukReadMe.html
                      MD5

                      ef4f7747ff07d010fc040da223fdbc61

                      SHA1

                      2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

                      SHA256

                      6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

                      SHA512

                      0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
                      MD5

                      4146da908399abe59d881e6081cb1cc3

                      SHA1

                      f083cf542d2a896c2fe942bd554ee0aefe8ece80

                      SHA256

                      38746c2dab5ac9d3d652b7f5045fe73d1c6ca4295590f9fcdb12ae03783fe34d

                      SHA512

                      2573105fd4bd4cc2e0664ceef70b474a914cfa34be8db9d2d70c4472477e60340683c36e48981629ba4896777e6b26c1332896433155a5cb2a8a776a905e5452

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.RYK
                      MD5

                      f4e5be8516f7b460dcd94c127c5e6e2e

                      SHA1

                      8a0f4dd501e15fae7c0474d8af0bbe2936264092

                      SHA256

                      76d20f0d5f1a3e6d1b7826f806b5d07795ed14dde07c604936df72705d9df2c9

                      SHA512

                      af491784f0835f553e4b1b5896788eabf0ca45384459e935ada9e64189bf0d824419250914aa0a43eb475997ce41f2c8a9a9bfb003d249971a7973d56c3dbae5

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi.RYK
                      MD5

                      e2ed9b98d877cbf9410250cac932e8bd

                      SHA1

                      413cd7e90c19e5978869fa3170ad3864f7384baf

                      SHA256

                      80a608eb62cd2c7cb814323c2956d3cebd8997b1cd19e4fd1eaf7004febe8926

                      SHA512

                      cfd337e9b5cadf520a0d9169d445faf958125bd0c0165aeb34d56e5022e721d7aefaedc29a83785dcfad2a101787875839f2be5b5210ec9bd9d956df10462711

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml.RYK
                      MD5

                      7d92cb0ba14d1885a257b2c03aaf94ac

                      SHA1

                      ebd958a77b62afbfc8bfb974029000b97bbb7e6c

                      SHA256

                      93ff07cf01d98d0389f4f11e397b7704447dc871ce03f4234ec86919fa406f6a

                      SHA512

                      13e272ac88a7f3ac31855ea9a26923286cce4f3141391645e7cc88b285ee72883aa334229453bbbb3e667cfa002c6ab9e487079fd35f70f11c2d977762b370a2

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RyukReadMe.html
                      MD5

                      ef4f7747ff07d010fc040da223fdbc61

                      SHA1

                      2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

                      SHA256

                      6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

                      SHA512

                      0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
                      MD5

                      45ca93f736f134c3f9371047ec1440a6

                      SHA1

                      37ea46875c4cacd4360d57ade8e4a390723f798b

                      SHA256

                      6d9a93f332b8a96c5ee8ba819873afc60d6c005027372e3ed6b50629c98d93f8

                      SHA512

                      dd719e0ff29f776056d9fe3e189a219f422246a4eacc7302964488c7f575985019777d85144aa9cde24b73a1e638f66dcd1e92eae95fec14a860cfdfb34cd72b

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\RyukReadMe.html
                      MD5

                      ef4f7747ff07d010fc040da223fdbc61

                      SHA1

                      2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

                      SHA256

                      6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

                      SHA512

                      0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
                      MD5

                      9d3279648d258b829010da11eea4d7cf

                      SHA1

                      72fc1f3c2a3960a84b986fdb8333e572eb7fd332

                      SHA256

                      875e2c5df908de49c0f99233b671447058a7e84a3719d60f314821ef0f5c9143

                      SHA512

                      17c7304adaf2993c536d290a69c90d02f2dfc847b4a1f9a5f3118957fbae08da1856b5fdf3024f60ac2c8fce8c898754e6a671aad89a38bf1689955938dec7f3

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab.RYK
                      MD5

                      f0b1dc148ecf63eefe95deeb85ff76ed

                      SHA1

                      8f7f0025fccd00778cf2b5b1905d73486fe0f66f

                      SHA256

                      e79d74a55ec5df200db803e796c85fd9001572f409618614898c6da39b26c3fe

                      SHA512

                      db55ec5bdfb768530d043248edbd075e52c584587c1ac25be0e2e3ce9786cdb69ef191f5dbd4ae118ce43b77219cff24caa9956e8d8cb36d36d64f0dc4b98cc5

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.RYK
                      MD5

                      96ed7b21f3fb8a6d38677e6bd5a80232

                      SHA1

                      24731676a5bcd9a66f1a77996c2f27b2657ea964

                      SHA256

                      086735c154f925c3b02cfc4d7dddb1cd8565dac251630258c547698805b3a2f4

                      SHA512

                      c5d4203d199ec498640dd5fa06357fdd2ff0b1f44aa15a641a330a596ebb2b94da4859a4c0bf93939d08e4e5ecb0e8511324d67fa1a8cc392bc7defda65eda51

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml.RYK
                      MD5

                      1bd659c2bda99ef03777d0362febc3a1

                      SHA1

                      474da059286a788be6dc222c0d2306430615f295

                      SHA256

                      3135bf33f083d2261445a8642870f2ca466a7bb52fd785406d8d1c519e18cc93

                      SHA512

                      f27ca7173437dab73e130da5e5bfb7ee19893b1f24c06cf9bed08282118ce46c92382e8cfe02dfc548e6fc09fc237c37e0235e8e4644a9d6f129b3052fd27a71

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.RYK
                      MD5

                      2349d37869ef0e54d58f4c066ec51760

                      SHA1

                      16bdc795adc6e3262939d07b9c3701e68d877c84

                      SHA256

                      336e378dcd755bb8017b3a9e555587b80297776294a3557bb4e3c84584a0cdda

                      SHA512

                      0ba5279a278b181718daa0877301d63a70dd588452be9f40ee1c4f0533e13e82395619121580336e4d1edc07ed12c9194b77f23be6c8cf383fbb6e192982824b

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi.RYK
                      MD5

                      62de6ceea3ab5f7542430ed1e026e490

                      SHA1

                      30c34e746ff5d3dc4ffa40df0e7588dd63573b19

                      SHA256

                      eed928b40c140291db7ea08ca9c010f8c1a0c98ce85d1e85349faaca68505a10

                      SHA512

                      cc6c7aef1dfa4aac1b1981e4db80c79399ad2a253e099e4131310f2bd71447d45d7e5e626dd3f2e4a142179b7379ae528ec0b41ce9b5a2d071b5212a99497b13

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml.RYK
                      MD5

                      86306e7ec35ea3cd4e3b8e52f07ecc64

                      SHA1

                      5ffbc3e8a63008b1de05f371ae6a805ea2970a66

                      SHA256

                      9d5ccc2d8984cf80fd9ecda90a437b5d71c3c4b2413b3cb15009c0dacf61cf21

                      SHA512

                      c852e77b4cd8f100f9ebd7cb16232842c8dd4adbe449ddc235aa0bfba883cb48eeceb4570255d9437127e833a6a11d203522e7988c6c3d6030e265e1704c3360

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\RyukReadMe.html
                      MD5

                      ef4f7747ff07d010fc040da223fdbc61

                      SHA1

                      2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

                      SHA256

                      6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

                      SHA512

                      0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.RYK
                      MD5

                      1e1c52a82cc80ce265651e78c1196641

                      SHA1

                      ccfae7b43ca7271a1178aae7d192276f09227b47

                      SHA256

                      172c38690c470323e4f294e17169359607f49b7ad434d62340a265ed3220f41c

                      SHA512

                      2a90327ae401b45daaec056801d9a745c5a59e12ac2d5a0948b96246199e333de8b93ad7a35bd5f4272492b0f887cfb0773fd1c002ad47bd8115f1d3206499f9

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi.RYK
                      MD5

                      f422656f39f266a55e037d07f77fa78a

                      SHA1

                      2f1d34837d6bc634f8224c58473d911c752273b5

                      SHA256

                      1367ff64a4ceccdb1cfb715985ff29f88700c476351070ffbf700682ea2785d7

                      SHA512

                      e43804013708100ed3bf238975521198f1320c730f99efebf6f8bfe997eedfb016c4fe07707e97cf32158a2d5744b8d90ebf81036d58e9380b20563c291b967f

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml.RYK
                      MD5

                      b1d372c6aeb1e058a23a252f76438567

                      SHA1

                      60b9d6b6f62f28a87453b9e8a566cf1881b4dcf7

                      SHA256

                      43fb696b10d61207d69282bc604236935a3f52fa66594f18810d53925673d905

                      SHA512

                      ffdb47427d9acefc25474cac64041db3cf54560d719e46a30eb92772665d88dd90f6a320a16498d67fd2a8f112b464d34d04d2f270de63213ceeeaf31f7958fc

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\RyukReadMe.html
                      MD5

                      ef4f7747ff07d010fc040da223fdbc61

                      SHA1

                      2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

                      SHA256

                      6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

                      SHA512

                      0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.RYK
                      MD5

                      225803237008b7ce74e6b18de4f47171

                      SHA1

                      c57786c5d798484d7b86fc0f6a5cd25d42c21283

                      SHA256

                      a2019bb1284f843f07367d055b285182e4fefeb9fd4f5e3a30035b9ea0da5961

                      SHA512

                      b5bd14a9df399c26e9a8885ff912e586f5140985993090a11805d5947cb69c2e440fd029ceb2c01356ab6848d461ff29cef94a6bc9eb4caa906bb383f79d2ef1

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi.RYK
                      MD5

                      ff051cebdc197452f3abd4eda0304120

                      SHA1

                      d17078a403297b979f6cd66dac3d2bdd7d419bd6

                      SHA256

                      7ee63a53c0653279c81cdf76777a905f5d7c4164bf896c6cf11da56a5cca02ed

                      SHA512

                      2a169c311b80fd7249a44dca64d6215e8b8b346b86d76190df43dd7c987d9c720fdb68e6009c16ab3a967f3bdd7cd283589bbe8ab67f6f5bb1fa48c62f197eee

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml.RYK
                      MD5

                      f88c63155e780e7ddb867b3f5516e0dd

                      SHA1

                      5ac75e404e7a9ffbee36d5bfb320e9f304b9e208

                      SHA256

                      526cdd1bd94436a330b3c3a930dd1d8df81ae5256aefbdce56d5346e22e2380c

                      SHA512

                      6c6885f6ee176eb19138c65448cfc78a20a3a101c0d3e51a0b07e494f650c52e7a42a7a73b294b86faf009a4347ac8e77d164e0586b49c18d4cb45e6665c768e

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\RyukReadMe.html
                      MD5

                      ef4f7747ff07d010fc040da223fdbc61

                      SHA1

                      2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

                      SHA256

                      6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

                      SHA512

                      0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi.RYK
                      MD5

                      af0fddd77e285561ffe9919a970afc6f

                      SHA1

                      9b7fdcd534957d8aa449e63a94ac847b02e5160d

                      SHA256

                      8d33822d4b80e5aaa62359dd0f50789e93fa7dd00ad7c18807457dc46fca3472

                      SHA512

                      6c734f0179c6785417db1548917597837333a1e2810615c4abb86bfc3bcf9aad935497461cf86f4fb5f4f391296ec171543b51910200070bbe6649f17532e775

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml.RYK
                      MD5

                      acb6a25fa2dfcf59a75847ba8eb7a077

                      SHA1

                      fa640b0261e19feb2d39e1e8cc3708962232dbb0

                      SHA256

                      48651557fdbcfe1cff244f6af91a241e6332004d85a2ecb2ba6a31929d2f566c

                      SHA512

                      b70738c445aa0c80458bafee796db85ccc967fa1a16ad77cbc850abfb1310701decdd0d7789e8dfc910a9da6692e2d7039390eef62dfa284915b5172aa080677

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\RyukReadMe.html
                      MD5

                      ef4f7747ff07d010fc040da223fdbc61

                      SHA1

                      2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

                      SHA256

                      6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

                      SHA512

                      0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
                      MD5

                      4e906305d721e4dc9d45f9a9a5e980ba

                      SHA1

                      b64a7efe6d2f5a55dc50cfabdb414ef7ef30213d

                      SHA256

                      3eee66f64f8b3f32fb5f88f68f407db6b76d3a2747d33b9ceec214dc25f658f8

                      SHA512

                      8b3ca9ba074c8df74ef424e78486387309a0f7605de9a837c71195bde9e4faeff7583cd1273c600a0776d385ea8459d6c465f41bb54f0fee2dfbb06cf11a8100

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.RYK
                      MD5

                      33f4f31a98b4fb6e4cc7fe66c894ca3a

                      SHA1

                      2d6810e7acf195042993614c33876e4bf8252a4d

                      SHA256

                      7a70c8eff92c69f8ce73a01cc4e224d0a22cfd49ad7e537e29122eacac1d120b

                      SHA512

                      663bb97f915ef36cada01fd2b87083d2a2df8a6f6925742f1b3541e90dc564ca018dcfbb6fc3efb4d1eddec3dd1f328f0684e1385c3e95225db36490eff7c469

                      Download Submit
                    • C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.RYK
                      MD5

                      1cf2bf0dac8897f3a5fcb1cf467d7839

                      SHA1

                      ab91226ee50beed4402e9f0e98888307df0b28e2

                      SHA256

                      e09c450622c7ddd1bb15ac5f6670bdc88421247d6cbff62df8fc17e8e3d82a6d

                      SHA512

                      3c6cadef8fa8d16076530bfd9deb20d035f5f2564b4f8369a9eb8043af05fe4257208a79783c3ea3a58f864e444db4a9277a7cbd5661cc05cfcd251ba0b6ea32

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\FowgzSvUJrep.exe
                      MD5

                      c0f972c5e033c0b4dc268a805cfa16a2

                      SHA1

                      a3f38579feb14d3b20289e453b41d88232145f68

                      SHA256

                      d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488

                      SHA512

                      de7803c4119355be7e06616abbfbf44b4ee23ba2caa987b630ad520126187c1f9eb2308f0ba5ba51cc8287fa75e5251d4e9d5ad940e8beb90b97f65d4890ca47

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\JdYNxTfxGlan.exe
                      MD5

                      c0f972c5e033c0b4dc268a805cfa16a2

                      SHA1

                      a3f38579feb14d3b20289e453b41d88232145f68

                      SHA256

                      d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488

                      SHA512

                      de7803c4119355be7e06616abbfbf44b4ee23ba2caa987b630ad520126187c1f9eb2308f0ba5ba51cc8287fa75e5251d4e9d5ad940e8beb90b97f65d4890ca47

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\aPQiBbtlZlan.exe
                      MD5

                      c0f972c5e033c0b4dc268a805cfa16a2

                      SHA1

                      a3f38579feb14d3b20289e453b41d88232145f68

                      SHA256

                      d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488

                      SHA512

                      de7803c4119355be7e06616abbfbf44b4ee23ba2caa987b630ad520126187c1f9eb2308f0ba5ba51cc8287fa75e5251d4e9d5ad940e8beb90b97f65d4890ca47

                      Download Submit
                    • \Users\Admin\AppData\Local\Temp\FowgzSvUJrep.exe
                      MD5

                      c0f972c5e033c0b4dc268a805cfa16a2

                      SHA1

                      a3f38579feb14d3b20289e453b41d88232145f68

                      SHA256

                      d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488

                      SHA512

                      de7803c4119355be7e06616abbfbf44b4ee23ba2caa987b630ad520126187c1f9eb2308f0ba5ba51cc8287fa75e5251d4e9d5ad940e8beb90b97f65d4890ca47

                      Download Submit
                    • \Users\Admin\AppData\Local\Temp\FowgzSvUJrep.exe
                      MD5

                      c0f972c5e033c0b4dc268a805cfa16a2

                      SHA1

                      a3f38579feb14d3b20289e453b41d88232145f68

                      SHA256

                      d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488

                      SHA512

                      de7803c4119355be7e06616abbfbf44b4ee23ba2caa987b630ad520126187c1f9eb2308f0ba5ba51cc8287fa75e5251d4e9d5ad940e8beb90b97f65d4890ca47

                      Download Submit
                    • \Users\Admin\AppData\Local\Temp\JdYNxTfxGlan.exe
                      MD5

                      c0f972c5e033c0b4dc268a805cfa16a2

                      SHA1

                      a3f38579feb14d3b20289e453b41d88232145f68

                      SHA256

                      d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488

                      SHA512

                      de7803c4119355be7e06616abbfbf44b4ee23ba2caa987b630ad520126187c1f9eb2308f0ba5ba51cc8287fa75e5251d4e9d5ad940e8beb90b97f65d4890ca47

                      Download Submit
                    • \Users\Admin\AppData\Local\Temp\JdYNxTfxGlan.exe
                      MD5

                      c0f972c5e033c0b4dc268a805cfa16a2

                      SHA1

                      a3f38579feb14d3b20289e453b41d88232145f68

                      SHA256

                      d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488

                      SHA512

                      de7803c4119355be7e06616abbfbf44b4ee23ba2caa987b630ad520126187c1f9eb2308f0ba5ba51cc8287fa75e5251d4e9d5ad940e8beb90b97f65d4890ca47

                      Download Submit
                    • \Users\Admin\AppData\Local\Temp\aPQiBbtlZlan.exe
                      MD5

                      c0f972c5e033c0b4dc268a805cfa16a2

                      SHA1

                      a3f38579feb14d3b20289e453b41d88232145f68

                      SHA256

                      d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488

                      SHA512

                      de7803c4119355be7e06616abbfbf44b4ee23ba2caa987b630ad520126187c1f9eb2308f0ba5ba51cc8287fa75e5251d4e9d5ad940e8beb90b97f65d4890ca47

                      Download Submit
                    • \Users\Admin\AppData\Local\Temp\aPQiBbtlZlan.exe
                      MD5

                      c0f972c5e033c0b4dc268a805cfa16a2

                      SHA1

                      a3f38579feb14d3b20289e453b41d88232145f68

                      SHA256

                      d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488

                      SHA512

                      de7803c4119355be7e06616abbfbf44b4ee23ba2caa987b630ad520126187c1f9eb2308f0ba5ba51cc8287fa75e5251d4e9d5ad940e8beb90b97f65d4890ca47

                      Download Submit
                    • memory/432-60-0x0000000000000000-mapping.dmp
                      Download
                    • memory/524-130-0x0000000000000000-mapping.dmp
                      Download
                    • memory/860-66-0x0000000000000000-mapping.dmp
                      Download
                    • memory/892-56-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1016-67-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1092-125-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1160-64-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1188-53-0x00000000762A1000-0x00000000762A3000-memory.dmp
                      Filesize

                      8KB

                      Download
                    • memory/1580-124-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2604-123-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2688-128-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2708-127-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2896-129-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3000-126-0x0000000000000000-mapping.dmp
                      Download