Analysis

  • max time kernel
    167s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    20-02-2022 06:47

General

  • Target

    5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe

  • Size

    150KB

  • MD5

    e78cd758ff117ff26e2c333b484b03b1

  • SHA1

    a477b3fc1c8f9c571e1dcfda0c84606fb7d34d93

  • SHA256

    5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28

  • SHA512

    a9bec103ecda3c0faca8868a46790787697d0c28ae849fb6857850a378c2812671ec3f2f96d4b9711d74cc3549e909bafb65ad82ab2bd86052f1d24b995e0708

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation. More than a year ago, world experts recognized the impossibility of deciphering by any means except the original decoder. No decryption software is available in the public. Antiviruse companies, researchers, IT specialists, and no other persons cant help you encrypt the data. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions.Send 2 different random files and you will get it decrypted. It can be from different computers on your network to be sure that one key decrypts everything. 2 files we unlock for free To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 1Kx9TT76PHwk8sw7Ur6PsMWyEtaogX7wWY Ryuk No system is safe
Wallets

1Kx9TT76PHwk8sw7Ur6PsMWyEtaogX7wWY

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1312
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      PID:1220
    • C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe
      "C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe"
      1⤵
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1660
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:652
        • C:\Windows\system32\reg.exe
          REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe" /f
          3⤵
          • Adds Run key to start application
          PID:1468

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Documents and Settings\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • C:\MSOCache\All Users\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.RYK

      MD5

      3abf82904914e22cf836629cde5840c3

      SHA1

      167dfb48e501e11eb3d3b51f9a160da8650b7259

      SHA256

      7d99b31f614f49018d30be7af529a08606a3f39d5ce9c32ebcc97d275297c7b9

      SHA512

      c2361ae9acc8a8ea707466954517420734d01a1601278e05b1b543cb755259229080e8bf34176d0296fc1b6468aa1095cb11d5b144ddfdb46015e267af3606d0

    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.RYK

      MD5

      753ca2354d1a1bbdf428863f64c55e84

      SHA1

      af26e5d969070d920fbcde1c3af5a26aa6448502

      SHA256

      8dff0e1436355e6d8529464ac8f5ac3539e5b1c4560d72db84515751d997bae5

      SHA512

      6af3be0ebefd8b70694abe980c4929085d1b180ea09c320b90a897843ff6e31f2e21c0c83f17581f42dad155c81938742ca1585d461de6d0e13001a4e06259f8

    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.RYK

      MD5

      6f879fee3cccb4cb8740e54ffabc5245

      SHA1

      0f4c6acc78300b1c6e7d0f3284219c3d6be8b481

      SHA256

      8bc82cd16ed3ef8f7500e3c75afd6440ecca920674c327912d8496fbe6c95b25

      SHA512

      fc056c15432f978104c010159470a22510090105b201c2bbadb700ed2033990d9b3c92770c649c4219fb40db1cfe254514379a9a69ffea1b96e0f52c29c9e11b

    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.RYK

      MD5

      83134cf98d05c6ac31ed7f6b7fc89884

      SHA1

      77887cf1b138f40bad99ac5b9e84f6543823d10e

      SHA256

      e5c67928d5175bd32d4a5a2395f40f96833367482c3ce3f684f088b57ac67b30

      SHA512

      5761dd190ba211e8d2b1046c1d9261afed01cbb9e607397c47a686cd6eff88288ee71ea14fa664509c27cdcf3304902d1374f9b7da12dd952d12df3231e5e5be

    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.RYK

      MD5

      25b4d63269cb9ecc2827d547985a6a2b

      SHA1

      5e1bfc64b1d1bb7e88e1750220301d93d8eeb612

      SHA256

      66978a22689b204fd08723317846fd31b557db40a0f17ecb667a6e999443384b

      SHA512

      3bb6d94fe164aa30daa056159fe62793e33f30d38692e526ccb85af7c7e0dd0ef9fd0ea32df3c9e4948aaa2c728b5320b4ad3f0f56b1d0ce3be8662b5b08e0a6

    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.RYK

      MD5

      016f00dde25f2617512673748a607e6e

      SHA1

      c958e1081669667804320dfc39b0168edf19412b

      SHA256

      d01f8d1ad9da4b17a26822d7bf87b0892b1b4e303a1cc2d8c58617d39fdff332

      SHA512

      c6f94b0709386ccdc7787d60d03c9996134da1c061806957407699a6dbee5656b0bbd3502195e64df5e60b928db85485408702d7db6111a4862affe5fce85653

    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab.RYK

      MD5

      1f282054f61097d2102b18ad3d49ced9

      SHA1

      3d76300dd57e338070aead12938e8216f5891ead

      SHA256

      fb2f334d7c6d590fb2b85fa29453c3c4537eaca304a00768638e03ba0098535f

      SHA512

      d46e586b942fd92b64d698cf7a8daddda873186929011d64715e8110d3fc07d7c43ed0bb83fb652c7ed102e2989de47158753952a97f7d1e53b802959e8cdb0b

    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Setup.xml.RYK

      MD5

      342bf42dbe0a5bea6dc2f3adcb9e8940

      SHA1

      7ef282a5f82e738cff497ba1ed5c70a028e6208f

      SHA256

      13dfbafe7e1bfd15c23b5369e47c6b6f8ec02a63754504598515d54f655de6ad

      SHA512

      8d2993478911b19a7edd0ffb7270417c2529c99590679c03f51ff018ff5f4f05d5203a34f3a43951d314af1925d9a76ba1582ff339ad40b67e0843405c24a91c

    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.RYK

      MD5

      4732fc480a3bb07672d12a7f807e14ca

      SHA1

      0eed402c5087ecc7a88b962390a3d6b474306063

      SHA256

      2069b0178d86c241eee21524dc56b4558bbca5ffd0a68143eddcee536b6d09d4

      SHA512

      d0f675b3181b6137dda34ded6f5726742a18ab05d7107dfb0fb02c9ac1e866d8551effaf64777048cc03fa032562adc4e72fbd8bbf399c10b79360ab5b6ccba4

    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.RYK

      MD5

      2553dcf0156edccdc9e09499c30b2800

      SHA1

      0bca0a06ed3183367037bbe8dc04ad1605e58413

      SHA256

      7f07d3b98ce678e0f3b53d7646711190396702cb498436f9d2f1f160ddbe1991

      SHA512

      ae0179a35e54020ca54e406ef29de3c92c174f97d320fc0386746f1154a230f0cd3700d8d3b2ba3ab3bb285905e00d1901724a7dc18b484ecabad1dec0e26aa9

    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.RYK

      MD5

      077305424787f525f796d0e1cdece74e

      SHA1

      ce5fe3bc77ca06e7901582f0203a584f20ff7a8f

      SHA256

      a807f23cf46be8556b48911383003ac71e270412c952ee8a0e8d0a1c91f100a2

      SHA512

      60809dcce646747ac290a8dc3a0dc39775dac56cce5738c0a10d68f641b68087933c306f90222e7ea5ca35192a019c7acc3d1411a97dae8da8aee3565c8a44b3

    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml.RYK

      MD5

      dbd8a67439a5d617ae867011e46cc29f

      SHA1

      88c52530167ad73d60aa697759b4eaeaa04d25a2

      SHA256

      a1b519d153038d5dda13737e1ddb247b10fe65f1f6e59662260c75168e60a4c7

      SHA512

      b11d637f1dc09c97b44c3bc6c453520a4fd7821dae1d8e34b866cdbf29d5b11253ceabc894def232dde9662427677962a2c0ca6c16087d4b1f137f6fa726b138

    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

      MD5

      b0bea3ce9627cd13f1937632bf597a5c

      SHA1

      6ef8b8f5723a5aaf3587b4ac0f41d76ed9d741ab

      SHA256

      7da551348bf11a6ee7a9c35fc6554c3fc6ee1ec294e34c138567dd4213d57a7d

      SHA512

      efa21856f22d2641f3e770598a55775c7d78b2b8bf86e7520e38c4e5eb3130378cc7ca93df0d6704836c3d08657e422c2f6c8e7502f15d7cd8f34515ad06d2af

    • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.RYK

      MD5

      962277252bc519b8661a789c87fc3c18

      SHA1

      d64a5499a793b7c15e043c8ea06a60329e5f0226

      SHA256

      d47d4f7438e55defb7acf8c5a7bb308eabd9f19fe692b0f87d388a720056db87

      SHA512

      16cd5ba079f2750c89048641d343772a5248484d3c98ffa566f5b1ed2166c41bf4f57f00cceed925ee4a811e07554d36437142b2094a09a9c2e1dc19b0f32ce2

    • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab.RYK

      MD5

      da809a4eca37a8c0018f487352ed95e3

      SHA1

      49140565dffe6fda2b60a059d70e5a4196969677

      SHA256

      7bb73495d65b1fbdf51b4503d6b0d28907ec581b4873069745747bd57631f281

      SHA512

      d05387d13426abcd658d75ff9c666e9bd63f989385fcf432d0cd5c9c0538ea4ce5425fd0f9eb33e38be9f9e22c8455c7bb66fc9d90283b1292023127d9df89bb

    • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

      MD5

      1bf5889767fe7afc866048f52ed3bfc9

      SHA1

      144c191a14ac4b7c681bd0f7a17ef50f8db77cd8

      SHA256

      9d515a721aa95feb622219162d72f919b7b36652e2e2d529af249d11343169ac

      SHA512

      95a6572c45fb37c33f224bac15584d4aa534665daf7b027483f75af54deb18aba7c4c031eb2b6384161f8a5b092cf9b7e189991fcf3d9d407d8de82b85f06190

    • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.RYK

      MD5

      2a984ba4c70cde5a33df29b5462ad03d

      SHA1

      9efe1b6b0e8186cf2adaa0fb3a81cb1210b1b644

      SHA256

      6901f3c7db15fe64e7ecf79d99f0334e49d637fb76fa3f9c9c08fdcdc12cffd8

      SHA512

      0e01e9eb07df0f6e44ecc4a51a0d80e694031050770e9365cee930436bedf6051884374980553e80829a8c49b2a596160a61735dab71f3c8060a7d512590f54b

    • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.RYK

      MD5

      85acfa0ce9b23f7633e5ee4a14a782a0

      SHA1

      5a324253ad276228c4378721b8d4179ddd18cf97

      SHA256

      9fc23aff707bea2a7d5af74633379555aa755bd2975d8b403cc8d9043bf88b47

      SHA512

      2a118f2b4a412913a53f7194d61747a698092ff639d8a946d517f2707aa65e04e2824c7bf5b90b44fd25f878ff2fe99d5bcb65b462c02bdfc6b1dccc05abf1fb

    • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml.RYK

      MD5

      50625cd131b990c20e862370fef83e81

      SHA1

      6633abff5016fea14161784857c56c7793dbbd1e

      SHA256

      ea2ab8ae5005669bb4463dbdc1e19872808090d137cd65a71eca6b62afeaa6f1

      SHA512

      34c38e244ad9cece7ae457f5a537d746991998fba37ee065a8b8a03cfdf2b2022b6a76370f4ba88420e41e887d5df73fd838c2e20019755118fde5df429b26f2

    • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

      MD5

      03bfc690ae4eeb17b642ef552ca7ac70

      SHA1

      1ce2196dcf73083734a4a787175645e3d5a6abd1

      SHA256

      169cd8d1b0e194aa6d4d948e4c6ed41c79b9c7a7cedb1c4440fc5d978e2d28ac

      SHA512

      01d00a3675f0c38552707a9a6626047e8a8716524973b544b6d5f5ebe531746e3e3751986dece475e82308c7165db9f46579628a7287311936ae32ec83202daa

    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.RYK

      MD5

      29360f4950c46da225587e2b57ec61d7

      SHA1

      09d129db1f6300e5f591ec5fa7b049ee295de14e

      SHA256

      7ca63d5d2e4c49c413fcbcc99eea2ebb29f89d04e55657bd469e362c22b85173

      SHA512

      787d6fb1dc70d627180f8a87080bd10a0ba3d212d895e3f704840223ea602e98da51603e74a1d7f1811a47312e671f7362a132a32d6c57d11ede4d65e2882492

    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi.RYK

      MD5

      1a3d99fff0cb6474f7ab8b21f09ad509

      SHA1

      8baa9dc6f49e87abfea76f1088396ad3b757d7f8

      SHA256

      3aa2fe820039fd0a6540d8ee9d8148640c115abef87663bb72ad75e06490d7f9

      SHA512

      18e73120637b5acd8adb5a1ca1d1d1c6fb8b319cc5864b6acd031dc4bfc9b146aaeee60b27fb34a22d84e4b482c3fbd0c2abf2fb1f8481d5364d091f94740bf6

    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml.RYK

      MD5

      fa8b4a5b33a71288fa201b1168ec1fd7

      SHA1

      3c9d4ecb2c741b63d0d3ac49b13da24fbde0a71d

      SHA256

      baaf6dbd69f8a937637bc681a161963f6ce9c67dbf35993c2c2456631c304df0

      SHA512

      7093c42c88b50bd485b4c7026c400904ad2dc5da396b282a3e4a576f893e2297d8233ce19cee9eb37eb14194f1b60be4c8ef0d38747e63e10d77007a158cd475

    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

      MD5

      6947b94375ac4cec5aec8232d3a7a0cd

      SHA1

      c869c86f34e99981ee08b250d92e356d5c7067b1

      SHA256

      c54b0b197d655c66e1fc23e2fd0e078e01c64791dde13f524607345094dcc5f7

      SHA512

      7694a6d7e226a74425420afb82354668b60561049faaacd0d89b4b8898ffeec8dfc0993ba4aab9bbac25dab37494f422d983bd981cb434598c9cfb18aad6b91d

    • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

      MD5

      20dc2aa60d0eb91937bd8aeced9b6049

      SHA1

      5cc0c1b07348c1cbd3244b102660bacf0b772337

      SHA256

      c098e9e80736fd6327fa978494121eedfa0017bbab93cc9e1b265fa8e0de05e3

      SHA512

      0061cb1e1e11449b342b42d3f3c0c41a3c4af37a7612498c5368e7652ee91ceff4c2e6d4706a835c05c478901c12c8c1e52ebe07d9d41fec5bb078d078fc6030

    • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab.RYK

      MD5

      72f60c7c52cfed778beb44f578a3033c

      SHA1

      3eab490892f77b0e8d7ca9cb1ddff953c33d1632

      SHA256

      7f811db5f0f8dc96cf6fc00259c5c5d7e2f7004962a09f0b8a86ecd62beee1b3

      SHA512

      5426edf7f2fe0251b19ca5cade7dffe54c3ceffc0379debbffa0a060e67f1d4e1db2798ad13bf1945754d763dd180af10bd1cddc422c5ea475998d28d0ff0a81

    • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.RYK

      MD5

      2f4f893e3687cf9869d3a5e481c23d31

      SHA1

      84d4d0ce38c76f40b67e46d495f657a648f184e8

      SHA256

      667c5962f5d0d0294e7fb83f74211684d686708a2b67eae8de15829040dc42aa

      SHA512

      42ec8b2d8ca994517d5b57e48113f517fc7284026d465b40aa66a4f884352c2b9f495c496c874bdffe03a5e9ed652dd6d2faaf0133d0168bb540db6e1c860f76

    • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml.RYK

      MD5

      583ab73eda8c985700ec685346a736b6

      SHA1

      dbda9befc1d0fda886d6a66df4637e8aaabe13e1

      SHA256

      8101eb2e57c4a255a14f8eba45a29691bd3b82f151906fe1fd34a3dd248ffeb8

      SHA512

      ce050493da9f3f0eac94841543f0113c687e5f6ce9f6212c3e8e3ac4799fd597c1a98da96913ab67707bf493423e0b1c5f5cb05b2abf4b93fbb74e3c6e0e7ca6

    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.RYK

      MD5

      c118b1f1fd45552829a55494d459270a

      SHA1

      416811bf8f1ca8ce85f40c3d12bb243ba35d5def

      SHA256

      36b11c3668b283c131a49c4615e0de97f9118d58a9033aa567adbc0b2c12e5fd

      SHA512

      2c1c69e24b4e3f222a31a3d9c0ba940536838cf3b6380e5274b9c456fd137a453d3cb67e3402a71571dc44cf46388d8bf904a19c8ca620f53a95c6a03d324a5f

    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi.RYK

      MD5

      824bcbdb821b0c9e23aa185f581f11f1

      SHA1

      76f6280d8c6898426142ed1953eb348fd98cf72c

      SHA256

      cdad19d6b4d75d756a87051379855581db5d65b1e640f120015d7c5f9ca9d857

      SHA512

      76a3b81efa00018be102d792b72f178b176fb74dc70dfe4141af330414cd8515e37a560b6911cf35c0a247a6fbc3e6b2dcdbe2da7ebb7399376ea48da5096640

    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml.RYK

      MD5

      afbebefc873d8f428688327d06323b46

      SHA1

      d2fb7c19a153cdf8b48b2fba08711d5ac41001fa

      SHA256

      0c66b0f0fac8191de9b82b67d76b99122503b045f30308d04fcb60b144411b61

      SHA512

      29b5a81c62f44ae49648a7726a9ed5699f6e6f07663bf5490cf3154d8a6690eb8d64a1294fcc3970852d6712f95fcb0639a61049e646d12d000f61fb2546c094

    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.RYK

      MD5

      26641a8e530fc32bf5ad5a13d75aa21a

      SHA1

      b931c9ac89a67f99439dbd810c534efd93641fb3

      SHA256

      f1f939abb470f72e3c4d2f636c1d76e30667ea5e6765a5b02cc5e5b2c19b3445

      SHA512

      fbe234d4eec138e6932fd8e973fb39290b9f16b00a7b2743fb92ead47d8c12c35122a214ae4c29cd0b42ad79b9517765b8222e96fb36c3bee460ec451b3caab7

    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi.RYK

      MD5

      247e41cb2f937236895fe0c63a5229ff

      SHA1

      8764438391905125f4013181a85a185febcf4a77

      SHA256

      c1ba587a4c40985af8679e7e16040e8e117e71f4060797b06634271a2ab4842b

      SHA512

      0f46b833308fe0a4d6696fc682217810711e41dd15b1ab21895cf90b4c0ca504eb83dbb082bcc47de87d9c88734e5e92580cf196a90bdcdf6d633e9b05bde36d

    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml.RYK

      MD5

      5ce67dcf003433d842d8643717b407be

      SHA1

      98eab1ebfd490cf7238450302c8b423ed08e3f11

      SHA256

      477fca2100fc5a6d9f2100aff777b1eb9fb4600bb85baa02d7eceac0d6dc1889

      SHA512

      b307b235d9f9e97f0e8e5315848fb525416f5e4ef386e46d79b4727fa1dfc0d7378e64abb86498fa22b29149e778d28b7a4563058674a2bfe4a85078a87a3c17

    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.RYK

      MD5

      983c45672d4f063fab2b2e7ee26b0666

      SHA1

      8dcda87da2f673938e8b0fb30ecfe8533400387c

      SHA256

      8caf427c79c70525d5e38c1e821f9be9d339d81307be1c9df3fd4c0850513d51

      SHA512

      a909fa0fd68c1fc029ef7e6ed8eb0422c6bfa97188698189554ab24236b58a40dcd0002f1066f63d8f26552338ee2ac372caef5b5704884ee267b3aa8a74b904

    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi.RYK

      MD5

      85a69b80348005ad0fa7e6e58b8576c8

      SHA1

      0eb304e6bc2eb05976e1d635a6122fbd1c6387d5

      SHA256

      2dbac883c0efc591eb20530f9215f94015a4cb24091400fe5274f3d4ca1c4960

      SHA512

      5d72fd5f60c289deb7bcc488ef528d89ea6f3da8f9365d1f08248174ea20a40e3b58dda238c519c6b071c1e421ae631ed7b22b11fd41534e06d87863d5d7efc6

    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml.RYK

      MD5

      8a88112faf74b40aafbc9c1003dd711f

      SHA1

      85afb32271e9b48ed0fa1947626ca6d48db9985b

      SHA256

      8e763b4c4aff061e37afde371d455dbfbd7e0005a4568eb8f4a88a5126aa686e

      SHA512

      997813b9b6c32b3b49100d8d253a42c607cff454278a63493a22ef0e6cef081ba031a51b17f5705ebd2292d11faec112ed1155dd90ec0c6f94c825078a7fd65b

    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi.RYK

      MD5

      4913661fcca32dd44df1a54f45ebeda2

      SHA1

      1e2046cab99ee4d063fac08ee45ad1fedf81d763

      SHA256

      7bf2d8d9bf7f352e8943c8cbd361776b2bf91a3f9746a1ff78ce1eafcb71bf2e

      SHA512

      2086bf071c8c39f65811419e1287326da12257525c2c4d3742f87e5e1545060ce72ff9865abe1ad3dcae303951273497eb1c31efe263dfbacd1c9c869b6636c8

    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml.RYK

      MD5

      876260fc80243e4a72e4e5312213573a

      SHA1

      9f766f476a4ee5e284b1715eb98aca854f21a68f

      SHA256

      f544b1e0d7bc8296f8ea74125134a8d20519af3b3eded578241021eb2774a2d6

      SHA512

      83af8ff2383325c90b67010ff9cfab3da13bed3f312a4158d4cd3725294ca5f351d15894f1a25b81792d31f18f5e849063ede9374437f7eff12b4f619b992990

    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

      MD5

      2a708a3c19098bc6a7dd4ade49210449

      SHA1

      6f3c8f7e1010ddda5f0d84e63cb3dfd591894880

      SHA256

      b4863c9126632822b1c09826b799fafec079b62627e952d2dfe47280b0e92654

      SHA512

      56fb1afcbe58c6e2d0ac95f12ed882d3da46915d1d72af62078a8bd840a5782ab6ab2f36f8d52380bf64e0f630854db8359a522d59a90e225953c3930fd8fed0

    • C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.RYK

      MD5

      615aab8db7e66b8587694b3b007e62b3

      SHA1

      796f23d7277fb134a9f8946181bf3385e6024d9b

      SHA256

      dd70bacd5909afbb48935adf2476962549adafe6ea79e9211f8bfa55058209d9

      SHA512

      dafdda0b66e59f283e4a9108a435a7ca621ea0a22109263866e2926c57325c0dd6f4865003246c1c6caa5420b74f8054cc56a87d0f5c685d6e3385bf71f717ab

    • C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.RYK

      MD5

      c3f63cf82d5562bc195d492f878fa052

      SHA1

      f13449275ded54f228a711c43d35a3a9a9313862

      SHA256

      e54f0c962b590fda87e2c755dbb9b0cdc558cf27137f8db278a2ef0c9d1df17b

      SHA512

      9983f1dcc889e0a9d2181a05d3c4b7034f23113e4e7faf3b5df53df9aafe92cc653e0c6cfbd40674bdc57b3f44a00e1503ca12ab5a007de61bfe3b6b80550f59

    • C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml.RYK

      MD5

      06908507ef767db6296b7fa10aa6322e

      SHA1

      181421cf35d5e7d78ea6876fbfcd4d24ce5ebdc3

      SHA256

      7c0e5e5c5edbe842cde73a2e4f40b613cc7fbf2b5374ffd97bbde5153e3020ce

      SHA512

      bc3add846c9a1e082e249e4b039ca58b258cdcd57a269de73cb018f1b468155f477a5fda9eaf6811d595b0a0432b211f5206f7b38440c930255ad4d63e7f4fa7

    • C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

      MD5

      6193195dc7a4678d8a2b4ffd3265428b

      SHA1

      c00a80f71b3f5d14b2a6c7b29a0007679881b300

      SHA256

      10e4ccf2c2281b8c80825059f51977ed287cfdab5e50c7b163c842f6483b5c62

      SHA512

      bf6b99b6a2302b7cf81f1773f5e9b84de47dea716db9dc6f3a28c90b641cf2655338a6e973ced936125dbe4a7fbda061e6dc3b1fabd7ea93eac169979802a735

    • C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi.RYK

      MD5

      5e213afe917ad6f4695b013e4a74d234

      SHA1

      0d948f315186a592ed76fc6b45319daac6adefa5

      SHA256

      ea91f069ab6ed8eed8274d01ab73a952ac25e39e542eef9f89c530b08e20f976

      SHA512

      8847b8a5c79ceace6271e7d2bddbff2d3084a2b51d13038da6babf97cef44b9521af677ba1e6413d4efa29e8fec91f5abe9e318c7a789d0350c941ed00c09fd6

    • C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • C:\MSOCache\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3bd845b8-ce6a-4337-9974-31490196462a

      MD5

      93a5aadeec082ffc1bca5aa27af70f52

      SHA1

      47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

      SHA256

      a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

      SHA512

      df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

    • C:\RyukReadMe.txt

      MD5

      7eff265f2a66466e6c8c0ba2c476da24

      SHA1

      1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5

      SHA256

      f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384

      SHA512

      a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

    • memory/1220-58-0x000000013F5B0000-0x000000013F938000-memory.dmp

      Filesize

      3.5MB

    • memory/1220-56-0x000000013F5B0000-0x000000013F938000-memory.dmp

      Filesize

      3.5MB

    • memory/1312-59-0x000000013F5B0000-0x000000013F938000-memory.dmp

      Filesize

      3.5MB

    • memory/1660-55-0x000007FEFC0E1000-0x000007FEFC0E3000-memory.dmp

      Filesize

      8KB