Malware Analysis Report

2024-10-23 18:36

Sample ID 220220-hkmx5ahgb4
Target 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28
SHA256 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28
Tags
ryuk persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28

Threat Level: Known bad

The file 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28 was found to be: Known bad.

Malicious Activity Summary

ryuk persistence ransomware

Ryuk

Checks computer location settings

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-20 06:47

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-20 06:47

Reported

2022-02-20 07:23

Platform

win7-en-20211208

Max time kernel

167s

Max time network

144s

Command Line

"C:\Windows\system32\Dwm.exe"

Signatures

Ryuk

ransomware ryuk

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\system32\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe" C:\Windows\system32\reg.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\cs.txt C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sa.txt C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msado25.tlb C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\RyukReadMe.txt C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lt.txt C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\RyukReadMe.txt C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\uk.txt C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\es-ES\RyukReadMe.txt C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\RyukReadMe.txt C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mr.txt C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\yo.txt C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\RyukReadMe.txt C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\Common Files\System\en-US\RyukReadMe.txt C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hr.txt C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\RyukReadMe.txt C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat C:\Windows\system32\taskhost.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png C:\Windows\system32\taskhost.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A

Processes

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe

"C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe" /f

C:\Windows\system32\reg.exe

REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe" /f

Network

N/A

Files

memory/1660-55-0x000007FEFC0E1000-0x000007FEFC0E3000-memory.dmp

memory/1220-56-0x000000013F5B0000-0x000000013F938000-memory.dmp

memory/1220-58-0x000000013F5B0000-0x000000013F938000-memory.dmp

memory/1312-59-0x000000013F5B0000-0x000000013F938000-memory.dmp

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3bd845b8-ce6a-4337-9974-31490196462a

MD5 93a5aadeec082ffc1bca5aa27af70f52
SHA1 47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256 a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512 df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

C:\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\Documents and Settings\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\MSOCache\All Users\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\MSOCache\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.RYK

MD5 4732fc480a3bb07672d12a7f807e14ca
SHA1 0eed402c5087ecc7a88b962390a3d6b474306063
SHA256 2069b0178d86c241eee21524dc56b4558bbca5ffd0a68143eddcee536b6d09d4
SHA512 d0f675b3181b6137dda34ded6f5726742a18ab05d7107dfb0fb02c9ac1e866d8551effaf64777048cc03fa032562adc4e72fbd8bbf399c10b79360ab5b6ccba4

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.RYK

MD5 2f4f893e3687cf9869d3a5e481c23d31
SHA1 84d4d0ce38c76f40b67e46d495f657a648f184e8
SHA256 667c5962f5d0d0294e7fb83f74211684d686708a2b67eae8de15829040dc42aa
SHA512 42ec8b2d8ca994517d5b57e48113f517fc7284026d465b40aa66a4f884352c2b9f495c496c874bdffe03a5e9ed652dd6d2faaf0133d0168bb540db6e1c860f76

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.RYK

MD5 2553dcf0156edccdc9e09499c30b2800
SHA1 0bca0a06ed3183367037bbe8dc04ad1605e58413
SHA256 7f07d3b98ce678e0f3b53d7646711190396702cb498436f9d2f1f160ddbe1991
SHA512 ae0179a35e54020ca54e406ef29de3c92c174f97d320fc0386746f1154a230f0cd3700d8d3b2ba3ab3bb285905e00d1901724a7dc18b484ecabad1dec0e26aa9

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi.RYK

MD5 5e213afe917ad6f4695b013e4a74d234
SHA1 0d948f315186a592ed76fc6b45319daac6adefa5
SHA256 ea91f069ab6ed8eed8274d01ab73a952ac25e39e542eef9f89c530b08e20f976
SHA512 8847b8a5c79ceace6271e7d2bddbff2d3084a2b51d13038da6babf97cef44b9521af677ba1e6413d4efa29e8fec91f5abe9e318c7a789d0350c941ed00c09fd6

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.RYK

MD5 615aab8db7e66b8587694b3b007e62b3
SHA1 796f23d7277fb134a9f8946181bf3385e6024d9b
SHA256 dd70bacd5909afbb48935adf2476962549adafe6ea79e9211f8bfa55058209d9
SHA512 dafdda0b66e59f283e4a9108a435a7ca621ea0a22109263866e2926c57325c0dd6f4865003246c1c6caa5420b74f8054cc56a87d0f5c685d6e3385bf71f717ab

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml.RYK

MD5 876260fc80243e4a72e4e5312213573a
SHA1 9f766f476a4ee5e284b1715eb98aca854f21a68f
SHA256 f544b1e0d7bc8296f8ea74125134a8d20519af3b3eded578241021eb2774a2d6
SHA512 83af8ff2383325c90b67010ff9cfab3da13bed3f312a4158d4cd3725294ca5f351d15894f1a25b81792d31f18f5e849063ede9374437f7eff12b4f619b992990

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.RYK

MD5 c118b1f1fd45552829a55494d459270a
SHA1 416811bf8f1ca8ce85f40c3d12bb243ba35d5def
SHA256 36b11c3668b283c131a49c4615e0de97f9118d58a9033aa567adbc0b2c12e5fd
SHA512 2c1c69e24b4e3f222a31a3d9c0ba940536838cf3b6380e5274b9c456fd137a453d3cb67e3402a71571dc44cf46388d8bf904a19c8ca620f53a95c6a03d324a5f

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.RYK

MD5 83134cf98d05c6ac31ed7f6b7fc89884
SHA1 77887cf1b138f40bad99ac5b9e84f6543823d10e
SHA256 e5c67928d5175bd32d4a5a2395f40f96833367482c3ce3f684f088b57ac67b30
SHA512 5761dd190ba211e8d2b1046c1d9261afed01cbb9e607397c47a686cd6eff88288ee71ea14fa664509c27cdcf3304902d1374f9b7da12dd952d12df3231e5e5be

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.RYK

MD5 016f00dde25f2617512673748a607e6e
SHA1 c958e1081669667804320dfc39b0168edf19412b
SHA256 d01f8d1ad9da4b17a26822d7bf87b0892b1b4e303a1cc2d8c58617d39fdff332
SHA512 c6f94b0709386ccdc7787d60d03c9996134da1c061806957407699a6dbee5656b0bbd3502195e64df5e60b928db85485408702d7db6111a4862affe5fce85653

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml.RYK

MD5 06908507ef767db6296b7fa10aa6322e
SHA1 181421cf35d5e7d78ea6876fbfcd4d24ce5ebdc3
SHA256 7c0e5e5c5edbe842cde73a2e4f40b613cc7fbf2b5374ffd97bbde5153e3020ce
SHA512 bc3add846c9a1e082e249e4b039ca58b258cdcd57a269de73cb018f1b468155f477a5fda9eaf6811d595b0a0432b211f5206f7b38440c930255ad4d63e7f4fa7

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5 20dc2aa60d0eb91937bd8aeced9b6049
SHA1 5cc0c1b07348c1cbd3244b102660bacf0b772337
SHA256 c098e9e80736fd6327fa978494121eedfa0017bbab93cc9e1b265fa8e0de05e3
SHA512 0061cb1e1e11449b342b42d3f3c0c41a3c4af37a7612498c5368e7652ee91ceff4c2e6d4706a835c05c478901c12c8c1e52ebe07d9d41fec5bb078d078fc6030

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml.RYK

MD5 8a88112faf74b40aafbc9c1003dd711f
SHA1 85afb32271e9b48ed0fa1947626ca6d48db9985b
SHA256 8e763b4c4aff061e37afde371d455dbfbd7e0005a4568eb8f4a88a5126aa686e
SHA512 997813b9b6c32b3b49100d8d253a42c607cff454278a63493a22ef0e6cef081ba031a51b17f5705ebd2292d11faec112ed1155dd90ec0c6f94c825078a7fd65b

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.RYK

MD5 983c45672d4f063fab2b2e7ee26b0666
SHA1 8dcda87da2f673938e8b0fb30ecfe8533400387c
SHA256 8caf427c79c70525d5e38c1e821f9be9d339d81307be1c9df3fd4c0850513d51
SHA512 a909fa0fd68c1fc029ef7e6ed8eb0422c6bfa97188698189554ab24236b58a40dcd0002f1066f63d8f26552338ee2ac372caef5b5704884ee267b3aa8a74b904

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi.RYK

MD5 247e41cb2f937236895fe0c63a5229ff
SHA1 8764438391905125f4013181a85a185febcf4a77
SHA256 c1ba587a4c40985af8679e7e16040e8e117e71f4060797b06634271a2ab4842b
SHA512 0f46b833308fe0a4d6696fc682217810711e41dd15b1ab21895cf90b4c0ca504eb83dbb082bcc47de87d9c88734e5e92580cf196a90bdcdf6d633e9b05bde36d

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml.RYK

MD5 afbebefc873d8f428688327d06323b46
SHA1 d2fb7c19a153cdf8b48b2fba08711d5ac41001fa
SHA256 0c66b0f0fac8191de9b82b67d76b99122503b045f30308d04fcb60b144411b61
SHA512 29b5a81c62f44ae49648a7726a9ed5699f6e6f07663bf5490cf3154d8a6690eb8d64a1294fcc3970852d6712f95fcb0639a61049e646d12d000f61fb2546c094

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\RyukReadMe.txt

MD5 7eff265f2a66466e6c8c0ba2c476da24
SHA1 1faaf3c17747a9c943290ca3d99cd0a8dc00ddd5
SHA256 f331f89725a898dfb9c93135ec848faed01dae1868a35d749cbf32f34ec60384
SHA512 a67f265dc6802c5022f2e229712882fa8ef7bb3aa65ad5b0b836bda97ff816fe27e118a00571f2419b065ff41c467050d62f5e504cad0f856a152e4dd3e678f5

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml.RYK

MD5 fa8b4a5b33a71288fa201b1168ec1fd7
SHA1 3c9d4ecb2c741b63d0d3ac49b13da24fbde0a71d
SHA256 baaf6dbd69f8a937637bc681a161963f6ce9c67dbf35993c2c2456631c304df0
SHA512 7093c42c88b50bd485b4c7026c400904ad2dc5da396b282a3e4a576f893e2297d8233ce19cee9eb37eb14194f1b60be4c8ef0d38747e63e10d77007a158cd475

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.RYK

MD5 29360f4950c46da225587e2b57ec61d7
SHA1 09d129db1f6300e5f591ec5fa7b049ee295de14e
SHA256 7ca63d5d2e4c49c413fcbcc99eea2ebb29f89d04e55657bd469e362c22b85173
SHA512 787d6fb1dc70d627180f8a87080bd10a0ba3d212d895e3f704840223ea602e98da51603e74a1d7f1811a47312e671f7362a132a32d6c57d11ede4d65e2882492

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.RYK

MD5 2a984ba4c70cde5a33df29b5462ad03d
SHA1 9efe1b6b0e8186cf2adaa0fb3a81cb1210b1b644
SHA256 6901f3c7db15fe64e7ecf79d99f0334e49d637fb76fa3f9c9c08fdcdc12cffd8
SHA512 0e01e9eb07df0f6e44ecc4a51a0d80e694031050770e9365cee930436bedf6051884374980553e80829a8c49b2a596160a61735dab71f3c8060a7d512590f54b

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.RYK

MD5 85acfa0ce9b23f7633e5ee4a14a782a0
SHA1 5a324253ad276228c4378721b8d4179ddd18cf97
SHA256 9fc23aff707bea2a7d5af74633379555aa755bd2975d8b403cc8d9043bf88b47
SHA512 2a118f2b4a412913a53f7194d61747a698092ff639d8a946d517f2707aa65e04e2824c7bf5b90b44fd25f878ff2fe99d5bcb65b462c02bdfc6b1dccc05abf1fb

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab.RYK

MD5 da809a4eca37a8c0018f487352ed95e3
SHA1 49140565dffe6fda2b60a059d70e5a4196969677
SHA256 7bb73495d65b1fbdf51b4503d6b0d28907ec581b4873069745747bd57631f281
SHA512 d05387d13426abcd658d75ff9c666e9bd63f989385fcf432d0cd5c9c0538ea4ce5425fd0f9eb33e38be9f9e22c8455c7bb66fc9d90283b1292023127d9df89bb

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.RYK

MD5 962277252bc519b8661a789c87fc3c18
SHA1 d64a5499a793b7c15e043c8ea06a60329e5f0226
SHA256 d47d4f7438e55defb7acf8c5a7bb308eabd9f19fe692b0f87d388a720056db87
SHA512 16cd5ba079f2750c89048641d343772a5248484d3c98ffa566f5b1ed2166c41bf4f57f00cceed925ee4a811e07554d36437142b2094a09a9c2e1dc19b0f32ce2

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml.RYK

MD5 dbd8a67439a5d617ae867011e46cc29f
SHA1 88c52530167ad73d60aa697759b4eaeaa04d25a2
SHA256 a1b519d153038d5dda13737e1ddb247b10fe65f1f6e59662260c75168e60a4c7
SHA512 b11d637f1dc09c97b44c3bc6c453520a4fd7821dae1d8e34b866cdbf29d5b11253ceabc894def232dde9662427677962a2c0ca6c16087d4b1f137f6fa726b138

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5 6193195dc7a4678d8a2b4ffd3265428b
SHA1 c00a80f71b3f5d14b2a6c7b29a0007679881b300
SHA256 10e4ccf2c2281b8c80825059f51977ed287cfdab5e50c7b163c842f6483b5c62
SHA512 bf6b99b6a2302b7cf81f1773f5e9b84de47dea716db9dc6f3a28c90b641cf2655338a6e973ced936125dbe4a7fbda061e6dc3b1fabd7ea93eac169979802a735

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.RYK

MD5 c3f63cf82d5562bc195d492f878fa052
SHA1 f13449275ded54f228a711c43d35a3a9a9313862
SHA256 e54f0c962b590fda87e2c755dbb9b0cdc558cf27137f8db278a2ef0c9d1df17b
SHA512 9983f1dcc889e0a9d2181a05d3c4b7034f23113e4e7faf3b5df53df9aafe92cc653e0c6cfbd40674bdc57b3f44a00e1503ca12ab5a007de61bfe3b6b80550f59

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5 2a708a3c19098bc6a7dd4ade49210449
SHA1 6f3c8f7e1010ddda5f0d84e63cb3dfd591894880
SHA256 b4863c9126632822b1c09826b799fafec079b62627e952d2dfe47280b0e92654
SHA512 56fb1afcbe58c6e2d0ac95f12ed882d3da46915d1d72af62078a8bd840a5782ab6ab2f36f8d52380bf64e0f630854db8359a522d59a90e225953c3930fd8fed0

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi.RYK

MD5 4913661fcca32dd44df1a54f45ebeda2
SHA1 1e2046cab99ee4d063fac08ee45ad1fedf81d763
SHA256 7bf2d8d9bf7f352e8943c8cbd361776b2bf91a3f9746a1ff78ce1eafcb71bf2e
SHA512 2086bf071c8c39f65811419e1287326da12257525c2c4d3742f87e5e1545060ce72ff9865abe1ad3dcae303951273497eb1c31efe263dfbacd1c9c869b6636c8

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi.RYK

MD5 85a69b80348005ad0fa7e6e58b8576c8
SHA1 0eb304e6bc2eb05976e1d635a6122fbd1c6387d5
SHA256 2dbac883c0efc591eb20530f9215f94015a4cb24091400fe5274f3d4ca1c4960
SHA512 5d72fd5f60c289deb7bcc488ef528d89ea6f3da8f9365d1f08248174ea20a40e3b58dda238c519c6b071c1e421ae631ed7b22b11fd41534e06d87863d5d7efc6

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml.RYK

MD5 5ce67dcf003433d842d8643717b407be
SHA1 98eab1ebfd490cf7238450302c8b423ed08e3f11
SHA256 477fca2100fc5a6d9f2100aff777b1eb9fb4600bb85baa02d7eceac0d6dc1889
SHA512 b307b235d9f9e97f0e8e5315848fb525416f5e4ef386e46d79b4727fa1dfc0d7378e64abb86498fa22b29149e778d28b7a4563058674a2bfe4a85078a87a3c17

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.RYK

MD5 26641a8e530fc32bf5ad5a13d75aa21a
SHA1 b931c9ac89a67f99439dbd810c534efd93641fb3
SHA256 f1f939abb470f72e3c4d2f636c1d76e30667ea5e6765a5b02cc5e5b2c19b3445
SHA512 fbe234d4eec138e6932fd8e973fb39290b9f16b00a7b2743fb92ead47d8c12c35122a214ae4c29cd0b42ad79b9517765b8222e96fb36c3bee460ec451b3caab7

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi.RYK

MD5 824bcbdb821b0c9e23aa185f581f11f1
SHA1 76f6280d8c6898426142ed1953eb348fd98cf72c
SHA256 cdad19d6b4d75d756a87051379855581db5d65b1e640f120015d7c5f9ca9d857
SHA512 76a3b81efa00018be102d792b72f178b176fb74dc70dfe4141af330414cd8515e37a560b6911cf35c0a247a6fbc3e6b2dcdbe2da7ebb7399376ea48da5096640

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml.RYK

MD5 583ab73eda8c985700ec685346a736b6
SHA1 dbda9befc1d0fda886d6a66df4637e8aaabe13e1
SHA256 8101eb2e57c4a255a14f8eba45a29691bd3b82f151906fe1fd34a3dd248ffeb8
SHA512 ce050493da9f3f0eac94841543f0113c687e5f6ce9f6212c3e8e3ac4799fd597c1a98da96913ab67707bf493423e0b1c5f5cb05b2abf4b93fbb74e3c6e0e7ca6

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab.RYK

MD5 72f60c7c52cfed778beb44f578a3033c
SHA1 3eab490892f77b0e8d7ca9cb1ddff953c33d1632
SHA256 7f811db5f0f8dc96cf6fc00259c5c5d7e2f7004962a09f0b8a86ecd62beee1b3
SHA512 5426edf7f2fe0251b19ca5cade7dffe54c3ceffc0379debbffa0a060e67f1d4e1db2798ad13bf1945754d763dd180af10bd1cddc422c5ea475998d28d0ff0a81

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5 6947b94375ac4cec5aec8232d3a7a0cd
SHA1 c869c86f34e99981ee08b250d92e356d5c7067b1
SHA256 c54b0b197d655c66e1fc23e2fd0e078e01c64791dde13f524607345094dcc5f7
SHA512 7694a6d7e226a74425420afb82354668b60561049faaacd0d89b4b8898ffeec8dfc0993ba4aab9bbac25dab37494f422d983bd981cb434598c9cfb18aad6b91d

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi.RYK

MD5 1a3d99fff0cb6474f7ab8b21f09ad509
SHA1 8baa9dc6f49e87abfea76f1088396ad3b757d7f8
SHA256 3aa2fe820039fd0a6540d8ee9d8148640c115abef87663bb72ad75e06490d7f9
SHA512 18e73120637b5acd8adb5a1ca1d1d1c6fb8b319cc5864b6acd031dc4bfc9b146aaeee60b27fb34a22d84e4b482c3fbd0c2abf2fb1f8481d5364d091f94740bf6

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5 03bfc690ae4eeb17b642ef552ca7ac70
SHA1 1ce2196dcf73083734a4a787175645e3d5a6abd1
SHA256 169cd8d1b0e194aa6d4d948e4c6ed41c79b9c7a7cedb1c4440fc5d978e2d28ac
SHA512 01d00a3675f0c38552707a9a6626047e8a8716524973b544b6d5f5ebe531746e3e3751986dece475e82308c7165db9f46579628a7287311936ae32ec83202daa

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml.RYK

MD5 50625cd131b990c20e862370fef83e81
SHA1 6633abff5016fea14161784857c56c7793dbbd1e
SHA256 ea2ab8ae5005669bb4463dbdc1e19872808090d137cd65a71eca6b62afeaa6f1
SHA512 34c38e244ad9cece7ae457f5a537d746991998fba37ee065a8b8a03cfdf2b2022b6a76370f4ba88420e41e887d5df73fd838c2e20019755118fde5df429b26f2

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5 1bf5889767fe7afc866048f52ed3bfc9
SHA1 144c191a14ac4b7c681bd0f7a17ef50f8db77cd8
SHA256 9d515a721aa95feb622219162d72f919b7b36652e2e2d529af249d11343169ac
SHA512 95a6572c45fb37c33f224bac15584d4aa534665daf7b027483f75af54deb18aba7c4c031eb2b6384161f8a5b092cf9b7e189991fcf3d9d407d8de82b85f06190

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5 b0bea3ce9627cd13f1937632bf597a5c
SHA1 6ef8b8f5723a5aaf3587b4ac0f41d76ed9d741ab
SHA256 7da551348bf11a6ee7a9c35fc6554c3fc6ee1ec294e34c138567dd4213d57a7d
SHA512 efa21856f22d2641f3e770598a55775c7d78b2b8bf86e7520e38c4e5eb3130378cc7ca93df0d6704836c3d08657e422c2f6c8e7502f15d7cd8f34515ad06d2af

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.RYK

MD5 077305424787f525f796d0e1cdece74e
SHA1 ce5fe3bc77ca06e7901582f0203a584f20ff7a8f
SHA256 a807f23cf46be8556b48911383003ac71e270412c952ee8a0e8d0a1c91f100a2
SHA512 60809dcce646747ac290a8dc3a0dc39775dac56cce5738c0a10d68f641b68087933c306f90222e7ea5ca35192a019c7acc3d1411a97dae8da8aee3565c8a44b3

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Setup.xml.RYK

MD5 342bf42dbe0a5bea6dc2f3adcb9e8940
SHA1 7ef282a5f82e738cff497ba1ed5c70a028e6208f
SHA256 13dfbafe7e1bfd15c23b5369e47c6b6f8ec02a63754504598515d54f655de6ad
SHA512 8d2993478911b19a7edd0ffb7270417c2529c99590679c03f51ff018ff5f4f05d5203a34f3a43951d314af1925d9a76ba1582ff339ad40b67e0843405c24a91c

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.RYK

MD5 3abf82904914e22cf836629cde5840c3
SHA1 167dfb48e501e11eb3d3b51f9a160da8650b7259
SHA256 7d99b31f614f49018d30be7af529a08606a3f39d5ce9c32ebcc97d275297c7b9
SHA512 c2361ae9acc8a8ea707466954517420734d01a1601278e05b1b543cb755259229080e8bf34176d0296fc1b6468aa1095cb11d5b144ddfdb46015e267af3606d0

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.RYK

MD5 753ca2354d1a1bbdf428863f64c55e84
SHA1 af26e5d969070d920fbcde1c3af5a26aa6448502
SHA256 8dff0e1436355e6d8529464ac8f5ac3539e5b1c4560d72db84515751d997bae5
SHA512 6af3be0ebefd8b70694abe980c4929085d1b180ea09c320b90a897843ff6e31f2e21c0c83f17581f42dad155c81938742ca1585d461de6d0e13001a4e06259f8

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.RYK

MD5 25b4d63269cb9ecc2827d547985a6a2b
SHA1 5e1bfc64b1d1bb7e88e1750220301d93d8eeb612
SHA256 66978a22689b204fd08723317846fd31b557db40a0f17ecb667a6e999443384b
SHA512 3bb6d94fe164aa30daa056159fe62793e33f30d38692e526ccb85af7c7e0dd0ef9fd0ea32df3c9e4948aaa2c728b5320b4ad3f0f56b1d0ce3be8662b5b08e0a6

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab.RYK

MD5 1f282054f61097d2102b18ad3d49ced9
SHA1 3d76300dd57e338070aead12938e8216f5891ead
SHA256 fb2f334d7c6d590fb2b85fa29453c3c4537eaca304a00768638e03ba0098535f
SHA512 d46e586b942fd92b64d698cf7a8daddda873186929011d64715e8110d3fc07d7c43ed0bb83fb652c7ed102e2989de47158753952a97f7d1e53b802959e8cdb0b

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.RYK

MD5 6f879fee3cccb4cb8740e54ffabc5245
SHA1 0f4c6acc78300b1c6e7d0f3284219c3d6be8b481
SHA256 8bc82cd16ed3ef8f7500e3c75afd6440ecca920674c327912d8496fbe6c95b25
SHA512 fc056c15432f978104c010159470a22510090105b201c2bbadb700ed2033990d9b3c92770c649c4219fb40db1cfe254514379a9a69ffea1b96e0f52c29c9e11b

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-20 06:47

Reported

2022-02-20 07:24

Platform

win10v2004-en-20220113

Max time kernel

59s

Max time network

120s

Command Line

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe N/A

Processes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\sihost.exe

sihost.exe

C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe

"C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe" /f

C:\Windows\system32\reg.exe

REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe" /f

Network

Country Destination Domain Proto
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp

Files

memory/2312-130-0x00007FF694E80000-0x00007FF695208000-memory.dmp

memory/3096-131-0x00007FF694E80000-0x00007FF695208000-memory.dmp