Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    06-03-2022 02:26

General

  • Target

    af5169631789347e6884a5402a945d7eac6d07784a79caf858ab59c8e2201e8b.exe

  • Size

    120KB

  • MD5

    d06b3960bbb5b12b3b5827296d6551db

  • SHA1

    58c0a54b4c6dd1f616631ffd973a54ee77b50c55

  • SHA256

    af5169631789347e6884a5402a945d7eac6d07784a79caf858ab59c8e2201e8b

  • SHA512

    e40bc6aab4fa50543f649879aa0ecd200a60e305057cf32671067377d0c027b869bcbbf28e02e408d9ec77f6ed058f6a70cf68849eda8cef67281d3717ee75f0

Malware Config

Extracted

Path

C:\$Recycle.Bin\RyukReadMe.html

Family

ryuk

Ransom Note
apmasampbubb1977@protonmail.com balance of shadow universe Ryuk
Emails

apmasampbubb1977@protonmail.com

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Modifies file permissions 1 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af5169631789347e6884a5402a945d7eac6d07784a79caf858ab59c8e2201e8b.exe
    "C:\Users\Admin\AppData\Local\Temp\af5169631789347e6884a5402a945d7eac6d07784a79caf858ab59c8e2201e8b.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\*" /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      PID:1412
    • C:\Windows\SysWOW64\icacls.exe
      icacls "D:\*" /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      PID:1828
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1708

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Permissions Modification

1
T1222

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\MSOCache\All Users\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.RYK
    MD5

    9b69c63963b2298a1ea3fe5dbf6be337

    SHA1

    5a517a82dd45832339d3e21908d7b45605ecb4bc

    SHA256

    1ba861e0fcaf7c4daeef2aa08db71e8ed9355ae7fa4a98ef14c54a4822f64bc2

    SHA512

    cc282f4b4da1545f63fb0624d6304a49227d19d8198b0ce857a25dfcc62c3520699a0032ba5ceeff3561a40f381e735c87b7091a290e543b3742a1e48aa791ce

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.RYK
    MD5

    5083a28ad25067b4861b7906ca0900f4

    SHA1

    69488c71d4bd0c54a0d008ab3c286363bb3df059

    SHA256

    b5cac5dfc7fc8f2a93194df254839dacd7f84a4d1307fa470755f4bbe587546e

    SHA512

    2764db9166ccf58525e9cb18a39042bb97f817f075c2dc53d8288da76ae3aa2909900af57578d9a88973547759213338cb749485b73600a15a4a01f18615610d

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.RYK
    MD5

    99afd3c3e98f8560b4e3cb68e68cdead

    SHA1

    8cbcd68e2632eadecf5432bb546ef02a3706e0e9

    SHA256

    02e4ec956697f42e119dc95daceef48bcbc11ebc4b7397799f02d754a4602f76

    SHA512

    34eb9928b07dc2f062a51aa9343430a979b37be75fd9fa077797f9c45b66384a933a1886338a51ed937f9e5ee8e95927195345c2722a1d080d37388f8a52de85

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi
    MD5

    2cbd4265b8885fc7b314f649b0ac3f41

    SHA1

    cbaaa492abaa2c5806295c0721869eac66bd7350

    SHA256

    0fe4d503e2000126ef627525bce746879e0721ab6f08628a863c2ce2796025dd

    SHA512

    3c71c1196096ecf54e9ca24c55a49f2120fc867c3be40ec7d3abd938f8baa9f96e6ceacfda0d7ee2d21bd3ea8d2ef8cc4d7ec40cb185f1fd113c4a5b1f127c13

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.RYK
    MD5

    fb4a2bc010efec8c5906407524eb38c3

    SHA1

    33770362f43a68282a2cf75a66a0ee811eedabb2

    SHA256

    c1193750a00b7a4a9d1eed130864c47e7280a2782f418d0e91f603242558a13b

    SHA512

    c6d94e2e52c29e0c5e439285e9bff584daa77557104993ddc1386d5e8016650bf90ea65d6ebd32c37879f25156d39679606adb962dd51dd9652d891856c5b467

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab
    MD5

    654ca6e589fe42d110bb7acee7bc173f

    SHA1

    36530ba48562d012e613fcc6205d75ce0aa9bd12

    SHA256

    531bd72fb7bfc656df37ba1aa1d49c40d2ee56fcde92427feaccab84f8375ee2

    SHA512

    6b93d81840cdeef7e93146dd115d7d9099a7e92cbab4e1f1a116c857b7514156aae75e28a1ce7a01277508085591b24198fd149c8778e4f86ce2d30d7d96dbbc

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab.RYK
    MD5

    6518e0cc7c00671b8804f27539893024

    SHA1

    3f58067926269b5cfbe46bb745b36533883c5d80

    SHA256

    df5012546fa206a1d863a1b378b7987c5d9bb268735211750bfe2273bc7a072b

    SHA512

    60a1021f2a1f2a0bf1c15547512f4bd6e0f298a94220bf0096bd2c106345cce385cfffa551217dec04553687322cbd0aa203bd96d1d19dc34ebf13c6194e05b8

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Setup.xml.RYK
    MD5

    2f3f3320bc3725c5f93ab046aebe5cb4

    SHA1

    9ee9adba468a64301801825db65259f534b96c25

    SHA256

    a375b3b3df46592751f111f4981e42cd72767c49eec24cbcdf2300a9c7243584

    SHA512

    18ebc630a8a58da1306380f2ff471ba8136d6bfebf69f1df5f065e2400f560577e31cd2b2859555b65f148d41aa656c167c9c5858ef42c53951fad807d5b31cf

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.RYK
    MD5

    61571ee31f3e15d6b3b8120ef47319b8

    SHA1

    60515f0869113b12b2fba42321cf697888e77d0b

    SHA256

    d69d77d8c66180c5ffa44197883fd4e15f19892cc48f7ad1bf6497c4422c5941

    SHA512

    d0d138626b515bc6019471e75f3a08f8f741fdf4e3b4fa73284e6737d9bf88931e220e6dc111579e7f0f6ef402681ffa6131179cd98c478a8c553f660bc37784

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.RYK
    MD5

    bfa388f81b485b62bc80d2d200e82d24

    SHA1

    8c872078f86eef5fe4d5b6abb74411816b964050

    SHA256

    1589311293f8ba8f60fc44046530ddc282f293902ff28e007a0033a5825007df

    SHA512

    672853bd44050a43d9610d9a1361cf3e014400588aa067a53baa14daed86c0762511f928730f0156bff93f7eb30fbd96dfea6a67e5aa63c71aa43cbd0d47d7c9

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.RYK
    MD5

    7f474db34f855295d8ca6ad6edb2190a

    SHA1

    9a5da49cdc10d244f6bdeb917ba77aa15b063bd5

    SHA256

    c35d254d7349982ea5ffbc6c849aefb73c2d25fbfc7e808afbc67b3101ff87b0

    SHA512

    574ec720a4f09d0b9f3cc42767adee8c1eb6b378a771d548f1bd9004ecfda03e8336e53226817174d9c691cd45402b9aad5c371c421566fddbdb86f3afa02e02

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml.RYK
    MD5

    f00b867b14135777cc966eba36f59420

    SHA1

    b49d572bca74bf20a38a4b756a9a1da03d6b8a14

    SHA256

    ad3b7bfb422b87bfa247ab1fd913dc2c953bb4f8bb908940e308525dbec08c8a

    SHA512

    873c52cfed5ebdfe98286eca4f3f8f2448dcc04967f21d573b678629061aabba186df054c96807fb1fbcd88530eda7e8a479a69a976e767a9bd864e96202e0d8

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
    MD5

    7d30681153912db26f2ef4b38331be54

    SHA1

    67616acffef5d67e1e78a479d0233532e1507f01

    SHA256

    1f654793ecf596ae6ca897d7a24951a34ea53e12f8fde077621a8983a58c8da7

    SHA512

    9b32869e3b8b4c2cf417deb07bda2c2211166fee9d04502b165a9020c8208d1b0e06dc65bbb9eee9a6acf64ec316dc41dc4a3644401979aefa1033c26ab57cfc

  • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.RYK
    MD5

    218a656429ab0f05eb9dc9168f1924f2

    SHA1

    04bf220fac3d2a422b28bf3d1f34ada22baf81a0

    SHA256

    d547aa7eb88731a4d646df1b1331e998c631bcf12b48090da2f2bf53a1be083e

    SHA512

    25031fa6a0d74108c4d3f27899c3512a23827744ffd60fb84c5cb695bf678cdfc23a945b3dae6e4babdf3e27ba8cb9f532b71f2799f62fad7be200d935435e6e

  • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml.RYK
    MD5

    dc26cd56867b0e4f0c4041e8d4536c66

    SHA1

    921770cd7446260f398921e657d5bf7c2b185a84

    SHA256

    e7f6c3ae4156a6580a1e96b41f84f0bd3fd56db571f55a741db63457349efc17

    SHA512

    98755c1353bae8bd71ba7408f2560c42b8d9c76f503fd730cfcee2f71c0b88d9f8b0e6f3c7a5f509f654ddf8d1bfe3695e0d9fb47ef0111549c80b667c93dee0

  • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab.RYK
    MD5

    a9ba4e5e2063f7160cd400200d0cc2b6

    SHA1

    b46d19cd01b438943ea143ba05022acc9e59438d

    SHA256

    96c2e6ab1196663d6f1d393315e7825e597c19721f24d0530e6457d09e77a396

    SHA512

    76430e733293224a33a7e19d93f4d63da2207ef3e28267c2270a8204c7cdb4a45083878fd4b290928fd48c19045e9af4961e78d6cc7189bdec055d998ade94cf

  • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
    MD5

    81591e0d2d967702df03b189bf2fc430

    SHA1

    eb5d00c5ddaa48fb6da080bec93111381e4a9790

    SHA256

    7a0a5980d3429e74ea0762f94d03f8899c8a7a8d85e9c3f064cb9fc6450f97eb

    SHA512

    f16114f12e7b60e41cf27519588795c2e0cafbbd786ce045f5d6c183f1acc00a4b20e06d9ef65a2d7fb71e8b0631f5c10b4ebeda3c597406acfe6b1ad59bd0bf

  • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.RYK
    MD5

    e77e4c25a421227e987b81c1864cfea9

    SHA1

    30f61ca2e2d40e25c832e429bb948e0131ea84be

    SHA256

    0124f07a2b4fa7bde668e7ba51e3bfd2de592f9a460578fa7fdaaf9c32230339

    SHA512

    50ab1d03af0b343a11d07a56e58255656918b0f8faba3ed03a17f1579ea1348e387302a867f5e4856144249aa964be1d0d4f3706676ed29924d85e7134e68f7c

  • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.RYK
    MD5

    3dccb4eaf2f3292e2b156e3c1e2737c5

    SHA1

    c25dfc88b3c371e12e69316638c416a7af24c5be

    SHA256

    c327479a350b25aad22890a55ceb5826a2420adb954be51fc1f2c51493e1445f

    SHA512

    a32f55c74b631c20604cbe311f518b524ea7cb4b11d1b44c36dbcb15891270ecfc04d1bb2f7f7fe00cc54fe56e59ab7bfa11d98bee24e2c65fc4ba62836859c6

  • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml.RYK
    MD5

    9ce0a848303ac071d260ea498e748db6

    SHA1

    71ee56445322f356b4e56f95d1894f7a088e1cdc

    SHA256

    8f7a47a26fdfacc662be2a0e2391bfa7599e39cf551e5bc8d83910f4fe78b829

    SHA512

    cb16f69bad882a5d1aa9e4ef92183b26bafda8034a531e1e517c52eace41ce2a2e0907fb1ec84f2515920fbabc2fbe46c44319b3f4537a272a60ab18274492b1

  • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
    MD5

    5da2f73da80ec627e17cb0b914cd6652

    SHA1

    c857ce9caca7cb5047211134a12f869a2ca4c092

    SHA256

    f6f32cb1dda04fe3ad376d6d7cf901e112bc3059beebdedb2d72203c661932c5

    SHA512

    94125ef6ced74af79f766b98cbc96658ece88e57ce6f25b623c672bf7e1f32e95d619a081acc7bc62ac4301926f7da4983bbaeb6ee14c5c882c0c92afbd2d0b4

  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.RYK
    MD5

    14d8ceb841b0b592da232addca20018c

    SHA1

    508e448bceaee7a5f8e9062356b405eb500c64d9

    SHA256

    3de1eab189a8d61038e115a84e3d99b49d930259c5475aabd35c848bfcf14530

    SHA512

    a1e4675a9f18b6f4b1dcf378278b825523499d9629999067e9de182c443559dd75888f2b4c69a0ae9e03f804554b76be28581c25b9076bfa8bdc1d94f16c9e9f

  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi.RYK
    MD5

    e8c7985c0ef8f940fdfd04fcd4b6244b

    SHA1

    17241013d5d0e759110b031cf3edc151c545cefb

    SHA256

    39cd1386c9ba9001bee97481729bef955c408d900138f2a6de1d0a0af81d6bbc

    SHA512

    7c2d7b08bdeab8d51999e0103dc1da32e67bc51afbf5e34337065eddbb2a5d618cbe622af94e3bb7c679853b0b93acd26a3d22bc93acf864ced8c7772e8f7f72

  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml.RYK
    MD5

    00dab4dc1d873aba4a540da0f43875dd

    SHA1

    cfef68934e8872c00b47a9181c0358cd9893631f

    SHA256

    b88c205a6bb477cb7ab599b64191a1be58fe3c712c8f32e7b8f67cf93c3fccac

    SHA512

    c2f8793b325613526299f2e1ac99a70716898fa7a2e5b1b2a2c91676bb24cf64257144df1d0f2a754fe812c8c61102c50f66ee76047e55133e90d982c2527dac

  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
    MD5

    66905e9a5e188931eac685c0e3891d69

    SHA1

    f8e5926710dbacdacfd67884d4a1a1d2253796fc

    SHA256

    51b2f01dba9f9b231ab5578def2cb1ee5ef99bb39ef9786d0c88202b474a479f

    SHA512

    e6bc2df089a753acdf478e6168e4387b5a42972cc390cf9b0529e2528420d88548b0c229522da9a677e51b1d292c72b336cbdb2ffe43e28a1eb35f6a3dc6a0f7

  • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
    MD5

    423312776c848e3d417ee3e9d48a6d15

    SHA1

    8c50d9d3b2717b13bb7786599ee63853ebb2c2c2

    SHA256

    6be72e2a3f0d0f01c2c30542a8fde32d6e0a79bb3f291dce21dc07eb44ded368

    SHA512

    f706c375618e45a1ed1f5d33da60972ebc0e0d62a600c67223285bb2bf62f5d8db34428c91aaf4b74947b74d66986d6861eb24bc62cc450bb7ae87ad304d672d

  • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab.RYK
    MD5

    0508e7f948aef1a412dc576340d420de

    SHA1

    eb483a94d45b88ea456e210e527adc0afa9d7bb0

    SHA256

    79efafe4dab5b01366718d913edc14828490cd57f3eca3824eadb61b95a22757

    SHA512

    9767b112b9ad7356e572f3868110e753d851fd891e2bd656bb0979147290f6c89165b2c4e8aaaa696b3ccb16c9543598684077ddf817b79cdbeb6f17be6e38ec

  • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.RYK
    MD5

    01e7b6860d99d64c53c2c185c4dc7187

    SHA1

    e190a0ec0228393e4ef7a25ffcbae6ca56728bf4

    SHA256

    f423b3eeeb97923c575a7406b0ec17d0b41d619573321ee976ff165b0a1bfadf

    SHA512

    467b9c6076c22a4073d2d3501ff2b765e3fc5c5be71fb633c6d0de7ac490477366aa23d12aced5e32dcd672f0d2d9c3a0a112a403dd072bd935477c04d2d9f09

  • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml.RYK
    MD5

    76bedb82203a3b8df4450dadef524393

    SHA1

    d6cde0eca0b16dbeb77a16d10d3b779327d216d7

    SHA256

    050f3fd9178b2241814a30f2faf00f584014046b43585a35232583db0a600812

    SHA512

    6514e07eb9fb19c52bdc3c4db852daa2f5cb1c1fee63b0b78efccc652ab74604abbe5453d32043a03892dc75c8583eac4d8b92d9ea4fa15a7f5b68937084aedf

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.RYK
    MD5

    2be58a976a24857b99f5ba8c66cb21be

    SHA1

    77e66e5270fde8a0e752ca0a49b271218d5f76ad

    SHA256

    97442ed6336403484518955f35bebb51bbbbe26b98ccbc3026e28e619ee0fff1

    SHA512

    ea9226fa5ba8d41b7fef7505e936c6e1cbf296a681709d0baefa6512aeae719c413ecec91b253a2a3a100c9e787a71f6de567b2c21c612302af1bd4952f23e69

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi.RYK
    MD5

    3b3a6d3776b420d3d7c65ceafc4142ba

    SHA1

    9518374c370d4104e55e929b591573f0a3fe01e0

    SHA256

    2aadd41a864663feb66826983b4ecb80e1eb58090b1f83fa263ec4212b6554a3

    SHA512

    1bb42b82c544de8b848253f825a86bbe65f105023fa177148b92dff3890392fef2cd24c391a19bd65a887bd71671497893de2a05b4114d3b91bf9c1fa59939ce

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml.RYK
    MD5

    c5dc927f79cdcec89b0f6027701d8d71

    SHA1

    ef298d810d9456e9606358a31e60ae8b2f8e811f

    SHA256

    e8f61a2140a2192dca33404a716841c75ea04f0792c81f46c416a5f527f8fdc4

    SHA512

    b2b2c8bfabeabe4fe3260f746723b881b6dd93bf99a051d1bf6e4bb783fb43d4a113707c3cbfb8033eabb60700d9775724f62ee119a956ff7d268a0c08dae495

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab
    MD5

    ea8b2453172d8ec40f7c1533866a20c7

    SHA1

    fd0a7b7ccb71b678c6f0c896b7a820877743adb0

    SHA256

    2c8c7550584d40ce0735792cd50c9d4d3fad45aec3ddce44976c6fa412f0329a

    SHA512

    d4a607fbb6c7488721e48256e4ea53c7e4e2a16327df342052a46950e9a71939d12ce63bee1f8d174c2378d2899bb9f7cf9ac16592097710257e4d5d203a8ed9

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi.RYK
    MD5

    d96b6cb6a236dc8f28af298bd60d0d1b

    SHA1

    e67017759baaa4653a5cf341abe2d32891150047

    SHA256

    ae302a7b3b35561efe5ab5f6070a8dfa54f80c921f3c37da5b45a0b3b3befc6b

    SHA512

    bc80693cc5e10df161703a9bac321b04df4d8251c0417c7ee4657655e56ad7e41810fbe5ea40d919b23744a585f502547ca5bb34e481207a6ded66efb780ce05

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml.RYK
    MD5

    d54b5afc71d81b600143841dbb9dcc8d

    SHA1

    e04b228c1549b2ce925198e43cbd0d889221b21c

    SHA256

    673c784ecfe40d0da5cd89071d5352ef0cf3da7d6ca0702aea4d9d7f67c4b567

    SHA512

    0cb0a27c28b58423f18a890ac8d41de8e4d8724c3ca88b735ef35379f48193cfeaa481c5abc539c4019bb471e5497e917419443d9d4285872d85983784dcd44c

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab
    MD5

    99285e37c3051d7e96ee807a050f1bbe

    SHA1

    ed2e7598b143058eeab918a458b129b77bd16551

    SHA256

    d9ac0c9b56b37c96b891a816b660d0375a5ef05c5f154b8ea411c246c42fb45b

    SHA512

    e498fd3c4db0d6344d32126398badbd5617c18f5183475b48ca58294572f50ece3039f006f66c18298028ae8d02afadfa54b70f9f88b8eb7277141f98dc674d5

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi.RYK
    MD5

    0c16ec0822b568e338beea2c9acca5f3

    SHA1

    f214f1063d4f3889300b905471f35775cbc961c2

    SHA256

    61b7e20bc4f77fd97af47cee92ae5bb812fa5e811535e676f0c49a21bb7ef79f

    SHA512

    b367f422fa2eb2dcf94c2e0a38e477f8ef88e918c60cca03d619491b108487d0cfc6a08ece49117b3e6b18fdde42c9e70f48b1811c4b3e9e0e84c2ae34f7de30

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml.RYK
    MD5

    0a007b4ab83866fcf5c731b23d750080

    SHA1

    9de7c2f5db5927bfa39835b11fdc0c6f696c0d05

    SHA256

    28943867cdf8d0ebeee8e75090888f1eb9c565929670e4119eb7257708604d16

    SHA512

    f8559531f10901ecbb52ccecea59ad31b9437b51a4dd2879aba21553be58a029fcedff55558eeab8c5d839d8296710899d01d550771715e3f02ba4bfa160b3c6

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi.RYK
    MD5

    25b11e4c487910befbb3fe8f39b16cb0

    SHA1

    1e684ae38f6a37780113f05a85a403bc2149b9ad

    SHA256

    f32a55c02992185e30000859c9b009353e81a84a4f837926b3775dac6822ddd8

    SHA512

    e42d680f64840797d47feabd78851b5d177194f06bfdb5251a2f8d45adcb08b5dc53852815f0b4a882deaf02d51b54788091e42b887b2dd5ecccf4dcf7a7b2da

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml.RYK
    MD5

    5969d4dbaf0dcd699043dc218cc325c8

    SHA1

    dac9f33f71cb47ed8eb00c566e203095f308ecf4

    SHA256

    1c5eb0feb967951db31dbf7e22e4bd36c5e6e7d39a89fae8fe6e81e7d812a044

    SHA512

    52a0866403f0d5a1617f707d70a21017ac5539fddf798cfec306cf242dd2115bc5fd06b70b13831e81c727e62e74c99c3f23b947dc917ac642ddb1bc5ef2eb69

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
    MD5

    3172c036cbdcf1ce1941f5c30af9bf43

    SHA1

    2ee88a0637ec3ea4f220761fba27b76ba9c7a03f

    SHA256

    5e7abbd0f64030cbcdcf778243565c6ca469909a223fea597c285b4ee4f35f42

    SHA512

    51d166d048daf0658eb7776aaed276dde4a9eb557b2912be48828017dd956b8c2d5e6eee0d6fe73df2110e06530b9a5d54cc7d67434a686d1c82046ce2ba6eb6

  • C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.RYK
    MD5

    44f3fe8d3970681f3acce7cf0df9d63e

    SHA1

    3363f375db15b68d1679ce73c5312e432cafa127

    SHA256

    506a87093e5d3cb5c8b93e199f887fbba49e55c55ed8fca8a973ff155c6b95c6

    SHA512

    e7f7b78d94b3630037c143b7a9c103329694475fd00991921d958d68eb55129e2e5f7dddafacc8fc1c6043715b952769e9e38e12745f2bf96085e1fd94e913fa

  • C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.RYK
    MD5

    bd208f5acfb7645de7cdf5dfdee63450

    SHA1

    b891badbe9ae8dba8c5e585e8e08adcb2116fa07

    SHA256

    9199a28ca0693c8863601456f1cb907ac13c4dcaa71f061776a2e65a0ed1d83c

    SHA512

    88021d013cf2cc0e907a4864b5c7294a4b21794c551fba4aad9e27481300330aeb8a838b36f75017669922dab6e4a1d5d157b2a0b5de37a796970c99c0a30667

  • C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml.RYK
    MD5

    498fcf381c129095f419e4d0d1908ac8

    SHA1

    3f0f676a1f7234b474f47875408755882e176484

    SHA256

    edf0b4752385681fadbd5af11df1e2cfa92e37897fd9dec2f0e5075476cb010d

    SHA512

    ee095018b2376b0a6e95b203921067e24cfce2b59a379efa56c56f310354f9ffca35ef84d996b876dd364fc9d871dcb371ec24c3b470b8fa2db592fecf19cce3

  • C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
    MD5

    dfb8d26b2a0457fc27b6e3fcf5df7e4c

    SHA1

    c478c6cfbfe99af3f4a31e9e781969d424f19d88

    SHA256

    9f814f6bdf2d7bc8ff87854a05f63b94043821d4863c87180abdc5130ffd2eb4

    SHA512

    ef1967887add652ca6020480da539082873cc7eb974c0d48bfc1cecb059fc671ee98dced6d052507d7849b80683db5d1aec2b8ae24095433bcd8acf361e802ea

  • C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi.RYK
    MD5

    dd51e5f58a0483adf8926cbd23d4dac6

    SHA1

    2e3667feac2917b98ef3b35549950c0f80c986b9

    SHA256

    7be57bc4f43d02beb9ee69464be41c5211450c89d78ca95d338104f2aa753e5c

    SHA512

    c6bc4df844eff54ac11c23276408d51959624ff805f5123d241abb64c76c11e72d2500ca18346b656a145b3f5e9c34a4c634c4e22bf3ebaa395f61accf19d6f1

  • C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml.RYK
    MD5

    f3d1edd955c11f33fe269d56d51f8ab4

    SHA1

    93e1cc4f164837f1d0881c4e63f15a84f760fa7a

    SHA256

    ca7f0fe55925e7d65daeba4834515c1c18f2e1008298cdafc24a8eb52aa75c38

    SHA512

    e21e24713e491b16819cda32610fbe5e8256566568a0d32361fccf8cb45d9b097c9be088984da30a01cc12d99c1fb995e82f40cb31a81a308cd47804323f0ceb

  • C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab
    MD5

    b07e8cf21657825e8fae3a225fb30f03

    SHA1

    1d55e15300e281b346826435244dd09d13b8668e

    SHA256

    63472b8137be90dfce93a3180e1c4ee6f6c1bf7b87de4e2e7507291ec5e638b7

    SHA512

    16a4bfcb7cd1bdf55e9551055ac126999c1c32ab3ed08993dacd9f2640a086108c6112d7b7276b925e9dddd34c97efeb95278b1f16d6fdb14cb9b489ca98263a

  • C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
    MD5

    7c19bed257167b6af44ca46afa3cda86

    SHA1

    9943dfa1ac74b2c427bea58ccf42fe95b73a554b

    SHA256

    58777e05376dcf8c398efa6cd9ce2705c06bc35da7f604724fa16b9e7f174be9

    SHA512

    5d6ec2c5a375739b0aaa59076340cf5c032e994cad1d416b32986de9fd58c99abd89afcc261730dfe47197aef8622f73bec1837769b731f1264661a6927cab82

  • C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.RYK
    MD5

    574bd05e8091ff468b7c573dc21534ce

    SHA1

    40b9b8dd42b821f9b6b036d79d609bd2ca02ce4c

    SHA256

    f033b11230aeacc7af1d9c40c9541c7ccf0b470873c7672b8b5f7c4b688d066e

    SHA512

    86ce2aa864b03bbde07a7299aacd7a88add752ddaea0ce95feb29dc72f22d97bf2a77c65772a2d24927ef40a181d880d9f99a09b492aefe43b0c8d9dbba3d2e0

  • memory/1660-54-0x0000000075F81000-0x0000000075F83000-memory.dmp
    Filesize

    8KB

  • memory/1708-119-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp
    Filesize

    8KB