Analysis

  • max time kernel
    144s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19-08-2022 17:07

General

  • Target

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4.exe

  • Size

    397KB

  • MD5

    5af409fe584bed2f8b847bb9d2eca34f

  • SHA1

    b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3

  • SHA256

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4

  • SHA512

    f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note
paustupexmnem1974@protonmail.com balance of shadow universe Ryuk
Emails

paustupexmnem1974@protonmail.com

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Dave packer 1 IoCs

    Detects executable using a packer named 'Dave' by the community, based on a string at the end.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4.exe
    "C:\Users\Admin\AppData\Local\Temp\3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Users\Admin\AppData\Local\Temp\MLFtFWvVolan.exe
      "C:\Users\Admin\AppData\Local\Temp\MLFtFWvVolan.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      PID:1724
    • C:\Users\Admin\AppData\Local\Temp\nkcnbDYgSlan.exe
      "C:\Users\Admin\AppData\Local\Temp\nkcnbDYgSlan.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      PID:1988
    • C:\Users\Admin\AppData\Local\Temp\oxmiNLhAulan.exe
      "C:\Users\Admin\AppData\Local\Temp\oxmiNLhAulan.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      PID:840
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\*" /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      PID:740
    • C:\Windows\SysWOW64\icacls.exe
      icacls "D:\*" /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      PID:1084

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Permissions Modification

1
T1222

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • C:\MSOCache\All Users\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab
    Filesize

    3.7MB

    MD5

    73d5c3b8acd6b93fcc58d6df5f981b64

    SHA1

    aa483973647e29a62bcebdada23e721d779b6995

    SHA256

    eb661144a0d91eb8d929129ad2e3b45de0c78bdd962630030a5650c80e071871

    SHA512

    5485b101a770fc291894f0291b5497c24b1e0470ce2641baf753f4e741dc3531ad53ba71ea6588af36a552cc2109f2e3db001527de9dd9c68e00e643197b25c2

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.RYK
    Filesize

    2.9MB

    MD5

    dcaea70bac5b68da1fe6b99235b62990

    SHA1

    1bc488692ce4fab96169eb19b72906a78db4a044

    SHA256

    7bb42deff68e0491a66c02c89338f68497004c2f35564cce2c839bd4e56c3990

    SHA512

    538bd40c571df52a3a5d42616d6cd6b4df38d54e70b5c9fa8b6204f2b66d3954fa092bf05e6ac91448882d1fa0cff098825f1a0d6e888d1689714142623befde

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.RYK
    Filesize

    4KB

    MD5

    213ec4123014f61b97cbbc01da019794

    SHA1

    2714cdbd3ff1fc5935f697362eab823d8e7be8d4

    SHA256

    b8b448cfcf726f135fc69551e6c9d9a0ad981b984b2f00daafc76436fac2e722

    SHA512

    bdf6828c140ffefb55c1a788f963235c98890542ba7a072b55b78103ecd3a2fad7f400d68643a155e54cfa879835632ca739c9b3eb0c37faac791a411c43e6c8

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi
    Filesize

    3.8MB

    MD5

    c03efec41db197ed5aaccf306f41a3e8

    SHA1

    4534ffe64dc64b5d398212bb6bfcc0a4a96ea652

    SHA256

    c746f26e124225549de0674ebc5e1d4bac5999efdd7419385459c2fc74fc54b3

    SHA512

    9ee9ee22e624d149c79a56774f6a7177cee57f80cb5de8b932da070a74bb9ed6b58e5c1bd4975223972b608cb982c785bf32cbcb4136b2bd2b8bfa8c99884a1a

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.RYK
    Filesize

    17KB

    MD5

    fe38b0d639f305feb9e808fdb1f5445b

    SHA1

    12efb8b01eeb5b86ee3642d2962162c92a881388

    SHA256

    e471527b0edff1ba694cb3a417978a6bc323e713871bc8b6cfc12d17c591b419

    SHA512

    8d9060a71fcf2ed43bbdb2866d99df5f258298d5a94d55f3665e226b4092b4e29d1dbbdee02ba9437ea262a43ef22e776d360aad5a4de5dfe56673bfe451df3f

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab
    Filesize

    3.8MB

    MD5

    1e6a4efab725b65cdb41f8bbb90758c5

    SHA1

    1bdbd7c7738a19203365895b79fa509236a124fc

    SHA256

    4eecac8cc33530a83917d66cce63b47dd528ed80cfc4d244fc6e09669fb3b03d

    SHA512

    a85a49c3fc98f1b07d4f607915f0e6a98813b3ddb60cdcbaf2847ae4c39adc257745d45ca894002038dfb5401e9a3400967a0abe64c9d2e9f4b2ea2d9cd04aba

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab
    Filesize

    3.8MB

    MD5

    263e52655cfcb9c50421b5b964b71737

    SHA1

    94a8ce5971d806ccbefe6c7da56b31de2ae2c58f

    SHA256

    caac09f056bac26e7a4bbe86abad0b57331ece2a23a65c85b4eab232edfea1e9

    SHA512

    2d8d4902ad04b3a43152fcff9f4ed592dd0431d848b559f6ba5a0fdbc74a69004e83915172c9bb86ced892b035daf8878017019ef8da61886a49a585dc2f51b8

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Setup.xml.RYK
    Filesize

    31KB

    MD5

    fb26b598cd216ecf00f640690482fd83

    SHA1

    277b4b6af3e5008027cbb5b9495935b32a18bb60

    SHA256

    0eb3579296e6e08ed7163c80e5bd002bdf56708ed60165b1aed63e69b1bf8c5d

    SHA512

    69f8e48a2d04e024374367c18dd05ec440cf21c6b3757fe5c07895f0ac43d9be4aad72ebdad0e0a8cc17f0819d82f15975321b5212dec4e73fc9d89d59865d86

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.RYK
    Filesize

    699KB

    MD5

    86183465febfb74d4aabba71e9abc446

    SHA1

    0f5887a8b103eb9da3364130225639f6e3df124a

    SHA256

    6690d0df0b1392fcc8274d56380cb17f497e6ed3cbd04a8a181ac875479257b4

    SHA512

    355510d02f7eb8ec9164797d012a394e52985a20ba390f4426cdb424fa620f88c3edb50f90be3b5a0fb52a928c2540515fcd15481c9e1b29e90cbc2d0357bfe3

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.RYK
    Filesize

    3.8MB

    MD5

    5b493fe59cbebfa0bc0c8b167da1766e

    SHA1

    ec5716f719ddbbb7644055a1611d04f3cdc5ee84

    SHA256

    ca2b222922c2af0c8cd1059e5ed989cf52fca16cdd9313fd5b6563183e080d0c

    SHA512

    bcf09e0d89478cd4536ae2df926f55ed6602730f4582deb141d9f08650ce49e3772cc6443529c3d7a15d2ff44e334705f4f3f77a1fc5b05a3fae2118ae2b59a4

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.RYK
    Filesize

    1.7MB

    MD5

    d59dbe684261ac627f92e0bc4942d71f

    SHA1

    119a0b45d7e7eabf8fc95ed6874cd856dd9ddfcb

    SHA256

    2eac5f75212acf20e2304fd2cf2ecd14d61608a4460da86d54078b5c8586f532

    SHA512

    89daed4eb5bfc776652856ebbcd477997400da78bbaf059779fef6e7900576304700fa939d198294d4ef40235c11f2c8bc224209d61413942c5e531082d63471

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml.RYK
    Filesize

    1KB

    MD5

    cf8182f7d402a4bd4155fcaa3c0c71c3

    SHA1

    69a74f7e7dfd6711960199da5a540bbfbfc239ca

    SHA256

    4ca92cc2aa895a293d78c81458e2d172619e33e6ef429bf52d7a6b61d129708a

    SHA512

    cd48e7680da7b7a60560f1b3f3192e981d88a8ae790b2ae977a9db7ab2ce6228af3c805885a6ea963ed7fc690e8843db417f85a15693eebb9a3ce2f7845a3017

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
    Filesize

    2KB

    MD5

    0a48b7e1ebd94b32d78302f788a6f855

    SHA1

    b8536a44f6f36ff113ccb41b9ff8806ba66ec982

    SHA256

    dcadc7dd2e6d00dd61a01a75ea8d7382d093da85eed543211830f02e93bb3415

    SHA512

    9503e45c3ced575a993901972919bff87b1732f389b26ce8b810f6ee2074371edd993e67663da0110e1baa844f79687055d888776a0004f8ca463ffcefeb3b37

  • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.RYK
    Filesize

    1.7MB

    MD5

    e84b2b78bb2de7f4f718995ce51a62ac

    SHA1

    d832a715760e86fecc5871c9af8e9b3866a6e9d2

    SHA256

    0102060a0d59e5ef12707d15443f88edf6a48a80c01f7e1d2ef946541b0cf8c2

    SHA512

    42dffb3eff55e3b98f6bd58be527a1687b32be8b66cca9e3c80cbd1c3d692b6d238cfcf139b92631d3985f7f7563cb2e2ba076528be0ed9b65cff5cdec1e97f9

  • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml.RYK
    Filesize

    1KB

    MD5

    9412a5e5f76d69baf1db43cd56186b86

    SHA1

    a79a21fb4227692acd1023d28afd1c0f9def2b6f

    SHA256

    8164b064127ecb99ccd54cebef00be5a9b53c12dc42168367dd2f1a131876078

    SHA512

    de118c723ea8162a9b154f8fb3af1a7f4257493c084e8a01f0c0817f27da038ebd019a6d8ba1cfe690be0db5999d8e8cbfa3eb12c1ae44420f019602a7ca3fe1

  • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab.RYK
    Filesize

    3.8MB

    MD5

    e0059afbda7b547f2d3a27b77af7151c

    SHA1

    2b86e73cb642322d72732c3177f25cce766d7945

    SHA256

    4c3e5f8139089ed184314f5900daa4c20245ef73e39a5f2c19472bc286331c62

    SHA512

    81b82cce92a8ac6dc5238048deb308ef436ee1c51cc8560137e24387d8c923fd734aefa105fe36d89106fe649dbf3f030a019fe9473a9d3805059dd2d4c46d3f

  • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
    Filesize

    2KB

    MD5

    e4d0fd6384e226f722c105859dbd4a10

    SHA1

    7431b6e77f97f6f1c380d074565b9ed9e6b066a4

    SHA256

    7eaf9fbd12a68d99286ea279d2a9b58620c544cec97e14ee4d07a6b80a72a91c

    SHA512

    5c81e45ca049debcd193ac0d247e252a929564ef4455e0331aa6031c40b244fdc77eb9bf2bfca7d2313994a997f61732d673ba876b60de4a27e58f94f52aba09

  • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.RYK
    Filesize

    3.7MB

    MD5

    10288ec067b0ee00e8d57edae1a1a947

    SHA1

    a317d0840f0dc92f58c3558bf6f5bd631247e6b5

    SHA256

    8dddb615846961c10cd46fd9571104789e68c3178b9030b976c5b6654283d779

    SHA512

    8f6e930ea34b58c77e52a118af19826a1e05e16623b324750b455946a89860f43a058082fb3cb405d05874c74ed8d2a2376052e9028ce25fda9d9bd56e6566a7

  • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.RYK
    Filesize

    1.7MB

    MD5

    0af2a229d48240af2bd7e500d1cc2619

    SHA1

    6eb0fb9ec9d8bec969d23ec2b7a31a6a7fe8f8d7

    SHA256

    33015abdfbce9e0081668dcc4eed7b0c3a2307314ddc3b6c44bb60e99df3479f

    SHA512

    399dce6b210164f2b1e7bb149207916ac7e08d4066e91c84bbc42965ac93ea5a9b0636fbbf5d53f3cd128705b56d46c341e6d99619bdc31a9bcd4c99bddb48e1

  • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml.RYK
    Filesize

    1KB

    MD5

    c54182dbee39f53a4b3a8c11ffc1b89b

    SHA1

    86259d89e2baeb0e65f1ee1e7db362200e839c2f

    SHA256

    4caa23215f58f6b567121c9179ae37e43d7b7d6e2fbc71023ccbe7618ac468a4

    SHA512

    8c0329e7638b403a8c0f68ce917ab5a6123e756e0d8e1f4fd230210eaabd04999dd41fd0f8c961c98aa48770c548eac240ddc82434e1675ec606678c5d021ab5

  • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
    Filesize

    1KB

    MD5

    d686c71d854a1bd296e8e7c3e902fec0

    SHA1

    f4769ac9f10e0a733ef9ecf311df474202eb0702

    SHA256

    6961898d778ead50cd810c933d02a801f241c7c526f7cad7d68ebc1f2980c81c

    SHA512

    77abbb5bc6964f576baa22ca7a971537c644fa2191295c44417dbacbfbd8021e964a0dbf509e10af327d1023be57892400a03c81d7b971f6d001dec2f6fc92a1

  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab
    Filesize

    3.7MB

    MD5

    70eecb759c8d8c7cd9e3f7ec60251a65

    SHA1

    3bf9e4c38bd36160312249110f99dc69f137155e

    SHA256

    8f58a4aea0990b2353f20943c0c64a8e3ce6fb6119aa2b963f0ab1e48878ac29

    SHA512

    faeff49fa2db1ea6bccddca1902fb6de2f55a4768a88f93ef1fb34efbf8b2954b6280afbe5b4dda9408e8bfeb5a239205eb82adab02c8ae1e613f0e49c46c253

  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi.RYK
    Filesize

    2.0MB

    MD5

    42d5059759c32baa3ca39052d549a400

    SHA1

    c7ab20b672204d7c61071e68d8904b8bcee4cecb

    SHA256

    7bc055b9a8c105c65c1f32025a735f26e8d8dca0954fa52d9bb84bd336d5ffcb

    SHA512

    63421c06e42497b19625b1cd5463d1c529aee5a1efac0ec50c15e70fb0211eb901ae184de39c24c363be9d1d6569522cf2accf33656e7610d036f549446ea32f

  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml.RYK
    Filesize

    3KB

    MD5

    2921a73d667451c93651e94658aad572

    SHA1

    e5bf9ab6af92edfe1a4f8f74749daa230647496f

    SHA256

    0b041a8e839dc1d60550d0e49224fdf75b8778a88c10c5cae6ce465ced3d9c4b

    SHA512

    ecccec435da8675eaf1106d128cdcb474c2debc4c5604fa5a755538f07cd07c948765f692b13725d9a38583edae2ce62b87b6bbed2d2f790d202aee3159d748c

  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
    Filesize

    4KB

    MD5

    3675321381be2e23b8073fd8d5697965

    SHA1

    c4cd1ada9331ad91416e0d8549f33c996a94dbf5

    SHA256

    eced3ab63fbf8518a5171b942df9a18f6423364a9580e6849de57510fcd9f482

    SHA512

    05e111b9a320e0bf1fcbfba6bb653d8668cd379ff5c61fe9cec9b928634ac7ec96fb0c8b98cb25578d848e74a68cedc9fa87f50c801e6d59361eac5ad3c0ed4f

  • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.RYK
    Filesize

    2KB

    MD5

    a33a722f7959ebd84e41635218619a9e

    SHA1

    e3d081d9bd8186a98a830ecc677646587e525028

    SHA256

    0f8ef942d66ac9c987c0da80fb4f7a989275126a9e4125eabdb45f705b49f1c6

    SHA512

    87fb8d906561c151989468a6e485ea4b615c029dbe550da4f25a2297ae57fbbb198d622336e81753a0944b083254dc7ae89145c9a43750a1606cd9b12549691b

  • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab.RYK
    Filesize

    1.4MB

    MD5

    8f6563e33af99390054365fef148ac83

    SHA1

    73e4ac44142c17be3e45cdf65cb7bc6d3f000c93

    SHA256

    c228fbd2060eaac83484c9c00162507510bcf3f2b70af2432d2e923668cd26e6

    SHA512

    f3836f883ae585a9b1ececb86f501e53140fa3d3d2990d53bce11440f3e2a5a3ac0c39829e79e3e655418f755f29bf6ee924aa521e944dd47d9d8c0c903f970c

  • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.RYK
    Filesize

    1.7MB

    MD5

    a77cb79bfdc646778a7e1bc6062b29d5

    SHA1

    8ed00ecf9e2112a36744433e1e9a2b667c06b744

    SHA256

    4be334871c82e0b459d49861c8e7bc2e8950220c8328d24e8438e2d0a750a31e

    SHA512

    3e1cd926b87181bfb45c65e80839b6a35a4679e9fd81118ed4a1e5eeafd726f232605095c431224b72bf2f291b3199d4e0d25d69a95714f03caa57c46a01a59e

  • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml.RYK
    Filesize

    2KB

    MD5

    b199291dd0164db46a3165db88d8460f

    SHA1

    187d64ffe6a460da682a603f91d6863fd4d80afc

    SHA256

    4951341f7927b4dfae28b6de64ec86cbc2671baae2566b1693a001ca61d51d6d

    SHA512

    f03ae8e2a42fe461ba6e44903daa26b34648e64f2ca31e951ab89c4a7caec51d64f753fb929a3526c4479614c32557a09470dc9726ccd09ee8187078cb2cd59e

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.RYK
    Filesize

    1.3MB

    MD5

    6587ce07e6216810f018dbb6c55498bb

    SHA1

    f8ff75979d11720549c0f277b9d695a5c08beaca

    SHA256

    9de8cc92e3194ecc2ee41271e94ea5d95727fe38895bd24dbd8ea3b27d7fe53e

    SHA512

    d74224f4aa9cc28f18b910242a711e574f0e35e83b2faa3046db57d6991fe3c6a1456f146eb3dbd7cf95ac5a12ab63372ee435c7a446a09aaa8989592d3b723e

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi.RYK
    Filesize

    641KB

    MD5

    ea186d34185d33a9e012a25f3b2a0100

    SHA1

    24c0a78f545413e8be8608f9053b1667040b04d9

    SHA256

    6cd26de27cbe87b8348cf16822954dfe7abea41f23d283202e4b28d2318601a5

    SHA512

    79097eb3a53feb80199f92d2e4edc05783ad8c6073a38fc74bf7d76cd15682335dccc49eb1d5d97a47142e2f88c871bb40e4bb43e3d306a374d4092a5de663e7

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml.RYK
    Filesize

    1KB

    MD5

    911dc4cefdab50985aa731f7d8da4804

    SHA1

    aa8f604941688823a5644eecb01839c5c3bbdf05

    SHA256

    ca782303bab9aff4efd5e9eff5d0adbe7989796b245066cb6f4264e1b413c952

    SHA512

    1755cfa5ab37d80f8c945077c5fed842ec09bd6259e3d69d2a57499d03b8912d6c0725f9bcf60d5f696cb6262ff7c3081e997e4d3fba3369473427b4b4d37a79

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.RYK
    Filesize

    1.3MB

    MD5

    b9b0e91310cede423b799ae0dbfe5cba

    SHA1

    cfa294385dd4d75fbd2e48eac6b8b740188e64dc

    SHA256

    b4153ca1a792aa2281e2a55a8a04fd1a2283c106e4734aad9315b1b6bc7ed736

    SHA512

    b8f1e513097c09eee88476a6d97e5c640ff36ada0c161e9683a8f9474c11aa705a9e1fa09f0dba9bfa3e53fe382e3babf39d9723418bbd21e15598754aaff190

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi.RYK
    Filesize

    647KB

    MD5

    5081cbe76268f7f64d86671993377e63

    SHA1

    43166aa4c2f23f99c04295eeb633d123c2e4057c

    SHA256

    415f3cdfa096c8bea56e04a200c20c182fa13ccf2cee7e5d72feadaa8d4cf654

    SHA512

    5d9946ea3a6f452b0de75a7db0b9c24cd84f9c9925fb1e2eacf29e28308f38972f9c3935ca15125869e2fab9155a9606ece883a0976fe5afe19b5908670865f8

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml.RYK
    Filesize

    1KB

    MD5

    e056cc8111f5f20c53f3da07ec96cba6

    SHA1

    2a5675a15d4b8e21177bcb379fe9018d3fcfa699

    SHA256

    fd3a447d756e62096962bc52b16629f9d4f66234bb428ac8d4678920f371ff1b

    SHA512

    32a4368bbe5beba798521470d2e9c83bb858618c67cfa49db189a01c6b9e11f12c5f824c9836630904874cdd2a22ac47400b5fadd8f3ae3b91d7082e788bd46e

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.RYK
    Filesize

    1024KB

    MD5

    30ae3deca87ee2804039ca3255fc8fdd

    SHA1

    1e3b38ca435ad61f673d0224030fd00b2a816747

    SHA256

    786d3b520b6ca0a3717896b5a5d001f3ccd7c4fe3075dfdc8e40dc8ce43cee20

    SHA512

    5f86db6c4ccea6c52854c7c1249428d752f9a0374191a494b4ff767a7240ca7ce8d215f99dd4a022e1d51a414b9f5288b4055841e554b570150a1a7a6f8d758c

  • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi.RYK
    Filesize

    652KB

    MD5

    4cdfd369b1191fb8f4e4a0adb3836410

    SHA1

    6703f9dfd3e64f2a8b6c4f340e92ec49e6783caf

    SHA256

    0a06da4c36ff5ae786e4009e38b9ebe33d5d673f17702aab9fdd03a12a0c3888

    SHA512

    4e1440a53bb9319cd1a35c02deccf44bf3b934191c5dc522c883095b7eb0685ab7b30e618e319de9cfc00257f940cf380ff1e0918040a6d9a31355f14de51641

  • C:\Users\Admin\AppData\Local\Temp\MLFtFWvVolan.exe
    Filesize

    397KB

    MD5

    5af409fe584bed2f8b847bb9d2eca34f

    SHA1

    b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3

    SHA256

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4

    SHA512

    f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc

  • C:\Users\Admin\AppData\Local\Temp\nkcnbDYgSlan.exe
    Filesize

    397KB

    MD5

    5af409fe584bed2f8b847bb9d2eca34f

    SHA1

    b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3

    SHA256

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4

    SHA512

    f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc

  • C:\Users\Admin\AppData\Local\Temp\oxmiNLhAulan.exe
    Filesize

    397KB

    MD5

    5af409fe584bed2f8b847bb9d2eca34f

    SHA1

    b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3

    SHA256

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4

    SHA512

    f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc

  • C:\users\Public\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • \Users\Admin\AppData\Local\Temp\MLFtFWvVolan.exe
    Filesize

    397KB

    MD5

    5af409fe584bed2f8b847bb9d2eca34f

    SHA1

    b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3

    SHA256

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4

    SHA512

    f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc

  • \Users\Admin\AppData\Local\Temp\MLFtFWvVolan.exe
    Filesize

    397KB

    MD5

    5af409fe584bed2f8b847bb9d2eca34f

    SHA1

    b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3

    SHA256

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4

    SHA512

    f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc

  • \Users\Admin\AppData\Local\Temp\nkcnbDYgSlan.exe
    Filesize

    397KB

    MD5

    5af409fe584bed2f8b847bb9d2eca34f

    SHA1

    b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3

    SHA256

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4

    SHA512

    f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc

  • \Users\Admin\AppData\Local\Temp\nkcnbDYgSlan.exe
    Filesize

    397KB

    MD5

    5af409fe584bed2f8b847bb9d2eca34f

    SHA1

    b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3

    SHA256

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4

    SHA512

    f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc

  • \Users\Admin\AppData\Local\Temp\oxmiNLhAulan.exe
    Filesize

    397KB

    MD5

    5af409fe584bed2f8b847bb9d2eca34f

    SHA1

    b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3

    SHA256

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4

    SHA512

    f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc

  • \Users\Admin\AppData\Local\Temp\oxmiNLhAulan.exe
    Filesize

    397KB

    MD5

    5af409fe584bed2f8b847bb9d2eca34f

    SHA1

    b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3

    SHA256

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4

    SHA512

    f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc

  • memory/740-102-0x0000000000000000-mapping.dmp
  • memory/840-90-0x0000000000000000-mapping.dmp
  • memory/840-92-0x0000000001E10000-0x0000000001E36000-memory.dmp
    Filesize

    152KB

  • memory/1084-103-0x0000000000000000-mapping.dmp
  • memory/1096-58-0x0000000035000000-0x000000003502B000-memory.dmp
    Filesize

    172KB

  • memory/1096-62-0x0000000000480000-0x00000000004A4000-memory.dmp
    Filesize

    144KB

  • memory/1096-63-0x0000000075ED1000-0x0000000075ED3000-memory.dmp
    Filesize

    8KB

  • memory/1096-54-0x00000000006C0000-0x00000000006E6000-memory.dmp
    Filesize

    152KB

  • memory/1724-66-0x0000000000000000-mapping.dmp
  • memory/1724-68-0x0000000000390000-0x00000000003B6000-memory.dmp
    Filesize

    152KB

  • memory/1988-78-0x0000000000000000-mapping.dmp