Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-02_8a17da61d90fde600b9e139e6560da3c_ryuk.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-02_8a17da61d90fde600b9e139e6560da3c_ryuk.exe
Resource
win10v2004-20231222-en
Target
2024-02-02_8a17da61d90fde600b9e139e6560da3c_ryuk
Size
5.1MB
MD5
8a17da61d90fde600b9e139e6560da3c
SHA1
20ef761924b691836c38886b173d033132ecbcb1
SHA256
e7c6048cd58d1164cd60525ca831d2c201090ea12c573f93ee003872ad428819
SHA512
063be08b5743d94c5fd8a86decb347e46cb2cd2dd0efaa4b4af67cf052fa99d3998ea644f4e7104a0822c5f55cea3c8fcfb0ea497ed472faa5ba03321fe5e55e
SSDEEP
98304:6w8FWz5yANXr/9PvvAD0ACBCR+uaPC/e669r1tkhcK3dClu7:n4WljpPvvAXCBC+Hce665vkhcg80
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
D:\WKSPC\4.4Fix\sourceCode\build\WindowsStandaloneSupport\Variations\win64_nondevelopment_il2cpp\WindowsPlayer_x64_Master.pdb
UnityMain
FindNextFileW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
WTSSendMessageW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
�/�����Ɍ�QDA��#�C�#����`��ZA��[�0/4W6��H���������}��/l���E_aҕ�����Vr(sa��xjD�0��pJ���!@�QT���}���zp(�l)\�| hY>��˯�c�&����K���:}5gC�E�&V�AGM�����!����#�cɤc�A���q�a��ԣ0��@NBk���u,���e_��<}�>1�;鄸ꃘAЅx���x�U�Q�o �d���Iح�����x�����O)�1P���C E24\{���7J#��"(�\z2�q��W5F��g�` '}�7�~Ϡ��Ւ��1��� �`��P�3q�?�P�5'9�&�Rj2Y�|���b�Z��,��WO&� ���_�`�탚�5JTK�����?�d�p�=��OO��&&\)�< ���fIJ�<���@{ͅ�n��9KN1L�c<�m-�]�Ik�h� v�s�q��M��'�����zJ�kM/p3`�x �'M������-���/� ����.��*0�� C웤��yrs1-|�?�(��l�Bi���ˇ�������5�< �Jz�㒎k_0!7A�QԹt�h��R��:�p�n�Tb�O���_��h�YlS�s�c�B���>)�(Ď69d0���T��{:� ��|^-u������ֈ��fZ�9�1$��/����ݭ��5�7��V�>�<��l�a��S�PB$pATK��I8"{�t릻�xX�YG��� ����q*ǒ����CB�9 ����>��W�4y�>�i�ܙ�r�];����O�Wsq1j�"�@>�U�0��!J�S7��l����<̪�?��aY]K Q9Y�'F�)�H��U{����uJ�ʃD$@�D��pl ���5B��}��o�b�z��3)S ��������W��Χ�~{#���rAF;O�_��֞��t�}����Vl��C�f`/��]4������2ŏ�/�f���+T�[$����?/AO\�ĸ�G�HJ�̃�6���0|%Ha>i-��=g����֒b���H��a�@�����G��"�445#p�\˼�S�u֚9ߚv���X�$y9�&L�N�Ԝ*\��W0��V�,���-af��>���z�\t��x� T;m���nc\����?Q~S_�c�`�Pg��jF�%T�4�F�z��*����-+L>1�;��ڵ��*�[js��g��B��ܸϡ�D����8�O[�Y���6�`�c��;��}S"IK��o���m��-�d%F�����F>�������m�Q�l��#0�N���`��WM��q) f$�r��w�D��fm��.IJ���,#����~��c'uv@�o�4ِ>��u�W�^�O�9+ ��W���l���67���a�̟��~'~�-�x��gʥ}�CZk�������6B7(�U��r�� M���u�������um8ZZ'*���"0�-��Aؙ"�e�%e��,SE� �����8��;�b�$�,gJ���`�HOM��*�j��n���Wê�����r�D�ۻ0� ܰ�����ld���x���� 8�ДR2qM��kL�[|ߩ�/�S���Y����������(eg}ŗ���q��l�z~*�U!,���˷fb�<�{A���)ey��2��➨h�����ɛ�����&�����;�X�Đ�vT��<!��ɱAJ��?N2��D��ݢ��_��+����y����w'��65ynwX䅨�sK��7fp�y�>������@rS��m1����oaځ�ie��q����/[# Q"'���[�+oSATK�Y�4�h��d~.<�+ ����ө���]�A�V�#�/��!��6�}a)T����}�c;6���O�Z�P�TO�k��k;�kv ��l�ó��nw���o���#�����TK�haV�������2�K;�bXE#*@�R 0fB�x6?ov��j��*����ݠ��d7t,ʛ�~0����wx��������'+~%ΰ���(�����2��3�a�D��ڷo�}�?���%�s])��>ӱYPٺ�Q��P�6�(�g�l(`Z{=�=K �L���]�4�$eM����Ʊm�"["'��F�ay@c����!H��'.��SkGr�ļ��?j��⼬��<u�},Z��(�8_ f�� �?���/=�I��P�3��r�WTFP�y �.��� ��wi72�_ɐ�}��`��4�H1�:���j��^���(�aҖ2W?zԻ�':�$-��u��mpM�E�.�������J� �Վ"�<�/�V��j�sȀצ�-����Rj���c���2�g2�p�^[#���~��A-�A�|��"���4���?���F� 輦 ��Ď� ���3`O��L�5� �R����*Vi�����L���Ӑ:�t�$1{��&��a�(Zm��DB�ÿ��s�=㯰a4e�T#jk�Ӱ=y�G2�?����^�*ԕ�����E9��ذ����d�Ѓ�?�s���g�������tr�q�(o�&�`y���l\�3a�2+�z�d<����:g~����#e.�S �ޠb��?�*��L�E��/C�#�߿����ٵK�F��g]Ec!�d�b>G\v� L(i���!��^ �wS�z7+q����t�^��H�R����s��iF�7�f���d>u����3v��Ȭ��������_ߛPa��؞��kՀ���qe,<C-��j���/��� ȕ�M��~U�\�8��<$�"�`�V�`P"� !����� ?涄Kb zRKy[r�%b�b�"�<o鱒i�bU�oBhb �rI����Nz�ˀ��ڢ�|�|2@ӊ�G�뤃�&�ND��K�ә����4uIWE���;��Ai@ ���@�@�����;�H�=��� tW�`���#(���=��Uz�}B�g�g;M���2���хN�#�U�tb?��!�%��.��/~��X��F�i�q��%��ɀ{7&B�j ��a����@ͱ�����]/Thb~蓖�s ���~�u;{�� ������������?�9
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ