Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-11_43c88fd7a6363a7cec63d9b6a7356370_ryuk.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-11_43c88fd7a6363a7cec63d9b6a7356370_ryuk.exe
Resource
win10v2004-20240226-en
Target
2024-04-11_43c88fd7a6363a7cec63d9b6a7356370_ryuk
Size
7.9MB
MD5
43c88fd7a6363a7cec63d9b6a7356370
SHA1
575a8ed7f3187447a1038a0442b8de47b1b104c7
SHA256
bb6298bcc1b3bb13ef91b2ad41b3813719904670b3899a826d0a2599c643e75a
SHA512
02f0fb09924c3a99d49d27292826b2eba8bbc1fffdf14fd81d155e573ce2a3eb8221d8533f35f1df14c2537185bb43a1c93229b3307943cb492275e923677c42
SSDEEP
196608:CWZssELJ7ujlRu+/0PhWFStJPDo6DzNpiRVxK65W:hZYJvtKCIRVlo
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
D:\WKSPC\4.5Hotfix\sourceCode\build\WindowsStandaloneSupport\Variations\win64_nondevelopment_il2cpp\WindowsPlayer_x64_Master.pdb
UnityMain
FindNextFileW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
WTSSendMessageW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
�0}�O�M�N< ��#g�|΅l�,��ӣ��&�}:�rV$i�a4�M�2N�s��*c���?�`13:j�� �NB0.[��/tdzTJ�y���BWs�~b�1CqT�pdd@L �v�a�d��(�%������wrۋ �ƼQ�sH����#�ͧL�bT������e�仐K^�>�����G3:��.O����a�iGj�"��˾x���+ �o:�<)�Ԑ �0�n��!J����;�� !���]�|�{Y��V�US�Pʜ�4�w$K��\��� g����n+�7tѾ]���Sm�,.��`���g~�PW0)���qo�����W��%쭻��O��&"�R����{�f/���ك��1s]���~,�� ^�|_v,$�'9G�������U Ms�����)m��/�0<���Rk=�x�& Y�۟P�����w�B2��%��Ф�{pV�`R����|��%SŜTdp"����H�wUO�Շ�u��ݰ(�yTq����&c����#��7��\�}�< ��^h��1V���J�� ��23y��������ǂm���7�:�g��8!{��Z��Ţ"�fCs�R[��j\�$2p�����L����{:~�m���w�r-ߊi���AA����Q!&%l�ޓ�9KY�~q0�f�$8��`���9� ed���c2\���'R~�b���㹮h�Dޅ-�$-�i�R�">�w� ������~�\�G����gs�lu��A>k��#L}���<���v1K0��8pN���M��W�!K�+��ڛE��*@���P��]=�l�أU��T<Յit�谩��ql���VФ]Ym���f6]��M�_�ؗ>�G�ĄC��l����S�pЗ���>�� ��'T}M$%N^)-,����וo�����%Ir(�2��o���'��R3,�5�Иo5�k�z�E�8J3g�+�瘣���`w�4�0?���ے&;l*���kDjB|Tt��m7yL�f��(�;�t��}4k���Omc��x�ݓ��Q��� e��T��d����-��u��b�{�#W��R�>��P�|�� ��{��fX-�4f�bT)Wʒ��ޝu;+�_0���c�?�8���w_�g�H�Y��Y��\�V6�G�f�ʣ3�`�5�S5��|�-�n3�߃��Bg4I�ks�7�� ��}t��de%#l�J�,6Jϟ�&o�S��_ƀ���Ŕ��+�ل?��p�#��fa���M�6�us�2bt�Y��a �fq���-PS�؟�u�)o�1z9����.��m�'�����6����yT�Q\" RT㼋w�%�f��O�~��m`�C��R�S�������՛�Y��h��,��d��3)�������箫[�M�Z�/�EF�����c��ѱ�^��/j(��r�� ��N�_lj��s�����x�we�� � �����~���M�tpD�Pu�����xμ*�%�(�ӚF5��N�!�z�7�|��t� -�g�Cb���zL����j?�b>����N�*���(�W��~T"������S�(�v^��A��J�dDz��٭�W��ơ�b�H����$��} =yk�Y�"�-'�Ƅ�"�Y�A�N��a�u�k��oj�� $�� ����'��_]_��0�ɜP������^g��|��uVPsT��O�'z�=r���FcH�t��"e�VE��rX��*��uv� ��)�0`2Yx�ß�/� ������';̸�{���#AR������1J���e�t�)&�3�➺N��AL��� '��-R���w���>��*�r*���I�l:�&I(^#� Bw�G���?�!�?��t �)�8ffrk���?i���]Q�J���\�QOH���$�:B6�/\�qDZ*4�<��bk��=����#�0k,��7�r��w0�3ߵ��mn�('Z+U.���m��Jv �cY�� �ete���sk�jZ� +���K:P����#)(B��t�����$�K��)^���*� _���/�UV�`R�%�`���j+�j$��I�����D���Msd��=�r�K����C�ԧ#���W�G-�w+�k;k�.��i������/fGnJ�z@ɮ��?�rOt A� bu�x�v�����g�N��ys@^0M����=��e�K=7:xWM��>�x�K*߅:��>k|gf+�\1pf^�ği|���0y���-��Sf�e�!�B���l2��f�e�k�gC�Az�Oz�ϙ��0�H�}���|0oZ�����0�;(d��_W�}vt~µ�����,���ڷ�}s"G앆�� ��.]=yz"�����O,�����x��m�_�9�n�`��c�E�鼯 �%t��q��_$Tb�Ą �*���/�8�.uP7���֎+���>��e�)�Ŷ�ap���ۨ,5/2������^�C&�{����R��e��'b7ށn�Yܴȯm��}������DGw�*�� �[X�0|����mz��o��Q}�Y���M��@�e!-����M�(�@/�1s�o�"���u�M ��hWr�'n��i�4]�2��Q�������Ŷ,ܙ��2 k������E��S�*)B;h%����!$��GM+DD�~���K��F����l ܦt�H�����'J��A����]��|�+a؞nj�(��ӆ�<��ª���C����eM�dœn�����Ye��Bzm�h�g������M#-?R���走�s��۶u=����8�F�/���QN��%��?ra���q�y"ãy�f]vz��a�H5>ݑ�R���+����$�������dQ `��qGYb� ��.S�K�l�{2���Ӯ�����] ���+~�!�팢����R��odZ P���}�$�����e�}S-��:�6�MO�E�߆��)Ue��zY����7���]Ȫ1`�� ���Os�"H?>�O��[x�^+������k�o��|-?�̧̇��-�y�L����UiM!FZ��qq��df�����[O ��s�SWM�VY��:L�N���X{Sɛ��������ꄸ~ W:.��3
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ