Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_7b1728945b3de455e5f526f007449d77_ryuk.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-06-11_7b1728945b3de455e5f526f007449d77_ryuk.exe
Resource
win10v2004-20240508-en
Target
2024-06-11_7b1728945b3de455e5f526f007449d77_ryuk
Size
5.1MB
MD5
7b1728945b3de455e5f526f007449d77
SHA1
c97665d8d5cdf2fd5493f323ac6fb4df395b1358
SHA256
b3fb21d528883508bd1e1264bbca4a04ec8d9ad5b43863f7ec2fb942c70475c9
SHA512
c1cc004485d1ad7796b4ecb2cb614c4f736468e9202231cb5b4617a714120530490215b6e43550f49fa8ced6ac45ce9ff014c881f7ece90981f2f9bbf45a9d47
SSDEEP
98304:feRnY+D6p3Sqxawp0otQNgJGDrRNcFBS+RFGeUy3EolES:2BGp3Zxp3aDFNcF7RFmYEo6S
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
D:\WKSPC\4.6Fix\sourceCode\build\WindowsStandaloneSupport\Variations\win64_nondevelopment_il2cpp\WindowsPlayer_x64_Master.pdb
UnityMain
FindNextFileW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
WTSSendMessageW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
4��Q�Y�=��K�~�%�W� %�amq������6��vAsZ�*��S����G�,[�K F��ʽ�Q�4>�1>U��~�:݉����Ö��vP�2V������ *�62|.��X/ �����v���/�^��0&��y��<;���%�J`i�V)�E�@gN\�f�7�\M�ʉ�w�?:�a���c2��$E��H[ ��Ж���C�����C�M���> �;��O{���v��j;��I�W� U�F1�4� t��ҾdF<ސ�1�}�rE�)K-ù���X��x��]��~jn ��8I\��ٿ��Îv1�q\��i�¸]l�/�`ST���6�JS�0��h�@ĔC�=FJS��_����dR{� ���S�8�;�G;�Ym�`D�\n��9������ʟ���5��5����r�Y���2���748�ń�N���/ ��f���!l�*�ߜ�y��qt�C��I�ھ�3��r�5���d��}���[�2�^�0�|m�����E��[��]W���3�{%�v��� n��A���M�ڀ�� W�E�t���v{O������*��F��h."o oeHǽ��b��;Clf���J!��K��U�^XXs 9����+a��[��D�=�&� ͺ��g9 i9j��p;�9��j�@*��E〯�RreD�����{O����z��F���ՙ�w������^�u~� �P����]"�CM(ص�I��ixa��01,�9PM���JR��:F�"��p�i$�E�cyw?S~��o����4�+�{��E](��t���ݴ��?��2�Tp{J�t�� M�/����M�q��M~���B��+�@�ځ#�\���ho̝��X�D� ;�_��'c*0j���'��\��+VB^��E`�� 8���X,�o)��� PKJ ���P���&���Y�9p�Yj�����U�8�{�`����9::A1ֵ�A�s�d��\? \i�È�0�dX�0gRB��^D���^4�-���J�/�M~Q�Z��}M&9�y�8�E�늖�ZoC� V�VmXp��ܬ�G � ���/���2�}Ѫ���3���&�,fx�A�`i��E��.�=�%^�035q��.�^ޟ�4��k����� ��@��G��Sz�U?��>����=qz����A_�B�p�T��̳4��L��1|�Ǻ�?si�s�sׇ�������k{�l#���=���_� ��_7�Q��JC�|h�<���X��ȷ���M&4��$��r �{M~^oJ������2� d�:�tO|D�Y�Yb�%t咽խVuH��H�F�B��6���OP"0��Ԓw�ڇы�N��!�?) O�Ѝur�c�_����6^"5�q�a��^7�ڶ��zLK"ɓ������J|�[��u�/Kvn�2ra���'�q}h]���_'u츲��=L]�q=00V�����hS��H�E������ff;��vT�������|M_� U��{j j�fV1��<6�eQ���Z��'�^c���|AƑ��Ԛ�ȸG��4qy~/�ş�(!6I_��G}�?�'o��� {��0��z��b]X�:�ګ!��ƕܨD���C���#RW�����o����OS\Ӂ%���I� ��:�Z��(��L^�g���)U�i:�5��2'#r�j�gn�n����!��|99�L��ِEM��#�h��=D =[9�0��ؠ�X��+g�l�Y���Um�J@T���k�S�6J��� ���Q ����M��}������)�3�*�]�<8��m$dvu�+�*��BQ�b�����&�����Vݦ~'�vL���5��d,L�T0^:�f�|���x�KZ� �I���F"�`]*- Tn�F��v�5����opM���u�Mp�� ve���ӻ�7�s�1�B�zG_���V8��7� ����8ދj ��D>�k��Z7�V�`�����Oq�.� 5�Y����:23��6D0|,�cD�!e��'����k���x3eI¦��~�aS��k�qHT��Ahf�K����0��)P�)�7v涨�Z`'4᭛�,�P������;b�p��ٙ�w�'4~��O���zd+A-�i��&F/��Ȃ�{��^a��?�7��H$RY���e�g3�+<����`)Ԅi��@9�cҟ�� A-����a�Xv� ��d�^�>c�a{4Η ���v��z�im���,r ��=(�87�����%`&��j��^7��bRm��@[n�h�f���>�z�*�}�8��V���9��q�KdT²�亼_l�K�(m����2���>�]�#_�gM�0���c��(�8굤6��Q�.�c���.d<�`G���^�)��:=]y�>?6���&"�Tpd��E9�q�b�J�F�}h�e-4�ۀ̐z��Lڌ�������L�_�}���~����{��͆�1В%����9��6�PF�fx)D{�'�a���v }AO������v�-}��21wA%6�`���3���7f�������)���A�[��u�����G��>�m~.A����߆��rI��T|Qۂ���l��>`L����DN�|�tva� W�~��7�c;8<i�ȱ������@��t�9�V�Ԣɝ��BW�0�OK�Pm����R�χ��a]�߾�K��XL�����+"J��ޞ�oD��f��T�9;�E��!0{� [�zh�D�)`U�*ͦ�d��J��Y�Pv�>5�Jgo���z,�Եx)s�d��%��N�����+�I��D�;��یu�V�� x` ����c�31�x�Q��߬���/ OQ��z1L0�@��1������c� ��1�S���~ ε�b��*��n�P� �Wkʜ�ޥ`��"���UH��Ԛ�1� lu�S��[*ё�b���p V�����wݛ���+���� |����|j�����P���д��%�� ]z˞�/��l�c,�j�����n����G>h��E����AOr> BjO6����� �
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ