Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    51s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2024, 00:43

General

  • Target

    352b1f3533ded8c575246d4466f68c49.exe

  • Size

    545KB

  • MD5

    352b1f3533ded8c575246d4466f68c49

  • SHA1

    e430730620feec3673b9c38d87482c9294421b19

  • SHA256

    b513cfbd101e728ec41c9d6f6515278434820466bfe8e4bc1849f2418d3f86da

  • SHA512

    db9ab4315417679f6d1003e97067e87aae7f1c2b9f5a8358e32004d8322a997fc5f1627c3535517ca515e9493e9edb7292f1d1c6080e19d8ea71419fd4c6e9c9

  • SSDEEP

    6144:GVnPzIGM2LsWO1LXmw42Upm5zc8VnPzIGM2LsWO1LXmw42Upm5zcZ:GVPzIGhAXBXLZgeVPzIGhAXBXLZgf

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note
contact balance of shadow universe Ryuk $password = '2neBqEej6'; $torlink = 'http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs

http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Ryuk family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\352b1f3533ded8c575246d4466f68c49.exe
    "C:\Users\Admin\AppData\Local\Temp\352b1f3533ded8c575246d4466f68c49.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Users\Admin\AppData\Local\Temp\AEbTqAtmirep.exe
      "C:\Users\Admin\AppData\Local\Temp\AEbTqAtmirep.exe" 9 REP
      2⤵
      • Executes dropped EXE
      PID:2028
    • C:\Users\Admin\AppData\Local\Temp\DufOCWVyXlan.exe
      "C:\Users\Admin\AppData\Local\Temp\DufOCWVyXlan.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      PID:2924
    • C:\Users\Admin\AppData\Local\Temp\OtPLkxOFKlan.exe
      "C:\Users\Admin\AppData\Local\Temp\OtPLkxOFKlan.exe" 8 LAN
      2⤵
        PID:2968
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\*" /grant Everyone:F /T /C /Q
        2⤵
        • Modifies file permissions
        PID:23912
      • C:\Windows\SysWOW64\icacls.exe
        icacls "D:\*" /grant Everyone:F /T /C /Q
        2⤵
        • Modifies file permissions
        PID:23920
      • C:\Windows\SysWOW64\icacls.exe
        icacls "F:\*" /grant Everyone:F /T /C /Q
        2⤵
        • Modifies file permissions
        PID:23936
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
        2⤵
          PID:35048
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "audioendpointbuilder" /y
            3⤵
              PID:35812
          • C:\Windows\SysWOW64\net.exe
            "C:\Windows\System32\net.exe" stop "samss" /y
            2⤵
              PID:35116
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "samss" /y
                3⤵
                  PID:35804
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
                2⤵
                  PID:34972
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                    3⤵
                      PID:35748
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" stop "samss" /y
                    2⤵
                      PID:35716
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop "samss" /y
                        3⤵
                          PID:34820

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.RYK

                      Filesize

                      4.5MB

                      MD5

                      4e3656f11584d67bae0bc23efe945017

                      SHA1

                      a5888986844a1d440f9cda013adeb2e382f20d25

                      SHA256

                      a7a8f1d55636ab041450bee79724307fb07e3339351e6e676d9553b43f19a907

                      SHA512

                      1369722be6448eedcc4ec944e3f62a519354485da097078ed71962bd28634ae8813585597ef677f95006239b9e253e0d87884545181d2efbb6a3132e3705d487

                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.RYK

                      Filesize

                      2.9MB

                      MD5

                      67bb1723c43ba2d438a62236b39383e3

                      SHA1

                      792a6504311218b092f01b81810d8a60edc53539

                      SHA256

                      3ed0660e11a025efad979c5ed746b5fe12f744e35212cccf0728b83ec453b61e

                      SHA512

                      8a88a0ed08898c018e840ebde24b441c199b556264774ad4d6c7b91dcbf67e9cd36cb2e71402c5739c7939b056f8d0abebf107f52444646ed3ae5c40e3fe79da

                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.RYK

                      Filesize

                      4KB

                      MD5

                      9d5d5a1959e77c1cd2be66bc204af8fe

                      SHA1

                      37b5ac067bf287e3bf7f049c896ae9f459cf26a1

                      SHA256

                      b1a3d7ff56bf180a42fdd3d3674ad0df42fbb8c9b90fd1063bb94109c1bd6256

                      SHA512

                      6fd12530916e7957da061382ee34bfe75fa28b04c87d858dfbb48f87277e8e860b95985d2a81576dd93bbcbbac9e3266f465e544f773fb711b2804150cde1aa4

                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.RYK

                      Filesize

                      4.2MB

                      MD5

                      ad28d77d479ebedfd185a7e98f877852

                      SHA1

                      acb77894f0df99b8ed3c4f905fa8b0e29712322f

                      SHA256

                      6a91ce794a739314b0dc35ca30989a68d1dbec6255f8df376259802bd10eb2a6

                      SHA512

                      ec103d0358db16758160de1c470a7fb95a9b389bf70fb04343eb2c8bc88695b53e4ee835e1e40e8328be481e1bb74d97afa3052ebc82397663609ce0a456e89a

                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.RYK

                      Filesize

                      17KB

                      MD5

                      0836f3e189f12a7098d5840804beb899

                      SHA1

                      6baac3ca86b4ef7e14f8337a1763eab7529c37cc

                      SHA256

                      3ab19545b6585a168634506424fb4649086a6076f66ffd2f1b3c8331299353b1

                      SHA512

                      bcf56fc220c00dd4e33bdd0a881a49e45c6c856256cbb04fbee02d883d3454b5cc86d5cbf44b1623b1b6462a5dd671d0a2861bb5e6f9762094fea228b5012fe4

                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Setup.xml.RYK

                      Filesize

                      31KB

                      MD5

                      effedee663e59b2b808f7cab5131cacd

                      SHA1

                      92f35d2b419c8aa086e923fc34783524a1273107

                      SHA256

                      d64494ed166924f7884e6d1ff273ffc27ebe26b6d1dedfb8711b352b058f1cf3

                      SHA512

                      69a7bfc7e77b886f82b91df58f81782b3c13d5dbb44fa82223e8ac5d248b0aadb50096447ea2debf7b399aab1673edeca2d7edec9bdd5cee03c7689dedc9137b

                    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.RYK

                      Filesize

                      699KB

                      MD5

                      61c483c4bb17c957f1e53be34c4d9c6f

                      SHA1

                      c3121909b4cf65382b6db60b0dccc24246cc2110

                      SHA256

                      bcd3083279f733455a8e95942fbde35ee0977013d2f0e8af97266d88d59e7ce9

                      SHA512

                      32503d4c3d801eea4d5ab758cbca3dec083bb32bacab57158f638d3722cf13f0d4d2f587f8cdd9e823eb50d741d5490a325e49aca63183827c52f96c4a235d0b

                    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab

                      Filesize

                      4.3MB

                      MD5

                      d207fed04991c58b6c8f2bb8f13344c6

                      SHA1

                      26c0e71ff16529c1680511a18e8f76e58fb63908

                      SHA256

                      080780ef44763302c589d46d82d9d242cdbf5e5bb2b6360efa0fd736bbc49add

                      SHA512

                      40fae51ed5f096b11b56b3013a436c7c54bd5e9c11587055ae30de78ab2c34339c2f30a131568a952f49d524cd266b639befa89b5ffc0c98d44d24edd05173d4

                    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.RYK

                      Filesize

                      1.7MB

                      MD5

                      40d771aafa5ac4978fb7892796d0597b

                      SHA1

                      8fb007032eb62016cbdcd1d39ca524b158bc811d

                      SHA256

                      582c808e0c02677044c3e67b4ddb6fe9d7735dfaa97ec79b1134c51009a8b1f1

                      SHA512

                      8f635848546d0d2ffd7d3080c6374a2c39076bc1216702e0c4733d1c12e07ce10fe287080f1d71c583323e351606a2c88c1675055d7e7fd85b13753240a949e4

                    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml.RYK

                      Filesize

                      1KB

                      MD5

                      2b158990d0592ec197d39f9c64988684

                      SHA1

                      6d44e80796a55ff7b7945327149af8ca8d98a9fb

                      SHA256

                      849b44ce412b76ba2be2337df87f38ced976f38e5309fcb7691b00019718ac6e

                      SHA512

                      c251fb5c20648168034499d4f3565a7463d9af8a059debf3ec194309a7e909af1a335cbfe3d0874fa6b4238d8d29bf4adb8da470c56f5945d233c6c500b20ffb

                    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

                      Filesize

                      2KB

                      MD5

                      df76fa473d381a362810e7d2236d96ce

                      SHA1

                      661764b7c90ebb2de202777bfefb5c07c92e2950

                      SHA256

                      c00c5e0c673075bd3c22e3f4b5fb0d358f15c858d2420c222434ac4e3f4625ab

                      SHA512

                      b5c542cecdd3d1d6bbb943dce397a94897529859287bbf86869159ba203d70ed5e7c5fb2c19d02af262e3c5f6a4ed3a84f13be93e732f1424ab3e61cd3bdf267

                    • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.RYK

                      Filesize

                      1.7MB

                      MD5

                      22b85d217f73f041a6afbe4ad01db1e7

                      SHA1

                      34393edfe291847043984ad5a6d8dbc568e8ab46

                      SHA256

                      13c1cb89cc2775026911ceeaa87b83fab49e7c925d3e69c18f6c7d01b5b02061

                      SHA512

                      45acbfc70a450ebb894c3d62e189000eeee818db62a3afa042820409c92e41c935f12b3eb97b731361c8f14ea3e00f23123f5c90b00cd165073a71e88a6a0454

                    • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml.RYK

                      Filesize

                      1KB

                      MD5

                      947c3e30d3d428a592b0590a9f2457a6

                      SHA1

                      64d2925fa9f23738741b012f25f9f93b7b288b20

                      SHA256

                      5298a858a7a19911a0d1bd8b534951498be30c607da0e3bc63f5be9b644fb765

                      SHA512

                      ca817bd8a09a94b9b67a729056bb072a08645a791728a98acfc37c21a5758ec63dc5be0710cc8c73f0ca0845f572dd2e64d9d5c7e64d1b25729e034b8b79b9c4

                    • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

                      Filesize

                      2KB

                      MD5

                      bd4e1e0c51370f96f0a53f14bac31e9b

                      SHA1

                      3b4ff09905c521147983318babb9d3f85c839cb6

                      SHA256

                      4e32087a6d41fafa762e4a1ba6f5924c3a524b06d5ce01237c8e3d807670872e

                      SHA512

                      847004b7c00bd382a89b8d996dc5604fd750d026a317bc461360a38dca88fb5cb9e397ac1359b3a168fe3b87af21b9eb0f40cae03ee4fadcf0580b7f5c01472a

                    • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab

                      Filesize

                      4.2MB

                      MD5

                      d06c9342a3ceb44cbb63f3fff0113b35

                      SHA1

                      6c23a8a42b2f979bcb5ea51f8aa317eaf28355a8

                      SHA256

                      8129dbddac5d68ba1fabb1c96d54190c9d9e0405fe664a7fe15540d08ac4aa11

                      SHA512

                      b0f667427a999bc79679b251c62c2b74df837d85a6a1ce3a9c444ed50fb0a8abda497858cf917a9122f212f66992a2a6ee48b0802be8403c437cbeb82caf9daa

                    • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi

                      Filesize

                      1.7MB

                      MD5

                      d361bd8ee1faf03058f0809701ea2e25

                      SHA1

                      6e777c6fa3cdf4c79161df2afee68327dd2dd928

                      SHA256

                      c447bcce39078396b3e976e12fc1b3a1f950f6c59102d5ef806a0341433667e0

                      SHA512

                      76f3c883172f109a0f353a5d274021cb6ffdb277d8a1fa6b75af530a850ef554711b16f01e7efb8f4718dfa9561ee1ea1a16dd10092f278587aaecf4dd592708

                    • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

                      Filesize

                      1KB

                      MD5

                      7267680d3e31991a88db4b82f930226d

                      SHA1

                      19619296c48019e24dc752b054b35744ebfe73b8

                      SHA256

                      df7ca84a88b685ad8d354beb4a7371ebf5f716c0e4ba39507080e94f8b272737

                      SHA512

                      0b26c41fcc45c7b4e57d0923656f3c58869679518129a2b6e7b6a85410480151f6814213f90c45286e25a7d455e892ae1b6b3e2e32006d6e3331c7c546998225

                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.RYK

                      Filesize

                      4.7MB

                      MD5

                      7c6dd935dae25b696815962bf2ed0cca

                      SHA1

                      e166ea57deb950245b18904323ff7e6581162b1d

                      SHA256

                      8f5ee0300ec43bc1c75c5998b367ed3c3b49e198aa6638649d8d6d83e8116f97

                      SHA512

                      c4651681e1bbff380f95b6d4c22bb955afafea23325c07058fb18a58d0502c511f4fbe05673b31de7aedf32574a8f755e95ad0b183725cc86a117743028ed7eb

                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi.RYK

                      Filesize

                      2.0MB

                      MD5

                      47411578094ba99bfd1d5f70773d63c8

                      SHA1

                      c07027d22644e0ffc656da6371b4d2d1adf2bd6c

                      SHA256

                      a74d62fc100f2075f370ed50c42271e689f1a576beeeb61a2becdf6c14b74649

                      SHA512

                      cfa99741aedf9ac9e0a27e672dfa64c01f448594fed99dd258b25bf035fd493fd498af45868c6a1d4c9c96a29efc162f7a5e77c18ad56eab7163015673193dd9

                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml.RYK

                      Filesize

                      3KB

                      MD5

                      3854a5aed9a4ac49bbf1b6e08f58dd60

                      SHA1

                      3f9291a9baee6430299d4c8d70495c66a4fd15d5

                      SHA256

                      8beb1cc764cb98c5f8a9b13f43ff59c6674a74e59e222207c6a47fbfab9d7431

                      SHA512

                      8098392ab737866924cc8a3797f20c0a5feb612ece5e7746315b35648361032ba7bba44342b4df0ad2dc42dd586bb0a22893c4d157c3025b866c749c5fd26047

                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

                      Filesize

                      4KB

                      MD5

                      53ed2eddbe6eda50c7651f70810623cb

                      SHA1

                      01b4ae2ca68a73c22f2730dfe6f3db2e8c04dd4d

                      SHA256

                      3fae4dd2262725ca654cec89e29153b6ee2855d29c86c1adfebfc900c3738b56

                      SHA512

                      dbfea2a676cb0c1a3a26dd00d98e0180bca77baa9625e137f315da2297f2a18e99e40304958bdd277a90663d2baae26e2bef39a8b0412d008bba9da25d8e12bd

                    • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

                      Filesize

                      2KB

                      MD5

                      88c52fdb52f7ddcb8d87421b3db72835

                      SHA1

                      dca39c99e0431b1a71fecb679ccc4bfbf8b11564

                      SHA256

                      d8e1dea8d8bcf96b802c85cf81ceeb1ce880c8801f98b1c616956d3e9bd5ecbc

                      SHA512

                      e11e7581f617cd18690a50640e913f9cdd44056fdf42be51ffd7cad241a83482b07a3799d260a6606c52d01d11f4cb93cdba687946c28e3956ca5155236180af

                    • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab

                      Filesize

                      4.6MB

                      MD5

                      c8a800ff0b4d3cf80a158c75518fd51e

                      SHA1

                      a3002a43af5cc54879c56bb681ddaa84a6e5c505

                      SHA256

                      dd87ad2f4b03daf6ae3e3f7e5e53c469fc3e683d27f35dc149654ea8f3bffce8

                      SHA512

                      ebd56810d2a1282f205d24995e070a2ff9c8a70f5a94410f17a0617d92be9539e082669df75aa75650c624a460e1527f185760971bf79ebe95ac5b8432874b43

                    • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.RYK

                      Filesize

                      1.7MB

                      MD5

                      662c095c7707362e83a8a2c9ef5b5fc1

                      SHA1

                      9d4235399ccab90ed8f29fd35e2dba3b5b8fd4cb

                      SHA256

                      dab181562dd46e0012aadd1d7280b3f73e03b751e2312eb9ded00aa3054a4615

                      SHA512

                      0b1ca865ebdb6e8431040c50f37c7a5cecf5e58f7670261b9852f55cfd8af32017c2b6118b732cbe95f768be19fb7983aa94bc1222529cdf73d30293752bd8a0

                    • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml.RYK

                      Filesize

                      2KB

                      MD5

                      f8681e22e762cef1e86cbc3c5d96a890

                      SHA1

                      900219de9a8fbba768083ecc540d03db76c4de9a

                      SHA256

                      ae90cbcca9ba9c402d39bf5095934a2c60e42761af074fdf44290ba55179d6f2

                      SHA512

                      028317c9229180d4242b441e2b093d3b94101aa6ad225aa1c89c8eb21b0e6d09164120b3b4f374a8c266c47136a4465144cbaabfee9617a75a9e1612ee2cb85e

                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi

                      Filesize

                      641KB

                      MD5

                      228a704eb59489f3209c28b4ea826574

                      SHA1

                      d6d815173301f71ce25a46f4ede1a758243b5267

                      SHA256

                      25c4d84978f42b462fcaaca800e41393ccd4c69169ba4d75b97f18675ca73c13

                      SHA512

                      13b9da82c04d9d966728236bdbe13bbf3a7310c11a40beb912d66219e4f996e09af849aaf75b73ac168ec73ed6056f0387b454e144c291f00a18ec94d1aede99

                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml.RYK

                      Filesize

                      1KB

                      MD5

                      5511034660d30aa30232618c9698028f

                      SHA1

                      dfcd3b3669392383022ae44ba97832634d23a189

                      SHA256

                      80a0e8b073d58f3bca9beac7ce1ddcfaa7a4ca2ec858142422b9ddc288ab0337

                      SHA512

                      cbaa3455e0f6717057bab8459d4cd2427160850a12de5e347f3644e5ebe759f2dbdaee8fd385c753316da862736c3fddb8de77092f3972b57c31e40c1c63967f

                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.RYK

                      Filesize

                      3.9MB

                      MD5

                      3b2369d41c8c4791d323fd04af8d2cc7

                      SHA1

                      ebe3ef14bfaf199d8f8f9dec711b14d80873fc21

                      SHA256

                      68d392252eba3866159a39681d3b82c32e29809c24b0821a2ae9d7b7c3f4669b

                      SHA512

                      20c979869eca014b4bd4fa3ab0ba6fe0080f7ec3125c2517a1f80ecedf79452b9a7f9d051ba5bec6f45904e8063355cff0d036cca66807062bc14a9ce3523391

                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi.RYK

                      Filesize

                      647KB

                      MD5

                      2f14e2dd0b89af1fdb4aa56682405b5c

                      SHA1

                      a9af91a9362adea45e719eb616fac9268aa76558

                      SHA256

                      cac204893a89d317728624430ba9e66de77340b1e22ce9bb39a991fda76d6116

                      SHA512

                      50a55c25199b0953974145ec82fb66f918ef46344bf96ac45f544ccade812df01bcdd3bd00fcac616408356e410213bace36b4813fc856ac080ed4a50ee9ef3c

                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml.RYK

                      Filesize

                      1KB

                      MD5

                      311a1469aac05b814cef8115ba6986c5

                      SHA1

                      403c3515b85b34f019e023ed3efec4db7b5c05ab

                      SHA256

                      0dbdca216b1e82dd1bbf437f946e49236f55f13d7fe280cb4e2d1162c76cf69f

                      SHA512

                      ca02f956b5c3bab081d42e772befd36540d26f6bbfb70475ba70df85c8993fb30a3faff6d6882d071118844445e4cba66f91244317cd8a7df8586210d9213247

                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab

                      Filesize

                      4.4MB

                      MD5

                      6fa07b661865d62c1e80c4c0bb922062

                      SHA1

                      dfea7c0e7f419f5b47a8e581a71ed68904a9b4d0

                      SHA256

                      3745d6c846cb7ac41c8deaab7f0b43e758106188b84e48649d60ce60390ffdde

                      SHA512

                      cbb99b3423d5d054acaa3ac71e567da827215bd6b4021049bd54b141caade1f724fdfd7ba0413dfb709d67453e1adacd34f84716e2b714f09f201323e6268796

                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi.RYK

                      Filesize

                      652KB

                      MD5

                      1476f08b12d186937baf2a4625831859

                      SHA1

                      3d899e450f4f7c4f3d1627eb4d3fe01f297ce1b5

                      SHA256

                      1eebcf500e09f9c7ea6a3be0814beef3f19d802d78132494ae2073a2a8d1fcbf

                      SHA512

                      c5efca9dc2b1ed3c9a99d25d3107809833bc46b65652d90b57940fdd0a59637a87208c6a081489d5c6217bc03619fb01a7b5183d3aca039870c3187740b17ff8

                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml.RYK

                      Filesize

                      1KB

                      MD5

                      6515bf4e63e095a89685a4d843102474

                      SHA1

                      afd83c44615e44e3271d14da6bbaffed434743fb

                      SHA256

                      1521d5df6b2441125f03144ca423f575da31d27e4ca8e3c5de0e35fa04b6e3a0

                      SHA512

                      fba1938d41b9cd30468128b62d860364019da29bea0ae98540cb21464f42d2ebc44eac3628151e3d502e0753d0f7544fc7c1a02b797af7482de8f1553d7845ee

                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi.RYK

                      Filesize

                      635KB

                      MD5

                      ff000ae08a31ea53e2ccd0f15910f42d

                      SHA1

                      e6d132f904b24f21219cb85d7565ba31b57e8022

                      SHA256

                      7d02dece9b33713fd906f730da88b46c9152ab65a8296bc59a8e7438121327f6

                      SHA512

                      7b684f2df3480a931a2b24119dadfd0021f6177d7b1fcdef31eba87640ed122d0dc3e3e430af64a32bd4e5526f25f6a6a32702bdbdcb32e490d9aceacebbe5c5

                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml.RYK

                      Filesize

                      1KB

                      MD5

                      d82ab77778a10a75f916b75ef696e168

                      SHA1

                      2c6d513b049c75c4ff0f5ae06b3989a9f4647c53

                      SHA256

                      ec8026f43836788204b8687d62557d469ed3127c87073fdbedcd8f5420ede9b8

                      SHA512

                      c75bbb6e0cd8c8acf84aa8ad2a961f53e455648d38d96aea73e5382a1ea06866151430d6b4da44a01c17aeef29674438c616b4c040150bbda632b350f64ebb73

                    • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

                      Filesize

                      6KB

                      MD5

                      442c5ef3be34bbe617e79440f9e3f7da

                      SHA1

                      7c9584d4ff072e321a6b95ee936daeb3c370943b

                      SHA256

                      4bd58953f45b2bd87f0acb3c9af3540ec6ad17e93eff117dbec29f89a1049f95

                      SHA512

                      2da9fe69a1f605316459447b10b32376ee146972866f49e37c861da05692c26f076f80b2b9dbc6c3231feb1bb85642a88443f5208a4646be62ba913e03690082

                    • C:\users\Public\RyukReadMe.html

                      Filesize

                      1KB

                      MD5

                      ec045fdae3dae1842abdb56beab2c896

                      SHA1

                      e29c48f8dbf1b5fe202afda1af9ccc0a676ca614

                      SHA256

                      5338e35c0f70a220c4627bc8917c562014db2b537c2b5fe2817a7595a7caa92f

                      SHA512

                      40e19f1bc6d62f8c5165ef881250be8167d4110a49d129e09b2670893f335ca5faf122f0da82259738d50ae9060614c91781bce3b3a3a18645671aee789d7165

                    • \Users\Admin\AppData\Local\Temp\AEbTqAtmirep.exe

                      Filesize

                      545KB

                      MD5

                      352b1f3533ded8c575246d4466f68c49

                      SHA1

                      e430730620feec3673b9c38d87482c9294421b19

                      SHA256

                      b513cfbd101e728ec41c9d6f6515278434820466bfe8e4bc1849f2418d3f86da

                      SHA512

                      db9ab4315417679f6d1003e97067e87aae7f1c2b9f5a8358e32004d8322a997fc5f1627c3535517ca515e9493e9edb7292f1d1c6080e19d8ea71419fd4c6e9c9

                    • memory/2028-50-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2028-46-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2028-14219-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2028-10967-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2028-8721-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2028-172-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2028-19-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2028-5942-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2028-3098-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2028-32-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2028-702-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2356-8720-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2356-5-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2356-49-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2356-15153-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2356-8-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2356-4-0x0000000000270000-0x0000000000370000-memory.dmp

                      Filesize

                      1024KB

                    • memory/2356-672-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2356-3-0x0000000035000000-0x0000000035029000-memory.dmp

                      Filesize

                      164KB

                    • memory/2356-2-0x0000000000020000-0x000000000003F000-memory.dmp

                      Filesize

                      124KB

                    • memory/2356-2878-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2356-10966-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2356-171-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2356-5897-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2356-31-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2356-1-0x0000000000270000-0x0000000000370000-memory.dmp

                      Filesize

                      1024KB

                    • memory/2924-34-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2924-12757-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2924-53-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2924-14755-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2968-3103-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2968-752-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2968-51-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB

                    • memory/2968-15175-0x0000000035000000-0x00000000376DF000-memory.dmp

                      Filesize

                      38.9MB