Malware Analysis Report

2024-08-06 09:25

Sample ID 230912-jda6esea81
Target Sample_5d283d656ea1e5165f2c7b8c.exe
SHA256 c85fec6ed44bdfd54c5f37190ffad38919640064ce718045e228dca65f74ec7b
Tags
ryuk ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c85fec6ed44bdfd54c5f37190ffad38919640064ce718045e228dca65f74ec7b

Threat Level: Known bad

The file Sample_5d283d656ea1e5165f2c7b8c.exe was found to be: Known bad.

Malicious Activity Summary

ryuk ransomware

Ryuk

Checks computer location settings

Enumerates physical storage devices

Unsigned PE

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2023-09-12 07:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-12 07:32

Reported

2023-09-12 07:54

Platform

win7-20230831-en

Max time kernel

34s

Max time network

121s

Command Line

"C:\Windows\system32\Dwm.exe"

Signatures

Ryuk

ransomware ryuk

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
N/A N/A C:\Windows\system32\taskhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\taskhost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1728 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 1728 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 1728 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 1728 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\system32\taskhost.exe
PID 1728 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 1728 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 1728 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 2324 wrote to memory of 2596 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2324 wrote to memory of 2596 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2324 wrote to memory of 2596 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2688 wrote to memory of 2064 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2688 wrote to memory of 2064 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2688 wrote to memory of 2064 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 1728 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\system32\Dwm.exe
PID 1268 wrote to memory of 2528 N/A C:\Windows\system32\taskhost.exe C:\Windows\System32\net.exe
PID 1268 wrote to memory of 2528 N/A C:\Windows\system32\taskhost.exe C:\Windows\System32\net.exe
PID 1268 wrote to memory of 2528 N/A C:\Windows\system32\taskhost.exe C:\Windows\System32\net.exe
PID 2528 wrote to memory of 3060 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2528 wrote to memory of 3060 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2528 wrote to memory of 3060 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 1728 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 1728 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 1728 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 2808 wrote to memory of 1564 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2808 wrote to memory of 1564 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2808 wrote to memory of 1564 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe

Processes

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe

"C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe"

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

Network

N/A

Files

memory/1268-0-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-2-0x000000013F510000-0x000000013F7EA000-memory.dmp

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_f8462d6b-7d99-409c-b6aa-08f77c38ad4f

MD5 93a5aadeec082ffc1bca5aa27af70f52
SHA1 47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256 a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512 df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

memory/1268-8-0x000000013F510000-0x000000013F7EA000-memory.dmp

F:\$RECYCLE.BIN\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

memory/1268-22-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-27-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-34-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-48-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-35-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-59-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-61-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-55-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-64-0x000000013F510000-0x000000013F7EA000-memory.dmp

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

memory/1268-79-0x000000013F510000-0x000000013F7EA000-memory.dmp

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK

MD5 67c0a5d8638dc4e790800beb22e2258f
SHA1 af1f7c8c581cf23f85d5254fe274a72ebf405660
SHA256 bf8b974c2152d308b4928029cfc68c2bf3f9556b32e38f3c41c11e63b85497d8
SHA512 d188303f752580395d702f39b63390c3a8cfc704a83047e4894656a59af3219c490360edbc2b07a621a748c333419e1e493ef74ee1f4663056f66f3b2fbcf681

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst.RYK

MD5 c9eb70a10c252a47192621bd5c190fcf
SHA1 9934ecbc9b9020fde32a71613e76ee4a6f8a44e0
SHA256 7a7cf3108bb6862fff18c1302a044d74a3e559bb70e8b8f8e66164a83174c67a
SHA512 69c1d4dfb4526d28b41e477a15580c50bdafbabaa9ffe073b7f8d1253be5335b32a7822595b5d80a7dcfceade74a57c2868868c2ece7300c45e3dcfe867082d2

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.RYK

MD5 8bb6a8b4f5b6cd66c93b3ecff60c6148
SHA1 b19de2f0ffe04e7f8d41e722e165ec52893f4a10
SHA256 66b37b7b3bfb9219339382042a6ef16a7e42bf5ff27316ce41fd752fe68b6afc
SHA512 f58d5d5daced5b5c0299b9123e2ddaccd49bebc9219c314660f26636124f690b1fbd3939af286cadab034e632e80aa79eb76e1e14fc08f1b31149644832eacc9

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\ACECache10.lst.RYK

MD5 c55db258ba7e11496704066b40a7357a
SHA1 3b20ddc6ef01037b977db8aa84092d0ed5f46325
SHA256 aacf48fd6d30b477a9eacb73178accd3a47a882c16ae60ac1411998211066837
SHA512 813aece2c15c14e03145d762b98e5ac86beeed53e5374af7b530c454a358d26f049a260ec0202fcc1458e1ca6cc25d065fdca6319054c8aa2a69bee53f5790f7

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Adobe\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

memory/1268-87-0x000000013F510000-0x000000013F7EA000-memory.dmp

C:\Documents and Settings\Admin\AppData\Local\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

memory/1268-106-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-110-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-111-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-112-0x000000013F510000-0x000000013F7EA000-memory.dmp

C:\Documents and Settings\Admin\AppData\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

memory/1268-115-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-114-0x000000013F510000-0x000000013F7EA000-memory.dmp

C:\Documents and Settings\Admin\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

memory/1268-118-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-119-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-120-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-125-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-151-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-152-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-153-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1372-154-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-156-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-158-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-161-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-164-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-172-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-178-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-179-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-188-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-191-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-199-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-201-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-202-0x000000013F510000-0x000000013F7EA000-memory.dmp

memory/1268-213-0x000000013F510000-0x000000013F7EA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ASPNETSetup_00000.log

MD5 a3db951724f96acc1d6f0a4382b5442f
SHA1 2dfc76a74c1081916797136d0b42095b4f842673
SHA256 b05ab870443c2572f51da0d26eeb0a9a5f28dca358b1ca8a2f3857a17c486568
SHA512 0afd5be9bf3c590456051654dde96de08f163aa27937c5d2b01c8c735e3126392a303c310ad695b16573ff6f738c208b662c5d6f0cbdae0dca4a40d60c7b9ab1

C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

MD5 7d06d45b8f3016a26d097c57acc06396
SHA1 acc006f277a83d6fa71a285ebe215ed4ce972e0d
SHA256 2ae26a7570437e4130b52e9b78991e7a75b3a36dfe5b4eda56add22c3e725eee
SHA512 321727de5e3a14dfc967683180c34296f7bf2ddd2cd58156d973de62b4dc2fb7affd361b0567913d26d56f2810a9ee0127860a2d48bdafa3665eaa89d3d135d1

C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility.txt

MD5 84c083db944e92169e8533ee3b2aa777
SHA1 43601869fba25caf267e763f1b97136ea4bd3eaa
SHA256 1877d6e81ad082c0294a424442133311bfab30aac0f75447327ec1fab12a29fd
SHA512 9051c360b1b6a72b04f831769bd35e8ff0a95c91bc4d7ae732c3b87db92fa0581bded81068466578533ce7bf907a222e723b01fd3d3d07bfdf874da10f36135e

C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI1FD7.txt

MD5 01c1a32cfb9ac6da4521e0fa3405cbb7
SHA1 04db02d6fd553e75859232883d3a06b35a4b04e6
SHA256 ffa49a3b7f7b3c79c7f8020bc3c426e39d43bda15f6227b6be94f73d51fe62d5
SHA512 46707767c6aa463bd2b2dc59d18881fb74d9ce1e696b3e678cc679c2c7dfa0c171a074ba01c4ab59855635e0285f4b0b5d059a164abee3b92ef0c76f0027937f

C:\Users\Admin\AppData\Local\Temp\java_install_reg.log

MD5 f5e1975bf61912f3f65fa506540bc9ac
SHA1 57e05148ae771398e70647214ed431c1cdb017a5
SHA256 d43ad511cd11ccdeee6ef409e0f92a6df6278577362f637692b393d258b0bd2d
SHA512 6833bb207280a6b81333f2b6dccb434943db3e10c2aafb3e0cfc26cba436d03febfc29f1ba9a909ea6ec60266855c023f7c0c15e6ac8b6ef8eeac72bc03cf58d

C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI1F75.txt

MD5 a5a43eed79f7196758434ac0c8efdf96
SHA1 a98902869ab0669b00efd4b9aee772c7da579d65
SHA256 d96c8f9cd378b42240071c1ca158cb71917c4737d096e96408a9e105c570ee20
SHA512 4818d5ddfc01ef5b899c7fde7c534ddbc57890f5106c954a3d83039431c627070af681abdcfce336cda5d1e35f2b8a80a5a49e4f32724d5d85539f93177aea9a

C:\Users\Admin\AppData\Local\Temp\ASPNETSetup_00001.log

MD5 26dc20b3aa46f12239b31eff33a4f709
SHA1 e873f7fe5ced5aa022a9b0d759b251011ddb4bab
SHA256 7e5f485a37b82f8995803f099b88797c19bfee2ecaf585261d0f576227d8b88f
SHA512 1526891d255335fa4e88bc84131974e47b82761054f8ddf589adbcbdb7449d5c78ee1cee6480d68a549e8b60ff1c6ff613adb9eb057023f8b49606edfcadb655

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.htm

MD5 912fa64d320e9704053d7eb379b6affa
SHA1 584b8c3f687346741d3d1a2e9371bc2cb6c8b984
SHA256 25ccc502d61b0959352c86a154b15e00b8c641ac6b26e2586ae51d0cda4374d0
SHA512 dede71cdfc767b00e0e75b8200157e1a4229fb3d370366d1dbaf5b39649e9abe2a1ede004cfa4aa3b7f940c6bdc1e69d8b717ebfcc35c40687c22c2a15260b24

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Graph.emfRYK.RYK

MD5 ee3975d728dca5d4ee4c2050fc3b71f2
SHA1 554ffd11a7182319900a9519ea6638dcec3cb3b8
SHA256 57a7a4ca2420cbd853b0281214339b94937cc9b8940bc600bdaf05797c3f87b9
SHA512 4015da13683d54e72c56c60df3ab80b1cad3272d6f7ad9da1241f6e9a231f072186dc4e4c79176f1383b0d02697f2b29c50bc6a11d8f18307488c3d863e9acd5

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Seyes.emf

MD5 095becfa304c226676dc905f20aac450
SHA1 4ccddfc45f053dce0f47afb01907dd7a58507a43
SHA256 03a0735daf6651b31fb57c7c9be8186a3267ad219d8eedc226c6620179407c5a
SHA512 40466b8dc990064c5415cffdd46d46f5278fbc7b86097359c58db978ca8ec19b357cc72d9d337005e1db09cfadc2e50e416ed5b2f1636e02518ae06f6429ee65

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg.RYK

MD5 7e6d808f0c18b0108a9fa805fb72ca92
SHA1 1e57b82fcdefe5a9a182cf7f7920298bfbde89bb
SHA256 3ef8f65c8c7bdf26e92aada395ef03b9d2eddd259df9b1047bc03b5158f6a66f
SHA512 fa62903adbcc4c2783b357a1847da1455d70f7b2b534bcac6cac2cbbd17a06ef3baae234ffd5d1d4444ad65aa71dc90700ec1af51f37c8706cd4bf308fc7f1d8

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg

MD5 1561321f1458e9d3e472838eaddf9337
SHA1 27a94b9c508fd40bde65607353ebd8c2aee6dd77
SHA256 9cdd52f2e4669577d8a80d957e0db0f7aaf7c88aad258e60a3c27a7a5acc3eae
SHA512 39d0c75f2f4f375db640f7e03e35a6491e93a6cd3b7ef095dc00e8a43781efc50b0c9f017873b7cc06bc1ad4f60c13c9d367f1f300fbb5cd330d8b7a5f620bdb

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Memo.emf

MD5 019604564516989f5ec5d109712be3ee
SHA1 8583912033ff2e9198488aafc9b872fa917893ab
SHA256 eff7d49b41fc7e4b2d57bcaece5a479d17d63f44a1913ceb6361ceb0ca904ad3
SHA512 9254a4b82f9f4f13e11111b019f6d1ae2d6a5de212423fd76835444513ffb9f903729f3b7c3cc1c3ab23ba703d5c82bea47a99f2d46b9798dea5a43dbc0b7fc1

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Monet.jpg

MD5 d1d91ea8203d7c7e212e755127ef07d0
SHA1 5a8f4dea4dfccc6497b336e34abe6c6a6a67e229
SHA256 575c30ac7434c318525fa8b6781471a4f497442af5518cfee62be1dc576c2ec4
SHA512 e5824179efa53d846cfaa870859fbf566ec08a0bdd588138e13b2c062a8a067e9c913876936c268ece3940c376ab52fe9ce9c3b9773c75044912aca0f544e513

C:\Users\Admin\AppData\Local\Temp\wmsetup.log.RYK

MD5 29951c0e43a3d38dca1f3e8a43506397
SHA1 e53bd633798b4ca5f4b549eeeb3169b5238345b7
SHA256 05f571453735acee3084636f7eda8b644f1628555bfe64fe3c5f62160b1d6e8a
SHA512 25b83b85dfb6d836f5202f6920c9414deeb77e91fb5302ab277cd5cc01b5b0ea795162cd73e1ce079f760d3a09f64aba6c60d3086a7ef8d7c044043e05990daf

C:\Users\Admin\AppData\Local\Temp\RGI2D48.tmp.RYK

MD5 4e8cb282396ba7be0384198db04bb15c
SHA1 2dfb98684b974d593284028003e965aaad3d9f34
SHA256 e0ef7075b998d91a64b53925ea2c25e67a2546dae056fc7832a7cd3f6e57eef4
SHA512 4e8fc03afbd4f37d1a6a8521c43b1b33dc3997e18505f5186fc64e689ed6b2ca5fd8f529b8da8ed24beb92e5a391bfd0b6f6bf5713fc32ef9208678bbb8b3b0c

C:\Users\Admin\AppData\Local\Temp\jusched.log.RYK

MD5 b70630e47e1f98a0ea00dcee99272733
SHA1 f40d6850f2e8f3c15c47bd302cc4bab2e2a68a94
SHA256 b62ba4c2de30c5a16be03d47014e8cbf30735e05637dd0398f2990c079e2d60b
SHA512 0b9c06566bfcf4038e49db3b293145f7179393d8552658f272dd69be3f88a7e824ccc164b59a10cd1a6993ff847104d7c7b067cd91c6ed8c927094959cbfaae4

C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log.RYK

MD5 a818f0e7e094ac73161f11dae24b579e
SHA1 f146e76d5519dc482b3816cee65d548a46b09e1c
SHA256 d539c079099c663ee3a53a57864843ca7ca5bd3bf0cfd27ec44edd62a3e896a0
SHA512 c9231800492991321065dc094ff392b68c5e29a78b9a79ca8fa50c1b5c546a7590dbc0112c6369d41ef3125f5e961fc2574a5209424ec8c26e87aa49dd69159c

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Music.emf225-0.log.RYK.RYK

MD5 fc7f555805ca551a82edec6bc83dcf83
SHA1 aef2189278ff00735a17b8ddcbc023ce3b44c78f
SHA256 6154d9ea7b57822f24e2f135e66e349f16d0a8b0be7e708e95ea433d6c1888ae
SHA512 514a0226bae8f9f0d933113e1310387cf013f4441429b31a58c026db58d563514e12a844ac1f87764d0c96afc4c19ad1ff9e13e2af6044eaf27e82dd62c6164e

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.RYK

MD5 589daedc38dd73b17b9ab75c5c2fb0ac
SHA1 cebcac9504b43c37d676c644b2faeac9e23b0790
SHA256 625221c5c0fe7ef71946bc6ef8f9d0c2b57c45c2aaa9f398da03e519bd3cbab0
SHA512 2e01a3ee3f0c3cbc650bbb6dd98602792de86613bf38c3c59e07146b2ce7b547b1ac10d4d8174abfedbdce904314cb0195b4009e2fd541f22126e2f529d9890a

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.htm.RYK

MD5 b232c043e3d6f67b0f6349f9e7368a5f
SHA1 8a83f49b54a5604ea8e5b1ba4fa3a6f8d64ee297
SHA256 3a28f47f9c220328574263740c5d27223ad7c24dc3656c48d678672caefc900f
SHA512 d554ce669e20ba3523c9a24cb1a92a4b6870b31babdfc363f31e3bdd85d495c29193fa8c589513d2c52a9e155e131701b4bc374747f496a31ee54beb1a85cbd9

C:\Users\Admin\AppData\Local\Temp\Admin.bmp.RYK

MD5 8eec01a33177e834e3e5c8ff3cfcef28
SHA1 126f01a49c3577696f393a1e887ada66e2e24ac2
SHA256 503a8fbc08c38bff36bb86c610533c5c6f5913eda7f2378bcd2b6d6ac5d2307f
SHA512 4321cc381ce5a3baf618e986b591d39f2c29ceea1c39761d41db5168ca3659c66803055097b1bf53342effbaa0bf49eb76be7ddcb5420b8ac7b16d3534020b65

C:\Users\Admin\AppData\Local\Temp\java_install.log.RYK

MD5 868a6cbd854dfc782a2ee41e854ccf41
SHA1 6889883a0ad87e3b8b4b715956a705e3f37d5fb5
SHA256 a579fa060da38778355d77df6792d62abc6ba2e6ed6c8c7fb2437c34ad287b65
SHA512 e9d594ae63c316642e90fc3551d0223db053af3245ccafed1d6bfc23740a46c72dad14ea4b9fbcb66908217d931ed9e8de21acdecee0fd5360c6aee96c92ff5d

C:\Users\Admin\AppData\Local\Temp\RGI2D48.tmp-tmp.RYK

MD5 1ea3502efecce6413525e9c8304539d0
SHA1 d9f7b9bd476f15b526f1483c635f836108f2d53e
SHA256 902fea5dd74e877ca0009072539b030997fcba6908a47c6789e1bfa3e96b23bc
SHA512 3f2acaa7ec896ee6ab68256a2c3207113215a0c864e76b31f3adadc410a57da2f5de1a10f26f1be3678c2bb2b2e735718ba65670b022f9912b304246ed2da5ca

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD.RYK

MD5 f15364a02d6ae08969c971820e6a74ee
SHA1 245ba595e26ccd1aaf7773a02f8947b592061507
SHA256 efd3080cf7a30ebc15b4275202a7976642bd80f62b0b995e33729ff5451c1df8
SHA512 260769226c8eac7daed2a5581fc565ce80b1310fe564db01f118c876f2556c3959138ad2b2fa19446f40fbd9fa58bf74fabf47138382ba4b5959c38011e2070a

C:\Users\Admin\AppData\Local\Temp\dd_wcf_CA_smci_20230901_013011_945.txt.RYK

MD5 61e1e5300492d3594b6219081beae7a0
SHA1 aefa4689b90b8a617f7b8a93f5e5ab771085a1e6
SHA256 0f8f6319bfe7ba3d5018994cc72c791788a98223ed4d2acec0afbf5dd1d57385
SHA512 ca9639bc0806854011d360273786dd1e0cd72cd1a8d2698da8f6f186b3d64d227801f89da8dde00d7b47e3ca086692533af18140014dc3b2b9b9a7aaf46bf38c

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.htmles.jpg.RYK.RYK

MD5 11f774138faa0fe7c8e8ea50c330c43d
SHA1 8420e880b59651bc874ea9563c68e0be35e0da73
SHA256 59abe384f94344dd7c31bd125291255c1c0a9132cfaeb49f849ff0d1d5826672
SHA512 f67bdc28458815b200a9d491a76765a25bfc821686aeb2b861eb8914b5c026a6cf23dd1faa13ed1d6bd41f12f56ff7601153ddcb42fbca2c6d7ad19856f43d08

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Tiki.gif.RYK

MD5 aa4ab5c3f4fcdbc7334f26f3bf75f43b
SHA1 27a0d48994c2e0aae7f6598c57ab4987dd03b5af
SHA256 8abcd9313892b2348650cee1bf8f66b243d29065a4f1358e5d9a7cf5727a8623
SHA512 002bcf7939811fec59aeb9189a7fec83adefb40de4bb85f546262945be43549838758f9b26b59e680a047ed70f5a81c1808eeb1e0e303beef28d40972395af4e

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg.RYK.RYK

MD5 73220fcd620bafc9c13fa06944bfa2ae
SHA1 847f1ff0b7e4f862577a8386de687c7b960b7abb
SHA256 2110a22b6e1ae679fc0eeee56959fe920ee3d7a19176452b344443f1ac4457a6
SHA512 3a8474ee845c93e3ba8bf994bd2f37fd4f3dd6d12cd87dd882e2c3cb9ca0a00853c1bd74960939c4d2f3e61100fabfa6d6841979651ecadfbe9710462256d494

C:\Users\Admin\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK

MD5 d1e38581f373806737555691594bbbbf
SHA1 cd9130bde3bd86ce73cac1c294c9f19cc50bfdad
SHA256 5bd6f49b877c419252c32e49627e304c31b22861332b83828f84b63b07fcfcdc
SHA512 57c97e757bd41748aa04fcce11e6b80209fe5505b4d16696a4d1a27ac9c1c7cfab43e7984776b28ff6f74e781d942da226e7b8c1270dcfecc8f00788a0017baa

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.RYK

MD5 532a6280f104b7e8b98b1f1801ac27fd
SHA1 0aaea2a596efffde1ca7cec8c79861f03044be56
SHA256 a3afafb4d0e305ed4c5bc5f422cfe612ff3a630e411855f187a0978ffe1527b2
SHA512 8eccac0ac91fbb63d03138b6c26d07986fc8369bd680d53d64c3fbf02756b100f98c7d0dd7788b3df61451068a9e2d05e4c2e9d0a6616b4ffa89493b32449f70

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms

MD5 2e135ddc448f11457f9010f5d9d9b6aa
SHA1 2969c4e2f61fb683e45329cb0fe97550916d68d9
SHA256 90bda87174c0985c815b77665fcd9d84c75c2b7f86edac7848065b505cac265f
SHA512 d3fca2e2d962ce2f2d2203fade4de7625ca206a6d5f8098b4ea7836bbe0475b580222778be6e621b6bfa2b2a4462aa3fb8c280c6fddfdfc880177c12b019c67a

C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb.RYK

MD5 70cdc3aade27242e92795e29b0a7f833
SHA1 5689f34f84876ce8c4bb8bb72790845a8cd711b3
SHA256 f3baaea22cc7c2b1a2aac88c6752a05b743c478d6e09335c6fceb673acfea602
SHA512 e3ae753940c14629924baa53c4ca6b5886f2fc8136d509d62db316b6dbc0b733e8dcee6a7a865f1a965dc0b51ca38cdabd947613166be3664693cabc5474f3a6

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.bak.RYK

MD5 4d69ee2609e52b7f43b76df5d024d716
SHA1 31614b40971047b9949dca43ac7602b64c6183d3
SHA256 63c4291745c7a24be0c2a2de71dcd7745de2a7823350fcf058f0a9c76178f0e4
SHA512 fcd3c0c0e3b5c9cda0d0a568b6cf8bcbe04a7391ad292cc81fe73bce56fde46d656a4bdb61a7514d3234b442ce1493a48a8780baa7b41a9e3b17949d50a7e2fc

C:\Users\Admin\AppData\Local\Temp\dd_wcf_CA_smci_20230901_013010_697.txt.RYK

MD5 7f41d2dcb61ca44bd324b32bd12178ce
SHA1 b2227088c8d19087815d88bfa783e1b9c99ffe28
SHA256 ff4ac6f22573e344b5bdf0dc7656e94077338bb1feea44f4caa6ad275474aee2
SHA512 e3cc33238b4883b9e21bbe6e78fd8b712483a922a7e1fe4637ba2add90f9cf1e5de3e6c39a52f172b3e8eb0bacdb697dd721bfd8ab489d0b0a57336d504d6efa

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb00001.log.RYK

MD5 515319df27dc100dbf947550ff73c723
SHA1 4935f633abdac6a671b826a7b3a2ea9cd1d90194
SHA256 49f7e957b2115fe3980b37a965f3d5f43b2e26e1919b56ec109f62d60422508a
SHA512 80932b0a28baa7bf373d80c2540c82e4a55813c7cb18247193a6831c1d610d077b4776a8b261fb9a1b66eb536fe394c30a43d70065bd7acd26d33126d44ed12e

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.chk.RYK

MD5 8fb9663f308d9eb880057a938cfd44ce
SHA1 42259df865f5f42749961b0f050484441959dda9
SHA256 626276a36b7994c1de109311a692ce78c40eecec79ff95a03ce40b39beb0dba4
SHA512 5a70a6fa482db9ebb5e46807419a9e33049a9c04872c5463189c2f41adfa9dd53840176156798e69e602b929af6b9b32eb8471418e9e7b06c887f2b1526036ab

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edbres00002.jrs.RYK

MD5 6a9be6890a95f95c7b038a7945dcc3e0
SHA1 333b56b80c1ae74da1beddc710e046fe5f777c14
SHA256 a0dcd77dc0410b114570798de268fd5dec7b40aea4210845d2e16dc89092e112
SHA512 0d9fb34ca448981f134a9fbcde729ca1fda1ef80deaaf95161278f0948f42f9e87f01dc5592c4ac97b539466e1e1d48b5afbc312ec62c10462617d722c813bcb

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.log.RYK

MD5 c4b328747b95844e33df7a8811467e33
SHA1 35048a1680c00976c81bfee755db275c85e3032d
SHA256 8e15cfbb801a955c45379aec9da60ca74ccdaf2f721ccd1bea1a3f31227bd3d5
SHA512 4c8bb2eef4ad7f6172057b84da2721ad37db03c555e85e8629bb818527a4ba749b01d390fc0a00b1d8d3c7cf7725c90139052a0f77fb7abd6840dff0a00e985f

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edbres00001.jrs.RYK

MD5 1b6e99ff247c3ac97d8f1fe6200bf6ea
SHA1 69c1dcb4cb3dd6fde304fc1fc76a93390db42b66
SHA256 eae6cff603b17a0da8c9a183a499a5378932643bceac500bf00df9521b348801
SHA512 5f5fdc300fbe9d521f7d0eba92efcd4f488aabbaf3407619cb3f662d20a113d2445ce495b05cfc3975d53ca341fab85ee23bcb3cee4c050d18ecd289b49cf968

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\oeold.xml.RYK

MD5 26e25c35b9ebbf787c3e244d9ceaf2a9
SHA1 b816c3f90243aa420676fbcaf74b85831652f744
SHA256 8b632b7371aaf78b27525a54f92cd60ee209bbad6cbd966563a02d4ee0e00c4c
SHA512 fe1238fd9949f3f367408aea7206ffc925a8dddd53ac2036972e7a586bcb9ad3b1536b17d8de157362859d04cc374b3a443f43433efe5ebd55d094ebc1bc47b1

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.MSMessageStore.RYK.RYK

MD5 6098205975f5f2c26dab61a03b50e3bf
SHA1 7a0c02ef5b63fba8d9524ff07d19b52882562ab4
SHA256 793ceec0686b9262d45286f3a1d6e825665e5e30ce5b900ae36ca88ac3734c0d
SHA512 9ddf0e3ae6b661da4332d1c41f0ee75851e823fab17fc920f2c67b31cd0ca38b98d54ac68500d7f5f20e469cb45b32c4bd9addd0a4320e55b3a93505569f7682

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-msws.jpg.RYK.RYK

MD5 14256272ee991cd01079ac09e144152d
SHA1 ced440bf0dd73a01203d11c88c54262d84168927
SHA256 dfe60de0c703d68da750e7877d5c5060caac5a7bc70655defffc1b0d65b829af
SHA512 3b76245cbbfe71852c835ce161537ca0194441e6f0e657bb8557e08e0783faf51dd47784c4ff48282feaef19eb193849317498ccccc7dfd3fc148283812502ab

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xmlList.emf.RYK.RYK

MD5 cba18acdcbb49214fa5853075f3ec07d
SHA1 bc20e4f62fd9bc7821fc27d5a95fbe34bbaa9194
SHA256 1b164a971db9361d35d0e918875cbfee8fdbae9c052d88c09d4d411c18f6633b
SHA512 97fbfee7d65a7c49f77b99bc82eed5864f273ace332d2ad94f768722d35c84bed9e5b70e48ce762521e4874f78cd55fe0c9a4516300f514fa74e95f1bdb0f45d

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db.RYK

MD5 c3b1d89db4111451d2d600775cbc7c27
SHA1 8bcbdf2c17f6114d044c209e8d70220b0b86777d
SHA256 2eaae06dd74d704652c1b45a87637427257404c57fc4f64b8ed414f6713ddb32
SHA512 8488d5e40792be254da66eff2302b0f4bcba24c69f582de1618bd44e58df88ab521b8d7ba7a5131445abb0b3208b6b04f8224e9cc4bc884e4725a023b679083c

C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI1FD7.txt.RYK

MD5 10d2ffa4e4fa8ea52166efc4843121bb
SHA1 bd1bd1e11111ccc6563f6569af30207d79eac26b
SHA256 abd6246718d85a156ebd4ea3f799050c24c8244ca706d6d1b68afbf938ca5342
SHA512 006f83b06551fc2ea6304f3faffcc410464c49565dc4bf5339578d94fab7b00fb4e4dfff334f656cb9a7e03e4a4e7f43c7cbcd8aa353750c4ff908e10b4120dc

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat.RYK

MD5 0e20485e55ec094b365114fbd90752b8
SHA1 b4485d871728428a632d9afb3b42febe93ad0222
SHA256 8bb533b40772d3a63d4046625e46e740dd9ecb00cac906196c07ec0e6b0dee60
SHA512 83db9db5f5e6f49e5d83e2e97cefe7f04427546808b8eafc2472de6e435575662ad41496607e43db6b34f27ad442acd7b5fa4db0766726a1c88bf0a7599d06dc

C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI1F75.txt.RYK

MD5 5cf5f45f22c3658f546ac15dbda56535
SHA1 18c9523e5bfd96597f64451585b34f94c95fdf74
SHA256 a5ad2d7330027b87cc68fb775e56df3adabd5acafa74f3885d71dedbc45dd3aa
SHA512 8fef86d8529197b5639c12238305052389ac79fb1bfc0d114b16b3d86e8b8e286625a04b78641805b32eccb4f2497d1ee5c18dd5c488d230a3054e74a022b1e0

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230901-014911-0.log.RYK

MD5 6aba1445b6d19770731ef6c707c565a8
SHA1 9819478ef6bfdb86c0fddcfa6cc45e954550409a
SHA256 d938d3e94cff2956788e4b0ee744696486aab521739c6d90a3b7a19e1c26718b
SHA512 47683de565f2a16fa675e353e4836b2284f65e251024d9c3c23949780d6035f34af9ffb0f315e30534b75c877882a708b930fc5de0250348de5a3c70c8df8261

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230901-014547-0.log.RYK

MD5 549238b3db6df552d9d952f3d26c3891
SHA1 d3f737067117a4343b0386c88c7e6f9545997d80
SHA256 b120c796316c98e7c087a1289df270575fc10e0e49a2909860f354d6a3174ecf
SHA512 c2aef8dd27c13d5608938b9ef46dd18c425c142ebc7ed6a048e2ad78233d6d92ae716c2b43c1f9932685c040da5b14902b9571b45fe1f399530a91e3ce93f503

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230901-015225-0.log.RYK

MD5 655d08b97321990a0b0c4cb80ab7ca0d
SHA1 ea75414bddc3358baaf63763542224d7a2b70e06
SHA256 7b4edd6cba5f7e961d3d54b45978b3b01710860fe7e24068ef6624f5dfbaa9bc
SHA512 827856b47b4d32799d05413d6b43d565c898a4e59efc081323ebb0c902119b277aed3ae188a3503c6af392482c964d5ac500fc6fdc7c93b71db707a29a9780aa

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230901-015534-0.log.RYK

MD5 96929c2fd0b5a093c4e55a82d98ece6a
SHA1 8521cb555b3702c655e905b2e942d31a1e7f57cc
SHA256 cb46f2c6a858db3165f8e74c7b6003eec57ba4d1ef64403f78607b6dd41566a6
SHA512 a8c9742e92276a79098faec601783589e82499da65c786a51a753c70564a8fb6cf9e0c3efe6ac312efd650a4cb16945a0702e1822c46bcef7e7e562955b42962

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230901-015904-0.log.RYK

MD5 ab688e135b612ae28829c55f4eb4f1a4
SHA1 3d3a4a632e9d398bf63b642a8a4ea0bdc1e258ed
SHA256 f894f846caee06e7a891569c1933a5329a0fbd754cb232c727d6f7b2f6d72393
SHA512 9371a5591ec3cf9226ce5e5f14e1d62c46e317d1ab71f07f23672154efc8a00de6ca989fe03abb1b1b4eb198ceceb6e8fc1f61f1ec6a7b2f672c0e3ad7685017

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat.RYK

MD5 5373216c2bb5477fcf262717ecf8c7be
SHA1 e6a499e12fc40ab83b718c2d1012187c83fa8e09
SHA256 8574a9555cf391968fa46ad4547086eac10cdbef8ff1fc033a8b5c804dc22a97
SHA512 0e6aadf186f3b0b519efd069c5bdf7f06a4738927c6acc42d1d9bb47eb33980cf2895125cd67c9f90f74b1733c72b8173c9b3b7ce225df4e1f1661168a9ebb55

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.RYK

MD5 a42873baad1aef1bcdca4651e93b39a9
SHA1 dc5f8e438e266460ae7ba680045915afe3f4d951
SHA256 10be1e93579450c9cdeecbb6fa7887ef41ef3d0bd3947f5d55e0b72e5386fc21
SHA512 8e59decc86f98ccc3c5085754dde74de2a79afa38a2f7bbd470ceb467d444b008706764af96cc3b881e582ddb2a7d5c394046fd44e7aa81c8681d14651639c84

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N1ZD8WV6\favicon[1].ico.RYK

MD5 c60f992a232a427c5fad788c7059c3da
SHA1 8acc56ef08ae3958bdcb84c10cac002d8686757e
SHA256 e2a84547b0cec97c375e74398ff2d0e34b79e7bc82076d6080bd5cec48f804e3
SHA512 f885b13244d3c2bdb665b6c9d801d74dcb9e3ce99b0978017f7dc0386bc0088d7c889e4c5e0431f7e4b67e619ac1e5ee6bcffda73652fc65d6a62bb379f8ad2b

C:\Users\Admin\AppData\Local\Temp\SetupExe(20230901013733528).log.RYK

MD5 da6d73f5cc5f5b86a58739bba20a2caf
SHA1 19ead92d6b9173ae348099b57588b0968a1b534a
SHA256 0896ebbe96d50f0203197ac2cef7c980b472327bdbc58ed1e5c02a0496abc7fe
SHA512 b140b7f0ee84515eaba88c7bd62d3e0e587a5fe7c8eb6eccfe9725b7ddb67cb31a161b3ad0bfa9ae50598b5caa3690f15d70f986130df14f7a9e5d8a534491dc

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb.RYK

MD5 b971349db97a662b6e3627435d23acf4
SHA1 885accdc3e5ce342228396bada8175bf7ff675b4
SHA256 6bddd031505c04e66e546fc99398723d5803a87aa6e628ca95dd633fe558876c
SHA512 bdcc0c36374a67ef0bbde358b1bf25424d1090dad756794c3a877def61dd416ff7ce02c697e3ca33ea4c49de810fd9e99a5ad8127b6c6143bdf1b9e3efda7baf

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\edb00001.log.RYK

MD5 101d6be2c112496cce130f26c1fc16bf
SHA1 59a2148ffec5c8e8cbf1c3d7450225eae92bee94
SHA256 ffda3b270d29e2cd14d238ab90757fa1ac7f4561656fffaf7cdb219f2e5f7311
SHA512 8b6f5ff88488a076efd9719d49edc3f168f4562c8601fd8f5ebaaf5dfdaa4a203d9293f6e99b9a56a90b3d5d0272a299bfbc708e4ad37a1252042e0185de3902

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.pat.RYK

MD5 cb6a6b83d90afcdf470a38921bea840d
SHA1 9f9728d3607f9d8b7929dffe9a9afd9a5438f5e2
SHA256 4304ad05a778c5854c09e02621d1ae21e8d4b683e86ef761109fd5d677ffb0ba
SHA512 e8d197be51fe468746098ea9e3eb368716fe869ef22cdddd405c60364deebfff32fde6d9cfdbb771ff91b7cde48232f30587de066e6fc82c7a115febeb78c247

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif.RYK

MD5 080ea6845982174d83c1651f4d251be9
SHA1 95e501bf53ac6aaa2949f8f0252163788a8f2954
SHA256 1b4e5c33dc39da44a347f3e2feed753e78670805afdc9d791f5c150c260bf87b
SHA512 d92562afd75dc160b8a54815cfb4fc89c26f3ba05c970ef4731d117d497dcbdff7664a8de1f6fc089c49c9dcf91cbe6b94d032ef9085ee6cefbd40ee20610728

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Green Bubbles.htm.RYK

MD5 a19254923ad28ca781529445d1d900df
SHA1 31eb73060958c20e156db753c873d950523fb37d
SHA256 948df29165dc31a3b2b588abd720efbe5c0450aa63f29d6dbd6ca7d38096b581
SHA512 626ee22b56330eee3b23d24d73344eb755c1323bef4f2c1ced170e5b2a1047495b60b3c56005d0355e1c68678f5650219792a72ed1005aa500ca4193fcd0b8a2

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg.RYK

MD5 0001da5f75dec002a9151da94873160f
SHA1 9d0b4fc65ffeafed8a57d0ab3b0cdd3969799940
SHA256 2168712a4d658fa9a955508b91ebbf99a57dce467b3e9e2905710dde65093408
SHA512 f553312d12a9434220de5d085b951cc6996eb0e18ad241e89d05da31e4b6e60ad0d7371533a828900b1f00007a262987267989bb5c88430bfba7dbf177991edb

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.RYK

MD5 2b2bad637fdbafad5122e21f6e353c49
SHA1 d86d5510f4760fd3da8507df0be1e9630572061c
SHA256 0c829086839bd6b538e514fe268cedab408181edabef11226921dfb0152d51a6
SHA512 ad4b0bffdddf9e4492c60c3ad0c75972b95822e23a556f1a2ef0fe4b16ce34b55d8137d571b3cef34bf43cb375ee0871d98420fb4c6ed2b034c8f2f80d4fd6c2

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Connectivity.gif.RYK

MD5 9e1bb9d4ee60333b1ddef7d194bbae1a
SHA1 ff2c7432bc50e0d09b57ad236d0d44b047e9b25a
SHA256 d58c67f877fdce950277311f6c167cece6cc629f36e4f60bb397332cefd92ffc
SHA512 7bbf359f3bd8ac13540fa467d6f970fb06097784fe64f2fe65531caec40258f5e2f76bd16a361c9925f8b0db8b97649e18154b0b0226e1100672de6606f8b5d0

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.htm.RYK

MD5 bac5af1a996d863f4cb5222d8aa10ad0
SHA1 ecb2d8e413baeb676c9fb1de0463c05972631958
SHA256 0eac90ce6e3e856793826b0508fefc3fe25aa49ccf219ea4227aa29ac007c457
SHA512 126c169dcbc9368992802e5bf2b22ee64b928ca87f2a2a20f8b56c4fbc158b520eae51beaafde38b71bacf5582747fda8bdff892026ae8a056292f39aab46904

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Genko_1.emf.RYK

MD5 60113f963765e642620160366840ef27
SHA1 f2935a29a75076636e48a4362459359cd0cac8e3
SHA256 537b7bd8e54ff59fbbab2dbe29f47fe5ae92bf657f4552003ba4d7c221056df4
SHA512 bbd8845ce59086276e3324f03ada4664147653d0fca7a313dac6d37e68363b5c6000c7a06aae4f347f5cd68a83e9a9064d0a44df214a0b7836bdffc2ac17559d

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.RYK

MD5 043a385bb1faf67c938ad3f01b2837f7
SHA1 79bc8b98e3c013da1bacaaf278d20dc19451f2a8
SHA256 0fb9fe6e09e75eae32419dc2040dfcf617bf05ec1646f65021560fe873aee4e3
SHA512 94df119c6a6d31dd947909da1d3b819ca98392e55be38503d3e74fc2946d15e30e5001c29b09a8ee7f819907389857b0b260bc461cbd9c5decf1400d59d06ced

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\grid_(inch).wmf.RYK

MD5 6d4173a594e3b369c7b07e0c7861e6ac
SHA1 ee431ccc2d36587139f6d3fc0cd7b6552bd54c1c
SHA256 6f85d3251a3594f3cc2e97dbf8427e5e3fbc2a31e83ca074e210ee316efc237f
SHA512 db3ba50ea39a154befa34eff579f14aace8d0fda913d2ca0c22c4f2130750be6741e96818e8e5a3fd022b6689646a89d7a36d716d85e5fe06068d94db7dec74f

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg.RYK

MD5 cd5b4101940326d193c6873296095eae
SHA1 12dc19d0706cd7520881d8f1a458f0b9d57bc930
SHA256 1e6f7a3ef92791d94f35a4a32deb05e81a305c985ad986825200a454882ba137
SHA512 a30c6a9b089ea840b98f3fd1f52a107ab2ae63dd9f6e81e0f0cbff4149ef2c654dd772d2d148b0b4f43fe4f185d4d6bcba3a70bbbf8123aaa0c0b3fda14b4a22

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Orange Circles.htm.RYK

MD5 785cc61dcbf7c8cce81111b7bf0bf725
SHA1 39307e876d104e662e199fb09fc66cae6d09d6d2
SHA256 49b8e2f15ac9b3c5b845351dd46a4a0f2cd25f60b1ec21a60c0e1ecc46a816d1
SHA512 6ff66c2ed6c091f7d0e5642d9db3642d3c569e7ec2d1846bbdc679f6e2f36593d3ba0e64228c3f11f4789c69e59a1fc9079d6b399d379e0a4aee19bc3152f84d

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.htm.RYK

MD5 bcdc3a8d1e8f7a964df7773955af5347
SHA1 52207de438aec6990a592f9b224857bad056bb2c
SHA256 6f4037be82d9cbf0e1d42beb5a2b39b2e5fd4d729b305549ad40716cd1983072
SHA512 80bac614d63673a7370636c9ea70f898d0a93e5481a8a344aac19096a18da8f45dab9e236e2ee1c74895ac669fa73e8019b40e12733cba91b808b3c16b3d3908

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg.RYK

MD5 85850c7747e22291a8d623694cdb4c8a
SHA1 5f01a7c12ea5984a8c64c867a8e95d174940ead3
SHA256 ac7f9790070cba5315f3f22d56798319dd9bc425a524f8ed2fb24a027bdfb6f6
SHA512 02ccee944dcdd8cf4e2aed37a07de9b17fa0473bc3b70d4dfa93911acf94aa80aab6e95623c18856681b043143183c374eca13640d5f9b5acdf773d4fd5de2a1

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Psychedelic.jpg.RYK

MD5 9b8534b713768fb5dbbf43d1a31f7eb8
SHA1 8d48740d4fdb907482e8a115b35361dbee16bade
SHA256 59c29b99f233196e4f9f5df2d0ea60cec2144fea5a5911bbb41c99f08408c831
SHA512 5d7a165315f2bcecac33c0d4097b399de3e8396defa318fe786f49d5475c17da5d920f58eefe37c7b4e870103655bb9c0d6697050886b0280425ed1417fae4c2

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.RYK

MD5 c1f0a2bc6fb6cbb12b9a7cc4d7dd3b35
SHA1 3469764a661a4da2a86f061454f7575ba7c4d41f
SHA256 fb5444f530f84bf6e5bba83c9a9ca9e77f9cb0b85cfd6feaa718469a58e151c0
SHA512 0ccc5611c1be4b88a3f8b49bf48451703bb30d373ea2bcbca46f085975aec6ca5869f4ac731553c5cbbc0e4a7312f2f145f697e761358028913ce6ed42e42383

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Small_News.jpg.RYK

MD5 4764c47e9b1b6a8c6e77c43ec4f467c1
SHA1 ac4a099165b3144fbc0f4aad63bb2806cfbade27
SHA256 96e7c0cdcf5b79222a0a1df1e505f801ab7f092547a1c4380ec6bb8ad045cdaa
SHA512 1c1a44fb4ea86f9569e7b877ef377efde7c81b57070c0abc94770a226e9201a99ea2082a691b7bd3bbf53d4bec91292e3e2b55b2816eb6db92c14e2405287b29

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.RYK

MD5 27b96dee0da44c98b46d2f41671b552b
SHA1 940adf3fc5d37803d619998f44c3f3dc76e170c6
SHA256 5162f9752b8f9a33f913cf4f984046a4200e077ab62f0f0e313c7d287e120c96
SHA512 cdf249a7fe489f3504d7fd2a1a0b2c3b00d01c2e95d180a3239b9e5634619ff9f33b5fe9d1620e9c7349463c16553de8c642363c3364d6c0612f7209091812e5

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.RYK

MD5 8a20157be7e6bd07dacbda8332ef121e
SHA1 ec25d48984e0d55ae7c80ec56e5532910d5d9497
SHA256 e7e04c21ef55fc06ac6173c24f7b995a9d429c0ea6a0f8a2196a28aea836a2a3
SHA512 8bec79aa08f368fdf74a222e116bf00d8383e47d82a96d13a0da99603422a2bdbb25d99e76400812a658648333ca176d6a051c006550e366f9963bf179314776

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\To_Do_List.emf.RYK

MD5 28bfee901895004759039f3cde00ee9a
SHA1 21d0a71a71ef2cb491512a43aac94c95b977e86c
SHA256 59e48f419bbafaa471ad4d6f45ee319fec9fc1f7169af21ddb6c0eccc41153ae
SHA512 c677cfa5c3d1070a26b926f096ad5ac2c8d3be0b641669f4395db092d0ece07a62c93673687fd9904d41dff6bb994eaaeb7e42e931c7d907bcd7d98534a4488c

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif.RYK

MD5 5092fed898cdd14aff2298ce543e7ea8
SHA1 e5a40177099ef14f7129ff65613e52e21ab1ea6a
SHA256 eba03629aa0d85f0e5373f30bfd065619ec7d4e5b370541a55e1480865c74150
SHA512 b4d1408ac847d0d95d7dbf847c9c5482fce1f858a1fecd540b7d24c0613d8f80dbc773288ebff25a8c7d8e15b3d3d41d08f19640bc85c6a32366ea69eadd4687

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Admin.bmp.RYK

MD5 8eec01a33177e834e3e5c8ff3cfcef28
SHA1 126f01a49c3577696f393a1e887ada66e2e24ac2
SHA256 503a8fbc08c38bff36bb86c610533c5c6f5913eda7f2378bcd2b6d6ac5d2307f
SHA512 4321cc381ce5a3baf618e986b591d39f2c29ceea1c39761d41db5168ca3659c66803055097b1bf53342effbaa0bf49eb76be7ddcb5420b8ac7b16d3534020b65

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Soft Blue.htm.RYK

MD5 7bcb45ed1ef6cfe1f20f0893d888481a
SHA1 ef0c3aafc62a6f21cc066a13f32e57f9188bbe07
SHA256 0243956a20787f4c5449610ab609ccaffbcf2f0ad2aa4f0c67c8a7b8e82884c7
SHA512 293a8fa8e54c3f76dd8b669a8ed1dff07ad727b9c4a195bd5b84bccad3b009b8f565f96cca4f257ea4d9b5b657526d67217c89e11820cd34364186aea971648a

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore.RYK

MD5 e2322bff275cf836e4fe066a055643fb
SHA1 56e336238733e01e840e8c0c12a2f39e61653ba3
SHA256 5649cf48ae78e264b84aad289cbf27931c23e8b52c28c9d4c95a28c0255e5f07
SHA512 3b1ae392ef108fbc3d39ee92c0054d20c14c73c932c92dc9628424989e5c0105f42cac4bf1e95c9120254c3667e13513e8d707a73e93ddc124fb38ace584bb66

C:\Users\Admin\AppData\Local\Temp\933e3de7-4ce3-45cc-9ff2-da2d6ddee935.tmp.RYK

MD5 a4cdab4a3e5984f6f9b9397a137fdede
SHA1 ead710a148f1b75faad7a84c88e92483aecce38b
SHA256 205d7ed7f61478a76c261ce6be44310e2f71ca50a81536e284c442edfd35a1aa
SHA512 38f25af732063da0e0e72b3c0c96f2c0dfc5414419cfd65af2fd9e97694eb1425ba962853502eab577386913753489eef0aca66a7916a1a32847668b839c73a4

C:\Users\Admin\AppData\Local\Temp\79231cff-fc6e-42e4-87c8-5b9a0b5e956f.tmp.RYK

MD5 63ab9d0fb5889e0b2e6f19b7c7717f11
SHA1 839f829d64e34f0017d11f6e959b7080cc7476bd
SHA256 24e3ac2183aee63f1e54df5cc307f6f96345cf98487e49054d7b5190210158f2
SHA512 95d64482b5783f4f849edacfd0310b065332eafec42eb11eb34e4206ec37aedee5004b8747178959fbed958d74e1fc498e7b4d468e5f0dbdb675ff3e79aab8f2

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\JavaDeployReg.log.RYK

MD5 a818f0e7e094ac73161f11dae24b579e
SHA1 f146e76d5519dc482b3816cee65d548a46b09e1c
SHA256 d539c079099c663ee3a53a57864843ca7ca5bd3bf0cfd27ec44edd62a3e896a0
SHA512 c9231800492991321065dc094ff392b68c5e29a78b9a79ca8fa50c1b5c546a7590dbc0112c6369d41ef3125f5e961fc2574a5209424ec8c26e87aa49dd69159c

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Shades of Blue.htm.RYK

MD5 ee0803d0160d1b8cb3bfb99127886c0d
SHA1 201675e472db539149ea9150c0571e93f17bc935
SHA256 fa6cf5a858b2a8fc2c6163d3546d024d009d67606ef9ca4acc460e75b727801d
SHA512 d1e9d4bff1110f3bad4ee7a2d3f0fc6a62bd60e2ccd9e498c35af544f7c395074a8f2353f7828c0ff453510bc6cd2000828b63013a2842d2c3a0f7a0d2be284a

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\java_install.log.RYK

MD5 868a6cbd854dfc782a2ee41e854ccf41
SHA1 6889883a0ad87e3b8b4b715956a705e3f37d5fb5
SHA256 a579fa060da38778355d77df6792d62abc6ba2e6ed6c8c7fb2437c34ad287b65
SHA512 e9d594ae63c316642e90fc3551d0223db053af3245ccafed1d6bfc23740a46c72dad14ea4b9fbcb66908217d931ed9e8de21acdecee0fd5360c6aee96c92ff5d

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml.RYK

MD5 f0bf6ae1a24c91ddc3047765930eafb8
SHA1 bf50c23750eddea69a510302d4dfe428a2a43374
SHA256 5843ff88908f37a4806176413b02c82e86b05b8f8ddf9dd76d6e74ce297c6e83
SHA512 f0e8f13d0e25aa8abfada858758074893ac4f68af275b3bf7c8a6dec0b061d86962972529ceea407db74702e9419244e63fbfd7c94b675005569a10a6eb22b85

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat.RYK

MD5 0c19da52f0d0632f0b7b5210eb929159
SHA1 53e2ada8eea569f6c1ea0e3838fbf7831fd663f6
SHA256 47f47de68d6569517e3f7d9bc07e2e2697ecddcb5e2fb204c2e6732945797a46
SHA512 dd35e187a1d5487674c6599fb9ea8d3c57b4f5c8ea2d309fc5250df423136d6babe98c2e28d97bad9f70ebe3739b71f315365f0ffc4d84631a6d5c1b168bfb61

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00008526\11_All_Pictures.wpl.RYK

MD5 1c16f059f2b119fa1fcc4f160cf67b6e
SHA1 b8e648a78244a3ebeac748b22881ae1af7c61fd7
SHA256 53fc4e79ecf902ced2eaf240c3bb5d4549d44a8899a4acbcc6f29d110d09b5f1
SHA512 f4f7269b5c9941790169919c336187baa7ce0a6283e3c4fcc6dd220b9997e25bb23ffe01f7cc371fd84f94a42c16455cfb4734a36eb9a47e158c15b2f1f2f707

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00008526\12_All_Video.wpl.RYK

MD5 174d44109a57dabca0f1cb93eaca359f
SHA1 68b1deee08c483623016dae6ef0eaf79ac79727c
SHA256 cfab2a1ffd09afbc5ec471343f9ddb63245b58d95186de393b42d454dfc9d9dc
SHA512 8a8e2f3fbe2875e749104ccd3b62eff6a4e2b7a6e4c927a4f17e2f68bdd03302aa3c76f0ab55158b33d9efcebdd62b1187564f6b3ad1d02ef290d7eda740b935

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00008526\10_All_Music.wpl.RYK

MD5 8949a2bf7c1a8d6a8e283c5f33f69967
SHA1 126d1f0fd2f45041d68f62363507f7bcaf84cadd
SHA256 541dc246f37c1c7646d6510524ac48cc4c10e45a35e4cfbde78dd88d54285361
SHA512 e3bfe2624d9b4aaa43f9ab8bd84f4afe8ddd585ab73c4fd1415044fe9b99d3ead1101e1b57b765ed8cb4dea96e44a19801c331a691b8d84bd02b1fb80393d9d6

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin9728060290\msapplication.xml.RYK

MD5 0621e0618b7bbc2affd058ece7613b3a
SHA1 7bef916608930d3630f41d76e86f496e405a994e
SHA256 8fb75ebcfbd49c0633e4806d3360898f9e84aad2b71be6cc20bf1180ada4af16
SHA512 2294361cd9ee417d64bfb2c6e9597128999939a745fbcf86425e9c6ee54051bff8e1bba80bd13d8b6f6171362d902feb0fa7c267df1daa9c0ae3085289c2855f

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4EA35C24-486D-11EE-A617-EEDB236BE57B}.dat

MD5 6cd85d841b8e3e572b52706819d73fcb
SHA1 ff86d5b4683fee880cedb321b65770f35d52c391
SHA256 871493531548ca9d1d3cb60669ca26ea82768224062f841ecc5714a4fc5ea7d2
SHA512 6fb31a541989d881025ce73fbbee7544c8e35288e6f0e1f63a7db2d98152140610171c552747e381102cafdca011c9eeb68b4dc7920f2f067450beceb8f27292

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~\Popular Government Questions from USA~dgov~.feed-ms.RYK

MD5 d383408645eed95cd9b6e1fd1e66cda2
SHA1 906c37dd8f3ecaa8339a761c8292990b188d1034
SHA256 0b2ea5b9dcd8d3cded209e47b513112d0428b6a15b698fcab061df81489909a7
SHA512 8c1fbee6fc57732509c8187fa3fc9745d5f05be9b12cff242642c03d681e0a3da096cc34f10db928c0f394674c7d18e2aa4006ee19e8d7a59499048911a43df4

C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-msemf.RYK.RYK

MD5 347b17cc0a97977807ae4a98daa9b4ea
SHA1 6bf5175cf0ebeb30bbd6292e24f82d6589fe8021
SHA256 57c819afa08f18de75e660603d1188412862e65e3e0487d762accba7b87b86c6
SHA512 d03670f56674b988a898c89ed71f56990e2e474b22ff0d324e39a79042bd7552e0c656e03305ae04a8672ee18bc27f9345cd2f39ab60afa47bc9f0844b414ab7

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\jusched.log.RYK

MD5 b70630e47e1f98a0ea00dcee99272733
SHA1 f40d6850f2e8f3c15c47bd302cc4bab2e2a68a94
SHA256 b62ba4c2de30c5a16be03d47014e8cbf30735e05637dd0398f2990c079e2d60b
SHA512 0b9c06566bfcf4038e49db3b293145f7179393d8552658f272dd69be3f88a7e824ccc164b59a10cd1a6993ff847104d7c7b067cd91c6ed8c927094959cbfaae4

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00008526\05_Pictures_taken_in_the_last_month.wplunt.RYK.RYK

MD5 60486e101da06b1a0446ec7d0f7f24ac
SHA1 aaa74dee02dbf08e8ca752d6f8de2e95c550a458
SHA256 f6fb1b7ee8ab103196e8abd93e35bd448bc0b5939a58b1c3104c8c0298b28d04
SHA512 9adf5a33023596f48a8b0cc9c48b0e2418de663db30d4aec27207f5522c423a4af9726ac43f3c95dfe9b11eabc1c5afb6c5fb5121285097f461f9cc9ff3ed4e6

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Notebook.jpg.RYK

MD5 0a293408201b14e330ee33df610e2b72
SHA1 7a54c345bb9df5480b606a9d76b2428debf3f849
SHA256 3ad86ca2a8edda300dec52fd94883a2aa95c142d65ef52b7f76599201bc46469
SHA512 d435b81b4eaf22f545313668be755af3b5e7510a3b062b4af4fc72f3db380720424af6029ded2df1813c6dc7f69a639a7abe0da7c94a741d15f1c75055dbf7f8

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~\USA~dgov Updates~c News and Features~.feed-ms.RYK

MD5 89edfeba184526db101ebec0725b90bb
SHA1 bb191c2302f52affe64acb4ed9a765a7b50f4901
SHA256 9ffe9e4290a37449dfa1469fed47ee01b67828387698b1dbbaf3c964ae44bfe0
SHA512 c026e9b1687938d07197571166e5cd213f064b1f27ebf1fe31f0f5a4ed5251e081a4cf9d733cc30019e58c3dfed503a43136e9a4eb3f76e3d863c30f12bd96dc

C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20230901_012943179.html.RYK

MD5 8ecda24234c09126b4bdff6d9dfb00bd
SHA1 070992ac65f71975fbfd1f336cfc85c0843058fc
SHA256 0e95d86904ba9f5210be9a32d53d4c9b967b0cd177849c5951befade6dbb33b3
SHA512 b685f1e23bb85df6364f75ca419b3f5a63718f8559974c9b481dd1cb65f40025ef0e07e5be3c1b77840924a851219bea36fd8d8d2043a4445e85cd4b843e08bd

C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.RYK

MD5 79d9327bfebf45a6263b1ce144cee08a
SHA1 67993920f1aea8bfd4dcfdb01e4b2396ff2488ce
SHA256 4f1a4089a854230adbb658c200f1ca4a86e2281404ef9e46a5862eaa900384fd
SHA512 d530e74c8e2d4dbc2eeb554c45c5031c3b793d81f2c3c773088bc538b3441af3d35cba9c86ac536e90f5ced94f98d1a18a13bbf5edb8940a0618f23ca87cda05

C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms

MD5 d45de0dca054827192295511f9b03cce
SHA1 ada2a92d3be1bb2eea779948b74a1afcdb7764e2
SHA256 dfc931d1bb552b7c36a96f8c2136d6234e1df6ac21d4c7aecbf4b6841ed2b21d
SHA512 46c10c9bb5ea3c5c8feb129a6850f9afd7dc20d183e9dab25402c2a59e6b36e13b4675890bf0f53060983c4aa70db2324a5c2e4dd98f43eaf63c650f1d903217

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Low\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Stucco.gif.RYK

MD5 0a1f4bee60dc7e2021fb69a410ff667d
SHA1 1a4dedad561c4952e2e580a76fa1158c005a494f
SHA256 7a15a77ddcc304eff1c168e7ce1318f13d68533dff73b3bb1c4f5ccafa4e75f3
SHA512 9c8c2e954ee96a9bb867ce190c30bbb14b5c1994ae97c7c59c10e1751eda1132e9eb491b26b052f321edc4b68570238fedd703d7809dd8364dfdd458993ea7fb

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.RYK

MD5 59fbcdb0024c8e2391b8c165bc9b4602
SHA1 bcdd72088848db88d334d078ae06079f98f70350
SHA256 63bb25f0bb1ac1c53ef312ca2739fbd1f08a0a42d89ea9f3e10beaf77f370dcf
SHA512 6924b682f694c453e74f96bd1eb04f2dd2c9e84534600e0cbc9cbcca287ab894b99a195076b9b51ed2710f2d74ae29eb8a451670743214cafcd29840c592ae47

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg.RYK

MD5 46e3d5b882d719513efa05529656ec63
SHA1 6d6ab8f9ede50aff4c68faf9c090a331620b22c2
SHA256 ef4efde94e6834569732cac6a0427574c294e2688d0bae294e870e086cf5bd3b
SHA512 2fb2987b402203b40d19b290f950a92822b8e0af67c6cffc270f1730c3f3337e27ee8358d7d27b8e8817b3b04eb5f4fe06afd91cc476553339b554d50dd835d3

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.RYK

MD5 4313ffba6986f60412450d99fb933179
SHA1 b3b1b4ba135aa1b5aeb0948deca7517e383a3fc6
SHA256 fc7f57e9efd2a36d8285c78520a9e1ea1ddc8dcb49d58f20f827ae11be2245bf
SHA512 77b6bf2b39d4e097bb57d5630fe76995ab1e8fb0751b2bf6d53143e92b339bc6dc7948619f5052d0bccf6a13258e5098a1d1ece5393be67225e91a5d7f55b110

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Month_Calendar.emf.RYK

MD5 d18f242cc48ce95503bdfd414c34ada3
SHA1 f8317ff492a0ab2e544571e02b507a169f4f83da
SHA256 69392143c5d19303fb49dd37aa198b99901fbaa81ae840ed5e7164044f51f57f
SHA512 85b6b32bd8d815327b16fc5adb18aabccbe496bbb2c67e7b8909b41f5576fd544bd6cc2cb66519da93660e49889cbc779fa124796d9deb1ef2078b728d0fabd6

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Hand Prints.htm.RYK

MD5 7d66ab8017d74f05dc10fc96340424c6
SHA1 3e6bac021cc45cf7d91d0b7bf94998f2377f2e79
SHA256 4e2fbd345bd2cd575a4bf0109ff666ffdc20077ad7e669b5b6d1d657b8340d52
SHA512 317e7d761b20c5b3c5e2b4b5577466b2afa5b88331dcc79c00fab82da11c4abb06f442b64ab58238a26501b82f3f35deff3b088371f5280607b4296f6d60d4c5

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\grid_(cm).wmf.RYK

MD5 5af15615bb69cf87bcffe3e322ad560a
SHA1 9ba957b91dcb949ca93710b7e0557fe2bfcec3b9
SHA256 15b9c560a63bc78b1a8ba2c78af2bff053fea4d358eff3a3d92c4dc8e290b6f1
SHA512 c145b6847cc1ab771fbbed8a43b97f488ee1e1626ba845d386413baa7c155bbc55c16d0bc4faae6d6dc9a958081557ccaf3a6e8b8b335790708d238b0e0c7975

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Genko_2.emf.RYK

MD5 6a36af287818809eaae3993b3afc7759
SHA1 629554f0f8ea3a1a3ea4e87e54865bbc83350a3d
SHA256 952871ed428bd4bc7d62f7b59d7c9d78480cb27e7721e76e15f910bf6dc765c0
SHA512 42633f37bbaa0cd429b2bf5fe848d4b21583d52db638e2142f77cedfa353b2370ff52238735047b1272ff72cfc254718ac08cdf6b1077454d48d10dacde41f78

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg.RYK

MD5 c5f452687a25249685ad8a78c51e36e8
SHA1 392b7975a2b368aee3966ea843a526c0e34e6d87
SHA256 26f97e9c04788bf95ebb1449224716843186ab5cc5a5aeb1625aff0af8276e78
SHA512 6e7983a1e51f478ce92a91ad305bc133e018ae7756753d57e43495645c002bfd3b22a10f4596adf3e889ed0abc9c9de3440ebad1f19108a3900c7f97e4883a23

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Dotted_Lines.emf.RYK

MD5 965b5f152ecf5d01f7a995b6ff6e79f0
SHA1 430efca3cc8175909ebd57949bae734f0835dbe4
SHA256 a4076ce40639bb64b15e4bdd43eefe173a57151b475f736b73c9d885a3da6c1d
SHA512 40c70a59b51974198857cbde3b73d432df30f944839ca5b06814f8d8ea4208d7b55e4b27ef4c0acaa016ff48146744525d23bba99f05a0377725a148e1ebb182

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4EA35C23-486D-11EE-A617-EEDB236BE57B}.dat_Peacock.jpg.RYK.RYK

MD5 e40ee5623d7c3b32a4e79cefbdaffdf0
SHA1 3a7d7f65818ebb13f2708916abcb76b71f1f81ef
SHA256 ec2a5099e3aa60758d508089a99dbf11316bea63108ccee61b2dc3efb43055a0
SHA512 9f1c6597f9a4a63b16459517de32b1708d5e530ee2a6b6eceb4d738a026fa153556be01da06029d43ab5a61325d8d0edf111b0bf865acd99f30485eea6d710cd

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{07765EA0-4869-11EE-BEE3-62B3D3F2749B}.datRYK.RYK

MD5 849ec597d89b4f4f1632fc94c1bc176a
SHA1 106663dc2d168e552252f14a434c9f7379857f84
SHA256 0296981cc31d6ed9fd1a17653e99fb78998fa075f5468bc3707c2306a46aaa96
SHA512 586b1d4da917d05c7aee7a70755718a15b72de89bdd9c3793337fdd2806cf179e5af91f9e4e1db2c4d6b58cfbab41fb8092f401e123c2cd18d89b399c2fc81b6

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00008526\08_Video_rated_at_4_or_5_stars.wpl.RYK

MD5 7a994a479d25e3b6108332c4055ff595
SHA1 64934b95e921488931f425661d8d1722075971e6
SHA256 eca285bf1eb9b807f5d99daf22fde80658396087cf05499f0437c6727bd3dbb5
SHA512 4fb883176bee5015a4320e37871b575a830875a06894e177fdd9662ed001430127a280a27f0c3160ec8c0a3385e4ea1bcfe63fa6d473d1424484e7bc897c6f10

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Shorthand.emf.RYK

MD5 be925dffbc2df67984266ac227ad01c7
SHA1 8cbac9c64a7463a1cd8175e43963a5ef992f303b
SHA256 96abf29d67afd7d81ef118b1f2c6c0437b45d9cd3b0e4fd33ea84a0b3084cb0a
SHA512 3b4a0909ed95c202ace42425e33a6b97b2ca05e283f194f1416086965c4f7e4fb48f1067597e2b2eb832dec0fe7f359f1e16bb50b6799b1f9b40e4ea320a888a

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg.RYK

MD5 5d6749d212e1b0c41dcfc6411bfaaf10
SHA1 42539a0ac4496360597a2b70e41bf06aa0854545
SHA256 d4b4bb895993cf248325c545fcad73ba00d9105bb30376251786a0144833a61d
SHA512 eb842b920de13d300db7eaaf134c1e9c4d66cfd1bc798632af30606479b120881664f22a71e0877a5fb8c868963e013216d79b76f9d9c9fd9fb67c50daedf04f

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00008526\03_Music_rated_at_4_or_5_stars.wpl.RYK

MD5 c6d254e7c7933126a04907a05e3d4799
SHA1 de9e4d6a5f515a17a04dc02e3dd3a6ac1d2b0075
SHA256 22024ba2c3b2768b448481fec2f9b35edee0e68b46912de378539cc864257015
SHA512 12fc9edd9ee267c8be00dd5df2d59b9cf25997adc1a022ee9c675d0959dc32ca8bc13c23538d027242af85a3bcd94874320c7e2e2553b22f361c127e9bc4d939

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00008526\09_Music_played_the_most.wpl.RYK

MD5 7b67d4fbb975b18a0c6004b549a5deff
SHA1 9747bdb6ba71425a3d422becac6f482b24acebfa
SHA256 3bbc8fda50f243ac7274b8e8d7dc4cafa147b1c350398605dae14b0a798df83e
SHA512 4347577ae5c7d72c97676223594259c086afecb8ae7d2c0874758ea104b21017f4e7adbae248901221cbf42086b4b57020a392daeca031eb084ec8e044769c36

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\account{72ABF4C8-5198-4CB8-973A-28AB123CE9B9}.oeaccount.RYK

MD5 a4a15f80dffd61466fddef3041ea55d8
SHA1 009b749044051c2f2cecd36c329a7c59116f57ec
SHA256 51a8906bdeaf5caa9828bf186820c8ee9280796a9a15e988e174b4f47a0d3740
SHA512 ef6ba9f17dd03e4ca0f02b629ed112a1542e134a75e497c28b7ab720234d2e4ae0fae76a98d152fff6cb528e9170f70280c1417cb8a09f05253dad7f6c9974ec

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00008526\06_Pictures_rated_4_or_5_stars.wpl.RYK

MD5 89662c30b9a3f3d3f44b9096f6155919
SHA1 ae1bc3d94d309de64802a04d6103076377ced0b1
SHA256 0cd0daa9fb746205623d89212ed22ef16e0f55001e8ce9eb9700e3f3df3fc775
SHA512 e09b247c32fddc3d086ae94ab09fa67de67f7b7996b7e1b98120d6468a738ee2ef387f1b25743e3fe71fec71ab3242ec8e1ab95b510c3242c630fec12e01a3a8

C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20230901_012943179-MSI_netfx_Full_x64.msi.txt.RYK

MD5 73d071fb5ee21ab188052f100f60134a
SHA1 4a51f302a945fd9b3eee120c16f57aad4ac2e71a
SHA256 6d757aaec12cfb33900371498d1b19a0754cbbce8a8f573c35033a550d578756
SHA512 9423e5981f5f5331a17b53a49a82721260ce98e16fd0ec55bd3e4e3303a4b4c1502c2bd8e3cd7d1a21e3f870658c85897c72cb193d0e2c6168efb4370ad47469

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\account{335D35EF-6326-4566-9533-4B1C895AD143}.oeaccount.RYK

MD5 0ebd1d1d3f4401d815f3b1689e2b99cb
SHA1 6305c6c7231476dc04c2b5e85edd956a71d5fc60
SHA256 d4dba5f694378f07a5cb3d8dead80bf03140410a08de3715d9e016206e45f4d4
SHA512 83fcd14ec61725705b8920249ee6a71f6ea1ca5d93687d881b9eadcb6a0731042211a5c721f09a508378c7e5c03db530f29444b58a0839610cea91f274cb4a11

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00008526\07_TV_recorded_in_the_last_week.wpl.RYK

MD5 a3c575669c287e5b20d814fe82f5ea6c
SHA1 817a97746c587726913524ef0af566353afc694c
SHA256 6bef9815cd8c6725bcd38497450337c7cdbf43bf64d9aedf3914b0ae8994e2ec
SHA512 915986eb95b4c84a712c071ddd52dcf8deed2e79e768ec42ecbffde6e218c969c18e4411b2db06f0a2e02a06264d816b4c1f9e01650a764679a6596331763cff

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00008526\01_Music_auto_rated_at_5_stars.wpl.RYK

MD5 0b5c27c7c06694d6fd050b96945443a1
SHA1 a268cdb452b1b94e0870d9c91d75dc3dfd35ddf5
SHA256 d2439e98614355bf59db49ee2a1dfd1d25df974f6b27927f90e45a1a6d333a6a
SHA512 4a10d030a0eff06fd48a98f1832f6eea113d14e3eca17c64b0ac0775b657c92f0cb5103a63de133e883aede0948e46c8d8f62313d18df3cd7a300f0c859db8f9

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00008526\04_Music_played_in_the_last_month.wpl.RYK

MD5 8d8986cc638a44bd4663d1360b9e3e1c
SHA1 ae8d65a332f981e58c1ef24b044a41eeaefff44e
SHA256 d5486dea9e11ad38e472b2c1ed0a272eb1c2d12d04524f2507e3ad8f521043aa
SHA512 4d7201acf4b0ae84bfc3f3337f95e22e775cbb9f7040da8bc1d75471033a4cf135bffc65253ef02ad6e03cffc7d8af3a7a8dbe32c165fa97a8f1eb5f0962b263

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00008526\02_Music_added_in_the_last_month.wpl.RYK

MD5 c3c97e3a80720395c9d1d12fdf622011
SHA1 8f2d1b6e0dc7d0666c8fb7b74bfcfaff1c1972e8
SHA256 8773414635eece88147a115dc68ebf9d929c5b531a4d5aeb33a4dff160e920df
SHA512 50273b6eee2ad0909a4fea452e8237b6df0420a3c8012815b1e538e68251e4cc8551509119875ec6a799eaaf68591cb36a3cd474cef771beba84e1007f0c18d0

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4EA35C21-486D-11EE-A617-EEDB236BE57B}.dat.RYK

MD5 8eb7f3b2ae8a2c7aa8c5d9815870f01b
SHA1 fa2ff88bf68d0a275106e43ec7e63261b1c19d60
SHA256 2e6dac2b69660a02571e589cd8440730035c8598593986b27e530404a78e6979
SHA512 6b9f5aa6984661720f9b83f559fa55ef0fc8b030aff34e0fb5e34e02ab2e32aa00e6d9e62f065d2520b9490b6a7b71a3ba3cf55a642fdc2a2dc523217c46a398

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\account{A0C4FEDC-1D79-4DB1-AF15-B1B38ABA0529}.oeaccount.RYK

MD5 c7ece2229e210bff7960c1db7467e7cf
SHA1 de938aae16820a68e36b08a39c5776c49101b67c
SHA256 a26615175bd67ff587c23863880b418f037e3d43d7ee7cadcd6cbe1b23a8e805
SHA512 f6b0051b544b2e7682819da820ec8155a2a2c180d132846725acd0c7961e351942fb10f6d017eb524810084a4bdf8102969698205084b6bd5d72ec1f131ca1ca

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RGI2D48.tmp-tmp.RYK

MD5 1ea3502efecce6413525e9c8304539d0
SHA1 d9f7b9bd476f15b526f1483c635f836108f2d53e
SHA256 902fea5dd74e877ca0009072539b030997fcba6908a47c6789e1bfa3e96b23bc
SHA512 3f2acaa7ec896ee6ab68256a2c3207113215a0c864e76b31f3adadc410a57da2f5de1a10f26f1be3678c2bb2b2e735718ba65670b022f9912b304246ed2da5ca

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RGI2D48.tmp.RYK

MD5 4e8cb282396ba7be0384198db04bb15c
SHA1 2dfb98684b974d593284028003e965aaad3d9f34
SHA256 e0ef7075b998d91a64b53925ea2c25e67a2546dae056fc7832a7cd3f6e57eef4
SHA512 4e8fc03afbd4f37d1a6a8521c43b1b33dc3997e18505f5186fc64e689ed6b2ca5fd8f529b8da8ed24beb92e5a391bfd0b6f6bf5713fc32ef9208678bbb8b3b0c

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wmsetup.log.RYK

MD5 29951c0e43a3d38dca1f3e8a43506397
SHA1 e53bd633798b4ca5f4b549eeeb3169b5238345b7
SHA256 05f571453735acee3084636f7eda8b644f1628555bfe64fe3c5f62160b1d6e8a
SHA512 25b83b85dfb6d836f5202f6920c9414deeb77e91fb5302ab277cd5cc01b5b0ea795162cd73e1ce079f760d3a09f64aba6c60d3086a7ef8d7c044043e05990daf

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK

MD5 d1e38581f373806737555691594bbbbf
SHA1 cd9130bde3bd86ce73cac1c294c9f19cc50bfdad
SHA256 5bd6f49b877c419252c32e49627e304c31b22861332b83828f84b63b07fcfcdc
SHA512 57c97e757bd41748aa04fcce11e6b80209fe5505b4d16696a4d1a27ac9c1c7cfab43e7984776b28ff6f74e781d942da226e7b8c1270dcfecc8f00788a0017baa

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.bak.RYK

MD5 4d69ee2609e52b7f43b76df5d024d716
SHA1 31614b40971047b9949dca43ac7602b64c6183d3
SHA256 63c4291745c7a24be0c2a2de71dcd7745de2a7823350fcf058f0a9c76178f0e4
SHA512 fcd3c0c0e3b5c9cda0d0a568b6cf8bcbe04a7391ad292cc81fe73bce56fde46d656a4bdb61a7514d3234b442ce1493a48a8780baa7b41a9e3b17949d50a7e2fc

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.RYK

MD5 532a6280f104b7e8b98b1f1801ac27fd
SHA1 0aaea2a596efffde1ca7cec8c79861f03044be56
SHA256 a3afafb4d0e305ed4c5bc5f422cfe612ff3a630e411855f187a0978ffe1527b2
SHA512 8eccac0ac91fbb63d03138b6c26d07986fc8369bd680d53d64c3fbf02756b100f98c7d0dd7788b3df61451068a9e2d05e4c2e9d0a6616b4ffa89493b32449f70

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\LocalMLS_3.wmdb.RYK

MD5 70cdc3aade27242e92795e29b0a7f833
SHA1 5689f34f84876ce8c4bb8bb72790845a8cd711b3
SHA256 f3baaea22cc7c2b1a2aac88c6752a05b743c478d6e09335c6fceb673acfea602
SHA512 e3ae753940c14629924baa53c4ca6b5886f2fc8136d509d62db316b6dbc0b733e8dcee6a7a865f1a965dc0b51ca38cdabd947613166be3664693cabc5474f3a6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WebCache\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\PlayReady\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.chk.RYK

MD5 8fb9663f308d9eb880057a938cfd44ce
SHA1 42259df865f5f42749961b0f050484441959dda9
SHA256 626276a36b7994c1de109311a692ce78c40eecec79ff95a03ce40b39beb0dba4
SHA512 5a70a6fa482db9ebb5e46807419a9e33049a9c04872c5463189c2f41adfa9dd53840176156798e69e602b929af6b9b32eb8471418e9e7b06c887f2b1526036ab

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.log.RYK

MD5 c4b328747b95844e33df7a8811467e33
SHA1 35048a1680c00976c81bfee755db275c85e3032d
SHA256 8e15cfbb801a955c45379aec9da60ca74ccdaf2f721ccd1bea1a3f31227bd3d5
SHA512 4c8bb2eef4ad7f6172057b84da2721ad37db03c555e85e8629bb818527a4ba749b01d390fc0a00b1d8d3c7cf7725c90139052a0f77fb7abd6840dff0a00e985f

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb00001.log.RYK

MD5 515319df27dc100dbf947550ff73c723
SHA1 4935f633abdac6a671b826a7b3a2ea9cd1d90194
SHA256 49f7e957b2115fe3980b37a965f3d5f43b2e26e1919b56ec109f62d60422508a
SHA512 80932b0a28baa7bf373d80c2540c82e4a55813c7cb18247193a6831c1d610d077b4776a8b261fb9a1b66eb536fe394c30a43d70065bd7acd26d33126d44ed12e

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00001.jrs.RYK

MD5 1b6e99ff247c3ac97d8f1fe6200bf6ea
SHA1 69c1dcb4cb3dd6fde304fc1fc76a93390db42b66
SHA256 eae6cff603b17a0da8c9a183a499a5378932643bceac500bf00df9521b348801
SHA512 5f5fdc300fbe9d521f7d0eba92efcd4f488aabbaf3407619cb3f662d20a113d2445ce495b05cfc3975d53ca341fab85ee23bcb3cee4c050d18ecd289b49cf968

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00002.jrs.RYK

MD5 6a9be6890a95f95c7b038a7945dcc3e0
SHA1 333b56b80c1ae74da1beddc710e046fe5f777c14
SHA256 a0dcd77dc0410b114570798de268fd5dec7b40aea4210845d2e16dc89092e112
SHA512 0d9fb34ca448981f134a9fbcde729ca1fda1ef80deaaf95161278f0948f42f9e87f01dc5592c4ac97b539466e1e1d48b5afbc312ec62c10462617d722c813bcb

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\oeold.xml.RYK

MD5 26e25c35b9ebbf787c3e244d9ceaf2a9
SHA1 b816c3f90243aa420676fbcaf74b85831652f744
SHA256 8b632b7371aaf78b27525a54f92cd60ee209bbad6cbd966563a02d4ee0e00c4c
SHA512 fe1238fd9949f3f367408aea7206ffc925a8dddd53ac2036972e7a586bcb9ad3b1536b17d8de157362859d04cc374b3a443f43433efe5ebd55d094ebc1bc47b1

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\WindowsMail.pat.RYK

MD5 0e20485e55ec094b365114fbd90752b8
SHA1 b4485d871728428a632d9afb3b42febe93ad0222
SHA256 8bb533b40772d3a63d4046625e46e740dd9ecb00cac906196c07ec0e6b0dee60
SHA512 83db9db5f5e6f49e5d83e2e97cefe7f04427546808b8eafc2472de6e435575662ad41496607e43db6b34f27ad442acd7b5fa4db0766726a1c88bf0a7599d06dc

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\3108930468\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft Help\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ASPNETSetup_00000.log.RYK

MD5 a3db951724f96acc1d6f0a4382b5442f
SHA1 2dfc76a74c1081916797136d0b42095b4f842673
SHA256 b05ab870443c2572f51da0d26eeb0a9a5f28dca358b1ca8a2f3857a17c486568
SHA512 0afd5be9bf3c590456051654dde96de08f163aa27937c5d2b01c8c735e3126392a303c310ad695b16573ff6f738c208b662c5d6f0cbdae0dca4a40d60c7b9ab1

C:\Users\Admin\AppData\Roaming\UndoAssert.001.RYK

MD5 26e4fa96bd33e44725bccbdcfb36acbf
SHA1 963c133d42eb33ff378c64d703a945336526f43f
SHA256 27e32b9a9a595c2022faa96059576b599cd47170a4b9302664bc2ff192901cd9
SHA512 094b17f02f9fa8f48b53f382d4f728c75263c4a0ddee4044783a023b3e40dc1001e3f4cbe20488167520839d343adb0e33d7eacb6294dd370a11809d5fed8445

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ASPNETSetup_00001.log.RYK

MD5 26dc20b3aa46f12239b31eff33a4f709
SHA1 e873f7fe5ced5aa022a9b0d759b251011ddb4bab
SHA256 7e5f485a37b82f8995803f099b88797c19bfee2ecaf585261d0f576227d8b88f
SHA512 1526891d255335fa4e88bc84131974e47b82761054f8ddf589adbcbdb7449d5c78ee1cee6480d68a549e8b60ff1c6ff613adb9eb057023f8b49606edfcadb655

C:\Users\Admin\Music\ApproveRegister.xlt.RYK

MD5 59e862b1b644841653af9cb1b9a1ab50
SHA1 561a180c0ef8b316e71bca37b78f4fb7392f083b
SHA256 129677273a68dfdab1ed9e8dca2d5472194eef72999994eda0b9d8cb68bdc6df
SHA512 ce380037f5cf97219d4fe6e94c58d64f58873ac988f6159ceaae512951d7678682f76fc0bd32a57288644a0191ab38a2e434cb4d0f5844f9e9239ab16b648cad

C:\Users\Admin\Music\ConvertExpand.shtml.RYK

MD5 23ad7d282e07ce1d19e894ecb673a672
SHA1 0f64557a482a827505500c47498261f72cd5bb7d
SHA256 c6786e1751c5606504a4511febc9bbe22bcb638dc47fab9c886a711851235762
SHA512 2d3443c756a811c575a9f79a186f7dd5289f4fe394c72bad078c65e367c424d062a6503f5db89fdf8ed0c226032e162d1786dece061b70a0aee65af51d6e05d3

C:\Users\Admin\Music\ConvertMove.3g2.RYK

MD5 d2a17ddae2a3cff985993def4aa46129
SHA1 a2c0fb7eb68e358a9068640a753cf92e858a2094
SHA256 5fedd36cb73350aefd0938abb0eb81b0cee70077d58e2699c9c4dcdb075e1eb9
SHA512 60d19ced70f3b9cfccd34df535880d6b36d5102cd165e7fb6909e66449178816bd395f1ad5eaf0b78abfa48a4fbe8509b7056a19124555410ceb0f82945fd7d8

C:\Users\Admin\Music\DismountConnect.mov.RYK

MD5 53e3b56d92fc818a7f407dd492b9ab74
SHA1 43424c03dbe7736a7aee4e7d9aa5aceddae9f97b
SHA256 690707355e8cc93c05c96d7a0ad135883b8d6fa2670c1ff2ce453c371c9954d9
SHA512 a3687dca58272e1389f0045635719facf5586c3e83025ae90d9ca57669a7df6da9d90efa7f55810beb7895b92e79b4b643c2ba0711d27e33f167a879e77e1712

C:\Users\Admin\Music\MountConvert.wps.RYK

MD5 bc534134e43e1222058a147e72fea28d
SHA1 3c127f61c120f1101d8351a977354541c259a253
SHA256 87e34a56cdabc51f88fae223b195c87b49e7900b934598e9eee62db071bacf55
SHA512 9456196871d980d9025086633af872239daa7188cabfce542f3ae73e00400948b3a7f71482ba0d698fb2664f6ee3479567e920deecbbbf747feaf328ed026c9b

C:\Users\Admin\Music\SubmitNew.dot.RYK

MD5 e0b575be2661d5fb09ee37af4630fc7e
SHA1 02cf940f06a1f79d8cf394f17c3c7e12fe14d002
SHA256 dc6a5b7c803346a150587a7cc9e39e4e45013cf6c1a4a939a21782252db113a4
SHA512 12c230f96409efc6a76ee483cd7c606cc4842acbe4c9e7e01d6082ebb71527b77232db992e6d2f8f5a06edd6ef9f78f45d37af0d52f9a778d4f44e7eb237672e

C:\Users\Admin\Music\EditEnter.vsdx.RYK

MD5 69d125e224f04482ef7362993546f155
SHA1 71f8a0a15ec873d1bd505068848db6a54fe2bd40
SHA256 2c591072a231cd3f7a50b5052db8d0a077444b81d6f05a318727c90b4a93211d
SHA512 00475c6f82393716e611b688b455b221a6c9c4063ec81bd63292d555f045fd141dfdde496f4ff0a758365260d7438406001b4c9b379d816d70944858086e8d05

C:\Users\Admin\Music\UnblockClear.tmp.RYK

MD5 2f22fec5f3d533a0dfb905e792a7580c
SHA1 edd09e70adf024b226df53ed0680673266227ce7
SHA256 581b9260b3cdc14bbcf7e5be6f7f12e10aca8761cc30384a889718b9b4649bc8
SHA512 042b7d01261de485a64f3b95ee218ec398f106351396db7a6cd2c7e8d21ca0f0026d5884c72e57cbdfee05035d610af490f2414c1f51349b223ce016b0fb5da9

C:\Users\Admin\Music\SkipFormat.xps.RYK

MD5 3a0690ea624f5c702f4f98f6337b2f40
SHA1 37976d9aca55865827a970580525dc4aaa9f8336
SHA256 dfad288a3f5e569f3fee616331f2592d603e5651ccdf445e78f25c3964a1f9ba
SHA512 3749eaf075f5818c03e59dee7b6acfa6ac10abbd5581782bebea91471f55219fc4f81e18bafa0046c95e4ae1170a3a03bb77ab7d2df11eccaca04562eda39338

C:\Users\Admin\Music\RepairSend.odp.RYK

MD5 914688eaec8c65ac5e5df43aec026b16
SHA1 80fde7c8508378216b5e8fe642a6838a6c9310f7
SHA256 93af6c23779218ad5648a186ecfad9f719badd9d2d16798f05f8b11105a90cbe
SHA512 77a86dc3bc2ebb1c249e67307018b13aaa52b3abe4042610461992daeb4da6bd76cab3b939b98cdd454e944e36efc0c44312d0e583de1536d98db49dc7c33b5d

C:\Users\Admin\Music\RemoveUnregister.rmi.RYK

MD5 da4a8c37d699af4421e860237f44f625
SHA1 26dd748b35d5c7c86d8c45d87cf48a643bdeaa31
SHA256 0778bcdb19759e2df11cd83ad115346b2a1a8991d721be61d7457b3dd2e9f235
SHA512 45c122eb87a33bf4691087f757b3745db04faa6d4c49ebb67b4b4a038fff21d74d21f9090ccac5a2230bd9bfaebfb7c8bdf8a0c00da99c38ec9dfcbc1fd9517a

C:\Users\Admin\Music\ReceiveConvertTo.mpa.RYK

MD5 104a9fa83c3f05db9d288426df135553
SHA1 ccaa1a87cf6eb169c52e4880ef13bf2963a5590b
SHA256 0a839987b6356e44fc2faf50ab7490f55a6d2ea1fbe9747bf1e58bf3fde410cd
SHA512 4cc4f25fd6858afdc09a579638286d6153742e70d20ce1aae55a8185c642bab173557319ab7d80f6b320547c6769a82740e5e886483398dbfe9721c9f4ad9908

C:\Users\Admin\Music\PopSearch.ppt.RYK

MD5 7da950251888ccd84bdb747d8f117695
SHA1 20df838642214a29f4ca17928cec4a9bd19e1218
SHA256 ccec920e8d050eddbd3d350c67464a534e2c899c7b16df756b019c527dc3afc1
SHA512 d5bc8e8ec3766d3931799b12a177eefdb51db5dd2bcd887898c2c2ec2c03d1423e9daabb88eb7b746e1a59f7477f71fb908d43c5a20cb98155e2cc8bebbcdb0f

C:\Users\Admin\Music\HideConvertTo.midi.RYK

MD5 1a26730fec459a80a87eca36383acc1b
SHA1 3ce1bb3c08d28d4f8ddde89275c947a6cc1e469b
SHA256 d80c0103b39fc79fe946df987252f3f595476d858ce9052c292ba621eecbea7f
SHA512 785101342fc6bf2dabeb9dadc9007a6fb5416ab1359b9fbdfea81052d5b4823deb8c4a0159c40d7bb8fb518632559749ecd057b4ffddd4ab9b91e9e4449bb7c7

C:\Users\Admin\Music\EnableDisconnect.vstx.RYK

MD5 789ef63f3154c3a93c61831dd5e813aa
SHA1 638f188545561bd4842666cde0a8db32f980525b
SHA256 0410ae8d4ecc8ecb1ac9e716c6de5ba7cdde62fde46dde019edc9d38b62dec96
SHA512 c492a09d92f4dc291fca2062fc3740b0f3e91ca3f671439911745e91b035149a770d4e37d5131820423ccf3f255474a49f0d0690707dd04351445cb3c7e333de

C:\Users\Admin\Music\ConvertToDebug.reg.RYK

MD5 f2c3d0cbe6992ddab6102d14ff820867
SHA1 1641b81ae350ff574cbabc879c6ee2f580f64e63
SHA256 fb7f575c48b6be9010a16228597cd73a724c25ac902a19d52a54943500ed5dc6
SHA512 b8f4c070c51c50560e60b9aa517da87fb93ba8b0e78c2f50c67098b0269a2f2db24be25dbf9f5fe849a9634d9d43f4d7a97964b068aae07e027a26a8b27644a5

C:\Users\Admin\Pictures\RestartImport.ico.RYK

MD5 d15ed76e2c321e2501a27307f65e1452
SHA1 6b0a3e53437d0363c2c5dbcc36aec60e8c4e3f6f
SHA256 530fde30c199bfdeaa577ef931dea715fde8410d6e723040a672b009bb1e9dc0
SHA512 a81312d133b0d5aef9c5a00a946d9271ba7093eaa3197d4019eeb628c2ee7626bb69facb9ecb3a27be7325f90cf33d7347b756e2af3718a867773647283d2a43

C:\Users\Admin\Pictures\UnpublishUnprotect.eps.RYK

MD5 7c34562614bf3687e8696b9244395ada
SHA1 f075f51b67358c785483a659921d40a3c9848155
SHA256 acc326e74508a986ef93a653404c024389e38012afe0c9144ba331f150f7c7cd
SHA512 ce6044c522a9180a21f1c38bbe3e15b6635039fb6770b1cdd7966f5d0b34309503904c6fd6ea0398cd21d6ae9d2a369e93ee83b14e4de4b0a5aa4f414ac500e7

C:\Users\Admin\Pictures\SearchRevoke.tif.RYK

MD5 f6032e6802920033a6f2376f02d3a9cb
SHA1 e3b8ebb020e0435fbff5f15074c89b3e8c50076a
SHA256 fc4d8775fef65a6e19e494b1aa6968062bd579e034936cb074841e346914f5d6
SHA512 6fd5d94d1b539746b5f3c7d3f9b30b3f3f91cf1389527deb4ec4805b012a4b47ac0a6df0bf9f49ebea68d8179dc351cb7d8c6031e532cc960d90f7f9b1f6cc39

C:\Users\Admin\Pictures\UpdateWrite.ico.RYK

MD5 e9af1a1b5ffc3766110c065bba3b8f5c
SHA1 be5aed4784cf4fca4fe5ec9e3042c87bc4974e69
SHA256 f3f459b225bb8d296914aff6711dd57788108a77abac58876aff9bfecf745098
SHA512 3a0bb3fa34d5d253b27167a6c32c6e047cfffceecb2f6b8dd9ebd2e9f414af313890d4f3da625b5aec87c87e5c2a6ab1b33f81341e20bbcaf44a8fdff20a92d5

C:\Users\Admin\Pictures\StepSuspend.jpeg.RYK

MD5 11263b767f2901818f24e48ef6d4225b
SHA1 29b2dd042a735e34c78c44504b1c40a3d056e361
SHA256 939aa98a0fc320e0d5b781957a622137147504b5ad9847d217ea4d1431a7719e
SHA512 679207cfe0ac4a28bad7344e3b0a065322fed25dbddeee60f890df69089aa9a1514f66f2e26131d17bbf93ac9c8302a468b5492b77aaa7ebec7414d1855b0ab3

C:\Users\Admin\Pictures\RestoreGroup.bmp.RYK

MD5 d1c4075b374c18edcff0361578fc048b
SHA1 982a0f39241f0571c07f209d2804a6d0c0ef2f58
SHA256 3864bcf56bf37736dfec294a3ee4326071ef72543b63186fd478c1df501876c8
SHA512 2407d0440daafb55930162837c24741c898517b42b231e713241d1aaba8355c3a8afabc0601bed07a53a6836148e89ebe41163c029d8f9cfb362cf783d28b0d8

C:\Users\Admin\Pictures\RequestSync.emz.RYK

MD5 4f6e6c62dc1e65fc8bd006a09ded153d
SHA1 5d7850001f5500bfec423378068d4b26d28292c9
SHA256 cfcc03f0c64c5f6934485904b1824f3869049e498452132a16ae7792c07a8026
SHA512 09d790f2bb8abd7da031f7106d0bdcd4148ba32fef7d21a1ae19a93dc9d54a2766d0679ce22a0bd7706a6bfe8de1ef2c551298d10dbb5fe28992a7096ea7d5fd

C:\Users\Admin\Pictures\OpenRepair.pcx.RYK

MD5 772538cc6f23835744b48f8b2f3dec6a
SHA1 0ca2a0ff68bf716a19dae05f725ef27f3392b872
SHA256 8302d81cf2baa35ac3e75a5865c56c522ebe11e43a3ab0ebbc626b58511a3952
SHA512 c8dd4fb9b9cd7e4bc48ab55b4aa21732565d5f745ca04188eb28b403107a5cf8e97d757d1849697ea334c0ea52f9f2653da7b2b89ebca0f8f618b6d0ba854a55

C:\Users\Admin\Pictures\MeasureRepair.gif.RYK

MD5 7198ea4189a185b15634a71c2f9030e9
SHA1 f70ad69ce2dbd5b13099485ff243bb9a9463fed0
SHA256 33aa0135012fe52075aff2f73d404b232822bf0b51a5c27e2bcacb336bdff16d
SHA512 f13e4f1e90c578bdd7190313cfb042f9447a2e10b4fdeb0fd861095515296d01d7aa33a334cbabdc8c094061579dce31025beb1d7ce66331e119e3fd1e4d8f5a

C:\Users\Admin\Pictures\LockSync.crw.RYK

MD5 0292e4338374b03cb41e06b7c78938bd
SHA1 eecaf5b1159f40b938c6ddcd6cd31ccbee87e6eb
SHA256 2689d8382a030e6f2664a53867ed7a8fde1fe8dd1e9b07e7bd5d418482740fda
SHA512 973c4cc94560d7a5daf526e25e2a581ad5f07ce0e767bad7bbe691a55d6c3c9dde3101aa4e00bd83008c9d2ad8d950cb9f00a3faaf25000c42f10dbcbc0ec2c2

C:\Users\Admin\Pictures\InstallUse.dxf.RYK

MD5 029ff44ac36e7d142977ecdfe1b9e6e9
SHA1 7fd7252a47f0194afc06ef69e642ceae94a01724
SHA256 7dbbbc8cae89424640a5a5da37a092e2da69b843485e4a3d1e16ca890d2b8e18
SHA512 6fc4ed82971b98bd3e7586cff2f9b89f7401e75a0458d17edb38edef4c7b2edc0578e523329497a7a8a0e27b2d361aca9519408182e1fa3700c3b7cc3c5f822c

C:\Users\Admin\Pictures\ExpandRegister.dxf.RYK

MD5 bf38d10b7676a2b0239735deec2c975a
SHA1 172daaea1c6eca939c97f587c9d452ca6e5da4f6
SHA256 eb5bbc123fb66a4fac71bc7e30f853be8be87938b8f7bf1fef9977ebf6e16ca0
SHA512 e89e7d91f8e683ce9157d46f41a9ba20fa5b2d1902a747a1d6202d5bd636e0df44dbce8a969e5520cd57b932c964357481cacab511420e7d849ca89275b6e818

C:\Users\Admin\Pictures\DisableUse.tiff.RYK

MD5 7dabeaf1675b4655741bd1e4088f1f4d
SHA1 5fac0a43295576b82b47b75fcf197ec5803cca7e
SHA256 03eaffb122a4f3b5e65c77b93362ee912646cb210091368b4a676e2bf0a2e7f9
SHA512 fe8f390c224b903464c74a7fb860d99ca0f977c9af9ea19e94827a6293ddba09e3f7e635b020b916d978dcc05b167aade88b74a9a4875b138be51026afc8e737

C:\Users\Admin\Pictures\ConnectStart.eps.RYK

MD5 a4e2c2ec5c2c3e3416eede7d1aecb877
SHA1 41e0b3153e301c45a84fae250dae7de6203795b2
SHA256 bc7494b40b9ac769adb2fe43e19e5f2beb597836983fbb3958c9f65996b501ad
SHA512 9a0e382f637738207795df51b7781c84f72779887c8e7590e91f18819be4079ba6c7f14403983f942638d436b1f8a66bf54f589c069681929f6fb74953cbf1a2

C:\Users\Admin\Pictures\CheckpointResolve.crw.RYK

MD5 d6ee39157c74785b052a8ff3055f56a9
SHA1 8cd3e849f4098836a2ff412094f00ee1034e533e
SHA256 529d8a8f1d504460f16ed54c26a26cde44cd4a5fc2e2a5779694828c644e04a3
SHA512 7cddf22afe20af7f5750327c895067f9133a4dda7f4fb8eb817093b818c9a7fccd465ceb02bf9acb9a773239bd5c017e00b60b842f278982fc24ec041fa100e7

C:\Users\Admin\Pictures\ApproveInitialize.dib.RYK

MD5 25df3fdde2c11264d44b6032b630a5b7
SHA1 fbe2092c4f6a8ae610954dea2329db7c6d50b394
SHA256 98fc353f5c60583ef0cb7a880c4e4d5ce9d59eff7d27f7c76410e3017934139c
SHA512 28937159fc372b7d590dcec28b742c383553a5d4a98fabf40d4f65f4eebffa014d74a65aecfd129152f8bc71a098f3df8392eab9c7a6ff147efe7dff58062cc2

C:\Users\Admin\Pictures\RemoveResolve.ico.RYK

MD5 3739d5ca33b913e06346c9be58c563dc
SHA1 b75083ebe31d9e6c60bca07cf16dde4ce7cd73cd
SHA256 3810d28e4a8056e3617e46a24231e2b15ccf8556df2316eabc7b7eb73baab95e
SHA512 d694021ed529fe6f5fee101b06692288d2c91565e1a8430a23b1b32bb8313e53d285adf0b824954eac8171c871be7ce304e581c0809ec326ffca8184a923504e

C:\Users\Admin\Pictures\My Wallpaper.jpg.RYK

MD5 22719e333d91d9a166a5817790516003
SHA1 eec28abb9968da23d33d747f5c6c3d7fbb728b62
SHA256 1ccc2482b9b2e648f061c546020ea94621cc82a8062567dd79294c1ad3fe56e0
SHA512 821d0b03a166beca26958ff20c9080c4e88400c26aec8211e62385451b4058ea5cefae778f685d598f003ecaa6076d71ea4f4070bdce0c7115fd8c74ab1de6ae

C:\Users\Admin\Pictures\MeasureClose.dxf.RYK

MD5 7144524bef22cf0b8c0d2c6f7fc62f8f
SHA1 d2aeae166f7c79e5e9433ffd631204f8dc3dc755
SHA256 be09f4b84b2cdf365728d7c8738b9d117aab4bbf34596538db8ed2e825d05c92
SHA512 d809bcb5183384da27a3532e777f20952b53cb105b4830815afc5594dd127f13dce4f99f116bad814ff69d17703feb725aa9754e51e7687dc4e28ed71973c5af

C:\Users\Admin\Pictures\InvokeSave.svgz.RYK

MD5 92473ef9f0ef816f7e80825949142a2a
SHA1 513382d5688e12b67b64b6160bd87af4d5b5e4ff
SHA256 efd252ae7af1f489bac957aa5106580f474b8191f02530801b3b0365d8d4d110
SHA512 44413d93c6590bbbe4f35f30ea3a0dd649c38b35c948578ac704019ddb2e41618cf7d1a38acd7020b8ecc5e06ba5a553e0be45f78464bb458b1cfcd7a613a32e

C:\Users\Admin\Pictures\ImportProtect.tiff.RYK

MD5 cf1832372b3be5ddc57674a5ba22127a
SHA1 3f709716e41dd2cf1e6d353ede9b6d8bfbeb947a
SHA256 03c180215c9f92520afe01eb1ad44b414e41c330a71c717a261836a52f474323
SHA512 9f9f0b012be967960acabb0a23881c05fe37f83e144d0c2ec06da67bf607cdce17b74bf956f9411ca3957d1a3fa5d31b6e91cb478243c5739fbc9e4937fb8d4f

C:\Users\Admin\Pictures\EnterRead.svgz.RYK

MD5 fe6e18dd7efdf0e97fc88293005878b8
SHA1 1db36f5a60fc6485976d9f5fb923086f34b6f426
SHA256 0d14c824a536d9dbed71355b79142b3b9b6146a219113afe9add09d8a2257009
SHA512 d00eaac6652425866e3a62d425a92b150edff67eeb85c29321d3f4bd6f97e87a55713babeb062a99fbd7e3d7bcb56b8e45cb5f6bc84dc65adc073383e431f474

C:\Users\Admin\Pictures\DebugRead.wmf.RYK

MD5 62bc9c16d91c41dce4510040e0cfa1b8
SHA1 713f546f50df3bdfd75d6729c74625db12dee592
SHA256 96008413d5b20c0094c7b70868703f98998df9b912f8a91a886d57b80fa4c169
SHA512 ffde0a131974b21466eac3a8a3a4a906ba586a5b2c7b9c2d4d5df74ae1b3e2ae796aa4d4bb37f2ba93d793d9bfe187320cf257b0402ceaa8ec62c5478bb534bc

C:\Users\Admin\Pictures\CompressSync.pcx.RYK

MD5 07029b2e9d6ecf5d33a79081f572ab5a
SHA1 c0eceda1afea735c37b4ae08019764bf120b6f7f
SHA256 50a57df8a943ce23cbd49c1b141067072c15a860530be8010d71a55aae5d2d94
SHA512 1a6759350dc6421f303b9cd56c424b6c65f83a03f78987968af267591040f4949cca41543746b66ab4a33022e85a580ecf88800b08b8ab57c1b2fd575a5395a6

C:\Users\Admin\Pictures\BackupExpand.dxf.RYK

MD5 a8a7d293dd300a9e950cdfd3fdc7cdc0
SHA1 c55acb4152ac172d9f4c32d725ec94b626a128b4
SHA256 13a45e8fd3ff5e04c74d2f5928eab79a8f7c97b1dc92af8b36988df503bab693
SHA512 12e0a8352de7979833ba1484c29abfda3d9938600eab547ee2c2bab2b1bce43ca662522aff6c7cf00a4017dc56dcb2dd012f9bcf73558aab60c43a3fd3ebbeb1

C:\Users\Admin\Music\ConvertFromMount.fon.RYK

MD5 6d7ab7f9aebf4cb14eb341e3cdb1951a
SHA1 a4ea348c0f368026fbb56854c8387486fef3d063
SHA256 b8e998cfacf0bad161d1f3e922e1093098814a22144447320842c5721a71d7a9
SHA512 8b6d369a6dd344131c62ee0046195257d72436446e452ce97c7ead7e9221937cb132bb2a09537bee40005e2eca4107d69b3c0962718be9fd716133659fda5708

C:\Users\Admin\Music\CheckpointRepair.jpg.RYK

MD5 504701b6f0812f22462b272dd7e34ac5
SHA1 28cb96fa9f1f8e32fc8b94cf801d88e3aad3d1d2
SHA256 e821c591121d6a8b39d7a774f07f1869467884857427cf7f14f05ce20d0a5bc8
SHA512 e4d1c6acf065aca6dd9053b3c89e8a9ae7ed1e2fc7a391001a375ba56078c14d4966f825a9cf243d47cbb50b5036a1d1c53c8c9de2d0151d41b39b5a6582d3b8

C:\Users\Admin\Music\UnlockDebug.mht.RYK

MD5 4431b30bb68476449ffa738b7d8650d2
SHA1 732edf60b86bf7c0275999e500b6ecd9ce4eb858
SHA256 ba1cdb8fdd748cbaef12a1e1db2714d26e464d740ba653d92e5937a794aef618
SHA512 c1dfbe5e433e17b63965efd40f6d97341908f04e3ae4162303b10ae84e0926c7315673d247136f726b58fe5cb76f3226a15ec973c759950d4aa2b4904b9900d7

C:\Users\Admin\Music\SelectDebug.svgz.RYK

MD5 df9c034d691afddb6d55a7b63baaeb9d
SHA1 d8ff11354c20ce4cf93b4cdde82b8413628296ca
SHA256 530e2bd78341cd2dfcf1520bae60b40b03693537444947fb573fff349245f6b3
SHA512 c99580193e2ffe42defcde923c4aa017ec6e985780d8c7d37ef79e287b880b8020ea0f9e7c0bcc154a88d53ec60a8c821a8ae804dd909cf1afd7b824042e421e

C:\Users\Admin\Music\RepairHide.cr2.RYK

MD5 35e6dcc979f7189ac7af23381b6c0c7b
SHA1 45eebae92ec541d277e23304cc2b160ff6120af2
SHA256 9f99ed5a3b63e0e104e557ca65f9633eef97c8e920b0eac13e49423657cc057f
SHA512 0993825360aaf7b45d87b89ba9b77312e851cbba6da4317d5650bf03ea48d2e713ba49b9f5e331a9190589e3e119dd8917f9f8eabb9be49b1aef0cc644e905e5

C:\Users\Admin\Music\RemoveCheckpoint.docx.RYK

MD5 f667f487f16f4aac8e75e13cd27768f8
SHA1 05bd8b8c429cbc16977c66580f1a8f49c07b6a1f
SHA256 463e507e5faf705e1ad7796c84fd8a2039234e3b3599e63f039f2dd7a72b30b0
SHA512 c49ae69710b27652cb3c9a1b9f90515fb5887fb8db130cf1fd561f163b22fb44aab3814bb1aa88867b02d4bdacb32c8327c04d9ecd681552c2d28eab9fec3ea0

C:\Users\Admin\Music\PushDebug.mp4.RYK

MD5 a53835723f73227da6c0cb1593e1147a
SHA1 ee20015fc0e7293ede26bb7f87a321a715a6be44
SHA256 b6badb8f41f5a7307461787cd7c3acac4892864ee164861a7b2eda903c12400a
SHA512 e8831e3f195bc06a9868d96e11202bb8ba3352e8c6c75d620272a8b574d0e1c29e3a432a07be569c07cb48d97955595e713181d206713f0109a172ead59344f6

C:\Users\Admin\Music\GrantStep.contact.RYK

MD5 698ea8f653d0fc04163946df1cdc1bcd
SHA1 01f280d45ef070ab8c17b4312e8ee938ec9d6db7
SHA256 e88efd9f6246b5ba3b1a65362650a057ca75b56d35d1792f1aa6321c2387acec
SHA512 335e9044ce21673f101c0c1ade7fdc4a6aea09733c39bd634004501618a382c2b63e959c19604690bcaa3c8687d3b30fd73de95b6e88d298210aa633845af78c

C:\Users\Admin\Music\EnableComplete.WTV.RYK

MD5 33ec610da81db2872178102657f81c33
SHA1 9067d1e0cd32a59bdf298b0d5804eb9958426bc5
SHA256 f87a9c09a0648a99633c8c13735194292aecc0f5890bd93c0272fe3f284633b4
SHA512 4e5fb7da5be79d5bcb9b5bc7151cc8210e1cf73f9db3fc000df9a55850aa3051d3322c2229c568c9108588e747c257de623baeb5890f1b0ed4dd26ae1fad5c9a

C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata.RYK

MD5 5ea5d53df6e38d4246277f91ce84b4ec
SHA1 f90018ca764aaedbd3016e03f8f385f06ba388ab
SHA256 c10cfe5f1a4d63559c59856e086f223d10615b187354c9e9c8b90d6cd805d4d7
SHA512 48c5949151497bb076214f961f1f68dce53c3b1dd0d67a603be30beaa83e5bec2404d7b8570993a9cf3a42925903bc1d289c3e4b9fb11217c9ec66b08c761da6

C:\ProgramData\Adobe\Updater6\AdobeESDGlobalApps.xml.RYK

MD5 44084f307023a2f469039b55c70b8070
SHA1 f53d14b403792494b44c07ab87743f7cb94c9513
SHA256 6021642587d7689d83d9483d9dc30e6132a235a81196d7bf276906a019044d45
SHA512 804b62543a9ec684e2f9f966435fdfda6413d03d331a76bc91d987995bb80cbe0b92ebd1be6c0868e2cda8cd25b2e2f9fd0fbc513a6d9fb7f212a988affb63da

C:\ProgramData\Microsoft\OFFICE\MySharePoints.ico

MD5 aabca14091768595a94d2394b272ac40
SHA1 d83581ddbf41cd759eab8dcdce175c2d04b9e859
SHA256 f86177967b31c5a34f85d6898f34f31afc940532445a84aba9c3fad17ebbd0bb
SHA512 343c38c04b438db7f195a4a22a0e183904b8d7026b6eb9511fd67fb625357f81ada05c65db76e04a0464b88b71b568c9943eee8e25372459a46c4ee207bbbcfe

C:\ProgramData\Microsoft\OFFICE\AssetLibrary.ico

MD5 7fc9768d64365dcab52d861a31dc2b63
SHA1 289e9aba1db8b5dfbdaaaf3a0a4c167ebdb1c4bb
SHA256 562eea831f2fa149f652fce3968ecee28bec53fd6e7e9bd3af860f15ec63d9eb
SHA512 8bcd80bced4313e6a624c5d26425eb1585c4f8d38bf57b0e4eea4535075d57b69473538604bb188c55fce03f5707274be23ed24927eef41608816154d4a3df1a

C:\ProgramData\Microsoft Help\Hx_1033_MKWD_K.HxW

MD5 ea51280845f3865c44721130d311766d
SHA1 de16f7373430e527ff32014d05d156a61b46665f
SHA256 8f04296f4b2cff52e6f7b6545263adfe9158bfe7458755e4720ec34b6ee81ede
SHA512 67332c8b86ce41891969ea9c77c15ebc71e80b0b57e397eddb3cbbc39a857939a9196e7cd1bad8afde8e955ada9017c538b9fba001d3dd036b5d00536eb0f975

C:\ProgramData\Microsoft Help\MS.MSPUB.14.1033.hxn

MD5 6bdde56a70dddd61d460ddde72e34069
SHA1 da2dcf809c0a908e4df16b76508261e5d8055210
SHA256 a1c78dfcac6b71d14ed739776a37c4f0eb9880ac81f731f1462b01181db20c97
SHA512 35b20f2eb0d71044b66d0109058bfea5a3c9469458d7db044810f89da9c421d8c74b7fa0e3c1126123894800c1fb219e99f7dca6cacce86cea14851660d2bf4d

C:\ProgramData\Microsoft Help\MS.GROOVE.14.1033.hxn

MD5 cfc0b917b4d980894ac330e450406367
SHA1 4ae5cd988beb5368b905e15c22cf6099544c3672
SHA256 cdf7bccb34d0193caa480f7da945b0c53913b58a541a8f0fa2bd5b4e35625acf
SHA512 ad78e01fd7f2240be50ac4cc9aff59828aea2daeb96487e4a91e84aae7998753e832c8ef747b8b48033bcfcfcdd5af1e705d63f33d2ad1208bb97e86c89ba02c

C:\ProgramData\Microsoft Help\Hx_1033_MTOC_Hx.HxH

MD5 2320e5cae2e63734eab372a2c8255605
SHA1 ae32105f14fa8e620d0fdc8d44f8a5c8ae74db12
SHA256 d1ae259736a0f39b3fd93da164ceb81dc1137fc1f9dddab2be0e0e6a9e2ee9ac
SHA512 ecc4af6b60c9e1f70671df3b2f6a095c7323c2eb7606158452f0100fddf1bbeb63df6a1b0a46c8a5b27528dd8329c4e13ee53141c86efdf07612eca00a2f6413

C:\ProgramData\Microsoft Help\MS.MSTORE.14.1033.hxn

MD5 3e6835bb535188e423d71531f823a74c
SHA1 8df77c86282ea3debffe21616bf29ca346590a2a
SHA256 fee5a546fb2c73b3a902b8de446b25e3b28a4b6aaa3e811cc2ad34defa772605
SHA512 c26b8b61f820f6d020621984fc25bfe77c67487103d01aa221cf26af098f4cff3ea990ed18df8f03b413fc256fa4c9fe092ab59573acc6d4670c078cbca3224c

C:\ProgramData\Microsoft Help\MS.GRAPH.14.1033.hxn

MD5 d8ecbdc656ea92adaea450703e4def35
SHA1 6f66e69706297ac14f381a366720b3f683c93961
SHA256 2b6a58522a25c5d68254f338ed764c52339fe6f3431f3b04742391ff6d69da25
SHA512 96e2469bfed2e2c6d11f829da2b70a779fabd5d94a68c439cbcb20ffe630c80f0ff8d3ec7cf6e57fe2bd022979c7657108e7390c49ac05a895622c118164e9cb

C:\ProgramData\Microsoft Help\MS.EXCEL.14.1033.hxn

MD5 421cbb67abc88b296e132d4f6d1bc78d
SHA1 a0dca2ad14f24270de7d3b254b10368700342ccf
SHA256 154a0c1603ec883ea036f5b4af5d50ba996fae73c4f776305a4ad0d685885038
SHA512 12de3309391ee8fe0962af6de8db88a302e5711fb8249f9d86b2d55e2882d660b19d529d719962f432558b058eb2599a0a525e9d8faef7acc09e650af3f0ccd2

C:\ProgramData\Microsoft Help\MS.MSOUC.14.1033.hxn

MD5 10520c9a12ae8f8190fb0c93a3e7114f
SHA1 f0d7d181211d5d2d3f991ceb7ef7a4682361e44a
SHA256 c650b8d205fc4d547a34767706c421a13b1ffd48f2ba74f015c22ab001de90fb
SHA512 eb04703fd285a3b21d229ae86cea43ff90cdf4c66236728157f68d2f3e6612c2e85782e2bf9289ba4488ca88f38cf56e4cf20c1e595bb5f6f5024f6db056169d

C:\ProgramData\Microsoft Help\MS.OIS.14.1033.hxn

MD5 dad18c8c1b353292c6f7bc27dd9022f9
SHA1 eaae182cca1a856e1f128ccb694a57b2dca18554
SHA256 4b313a4f33ee04967205c5154f8593b9b75993281e228cdf1898ba28d1c4df3f
SHA512 4f8b0a01cf38c32737b47bf771da247378c4818b53787a0ff235ddf1eec1f85d2043e144480d23431c90450c4d6075b79a71013bfbc6c9c8dd969c8a666f7ef6

C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg

MD5 fc95c909f18f1479327fe9ee852209b9
SHA1 ad5d772d09860108803b7cffcedae17f9b1bcf59
SHA256 b52be5a4efcc7b80031addea20d4883b93519b61b49cd15e25bf24c9e2b937bc
SHA512 0b8df4e60b5c1e64a3c86d8a6203f847a8ccae318ad65443eb42f6990cb34b660fe414dd2fe10f18caacab103cf6bac53fe3be4afbad70cd7c80aaabb15356a5

C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg

MD5 5b471b17983688ea95a6b1b10a9a2bec
SHA1 a1a3aa7d913274cb95e3da75f0975be92eacd883
SHA256 c513656cf785ad3ae07e75ad2ab3d6e4cfaf07b14485b744636722424ce77258
SHA512 48187cc1af68a56805167fc0ce6c896db1f88901ca4afa1dfdbafe13dafdac3caafc528932e8e6821546a7ed29e6f513a8c8d48f58187f9020cc815996a87b83

C:\ProgramData\Microsoft\MF\Pending.GRL.RYK

MD5 36831b4ad5e75f770f24a06a0158727f
SHA1 ddd1df77246e734634f766efedeac722d3f51ddc
SHA256 16c5465db2b757cca1967290e9830d058dbb67286265cacf7bbf9aa9d0e370bd
SHA512 f35d8c115ee44f4f39bfed110a4f4746437178bb3508ae5374c742b1df02d5162948d7c2215cdd1ab51719a2b889f31a100f03a63ca025264004e2ebbd7893ae

C:\ProgramData\Microsoft\MF\Active.GRL.RYK

MD5 3aba5a0ca9feb06c519eaa0688454f61
SHA1 103b5c9f43e6048184ef5d203ec93ca2e692cb76
SHA256 59ade0e15f0182611677e30e84198cc777d85c7fe975a6520f354c256b935118
SHA512 46791667828f923a278d84149cfbce76dd7c3c23d7be5632b041d2014f9c133371013cc599d23a7540429cebf3c57199120e03b13f11811a95a83be6384ea777

C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg

MD5 75c1f3dc6d6de0da1a4fbdbc094f3234
SHA1 57fa7c30ca84326120adebe43ede737d74a45a31
SHA256 87d1865f19f0cec14e7a83ea2f3e033068ca4fa980704b03a6c6a681e8795e6f
SHA512 0790b2d81da6067f67cbdedf1d72750bcdaf6812563c112093153bf1a63b7700a8cb438c5e3179fbfa6cfc326e43ddf00a9cd5ccf2aa8adfbf94160c28c751c7

C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg3.hxn.RYK.RYK

MD5 156465523a56b542ff80fda11a7c6eed
SHA1 639186ae2c1ccc6ed9a6a2c362e1c3bc4e3b7cd7
SHA256 a93eac517dd860cd0e16d11c3b35234370ceda5a23b4e19cc5f33ae18c4dcfe9
SHA512 735fbf1247e7714c5c893d32725d5ca0751a6dba35a0135b80b4a86dea881a775abe23be603412948bd305ac81a36877965d78b4e678fe89cb82d60da7065167

C:\ProgramData\Microsoft\OFFICE\MySite.ico.RYK

MD5 3fb7c4f4f9005864bce21426866bb2bd
SHA1 a99912fa7169c1157a7955659d6c2917014e6f3f
SHA256 66332b746a0c890113c6d486f5e9e44b6af1d6d455a9bec333985e60ef59205a
SHA512 8c3e805f922cb3a7284f9199eeaff59c320ef2a6ae65fb500f938005bc2a92528be84d94bdef80463783815ddd283dc0b4c386ae4f4d339f935934379cf56d00

C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat

MD5 9109d18094e0b9101dc637af8af6ac20
SHA1 542b4b3cb1bd461db90596548729b616d478eb57
SHA256 6be6da96a1d92ae6720ba71a23dcb345e814a65bb4648494ce4118228b9467e6
SHA512 bc46d7ca5762737399869db723eb211f274d3030d984a9344e73209a95020d261b462503a2573ee82cde82e016bf2067efd71dae865be4b74bdd3b5a81835e49

C:\ProgramData\Microsoft Help\Hx.hxn.RYK

MD5 62f9804cdf2dc92238d7d998de344b31
SHA1 4e53d9731aff89e595ac04aa3fb7e60bbbe5fb75
SHA256 9b4ec1b9391d559cb1917ac132bc04e6b37784082cfb0a4d66eb385c02aacdca
SHA512 3eebc366cda66ee66c5a7b6494ecc11772c3001a76ba04b3c87e313c4ffae5a7e82735494cc3c03785427d239a6ad722b471552374ecf53df64966971142c62e

C:\ProgramData\Microsoft Help\nslist.hxl.RYK

MD5 86392c0901b4f068135295a400784f0f
SHA1 158c408c0cd88c757770e1dd616f7286ff6ba779
SHA256 8fdde84e33b39131822fb5102a0d9cf486ed0a22053de7b30c68264b030f85ce
SHA512 3eb877a2610f5fd1556f62ddf4acba56821bf3d75e8c9bb1f95f2de7a28e1b64849c9c457f5486a08737dcd50cc772eac9934da9f0d9b8c4dbae90f27bf0a505

C:\Users\Public\Music\Sample Music\Kalimba.mp3.RYK

MD5 3e34ecbff382b44de0d535c396f6b7a4
SHA1 6e36e95edbe2ad2db55061412d4628e2ce4fc8b8
SHA256 78a167c1d82547e46e17b04e0b841ba7715a6646c46c9703d678d18f9eed9f2a
SHA512 e46c7e96d371a94ef4e01a9eb16826f1c79003fa07715476bb458ec00ba8739337008719cc8f50a95f53832081365bb947b8f398660eb66bea0f8334caf4dbcb

C:\Users\Public\Music\Sample Music\Sleep Away.mp3.RYK

MD5 47cb27d6acb0fe51af3dd8e5c9f2e6a2
SHA1 0f33dde48cd225c0cbad927dc6448c18d9b65af3
SHA256 b39867390e6b75e12ffefaff683f9b960ca1b01f1f3ca3f8c0aa0c714048a2ef
SHA512 51eec88a41f39586adfe4dcec4c643d3ab12efc26bca7be4221a3ccb0982051bbdfbd5fb03100ba1c8bb9038181fa0511e71efdf590b1416adce4fa1c4af1f04

C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.RYK

MD5 67201e4b8c433752cdc406d1dca94506
SHA1 47a1d1b25677c79b34cc12bd98714d4f0dcc5b29
SHA256 c44a2b5a4b789e2853db07db90cca5f43a8c1c36b7dbe52b0e1016c0e0f35d30
SHA512 65888783dd84df3a85f933001550da04206bcc4e58e32ba6d4ede07dc67d08dce91e6ace062d0e164f33fe364dcbdb4b3fd50cd2f147f7bc8196fae4ba5fa7f8

C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.RYK

MD5 e3c9834d3a303fcf872f67ef5a0cc39d
SHA1 76fe7cffbd47693116dd162c7fe66c4dcaf71301
SHA256 8a52d13280f1a7e6d732a49795bb9f15b3cbb050c162619230f517e413761043
SHA512 b4b6956dc4973b85eebb33b66a3accc0150f27241e7c27e9d1beb6c5fc4aa4e83698fdecf1cbf26967344a5893c4382077bb3232f60552cc65447b2984741528

C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.RYK

MD5 f9459a6986d3f4c08c4c05e3d3b5f625
SHA1 6ffa0ab90902148af7980426b7512bee5a9ee1c8
SHA256 db44d9c635a18e72a55ddf6f3b984074e823e92b39ee32155373a2a9feb33a2c
SHA512 0035ac121ad2a0dc083f724a13f99986f7b160030e54b54ef87af645babeb0730fbe7d92373c696cee124533eb390bfe2f32d2a116b9a9961dd219393c7493a4

C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.RYK

MD5 f42db8b3f5557c5cc31461e823e66051
SHA1 7ada566827f954b8fbf00fb7d504b09dd53493d2
SHA256 548ac7f8f397be6646b2ae14aae100fbff471abaf0bf4e19d96fdeee179fbba1
SHA512 a59b01ee7ba6eaae79c7b5471514e1853cb2345616d22fdefbda7e92b2e967608740334dd6b7417f67a0bba2fb14168aaad81e37458acadec6829c89763f2a54

C:\ProgramData\Microsoft\OFFICE\SharePointTeamSite.ico.RYK

MD5 11b4b8a2929717dd0d55e363c4acd3c1
SHA1 063a2fd676222db8a3988311d6804e82c0faea10
SHA256 f592dcaef8758b1a31db65180e7b1f82fa3869eaee28acb47ff891889a71d10b
SHA512 c6551502152f6016a043d32fc193a3c7256fbb4be7a953ed918ef097edf045488a9695386b43ebe1c1a201280e3a44632f94f3c5b088d9dd728984ee7c9677d2

C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.RYK

MD5 525876ccd54f87b2f1358824b6a39562
SHA1 ba48ee38141d36c41acc986319ded4d91b7f747f
SHA256 d4eadb576abefbde6a55b172df0748d42045a746a9280e4109b4b2d0957b9ffd
SHA512 01eba0d60b943876a9f8a6dd2bef73000ddfefd936d6ee05ac6a45e3ce29a351e1597880f892ad6cbb6b22261b12b4419410bba5416cf977b4bb655321dbd430

C:\ProgramData\Microsoft\OFFICE\DocumentRepository.ico.RYK

MD5 f4298f43653e187806f4f7716c3bd24e
SHA1 40d334373273aef95944cc80853c6ba4154b1473
SHA256 d2542b0870382bddac5c444ee8ed06c2d3cc90e082013e054160debf7dc5429f
SHA512 596ef8ebe31c948ca0c14edd472381e1d599a5fca2a3246e20ff389c4d63d1475a13b230cc8a468aefe474e5aa02d281926088f4265b6b41b1045acd03eceb22

C:\ProgramData\Microsoft\OFFICE\SharePointPortalSite.ico.RYK

MD5 3be06a1351ca4e8e115bc19d18442ec9
SHA1 5f1f7be0f165ba33ae03ef58f416068e81e777a7
SHA256 0c977ff284f0b77059e36ebd9ef23452ed9cf1c8ac810358ef181a5647a99c70
SHA512 dcb490c67e2b3f577d88cec289ed55108af11e1e343ebc33fa6b02bbce44287a9ff0de3b83bce1db928395d96b5352eb3239f27fba77f69ad32e75c802288341

C:\ProgramData\Microsoft\User Account Pictures\user.bmp.RYK

MD5 8d845946d29ae4976aa3dabc26a7bc78
SHA1 b59c32c0d1150c1911fa5bd849aca8f1c683da8a
SHA256 b0cf73976143c6a8c7ad4ed9107019f4ec40c7f2ddbbc2db5c2673f404412c8f
SHA512 e3dc8cc3ddb36e432ae3372f43f42e20f48b884b6a623a9a7981a9b42353021a6a6d73bca4c73c4e646031029300898988ba5d268e24a6a8b13edb9f246158bd

C:\ProgramData\Microsoft Help\Hx_1033_MKWD_NamedURL.HxW.RYK

MD5 0cc711b4b9caba8266e23066bd569bdc
SHA1 67704d2c9e87933b0e54cd92eddca62aedbb7da6
SHA256 e431346ef4ea9cf9136a086b947c1752f3edba62bb59101195d44e3d303ccda1
SHA512 2566ab667fdfdd83e0e1a21dbfde79d4ddaab0ada08cdd4849487be20abd8cb7b970f13ce3177844b6d21455d679db350e839ce38188d343c34b1ce3d4fae1f6

C:\ProgramData\Microsoft Help\MS.ONENOTE.14.1033.hxn.RYK

MD5 3f919f3957f45f349f4305f75f337f14
SHA1 9e48ae3530b86a53234672d27909e48c7b9fc833
SHA256 8c6eacb9eb41feb13e3187b0896e7f34ea584da7777731025a7117980328b31b
SHA512 d781755f98eebd24b822c8a4afe34d416357231bc8f5293a6d39f53a9698d6d7042fabc55e449dda5bd57be3225dbadc9b5d8877998384e0882b078fdfd7c31c

C:\ProgramData\Microsoft Help\MS.EXCEL.DEV.14.1033.hxn.RYK

MD5 fa8de68b9a8442bcd165f9098831b9ec
SHA1 c5d8a662a63a2858c02e735c9a8100638fc1d52b
SHA256 99f3246b7807fc2e8735bafb18cefe28f5836d7361f06b9de8c660c99bce912f
SHA512 92cffc664bc1d64e3fb3a9486595c64c009aee5ffc1ed064c4fc40e0f7985ab77b943a6abb673bd3776e5c63c21176a46e008fa9b73c67e30bfdec6bef4cd34b

C:\ProgramData\Microsoft Help\MS.MSACCESS.14.1033.hxn.RYK

MD5 79381759bd4f77ef21218268b44ebf44
SHA1 3c6212ae0c46271f7bf622a5b77da6e7594c50d4
SHA256 f41010cace2002e980b3c9863edf2bac7559ad4ef7e94d6e3453ebeccbc3db48
SHA512 21d0833c722312a3c064180e9736bade7dac6753c68593e57cb612f7f635b0abdf6f34d9035270a28989f376aac35844d6cb409c992e3556a037aa68d12b2919

C:\ProgramData\Microsoft Help\MS.POWERPNT.14.1033.hxn.RYK

MD5 1be809394d87acd788543a675767d876
SHA1 fb9b9bed92a86516cec032852869410c756ca406
SHA256 83894fa0f8e647d9ec0f03877af3f7169c3bb370f2b1e69b7c91f3550dd461e2
SHA512 e43ff2e0a131e56102cb931d9d85b5c47385f3abc9ba842b22a08c1ce9d42f859701f1a49d92589fea04953742ce040458bb2d22999f58c507fe5aaae7f77c99

C:\ProgramData\Microsoft Help\MS.SETLANG.14.1033.hxn.RYK

MD5 b08d9dbfa8fa65b6f97a2c3bfd469003
SHA1 4615dd6e5ffd52a4c767a07cf1d870dbde8dd2c7
SHA256 a945a197891c46f57657cadce9fbb49adfbbf6e19a08f36a1875c4bff24eed78
SHA512 07aaf04bc63e77d57de58b8a3069b345246111b0e777f1dff6276f4ca46c4c281d60422c403985d005d27d25507bc3bb71efe917ec7c1614ffd5c7c11371bded

C:\ProgramData\Microsoft Help\MS.WINWORD.DEV.14.1033.hxn.RYK

MD5 e4c66734a7763fb9b3051cf503a773db
SHA1 8643e36ea967f698c648705ed0b2349ea397c008
SHA256 60f167eb6df973eec55ec1fa1ac14e46c62a5a0f309bdbe68f0cc492a6cfc315
SHA512 be3720798c4ba6b290de2fef83f215fe7072504aa1772b5f217cadfb61bae2bf63e57015dd9a976611a83f0d5f19311a17aa77abeca4d0bdff5ff53f8323ac41

C:\ProgramData\Microsoft Help\MS.OUTLOOK.14.1033.hxn.RYK

MD5 1cdf87c43a74fb8791bca2b1fdcfdf91
SHA1 8456eafff9f839a0c4149f542698087f938141e2
SHA256 f1b91eec8f5f02dbf1673aed8bce56bef1d8727ecfdc19feecd0b3131290733b
SHA512 e8d287db2e1974768d317f4c9010fbcd61488b1535fc14d5a6eebfe57139900bda7fc8484b0e65dff7983b5bcc94fe0db2c903f87ffa37d111ca18c5585c5f87

C:\ProgramData\Microsoft Help\MS.MSPUB.DEV.14.1033.hxn.RYK

MD5 46a32fb32aca4bdc85b47d44cd8ce93e
SHA1 54e733a8e5a7e840c604b47ff1e5af23548fe0e7
SHA256 8d7110e14224479fd68c71bcca36bb30ce6a196c3333f2e437ff8e322bacda42
SHA512 dd618424b352713ff0f1d76b0716d02c942b51677a4a6caf1d3099de95f235c108289944ca42bff9f8296e55c6e8f2f3ddcc9c69f6fd25af27e6bdd8223fed48

C:\ProgramData\Microsoft Help\MS.INFOPATH.14.1033.hxn.RYK

MD5 236571124356bccf0c427ac3532302c8
SHA1 7e0abbed1f9c4ab27c87ed26dab2093ff781dc1d
SHA256 69751573e06a78acf624bfc4bf471169891ef2d19042786b280dd234c4e6ed37
SHA512 5b0d70742e6966c50af154ecf1941fe2420b50fef7664752c9b46f0f8458a5551b09ff31943d277df9bd0ecd9f19c81cb670074b9356109f547f60f61544c932

C:\ProgramData\Microsoft Help\Hx_1033_MValidator.HxD.RYK

MD5 bed065bbf28703b02d19d7e58b997fbe
SHA1 a0a962cd0a9774b4d5597c958557d11fc871ac55
SHA256 c51a65afec4ad4f40da45f34b88f5c689ede66431600d3a726036168d4c1af4e
SHA512 2e8d758b6cf637ecd80decd46a3a1becec278d4a9562dcf62bb77bec88082bbae69a9426670ede7e593d6d27f92fb840f31a3e3a94ace68953f76b2677c80319

C:\ProgramData\Microsoft Help\MS.INFOPATHEDITOR.14.1033.hxn.RYK

MD5 bd63e64603aa01a207f78c5035462404
SHA1 1ebcad76e891e8d330e4f95e0ac82744ab99ca63
SHA256 cc9c64a241517811ff925832387e24aeadc8850b88dd7be9f627417c42c5724f
SHA512 2781eb7825b49b5cc85202b193174e3ab1530ae87ed9b71ffac11b4875e3801cf2dcc4f1fc3bdc2794b47048f1337cf145b28f5be50de139dc5e30a16b703cfa

C:\ProgramData\Microsoft Help\MS.MSACCESS.DEV.14.1033.hxn.RYK

MD5 fab662ea412d367e42738d246d90c3f8
SHA1 e575d7144cc36224d19895b1ff04f74b44e9f443
SHA256 71f21fcabd3cf1204a314a32ec6220a798c7a46820eebb677f46fc8cc6620e65
SHA512 2e4cec210d7141dedd1cc05ecc9d3f4056aba279ab927eb722e4749c5e1fd1b55c3d494ce3f29fd8dc47b4f2dd3f9bb8f5ce9530cae6a89d366d81209109258d

C:\ProgramData\Microsoft Help\MS.OUTLOOK.DEV.14.1033.hxn.RYK

MD5 f545be320055f5e4d264466bd0c2ed2d
SHA1 1e07a3df66147399c89ba5a20229cd2f7f811b9f
SHA256 3a763a525a294eda87ca6473f8f864f84ed4a31d5df8c87b01dc04199e033d71
SHA512 54d14dafbdb6b013567466c0b2003add533f741181a466a690bb5ecee93b67ec5159c2412abfff49c08d13ada77254dfb4debdb40b7d2e312e60e31bb2cbd63d

C:\ProgramData\Microsoft Help\MS.POWERPNT.DEV.14.1033.hxn.RYK

MD5 df1e030f1c8a1b106cee308f207822c9
SHA1 5037b0a35d833ff2fd70369115c532601423431d
SHA256 ec061c631b4f37220b0d04584b6f3536ee6b9d4468966ba76de0aaee0dfe530a
SHA512 93002b6f2250c8efa2ab0a1392110a4d907043189b46c7e3b571abb0882c9c92060bf2ee024efcc9df9417a17f97700ee2ae6203eed9dc91692ee13748586ce1

C:\ProgramData\Microsoft Help\MS.WINWORD.14.1033.hxn.RYK

MD5 13fb72d65e15cbbd6198f43795340a99
SHA1 d16cde1487d5f3ccd50b22d99c37abfebd964a68
SHA256 45da6ec6007e4b1a8e35c37d4fa9cdbc7668e1d66113be2ad6e47db7461c3508
SHA512 ad97740e2d3a9776e950521f11f289c5a71798301f36f04c92b0c602e5c0cc17bf9cb8295909a4ff1ce7438eae56247d6e7e30fe44bcc26c5225b9bee8902d4c

C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.RYK

MD5 13ae5cd2fe830b6882f5bff5eace3c3e
SHA1 1e1d704636d964dc85ac3b54a8df72b72a60415f
SHA256 31daccd1b314b204f98cbdf717ccfeeda5648ff23f05b89d800ed37e84037837
SHA512 aa3b568d44e7a3da5833569039d5387ed83829630406b9f4301306f24a0eb3df13d48be7f26320e98b5ecc2e3b31453e1ff3e45a5d4378c95736918f622f9f00

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_AssetId.H1W.RYK

MD5 f766f5c25f7fad97a77688d4e8b5d71a
SHA1 269a11bc2fffa7bb07e89e2856f0c88417fcd28a
SHA256 092e12d931786326f486389aebeca8cfd1a8bb34ef89ff093738982e0e06b999
SHA512 1174996827c6307cfb0ecad03c303d5684616e62ba2c45a4db2970159b902e04ab3feb4c315fca71d13d374d172abf298e129d94c9bb615c97fb8befd115197f

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MTOC_help.H1H.RYK

MD5 395b32b6e21b514b8a700253a5509571
SHA1 04f463b213887be940403232121563375862e8bb
SHA256 34308c429b243c468cbf170e5c95f2295483c1eab53ecd2dee8974433e1e050d
SHA512 ccba010a6a34e4d130f9f17e4ff161f7484e0abf59312c66d474ad3fd2f29600a390ac277dc53ee689c28f2afdb40ce6fa4b84d936b80c1ff93e0a22aaaa54a7

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MTOC_help.H1H.RYK

MD5 2a5fc6751bb3624059a0ac26323be22d
SHA1 53fe86e7fb6184c8a14a50da0d8612cfa13052ac
SHA256 c7c85454e9dd6c7061f5bc572d35b29201c086fe199532915faf7855d2c817a2
SHA512 d2ce2540eaa58fe907272026d3ef51ec797bfe9ea473d79b24b9656cfd3426152db8f8c1508d83c101427036538933aae426c7b772c1943008b0be39803ba213

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_AssetId.H1W.RYK

MD5 8b8e1e059a33ce605612806bfdce7d84
SHA1 f4e3c797123712d4966da5468187e8390769f34f
SHA256 7bc856661514194d383c7254ce101cd4532a41a6fcaee62322453adfd1ab50f8
SHA512 237562fd8b4eb38ca3d09ecacdfe4b433ed57afa399b42bff6d44eeedbbea09ed73d47bab2d813bd73814f8940a1ec682080aed54d501b89f6c5490c11685df5

C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.RYK

MD5 34a6c7f985002a0424f95c7987698a60
SHA1 09dfb8e0de1bc57e855cdff5c9949814605446d8
SHA256 5e99a767bf943768b64c1cc69b12d5c1d92b4066e4777fc86aa3febfe498a8f2
SHA512 b6c8495cdbfc6832cdbaefde71489d0b5a1405c02b3c099e82c7bff0182f1e4a9c5d421cbd39774c2bfeecbe810d5d521d58147bfd2b3f067fde27fa1266159c

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_AssetId.H1W.RYK

MD5 29fd2c909b0c40c4aeb543fc8e16020d
SHA1 5391ce587ab36f471acbaacf3c9d59e0a9451af8
SHA256 36f18d04a62d392b95db20ff9d3b3f7618605e5ebe0ad7b67f05693422fffc12
SHA512 7a48e6e500d96d4438cdfc332af20df33af4b6ca482058b190ba374b7e7795ff7dc47c536ce6d0d544f608044c6e14cc245342d825f04a94b6da7244e9842420

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MValidator.H1D.RYK

MD5 8ca875f5a64dd9dba80991dddc2b567e
SHA1 c52e9f76a873deff1c7a8f389ef502e058fa1550
SHA256 6828abafbd7a649626e2862bc5245fca74e16e7f4be21b0a2674b11e96289bc3
SHA512 0f2686776e4b6ea51fe993d437bb36112dbb25b15e5e3a32312baf3b6bb29e70bcba9a40c987fc89103dce70e73514088b20dc286c3d60429bc64673222f3e69

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help{E1E8F15E-8BEC-45DF-83BF-50FF84D0CAB5}.H1Q.RYK

MD5 36da51a34911be347ccde85acfd359a8
SHA1 454bafe90a641602f0582825527af0c935e5c1b5
SHA256 ced46284e01a549d9091463bc7f0765fd693270b7a1c463f61465b5675783576
SHA512 3e7f29e4e5c376be6d7d669afeef9c305943170bd465d127909c100a37bb1c5be9599601a26ba2df774643cfe8f0f737d0fdc17011c88f3ae5d496227137958d

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q.RYK

MD5 a7eb440243a625d964edf758418137d3
SHA1 3f7fc41d8dcb5253ae7ba73e034631f8ec0c5c76
SHA256 d9249a175f552715878126f676aea2a32f09537a44a1d30af00ba4117fe3be60
SHA512 6d2ecfd9b4c6c96c92c2d278c8b22c14d292ec692c0b2b3b9b362e85e7511783e4156523970006a2fd3667730625014cd7a35266a2af89becca1cdfd45f9a6d3

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help{92F2118A-E813-4A4D-9DE2-F96A9DC02C53}.H1Q

MD5 f8083d11629fb98c25d7b1e274517f0f
SHA1 30f2958af3ab4035104d084382fd2e04b932802b
SHA256 0f82866cc9fadd06bb0d3827a589c2e4513538e6789e18eaf0fe7faf00253211
SHA512 dc8e8e266e3a462a3afae3e2769c0d50a62654948a6ef5a8488b5c3baa646647021e77022a044bec6f67bf1ee486ab9bc76d8df82f86b378263225ec5d330f1f

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_BestBet.H1W.RYK

MD5 048c236138e0c4b09bac92b348e113a6
SHA1 363cb8cdec63fdae6e779594fdf7ddfbcc472338
SHA256 44a1d6a85382cff4903caf86168e837caaf122799e18da53d3490a4e8d23797e
SHA512 4f76f2623783e1ae3ee4da5cdb4f43d3d02f4d33fe8a945de32850a92ef408c7b61f6c11351ed50250f80a600fd74741367ca24f147865a620bc425853a6c216

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_CValidator.H1D.RYK

MD5 a5330f9159ab27a10995eb2e5b714c35
SHA1 f82f55f482be064ba2ac2060f5f0faae8f8d399b
SHA256 93ca82479fc4072abfd639796462ba80548334e22738eed4d7744424da0bbef5
SHA512 07b5afeb25a530c576801dc6d2dd7f4ad9a5ed8ea7da214ef78ab5a89354861655b94e1538aa1ddab227d63a2b1211c827a7eb0d2e3c50638b6c8b3b7384c805

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_CValidator.H1D.RYK

MD5 dc2def29c456bdb3acd14167f69817b3
SHA1 8235c0b5ebba37e69574a8a69b2efbeffefcf0f0
SHA256 722a9d9e5868b85c97bf046352af643b433721a6faebb0a2854e00a2075d1cf2
SHA512 729cd5aa6a828d4c0ab9cbf87d1fc396091db00ae8b399555adbd0759faff82f7297bf545f5b1ad695143aa50ff1f9087e852abf8ca6d9101334f6da08c0539e

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_BestBet.H1W.RYK

MD5 a58e2450debd6fffee5a88e8395c9b12
SHA1 57785eabc189d20c0dabd1833ff1a00a45bc0ed5
SHA256 c8e5ad4d14fa763053da57bfa93c0f4eef25c3a6c0b222f40ea7daf902bd9c53
SHA512 930c61abc1cd1cc85d79c0dcd42cbcecd6158212f88945741369b6d306408641cd407c3d8419b122c825adbf293a64a003618b0e1db53cdd9a866b6645357ec4

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MValidator.H1D.RYK

MD5 e71579afdd60cb518c63ef3e9e468947
SHA1 adc8b69ff3a8e258397bd6b7b2cdd6b19bd2e8a8
SHA256 102771b1758e54afdacfe1cb6d955cd62911e1aea73cc2d5b18408cd4e2b8e6a
SHA512 f9969d96c2e948de8ace9d87b9e9c1d6b519b259b1b0b450d47b1a78a45fce8703cf80b870cbbbf63fd12f8c76a8570da0d0694c36231b549e8cf057f661260c

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_AssetId.H1W.RYK

MD5 876e85da695d3d2be3210f1893459095
SHA1 d8c770c03a3e820d935d2cbb13f3058d691e10b8
SHA256 d97fcb25b0388c03018d5961c109059c4af305d0a830b8223469eb0783f7217b
SHA512 e28fa2db356555112b7428debf2c2d0989522e8388d950882f93b96cbab071a07b9e7b7963282b8ea031b6b6e5b810ceece944074ef78528eb3b094ca095fd04

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H.RYK

MD5 f721649dda1198c16c596fd24f90ecf6
SHA1 4347d90efc20a8ea2490253dd8649b0df2647436
SHA256 f47cc5f0a9710335b4455ab5377b8b17379105f04b7855bea761621dc5ed2bba
SHA512 22135a0608cb0a2e571f6f26b57b5b470ef1988d82891f65b692eb52ccd07502ae81384a18ccc8d6d1e9edac2bb35fd87def2cd1d0303ed34c5ea8ca47c6d3d0

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_CValidator.H1D.RYK

MD5 d8c3be2ef58c7be3cee2fcc752913e98
SHA1 f5c21a319d2edaf416409b6657e9b6c394c6d373
SHA256 2b61a2f237c4027cedb7d57cea7e7d7ca6801ee910866ff231ded9101c8d2ea0
SHA512 cfd31ed23e1743cc6dba53fb67399535694ffd4d6065064a3dd3168d16c4ae5ca0249ff6c1bc9ac48c9ecb5413e7c30dba90c2871b556a72627e122af8f0cd20

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_BestBet.H1W.RYK

MD5 ed1230a3d97008cecf47dc9d2a26de1f
SHA1 0c485856a807d5ee3cb87c8d6158e02ed1e3f004
SHA256 ab643f353f5658b12d31627238b447f41db3a7776d110d20b5189735a186bdca
SHA512 af9f5d0b3e1aebfd7acc0fc12ada800c4efdd6a4b12834edbd9cd8e0f080b36289daf4a69705179b8b44135156ff6338844cd1f3ce84b0944dd89996b730070c

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.H1D.RYK

MD5 2a95b6020623a45d2ed175c6823fe981
SHA1 56a61621618f248be6fd4b6e94c046bba68e0cd1
SHA256 f102eab4a82024e74bb13427edcf1a13d0e6cadd909ca8f7e18c8b520cf13a29
SHA512 8702d3afd5afa414d57f660c85803a3c53c0bea4484e6fd258cb24a18274d99d7d456a7d2208774340a2dec9253be4f9a30fae770e212a483517655d48430321

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_AssetId.H1W.RYK

MD5 2fc1abc3e229ab688e6827c1caef5214
SHA1 739c55c183feef3d7d175ca388201f9abfe08b6f
SHA256 9d0ab7d67a932e6d842157eb36f87c1069de22c0136e9edac244be06c9a72583
SHA512 630578b6792cb61cbfa3fb84b5817c4ef3532caa0f70f3c4508826e62526db72820c3ff491e489467bdecb6945e09383c4c75b43061fe3e9e8c82deb77b7dec3

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MTOC_help.H1H.RYK

MD5 c297581cd33e56f13fb8f5ba263ad005
SHA1 608d6e806d9105d0b1365f4982fea6d60a105630
SHA256 b57b9229c51d73db74585e5e479a70aaa759fa12c3ac95725f9d049ba184d3a8
SHA512 382ab6f9a2e231536176993a652d0011915899c6ea5020921a37f782d48ab57e9764f3c0b9008ce5e1e6d1ef95ac7eb9bcbb88d23e6abf09067d9c62a91cf050

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_CValidator.H1D.RYK

MD5 4e40cbb20842ba52f19312a774139880
SHA1 e029bf49602af923b235b619b7ca590f78a358eb
SHA256 a714ee7872e691494a05c7445618dbbae9ea92843da17eff4c54c4caa2e78c92
SHA512 1f967f2be7803551e448063d2aa8776f0b9d8a4c3f93df42cbc43e902ebe87a548c3091a301027d01eeb359d7752d1486b46264c44d9c5ea92c794db0fdacfd0

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help{68DC71DC-2327-4040-8F03-50D6A9805049}.H1Q

MD5 75bfa38cae0797295d266a0faec0802f
SHA1 44f5190adb6f241cc3262c1ff038ac226a7bfbec
SHA256 01fb23792a2e0fbe40258cc4653e0b0a75589deb0e224a5555e38efa73478326
SHA512 ad556dbf7c192c6a4061e54b632cd7558d6003727049d8ae4366c5a940545abe5d7ed44e1227fb94335a2a1cf8de99ea229674c497e3ce2c3a4c38ef357a45dd

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_BestBet.H1W.RYK

MD5 aaa2d80018611477214a001a98cdcd7a
SHA1 b7e6b834901fe5c8364f80f2d8d9deffa7fcc26c
SHA256 4ea165e0c58cc4c135dc7e2a42677401e1480c7960e29fbd8a0c5788df7718ae
SHA512 059631143fa956a6397bd0371692ff6d8763b4cd9ec346ff426d19a9e86d4f728580d403c6041c711454197746a1c7277add98cd888d213fd1ca8e198004d579

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MValidator.H1D.RYK

MD5 c23d01c73ecc9ea4a27f912780c84a1e
SHA1 c15bd5c52b474c091f773233cb832cb17d82ecee
SHA256 551464d110515c812e878f79d33d8fe00d733538507b915b079b0f6d304aecbd
SHA512 40ebec20b0823a5c6269c1c999b3f07ed0e7a4f3ea33e64cc0ca01955ade428f453bef7e66a91d95cf6f569c30c32d88c9904c2e3304559d7052b7335df895ab

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help{45EACA36-DBE9-4E4A-A26D-5C201902346D}.H1Q.RYK

MD5 fe9834b11e6142a744872c54b97bfe10
SHA1 a9cb3ec99e70a419036126df6e05ee47b4004a26
SHA256 3225cad201dc532b482b447dcaae90d14a5889feb83db69d01cbee20bf58ef04
SHA512 0b0bdc37e7179f6e7955ab627c3b11fc801a49981be4d466eb9782ed4bf8b9bc8e2f093fb981d39eb97162bd46034c208c52449a580b8f165317fe5b72aa9d65

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MValidator.H1D.RYK

MD5 0a0fc51e4b819dc2533e2d94987138bf
SHA1 fba5967ac5ec1a273cb2c64cc6b3570f2b8eab67
SHA256 b55a8b584ac168c899d61faf2bb8f20ab71a8f41b2d5a04f391cd58e34c5f169
SHA512 891e5c8a473373bb5693cda80dc7133f5b0df35eff0a53b15ef6287cf450df8d9f304e207616cbe073f1f1a8b57556deb556477608ac35f22ed69990df1c94dc

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_BestBet.H1W.RYK

MD5 ad2fcc21359e7551b5879fc06a31d6d5
SHA1 7a977d3855462820fd52fe87ca4eda116712b71d
SHA256 202a8df2a423616bf98733c474ea7e89823af3aa7b8aea9b9ef20e62c85fb1f9
SHA512 e635dfd138acc4312767977adbb660b7c388b792cda09f803660253eefaf0c0fc6dc37d55d6b80880969a9d4ac96e806542f60bbed558f29f3071e56c2b8d6a9

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help{7E352021-69D6-4553-86AC-430B0D8FF913}.H1QK.RYK

MD5 ff7328d57f9f42dcbd6de2880a64913e
SHA1 71c5e9ebd5cf23b23f81c5a9ed37eca21164296d
SHA256 912b6e2a91b1726bfb0b47b8e5da9f1d6a0ba2fdbeb3d8372aab94d369776a6c
SHA512 3aba1188811391b29e1da48197d7ea3be567cfaa451415865b28de2aafe9e7bfdc18620bdfd8cc4b606e1f2f1314fcdf1501e93602efeded3d3cbf794e7ee7c7

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_CValidator.H1D.RYK

MD5 afbe6dbe47bdf05ff3387f4af7d2cd99
SHA1 4b13c1ae885cbccae94397f6db9ec0b16f5d866d
SHA256 567e0cce78d4697ad03c2923249a316c362022d27b1097a2611e93293dc8ce70
SHA512 fa328de9dde9df7e71739bceb83aa6204817c4ffa964e0548443477927c3b80b694fd8b009c555aeff2a8e4a141e96498ca86ad20de03a9ce70f60f2f627176f

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MTOC_help.H1H.RYK

MD5 720d8c7b9fdd462deacef9049c12602d
SHA1 f9942e458f919a40f1ce94e824a535a656a5395d
SHA256 ebbbe6004b8a9fea40b5675c39fe7f163f9a3e5d3fca42e90b3c98f0c5bd7d1f
SHA512 2b179031d660aa0ff388a4b35704839fdbf16f87133bd2cd4e6f6e5f2089a80e70d9a80f599ce9f0310c68aa6ef56197fce28fd5dcf5934617e7bdd20c4cda9b

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_AssetId.H1W.RYK

MD5 78bd9715d75f0c82b91f5b9a7aae65cd
SHA1 cb4b3c77c402e83509ec258ce4ac3472d7d2d0f1
SHA256 99fbe43c9612f35e92f5f85c7bf4fd42ca528ab229b786fc5e153d8571477348
SHA512 9973c00cac04ab7981451f8859a87b5813e4689220c3fd900a31e84b655b82a4f4db65d790ffe161821a7111681000eaa1b5bf31a79fe0a92339edd10cf1a9a6

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.H1D.RYK

MD5 9a725a7f04ef311f2b0e9d407deed2a1
SHA1 96b36f7c5e93aeadcdc7c234289ae40edc6bb987
SHA256 eecca2b8762b6cbb77b2ae759e07b32ca2ec64df62dd379e6665b7206be3020c
SHA512 7012d9c2e426ae49d6c652088a9f72521c7953a50069c427f12e2e5b10992e395e232bd2c9db01b729fb666d82b4de81659daa3aed1e515ec465ea588ad8a251

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_BestBet.H1W.RYK

MD5 e638ba02565db4c5ba5d3fbb5c2624af
SHA1 9f357920a77b455abb458c00bd387864f08202d0
SHA256 04e33c54f6d8ee50b7236ddda4466667e0c070100982b9f8f958d3a16ddca33a
SHA512 913bcf627ecf5cb238e003654d1a187ba10f57d34b04880f51c078bbe50351ac6119ac6cf8bb7788bcff9a816e313c1c200da2ebac02beb6fc8f1d00b6720f2d

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D.RYK

MD5 9712f5f00743be806bd19445699a5ea5
SHA1 705827bba093088cdb3b15f82b264f4815b24443
SHA256 5c14fc8aebae34b92f16ce212f81811c376e2ab55e92908c5fb875d265e546f5
SHA512 dd086bf6771d2515aa64e2016ecd5baca513d08b0511573c4f44aa4c56c7a29cde9fcaf45ff300fc10d91f79706262fec4b071e3fccb0ba2bec84f688ad176a7

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MTOC_help.H1H.RYK

MD5 108763be310e29fd774f0dec3d111ad3
SHA1 025577d73762a74fd0303c136de18421eb7e8c13
SHA256 6672b6b90b5d39abdf1b9f410facf64e74a0f107af514259eb432e97da3b6f0b
SHA512 febb1eb79db48c268834e89c819a711b6649c7eaef940bbfbb8b71d30a77045d888b31de7713792f8d4b82642d324c33f33f6dd871940459451cd5ce8ada7500

C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat.RYK

MD5 4c77fce2690a9c6a9c0c8eda074e4396
SHA1 24382ee550918b476c6429d0272a557226e9c003
SHA256 e165556888b7d5a1d49402fc684f7a3eccd7f9ed271e31ad0edd60c01f97e692
SHA512 fd97aaf7688b78989e58c465e3c2c2d128cb54b63b9be167a9636d79822cbcc3407224a0076a9826794a24b6412e690c95ecd70d9ca2cbfd2d5d5fa2649cb145

C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-07132009-221054.log.RYK

MD5 aac5b6f251e415b231c1cfe1d3a90b45
SHA1 21646ad4e94147bbef92bb83b683263bf9beb029
SHA256 8991d43d38b8c364da2f73cc60baa8d64d89115f5dff24c3a14efc66ad21cf89
SHA512 16b3fa4295d0c9c7ca24f58754fbaa2368d17b587a5b65aee99ab201d16893b20cc8905f56866f680e8684125eb7b11fdd02c10262ca68d19f119d3cdb168e18

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\state.rsm.RYK

MD5 18666843e895cb237aeea123610a92de
SHA1 ab5c808bf638931638b88fd16bddd0f44d3de421
SHA256 450a67016a9c8195ac7c41e804b1b68c48489379cc7a737c4c07a7d5a2286127
SHA512 fb879546c3fb7ff6077b2f5d9622846d16bc13bceb5a8603b484ea2a5c0768a4329dc960a9d9a91a619b5bbf1a39ff9eea5ba7df9ed54c869177d1d63224c61a

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.RYK

MD5 94669675d5517bc9aeb3a2c071eae56a
SHA1 52bba4f3e7f47e5540af94dd310a60d70ceb85bb
SHA256 b5f33621b68586cfe21791d65a6f96b6a345aea0114c6054465dea7030cf8299
SHA512 363798d4d6bce05a6e7f2278b5294f35c85935bc5d34d6965236e06d60f066cc67a4130a614858301dc768ab7d21a66148ce4a4cd7e2f42d7c5ad8caf8fc4ccc

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\state.rsm.RYK

MD5 131b34f43d32c0f5b08b56a75f2a0bd1
SHA1 d7045a3ba673c5a71b22b82dd2b90e1ac86f7b44
SHA256 548d069e3f938cca373e0a8843353877beb4c5bd8ace94b4f92198dd3557273f
SHA512 4afb35dc2ebc7b1e2f368284ebc716fd3269fa047f7bc052ee865f21a0166a656ab876faa27421e65d8a0450d2a900fc03c529afd06a0c30b894b620c48f9f5f

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm.RYK

MD5 286f49e8a4553e9fc120c76fe1ff0f79
SHA1 708799006d78fd01541bec36da0bd7426f09a73c
SHA256 967523b8a000e4e548b764bd29b4fc1a0a15693455993025e9239d1b93711a37
SHA512 6a4a99e53db3b90134dc75805ceeed215191d112a35033ad0297429ad78ac5e98fb5e12f5a9f733499361305bfa0b117b54067dbaf2f455fc42aa024d2ee7087

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\state.rsm.RYK

MD5 4453fd4d8cd0f1da842b43e788b26fe0
SHA1 7cf3b85c27536ce35015c834f9c35fec34722b90
SHA256 fa847f9e5d747e7dd3a5c0125d17717159598129736224f84a42ed9ea7d76fe7
SHA512 d132dace759ce92a086223fcf9349540c8c8c13e4b6247f21c14bc7b1dcf7d15dd00eb4569b8ae01d938f55b0f54ef2776cb999695ad55160a971ec5309117cf

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\state.rsm.RYK

MD5 c40202f8df48f5190fdf037ec9e2c9a8
SHA1 291b7647b666e8c72c5ea008e87eaed991ee7dff
SHA256 0678cf9614f2abdd43fd75e4ac6485aa49910ae869b26b95daf68c7aba0062e7
SHA512 5726b30e7fc736df6ab52d35a7cf8789730b1a489b34fcb0f8188c6c1db29f40c77b5598de397dccf337ee4b604a7bc055148276b7f854a26bbcab50299831ab

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_f8462d6b-7d99-409c-b6aa-08f77c38ad4f

MD5 b3692191f79f66cc20a5d7918d41b99d
SHA1 732916ca15107d466de7379a90f47d95f5b96e17
SHA256 29083cc7bb013c39265b2bd1582f2e8a580541b8519f8c7733aad0557d9b6a41
SHA512 434cfc5d8b052972a377f5518ffa01b4a4e3de00ae8f6c9c1d5102166861f60360219c909ceeb8af13969d9feb92841c7e8e752f4bd96010192997fd8c2d3621

C:\ProgramData\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu.RYK

MD5 3787d3dff08684032f651624544abc6d
SHA1 2d527671266abd0b1898c37ddacd529dfd43d3cf
SHA256 c22391585a256b2325b87f4608f2941b11b9b6e8673bf8c7480bed211ab5a648
SHA512 b90b581ba7f00489df8144390971424f3f0b82021395c476049a8976b5cbd7f316ccb34208b6e3ef346187ad3737e38fd411fd6407d0e715b6bedfb3e500201e

C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab.RYK

MD5 7785722f4e9b2d46f8f427cd5a640021
SHA1 06c844f992227a6b487eebd692e38fec07ef74c8
SHA256 0fcdf6e35e2b26ef8731896bb7772ec901e390f8753789b314d6848455598cbd
SHA512 19f08edfca88dda4f0fadb89c1dcfe115f8026f651a013c0a75d65bca1b927e20a4caff30acd05ee4ab4e009b7d1d6122220763a95ab1b71c76ee585b92f618e

C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\cab1.cab.RYK

MD5 d4f12dde8171890a96647b28ba95a345
SHA1 68834b37feafe5ebb1dce1b514719338bcceafa5
SHA256 acb81910f86846a5d0c2b44052170a9111814e2091ce5ed7cb57926424f27880
SHA512 3d5f321caa84af5b637db4131ad8bcc09d5e2d2459b5718734ec3e41a0f8580566b97cd4241036cb960e9f9e8e912f4d659769b9561aada9532262f1eefc7268

C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\cab1.cab.RYK

MD5 43cc96e9ad884cdac76bd67a01a35033
SHA1 0c37f5846e35cdbbac31132ee5914431fdd80cee
SHA256 d35c6d1f40e32a51822dbd41e9f31ddd2f4cc98b5a184926cdd82c6bf0f87ef1
SHA512 3f5b2bbe8b801b19c2e55d0e2c611def292c08f22b40fbe6f47ed0cfdd938f05c7facded7f57037272f0ec03a61615da02d2439f7d40e3ed1377a240869fcb6f

C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab.RYK

MD5 cce42cd18ea9507b5083ab1313bcd445
SHA1 b01eb2ea2d3d3618bcbb4087eb9846d938c9a1a0
SHA256 7d4b2adb4c21edc9cf5ac6589a33d73861599110041654ce53b12ba242702724
SHA512 5cd3179c24a9b1f51ddfe12f9688a0a86f3408f90aaebb06cdbd03b97c9b8102710583b86b41979bc1513b4ba8153fb887547d394e5071abc3cce326440270fc

C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\cab1.cab

MD5 616e8d7f6880c02f91f47ea7d56215ab
SHA1 cb6fdaa8924d36f62deb5d1c68ec88314ac8a795
SHA256 3a9d135e9472590fdcf588a0f4e9c750d0ea4c2c2ca959cc30b3fe1a7bfafcf7
SHA512 a82b96d5978355090c27bc8ce944ffc5a5f0e6dbd6bfa3d2b96ea310e0a8187c086c63870904818cb51c8b0c51fe2febb07d039d09e5e5507e6288bdac877669

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_f8462d6b-7d99-409c-b6aa-08f77c38ad4f.RYK

MD5 70a129621df5a46f3e5a2abed4869cd2
SHA1 acab10fb5705f83976aad7de033fb236d548ba9c
SHA256 d8056ab69bf1c5bd202b0db730159a73c7e66ed480daf0c26b9a95eb592cff63
SHA512 d1b70bd5e238d29ab735ab1916b510e863fe0faa7b6cfe26af8cc6aa8b1b73d91389984d86c4c1cd215742d421478a57b6ceae314246c4e3548fa9b0598404ba

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasbase.vdm.RYK

MD5 4808046d69abf8b10e1c56dcd4eb48c6
SHA1 6b17fada57bf65063cf1d3ff8b93246124b61aba
SHA256 8194b66d6565611a13acde9eb5363eb3d945f224ab0dec368219d05c42600ab8
SHA512 11a2c92176e750e4f4d2d3b20d1baa1a1ed5c4b7eba18e90b4b5ed8ff98596e2733a09746f13011bdf891f04cacb6a105c62045689f53bbbc869b5398ba60a99

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasdlta.vdm.RYK

MD5 2e5d21e82ebdab36293379e3b6c38c86
SHA1 2cded10a455fbccc791d9a3dd51bbce37dbe1d58
SHA256 d2a98ad96d779767849fb3deaf303267730b21554dba0ade140731bed3aa45b3
SHA512 6c7a73ed0daa1fd4c88762972bcd409c24cbd9c5c81edf28e64075baeb708b620b62d5135a4c6e29d2b3a8702b7ffe0412bdea4628b6314957cb3522acae481a

C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi

MD5 fef1a3e105e513194c78ae67d58d5751
SHA1 a9e65fffe30c007abc261c55c615c5722ec254e4
SHA256 881596d28f5e8d7e2cdd16888ded0142af1d3b02c49985d61b764adb6f684353
SHA512 66d192db5e70d4b43cf42b7eaf7612c0b711670ad815cd76ae6bafdc21e08c938dbee32911081915300ef32e625615aaf98e44f7fbeea3991ab65919a023a036

C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi.RYK

MD5 d9e72cf7d34c6e3bca12b775d3d3dce6
SHA1 1c6dc4666b2553ec32b8c8ffb373a91098b8fcb0
SHA256 2fdf9dac0e70cc53d3f28a3f4192dd6eb9faa7b02d2c4df8244030919412a70b
SHA512 539b236dda9b41c7119790f37208bba5c2e1f96619ec0e9fa178173d511d74aa74367ca85617e123453895d9a41dd0e708823d4fb85492e4cd95b22dd237ac64

C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.RYK

MD5 49fc9faba0813c288e3c715efb89a81c
SHA1 99ffac153edefa94730aa93c10cb3f39365cd8de
SHA256 d26683c55f357e80b8df5e15f6449a6516aec0363fa502bee1399140c6686b88
SHA512 864310797b5b8138c5daf51f387a280df76cacbc0cc80434abd9ec31017fa7b71356e17cb2f8fa822ca51edbb65b4b5b11af1d3c9bded991af56ee010aa51868

C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi

MD5 339f87b6900513d3171fa953f2d6ec77
SHA1 a8ab75ab1a0b3fde9a43fe61e0b978d9dafba707
SHA256 3dc0e59050f3d1f36a370669725dc5fdb3c2ba53b5846db1eba096d1d2bd3266
SHA512 671c22bfd26a1dc70586d895e6b38731c495eb7f2d70e15283107e2ea624e0a499215eecd8f600617968cb13e757ec120239378fb0fb9d4c813f8e7e01aa3cd6

C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.RYK

MD5 348c78c8a11cd0e9cd63b7632c748e61
SHA1 396e4a31eddd1ac5f9d36c01f72d89f2c8d4d2a1
SHA256 5a65320d7c0446cb6b5c3f1070355b80501d6af4be050de4ff24228d2360c40e
SHA512 a6ceb1e1271dbe821ffdcc73722b31d75fafcfce432e6ad981a0509f119a2056e12c24fd7f2bee4f5a5999cacd0576445074cade45360a72a43b03dfdf202c22

C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\cab1.cab.RYK

MD5 bb28b47d930d39e4a3151cd0058dd790
SHA1 4a735a7037dfaffd0e581790e2142ca0869e2fa8
SHA256 33995c66fff9574a6276cce99dba8e89ef9b8f5a61f2728396682688aa884b33
SHA512 96fefc799c47546813c8f16c48f6497d7bc037840dd2eab4eb5c27d9033c2e654bc9c71d33b5e4d7b243b7ffe4af13faad71e478210d71cdda25e76c80210c6e

C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\cab1.cab.RYK

MD5 a29dc037790aac165e75fe962e6cf009
SHA1 41217fb16e7bb58a23046e14d5f91c13087e521e
SHA256 53d41466d737ff348c5f344e90df36b74a2ea5fa5b7d4caafb38248f2f70d036
SHA512 5b1da2656d90a4b5b9077921578f8143b17cf51576ddbfb4727c81ea56b05761fce74c085359b25d64e93f0991ef4c8ff18290cd24eb07d0d9ba6e119f8fcc9f

C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab.RYK

MD5 9d3a31373c7d58f7a734b778e737d5e0
SHA1 0b581f6866aa6e5e50874acfac57d3771c1a7e0e
SHA256 f83a441095efef075ce3275c600f04578182d304c06c57ff8eeeaf908ae7228f
SHA512 068efc1244dd42dd8a8280083f43f95435afcf5632275ccc062b313eb851f3760c7637009196d8128b7c730386248d9a428ce9df7e6d2ee6cdebd853b4a1ee87

C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\cab1.cab.RYK

MD5 726f834298742a7164850525f04234b0
SHA1 4fdf5a468117c50e064c31320bea6f6db171ba3b
SHA256 ecc9ce502b9061d877cc9ffe165824c07165b8a546a8c2384d587b9f07cc648a
SHA512 1f1b39f7a43b7a38b79564dbf78882bd9dacea84bcd8a79b2e0f446232c822df4a745a5d4f04f4ecbc4b88757ca66a227ffc9d962940a4191e3344f4ddb1d9b5

C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\cab1.cab.RYK

MD5 152cd03ca535a3d77acdea0f24dd786a
SHA1 d8e7c93368398dba1c89a0174f40c430eb392d0b
SHA256 b30a544e4cd7327fb2b0cc99ed7b1a65c311b2111a8a12e987f4601d6bbd0040
SHA512 3979926155b44abe25f8f7184d1b73406ebaf20a78bc71a4ba6148939d5c8fd2cbe035f2be45e3e2ce1deaf181d6767b267b1048334605151a907a843f33ddd1

C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\cab1.cab.RYK

MD5 43ce94d774937f98fbe5c2a5bb293b5a
SHA1 c5f564dd8b82b940872644059307dd3421b133cf
SHA256 272c8b600d02a580bc84d95a5c8576284dc60e220c824fbcf2d191b8660a04d0
SHA512 2ebfb8b1f21cee4bf93ec0821c41d61babe0d3bee912fe30b56db607fe31798cc4f9614a75ade08d1e40741439fce299b2dca784d4deb42f38337d62f30eca01

C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab.RYK

MD5 e59a7510e1cf084093a2d8086b87e697
SHA1 be4623683e485be7fe57b79e8cc7d3e8c1293f3b
SHA256 b9b45020fdfb4f735979cab3b3d89679a85d85365aea6daf8e24ae17bc56f8a4
SHA512 c85cc91bd7b457dfaab17641ea2e56f00186f5a422c6911327d2e153362a7ce36ab61da3a331735ed2028c4e2a06dbdab8c48d27e14021c24077132bf14f17b8

C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi.RYK

MD5 8b0710a41f29064d773189807d402ab2
SHA1 0c8cda0626c291f2f747dc08a3c70b88631b240f
SHA256 35f55edf3efde9f71328c876633f5fd546a2cbe17c3b215409d295681a4b0815
SHA512 190c93f559d6d4743ecc5a8c0dd825a17a969417d3d818e87e6930b6c27a6a2e499f20623f2da933f904126b9fd0b2a11ff889fc3a23e90b8bed4964c14168a0

C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.RYK

MD5 9541e6d4edaf8a5f0765a5769abd30ca
SHA1 57212bd0c7e888dc659684f07b403aa0700854d2
SHA256 e74520efa9db9f77579d765ff6c4addf00a28a52165072280aebfc093561b5be
SHA512 19b4ea9c83b9863523f7442671570fd6cc83b7fbcefb62b6054ce55d118f46e9bb052b2d6c3c4d62b2bf5f523f39f8d728627f283873662839bba2895eb2d5e3

C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.RYK

MD5 b582aaafeaee5ad0c76fdb3cc2a68b07
SHA1 8d1fe91bb9c20dc607d22c76524f442ae5addeea
SHA256 80c0935cc92cd3f99c6ff642e133548bff357cf3a23f7850b751e749daa6404d
SHA512 f2566785eb4ddf9cdf9dee21b8b3f4b7dc754037cd92784e2dec1caeffacac6e225c51bbe60d04e4f97b8fa787d6a595c511924284b8b816d43d37d7fd51acb0

C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi.RYK

MD5 80ecaa1befb751c20d2ccf854c19a7fd
SHA1 d0bb23201f5659282c81b05204ed23d1bc50551e
SHA256 41993be022dd2dc235843e5ea95420e984b0fde089816d7e6da8f35af5316a1c
SHA512 f155075bf6add672cb16b7e05b5c0c8b409bedf4aaa76266927d682d9e4706c502889beb2a961a7ca3b0b2e845f72683ef6ab8875b91f0ca94dc615e4e138f99

C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi.RYK

MD5 025cb06722f1349513ad1b1e5482cad9
SHA1 d69b5314e74820f9d42b7a181a399c485b14e926
SHA256 690a6929252aeabd59cf6289215c187a915b3d69fb0f7c02dfd0aedaa4da9aeb
SHA512 dde40c1cef4c594f3915827b91890c78d982d213cc01c92e88128e486ef5c46a90622d22653c5cac1e677dbf834d2fd20a235e6692929b9f093bc31b523f5e80

C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.RYK

MD5 7a78cb79e641f98b651f3a9daaf1fbe9
SHA1 84825c6f088d05bb79c74df8abffabc39110e49d
SHA256 c75dadcb9fb5aba62513deff25128a7cdeb4c5be26ec68f866658798a3b50b18
SHA512 3c548ecbe708a028b9ce1d81607454be35a138e2ee1e3dc3a60522e0d61c5616831bbe0ee6dcc641e95e0e03e977986b8530014f0ab202d777c90cccc90a2067

C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.RYK

MD5 a6510c99321891ddf6db3c621fc77192
SHA1 57ef66c924b9a6f1e5dc295bbc9b12df7fda7a6b
SHA256 42eb9c4b6d6f0033f8a85b231d660cf5688f6fce59ebe9e810ffcc73f7db4dd7
SHA512 6b3854adb960775fe0247548ce882ba3d1cc1e0037268bb3df34b7225b379babee92b27a72e8e997b784e1b497e2256109b1828022a49e0b87958950e640076b

Analysis: behavioral2

Detonation Overview

Submitted

2023-09-12 07:32

Reported

2023-09-12 07:54

Platform

win10v2004-20230831-en

Max time kernel

7s

Max time network

10s

Command Line

sihost.exe

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3956 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\system32\sihost.exe
PID 3956 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3956 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3936 wrote to memory of 3148 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 3936 wrote to memory of 3148 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 3956 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3956 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 4252 wrote to memory of 3896 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 4252 wrote to memory of 3896 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 3956 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\system32\svchost.exe
PID 3956 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\system32\taskhostw.exe
PID 3956 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\system32\svchost.exe
PID 3956 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\system32\DllHost.exe

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe

"C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe"

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

Network

Country Destination Domain Proto
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp

Files

memory/2400-0-0x00007FF74B3B0000-0x00007FF74B68A000-memory.dmp