Malware Analysis Report

2024-08-06 09:33

Sample ID 230925-mb4lqsec5v
Target Sample_5d283d656ea1e5165f2c7b8c.exe
SHA256 c85fec6ed44bdfd54c5f37190ffad38919640064ce718045e228dca65f74ec7b
Tags
ryuk ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c85fec6ed44bdfd54c5f37190ffad38919640064ce718045e228dca65f74ec7b

Threat Level: Known bad

The file Sample_5d283d656ea1e5165f2c7b8c.exe was found to be: Known bad.

Malicious Activity Summary

ryuk ransomware

Ryuk

Renames multiple (7393) files with added filename extension

Drops startup file

Checks computer location settings

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2023-09-25 10:18

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-25 10:18

Reported

2023-09-25 10:21

Platform

win7-20230831-en

Max time kernel

142s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe"

Signatures

Ryuk

ransomware ryuk

Renames multiple (7393) files with added filename extension

ransomware

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Common Files\System\en-US\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02048_.WMF C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\picturePuzzle.js C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\settings.js C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\7.png C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Median.xml C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\settings.js C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18249_.WMF C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR28B.GIF C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\RestartMerge.scf C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\localizedSettings.css C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0149407.WMF C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\SketchIconImages.bmp C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\library.js C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.change_2.10.0.v20140901-1043.jar C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Windows Journal\Templates\To_Do_List.jtp C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tahiti C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\VSTARemotingServer.tlb C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CMNTY_01.MID C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02280_.WMF C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7FR.LEX C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\Parity.fx C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PULLQUOTEBB.POC C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Warsaw C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OnLineBusy.ico C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0313896.JPG C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Form.zip C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\clock.js C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\grayStateIcon.png C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\localizedStrings.js C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\weather.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_snow.png C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153095.WMF C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18245_.WMF C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\DVD Maker\fieldswitch.ax C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00932_.WMF C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Minesweeper\it-IT\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02373_.WMF C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\MDIParent.zip C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB1B.BDR C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LTHD98SP.POC C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK.DEV_COL.HXT C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_hov.png C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_On.png C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN048.XML C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\19837bdc62b7667aba81364142e3565a\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_64\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_it_31bf3856ad364e35\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Messaging\ee9a323861b378713f17421b0d98adb5\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ifcaec084#\76d37f23cee2b392f7fdbd7ad95bc8b2\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\mcstore\67c2902f53638a9056174f6130a8bde7\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Design.resources\2.0.0.0_ja_b03f5f7f11d50a3a\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\10.0.0.0__b03f5f7f11d50a3a\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\system.io.log.resources\3.0.0.0_es_b03f5f7f11d50a3a\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\e4031bd0b7706fd0a686e9bb6353aa2a\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Eng#\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Windows.D#\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_de_31bf3856ad364e35\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_de_31bf3856ad364e35\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Web.Entity\3.5.0.0__b77a5c561934e089\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\748de10ea72fad908022d9507c7304fc\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\MCESidebarCtrl\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\System.AddIn.Contra#\eadb7dd5fe85da92b491154484bc40e3\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\UIAutomationTypes\69e6acc80dfb71c3ebeac12584ea008c\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC\mscomctl\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\6.1.0.0__31bf3856ad364e35\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement.resources\3.5.0.0_de_b77a5c561934e089\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Web.Mobile\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Windows.Presentation\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\napsnap\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_ja_31bf3856ad364e35\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Configuration\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Core.resources\3.5.0.0_it_b77a5c561934e089\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\e7b8df5d803bb9bd27f63f0074775aaf\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_fr_b77a5c561934e089\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_es_31bf3856ad364e35\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\7073e12b4c349a6ad94522e465e4f4ed\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_es_31bf3856ad364e35\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_it_31bf3856ad364e35\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.6.0.Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Deployment.resources\2.0.0.0_de_b03f5f7f11d50a3a\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Web.Mobile.resources\2.0.0.0_ja_b03f5f7f11d50a3a\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\CustomMarshalers\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Web.Extensio#\e2d043bbce0d8d303dadd068037c3ffb\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_en_31bf3856ad364e35\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\policy.3.5.System.Data.SqlServerCe\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\SrpUxSnapIn.resources\6.1.0.0_en_31bf3856ad364e35\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Data.SqlServerCe\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Web.Entity.resources\3.5.0.0_it_b77a5c561934e089\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Sentinel.v3.5Client\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Configuration.Install.resources\2.0.0.0_fr_b03f5f7f11d50a3a\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Security.#\84ebf4aede3a599b943b3320ca704911\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
N/A N/A C:\Windows\system32\taskhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
N/A N/A C:\Windows\system32\taskhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
N/A N/A C:\Windows\system32\taskhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\taskhost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3008 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3008 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3008 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3008 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\system32\taskhost.exe
PID 1728 wrote to memory of 2232 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 1728 wrote to memory of 2232 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 1728 wrote to memory of 2232 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 3008 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3008 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3008 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 2076 wrote to memory of 2604 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2076 wrote to memory of 2604 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2076 wrote to memory of 2604 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 3008 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\system32\Dwm.exe
PID 1108 wrote to memory of 2624 N/A C:\Windows\system32\taskhost.exe C:\Windows\System32\net.exe
PID 1108 wrote to memory of 2624 N/A C:\Windows\system32\taskhost.exe C:\Windows\System32\net.exe
PID 1108 wrote to memory of 2624 N/A C:\Windows\system32\taskhost.exe C:\Windows\System32\net.exe
PID 2624 wrote to memory of 2416 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2624 wrote to memory of 2416 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2624 wrote to memory of 2416 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 3008 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3008 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3008 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 1320 wrote to memory of 1052 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 1320 wrote to memory of 1052 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 1320 wrote to memory of 1052 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 3008 wrote to memory of 30164 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3008 wrote to memory of 30164 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3008 wrote to memory of 30164 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 30164 wrote to memory of 30252 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 30164 wrote to memory of 30252 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 30164 wrote to memory of 30252 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 1108 wrote to memory of 31688 N/A C:\Windows\system32\taskhost.exe C:\Windows\System32\net.exe
PID 1108 wrote to memory of 31688 N/A C:\Windows\system32\taskhost.exe C:\Windows\System32\net.exe
PID 1108 wrote to memory of 31688 N/A C:\Windows\system32\taskhost.exe C:\Windows\System32\net.exe
PID 31688 wrote to memory of 31636 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 31688 wrote to memory of 31636 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 31688 wrote to memory of 31636 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 3008 wrote to memory of 31644 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3008 wrote to memory of 31644 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3008 wrote to memory of 31644 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 31644 wrote to memory of 30920 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 31644 wrote to memory of 30920 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 31644 wrote to memory of 30920 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 3008 wrote to memory of 57380 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3008 wrote to memory of 57380 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3008 wrote to memory of 57380 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 57380 wrote to memory of 59268 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 57380 wrote to memory of 59268 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 57380 wrote to memory of 59268 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 1108 wrote to memory of 62936 N/A C:\Windows\system32\taskhost.exe C:\Windows\System32\net.exe
PID 1108 wrote to memory of 62936 N/A C:\Windows\system32\taskhost.exe C:\Windows\System32\net.exe
PID 1108 wrote to memory of 62936 N/A C:\Windows\system32\taskhost.exe C:\Windows\System32\net.exe
PID 62936 wrote to memory of 62960 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 62936 wrote to memory of 62960 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 62936 wrote to memory of 62960 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 3008 wrote to memory of 63852 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3008 wrote to memory of 63852 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 3008 wrote to memory of 63852 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 63852 wrote to memory of 63964 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 63852 wrote to memory of 63964 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 63852 wrote to memory of 63964 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe

"C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

Network

N/A

Files

memory/1108-0-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-2-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-7-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3406f593-57ce-4523-be0b-a609f93fe971

MD5 93a5aadeec082ffc1bca5aa27af70f52
SHA1 47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256 a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512 df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

F:\$RECYCLE.BIN\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

memory/1108-22-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-27-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-32-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-30-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-33-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-51-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-36-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

memory/1108-74-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-106-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-109-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-122-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\ACECache10.lst.RYK

MD5 54e3cd5e520e7493acdef3a815e1cbf4
SHA1 1b7d0c4d8189ec972595f3e15c411c4d846efd4a
SHA256 60cf5996e993b3a5f87c95cd5c78e91b6148f0d21e50e5347d33b305556d072f
SHA512 64c8073aaa65cd11426735dbb9b33214f14b6cbf483aa830e327a5aeccc99e7881e3568ca3c6ef66c0df9638952fa683bcb3f9a7ed2c835f8f4ed423456e1d65

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.RYK

MD5 eda75dcb4b0ccac5eb27c0bc13bac1ab
SHA1 a4f1187a54c1fa46eafb61a979983f5d7b6680c1
SHA256 56736d528062f854a2948f164deb116b45524e10e79fe9b93967a54a0b8d308d
SHA512 aa99927b59921a7e37c6e955bf8c33be5a87d90a2978b5bbea79a0906f4f26c8ad019921548203d6ea1fa3c81ca6dca3f6dbe259bbb2ffe0e591ef03ff8e81f9

memory/1108-86-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK

MD5 cc22f9be6e1d46ddb76543565d7a9771
SHA1 2c662fe014a45d2326688e6336199aff60099acd
SHA256 14d03a1b2e76b0d35bdd065e1904f579dcaa0d7c8eaca1814904694ae981076a
SHA512 58ac72a66609fa76dc99fae81cc10e74be2f04604a5913a70ebf929b063864a5a2906f2886546682b5f5d8cf553e20e87a806a6a78f2415aed85fd6bd5276f2d

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst.RYK

MD5 31f0c4bc13240c75abba152a530e40a4
SHA1 14add951db5e1549a675fe7509626ef04ff97e51
SHA256 763a507dfda669489a24916421c89ce2b3c077d4838603aa0822241482f06398
SHA512 76323ab0a0fb689ad569ab729a6cb1e736491d92b4ce32c471edeeae659cda6864b99bbf8c5fb1ec0ee13e1cdcf8af60ab589077a341e0e4b2d5cb140730bf37

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Adobe\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

memory/1108-132-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-134-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-130-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-128-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-135-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-148-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-146-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-145-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-143-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-152-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-179-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-178-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-142-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-180-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-185-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-195-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-202-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-208-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-199-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-196-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-192-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-191-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-190-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-184-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-183-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-223-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

memory/1108-222-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\java_install_reg.log

MD5 3ce66beaf91c3eb6d78d4612d98c6f8c
SHA1 4edeeb63244f5752e2b52998618219c37656b24e
SHA256 c182a7ef0cc1c2698f11723f57b625e7032f6e3214f7ddf1c4be52fee78bf8a9
SHA512 4731b10cafc0d9851d914f74c759964e09b33af27bb289cb0c2bb5bd22d14000d0691fabdedb2b3acd669ce44a2ae3b2ee1b8617e28f432a3f656576876bad97

C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI1A08.txt

MD5 2589a4bd85e41dc9863b17f07d1cfc2c
SHA1 ab34a16d40c73e31e288962ef7e835ede942474b
SHA256 b24e5db404ba5ea1e3565aa21fb5da0da7a80d11596191701d0eb396130cac19
SHA512 e00a3fd07897454cadf3f39f316d238a4c484352900a96ce38364f268a14833335f760a1b9509f1c53232d6111b4001ff52cd50f2472b62941d4ce11c07f2ad3

C:\Users\Admin\AppData\Local\Temp\ASPNETSetup_00001.log

MD5 9721d65ec740abef1524f438a379ac67
SHA1 911ea28f17a05e4b9adf491c3e3386a19f76e37a
SHA256 98fe37a5c7fa0e31aaa3235a0bebe77a7be945e46153dccfe4c1afa9f5452615
SHA512 3ac3107b37226584d9dffb3efdc95326ff3ffdc546e1b5a12093ae76bbf0fb43698e7c348ed1b8c2fa12cb08dc150748fc97afd38d2afc5758ce1c70470e7f73

memory/1168-334-0x000000013F0F0000-0x000000013F3CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI1A5C.txt

MD5 ff441384ed94acef46a93f7b0a216376
SHA1 330826b0c2176e28b3542012113d3ef467d39782
SHA256 e246bc57c4db40696c92e6247201f50592c77e56578debde67eb43bfd1970385
SHA512 cfa3a3a676dbd8996f8aa882145d4ed81da2bddb8e29fc44c33bbf8863ff8bb94f2f44d76e730bcbdfe80364fa81b1430b13958f1578d86fe269ede1a733b120

C:\Users\Admin\AppData\Local\Temp\chrome_installer.logb.chk.RYK.RYK

MD5 7a48443858864f40f3861b690dcb0a03
SHA1 ac533369418a4f6f39a8f4a80bc911665bf6e4cd
SHA256 e958a87a2ee0ef3257f1f9be2cbbab933a608f7e2efe81a7822b1b265f1f954f
SHA512 e48f6d9e5900f88a6658d6cacdbdb6020d403d76c628ee45b2928e841814d84ecacbf41001c8782669098675765dd36e48bbf0765f55cf13f264b13015968984

C:\Users\Admin\AppData\Local\Temp\ASPNETSetup_00000.log

MD5 0093b2154b6262a1a90a32c24b63c7e4
SHA1 6561bf868ce2e3e8db851ea2c32ee525b9bdb54d
SHA256 bb35de61578e85380409533d525162bdc451807d8be9ad4a887f7ccd5113a023
SHA512 b2910c5bcaf5914be01159f0c91ff6ab16ec3543eb4b2f45d9142a18197a2b2c670c3d2a5016d98910e1d80c6afe076c43efcbf126aebab2e648856a618c66df

C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility.txt

MD5 c641b28228a279acb87367a5016749f2
SHA1 4d4f6d47820aba4d0db5a608150bd859e1466412
SHA256 9cf5dae7a8cb436ba04c9bd7545c55869c5cd56c39e2fe4fa024ee3d5bb6108f
SHA512 71b6ab77b4e2e236c4294a513a02fa4821a8ae668cef53fa14c5b0992a326c757a12a2b627c76f7c840232ef37a3656351109570b67be707b10e0b56af44aab4

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Graph.emf

MD5 dc2a5cf6cc151986885421464b213502
SHA1 4cb1fe3fdd52c4dcb865b6cbc28b1595f7675da6
SHA256 5f82099c9f0120744555c89bb995ea844583fe0ea04e3162a02c612ee8bbdc49
SHA512 2eaeb5bf772f607fdc64cbf87ebcc5a22dc5aaec6baebab9f5209baf4ac38cba59fa2b91966a15a8b62d012bbb7f257407a5ae68845e019381f40bab1a2a0496

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Music.emf

MD5 c20169b1e41595b4a209f5f4082c8584
SHA1 47529ee8c4b05f4bca3d8152f05df65e135fc869
SHA256 3b373684b2f8c8b8ad9e8ceda9c194dd1e4e5f5db8d85e1f7cd548815ab9cc84
SHA512 968fe8fb016cbeb3cd72df23b33d25e977b28adb211d885c1e9574d5116bff420cbd1f442bda0331549e336c2a8963dd68b3a3fc8fdf8f17611067ccef94b706

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Memo.emf

MD5 052443fcd53242504c4444b715cfd83c
SHA1 6b6d3399595cb493fe11e204b9a068f95f91212c
SHA256 b3f47f6c1a725141448278ad2fe29547e3038d736e0bd3c285ddaa06e400d7fa
SHA512 28a893f4c126841c124c70c692c8cbd115b91d1343aa15f551a5568dc3a508dd36fa560043cb1f15eb254ca74104f34cc7f0b78ef022c35905490565613b5c81

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg

MD5 072a99db34fe058c7a4dcec629acfe02
SHA1 c6fe8687c4d7bcf699e103d81abe337171ca1f3d
SHA256 913490306f6f80590220c5be5987593b4f406b1e47749aee5c8a7a6e1c4642ab
SHA512 b9305bad8f2104f0be2e5e49a5446ab1da9b2cad918991589348c984e9a75328d3376fb16f46cbcc6c9d30c76ef6a2070457872ca86e4c6f043494f28250710e

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.htm

MD5 d2404e069e7fc78b75518e4e96899d85
SHA1 080477567bad976934069599823e4718c76981e4
SHA256 27c72b12db19cfd1458d38fed49e84fe7f43c37efd09d3fc70e451dff06a3612
SHA512 4d79182e2289c69ed929a0782c0fb07b521671debc50d43922b882cebeaba40a44cbcfd4d37db83e1cf01cccc881818caf8bae6c175a262dc9186da4ad628192

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Seyes.emf

MD5 a138641cff36ca88395b532d452acae3
SHA1 d7fe5fbb227e2f8057b26b7bd1107ddd2ea55d47
SHA256 d0e73b024ade7f411d174618d37cc23f3c9e1ee557707e978a036b271215da72
SHA512 6212f28fa2678b99fc0fbf20ae34a5644982144752bffc1d6f75130836d9ea3d22d24f6363f6ef116512a9d4e9a4540b7e0b409e34f9e7abc30a86f5391e3195

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.htm

MD5 a0c3e9a7b059f70d07500575dafd092b
SHA1 ac41b3a2cd375f0c0f515c156481e193a142e532
SHA256 af89adf035cff5255ec3b6a89628f2c2e02a73fc7286f116e4b8a962e09ccbd9
SHA512 98016abb43c32dd81a1c5cd1743ca13d3841429a1769cae86dbcc487ab889cf19f0ec70befee2332e7169c3a4601873a69b06bf33cb980d919fee07bf95dd9e5

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg

MD5 eda9061e0e715989c95d8d0e41d771c6
SHA1 d737c9f95029369adf5f00f6de2dcb0dceef2319
SHA256 90344020a6b1864c7b7f5ac214d793bb5536ab0c194d2b32219886956ee1853d
SHA512 528bed3c04127594acb2af48de643baf2f07930e0f8efa9a4bbe75139da8739c5469deb18a81ccdeea8a753b5672cf22a6812ac15aa64c9ba4d39ecf83c59987

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Tiki.gif

MD5 042624b0268bfa27463823e573a305fd
SHA1 72fc8eb3ce085faa8ebe701ed0cc89429e0af4d1
SHA256 3f211e9b4dbf9b97f39b97b17d8b67c58ba791f946135f5460c99821d88e6163
SHA512 3b0dd84a664051815537f7bad8763cfc52f1752fecfc3f17ef05728aaba53389420211adec1274b974d2e453161803e131f82a8f8d4058ea146fe42f7e9cfd51

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpgK.RYK

MD5 709aeba4e59bdda44767d01e834a0001
SHA1 1087377e8a8d639d11545deafa89b0dcda21855c
SHA256 beb904beaa1de8cdf01f2d7fc98ca5915e2502ac1b90f080c78bce5d459610e3
SHA512 1677b477d73237acf12c5a9c64d79fe7adb26da94ccb78781d9cf6bc6bc51631a30b730811671688a66e74f2a60de2a7d6c46d16869da09bf7c4257a1dbf1a3b

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Monet.jpg

MD5 a38d13041c6c48cc40f41ea2d037216d
SHA1 9fe51c483866ed2925828a00d638ad8c384e0006
SHA256 995105f01ca833f54f1133534e48f2e226ccf890ba602ae6e7d2564d6bfd19dc
SHA512 a9b13c287b5d19084b746204881aed5175a43f11a61a218609610e1c2548fd53dd63a2e1f27c022b0dead752f0e2f011ee26fe0b18186519ed21c3fd8efc53bb

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.htmK.RYK

MD5 e396ae8f7eab8f80bc3a63b39a193dfe
SHA1 4c5817c1a5b69ec4795fdbb90fb0844fe217c4c2
SHA256 f8f2e1e9767584689f36930a27a6f4980db77c478a2e4b6309797047aeb79ecf
SHA512 cd96f7dcaad8723470bb1153bf3ff53c5ddba73c4821f6e1150f3ef620e05311856cb735ac3f15a543c4c90723c0b3a8dad335c0f472a7a4af3ec4f030ab5e05

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

MD5 2a44550451358d98df9f59a49e576be5
SHA1 4513e2a1274ab6ffe5f064dd2797f26c217ccd9d
SHA256 ada638cd1022fed89427f438714eebfe53a7318d01f02048be603a1f018c4df3
SHA512 dbd81b8a8fdbf46f3f8a15f6396234dbb89d6b6f28750948e5c7a68604f8c2a6a84794b31435ce96d2760ca2081179610bc86c5ef5c29992cd10146439a45d82

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML72.wmdb.RYK.RYK

MD5 e40ca37245930fe14b7e26c647600ff5
SHA1 37e72ea019b920fe0e171736f0f01e4ccf1a6f85
SHA256 a8587070e0898a7c7110278f7f84517ae219f24443a15217e48b5ecc543592e0
SHA512 2dcc5ed2ad949a4e24b9ab18db1fe9dc7a48bd438d646a67bff251e931e1573c363348e956c45ec525d00906f7359bb53999485497b3d3ed384e1ef636b1bed8

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms.RYK

MD5 3c55ebe482229367d627260d50b469cc
SHA1 53fd04ddda822c1de2dfbf126f687d050e3d649c
SHA256 23c473183bca1e6eda758dc33ac1cf6dd751f573e2cce57c66b21ca559011ff5
SHA512 e6f6557296f53084cbc58ef0a7181d7e76dded01d503ae9f5700ca8b7bd703d598383e02047b61206d359824b222d17752077ba633812f72c2c2c054627c7e04

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.bak.RYK

MD5 921a8cbd3adefb906b1623ee9dbcaf4d
SHA1 51d34a71c754e057afc46a433b3efb9617c99277
SHA256 003863e7e0cce88bd816bcb1c972c839a28ca701291f59864ad0c4bafe2d5c8d
SHA512 cd439c87a3faaf6aa93d67f91fb350c5537604897f681c61b16cc81c32e630b43333a80734728c7d2e454e3ee46c930d464b187ad67d95c4c1e145381180be0d

C:\Users\Admin\AppData\Local\Temp\java_install.log.RYK

MD5 acd5f0927e6ef14c52b3c84e9a504315
SHA1 37e97a5449f039acdf282faed3ef1f230e080ce4
SHA256 647c66e8107b02ce28b94d8f980f634496c475a41118e12a29039fa565ed8540
SHA512 c502c80cdbc754345e3f14ae7f1de87c6f8cce50ad18aafd53cb1a49789ee466202f0ccbce40e82a40e52dc18785ec2abd3a6c53ef78f4524c1ea9e10b30b367

C:\Users\Admin\AppData\Local\Temp\RGIA7C5.tmp-tmp.RYK

MD5 5ee0b0bc052b3fba07daeb56750d451d
SHA1 fdf419673a20f09f02ef4dd7afaac0a7ccd1aaa7
SHA256 9090edbdced25b7d6e5e71bec3a21398285b6e78cd0fc4809da17eb4a664ec57
SHA512 bc532566bb81e433505c2ff4d13a95e75462b81d7607eda80bf518a854e633d410055d56b11fed480d077f085cd470564c7b303ed145d91e043aaf10146cb845

C:\Users\Admin\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK

MD5 f30a477a711554b44ec3f4434a1b5972
SHA1 a409a933ae6dea784d5e1974f27529575f8c4b81
SHA256 9cf00a9fd242e5a9b15d7201c790bff346fbc54376319e19f590b84f99f92f2d
SHA512 7d125776e056e74aec26e09ebb0d0a762c62982bffd3566f7e9fa529609a1c82cc017f91f50e1a00713fb0511740eae557e50d9e04914940cbb2514e3a69aca0

C:\Users\Admin\AppData\Local\Temp\Admin.bmp.RYK

MD5 53c48d28c42906c4f91ae7d88b4f1db9
SHA1 9f1c1a5e3e31945151dbf5e0146a7ac3914f39a5
SHA256 d12ff3d07071c11390789d5e401b0525b4bce244a121f7508cac36047cb5dc7b
SHA512 13bed67bca2136af39829d5f6e6d03f1390e8ec91c1c0170272a8f397d852733b16e8dd043720974932c29bbe376bfa16c74689f072717e0aaa776fa79298a4f

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.RYK

MD5 45a42eb612dc25af713019da526a7de4
SHA1 510b1c7cd724f34d6ad6c1005194d66c5a7fc9b0
SHA256 3a5e14fc47e516fff9d735bb892010dca58866742043e7a4d43e23f70bb37129
SHA512 8949bf8cacb12c3c97e3da59de1353ef61d74b97791d60249ca00973b682b258ad78d1cf35717ffbf9ecbae824a704a0bb1fbbe858ae476bafe3ea649d44529d

C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log.RYK

MD5 df6605996ed11fff20805a081e468717
SHA1 4c374321b2705efd3d5b0516a7d149e106702a8e
SHA256 129895dacc24c90eb9563abdd152d48feed1aceebd65b76da13810c4f28a51a3
SHA512 8730eca97c56c3803e740e220169c4ee77b942c2918c94273f68e0aa5847ba7b03829c0bec4da10b32a5c250ca74e1033f32aa9615a8c710e608e5154c90a7f9

C:\Users\Admin\AppData\Local\Temp\jusched.log.RYK

MD5 5e2a82d022bf55cc561cc8f3d4588390
SHA1 68ab7600bc77e91c8365437794cbc40c0f3ab5ab
SHA256 d63c5e325d4390777ca83c8a9417bfc9dfb0d43048bb4168b4ade7e998675dac
SHA512 acc26528873c5304d508348ce5bb29bc58da1f8136f112ca76193c2d441c79419ae4b08eaaa1af34ed13393c05fafced0e6b673e15fb71649f179a028bb4acfa

C:\Users\Admin\AppData\Local\Temp\RGIA7C5.tmp.RYK

MD5 546fbd0aa5dd6721eebfe1fc11d74630
SHA1 4e34d1ba9d714b8933f670adfe6cf07757cb57e3
SHA256 c714430a75c49d55bf239349328eb0a8a2bf5416969f3796d33bd542ec52e036
SHA512 8dc428fb4eafc1ab2805d6280902c2c54a0bc34ef6bf3869a839ff48765388bd0fc1e112b379bbfe5e49fed084fcb6508d6a067ff1564bc07c98f3dc3e2e48eb

C:\Users\Admin\AppData\Local\Temp\wmsetup.log.RYK

MD5 3c0d7ab3d22630e29903cb7134e1c999
SHA1 c50e25896aab634ed1f5b82cb961d799e6501fef
SHA256 c00714e88b61aa6ee20e83f4405d7ad5abb3bd6e2b46d580e231c73c866d54b8
SHA512 238e20a1dac81379e3cf13d35676774334aa3f214b6f5ca64351b0b386aa441ffbb0047a95c634511befe0e9615a64f8538749e1f3f1935e924f1364dc7757c3

C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb.RYK

MD5 2705a086ea9eba06a3e4f6571cc32658
SHA1 d006931a19fc4869605a68ce75def04bd9f00a3f
SHA256 379ea2d9c15f32a870ff80be34fff2f59295fab2252baa9cb9f27df55514ea1b
SHA512 2402b79b5993cca39f5dd56366837a948de2be018808a1304f8815935d6ccd68e807b10cfab0408b1f98ebb77cc1d2df076a284cbf9e71a4bab2a695fd1094bb

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xmlmicrosoft[1].RYK.RYK

MD5 414e9feb0cf367d0a2e40ceb352744de
SHA1 0c6f8672c35ecbbf81d9411573873a0ad079303d
SHA256 6055aeae4d5b5014372f70f30c1f81ed6158521539c0633d56db738ca9515aee
SHA512 223efbf8dd91428e7cede907e7352edaddfa9b25f2df72c3c91323597b4c5751796fdde580d8793bd157d79acef397a71d91cfb321fad16a3509f5fad65ef018

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\oeold.xml.RYK

MD5 a18dd709f4348732383cb4fb79a9b935
SHA1 a8dda34cf476f4a182ca5698947adabf2efc8a0f
SHA256 f697b4e60b1062616ba3026396515230e6634f540cdb224f7333ae5e3dbad826
SHA512 e60d7985c27f8ffdc1b17de02be98a4f33f0220257deb1908e1c3409d94cd5b8d56a784865056c4bcfc4fbcbba867f5529db6c172cb44e2303e500ed3f8c1016

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edbres00001.jrs.RYK

MD5 2f5234e601fc94f9a9479951dd0bae7f
SHA1 925c0092ab06e2af6b3d1d1c870a22bf87328c85
SHA256 3029220cf6094c0eef3e0ddf9babec3c80db9212c34aa9fc7f1b4713cd1870ae
SHA512 1fa88f13516816efa1c13e44ccda0009a7a4283adc6db72df1b287143649f3034625b0c675111eaead8a8f83d66392b32c1cf4c9a8504b3767a78395ceb81792

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.log.RYK

MD5 547f31397d4b28db22b2741ad3d4f193
SHA1 3d8bd3a6837e0e2a041ba7c5aa17a0301a6ad063
SHA256 f53e1f75785b289b2b2838595b7e1b610c3798096620a84ffcab7b34b554fca1
SHA512 3c18bba02d98e5b0e0ae776a446d7e19bb95bb13997bf65f4a9d0704a70d57b424852d3411626ee1a98ea238d3d472ccf85dc84ba0fb720c32914a3b798b6112

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms.RYK

MD5 3b7b15ed43edcc7bfbeaace073b430d9
SHA1 06eeaef853be39a922e3e67d662e5ec5510d3374
SHA256 59f3b2014928520c3114a16d540de1aab9ec04af57f6f3f512d1f7fe7dc4715d
SHA512 196a85dd7f1616c0bec6735ab9d8001526ebd70c19c7e7520c3c62dff0cdff2ef3aab099225d0e5295c05d3cbb6a3d44bd7fc63e41542a265887dce025602386

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edbres00002.jrs.RYK

MD5 4c914b44b1e0fa414cf7b2227aeff97e
SHA1 0d677f3bde34ac630dd26f0c6f63dfc876b2a2a1
SHA256 d696a2cebeeb9cfba03972226e8b544ceaddd7c044b30261e1224ca5560ac447
SHA512 6e106c046ce012fbe5b68f90f617dc9a4b27760908bc3c4007d9d7480c75af8d98af173c88ae3cf75734ef01509042130bd3c823353a0d52fa6fb010e76a11dc

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb00001.log.RYK

MD5 94ee7bf16d72f4e5e191264f716b940a
SHA1 68a32dd0343ce9cd90d750ed3d1fb410417445f5
SHA256 5006382f123d0ad0888fe13d6ef473eaa7a2df3dbcaa8dccdc13a77ac61ea012
SHA512 19dc089547c8d6b35febade6f31ea126aa2192d63479d68ebed1f94c59ea39acf4afb781e0142839146fbc393f2cbd2e652a79ab22195185c6c9de973f2f5d04

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.chk.RYK

MD5 16271359aff142e23a96614684da04fa
SHA1 12e80aa0683dd060852dd91914ed788a25b782f6
SHA256 1c01096db1188a0d997d3ddfa9efb03a8ea766211295fb2e20f29ad441719593
SHA512 70d8f1b91406722cda4647a6ec3ef4b69f82dc8208102b4573bfad7bbb72d7a15ddf7a5914a94277fc61f05579353e5ef274cacdd9ba044fdfbf8f6a1e66115f

C:\Users\Admin\AppData\Local\Temp\dd_wcf_CA_smci_20230831_223512_435.txt.RYK.RYK

MD5 48d7af219744ed43019185d89e7542cb
SHA1 d1eae10137c8bd9466862862dd3d1fc39ef6a5c8
SHA256 2dfcc5c7ef4a497283ad9c6bd0c4143770511571fbea67e846a85eab1e3c6045
SHA512 8d216e0530022814efc12317ab33340a8d8c5e0d05dfd5cdd789178adf88ceb15fa64a86c54a71ccd97fbba3c98f283a25cb6df06c140483997b21de49288ce3

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.MSMessageStore

MD5 81ab57d91fe28ad968ddc0f3619c2ff9
SHA1 c8193026fac4edb8a82a3f70e35b5daee165b2eb
SHA256 d86c0c3e861911952e349bd24fc65e358ed0fac8435d91768fd6cef3fde086db
SHA512 e0f892415345e488c44aeba09ff9a3089faa05f45c75189624b4a3084bf81cc71413d68560aeb62684f9dfc98fdade0c40912b2ecdbaca610c9b772a394eee82

C:\Users\Admin\AppData\Local\Temp\dd_wcf_CA_smci_20230831_223514_448.txtts.htm.RYK.RYK

MD5 06279098de7a1fe003c72ae3ec3a9833
SHA1 f3677b47177ef9f1d8f10282a04f91a3f4b7a2be
SHA256 bdece2534575ce35393e16e03b58202d2b23a9622a2d39e1312c3a3e20d52981
SHA512 d802e9a67b2eb88a9e10d2257661d50970945df37d7703628eca2936427683edb8b0c448313335a7ee9f881a065372d47bab840770f6aaa00fa7561b638d0788

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db.RYK

MD5 328d0bac383215b3fc71eaa94aafd37d
SHA1 3c3e0f9b7e5038ccdaa7c96b1cd7cd268316d58b
SHA256 6d994351c53b2c4d3d94b9246ea1afab1157d7e2bf847a7f61a7088d9cb7163e
SHA512 d322b57d322bde5a790fb68eeca20c3890974d389946bc519d70a627d1b7b30d910c1d823dc2fac5b58e5f5bce416113ea274096cc70e534e76e560995f66db3

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Admin.bmp.RYK

MD5 53c48d28c42906c4f91ae7d88b4f1db9
SHA1 9f1c1a5e3e31945151dbf5e0146a7ac3914f39a5
SHA256 d12ff3d07071c11390789d5e401b0525b4bce244a121f7508cac36047cb5dc7b
SHA512 13bed67bca2136af39829d5f6e6d03f1390e8ec91c1c0170272a8f397d852733b16e8dd043720974932c29bbe376bfa16c74689f072717e0aaa776fa79298a4f

C:\Users\Admin\AppData\Local\Temp\SetupExe(20230831224110820).log.RYK

MD5 4f574a4f859be1263172adc876e232e9
SHA1 3920221ba6503aad181e831b8e7bf36fb8bcbeff
SHA256 ad061241c330f9038d09122cfec73bc1528c72d3097468298ef0a8cb63572d73
SHA512 b57f92fc4e93b1a36d75dc12cdf08e29a6f04596b06861b91bcd38958b50b10f99ecd34797bee02e55a26ed7d7d269cf694562dca5fae1c828448fe34be3340a

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230831-225929-0.log.RYK

MD5 1908efb307d894abe010dc163348a992
SHA1 e8422bae604c6d097770d098073bff04a77d7c28
SHA256 96924ada0968b9f699cd8d7f037ff0052e78dfb9006a8b72ab7ed505ac0c9291
SHA512 f08faf697ce441a1575b3a351a4ed72a3c1cd188232fe70ffde6e5c7547dcbccfd574632b1bd31720bdaecdb8718724211cf5c8d084db0bca0bbd9716e943a38

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230831-225339-0.log.RYK

MD5 e21588dfa314c66a4b74d74aecaa85cb
SHA1 465c44ec0b12d536468d8b0b843f3440a141bc99
SHA256 0fa4578d54234f5d419b92ef2b8e1499c0926e2958d53ef753c799c97c9dcdcd
SHA512 b0b3d4026b678c039672e4ca05ad17b3dccc925ddf4718ad211c6b7aff9f5157c23d6d2d8eae032c12e0bc2c799962752e197e6bef9f48d227ee2da02c9bb6be

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230831-224748-0.log.RYK

MD5 bc02bf5bf9954a0219b98fc8dc0267a5
SHA1 e0755754b0fbca851b50fa83ddca06dfba7ddbb5
SHA256 9c44b52ce816b7476b005191b81e809bb8df71bd7c40d89fee36d91cd3978c3a
SHA512 8f8163ecd90f803f635fc1967148cfeec8eb72e2c41764cd9c3f79ee4ab29cb6a59019f729c99dc6cd01ef8a60771bc3b1327ea1c4f314dee0331109d0cd85c2

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb.RYK

MD5 361a254f0b14954991e0062f666b5b19
SHA1 4823b76956de52f9286471118da207102bf29fae
SHA256 ca9804ffd6b2ac1cf1bcad6dfb8851257cb012f8de91c9c3e078d969f26aa8bf
SHA512 65f5427beea1dca9543fe399d6036b67049fd8ff5fc8ab70675028279cd982a28719d25262c0ad9f266c2a89a9dd74efd64379889b3a740d3ebfd907c9515c3d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JORLV5PC\favicon[1].ico.RYK

MD5 c509016f511ee109d5d62405cec68074
SHA1 b0c31fc277bd2ade2451b84a7f716b02e54e5a48
SHA256 9605c752a6c06e22a38b28e1168d8ed0e188a3d656a6f538ccb09ea9a6370a19
SHA512 05bcf57edc79471da15e3d5418d70ca543f4dc39836a7a0396a9de14c6e6c0c820b594af4a12dd33d95cf15a308a1a1484e5e97ff60a346fed26a0e77dfd3ff4

C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI1A5C.txt.RYK

MD5 f24fde7384c1a1555cc7054f2d641700
SHA1 ff44fe97abdb17e0d2641f6561a431aeb5c1eb03
SHA256 ae6ff6a3c5b27c8a5dd59c8054a6093736cb7b1ace82671ce8172624b02c30e4
SHA512 50b63689b7eec717893062350bd1d8bca5f48981387f435aea96b7b8328aa2a5df0bad83902d7ac7ed5eb4e7716eb3218717b44713e95e39a186760a4f7472f6

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.RYK

MD5 4c4432b1db253aa97842278e8f37d0e1
SHA1 5c7d6b466b182c7429d8ca91c242d46f63620aed
SHA256 e13d2af7538c94f86234e986f3000ca5748f3a1f913f534a08d3e04385a4bfd7
SHA512 54875d8b176054b22fa8963d2077fff6351916f4422bb585cf52fea58d303a9755ca31e5092ec7169eeac37567afc9b99ba3f3fcae8803cbb5e506aaacb9153e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat.RYK

MD5 68a2305102538fc0a95c9d81589ede5d
SHA1 92be25fc3fa64d00a9b583f092b7c69c37f18d80
SHA256 5e9f30bb3831194c080fda4a6da883879c93886e40bb68db251913a76cae09e4
SHA512 93ba91d5ffac97abae8c6c240693bc3346cfd0a2220097c344cba0c06792f36751bcc1e02ad7b8f47b46a70d6bcfcde7934b5e1935178103e9ae040792c67740

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat.RYK

MD5 2378eafd9362841943a23758c21427f6
SHA1 505d240dacfa5db47f11514a7d46684e8fc92d09
SHA256 6f49c3be292a49a457451224cbaa0a54529201eca21bed526f48c0be3be17c70
SHA512 cad723321c3475ee430ec6718e686b53a03526472f74b58aeda0d6a0d5f6549f8d89b9bcd5986a13016a1c39e9267a411eee6a22bb833098dbe06bc72ff37b29

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.pat.RYK

MD5 a78cf74ec9a4e9c4be057091242835d3
SHA1 148f4867392a86a12f2d8c5192c23e9c890fdeeb
SHA256 09bb3f077968fe6b6e7618b99df434f2deeae85691c1697813e118666fdefb0c
SHA512 ed3241db90fc8bd64043e0b83692ac74cd80ad7e4dee30436c214759bce021a182ce6adba9aaf9fe3c922e4854fa37c8001c4882262ab55030485fc60e4031f4

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Psychedelic.jpg.RYK

MD5 097550acbf0f95539114ac92a9d27ce8
SHA1 d7d405555d85e9f57121642ab3aa58ad49ecd1dc
SHA256 89added2818b1e130c4a9d293fda76e3c582337ad6c52d65287cccdc2b2f3081
SHA512 04104635aa1ba5bf41822bf66f7ff05604c500e21f1bd02bfce4c24004463e7a56677d4d20d1b0972acc422b847c8bf3c064fa3b7b95927da280d6ce1f73355d

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Connectivity.gif.RYK

MD5 52ac94081985e3809999855679922de2
SHA1 f5a522b05ca00ceaeb63270f22705b73c1bdaa69
SHA256 c6b57a9dd18c232172dc9afd230f5f3418dc2f149491c72ef64f993feabe465e
SHA512 235d1e7e924e9e4679298c2d4155ea64bdf209ba48078bda7314d2c668d2e2189db9fd4cb84d4c79a0c2832e04f88df2b0485488dc30519f78c94e4a4bcf8acf

C:\Users\Admin\AppData\Local\Temp\2776d71e-2bea-4591-a9a8-4636ddf7dcd1.tmp.RYK

MD5 e285556ab78c0f57941046d125a07ad6
SHA1 f46ccd99700819f3245439b005fb82350c40922e
SHA256 cd87d5676a75439caa903f00df4f029be18fdb9d87e1ec04d2b47bce0ee6888b
SHA512 7d3732b19db8e40709175e0c0cf11a90ee04e5b18c25f1010ad3990aba96c80bdde6fecf5fa952f99b011dbbf2ad06cfd1534349e2707df7d6759d457a03dc26

C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI1A08.txt.RYK

MD5 ff15fe53ac740770334b50c0150fd711
SHA1 deb34503133e1e36deee4d1837958e87e69edf16
SHA256 6b03bcea60f48b8964ccaf93d323a54c23c9d9f8fb6f9ddf8caed2ec71e4fa61
SHA512 5f7209ac5bcd51eef1785267873b6234d8aa7d64b7c7534939af98730ebfb6b70c553d07ea688cf3d91cc0154e6b88f3d9c82ae19d9241cb91276b606c3f451a

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230831-225058-0.log.RYK

MD5 081831e983f6fc346a477b538c349d37
SHA1 05b73b13ced50d2bb11a05d02356ccdfb9a3d380
SHA256 3186ac422ccf9e1e1c7fae21ead28f0be79413c559a5aae3e183da50d433d483
SHA512 2ce71bd11e8dc2a38f7dfa7efbe4907293112d9aa5d51a2e1f868e19f1e7bfe76dbe0879812370a9802a65a4ef72324c0ecdb8cee2e5eab1a249887f31713b91

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230831-225639-0.log.RYK

MD5 1d06ca10bc53ddfd9464e55d177857b4
SHA1 eafea7da536531606af6bb0aca1611a9b429e716
SHA256 76871334ffb7850b74688628c0864c2173c9e1deadf9c0c174b6191516151d53
SHA512 44b2213894de3f10e89ec3d256220bd9c39c8b8e9323e4d759b4ce686f784782427647718fcf3155086b616eb3afb953ee7b1913801232088f8e8ad151b574e2

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif.RYK

MD5 4d7023556cc18861a11c84b5a5fbe1bc
SHA1 6a8e655596f3bffe20a7ac892895616a7d007428
SHA256 d9347d9b25ee66e507c65a90ea469b2f9d853fca47920a4ef8c345050d31a134
SHA512 990581ac4e5c7205f547253417f21c997791977f8bccdbd4a6d2c7d8402b988097a8158c850155c0bb8debaab0aaaedc8567b1fcc1409768830e1c93a016d28c

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\To_Do_List.emf.RYK

MD5 fd0dddf9a934015238411ddbd4ad2fb8
SHA1 90bbcdbd89e486075a12d32b0aca962e8f505b7e
SHA256 580cd7ea302a1d20df0e5883b58d8b1ff1138b1d616016e1b6cb9a069a5d60f1
SHA512 38a1b72425fd2ef8bbd213e1086255bdc79add82c5f5c36a331c8c2fef75d66764fd120d7b9c8ed3c53fc0edf6e99cd43c9760de25617cf9dbca154081ad4e75

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.RYK

MD5 ce49db267efed6efbd81eee3d8bac442
SHA1 ba98c4a1544b9022d802c1f7d9508166d3dce551
SHA256 6eb33a5734f9e9a8e628185ffe9a666f3af15addf494689275defdae8061cf70
SHA512 f337617b08e13fa98eb8c394eabd26b9a6e0dcbd59d98137cc6edbb2df818a4d21ad69aad21e676e7ff1be5acdfe9945803d0fa1d82c3980d9a8acdf1f018d4e

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.RYK

MD5 76813fae2a62dd90282486ecf154fe1b
SHA1 d0e7cb4df51b8bae14b368356527e13504dbe82c
SHA256 c69761a89e4c2da87ff82c145fb502ec091569bd524832ded23e5a1f6928b14a
SHA512 270567c92dcf50c639a3ba987c9c1e5efdd53f0716367c9feeae86ef34cd287129e32584149ef09b4a858734550b8e25dc80aa932f2d0ef5590d121bcedc4309

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Small_News.jpg.RYK

MD5 17657b195d74d11e35bda6dff08cad9d
SHA1 20a87e6ea097c2d50392b659c8dbaf38c75b71d5
SHA256 3eae0420c3457a96b4bb8d2c653c7dbbf3c99d2e0ccdf4f97a2cca0f050fd1e0
SHA512 0123d80fe4e0cd468e7889324dfbf200bc1e09e0c67220025e2e40b5de033d7edf4589844045061e66460e23bc7cde6cb041e937e2520068accfc863d66e3e94

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.RYK

MD5 22acf455665b5ee1dfa4450abdeb3cab
SHA1 5eaf5240c36c8dd264779a2c685f26dd4c4c00f5
SHA256 6da6edd53b23eace58f725f53a745fc102b961ab129f1b2e5d323b4cebb3d8a2
SHA512 8725fc9e24a0227db5e99fb2e4dd06d89401f88978720c690dbcaf8daf4326728f9af4bd0cf340adbafb8daad0350fc08e337c39bb6af1ec0ceedea4a8d19e5c

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg.RYK

MD5 5518aaa078dd9bd4afff2e4dc1a3c1e3
SHA1 834c82bd510783de838e882a692c1cce9d1ead50
SHA256 378fa9bf7eaaea4d6b6b5b9ec44b7a47e2864440d73e803f57ca1fd055ecc4dc
SHA512 e5a05db4a0342a93d1590859e713ba4b91cfaf16efc754f7bff60b1fa0595a24034a6bb948d1e0ac8ba9e5aa0368dff16470d2214c57f10163c10d74ae13ec24

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.htm.RYK

MD5 5e5d7e59f4cf4d27f1e77df30268d726
SHA1 f4ace6fdc9d117e029081085eb7288c861df65c2
SHA256 0ea5482a54e3b4e7b3db97a44281918886567ed3de487867b87f547d772f09f6
SHA512 012bb1403b426339365038427e0de298b9d0b4b828850014dd42d17a76867683e5b57fabde3b567e2c0c81a7dc8eef62e8f4a76765a42529735bc82facca3bbf

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Orange Circles.htm.RYK

MD5 77532f537d623c77f41455756bc64f69
SHA1 0769b465d9bbdabbdea6c2584108ba7269b3eca9
SHA256 1a294ee5611d81fd7143b27a872639d514186721d2f11dbb91d4ab43ecb41a80
SHA512 ce1ded45dd8d2f2ed05bf4782de8d61cc2c6b9e1c36eec183df11b686f95b6dbcf06047a845e611827fef9394c851d484dac53ce73488271ee05223b1315b170

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg.RYK

MD5 19098b850bb4cdfd4299147b8db40193
SHA1 f9b3ee09a54c13bfd017692a7f528ade3260eadb
SHA256 53fd872097f1c0b62c866cc82bb634228924698ada9b3ca9b87b1f6412caa217
SHA512 d6394b388f821ab550199d75a4f4390cde94ad9cc1cbfac92cb82c4394c1bdd42364fc08e3b22162e605e61b9a2a3292c6957fe62bac20ccf945114be6d85efc

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\grid_(inch).wmf.RYK

MD5 a94dba5f2fb43fa1d9eaf180527699c6
SHA1 d4032c0ef34356b4f57a722159937e1ce88de6cd
SHA256 41272c35760d58b816ab27c6b2dc3e7902f793ebf04f35bb99d9ecd56b9a26c4
SHA512 19c72d2b0c7aa8012bd2f3c9f0fe72b7b7092ed47ff4d4746fefaf6c0525c69e9fcd6102295029c9a8e92753048ca392f6aa4830b49f259a9a1b69dc7a3775f9

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.RYK

MD5 3a3f988d0fbd148a49d2dba449a32eca
SHA1 9e8e857fbb4d38cb93d5a49ac012d9abaae5e67d
SHA256 d55e4a2bcee3d77b4225e9005314e2ba5238c0c0b208e29ea10cb7ce39226405
SHA512 9a237efe3bfa7e70ff333584d0f113a427f1a44ca1bd23ce22dfe05cbf287c08f12327a8dcf2e0b9e472fac574db9a8062f34239403ed1adff7d2896c89f5869

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Genko_1.emf.RYK

MD5 7a1e1e122872f7323262af86c5857c7b
SHA1 d2f2d2b52ae93cc712b3897ebb0a2bb56dcabf81
SHA256 911e74af2a2049a3006580363cb3303ae6f8ba490e8469fcdaecb3ebc5a7673a
SHA512 7f5aa2a957f0cb4f1811ac08277ee5c6bf1d317d71179f20bf8cad8e545eee7257a79b27233edcf0f074b04d57a22ae9934ec3380e7a5059f834c7596bb3d54d

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.htm.RYK

MD5 58305a29fa406c48670f23dd61227cab
SHA1 84dc34aae97b34aa09d38cb842b3c3a42fc637b2
SHA256 4a077d33cc3996214be3b35a9e7c268394efd8c11627252f2468d3e000a5584d
SHA512 1983dc7c2db911e7d181c1ace1a6482de9d95a7ac5f12ec3685ea4dbf2ea4b91d7bbe13aaceb1cdd3189a0beee17141e1002c2378634f894d21bb60b52da6539

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.RYK

MD5 3d72b8700a299d2e3db76e300f04d445
SHA1 2068c9444b03fd12feabd76d9351bff175ca416f
SHA256 85052cdb4e50b75f57330b8b18aa70105d9ca6e6fb91b68e8b2a6229ae65834d
SHA512 81e1cb1f8c46a0098d2284f357560a104b9d1dcfb974c2cc4a3c84e322c21ad2b6103ef211227cb3d664dc7253e4256e64dc9d969e9773939086bf07dca04c1e

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Shorthand.emf.RYK

MD5 346632b1393fb860bd2ee987c7b16c15
SHA1 170cb0b81644c921d65cdf65e0df9c236ce8cf95
SHA256 1f7f30c26ffe9e1259e3bb693608b4ba42578db1fd7f9e050eea34eb06d5c338
SHA512 53425150f3440c8b7d1bfc4e9d2fa36a7f746f74777f80f1ca21ac0c8ffdb64950f290d5c0ec9ecc745cfedca91aadab5f3855f655ae94df5cdeff587c90e85e

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.RYK

MD5 8d5ef1da3178144f6bf0dec7ccd1cfde
SHA1 b899471f7ad4032f306756e4445855529afde4a7
SHA256 fd47dbab4480959f2861fa90e89e3ae2b0949897e974fea5254eb43f834f1937
SHA512 11564dd8ceb20b75f1560081aad7f92049282ed190414faed984c0b8dc88389975ae7b2c4dc1065d44f835a658332b1d264a5466e690825d853908c8117aead0

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Dotted_Lines.emf.RYK

MD5 cfdfccb20a48bbd2a96be08ef9d55ca6
SHA1 7bb0690bef9da6f569463d1f6a61edd0034c22af
SHA256 481695906a463a8d51ae59c6c7e63de4bf04936fccad78b208d7c81edc6102eb
SHA512 e03132627159ef5c173cbc6d53697e32caf654831064285df648276a1ba6e2b0d86ad794e64036156ba34a530831560f955ab9687a8e873b304f9526e8de2570

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif.RYK

MD5 8fd8b6c90f7b39e4d4e0471c301f7b0f
SHA1 68b4705134707a21257999c74d9f40a49347aad3
SHA256 387c1fd53e4c8769c7a4ce7514927003683c592d1084b397517b04f1d4395998
SHA512 290409575702eefe5b768b35fc9f6930c49a354afb3beca51137180227bd56f37e4380fcadf19e9e1324296bbb50487e0507f05dc8dd4dcc5fd5d3e95fe08cb0

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\edb00001.log.RYK

MD5 086afb8cf153c2807c6dd0d60c9047c9
SHA1 0a7bb0d06709d0f42d6959a0d23777c036ff1b89
SHA256 1b2a28fea2fa696b1d878e6729f4c9722d33deb901185d14e5d20a1c6e138b33
SHA512 6eda2563977b4c2ae7feba09994dfda25a8c0dfa8ee6d450c4fe4e62fe730503a851fe9c7ae00795d7aadd3207410268bedfe41cbee6736dbec26279f68c61e8

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore.RYK

MD5 5508a777b556add297d84ab1ed3e0cc2
SHA1 0801e976df150f9e61fad15c2d75708f13b04df4
SHA256 c2eb78aefd287bec57d299fa057a9d9cac9958072eaa78f9acd8d0a64b658256
SHA512 42ed112f390bf6f7933df294a8946899196c9f139e29076e180c298912d5df2547e03193735a31ca61c7c8bac5c00172b0a8c211d7fcd9b7628c5379ec34ff42

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg.RYK

MD5 9c53e376531fa2eed703513bffb2ac05
SHA1 73fd9dd722c7d624c69ec5773ad95e6eeb6db1ec
SHA256 516c65fd44e72ec440abdaf11ced6bd3d5a897a9e24946edc03e1784940a3d8a
SHA512 3f9e14f4586a68f5eca4b22963691617d8a4120a16232f451730879b7f87dcb3fb1454e3f351d833dfc4c47eecc1883396c1b3193a7e7c2965454620042d4355

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Stucco.gif.RYK

MD5 5b0d0ed5db37600282f016394d1ef2f8
SHA1 e6d724b4db08f7c0ca43e437a598883dd1f049e8
SHA256 1d714bbb99e9abf253a41b63fa51e06b3a8274297d7bb7066afebe216b35dd0b
SHA512 e0067ab45096e63c454c098e7c51c5009e463cd1c10d611fa5f0d510dbfb51c317c4c933f40cfcbb14623c66926e13f3a4ae730552b251bdf688fdb8b6d26644

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Soft Blue.htm.RYK

MD5 ba4e2f1286f52fdf6e4e21ce38c74d8d
SHA1 7917bfb8cb199fc9112a9d5604762d53e008f316
SHA256 abb020498610f99e1571104259de56437ee3c7fa4192504dec747c49ab94f79f
SHA512 f1006c625d493e93a2695cd9eaca6ae2e3d44e7f6d5230f7768f53e916def55257fb9533a3755491008baf5d1f137dbf0f2015d90b179428cc818f1c0a302a4f

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Shades of Blue.htm.RYK

MD5 5415211990d5ba72ba27860b79600afa
SHA1 102b3b455ac51d0cf195b3ee794f3239f4697b3d
SHA256 15ced42aad3f8da4b1877b55a232930d60fc8125965f81c720e9ec15c339b87c
SHA512 157104255d08913c762d3a5543e2fffdb87f0db85cf1c81f5e2b2f741f292ab9b7f4557524bf6b9bbf3f43f0e0c7700f2df0bbd93d5c4551a0463aa5852d535d

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg.RYK

MD5 19614876dbb7428cc64676a05b223d7f
SHA1 c7b27856379b1672b9055b7cabce336ca6d4372d
SHA256 493a290ebd10d91b9f8f957022fa5a7760a3eb2231526a2c7b7e9ad55d90c369
SHA512 40b2dd173b09cd2a03824b43e40882539a4162d7021b70a5b9d0d1b6765a99046d86d762a82511bf93a42279e5e4634ed56dee7015f9f1226bb16bd1303c4759

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.RYK

MD5 90ab086689e1e7f83ff34f10dbec6a99
SHA1 5ddf7f49eeb8b4cc9708e02c9317ee8e643f5a2f
SHA256 53003a7a4a7b06e6e0757214ba56e29667315bbcd2e3a50b1c69c43a0349aeda
SHA512 08058cee7278666be886fc0e0dea2a1cfd1c9f358062eccca91875e0f2aa88c550206a86695c2781350ae7d83c5475c9026b9f86cf527f77392ae7bab6b1b581

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg.RYK

MD5 f863dac8b5af4847bde7aab9be7c7acf
SHA1 24d2b785c78980fec0d014d001e184f6e028469b
SHA256 a7fde2f78898f8b8fd19cb5a19b3274c5e6deb246807cc7a8b9d43af5ef9a614
SHA512 b5a9615205ce32a91e4549bbc755b4589bde510f2a698ff30c414bfce8bcf8e813485110ec612868dd8cfd351bc957bd6d1edb6f43ccf1c04dd6c90ee3a5fe44

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Notebook.jpg.RYK

MD5 2f218b37574542082c4dda231df8308a
SHA1 7f85e64544eec6cc7c48529e705985a3d0662124
SHA256 1994c54220ccaf7bd5719653f1742d0c0e87ada35e1d46a3b29ab93cfe99529e
SHA512 5c53477c65062455c545b01954ac3684f351d086e4e40becbed3b05b6ebd415dd38e2a64a1b1788a25941744d88dcf1bbedf0be3f2cd5484c20b85b113b246b9

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Month_Calendar.emf.RYK

MD5 43b8318dc37974f6fc47edb712a1cdfd
SHA1 d591573b0cb4d66a30644760084798571dfd3050
SHA256 42160264bf8315b9a2596e2f96644298e99baa94eefb128a3ec48a721807c694
SHA512 4bdb5b894aded9bd546a2ed2510a286b585537e19e8df17dd174b12e3a78492dd754ee8ea63890c8269ddb224bc9f70e9bccad55757a96db5014021880d41289

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Hand Prints.htm.RYK

MD5 14a9763b44f2f953eda2cbc0ee0800ba
SHA1 073cdd0583db366f3d760a1c1eb95e8144ec20d9
SHA256 ee6e22323c25f3c7dea3501cc7125d08c89f6c9eabbe0719b03dce91d87c44e9
SHA512 ac9235a258038a0706c044186d8946ef2cba31a153643009b0a6d930b290ff222ca6b2929627dbbd8fab8ca90973ee5bf3ead0393b7d18c1eeb346e77a0895cd

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\grid_(cm).wmf.RYK

MD5 fa485556f3d8b68c33f5eefd74370bc7
SHA1 ed9033812a4e33f545c84f3d3b4fe715f61c5cc4
SHA256 a9698c8a16b5175af8f7ed7bc936627fdd6f4bc591a8ab607dd136be1a26273b
SHA512 b4783fde53db96177794084fb459f40e20857a4e043d361250f6eb2d16d2b2a16c3bcc1fe3f09a868fccbb279e66b7226bd43c07543c801ced5c4d8184bd6a48

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Green Bubbles.htm.RYK

MD5 6d332f1562681c88739b857f8aee712e
SHA1 90ff2c4283a553cf188c1ce3bb035fb2d1f25fac
SHA256 571f8a904130692d6fd9f1ff3c68bd365a326d98430029c68773ac6be27eb4e0
SHA512 de907034aa8a8def21a53f8d5afa490b5bac443a901f3145fb043c8443b5f923fa80278c315a1d6d894d4550000818e20376edc417ce5ebc445420ad1aa8cc25

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Genko_2.emf.RYK

MD5 dcd1ef9732e124c547541b2cbbb2fba2
SHA1 f046650ac94db15bcdf9d2ee2dc1c098855327d7
SHA256 fd3b80847c778fc399b41decba3230104fb06c60efbb6e5297e72c34b87e5cf8
SHA512 556bd760220d4f62ea4fcbdb864f919699a6a44295192b27320ec7d407cd446a00f2c020e8746b5057aaeef7ffb54d3850c2ff86e55680afcc3a3645f49dabe6

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg.RYK

MD5 2ab6eafa3f4b28a4f5223b1a500ba6a4
SHA1 b85e4824dbd27fb83dbdc82cf2f3a2d1e677e0fc
SHA256 66b23bbd8b8e2204b47b1c57be7859455679b5146471c90930fa525a15cba43e
SHA512 9cd78694dcac7fbb2621005a7a648fc84f9cf1d6ed9103259a2e9c1f93895569cb0c2dc94719b1251e3c6e7ed678c7ff7cac8e997ab5176773ec34a7422040c3

C:\Users\Admin\AppData\Local\Temp\fef0a317-3003-44a4-9a04-c0ef4df8f4b1.tmp.RYK

MD5 f15fd07eea7299f8becae58c6a179698
SHA1 a010819538b97af8c41575b19229a13c9457740e
SHA256 406360c8850f32b4ab13e11cdd402948e08c867f696c646df8c85c51fa49bc32
SHA512 dec2b39b568cda694a33aeb88e4b938cf88c446220ba9b4a9608ee0d1e028a3ac67c49e90336e241064e9b6023a7cb95b912e7db4f3a251a5268f95060f405bf

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin9728060290\msapplication.xml.RYK

MD5 7ea8586626a20825fbdbaae93027a19f
SHA1 144abef49a7b746f14d9f21a8ddd09cfd7671277
SHA256 b215cd31b13109e2d1828355f570490a6ef9c3288b517cc8bd0b4900d41380a9
SHA512 63eaea351f56e85416c2fa9a1f8af76a32523e16a3052f2438767e2f28b30d8fe7c1ebfa8d8644ef1137997f41a0e82cde887442a6fa4d81cbf370870a6b480a

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat.RYK

MD5 eacb437d72f3dd4830419e9b302cba67
SHA1 3fe93b9b4580d0b145ef3145918feaf031c69e11
SHA256 9761d119ee23f91caac4469bb4ec27e0d82d6431b0727792255cadb237b37721
SHA512 24aee53dd328db6526ee0f8765e0d57344ec7b5c9fb4fad7b762f513e1d65d8c3975df82ff26bddd864ca8aa046ecae6cda93dfdf4a87dae4cc8d5820fca788d

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{00825413-4854-11EE-9FE5-CE1068F0F1D9}.dathtm.RYK.RYK

MD5 e80b0e399e744f4af387b6489a88f995
SHA1 3dac5d08d8b84f11b88ec7ee687a9e70d40b3084
SHA256 cd0e0c93a728f8b791fdd781a9eeebaba454edee4db5e8aaeb6ee3ee191a052f
SHA512 bcc9b334ecfaa9b27d36364ef4d6aa928d7761b591b4f52d8a4b5322e5fbfc1e6f2014d1211f4ad2997bf3d133c4d3ca60717e8efcd09f0136743a5bd4f3ecd6

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml.RYK

MD5 d9d8ef84ba2ddcdbe38340fe4adcfdd9
SHA1 0bc14f30d1e29eae533571a9e1ba3f3fc862251f
SHA256 f5c8d0ef9838e94697fe1d0e21216373911d5675067a4b2447f5f35627327dbe
SHA512 b8c1259477bf4611edec2bb2a51f43747351532e4ef3f71d01648242997e45298decba5f65094e8411515dbfd7319a7f7a38ffd3d145d54dded12c018cdc2976

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\JavaDeployReg.log.RYK

MD5 df6605996ed11fff20805a081e468717
SHA1 4c374321b2705efd3d5b0516a7d149e106702a8e
SHA256 129895dacc24c90eb9563abdd152d48feed1aceebd65b76da13810c4f28a51a3
SHA512 8730eca97c56c3803e740e220169c4ee77b942c2918c94273f68e0aa5847ba7b03829c0bec4da10b32a5c250ca74e1033f32aa9615a8c710e608e5154c90a7f9

C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-msemf.RYK.RYK

MD5 38b6077d44b8987e6c4c7e76fc50b59a
SHA1 8beb5083b87bf31b95b5dd334c0fb9236ba6ad50
SHA256 fe0047a028017d788104c8a57a38a69094bb9573cd71c94fa504175d4e37b486
SHA512 6a558e27ae189753ab342c60710742c39a99270d997e77d7ea4ce94a44b01ed1d1be0f6a4f7688f31a7450f4bb74d276a90674cd537dcec925c6a2165233fbf2

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~\Popular Government Questions from USA~dgov~.feed-msnch).wmf.RYK.RYK

MD5 bad4efac9cbdc30a11d8b86eca7dde12
SHA1 7353e33cf98676e4a4bcd290f3919f898db5d028
SHA256 0237688599e7df672f53ddf43d3955826901c3e3826afc9967fb9066866f1252
SHA512 1412f725ad29b91d5cb8af1de873843f680c92d9b08ef977c7218bbc2788489723474bb484c88d4b9513d9e5d0d54a6edc57bb467dc797455e55ed1ca45bda77

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\java_install.log.RYK

MD5 acd5f0927e6ef14c52b3c84e9a504315
SHA1 37e97a5449f039acdf282faed3ef1f230e080ce4
SHA256 647c66e8107b02ce28b94d8f980f634496c475a41118e12a29039fa565ed8540
SHA512 c502c80cdbc754345e3f14ae7f1de87c6f8cce50ad18aafd53cb1a49789ee466202f0ccbce40e82a40e52dc18785ec2abd3a6c53ef78f4524c1ea9e10b30b367

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\jusched.log.RYK

MD5 5e2a82d022bf55cc561cc8f3d4588390
SHA1 68ab7600bc77e91c8365437794cbc40c0f3ab5ab
SHA256 d63c5e325d4390777ca83c8a9417bfc9dfb0d43048bb4168b4ade7e998675dac
SHA512 acc26528873c5304d508348ce5bb29bc58da1f8136f112ca76193c2d441c79419ae4b08eaaa1af34ed13393c05fafced0e6b673e15fb71649f179a028bb4acfa

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{00825414-4854-11EE-9FE5-CE1068F0F1D9}.datjpg.RYK.RYK

MD5 20fdc915b5809d0e61512a3273d76fe3
SHA1 e0cb3ca0ba95076de9862c6eab1ff6d272bfe263
SHA256 a7816a946274bd032afeb9d2c2fcef30a2837bb5b5f5444abcd454f01af03d4b
SHA512 7f7b4eb465aae11f348f7e12e4df32c623689a4ccf0258c3bc890ba2e0c74c4ff402a7bbe30d927bfba2799a1cbea136611069abd59624ea30b823d857acc505

C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms5058-0.log.RYK.RYK

MD5 4863d7107d7840cf473dde4e63a130f8
SHA1 aec5094f567d38b596e2ecba31450ae7c47d35b8
SHA256 73f8bc20b569c6538e139b67b3b478749354b726cffd8b6ff3d2ff018bb5dfe2
SHA512 beed244f61a7f7b020683e2931064418c0f3bbd68e104c52b5ea66784208bd6cef5f9fd1a14df424475e7249669c2dc788dec3f2ab3fb11c53e3bead73a39d60

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Low\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\10_All_Music.wpl.RYK

MD5 8e6edec16349f2d74132147a4594f3ce
SHA1 c0c0535de2bbdb5eaf4f66707677363c46ef3062
SHA256 e6ea0446d8fc99d3e5439fd1ef16f2b3b7ce2daf0065bbafc7971bf709dec701
SHA512 f93d214c726100360f0febf4e8ff96672e69f1dfb45f9053c4a856a7470bd91603933c4dd932d9e818fc9f882614a3a4ed209f6f2b5da1deaa165204f88c573a

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\12_All_Video.wpl.RYK

MD5 31144df947c9d1b497f8277001e2ffaf
SHA1 91803c922a93d6ec2579a07480972eae0819b9ac
SHA256 df2d2d075ea1de2e80e9c5b2654ecbe4f6a4bbcf98cd61f5dfc5759d0e2ded8f
SHA512 2302d6f3caf2cffc485fa2a0f6ab1dbeed4560f918ec62958571a9850d304f644437a48abeb65d59e05cddbef9f34bae941dcfb2d8b5ddc48ccadfbd2dbc3253

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\11_All_Pictures.wpl.RYK

MD5 acf013bc65c1ff3e2f34a41528e31701
SHA1 5d9647b031a44d232ef845bceb4a6739ea1bf788
SHA256 9c5c7a0074de4c686ced1c4dd8d35f811f40632bfcea0b33e757a0451b1396d9
SHA512 6e5a09a11411bd9beb0c0e788489181a1c53181185ec6b74671517120a8ca61a1ec8968f35c6b31fec55d97d338e6f762df950f7437a0e1bf12f98e033c40421

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\05_Pictures_taken_in_the_last_month.wplws~.feed-ms.RYK.RYK

MD5 04b8b18be48b1a08589bc4a3e572317d
SHA1 f216298caee354249132ec334a3a51dda69e57c1
SHA256 57bdeaed76e9167727d2e768374ade04f04e63a5244a7a15bb10c15e609731e9
SHA512 8dfa49a5f5ca7ffc7f5067eee6fd2780513c683ca58035e7c6cc177f57b6fe080ae976925e18a15c5e643ddc6572c2e15efd627c98ed7df815c66b6e304a6c4f

C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20230831_223456773.html.RYK

MD5 032f4a5238b8d690d4a621660523f6c0
SHA1 d1e63e932ad01dfa3b36554da50457f8e1c0f274
SHA256 e57551f73d8515d369ce613bc789d631346b6aa4b33c7af5c26ad874aed514cb
SHA512 edf8904a9cbc258c3678bdec900461d50581e952a4627d2a4b769afd094ac67d93bb8aafde5279eb48f7f819d1d2d2652babb86600f472ac14ab5b8f42231efb

C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.RYK

MD5 8a3b00a14cc1d619bf42939041ee5808
SHA1 f0c3cce442981a0f8c31ab5ca2d8d100bff1fcca
SHA256 6eca0d40cb718259896fdb5dd7cb5929eb146a06f437cfd3672cbb732f6070da
SHA512 7d2c24c3967fc332cfcf68e2659c0e076401075552b2fdc2180c940717657ff9c192a1ca2eb6b65406da0bb7452043f9f68263cf591655e687e0a6b4b3183059

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\08_Video_rated_at_4_or_5_stars.wpl.RYK

MD5 a1766c8451f4f73d0e1f6d75b1ea457d
SHA1 6f155dea76e437e2bd374f27b5156714412e58e5
SHA256 09faff19cf97c5d3fdc09612113d85f400b0074317f81e019aec2200afa89902
SHA512 f4cec01895c5d0cfca571c84cef339ecfa5e0c1c2f25a388f8a3066887788547c88131ec37b3ee1bd7a7118c8fc47380a3fcea038c9c691c4e822a54227b7a16

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\06_Pictures_rated_4_or_5_stars.wpl.RYK

MD5 1ddef54d601fdc7e0afa822546de09a0
SHA1 343dc9f7b44ecc83ce84dec1a6897b9f31d26faa
SHA256 50b33f2ef8302673c0773c7e0a41751150330c6915d2d1b5b9be4bc127e09c7b
SHA512 8b8b9e8a8635dc3417ccdb8d4d5ce8489aab24160a728bbcdf6192257a1d038a306a229ce022dafacfb024709985604d7a5a00fa709c7a85904864f3407f77d4

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\account{942E6743-4A4C-4F4E-A531-073FBCC62756}.oeaccount.RYK

MD5 1880b9c411735156d4b70ea72ab88ed8
SHA1 26bf902ef155b6f0f6956f53e78e741e51f368aa
SHA256 ac71a26b04adbbd03a2d9c188e17b80be3fd26704423774cc913cfd61dea92dc
SHA512 4323306fc4a856f18f7ec181d8fd7b391198c45dc683358bc16354244b24a4850bc752eec4f93fff818ca6abbddfd6fbea3b435ea74132826f94b1b39ceff9d8

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\03_Music_rated_at_4_or_5_stars.wpl.RYK

MD5 aa5bc7f7b0d324d7ca04c7b80294cef0
SHA1 8dc6c58c7af24502397079853254c57455615d06
SHA256 3f7f9fb3fb92302f0cf1ec579ddb019d673dd716f3e86fc938ff835b60bf70af
SHA512 b7334a0a8293bf3b65cf3c8b922b5f1251822628e1dfe34db2ef4d3a0161d70efc6d7e1a0ba4698125033c7a022400de4734d3f87f57c07c6b7eb97daad4d366

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\01_Music_auto_rated_at_5_stars.wpl.RYK

MD5 cb3556dda9412608de529d5759f6e768
SHA1 b9233fb6c0aaffb6282a88536ac89caf2e73d112
SHA256 3ace1db7774b9740d19a614e475eeb10b0c61635db776232ae16252f771d3df6
SHA512 0263d8709bd9543912fb71b121ef37118c570f0df38f810ce5341eaeb3adc3036375548367aab02a66aa0dd72d4cb7b502d661a7839e4c9041f190881258e7e5

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~\USA~dgov Updates~c News and Features~.feed-ms.RYK

MD5 fb3867c27326c63f0b8b1c824f6797c5
SHA1 6c63051994ba25dc287c11aedeb3e084f984556e
SHA256 2ce38714fa38f97288f4e935ce2b7403bb40c7b45778b4f1d99ee470294d3261
SHA512 6d072219bf436c475208537ea078a2e484548e3c22274454d4d9442c7dee52803e04349769209957c67a627d73d5e720dace42b72cf33ac9bc2459d1b6903ddb

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{3649F480-4850-11EE-B069-62B3D3F2749B}.datYK.RYK

MD5 13ba4bcd8be1a397843af16c9f306f56
SHA1 18fda412cf8e1008f93211ede809fa26168abee3
SHA256 3fa353c3bf224a732801489e9d59c17fc6168a26999405fa9cff87b125ef5029
SHA512 1ca9aef5123d7b432a4e50a69403dd86513e30795e26ff8d5170bb0441e829391efb8825a083725a0cef86ae9e19cbd179f7ba57d7cd2e8134e5a78bf7baf714

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\04_Music_played_in_the_last_month.wpl.RYK

MD5 9a64de8897013ffdd048adf526e5c538
SHA1 1108233c0a35df693dec71833fd0f4d1b5843cf5
SHA256 dd7acf22d30a8cc8058e2f5dd4dd63261bacf4cf3bb8623b605be1921b0ce0ab
SHA512 aa75a7c03a80772e289b689569d897c81b12dc7da7b5139564d8523304848e60c45abdbd66f720b73a0bd02a4aac4a7dc5abff5773ba0d7177dec56e244f98d2

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\07_TV_recorded_in_the_last_week.wpl.RYK

MD5 d2d3cb50fa4ca3f4a143dffa803c6767
SHA1 3d4ac8142a95338a101abf88cd302c5ca924ded8
SHA256 9199ba0277f251ccf347fd5717d037fe4f403278c8ed7038c3e9ae3f585ea559
SHA512 5509cabaab0d2f5df407cd060e591568218d18cb765017a03bd355e9988ef43235c69806c2d3c1396e8a5faa709e505ec9f7116f9faea7cf2f8275bcf4ecd77a

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{00825411-4854-11EE-9FE5-CE1068F0F1D9}.dat.RYK

MD5 94b1b226bc59302db0a903789e87c8a4
SHA1 e47848c6c5198d807613d23601605ac37cf54d67
SHA256 c4241d2d0654400e573ae83242f61cf9907d7bf3744be02fed4e58ad0e728ee2
SHA512 cde9dcd8f65306c93ff1ea7bdc78a20534073d4de8a64aa976aacf20ebe9afca885fded54ff9eb411468b1d4683cb382c236d36fba541217cd25705429f3ad44

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RGIA7C5.tmp-tmp.RYK

MD5 5ee0b0bc052b3fba07daeb56750d451d
SHA1 fdf419673a20f09f02ef4dd7afaac0a7ccd1aaa7
SHA256 9090edbdced25b7d6e5e71bec3a21398285b6e78cd0fc4809da17eb4a664ec57
SHA512 bc532566bb81e433505c2ff4d13a95e75462b81d7607eda80bf518a854e633d410055d56b11fed480d077f085cd470564c7b303ed145d91e043aaf10146cb845

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\account{CFF5B4E6-4EBD-489D-BF54-13813C82E0D4}.oeaccount.RYK

MD5 18df39639460930950b8a2c0d0da555b
SHA1 29fd9ee61bddb098f30f6baeab7d98881e8ff82a
SHA256 c96926f661e810096b0e3fa3ce9d6d22ab10a52acc0e96100df93b66cbdcf546
SHA512 69822656f5a23fd6234ba486e4b3dec12869bfa17b9bbb14f967a2eb2176472f2c0fdfaf7ac00d7ac32b0244803b68ce0602ae297cb38f1119cb4d58ebbbbddd

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wmsetup.log.RYK

MD5 3c0d7ab3d22630e29903cb7134e1c999
SHA1 c50e25896aab634ed1f5b82cb961d799e6501fef
SHA256 c00714e88b61aa6ee20e83f4405d7ad5abb3bd6e2b46d580e231c73c866d54b8
SHA512 238e20a1dac81379e3cf13d35676774334aa3f214b6f5ca64351b0b386aa441ffbb0047a95c634511befe0e9615a64f8538749e1f3f1935e924f1364dc7757c3

C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20230831_223456773-MSI_netfx_Full_x64.msi.txt.RYK

MD5 61ab60a2c2fb74841c0a5acd003c81da
SHA1 0c1d588e9a8f7b70b8f2e8639020289013a47156
SHA256 b519453c6b8517ee3bfb8629dd6b122f44017def0a672b9461acffdc1a048732
SHA512 680f470709673628adadbbde45e20b27d1cdf515a978f5079cd7f69f97eb14f45c524c6ac039c475f920c83f603af1c4d53830980dacbe42a24616bbd4b2682a

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\account{84BB0129-019A-48F5-AFFC-F6BA01E4E5EB}.oeaccount.RYK

MD5 1d49fb54bbf75a67d4825faedf46f1d3
SHA1 7ceb6b22f0352d60c56aa4645f5da5c2279fc70e
SHA256 68121aaf95b8a616df825a0b706d124a82765d863b83efa3ba4f3669fcec1e19
SHA512 fcdf4f213ac4b06fae3177b2cd58c288afb14b50f74a9405a2a086b2256c28c518428c003a61d844c11554b9c78057638c24f0cd3be6d3ca00d959bcd2fc2467

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\09_Music_played_the_most.wpl.RYK

MD5 e9011a9c5a43d3ae210de607d9947f0b
SHA1 f4ea1f47f8d8e88601f80247f079dfebd593f2e9
SHA256 56870153a37b080cdc778ef3d53c12abd010a35de4b427c9c82418f56d9f0ed9
SHA512 c6d5cf49cf6b1baa325ee2c8573fe6a39a491111ad508220e305c9211a2ad9738608f6a0598c95666a2b35de98ba7430b5216aebab93eb7f34503b1d1dd4c648

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RGIA7C5.tmp.RYK

MD5 546fbd0aa5dd6721eebfe1fc11d74630
SHA1 4e34d1ba9d714b8933f670adfe6cf07757cb57e3
SHA256 c714430a75c49d55bf239349328eb0a8a2bf5416969f3796d33bd542ec52e036
SHA512 8dc428fb4eafc1ab2805d6280902c2c54a0bc34ef6bf3869a839ff48765388bd0fc1e112b379bbfe5e49fed084fcb6508d6a067ff1564bc07c98f3dc3e2e48eb

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\02_Music_added_in_the_last_month.wpl.RYK

MD5 72a44eba9a7a906541d2fdace25b5e34
SHA1 6848bf3269df49aabbf72e967df54a2c3b25d9e4
SHA256 d3d1a4e6e4d149389f7b79f83c23c6409bba03bbf746589cfa6e4b2b11e359f6
SHA512 2a0c9526d43fa361ec3135dfe02cb36698356baf34a4d4a156ea1e79c08322c2cd060c817be3541dff46056c3b935f1f9a8357f324d1a40b6e1522713f4e0a41

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK

MD5 f30a477a711554b44ec3f4434a1b5972
SHA1 a409a933ae6dea784d5e1974f27529575f8c4b81
SHA256 9cf00a9fd242e5a9b15d7201c790bff346fbc54376319e19f590b84f99f92f2d
SHA512 7d125776e056e74aec26e09ebb0d0a762c62982bffd3566f7e9fa529609a1c82cc017f91f50e1a00713fb0511740eae557e50d9e04914940cbb2514e3a69aca0

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.bak.RYK

MD5 921a8cbd3adefb906b1623ee9dbcaf4d
SHA1 51d34a71c754e057afc46a433b3efb9617c99277
SHA256 003863e7e0cce88bd816bcb1c972c839a28ca701291f59864ad0c4bafe2d5c8d
SHA512 cd439c87a3faaf6aa93d67f91fb350c5537604897f681c61b16cc81c32e630b43333a80734728c7d2e454e3ee46c930d464b187ad67d95c4c1e145381180be0d

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.RYK

MD5 45a42eb612dc25af713019da526a7de4
SHA1 510b1c7cd724f34d6ad6c1005194d66c5a7fc9b0
SHA256 3a5e14fc47e516fff9d735bb892010dca58866742043e7a4d43e23f70bb37129
SHA512 8949bf8cacb12c3c97e3da59de1353ef61d74b97791d60249ca00973b682b258ad78d1cf35717ffbf9ecbae824a704a0bb1fbbe858ae476bafe3ea649d44529d

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\PlayReady\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WebCache\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\LocalMLS_3.wmdb.RYK

MD5 2705a086ea9eba06a3e4f6571cc32658
SHA1 d006931a19fc4869605a68ce75def04bd9f00a3f
SHA256 379ea2d9c15f32a870ff80be34fff2f59295fab2252baa9cb9f27df55514ea1b
SHA512 2402b79b5993cca39f5dd56366837a948de2be018808a1304f8815935d6ccd68e807b10cfab0408b1f98ebb77cc1d2df076a284cbf9e71a4bab2a695fd1094bb

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.chk.RYK

MD5 16271359aff142e23a96614684da04fa
SHA1 12e80aa0683dd060852dd91914ed788a25b782f6
SHA256 1c01096db1188a0d997d3ddfa9efb03a8ea766211295fb2e20f29ad441719593
SHA512 70d8f1b91406722cda4647a6ec3ef4b69f82dc8208102b4573bfad7bbb72d7a15ddf7a5914a94277fc61f05579353e5ef274cacdd9ba044fdfbf8f6a1e66115f

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.log.RYK

MD5 547f31397d4b28db22b2741ad3d4f193
SHA1 3d8bd3a6837e0e2a041ba7c5aa17a0301a6ad063
SHA256 f53e1f75785b289b2b2838595b7e1b610c3798096620a84ffcab7b34b554fca1
SHA512 3c18bba02d98e5b0e0ae776a446d7e19bb95bb13997bf65f4a9d0704a70d57b424852d3411626ee1a98ea238d3d472ccf85dc84ba0fb720c32914a3b798b6112

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb00001.log.RYK

MD5 94ee7bf16d72f4e5e191264f716b940a
SHA1 68a32dd0343ce9cd90d750ed3d1fb410417445f5
SHA256 5006382f123d0ad0888fe13d6ef473eaa7a2df3dbcaa8dccdc13a77ac61ea012
SHA512 19dc089547c8d6b35febade6f31ea126aa2192d63479d68ebed1f94c59ea39acf4afb781e0142839146fbc393f2cbd2e652a79ab22195185c6c9de973f2f5d04

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00001.jrs.RYK

MD5 2f5234e601fc94f9a9479951dd0bae7f
SHA1 925c0092ab06e2af6b3d1d1c870a22bf87328c85
SHA256 3029220cf6094c0eef3e0ddf9babec3c80db9212c34aa9fc7f1b4713cd1870ae
SHA512 1fa88f13516816efa1c13e44ccda0009a7a4283adc6db72df1b287143649f3034625b0c675111eaead8a8f83d66392b32c1cf4c9a8504b3767a78395ceb81792

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00002.jrs.RYK

MD5 4c914b44b1e0fa414cf7b2227aeff97e
SHA1 0d677f3bde34ac630dd26f0c6f63dfc876b2a2a1
SHA256 d696a2cebeeb9cfba03972226e8b544ceaddd7c044b30261e1224ca5560ac447
SHA512 6e106c046ce012fbe5b68f90f617dc9a4b27760908bc3c4007d9d7480c75af8d98af173c88ae3cf75734ef01509042130bd3c823353a0d52fa6fb010e76a11dc

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\oeold.xml.RYK

MD5 a18dd709f4348732383cb4fb79a9b935
SHA1 a8dda34cf476f4a182ca5698947adabf2efc8a0f
SHA256 f697b4e60b1062616ba3026396515230e6634f540cdb224f7333ae5e3dbad826
SHA512 e60d7985c27f8ffdc1b17de02be98a4f33f0220257deb1908e1c3409d94cd5b8d56a784865056c4bcfc4fbcbba867f5529db6c172cb44e2303e500ed3f8c1016

C:\Users\Admin\Music\AssertShow.M2V.RYK

MD5 6892291cc6edf381412bd2c2da418db1
SHA1 dc7718bcef052e302bc0d9880a128ef6f46d77b6
SHA256 5c0e2a1130f5cb4008b11442ca1d8cc8e3f5908f6256deda58ebe4a5f4504726
SHA512 b4cdb8042cc3b2ea66f4626571f5a6bec4a1de523ad588b5b53f2ca728b6b0aceb60b2c2721e88db4ff1a262d3d76d3f99264c6efb3163687158f39b349d7fc0

C:\Users\Admin\Music\ShowCompress.vssx.RYK

MD5 138ffe9c4c77bee4655e93e60dd3f0d1
SHA1 1ab25ec31ef416922d6268128474d89d3cedf887
SHA256 43eb54ea807c373b1d5203abe2e4f1811dbb384bff3cb2f3fecc6b037517eb6f
SHA512 412c9897da1eb612d176ac44683af0a72fbd21103641c5549ade28f2e33d4b2fdd7610247cd1ab7ec76d5d961298ed2e05ef00dc094c31b9063fe3bd9aa2c8f4

C:\Users\Admin\Music\ConvertFromEdit.vdx.RYK

MD5 a42c911945994bfe5e04b316c0106eab
SHA1 b3e1d575ef826bdfca1421195b63e6839ad6a142
SHA256 cb85fd29d050c0b596f4b166e697a242f17bf43ec6c7e2b6acd37cec12bff9c4
SHA512 93649a80691dfec59abf8ee0545b768e0f30956829a37396ff9ef55cdbd12fc520eefc4764dc8f505ffd0ba6fb6652a42634c73b23e3f282e8a2935389046fbf

C:\Users\Admin\Music\UseWrite.hta.RYK

MD5 b71b04b7ebe806a24f0a2aa5967475c2
SHA1 29a24ab814eb2ea9e7e218e1947f3f8bceec9096
SHA256 b6462aad59ad5f648d112f948a59de9796eb8c4f8005d30ef8e8d2a2b21c9f75
SHA512 4fbd598518662406e981f265ce155cadd2905044fed56fe0e1f44e1c9a0047a1a65c4842c5b84b2c20599dbdac6b92147f428f4b1ec2b70ccb2b0f11085183f1

C:\Users\Admin\Pictures\DebugUnregister.tiff.RYK

MD5 7aa74bb114375af3120f0e5965abcd51
SHA1 611695c86e62db0c3a38891d71b64bcace088cba
SHA256 5ed5f93999a6ebc4e40fee24199baf49b64cafab86de3de34678899561238d43
SHA512 62bcb380f1e987c7e465fda3c1106e329d7ceeb665b62e47c4d8fdb105158cea518acc6c32e6dfe2bf2e1e7b646c406f6bcc2ae1488c8d49e0a82143eccc9c0c

C:\Users\Admin\Music\DebugUninstall.MOD.RYK

MD5 e580017cd830638b995f3868aff7ea1d
SHA1 f707a372cfd993356414d313c4b66dff2339fd25
SHA256 c4d9a95a19fb87a142412764e9a5207d016b45ef9ca3a0bf4d53135eae966891
SHA512 faca4b523e90770ea44e4482762268b1a4dcc6c292557509638b8e5c9e68b1c2f84e0d293e882c39112e88b4db4ea12312e8a0e7a23b34d0cc911529e01d8077

C:\Users\Admin\Music\GroupResolve.mp2v.RYK

MD5 bcf1fd02611ea6854e2364abb04f8cd6
SHA1 5fb2567cc51363b0e30b8a46311cf12569a20e49
SHA256 2e7a041724bfc2ee473f1150a54af88f548d475d690781d9184723a4bb483488
SHA512 63386e67c2f42192f77d19745cd8e60842f10037417e2d1566baa9f8f0b312e555ddeb251caba0847b8a6a126e75487839742e91401cd2e8bf8c981f8f0fee2e

C:\Users\Admin\Music\MoveConvertFrom.pptm.RYK

MD5 2b507208d82e5302422af1ac2dbdb43c
SHA1 5bb7a0fd49047ca7176d0f599154b73d62879876
SHA256 648fb71e103204c52c0757ede85f0cd8a0def40ab05cee684f59d15f54f99078
SHA512 df971cb722d05293f567e3233dbf37d5b601152215dd57ede5aba7d647d7e58f45f607a6e21d29797efdb97c75d1f5e44cdb714d9f7e61f695dd818263406268

C:\Users\Admin\Music\PingClose.xls.RYK

MD5 b2c838d94e0200200423531af60a043d
SHA1 ddadbe7b343d1990a18aee64370c1cb6d6e8b939
SHA256 9781f3170b8d6eb73ce82b581fb65720cbb07d7db98848eaa1414a5319bb8a2e
SHA512 0c74b82d52415e1cced4fa229ac6f925ed2c2a8cb0df19261781ab3bb83165d19d3f0b1f179c9c17185efc2c7f3685636f33ea1146f9902c56020ae1a366de91

C:\Users\Admin\Music\ProtectResolve.php.RYK

MD5 ec2500c57c0b3eb0a0bbaacad9c63485
SHA1 870fff75661aea1e6b7756c0116036c9c4984dfd
SHA256 fbd6e0cacad96ef79622ddf9bb343ee91e49950c134fa35b5b4fe6502e8bfb28
SHA512 15b78aec2d7db084da3c0b1f7d224245131d95efbd4541124a83701c80f5318e65c9c3e7a7f0699a6f8b0c51ddacf79fa74d8730927644421a9effe109577b2c

C:\Users\Admin\Music\RegisterConvertFrom.mhtml.RYK

MD5 be9b49d7e26dc0870af78b3b035c6199
SHA1 e27810441660fd2d74b7c4533602d4c2f4e992f5
SHA256 c2fca9610ae0ca9e8106e97d809a8eae2c7a2b1d641350948c438cdcaa7c3671
SHA512 42aa2904b76c61baa5e0637c0571d7a173d9694eb292131f67f7f3420c21b1faba0d27ea17a0e00b38133912223dc998439358ed18873634607a7ecd8d6e5588

C:\Users\Admin\Music\RenameTest.wdp.RYK

MD5 f3e2e9929e7cc14ae168051b57036f15
SHA1 f87fed580de0feb3b143de4943c1450123899fec
SHA256 852c2fcdd8919cdd7e49210a34f77fd1088a8f7abd761ce6f1f2b16751bc3334
SHA512 9eab601cf9a501a1848999bf5238ab6e647fbf6baaa59bad6f2f52eddb2da652eda1883c33362d409d3c0cc649b53f522aa5e96d90be2f6aea6e8fcb472b93e3

C:\Users\Admin\Music\ResetConvertFrom.asf.RYK

MD5 2bdb17d0dc882ed89c7dbe5007ea950c
SHA1 c549a99deb88c5f3f41d585309ba08f52a1fef4e
SHA256 c18825cb8b84717406e90c59e895bc97520b9216e315ba12c56c2f6a867406d3
SHA512 2ffd5f43630d3a80912f521e89819c3988c16b201f678460b10cdf75440c526f3a42491961e6b6d165b92fd31e085d4dcbbc0b668dbadeb8b2c40cff44bb8a33

C:\Users\Admin\Music\UnprotectSend.mov.RYK

MD5 d9f9c04afcc20e14e4d0fa1b15dd07bb
SHA1 31c9361626646a9edd203ddbc9b710ed7be0c185
SHA256 388d9179e3d0741a86f4614cdf75e55ce7ad4beb6c453fd4874bebe004ca2a65
SHA512 7ad65eb798e1d3fb2d9954074be13d9346e0b95d94ba70c74690da71ac015a5c15a4e828a12d36af3cd66c78d2b4de93389ed12661c55b0e38e6d50c0fe71472

C:\Users\Admin\Music\JoinInstall.vb.RYK

MD5 6c0c209de3ebed0b03baa627a8feb7f2
SHA1 747a30d697341f718f3811e27e0951aa699dddef
SHA256 335519182f8ca3294271b204301ee5d6b4e92dde73461ee5ae9e9bd7d91121c9
SHA512 07f4f4dc3982cc56fecd924484f3c76868dacfdcae81a6b69e07a5cc34b20c71e64b1085e76f0766225f06a230ece6f0734616b0342b205edff168abc6239770

C:\Users\Admin\Music\UninstallRead.bmp.RYK

MD5 1600864ba7e1581de1f4ea364b7e6c9e
SHA1 d12c79e1d2ea8a18642be307317fdf0381533b46
SHA256 a24d769c189d58cc5c5397b73922615c0120198594891a2b4942fe5396a5d897
SHA512 36dc470cf6fb1e31549ea1038873fa09a148d95b7c8af29455c8971aa2e95401ee0588344e48640f618e8e92cb4cbbb1697489279058a50bf9c8dc58a4561e76

C:\Users\Admin\Music\StepRevoke.asx.RYK

MD5 7223cc16242b1549873e992300d886d6
SHA1 ab7294f143bd8dd636af5a724335cb216df5af07
SHA256 b98f714147e8261bc4590dd9672c8f8f20ae895adaf6d785d58007855480f492
SHA512 c1e1c73d6ef84f21b2623621eba232f953661f1a509e6a5eb9431e21be11ee984bf335b1b0e7317e4e434b9e62f35ea49cb7d7fde0e18eefac7627a9ca48cf5a

C:\Users\Admin\Music\ConvertToRevoke.nfo.RYK

MD5 815026c9180c0de248a7289e72753264
SHA1 4a5acf64fa1a231266cf620f0c95ad3dcef3a1c8
SHA256 8013186eeb296d9269a3250709dd8c422048ae6adf534e12884f8cbcc6c5ccb3
SHA512 1f5e93a3a3d70ad94856b707bca7f0f2beb089653a9473d4a4344d355336796e7d4b0efc0a31b0a5a263a62b9c8bcd8324a1bbfd67f9ac461be15e8987a370e3

C:\Users\Admin\Pictures\CloseComplete.raw.RYK

MD5 7059d68b2cdba0a99d005209c203ee1a
SHA1 c0374dce12206c92bf5234a3b1474086d79aca6a
SHA256 ebb54120fd5bc2d80a1e8f334d79e67694061818b3ec6c5fe6d951b2c80a3187
SHA512 deb683d22c05f73df1c3705ba68c6a642668d668984f75bd645a7544fc19feff58811a582afee38f6b966f05be12aba05a11bb734efbbb538e12da9ed58ec8d4

C:\Users\Admin\Pictures\SyncRepair.bmp.RYK

MD5 b4dd3fec45cb963efe79038b838e8a6a
SHA1 2b3cb0d1887ece4ae6c982a3f2b23e63a2caa437
SHA256 f206dba2e66d48d6680e37898c69477f65384c64c7e06fb70bba7f6095411111
SHA512 05477b6892dc0c81ea69272a51fec549a4b97ca8777ee21aaddb02cc5ca027599e5549a21286fb2f5ee162e134fd304525a8e5c1a48b02f32dc251c53d724366

C:\Users\Admin\Pictures\BackupSave.emf.RYK

MD5 800e90718615fbea8c6bfd0bcf190d80
SHA1 eb9d2773c37a9da7d6fefa33ebf2bd8b595464d1
SHA256 801d9632f8c5430079fb8c40bc2eb497cfd36a64d47a796db1a574036abf127a
SHA512 037983df5b429fd6ea76af1dc1a309613342a1ffb62208e4ea43ab5406c4cb50f1143019a1dc920f90207e3ab92751c6d47a3d6e972e5fe7aa3de8732bac939a

C:\Users\Admin\Pictures\CheckpointGet.dxf.RYK

MD5 05a8c6180bfcdfc4741a1ea97e4c7aea
SHA1 4719484ce8624af593b3a3a3119fe89142caecd1
SHA256 55e306bc94d0d0ab191086ada7618b8cc736a57bfa27121b58b38abacfe7cb64
SHA512 0e2b6c35454adbfafc00713a99130b9f6201167bb0f1fff4b1f647c4dbc0a2bfec90066429835798295518e49e79ac3a7e6c5bc5c70b37cc03182ee3255b13b2

C:\Users\Admin\Pictures\UnlockRemove.jpg.RYK

MD5 1136c8e4089495ceadc3cd057776d070
SHA1 457dd73a8311c94a35c12e19913b4aa647d7e1dc
SHA256 84c8ade1bdc7ad9b61fd0ad14729262ce93f50be2289db07f550f2d49bcaa1b7
SHA512 5de74d9b44f275f2ff23204b03cf727c9e7ceda10a7b6c4b05eba9726b453c98150a3becf364fe022f06c1ba05b3091bc4302c19994fd794102e760296b9ff26

C:\Users\Admin\Pictures\SwitchLimit.svg.RYK

MD5 183802418f106a49c153f5acf616296d
SHA1 82aacf21666a06c556cd6a867c85ecbd3ed13b4b
SHA256 41da6dd811837d577a4d4eeebcc1c457d033a7777daa524eca9ca39cd3db0960
SHA512 c009e02c0f4a5ac036d0b05985eb30fc308f392df065d47589aa328e64f0337c5cbae9361d7258f5ab3179bc1de6930c9fe779f4cc1c4da8dce2d4b3b20d0b92

C:\Users\Admin\Pictures\SubmitTest.cr2.RYK

MD5 08e0bce226b38c3d1e491df046647455
SHA1 cb429997109c2b7b3353823862483e77ad621527
SHA256 c37433369b06d51bb74d505b6a3d793132ab5078771a47e92697391050b3055a
SHA512 91c82d66d76bbc9dca6ae8561730590f7928084c96354f1edb0806f612f0fbf7b0cb0c86df35c97e0a1bab9b08a5cac78e0aae853a51dfbec87e9ec4fcd690e1

C:\Users\Admin\Pictures\StepDisconnect.svgz.RYK

MD5 4a9c67c1f9f46a9913bfd9cf434da930
SHA1 f910aae29734798cf5534b5eaf0b45df6e834a30
SHA256 78dc7d4d9d49e0907cd52efca787a98d6f307a067596929aee1bc3bfb6364abb
SHA512 99bc288fea2d86d055f5b9d661307cad4a67d5b0f3c3a1e9c5650b2a23433034c169b1e3dc6e393c06a28d619655ad6c0e26a003d4de8a1002b133a184fbd5cc

C:\Users\Admin\Pictures\SkipUnpublish.svgz.RYK

MD5 5ce2b38204d6040f3405b159a0c58642
SHA1 03a81f73d210f8fb3835c8ef195e0743f033c90e
SHA256 9c53bd474e936a2afe71374771dc536a86ddb4e6200bdbfc954e1546a58967a5
SHA512 4894ba053cbaf29e1fd71db4504108f495d712d7cac3b3a46ef98426b97b009bc6236f9c3d5efde23ef03d0254d32068d5d801f2fc05a49ac58d2a7087420c0d

C:\Users\Admin\Pictures\SelectDisable.tif.RYK

MD5 a8d7e8f60b8ef42faccfae8eb2d2c770
SHA1 4ba6428abd452c9c76122783060c0baa40801c0c
SHA256 8db5ef99ea954e7acd77b5a798d4ef325ece5b5798e6a95c32f2274bcead727e
SHA512 cb1db8a7b198f607b057130cbe05d1ee9235af25ce8cb5c1d6a8ea928baeeb5210f0aae46954e2eed739f0418e9d1012b73edfaf5098a1281377b4813a8b2141

C:\Users\Admin\Pictures\RenameEdit.dib.RYK

MD5 8a0210635f6757f4eef345e07ff86e66
SHA1 5183fb23b95c6060bcbaa87d30d1221d026a6180
SHA256 e84958f3a20e438a292818f79fb55a9b0745f187c8bcee6d3e13ca2181423b7b
SHA512 dce9b515e054694688e0595fe006d3f895a9b4fe2c25280203aefe75d446dac7faa1c1f9900ecb858c8cb42b17c77c6124aa828f477c1e2d579d090325c9179c

C:\Users\Admin\Pictures\PingUndo.jpeg.RYK

MD5 3783a0432ac0b70a24b670093a05ed56
SHA1 af264e3c411e44dc42d0a8c903be730584b8b4f0
SHA256 999dc6986f5cc99a6507ea6d02173feea44d9d8cebb3c6b9da5a1b432e26d511
SHA512 0a3b18135ecb63a1a9b1df9473cca2a63ea27b9a9167a20431b70f2f68d3608385847e92ff86a424597665613c3cca38220adab0cdb5fb12fdbd92b28cd1b4ec

C:\Users\Admin\Pictures\OpenSet.jpg.RYK

MD5 8e13db2f00c919469622ba7188afb9b9
SHA1 ebe0cf5b7380256b4cb13acd07ffdcd1c89c30da
SHA256 3afa4006fb7dc187b8e2efa8e28645026d827f47b3fb600c914be27be218ff63
SHA512 0f2a525d56fe18761791752c551684db5c73971a88139d83422f897a1fec1db2ff0b7c0312cdd8b7c9f542931d998f8c0ffc9aadf6dff42f8b380f3732659046

C:\Users\Admin\Pictures\My Wallpaper.jpg.RYK

MD5 2ba332d8d3d048ca0e5cce16bcbb0a03
SHA1 ad5dd0c67d72cb7064c30192b30c7d4b7386f252
SHA256 bb3f5a9de6b4302ea56d4b5e855a83adc71c1c495bbfe6ea7e6fb7873eb6ba3e
SHA512 b02b8ea5aea5064cea4b5554c44d214f5830f39383f40ba88157347acf73bb0b90a4bea0e62a97e3d31426bb4bc7defbf029d3e7b2dee67e7c2d984375be7f89

C:\Users\Admin\Pictures\LimitConvertFrom.png.RYK

MD5 2382042f8a6b7b79d5467816a577a645
SHA1 a5a81d933c3bd3c993055d3eed0ebaaba9aa1a1b
SHA256 40e1ab5017f1af9e9da63e89ba79e36347d416a66f1fdec9130bf96f8c8404c2
SHA512 f62fc10f8b0d30c9c4e10e9b7da116b66227ab13359b1a3892e3c157244aa42569f5cd77494d31d1a689c4d246a143ea8343acb1dcbc17bdc6326b595887f39c

C:\Users\Admin\Pictures\FormatFind.jpg.RYK

MD5 79a2a8966eb55e88c63328f22218aab2
SHA1 62cdedae6fb68319f795709266f363e3046596c5
SHA256 6749da3bfd2991c604849b40c54af0377bba302727e8aad891d5c8c397baaad4
SHA512 95e67c9137cd426c8d54da3d516992fc16245ea0ae63b9a96b0624b1739373a1c69ddb571df384fd5d73b623efb4366c3fe95f460633fbdb08ca4941eea28605

C:\Users\Admin\Pictures\EditInvoke.emf.RYK

MD5 ec80157a28a16892578a6fc3cdd4c990
SHA1 71f2e9d840fff19073775164434e9616c0d49f20
SHA256 41ece0e59634e56d00e9bdfd5e855c1a577704352ee3785facbef4bf1e20b747
SHA512 ed72f1880a76ce3ffce70d5f257c52e54996ef9d153ee3d5e5f77e418dc576eb65d6965b3e6cf1d4888c5ca84b4016c98ff0fc7ff5db964aac5e175777bfa795

C:\Users\Admin\Pictures\DisableOut.jpg.RYK

MD5 58b317febdc9d6d52d8463fee7eae20f
SHA1 4727850ebf77e23bba91c4203e033db735529dd0
SHA256 7b9cbc9dc93a72369fe439e22356800a5990318beac0daaa7d37a02592e7c98d
SHA512 d0dcf2b7057b14ed6ddea257ae6c37eaaaf293e0606db37f31dadee113b3f9e864177068fdc92af4ad7af3444455b22ad5f666dbaff528aab4c717446562c829

C:\Users\Admin\Pictures\DisableCheckpoint.raw.RYK

MD5 32d90d328728db04cf7b32e3a6a7988d
SHA1 3fb5ce2a9e773f2e4e3b379ce9eb1186a4fad827
SHA256 aadeb12dd6bdffcb99265c3fe348f81b26a17a2951e82deb58cd9d5fd01ebc13
SHA512 6728890b18b1b41da5129b14dec3f04c195fb4cbb6fba885a8c22c9cdfd837dfee61cd08056e879ed4af2f45fa7450b514319baa6d5269267a87085e481b4a31

C:\Users\Admin\Pictures\DebugProtect.svgz.RYK

MD5 cd971ea38b9e5bf822caf7ee43159072
SHA1 59978d938b8cef6942502ac7466609dea372fd47
SHA256 9593f9c441a60ac9cf2f079b15443747c11d3746aec69ecc561009d092a7e7e0
SHA512 769a40d70afc6eca45c95693ed36680a4c9737730b386b75779b3da7d64e17d6607dd38a2d30858024aedca4dda94f74dd4aa88a49dc861297c801c21985364a

C:\Users\Admin\Pictures\CopyLimit.jpg.RYK

MD5 61b1b7b77e77a7750113f8aa0523d2ac
SHA1 ab9f6fb14d95da1ce6c21d5f2c46a79c2872102b
SHA256 583d20dd18f4e1dbcc93228401de99a5655eaab52c9ed9a0d47c9e70e0049bc7
SHA512 8112598d6035f07ffd99cdb8a189574330411e722b63aae5fc0bfec1b1ac7601a7517ba7fdc7d6eb51f8b14dda986b778291dc6f29fa636fe666c393baa0cbd1

C:\Users\Admin\Pictures\CompletePush.wmf.RYK

MD5 4391d15c33db5a585132455a95426d18
SHA1 f73e56038b284604658db6fe69996644652d6aba
SHA256 8fa54ba95ee3baa5b2d13cc97b968a3917329e35f9bebdc791e3a41872b6518c
SHA512 31b57b5b8defd1e13320ea64b72da36c4068ecd90893fabef426f573a5446d15e7b8db9943666a7df90793e2d44db2c80b4db3f4768e7a9c6fb96edd7a064605

C:\Users\Admin\Music\WatchUnprotect.bat.RYK

MD5 d2c949d03ee901c800c823652a1a260f
SHA1 7e97964bdb8ab1d2bf3cfd7d8ed2074181ab6c9d
SHA256 3c0c3b937e83b53a20d0027eb9387d022fc0d45b9f2d94198cbe28c9b6e3912c
SHA512 365f89b3b99a3d96bc0de4f138a925183e0524554714f813f018f6fa60dd01b3d7d02b5a0440ec66ee54456af955a4d5c395f5c83bef0cbae1b257059d3249de

C:\Users\Admin\Music\UseSelect.html.RYK

MD5 ed0019acada7bd56328422f08a3b08a5
SHA1 214757fac9d45df90398fa738c0fe988021bd5e8
SHA256 2fa33d47f20ab02fc3e815faa37424d121bd3c04977c70aa8108245da64cb593
SHA512 1bebeaf35a2de5ddb07138aeeab70e5199c93f9297b84e2af723b01351b5944cdf8f0dfe28c20b05a351ef582850ba0183418c7793e75ef531054b8827058c98

C:\Users\Admin\Music\UnlockEnter.dxf.RYK

MD5 1436103f1fbd5719fb81a14bd38672e7
SHA1 0e43e947b567dcb757f636134f2c8b3083049472
SHA256 e7e21124303c8f3aa3aae13df975e92ec9989b2186b6f8fb7e3585ce45c6ab1c
SHA512 92154223356b99a611a41c8312ecee3d9155c8dce01eefd83f8efbc47844a4566299ae3d5c88178218c6cec41a534da970b3baea16ee4f57f69017ac70f3ecdf

C:\Users\Admin\Music\StopRepair.wmx.RYK

MD5 571ddca3f6c6645ff31c6cb88dd1da76
SHA1 93205679b6d060613bb8277a7dee08eb0fafb4f1
SHA256 461d765638ff3f2d18e98f7261e9c1b0707ce08f988ff1a2351126772b7a4206
SHA512 95ced667f3e8e10081645be8981afc3c23c2a5e236b8e5ed85dd55d535b825229b757a41b074346763cfa82ba9c564339ce76477fb7fdd861b5e7b6e3c193dc6

C:\Users\Admin\Music\StepRequest.mpg.RYK

MD5 c13bac2f831924addce8424cfab3a27c
SHA1 2bb6297cc7c32268c0984685ee88a1f5cff08ce4
SHA256 074ca72e44c63bd1c92bf475a5acc4888ade4898eabdd63877b2c002a691a596
SHA512 4ada391ab30bae9dc20556d8c6d8eb850a43df136d5048dca49ec94076176f8ec954395428bea81101086a644f77f1fd7c130c2b60e270ec41ddb2ddbbd942b1

C:\Users\Admin\Music\ResumeBlock.emf.RYK

MD5 04bfe80be5fc4e5a9cfece717b69772a
SHA1 3d5ecab2f3d82b4b701e26dea0d781ef1bb35005
SHA256 aebba501bf5d152b935c67e50f11ac48509ee0206d182d11bec1ff5a0cd1dca3
SHA512 122a6bcabe18cdce351272bd83adebada749e7d41d539cd472083b5e786e036f11097d287e9a0d246a1435d82630af5b5fc0cbf49f704bc0621db478e8edd63e

C:\Users\Admin\Music\ResetBlock.TTS.RYK

MD5 3bae9ce5dec913fbecd7ad2769bcf1a5
SHA1 821fcccdf792a15d34b92a1c8a3ebad432bde08d
SHA256 31dda0592275d08fd611c6765e9687f4e12ef1b224f66710ddb7c93c84b65ca0
SHA512 d9d5201c4b5b512e13d5f9b3dd5d7b73bd92c893555d87cf3d21d6cae155a4be7fc9399a7a8a80d6800c031045ce7746ca9f1b23ee959cc5d3a523d5f66bc688

C:\Users\Admin\Music\RegisterStep.mp2.RYK

MD5 7e5cdf505c7511eb882d743063abcdfc
SHA1 f113024188b5a968ff03ed46a186eca24447be60
SHA256 45e846b34d0a28a761af0e09b335ad0c8462081b7255a65ea28fbfd9c9804bd8
SHA512 10134c75debc1af4a73d51f6fc6a7b91f44542a6c9c9dde480cf59cacc6f63d9eb6918a291e74dd01c8a2433e2aabf304adc8c0b05b9e4d537daeffa54500a93

C:\Users\Admin\Music\RedoRead.mhtml.RYK

MD5 06fc89ed4ce755e0591a1ef1e882b7ec
SHA1 6d39624fcb27a463e0a27f43695a1bdb71290623
SHA256 13a700457e12e8d2fad29583975f62d703fe43494bbb1c45f60decb44e45dd41
SHA512 30a8e9cc875cb87da84cbf522669265f76321b9fc657acdc2d70b6bc29dc09511e1820b5166916ad1c5da0de7c38a16419520b012331c5a226cddee5c708dce2

C:\Users\Admin\Music\PingWait.crw.RYK

MD5 d9f99021314ec09ecd099963526a2b4f
SHA1 505f2e856e3c0794e70e8a4236d730b4a2954437
SHA256 a34d296a642ca0492a08a3635ab6603447e3edcbf1d9b591659538903eb2eee6
SHA512 b4c80a801ec35610ec5c0b7ac70b2532d83583d37a01d5d1cf079490cefb9896fefd5a3cdc06483980b4df29601aef5f074c59c8893c1d724b599e69d6677bf5

C:\Users\Admin\Music\OpenStop.png.RYK

MD5 1e25d0a7898db5054071a87112d41dbc
SHA1 7a3679b6e988ff1109da100e95ab420f5e165fd8
SHA256 863eb891b8e68af7105daccdc8c4a15acd4e78c07bc27324ed2547d2f0188b9b
SHA512 e9248ab8aad0e8f8c798c4507b41c328f6a57f283e5ed088a7ea9646e4ea42217bfbf4990905e64270ab2dac1a0420272d7306337af7d8e6109a51f4411ca254

C:\Users\Admin\Music\JoinLock.tif.RYK

MD5 4f8243a67ed85151acab55a6f07d2f35
SHA1 acd1be8793a0c031855fecfe49f2c8fe888d481f
SHA256 de215cdb0f2fce3ee84e257805cf3ecad291a69f98296e17b4f24f3cbe108b3c
SHA512 e4c88690ef677d2533d3261116a0a6722e40f6f0d890db17ebd659c1bd9ca43c8745c6dd762759a77decf96e0962bfb02b65e061bf3a0edcedd40f4610550e97

C:\Users\Admin\Music\ImportOut.mpeg2.RYK

MD5 13fdb705781bde065b6a354d86114f9f
SHA1 c4833f2ff3b1cf43b403d3d3022344c75084618b
SHA256 2cb250afac433f7316567862ac713073a62a157cbf069cd8a4127a7bf1e6acda
SHA512 f260a169ac2c49c1b7b3498524113b948c1c40b97eeffb5159f1b0c78a1e0d2a3cabf8310e7f1e952702683e6be909f98eee1a7f2bc6465855c87f46749a3a50

C:\Users\Admin\Music\DismountJoin.xls.RYK

MD5 72b16c044d773abae9952099518d697b
SHA1 21129a59b2465068896884598bdfd750f5e741c2
SHA256 3a8f7c01a63ced85b9a35636a35d90e245d7a4184ce19f1ce16d8783a792bee9
SHA512 44b51f5e1ab75f56e0325b8658ea856587eac4ee03359890f262802681dc22174bc148b1ed7079bb55ed4acba521a4c149ec32e95d46c22a3989cc8d87b57fb1

C:\Users\Admin\Music\DebugSend.m1v.RYK

MD5 03df6f870840ee2a3d8058ca7ccc5820
SHA1 5cba1bc4b0dbf69fa24ba859ae544d3d584c80d6
SHA256 9c033f63aa3eb261f2861a1a19e3e337ebd892a7a130dfc1e6e11a5220d14443
SHA512 8cbad6f9ace91e1da5001b7243b5335ecb630a06f318c8d3904b74a64cb25efebc97a2e7d0a872650a2f9195457a875124770066bdfd5939e73fecfaa423f83d

C:\Users\Admin\Pictures\SuspendUnpublish.dxf.RYK

MD5 d7e818f098e684dbc385411d0a55fabb
SHA1 0dcfcb84d9f99a771187650caa6371211a634e0f
SHA256 f86fbb0fb3a0263d794005a68dff07df0dc99e3c4f62f64724ab8f8ed4317b88
SHA512 ffd24a051ee39fec0aa0a7e38fcd98503e3f2f5033c5eb4bc63fbb3a7d9761e1c681aa2846d95b333386b9579f1e9980a70a1a00497769641c00a570d6ca8fa1

C:\Users\Admin\Pictures\StopEnable.svg.RYK

MD5 23f8218f157799da9e8d405dfec138d7
SHA1 43a5b633f10acff137ba8df7668c22ead5619297
SHA256 632c315245f71d176b621f43d2e7fbf0687e9e89b44d73f53fe04bf6531cf5a6
SHA512 c5dfed0c31a00f2396ddcc180ec0837367c5422e1d5f65d840d9aad42997a86207e203ff99517c0d7dd7c2507fc5a0919daba9eca4c3e9b6e15139b8c5729af5

C:\Users\Admin\Pictures\StartConvert.emf.RYK

MD5 417db093416001e7e80f285bd285b273
SHA1 09cbdeaf3b38aa95c2eb4c392c6ef8d873d50a4d
SHA256 ff26bafd8b185e6a3929430edf1ef5da29c5aa2a37b07b4a997bfda6eef9bdfb
SHA512 4db5e4c036fb36fbf772dda514f218b9ea893397d5b759a63c1f102bebc35d42b67a7cb373f6af0660746ddca206c8ee8e1cc4925c4707f088a4c3f262732fd4

C:\Users\Admin\Pictures\SkipProtect.jpg.RYK

MD5 85747bdd71921309fe7a5c59c32e6b34
SHA1 d1098ca32edee8841de8d10407bd6f202b61a617
SHA256 c8ecc9cae9caa9a3c102db59b6f7712194958639b7377aae3e37a361f8f59527
SHA512 eb90209428644088262cbd530959884b62719dbc1ce30792b0d6a262e03b484549547d303d4e01a5686fdae16abcebf643e5f6d03230e8e131b261d25eef0a44

C:\Users\Admin\Pictures\RestoreInitialize.bmp.RYK

MD5 728e93c6ef40595c8c8616876ffa4347
SHA1 1435141f7b707d4273e12c99a865441cf6e06d14
SHA256 0bad46cf18c729a48e753d59ad15574a9af157d581a2bbddb76a718724dcdd64
SHA512 5605f17581be53e2175edf4b0b72dbf01e81a5d06bb9dfa343c4d48c8cf0c41baf83b1bd130c7577a606f14b00f771d7823092e196c65b4b154ecb0a81984236

C:\Users\Admin\Pictures\RenameDisable.cr2.RYK

MD5 0e2ea5fc5c73c577f1c094dc8fb25ffd
SHA1 6077783922e6974e260490bb1e31fc015432ccc4
SHA256 2af254122ec25f589a0ef9e704267ad7f748fffbd6e3bc28938ee903d70e0d12
SHA512 1213cbf8df4d8ce0ab5aeedc03eae6bd691f843621aabd07c524f5fc86e250b39b9d798e7cadae190195e0e94e86c152a72e7b308066009174c3cf98b3c7816d

C:\Users\Admin\Pictures\OpenSplit.raw.RYK

MD5 330857639fc32ac0b7d1b6173892e760
SHA1 8d99e197545e75b58a4161d731f558c673a29ce4
SHA256 c60cfeba84ac88457b95a9e346226c23a830b5b423b852dd394c9a2779e7a569
SHA512 631f087599748d0cddaa239bb4ed6e217b34606b1d7d9a570e57f0cc274c75f9cef7307babcc00f07095746a50e15e250dba8b5661a49bbc868716b97119fc3e

C:\Users\Admin\Pictures\OpenJoin.jpeg.RYK

MD5 d939af67d2c2999485dd44f3aa6b9c19
SHA1 2c3a3cff786cd8a59c6eadaf88c61e5a28a3d209
SHA256 4dda12e4a86d5fc317f4905af3fc0ff0cd039cdaf68cc6af4a019f4b70b785ef
SHA512 6e5fdf46ed0cb88f352e6a1a407c783acccac80f4a953be5177020d3865af5e7aa25a7f609ffd187d33e0e60c1e4a2612395440644ac8b654c639fdfb54a030d

C:\Users\Admin\Pictures\LimitLock.wmf.RYK

MD5 a27c2bfe460e01280d99e84c678da4e2
SHA1 9c9ccf65821ded89da8c099d603ea5819c746b0c
SHA256 4dc220c1535d93ad3239d445574f6a1c68e28fb305d3b8d9e40103ec53deb1c6
SHA512 bc350972603716917e3bd6ca81ab4f2d726edfe5c80a5be656ae4d9981aadf10e2015be6d95d0a0813a98993921e303ce71578eee3a034c4f2a15928dc0eecfc

C:\Users\Admin\Pictures\JoinFormat.dwg.RYK

MD5 b29c718a32b4e212feade4f67b583387
SHA1 09cf91561d1b8ea63b837067905d447bfd3d0fb3
SHA256 e4e9cfa2c4697676906b49c1dd1c230d0e219e86146fd1e809b263a24d7ba31f
SHA512 697e0fdc7c847aac66ee1680b74654b3895ee01689e8061a1d40fd580e139cceeeedd8e30e33cc976fb685326c68e65f44629d8fd23d6bee85207d9dbfb66857

C:\Users\Admin\Music\ConvertToSave.rar.RYK

MD5 d94fbdc5541f25a817a53342d87dd295
SHA1 89cb20ad76ddb4235e06f692ccab1e4cf76f5038
SHA256 201cfd00dd8cb449d7bcae43a0b358f05d1f73ea5a33601f46e40f97c57c36a9
SHA512 f7ae7a9e4ff9474222cd5aa5e5452808437e77de110ca054c778407ac34fe4fcd5187294dc13ebfe5c5d0ae441248307f7a6460c4a84a143e4cffc2b68910658

C:\Users\Admin\Pictures\FormatConvertTo.wmf.RYK

MD5 6fac8c98423d1f52ff231cafa6bcd7fc
SHA1 08c9ff58d1a500eaad57e082eff1a75fc83ff927
SHA256 2f1ad1ecd6f7cb644144b9b098ed83291f5267d43be08a438becb3ba9c8c8940
SHA512 3c268418583999e0e422d1a52ae9c5e5bc58d7579db3b7630b67968fe8f17441671dd239d13e8d0f694c201698327f59ef5d03ed1c62b3b74da5820389019f46

C:\Users\Admin\Pictures\DismountWatch.wmf.RYK

MD5 0d28fd7316ca59d6ee0bcc2a7d548f6d
SHA1 36be33e59fb496c4d7d414b107ae5850b543a448
SHA256 76d0eb069176ae8b00290e6608b02a277487da61f87559e2a9d148ba26ae9689
SHA512 4693ee4bb6f424b33eefc1f1143a6a529463c927ee98bb66cda2a7663ed3a7187eed5942ef234f33304e1a6b3918c838177781309550a94fdc32fc5b19c7113f

C:\Users\Admin\Pictures\DisableFind.emz.RYK

MD5 8e7e8274962157f9da5f0aa3738ca930
SHA1 79ea9d5cca00076d93cd6f0bf99c1b596d24dd77
SHA256 489ef78223d00f2b2dd4b0265aa14bc20099b6ec1571aaf2b36989c1ed97ede1
SHA512 32770acdb5d802ef9e94834a445ddcc986bdf80adb7165db359d4014bb4a2efc86dadba7bca228d4cb19efde3a03ecd53884092e797c0e3a37fe71a98f0e04b3

C:\Users\Admin\Pictures\DebugCompress.emz.RYK

MD5 bcab8892e444d742a8937abf5dcac162
SHA1 ce92362c6f061f2c794030da5e713565d1cc4922
SHA256 c7d4f58f93bc49eca9b7a11b7d6eb1a7575a1f5c55a3bd7825e3dd95152467d8
SHA512 15bcaf5c2715d610ab9cd6e28354a077fe7e57e01ced2b871cf52152ec0d66d907f2fcef2766577a622e882fc108d19526cc14b72b50b22777d7d0c3cbc83c47

C:\Users\Admin\Pictures\ConvertFromSearch.tiff.RYK

MD5 a0664b292b5e412e1c9a98de786954e6
SHA1 770c8e6e115a95ff1fe0642c6dce018d063d32a1
SHA256 9665a5138685e5295afd8b823ad268d266faa65552def667985bdfe257c3dcf6
SHA512 97f486132b3692df9576025b8941eb5232967ba0813167f2d4617da5b56616b5d87b89b53df218d365df66bb7f8c417f8047d367ba59ce1b12171572b6f0411a

C:\Users\Admin\Pictures\BlockFind.dwg.RYK

MD5 dff3c22fb3700a30483ad27cfe66ab74
SHA1 f64e6b25286c9a89621aadd9ffea7a01c3a1e990
SHA256 76c43dac7d0bf973d37a212b2088870a70bb18f3993661caa56d2da13cda09d9
SHA512 19372fc7788cb4768b49658cdc9f3ee50ad6c164e6aa1a627f4c7514c34daca26ac54239878aa6935d616f4d55c687a38998207b208221a241a2efe1a21faed4

C:\Users\Admin\Pictures\AddRestore.raw.RYK

MD5 38496b8205b5c5bf55820e1ccf586ffd
SHA1 40a52d447f60b6e0a1a2c93d857f50468c355c9d
SHA256 fd1ac67ee814baa64f027a24060c29bc9864adbf27f6cfc22cb2b4fefc45048b
SHA512 5960a405a064817d4e9f569d81d9bdffadfd60bc8445506480c60f39cf8cb73310913954bc26ac596e7c7acfc88482610eacda9c6384ff051f41a214eaba66f1

C:\ProgramData\Microsoft\OFFICE\MySharePoints.ico

MD5 18ed86cfc9c7519ae53198c75f28995f
SHA1 ab3286bd2f6dafc9c38d9cb51eac8127022c9195
SHA256 8020dba510e837165595882f1d60da6c025bb9aff03a39c8b462157ec55fdee3
SHA512 372b79a29a5e180760c8846c84a34cf21d76038398af348e9b0ca275207817a917152e0b271faff27a579367a10db17452b09497340b43bb3a9752ab098cb744

C:\ProgramData\Microsoft\OFFICE\AssetLibrary.ico

MD5 0d412881ce40d5ba70a53d938ad7f186
SHA1 146910fc32f3b8a2d3d90fa9c08c09dff96a6d16
SHA256 b7107218e3139fdec0ec760f50c729924e99d23ef545baf73321738bc68b96de
SHA512 14dca0fddeeec30b28d4b0f428bf6a743aa916bb87c59f78e2bab9b20721245c89eee7f06379acb1087df04d7816e26c8fa1aee440778c871039460aff22df9d

C:\ProgramData\Microsoft Help\Hx_1033_MTOC_Hx.HxH

MD5 b7832dc4328919b85afdc861b31f2676
SHA1 21fda6717bf8c4dd07589cba311bb15cf0fce209
SHA256 8259211becc5c0d0f44861d74d1c1c61b11aa1057ce136c1930e446d1b397cf6
SHA512 97acfdec50c7fc59bc3c9d8c58c5cd227a0f5c8c1ab6b214550cf38aff63d66daea650fe452930185c99c62bcb0f298d6b0e64d61df7f61f83856e034cf34035

C:\ProgramData\Microsoft Help\Hx_1033_MKWD_K.HxW

MD5 68b5768379e3479d6cc2aa1fb2f5b501
SHA1 627cab967844d97a32a5ceebae82f50173a9c3d0
SHA256 6d3ecb8486f7584e54ceaeded6985142e7a40b0198e1fddfcb0e7d835bbaa4d8
SHA512 dc4eb49f9ffd2fbd174990f0b2bd95c39084f85740e41086a3bf1990ab95dd5a958248277c3ede97370d429b39087051fd745c2a7e087b6224d57297676ab63b

C:\ProgramData\Microsoft Help\MS.GROOVE.14.1033.hxn

MD5 ef1b5096d3be420d937b4a5dfe60792f
SHA1 7a8db6eec09368dafe9b0be67fa72a81a4e7d00b
SHA256 622ee85110951667c0a89877d899987277f74c897854140a5e0f88a459e5a475
SHA512 3609a3becb5361ee806f8572d02360681f0c83f252c42e65226b3d939d5da680e01c3fab1c0b23af45673326a0bbfb08995f9e0a6544172ddb7d85958b493f07

C:\ProgramData\Microsoft Help\MS.MSPUB.14.1033.hxn

MD5 ed0b668cff884a8ff1178a8f637aa542
SHA1 73e39727760bed09b4d346ba9f616bdd98a450a7
SHA256 d4e1230637cbe01b69af8eb6d9cadb92a9ee6b9d5d17e12bb9a9d69a3cf4ce42
SHA512 5e8369d673492f1045169f715fd7863f75bbb46549106b633e49a2892362081a8e12de59bb65d03fa2f4e9399871496480392cd553a05fbdec24653ad6fd3891

C:\ProgramData\Microsoft Help\MS.MSTORE.14.1033.hxn

MD5 00d7af36f1f1d46bf952fed416b49d81
SHA1 674eaf02cb91f49ebf16770f139b2f9a6c25dd1f
SHA256 83f6838269e66e61f2d1cc5d226b10ab32b0505dad00767b64477d5614db3d64
SHA512 75ae2696faba33cafc55e7a49662afacf7f4482f31bb4808a1b01105f7ad1b68eb78c405b73fdf87b984b70fe83646333e5ea4e4b715d6c82d524e938bdd12d4

C:\ProgramData\Microsoft Help\MS.EXCEL.14.1033.hxn

MD5 9f68404ac4b2a64f3c85cdaf0888bf2b
SHA1 639494e77e4f63482f17c83ef6ee00b99054a020
SHA256 cd3905e086379ba31886056d0723ae3d8e909ed3c06ff76a9fba0d27be367aea
SHA512 c83b4ae4749d3f519629f04770f9c7538b4ad5b66134254a783a915a5465d6c327fa8309ed45487c973f05154a99e35a2d31d73d29bd59d081bbdd97f6450a7f

C:\ProgramData\Microsoft Help\MS.OIS.14.1033.hxn

MD5 9ba39ef3ed14d661c1af904617a98a93
SHA1 18d7c1c3325ecdc782c81c2de7ece921cd2594b1
SHA256 ac945e840bdcb04efbd0beed6107c0e8eb6224db95433aee65740a9070d8bca8
SHA512 cbf5b3a8dc1888118547ec2dcc0210ba28d28ae58bbe9c5a81580fff17edf0562f004e27a7a49feae6c333da1bc3d65040aad14b7547b1cbb5c64f8e199d5876

C:\ProgramData\Microsoft Help\MS.MSOUC.14.1033.hxn

MD5 c666eb90e11572ddfa25226281553155
SHA1 73453540a9f74772706d4b75301316ffea87bfcc
SHA256 afe530cf76f91e0b03960083adfde77a2760087865d581df8b7240b836b503e4
SHA512 ae49db730e67cd8fb0c57e38a4edae5441687e08dcab77d84fcb2b4bc1694b246c014e2190e6705b8d8769d6051e6bd8bd54bdcaad4bcd84f3eaffd3a0a77040

C:\ProgramData\Microsoft\MF\Pending.GRL.RYK

MD5 26ac66543be5eb0b7e7dd1d4024e36e9
SHA1 cf3ff01212ca33dfafb9953f1043c96b6915dac9
SHA256 ee627b40c770782e493f8173b717ef9dea2aa884d289cacb1d4f8c6f449c1bb4
SHA512 8c67d7954b5a111f52caf7351fd2115dab28af1829a0d68b328a7d682bb39bb483c8661e465ceb6d6671923e53aae180b5387057f56d420197681495098292c9

C:\ProgramData\Microsoft Help\MS.GRAPH.14.1033.hxn

MD5 ae67e76450e95bcaf9d29b18e22b8840
SHA1 2712816d20a08bdb334c1efc4ff8bfc8a0537185
SHA256 400e265b89247bf21f2321a16e872f97086fc88ca8a64c1b6e26c667190f11f1
SHA512 81fdb686e65761868ad597a5ba8d5599e2623ea123d24fa57d1e307d55071e5bb21a983283edec7afcbc5000518d4d4a26c42a3d518bc421f8a0ded404b3bfe3

C:\ProgramData\Microsoft\MF\Active.GRL.RYK

MD5 550dae13af76f7660ea670e962af8a8a
SHA1 fd72eaf3f94e584ee18cb04065bc57f0400a8bad
SHA256 b61bb882538cfe42dd56e363fcb76d9c373839eb49d00bea76586ce2633c9010
SHA512 725067f43ae730f01d6900c2df6fb0b37f949e953015fda1cd181bad7f2a8a416b7822c509fedfd2cf36324f84d409b9a551bd2da4bd17f864acda9be3197d6f

C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg

MD5 6b922d9be45d924f6ae81ae59af03ad4
SHA1 a89d81851d9c12aa610ab246ad851c8de07276f1
SHA256 0a77c605ce344fc08af4d9766ea277893ae10904b21c318cce2ca7995e5db7b1
SHA512 8e303370c9a259c7484970a82fad9fa9e56992015b24d9eb92965a572b1ae777bdc1397dfdcf87411ed76317d7fbaae7d6e374d7627f3ccc226707cf3e93a5d3

C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg

MD5 fdb83e21fb338c073093682f8db5d9bc
SHA1 485b3ddbd9131f1120753b0972b1fe7b6bfd478c
SHA256 3686677e7974988c1f3070bd0ae96aa7cdd4e09ff332d350c6c365c9e12a9cc7
SHA512 842c442e3965a3ed1cf5a3fb07c5cf4ca228a4f169a2c3cc4ddd9b0d8f9b649d7ab1751f225f24812564940f47afb87c87b1965086ca7fa3f87588ac3ae06830

C:\ProgramData\Microsoft\OFFICE\MySite.ico.RYK

MD5 dc635bd3e43f543dbcdf2a10df3e8d06
SHA1 8f5539963674dbc7f405869451e8e5abbd4397ab
SHA256 7847c31fccf00a5edc8993e9040911e33e0074d9d168821ee7d3a78c5efcb739
SHA512 6160316dc16dbe704d788bd58b3d93a07e0a77614f79df905920fa8ca57089ffaf2926c9394c25ae5ee26fdc198711bbae92b1a224a0a5b03c659640651f327a

C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg

MD5 3470a14a37f39db1c06158915be45478
SHA1 c10d9019edaca6ece621d966b8f4042178ffd339
SHA256 a5393835306b4b917963d461f4ed0b7235f418aafb9e2bb46197b5c6fe4f938f
SHA512 6ca6a1b086557980fb496dc7299a14f17302562f0bc07667188941cfcec63a0d7240b1a005059b7e7a4bb8eb44ce9c4b4e8bbc6528b3bed699a81af5ab73c2ea

C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.RYK.RYK

MD5 f889066ef4398b2fb7b95b19ffa51784
SHA1 16fff93a3e463f89825d2209f8571e293512d49e
SHA256 ae1da2688e4077849528303dc1eded2a63d457e5d010b271bc5c693c0c3c4f3b
SHA512 e0c803ca5a9ca6ad744b027e163ff22a76727b736df64a3ce20bd5f73fdcc2a1a9adc72b112a0175009dc9518c2552636d2dad4608fa60e720782370f9956dd9

C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\tokens.datHair.mp3.RYK.RYK

MD5 f71f58761633f743a4ed918c55493095
SHA1 17b4769f9469239fb487d5250c033ce277fab292
SHA256 edc5442dce4001afeeeb45b842827874474108466853f0bafe3aa74bedc2a9d1
SHA512 3567add52d4aa63b344cddf43d28f76befd1bce90d0bf6df23eba0201f1c8765e91e99ad76a4ce4a749306e9242f1f986e80e4e02bf9de7b63bc54fe71d9e50a

C:\ProgramData\Microsoft Help\nslist.hxl.RYK

MD5 e56b3291ad3f2f27d0ef24dcac60f83a
SHA1 ab3ebfafd16daa628e7d14680da8dfd0ccb17c05
SHA256 d7bf554723904b2bcf439d614cefbd70482748c99cddacfafa60dafaad01e0e0
SHA512 dce4dac5a0a20c144af50f5031ea37285c6e9a58d1745e6c6034b42f344b6898728b8d502384c95e3285cd21e287f62216b766d49f2b9ae9eb054768d1089e3e

C:\ProgramData\Microsoft Help\Hx.hxn.RYK

MD5 504c44a5f00d8134cc030bf2ebd33f8d
SHA1 14e6241635841c840906f476f3da7b4e1443e2dc
SHA256 c48ce2761bd9a1c33cd3eee04f5c92b46022d12a10d41b45d8d5fe88c4dc6506
SHA512 8a115c0c6d5ee533d3247acce0bfaa58042c7e7b4d05c461ff30daf614997274274d8f88269a118affa9cdab4b34f3dbc4ddf25724abed396f2430d9cad153b6

C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.RYK

MD5 ca304d40a40ddc3a43b350286c649e85
SHA1 27761358a6e0b946b3be55e05229bae0b0e96320
SHA256 c28eec1320a8a2dbdfcdfbfcfec314eb4dad69e062e55111daa6cd512f7cea7a
SHA512 75f1837cfff5dfdb352d41ab6a8c0ece10d9f4db032ade569e79cab2f58c4e26f259102f5d55e32b1c34c5dff2967b579385c731e193184688921879f3c8797b

C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.RYK

MD5 4cbaad771d0fa964161249e61d58f0bf
SHA1 f535f84a6754857c435b85328d8f1c90b6bb58f2
SHA256 1c36244abd3599de6513873a59d784d2f4a6f8cd86f395c6160a6b665ae8b20a
SHA512 0ac3699697ff44555939aa100563fe65cfca05c50ff52a3a1b9e5e7c13ec7fd4993a6580158e9ed54745f1aea906c1d4c0d8fbd25279c7904b0ff6c1e80b4c7e

C:\ProgramData\Microsoft\OFFICE\SharePointTeamSite.ico.RYK

MD5 2d96ff56873a858ff804890fc3a49871
SHA1 5b6c48f34b102a95f8ec88862187c3e6ce71e563
SHA256 2d5bbad5b366aa5c3fd10f0b20ae4746e7c22d855b48a3f9334bb9f817e75156
SHA512 c941434dbcfaeea3ea59119c9fc1261c925a6b6259b444f8d47cd9c935f0ecdbda90daf0b16386acdc8d9f03d121ed523dd9eba640a3d34248006fb1b642318c

C:\ProgramData\Microsoft\OFFICE\DocumentRepository.ico.RYK

MD5 fd70e4588182b2b2e5e812e31c9e234a
SHA1 28efc8e7837dd21d7f4d7b0f2afab1720bf471e3
SHA256 f8fd13c2da43c2cd216922e7015e4f0ad34a710d0d14107748b17fb609f401b7
SHA512 67e15a6a4225d262e4de9dc0f2d0cc41bc87d68f4151e3a61beafd37e548935c289e081404cc04851851f1792755d119513970eba2cd6cf4357fa4c6abe0e3eb

C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.RYK

MD5 6e3b98daabf5c28340541ce439f5d2f0
SHA1 22d7807f5b5546f6d2e08564fb73efeb3ae48350
SHA256 938d3f02a0bcff33f1231fcacce028127393e3cc6d5563feb7ca222af9bc2cfc
SHA512 01e7cac57df653e61a6f04e3d3f8c803af2ecbd03d062f9fc37c06357c87705a1db45f5bf7a7b79e85c8a56c1f660ea83fb07b6fa65a7dc770379cd1d4da4d56

C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.RYK

MD5 bf6cefa4d47b9ea1304539eef4cd9bb7
SHA1 d277673916f9646ef75c18136a79ab4f813f1393
SHA256 931f79d515d66aa05474cc4554849a3e42e209781b370b6ad998441b1e760edb
SHA512 e0b03864acc97f1605e9107f71e400caade012f616b40e94374c465eb1f3056d1d83a6bf7cf91fd80068dff6e5dc421f75d34a777a1cd5990f1a6dc205840014

C:\Users\Public\Music\Sample Music\Sleep Away.mp3.RYK

MD5 628288d880d952fb470e1c15f4b9c4a8
SHA1 08e920860bbf4e11ab6ca4e6c376240a27c0f2e1
SHA256 54c93a134b258c45c92c955d546442dcd607df5bd2c41fd7c91607928b2c2656
SHA512 94523aafd3088856bf47710934b787fda7311561756a2630a9ecb90345822b56754ecaaa16dd0cdb00369ab2d9035ed7f781143f67611715a54f356caf8d7e7c

C:\Users\Public\Music\Sample Music\Kalimba.mp3.RYK

MD5 cbf359d997da10b2aa61c836c57d26c6
SHA1 eeaaba0fa194b540da4ce2e6c7609220532552d1
SHA256 4e72d929b2c4ad977aa180567cd06452ce204988e3f246fd889cda2cf6b5984a
SHA512 4ce647ec065516288c4443ecfafdcf747dcbc2dfafc0f0393a26cc205d27d798d0bd265f11ca46d8178b39b79997349db10ba70248528e40a29b0a4c6379cca2

C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.RYK

MD5 cbeebdfb6546bd5a134cfb3ff2e130dc
SHA1 4b26cdf0cd1536a21f824cbe32b5933a9676539e
SHA256 851b1f5a9fb7deaf455af4bae4b610fda25a9084217ffc9b680fded91c32f432
SHA512 1fb513731d1de79b1b56570535967bd5fb033a3743677e52a80de6154754b35ebbbbda01177d4e4a5ec1a7e22d6caa083e79e3419c03009ada477ab6495fee96

C:\ProgramData\Microsoft\OFFICE\SharePointPortalSite.ico.RYK

MD5 0a7cf6d44713673508b1502dcee9b167
SHA1 4495ad506c7bde8828dce47c5fd8532f7f897425
SHA256 e479ca8645aa7f8909c866050b39d43cbdd783dec1d70a9764082dccb66cb443
SHA512 d5519665744ef212a04206c19cd24bb43551d091f01b4b6ebdcb70b52ebcbdcc92fbd4d1bf53adfda50a35af71bfe16657f62620caf2af6578efcb3802355f7d

C:\ProgramData\Microsoft\User Account Pictures\user.bmp.RYK

MD5 0cb27e6fe45868ad92f2f9dad11a0f45
SHA1 5dd5e13275595b7b003fe90949810feff12c3a9a
SHA256 653dc8f6c7420ad6e1d8b8a603c9793f89c72da3354020554599a3e513a29873
SHA512 c0e6c0507b1a7b948047583e39137a5a27f6ca6fb685dd05057219a2baeb13555f1ad75f6ce066832e2054e094026fd774fbd192594281397e3985c5804b1b52

C:\ProgramData\Microsoft Help\MS.MSACCESS.14.1033.hxn.RYK

MD5 fde390d0970d4358d09ae9ecf2be14d4
SHA1 db67eec88a89033402a384aca44e3744b38199d2
SHA256 ede44695cbae7257fb9bbb8cd970bdbda822b4c8995fcd28ce8d7de601da90d0
SHA512 d52829c4b7594cf44cadb59fd52b93750bc3bd829177e20a41eea35fbfd4233fe6f30c14a0adf54ab8a51a7df6f30df25dd386f725f28e2df4f1c420fdbe727a

C:\ProgramData\Microsoft Help\MS.WINWORD.DEV.14.1033.hxn.RYK

MD5 0f3c2e8bf4b677efcb2c59f8d94f7b34
SHA1 d7118627cbac6d5d3de1e8624f7562c4a317167a
SHA256 4bd4cf7194c001ff3f40c040db88fec171ef0cadae7342b1ceb48fb39554b01c
SHA512 e5a2f1d0cfb9a9b0b71b4751c328c15193144216eae371a69ec22486c37d69606e4835127b81dcafec68303b574d2c06ff94d203385d9b0cefe3efa86b3e6397

C:\ProgramData\Microsoft Help\MS.SETLANG.14.1033.hxn.RYK

MD5 dd8af31f6a0a59b845abd18c291d7b64
SHA1 e6c37a341b2db9a00182e39987fac66932d37588
SHA256 c32d32971e96da05c8e6dade2c853dafea26e949e1198e761baf4af3e162d6b8
SHA512 d779b97e6effa9445b97797167206115d1ed32446e61d20eefe02331671ff5ddafa285213fc29455ce93dce858ec7dbef1a769c64401c628f84933ffda2334fa

C:\ProgramData\Microsoft Help\MS.POWERPNT.14.1033.hxn.RYK

MD5 aaeeaf3022ef02d1d0bb7d69d9c38272
SHA1 f0b963b1c1e0d53a9bfc5fcc26d8a28f23c1128c
SHA256 b328baff21744eb5ef90a0e600786f138bec491790cb59e129ea511facba0930
SHA512 de27cc4e94e9362de24f89592a47281685a2486679757ef13358c6b0f00c2a04deda78c7d0d8d7ef12a1e6bd648338925595a4b7a96b0463e639899464993329

C:\ProgramData\Microsoft Help\MS.OUTLOOK.14.1033.hxn.RYK

MD5 934cf76d852d7cb29a9f88b43846c4b8
SHA1 465f0e48f542af7ac89cbeb28418a3c0ad2c210a
SHA256 4c35c9e419fcc29daa0f4069984f00aa2d04092dda5a1a51a835518f87821ffc
SHA512 8a79df711358aea096efe392f1ead2119834622530d2fbd8fc274f9e204c1d22cc5c854ee6bb6a602b727aa9e9be5892646af27d86b9ef472cddd9c80697cb66

C:\ProgramData\Microsoft Help\MS.MSPUB.DEV.14.1033.hxn.RYK

MD5 bd62fd7f85e0202b83806b3ba6fbdef0
SHA1 047b4b525d3207f0a46848f6480e9030820fd8f2
SHA256 bc401f1469a157f6d3957d0ef50384778485aa7b2b707072d7b22282f8ffd6ee
SHA512 3c5de62fe8b6688c53baa7b92072891932acaba58c70282dbee89d64bc7fc49640e46745ecc5c74211534e26f56366bea51a3713bcaa349c912f48e8737bf1fe

C:\ProgramData\Microsoft Help\MS.INFOPATH.14.1033.hxn.RYK

MD5 2b79adf9ce793a061e8889a54a81a1ef
SHA1 7a512487893db76a23de2f038124df12c7f06b7c
SHA256 6711c8b134781fa76d4deddda13f083feeb8e9d3df5b577b63f41f1b846c4ea9
SHA512 6087b7b65b417ae3885b3fe35a5bfd0002578af209d02d7ed08d7d01e7fe05ae930d963f91adf94c3e87cb5bc398e6bdef3bf9f4773ef84baac63727432006e0

C:\ProgramData\Microsoft Help\Hx_1033_MValidator.HxD.RYK

MD5 fc495eda7cbb32f402831bdba104419f
SHA1 4861851b82c4bfa74dbc7d243af9a6e0895b9451
SHA256 f5838fbea1efb64cad86538bb9a58693db7405540db75683b07ac0a18bbe6fe0
SHA512 c4ecde7ca44d6ebf8dae99da31608f502d65a5d19a1c9ac839a7b15d542d9e7f29108af73e6bf14c873fd69a4051af901a80d81d5924f14cd9cac8e10a5e740d

C:\ProgramData\Microsoft Help\Hx_1033_MKWD_NamedURL.HxW.RYK

MD5 9f8feb88d2c0f67f8da3a34aeef697d7
SHA1 3378bdb7a1779f2e7f576421847a8b6ec96508fa
SHA256 3d0a15c79ff88c7d5049409d4265d7ec31511a66a731292cfbb4a61639f1c17a
SHA512 80a824695d0524c10366466d86e36151d970b5e64a4fe3b13248b8f3c285a6860051c293e4ae84f18e9309de7f8f81450200776c33d95191198cf3fe6c21e390

C:\ProgramData\Microsoft Help\MS.EXCEL.DEV.14.1033.hxn.RYK

MD5 2a9d84213f3262f53b131067509de28c
SHA1 8a80c87e125519edac3fe22d12763264541d5abe
SHA256 0556ea77b381280e6e94eb790972bedf006902d50e06c912c513f8214a3f048d
SHA512 faa4eb14aee148de5e8f24955c577eb0bb2dd5211e34adbb1b1a535b0c940172f3c5cd35d555a2d54bdcf03be94a3a0a43940ff448d8da955b77d700df0033bc

C:\ProgramData\Microsoft Help\MS.INFOPATHEDITOR.14.1033.hxn.RYK

MD5 ffd37453c9b74b716f371045b5724dd7
SHA1 d96bdcec55d60d6c3439a6824bb0e79866934a33
SHA256 e0a7d7559a4288c31a2c53b2b204ec87f913656963343c6917a0c8b7ed8680b6
SHA512 644516f123a5e6d42ad3e82035873df2f5c77029da0c163e124b5a23bccc5338101e452b0c6eeb86a7291703660262eea5961f36786e83be6d950227ca229528

C:\ProgramData\Microsoft Help\MS.MSACCESS.DEV.14.1033.hxn.RYK

MD5 9bdf4dd297250439e45f8d01754932c4
SHA1 c2cfdaab747e8c37cdf240b6260ec0eb46a43e34
SHA256 949509bf483f79f8fb755e3e01b629dccc63337d4227a9b729c10c74294115d5
SHA512 2cb0ff33f556ba769ca07bc5e7922463ae92d1d7fea34ee8e6c2fae8a7443a45aa0df4f43e44af41a5cf3484cbba0b71d7c079e76a91414cc369dc9fe87841ae

C:\ProgramData\Microsoft Help\MS.ONENOTE.14.1033.hxn.RYK

MD5 114520c2ccd15350681dc796e6cb0d6c
SHA1 78b6d7d30f77a2c1b11ec5202cc514c64933bf0c
SHA256 a6adff4021145bb410f9916e752ef61f641a8c9e369411a8f7b56861c17bd327
SHA512 b3bda2a4c9d5328f46403ada17e8b43bbdef88cc95faf258bd44eacfafe12417177aa71025c487312f82ba47e6987cd8b48b653c3eaed5d58502f9aeb592f6a0

C:\ProgramData\Microsoft Help\MS.OUTLOOK.DEV.14.1033.hxn.RYK

MD5 066a1f6b1f72d3bcfcc984ecc13eb6f4
SHA1 256f25f41634e8afe8109569c91dae4378df8810
SHA256 7f0cba01c9c78c207bea4b3baeced314bde1de3978cea5a20f6f67ecac5e16ed
SHA512 a5e7766d67b177cea53eb9f1ad1e6e97d84d39e4b683fb495887a1c43c1de02869346a4e1e6d844d138c32e1527b2330576454a33d42edba1f14ea0a704b1a38

C:\ProgramData\Microsoft Help\MS.POWERPNT.DEV.14.1033.hxn.RYK

MD5 40747dcaf48763c7b7963ea52c0727e6
SHA1 a5d2fc4a912a743ccf61b94176733fed85ec6896
SHA256 12036c2a00ca55e8af6c094123a7cc1394bb7d6c9f917430db6a10946be14f66
SHA512 5222e664751e0659ae0cdf246c122749f5f692f52c3354ecc4bb294a00c5e4419ecf1b2d1adb3d7f57aef8c0e9b7ddca9b9f832691d3a04c18e6400876c537f7

C:\ProgramData\Microsoft Help\MS.WINWORD.14.1033.hxn.RYK

MD5 fc3ad177c032e8bbaaac7d75111a0910
SHA1 b94228d275f4fee80a3fc577fdb92c42b2bd087a
SHA256 6da44c81800a6dfc59ec24edf3a5c7ab79053139059bd0f9c6d9c598c3e9b819
SHA512 d547c264830e9650b209b33d7fcce7a638e938d7b8368d60202ed49910c945ae40c64c0d9930c053d29c7f103c46ca2ebd359db74299e1950783bd73723c75b3

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help{92F2118A-E813-4A4D-9DE2-F96A9DC02C53}.H1Q.RYK

MD5 10c96de9e585b352c2bcff191a49565a
SHA1 2235876f53fa586a6be75fa91b46968788ac3b88
SHA256 cf5588d2b40f02889786cc7babcda351dfa09b93c8918b3c7cf80c5df2dbc9df
SHA512 5ef3592bc827f5c1875c504e361694f9d7be2842b6322c3c21f3669cdca0b8c4f877336feb1bd99a2300e744eef2adf46806f1ed847e7855a7020a8ba703e7c9

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MValidator.H1D.RYK

MD5 c6a220152d8f2cdfcd27fdf628b61fbd
SHA1 6b21c4b1a515e0b2be56ec2840680f8c484d85c5
SHA256 b71608945d36358552e77e58ebe4e87ad705943cc347bccaba15baaad3a496c4
SHA512 81cf7a7e51328d7f87369a998793fc433cdfc58d59a72558cc9b962ac938a975d6c9ae11dfdc1854c0b2f02b089cb9c0d9352c5ae8b2fef8a879c069e59858da

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_BestBet.H1W.RYK

MD5 af3269eb3e03c11919ea49eca6a491e0
SHA1 1fdcb31b909571e77730b83dea9cf6dff53d6aa7
SHA256 e9fe76b0f75534033439ab9833d18a4397298f1c0db8290085c3d14432dcd810
SHA512 39eb702142362f86e65b0a1f0b252bd1fe59d1e1c25401469cf1715eba0c35a5f6e09c68e9df408f1a542ec298d0237d6307bd81b51f01a61c2c26031f54d1c6

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_CValidator.H1D.RYK

MD5 f5e9764073eaa50f097b775af85aa170
SHA1 ddd7ea43767f98f64acd7803fa115b2e38d1d576
SHA256 c6c9eda36c32c6eb0e74c742603dc80f527581bd75ab38d5bd12e8955c6c608b
SHA512 8cbd4dae51c708013bbd12f488d0abfe02b414815e3c999a4abb7a86874e3a9223e67abc908ba6b7622a283282bec23c4443f916c787c3baacca0c758be81eed

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q.RYK

MD5 517b76565ee87c1ba6581bf7fe59e1ca
SHA1 749c2a27f13c53b7bcb09a4b557a314abeb66ce3
SHA256 1176be2d16d569ebe286954196cdc838f9967b7872a362f925998d033f9f023c
SHA512 8c926ebaa80e18ff5c9a12db792cc961ec06a3672855b4d521df5f227e53bc5216fd2443f4a0799384908b977860251658933f08502b2135b28e8d33728af28d

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MTOC_help.H1H.RYK

MD5 321da18f8ebde9a7a2b366115067d356
SHA1 5f1071d9aa638fa1e3e4132387600a50def416ee
SHA256 789ddb2b049798e5280df33c3e0a473e395e555358be1c036506ca35a77ed05b
SHA512 e2ac05af4aa325fe9e2f78ad1269bdacac80fa20f6f7224827b67efeaf9fdeb05231c6571ea771747714612b6bb9a4c0f8837fe64723d542b744fa0999b25d1a

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_AssetId.H1W.RYK

MD5 16c7b755655d651d8bd83dc1e496b5eb
SHA1 3b752850f455743c72ef057fecbc0337233cd5fe
SHA256 cf598fcc283734f0cca77b679cf9d609baed3eea5611b6c49dc02cc164a1f3ce
SHA512 17c91ece8ee1bed104eac8115a0c7de9252c729c0ca81e0fa83c941999549824eb5d1131ed9e259c15cd7dabe426f026fdec6822a4d0dd06aa1ec151ee006e9d

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MValidator.H1D.RYK

MD5 a7cbd03e46c92749f156273f6a1eb4a7
SHA1 9eb2f0661d0dfa8453c6dda6491cd6b85f8a5cd8
SHA256 5e59175e86769c47036b72ad44dd6c3b8eb3b9ee1ef5973606973ba60f5458d6
SHA512 39aac32378f4bebf0d0db4b90d6013fea752f62c6d681251b9db70c5cfde576884f86cc7d25304569e5a27f7ce468005ec1c46736959ab3954d595464fa355c1

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_BestBet.H1W.RYK

MD5 e614c1eb6c529cac867f94d97fab96ad
SHA1 0d11dbe778a1d496af0db718d7b1021649baa644
SHA256 6c7f41229d3c338fb6175c120d5e3902fcdeef4bf0d415a10ddffab00550e1dc
SHA512 3ee143adde36fb246735772a5c76218396b6a969b25fb0c5fcf5c2d78eb7787e62daa53843050cfac2d0b2282bdf1e698de06ade77ed777df986e43845e43625

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_CValidator.H1D.RYK

MD5 5e05a4dc83c329bd54dc701afbe28d5c
SHA1 07927ed06408f69c8e3205e2b1c40f640661b56a
SHA256 3e9ab1a7a3ba24acf90ae5a026c89f7aece9fdd0d70b385bcdd4e0d8fc46a51c
SHA512 c7e1eeb921bdd4f6ab501ed097b6338159f723272ce7800d7a43533fd6433f475e202164dff212db95a2a70415e818f96d8fb7dc6f5a4c833c4f37b9bee0db38

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MTOC_help.H1H.RYK

MD5 202f32cd513bf9077e6826c1ce92444e
SHA1 d74b3d941f429915f274093c0e3128b29724de8c
SHA256 42e738f993531655d71966b465bab9d3553a51e4a277b77c52712d4be52c7c26
SHA512 29b8e7f30f2ddf8adffa68fee9c0017a6f4db854321d8bcaa26d59875ac8e75d6f07728da887b9ecb1db57027fe21879aa3890fd0e30e1d2c30c1565f643f09d

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_AssetId.H1W.RYK

MD5 aae358a19dd5bdafb08514c7c5759403
SHA1 a35d308da6041b8a31cac073ada2fa54da3eaa3b
SHA256 f407d10f06b859343b47272775c396ae485708af5f6ffc71e2d0bbf12d46fc32
SHA512 16763f082555dacb5d649fd4f28fb8b0158dbdfbacf102dbea363761ece741249bdf58c94ebfc535925217a8b81523ce53650e3680528a9eee97f76b2b7cf230

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.H1D.RYK

MD5 db148b9ca7e3d5164f90778eeaeaa19a
SHA1 f56281649888f9d5f5bc8819d778f8f4c8dec58b
SHA256 2ad1d3f108d0aae3e9af243dae6d4d5913e12ca0581090e1c6745c67e5aca2fa
SHA512 9e0b9174e09bb36ec598f0939a9696faa1a57b991e25255c334caba0f3c70fb02946ea5b6e9cb41fbb66d1062cf4e2e617f9e96dfa91b8c72e6fe470a7c63a7c

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_BestBet.H1W.RYK

MD5 d896e8a7b82a2ca1127ed0b5e0983906
SHA1 9aa1e67c7e30821df0ffbecb6d4aefc10fa74076
SHA256 aa92916858bdb5ca60f13cf9524da4d051a3fe1091e810d2c250217265054cff
SHA512 215076257203e2c64ce6cb2e24cd4dbcbb3e52274136c77e74162f2dfe2b9540a8084cfb3b3cc3f0549e3076b06abdfbde00f0e2b4e24762755053022e1d90a2

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MTOC_help.H1H.RYK

MD5 b9cd51295b25ca907d512b98bb0625e1
SHA1 ab8fc8b600c143d3e8aef7c1dbe36b3720f1189b
SHA256 6d5612a87ae804e9924a29d6a25b7f92b87230ae9d4facdc442aaf9be16a9121
SHA512 c659c51534291907b6b4245eb8886775cb17cf69e298f4b6c015143767505697c7a9208c1003e33fec77bf4b236aec27190e00c6979a849c068b8cc10878fb52

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_AssetId.H1W.RYK

MD5 e5b1d38d42874d2257c3d86d4e6403b1
SHA1 2606b8502e56c0dbbef9ca6a70b8f1e267119c39
SHA256 0acaf7be473f31733578a3c1fb251a183086a0c4d1bfe87cc93973a817ddd863
SHA512 cae2b2c4d7fa711195a12aac575cc767c53eb93aa36454a10bb649a75cf98b882e68e61ef112bb2f982607984119b076ac6c4678436ed7d54df95cf074f68fb8

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D.RYK

MD5 21efab06402fdc1214182f7ae2a68fa1
SHA1 7e7ba2817a595eb3f6a88bf0508b65823f6b2820
SHA256 843eefe0fe4c01c6d4c19908b24ef8450cd3e93941a289f8de0cd84a5836ceb3
SHA512 43fe8bbec90edadfb304fadae8462c974acd452a918aeeec912bc77c744594a0e884ab23616ed7673e7e0ad241afb40d03a0e08511abbf6c8f1a8877e024e7c9

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MTOC_help.H1H.RYK

MD5 9f226ab817c62dd5535189d2b7df1bcd
SHA1 e783ccea540512ed251e8818737a88db28ec0ffc
SHA256 00c52ac55ccd1584430fb4e0edcfc860388c76b30e5d24c25af12aec0ca8bcce
SHA512 7a4a17b4e22d7a88117bf289e2bd3b8f6e44f7d46ec1ab36f4c16e1fd7b4e54b3e1701edca40c6c7f8a89bd42547756b007326524e3b68635fa394ac7aaa422f

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_AssetId.H1W.RYK

MD5 281ae8016b629cb8eac3b7d9c0f4439d
SHA1 c371f4536c81f52b0c41e429dcf2d0989b194abe
SHA256 d27700ee94d598083e158f718bcd00be5aec0c2dafd4655f13acd7eb734f2473
SHA512 ba7178e6876f6249197e4deae6074d8584f31c3fafdf9f34a62c9c4a5f7ddadecaee180aa444c7e5177f524b218faebbaa9ac1170b22328e39e93ea380cb2d8a

C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.RYK

MD5 1722e5beba90f7bedc302e2a4b9e37aa
SHA1 1f27a0fae2d2c442cd7ada404137c9f2a45f74bd
SHA256 41ace16d83f37bf1af49e6298cd779a976aa54d6845af24f5fcbf7ed64fbac07
SHA512 5cff534466ba0663655684fd58a39a468666f94c39274146322669015d06b252ac0a686f6f164aa3638d0fe56b079065f896008da5e0a46ef7ec2faf4d6f88a9

C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.RYK

MD5 91f1d07f67301cdb527863a29ab76d48
SHA1 03953a683fd51911a8c6a6f06ba10f649da5f82f
SHA256 50695f09e2ae380f58a4790fc9eda5ec968e7d92b7ab80226f0d3a2611aa1ac3
SHA512 87ce2b9bc2391411f41969fa0b7ca717b62a96665341c352af9f636a98c07cd866f35fcbbdb1b18e1443e002bcdcb11522085e20fcdfe9fa17d5ba547c30f5eb

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_AssetId.H1W.RYK

MD5 e980b1f2fc8585e70c8638a7f39b91cc
SHA1 e2a993a223be1b1d64fb495c842281f67d3f81d4
SHA256 0efcbecaf96a67aa258e86556a4dde47871b7e0a5a73522962a9e8026620b26c
SHA512 a103caaf1b08a5052c1e9df81e813672e11d6b6a1d2c480be806cfa44dfcf3426d33a0a8a407519a9e2a07bd025875bedc5242d17386d282673bd8c1e9370b1c

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help{7E352021-69D6-4553-86AC-430B0D8FF913}.H1Q

MD5 345569fcc4d2dc5e514c1d8e17f10b48
SHA1 e386e994e4a85a4a8e98f1829e722a489c4535e3
SHA256 40ae41039e9f7945cf01e1d67be2436f537664bf6e8c933cb9a1c9c2b7957f80
SHA512 037a6e71d4312525660de02fea891f0eaf80d1ed404fe4fe4422f8f41324f99368650809bb7d1492c62d36f4f13081d6527bddf74241d1a21ea12ea7283cf7e8

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_CValidator.H1D.RYK

MD5 af62bdbbba66981f4b8ad17ebddeadc0
SHA1 e02f2628473855fbee6a423f1cb0711f2d633242
SHA256 8de925369a1e343ec7592df67165fb55fbc1aea04f8f526fc507e56ebfe2be58
SHA512 8f3da68098cf5dff90d023b23daed195752cd189269bd9184418b630932a95838c6e514ca6b4b6682edebed2c3488f54447bc1a4969dada752c7790244c525f8

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_BestBet.H1W.RYK

MD5 83da2e7b402e663a15b576656dab07f0
SHA1 d851f52d661df81f3740c45967354bed543e6221
SHA256 89466021fcd5e61acfca54af08802f81f9b07a44dea95dbca4e1d58e993e9938
SHA512 9e3f4f1bb79125dfea96c43fac35697f8d07ebb8bc65e78cc5cecbc528d504446a34f7b03416f946c2d273edcb8aeb8b75d536470490bd993d1db76d833daeb8

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MValidator.H1D.RYK

MD5 b868b5d005ff1d280895e63648e63329
SHA1 70fcdaae0370010270948aba5c0286f85a471b7d
SHA256 5ef0defb90eeea8b92465800715916957076dc6e91d91beedcc6ea39110c676a
SHA512 d9ddb3b1ea8c90e4868f4bb06918b3e21424eb94cf42185e1d263751da9cf940beebd32a8edb0246de7b066215c697a7248a5abddb9d551d8028fdfcc2f221b6

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_AssetId.H1W.RYK

MD5 2fc47d05e573bb86f8c1bdd1429a967a
SHA1 48aacf3507c9a4870855d29aa18c64890753a506
SHA256 4e949b7910ece3ba64bc9c1897b90ad951845cde9abe295e65e8dca5c151285e
SHA512 d33a9d9777fb73c261c1ed2027bda8982f256f5d8e20400ec7b1de8b5e709d16e2d7157b538ab70e68f028a06b4387cdbb286b0d0a8b94eca87a1235ef5d2d2e

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H.RYK

MD5 154243b077ad0b8e3dcf99f1b962fc0a
SHA1 9f7e31b519ec53d365df5d047c92b9b40ccbc17a
SHA256 ee1c57dfaccdbbef11db2e54ca68b0e210d6808deb5bb3be3efb72abb42df93e
SHA512 25332c6701ef4adaad107751419cc787442ad1eba3033c058e4d5fae8a137a5a71e08e472759d20502c7b1abef5358bff3f336e072fe7984e0e41d0c9f396e06

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.H1D.RYK

MD5 b94f759c1bbd3055eb95dce3419450cf
SHA1 7a16d11613860deb1faaf401c8f759a3523e33b8
SHA256 5749a58f3438fdbceeccdad6d268b2533d2e35982e4e79984e6f4013c40fde63
SHA512 a006a7cf4aab0b3a2746083a9b062a53bb723fd534b42d37cc4537d16d94c4ca907e8b5137bfa23185b6b453d74ca445652df3b5cd91c4fb80455198389b58af

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MTOC_help.H1H.RYK

MD5 33f9b16240d37632aa65126fa786e728
SHA1 bcd5dbd964313ed298b96dafa63ddc4e33dd021b
SHA256 77e0eef8fec8880d73d10d229c54cd18285c1bcc4df1a713d8e8150863d85c24
SHA512 627a39e8e90fe0fd5e8103724faac9e7c8c51cabbab960128666d0863910d758412c25b4cb2c1f48092fc4db24e8aac39dd056147fe236c07ebc57941110ec89

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_BestBet.H1W.RYK

MD5 0b3151d70b6db2fffcbe37afb1f0afcd
SHA1 2eada2fedb4b0520f661f6eb8cdb2803594e6b65
SHA256 593cc25a8aa76dc65af2e97c9fec143c44b1ae94b4bf1f78b75cf8fd6f592da1
SHA512 4a7a54c607fd056d0216e5d6d86bf918e275ffd34cc53030510dc9ca92abdf10b3f7c2815b7221085ac1c15bc2cbdbae9f1358a6fbfd1b773db19ba2a0d2cf8c

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_CValidator.H1D.RYK

MD5 915a9e180513e88b2924503697a25de5
SHA1 2a2742af7fc31652173190e2b04a20d86b9e3f9e
SHA256 7d45836234435854b660ad9ab8cb3a7beca001642a15027640204158cd08429e
SHA512 abb5a301e64fbbc0fbf06feb8e4d7a7fbfa4a3da7118cb6d776984386c7cf0b380a5d14e11d47b506f12d48009a5a5b101b363033a1ffa5489e744f9341c16e6

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MValidator.H1D.RYK

MD5 a2b1efd7463ed3e34ef02f18ae49a3df
SHA1 95ea694186709023f6d59353c7c2232279793624
SHA256 43610986ca8429dd642a05c85cfd8bb82736260ab82b9cd2677f31dd3194bca0
SHA512 03b74f91c366a562cc79759a1b1e69df9795c1c8be51cf182f66719d936a3afc61495e3fb0241df5db996f780eaf85379666f3d99a15672d3b97a22d3dd8489e

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_BestBet.H1W.RYK

MD5 6693c2dc55201544c7d7015dedce35bd
SHA1 c67fe7de77f75b1ba67062cd2caa12f8abb19b66
SHA256 a6958fcdbc2ccdc12346f2694527e3b3f64e8b1da8566e7452e6d129117f3b2b
SHA512 732693f757eee16c24e720fed7824bbdbd810c32712fb3043295d307dc0d186d51a6daed00a38d076e47b030b1161664400a8222e5dcdda147ebe455ce5e57fa

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_CValidator.H1D.RYK

MD5 16320a4444a74c3950af685aa84c95b7
SHA1 c2e14fe381c4cc387680586995413158fd1e6a6a
SHA256 58d38f2a0bc5effa53e51663f43ba13e5b30ccaf1f3652bf4144570f8fb1d37c
SHA512 4a63fba674fd2b3d35ecffaf585918bd3d0d34eb7978a17878106ecf2c6aa079c96186235208c2057bff76ef82ff86e6cd5bde9c8dbd80926e1777439f65e1c1

C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat.RYK

MD5 3f32eb5acbd9b5938c6f270ddaecd26f
SHA1 2a8ef1384c5f7b5cd42f635f357802cf03e2ab4c
SHA256 5dd06aee2f9f536c1e9e4d26d3e0887b0d014fee5e5d8ba55bd5fd471849a704
SHA512 2dc8494c36628683454e1a531e8c932cd8ae807762456916d63b3df2c5ae8264565dbac02a9078b6578d337676ea4cec1b92019ab87386b6da55585572a1d014

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\state.rsm.RYK

MD5 07cfe2ab6ce4fefafd2853fb8558ea88
SHA1 a21dcbfaaa4b352f6cb9109a1e5639d88e6ebddb
SHA256 df35329e57433b701856cad16afa22257d4b38a451d90c48f7699ffae45224c9
SHA512 49ce313729664082e17505de708074787c62dbe434860b0486df22657ff04d1bd5ce2f80255aec4e59165872cc4ce6ec28b67e96446ce4bde13b491486bbd3bc

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.RYK

MD5 6a86fe178aaa146c8c5f899375f6f39e
SHA1 933b6b0177700bc7ad1fa9ccc2ceafcd5b8e16da
SHA256 46d1050c22df2f3116774a39100fae0c0870189a434d5110b0b601c52ced7176
SHA512 c5c4a78bf614b5c117458ae349098e30100cec5145a4694f36da1e4032b5b1ca7627295945bcc03fc80f5d81547b1a0b27e6cee37e1ae9b4b87d3c6396a27a09

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\state.rsm.RYK

MD5 19e64694a19c233dc30761970e69272e
SHA1 61ef213878f57c2385f68d130ce8af76bb563cdd
SHA256 f864943f3f5ee52854476a283f3ec19c81b031be90e46877d3cd938249195bab
SHA512 a3a0ac7e25138cb479f9728a50d8ca1dfcc90ffb64718fafbab13511d53c35061ec718727944d0e1dbd32d3178d29d03bb68d740bae6d080d51502b9e1112383

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\state.rsm.RYK

MD5 7f131eba419f1945c230b685247b4761
SHA1 6fb7ecd1cc2aac0e78ca2078f56391e476f11508
SHA256 5b02366b246cdbe714969ea05ea02e061a9ae5a643296880abdb4ae1213c846d
SHA512 9bde8e346b602fb91a84fa673111cec05539d2cde2b39f415e817d85d0ddfbf747db775b7184e9540c319c254f9be25a799d2e47af0a5b8e0d14b80401e86985

C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-07132009-221054.log.RYK

MD5 0efb4c10e9ad1238b287f3c757374705
SHA1 27bba97ddd6ff902b5dbc56151413e4da9a1518d
SHA256 297d8ecf949e85003fbf004161c48883d22433f6504f26616fb6a44645705471
SHA512 6cc656b8d1a75984cc526fe751b9d59f41eeb1f8dc46330824d1339511c7293d23f14e54222a04bc813856e42edee0647b0b8f42e07ef649a91e3d2c4d116ae0

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help{45EACA36-DBE9-4E4A-A26D-5C201902346D}.H1Q.RYK

MD5 9150a613aba00d78840ddb2448893d85
SHA1 a10a8f79d0ece0086ab0aed34864c48b6c768c47
SHA256 ae13a8962eeab8c4bc8eee18c13e14ec00ef9ce293466bd8a56263191d5bbf44
SHA512 6ff3ed9ac520b09aee8d64cd4c859a885dd0bfa700930c823b17b8f4aab69fd7da787fb43c5840f9f807cbe496e80eb8a737ceab5654de5d2933abfbca5e0126

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help{68DC71DC-2327-4040-8F03-50D6A9805049}.H1Q

MD5 ab30aa304e5b9f03744e44f4ce635586
SHA1 598e157a16d20f6986f38e02cc7aed0e50d8e39c
SHA256 ac1e42823cdc6ddbddd07c32373eec6d818401852965c2dfeb5c8e2bcbbd297f
SHA512 f9b8bceb6a98ed28a4113ea586432283b21d162e7c4b3a23e78845fe28056915c796c384e9c8db059f7e1174ab7b66b158a92d743e96e839135db030074313db

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help{E1E8F15E-8BEC-45DF-83BF-50FF84D0CAB5}.H1Q

MD5 d3da764bc96f87b9d4fd57066379636d
SHA1 f8168fd1eaac4ad69bdbe96ffa3b2c5d8c09ee2c
SHA256 c9abf6392d530ddf452d148046193fdd5c3b14fb97aa4b5c73f3aa2a41d7d392
SHA512 39e32473ba9793a852bc37d05816dfb6a17572371588157e7a1b9dc3f0ed4a8873ca87a25d9825742dedcba8895756e5abdde9330231deceb6a65070a418664c

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm.RYK

MD5 445f94cde2ba9adc62ddc268c64073b4
SHA1 90a409caa7bf15d5161620bcb56206f73da80c4e
SHA256 b10d6d4b637a0cea5e524f08a5bd79d12af68b5fd0b07a32502de1a534f8e726
SHA512 4be5ae8690e2c4ebf25e46b81a1325ce68fe7c8f30c0e311d8d7c675cfacb05407fecdf3a492ed809e0651f2f1683d428c1e549056979af78d90733c95e7b143

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\state.rsm.RYK

MD5 03af98ea55827ec5d8476a3f8c5a8b4c
SHA1 13af987573a281b6409de5eb86d0b20b5a7e5f3d
SHA256 8f2fb44f51da5ec42885518b14d946112ea54a8865e156ad19dda20f237d592c
SHA512 4050743550febab1b711043ef917488b3cf60e8a26b83bcd0f13b7921e5705ec77201555b559e62b189bd80a15f1e86ebba232722bdf3255c363f0ac94d241a7

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasdlta.vdm.RYK

MD5 bb2bf5b1af23035c358c5d9125178264
SHA1 60a17a12f014740c42be167a4ced9a5c5b2ade7b
SHA256 a95f8aa15574d43e6571e0fad43a7f0270fbc8e640d5a363d53d377910bb9bda
SHA512 249ffa355a3f92806a5facf4d60a2072a456478c91690bcceec4f0962b1ba8d44f0035b7f23bbc8256b0d3682a952daf47c6fd12a5d0535c1d14c861518bfdf4

C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab

MD5 90bec8c1cafb7e62370b5885d78df51e
SHA1 e91a693f8fe92f741c50657050d133bf1a7a1551
SHA256 77647cd6961095ae783cb06ea2372909fecf89a0e8a3fca9b1eee6cbfced7886
SHA512 279459f19c60b32a74cbc86259fbf0b778a98a91b724d5c3af89785d391f50675f1cb0b70206566c3103350994353581f10839330734fbe30165df2196221ed1

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_3406f593-57ce-4523-be0b-a609f93fe971.RYK

MD5 ad5c8f4696b0a0f53068d367c32c3557
SHA1 c2461612910d223f83a6ad93ed3b57b77f36c94b
SHA256 13d141c2ca57cbb77b1eb04fb3728c660d36e0380d9706f89f316878f29106d0
SHA512 eb67d3b1d66f7b31779f23cc62d734617a0f5de7cbeefb42c40acf05c8b4a1ad791ba375f300f3c1c26bb00f812bd5c2790969062e31c9d2abeff25dc9eb2f7e

C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\cab1.cab

MD5 22443953cd7cfda7c46268c93f99c8c2
SHA1 c7f241bb2ef7d16857493516afd4f0501e7d5ff7
SHA256 d548954bcc942bdac20c7b2bfb624ff9b4046bba99d906fb9b0e6b332392f964
SHA512 bcbab9d994f3ea2a63d616dbba160bac2cee782818d19723b48559109751a38a2e7e46c3b2d4b85e57014f39a91937f12b4be2e70f26c07fa698d38b630b61c6

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3406f593-57ce-4523-be0b-a609f93fe971.RYK

MD5 a5bdeb9a31a8b303d01cbec4efe3dd5b
SHA1 2fde4464698b1755f0b7bdb771ff2237a603326d
SHA256 a574351edb15e1725e537cdd1a08490f9a2dc7e3399a757ee0919020febd3da7
SHA512 d6a95ca3d89a58e3344928266c256a318247c8d7d547a0dcb55a756a296bd182b5ae5bb128cae7f32efbc61f73eaa2f2f6304f6ded781593c84805faae0b007a

C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab

MD5 0cd3dcba57b5596ccfc24b1739268ef6
SHA1 9edfe11f5d7bf0ce1ece2f0b2936591eb959848f
SHA256 4731cbd67783e86ef532de7264a4c3caf6dc301907fc861f36e5003961b0692f
SHA512 f5f2ce9712d7a60c9a085c9744ecd13f9336d986ad41819b7393c14657e7c0c3d186d7b68cc22ecf4df0302c3898f0abfe29e83baa82c90db30ad009fc9727fc

C:\ProgramData\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu.RYK

MD5 a4efcb63ae89d620a81fb67739798a11
SHA1 973a8b37a2e963404f8323ef2b6ee45ea577da65
SHA256 8c24943175c8b39fdafe870c6394e3135ecf302608d7dea52d0bd263e1ad414a
SHA512 221133c4c97d600afd720c791c8303bb71d608fec9d440849e0a949bd6947532808ba551bead4abf6dd6259eb81c6665c4c62fb72361c9a0123e71bec660178c

C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\cab1.cab1.cab.RYK.RYK

MD5 c13b38a2a8e292065539c9b01909a9ac
SHA1 8850093cf2a9ce889690513ce82752a6dca633a9
SHA256 e22a01aeb41ac21eef2b63b2fcca7a7c5b9b6e8ac334646456efa66fd1ac7971
SHA512 0ae64e98388abd91bca44dd232aa6bbbe3b14b756eb4db5a4a26ec196f89751c46d51f28f18b04744b610135ec7ae40e40525de53fa0a1be0467bdbd5e60c719

C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\cab1.cab

MD5 f0201a8b1d2f69bb31293b845783dfa9
SHA1 b7c82e928beade83b06552302d170ecce7590115
SHA256 e2093cf32f25b64120e55b875660c03ca4dd1daa21f416f323581f1bc8d1b965
SHA512 03b7af071295eafe7e5a1bb90697cc91f59e6ede2e71f1e4d51182d47c2e9674f4fec46c16fad0d9f063017834a63c936aaf344a8af3912102808d3ec751c03f

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasbase.vdm.RYK

MD5 dd63fe7a5d1935957b2ecb3082e1223f
SHA1 cff5ff36aac6388e1d9f06553abbdb5003a4d465
SHA256 b6aede581a12c05e991f070c7a1573197252c5328eacef1c99fef36a963f91c8
SHA512 74c5affca07b8d2955cfa81cd1dfd23bd7a6814964b2135b21e8c6535276313ca3dd05c988e3bb0c33703f933169b3c978dc7d60c5f3e43123f9b61b77bd0ab1

C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi

MD5 71917f1b879d930c80496804b003e48d
SHA1 d128f27379cb080aa8472e4b1eb73ad6973e6a43
SHA256 fa2e429b08a60f11a59ac61cbf70d8f00b72956a8ce502c0e8b3538fd93db62b
SHA512 e65b1ef65a39b32c299afec062a647860ca02abffa91bf67b73c0d78bfaf7bb18b9f2b39ad4b2a04d842580fd09740927bbbb3b55bfc0299bf819bf0e97a1cb7

C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi

MD5 f69b3ff61ccf7ea6c126b0070c821dea
SHA1 f8f3f2cd659c348f873b9da7a032ec4959a19230
SHA256 9a5dd10cfc4bdb0d5d6c04cc57d936bbe840f232b06d6480a49aebd02b9643b5
SHA512 6a9ac8ba814ae10f6c0b68605afea131061f63be40efc78c1cea0285df72f5fa2bf3a39d382b4f73ec16c5b2d768e4c397f955da50f285149f8a7725dd9273c1

C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab.RYK

MD5 634183a09cc06ab2667337b15da670ae
SHA1 d33df91bd68363f86ad632c0771d7dfeaf05d0c1
SHA256 6c6e5606bf1ded0c332233607eb6c384ad44f6a367896454d747b7c17130af4b
SHA512 8432d11d17d40f2a5d965ffb6b6f661fc3bc003122159282d7907d454079a659148b0e0ce43e23b224388a0b9ba39586e63d8d8f445bbbee3c8846f19ce2ac03

C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.RYK

MD5 324fedbcd1061bea196b54233fe41a09
SHA1 53e38c074f7ee735eef556e8aa2874626170e5da
SHA256 eca707f99af638d9c0af6f50ab7ae07939efb40908a61728456d79cc8074ce4e
SHA512 cf857c73630d72192894b30401ebcaba39374b0ab422cb94da86bb46ecde53cb87e9a36ebf1af59997213875a3f37946a48b2447f6a7e592408bc783145f5508

C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.RYK

MD5 26b375b5f41d7284566d9d1760ce4e14
SHA1 922cb8bb31b5eaf58bc927c8cf55004ae7623f55
SHA256 15a069d6aa2ace805b8b7f254869a3f796dc1fa20ca6da54acfad0b5b7bda324
SHA512 ff8d292b1d4bb7040f610182b8754ed394aaefb66f1b0dd27131dbde4005c28dc0396f6418dcfe209232f457ed486597d7c899df3a0002a89c327c72e92b4233

C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.RYK

MD5 383aa401d85b50c714dd9e1c1a2146c1
SHA1 c2ad4999d077d223ddfb86aae5f2c51ede75ade3
SHA256 9dbdb4c7b64bc6988f003b62efc522925ff9510233f0ecd0e77c9dc57ca7a85c
SHA512 d46e0a92c82e00c44ab7c12f9f637208d0ddda12b20066ae7cd1772a53ca1759603dc3e769fc4b33a95dedc34d43ad777bb081f0de707696fc9ecf88ebd901e0

C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi.RYK

MD5 20e4c2b7b434363eff505313418001fb
SHA1 52acbe5e1250896d886c08d5f85e31b660367036
SHA256 9f8b1e3ffe5331042a491e7903b4deed5f5b8eb1c452b8ce903b273a905eda46
SHA512 9b9edaf8aa36e99977b72e9c2b8d89634cc4f0deb5cd653697c1a5699163a72a1f1d63cf96ad20d545937f6429db48513524185ad1ba1b5676a95d770dbb25ce

C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.RYK

MD5 b5511bb87da03ef0c3476895fba36b24
SHA1 926d9b7144f4234f6b2c9e12c010eff79db2c2fd
SHA256 1bedb782d29b8cc725079023dd3daac3617c92702ae1a0b73621ff1a6232e119
SHA512 be19c2c1a7505d30a267359a268f300f9d44dab8abe549716c04f9c9503e39bc126ce509b5ebdff6c7bb5933d70724601d2cbd3adac62171190845079654a64b

C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi.RYK

MD5 e566114def7bd61d003a47102a0ee032
SHA1 b8825ede401875dfac911ef8682bdd5b53c0c527
SHA256 026bc6407ccb640e2ce998af7f8fbb1df06e7c82a757b661255f55fd904d793b
SHA512 d9aecff171f9eb70c6770fb0b367c848acf8fccef4c37a88d30de02c21a86784f019d3ebe3a823082a9948e950a9a0a4f3b36ded003b1492f7d726d1654fac2d

C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.RYK

MD5 8b23df35db6272247ad79dfc6b3dce8b
SHA1 66ae4cc1d8662af521da541d0a0a5b70fddc1d63
SHA256 175cd189ab4b25e5487d5e9b7954e0161f43c80dacf3d61b5597bc183569e27d
SHA512 12e59992736d46ceaacd4fbcdc09864c9f8ce53e8add63046b397c85252c9b902679ec1074a1ebaa7cdd316d8be4ed9ea6fa0379913f301ce928d5e35a450f66

C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.RYK

MD5 b393538ecacb6f2d87f0293761308de8
SHA1 57a6a86c9fc288c83d94b768912af1d802507bc2
SHA256 f72977a9876a1d103871ee6f294b7fa44c396e8b16f80111151c94289be9a321
SHA512 a78ff2c095460c1733125ef2940a494262b32614c5963dcf3cb549bfc6ccc6326d72ae012415d1df75cdee9b85bcc7ce88ad7110d547fd7ccd2d4418adce9d23

C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi.RYK

MD5 5b64c5b1f2b184e848d3ce39e8058d9d
SHA1 b2730b44ab673718581793cb68ce9ef143476b2a
SHA256 8bc016ce5ea1a54fdf9367ef726107291e80b476c6b1fd02d3c3b147c6835377
SHA512 57aa41523bd1522450ffe572ee05d8f6b7ddb5436dc14e66394b46574bdb7fa826789cf9b1b15b650789908e6f995245332317fe8a4721d434e28e5788a07dda

C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\cab1.cab.RYK

MD5 5020b04df6acd231821201d05b9d4773
SHA1 7cd95711fb9f4a4f6e2569ded64628efce9ad9a2
SHA256 84f5c0f36850e7b23925a121b3cdadc07a9c2d5f651fdba0e4ced335fd16ddd8
SHA512 a5e2414a97e731ea41259a8929dd5f2bfab5674ff349cd3245db1448a2661984f912fe9219c9a8b255fc08d064fea4106f711cea9bf9183263903cf754a19bc2

C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\cab1.cab.RYK

MD5 bf34d262d4f9415553fbc065f39de0fd
SHA1 d86b93002b5bc741ee1186233cb757b66dddeb3b
SHA256 9e7e3cb2a563bc48fcb1cc2b572afb1976589989e4e43df4ddaec55f7bf8de3c
SHA512 7c7b0cb91485666ed6c77d827e12c463f78afc6ee43fceb1b65b9efc1aa9edc21ea10b422a65c6731c0f1945a9fdec2cfe08c595c00a20a5c157d471f9797940

C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi.RYK

MD5 ca984de8326575b2f77486acd5212e3f
SHA1 7a5ed4b7d0b7cdd8ecb73182a0fc8496ab494420
SHA256 3256190ae09f2aabca866ec9bc8aecf7255d8df6c1e87620c7e9d9ffed3e00f0
SHA512 39099573d30d2f93477e93962db12daf945240a7f954239c6c7286050f6ec7d3f97740599b12ba604ddf2e81c57d713ba6580347cc97ff056006775ab5e14c38

C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\cab1.cab.RYK

MD5 464d3f7e18541f279b3812ebd00e507d
SHA1 db7e3d44818e2b8f23d9c195c0ad6c918dc07ceb
SHA256 6bab81295cee04c743ded27db4fea494a574d8e0f99c49fa859c428051182d5c
SHA512 48663d24bd524d8ae32ce23ba0003cabc139f89198eefe233c51d6e2b0218b456855cb6f62c06a4cd711d9e62e0e3d5a87ac066536eb178d414122b5f6846825

C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\cab1.cab.RYK

MD5 7bbaea5000fe6d2e395087d79ec4132b
SHA1 6074f2377dfd1776827ac89874ffe3d183e543a3
SHA256 a2217e56b3190a25aad165b3baab0e940670e3da1c3714c79ef8574668c11759
SHA512 71980b1df3b763b3ab0714154a534dbfb41841da397fb10a0228b2cc2c6150f4ffcf14f3ec0d6453580af467b940c09adbcbe4ff6f0f2ffb4b03f1456101afd2

C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab.RYK

MD5 d14fe12cfd33de85c0d02f58e80ce28e
SHA1 a8a053d5361055ddd9c82566576c407a9d91cd2d
SHA256 b9127d6fed35aa84ef2b188b9936543cbcb9ed2486f20182b69ae15f4d9241ac
SHA512 a2edd3a0c4610a4a7cdf4a3243735b4ae202525b87c824129cb37f235402341aed92c40d61f1bf0cf18afa284821d21f83110befbcfe52bb3e6cd6b4034fc77e

C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\cab1.cab.RYK

MD5 69a1e11e793edf1b1e6269edb4f05708
SHA1 781832b2cd838e6efdd70e62de31343440360454
SHA256 2f7a2c7915f9c0076cd6728dcb6b404ebd6043ffc11bfae58137e333f18fffcd
SHA512 f7dadee15f9fdcb85b3c7c95ed7f5a717130aa81d4913943d9d2e116073a2e337161c430e7898c0aac8b728a47c7f2813154b8c8f5b142380f070125ec0da9d5

C:\ProgramData\Adobe\Updater6\AdobeESDGlobalApps.xml.RYK

MD5 1ed284e77e2e85a444271e9abf0b7fc8
SHA1 cd7bbb83d077955695b676ff8cd7c6564e26d573
SHA256 d8e5059c221c5999827ff53aad88add6ccc7707ffd44a9216a5231ae6e3d0e73
SHA512 bc6fd7b019a1fed283c0723d21a0a30e902c32815445dd8ba8e5d4b9e54484a731073dde3e66293bc791f71e1ef2604da3183d1d8ea8bad9607695a26efd5086

C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata.RYK

MD5 d9975a0ca17af4af6625e6c4d0ecc0fe
SHA1 9394bbe2f64c001811ff4ebcf15d8430ea09d6b1
SHA256 91946d612c1a2ca2d8cce0101fb49a4d81fdeeb0cc7c7d3f0604f316e02a4238
SHA512 57040933aad222690f8ab3ba3401a693f5dd8c7132740f201a4c3c9ff21fe6ec2991ee6b8942c5750b926651f5688d32f5cd644ff50a722a3e6581c13327a56c

C:\Users\Admin\AppData\Roaming\MeasureUnregister.emf.RYK

MD5 d915bd66a943a01a9b2ec1474b2b1a00
SHA1 3faec1fd80d84c8b1ac98ba36bfa98a6f7f8f8c4
SHA256 74143af6f080f71171784f10129cda509bb83cac080f50cd15f4eb8f661e3c5d
SHA512 83dfe8f3f0a6d4628fd76d9b6452e09b79b786d47cb7d0327266efb10ba909c15944fc06aea0059bd51c0b39dac362beb203231f1b9c5fb4e6ecc15e572a6b62

C:\Users\Admin\AppData\Roaming\ConvertToStop.tmp.RYK

MD5 717031ce12516df0dc879a59a7790736
SHA1 2df2b047ab5a23489fa27dbf1ae8e30539e2bb4c
SHA256 4dcec60ee58217f6b028c3a5c27d0a4adbfc3ed97ea56632e6101c63d1ad7f6e
SHA512 2d61bb9acd9910943fd1668b88b10b78db188a2dbfde396612e8847bd0e33c9b97caf34f7eb661bea8248b986f573d6d86a477e9ff40d1d1cea97515f61b75e7

C:\Users\Admin\AppData\Roaming\UseMerge.mov.RYK

MD5 1a6bd07b3b42b0e03bd6d2952c44ea70
SHA1 2abebf26e4c198cf38f22bc34a4151bc677c1fea
SHA256 df46e9e10efc63b7bf890915d3df8995c63777a18d2900bd991548131bfa6e36
SHA512 6e0350ac1a7aee539ba5a398cfd621590e3b41802e153dae0dfdd3efb68b8195857bac7353471075acce879a69531b12bf971820252ad563800853ce8f6c5aeb

C:\Users\Admin\AppData\Roaming\RevokeDebug.dwg.RYK

MD5 40863932b8bacc5766a1b811826288ff
SHA1 001612798999dbbb6b576a350aa029d3588c2afe
SHA256 308807873512ca1b6e21707c12792a7811bd29c1890478025ac30dc2f8f0fe38
SHA512 73639c76edea3bd880e9714b6db528cc6089887a84ed628aa770d7e3da6fdf1590fb88b2a4e39495df962146c59cd9317d3a3618fffd3a17a84c2077e113535f

C:\Users\Admin\AppData\Roaming\ConfirmEnable.aiff.RYK

MD5 9b956af00b09caef12c3a8ad94e5e8c1
SHA1 ae12d83c052932aca64823b0f8ca89482a6c982c
SHA256 bf9a7e487023fa39939e1b86114c0a29762dcf9470012b54207ee739aa38a0bc
SHA512 e375f83faa5a4d3874faa55e83a6a69ea688951d6ffe023cea74d3657f12eb7470b43ad37950e54d5954a7ad0819c555e7b6ebc9660f04f50ae58acb411648ce

C:\Users\Admin\AppData\Roaming\CloseRedo.AAC.RYK

MD5 0e47af596ae23fa23023b9192ff3739f
SHA1 08e063d56f80052d0427bb2b56d79913cc00aa6b
SHA256 93eb4e28dcf069659da167cd9b3db43e90d9ff181d372df4464094c786d48d9a
SHA512 b1e8be977a472df43795205a46330d14cd656e34007c38d80d94b0869f4add0c0ad33bbb654c9c37cb18a8a6e632fd090803dc0406c611caaab2dfa117017b34

C:\Users\Admin\AppData\Roaming\BlockUnlock.pot.RYK

MD5 5ee14033c5dec28ae3bc579d2596da3a
SHA1 c316e173e565cac7a9528b9b70ed6512e1d73567
SHA256 0e6bd37af27f9c69149895af3f2d0f57691cdbe087b38161977cf666d0b1d490
SHA512 0aaaea8c7dd1aed9ee3a34cc9432de8334fe8f9cd2b1f0f2c2bce3693c9caaf4f868d5801dbf38e2e2d2c8db17083f04745e03ee20817ad2c49ced33adbd5f27

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\UserCache.bin.RYK

MD5 652cad0ff508c99a143c0490ca778e37
SHA1 c42ca47bf4f2849c1e64edf17d19767d302bab8b
SHA256 fe5737d46e4210c63135108d399e01943dbecdcc0f4fc96d025039671114f3a1
SHA512 083604aa7f17f3d7bda30ee6fd2dd4c38dd9d666350b748edf560c85fe368221562ef914831b7dc237bf391f09df1ba93ce77769f2f1aeacdf5e64f0261aa64d

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\AdobeSysFnt09.lst.RYK

MD5 58d6a2e8575d08bf13c2198a8ae5eab5
SHA1 7efb1bd7ab7ae2277eb2f99a3061883734f016f4
SHA256 fa699bd9d4932a32a26120e54852938c5d54f22419337c57a31a343fa32b8e17
SHA512 a954809d6ab8d0258de233d2899cda29904407d5a68d44e72288b8932ee43f06774056a065b426989897b491c12652d5187322066838d4d9c597a7be860fefca

C:\Users\Admin\Documents\HideDisable.odt.RYK

MD5 9e31b789b0a9f75182f39ddd5cc24b5c
SHA1 0b8ebfc6f66250fb5ea08df1b0949f81a2a78f3c
SHA256 46dc829a2dc8758897ca02cc0a07449046ac693f30cd63b5edfadb08a8c2a88e
SHA512 7388bc348435a972da04f76b94e9035e2adee3a5db9ad7888e9d78aae6fa5e1f940851dcc849f1c79e9a1d81236712504fcc5227890b094af0647672962ce1bd

C:\Users\Admin\Documents\GetSync.pptx.RYK

MD5 0d199d938a0bf5c6608402f0d5c4f3d2
SHA1 2b2804c45a358f421a51c8240e456ffa75cff39c
SHA256 fca9d47c146f73d1f507c0f7f64d68376931fe14344dbe2bcfc202730171ef40
SHA512 67917bc205b792eff8215dc53304418c658e455cc0757e292a5aaf643eba9093f917ed3b31a2b25a5e3d81c1295a01e0c0a244f8713ffaf08614b17a152950f9

C:\Users\Admin\Documents\Files.docx.RYK

MD5 8a4283ee15d17f7d399758462abba1b0
SHA1 c765de2cd2dc8863cc6e070ea0e458e5b6c01a13
SHA256 517ccd6c074497bf1f15b31fc3f2e9b917dec49536434f2c874b430c67421bdd
SHA512 4a49f340b82792c86523a0de8c69a18597c9df83b5a3d52229b4c3f1533585158342bbfcedcbc84c554297601bc1d240911c0a4be5fdf9a2fb1be46b4e966476

C:\Users\Admin\Documents\ExitDismount.xls.RYK

MD5 e40160b0a34adb01ca7251e6bc06f55e
SHA1 5eeb8239c11fc742f537bb363dee877ffabaa2eb
SHA256 716c250c0c3094a74d1bb730cc1a97fd51ffeba60b07d506d403771414cb5fa2
SHA512 7a00f8ecb35442d8e20ce9bd4974061078a13cef3e69211d9ae6dccde0b05844801be84c687bd1035c81395a1f4e0f5c5aeb025853d9bac725fa54590c9e3e89

C:\Users\Admin\Documents\DenyGroup.xlsb.RYK

MD5 3bf6eb44dbbea6d0a8c9e6765253c93b
SHA1 2e972cf35f01b6a634d7b264768e60f2468735bb
SHA256 71543421f7fdd343ab8ff412d903c3bef2773978339e9ac32fa3f30ea871bdbf
SHA512 efc9eb9f6127a344b9e2ea7fe3fb5a39870a06be937d48f2c57c82dd6a6e1ad101fcfe3d5f8303db0e6967a1e790842308a69ac4f2e7c34002818cf0d3d1a518

C:\Users\Admin\Documents\BlockRename.vstx.RYK

MD5 67880372f569b74f4fed082f8c927cf7
SHA1 9d5d5eec0a20dbc0cc84a78ccef684ba8ef2f98e
SHA256 89f1077f3335973393573cc9522b04570edaf8a3ed7ca8789e3db2b54b96dbba
SHA512 b6b6f2988b689588654a307da3437a75816c4697d625b10cdab794ef788d21af5662b67ea725a572ea3e249ed03104d19ca82dbc14afebf58fb5e0aadb5455cb

C:\Users\Admin\Documents\Are.docx.RYK

MD5 1f1f70f62ccde11c923b8c5e1f7f1b06
SHA1 49b6488b073ad00baed2971a9b7b5dab964030e5
SHA256 b9f6ff8d560338ec4d72b592c9b8a5741aea2674ee73f472e6f735c95fc822f6
SHA512 a1339da07d5f8ed81edc4207b8036b27c104cc9513c27635504e350665ddadb38d9596d9e5d2bfce09204338cd74a4ac0ed588cf26b015355661de1539552682

C:\Users\Admin\AppData\Roaming\SubmitSwitch.gif.RYK

MD5 7aaae8a5a948cc5d0e5be5d4e232babc
SHA1 3ee5f04bf05574f025d899c22068f70991c2e6ab
SHA256 a6c411090c04ff3b814ed5c2726bbf469857aa71bd22262f59cf3f72b3139b10
SHA512 55a4f0a8065b4a0c13d89b6532db08ddf2ed2b1851a3fb67e594c8c436959cd6aae22c3526cea5e07966a1b835842102e64397426f6c8f5af3467da30019dc92

C:\Users\Admin\AppData\Roaming\OutDeny.kix.RYK

MD5 a28aa6c022bd312aad99839f2698294a
SHA1 552497d2cd9c6498477466ed9612c36574120c3e
SHA256 982e97b1655d4e882286407e01f94ea2a0f902484963a8ecb37449c0f4a7d3d2
SHA512 e4ccd72a8edcc4f8f6a4d2b5c49898c2db3aaafe5199de659a3fb8377a30c045702cc9f5cfcca03c058ce4c37e0ff57dbd3fda513a1744a02c8dd4a30076187f

C:\Users\Admin\AppData\Roaming\PushDismount.mp4v.RYK

MD5 edd1cfc25475618ad2cc328fa6560aec
SHA1 ade36b70923f46f0165c7ac10a0ce2ecb98008dc
SHA256 eeeb3a019a92ddea28d8c7a670f704bb17d618924d02c3831789cd8f168821d4
SHA512 d0f9ce9b5f98d7054e3f5db222fff27290db1e898dc28451f01d3ef9bf402165d9093b4ef1e449a75d15549022d3b6a74ca157f5267b6966a19f14fd79d81694

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-3750544865-3773649541-1858556521-1000\b1588291-eac6-44ef-bc85-c7515db804ef.RYK

MD5 d01f46b5ae246ff2f5b118c36031ebd3
SHA1 328caaa7a136ceedba37aaa30f3a7368e80fe1bf
SHA256 0526a276fcb0e93d6b00d0ed9669b6e01a4a74b2e8822fdafe8a02c3920b5ee9
SHA512 ff541701a4c54f26967cc72d1dd3a3bd0b77fd6d5f24755d13454b357f726e8610c8696bcba7dd31db471801dfeddb0093f12497e49fb2deaf303597179eda01

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3750544865-3773649541-1858556521-1000\0f5007522459c86e95ffcc62f32308f1_3406f593-57ce-4523-be0b-a609f93fe971.RYK

MD5 1dee4eb27d5e5b579e302743cd2da132
SHA1 48ef17fe249899cdf6ff44640c48341e20565de0
SHA256 4e7e44309ddde5be3a18f7ee468bf835d2fe7cbe1c3e8e860d45a17bccce4e4e
SHA512 e1ddcbb7d9d1059e3dcb2a0ac1fda1d8d038ef315ef17c21ef170b7d207f1854c6ed00470f5195ed4464fe7000bd28f6b1bf413ae8242f3de89feec2e9f8eb77

C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol.RYK

MD5 568ae0764c9942a52620fc8af08af02c
SHA1 789d98bfd5612f353d78f689f6e0957ac7aef48f
SHA256 0a132fe988ac62c62edc1ae826120656a07825716d875b89bd2c64a999a055af
SHA512 a5713971ed02bf430f97d34ee116ab45c6df47a85fd90f3b1d8cbb0ed9399b565b954876b846d3cea2ead798c32d1bf664e02de545888bfae28e1a1eae288c37

C:\Users\Admin\AppData\Roaming\ConvertFromWait.dib.RYK

MD5 85f738ac88c0145dca4edad5d6b7e3d8
SHA1 277fe56aa0a54f9ea511e2d89185d6f18641acc8
SHA256 88cff9d44a3910ad45a83f0e849bc47a80909ce01af95deab9ecaf4026cff03b
SHA512 7b1987aa182ae975a1600198683cf19c7462e0bde267af1cf0866110c87dbf0940fcd5f1f8dbe127277139dbfb84872986f58ee4ab998b3a7daf146f8d5c5a8c

C:\Users\Admin\AppData\Roaming\CompleteSave.svgz.RYK

MD5 8e70e53a7ff71c6379ef3e4c13cf7ac8
SHA1 0e867a59c9caba91804208a370e4fc1fc0e00631
SHA256 7e121206be82e1b31f80850da765817a6e34ed62086e39e17a535f8891a0d91c
SHA512 f18818d8c93101851d6b890e57d9bef914a070666e18f733c95100d8011135937b09fdd443bfbcdf5750c0e29ce061b8c29541e97804dc9224ae675139437553

C:\Users\Admin\AppData\Roaming\CheckpointEnable.potx.RYK

MD5 043025ac6dda2717c19656e3d4e5d30a
SHA1 6be2f4b656db282d38effdee874fe44e222de6c3
SHA256 01d2510c0c364dde169eacc46f39a50f3bd45ae6c052a898f54088495ce3d08c
SHA512 55ca8307cf6f1a77d39895a96d623a8b5bc8ce1a8c88b365c7c5db4fb66a0df57d7889d54ea3ba9fd105e81e69541f3941c670d635c0717da0acb3b373ae7e17

C:\Users\Admin\AppData\Roaming\AssertConvert.pot.RYK

MD5 cabc738189aae1fd214488c3fd532827
SHA1 0c18302b7b7edd3340cc774d45747ef1244b8b11
SHA256 120ce101166a0979f0a88de4c30666b604cade065fa3bd03d9e636808fb32ff8
SHA512 423b853a55d108332e215f66edae08575363b1092f4ce01cde06e6f7d5a9f3250bd08dbfd9a189f46c6265bfc4d9c3de35402d538bf8bc99a403fe22fc4da0a7

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents.RYK

MD5 5ca94b6d34582df7ca079d984074aad5
SHA1 155d0d4ce86d159e670a2ee8bc138a67ca081044
SHA256 267e012cbd579445ebb4f9c5649f16c832bf095e5dd839c54b750c929680df28
SHA512 517152e90c0fb05fb101be849b71209f39cc5fb6ba9a39fcda9862d1ed7fc1910d75e9b68ceaa2effd2516cec93512cd20f2fa9c1dc9faf3a63ff727ff34f080

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst.RYK

MD5 5d463cd331becfbe01a2a44295827b41
SHA1 f6cde9e4699e37ee03673bae0588a8a1e2b19da2
SHA256 baf97971b805919f62c33fb1462cfc84b6742fa21c951f05079c1a3dbe7c85d2
SHA512 b9e463fd787e5fd14be7c084568ee0ba545b94696189527a5faa34801f36504f3db8241b576eeb737154d742c117e013ad992ea1b2282698e987e99a9fbf80e7

C:\Users\Admin\AppData\Roaming\ProtectUnpublish.xps.RYK

MD5 09f95b33809f87bb216acc156a757750
SHA1 248c3772022046e9850312fb55f0f73c984c9f20
SHA256 fc0891998b0b2e77df2ac76c8535764beabf1d5fac7cbe37da9ab233f2bb0f03
SHA512 ea0bfdda7379ee5b1c9cc30fe1d154593fc40aa4c33831fd9bc4ca2e02fcaa90f374cbc3328d7383e444739dcc554f61796d6bbd169a4821b1c06e0e4cb2e976

C:\Users\Admin\Documents\Recently.docx.RYK

MD5 666c8b17f7a5c222ba1583d2a0719f82
SHA1 e653a2f72c6d38bb9ad1b77a37647634efaaf01d
SHA256 a35110bbbc57d3f82c6bcb8a1ae0886cccf8a2bd622d34eeb5842571c837eeb0
SHA512 b87cc55e54e793bfb947a3de2e6b9781603ca1e3f8e8c8026a95269e59e62bb7958d630b58f6a2b1558094660b6ef9fca52b539a500a8b754474e9071ed802fa

C:\Users\Admin\Documents\Opened.docx.RYK

MD5 ae203fb06e9c646ac3fced2742a0edcd
SHA1 7be648638e0386dbfa83dc5b9ca6da4c6dd37d71
SHA256 1516f677449c951960fb02800c15c804e5117c3e9f4b6723300974fa37949939
SHA512 b2e46374d9dae4d0c0aa8a011f71b0e25e78ddf75d1c91df919ee235fb2994383f848daf6b400a611d121b56be9425c07274f77458c526367561e0b96987c278

C:\Users\Admin\Documents\These.docx.RYK

MD5 47d9cd43112d0d0ac72d92388303eb14
SHA1 ce49b57b6d283474f4cb0f829857950bde249fe3
SHA256 2cc7203ce6fdd81388125ee5535ed18e8d3f2105d7e7a26d197d01d0af569646
SHA512 e6b5d629192468719f912333aa4365edc1227abbc738e4a114d1443a79dbdcbdf9b8aa409426623a8adf68fd656f322dd70f4a0544f6c63a0aaed20ac3d9d906

C:\Users\Admin\Documents\SkipGet.vstm.RYK

MD5 ea2daf1ed8bfdec7a1184787316ca36d
SHA1 dbdb65811ddbc641902328fe774c1a4d6915c2a9
SHA256 8102e204500337d7708f269e64fc5ba10fdc75fc3168935365e428f803657f85
SHA512 cb1de5ff34ef1bfd291786b913689996bc601f1ea34688a0678c7bf5f5e9878031ac038f93c21b5e0f37036c457a4cb58bab043c3468224cb48be1604d8f3964

C:\Users\Admin\Documents\UninstallCheckpoint.mhtml.RYK

MD5 1fd9b6337cc6f53c6c46cde681146b98
SHA1 8e73c5d31ef7192a53ad4f26159f8bed68e6c39d
SHA256 93d6877b6ad5a0e0ba2901b507afe13f5a370e5d6ce1bc902e935381e34d1e20
SHA512 a869c15d3d85428ff32bbc4db34b53617510b36104f4484b3740831621c543004142a836389ce9cfe9d1fcc51fd981a058f2870af30a528e26b8bcaf56e43d02

C:\Users\Admin\Documents\UnregisterMount.ppt.RYK

MD5 b2366052f056b32b5595774cbeb9fd64
SHA1 2b4fba56e6e8564b63992d9420106aabf45ebc3f
SHA256 7f0800d5642115c62131dd9d35c89f688af85cbfade90a6eb3861ceea15b7407
SHA512 aeb84ea360949900c33f46815d42014028bb98591df5ace2f9de1580c28b51237be1a34ddd2469e5a29ad51ca7ad0012afa23500d399d0387792378b8727d4e7

C:\Users\Admin\Documents\GroupResolve.mpp.RYK

MD5 36b4764fc504bd931099220b6a000f72
SHA1 ea03deec30a036acf2ecab2d40b16cf4c41bf708
SHA256 583c6db5afead50c3e560ab860af18052c11eb24a24ff40a1434e812df83787f
SHA512 aa4e1eb42ecc6cd0311807b8042b6536e04ec0b2fdadd39398aaebcd774a17daf87cdac7a47f48012ea87491034b8e38e4654521de587737772e7a36e24678e1

C:\Users\Admin\Documents\FormatUnregister.txt.RYK

MD5 9b9b933980aae0acc817067513a77280
SHA1 fb51aff1539e70d107a19a0a7fa446f6902a55bc
SHA256 a686cc423732b4bf21e3fa702c28a00c4f44448eba2586afd7b078dcfdb4ebfe
SHA512 8ebf76e39382e2935d3c35a4b9b1c3f8c7d5f9d6248ab27189659cb08077ea52b59bb071cdf782f3c543d216e56ba39bf2082641f1032fa6e17962bd9cfd9803

C:\Users\Admin\Documents\ExpandSubmit.vsdm.RYK

MD5 18831db2ef5e21e1ab98d780ccaea396
SHA1 aee37a002595d660ceeff1bd8e3958b8fd54b2f4
SHA256 4f31b072ad2bd7dd3dc47aa096bc98b2e50d65b529d9b79e378fe8c516cb1089
SHA512 c42c83da3f85ab7dbc5fa45165f56d86f35b07ad20a5701652767f347905a52f5160e4656ca8c7762e74ae387c015784af5f1617f997bfcff12de20db5d2b334

C:\Users\Admin\Documents\ClearSplit.html.RYK

MD5 f4b715c27dd9eead2c24f76cf7cac195
SHA1 02516f99d011d3a2281b1bb77d5a6cf55deb776c
SHA256 d562fcb763d831d907f6710a659d6b3d7fc7575b9bef1674426bfa71cd2b461d
SHA512 27b9033384090bd18f419c058f77b9bdc9279c80083a78fc4d66f6b36d8d8f1e87f98c1a882bbb8893a21e9802da4ab5629279874d0446693d18920c23c0f81f

C:\Users\Admin\Documents\EnableDeny.pptx.RYK

MD5 59994242bd8fe35c9cffed536f16a894
SHA1 68c9c1d4f1ea3f04297ed5fe795b0e8ea63f4037
SHA256 cdd376eca21df39472a1e382d03d641b6f97ed982791032f2bbf301a372ec501
SHA512 4fa4f20c73bad54d479eff7d4f6a59ade3f8bbef0fdffd4823ba2b99dd35355d7d651d5131b07d81d51849325169857b4ea436495df9e3e22635255a7b2303d0

C:\Users\Admin\Documents\PushWrite.pub.RYK

MD5 32dc9c92b07dd39209e087a25dd06f9e
SHA1 2e65947093831ba6715f7b1002802b5cb3ae07ae
SHA256 14a4f164f5d8f013e153d0a4f1fe820781608363d7b0f9e7959e56ba63df4788
SHA512 3ec71a933c6594637bb226c14b4419227bd62788eca3a7e9f87191218baddda013b68d885123ea143ef2de417878732aad771defddbf9f65025daefec00ee82c

C:\Users\Admin\Documents\ShowResolve.vsx.RYK

MD5 9eaad211ac4556eb512d46529861fcfd
SHA1 154aadd54e7770a35ac31cc9b29f1943750e2e75
SHA256 85c0d22d5afc76a0f1533c9fcfb780089e599062aec6adba84fa2d6fc2b17c17
SHA512 e66d2c7b418fdbbdd4933f348e3f00ae3d73ee7d8b58d8c9685df26e701b464808a6e3e8e36793c61d5b223f3fee175243c159888fe2ce914352b79c48e89c02

C:\Users\Admin\Documents\SkipStop.pdf.RYK

MD5 e92cf84708ac6b3ec08f1010e50a9dc1
SHA1 424bfa6414a1e6dac28d3c67f8c63c0195f4a15f
SHA256 259e760abd625c174a60c3e6b886b953a149d4d2e12f6395e3b7a74cd9337500
SHA512 a9b88de911a7b0d5113b96b4c61564ce2638a1f67a554be78c0e054724cdfe0674b5c6a197ac975fec4f937086ae84e8efae5f26223ee3bbdd59f2d1c9f3aa16

C:\Users\Admin\Documents\UnlockJoin.mht.RYK

MD5 051f733c30de5d7ac96f049bf9dd2f24
SHA1 f6f48ab63a6d47cb8a104428c8307d3140282a52
SHA256 0f3a2cd9ad72950f378dae6dd8015dfb50269843c65aca298fad4793e674de7b
SHA512 3e907ec541a4fc34283bc4e5a3fc7d78368a40f9c68f4d18e23253c883a2638a33ce181731c096ac795621bc7344eae3695ee89036ba4991ef1896dfc20b42ad

C:\Users\Admin\Documents\UnblockSend.vdx.RYK

MD5 af02003996856c902be76e3c8dd2c5df
SHA1 7c39ee8da2d931a765ac4b4053b2a69fcc7bafc0
SHA256 1c6c7105235ee17e3ed8e83e166219c63db254d16171c7a2ce8dc52b9b69f200
SHA512 de7be2d581254718061d32087d75fa1fce6319311b30edb69bfdeaee16ae6ee8792912f27801e907054cd3998cd38d377a408ce23c144305681ced61b4de1fee

C:\Users\Admin\Documents\AssertSplit.pdf.RYK

MD5 5531e4a0643c2f75f25d76680b0038b4
SHA1 1b1896af056e9f57f9827cb2c2c4ce10e1432d98
SHA256 12e5b606b93c81a00a8aca3deff42e911a61529f8bc76199610cda3cc3570bcf
SHA512 aad77adba081c4ac3a0812f84c7e938bd99f430b5829ca986bc9b81bc61db17e65e1f0a6676bc9d86625b8278c1be224da40aa19904f3c599397a79495369983

C:\Users\Default\NTUSER.DAT.LOG1.RYK

MD5 cba179d98357bc434db04357f4a6d889
SHA1 803cce28d83ac8d413acd9efcb372c53e655c29b
SHA256 08125c6b9bb40c234c7cfca0603f54889b17f85461e58f39a5d056299734fa43
SHA512 2fba137db4b714ae208deccb1123ce31101299c0d7392b178d0e74d023ec46208bac4e30f13bcc24f12ffae73d0006a7327252831dd2e5e98387db92bccbe2e9

C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.RYK

MD5 c2b0ee44ddc007abfd8eb6bbba44f679
SHA1 d26da55f25751ad7c198d80a226744cabdb35d1c
SHA256 6791791ee609ecac5d69f8954a4dea78e78916a82242cc0c17d0300345eccc67
SHA512 b6218157b38495aeaffce45f591724d7738d8bb8a7c2c6927e7c757aaa974dd594b8fe6a9f0732085e238c1fa7b5b43c5dbbee89dcfedd5626e3c40eca5d5578

C:\Users\Default\NTUSER.DAT.RYK

MD5 73774b437d1b025646e5cd3255a13e55
SHA1 918be7f3d5794fd4767f24aa1735273ba54af410
SHA256 b02fca067a012e9e550b57aa43dbb087ca5862bab870bd21f6526ab36179421f
SHA512 f3bf314032a12efeb617faca3c45d0baa4ad82912905cca974392b72e3833e9bbdf8c0dd4055b13348eb3798cff15c0e2c88ee67ca97e40969f5b8168894d73f

C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.RYK

MD5 c5a6f822cbc54183835b8c11437780bf
SHA1 674564fd1b650298fac2e1b66404b74285f775e6
SHA256 93138be38f235baf74b2c7dc8768333fc1d19f10fd0f5749062a3c3508922507
SHA512 12ebd3e11615c2e688656bc0fc461ad755f7259781c6b2917bbc618ebbaf169ef911dfc69d1284749fbd6737ecfa4cc6360bac97b79e20ede36f69d25ef1c842

C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.RYK

MD5 454c950046bee05514fbfeef262d96dd
SHA1 e00252633030b2eeb6860b6772d1db6a2e31a5f3
SHA256 81fba37ea788da954ed9c777cd0294bbccd078ea1bd7f4aed44dd3d911464884
SHA512 c4814fecc04a19ad9af7e0f49e524adf95af3d83e3058752149081608c42b261495c09066cbaea6f0f0ed47960e1f22ed9cd52ccfcd9ea52b7a94e8819dcffda

C:\Users\Default\NTUSER.DAT.LOG.RYK

MD5 d53cca0fd3e51ba1da8fc228203afc5b
SHA1 d5c3cf7f0bc3474ef6a53d486600bfa3c3767be2
SHA256 9abc48a3d3742d947042ad677f3671ce95ca0829bbf5e1936110702bee3de3ac
SHA512 e5be6625f5fded1e10ef9720405eed4a58607f9c4d635d090e37ed5a21cddb6078760a1e10676ac9e85a5ea6f49a561179343d1f70f1ebb32df818f40a9c8a9d

Analysis: behavioral2

Detonation Overview

Submitted

2023-09-25 10:18

Reported

2023-09-25 10:21

Platform

win10v2004-20230915-en

Max time kernel

8s

Max time network

9s

Command Line

sihost.exe

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4764 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\system32\sihost.exe
PID 4764 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 4764 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 4764 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 4764 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\System32\net.exe
PID 2348 wrote to memory of 2620 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2348 wrote to memory of 2620 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 336 wrote to memory of 1652 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 336 wrote to memory of 1652 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 4764 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\system32\svchost.exe
PID 4764 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\system32\taskhostw.exe
PID 4764 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\system32\svchost.exe
PID 4764 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe C:\Windows\system32\DllHost.exe

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe

"C:\Users\Admin\AppData\Local\Temp\Sample_5d283d656ea1e5165f2c7b8c.exe"

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

Network

Country Destination Domain Proto
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp

Files

memory/2748-0-0x00007FF7B1410000-0x00007FF7B16EA000-memory.dmp

memory/2748-1-0x00007FF7B1410000-0x00007FF7B16EA000-memory.dmp