Description	Indicator	Process	Target
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALNDR98.POC	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\logo.png	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\PREVIEW.GIF	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14983_.GIF	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.IE.XML	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_rest.png	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14868_.GIF	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR30F.GIF	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\settings.html	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME41.CSS	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Trek.xml	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR28F.GIF	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-last-quarter.png	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)redStateIcon.png	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Adelaide	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Apia	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kk\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02567J.JPG	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Jamaica	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_play.png	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143754.GIF	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR49F.GIF	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageMask.bmp	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\fr-FR\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Blanc-Sablon	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityMergeFax.Dotx	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLTASK.FAE	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7EN.dub	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\ext\jaccess.jar	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107148.WMF	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR_F_COL.HXK	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_bkg.png	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\PREVIEW.GIF	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0302953.JPG	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\THMBNAIL.PNG	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN01165_.WMF	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10264_.GIF	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\skin.dtd	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\Wks9Pxy.cnv	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\RyukReadMe.html	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider_left.png	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\row_over.png	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ViewHeaderPreview.jpg	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\SEAMARBL.HTM	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Danmarkshavn	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
N/A	N/A	C:\Windows\system32\taskhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
N/A	N/A	C:\Windows\system32\taskhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
N/A	N/A	C:\Windows\system32\taskhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\taskhost.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2184 wrote to memory of 3036	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 2184 wrote to memory of 3036	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 2184 wrote to memory of 3036	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 2184 wrote to memory of 1100	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\system32\taskhost.exe
PID 2184 wrote to memory of 2616	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 2184 wrote to memory of 2616	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 2184 wrote to memory of 2616	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 3036 wrote to memory of 2684	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 3036 wrote to memory of 2684	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 3036 wrote to memory of 2684	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 2184 wrote to memory of 1156	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\system32\Dwm.exe
PID 2616 wrote to memory of 2672	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 2616 wrote to memory of 2672	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 2616 wrote to memory of 2672	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 1100 wrote to memory of 2980	N/A	C:\Windows\system32\taskhost.exe	C:\Windows\System32\net.exe
PID 1100 wrote to memory of 2980	N/A	C:\Windows\system32\taskhost.exe	C:\Windows\System32\net.exe
PID 1100 wrote to memory of 2980	N/A	C:\Windows\system32\taskhost.exe	C:\Windows\System32\net.exe
PID 2980 wrote to memory of 304	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 2980 wrote to memory of 304	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 2980 wrote to memory of 304	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 2184 wrote to memory of 2336	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 2184 wrote to memory of 2336	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 2184 wrote to memory of 2336	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 2336 wrote to memory of 988	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 2336 wrote to memory of 988	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 2336 wrote to memory of 988	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 2184 wrote to memory of 24568	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 2184 wrote to memory of 24568	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 2184 wrote to memory of 24568	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 24568 wrote to memory of 23740	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 24568 wrote to memory of 23740	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 24568 wrote to memory of 23740	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 1100 wrote to memory of 29528	N/A	C:\Windows\system32\taskhost.exe	C:\Windows\System32\net.exe
PID 1100 wrote to memory of 29528	N/A	C:\Windows\system32\taskhost.exe	C:\Windows\System32\net.exe
PID 1100 wrote to memory of 29528	N/A	C:\Windows\system32\taskhost.exe	C:\Windows\System32\net.exe
PID 29528 wrote to memory of 29512	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 29528 wrote to memory of 29512	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 29528 wrote to memory of 29512	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 2184 wrote to memory of 29660	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 2184 wrote to memory of 29660	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 2184 wrote to memory of 29660	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 29660 wrote to memory of 28372	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 29660 wrote to memory of 28372	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 29660 wrote to memory of 28372	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 2184 wrote to memory of 55704	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 2184 wrote to memory of 55704	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 2184 wrote to memory of 55704	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 55704 wrote to memory of 55728	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 55704 wrote to memory of 55728	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 55704 wrote to memory of 55728	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 1100 wrote to memory of 59204	N/A	C:\Windows\system32\taskhost.exe	C:\Windows\System32\net.exe
PID 1100 wrote to memory of 59204	N/A	C:\Windows\system32\taskhost.exe	C:\Windows\System32\net.exe
PID 1100 wrote to memory of 59204	N/A	C:\Windows\system32\taskhost.exe	C:\Windows\System32\net.exe
PID 59204 wrote to memory of 58972	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 59204 wrote to memory of 58972	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 59204 wrote to memory of 58972	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 2184 wrote to memory of 59404	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 2184 wrote to memory of 59404	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 2184 wrote to memory of 59404	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 59404 wrote to memory of 59908	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 59404 wrote to memory of 59908	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 59404 wrote to memory of 59908	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe

Processes

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Users\Admin\AppData\Local\Temp\tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp.exe"

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

Network

N/A

Files

memory/1100-0-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-2-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-3-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-8-0x000000013FB80000-0x000000013FE59000-memory.dmp

F:\$RECYCLE.BIN\RyukReadMe.html

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3406f593-57ce-4523-be0b-a609f93fe971

MD5	93a5aadeec082ffc1bca5aa27af70f52
SHA1	47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256	a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512	df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

memory/1100-23-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-28-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-33-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-36-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-40-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-52-0x000000013FB80000-0x000000013FE59000-memory.dmp

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst.RYK

MD5	f735779db9a9decfbc245c128f052f9a
SHA1	00e950efdf40d07c24ee3652a85b1fe54a9240e6
SHA256	619d1c2c1dc6d56dee51ae5adef853f1d9b6652420383fc3e32b7c93959583d4
SHA512	4928b629f70c062c1e874e693815714be45c556d96e66dcc75d55acc123f963685f0636ba2ea399d9dbb58e6ef62ec8ef9bf81b56a77c6c8248c0783fa7d323e

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\RyukReadMe.html

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\RyukReadMe.html

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\RyukReadMe.html

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\RyukReadMe.html

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\RyukReadMe.html

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

C:\Documents and Settings\Admin\AppData\Local\Adobe\RyukReadMe.html

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

C:\Documents and Settings\Admin\AppData\Local\RyukReadMe.html

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

C:\Documents and Settings\Admin\AppData\RyukReadMe.html

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

C:\Documents and Settings\Admin\RyukReadMe.html

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

C:\Documents and Settings\RyukReadMe.html

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

C:\RyukReadMe.html

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

memory/1100-49-0x000000013FB80000-0x000000013FE59000-memory.dmp

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.RYK

MD5	86ab277f59699070b847f7324475dd80
SHA1	f85356267b912061bd87bc1fc16343874b806b95
SHA256	4edf65b81667203cc855c64a5b1f20da40dc208cab8a22a110cfc850d9562545
SHA512	f75d15d77590d0154e39167879b6a1599f241e07ecf0f3988c4e929d287dc01a6476b709fe698781bc8c40fc102ded97b9bd090ad571018a5bb28419ea090c81

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\ACECache10.lst.RYK

MD5	8fda9c276d5dfce9f5b464a563cc2a63
SHA1	9376f0f2bd60034fdadcf629d6cab92f706d91c7
SHA256	5ffbc3139381e3532a1b7bc8021ff7bb9c4a6e5d4db9aedfa75425a230652e8a
SHA512	773833d82902b1f52ee0718c99be814496df18ccadd31315c6ba0cb71a66e047d3a66d13108125eda815b48a24b33d2f3d6782aea154d98c3799b2298c0bd126

memory/1100-57-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-76-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-84-0x000000013FB80000-0x000000013FE59000-memory.dmp

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK

MD5	13e411791ddff6313c36488a8c4de8df
SHA1	637c860a6400fcac7272e07bda39856004eb15c2
SHA256	47297d7d5a2877e03d97b276b71d54c81f2124c3479556f2e3757d266fa4dcae
SHA512	25318c6889d348c6a8751e5705b22e84a6492d2440fd6d34e4a0d1744e40b64125e6ad0b987f49f779634eee121a326438ac0f374b4696eb25b38e9cb0050246

memory/1100-85-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-119-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-87-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-124-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-123-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-121-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-127-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-126-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-88-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-140-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-139-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-145-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-146-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-154-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-143-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-136-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-134-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-182-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-196-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-226-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-232-0x000000013FB80000-0x000000013FE59000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ASPNETSetup_00001.log

MD5	af715b2caed258d7abbe9f98bd317b32
SHA1	5c1363746685d868c67ceffffcd7a4b44d5dc297
SHA256	aeb58075223bef0ecd425bbf05be7b02b07b0463ed4c033f8c2bed06f34eb4ee
SHA512	1082666c6931ce8fe099e11ba24d4bdbe94d340f2cfc06467cbfde74b02e77b8f2cafefa124950d423c297f67811bd04669da7d129039b8c96f6a3c77f954bc1

C:\Users\Admin\AppData\Local\Temp\java_install_reg.log

MD5	9027bfd9c730c7c975a58198cfc707e4
SHA1	e3e72b89c1423663d0501c237b0bc3a28f21b732
SHA256	d76032ffd128c7a2f32e6563cf60d80416f03f2aa538a9affd9919d3bbb556bd
SHA512	c8865d516f11c8739204447f3308817599cf8c42b5dd795ff5512f6780c841e47666c72c1ba405a4531d8e21402fec5041e88edcf3bd5082a9e8a92fb4679841

C:\Users\Admin\AppData\Local\Temp\ASPNETSetup_00000.log

MD5	4397dc47e0d45107629203e1e9d17788
SHA1	a6aa714252c81f9f6f93439139a8cf45f68dce20
SHA256	3890cc4e87f660e9afe165aed0adfca92a15ada98357f739eb1884aceb3109b7
SHA512	47dd41667265abc7103fd8a841f16a07539e881328b7148eed952d4aca93e389bff5a50f22326f8cd76f6b1ae184a061e861ed33dad5601820664ba571a6d13e

C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

MD5	411e54e9895a70331b98547474c1cb4f
SHA1	1c0f0d68886361ab3647b2e37f937805321caa74
SHA256	490743d83b753d1a27ea7cf20286f9b7c7055dcd39b54071d7e19427bfafe3b9
SHA512	7126abf280953c614710ba4344605c077b89b90f3658eb21cbeab02e86247e1c1ae21250acb1816e2d8265cdc463b2a6fbbd29ae8d04e5d25d990c1c12cea865

C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI1A08.txt

MD5	24da6d2ceff4ce990cb4890d7ebc1902
SHA1	34eee47e97e599a932ea0bb361e181fbe14ebbec
SHA256	4a07ae2926bfd6b27d7ae319e9bea2be2c8b4a8dbdf467f12f1a9c546a610bd9
SHA512	e4a0cdb710d119c0c3adaa61de87173739897c966dce5d8cc425125dc467a57a508d9b079d5f5e17efc838e43a8ca0e81d8cdf768a1757810862f977d5ad54df

memory/1100-225-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-224-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-195-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-194-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-318-0x000000013FB80000-0x000000013FE59000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility.txt

MD5	19f6f534b087dedd1ee7d9a701adc4ef
SHA1	bb3753972cc04536b0dd48341581defb3e072d53
SHA256	a90515e6a98607e3e4ac451e6a8e5160e17b0f0b6f2b5955a8bb20b9bc1a5935
SHA512	61870a3ad8672a392f1fbc433e58ce254649b62473d1920a5f509185034988d9841202e34a97c2ed6fa1b0ecf98ac43c690eb849088b5ff425410c0f34913e35

C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI1A5C.txt

MD5	22759149f5ced964ed4710256c1d6f22
SHA1	3f8ec2886d910a4075794f7e6aa8533b2c4218e6
SHA256	d498b5e0b06b4e3c94362e658f8c3fbab919d721dcbbad755eee0c79ef4dc3f0
SHA512	d9ca051ce71f486b01904e2773c6836ecd7899e5a6707ccace748c9fd92396d538d9fe6fd559f29f2ae9d348780c2b6f898b185c622994740f1e065dbe7d7260

memory/1100-317-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-327-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1100-324-0x000000013FB80000-0x000000013FE59000-memory.dmp

memory/1156-358-0x000000013FB80000-0x000000013FE59000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Graph.emf

MD5	0e7c26f7edcc16f8af0e9b6d86443ffa
SHA1	1db0f0269368365d0a53d08aa49af8702c7803b0
SHA256	e1ffbab6cb2fe2ee8ab5b08b07ef3f599e779e7d05b2e37476b09c984860fe89
SHA512	f4b18128aab4b82a5ee97b442e751d370fc78328073c4286495733a20df4e72b6ba02507a9ebaa5f9142831dba19dafde69d7b9876324e1844cb4cabe41a465c

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Monet.jpg

MD5	204a86c11bab6cb4a3d53787b97f84fe
SHA1	2740e14dff4dd6190325faf743582371b4b48432
SHA256	66df8493f212ff2ceed37aab055fc960e12928b7d1e46825523638839363f322
SHA512	d9b83e48ee47ea9ddd19f21e3d2244da8a6220a28674a1792dc9c04d80168a1804eefcd7f285827bf301a248501a2e337a786d96c966e54d1c2ef32683ab1875

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Music.emf

MD5	18aee53f784b4e749fe69423b5d5e44c
SHA1	2acf78cf0c6c5c2ab2438595777f5de3dfa909e3
SHA256	90568d1fe3b7269874fc8eb4f19e627fd2fdc6b5bb8c60c9d6a42e7bfc55056d
SHA512	cb2bc1646ee5a8c5507c5c02739d125185298a92f9facf64e60a82263831a38a0dcf67cf2d51d40b4cfb11064a345b4af2952051b5574f2f9d8f8dfb9b838bf8

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg

MD5	10a4ca62e49e7dbd2e07efa91a083d55
SHA1	814723b77634f054e7ffaa6820e2fa9e2d9df396
SHA256	d6bb1624d432a3a61d6776d8cb87dfb3b51cc135cab731408448dff4af31a12e
SHA512	7fd43f89949f009dd1ec309237c183c00ada575ccb71eb599bd537abf8f1199057b1599d5f990566565e9c4f989cc89a428159bb9eeb996be87a12b195b8de84

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Seyes.emf

MD5	bf57203555221377a14082190b3a1717
SHA1	9ff41e52f0c1f2527c660186be357414d3935575
SHA256	670d79424fbfa3a85b683ef7ce017475c3aebcc5d674c259c40d0af643784be8
SHA512	db3c435d7980b4c017a85036be0c9d333e58092e143085978588327a26824c9011c59d9fd57ba74a59003fe3a1738c9dae1cdeab4da02cc45cea5c5a1b4cb919

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg

MD5	e7cd2e914ca45ac4bb82c71542fce0d3
SHA1	4f7f1f9e2cd57fdd6840c3b376f84ae2ee878bd6
SHA256	8199016153668686ead4592cde9213d4c2566fa6b26af347d31db3287e2d655e
SHA512	d6deb99f8575fb3d17ee950dd1ecbe14efc5fde0a9e028c06c64ecdf3052f9b26aeb43415de77265935391e8da4a1603306017eb2f944c05e8f48d386434f926

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg

MD5	afe06f19211a2e7c66d9d167fcc36150
SHA1	d88079e0a18f75d1197e34d20db7b52b35d9b7c8
SHA256	2b34d5d2e006b1f5af47f7157d7276559ba450de5ef3ec3b6ac4b5e39330c6af
SHA512	9d7609227fd9779a68c37eec43f00f77d77b7880b4788e6bc2070656c84d9882fa6e93ba544c0cf6ce86ea231f4b256f9c4c43865f8865d9423057e8e411ce90

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Memo.emf

MD5	d903a07f077412cee6d9898f093239c0
SHA1	001580c57dba6c863f2906a52be5fbc9da2d3059
SHA256	c43497828ada3de9f5d0e3b6517c9d785d2ebceb244fc12490087dfcd5880b9c
SHA512	8cc0cac0e09d613ce772a43021bfcb7de3d42bc81eea19d952190a7d5bc7da4c2395a05a652eccf7a5fb3ee485b25de91974a096b59b927bf22bd998948dba20

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.htm

MD5	f27ddcc85bef3782cfa7d03521a5db85
SHA1	a9f49160731a179e7ed76fa4ff9b0481602bedda
SHA256	3d96c0a28b96e02af71c724be6b63c8a8ac6bf8af8ebac67ea016db88b2f93f6
SHA512	ce5c3227b09165affe8d9b414608f47b5204f7807fbab1cb4ce38a645a19786f6033dabd0e919c58685efc394e484e449ba03208292bcb4cdb7a7d336170ed5f

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.htm

MD5	b2bd1d5f828946ea70d76272171f7256
SHA1	bdec1f76b400f60cd96b72ce7796722303b71aa0
SHA256	083863969f3025ae42f203f79266d57647a930769d7aef65088d29969f516378
SHA512	e39ee0f6548ab627fcd6c8df9b780e847de4201143c7514e1dbcbb8a770a8143805d9e073825f4ab3213bd82acdcbb42fc8bad87b21ad42b48ff9c741a1585f4

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Tiki.gif

MD5	3409d71c82deedb1c0185c5f666b27d5
SHA1	aadabbc599fed47d8b8ac8566719e71a7fd637c5
SHA256	2a9aeb7eab28cfc098fa76ec983657e21d40b6e4419a66eb9134931c0b0d3cf7
SHA512	77e1c62db7e49bc04c7a6963ce9fc30d65fc4283cf1e49b731119d601a039b7a182f0a58db21ee1f8c39ece0ed665cbf3d522fba48b86403b86835a48f5a0442

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.htm

MD5	6f2cbeb07b9eef9de1d0cfb4aaffd135
SHA1	92a8a1af80e8c59a82b190e76e96cda795a391d0
SHA256	b2350899d72cb38b4f48b3d87619842062285702b6c2364d37af577cb6076f1c
SHA512	6bccf1b779fa983158d830d745c6bbb15cfe568a898a284e59835d0f1fcc70525b0874ccbfeb8b245bc0ba51ec0b52c67cb8f3f369121a031e67c9ecbac5f538

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edbres00002.jrs.RYK

MD5	9c22df4b383723d5d5b5cb261eb1918c
SHA1	4925a657ad19cae426dd60fc7f272c42043857d4
SHA256	8e521244371232553402a2c83f0ffa34a19c3f9650607a4365ad513ad5cfbb50
SHA512	c15a9e9e7639824587d2155446393687b4e0ec3db467e084dc931d15af908a250d31cf261d3c6c9c1a8ec6f775ce6546cbf02e697d3fc4d0f0e84ded86efdca7

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb00001.log.RYK

MD5	295d58decf8dd9dc3e340cae3aa85da0
SHA1	8e77fcb5bd2fd3337e35e9c300b8ccebdd8ba7b1
SHA256	027b003bdec1cc4098d3a1e44d322fa3acea19943aefb7c9812d0350f8f43d30
SHA512	a97b8d68b0bf9ec572589cd71ca1685af9de6164b9e780a2f654fbab5476dedbbf9c27c927fbbed11e961b6e964fd6c6962b9bb2f61282369bc2900de09ae86b

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.chk.RYK

MD5	d8be85ba89a828bc9202aa0a91fa3cb8
SHA1	26532a3f4b7cada915619e5aae568b2356a86299
SHA256	56ab4cbafaa8f8819f01f067f8cc81f691b8271e1c166941f44bf6e5b8c2712e
SHA512	fe04c926bf288ba20378ada52e45529eaa42f023949a59ffd920843edf92c6000d1cbea50d157e92045f33c8248956448afe1415b6f7f9744a90107eb202d5fc

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.MSMessageStore

MD5	449a15aa9ab2d45c4b8322a95060d443
SHA1	2eb2e55c6d0e534fb3eb49e0c299260fe458af40
SHA256	6196ebd869e3bb7cf24f152c580444188efea0f7fac5d18f6e39b2f477f75a10
SHA512	06f104702f47c31ee7a4f8ba2e41df8565dfc562bda1e6c89a533b3e871a984331d42b5052bf765f480a1c67501f747cb98c1d66c5c13820471457aaae2e9433

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.RYK

MD5	a0b610d1f79c6275d7732bb57428c52d
SHA1	9741aef82227ce2eef4990942002d5cbd574ae01
SHA256	c670db9ef3a8e98f3e805067abd47b1ff19809aa3fb7b5237c05902b28f22164
SHA512	e63b16924d6779e8afc540963a4f9e19186767e9442fcfc1c5f4543cc0f93743458163fe417c6a777df3aad58b93fd89560bb6048bebc86a1d1643ece20448ef

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms

MD5	754826da970721958a3060825198fb2f
SHA1	8c9d25996f49e5ebf3fe8a0490a9608ddfe9558e
SHA256	f1ccbba2ef5e9fa523acc5b42b1473baa3a8638be096f3362363aad5d1e5cdc2
SHA512	39a638cb01685f6d7827843d1646be5bcee07beb79ddb219dc8f630accd57d1f21e636da4b6d5bf7ae5b40e4bd5502e315813872606ebc426806a244bc4fe21b

C:\Users\Admin\AppData\Local\Temp\wmsetup.log.RYK

MD5	054c668fc52b75941f98d72125966cb3
SHA1	9b4d5a4990ae7747b9d685ff075d30b9f0237686
SHA256	591bd5a88cbba5d72ab0c2bfe49dbf6e998a5d863dd933d432b4cee99cc4c7dc
SHA512	ba44c2c51928ba9af9ecdaf1d04ed870b94d917db90f0c4f004f46f2758d8cce81d20e26315db9122bfc7913fd7226787120984268ec174b0a1447c14211106d

C:\Users\Admin\AppData\Local\Temp\RGIA7C5.tmp.RYK

MD5	9eb50b521a54e80b1a25c7cb324cf147
SHA1	bb3ef4ed9c9fc41b05118ac54aa5c3ecc7e18136
SHA256	1ebe1e230677854f3b8d7203f7354dee1cc6db31ddb189faeb8b5e8391ef5bd4
SHA512	351b74e75e8d5706c3ab949539595cffafbd3b4c2ee00e18072fc729e280d98c2969af1088c1e3b1e74a06fcb8a29758a451eec141931d6a7652b8790ef67a96

C:\Users\Admin\AppData\Local\Temp\jusched.log.RYK

MD5	34e36ca4c419ad08dd09cd855400c0cd
SHA1	463b5fb52a5a72f2069fe70156159a775f2299f3
SHA256	233acd3261920fa2d4d54473a966f0a42460122c2ac559746593476ec2fecabd
SHA512	c7b05caff566c57645ded9f214839a131f0ab504336d88265f0b88360b06f6b689f95c9e371e282b5942c7f782fd263cc743a1df911880760235cb658bee59a2

C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log.RYK

MD5	9144c47fbf5a79150d35d67517182cac
SHA1	005b330759bc9790a878288a065f1cf5477492a0
SHA256	7fb99d67960d86e53a41831e05e040e525e9b418a222e12915a07fcf7d6e6157
SHA512	559825f2966d3ce640a7bb5442689778396da585a80bc5456d209364139153084424a1477f0dd4a111d406a5efee072b8f081021df1803b44318896e6ddcea60

C:\Users\Admin\AppData\Local\Temp\dd_wcf_CA_smci_20230831_223512_435.txt.RYK.RYK

MD5	bfc5558374207dfd89b524b3ceebaaf9
SHA1	5c7c0abdfb913ee20acdf25df16b2208418be541
SHA256	267a279270abd3377053cfa475b42c6d03532398d54ff4b312dfeee800f550f9
SHA512	42fedc7479cecef4a469aec8cab2dd142ceecaa6bfa9e833942a6c9b5ff28c64d83257a61c91afa05ec7a494d21eac0dace3e116d5a46ba7d6982a4142c6888a

C:\Users\Admin\AppData\Local\Temp\Admin.bmp.RYK

MD5	4b649f6ce80914bd6a8931428cf2e594
SHA1	6b8b90a380cf6a9e5b7185e3f981672b38874512
SHA256	c22108974904980604067432451934af10ac9aec86f553be06e3b4b30d236df2
SHA512	3712878cc4326282b0607cba3c63d590d6902bcb36f81678827a8a155d5262eeb2f3010c0cb338af079439156d30bd0e0e68f46ff5a2d8431b4ab6587a3180a2

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.RYK.RYK

MD5	a7259f7453fbd5d3997990036bd52c91
SHA1	0db2808894d3bf8ee24af43c366b73e44716c6dc
SHA256	0794437ab18f22abe1357b7fa044067a8e96780664279cd65fa2a32bce9015ae
SHA512	56632f3900dc6949f649b2a5e1c247e047293e20f21ad93a0d3cdc51a85aae71fbedb062c6640de68b808edd51ab3f7fded56df9692ac7c99b0b0d5c66ed2967

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.bak.RYK

MD5	c31393a0472393453ccd7e947912a805
SHA1	73c7794dda6708e4911df2b533f00ae8122f370b
SHA256	44a6bf1992995b6864aaa8be6971533b7328c0be67a8f0669818845882c5a075
SHA512	13b4ae2203a77500a49981d8844fdc79695e135d49073c5b7aaf758f990c15ff686a1abec66598f139c7b9107c9bd35e69629529bff2ec8007e57199c763784e

C:\Users\Admin\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK

MD5	dc98024e659902722c58596c7cd8f6c2
SHA1	9d9e43ba03ac87387a17a0c22a4279dbe75011da
SHA256	15ea613b252601d5503b34e1e7d4d5c9ab650833d33526f7b0ba0334e2df16c7
SHA512	478779996cef75703029f9dd25a081d9f3b4b7a4cb59bc42ec9ea4ee8c8492a88cdc61e92c2fd01a4ccefe02de3c5ae4389b1817d79b60d58f9bfba7ab3e9300

C:\Users\Admin\AppData\Local\Temp\RGIA7C5.tmp-tmp.RYK

MD5	8d0d8e6ed6676eec472344862b5fcd53
SHA1	6093fc86a8ad05297abae485c6f5d03349b81c15
SHA256	5d5d0a1db03c66f73605e0dd27c95249b902205b902d98a3d3a6fb18f1574c57
SHA512	b1299f774a8fc19ea70ec4536274f57d9457eafb8167a0ac848307b21dc16a193937d4d9ff413ff1a222349db708e118fd7ec22e834825e3093ca8c31b22047d

C:\Users\Admin\AppData\Local\Temp\java_install.log.RYK

MD5	830569e194afbf04899c3ab92d5d09dd
SHA1	d2ad95c90c28acea515d60757abd1d0cdac8ef31
SHA256	7fbce79703c9885a60cf4eddd356eb2f71a90b4d0a9f3fa46b2fb55ad92ad701
SHA512	6c620ee0580d616b3a3b2d42a01021a8fc6b0012d793235a4a9ede26ca6a052002e3b3b95e8fa72a0925584a8e8dd82afdc3f4b750d1d4eb18abde8e23ea5622

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\oeold.xml.RYK

MD5	aa51d9cc5cb23dfb9d0a05ba91ab3ea8
SHA1	3c727108ea520387ff14d6b3ad627b269768aa27
SHA256	d47671b14c2590640dce61c672ad3745973dda1610d17d48b6d3a44c4405f2b8
SHA512	40c467ba009a812adbf00eb24ca22a4cb62de1c683781eae9ea5bdd4ce7ba4ca963089473111cf66369225dce0783b68fc1d67dea81cb20244095c9b7d32d660

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edbres00001.jrs.RYK

MD5	b26cbd155f4c0499736fc5b61906372b
SHA1	6d38e180b658fdcf0962f9825c8afd505f463fe0
SHA256	b61f374c5981c020b1111657e4a1a69086d324fafddf6f63c457acc69ad21749
SHA512	df7bec216cd1102164388159670599f2b363fb57a5b2fb8d91734f10c17136c8bb37aa97af466c8ba0ae5c6b7a4503c9c53912f3eceeed83aa1a3dc2d049c104

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.RYK

MD5	075860f72b28c7a0397eb9f8a5cba3b8
SHA1	a4d91e3c7a135b4a1a7d667f3f69758339b3de96
SHA256	942432b2fc79082b8ff8c4b424e112ff1c1e122715aa23a65fea9979e9016075
SHA512	82ce4a233367b95b90dde4197061db7b82ef5274304b796c782115988f5df9c49f0dbf19b516826fbd9ab19f22d78763d43fd6647a30a989cf3bca7d30e577de

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD.RYK.RYK

MD5	6f8e34c2545695a1e51e15ea58b5702a
SHA1	088deda0849dfd7bf4a0f62215f8adc2e9f1cda3
SHA256	76dd7c9b1973b50b4afc2c8f310f51598b0e4596421d724ddd189439bc7f571e
SHA512	617ed6c57e66fcd86bcdcadfdf269b264e5e3dca18c88de0a591f924aa50b0ea3d645fef04a0add807b24e756ccd30872e7215818b7a4cd755e8a667c003cabc

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.log.RYK

MD5	615712beabd76b4a7ecac6f472bb32c9
SHA1	c4ace5ff9328060a260e74767b9b2c0379bd2c8d
SHA256	a68f60557fac924c2f6c3ea08ae0a03b442b8622cdd17316056d81d3c209a284
SHA512	2f56a83045dbad9001f77dc638be6135fbbdd579d5b849a2d66474440d877fd1aa256159dc904f2a3bb5b2289fb69ab6b14bf1217516b0514bf25750410c9e12

C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb.RYK

MD5	7cdc386fc130fb64aa1597c6fd73985a
SHA1	4a3d8da9014688ae7308ff318ddf1a7875783a1b
SHA256	c3f71e6dade06e41caec59ecf9252b3790040e273f8b0a9a9cc517923b23aa1e
SHA512	88015ac0a6020764a8281c16be7455d60638e9d01b77f5c2358a547b28c87f9b648d8f12b503b28b2faaf8d1c2a1f58561becf60e935633e4af7ce4bd28c2d94

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-mse.db.RYK.RYK

MD5	424fb6f2b72e4fd3a5393e42c48700b5
SHA1	9ceca50bd619bac57d102b79c3a0b68a9b3dad2e
SHA256	003d706a060fd7e039efe16febe492359ef5dee1f889eefd5e0be3ad5a10f573
SHA512	38353331f4f2a078b04198a052d6cf57d2532771ca96a1c6c08f10d6f6707f6bf74e38f53feb1371e0a8984a5cda8e22ae2b3265e007cde59133571391b10bd3

C:\Users\Admin\AppData\Local\Temp\dd_wcf_CA_smci_20230831_223514_448.txt.RYK.RYK

MD5	50c2f02911571e6b74d3712159f50600
SHA1	c9a0f609c3fd28e13945ce00f1d0e89a4b53cd34
SHA256	b550729bc082de9f50f9a4c89e7e57feb52e35132794237930b4c2099c0312e0
SHA512	07b2054ff32395e15efc3e14082785f0fd5efd7efa1f913d5dfd1b9f6219c7f1b0a4dad5e72ca3378e17b275a415ca58a20a063a049f8d156e99f0ceb6840b91

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat.RYK

MD5	1493294ab52f5d32a2724094037697dc
SHA1	05f0196ee45c7949b57cff5fa6d2d0fe65a662d2
SHA256	401c0b7b73b23241acb58cdf9c07b15ade792a98bb54660e56cbe5fdd5e01ca6
SHA512	60347ef18da163b7c419bb14cc35d7a01726b1a84caacd124fde3fef413ed7cc8ecab02990f079b64c10244b6db9fe055c062570d7505c6d2f7c41d6a5e3ba04

C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI1A08.txt.RYK

MD5	5ade19f61afe0974f6313ca4a5d9a260
SHA1	3c2181fa01492c99eb3d713ed0c7f25ca42a83d5
SHA256	5161def4a43bae60a8e6fe7471d1976099e1adb23897d0acc31d6029f13acaa1
SHA512	1b6301b2b3ec383828b822a7b5465c7f3a2cd15e7d4f5c61fb57c429ca76fa201d3cbdcde5233bf760f709b396d39f7ef1405089a19bc463e46eb7dc8b6eada0

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230831-225929-0.log.RYK

MD5	315575d4e67a81499e58d5af2ba7d251
SHA1	b885e9ff85317792c5e88bb18bcc87eba9226017
SHA256	71b56466f2fb22bd39b7704aa4964768247b65f7adc2c3db8b0aa7feaf7b8d2d
SHA512	7dd6e52965ab285277e91ed2edb663fd6387b452365a792f0b14dee1acf4320991ed69377692b77c43028fe93f056cfb958286a3c391404a2947cbf7e232f67d

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230831-225339-0.log.RYK

MD5	7ce2182139f63ef62fe18a2bbf4f1146
SHA1	fbdeaf1adc146ed14c2ea930116af806451cca13
SHA256	f9ce2d41445e4c2a9a4cbd3e0c6fbab850ee019c535e8108b8b52e620fd15cfd
SHA512	0335a2d64bf339d8f0b6397a5a552f6001ebdccf4ae13a225bbce87ac808a74ddfbcadcb35939a0760031d3acf5523e9cdaaa45594295a5042d9eb040f56c212

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230831-224748-0.log.RYK

MD5	b64732a8c43b65864d045c89f9095a65
SHA1	2e3752f6fdd19b9062998b600abc34624e73c8e6
SHA256	f2cff6ee41e5b90f2aaed41b6ae665c49e1e0c81ddec8ca67f1f3682ce487c18
SHA512	b964f42562b6b45e7bcba456779fbee0aced9dc0b1022020adb84658fd5b2d3b0f6b791e7d9d4fbfdd25ca26f93a69a387f66baf1c3902f624d4e86c441c09b9

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230831-225058-0.log.RYK

MD5	7c9fccb8d362109876ceedfe18875788
SHA1	41f9e74c25e4b6a6d3f870d66e0ac7833ecff175
SHA256	91090d7932ef846ab3026d2876adc0cb16ad4a0e0cc5d58017d66515af5083d1
SHA512	7aad1aecddb713830b57380c47a40d7d9553ce8aac0ef0e1809c7060cb1d1678152331a557e983b52e9c06857389952a173368aa9bfe191f7176743c72242bde

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230831-225639-0.log.RYK

MD5	7e895e50f9929115f4ef18bae6f68e92
SHA1	8042174f7bd19412d0680d6d6e95182df60ff123
SHA256	94adb59411cc166100cf340b677d04b3d20974b4807e742427803165fea3328f
SHA512	52b47216bc503a6f510d703caec3455ba324fe74ac3a1323d5fe9b6034d942244669d8eb232fbdb2112ac188dd479629c8e9f2fc1706867ef0956a95c9ecd16d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat.RYK

MD5	761125a78868bf8eb23241e7e37427d3
SHA1	7c550f4d02a377142771a6687935a3ea81951031
SHA256	8531635951a51df6867c467681c38a529acd657cf45b336b40545a291c510fa0
SHA512	3e8f000a07cace6d18e860421ae5fc6331edaa8ed085140bc9c0fc8291e47ed72117b3adfa89318d1f10edd904ce8c735489fde49dcc950be7bcabb422874fca

C:\Users\Admin\AppData\Local\Temp\SetupExe(20230831224110820).log.RYK

MD5	b155d20e619e21cf18096fe4773ba118
SHA1	a1c251691e261fe7db403825c751f36f04b9de39
SHA256	b17184d1cf822ecba580efe89c2407985755483357e1fa7f9f1115c8bb98dc5a
SHA512	04df5f9c231f3ee5e80c64a449463375462f80839710f9ad3fd3af68d5670231fc7a89f9c833f33dbe371cb73b925fc9e2e2d15b70c54b2529d9968e6644162f

C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI1A5C.txt.RYK

MD5	b7f31dd37b7384d7fe68632f1f290977
SHA1	f7baf621a6df698e7cfc9910e0e3775402e38fd3
SHA256	931fda0d4805c041d50aa234f9e18bd7a0e7ec2db0669c7b4099800a521d1232
SHA512	98019ee64b82a5cf7a5b0f09d782f1723b10bc56d616dce1fa7b680aa99b3f796b03ba00ec4fc1e46b644a52a8f917d6d60975216317c89978e94312e0499fed

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.RYK

MD5	f6fe3ebe577479bf58388e51046395e7
SHA1	e9d33f7a09d1760592a09fba637bb618f101d156
SHA256	a368b085f25290b6ea2c552eecfd8bc1c568312b510a3c8af7c538daa771b1e7
SHA512	a77e3e2130186661127bf40e351fd1a8441142e3558b879a56c8edc1faabd7f06210712bf7b9f6b48408613c3e3ce8d1538ac20381969c20e4d40c7028d82f9e

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.html

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\To_Do_List.emf.RYK

MD5	0fcee4b5f1dbcd012c6581e83627af9e
SHA1	a84c7acebf5212f7aa9786a592e87c50ee335fe3
SHA256	d18cc3dd13afb32fd6c18eadcd1112542a386279943b46aaaffcbef1e505794f
SHA512	2c7556ab9e68d623aae2347baea60f64b991e87082953abf76d5318469d36cd42de9a66204cc1b23e7bbc1443aca78c409e4d699d41567721bc3ca55f2c4bcf8

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.RYK

MD5	8871b49dfb021b065dd8ae045fe2b6d6
SHA1	a7e22f6a730b20eba073d5189ea6b8e007882b0b
SHA256	6fc0757e5485a2cd14f404b8cffbac923c043b625166383baf91a2f2b1aac94b
SHA512	96f844b9509f72635e67088fbf319543774d6161f76b6f97fdbfef0f46865563d3ef0fc08dfcc553beed705d07dec8b9096517a98328bbac234f7c21af6938ce

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.RYK

MD5	e33b67b7970e9e3b8fcdb46f54548454
SHA1	17ba25167b185b08b74f9b8840cfb1f9877497b4
SHA256	34027c47443b27080bbaeec4fde9bfe8425849c70dda7e3b5e079d66c0cfb729
SHA512	6c7c610eef365a9522b895c842596f476cd328b7a455756de0f825110d43da06c3bf36d37c00d452fb79ab57a27f5f41ca079b7f8ae4209f79a6afda47f019f1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JORLV5PC\favicon[1].ico

MD5	e2fbde5f5a77e8ee77965f6b2ba244e1
SHA1	add0d9c81151a4960e7f345861e1ef2a2ce1cbf9
SHA256	f877e7ba06791ad114037623695f07004c26a96fa9a6717688a23883c66941fe
SHA512	e68e10eae520a5b1b66115503f5d373b8717303766459893556ba34223de10264b98116115775827602acc1c0118507332210a1166b53dd2379b9a54681f9b23

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\edb00001.log.RYK

MD5	652506dab26108d77f4c1b6ee82c6b73
SHA1	931ea6d180b6fde66ade454dcabdd43731c63863
SHA256	b626b8a2998d0cfc8a7561ddf0a4676c379a8918f2658c47b3b71f414ed5bb9c
SHA512	586c54137724bedb69a47e06fbee7339f74a04893512e430219eb014b48b44d1b6225c5c4a84de536dfe8f4cbf3cf877ba8cf6fcebcda98c42842b5f853161c9

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.RYK

MD5	2650c5b3feb1f87442ed6f4db381316f
SHA1	986de409ec3355f11546bf7c0ef2c0ea54a6c4ad
SHA256	cef6661e167dbdfd78aabd9fd97419771b6978633e3c8ee73107db95f2664d61
SHA512	22adb8e90636ccc578bf563fc899ddcaebec0c345870b6b1c5e5113d652aea65ff3c5f20d08dc0e26072a095bcde298a3291e1a42b1a43842569c54914c5a811

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg.RYK

MD5	d00d8e9c3c95f1af20046b6ce1cfb9e9
SHA1	63706667eb0555190ea4d40c15610538c8757c6a
SHA256	be0de383d15492323f9ccb02d6d2c1b5e97d548dbcac388760af72fa7e77f29a
SHA512	a5c124614f681d6ee7aa89c9982b00de92e559fd8ec9387866926ca49d875f26fdb314a7d6c26ecde0e793b53e4d522c60e1e120aeddc0521e24768625ef4214

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Psychedelic.jpg.RYK

MD5	0f20b9c154032edc340abedbb16bb64b
SHA1	5ced8b74cbf9caa3b9f08df4ca5ccafd20cb8684
SHA256	45ecd2acdbcea3faa0fdbeb52fc51492b44aed0a123b36f7d08fd1fb57369164
SHA512	46a8dab6ee9da572104173470e311982a95acb7bdef1b84e03f85ad801ea596a43cfb3a870053e7653fbe42439e0616195391a6a6757c84ce589f9704bff6ab7

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif.RYK

MD5	3dbbde7362a88de2c0b91ace98f367bf
SHA1	1e1e3cc5fc4d502334d3e90ca6e3a362511eda23
SHA256	da331888c224111c1e0a01242b266c66a5548224ac9f31f7ae1bbffcefd98938
SHA512	325c56a9f40196aec913ab2cf480855da21930e28c28e749221436f53ea7a21f20a91f5bb8695c8afd6a2c744ac87d21ac9d191814e0ed2170955e368fd1f34d

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Hand Prints.htm.RYK

MD5	927f73068c180762e7e227da09271ed0
SHA1	4fbf27a0c31ad106a5427015eded7aeb09cc948d
SHA256	5f132999835e5b57b07ba88d6a7824eafba73689ffecf861f106781a26e93813
SHA512	2d09e88b3f86beb8cd0b6b46b69b31b65ea8b57a461ae5fffbec34de493b56c45d83e99fc44164dc23e5ac802faf7ef5e04d63b004a765858bf5bceb58314760

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Small_News.jpg.RYK

MD5	270077f50f627ddcdc99264684dd5425
SHA1	f068f08f193ce117f56c2025ff119fdd61906902
SHA256	355fe5ddc37812fce0d86e40f6ec04d6aa51f3a03f0d14abf97aba1259a69bd2
SHA512	149b73c149d6dd7ca7a0a3dc5b87e9696b7f0a9e643f6eb1ab5252c5d099b14de9611c1bd4a06d71a851e1c7b9e9e78256fc52b92ec19f7575c34d7c24cad441

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Soft Blue.htm.RYK

MD5	31488f5e7a0a27dff924e312f95850ee
SHA1	39d2904fce4ecd892b59072aea92ca426830c7bc
SHA256	04cd10ea26123128b137d4fd1a994790dcb91a67ab322b38889c841da62e9335
SHA512	2c1186c4b23ede32a565e5fb87647096ff1acbe001a1ced01f3bc294d88c9ff8efdcb92e69e9473e34f659597b986e5b1b601ea8eb9ec5f262fab83f8db70be0

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Shorthand.emf.RYK

MD5	310f8214ac23ba7db3494c47663b916b
SHA1	7b8d25ba22656194c618fc7f9e1d0cc20e33e71a
SHA256	722b5bb13a4bfb0681f2807c61434ef57671bdea1f439e3e713d385d61c6d63c
SHA512	94f89d74b53e16a1976a0802051c9477ae3c102d8c7d9d0c8e8785cba88de2018025ebd2e627707d0341cfa521736e8ea5171e45c49f6f1558e8ad12e98f85f3

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Shades of Blue.htm.RYK

MD5	8d784bbb877ed4fdf47c66b4e7ae0d3e
SHA1	4e9c3539100d899771050a882fd044ad1911ac30
SHA256	3898b2ea19ef6c1ab6fff628e3f923be517c85549a6540ac0ca63cee2b3f86aa
SHA512	693c58df9bd47ea415759f9daae2f2230da3fcc6b5f931d9af9909e882aca3df8981852bfa857f1144c6730a447e7f1f592b10df4577058f097882cb178fc486

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg.RYK

MD5	06d3c3cefeb2ef9fa8ee8a4da0b28fdb
SHA1	a67ea5b7f94fe1b45d817ce0f6f8d418a75ade9a
SHA256	52b7703e1bd54a6518a8c91c439aee0b3aa8ffb671c79ccd83a5199fa7efe0d2
SHA512	fe9cb61a4a95178bad17075b423aebbdfa0d57585a42f09565a2dbbc29860c5a8c0a4213480eb4ad052cb273e488e6045bd28013133a59a9f5146d8251f680f6

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.RYK

MD5	338564d15f105d71d57cf4b07255c95e
SHA1	8e82de7668387b610f9626349f594e43c3f7f466
SHA256	c43e9882e49095206c92d2e7992efd8fb78e4896331784394535664a36f03a79
SHA512	f403ca4a32bcc03118050c956063f8fdce6f92634630bc5f0660213c2379d7ba812499493c429bb3cd5ce5bcd4b12d2fc53aebcd628bb7d54ea7d29e3ec9b243

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.RYK

MD5	d8dbffbc293d5869ecef6f21a1376ed5
SHA1	d59ffbd9eb361bce762b188ca2761cb69f4787f0
SHA256	6a335e5b64a8d1a03fc883f3dde0791ce98f15111439f58e3d781da8e40a2079
SHA512	9463ad9a682b03afd822869d2a73e6a616df631e38ea3f76fdc40495e577f35774bfb94ace9fb059bdd0921c3d4a3d5bd637f49c9e9476cf969bc8dcdd5a995e

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Month_Calendar.emf.RYK

MD5	f2b29835ce4375df836e93291c273107
SHA1	9b481213c0d92325b2dc4e9013f5ef819c80607c
SHA256	c61d7b739032d58f1d8f84e1e7185fdf0fdcc85d88a03d8b88b299c9fa984495
SHA512	1668fd27cf70cee10b9472ba79fcd5473dac159ac19cc14a507f545060706c33ad9a59e94812c14409159e2fd373fc3662ac534c2048ec59823f3f357605d13f

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg.RYK

MD5	fcd401086f5bb2b11589f47f4fb98e7d
SHA1	08516e0e626034bdd9da871dc931ffbacd237dad
SHA256	3882ef7b8ddfb0dde65f4bcab3988dec0673d6bae848a5458773933cf2682c2b
SHA512	474fe688da4184a9e2fa8618e71a2f055ed50a32aa129027bcde2e86d0e8ee376695a3e39e4292103e260f993dc539fa8064358bcd0540d671a44dc4505e1072

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Green Bubbles.htm.RYK

MD5	d93573af753887f612d69a8ab26846f9
SHA1	9706e90da510b70611d283a8067d06b3f00ee184
SHA256	742b689ed29539de8524513bb426f3ea775086cc804f58fb96f8818aac4f14ed
SHA512	f0dfe164819b0f52960026049c1adfddc929004b43c535e1e7c034693338b1c1727afe04a0e095dc9d29dc0e5bec156377b21ba3fda95b95676d516a6c78b7d3

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.RYK

MD5	fa937baa9bcc6290c0dd886df3cb6671
SHA1	7cc4806529e0fa9843f1f11fb2cfedad62ecb06b
SHA256	87032311bf75591b2b7f18acdca9511e8b042bf741cc6e00e3f882775ee83888
SHA512	c5dcd96b220269330ce7cd0cf705556a63fcb12d335e6b0eeaf7aeefa4bed63a2dbae3a25b4b4c2a1a5ba47c99e86c065bdaffe380472dd52e211dc91e303daf

MD5	1aeebef2b87e73579b1e9f9db70e80d1
SHA1	d89997dcbf393876ef9b526a96457c3533d567a7
SHA256	ea2444add8a4545711970d4b5f7bd5dfcb6e7e8cf22e43268ec0ac1670a85731
SHA512	0adafa37b7b35de883d6bc1199bba2e7f1cb57d3873e3746372a842387e36fd8ebfa0b261c680b9749abdab2d7225f9718ffd09e116cf47cacd356ff54666a5e

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.pat.RYK

MD5	d017ba2f61322792d6e3442b88225f05
SHA1	1e201076e93f0aa059f0777cf4377853207ef696
SHA256	8be39878b72b8f00941dc11668adf6cf5344a881425f9bcd22c7c728de51a7c5
SHA512	bc544f85102cbc45f226b5576d0e200a4800d5e653313e89ed95c8cf70c327e75e359d4101859b0e5597138652fb16595196051453f187faf183320320d90c77

C:\Users\Admin\AppData\Local\Temp\2776d71e-2bea-4591-a9a8-4636ddf7dcd1.tmp.RYK

MD5	482ed2e0e324e11242c6e585790079b8
SHA1	6e8362fafb7aaa1c093609b9424c4be6a3c9238a
SHA256	45757d062770572519e4d06d78d3971da803363ceabfebbf6f3aac41a05c9b35
SHA512	2a4f1f0824fc38367df1ef6c4189da10f5dac4a0fa72d78a53bc8a327d53be7b334a87b351d211128d48d8ed74cb66ee8e28206d43e820ed9b432f62fdf66ee8

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb.RYK

MD5	8a0c307e7a7f93bbab191b1b672f06eb
SHA1	0cad8820bda1e764f69e2433b3f768a2d1a38b6c
SHA256	aaeddbb07cb86369698333ad2e8a260f898ee63f2b525b66b6d8f413ab007843
SHA512	466aebdcf0ad72b47797ee7d08589b0aae68f873656a5e45a5569b5edac3627ac880ba24acd70571b8eff06a69bec6a09477239842ee7761345b18b77633e3b5

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.RYK

MD5	306dc0ca020672ab66117c09d9a00f83
SHA1	11d6011795c7efc798ecb757e0f720d3242e60f6
SHA256	9833d89c98cb7ba8bbf2f2da3500936d5da3d6f0f84988891f482750c9a3dade
SHA512	137ad5a7d41828fb985b17c17f6fbd527d8525b6dcdb5ef836befa185495f7af55bb3c1cc44ad59b6cb149eb728264d5bb0cb87dab263f2901e87f4a6fd2a686

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Connectivity.gif.RYK

MD5	532a0058fea9a5636e245bd7b1cfc8eb
SHA1	7d9e87e54d493a7107e94222f39d519c1a85edee
SHA256	1655cd8d3f43150bdcb52706983e8b945d720369436e2cd45c29481f44609245
SHA512	79e4322dec4c4ef049d80bdd45a098d2f5026c050b77d8f9e0dda971f0024d62bf6b1eb77140c28cbd78f4ea448a5201724b1432da78c7c58b8014d53a279030

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.htm.RYK

MD5	69c6b154fec414c86f5597bc2d636e1d
SHA1	1c61b14464bbbd9aa180b4c8c6ed9bc88fe1fb08
SHA256	13127599abfb3a2a2e8c2364db48714ef89440141abf36d60cc449f846ff3c61
SHA512	80ae3479fc6a3c521c515bdbc779debfe280c933edc57f137307adbb6f48cc864b6789f91f19c7246efd68e41f785ac4be851c7a0c28f81826d6852225fefa42

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Genko_1.emf.RYK

MD5	cfa8fde1d67fe1f0733574a52838ce86
SHA1	3e8872fefac8534206a9a3a6981ccc5a0eaf06f8
SHA256	17b81c0db0d51ef926ae22b1ea066709bcc31fdfa4b58afc8570ec90666c03c3
SHA512	4a949f036407ca1ba92afa570bf699fa95923cb92b89c531f3b683397b34411a8313ecc371b48c9a6f2096ad1736d279e65975998fbf713c4508cf2effe4631c

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\grid_(inch).wmf.RYK

MD5	d79a11ea98cc25b513b5bebcf628ceab
SHA1	4d9066df365d6819c2859385d6be47e6be415b35
SHA256	f6eade3a01131b431f0b2e32f21bc7fd46728f6322b2fc9ed1f44caad40cd7fa
SHA512	84e598ba9d0e2d59c76515a60b1e3beb0bc35d63cd52601fa32ec8a5719c6e0a52a8df0a64a6188f3afa94a16c8875560a5713240d2e4fb777d9957d056ed2c2

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg.RYK

MD5	fc93098fa4b15f2fb3ebd5b748ffe30a
SHA1	a147fd86649ce0a77dd80ae958632ed8baa8421a
SHA256	994ce55b87e8c95d474b28a8ae31e45031d97a09587a87176f1dcbd1dd5149b2
SHA512	c28caa87dc385a4b7e11d164c2c41511880bafa208cfb28f8ec19002827a4c8cbd65cb0eb12d1fc837bf74d455e35554b72026c5d8f0ca670ff4780b813b1008

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Orange Circles.htm.RYK

MD5	ec54fc9935f6211e720fcc8c4dba3b6d
SHA1	674d6158676a1974d90c573f8f36c0c15e507ff3
SHA256	600b2f21d055792ea0f1e7b5126820820e0ca4363741341a1acf41d90a67528d
SHA512	ccffea259c86c32f10062d212a83d6901324e7f83e9516bb55e98399b00b3641bcf65e790d978d48577d74a25d53afb8930226a4b90c02372e51e7944c7ebf49

C:\Users\Admin\AppData\Local\Temp\fef0a317-3003-44a4-9a04-c0ef4df8f4b1.tmp.RYK

MD5	cfb3ef47cfb92b9d0584d10a15a694a8
SHA1	fbb0ddc8c4833df3c5e3fe9c06147213251e75d3
SHA256	ee48f4ab86f250f78d539c2b2f28e9bd781bf24823d6bf95691e796f2418abbc
SHA512	9247b5ded5db319c051520a1e489d29995a553fd83e08430ccaf747a8a30b6b7117744cfca3b2595d4798a1ebb6c336a40323ff8d6618a35f41b5050b9f45f49

C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms1.emf.RYK.RYK

MD5	25d19c1c1708c3b95f1f38da628c2481
SHA1	77850b66b703dddd784537da653117486ca23cf2
SHA256	4961231b3fc66bd29252ec7dd07ff365246153ed6abd8e2cdcef659a9349b07b
SHA512	bbbb9592b821e19b57f48b95ed48b14b2620d8c0dddf4721f82c5ccf00b15f66c891759f5a0bd4ecb4b64cb6ad9a785d801b2e109ff3a006153b2e65bce06056

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~\Popular Government Questions from USA~dgov~.feed-ms

MD5	e19dfbc46a5530d5f84e8c0a6781b202
SHA1	c6caa12c6abfda4be25ae279700534790713ce29
SHA256	55bb203e405d47ca12d38e6d6d75a1fb7f52c2f369adfce26388e4d4c065f12d
SHA512	80c67a7cb57a4a07e4b563c87f5480de22f587c32c5c2eda93e529131ba9cf560d95b3183492a6f09008967882dd2c956bb29278047a1362fa6fe6fa3fc8343f

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml.RYK

MD5	91f802709be6b652aa82b09d0d39494e
SHA1	71d0f04d073ac60e60f6d3e11c190fd633699c7e
SHA256	3ab7efd8e38549eadc9a375564dcbedfea079bc84aa30c59467a9fb36e7875c6
SHA512	0902a6bf1559676892979f8b4fbf8c97e19026152a335470e57c703a9e27ec9fc826aa320621530d05a790c480b03050c00468e97b0af63da42623ebe6216454

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat.RYK

MD5	46553363d94267d71d2d106b033371d4
SHA1	75dd38f2c8ec68021045075443d46d0e8ef5a852
SHA256	1fb539fbd8aed6be8d0d6da7d9cbf4b501b7ba8a1cbcffa00ce297b5a072f263
SHA512	9e9c805df9f17d6b78a35f16fdd1055bf43fc8d660942769a043b63484b3b967595174cec66cc7d0d2266ca8c33f274968e68166706cd5def0e2116a3148e12d

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin9728060290\msapplication.xml.RYK

MD5	fbf4e52131d0b429501fbbdfb61535f8
SHA1	870f649905bdf52eb693db68a75dda4396132d84
SHA256	a0daffab49c9bb1ea6ee7839187263dcbb7c53fbfc0fb26a8cb2f3daa6b00b88
SHA512	3eb2d47817a8fef658f46e04897e859af65ebe58def7c5c768187cc2143242d7440147fe0b8e6cb70d9575578934d38b02714ef5e2fcde9ea8b2d448ec6b7756

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FD504B43-4852-11EE-BB89-F2498EDA0870}.datost.wpl.RYK.RYK

MD5	7c26fbfff85c807fe3ffa3dd4d3f5a65
SHA1	345a4d8804cb57e23079b0ecdf99d3ffdda6a3f2
SHA256	6c2aa5598ecbce5a72bfccdad3049027c38ea4ce082fc2fd8af31ba34b4a4724
SHA512	76c2fdb166fbd0c6e8a9f93a4e4427cf95c630771f1f4977dcedaaa81fb4f94c2e7cff5028ba36e46498d7dfebcfcb981908df291fafb013f02a9165445c62d7

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FD504B44-4852-11EE-BB89-F2498EDA0870}.dat

MD5	d80fc5c1287859ff01fd5ca861d6de4b
SHA1	e99317af29b16f72ace5d6d9da2f4d42820bb332
SHA256	8e0c3625a776d7c9a19d9138f3b3d05033af5034f4f9441e1d6b80b9669c6431
SHA512	e289cb1650ab128ab1b88f6269af97d75235b62d8e8371b3ee5c49ad8eaeb8205e663aa1c6d514970a169c7a0f484171a9fa9113c324d3a01ff40f6266a259c2

C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-msemf.RYK.RYK

MD5	599114df26677b110e252e1473776d98
SHA1	d112427dabd57b21cd014af36ae8f67a1adf55c2
SHA256	63ad8cf0fcc4c38a20e7ef5fca04e542fbda5636d559a196f3028c0978c1ed54
SHA512	fb3e11e9810a1d02fbcaeaceadc23f3582fa7d921ee583ba3c7dc0966794d934a585b0bff5e6007a6d55f3d9875e39a0d1d19eaec529217e8251b6f7c73b2593

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\12_All_Video.wpl.RYK

MD5	291e55c50f69764ddd989fd7180cfba6
SHA1	5512e77a047a9319a00f48eeb2cd3f060c37abfd
SHA256	c2ac07c4a5c19f38bf227d0d2847a664eb8907a0e59abef316f64ad15fbe6769
SHA512	edc7c7a46f259065ac96255c9caacd5fda9a961cfc3e329946399403b41b4512b43a180b3dd31deefbc869747ea52120fab133c6a59f4c17285a213f635fcffa

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\11_All_Pictures.wpl.RYK

MD5	b52af9d2f304f14423562ab8fdf5103d
SHA1	5c7a0343353ceceed668a1a62956316b95a5ade6
SHA256	05b0c54739a6bb5f4c5d50aa0d22ac01376efe54f1e2b1ac0ba4750c3b4dd7da
SHA512	73b48bb511bd41dd6b9abffeb5b8190318623ea45f2a5115f82779b2d101f4cc0ae2e6bbab82d363d78a8c770e241227e9c4b9fad436025f11040100bbecf0c4

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.htm.RYK

MD5	78b23401e1b8759f09e7391c3d515bf8
SHA1	b728e054015bb61b2c434188edf6f9d017a34cda
SHA256	85f800f587c5bee08c578011e451b26bbdfd9488162a2cbce5ad9fe888f26ce5
SHA512	e16b06af92763e39cf73e2832cef693ef15e4b7831b81f854a0f0275dc466e64fd045ed12f4b7d08414f6c7c61b71b9ca8c1a1317e94a439d2c095ab219e5fb8

C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.RYK

MD5	561272165fe08111949c1cd18cabf07b
SHA1	19e9c5a1d8c081895621ffdabf92f90b3feb3ee6
SHA256	ee9e7bb9d283a3ea3755e821bb625304c08bd5482e393ca1cd494171848d4cad
SHA512	cc1dddace50dc6687487639bc6cfd2b8f43ab435bbd736cad69068a325023f08dfedf55ab09450738360cba6e5361b9f076dcab5579eb504c0139907881a1009

C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20230831_223456773.html.RYK

MD5	09d07ed7bb36c5dfc4274b23f64a5fbc
SHA1	dd758a177990fd64ee26c0cbea6eb5176c3bc3c1
SHA256	28c2f3f700eb7396f0b656e14110d7435ad093478ffb96282281d579e0f8f001
SHA512	60f6abc31e167259ed51cb87a1be0f3c9d39c8a756e18be909676dfd823912b97dc228d147d40d6e1200d3b8c83461fa2e98bac479677243a262f03cb6312852

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore.RYK

MD5	491e91da9890a0399d58cf39e87e7b52
SHA1	a6953cbe3fbb2deb99f32d8da667826becaa742e
SHA256	2833432d7123f433c13e3469fd189fcba01b212656911934f39c2f9001b32c64
SHA512	2f1b26a626d7f828d8721bf078e8806ecbe3b163097a9db3f596122f2a6ac9c4e693833bb305b34dcb7ec244670bb7eed496731a4934d07c7d714463316d18b6

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Stucco.gif.RYK

MD5	ba8b0d6a206ec23b32648832f7e34c04
SHA1	a82826c3209a2a3b3d524e57678817abcc85bacb
SHA256	4d1acadceab59936d50672d8ab83268b18c79cb4072a3bbee0b468d5957981a1
SHA512	9f89336cb81e17b9601b486c76e46bfd97d2e9d40f2e373cc14409d010654a2815c49ee51ef8751c7c02c47bbfb5db06c0a4097768dec8e1f5822f00a29b2ec9

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg.RYK

MD5	69e69a92534de8db6c9f826852d7658a
SHA1	9c7d864d70ccf767bbf7b24be8337b9ea03e847a
SHA256	d892ac7ae2929ff782213894a26d2021542af406425daf77d83f9ef2a39cb937
SHA512	2d2059e26b39a35690d885a38636e077250e0141cc69478111d04f3d9c884a302c600086848d25a83145237e31a5d1d15606a97d2938b895be5674e85257420a

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Notebook.jpg.RYK

MD5	da2e23f67385de2f36364a99e954cda7
SHA1	15c3f381c4563373da79d6f17560b18301b3dfbf
SHA256	5e5b6a3ec7cd44a20bf048ee496bd015a9b581d1da0ac26beebf1f9155336a27
SHA512	fcbd0c122b1d952d66f0a1ea3a3f7c122e62a25af03a13486e86df5ebc47ab12baf63749bce1b5023b11caaaaf8ed4f12c93c07fd9e96602a7ce29fd21976e68

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\grid_(cm).wmf.RYK

MD5	9812a866ee8b0955455c6d0e2ce7ef4e
SHA1	f324f047bdec85bb4d8717483ee3bc4bf838e9c2
SHA256	e9595d06c84313bb21691860ff971b4d64d6578c7446f1fe96dbdae26976a8c3
SHA512	15550028c2e1f1c4fc7649dbab0a07b46669518db5f28ec2a3746fb425850a6d19f43a60797b5d1064695febb616be0da8085907b8d3baf5c482fcb25602cf06

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Genko_2.emf.RYK

MD5	34b683a2a9d8db89617321626101c0a3
SHA1	16496c1db938bae402cf9858407fd16322012254
SHA256	4cddd6b0205554635546bd12923228137557b75cc70b2b0692e893cdd0ffa0e5
SHA512	962630c8a1f43e75868b2a309b0e661611ce92f47d2bb729bbefba37332539c379a5e2bd2bcc093d8cc6a6eb15c9a053dc71cecf3c9017f9d29d02cf71858b27

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg.RYK

MD5	90ca593f4fc7f393d083534d5930aeae
SHA1	4652ccc1c6a5732401a7d7c76a7bcdaa8cc88bc9
SHA256	32090f91d500967f021ea223ac05d0f01ed1a4e2ca907ae14feaf35a72ff607a
SHA512	607d31a1bf4015b918028f87d826569fef1ef047faaecd61297355f8a53fe5794ccb6747bf996500801a3aa627886615e8ed7c4a205869e83882cc1092a60cb2

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Dotted_Lines.emf.RYK

MD5	091ba5367b4f5401a73e8b3e98c16fb5
SHA1	4b40a5b81c686b5433779abd42299ef2543996a0
SHA256	30c41d1a7423d5a4b5bbc3732dbfc48eaa39564a5e6a7f847c0a0d115f827204
SHA512	b159a99491b2a0146f95330a8c15ad9e5f8ca407142e049bcebef9f6dfe851eabd8a36d096d6b783c27962b71bf0fbe1fec9c12ab4028da8cab2cbe039d1fe8d

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif.RYK

MD5	97f9deea0eee2a58c298be933fdc6e5d
SHA1	774d210ab6c27bf4f95e606f7e6948a8fea50c86
SHA256	741c8a129909c22c2f41696c33b16e053a40962f515af21bc462b0490abbf29b
SHA512	8f5ada3b229ef0d4c2c60f24b20877a9e53196baaa20747ef36fff9ac53565d579e39b67e691ffaee231798232cba44a8e50e8bb6e27689ce90638202d32e746

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\10_All_Music.wpl.RYK

MD5	55f40b0cc6bf6f17a1bdac5f9441e108
SHA1	b173365ebe83b75c7c4de97bdeab13269892179e
SHA256	c20f131a919c8b403566d6c2d90a4dac5a848bf0a2657c62c2ad3ea3bc996715
SHA512	fc9cb4f31ef75618004386fa3494de1cd28333343707ccb73193ba381743a725cbccc2bc96fe4c549e01658d0f28050b6d4635becea3df2b34a9ba5d85a13fc1

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~\USA~dgov Updates~c News and Features~.feed-ms.RYK

MD5	c60ebf506803560845cea729529ef80c
SHA1	83d3186693c01e0c5e9f00c87e3cea6435a04a0f
SHA256	ef0160e2405567ed291feab165a5a2c9a622badca8e1e3061bc3231a62cbfc80
SHA512	b5d02ca7e518f0e8d6467820dc8d00ac15668cfbd861a91202a87a73f7d9ab405d2920763b79f88f15b9af630d51f31d89e443df6c686a57a90745c111bae4dc

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\07_TV_recorded_in_the_last_week.wpl.RYK

MD5	9da4c8d3af00ec2e6a3d62d6138697e9
SHA1	4b879ba0efe84e071474f6d4de671f948d86dbf6
SHA256	b36a1373443af59d1bf2ff116091cb07fee01058548207afe1a54ce87a156d60
SHA512	69bf303ce45a7e4a762ba2a29e7c1095d17839258623861e48b92a67aa7b9b37330611d7f7542acd3c83d48aef08ab880fad96d26574fa71e19e977f52106f27

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\account{84BB0129-019A-48F5-AFFC-F6BA01E4E5EB}.oeaccount.RYK

MD5	0a03a081daa0c2c08bc94c7aff769d34
SHA1	59a1fe29da90d364be309109ae9f7aac3f9020e5
SHA256	77cb623b36250903fdf8ff85c02f2c5973971d3092d427b116530e2f839f12de
SHA512	7a4addc394cfd909123c0bfe44ae8071204b5802aff86ee0849c8a6e2bdfc85094d6817326f762d231b0d28b3ff6039003aad9bf832303ab64deb7b30d1cab95

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\08_Video_rated_at_4_or_5_stars.wpl.RYK

MD5	b07a3b0c2a15d9f1f43762ae9b11b86f
SHA1	5b4e37b70c1aed94a866292a497dbcc4e4dba7fc
SHA256	8f2b5f273df7f77b1db49805db71177bcc5e7fb636d55122f898c576c1502d07
SHA512	9be9f64219ead6bc9b3b820559f2541e346d83a98bd82e8092f2f75886b7c05a23015930e05d4910fb300c8738186f88f0f65d3ead97f79754c1eeca6bd97572

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\01_Music_auto_rated_at_5_stars.wpl.RYK

MD5	d48f7db4378ed85a2cef57bee979cc65
SHA1	66124deb1980007ff89cb552a87d2e3aa3c28d9e
SHA256	6fb9103e8344e00ff6fd2dd1dca396eeea613a6d41e22784a60e3abb84d77363
SHA512	f039b119d277cfd2e64def4008366e84cb4ee1df90e61728daebb9916282a0628ead02f12af196d998ee47a0e3264c139880eea244e5315b8b4611185c57765f

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\account{CFF5B4E6-4EBD-489D-BF54-13813C82E0D4}.oeaccount.RYK

MD5	7b065fee08d63f7578972e7b3cfbe001
SHA1	b9047a979941d1fb324f971fd5d05db87160e15f
SHA256	ae66dd664c934aca36387e114ce1a3d8218a3c77a4bb72c7f786e1bfc0340063
SHA512	e98e56a0bd620c571260f96023f0a81d02a21c8c3e3a2e9c23605d20053572640c326a241cdc90a78ae6f0e290c107f14fcb31c3430ba1bd91602da6459efd30

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\09_Music_played_the_most.wpl.RYK

MD5	ec7b09322c1356bee53b10972f79521f
SHA1	df03ac69c56d5dd4293dc63f3008b8a8d6216fda
SHA256	92e9543a7f9cb6d57be02918fddd331f5e100b3d23e1f9254b250aa42c63bf35
SHA512	1425775dbf957543d11d4f64c2816c324000939e5b47ede16597c4ac434cd69e7c944b59875fad8d18837f31415a59ead029fe00dbf1799f3ac1896db2772d2d

C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20230831_223456773-MSI_netfx_Full_x64.msi.txt.RYK

MD5	af4ebc82a66898c992ea56d6111b0d3e
SHA1	80cccbc18172b9b0e944ba4391b263919e43b24c
SHA256	6b1711c06cab37f150beb7cb677db3dab2ed4e226094be2c55828e943dc1362c
SHA512	252fa3130f326f101ecd501cc8e5e4498d0c7990c19cbdd2e5ac74b5b188de8a2989e7f2c73efffcc3122ff4b2f0c3015995b5e16f9116e77933cbe5d7913297

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{3649F480-4850-11EE-B069-62B3D3F2749B}.dat.RYK

MD5	aa1c2a49fa84500fdfbd2a74a81d541b
SHA1	36a78da562f859420823805060fe8d55167a89a2
SHA256	eeba871418a690d0258327404961089bb7d0b0ecdbb3793043258cebb83624a9
SHA512	56b0e2f072cd3e11eefa31a17d816c1ba712501942ace19716f88ce28e2e014d2aad809f4cddab89333e7cb75336f26dc59a6d5e8c0f0fb10681da2e1cf71201

MD5	4b649f6ce80914bd6a8931428cf2e594
SHA1	6b8b90a380cf6a9e5b7185e3f981672b38874512
SHA256	c22108974904980604067432451934af10ac9aec86f553be06e3b4b30d236df2
SHA512	3712878cc4326282b0607cba3c63d590d6902bcb36f81678827a8a155d5262eeb2f3010c0cb338af079439156d30bd0e0e68f46ff5a2d8431b4ab6587a3180a2

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\03_Music_rated_at_4_or_5_stars.wpl.RYK

MD5	db5e579064616eb0fca063a7a22f191e
SHA1	d5aa1faca26010966eb9f59b55eedead9a92f3a8
SHA256	b11c6291a752d9007c935b0aee5ee6e4c4fa32beb12c7ba255f61b3af4f3f8cd
SHA512	35b9325a99aa6ebe9a7fea8d5c8f42e9959c11c2e9b0ee78a9b311ebd35cdaf1b9748ffc0211ca6766abb339eadf2cd494df4f9925baf810883c37e62509f933

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\05_Pictures_taken_in_the_last_month.wpl.tmp.RYK.RYK

MD5	1d6fc60d653462dedd40cc16aa78b728
SHA1	700eca72585eb9bbc928ba32249c336ffcd83147
SHA256	554dd6a1fa97eba3b81f07796d8594d4c0b469f592358181fe1c11f9927e6df4
SHA512	b480a66dd2d2658edfab90d4524bd070a1d2668c931f48a9b7f7c872e97a5e53dd1b858fef3d5cef905e234c2e820053a8f518239f8cb81bd455f5b2103af79b

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\02_Music_added_in_the_last_month.wpl.RYK

MD5	d0cd6f0341ad7c81cda15e31e15e15cc
SHA1	d8378d239088457a6fb41bca77f432a48256b7fe
SHA256	64650fda576dc9749287dc42e9a2d1b38f5ea8cf3b9f16396bbc6ce691e5d3c9
SHA512	ebb2b8295f9389b01e2c639dec6d1b601f0b5289f545695fd5b272f39c885d39940ba6a505d5af58bd3c5ccfdd7b5664ae3027883479ffd3f04aedc7801023ca

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\account{942E6743-4A4C-4F4E-A531-073FBCC62756}.oeaccount.RYK

MD5	1bd81d407b68752360446b0df29341ed
SHA1	056134ba0526f1ea501361bfdf6c6f0c873affc5
SHA256	5c5a6602cd7b16cb2f3aea9fefc537ec622918802e5b75c03e566522524813f3
SHA512	ce3af7ba61f1ec57fcbc914b1f1790a9e29a5e023906699d9dc56ed50cc517670d321b876f0cf4c5ecdef5094f7fd698b9b4f9afd9e99b94e1b7a93b301dce3f

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\04_Music_played_in_the_last_month.wpl.RYK

MD5	451816e058ceffaea2d075f22cd9e362
SHA1	615681bfc134006e15ab16743108d5a0453317bb
SHA256	5bb0ec404520ca4ab52a5f3270930d7d6d8ff44d3c669653a21176ca8d02088b
SHA512	a651cc8ce4e49c270082c1c9e965181aa45a20c05c50784562695ffb2348f1f64aa5f3dca0ba96aa880bf16eb2a862abdaac5482a0e5103b0da98e2d11038494

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00007186\06_Pictures_rated_4_or_5_stars.wpl.RYK

MD5	c62d25de514808da5329f9477b262ef3
SHA1	b823863a7f1cae742d3cb7ece10def6c8c4b0234
SHA256	43cdeaf9d471b0ec61dae9fcd4d0cafe9876371fbc96fb82e310019a4e4adb30
SHA512	2c449d4ed17cf7a94b4b44771ef9adb2f87feddc593650c483d033fc445ee21840f5e2281fa8f86cffc8b30bc4b432b32a4b27d905b9d9251a87ff17ee9b1c9b

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FD504B41-4852-11EE-BB89-F2498EDA0870}.dat.RYK

MD5	302ab95a932df5aa71634f4507d28ce9
SHA1	b73f6c0037c9ff2346486a6c56e5188546e90f1a
SHA256	33d896791dc0f0b072cf26a1998c27613dedfad92f784aad2ae9b3341a19b134
SHA512	0e2800402ed224ffbf5a641d00243b3af3bf5ed46c6733a37980f6168b707221006e7c54c83113f7b4389cab97281e1ae4f484dfae073a87053e60afa2621c9c

MD5	9144c47fbf5a79150d35d67517182cac
SHA1	005b330759bc9790a878288a065f1cf5477492a0
SHA256	7fb99d67960d86e53a41831e05e040e525e9b418a222e12915a07fcf7d6e6157
SHA512	559825f2966d3ce640a7bb5442689778396da585a80bc5456d209364139153084424a1477f0dd4a111d406a5efee072b8f081021df1803b44318896e6ddcea60

MD5	830569e194afbf04899c3ab92d5d09dd
SHA1	d2ad95c90c28acea515d60757abd1d0cdac8ef31
SHA256	7fbce79703c9885a60cf4eddd356eb2f71a90b4d0a9f3fa46b2fb55ad92ad701
SHA512	6c620ee0580d616b3a3b2d42a01021a8fc6b0012d793235a4a9ede26ca6a052002e3b3b95e8fa72a0925584a8e8dd82afdc3f4b750d1d4eb18abde8e23ea5622

MD5	34e36ca4c419ad08dd09cd855400c0cd
SHA1	463b5fb52a5a72f2069fe70156159a775f2299f3
SHA256	233acd3261920fa2d4d54473a966f0a42460122c2ac559746593476ec2fecabd
SHA512	c7b05caff566c57645ded9f214839a131f0ab504336d88265f0b88360b06f6b689f95c9e371e282b5942c7f782fd263cc743a1df911880760235cb658bee59a2

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	9eb50b521a54e80b1a25c7cb324cf147
SHA1	bb3ef4ed9c9fc41b05118ac54aa5c3ecc7e18136
SHA256	1ebe1e230677854f3b8d7203f7354dee1cc6db31ddb189faeb8b5e8391ef5bd4
SHA512	351b74e75e8d5706c3ab949539595cffafbd3b4c2ee00e18072fc729e280d98c2969af1088c1e3b1e74a06fcb8a29758a451eec141931d6a7652b8790ef67a96

MD5	8d0d8e6ed6676eec472344862b5fcd53
SHA1	6093fc86a8ad05297abae485c6f5d03349b81c15
SHA256	5d5d0a1db03c66f73605e0dd27c95249b902205b902d98a3d3a6fb18f1574c57
SHA512	b1299f774a8fc19ea70ec4536274f57d9457eafb8167a0ac848307b21dc16a193937d4d9ff413ff1a222349db708e118fd7ec22e834825e3093ca8c31b22047d

MD5	054c668fc52b75941f98d72125966cb3
SHA1	9b4d5a4990ae7747b9d685ff075d30b9f0237686
SHA256	591bd5a88cbba5d72ab0c2bfe49dbf6e998a5d863dd933d432b4cee99cc4c7dc
SHA512	ba44c2c51928ba9af9ecdaf1d04ed870b94d917db90f0c4f004f46f2758d8cce81d20e26315db9122bfc7913fd7226787120984268ec174b0a1447c14211106d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	dc98024e659902722c58596c7cd8f6c2
SHA1	9d9e43ba03ac87387a17a0c22a4279dbe75011da
SHA256	15ea613b252601d5503b34e1e7d4d5c9ab650833d33526f7b0ba0334e2df16c7
SHA512	478779996cef75703029f9dd25a081d9f3b4b7a4cb59bc42ec9ea4ee8c8492a88cdc61e92c2fd01a4ccefe02de3c5ae4389b1817d79b60d58f9bfba7ab3e9300

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	c31393a0472393453ccd7e947912a805
SHA1	73c7794dda6708e4911df2b533f00ae8122f370b
SHA256	44a6bf1992995b6864aaa8be6971533b7328c0be67a8f0669818845882c5a075
SHA512	13b4ae2203a77500a49981d8844fdc79695e135d49073c5b7aaf758f990c15ff686a1abec66598f139c7b9107c9bd35e69629529bff2ec8007e57199c763784e

MD5	a0b610d1f79c6275d7732bb57428c52d
SHA1	9741aef82227ce2eef4990942002d5cbd574ae01
SHA256	c670db9ef3a8e98f3e805067abd47b1ff19809aa3fb7b5237c05902b28f22164
SHA512	e63b16924d6779e8afc540963a4f9e19186767e9442fcfc1c5f4543cc0f93743458163fe417c6a777df3aad58b93fd89560bb6048bebc86a1d1643ece20448ef

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	7cdc386fc130fb64aa1597c6fd73985a
SHA1	4a3d8da9014688ae7308ff318ddf1a7875783a1b
SHA256	c3f71e6dade06e41caec59ecf9252b3790040e273f8b0a9a9cc517923b23aa1e
SHA512	88015ac0a6020764a8281c16be7455d60638e9d01b77f5c2358a547b28c87f9b648d8f12b503b28b2faaf8d1c2a1f58561becf60e935633e4af7ce4bd28c2d94

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	d8be85ba89a828bc9202aa0a91fa3cb8
SHA1	26532a3f4b7cada915619e5aae568b2356a86299
SHA256	56ab4cbafaa8f8819f01f067f8cc81f691b8271e1c166941f44bf6e5b8c2712e
SHA512	fe04c926bf288ba20378ada52e45529eaa42f023949a59ffd920843edf92c6000d1cbea50d157e92045f33c8248956448afe1415b6f7f9744a90107eb202d5fc

MD5	615712beabd76b4a7ecac6f472bb32c9
SHA1	c4ace5ff9328060a260e74767b9b2c0379bd2c8d
SHA256	a68f60557fac924c2f6c3ea08ae0a03b442b8622cdd17316056d81d3c209a284
SHA512	2f56a83045dbad9001f77dc638be6135fbbdd579d5b849a2d66474440d877fd1aa256159dc904f2a3bb5b2289fb69ab6b14bf1217516b0514bf25750410c9e12

MD5	b26cbd155f4c0499736fc5b61906372b
SHA1	6d38e180b658fdcf0962f9825c8afd505f463fe0
SHA256	b61f374c5981c020b1111657e4a1a69086d324fafddf6f63c457acc69ad21749
SHA512	df7bec216cd1102164388159670599f2b363fb57a5b2fb8d91734f10c17136c8bb37aa97af466c8ba0ae5c6b7a4503c9c53912f3eceeed83aa1a3dc2d049c104

MD5	295d58decf8dd9dc3e340cae3aa85da0
SHA1	8e77fcb5bd2fd3337e35e9c300b8ccebdd8ba7b1
SHA256	027b003bdec1cc4098d3a1e44d322fa3acea19943aefb7c9812d0350f8f43d30
SHA512	a97b8d68b0bf9ec572589cd71ca1685af9de6164b9e780a2f654fbab5476dedbbf9c27c927fbbed11e961b6e964fd6c6962b9bb2f61282369bc2900de09ae86b

MD5	aa51d9cc5cb23dfb9d0a05ba91ab3ea8
SHA1	3c727108ea520387ff14d6b3ad627b269768aa27
SHA256	d47671b14c2590640dce61c672ad3745973dda1610d17d48b6d3a44c4405f2b8
SHA512	40c467ba009a812adbf00eb24ca22a4cb62de1c683781eae9ea5bdd4ce7ba4ca963089473111cf66369225dce0783b68fc1d67dea81cb20244095c9b7d32d660

MD5	9c22df4b383723d5d5b5cb261eb1918c
SHA1	4925a657ad19cae426dd60fc7f272c42043857d4
SHA256	8e521244371232553402a2c83f0ffa34a19c3f9650607a4365ad513ad5cfbb50
SHA512	c15a9e9e7639824587d2155446393687b4e0ec3db467e084dc931d15af908a250d31cf261d3c6c9c1a8ec6f775ce6546cbf02e697d3fc4d0f0e84ded86efdca7

C:\Users\Admin\AppData\Roaming\NewProtect.jpeg.RYK

MD5	a86e0e105bbd83dfd424d173a5d01f2d
SHA1	e46f933d93db4e191da3e2f11553d38c116ad606
SHA256	f0d5518ce87e804fb36fc585cca22b8f4adc0bff588d15fe2d061b4478966b76
SHA512	c3d3c1aa1090880021d994d44c99c1a0f29b54a74d13f50b680a61eebbbe6202936d8e11a5a448ffec7c0e8722ad9bfd3d701f4983266bc0d12fbf20ba47e8cf

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	1493294ab52f5d32a2724094037697dc
SHA1	05f0196ee45c7949b57cff5fa6d2d0fe65a662d2
SHA256	401c0b7b73b23241acb58cdf9c07b15ade792a98bb54660e56cbe5fdd5e01ca6
SHA512	60347ef18da163b7c419bb14cc35d7a01726b1a84caacd124fde3fef413ed7cc8ecab02990f079b64c10244b6db9fe055c062570d7505c6d2f7c41d6a5e3ba04

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	a8c2a78612d28e04153516ff595762fc
SHA1	2b44e81f4f0f0596d17e80e804d455a3a9271c93
SHA256	70bcc27635014e382f86fddb5e7337c6b7d5ece26ed61d262d3f1c3324322d0e
SHA512	992b0e2abe1939224379f1e713987bdc66025ca2b14c75bf42a50e19d544d10ac45259ccf3612b0eb4c33961edd7cd756c3e110b7f64bebbf33b422ac69f591d

MD5	4397dc47e0d45107629203e1e9d17788
SHA1	a6aa714252c81f9f6f93439139a8cf45f68dce20
SHA256	3890cc4e87f660e9afe165aed0adfca92a15ada98357f739eb1884aceb3109b7
SHA512	47dd41667265abc7103fd8a841f16a07539e881328b7148eed952d4aca93e389bff5a50f22326f8cd76f6b1ae184a061e861ed33dad5601820664ba571a6d13e

MD5	411e54e9895a70331b98547474c1cb4f
SHA1	1c0f0d68886361ab3647b2e37f937805321caa74
SHA256	490743d83b753d1a27ea7cf20286f9b7c7055dcd39b54071d7e19427bfafe3b9
SHA512	7126abf280953c614710ba4344605c077b89b90f3658eb21cbeab02e86247e1c1ae21250acb1816e2d8265cdc463b2a6fbbd29ae8d04e5d25d990c1c12cea865

C:\Users\Admin\Music\DenyUnpublish.M2T.RYK

MD5	b906e811f6e2293b188bd3a198c82727
SHA1	8d112ed4cf01e828e4402abcde540540f4e31be2
SHA256	e9d05573989dc0a262df0375e5c032669a57c3f27420c1e0675a484af7cd04ff
SHA512	3805d22e0333650c4eb4a9559b0e37174446b33966be9f85d2a91cdb6b657e5f76e443e24432baec5dc229c7084d0faf44e9364bac7ebdb9c6de0706845d56cb

C:\Users\Admin\Music\WatchWrite.xlsx.RYK

MD5	c6e1510f531c1362e57f927d3ad289c4
SHA1	3be2794f6cb30832c9c15247ed32d4475463f3e6
SHA256	85e39dc01b84bbf5d6b7712e24194d057a284e6c7884bc2661c4c5d238bd8cc3
SHA512	5f505f741c7129b819159089b0fcd882b67991e78931ff1d3dd449d82afc73ec0c3b7f16689942fedca4e17c44f37cc23c2970f5d92e3f3a68bb3c28463582d4

C:\Users\Admin\Pictures\EnableStart.jpg.RYK

MD5	015aed989de1004cb1cc79e6a7e5c783
SHA1	6b6dfb4cf6bfd4d4b6c953f9798919abf4a38dd8
SHA256	f3585ecc3f35f914ea41d1c5a581906fec2f51e891a37a781e0596aeb4b71af3
SHA512	6d53654e42399a8d49b96d9742a5de107e98fce7401eb833d7ec938dc6d0a93e1ba2065485d66cd4b446652bb274c0071617be96ebef22ac25ee83496034a536

C:\Users\Admin\Pictures\UpdateJoin.svgz.RYK

MD5	88f4eebf488c0b1dc0a705f8e45b83b1
SHA1	01eb20ca7adba9e8ae33c3b63761b05f363b2279
SHA256	50903c679e1122563f72904d5d069ede91604c2dd58a771b6d0e8e3d5ed69159
SHA512	e538b00237bc207a1f9e445b24bca34f58fc8247aeba67392d3c7c8595d898616ec0061450774d539fa888ee2ab3867ee2aa4fefc8887a3a65d45741d4b3c3e0

C:\Users\Admin\Pictures\TraceConfirm.cr2.RYK

MD5	cb2475d2a75f124636477f3b0b0ca8fa
SHA1	76cbeb04fffb53b0da82c0010257945b20042453
SHA256	523dee026fc39caa78d32215e3039074880dbf7af23b10563010b53eafcb10d9
SHA512	58bbd55b2b9a60ccee7f16044a07626dfefdf2fdfcf8772376f8e737d60fa93a5677168cf54a0e39bb6953e4e6d6fe5a2540f55832cd32b357343ac1ac52c270

C:\Users\Admin\Pictures\SuspendGet.gif.RYK

MD5	64b5e55f123b393efd3e433c6bfd88b8
SHA1	59c5519b4a790572b2dc85b20cf8295b00531313
SHA256	87092cb3a7ca6efb382b139e7bf1e6bef1606a3f23f57b6ebf8b355369cfc64c
SHA512	469aaa2095469a0d65339a131728fe889538ea2cfce897e75cfd47b2c87f05df39895981ba82697e502d9ff114c9a5ea7a16debbadc41249ed0b95faf8e5fcc9

C:\Users\Admin\Music\UnpublishDisconnect.asf.RYK

MD5	9f4a6b892931b4b701a3cf3e8dea8cd4
SHA1	41b7393e73d7ec96b6caaf657daa2b2baaff4f9d
SHA256	7696c68071b39df777f5b5977b16b7a112031efdb174fe6825755c4b04cebef9
SHA512	bb198822648787560a378201a203dcf42adca667cd4acc0163e2c7ba926ba555f2a4007af5a4b7fc2c0e9cf8f13872374ac7a5c752f11cf606f4b334c978b452

C:\Users\Admin\Music\UndoLock.docx.RYK

MD5	1ef341086fbb93d0a024b271075f8744
SHA1	a034b382e2713e7759be8c54b3fd04718ba992cc
SHA256	3bfdfb37baf7bd0ea0e5dabd692ddf3a0a72c3022d57fd3235ee6bdcabd72703
SHA512	4950e53579f1f2a8d5a0f113713673ad5bb5347363407385d706a72e0fc762564b99357c235dbbfeb8d969a40fc7a2785f76f8c48c0a97e739d425ac17e2baa1

C:\Users\Admin\Music\SubmitHide.tif.RYK

MD5	2bd8f18827ae07e4c1ed3b3b40e34b4d
SHA1	737f86ba41f1f0ddbd51386afa2ddbc781244171
SHA256	36b2fae2e69b18bfe5dfb90265f70a30f9a2f9196295d09b0287966cbdb9c29e
SHA512	328eb174d71346776425247e6c9462918c3316c49c529ea8c6f9d6646fc3df7a150bdc28d7bf8054b4a88ec1dafaf8c5f01e5773d7208860965b466e540de87e

C:\Users\Admin\Music\SkipUninstall.wmx.RYK

MD5	cafce9dfda483899db08d86a763ef550
SHA1	34f2274e326072bcc2e7288af81eb10f634cf27a
SHA256	c4520bc83f7435bbc7890f95c47698ac4343c8db8b63010c0bca75734342a4f4
SHA512	bf9b4dad63ff947351813a11ef0cd3d07be58c9cc0e605f85ca1963bc52bb7fb83eaee9fad16e89e171e40cb5e25379076f6badbf4347d9f64bab87dc3d06bfa

C:\Users\Admin\Music\SearchPush.gif.RYK

MD5	87c168536da62d45600af5b93a29a763
SHA1	5be809a91f0a054e5177006b6b4a1041fc3e8646
SHA256	d597e5f701b4fd481c35cb3622af0ea2529939b62b55b9297a769944ac9b34ec
SHA512	44d594123cf6d2acd68642fcae543413eae074299fce9cc75dccfb3a3b862af71b54cd2ceb22063e78f1dfe88e4cd66365176c13bff185d09b9c02f57f93218c

C:\Users\Admin\Music\RegisterRead.dot.RYK

MD5	1ebdb32562d5e18b0f70d7d1960f1f63
SHA1	3c0fa125877b3f6ded2779a784372dc81d6763f6
SHA256	6169cf7410619e4176145c01545da62f93fd2bc59f9478e3120d4d4527f55b95
SHA512	d83060abbdbed8199b58cd547907959708c90fd8b85830bdcdf3a317fd0e3372c697dee57b349d4b1c461e91d1a2994eed7583b7e921e7c552485435c310ba4c

C:\Users\Admin\Pictures\SelectExit.gif.RYK

MD5	055f451120e043d83bea9acdcb446bb0
SHA1	3e109ba5769293a75f0009c9a9bde644dbab449b
SHA256	7750d384261a493923846cd79ba0d02ee03af8b05508bb2a68ca2f42ea500f6f
SHA512	e60ffc1ef5d60fb8963584c8412729ca7b70d56910c2e5798e67b520b8e6c97f89fb014f2577d85ec1377d7b4b460992755cef37246df78d21da4b78094b0916

C:\Users\Admin\Pictures\ResumeEnter.svgz.RYK

MD5	b984cfe8f2e40bbd9163f9999c049ae9
SHA1	f706bf04e1bc27aff64db33b11635ec3430dfd10
SHA256	7254af8d28734425435d8a30b8821d6acb6be944b2f3e6f71126edcd91ae4021
SHA512	1183f1642dfd097f3af4a6ce03d3e258ef5c7d280c0f4bb7db5f822d30a9b8e19a4e2cf00b96d794e2498d9ae6f8701306680516cee91702147462a3ce00ff53

C:\Users\Admin\Pictures\RemoveRegister.eps.RYK

MD5	55659fb9919098ec439ce6430db175ca
SHA1	5a90015135a896025af6ad4b87fba02ea94596e6
SHA256	c3f9d0894e2b3f9a8db602beebb8a4d62f10aec7187f95972ad4b06895ca03f9
SHA512	6290b616c5685d1779585f62be8120f9aa27df2fab0aaabe576bf4593c6a95dd6d361df048373ef67bc7e7629628e3b3700c59c8e0de804beda8a0bdd60308df

C:\Users\Admin\Pictures\OutWait.dxf.RYK

MD5	2160a060d25594ba8e686dcf2f9f3ce8
SHA1	70b940cb2c8747613dc2b7a869325a28f41e7e0d
SHA256	9eac3931f7c4c9de55eed1e671b90b0105b080c2c7dd528c3f0e9632f8f5001e
SHA512	8d092ecf62466a7e14af541d3504dd01b17c88687d691db10bd6ea2dd36f033000366a8f7df5eabf3482b2795dee52bba6ee567dd6038b3b4cc0bfd1013e0842

C:\Users\Admin\Pictures\My Wallpaper.jpg.RYK

MD5	b364184113574b1eb0be069a88f78856
SHA1	bf78e37425d9b3b85ea7265dbe77e19b175bfa60
SHA256	7532c367b9b1547c516348dd4f4dd63942cc178c1b79311daafba404066abbb4
SHA512	91b01ea576e5535a693ceca8b5a0083ed268d3e716ee62b28e32ec8f7d9824111e330912209124a4e957f25e4fc5138a311b257b7e1f61c1295809ac9d4375d8

C:\Users\Admin\Pictures\GrantCopy.bmp.RYK

MD5	8bb57e8c5c24feb6bf17a6e9f720c94e
SHA1	ccd0c0ef3598bb985f9e71d65b782ed41cb13864
SHA256	261901171021459e9d3132d4ffb8963fbc1deb4fcc1358077ed9e8e1223aae94
SHA512	430a798918da088ebc4f71d33e32fd6ee84268aa7e9c29a556c97ea5068cb97062361af1cb4ed5eacec772e2883becd555d8df4deeadfc6f6cb76da9e0e8c295

C:\Users\Admin\Pictures\FindResolve.png.RYK

MD5	95f53d5dc57f8db506b8965e1fad4c06
SHA1	3d349e0c755e5c8fdb529b27cb41fe160bc656f6
SHA256	2c1455ea70fc7db5d0e0edfcc967323dd1e29e3fa4c67b5acbd59a5b3620f927
SHA512	8e9762cfa91d54333b10db9fe0a64a9f6ccde38598d2c3691ebf552f9569e501ae65ec07f27d7333fadb49e12c4db87c8ea66119d44d372f115b3e5e2886b475

C:\Users\Admin\Music\UndoUninstall.reg.RYK

MD5	e78b15e1773a822a0f90e04e2b0ba35f
SHA1	2a28b19c0278d7ee9ec63ab4419eedb691a45ab7
SHA256	469cf2747dea33d36b170cf33eabed344084f1d3de725bcc6dbf981859973a01
SHA512	6f2936d62099ecda81d473b7efb7ff03af6b11f0c0d4747182f70206119529fe3f41aaf6871a15385b222d9cfd10883d1d7402fcaad51d4a386e9c46c2373828

C:\Users\Admin\Music\SuspendPush.sys.RYK

MD5	6a83350f1df55379f11c303059b657ee
SHA1	e9fdcf0764d464e99e03cc743e94b5e248b82c7c
SHA256	5996436f5a670abfd9f93ff4a7d560cc7b2aadd073dae3af2ca678920385505f
SHA512	4df725ee2b5a6f3f9cd37d919d1037ac6dcbf425f5fb701328dd718961dfccceb55df847a26f92e57679ff761acd0d235c483565887a59b237f4218aa8c4d2b3

C:\Users\Admin\Music\StopImport.wmv.RYK

MD5	82094db3d27b7a148bded3ec939cc284
SHA1	e0af6b55f516748cf6a16a44aa96aa2ff782dd4e
SHA256	6c473c8dfd9be62b35aec2b75bde0a2cc6ea565e8b305ef309a8782e09e0f86b
SHA512	b976a0ce30989c8e4b75f1ff7119fc484756bc0ac55e1c388769a27f61c7fad555c90587c0667eba6b07598d05b3bc983d2650c7d40d402b9c23b4f42a253e5a

C:\Users\Admin\Music\SkipOpen.wmf.RYK

MD5	bea84252b0dcb5e83cdb94603a0e257e
SHA1	a7760ca71d0e5931361e2e1d1767bdf6b4184eb9
SHA256	602efd9358405d781d10bd3ae450b320f6a4b3acac4feea1a80ab368edfdf39d
SHA512	24cbb4d5cf4ba63f802e54cc1efa088eba102147cefde2c3cf7c4414f61b246f981afc63b1931196a3d3d4ea71244e902cb2f4f47e1176d58dbde67fdb55fa54

C:\Users\Admin\Music\ResumeSelect.vst.RYK

MD5	a3e126d1193d5b9389830a00aca86256
SHA1	ac513613542618f71294273b742ff98e96420172
SHA256	d6afbec64139bf5ec23692ad2c5d94d05b542fba3e84726d68e8082a03afb8a4
SHA512	fd5e96af416ba6cb8a7fc3fee3425f624ee3495e58c37452f66ca1406fb8f0051670393f1dae988c44e9797d2d0cf3656fa63bdf2ab3445234b86fc931b7a992

C:\Users\Admin\Music\JoinRestore.iso.RYK

MD5	8566bc2bcd4637259b76f80d7c5b6496
SHA1	61d84d0f653fea17bd390134b5561ff68f8a9f1e
SHA256	686e36e7db01ae8a6db8d8c308af52d82f467144cd9fbb0bf55b70bd9066921e
SHA512	2ca9b546b897f88c1e6a976aa55dd54d5fc9572e55ffb9836922e6de60e427513792ec42c6129589ee90a971a0f3635ae67f3849517710bef6dfab1d66435b31

C:\Users\Admin\Music\InitializeUnpublish.wm.RYK

MD5	5d84e41acdfdaa4eb5e6669b9e34bcbe
SHA1	ae5d1d81c1d9393c1ea5b0e72fea2cde8ca7aab1
SHA256	09dccf761d8aa40be69ef72b0750aa18a98da596d1353fde5bd84b05d16829b3
SHA512	b9c0912b1c9416a00b3d1599672f1c647e27e215014d99e5a0c7e0af8fcd7202fba5cc9c7d6b7e37f27fe00ebee30d6d795b013ebde1e05c73bbf831f976e6b1

C:\Users\Admin\Music\DismountEnter.htm.RYK

MD5	3cf128012d151277af80bc3686d809cb
SHA1	2a737e46c5753b9bf1f431967f18bca661cb2dbf
SHA256	3e17064b10efe551b3e49ae303df908252dcadd83d8158c0f59321bc1b00e503
SHA512	fffcfbd01bf9ef2553273fc7c8e8cb7971ef7915f1faf50514738aed139c30c4d3d9c26f8a26b9ec10b31e739cbd8edd6789bbebf691cbe96e185a057e9e8f8d

C:\Users\Admin\Music\ConfirmEnable.iso.RYK

MD5	c2997054a165eda5e550168725f7cdec
SHA1	2bed1658099a43d29998e62fb0bc0ad0e4d2a873
SHA256	b6ad83313ccefa219eb9a27b52df6719cdb28f7ead5cb99f8df058b4b5b495c9
SHA512	02489e1fdbb56bbc539c4fc089e4179d955a4fdd988f530d44ef8c1575a17fe966fc8d2e2bfd9ba8eeece2875823ea863bfaaf47aa12400b93d6d6d1b7c7ae21

C:\Users\Admin\Music\ImportUninstall.xsl.RYK

MD5	32f0bc0d564ff010706b6e2dc9cf0386
SHA1	5096a74415245a8e3f1d84465ee51eac05936143
SHA256	566b54cc750d7ade2fe50a28bf3b70e5c742fa563aba462c19cfdf88e31857d7
SHA512	738e592b6373f8c94c0afcf6c2ffdfcd8b45c6f29620e57deab475bed585856cbdaf8d0d6b6ce4f37cc76932367af721b783103a22e0b1022bbd90dc96b0b5af

C:\Users\Admin\Music\DisconnectOpen.xlsb.RYK

MD5	57d09c15edb7e9435334d3b08417f87b
SHA1	eb055123f2481971b900163c8f399ba9ea530634
SHA256	acb7e524850a1fff2cce8bf648906a9c8fa27ac928a04e48e1e01e44ed23a69a
SHA512	bae1da607c41ff8ee54968c8911dbb9168247ac4c469d2356ba2833f76fb138f739592eecd37ae5e9630726105c00fa891c02654646486465c8861ece84b1155

C:\Users\Admin\Music\CopySet.avi.RYK

MD5	03e6372628a2e1a452685f9784159e7b
SHA1	38e2516df388fcac69e4939de8d93b57a7989664
SHA256	7a71fac75ac6f17bf4359392492fd3bb9a5d9314a0dd5a461d95eafaf17729e8
SHA512	275a6c478e147fe4649b289ea587d3f53a268824226eec95341abafd547b973616137a0f4bb9d1326ecc378c011ea65ea61049f0fedfc8a042d2ff801919d8d4

C:\Users\Admin\Music\CloseFormat.ttc.RYK

MD5	da722ce956eaccd7f584fb83a9ecffbc
SHA1	b29b5bc0cb562977ca1b7921a8af9bd6e1db9da6
SHA256	36174180ba71754c990830d4c891ca8b654b0a0f43874dff5dcc5bbf61d5a9a4
SHA512	10b8739f070bb94fde024723ba89742d23d26f6212bf694b1f51d682d4af2a4af4ef38492eb97789975af43babab8640e49825edf51cfa9e483bf6e60c7a3bee

C:\Users\Admin\Pictures\UnlockSelect.crw.RYK

MD5	006d1ef3e3740ca9f69409cc8a572933
SHA1	bccd612e9898cf8409f073ede3ebda29f43039c1
SHA256	3ffa1176b08fe21c6129c7ecec09e64fd0bd6802901d502643f04c5280f6e28c
SHA512	6cbdd10ad6fdfba8eb82cc2ac470f7c93c978836ae7985acf8a0be117e24afe652629f85d2ebf0d166231da0c92bd9e35e16b143025ec01171162f8f0bcedc26

C:\Users\Admin\Pictures\TestUnregister.png.RYK

MD5	32aa9adf8c599f5dfa3b932844d0ddb7
SHA1	8256cfe5104c08a0bedfc7628c154830812829c4
SHA256	c49267b39a6cb7652d05b94ef3dffd53a6c1c02cd8f5c760f4970eea1db25b23
SHA512	127d757e6b0b49428c85be0755c999ba94755839057c3ffb4699dbb898baefa1cc22bda357a06d896e5ea62472a0c0ce43ea6cfad2c7d4742ddaad9982365478

C:\Users\Admin\Pictures\SkipProtect.png.RYK

MD5	ecba1d1c7c81c55f54422cd9c8d338ab
SHA1	e8b79dbb3ac82aca3aaa62bf6115dcf1b7b7bb34
SHA256	419f0704df852f114d6caf33d36e99484a510b9ee25b7f1055b79d25c8346eb8
SHA512	7c2e9cbc19f5eebbccb41fca342729da8ba5964e5c8aa1e83cb81e74c059a0abd22404fa98a62ba475daef2d2e74b4dc73c659d77aed195a92504ca2f95f77d0

C:\Users\Admin\Pictures\SaveInstall.tif.RYK

MD5	252e8a7ed78832f73bc22503169753c6
SHA1	f8994d1e6829964b8f0f3c1298f31c2f572314ce
SHA256	7916bec3b2a29ef862c626d758b88b3bb023b4e2471f1c8d69f7fa720f4dec25
SHA512	ac4a74ea90a7bbfeed8c213126b92b9acab20030a1136b30078d2bc87891ff65ac793fda3a3d6c974f5b67fc93c348df169492de458760f00996406e8d824f3b

C:\Users\Admin\Pictures\ResumeAssert.raw.RYK

MD5	1ec4f55dc37db39b831595fcdc14a93b
SHA1	3352d864f15e5783967b70c57ae9c9adfe266316
SHA256	0acc36964ad0c35a0e32755d79b083bca67ea82506d93cd3f5df772ac7a451d4
SHA512	2783e236eb0d7a7855b8f47777497882dfb9e31506f7057c36e2674e4ad9e6dbf0c6f2d4e682984bd7efe68d07549566b7c08cd6567d332e03e1b933fb5d2014

C:\Users\Admin\Pictures\ReadPop.svg.RYK

MD5	d9ad7d7af397a95686a82d76f33f6cb9
SHA1	092c79b71e266e835caab237fe5ba03bf80908e5
SHA256	a178d9db437a42fa877af5be73a9c104676509b197d49aa8184ebc2a7f04164d
SHA512	6706097cbfe78025ee4ee1b3aa948e357bd350e200e1fbbb5cd2f6957c8f0e004ccfd160b3e7e1fe040515afb61de7be36510be6f796d3f095cea070b2bae08f

C:\Users\Admin\Pictures\NewRedo.ico.RYK

MD5	9c9a6cd6fe2b0c47edeab0bbd232f12d
SHA1	cbf845289a256ac8e57fd6e8d657f0d086d8a434
SHA256	ce210aae65e43706fc763fab9d10bab4bcb8adc092472940ba0410c3815c9daf
SHA512	57e41955d2ecf77db8840c06d07e2496f90595ef913ff850783d0ccbd9c08fc665aff8df79e0bf409b8dee495a5889cf0622cc519bd9c8b5e09aa07c81b57e90

C:\Users\Admin\Pictures\CompareRemove.dib.RYK

MD5	1db65e339e0f87a37b6528021de4eca8
SHA1	1f52be7c83427b2002849a8df74ff952bab7fc0a
SHA256	1c0efabaf71090bfe2250fe80d07578c070c764fb1abceef0160fa810e32cabc
SHA512	6313a79966a16260b0e992230c2280a6a3afdaf40a0759220ba75eb633efe7350caf7d24a4caa4c7d22d990254235e20b8f11d060ec1deacb32dcbb9526f0601

C:\Users\Admin\Pictures\ExportReset.crw.RYK

MD5	742918488536679c9e9d88c4b9a84353
SHA1	2c937f2f3d796c2ce26fd9953dd23a6adf685ec1
SHA256	1b73422021e78af518beb684f06c9b97c5f8c05303913e38dfc218c4ea42fe76
SHA512	ac9163399092e3f1720edb2f42da420ecead3e06e65aa136021a2fa68cb86ed569dcfbe30cd8a1bf4a0e26f69f9f9aebfd48e6c4d315725493a9a650b5870860

C:\Users\Admin\Pictures\GetStart.ico.RYK

MD5	070680fc5fe9f8d5205e61624335a2f8
SHA1	82b4ce46510a7d9a766a69290c1e93214067d893
SHA256	6430d267fd055d3e26ecde5b2867cd0c75d05765a2f25f24fb9566faa85e0d71
SHA512	3b267890a79f9c3010b8f02a62ad8e6e56690af8c776eb8aac690e4f98b299d0dea82381129e103a9bb9d202a8316efe4a6241be695a638b2bb39006476ed9fd

C:\Users\Admin\Pictures\HideConnect.eps.RYK

MD5	f5c8d6b440c258e21e22ea19707c413b
SHA1	f36fa34539aef8e9f95ce3d8cc3aa52f5e12103b
SHA256	85cff14f30e49f4c3a618eae11d883595c4416b929377a50eade3b4abaed099c
SHA512	9b64ca5819f1ff898e3ff3ba60a9da60d892d0094aa36f4efd7fbda51d130040e370dde18534ff73a5f92bc9f0dd50aa10a7a272cd6b2c1934de2caa625720b8

C:\ProgramData\Microsoft\OFFICE\MySharePoints.ico

MD5	e649ef269b9070191dfd57de41c67de9
SHA1	45b5ad176e403c39fdb10e7e3436226b50a70998
SHA256	ce0019e358e9db12ed2ae92a58169c36fc56b03328f5b310909deaddc26c4808
SHA512	4297d593989cfcb09b08d73763661a40817315cdb0879cc523765cf3b6e99ba3a6087cec258cd91f727efeaf058b039ca217263c02a211b5ba506975327fb854

C:\ProgramData\Microsoft\OFFICE\AssetLibrary.ico

MD5	4852fb3a4eb987f5e7cc342ce2e140c8
SHA1	e937120392b570c660abe26f1efd30f397a98f27
SHA256	7ac2c9e8f3381f0384678bd6877f13bd7df7ca3518ae8766422126508bc73ea3
SHA512	bbef073ea58f9e02d8abe2217e3411cbf54a41e0a8e98d2f0ca947607e8516955f4a8ff24998c2703fa017354384901d3b92dc7625941b3be181c09c02c36f1c

C:\ProgramData\Microsoft Help\MS.GROOVE.14.1033.hxn

MD5	ef4e9e991325d278b60e3a221d420e5d
SHA1	f20742c5bf1112d717609245095a677caaa02210
SHA256	e211921303a5566491b4224737f51f6c9299f456dbbeb3ad3bcc5162da8e87b9
SHA512	79e285b25dd58e18994ac0c92497f1458be563aa3165cbc2b7a46137519730ec27d2552307c40a8b5c0077add875f4c8b65850242d5b07c1abb0ff88bc091fa3

C:\ProgramData\Microsoft Help\MS.EXCEL.14.1033.hxn

MD5	e9fbf7d017a49b999f6096b50be5c6e3
SHA1	e3a3161b4d55ee12fcbe38b443e0e901d0e76057
SHA256	c2ee7d20c8f87ee05a5a42ce2c6cc805b6d3cf4a2d016d3ee86b2400f88be0db
SHA512	6d880111e86613397a809a89fac48605d70501f392508dda55c867d4a6a39291a39ec908330c9a5575e61e7561ffb2eef687076b6640e9431b656f3449548980

C:\ProgramData\Microsoft Help\MS.GRAPH.14.1033.hxn

MD5	09afdc0ec332e3a70ad78c1c610a92ab
SHA1	ab945403506f22a88032bd8354188cfac715ba39
SHA256	69b5d06d9b78cfded359a0a5a3d4431be0387acec7478ae4123584c84671cf9e
SHA512	49b39c4c7a09bac63c6e9a7b483c476db52721e21f8b9eb5cb77121e514ee5786d7de0b992685ca41c228a9d260505b246a34ed59995bcb98a860a2db24eedf1

C:\ProgramData\Microsoft Help\MS.MSOUC.14.1033.hxn

MD5	4d53cfc61e71843aa3d03d49d5a39b75
SHA1	beca1f5194d1b9e92eacc67e497d8207632d3dae
SHA256	047a8b26b1bf839eb4f6a460f3d160307497a105154c05c5d0d4392e7998427b
SHA512	95e9c7d74dec808f62911bcb161e3c91c6d84cc00babb958b697516529b0896af4d52422ccc64410997c3dd3436d210ce8474fdd5d5e3ba2fa92d612ee80d14c

C:\ProgramData\Microsoft Help\MS.OIS.14.1033.hxn

MD5	cc0b95e860484c4b14129fd05c633078
SHA1	5a274c4659cd817c5b54be2f6c82af3a224c8c37
SHA256	efb1b4cc23705a9b9f5cc564c1d2e961569985181e601f386897ca4da58cd4bc
SHA512	3a82d91a1b4345a5873cdca611b41f4fe66e21ec895acbad9e1f7ea60b1f9eaad274975dee05b0da2ea0b77b8e3c78e1305ac925251129b5b5961c5682a3d77f

C:\ProgramData\Microsoft Help\MS.MSPUB.14.1033.hxn

MD5	c1450e6049ae89710b4ce872b5e48455
SHA1	8959bb35a8fa4fc15b06e9a4f364cc0e4a9ebf15
SHA256	29be3205650bc7fb507c983e7a2b6a7b25c1930a9eed07bcedc13773ca8e798c
SHA512	93b526777c56f809d1d10cdb9ea9773aa41cc9eb4dd1db756038f400ce47fc38ac8e01fba16fd7e8a496984526470bc64c64dd635f1b72109741feb1643795cd

C:\ProgramData\Microsoft Help\MS.MSTORE.14.1033.hxn

MD5	f1b3a269bc992f258dd131f31f1aec56
SHA1	6e3399dbdf664ae6c39f90d8c2afd004b6e96ed3
SHA256	0e6cec51627c51a075daaf90c46b305fcc415723d14130e5fd6b12b97b6ac5c3
SHA512	9d14863458370f445ac4239df294c752aba7c70e7dc91f5bac5a32920a91056abdc8d67427a8d00bc0c83f18ec448a29ce2dc688eacc42f9f2ee66d1c0c3a768

C:\ProgramData\Microsoft Help\Hx_1033_MTOC_Hx.HxH

MD5	743636cfc3224234f2cb6e8eec212438
SHA1	528ebfa1711e4b3be0872d815a54350d528d9e5d
SHA256	6c35b73fcd6f543039de1da2200e4e06fc84f6be9b764190b1f34afd7d963408
SHA512	927dcd504584d7641389717973df12134329127aee98180146790d660ba7658c26be4b0c898f5f99f935041f55f9c8db2c24023e4232222944027633391d9087

C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg

MD5	50aebdd6fbcf34bfb5792a3a1f5f3a7e
SHA1	0634b1c2f10e38c906efd2dbb29babca74fc48f7
SHA256	fa7f72f8c4311f668f8ab4303427b480f893238034dbf100d7820d15a5724456
SHA512	6398ad359f0c24a1ab62b7d668dcf9930863ed180a2289d7fe20e05d02dfd19715740a8a66f7ced4c794dcb97a582dcec99404e571bdc632e34cfb180ef24608

C:\ProgramData\Microsoft\MF\Active.GRL.RYK

MD5	6e059dfe74f744558e25d8f2ac3d99b5
SHA1	b10d4cf6673d90296cee7a0bea94861fd8226f28
SHA256	fee995dd11d7ceaf5a213c52f1a17e226856a7f292d4df6e16b42cc89a8d317d
SHA512	4984a4bed7d11f8aaa6cc68d257b2f5c4f53d740c240b7ec34385a514c5b1d6ba74e0a58ebbefc66650df215aa9eefffc355b591fe5da5ca8301d39870ea71fb

C:\ProgramData\Microsoft\MF\Pending.GRL.RYK

MD5	9985532da2c82a576178f75cd9f13b0e
SHA1	53abef4e0a79d0bff8841139f4f39514097dd054
SHA256	1639191c6d9297a3c728584d765f22931181a500cbf6ac7524c90769790d7f7c
SHA512	7313d1bb6d94d116f04efe073deb1ddfeb38406b16cbb1871ea0bc11468f4724e0402adc631aced58957ff232cd04a381c6e0f95a789c99d9491eb6f79883a9a

C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpgn.RYK.RYK

MD5	b846a0b9d034eb7800e2bc26a72e3915
SHA1	6f3ce51c14d84c9d6067d3097b8bc0e22e2e492a
SHA256	de0a07db2c47d23e1e00a99c95fd646a05638462e3300bbc92130abd83fb2d6d
SHA512	9ec003f7f1c19f5e9245cb24c3a31b8ea961bb37a7ab8a85ae7cf47e9efeaabfaab6c396844a1fb22489918b3723683d7585f4129e9e6b301caa74d1cd83ba72

C:\ProgramData\Microsoft\OFFICE\MySite.ico.RYK

MD5	5087d193d81a62f0865732849ed078b7
SHA1	080222d9e63e13a88324b1457f13c78d3c115813
SHA256	e59a4506240794022c758eed69e87131967f52b18a45f2b9deda9b6b7b34b6aa
SHA512	57ced6ae0dcc880ffdb1b0396902c0ea2b6168bd42d4b66250ee3330f7c67c0fd9752d3bbf1a9ed8f49bb8434c5e69e16c911d5622e478c693789a0538ba872f

C:\Users\Public\Pictures\Sample Pictures\Penguins.jpgxn.RYK.RYK

MD5	fd33971577a437e61d2ad47ac5ccaff1
SHA1	8add7afe7a2c021c1b7df73e683a440e01c2aeb6
SHA256	baa1b1b982727b9c7a29e07c512861f3a93f7f4b70831d2c63e6654b316bf1b8
SHA512	6122656c4fb9d462ae0863cd64f79efd873a9b195cc783899ea91440ac87ef0deac92918c60138a6511c539ab2d8cd8eaebed071c06bb02d7542e8ab0b015949

C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpgxD.RYK.RYK

MD5	a4ce4e271feebf7197a9bf928acddd75
SHA1	015442e3ba30aab4d5d1b98972551e5fccaf72a5
SHA256	135c8482314b815d0dd3664465acbbb48569ecefadcd10f03a0ac83f436b0027
SHA512	6e094e8f84d82133e4f0b04dd5a03c4aea8a146626ecdd44b0595a17dd5368894147ed3249770ffe1b0e39837fdc7440e48ddb541193cc32e5f9df837387b033

C:\ProgramData\Microsoft Help\Hx_1033_MKWD_K.HxWSite.ico.RYK.RYK

MD5	4f1204399a6608cf7c26e368ced5418b
SHA1	8fe47eef666f9a94f8111eff009ce5c8ce0263b2
SHA256	57438c417d5c63391f32f80171d6dcced44e46b9657b199b29f85c2dbcb77438
SHA512	1e3bc7c08b19ed802873fba57cbb58ea157ce399b1edcdb7ae5e300f5ccaa07dd540728c6329017dc7439faab0320e69551f2b959d821415c1fecc1451c1ecfb

C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat.RYK

MD5	fc3916f4d58d1fbe6a53a9c56a7debaf
SHA1	5f61ddbdeecac8a5af10c1e2f5773fcb0ddbd8c1
SHA256	a4e536b953cad4237053e5afb8240183db445405d3766bba01e4fbf9475cb151
SHA512	384540fce28efa75ede14eb2e65ceb8ec8a678eafc98818c467b736b04ffc4cb8380ad3451491e7ebe923c2a5584b0e6216821d3a5e3b8b5466be05e2e5308e6

C:\ProgramData\Microsoft Help\Hx.hxn.RYK

MD5	4b283fb75aa07a4d003c008e1b3232d7
SHA1	03638cfb4a7f819dd181e98f91aa06c612064996
SHA256	bde561add9afab114628d07c77c5343587a424989b841b18e9e3cd754ac879df
SHA512	fc0b90ccb60eed630634eb9cae63a3ddedc61b920d422bc506a0ade1ba50aa22a6f4713594f292d3bd742f3f77d6c89aed51322b610455d93d9ab9840a576682

C:\ProgramData\Microsoft Help\nslist.hxl.RYK

MD5	ffb93be6d56a7cbb7f71bf6310cd8cf9
SHA1	8ea96776459accd6f4ae04639412d12f9d702c40
SHA256	71030cfb9b8a729dcb5a95b99ecf260ebdeab8748543a7fa48ef9e868ae9d043
SHA512	6c2ae39e930ec0be71969d7a96902fcf9783e8c415decaeaeb6b466a07b337510a78fe56c96378ca7f1213896378c7e04fa556f02930b0806ebff7c6033531cb

C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.RYK

MD5	b1edb08133b27d581d8131760073941a
SHA1	323a9c9d48080c79616a5ff34745ccda061a8300
SHA256	96288db3e2ab5f1f950d76c681abdb9552f5c82ab495db89f4ba59eab1bee4dc
SHA512	5645f0ccebfa0f2390435f4043397a4c3545c3ff3334adfbe246536c2d9c066cfb2a4ce2af07c800c4ffb85c28617538f1ca30bf80b524edd8af60e1de0ba0e8

C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.RYK

MD5	cc3f1ec7c58a9fdf062733b36084d6ae
SHA1	603941891a632886d0fce1dda12198365d024469
SHA256	2ab0e5cd357928a636a67ca60a406a8725f667291fcf59337e5dfb420ca253b7
SHA512	61d6c35ab5e3ed367d293d4705ab0dbc3cfbaf8b3c3838ca85e2cc879ba9b6bd56e6d6ebb6afa7f2ceb3118dc7935f3a03a4e840541344b046d536ee25894e70

C:\Users\Public\Music\Sample Music\Kalimba.mp3.RYK

MD5	bae0298acc2335b87c0f8ad4b53bc181
SHA1	19d2efe0930acb9d80bebf785f69d2a351e00233
SHA256	4787390964b6fe1fa9c09dc9e280ad65eacee5ef2a057bea0785907e9db92c26
SHA512	2c2d173355a3467ae3e8c41fd9091424b35c191b0c5b93c6e50623870458e13d4255954b454fdb7d0350db2ac97eba2874abe82ecceb7222bcd28b11d7a61f37

C:\ProgramData\Microsoft\OFFICE\SharePointPortalSite.ico.RYK

MD5	654c134de167934c866337ca1e648646
SHA1	6ac4b99735d2c32c94b60f38f995e028fdb6b65c
SHA256	4851a5ef1b4329d767df9846babac69193482cf81636b0a6fce569a22a3f4f46
SHA512	59bdc959515d15766af3fda85b6bb573c00fe5b1df4aa2bc27a754c7ba6c0506396c418385b3b008c5060a90b693ce85f2ac70194804e0ee4d58c9230ca5682d

C:\ProgramData\Microsoft\OFFICE\SharePointTeamSite.ico.RYK

MD5	51fbddfe7c51f78792b2d1a018cdd444
SHA1	d0a0970c230a69d759fedb1c25845d62692777e9
SHA256	927f9eacb23e070d8b0306700098280fa4d67acb4e2fe08a0d9eee0840ac9fee
SHA512	da5297e66b5740f7dd2c0a45e4e65a51edacfce56a3fd0d711483764982ad3ba8cc160ed673a0087a556a3f36eb6dc7864c3f69c574abe887015b33b9731147f

C:\ProgramData\Microsoft\OFFICE\DocumentRepository.ico.RYK

MD5	9c79705851e51b03b2c248a60b59c47b
SHA1	b1950091538c4d0f7df96098177f84c133eb28d6
SHA256	7c864bd4a0024c09a823f361e3b8dc714ec8ff49958219f5b95ed9d0d76e5f77
SHA512	ba2513d6aaf6b264744659e5a86da426a8f3e77d30b2587852dde33f6c57002c22bbe67aaaa5682ccb8af7dbdefcfe190615db162e82c6584cfd8ec370fd70ec

C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.RYK

MD5	b1a4eb9694e9ebdf21b1f841974c5d2b
SHA1	065b449721e73dfc4159ddf889c95ab3e79487ce
SHA256	e6ac06f51aba5203a1c5117764830dc56e66adc08d288752bc5784337913382f
SHA512	98ecd11bbcf91204b5d8151bd04934ff375f5f6f1d2bd1ffe2f96a3c8dd5683359ac26314a3aca0776fa377f3e69ef23a0479e910c1c217ed0f43f062c58680e

C:\Users\Public\Music\Sample Music\Sleep Away.mp3.RYK

MD5	32812e3d29ebfeda0b32ee3a136e4b64
SHA1	a80592aa092f301a745e5376a3f45fcb738e5d15
SHA256	c741e4bdc56715cd19d3e465c2dbe88c85b73a49ddfb47d5039d2bc5ca883cfa
SHA512	4242874af3ec5869eb3d6679d237907fd20148a9bdc15e9a58e6e23b3efe1d56e8532a0f0d05679ace0b11bdbb86b8fd991242d48fa1f7c398a3565150c575dc

C:\ProgramData\Microsoft\User Account Pictures\user.bmp.RYK

MD5	64e9b0319563618d6be2d8fde0586004
SHA1	2708edfe3b0b2d267324ac2a95bed5e42a8cad04
SHA256	9cbfa07345fefe992992f8c600f4fb8aeccbc491433cd813651b03219fcfc01b
SHA512	ab8048bf3bba8cb317cbf9ceb105b777d8c2454c2b4823d88f90473cc16f390d247b23617c81e3042bc5fc92f1a226169d4529e4c9dbd74dc3bfa76028992285

C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.RYK

MD5	a47a17bd8328ef7cafa0cb546800e28c
SHA1	c949ebce7b72f24f476a0016e6638631c2fec3f8
SHA256	e0bd9255682167eac5cbece11dfc580b5cafc64e7b6b7cfc9bc49535e8e7dbdb
SHA512	2470ef61b98486fc29682e7680393d2fe13b0246e484c39407cda15471f22ef0d0dc9c95e5b2285aa1843c95043abcb0e3a2902f1b19649857f5783d8b52d257

C:\ProgramData\Microsoft Help\MS.WINWORD.14.1033.hxn.RYK

MD5	45ae37189757ef63bd2ce67c74221bd7
SHA1	6f02c9d74190a80af06be9ddfe764c6289ad641c
SHA256	c71f9dde6a2755e7195526db4a64a1ded236922c8cf9adcf7c0c5c850778943c
SHA512	3e22afa7529101dba6259accf0bd1897e3d6b4c44533f84a118f9bf7dffca781fac280ecaade5b5d799575c7939356c286fd627b7bfa1325ec4e0e9ab670b591

C:\ProgramData\Microsoft Help\MS.POWERPNT.DEV.14.1033.hxn.RYK

MD5	ac93054ab5644b90ade39a14ad031885
SHA1	49dee60651bffedb8d040d0ef7070f130c989ad0
SHA256	daa8931a3208ebaaeaf3e0c8d5335b62ef19726b3140a95f939ad6433e4fce70
SHA512	fcc3dc1907f4df68b8def41172c1082bbd2c42d6c4d4aae8879062b6718f038e005f7a2bde9394e5ca48fa308591672af84c42cbdc9dad21e242b025764f620c

C:\ProgramData\Microsoft Help\MS.OUTLOOK.DEV.14.1033.hxn.RYK

MD5	2192e5a721c07b9b0b6572fdcd15e34e
SHA1	57127f4ea50e972a8ca52e0bc36c047578e6bff8
SHA256	ff2bcd7139e797ac96149b5af8f177c7f18843b218314f5b7875916b12c7fec5
SHA512	fe1474c51f38912cfdbef1f7fdf11c227e68dfe522ef6188d3c38ca33f6b7e6ccc73bcabfb401ad0f674d05ad3bbf2ab069d1ec91b47965b55bd12a064de8c1f

C:\ProgramData\Microsoft Help\MS.ONENOTE.14.1033.hxn.RYK

MD5	3dcde34ef765e1592144026c6f17e2f0
SHA1	9e91e5ec2f809b89a97f0f6a2c898657747c00c6
SHA256	70d4de20da63251b18699d6087e432626fb36bb45e817a3a15b52cfe9c0e9101
SHA512	73db944906e542bcc24c3a8f5b09a7ba8a67dc88917427578e2aacc95bee0bc77f26048c34bac70849037062ff54a3c37182c94de1d9d405cd521b4c167002c4

C:\ProgramData\Microsoft Help\MS.MSACCESS.DEV.14.1033.hxn.RYK

MD5	8063a439719fe7021e518f484996add1
SHA1	386df61d6cf3a53ee8ab8575bc90faf2467db8af
SHA256	dd89758a7a348b7d9c5652e1681183dfbfa7bd7e97ce8cf2ba1efb6b45fe4934
SHA512	441aa09e562b01907f8d0b5ff87ec383c086dd8d3aea29134cfd37c76b610112fc0abc52c81f50e256d87625a90dace2b2498849b7b18a34472b3006f117a233

C:\ProgramData\Microsoft Help\MS.INFOPATHEDITOR.14.1033.hxn.RYK

MD5	e4857df618cf8d3b3af7e6a25f99f3ba
SHA1	c213b3dc513f4db92cf2e6436f4a5522789ccf23
SHA256	47a73c8aae48e199ec842ee617c02c67e2cbc903cb76b13525fc2d32dcff3209
SHA512	9065fab98dfa959568e96931f3e534bb15c038d6f6f9be2f33c127de8c4ac643effd11459cdcc6bea836a5a4078d1a5720a3fcd3117d8a3241669dec8d1e2391

C:\ProgramData\Microsoft Help\MS.WINWORD.DEV.14.1033.hxn.RYK

MD5	ee6ecb29d852e772d491c75fdc5344a2
SHA1	ede28bf0a0e7726f95914f10ee9b25527e84b343
SHA256	4b24aac0cf43423b64a216aa48126d72017cd2bca28f547947fbe86308e7f544
SHA512	694a0ada31c3ed606ab1f73e81826737b61d3fa3db4a4d1cbdec8e1cb00cf85f7929abbac4cff2d772e3af4e61150134a8a14ff5285f2a309df55c1111018a3b

C:\ProgramData\Microsoft Help\MS.SETLANG.14.1033.hxn.RYK

MD5	3cb0ccdc9a50c485fce12fd00cc7c6cd
SHA1	31102129cacb1bfc9791fe400b20879833bcf35f
SHA256	046ab1c2f4d8368a1589f72ff79ea724a9d919cc3963c50b47df262acc7b85a5
SHA512	d884a40556f30fa170d006e38a036051724e98787ee119c9c83d9c39c9724becaee4eaa384c56e42ed51fa1ba4a5b30d701d9b6f824f2fa7ecf3382c2d4f6541

C:\ProgramData\Microsoft Help\MS.POWERPNT.14.1033.hxn.RYK

MD5	271cb4a341b7cff73d11584a816666ea
SHA1	e95351712c951dfa7894e0fac12d717b91627f16
SHA256	be60dd07c4096b847fb506ffb42f9b6cb18c16f781f433329df2590761a06081
SHA512	b0296eb74f9f59279b6d2ebbcb4e48d1cc946f32dc0ebe48837be6f76942d8d62af6d88d312e86a4ce3a989ac8525442317232f8bd6d7075145bda3e4d146390

C:\ProgramData\Microsoft Help\MS.OUTLOOK.14.1033.hxn.RYK

MD5	e049ab2a0f41f891fda4a57bb03decc4
SHA1	a16a9d81c75072386896a152331ef713990a8024
SHA256	b3217fe15aa406642ed125fbd7e8ac1bddf8069b8efd9ca060a2bb96702a80d1
SHA512	56701f2d44cf1d69671599d5ceee342082f10d292813dd00b0da7be1a4401c55906aab895357ed88a89139d1b717f036164bc87197119d57e3a72036222cdf05

C:\ProgramData\Microsoft Help\MS.MSPUB.DEV.14.1033.hxn.RYK

MD5	ee01199410c774d81df9802c07bacfa0
SHA1	9ee91b1f51f43ffd24d31bb4b557eabf502f1e98
SHA256	6050da57ce6fe1830fb319e1decd661969e7aaed93eee76d239b6f0f8a0dec62
SHA512	796b6c7ce396aa6c7423e4f87a2fd70e398d5f0f49f0e0c388a5f7e2ff4d416bdb3652a22c475909f41c5fef198c346bd3de1cff3ed145e07cb77f5d9892ef44

C:\ProgramData\Microsoft Help\MS.MSACCESS.14.1033.hxn.RYK

MD5	3cc72ec63bff9e10f3f503556dadddab
SHA1	1f72344b948710a7e19ac0ea86f63e686cd01ed2
SHA256	a8dfa602712985569873e07772fc1497fd8c47f5d85a0d0a48a97a7634d9e8c2
SHA512	e89e62320acad33c3593373690c8264b0e7f36dc2b374ee176c27d246eb66300814c47f4702143525950bddc4283e0b9de9a6b5795138f2302dd492e37345f15

C:\ProgramData\Microsoft Help\MS.INFOPATH.14.1033.hxn.RYK

MD5	63924dd60db8588fafa623b670561705
SHA1	87931467c5079b1251d5d6ce6ee7b4980eae728b
SHA256	9c2c863e31f9c66a5f0d49b2bc17a1ba542381b51c10b2906b2a78290f95e556
SHA512	5616b2fa339431ba34b4f8ed827d5fa3b74ff457e6c452660fe34acdf76e3c417a77f150e58ad636ed99ee74fe8b1eb86b15c1fc1d80a206eece670c6fa73205

C:\ProgramData\Microsoft Help\Hx_1033_MValidator.HxD.RYK

MD5	4dae19d5459f29b11c1e7cf9c448019c
SHA1	f435c9fc64005935efffffd93acac0295a7220fa
SHA256	7792df4f4136f9f4fcf5063e9034391a12c31b74c026773571641c1478d787e1
SHA512	510f910634358b6b7d47016e3eb9845402a4e514b103ee53e72d8b3c457718452ee88f3e1d97d8d5c6f011b6f21b3b1c3d682f395a74afad6184ff52d9f39c75

C:\ProgramData\Microsoft Help\Hx_1033_MKWD_NamedURL.HxW.RYK

MD5	c5af3bdf4182800311e76de324fd3cca
SHA1	c62529aa3a6ce4313811df2b1f219be1b6edd5ce
SHA256	00299e8027bffddd5a34942e7f8890c8fff17831098abb0d024cdc819fb6eaf2
SHA512	d62c7e2482da9da5e01e8eb7b864e1b279bc48885ec480250d5d7079756fc346dc232d459bc5083d094668310a10e2dbee886b8c8a637b843bc59f6c1ed0433a

C:\ProgramData\Microsoft Help\MS.EXCEL.DEV.14.1033.hxn.RYK

MD5	3964b9a381e5668d63104b4d309f0137
SHA1	6992d3aadd01dbffe43b8192b80e8a5096e56336
SHA256	d6e08fe722a13ce4864c7c738bc6fd5d01e20b7ada1fb1ffbf75f851f857e566
SHA512	500f5bdf1b10e60d22047bc967d0bc247392f3f9c564b22fed7bac7ae7ab9ad57c5cbac334e4549abd450347c180e52e176ffbf70c37efdf0443771294423a5c

C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.RYK

MD5	70d36a1f53b63a79463656e1208a908d
SHA1	abe2812d1e7a0e23a5fafa47373c69b0061d08a7
SHA256	5768919fe5ddc969aa41b7371ab68d74105ec89300786c30dc56c5cdd21cdafe
SHA512	0177e11f740c63bea581dd4838384de0c25d10ee2e1d2aa1b93147a500cb77e7b8a02b70f464c8ddaba51787ea729b3b3212ee96a57b68dba67ab3bbb0e20e8b

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MValidator.H1D.RYK

MD5	1787b93e9a748c1b0fc17f4cf2868530
SHA1	17c6c7ffa50130f69168cd636d058bcf76658935
SHA256	fb213d295d063e78827d0be6f7598b3c1fd332c64596c25b684298a123be33d3
SHA512	e762be1c186f09ca0e3cafde19f54d8d6eb7b87f708c1b191ebd6f3d07d1248bb6c02787674de47d18b86b28d014486da6e46eba74c73aaa7106ef164fef6eb9

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_BestBet.H1W.RYK

MD5	ab41f2f4ad58cb6b8af55ce34f89a60f
SHA1	79c69b054501442e36cbf3767f7c4f19a626948a
SHA256	75d95793fcef6800ee5d8efdc6d03afb96ec82e6518390e0db588907fe2e420f
SHA512	8d757304c2b14d5817b335232befb7a9676db075abaf0ad397b0ecf6f47b6000f4a9989945eb97d009121af85e2098cd100ba77a0fb3e93a723e141bbdae62b1

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_CValidator.H1D.RYK

MD5	c7c2304fa3bd7987aa4b1fb2093d7685
SHA1	925c564b0dff029f1394009bebfb122025298d63
SHA256	e7e3c5c2d9f80d97a10b25ee5bb62e2439df7fe29f83f74f80e4b23387767093
SHA512	b2a24da7030ba05115fa0455a924bc261c9c55c765db6043736a3d8e72add7a3617b217bc457f117f32d51f47241236044f49eb46077f8be01fc7b99bb79f884

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MTOC_help.H1H.RYK

MD5	a21e4873e4beec804d81cd9008fd48b8
SHA1	4f0304ed2d49d9d47d18ba758f91d025fdd0a274
SHA256	9308d18e685b9754310b913c43fb915fc53ce9d3c0331be6440a65b11b7d4a06
SHA512	26511f4865d667caa8a7fbad10b79f194e16d6f8cf00f16bf19ca1bbf09313224dcf0f06ae8dae8a9f37ade7904813a66d1962176f99d8de429fcb777c3478cb

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_AssetId.H1W.RYK

MD5	86c4cfd2b1cdb6d23c9c35567bd23b98
SHA1	adc972745aaef0f4618d9bd1ddb464b21a7c697c
SHA256	e58357db3b2d527a43040ca576fe454f39ddbe8a71e9c5c83283e69731adb279
SHA512	b5bf9690f1fe6295e1226ddb648a18e8df0b601fb02e23dcd00fc363ecbe4348ed81c3db0268e9b8dcbf85f64a44a3198a02bfe29b01a02253ed81d52c6ce6f6

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MValidator.H1D.RYK

MD5	78b02cf440cb8f4d624d56f580b2f718
SHA1	26e923e41dab5425eff40dfcf3a35ea5e75acb45
SHA256	aa3e5cd428bbc8faabc6b4e4f4d8be7b38a2f18e189abac3484539005cb6c918
SHA512	7122c28ebe0e7e355d5c68e672d95ad588503a44ce7561dcc292369c12893805b5d45a1e5b1d02aa49db1591d13feff6bf203b33d0e701682397386900200904

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_BestBet.H1W.RYK

MD5	8670bde1891bf42ace589bfffb16c729
SHA1	884527660697e25dfde742b163b61ba6eebf442d
SHA256	9f910d68bea7bc7d57c1d9543a5c00eb530f54fa90aee52273edc1328e77d5c5
SHA512	c24c5b280328dc3ca99b435853756166d3a15b54e25a55a64e2b949532d91865a5462fc8b568bc5f14cf360aaa94cc2768c4af1d8254823218ec8068e287527d

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q.RYK

MD5	819727e697405a01f2c79ffcab23572a
SHA1	c948f71afc4cc7df3de96046aebd7c08d874f3ea
SHA256	ac3bcb603528741ea98e8bbcd2af0361e613a09b9b0921ae6a11a0a2898ca1e5
SHA512	c9f908bf22110c88849336c27a763119a1256ec227d4fbd370a839491f0dfac3dd808db20027edd5ad0ae7ceab76e580b54f03bb76650b898d405ff72d8a98bf

C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-07132009-221054.log.RYK

MD5	1c3d39273550c4f449de035988a7a4a4
SHA1	9e86934cf9cd2101b89e9906c79190240b57da38
SHA256	cdfe3acfa5caccb2ade0e609f298f8ff173a0db6d5eef55dd07f55f3b73f47e8
SHA512	528e0fac862179c3a7e9148846c70bbe557987040d72f6df045643204ea1b90828eeca2ce9fedaed8d01d79b931acd642d3b88bd0ff64cfc95272fcd1870c7ed

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_AssetId.H1W.RYK

MD5	ca7dadb18cdd9eee23fc8d4cbc344163
SHA1	2d0d1c4788bbf24f3db30918e7ea2eb2cd228bf0
SHA256	9f12b3a10cef55ccb6b618f908ba32240bbedbe7b0b7d2a1331dde5f553c5ff1
SHA512	dcf6414381ebecdd73529829325883519963ec073046a9b0f29d18ef03391367387db989f82a917429018b07afc2a934c66c61687ea761b2df6c107316478c4e

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MTOC_help.H1H.RYK

MD5	f507de4976a94e8fb1d66e7301e0b804
SHA1	be909492973da627ecb5a9cb745473b6acb3b4ff
SHA256	e3ba4cd15a1c95204b6345cb746fafeeda0e7d8efd24c5af56b009d289554494
SHA512	82eeb7ca77d172e50adf88e54f0b72a3f1ceef14c79b2b7bca4f526d2c257cb35020b502faf848e0570ba5b8cad9a87a55b541b3f2ac01bf0c3811fa047459c7

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help{7E352021-69D6-4553-86AC-430B0D8FF913}.H1Q.RYK

MD5	4ad9556eae7bfdc9346c9ab644643874
SHA1	0a04ab5120c43848a0aababa3d792a261400648a
SHA256	7487dc8bf0f0d3d5ba4f2cc38f60cdb15697e48c7f941eb7ae3b62960d024c3b
SHA512	76550aaa00ca6d76c63010d94e0af1b2f9a9d705b5dc72597797e15f6c69825887e75bb3908495115742ff1659c3dcb8f02814afcfd08a01d9352e685bfdd80b

C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat.RYK

MD5	365460f896ad1ea0fe4e105a74046804
SHA1	a5e3d892781ec03c0b16b28a16ed480f77cf0228
SHA256	b8a2d376368f8354f1012f0185ff6145ccb9d5970f0e33b88bed354e3b6d7f2e
SHA512	1c0e2d0c88d01c292610fa4f6b3cc9a2625bbec74f2ab463879336e2b141293118092940e107e6b94862d2988ed105c09bd3d71698f467bd9e62a0eaff9dc1fb

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help{E1E8F15E-8BEC-45DF-83BF-50FF84D0CAB5}.H1Q.RYK

MD5	21153be0c51dbbd35dc9cc6a145af2c4
SHA1	75bb728698c4657865fb8d19b50dc79db8e388b4
SHA256	2c36dd575a76786a486e901cf9c3d491afcf2d675f589081184e78885ceab662
SHA512	473c137526fb115636656e4984e98136c8531a72a0d10c96c5dd9ee42230b74c9e7446745dd54cc5505d02db1acfc2d0791c93ea1146dd2df992903c592d7666

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help{92F2118A-E813-4A4D-9DE2-F96A9DC02C53}.H1Q.RYK

MD5	b446897acfa79bcde9147fd0b00d0276
SHA1	82c873a84a704753c5d2e5db083a5d6ef2ea9250
SHA256	f9cf75411be3004132c2834b885525de0baadb373011d0078a63659226db0525
SHA512	499460adcd84380261bf76fc79bc4b287317fd572d97bac6ba1fa12b366ea2eb12b0a9e7b1140d219354d661b349a2c02ce95cc6bd64ade23776557a64c81ffc

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help{68DC71DC-2327-4040-8F03-50D6A9805049}.H1Q

MD5	55c008a04be9b2109f3f80b374a832bd
SHA1	1193232e028bc68ac7bb7b78485d2a7aab1f08c1
SHA256	504b4576a908be8cf0c88de1e3062ce61094cc571967b55bcf2fb819d8cdf092
SHA512	d1cce4e83ba91c30d9f2da4d5a0a8ffaf10b34ddbc6dc56d24266c3baa6d38c509812862cdb54a7f0592b00508c2cae9107bd1fc0a1ec0d9977e72a19c228b9b

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_CValidator.H1D.RYK

MD5	a1a9286ed4c430ee96bb8e34e7325900
SHA1	2d4cec68fd1f1265ab136ac7526448ef0cc378d6
SHA256	219c684ede0d1d7819ce3932d751c467a6bc6b9674d8e31b8ee4203dad604dc2
SHA512	1193bb63394348ab9e0485064af9eef1d6ad284ef08fb736b0527cdfa6140c84f0808c5690b274bfefa177f217555d983011a14a9453242c26fa0e64639b4cd0

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MTOC_help.H1H.RYK

MD5	6b2463d8a7e7a9d03de8effa42c8159d
SHA1	fc9cb905b83707062b7febf1fe8add88c313b5a6
SHA256	5c7663df69d50b983169996b6a0493a35eeb23aacba0e8c89ef51ce661c21f55
SHA512	b3e3364e9aeb9b55e98d3e0eb04c2928c56e3ad4f20bf852acd84ce999b7d8777c8b2f27f61aeb6e6965b128c5f3a1d8321183b81d53e19b4212b80a0a137fca

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_AssetId.H1W.RYK

MD5	061f9d8dc899c9911de05320954376d2
SHA1	4ed4daf53941c87edd9c007ac1bf8c998462975d
SHA256	6f7bd159fcbad1d295febea52d15c4ac5a2c0f526f4e2f5e611ce52d3d30b9de
SHA512	02f80fc47fdd4eeea7cbf33aaff058128585973e079b9207743c00e80770dc339ce441c4ecd8f8c2707a2f45d143f4831553a68526c0c89aa6e5f57034c5f8f7

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.H1D.RYK

MD5	432dfe2900c65be11bdaf142fecff1eb
SHA1	acc1f316cada6858ca08e7dc36b8656a0bdda172
SHA256	d29b17cf51a9a506f66e7cfb37953567780f2cae134e268baaa67268327b2737
SHA512	de63ad2bea56a7b368dad0be5ce59a4130933ed7ea2a7d4222efe3a7a68878b27a73d15db60b1e47165aa34770d17559f20b3d9117b7e20f08d9c3aeccb2344c

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_BestBet.H1W.RYK

MD5	cd1b92a0c88e72d513ca85a6de5ba16b
SHA1	5398613ad68c24594343a8074f18dc7992cba1dc
SHA256	0c7918f2d5ab264b74308dbd8d5ed5eb7f170d2ff53953300258b97c58359c6e
SHA512	d622600df7e3b3ffe974908fffe5027ddadf90176ce2559100085f3a1a2a71bb52cbc103e98b50e4cf24dc71bb4b9d4f1d8ee31c75a996a05b5e47f03fe0dc27

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D.RYK

MD5	edb5de7f1b1608131351c249e72b88eb
SHA1	1a3c287281bf31eafcffdd02677aedc4fc106354
SHA256	c352579baca08adb4d3032fcb3864d7b4aa841a1878bb1ea3aaade1e837230ff
SHA512	17bf20c400f415eebb836a64ac1a94cea669b6aaaf19c77d3280e78e6d1072321643c93a80d6e83b2f61344b2e635c764f30808267aff56dce35b1f3f74d474b

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MTOC_help.H1H.RYK

MD5	840712ca7a8f9052a7d5856f95401a50
SHA1	3fa450f3813c68f6c4d721b5ba1a6a09c10234cb
SHA256	94331aac13c3bf2304d40c2be8e161f1dd701a195d4b522a1900858a6a023b84
SHA512	4bf3f0a518cdb875b7efed712c474238183520aa7f09051406d2cfb72f63039a8a453ed1928dbf42a64f311a1e5b9570498c03c7c8959db88081a59884476b53

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_AssetId.H1W.RYK

MD5	48e7e2c9e3388d52dba6e5d901407fa4
SHA1	676d7ccf85b3d8a7435f5878030699d032d57a16
SHA256	9a08c3f335d6480b54e4d926adbe7e9f5735ac0d94047f1d38f79122498678d9
SHA512	cb8ef10381567d5ba80af1b5a5668d49fa6f0f95b26e1da4a560ea2afe0ec270aac0cfcdfec7a1fe33eb8b2cf405c0d8f2e4a9e886f46a4d29233fe1897cb75e

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MValidator.H1D.RYK

MD5	1fa23f5f5736bde29c9446f8058cc5ee
SHA1	0de4e7bced53c3192deb81de2fada9670bcba555
SHA256	b2f637509e3022bdd79d6b992d30458f2d1a08b36e8f7c9895c583c0b1328555
SHA512	10cc5f2012a467144bd24e2b5325deca6f625d011b3848bba0c9b8f69b956acb61b5dfb090a8486d9b280929f9e0612b24f34ac898d817005a57d9b67945e40d

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_BestBet.H1W.RYK

MD5	a719b2674b1608202ff3a822a43f96d7
SHA1	39185b7844af4c0ab45017f44eff9f1a675e2ee5
SHA256	1a96f8ecc68da1e91655ed8fa7712f76620a4cd11e43d11e1d877c4e0e019851
SHA512	ce25b28e9a74101b46e2f9efd11a88547d3ea9f5b42da6c5d082ec62cface6548f569b9c2a55bba0be22ec9b5d0802c5c4e86d8d0fe09b4e0ab3c38a92e08c38

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_CValidator.H1D.RYK

MD5	5135ad4951404a3e53505e08ac064b27
SHA1	887aa71e5ba5fcef7df3ce8e867f9c8ff77bebe5
SHA256	7152e25d9d3a6305d93c6ccecf8d5ded2b5a0449ff5886768364439b023439e7
SHA512	23c5b9a2d88e121cf8ccbd23142614bee1baff00f3aa8399787bc8652ab7a14d2c2a55350da491600585145646501fe098561d4ae2db65a0a141fe633ccdb533

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MTOC_help.H1H.RYK

MD5	fcc883b94f66f07027344e2112ce236b
SHA1	8f7d1d7b568f3ae9259c072faebf28c574d10d30
SHA256	71f1368a3c1f35aed22a2c5636a7ceddf57ced93c5f3569dc8ecf10cc93ddea3
SHA512	278a18bf4b900565851c9b80ac327700bd401be6fa2afc45e32230717f13a162d692e7b0e49b45efbf1b0bc47f4ed28199d1a6055844fec2562412a1c530f8d2

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_AssetId.H1W.RYK

MD5	8047daa70806b69950f67f578f9aaf5b
SHA1	3ee9d2e8e7f27cf9149d62d26b7cc1eaa37f9028
SHA256	ca86952c02abba6c9c73594211c339a170a60234cc3a2d0deab2eacb93e5940a
SHA512	359a5c5a17638f22d7349438544de10892868d281aa41b4617e739abb3aef5c657b00f8d721d00883cfdbd65d43c5bdc781459d79b0f95f758680c0bdc0da758

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.H1D.RYK

MD5	69d7af9db866bc280dd8e26f9b9e48ee
SHA1	8dc4f0f6726a6af229636d3a5f727f1ba4c5647a
SHA256	65d2598fae5affd3670468d78a08783f0d7bf11cf5bade7a40a0310f5ed21ac2
SHA512	2d01d68e2aa3559e49905987f273ad1df34cde192a6f4cfdb00235a9b410cbdca480b178f8b267cfbefcdf8eb25b726422a233554a7a5571e83570ce823d6193

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_BestBet.H1W.RYK

MD5	caa01757ee000e95727ca45c9843e6ab
SHA1	fc4f3c289d9aac261ad31fc2bb23c4ecac14c4aa
SHA256	e783d069e225a0f0bfbfabdd1a531f5a386b14efe4c437eeb2899f402b3ddbf4
SHA512	8cadc2e7c9f1bd05b00e02a2a75c0e9c0074a1ce467b62c4c4d4945c1aa945626c70ff4c1ca15c0caa6708af4f824c04d4dcd96b8aa45363972860bc67f09b90

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_CValidator.H1D.RYK

MD5	bc5187c1e1cdc410ac7a85c57e5ae1d1
SHA1	c38e791d065510c58f86fcbf60c0ff1fc5422f19
SHA256	311ca9da1b14bef5fdeba917672c41e18ddd306fcc7b139f6ca9c87b46742d92
SHA512	90b3932907063c75027255b76bbb30c5dbd7089efccd7aee90e944cdbf98a270023327ae17bc39aa27ca665500511aa4f2bd2ed418f6367e69a2e2bd421477c8

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H.RYK

MD5	ad9b815fa981525252fb2491a7992da2
SHA1	6821b81afadbc2a7c7b5dbac5643afc7ae1d5402
SHA256	dd2eb639b102bba5db9360ce5b6f6cdc557150ffd8818e60fea9b38e6bcd8983
SHA512	451b47103387a95d14435e54b6ca56140cec5c7596d68242e48b6e131207f51323e2eed8a64896e6141580dab41ba7f8142dc31356ff8a725aef890a92052a50

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_AssetId.H1W.RYK

MD5	7c4c64b0567ac43c2a8f5c6bd445262a
SHA1	f07639ad337266095b4cecd18240bcf76a3a2aa4
SHA256	d864bddc0064eae9a903d14707070cbabef4f2c8f57579133268e2c26d202096
SHA512	f48ff04435e9c5e8534de05dda9a810d80a25d9e77261761504276c445d90598da1be47cc672ba17751ce6cce954368553812fa6a68f4890a0f0e444ca1d6d1b

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help{45EACA36-DBE9-4E4A-A26D-5C201902346D}.H1Q

MD5	c09d9c5f0b306bd6bde2cb85b37721f6
SHA1	236c048b60c5ad59f4a0685938fb5b0ad203e04d
SHA256	3aae358c1990ed1bfc7fb251709e95dbb93919e8eb6d185e6dc263599bc36b21
SHA512	5cec2f31f6433f8c66222307819c4153bb80ee1390a5476ee73e76e53a890ffc4f278e0a2efef2262df3936ad83a1cc480ebca4240943189b30d9b4955b7e265

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MValidator.H1D.RYK

MD5	43619b4a0654224aed60b3e9cf7e63c6
SHA1	b99be290fe5970d950c3b0ffb1535eaa2659ce7a
SHA256	8a41bd1279d52e2550511edb1c8b125005dca20564eab6fc6b1e60834f60c75d
SHA512	ac5015bd9f4f3e0bf1107729f9cc526268d72592334e5d8c2203a929be6124704c1aa4c69fd3ae003b1c740b6baca867bdb7022db213b2cd41f9c943c3911eea

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_BestBet.H1W.RYK

MD5	f207b7b5b6eb7585d2ec3c895dba880b
SHA1	0b0f53835fbddfd44d4fc54cd0847b880c74f113
SHA256	34ea505a5745258e5598cdf20ba9e90bfe91a81b6357871380d68d32104f3512
SHA512	d84e2fccc0b36af3c489470b2995785e81c669783ea5258821aff8b07cce1f265073634e557232cab4cc449bf6f120765c5a5a063f92ebe349b17eb29ffa4d12

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_CValidator.H1D.RYK

MD5	0f0d331e80bf5806b16d9d1d34e5d590
SHA1	f04db2599c4b353a685d324c18edde316fbdfabb
SHA256	dc3b4f96556a4abd97a29f3d18ca4d424b18453f802fc42d7f6aed894731f950
SHA512	489a8fba65358725cbdb82a05a12d11221be187a8be3d26d4731c6eb1a9d5e1c9d6e269347731de33c4225f9995cf6ccaed0f7baadbb4a318504cc136e07368f

C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.RYK

MD5	5d66a89392e98f84dd23d844e14e0f70
SHA1	a4fad3bf4b69e59f3df99e7a6bc4d8453ec10b49
SHA256	cb87625d739ea6654698664a444b0f5826e9a9c210031cacd469461016d34bc8
SHA512	d08f7efdb9467a25b2407d98268ea12de5665204043118e95938f3374789131d4a43a7ef7fffac44af69598e8eb8d6b6b7804f94ddc293377b0948c0cbd51ed2

C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.RYK

MD5	c9d5f5ac0429f0537d2d0c5eb3c53703
SHA1	aac820f5bf2be6f4faf55ff84e3197d2076b0996
SHA256	048ad24775c5e192bbdbc807a3e74df11b8d05f2ea07a7116a54dd3b4613c81c
SHA512	ebea5d65b0a7a949e2909ffc805c86089b6810081f2a265341047f2216846b75984db84929ed6cfe0643d8a1b56874b11ef34ca0ba18829ea793786fdf02219c

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.RYK

MD5	b2206b9bb7884820259a5b650a66c2e9
SHA1	1a56238ad3fa4f9950a2976558c9b6693f43c8fc
SHA256	0da7a4c1482759fb8266b27e2d7afe928b529140d989cb4c1e91e9a7be430308
SHA512	fc119ab402d20ff94d5a8f55ad1e82daf642e7977a39cd4df88bf331b676a1b9350f03cf085901e28edecfaa7afb0cb4c032cea2b8d9343897ea7c4329e7cf65

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\state.rsm.RYK

MD5	53352f0202a7854fa207f09554465e54
SHA1	52705b47d94d66b7d519238ec261feea0fc54689
SHA256	d648fe3162bd6caacd6f2e406ef1819eada71eae18af60c61b7360a075e6a81f
SHA512	657d4a5a598c766ab92f3c1d5b16410b6f92de81d398a1b03d0f47b8a7b9149ed3dc763bc50428cf1054ee51fa2624165b33ac0609dfe7279c8aa6ca7a1d0fe2

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\state.rsm.RYK

MD5	3d64356ac94a1eb27495e87aea5e774b
SHA1	4d79e81d67063b291c9c2cbbc6927c339f552b2d
SHA256	6c6a891a6c097dfc6b0a6b4e5fa040c9e731d8e5e4e4247f7cafdcfd1d9eee12
SHA512	677ff2a1d74a1d4ac6365b7c185ec41e507e7a963ce45c9895d12ef10114fb1d0668ba51474c6d23ebfa891ef2f1dfcf7da6c361fcf0ac553311e852bb39de2c

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\state.rsm.RYK

MD5	6394698e61d2c54a5704d085ef865167
SHA1	46aa538de2cbe94c821e351a90cb7ab54c74e7eb
SHA256	b2b386be954143da2976746ca6ef2d99ce0dff562d95221c5cc24b8a8dea18e4
SHA512	18f603207af8146cc5b6e845b2bee60d1b2fcfc703a9b613c6454d8569539fca457880f51234bcfa25bce37504760cbe79f9d83bbc289ad0493561b4974ff42c

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\state.rsm.RYK

MD5	8781e74193ae260c61558007ed59507e
SHA1	be37c6fc29ea071b6e5773a03f7e4bebdc6fc8e5
SHA256	fa34bb5e2d86ed403c957f361edb255034d928638d76a68061fa793d3a99a803
SHA512	7e64e3c2ac02bedbe18d93364dbafa4dbc654ff4d13a316f74400279ea5eb60c377ae6e786a388621128506664e91ce56f54fede8f417e9a1d6a394e75455c82

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm.RYK

MD5	1dae9385139b6cacbda6729c7c6a9046
SHA1	5f401d3be7b70f1e9bd0f5548e760c9d23fb5677
SHA256	05ad23fd857be0c70ffe3a3d3bb7ed3d1727f2ec5d7daa7e62a69799c9b85621
SHA512	28d3a9993c0b9526567cb767107ca41f9d4129b5c69637993e045b79f4930b8d2a6ae8d221e755f78a0c94035e994aa4f34ed36ac636f50a5f0402152a682718

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3406f593-57ce-4523-be0b-a609f93fe971

MD5	b0483ba45ef661bd3b3334b5b1313949
SHA1	c46530ad781d0d1e3a21d27280e7d098dd7d1bb9
SHA256	01fd479c0e5070b6d4b3434d0b32d89d38ae1f6c217a134dbc49e7478f2d73ad
SHA512	df83652a0bdd6e641c36520b82797f2f5fd314930c14311989e724583b92cfe57069f25986930692a8489b38a2c382f10fe6c74baaf89c05c030695648be90a4

C:\ProgramData\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu.RYK

MD5	82c85ad70a7a8018679790958e9ef599
SHA1	fd7e68d45b5134a5d6be1a3ede46be5d299a6803
SHA256	b4398899b5cd3d1a820ab6bd0c3080aa176a752f4cc0d7f59bbac982238a98ba
SHA512	5db4c1e686df097a0433120f61c547931235c0d7152837fc8a337e82a5f1ca1088a47bc7029ec035168dd86e5e1245688ebbf0ab80e4a31e4fca7c450934af56

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_3406f593-57ce-4523-be0b-a609f93fe971.RYK

MD5	04a07d4ec154d2a922e9ea6bb49c36fd
SHA1	590595c8575341596f8955032eb29fb8a8df27d0
SHA256	ab38e45b77002067fe29592e5559027850afbec9a0702dd4db4c8852c51665a8
SHA512	ab5bc97f9b02f0bad0f946c0d7002d9af79102ed99eb9597134f32c421cb77f618c94c020b0a0e22fab5c7f542f438b9c481f5c457a9adc1b5062be613b3f35f

C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab.RYK

MD5	355b006d7d23f6ead0dcae1935118e53
SHA1	c53c17ea2bb9487c42b244a2d267ede4769cbdf2
SHA256	416d3e036a45815a4d3066789bc01066d8f0dfe757416783819130f0ccff93b9
SHA512	3ec0ca46d236018f9ee927fbf5b59eed8775d163d792f8a17a7a71f827a966c280eb51143002a6cdc12104ff89003cf43c24de3005d8858e58003ff1d868dcb3

C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\cab1.cab.RYK

MD5	e91e2e3c1868648f07c3d9fde324d92d
SHA1	c90f672da9d0171b05261714c6629ff95eacc3cb
SHA256	ef525d6e77ea5a10e67acbde71dbd1c698516154c8a415f3bc77a2e5050b7e9a
SHA512	73e2c8e904b82d0f32d67a124ca50d349c20c5bb06ab64884ca942d8b9c914db9e3c17e112a2d22bed5b4e59d1042d7e2ba5d31a3433e9a4f8d5844f345a9feb

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasbase.vdm.RYK

MD5	81c4d8a83cd451e22d45e855b9f4d2e4
SHA1	c21ceb1ce4bbfd311b3269f82db3fcbad92e8a78
SHA256	c54248a11fc3578a57f846d334b3e591d55c0b2b7d6be0bc272cb791484e5edc
SHA512	9dc77b400ed55dba428c6622e70dd8e0df023e94bf9e278f025e59a6fe771b54d33cdbb39ec8c294713f50c32e5530f1dc3f03f6f9f7de3eb3dce95d9bcb467e

C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\cab1.cab.RYK

MD5	0e7d8749ddeaa09c3f191f686c4f55bd
SHA1	7496481f600efb1c1d847f7120f516310cae20ff
SHA256	0f1a4274768f444db7f29ef1a8e44f973cbfef3028ea7dd578dfb058d290f86e
SHA512	9f76ef923227fa2450686ddd020ecaf3f2b1d701395a4529fd8c336e4829b0a2ea8f5c5a7a43a23f4ed0428f4446e9af4fe771ee372bcb8f71ef89541e8b3c63

C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\cab1.cab.RYK

MD5	68aaeec735c492db54573937b8ddba38
SHA1	a89b9714488c71cda4f801950f3ba0b1094e2d47
SHA256	002e3ae659f13d6a3bfaddb5d58c0c5534d33e2587c05b1daf4a5e4118adf36e
SHA512	f10b452a5d7660d61294f083d911b637f902b60eb2f550a7d5a28d5b11ca78fd9de06ab53e40b380d69d4720194d51c6d75dc7b6b9ea0fa5010e1befa883ca70

C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab.RYK

MD5	fe9b704f9763a057d09a2655bd01345e
SHA1	51bdb8b3a7663b1f96a63de7f1b91ca12466f119
SHA256	8e9ec96ac7e00a5720eea00bdfa1a9ee8e1f625b9cde60d92951e59def3e48ac
SHA512	95c53360ae09d90d26be75c43efc6f8cc7cf6a26cba65678cbf65c0b813c1a72fd9099388c406b73c2a01db8c8b3b253bc0ff8c74a6bc0ee60b4c38c50bec8e4

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasdlta.vdm.RYK

MD5	c8b510b53f8c5c2f0dd19cc417d0c2bf
SHA1	015e648c8b4d82a83c281ff3a33423cc58dcc50c
SHA256	4f35afa87383a5c41921ab9b853fe8f9e69cf67601606a9c7806a6393724f8b6
SHA512	7d0129682a906c2ff5d3ac5ab13cc9ab7aa1f7e833fdb5c851f26bcbb098e3bfbba66d75b96fd9d85ac3de9fb989f3a59f1f85ce77da8eac82b6644932dad1e7

C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.RYK

MD5	5a36922eb26867fe274d29a2898031c4
SHA1	6ed044a7d4b0aa6e343a97b5f29f1076823748fe
SHA256	060108458f951b93582fb65a5a527059e660d81df68e82adbc0684ffb2f20135
SHA512	6707d57e40da6885c97ab287fd4eef136f7be52ea60e076e7d4d6f9cb7fce20ef53fdb1b0df32e9266d637e88d4fd3ef39e12389ed860abe2863e48a80e29e72

C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.RYK

MD5	24ee8334f4fc4b43fbe490a923b62dfe
SHA1	5996751c0760bb132b0f8de708755b8b35c7ecc7
SHA256	493805f2c191cacce0f13f7272c68799a7c5036526a34a95670e660179b8bd92
SHA512	00e631b13179e6aea3460233fc957d5946d5a813014a5c24d14308071e23ca018dfac470967fec01d714294bad8b1ba8aee6f309482eecdfce1cfa034d10bf21

C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi.RYK

MD5	26422f66a517605921556548e24b3fca
SHA1	e00ac17f42103448de829c3dfd95aae6d13e4761
SHA256	dda6947b00ecd8e10fac2f679780468dac52484785d17a04bd4e35859983d21a
SHA512	b9bb044487226b63dbfe044c8f090037f4f9df1bab120a9d93b768dd07bbd80acff6f812412b2f688b230d86ad0118b11482eabe45186e16b7b0aaec376974cd

C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msiab.RYK.RYK

MD5	ee797499530d9e4f1f475903cf03b3e5
SHA1	ad73f4f7a2d23ba1cdd185c36b127c1808201844
SHA256	78e092f963789f20753bac372710efb9e8618ca0ee31ca13ec1cb01e1ede08a1
SHA512	2f9bfc227c7e5acbed97deef35d8ff57da4af4bf38e795bd07497ac020cdf34618082facb9f836a25e922bfe69c7d265ad3e379b06cd5fce418f9ff01d626018

C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi.RYK

MD5	fe0eaf671a1ff228a0199aab1d28bad4
SHA1	fa28f449401eff924a1e00286c04a50a29c030ff
SHA256	290a6248ba9eb1e8dbbefeeb67f7bd8cae9704e2204e09e88da0fe0b5df24fa7
SHA512	e675c748d60a86e62b4812927b2bc872bf2a971cff50bc9b0acd38edc95853cc815e3a1a56a1b85b8dcc4f78ac7cff28aa69e3621bd58fe898de9dc631eaf5fa

C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\cab1.cab.RYK

MD5	32ff9c7c634b04dc46c51003d3965940
SHA1	0a864f5826c12163adab3f0fd0ef6508c21f5679
SHA256	7b5110828db424b7986e33dcf4f62372a6c824310ce8e950ca4ea9bbd796bce9
SHA512	b741bfcc80cf16657971dfa7c3030d310570c194d0fc909fdfe828c5f2e6363ea08240bc9882c50a72bef2e6730964c4886b1a506873160effaa37cc235ce641

C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab.RYK

MD5	48f9915784bb517c0d31ce593e081f02
SHA1	d962e8467303ebeb3d3ca2062a2d0374bd520a01
SHA256	6db1aeffe759852340e996d33eeb393fcaf9ad42a22bbe099debdd2a075babd3
SHA512	bdec419e6286dbe7ab02bb566e031454c41c0aa9ed7b8e9729162ab69d0deef9d8b56c5a1f1926c603d505d6a012608c76074cc8685f89b7c1ff38464287b51c

C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\cab1.cab.RYK

MD5	3e53e3e87f41606a7655bb5f417b328f
SHA1	d04c7607ea4e9268ea9e58c170438e9a691019a8
SHA256	b2fd1c5c316ee0c33169698518120437648d2e03232c0d084a74c2337bcf1c93
SHA512	376ed393d6ba6b397f444593c209a31c0b7fd61da5af24f6ea33d0218c03e1dffc09fafe2c7633f214a9c7b0e879c2c9b060f152b6b1290225be7e125111f27f

C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\cab1.cab.RYK

MD5	0a024663ca10ed03056f7d2e4f4ce323
SHA1	c212b645278c06f680f0f4d9dab8f0a7d2adedad
SHA256	8deac10f701192dc28f6ed7863bc873701698de2a683af5c1505553d847ee99e
SHA512	e4c9c5ab3fa6d6a170e8b7cdff3c8a2672695c6c323394f739a7801a1c633bc7e86b7c60bba4c6dad8d65829c12d4f4ca5a7654e2cff1cdb6f9e2d4e4b2f290b

C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\cab1.cab.RYK

MD5	dbed148cd6b46bf025a5493d95d215a7
SHA1	89b185f7e5afa9245eee593476135742d13847c0
SHA256	ba30436955ccbddef1c04e27e50f15808d1bf423dc01e29ceabb27beb8c1d5a8
SHA512	4a89ce92421f9ff8647f2b4ad8fac2f2031d812495ab8aa21f6de83ab9828eb4cac18bb3362242ca075663507fbfd03b92f97b0402fb257583c7648a2f8a7964

C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\cab1.cab.RYK

MD5	6f5eb34ee46b09c7ce619c111163719c
SHA1	2eb73a1458dd3b914f649fd3248d420e56ff17ed
SHA256	41742f341e582e10fd3eaa37cd5515f9e95d36cd69e37727afda9db40a7b9c2f
SHA512	9091a801e1e6053c3fd7b8a6ea098a7efd51253f0dfe4ada2791955aab9959b97b3cd523cac4f96739c376946a15ce926d7a7adb9bf7084be147043a79aee69d

C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab.RYK

MD5	292c8602cd0e572c9f58fdd462fc6ada
SHA1	aac6d5c7b0f6dea4e1a7664fc9f0be7505f36a22
SHA256	7d2767bf8413a8b472086f66aab2b23bf27ddc23542b2282c1a36043a611bf33
SHA512	c55ebc959087318333f0586df6ea5fc94af3fca24f50762f2a9120d577659b2c1b4713233c6035906ec0b470e027cd5ed68bd3ae8a139796448e15a0018bc840

C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.RYK

MD5	554fb3dd2ae38588372faf6ee5b5cfb8
SHA1	88edc059b4c9402266b83a6cc4d94fd43c5fea3d
SHA256	755ef8f3d41ccd08d563763b3c90cd251cc6faa4f738a7d926c8e726c2e8658e
SHA512	3b9e0bb727510d5eb7a9967a10f00db444a82cbdb93f206a36979c31e552026605dcb9eea14919088b1f819da6ba92e7005e87caf09dde1af38604bc43e21c7a

C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.RYK

MD5	d3fa75a594c748d843531ca3794c737a
SHA1	a6f8e9c06c55f68cd634ec8e47b4c81c6b2fc2c2
SHA256	3beb13ad7b280d59462512c28a8148cc84a2c2d6e7bde7e24f838362c26585ba
SHA512	8632b050aa9522fb9d3aa0a40c94000199cedc293951ba14bb6898ec82f20159af678a64925081d3ef5462ef54652913d2a77190e03d51ec2cd119e59d27d41b

C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.RYK

MD5	971c9e9921ca5f5a3f9761c47fb59b5c
SHA1	394287e620fcc1307a74723eac9fedc8b99b406c
SHA256	92755784a2505db80356edbedcbc7a065b45c80486874ec843e23a7898659591
SHA512	2de13269ffc24fd2a963d0300d509db31a5914d7e4e8c8b67ef2fa640fe8fce13100a0e6658b1e9501f7462f1786e6a79641ee2db5d9f731621f3977d6094521

C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi.RYK

MD5	1fc2a184c1ce1f2d2cb1c6607e69972b
SHA1	104377fb327c4c503c97ed8bcba5510be28385cc
SHA256	a6ff7708d6353603b41b6ce4a1e0c5e54a6a5a12277e931d03508c61782b9cbc
SHA512	ed26b75f2739fd9a6fe4610cb7f1be34adf498338477b6e0b7818fa50f5168c9349fe93b652f7f54d5f2c28a78a14004e656639a6abd037ca5b7e760d78d819e

C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.RYK

MD5	9ce79365cbe2735cf2605cc572db0ecc
SHA1	6dac70e3c051d30ddc9cccd58a9bdc1ee267e177
SHA256	46aaa899e116ca6df0e013844530f987c7973e88464d98472c5e5c1d109f574d
SHA512	08406b023b05271cbe935d05af8db11e3a3feadc8da3f2659af6924f56864b13d89fb7ecf4a05e907c21cdec34b8dadf1644086da844ee9dfa7eac19e3aed18b

C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi.RYK

MD5	752f44fb8d1204213ac7b84b34dbf1cf
SHA1	049ba549d6378e79891908c4487d5f4a3e85da18
SHA256	b98c7550a0d04340c8e24ab387e6c744df4ac112cf1501a843696bd022f58503
SHA512	e9d5befe62dac0a7fa53fe9fa41929a4056b90c14b3aeaf1795b1177f494f0704416ce4ee3b472e09ebef6b41459af16ad685f717bec161dd009653787b68249

C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi.RYK

MD5	630569c41af0b51f53adbc40f489e5ec
SHA1	aab13fc07b409480d723635ce8aae6a633312b57
SHA256	3d219dfc5655c63c9b81f90a38fadd018fbb1abc3d3cc9e20595656550c7ad8d
SHA512	8f7ca80cde01073610893d3c3a6e3b9480adac712d5181f4a18e6e54096e058ed5ce926816502363322980e358645e9b78aaa900904b97bae3932b683eb3f207

C:\ProgramData\Adobe\Updater6\AdobeESDGlobalApps.xml.RYK

MD5	62ec6db5daeb8f4e598a0ebcdcb123b2
SHA1	f1536198b2cc0ff10b577c7d2cc149f631681587
SHA256	4ea825c53bdb6aee933b2d17d526c3f63ad78f4f516c384942a2120a4509210a
SHA512	99f7d3db5341a88080c065e40cc93d1d5ae1e024430ecae44512ee1c418bda5cb091062443ef8f4a213430d5979af304c1967db14fe15525ef604fa137410f89

C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata.RYK

MD5	5c12af6eb6441453b508b918de837249
SHA1	1293349da5bd391eff95ab5acb7f4083adc3cc17
SHA256	ae78cbfae1084a5a52c6c417ef8f429d92af58a13fe985394790c8a80b044237
SHA512	8b16bb98fd6b0cfc33dddaf2de184e7fc261963800d9815111cc2802609da9136230f7466e033aa2bae8c5a04ef69833bf230ac4a6b68326687472cf55d0b5f7

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3750544865-3773649541-1858556521-1000\0f5007522459c86e95ffcc62f32308f1_3406f593-57ce-4523-be0b-a609f93fe971.RYK

MD5	41610b1755b312855af45c8543f15830
SHA1	3f89e9d34d0319aa1923f6e303ea2c080bc61380
SHA256	55d315af63009083da805bca61d5a59a590c43f5ae0388dad474dd64349bcc23
SHA512	14bd9d8430dc74733fd7f64fec8ebe36880e9266186c56c843d2dcdec01e346287a5fdb17780547e6ad4564cf698351b9a30325cb2be0f20d31793878316031b

C:\Users\Admin\Documents\Recently.docx.RYK

MD5	02fa19e992e00f65f307fdbdd4c3501a
SHA1	c550f0a46c9dbd49e71884d6d131da59f0ac89e4
SHA256	af00e5240d81949599492d6f4b7860ddf3360f09b1f68e370a47a78e9b24aa26
SHA512	3e09e1e936ca79d43645faa7a3cedb310b5b8058988996278d1233da3284f8e09ee6442e1d309ca8bbac7321ccdca88809868d41601ac975c679d26fcda490d1

C:\Users\Admin\AppData\Roaming\CompleteUnblock.wma.RYK

MD5	55618a940743710616a3822f193b599e
SHA1	41a46af03f31412e6cda972bc95d9827d7aede8a
SHA256	0cbbf638021fe6bd6f8ae8269670e31a2f1d9b8e21fe243c9b93b59f1b687645
SHA512	73a0b3ac8f49f147334588eba257231c9f6dcafe4b1ea7e8001e64890c624e0c0c5ef913d2d7201c6ce7f700ae2e0f433479518412a3054a25fd4373aa0d68f8

C:\Users\Admin\AppData\Roaming\SwitchSearch.edrwx.RYK

MD5	cc6cd53ffdace7389ee5ebc8d9e3e267
SHA1	e769b895e3846daf0d871ba7485a962ea90d6346
SHA256	d343f8d1e42d8eae6ffe236379827827432934300f14600ebfa064279071304d
SHA512	54e8ef490b601ce6321038cff2eb8c9b76edc11d240931a91d263c76ccd3eb97a6f267e48e5096431e9b02c49025d42d60d806c02b637fb3bb9ca7a226dce0e6

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst.RYK

MD5	3039021ff7079849ad4168b0c7e9a88e
SHA1	65f9c12387c687ab997bed10ba950ded89b0ae22
SHA256	8e46a56b8d325a830b106e4c7d0a74f7d2db7f8b85e96f453b97db18cf155e8d
SHA512	9d1cd44d206d6209547374aea3e735328067f5f7fc0879e3218103db7bdfe70de50068b3a48a019905c837ac4f92355fcd1bf04f643b22b3b71e68ffa8165613

C:\Users\Admin\AppData\Roaming\UnpublishGet.wmx.RYK

MD5	d0f4d6c25af2ff5868dccb8876aa70eb
SHA1	bfa2b643115c9ba8dd512e003f16078550202b83
SHA256	dc6d012610ffcc756b81bfd63f85cca12cc901fb851bfdbdcf1f49a42e0eca74
SHA512	d8a314e5ef12e66bb33785476f508f0fb61fefd4eb8663af2eaff4e1e00ef32c5792d892dcb0b0b6adc5279d928382e5e6d80e3fdb5866f64df00b4424f29588

C:\Users\Admin\AppData\Roaming\SearchSuspend.xps.RYK

MD5	03dea91abf15711be4969e5458050699
SHA1	dc607fb8a02930342639a4ae88ecc45c0ded0881
SHA256	5df23a912ae4c0ba49901d0b270c4f09929878af68e3319a28467150aaa87df1
SHA512	bd89a165762e7af15e1ea4f3144a06d74f4aef8333439a8ca452358cae26ec7b88ffe1dfd02de7005f80deef5c9425dc9aeba63b4b64356f0086036c2dc2e895

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents.RYK

MD5	ee9655d56bcfcd85023d56e2cf52e799
SHA1	d5b23153d95700fc5fec651cf0cc43aaad68191e
SHA256	1044d4d1660df8a6c1670d0bf442cf0308d34dd5825b344e063f054b8fa12347
SHA512	366566501c73104bda4a314f10b3845c099a6e9c02ece67ffbffb1b9defd122b8679f115500acbb0f6b28e2171dc49505c1581e0197aa0568b3aa584d186e130

C:\Users\Admin\AppData\Roaming\LimitRename.edrwx.RYK

MD5	440056fea50f77a1dedcceaf47ad3788
SHA1	36d9f7924ec7a0930eb1de413820fb6cb68f88de
SHA256	4d15eae1986e77fd5ae78e56d9dd033e521623b8918813d0e83dc986c8af2466
SHA512	27505087a7d47fda2829a8086f56387adccb5b06453006067335fdf97d575cd27351d072cf81ccbad5a9cc5f7dcf8fb6189fda627249a1462f66fa26fb314bbd

C:\Users\Admin\AppData\Roaming\ApproveMove.wmv.RYK

MD5	a43fb190b0bee0218b2751b532574a4d
SHA1	b5a5eaa85a18ed8215e8f3fb044f6fafd8f4bc7f
SHA256	834e4703328f43508f8a749c46036b1b80548964a4b247e2711aef84020b585e
SHA512	0075be30545ff1e1ae0467ddf685d573199a466f5aa80e89ef695ffd15222170c6d822623bb49c5dbd9243e52bda37c82b838591f75ad4c7652d567980780fe2

C:\Users\Admin\AppData\Roaming\RevokeConnect.mpe.RYK

MD5	af328ffe4487395a707627e56aae5016
SHA1	a7a244eabca4b1e846986a6752f9534b7bdbb7ea
SHA256	0d35e7c115edd25e7789c01fa930245ae05558c98326a4235cceac663f9eb430
SHA512	61145592716ddce968dec20ed32118f00b9659b5336fdb4ecf10fc87293b4052d10839295255811f9d1c1190f3b6d37c4774f63958225e599e6f34c05a868667

C:\Users\Admin\AppData\Roaming\RemoveSync.wmf.RYK

MD5	1dd270bac11770c24a024e83385a254f
SHA1	bb0c3dd4f22328e2d03781bfccb8f7f5e1ac12a1
SHA256	f6b1f93cc49d334871611cf64a12a6ada2f3b7bda679eec583cbe01d97ce0ce0
SHA512	daeaf5a8a62d251e2510cb7139a66a2b39b0920cbe5a56d4cd92bddf63ca9b7b26b0315f5bedaa5dfe2e59874dfa2910bc1904455455bdda3032bd1ed0b57e5b

C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol.RYK

MD5	fe7ac5209ae169dbcd465d07b8672673
SHA1	0161bef768aa60ef44a8d68ff9b23553220de66b
SHA256	bffb68788f24cfed4f7e9082b939fa35e1f6ff5b1921c6645b8242361803bf9f
SHA512	ce69edd37fa51b29d58d59544428898da91608bc491383f92aafcc87d76ab3710328c5cfd334e9323a58154056544b0974e1e36b476541ab5b9f780f52be393d

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\UserCache.bin.RYK

MD5	0e667cb461424740ae631c4753588502
SHA1	2b5b06517b16c0f0e21cbb1091d9fb2ad5fb559a
SHA256	b81e7f41c43d957ce397c264ec11e4f442f4aa9519d0cee7583ca6c98b6b6557
SHA512	0f7ab9fd5e4ab3758c2322d9e1c61a23b78a5f11ebe89a986a5d9ef26b54197204f05f727909baf7a9ce9302667f4c0bea0e069b790ad3de77edf4b662d67a84

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\AdobeSysFnt09.lst.RYK

MD5	da0c12840e13a7a24ba6f627da116234
SHA1	8b43b2e73dc62572f60e28b237e9a47877bc8fc2
SHA256	486ccba99ed23fff58c24988c81ca55706bac9992002c95fcb8f557bd5c12f06
SHA512	745731c6ff1bd31a5c048736c2d5aa20d656535ebcae1e6a937b71883a3c7c53c1b71115f54bdfe3a098c72399a9eef38d7a225d3f6d773083e2bc22040e6d8f

C:\Users\Admin\Documents\Are.docx.RYK

MD5	0e4f646270df12b53a76f89c3d0cb25b
SHA1	4d22cac964481f180bff6ed51df79a4915afa576
SHA256	453b228d5c549b496540ec9170f7e1d08906ea1a592624a05876501729999294
SHA512	dc8e9c72d0774e8549c6c4cb8fea2029f181fb46d6fad6dd434f41929d5b80129cdd96c62c9df1fb33232951b80f4046faa4bed158ae42f66546de2f3d7eb8d0

C:\Users\Admin\Documents\These.docx.RYK

MD5	b5ac10e2b66a8e47fce482744f3a5a7c
SHA1	6a89ee50d4a0d3133668cd1cc3ca12149d96ec90
SHA256	b01e57c9ca1da2bb076cbf7b4943efadd36b908107e391d6304cb5a3cc95ff54
SHA512	f1c60a6cf843f74dcd790cc6863fea7d3feadeea6605fa237207aae83bbadbd6e5aa13d90d3e1bcf3273fd34b7ddc9aeb08a2fde31b69e512ead19df63ee9324

C:\Users\Admin\Documents\Files.docx.RYK

MD5	7552fb1a084dfd02b99c1be5ecfc520f
SHA1	7c373107eb851348faa46f9e072427d40ae4f2a5
SHA256	ce88df6317bad8e91c4827bf4ea2cb28e97bb9531caf01d41aae85eb5a3bd4f2
SHA512	df62575bf595605db7755a69add083af3079149e8704a6ce3009ef0e49c33d2a3cfdf1604dab1d7c3893620b18c0695eed039d164089f0fe50edb5114eea97bb

C:\Users\Admin\Documents\Opened.docx.RYK

MD5	e2dcca13b015fab6a6894eb8fe44b4a4
SHA1	77b20a8e44baf0054c6d0cfec8bc95770c1fc14f
SHA256	a054bc394d08971f6ca04b0df23575809f1673ee792ce924cbc8a25b8981e27a
SHA512	3ef2b603b81acf5cad0064aa6a1a8dc64cef3d3bc1a6c5534a506c0f46d3302fbf6b8111369c9899f497e778ad194aea3079a16154685915a5f3a7d96c15c98f

C:\Users\Admin\Documents\CompareStop.vsx.RYK

MD5	ea57cfbeffa0cfac2c99dc5c43f9d757
SHA1	9feedbefb06b1312e06b5fc0de88ccd0777aeb85
SHA256	9c9f0f15404f71f01cdf53288b0a7b448c2a0c1a5f96f3ae091d79994fc5cdb2
SHA512	03c0030e9a1f29bce86d76a4f793ad89525325ed14aaf6b9d8fe5f10b4a605a909c8f8423d21353c3cf8466bbb08f413cdfbfdcc074499a646c85dc79d91cf06

C:\Users\Admin\Documents\CheckpointExport.rtf.RYK

MD5	8a336403ec71fba88c997c8b2346dc54
SHA1	e73ed7bb27fca1ac098a1e359c79dfb03998151a
SHA256	a57d5524f8dba83272d514520c2c906f7997166eba502be8b97335c466a91560
SHA512	3f053b9b22701c1e2a703387d73979851259e8bc776ba3edb6278b05e3c6163c354e6e03d0789b5c1c3c191727b18f3865541c341cc9797e544788870ee6c395

C:\Users\Admin\Documents\MoveJoin.vsw.RYK

MD5	d260381c8b8f80aee1f3114bd8460607
SHA1	b6771ecd4c95e6eae8257d8272a2a75924eeacb7
SHA256	56313138fd73a82963b0f4775b062f758a3592077774a8ab0612b1614c8c9244
SHA512	9df216d58d09cab3a085d4cd456073c0b1afff766f33b8bae3f371a235e5ddfac50b5201b106764c7c1ee2b3d092f23a55136ca848908d1a27195d5f50c4ef21

C:\Users\Admin\Documents\HideSubmit.xltx.RYK

MD5	588df606677b1fdf37e7b9f7199220b4
SHA1	893e077603f11ac71da1f085fad0c10cece263c8
SHA256	cf02782a9535856bad6e81da8725845ec356993dede8c233910450b02ddab46b
SHA512	f494c93302a693b85e11a450f77427f56bec3393034e6f662363eaeb322333aef8c7733745b97df0cd2acfd13a971b5fdb6343cc07e7556c21ff7b27603e5f37

C:\Users\Admin\Documents\UseApprove.mht.RYK

MD5	f4b96f9775cf1646eaaec87443dfeda2
SHA1	25f1f7d9fc2aed09855f9f7f8cc59bc24dc15ac0
SHA256	acfd1083d006322706998773b9eb43ba64fd6e48aa836a3c02ad767c94aacec9
SHA512	d02014c910485f12404d20ad824a9892812421aeaf2c546c2c8bba7a545e4d16d510b63a0a4166eb5b95950ae5d595e9d482ea009c6e76c461f7604bd1290cd3

C:\Users\Admin\Documents\InvokePush.pub.RYK

MD5	3d6d3b787b4dca40696d1ea3ce4bade1
SHA1	2bad7ad9cb2ba91152b4d9782097b9425dd40268
SHA256	6ed23f026877718528a024c2e842d530cd2d9e85c591d3349568547172d7d0b4
SHA512	3c7963a18697c6a892f045298d13e2a2d8ff57706f9f5162b5045e26ac1697ebde4060fda2d1f010ff53cc44b4b606a1b7dbc05e725ba2f6505d706a1c03c5b1

C:\Users\Admin\Documents\RenameDismount.xls.RYK

MD5	4d86660b006e71a4fd1d9defeb07308a
SHA1	16f77e60cb817562c17bb722c3e00bffd9c2b151
SHA256	ab685a9b96f8b035d363b283bd1acc5b8164daf0255266534440ab6a1f40894c
SHA512	2512b1214630f5f9a20978ec7a18e54d04801894adb26d419c03d434b95828651d4987f5443a4039d2d140dd85b014cfac0e4c064e9ebe4dabc2e6a193339fdb

C:\Users\Admin\Documents\WaitDebug.vdx.RYK

MD5	e7ae7eaaa3d6062fb0119a5bc3dc23f6
SHA1	5264f8a43a46c8d92d9990196835f27bba935cdc
SHA256	28a25a29b0baddc9c13f5173dca480d8ce3c81f5f1516b6d741d2c01baa99c24
SHA512	7310e9d577f59324e28653de6adab9951b219350814d7bc558e7d82b5aa3417f97022089206422c27b9fcbbc30a32cf4c544c9002e62c8d066942e6d280485c9

C:\Users\Admin\Documents\UninstallSend.xlsm.RYK

MD5	0eaccb4b8882640098e2cda759726b3c
SHA1	65a3266ba0eb74bc1d01dc071d30bc954bde9ba1
SHA256	6eba50a4c6fd2f6ec22a19a57b7e12563d2b8227d8181c76d9df677379824ca5
SHA512	2ae6d4853a7c93636ef95afeeb06727a90328a119963252d6a8a479618b0c288c68d18feb565ff3ce8416279c95d272c836be691d2ea1668973b655bb7b842bc

C:\Users\Admin\Documents\ExportUnlock.potm.RYK

MD5	0f0df929562f2a4ce20876c998fa5617
SHA1	0b541268e23e37e61b2637804514f83aec8afa27
SHA256	4a57fae8658a63f6f7f9d23b9ff1857daec751869da6b0e20f9e6156f6066fa7
SHA512	18aa401dc97d9f34c99f665d90a0ac89e30c01fa50e37c33c4d9a85f83957f9b160a890fdf1af5a8256b9100965eeb8da93820ed816ee0616c62973028727113

C:\Users\Admin\Documents\RemoveClear.vsd.RYK

MD5	663708dc92446288d30c6d1231b0e1b4
SHA1	e5b1676b493f38bbd6ffbd0794f1b8550e63d945
SHA256	252083a301d6e7a1461dcfc99de3a7e3287c33752c42088ad3aeb3efbd70fe30
SHA512	2a465ed375a668217143e2a3eb3989acb8f1cb3c195d67e4623a7dcdb4315ba8138c7c03c1ddf8d07817f0c7f23b8530758d2af4e2acb9f05ef14923cbb93414

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-3750544865-3773649541-1858556521-1000\b1588291-eac6-44ef-bc85-c7515db804ef.RYK

MD5	921a78114e71fc8b2a25703cf52b75b5
SHA1	e0ca07d66bdd75cb4723b57f177be95edced2cbc
SHA256	5375d7203607352e0c0cda6294e0479b1d52a1b348e7ac68a40e6264fc86e093
SHA512	82cf1a746b919e72d0aa7e99319d668797ab66b9d2b25953f9a121f4184666b6a0ea21ca5a8cd182a28d807e2e7051eb3a4f87e55c349bef996691743ca313d7

C:\Users\Admin\AppData\Roaming\SaveSkip.odt.RYK

MD5	a9b0672e470f3474c4b002bd89e6d489
SHA1	1847dd6ae65e6e93e9d63cb7c4be9388e9d8b5f3
SHA256	371ec45c1208c95c342714645e9a3634bd1ab37085cb1c101f89a210ff922a8d
SHA512	a21ebf3f42aec9a3a0bbbee8641451ac04f0208d8774a5af1347e2fcd52b64ea187987900561cebcb86007870d9e17a8c0989517e7100269f23fd826c8058781

C:\Users\Admin\AppData\Roaming\SwitchUnregister.mid.RYK

MD5	d5041d51120d258a46b3b5d1ed5bceb2
SHA1	015e71094c46144f556a0a9e8bed759c9add21ee
SHA256	97e2d0db63965c6259c609814d0435b2385c78f561eafe14d5a49c21bd85d795
SHA512	b59ae3709fd2ac3db2c98015139c9f972362a086339ab3ccd5be29b40ae87770fa9e660effe983da04164a20dd12d63f926a1ac007bbef29930a78e17193993b

C:\Users\Admin\AppData\Roaming\NewMerge.dib.RYK

MD5	fb08d8f58eb174df7469dd504a514e59
SHA1	7c08a1f8f1b4c502a0af9c90afee3a4bd6f555ba
SHA256	21186f58259ec18711f82c21f86db9dfd0cfc497f442d35042f4a2cb51a2c2ca
SHA512	dde755bd86ec3572f308d60e3e4b37753b8a8b56eac8551073058237af5750d96dfbf2151da496d53b25b70e219714d7582f59c52f241ac06567411f63e621ca

C:\Users\Admin\AppData\Roaming\RepairConvertFrom.odp.RYK

MD5	a07f757ab67cbc84496c0236ab304196
SHA1	7560d1746890bec6f355276f7b1e8c0e633b20c8
SHA256	8007c70c9e1b2119379aae150139b28414398d08248bbb372a9bd557a9a881c5
SHA512	c167f3b81792f5c6d1b940971e6eb5f04f0e418b5547be9384c4094d586b1df8e093dc986e882df7af7ec3612094fec22ff157592fbbdb0d7c30508a48b3803c

C:\Users\Admin\AppData\Roaming\SkipConvertFrom.ADTS.RYK

MD5	640443fa913419b0c8dca4f580256cd0
SHA1	8c5af7e705368618b9055085bd21287b7c767186
SHA256	d85c14ea91acad5b64f2dcabd012feb4e5c010bb62105ee51c3cd439557ded18
SHA512	c2be766ea44c675102971b30fec64b2316c6c529584cf406ecc3d6e11a87ee47d0771ae7765efbb5a79e9d9009f25462af146affdd7af75dd295e9b479a5ffe1

C:\Users\Admin\AppData\Roaming\RegisterRename.jpg.RYK

MD5	8e8e1fd3832f28762d82bab41977522b
SHA1	67658c88318a41604fcca6afdb2f0d1bc0130e9f
SHA256	0050a472e817c38f5f2c515930511731da7cd5f199a3d04d21256a98b723aed9
SHA512	9092dedca4517d611a69a3e435d6cd5d80b9fdd77fa80308335e0d516de5b21e25c48a90cd9a474f661d81785dd7a0faf8c846db707f937b979af22ad1af966d

C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.RYK

MD5	4c00352fe7193a3fe9b45d8777b61592
SHA1	4dc8e76745663b4b0b7d4396e947dde9df84c0e8
SHA256	df5b927d16be8d42d55a54068368c8257f3cba7aef8c136b13cd38b41ffa5421
SHA512	96e01c7dffdc6bcdd67e527bb492fe4b362808a4f773d42a0bd7ceda38a459feb4f3ad8b87f484adc1d297d0464c7f12ca13e6ce2ecd251916e64d2c7c9ac693

C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.RYK

MD5	c99da67a5221116f20392a9f9e55e112
SHA1	70c9d713d3cc329d0d811434004b77b74dd79071
SHA256	4dabb707c8f80a6893b77d8a3b96ee8a9e888a9e138730cf7e677e45fb4640ee
SHA512	6a2ff6cb596471afdacb58ebb270628b84fbbb98efeaf3937b0a815979e462cece59a8cb1947991adfa5a74ba3e2a09dc731dec3bc4747d9ded58edb7f2e6203

C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.RYK

MD5	ef8781ea31ac808f0db507b9e0a9743d
SHA1	2c02bb6e247a8e164f8481740e941967b1f2d3ee
SHA256	94836c302815956d2368030f25bd95358bc87b1cc80abdf3b85ddd7a3acd50c1
SHA512	b4c8beeacab8edec5d3eec5c4fecabdd2f1c7f4369ef88e92a59a74c62ca73fcf1135114d8455ad6d2ff81ddf75c20a8f701e02e60df8d193a91aeb80fea8a33

C:\Users\Default\NTUSER.DAT.RYK

MD5	dc51c91abf9b8fc91d3701d41206e756
SHA1	2f334f1276102d35ecaa9e4ca940e7a3f091ccc3
SHA256	c44996cc9eb0a651db1f570341d9fdf646726900574f7df57a1398ef6a5bfc90
SHA512	01f5ca0ac45315b8ac191eae306be3e7432c6ee139133a65b06d2e9aa194a3b90883f840a3ec9ead925c07d6b080be04610c8e97286fd53e1267ffd9bf0c4c5c

C:\Users\Default\NTUSER.DAT.LOG1.RYK

MD5	aff892c852334caf9123fc173a6b9716
SHA1	3ec0a07fea984d6c263ba239c8cebe4ac50ca4ae
SHA256	1729fe10332dd55f76cb889e9fd80800f71232494ed188330fe6a1ae3e65fc93
SHA512	f7508927d9044a906bc8fdd7801a1614e566e032b64c1852c94c95d3645f5558750f4ccfb54c1e24092b41e528908f5931cc941bd15ba4d75f62f456256e2eb4

C:\Users\Default\NTUSER.DAT.LOG.RYK

MD5	c1d559febcfd6300ea6a845092289b15
SHA1	1dfcfcb358a94e7c3a5062a95082cd8715c5a26d
SHA256	046edc9b88442dca315b319c6a3d8ab83bcc36ca017efbe9859c5097bb344b4c
SHA512	f3d3440eb75d55f7cca3e619a091d82a072686824783e7a780219a6d85e29cc616f48dbe0fcd185583f53b7e3e1ac230d9ac9738243caac28c22c63bca928674

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-09 11:31

Reported

2023-10-09 11:34

Platform

win10v2004-20230915-en

Max time kernel

Max time network

Command Line

sihost.exe

Signatures

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4828 wrote to memory of 2388	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\system32\sihost.exe
PID 4828 wrote to memory of 4320	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 4828 wrote to memory of 4320	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 4828 wrote to memory of 3992	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 4828 wrote to memory of 3992	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\System32\net.exe
PID 4320 wrote to memory of 3692	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 4320 wrote to memory of 3692	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 3992 wrote to memory of 3748	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 3992 wrote to memory of 3748	N/A	C:\Windows\System32\net.exe	C:\Windows\system32\net1.exe
PID 4828 wrote to memory of 2404	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\system32\svchost.exe
PID 4828 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\system32\taskhostw.exe
PID 4828 wrote to memory of 3252	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\system32\svchost.exe
PID 4828 wrote to memory of 3484	N/A	C:\Users\Admin\AppData\Local\Temp\tmp.exe	C:\Windows\system32\DllHost.exe

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Users\Admin\AppData\Local\Temp\tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp.exe"

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	71.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	146.78.124.51.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	241.154.82.20.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	41.110.16.96.in-addr.arpa	udp

Files

memory/2388-0-0x00007FF7578A0000-0x00007FF757B79000-memory.dmp

Sample ID	231009-nm7m7see98
Target	tmp
SHA256	8da85cb00f7ba5e8c23b058d31a4b169c18936a8f7181015ce27e871d8b8cccd
Tags	ryuk ransomware

Malware Analysis Report

2024-08-06 09:26

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files