Malware Analysis Report

2024-08-06 09:32

Sample ID 231109-p2vgvshd4x
Target RYUK RANSOMWARE.bin
SHA256 c85fec6ed44bdfd54c5f37190ffad38919640064ce718045e228dca65f74ec7b
Tags
ryuk ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c85fec6ed44bdfd54c5f37190ffad38919640064ce718045e228dca65f74ec7b

Threat Level: Known bad

The file RYUK RANSOMWARE.bin was found to be: Known bad.

Malicious Activity Summary

ryuk ransomware

Ryuk

Checks computer location settings

Unsigned PE

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2023-11-09 12:49

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-09 12:49

Reported

2023-11-09 12:51

Platform

win7-20231025-en

Max time kernel

31s

Max time network

19s

Command Line

"C:\Windows\system32\Dwm.exe"

Signatures

Ryuk

ransomware ryuk

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe N/A
N/A N/A C:\Windows\system32\taskhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\taskhost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1676 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\system32\taskhost.exe
PID 1676 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\System32\net.exe
PID 1676 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\System32\net.exe
PID 1676 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\System32\net.exe
PID 2684 wrote to memory of 2680 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2684 wrote to memory of 2680 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2684 wrote to memory of 2680 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 1676 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\System32\net.exe
PID 1676 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\System32\net.exe
PID 1676 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\System32\net.exe
PID 2876 wrote to memory of 2880 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2876 wrote to memory of 2880 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2876 wrote to memory of 2880 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 1676 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\system32\Dwm.exe
PID 1072 wrote to memory of 2540 N/A C:\Windows\system32\taskhost.exe C:\Windows\System32\net.exe
PID 1072 wrote to memory of 2540 N/A C:\Windows\system32\taskhost.exe C:\Windows\System32\net.exe
PID 1072 wrote to memory of 2540 N/A C:\Windows\system32\taskhost.exe C:\Windows\System32\net.exe
PID 2540 wrote to memory of 2504 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2540 wrote to memory of 2504 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2540 wrote to memory of 2504 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 1676 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\System32\net.exe
PID 1676 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\System32\net.exe
PID 1676 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\System32\net.exe
PID 2652 wrote to memory of 3624 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2652 wrote to memory of 3624 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 2652 wrote to memory of 3624 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe

Processes

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe

"C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe"

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

Network

N/A

Files

memory/1072-2-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-0-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-3-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-8-0x000000013FF30000-0x000000014020A000-memory.dmp

F:\$RECYCLE.BIN\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_9b648116-f593-4cd0-af83-d6b6d154a9f2

MD5 93a5aadeec082ffc1bca5aa27af70f52
SHA1 47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256 a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512 df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

memory/1072-23-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-28-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-32-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-36-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-37-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-52-0x000000013FF30000-0x000000014020A000-memory.dmp

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.RYK

MD5 d57ec1f4cbf1c5ca04e02ff374822a39
SHA1 347ff707b5ea79ff614de57887b9b6116252a713
SHA256 03ee2d7b9ea81be89f720315e6b5872a522c068f0b4607ffa796be43365340bb
SHA512 2d1535f52118eca270960c6a4361e9d694a49182c629a36a24c04d8a84956d38999af257f8d6fedf2f94b5d38e8e9ad07bb66b3cfee3006d0b4458770435fabc

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK

MD5 678b1feeaf26b78a8c8b8617a6e76d30
SHA1 bec01dc4aef986724367b6e8fb6154cef2cb9944
SHA256 3fa61642fdf5c8fd3abb8de1cf42c8f816b205324cf4e8bdf2cd571e08bdcc37
SHA512 64b3432b0012d444df0c60c3e2c44b218b1c87f58097a95518afa8f673c11075ebd96fbcf1395059260d380acb238574c52d7180060633bccdecb5ff7371d9c1

memory/1072-94-0x000000013FF30000-0x000000014020A000-memory.dmp

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst.RYK

MD5 707845b7a88ef4695261f098200fc09e
SHA1 9d4f9ffbb124278f943c837af07a6f775e2b98c4
SHA256 6224d9f4781e6689b0c71c68cb850e82c681013be0c0c8c8ede024bdc807e493
SHA512 d5de8650557e10ed23380ec7a54fd6d56dd8c650b124ef96dfa89f8fca54e412d98f68ac12430bdbf4b1efc7dd18bc312468a3e5fd9dc2b08dbbadcd532a38a1

memory/1072-92-0x000000013FF30000-0x000000014020A000-memory.dmp

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\ACECache10.lst.RYK

MD5 0d424945116cf8818ea943308e2f805a
SHA1 1193958a739f308e94070dc5f5868aa8afe33e01
SHA256 1861270172c0b442ed7cd62c61586b4be44e702a906d5544dce646d9281b47ac
SHA512 02dd3bb4e641c369ecc717a49d86e32d5c4ff467012349da92ff87ed8a0475284e8d7c5e242b281887258c25ef5b58d4120fae940c0144a5d1845edd5883c1ba

memory/1072-65-0x000000013FF30000-0x000000014020A000-memory.dmp

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\9.0\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Adobe\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

memory/1072-98-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-102-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-107-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-117-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-111-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-101-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-207-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-213-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-210-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-199-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-197-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-194-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-193-0x000000013FF30000-0x000000014020A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility.txt

MD5 594c98b4c79d76db547c7d9216d8f74a
SHA1 6dffd4ea0ec9282b38b58ac39ccadb583e596304
SHA256 cbbb1cf2e0b16f4b7fdc72f046ab7c67a74cf0e64405368c60b47ef8f07cbfba
SHA512 e0af807c3e00e57d8a235e1a827c3dc64f1172457716e05300f7db8569bd490588079292c45609c29d086f12b42042a63348b5fae2d034c8dd0f4c9401b760d1

memory/1072-391-0x000000013FF30000-0x000000014020A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

MD5 702a8a911baacdc18094b67608de438d
SHA1 b93f28233c767112b46c050f868ebc491a13545f
SHA256 61caf7fcf81477503038330f932b2971350d1b57bb497ffd1fdd516274805fa0
SHA512 2105c8699398b6d2a93081ff741aa4dfb82fb55783569e47ae3e77e974d89c8e879d9c000e99537ad315aae92e407d58ef505b7568cffecea19fbc9e3f35754b

memory/1072-279-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-222-0x000000013FF30000-0x000000014020A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI6404.txt

MD5 3c551b8780eabe21892e2a4508559bde
SHA1 157a730dce8b7641856d21f286d7958f448e5bd9
SHA256 eb8949240d91ed2315bd1348e00a639056a98f1c61088b39b815f02198247675
SHA512 7105aeb74af281485ffe844c2d850b0193a3cd270bf5f0542aa4aa937b5d0bfb781d09f51382742d71baa166666c6df2cf92170444f3a7c42b05b56342a64775

memory/1072-396-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-410-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-423-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-442-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-445-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-453-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-454-0x000000013FF30000-0x000000014020A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.htm

MD5 4fe26e4d0a5daa83fa285e5dcd95e966
SHA1 284029ed4d78f0bdf4adc8eb2dcec1f761691c55
SHA256 663a508122deedfe9e7735f09e482e95f5c532f022e708da41e66bd8d2f0c530
SHA512 71aaf5d4882ada373005028c628b9f88d435be85933a83ad1f062ac565dddffb6c56ccffb404b024326430806c320145ca4e85bb8f9d24e1fab7bc3c40f26f3a

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.htm

MD5 426a9aa60a079d99d2c2fbbd27287d20
SHA1 fa07affb898ffae8b76325f02da7199a87f52bba
SHA256 2d85437c581fbb75f37a56f82e50a3044d4311fbadfc813274f78860a225010f
SHA512 3f040f6f20bd9092bfee2dec57b7d62bf9ca7fd3b3edff7b404f4b0babb5fe68327059dd6716ab66cc37be92e2fbd43bf8a6b7048c7b2dcd264f885a6691d609

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Memo.emf

MD5 58703c1d3cbb3019857def369fd3d5e0
SHA1 a82081b51d36441f4746b55caf3e12dd8c46295b
SHA256 20b5c2822e2534a7c8e5a3e8ce29c32d5150322dc849a8a6887c38ed012d1b65
SHA512 a761de14d6feb0c363e65ba11629dcdb5d9eb61159463964f0c83a5e020f0b9585b20405556b6924eaf826587b5fdbd16cdb931f640729499380727eae3f47cd

memory/1072-452-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-451-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-446-0x000000013FF30000-0x000000014020A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

MD5 a8b23860ec79a0dc2a6a499f7a3c4eaf
SHA1 b34fa0f65fa499243882b340e6f897b95f757f3b
SHA256 6eb7738fe3dcacf6afa4e84addea39fb2e28aa7ceee7dec225462b9fe616f386
SHA512 982350c1d8aed95d683db87a67629e3fa5723d9decc4a729d1be526f0efead802672fef999bddba90bc0bbd760d206c0cc00d77f278e8a7087b27e531bcbbf60

memory/1072-441-0x000000013FF30000-0x000000014020A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI63AC.txt

MD5 e17e8e4f98b76e0dcf2cacfca6f4e349
SHA1 f439975ae61833d65dc98d709126d316354a57f7
SHA256 ddc504f270cfe238476934ced62b2122bd1d6a989d116c38b91f9c8fb69c6acb
SHA512 c7f100ba80575df96ccbc5df919b31bf77ae643e0e3babef3f4fae799ab1df69cdd4d274022a48c253ca1b4037c4637b83cf3e6282ed792931cb0ed4affa8f3d

memory/1148-422-0x000000013FF30000-0x000000014020A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ASPNETSetup_00001.log

MD5 a1ef42a62980a9759bbd20fdc30177cd
SHA1 27942689a44492c934187226a040425a605a0656
SHA256 bf44c0aae629adb2c55418b5924512038895b3b8f51ce4301fff97217cda9b1a
SHA512 980881f3362cc086a6cc579f953a2dfd2558b0ae6d68c0f85b1b5ae093090393890492ab656006e04c9bb241d0915d274deef613fcb7c6ba2c2397bc456df179

memory/1072-407-0x000000013FF30000-0x000000014020A000-memory.dmp

memory/1072-392-0x000000013FF30000-0x000000014020A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XMLYK.RYK

MD5 bfb217c4d9b992ff080ab0e577f526ff
SHA1 fd2e6286144cf8efc70f43ae6e9492a3371798fd
SHA256 07e405f5e9dbe27f243a6fa1ca668ffbad21b85f1a3676a3e14f124bd3437e94
SHA512 b0fa8f29a3d6da8cd0e3bcb3dbd563e8564e1dda6777ae6dc820c3217c52961c2a54284adb949a418f8376dc41baacf7acd3b8539afc372121479e4b31b00a2c

C:\Users\Admin\AppData\Local\Temp\java_install_reg.log

MD5 36742c079483569be8fc88503066e8cb
SHA1 57ecc0402563193f4ba822980551a6a9ed31c5fa
SHA256 6a1e21d66bb851efcfc31bc51c2fe5f48967700b439cee9ed176ba5580bf24eb
SHA512 ab5a6c88af25e665c505311b1b59e52d06ceb2703619a920aabb8fdfcef4aa8e142c602461db63777b51b0c0ebc1aab63c28cb7d08e5f161c4d4b1155dfcdf37

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg

MD5 12d7b61bced6e310dbaf9f288a6e2ea9
SHA1 b652f11910ad8975cada997bc308d2fa1e71c7e1
SHA256 00727d92075ffeaca0093d50e9ecab59a41559ae38de02ed660f7c4287736e81
SHA512 30e700c8014022c95af49b244eaa35535c3e7142af44bef1a0a8080a47029d56c03d3cd055e21e54b12f47060cfbacea9ccdad02900c3e45c5f73fc416b89ad2

C:\Users\Admin\AppData\Local\Temp\RGIA564.tmp-tmp.RYK

MD5 7b55a83e1b35ca6cf30b561ff7f5ad9c
SHA1 50e96af503b34180e67374830194ee499d68ce7a
SHA256 b5129e2d3f52fe1a71639d13e8afb5d948d78f10cadd3f17b764de02f1e3ebf6
SHA512 2ff1af85be2023d992f671478a63ae369ab1658e44b67d07456e5c2d3d14ffe9ed5839e67341625342e2a91c41996889ccb17f2320f2d37f4bcac1e60cf8ed25

C:\Users\Admin\AppData\Local\Temp\ASPNETSetup_00000.log.RYK

MD5 1b30a295e03b2f9c9828de5d6d36f0bb
SHA1 ca1f78b3e9ae856ef55cb2487e8a054fbc85bcfd
SHA256 6b0bec2fac63f8820a6b991e7a340114642c5ee06cec6be9cd8f49f2529072c6
SHA512 80056bb9aa7a4cb318db625c7e7d2d9abbe828424b6838037e2f01e9c80d1ba6ac98a2988aa8c0b437cf1198be38a47c79005d39c0035074e97e29fdbb839cbc

C:\Users\Admin\AppData\Local\Temp\wmsetup.log.RYK

MD5 0743069f89fc15597da857343fbae7ef
SHA1 a12534f43c26bcee3d4aa1632bbe57bd9ffd0635
SHA256 78440af6549fe94455fa5a28a9b68bd48154fad38cc847687ba0ac522d85e073
SHA512 b2fd33cec81e44bef0290576089a7cdf44345ddeb8b1ab2fe6a94fad9723f46cee6581d64052c7f5ff27be3de26f3e9ffd6933a97e9847a3de93a126976353c4

C:\Users\Admin\AppData\Local\Temp\jusched.log.RYK

MD5 2426ef55eb629af2a29ed518461cafa0
SHA1 7fae6da3df7c03d0ef129ca6716e57f12a89745b
SHA256 a1099761468e8de25304fa7b8ae7dac64a9b59fd62133803e834618557d5f3c0
SHA512 5fced080523dac4e56eb401ccaf13c9b33395ec75a4fc7124452d89143f2a4942f0e6caca4df65ec32e388f2b006ac4c2cac46de161ec81341e3bea566ab085f

C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log.RYK

MD5 40384420a68e8ee5113c1f8678bfd7f7
SHA1 10398d990facb1f89e530b807c80342cfda0b5eb
SHA256 a6d8763add1c93ddcfc9fa4e4acfae61be23a9f45c4e91ee1fc24098a43eba50
SHA512 315393e638ff84aad3ad48551b7254d29efbe12ba6982e7d4314f87f9458a296d79508fb1b7bd07299def092ddf555ebd53e5af7f2bfb327b0afe84f238c3874

C:\Users\Admin\AppData\Local\Temp\Admin.bmp.RYK

MD5 ad3a82df1c0cf492efa247d4e309c6ff
SHA1 fec04ca27ccde7c291dc9ae629a08e0a0603320a
SHA256 99462c7854c2c9f22b106f0aadc042d0a5e455ab12784c56769f5e662f295ea3
SHA512 f20f0b33249b2da5b14bcf23f419990eb7c2b7a99fb24a959e89113714a3bbe2b20ad45527fdf6e93ecd2224b6a9aa96b7ed2ba0077d3212232878fd0360800a

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.RYK

MD5 0535dff6aba0f790ba8c48a79426c9a3
SHA1 0f48b1dd03c9a7ad04c2fb7375c20a58b8184d69
SHA256 e55558e214d6126d40681c821c3a98f5e61574e81e4a7a770826199b93ddafba
SHA512 0dc7279ca7b5d5e1dcf7e45e57a4f3a6572c18490fb2f8d6e0921da5e1067ff6235b62caf8568d6d891b39154ad8913cd0e4711f6db48843987acdcb016f2c0b

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-mst.RYK.RYK

MD5 7f0ae1556c43a5a10f872ba01eda41b6
SHA1 92da69df6e00c87bfc71d31dc0d83678044b482e
SHA256 bed7dd80bcb8683b2ce869d3d0411a86de4a64ad5c9330af306b6eef4e530189
SHA512 4bdb0605df1ffdffb3b9f5704c3311f1ec8e1ccb3dbec527025ce8bc2db1081aab145dd40b772fd97130a73b21b9536ee571a909becd306b67b1f4a33c35fea2

C:\Users\Admin\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK

MD5 f2c9e44eb26d89dac453c4d0f05c8226
SHA1 30c4863646936f0f90cc3117179926949785449c
SHA256 7a7d8fce86c4f07cf1e387b8da835117e77fd09df28722febc1500bf8bbbc9e8
SHA512 dfcc67f6bbe9147e33270c586001dabb9dc0af922c649ddc5932a26bdbf725f199c53352e48ebf1638b3c7887f1432b1b97953e2f6b31c4c8c29dd6e175e5663

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms

MD5 7c1e7c9ab60a82d3206fd7e14d622b15
SHA1 06d96fcfb2d4e07b997963e464be250a7992761b
SHA256 b6116a48a4f0c8d8d1f6a022d2d7da39d5e1cc17326b092b6bb2ad5e573c6c1b
SHA512 3e56ee2ff448e6a2732e3d66c9f7b2858484ced6858a4fcfedc052c2b4b2ff98aeae798845da74a7f7d0a05381fb001ffb676c103d393c3b1098b77d5068b587

C:\Users\Admin\AppData\Local\Temp\dd_wcf_CA_smci_20231025_170109_905.txtRYK.RYK

MD5 d108a8332942ad15e9dcbbd605836c1a
SHA1 d5a922340cfda740b4e075cf1c99173e251f9291
SHA256 5d62e1cc1b08148cbe448b821127bed6a2fa4246160a70946c94275f074ffaf2
SHA512 2d1f7a0b306a340f09a688d8cca4e406424df42132cec9f85b0e6de03476efda33896d4223cd6ca91f7b821c792924b2d0b1147ef50119d0163be25a303d56d1

C:\Users\Admin\AppData\Local\Temp\dd_wcf_CA_smci_20231025_170112_058.txt

MD5 0bb605ddf49f593b26e816f8bfc328d3
SHA1 ff4a334162c861d936f3cec88ef2f5ef3a6d8707
SHA256 97127eb87f208ec5abccc758584c92c063244e0a55e0ba68c4a0e0e575782b07
SHA512 3ac7d7a1e438278c9ad92db07f107eab88598561f956dce3162cbd98dedb3c5b6697dba3083924c3c6b1540a2887fd65c4b7c9e90b1ee1c385909fd3d3a6b5ca

C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb.RYK

MD5 a79fbc11fc3cf7e252fc2fb12ffaf18e
SHA1 2e908d942caba9eb9d122333840f75a3f7400233
SHA256 b6129c80d5f52f55db384b5b9dfb8dd79809f1f4f3236b1b92945cb057bb389c
SHA512 bda8fdb8b26a146cac2f04cdfb6fa0a8ce003f2fd2ed8147a7c10333c2235c733420a07064e3758f4e820c4c7cccc4aec1be3070987f2cc0c734009d98f6e3d8

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.bak.RYK

MD5 fb74ce68df5d75dcce4bef4a79085531
SHA1 1281ba46a8f2af848aaf0026e4d072eb8cd46433
SHA256 4e0be34508648dd5654607aea64d51980c815e384cdb0bdafb36f018ad298e18
SHA512 2d381d3b38df54f45720391eda5457bb9693cb6bb0c7cdb9c3299887c2f857f119c77f1f2da2f68c8b23ef95a0239edce24932558835d4b9f815ce3bd8b4e8bf

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml

MD5 79f316a54ba613052b9ea06f3b685cee
SHA1 d8e7a49126ce5702c8d0f8269bb6b3a1897a4767
SHA256 c9872dcea4562c969da9889060e939ff45e319ae722c02d32406e53fa913de97
SHA512 3d1d83c549006965c862c4f1859938e220fc04ae654a46f78d512a0e08ceb7152d9117acf2b90bfb031262034eae141fdf0ebc3b407e0055e0ee86022e5efcdb

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\oeold.xml.RYK

MD5 3fa4d9706975570cc85b7b62dc2eef94
SHA1 6581cd77caae606e095423bd7fa90a8db346482c
SHA256 c66880d2eedb2b2337a17060915e894e7f7953149761307a29f0dcbd8f70d6d3
SHA512 53ece8e4edd2eb4f6fe182589e8c80aab3d24edf65d151c84aacfdf3930d444b2e6a481847fba2ca8df8d0e7c1554ea0bc915723ecf898fe11ddaec367ffa441

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edbres00001.jrs.RYK

MD5 b87b84e4babd755ba62b1d0fe278aca4
SHA1 7692174b3b335cbc8fbcd9074f7d75d6fee693f7
SHA256 749c7e003781b66f56723546bfd8800cf82f8e1fed80cfcab514d412b4f2b675
SHA512 e13b3f830a3dec6ab5356362ea2de1451811f505e2b57417e69ad926c0dd999e8672602889a1b5ac46e8975afd40fc62de35001ca4698d934a908fccf4a38faa

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.log.RYK

MD5 a944a1ec89805758d2a2a4d2029c6ffb
SHA1 f4007977c1a086efc98f849ad42571bf43847bcc
SHA256 186f3ec1bfd393e071f679f5649e26f0f44ace146a25b10720fbdc1558dee8c5
SHA512 c3ad0cf4084cff88ec683fe755522116fefcb6e99cad94b346e5b4a67c585fae861551113c17adce7bd48bcd7985e21d39e6bbe7c261b28cdb091dd258fca032

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb00001.log.RYK

MD5 5300e35952ea1edef745dc788a3de4d3
SHA1 e2db298ddcdf18c3905c37bf7104b585b9f346aa
SHA256 2b77d8348ab1dca9d89b2036e80b6dec2fbeab4f1e253a484b3f05e94322a0a7
SHA512 8705b603b7340d22a4fb941ea9f94d42938d9c9320f9e71e0c4f1b797fd454ea5745f00c1a52c8fb78b37d9dbc2758d74d993dedb422b7c43a3331da2c887a0c

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.chk.RYK

MD5 39625c5ec53b16a35a0419eb53d5d4ca
SHA1 b43cef4573b171a90e4094ae76178bc3c364b12b
SHA256 6d5ae5ec8eed849d9d72281fbcd39b53366f38b0d8a9931b02452af11c6a637a
SHA512 eb2962d349ec7a5daae91ea8640382cdb4251d59482a3a2dba5f0e78cb774101816049d2093eee0d61f0b3ead5d315e24842ffdb8df2b890177f2339efea0cd1

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.MSMessageStoreRYK.RYK

MD5 22e7f16a9839d82b1bb4cc71f8d9dce8
SHA1 dc5cfd495dc00cfcb9702151903f18be65c1d825
SHA256 8cdf06f07c27f5a2a86937ec65c83d3ca026b9988fdd80500d89c0c9f818d2a3
SHA512 ef45205c22c3c77d1e4b988e5c6d0f43ed5b6b6042d92a4ecd4c1b8b46fb1e6a9b8e63b35c58a7d1385e086617c4740154a883785e55c0fc7bcc43edc9d1e948

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpgrosoft[1].RYK.RYK

MD5 de6b0a2a38125805a9f5633d4960258d
SHA1 c31cdd90d52034393bbfb0d3f8dfba99f0636a68
SHA256 848f6ef6ada0d1692b656e7bb6211f10a8818d701c521586645a5bc33dccef30
SHA512 61164a6ac709af0f781684a2a3532db50f812e8aad10245470ceffcf6971e38e638dec08ec4310dc2029e588897717d762b3e423c93b0f1e4b904fb128df3b91

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Tiki.gif.RYK

MD5 f1a8d94bd68fb97f6173521141d78db4
SHA1 adb8742dca873102854958c53f2154e3e5ddb18d
SHA256 0da49a95a248b5441b3d2cb12ed6dc9756d0098db8cfb92be247cb63496ea864
SHA512 14d51fd398f2ade37683229ec777bc7c236a973df3fd8b56ae5f5f7b9ea7c292de8cbac743f5627bac724e49d2ad3bf033da603676c49277529808fb097527a8

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg.RYK

MD5 efc82bb548afdbf0a92d5f5c019d1e58
SHA1 c6748ba5f3c500a5e4aa1df3865b8af5796de1cf
SHA256 1312bfd4c7dd8ed713b931dd2f11989c3ad0efae22cea98b0b0d55274ce281cd
SHA512 4e133512ae0da02fdec011ccad6d484cd076df3ec2f7bea1a864b6920b91f9d17e114a4e3e87685940be3c2255c38072beef022db1f773c9c9a4c4bd654a0d56

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Graph.emf

MD5 43a11850f2fc6fd08caed84843100a3a
SHA1 8963804d498ef77b9ba4cd4485572a659357b5ba
SHA256 15a759d713f83db4dc8d2d3ba63770cdf4e5f9072d1f4373445d04e1a6d68df2
SHA512 7e0362a15156eac6311d4a048b3c29cb0580a7b05affb9a089e1985fe5a8ca3f75da010fd0a69c9f737727f0c3ad8c38253dace9b24406773bdbabd27a901d9a

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Monet.jpg

MD5 b21997596ba9441ce6a245b02274bc49
SHA1 db1d8524194df2fde10b6c1cd4dc4c60a496b183
SHA256 46823ecef9d0a2664c8a7fc19d4913070a796dd16be206ddfc215221f1f0fe9a
SHA512 20367a4c769a90ecc0b04557487af205822c9e987c89e2b90037404922f35f4adbbef45642b373149e6ed6d5c4a41630322a55aa9e6cc7f2da7abfb7b9bdc35a

C:\Users\Admin\AppData\Local\Temp\RGIA564.tmp.RYK

MD5 8adbcf802b1a5bf3602002c419f329b8
SHA1 c138712d3f8229fccb3c352ac39447bbaa9d7318
SHA256 d56dc6b749100aa6708cb38def0daeaac911177e413f1c62ae922f9d1dad2271
SHA512 89ce31d5d18ee4bb84c89ec50cb583a0d4927d0f51757c70724a0e3040e67586e99e9ec304632229eb8878b8dd8ecc9839ef3b158e6dc243d3f9bf90bd8aa938

C:\Users\Admin\AppData\Local\Temp\SetupExe(20231025170646650).log.RYK

MD5 7c2542db02bbab07d29d337518557e0a
SHA1 e0c66aeb5947956ae93ec288d93def783ac8b57e
SHA256 e8ef42c43092992d1e492d9fb9beea1b47df7112396fa98e227b1fe475cb4a95
SHA512 6bf635cb3f6c2b037c334055e27030304fc987b677720112eed9d3ea3f51eb218ea6f0f24c65745e99e24c416d651246010cb121bd6b5feff649ef6bd8124443

C:\Users\Admin\AppData\Local\Temp\lpksetup-20231025-172338-0.log.RYK

MD5 b61965449c63a9565ba6ff270eb0beeb
SHA1 8b09dfe0f829d25c4567879c178506ca56623c55
SHA256 e14e301f2213d02ad7598421f75673271beaa6823f0c1cb9d5d4eabe40a6dd65
SHA512 1ea91564267639bbd202ad0ea814033829ca312645a3e474b545d06db2486884e8186ef7facb81077ec86e378bd32b1b63b570f26cc87c608d547ea3c40c8e72

C:\Users\Admin\AppData\Local\Temp\lpksetup-20231025-171820-0.log.RYK

MD5 62a8f1971b3abfc4ec5519ec84949ce4
SHA1 d67b99d2e3af1626e3569046bab18b8babb1342b
SHA256 8e3bffa6e0180192bb0ad0dd658efc5f1e758cc1e4a21f35f391455eac30a993
SHA512 1ba581ef23fdb4bf19dd0da3784db9ba320bf54c6856c235972152cb68b7b833496bba1dc54c9c2d6efdef11c8de36bcc6c7414c9d3298b448ce7c36c60b0f72

C:\Users\Admin\AppData\Local\Temp\lpksetup-20231025-171315-0.log.RYK

MD5 19482c7dbf62b4de843011fc02671922
SHA1 dec320563b1719d60abe23100c42252c35df4bcf
SHA256 00013b3409dd36d6a2f275b1df5dc0ded3dc11b9f5d8ff61fc95c16f61b237e2
SHA512 f130edd9e9df4b2910ccb091585257422b85d52988472d58b9c41ef1a0189ad4b2adc55743a4ea1708b91684cec26ea9dc7523a496fae39a78d2f123bd0359dc

C:\Users\Admin\AppData\Local\Temp\java_install.log.RYK

MD5 c0f7e8d0dedd3aec31038dce40a8195d
SHA1 a2c52d355fb70a92314875d361360bb083c12a52
SHA256 1c2c640257d8014d8be104f61117e8ba940c6d9f7115c2c36fb355a8f89fc1e4
SHA512 0e307b81f310ae8001f294ea3dd848e74198676aa70aae47ac64701240604b379818e9c653623a80ecce40d0f1a22e6b4c629f1214240a03ea180eefd8163d65

C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI6404.txt.RYK

MD5 dc6fb4335e6625a56a4eff254fee8e9d
SHA1 acee432516441a03ed27afd063039043bb81a0e0
SHA256 36438903187f5ff9805e85981423522e2050f386c14544d6273550d872db7325
SHA512 e49947d15e345ed2d60808cabe10c010edb0702f025aec40a1b362691598102fd2410c68fbecb33e02c1d77d2c668036a817ced67dafda5c09e7ec45217dca41

C:\Users\Admin\AppData\Local\Temp\lpksetup-20231025-172104-0.log.RYK

MD5 fb02ad34690d90cc1aec6d054b1ec3f6
SHA1 f081db66e0faaac109f44f14ab00b94b612024d1
SHA256 578a33fea43fdc6f377b6d31e82822c06f7cbeb517ad3cf3b8b8474505a2766e
SHA512 9ee0d5dcf51391e4dcd9af809d76e077fc8a03e85dc822b9b2213d0b4ef93ed1740cab9db45bd81607d88e1e45be51c1989b4c33ac0c202cda7431e75fa04714

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.RYK

MD5 1aa427d2e76b0338f3f11d32713cdb52
SHA1 301ecd255f0db89b1dada7aa01792d4819e242da
SHA256 6ba51c837c0f40046a9f964af7cc80c335eb5014aee81e1db49d2799513fcdc0
SHA512 d2e0fcfea8c381cdd77d9fdfd8a5446fe8953cbc1997f5f8c56e1db3da68bad9e6f63893556f5dc656195ab4b2c6c8b30cd5bb52de79b6d922f07e18f98065a3

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb.RYK

MD5 cee0566a7556dd4092454b8f67385641
SHA1 1e82e88c862cadeda5194e7448f094026b9e5a96
SHA256 724aea4b9160dbf5d53e8643f2c1bb3f7d45f507d93090df09ce2dbfca78e6ed
SHA512 078a4e7667cd623579b7c6e6f95b6a1ed08858ec7c5d77c22a092d7da0eb7768ba64f807cf8ea48cb84f7a8cb1f6e3fe1c9a507234b550ede55715c1fd34e1fa

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat.RYK

MD5 4888a738ff8df102a36e4e41d5f75f70
SHA1 81ac08e4b46e46be890eeb0a0d32dd6c631d84a0
SHA256 30ce219f3ecec5a8805b20215eab988eac17a2fcda900c089e3a57d97bb5f5ca
SHA512 c2538c7f5ba8cab4770a06858b3f611c38fd9f912e762cad179e35dff7f552ce48c527273f3d1a801dd61bb50479a173f4231f52a6f4f50828ebd705d4a90b1f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MQDFJ88W\favicon[1].ico

MD5 c50d3f6de60a7b513caf34b3ce1b6ac4
SHA1 62961ddf9d9422a73c3ca3affde4d5cb4b14d3df
SHA256 69335a31cebb4f939cbc206a20652d6dce054ce5fa8dd28088b40e67f09ccd1e
SHA512 bf26ef5ef3a012b2df53400ce13e172f595f636a5a1ea6cdecaf823f2132d26c3fe0df77bde5194176191f0196abb2904392326c1b48a2dbf037ebb851916605

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.pat.RYK

MD5 3d196660929038f91c2efd505aec5274
SHA1 f6f65b9a226ee3a4f4be210d5e770df0527539bc
SHA256 b09596f637920ea3d00eabe299c967b0106380033d4511089c6447bb0cb239e0
SHA512 0276839b215da6429e4644c45d3d461393acaf18969dab73356f1fbd8333d19a6e097bcae4607f8f7f7c77630fd5e497d8045dbd9687a1ab2e14c9c5f95ee15b

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\edb00001.log.RYK

MD5 552a09eb078d9842044b467b044ef041
SHA1 363ac97c4ddfd5f2899eb103d1da6c1460009346
SHA256 008e837cf869c42097411c548b2734d5986b83c2acb1e4ba11a91fc2542abe2e
SHA512 2045d4566af83ac95ef0e5611c02b949c15f346c04154fa69ad00ce7b4fcb8e00c01418e1b26728a850ada5880a8c3e2459449aac432e834414d5c454ea9c4b2

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edbres00002.jrs.RYK

MD5 eabac6de537e8c9a47a52ca0f9ccbaa4
SHA1 6d375f420ac98105f7be6745a7d4547ffdb8ef5b
SHA256 4848ab3929625317601c37227ac023fa5c35557042990ecf22b9c16b4ab96fe6
SHA512 59388224ad0c1ebed9f0d764e5471c067e992b952b2390a7fbf2c84115a8e49fb28f675618757ab5bfc0c47b624df4cbeb8643bd2923b8055f18bd632d78b6de

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db.RYK

MD5 6093a560c54a56146c1b44350e4a8a12
SHA1 b5ab78c29f8942dc5bd7b3d7b5c5821f83efe71f
SHA256 d192f98f1b63beb2ebce763f1166fce6033c18f9ebb035066b61e365f4bbb0b8
SHA512 41d0b37313a28ab5747477329f08f3f9f84e12da5278bdf5db58dba0ef3a01b7a76c8cda61953f49d52460346461a8795b8a0db3e4b29834eaa3dffd838d30e6

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.RYK

MD5 810a19361ce259a7a32715fbd1f3e4ee
SHA1 65a9cf95f407f902da1e713019381b75c762059c
SHA256 a97839f1b50dfc200939e5029f31aca8d989b2b2d50a7f46b936bf6734a2a4b5
SHA512 6b6aaed64474be9b99948258739ec3e418594e3ff5671eefc7be466431fd1def0aeb566c2c625c4ff5db78e05bfa09a1606f134c71473a4850a6467d18f7b011

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.RYK

MD5 183e4da8ce1cfec70c288de26154f59f
SHA1 9c2a4c8195ccad35e06e15183e664bd2f4c8b017
SHA256 93829ea5b968d7ff112b67ac09342b872f9343b2c8dbba81121c880e7dbf69ec
SHA512 1a39c1ea8917480d691a3538c3ba91f76c64bcbbd3e3b4deab9a6ad8ed2c3bd7ca003e86eea351d68bd9ff40f3a2326b3c3121a4071a23cf3ac0d4ceecab1765

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Connectivity.gif.RYK

MD5 5190f9e317a4259446dceeac53249f64
SHA1 52b9e6d743c5afbea476f878587c0103c45be80b
SHA256 abbab13a33192f23adf68445ea1037811d4902987c96e9e5a06890abbb203b83
SHA512 c46b743b965b884003d2c18bb8fd2f800106df799f2151ce9b50451dd8e6a36c33b1f232637d4fcd1d25da89a47426552a92ba9e7b4f164a01a0d5a7b75335ea

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.htm.RYK

MD5 c6fe7cdfd4896e143a40abcc101f4b9c
SHA1 f40f9c43da1c4303d425c0b5526c4ffb7434bdd0
SHA256 373513dd88cf8d5c2d28cd9c000e48087e2ff2bc36dc9714ec3073d437d7bcdc
SHA512 23813ab34535605e99828ef64071ac24613c084aaa1cb4da8c710de75f3361e1bf969b3b72cc3b350782bad7be5f8ea49ee2eb6a8a45dccf7fd8bcbcc91db354

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Genko_1.emf.RYK

MD5 1fb8706bc7f5b9b26845b269dd4eb82e
SHA1 b3cce18999f7930b2bd56663986fc1c60c65a786
SHA256 883949c637463e2129dbcb160815bc74e2293aa4d7bc77e92759dba599f17449
SHA512 ffe870f2606fc938321d765bcd856c1921d0346146d479b2bcb4667876cca7db91af6f028dd6b83c2cd69e18b80e241c0c23a6ad732849988b64f9cde38e695a

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.RYK

MD5 6178d94e7c9018e790cd9691e6f3e7c3
SHA1 57d3245e41441d679746d61c27861cb15fa386bd
SHA256 5f556ee49f1eff8417a95a4b6c911866fa5586044be6b7425f01235b5083745c
SHA512 5355a0b995b75215566ec717a5c92e821c46dc5e76a6b37c80e115df20fdda0ef888985d1d1453ae8a3f15a03b832c25b097f89e13114135c7b6908521359137

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\grid_(inch).wmf.RYK

MD5 2705392712942e0325734cdefa16c72a
SHA1 702fd9139d32ff2cafb261bf46395b2cf34a2bff
SHA256 914970a90f698e831829ca964ddb7623c0f212afd22030a9618bbcba22b114dc
SHA512 e2fff7bfd7af5c7e9d0e22596cce9e4f553d1da0ac7f122271d2a6307ac5f457c3927a00315baa9d09cc1c5d169bf56a802513f1fbf930265fe020747a295099

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg.RYK

MD5 03398518522e2f0be538204177e58434
SHA1 580e2d441890b858c194fb6e33babf320541512f
SHA256 b391d3b051246a724e74806715d2f1a49cddd704699f2ce96cb876174fbd9d5e
SHA512 3167eedf428465340f69e4d971495bb7594223156cf2fc763bf4352ea832260b7b1b295638acb03608191bbde7c957b9d940d178a0d99da7f9f37d48e9e157e6

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Orange Circles.htm.RYK

MD5 493da412cc991633e5caa2087cbbaa8f
SHA1 95c26564f142c133fdf6fa6a5271894732224f49
SHA256 73e361cf975f2eb7f79a862a59f5c51c1aae7fbc2276e24937ec73fc8b5a94e5
SHA512 eb658208c0d2bc170cfbbe725e11ef7ec4edf46314fa1af78b04b22fe6db211ed192f0e3168f0009c19a9bb17e9bdd8ef657fc97abc2341b4ec886e444a1f55e

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.htm.RYK

MD5 3758051b5157a5fc5b7eee6bdf670f68
SHA1 e9ff0c204ad378082d76dfb272f5e5561588867e
SHA256 663658b95072f5aa26d5c2cf942f8e27b1baf215de3ec81c2bfcfca6bb206c2d
SHA512 2eb67cfe488a72ba58fc259fcd4f779dbd8f9f64401778f3b177dcef400acf8152c7debda46eddb5cd93c082a8d3a9520a1a5e7b05803604b6c98cbea144e4a1

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg.RYK

MD5 e6a91ce7d0fef1b249a9ca8232624299
SHA1 8c81b71941b950fc7218d6398d1cd5bdbb7ac6c5
SHA256 18f3af94e478db5e83bca15717be30da8969f7ee2e0d062c53e00329b2cbfab8
SHA512 70bc669a1523f80865bdf195357ce9ff48bee0231e810a70567eaf0a5d7af67f799df54b07aa14fbbe8c7e8089b0c31087570915b73e213e2073070fea5e1789

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Psychedelic.jpg.RYK

MD5 2f56336bc9f165d8b29bc0b2be6a07fd
SHA1 fb21447f96eae47cdecc5a17aded8a33efb03509
SHA256 0ccd34da23d731ab0858de584a4e00748238b1a26d58905e3284d66924680950
SHA512 b1575ea5f0af8e210ca5753e00ead34f2fd17ae53b54479cbadcbfcfeb2ff81c69c21d7f5e48c3ce62d56c3c228e205368aa5bbdd4308a95623552629530c57b

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Seyes.emf.RYK

MD5 12908c81b66bec537f25d1d6e9f93bdd
SHA1 44a5d8a9a4335e30e021ea02f17b46b5f03cbe09
SHA256 0b8d842d7bf8cb63621094843f22ca5500723784d091a37756dd2ff83d04fdd3
SHA512 cef2b36f309a7c15a8fe46e87168890c5e2189363f203feccf72211873eaadcdc1ea2bc224f68b053ae93329ce7141171a7529419913d50c3586dec4ce4bbbc9

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.RYK

MD5 bdbd9b326a61c50840676871a5b97df2
SHA1 dd2207ddaaa4e0b77d96028950e5ba7aad6552d3
SHA256 21d74a364d6ed082eb5035ec1b7b1d57ca10c9362e42d405b605f2ad19747692
SHA512 4828c9c83e28237bd5027e5785d4bb22dc00e92e5b583f78c7630cd2eda3d64ad3436e753fadeed858afa56e9b9490b6854a9d4c279dcbde8b90967b0da68783

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Small_News.jpg.RYK

MD5 3e22bc5d27b98a8ffdccf0418be48eee
SHA1 68220c5a741dba38e786984b5d7a2c456e7ec80c
SHA256 0d01c1c488a39af03337b4161f59398844ed3474586992b974bd35f59691bffa
SHA512 372a0ecb8355465182f32fe518c932e8312a040d36ab289d22c9a1963a6e378220bbad0d4723517f6f688332aae6331bfa91eabf8cb9e22fa5664f7c654e72da

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.RYK

MD5 1808637668d88a669ab0e5803835555d
SHA1 ce00d6de11dd29d63f02e0f05d47474b953c2b74
SHA256 3bd15700abdb1fe1958edb1b524fa8cf7cbbd5b9e9e34047f2509c0a57ff945e
SHA512 3892623a40ccda39ac741aa19d3c66275e6bfcf1d8f2801603cbc6d29cd8a1c4aeaa848fa0229d7102e4ee6b1033b0f3f35a970fc173237126e3f140f5c429e7

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\To_Do_List.emf.RYK

MD5 b6d9faecada07369dc37245588cf26f2
SHA1 360b3e92bd410663bbaa9d05dbfc3cf150054712
SHA256 cfd945ead89a74233a54235845ef27e0c904a1c3907a690806a972e0860cd8cb
SHA512 6e68e15e2334bd47b2546eefdaa70f049f814039c7fdc8e2653494dbf5c47d598367fa80c884ea076bc34ea55d1ef430ab3f80d6bee2474d5e45001e99f4c705

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif.RYK

MD5 1f6e48a7ce5f75f956be8bf3e09f4da4
SHA1 d112830e8a4dd8614a1b60ee00d566a8985952a6
SHA256 d95b91d76657a37e466d884687abd6a668d74bf19fb812a20cf3cfcaa7481032
SHA512 edf6388962f735ecd9753c50dccbb45667e1c5aeff864bc6b8ea128dd591ff8b2f47f391f9c7390c13f0f03c84542339d0fc9b9618977403fd31238ef05872a6

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.htm.RYK

MD5 b12e07d0933f6bdb15ff3f4c413e1a0b
SHA1 c16a15dc887ac63d85627e039a5b0912ddbb526b
SHA256 c76bb6382a58900668e9446f6ebd8de822ad8b8db5162335c7f1fae828254aa6
SHA512 7ca1370610ef1d73cad96340dfc7c50ef1cef7d2ac5ba992917875c2e9a3824ced9b1a85e439caf1e20c05a506cbab10f1d543e71e05171087c4dd82cfae0a27

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Music.emf.RYK

MD5 7a952a058558f6e5d81e8145b55a9937
SHA1 c8bd2cb2e74d8b5f2d0400fbb3bf9f50f6870bb6
SHA256 c6ae8dd1b5d0249019666eadeb7f6d62e6e6b381de027ee68c6a1b95eabd4488
SHA512 cf9a5f30e42dcdda86fea80d7db9b6bb59c1ee47628c3d25ab216ed77ab5ea114da01fc44ad2d5b5231233f6c0d8c25965a7d342cecc5cc9d8086a377c89e3ae

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg.RYK

MD5 093db2117276e0cd951d8750431c2fbe
SHA1 a152cf87d93b0c6ab00e71b23f8cc851e38a730e
SHA256 50756c5b30b9c386b7cde62d23d03b1816e47ba74a948f44a90b00b74f1a0b64
SHA512 1b60b550e43d593aa054d406abae2f3cc998a138ffda4160ad806ed66a0198607f4f5dcd93e0c834e849de74db4927c18ed88bade1a70772bd5fb633fabe3678

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Green Bubbles.htm.RYK

MD5 617f7fe7ee35696c2b4718500b7f95f6
SHA1 1f06493a9c5a077615a74c5b1527081d2640e2d9
SHA256 cee2a8f8078dd0e7f541305ab29b3e83441a540a11eab859b1afd2980464f11f
SHA512 1c3ff31952757ea6e843e81f869ac1a262d353cd2f77ee253d82d06b1cbafbcb79851dc0b5c11f7788a894d82c0fe071a15efedcb0978b0f6baef3167327a96f

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Shorthand.emf.RYK

MD5 9169dcf0464bd4e584f75604f35852b9
SHA1 db5559bd2d8832c818fb3cc11acabb0649dcb61c
SHA256 a2458582c6771215c95c03a7a6f137576925f1be58f49c48759e2229032cd027
SHA512 89aac7ac12b890f5c620de3e15a9b2b4aa70de0fdb5e86c0196450bd9a0e58130f924c317bb43015e431d68c6eb061dbfb29f8ad2a9bf9650c74c1c04f037f38

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg.RYK

MD5 580d90cc6dc390c5e9f6d273cdd28ddf
SHA1 bc2f4b088f3ab78f6a499f02ed99d828bce7c084
SHA256 2a001253a365af50da66a922304ace69a9e90c7a5a7c6937a054730d8c4ee7e0
SHA512 c1c7ea1087e14c536f6a62341e69d586792ecf6a1e4d83c62e18e02f912590f30c44335221c7d0814cc3bd72dd8857c60228f91693a18b7c4ca3e4678b8f2d4b

C:\Users\Admin\AppData\Local\Temp\4d3370bc-5b10-4f8d-abe6-39b8f9d5291a.tmp.RYK

MD5 1d9c21c91c839a02eecfb8d4d961cb30
SHA1 745be77206700f7937e863061142c6f1c208198d
SHA256 ea6eee7db0c36d178f4ef5769df5cf497656bf4acb9a0ef86d9a035a6354cf78
SHA512 eba6affd46a9ba051d2919cb6e95d715c038b210c63c2c5bd04ba260ac6c8cc307b103e19ab29e3b3f610a4433c53fac1024ca7b6bf88aef32da152001ba23ca

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore.RYK

MD5 ebea02112f09a319c2af52b0ce1e2631
SHA1 c33bf52e4f4b6b6592ff71821d92e68d177d6cae
SHA256 bad01b9772bd9a2969796cfa056e85006baaedb3373c9f1651faadc07110f57f
SHA512 1ef11315eb2e0dc1c0ce588179104404c8a405734eb43af449dff520175edc6c5057d7bc96517824d7ab938e1fe98b5cf55e28f2689d144f478ab36c4bba36d8

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000073F6\05_Pictures_taken_in_the_last_month.wpltm.RYK.RYK

MD5 8303ec8dbebebf72c7c5e0a848332640
SHA1 0423417b3315d21f9aa837b38a04b9277e68378f
SHA256 da461df3f957469cbc2f54928e6ccc1cffca691d73bf2cb6d7a97ac19292c6c1
SHA512 66d2ab781f7b853a129da253cb5ded6c2f52a3da9331120fc78beb13cfe09c8ce6813d1ba9f5992f26404cceea22b96fbcd98974fafb420c95260f5683a102bb

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml.RYK

MD5 d55dbb668aac7de256759be3b7965f72
SHA1 42f1f95b3996d652bfb2b73bde9b1959541a933e
SHA256 e54bbec625da1ad4e8329e307e113dbc237c62a1980ab13f3182ca1b1e0699ad
SHA512 ba005ecc1d4ae177ac5f25167b162992dab1d1614f3d71d395bb4b264db41db30feb17674d2d8511d0dbe534462027550a126d41c8181cf899de388049445248

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Hand Prints.htm.RYK

MD5 9cc4523bb2958fdfa72e28f3e1fbbfdc
SHA1 2b8e04ed742d2627ab76ee5d585d05b8fc3e0315
SHA256 fb55c6fc5928058ae2ea8d52bd263fd929370fa1f3d33af09b6fdf73c2b6e812
SHA512 92a89c0c2f0551bffdc4369e01c48914f0fe8aa8492f4e205cd0268e90a747091aa09f416063b4a26496d3ead8908f71d203aebbb1e43b3ab370ccabde7d2cd3

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BF9F8D04-735F-11EE-AA50-CEE1673409DD}.datOfBlue.jpg.RYK.RYK

MD5 6192a7d6ace21de5f2c5e05805aba5d3
SHA1 82d9e721b9c20b236c294093ab82e24a01a690a2
SHA256 6732852d1d2f0ac2a948acffc98e2d5ee185796224cd841b0fd5d2a8d24c4181
SHA512 9d5f686a4b04b29ba0f52d4ff8531ad10e84302292b9d29012b4b2824102c890d9e146c1836622f0ecb503e4f055ab62983b4dae9ddd6bb05ad36ca19116de45

C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms.RYK

MD5 93e2ef8c26fdfea47da331b531521ec1
SHA1 a730143e9839eda196a1586e7ae6aba6ff16a798
SHA256 07ec49fe19469e32815145eb626304ac43b0d484e838680fd78643105daa6211
SHA512 8fab104eb60c2652caec27e161429b6840557495823c3394f9e470a596ea8ef6fe502f5f114d88b5b5ac41c77aa6366aed8087404b3a357bf047f5001af4a719

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat.RYK

MD5 f4304b348e8f28428aabda4c67938ee1
SHA1 2f87bf28c977a440f5656037e899ca168ce52c89
SHA256 21ae34b82849f06e94e5952eca06a0acd09bbecb800dbdb048db9f39a9ef0767
SHA512 b78492271068528f7e1e044883386b37e166d49bebbd1a56495d67cb647782c83e9d180461eeaa79ea42173ab89ef31253bd83846475a0f5819f1d057c563fca

C:\Users\Admin\AppData\Local\Temp\lpksetup-20231025-171550-0.log.RYK

MD5 bc5cba54573588c897062cd7fb7c203d
SHA1 f61b77003d36ec74c232507f28d8693b967c0870
SHA256 3a61be98f84954bb6308f6bd1fec59cc27ffd8c744e48698737ee2ed6c54125d
SHA512 d1d9b246091e013bad6b49b620484ef380bbbb9939e80766100ee6caa494d4e7bfd9a9bf04c4829c5d117f695b7ff6319778fccabbaacc7c4ecb577100a6d27b

C:\Users\Admin\AppData\Local\Temp\e5a31511-ed7d-420a-bace-6191e5bbfbd8.tmp.RYK

MD5 905b9b3f33aa29f87b0e9744a87cc171
SHA1 fb23a75132d6896bfd527c2aa621b9415e7d2bf8
SHA256 96ecfa708bfb24d1c2689d1fd274dd258cc8e7a55c3a57d0a9ae39b4f292b60d
SHA512 a38e4661e2c17514e052f2212e5d04f84e0b455ea8a95ea1c3ab3664f23a8fd7dd8b668a5bf2e60f5cdf3e67b394cb73cdb2a5be77b21daacd16ae563ba5706a

C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI63AC.txt.RYK

MD5 75a9a8262cd7f309d4cbf136a21f263c
SHA1 ed1c52dde2b15636df4ecfabd3646ec235740aab
SHA256 3ff84ba644e6aef026b267e3fcad422900d052db3425afca474ac9049177e8f7
SHA512 51fa8848324445fd992a907eb7273f9b9b233f83e2c2bee280f5d0fb56ac4776144c8a92220af68c5e6b8997ba18b09476cce401d03a17728584713b0e2f48ac

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat.RYK

MD5 0e45c26c487c48b0210309d326ce1fbf
SHA1 a733429569a19e5bd8dfbef9acd57e5b4540da53
SHA256 8893d8f3af37d7f633c7e475ae80fde766e5abbc4384264aedc0c4c6cd52488c
SHA512 9f09bb174e0f6da246721a8b770573b6bea385cfefe19a9a5631cfef7954fb40f4c3168f492d0be1f8233c2b21b72fc1419aa95d6c8b50c018eb5dbd60f1fb31

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\account{85A13177-147C-4AEF-924A-4971B8B0062D}.oeaccount.RYK

MD5 553cc7a308205ccedf226b711525fc89
SHA1 fad6d10744358df5ad146453a0b2534e25d23512
SHA256 a32870b43feec627c693c1cbc236806acd00359f56fff059741fd3605a759071
SHA512 6b91110ef58f26498749e9a1cc55f2475a4b361e3553aac6d0644f061b255d29b9f636053c9b4413d69dfc48cce314a1cf32a575d2f650d6e3f2b67e14b09534

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000073F6\08_Video_rated_at_4_or_5_stars.wpl.RYK

MD5 d67b040c74f484affad119e7b8bfc2d4
SHA1 82b72683ff04a3068591fdf9c475f14f87b3dbf5
SHA256 00f8428db9cc700f14ca64d9361b69f1924f7ec4a97b5adf2a4fcd577ecbec82
SHA512 bc580704f4bf08d562f8fcadb8e689348ceda9339e00e02a8eca254f24f91a6ab627396d75d0b6f92cede6224a8c647c2017504c3ce8365c1c9469e1daa19fdc

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000073F6\06_Pictures_rated_4_or_5_stars.wpl.RYK

MD5 1cf5b8eda9fa3bbf02ff9a396d7ccac5
SHA1 cbbefeb11bd28647783b6e67c891bb54acfeb484
SHA256 26013e1e7694a556aa06365a6822f16e6dd49d9faea213af0713840a74ce623e
SHA512 7dd2433d3f39d1aa9a35634d8d433b229fc750288d1428d15b3eee5ee70c8740cbf01ee5e6479ead9288cc92d25222450cede70a5b5f61821c7629d950410594

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000073F6\04_Music_played_in_the_last_month.wpl.RYK

MD5 d2ebe12df30a846316dbfaca4380d960
SHA1 a4b45fbee7f438fdd0a99f3cb5beda96dbac2f02
SHA256 6001d9cf91d4ec929f2cabaf8e01e57f29604af43fb67954f7e576082e98e9cd
SHA512 c84e9588dd363eadf6f9e0136b1be177d22780c3202d169dd2c85a49a24ad3fa54dfff0556ede54dfd5ed047df1ead6f63de1df488262fcfd9611e3ff2c58751

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000073F6\02_Music_added_in_the_last_month.wpl.RYK

MD5 07412172e8c3c07a4332923c150ced74
SHA1 13ec9bd85131efa30313fcdcc350412f2b2b6619
SHA256 4e452eb241418d26c11a14732bd4e6185b766b7731c6095ec02f7bc32b018c7d
SHA512 eff16edf12d889049a3cef5425fe6fcef97cbfbdbef438a9c539892d30b85efa207f2af300f621ed3b6b18bb956cf3aa9627d04af819b9f9ce386f6e2852d257

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\account{AAA255BF-8F01-45B7-86DA-9E31E47A2E41}.oeaccount.RYK

MD5 62c0a07432c027d1e55f41103ef8f60e
SHA1 d8a89263b9d4ff3f627e2cdc5c2de4a44a9db8a3
SHA256 b4535b470daccac6f0127b87d100e0c807e20814cbfbb8c5639890f47b6c66bf
SHA512 0d5f393c948f387420ba49ada4ed46981a7c0fa6ad975d92f67fb507c2f7b0e6171e0958a06c6d8feadecf5e83613090c4953fa285383cfd82af68f0ca2b1db4

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\account{024725D3-3CD4-4C39-9D51-97D850777D63}.oeaccount.RYK

MD5 c0d134680a1f92b9ba90488ecc26c3f0
SHA1 8b4f5619f50d475b32e70d5dd476a3953f2eeced
SHA256 150d6ede2fcfe5a3e6bebb2af24cbd1f5c6084f0a463fe0e691a6ad491bc3e02
SHA512 6d219e538e95f3d3ad7455c9b5e1898390e1d7bc69a540df5753e1b2835fa177628ebee1cd4ccf483bfb98ba5b77252328c07bb8e246979123360a38a3a12f97

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{98652890-7359-11EE-A578-CA9CBBC363D2}.dat.RYK

MD5 05529fda9b0e03050f509f19449b43a2
SHA1 663977879ae69f11d074ec789f93df206d7940fe
SHA256 667d0daac026a3017ea6e3fc5cdb9409d1d1326a6f7eb086a046ea0b3242af37
SHA512 bec28bc9ae5356ee860481c0f479280ec696afb6715f9673b2e35d7a79b79d5ca9d2ea6cdcfb0e9da730da355d694c34266f25795aefe2e6573a0ebd1264e698

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000073F6\09_Music_played_the_most.wpl.RYK

MD5 475bafea99ccbecf3a41f390d7fc9acd
SHA1 1d81ffea2de0d7cfb4666c1e7ade9c2d396e50e7
SHA256 8d48f00172f08d6c027a50f7582fb2d9ec546d730f948e2b0aa88aa886cd70ab
SHA512 654cf1a4cd952063d1bae25412f02e3677c2320f9bf97a3a6a45c3b9be1a4687676d2a1997e286d9287a2fd06207c4d56f7f529524f75acbad32925662483a64

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000073F6\07_TV_recorded_in_the_last_week.wpl.RYK

MD5 4564d89523357e706f4f18a356c865f4
SHA1 ee541fa445520789274cea967340869ff0bc26fd
SHA256 19db8bd9e1fe22cc799ee1790d4187d49e1f46b870a98087bc05b6df25069fd1
SHA512 16a0222dee4cb21069ea942a7694d8a41b6652686e55d7efaa1f1ea95fe7e89d725c82162a7ca7f186eb7fb27dbbb13769c23e5635bba3c6770258791efd3c87

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000073F6\03_Music_rated_at_4_or_5_stars.wpl.RYK

MD5 332b21a0a91bec84112202a24f23f89d
SHA1 cb45b83796b9f050421a9ea879b476c28a6dc599
SHA256 b278dfbc432281022325f6f31b2d97f160fc7bb08bbeeba5c6dccb44ea46f1e5
SHA512 6ad33ccad3bb88a315032d6589dd5f938237c8727233e8fbd306673d38e31336bdb7b0c2dccea82f7ff2b426c7a09a4a31bcbec67d51c2111ab350cbf4c61ef1

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000073F6\01_Music_auto_rated_at_5_stars.wpl.RYK

MD5 0c553b2c969b52f0230d9388611d6832
SHA1 e0d238ea1705c84251a87fc018021c539a2adc6c
SHA256 f362f2f8d268bac0d22108f110a7f4bc34aaf8fb451c073864af56eac42ccb45
SHA512 809b4fbe829b9f01f7e6dd0bf44e14c1785a25cf853bedfc6e7cfa7d33fe44db4d435b9e9dc89cc4f846c9dc4bb7343f362b57db1096ad97d0ba2930b8b49249

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~\USA~dgov Updates~c News and Features~.feed-ms.RYK

MD5 5d5b62f286abd93034732f14fd760394
SHA1 92463e65688d3d48edb50b06c5e256f67ac145ad
SHA256 1fa8421cae1a51bab58a7e9c87b08bcab01285fa81de36e3370daf9966337046
SHA512 c20caf31aadab917d68065c17a506f68b3cf935b5100dc05c3ce8b79366642ebcd9c2c8a9a3d4c88e17615e6484edfcd2fc6e0794b2eda170db497bcf04359f7

C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.RYK

MD5 4f4285964ddd43ccca40b258402645ae
SHA1 ba510f91fb5f571838e2b1299c374c4deeaa88f0
SHA256 379f154e8be3301a24e767904b06687bb01d54259cedd417fd56de170d2398d9
SHA512 7fe17ad395c8459597d83835844e4528b54ecf2d78adb25b1857ab238c94a40efbea0c640c5455234b5cc54d2a292d5d69ce1b0093990a370e71142d7abe42d2

C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20231025_170051763.html.RYK

MD5 7ce7a91df2be0e2ba136bde261cf8952
SHA1 9e40831b6bb82f2120da00b198fdd170b0064158
SHA256 fb1d11332c963e096406f61e3624bf7675d3aa4e1a1035af8d3bf7b2f0ab6804
SHA512 8ad30556aa0e731b1521e37f836e0c9b93b850c1848ff3d81aa342450e13c9ccd1936b3a59f379d6b462f3ba38976f65125929a57169d787c9fefebe1b09a7bd

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Soft Blue.htm.RYK

MD5 e958f9fe950ff9edabacd5a36f1339e9
SHA1 e6d366aabec3c5f15d0377af99cbc4346e450cc9
SHA256 ca62f7e525e52ccfe4fbef9686a857694a9a950ba9eb0e397bfef246abf87c04
SHA512 1d252ee3bbaa52efc161c4709250e38963f25ab82c4bf3ead20f24a2c9d6ee166d40448542962544abb30f0e5a7e550f1c1d454dd8b6d057d409268e343ef8be

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg.RYK

MD5 b53ae66af47ae1ec2e8f413f3b13ad9a
SHA1 bbc5e284186c8c7c29c4a5c1f73c6fb0a12e9f49
SHA256 31cc36be772a725a41282ec0260d845d68eee080be1d15c84a05ff06e51e4792
SHA512 7ff0189862c6ebabf6eebd6c46fee8c80b34b36321af3f55d08266644aa4c73257841d8a28dfcc01aa016f0d62ff19f975d1d841ed6083a0582c81d809c226c1

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.RYK

MD5 acf7ad11e77f6e580aa675b55cb54a6e
SHA1 14013975d72de2f98e2d43ca1acc489dd46beec1
SHA256 4513dc4c6937f09155cda8d3276bcb5b64d53605371c3f37c6de01a90fe37d07
SHA512 a6eb05ba18ff46d26aff461c40edc0ee6a1680225338a65b18cc4a4eb345cd1536e66d84338bf1b46f4c4fdc8c8751b86b681b70eabb82ed506253560847d986

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg.RYK

MD5 3441009cafdb9c8ba4a420dbc26f5158
SHA1 13904e2009c8415de0f5f2ba3be5e071f23b166e
SHA256 728b9fec0ac487a3efb8fd542fb3f8a8aa0a8051b10ff69c04fdb236193c0470
SHA512 99472f3ada78e71ff4b3a63078c46647ed5c57e9c07975ac1845316a0045275d7cd6739a0116e605ba30be2202225a234cb5e1ac0a916dfdc4b61e2828698a9e

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Notebook.jpg.RYK

MD5 29c20b2e7fec468d7ec9f3ee26fcac15
SHA1 02071e8df21334129b483bd10bb90f6cd486128d
SHA256 fa62f373c3dad163f739b0c20550a2d3ca064918178cd1b2e31ee882478629c2
SHA512 1826a9a8ce8e046a3d1ea3fafd7aa3755119d920c81c022ba70774f1fa6451178ceda2bd5c7853f1c6fc8b2a8d5d6026962a87b710a064b0881003d2d15e618d

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Month_Calendar.emf.RYK

MD5 42db5bda8c3286998193a17b82985dbb
SHA1 d33c0ebb5ea4af29e7b1fe5d7c2049dc1aeb45cc
SHA256 a845530f28d9d855eafc550ef53d057ad2618ae573c3f8fa46ec5db563ae32f8
SHA512 3068f978840efa596f694b6eecce0bd63e856e424e29a754753ccaf9ee24afabf33b9fa1b0b4c45b661c3c4a870723b075e7b54e0f6770dc1d531d42ca595427

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\grid_(cm).wmf.RYK

MD5 8946c5ee318c24e283ec26bcc9ecd432
SHA1 f0d6f18422b0599af637d65457763d8f02c1b6de
SHA256 e46d3dedeba561ec6f3c04ec697de0108a74daafb58f8d5b63a5e2dd0ea77e68
SHA512 5d5cf7284d1174b7830bbce5d46145d03e34b087df39d31cd810c24ee135dd1e4c512348529daec90dc18630b19da6d8f6a1f3c469580f264cae1941c1631e43

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Genko_2.emf.RYK

MD5 98c1fa7a635ba15aa2453fa3727f31c0
SHA1 412ad49bf40f1616a585b5d596f24fa2a7b8e614
SHA256 c9ff788976e1c37093e50462ab313570fbea06625154840431d8eba0b555093c
SHA512 4fe4731c6832e2839e1331cbba37b22dbf91c9db17688a10184a14d9cf6c3296c581e6f0843a8a02aa3c5a3fb7c8c3851ed186a96ea2ce1fca2903c722f6d1f4

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Dotted_Lines.emf.RYK

MD5 91d13f9ff853bf247c02d88de9de3ed8
SHA1 70acfec6affc551f95b810e95ee55195bf0a65fb
SHA256 7bc6db8e6d3ac54550aada10386b59fc70c84efeb1b15d0e1820794d0f7fd4cc
SHA512 c0570aa29ad0a222fbad034778c205f2018a372aa325a3e4cf4ef8531d8479e99ff7e07d8ed293b510c3cb19c57cd695d936862d74dd6d6e6da1122c4c3cc926

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif.RYK

MD5 f0cef59373e592c61090058eb6515e6a
SHA1 b555f5e30644291520bd283cc605e669abe33fa5
SHA256 b8acd1e8e12618604aedc059fda7a7567e4d648322b46c4b52622833826c1c66
SHA512 e99b77f1b0df1aa28ecd4353b88567d60a268610edd85fc73ca83eb7e75ee78689a113d3997159647db8d2519bcf65ae5d1e8a19fdac45c54c468ec3e60072ec

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000073F6\12_All_Video.wpl.RYK

MD5 6cb01652a24fd311456118b61103673a
SHA1 f38491a32572f841ac708575a777582429e625c8
SHA256 3935c7d883bb960e1b633c0dea63f112c7c5eb1e554e68f988ed5db8741ed0e1
SHA512 40a013bb0e86a923214d80998c146dad1d7352238ac3e3b613a45842de8949b1c9e2875fb8aeaaf36115be7acf70f60ffdae8c72741e815452f6e519e73caba4

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000073F6\10_All_Music.wpl.RYK

MD5 25dfd08600664e055978d763bc975351
SHA1 ee0f474bb8029a52c0091c9836bf2fa035baa455
SHA256 639e66bb075f0dfcdb9262521e3042f40ed8b33419decf5ee54ac7bdf20cd5d4
SHA512 007e085533b1a30cc1b4a1b69653c64cc6d08e25ba437db81d9ca2d82a2c876c252c1f2d8233e6460ee844c1e1dc5938a6a34ce996073f4cec7efa3ae2bc06ee

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BF9F8D03-735F-11EE-AA50-CEE1673409DD}.dat of Blue.htm.RYK.RYK

MD5 612b0b3bb3536a63796c156af0cd9b8b
SHA1 66f105dfbd500e16a45b8b9e8dc1a769fe1f0ce5
SHA256 715fac74d9ee0411e446863ed155d6d75c118f4d6f1eac3c3d59725aa181c628
SHA512 552c70a38ebed2e4eeb7c6f9dc629efb6f0b458f6a2a0e88c0aa8e4fdc4cd3d577d52933c001eb09bec72d844f6f44251a367e432bad396d04318f2a0506f427

C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms

MD5 228a068fc7894b8d253b92f8a1e51272
SHA1 f618ddfd198ba3a9636f247eb1e0402b72470585
SHA256 9ccd31be3be3d464cb9be217fd451a1d66ba4e1a5d41289822759cb4657e0680
SHA512 1d50b4534f79190f7a93874bdf1cd68d8f02995b22633bec93226f155c9046e0b334c5a68f2362c7553940589638be7231e233d76af21530a4110994c42bc9db

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~\Popular Government Questions from USA~dgov~.feed-msalendar.emf.RYK.RYK

MD5 77b8b2a81ed3d21f2773f4003ef23e04
SHA1 c894a93a4ccb2373810b0c57bb5c1be87ecb8d15
SHA256 9fa4934d4dffbf61f07352a51924e24f1b43f14e010afc13814b4e08f1a9333a
SHA512 fc75a574de7a514f832f1bfd7d7ce5ba1292c0c958af3fa0ee53cfc1e109a47a199cd3fd35358ed4734cdefdf0cc9f122102c9149ecb91b49207d463d8415e4c

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin9728060290\msapplication.xml.RYK

MD5 2cd8a8379effbef75f0fa17245b87364
SHA1 6140ae11b6cb119c1a3305627d4926a5c1c6a65c
SHA256 2b1c1503c4784e10341d2066216c701d864b862246d9758f53706875bab8784c
SHA512 2682e0935bf9f9258743270fe4b2576a0566a0c25328f3b36409b674237618d41938ce397caefc795f8e2ae14959d47d958f321272e8ea6b702478d4fbaea529

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.RYK

MD5 f7a56f8ff11e989345c5bd07541a576a
SHA1 b682fa8cdf743454197d1ee648d50d4c81a55be5
SHA256 f5cd277e8c6cd611a2d3429711814e2f493dc273202ef895f819b3b987941788
SHA512 e40da0e65e73e91f9354bfca30e7f4bf2adea986c0dec8b7664d3d8de0a9f5e9afaf21edc1a5f8a8787a946bf4e94fe1715e57430768cb7ca42e00de2e99736e

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Shades of Blue.htm.RYK

MD5 c275e435e74e1b74e40ea5ec4078ce2b
SHA1 9588f5ae6c6435def72f522d3ce9d7ed190840ee
SHA256 38cf4e1705226cbf73eebf6ad69afc2edd1a8fa47b28725865adbc4858c84ae0
SHA512 b5d35a708918f5034231982ab96cc6760a783394ac882c970b12e14f48c721fb428ff63220d9aa903012d66044de02997ea385eff95b202e84d9348fc6c42db2

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Stucco.gif.RYK

MD5 873ce305d3dffc6fc8a28e11cc24efb2
SHA1 871a46d6d74b6f6aa991ec28ae0faa0d9f1036b8
SHA256 dfec94d2210a722319a6975c096eb7c03cc4e7a5a83b9ee3531570c2c66d331e
SHA512 c79f2aa635b4ee3c31305355fcfb3cf063d48c170f53959b498c405667dd71bac02f2fe763c67424d0556d223bed2337f32c2ee04c6ee0cfc1a218a4daa285d2

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000073F6\11_All_Pictures.wpl.RYK

MD5 77e112d2f1cef401a87851ca7d49396a
SHA1 2601d2619d174ea443cfe87a63ef5bb7281ba5a9
SHA256 1d944008355c50005aa084797f8b805d213a7002cb51a7036add884e21cb18eb
SHA512 b1151a35f85a294efd3f4251f8e3c667e0661575c3c89cac0b660d83a6db95c38d36d51b92361e7573b5d9bdc14927002fd0d8f3fdcd69ff3297584b0786bda9

C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20231025_170051763-MSI_netfx_Full_x64.msi.txt.RYK

MD5 555b737e528ae4cca191d98512d22844
SHA1 3e5fadcf3611063abbcf006c72468e4db1ef28be
SHA256 a2982dfe8f7ce6cc337123200c45cdd0fb204bee3da2a34a90d2215992856680
SHA512 2d1d28c1806f61b28ff802f89d48a8a701bc6a5f491abadc16fb0e3ce41577b39b2025425fb1be14b5a906206844ef353a91f2fb0ae8c63d7a176f9b5e3fc4bd

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BF9F8D01-735F-11EE-AA50-CEE1673409DD}.dat.RYK

MD5 a450fbb30683ad8cd6cbe340f19bb3b8
SHA1 8a8ec594920ff01e48daf00dc5d8ac0dedd0429e
SHA256 db9a4615ebd02095660e7cdac55bf4fedc39eed4692b53ae2c72f07aa67c44e1
SHA512 3876d65c4e6bc3e4ce37e8494d78ec41c783dcbf6e031e22a13a592bc1f09d0cb703a9388790ac77a02d808303a9072377b662908aa2f803130d1400ce62961f

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Admin.bmp.RYK

MD5 ad3a82df1c0cf492efa247d4e309c6ff
SHA1 fec04ca27ccde7c291dc9ae629a08e0a0603320a
SHA256 99462c7854c2c9f22b106f0aadc042d0a5e455ab12784c56769f5e662f295ea3
SHA512 f20f0b33249b2da5b14bcf23f419990eb7c2b7a99fb24a959e89113714a3bbe2b20ad45527fdf6e93ecd2224b6a9aa96b7ed2ba0077d3212232878fd0360800a

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\JavaDeployReg.log.RYK

MD5 40384420a68e8ee5113c1f8678bfd7f7
SHA1 10398d990facb1f89e530b807c80342cfda0b5eb
SHA256 a6d8763add1c93ddcfc9fa4e4acfae61be23a9f45c4e91ee1fc24098a43eba50
SHA512 315393e638ff84aad3ad48551b7254d29efbe12ba6982e7d4314f87f9458a296d79508fb1b7bd07299def092ddf555ebd53e5af7f2bfb327b0afe84f238c3874

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\java_install.log.RYK

MD5 c0f7e8d0dedd3aec31038dce40a8195d
SHA1 a2c52d355fb70a92314875d361360bb083c12a52
SHA256 1c2c640257d8014d8be104f61117e8ba940c6d9f7115c2c36fb355a8f89fc1e4
SHA512 0e307b81f310ae8001f294ea3dd848e74198676aa70aae47ac64701240604b379818e9c653623a80ecce40d0f1a22e6b4c629f1214240a03ea180eefd8163d65

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\jusched.log.RYK

MD5 2426ef55eb629af2a29ed518461cafa0
SHA1 7fae6da3df7c03d0ef129ca6716e57f12a89745b
SHA256 a1099761468e8de25304fa7b8ae7dac64a9b59fd62133803e834618557d5f3c0
SHA512 5fced080523dac4e56eb401ccaf13c9b33395ec75a4fc7124452d89143f2a4942f0e6caca4df65ec32e388f2b006ac4c2cac46de161ec81341e3bea566ab085f

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Low\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RGIA564.tmp-tmp.RYK

MD5 7b55a83e1b35ca6cf30b561ff7f5ad9c
SHA1 50e96af503b34180e67374830194ee499d68ce7a
SHA256 b5129e2d3f52fe1a71639d13e8afb5d948d78f10cadd3f17b764de02f1e3ebf6
SHA512 2ff1af85be2023d992f671478a63ae369ab1658e44b67d07456e5c2d3d14ffe9ed5839e67341625342e2a91c41996889ccb17f2320f2d37f4bcac1e60cf8ed25

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RGIA564.tmp.RYK

MD5 8adbcf802b1a5bf3602002c419f329b8
SHA1 c138712d3f8229fccb3c352ac39447bbaa9d7318
SHA256 d56dc6b749100aa6708cb38def0daeaac911177e413f1c62ae922f9d1dad2271
SHA512 89ce31d5d18ee4bb84c89ec50cb583a0d4927d0f51757c70724a0e3040e67586e99e9ec304632229eb8878b8dd8ecc9839ef3b158e6dc243d3f9bf90bd8aa938

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wmsetup.log.RYK

MD5 0743069f89fc15597da857343fbae7ef
SHA1 a12534f43c26bcee3d4aa1632bbe57bd9ffd0635
SHA256 78440af6549fe94455fa5a28a9b68bd48154fad38cc847687ba0ac522d85e073
SHA512 b2fd33cec81e44bef0290576089a7cdf44345ddeb8b1ab2fe6a94fad9723f46cee6581d64052c7f5ff27be3de26f3e9ffd6933a97e9847a3de93a126976353c4

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK

MD5 f2c9e44eb26d89dac453c4d0f05c8226
SHA1 30c4863646936f0f90cc3117179926949785449c
SHA256 7a7d8fce86c4f07cf1e387b8da835117e77fd09df28722febc1500bf8bbbc9e8
SHA512 dfcc67f6bbe9147e33270c586001dabb9dc0af922c649ddc5932a26bdbf725f199c53352e48ebf1638b3c7887f1432b1b97953e2f6b31c4c8c29dd6e175e5663

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.bak.RYK

MD5 fb74ce68df5d75dcce4bef4a79085531
SHA1 1281ba46a8f2af848aaf0026e4d072eb8cd46433
SHA256 4e0be34508648dd5654607aea64d51980c815e384cdb0bdafb36f018ad298e18
SHA512 2d381d3b38df54f45720391eda5457bb9693cb6bb0c7cdb9c3299887c2f857f119c77f1f2da2f68c8b23ef95a0239edce24932558835d4b9f815ce3bd8b4e8bf

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.RYK

MD5 0535dff6aba0f790ba8c48a79426c9a3
SHA1 0f48b1dd03c9a7ad04c2fb7375c20a58b8184d69
SHA256 e55558e214d6126d40681c821c3a98f5e61574e81e4a7a770826199b93ddafba
SHA512 0dc7279ca7b5d5e1dcf7e45e57a4f3a6572c18490fb2f8d6e0921da5e1067ff6235b62caf8568d6d891b39154ad8913cd0e4711f6db48843987acdcb016f2c0b

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WebCache\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\LocalMLS_3.wmdb.RYK

MD5 a79fbc11fc3cf7e252fc2fb12ffaf18e
SHA1 2e908d942caba9eb9d122333840f75a3f7400233
SHA256 b6129c80d5f52f55db384b5b9dfb8dd79809f1f4f3236b1b92945cb057bb389c
SHA512 bda8fdb8b26a146cac2f04cdfb6fa0a8ce003f2fd2ed8147a7c10333c2235c733420a07064e3758f4e820c4c7cccc4aec1be3070987f2cc0c734009d98f6e3d8

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\PlayReady\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\RyukReadMe.html

MD5 c6f80ae28bad8b8fcc6bb729d9e0d8ed
SHA1 60bb5e6334a1316f0fe709d5da2dcda01b427698
SHA256 27e0adeab3920ca26cf68d73ed017e174860fd92a16fc9f150a06c4a1d76e473
SHA512 cfa7cc27dba4e052109052b0e9f0bdb2a91cf2c86ecd73911b018eeab0f2f02d9bed3d747199858d6b88d57b45b8329defce0eb28474fb0057f3e47f2402ede6

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb00001.log.RYK

MD5 5300e35952ea1edef745dc788a3de4d3
SHA1 e2db298ddcdf18c3905c37bf7104b585b9f346aa
SHA256 2b77d8348ab1dca9d89b2036e80b6dec2fbeab4f1e253a484b3f05e94322a0a7
SHA512 8705b603b7340d22a4fb941ea9f94d42938d9c9320f9e71e0c4f1b797fd454ea5745f00c1a52c8fb78b37d9dbc2758d74d993dedb422b7c43a3331da2c887a0c

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.chk.RYK

MD5 39625c5ec53b16a35a0419eb53d5d4ca
SHA1 b43cef4573b171a90e4094ae76178bc3c364b12b
SHA256 6d5ae5ec8eed849d9d72281fbcd39b53366f38b0d8a9931b02452af11c6a637a
SHA512 eb2962d349ec7a5daae91ea8640382cdb4251d59482a3a2dba5f0e78cb774101816049d2093eee0d61f0b3ead5d315e24842ffdb8df2b890177f2339efea0cd1

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.log.RYK

MD5 a944a1ec89805758d2a2a4d2029c6ffb
SHA1 f4007977c1a086efc98f849ad42571bf43847bcc
SHA256 186f3ec1bfd393e071f679f5649e26f0f44ace146a25b10720fbdc1558dee8c5
SHA512 c3ad0cf4084cff88ec683fe755522116fefcb6e99cad94b346e5b4a67c585fae861551113c17adce7bd48bcd7985e21d39e6bbe7c261b28cdb091dd258fca032

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00001.jrs.RYK

MD5 b87b84e4babd755ba62b1d0fe278aca4
SHA1 7692174b3b335cbc8fbcd9074f7d75d6fee693f7
SHA256 749c7e003781b66f56723546bfd8800cf82f8e1fed80cfcab514d412b4f2b675
SHA512 e13b3f830a3dec6ab5356362ea2de1451811f505e2b57417e69ad926c0dd999e8672602889a1b5ac46e8975afd40fc62de35001ca4698d934a908fccf4a38faa

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00002.jrs.RYK

MD5 eabac6de537e8c9a47a52ca0f9ccbaa4
SHA1 6d375f420ac98105f7be6745a7d4547ffdb8ef5b
SHA256 4848ab3929625317601c37227ac023fa5c35557042990ecf22b9c16b4ab96fe6
SHA512 59388224ad0c1ebed9f0d764e5471c067e992b952b2390a7fbf2c84115a8e49fb28f675618757ab5bfc0c47b624df4cbeb8643bd2923b8055f18bd632d78b6de

C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\oeold.xml.RYK

MD5 3fa4d9706975570cc85b7b62dc2eef94
SHA1 6581cd77caae606e095423bd7fa90a8db346482c
SHA256 c66880d2eedb2b2337a17060915e894e7f7953149761307a29f0dcbd8f70d6d3
SHA512 53ece8e4edd2eb4f6fe182589e8c80aab3d24edf65d151c84aacfdf3930d444b2e6a481847fba2ca8df8d0e7c1554ea0bc915723ecf898fe11ddaec367ffa441

C:\Users\Admin\Music\UninstallSwitch.midi.RYK

MD5 09dced57c9d5e842ae2cfbbd71eee21b
SHA1 844c5e2665aef29da62f2bb47efee137f99cfb94
SHA256 65737854f33fe404e4e19297aacbbbd950e363b9da7e1db86838a9980d14329b
SHA512 1918b8273263335020321d561e500c86e8abd402c59c4b5e425de62b662dd3d7a3beaa4fb788c3cbca48aaa3050fc33f364ded33ace4ed5db7dfa271d9e995b2

C:\Users\Admin\Music\SuspendCopy.mpeg2.RYK

MD5 86348edd714214b3c9ffbbceeb72c4d6
SHA1 55a45c869ada4b956ff2b61e24a7674e48fff3ff
SHA256 9399c1947ff5c1637105d64f72b7cffb213da3135dfef1dbd1ff1df40ba7e237
SHA512 f3eb19b8af4e09952a7cab42d1df0df9e7b4b733626f7efb8a90377a2510850ea5d9c64df46c95805f98b9bd6c38ccf7b6a90660fd32265971df1d34da46acb1

C:\Users\Admin\Music\PopImport.doc.RYK

MD5 ef626ebcc370b1c0f70a34c6fed954bf
SHA1 bfda7261bab813d3cf235ecf987f53c46521f774
SHA256 e9f71b4397598a8094b3bb5ece224c5924377cc542e5b00f243e6a8b1d423d44
SHA512 f1970a8085e58050234c3a82ed1eb2d7343da281aee2d16aa1a874486b682e22e53eb1945d2d4a49d9459469ccac08ed5796fac68cc5dec9d8e7cb20cad453a9

C:\Users\Admin\Music\HideRedo.ps1.RYK

MD5 2ca9c707cfa273168d26216d140bccb6
SHA1 695a3bd340d9a63eb541770b797e878cfe44619a
SHA256 81ad8f75f1e8fe3416ff87217ca12c76acc97da1747dc9f70ec045627f3a0b60
SHA512 a9d37d7d2c5dc46492d448e8b1072b0696dfbd64a3f9bb236e908e7f6d1d128664fe840f86e1e6bd7e9e239f971893de0e3f8445e7746764da84c36c69206750

C:\Users\Admin\Music\DebugSearch.xhtml.RYK

MD5 c5a83a96bd6d881de39522826622f9f1
SHA1 0e633db4a6169c6b2807095641487054648b00a5
SHA256 aef2b97cbd3d273b639f51e7e917b45bfb642339c8e013f3c4a06ef8e31ea93f
SHA512 765144c5e2080c89b2ff3f139bbf3b8e11f6cf9f36a8771403e4d4d9c8e65dab6307d9e73af8fbd4806322685dc5fc4b1c7cd4783859199f58c43c160426369a

C:\Users\Admin\Music\CopySuspend.odp.RYK

MD5 05bbcefb015163e16bda55c3575399e6
SHA1 752bbd238972ba0742562c81040c8f7c35337f3e
SHA256 7ed109c425a00aa9597c1f0dd69b23f427c27a3996334b13e2ec0b58a4b3bad7
SHA512 c1d2ce506466fd4c59428a4f7e1b36a9e9ae3a81fa22c7a0069d0afaafe01d972f6dd75f2c36156a231fb8a37457d0f1d808d476ebf9048c52b9a67e8527471e

C:\Users\Admin\Music\CompleteCompare.001.RYK

MD5 7aa104c338700e5f56b8b2ddc99b04e4
SHA1 fec78b738b70744c151b7e70876ddb4f71b205d5
SHA256 609dcd83652b994d6509f136a0a8d31a987ee701881318168cfd3ebbeff04bc4
SHA512 1da3d4248c57c39d5def10d98d8dbd83f3b15ef35e022d15b4af1ce87734f26e4741186b4763ec1d4a037de31d618d97d604d1e1e100c633b9a8bd190ea24e51

C:\Users\Admin\Pictures\UseSet.tif.RYK

MD5 1f5681fa7cfe9b29e015b1c01f9757cb
SHA1 6406690b017cc0c988bf5253c3b551c6f7e71d06
SHA256 c326bedc8f84d822db27a33f9d024a184c06acff9e9b56018b3b4835e047e1e3
SHA512 9c50ccc7c4ea2f41a61aa0c7c766b28d1d7da45e623fab76f91afd0ab918c37b0bc77fe5d789fd2fa7ed818dc9c4f5b96cba6688c0f95cc18828ed19e737c23a

C:\Users\Admin\Pictures\SkipRepair.bmp.RYK

MD5 c58630d9bedee57bac0e277ffba1500d
SHA1 b96016b0ec17c5577572720815c3ae26147b4ad1
SHA256 65d68f1d052c9e3052df7e64b6a4a0848bd43ca030f52c99772e9626d6733540
SHA512 f703367b7165bf04a99206cd04e68bc433c4aee5e115c1ceb7d8243dbc2e2e41f218ae6485238d9c7633c12fdee34a451a883708e8bd1ebbf1a1eabec1941412

C:\Users\Admin\Pictures\SearchEnable.jpeg.RYK

MD5 a64b4f888a196953c0ddc0e095264831
SHA1 028fa85688084963d4e4f3f20889c8b5ae231115
SHA256 bcf68412d082d2fcf22c29e97df66ebd42a46fbad49cedadef9488f3a7bdfc33
SHA512 59af7ca89b97a29a60327cb8911aa12ffc05b30a9312fab9fb8b247fe71154d0d72bcd2fc647fb082c288a60f2f2d0116453ea7f3c1951b05b809b8efb374108

C:\Users\Admin\Pictures\RevokeRename.bmp.RYK

MD5 7bf7ce2a4643b163376d2b4f428d2be7
SHA1 e6b0b49a429af241a1763a3ec2a6fb138433b9a8
SHA256 6360333c29963428b5603de9f0eadb9c2ce8eb8921a775d14946c786ff668676
SHA512 48759789cb8f1c9140116cbdd0cacb3c4cf56d29f142ceb0fa55a6506b62beaec1786cc652e785c91fd80d0eee53872573d8766a3475a1072d47352dd632b2fc

C:\Users\Admin\Pictures\RepairRestart.emz.RYK

MD5 f4070da39d9d1bce427e6256ecd97825
SHA1 4a097cb883131d159662c63e34f244ee87a2ef69
SHA256 0467a031df6e157dbe9ab865d7506def04782983b4c75de1218cebe6cdf74130
SHA512 d0fb442228b0a3bdb41fbda98fc9a5002a70732b94d677dd61ab73a9d94f972a5207d0ac8ae0228f306cbd0918fc808d9b940a09bb21532e598bd3d0445c800e

C:\Users\Admin\Pictures\PopMeasure.emf.RYK

MD5 f66a25d80b66c1c50abee75627c18068
SHA1 7be1a187608f508b96bf499d0f3160cc0946f155
SHA256 5f8c6cdbc099779c472319774d78bdfbfbda616edbcde785e3e28c64ded3a57c
SHA512 f03aa88c29d7b2eae418f83811188267fbbde1eb72e41b064fa84544a70fb72b23c0a40c9047bf135292c5256f65b5aa972a9eb22bd48b951b88da5e37f8a29f

C:\Users\Admin\Pictures\NewWatch.eps.RYK

MD5 550b336f8bfca9ef41dcacdcb7ee682d
SHA1 f5ee7fab93abcc17b67b81213afa693320b472b7
SHA256 491269b6e7551a042ae84f61f79a848b5d22f011687fa6c21c74573610d47215
SHA512 2c0aad9066346d21d0b94bd3c2c7dd2fd64df88964591c98cab6d9abb687720de147746cb49f653116e65f5250d8910715cbf588a2d9f200edfd20137738887a

C:\Users\Admin\Pictures\MoveSet.jpg.RYK

MD5 23ebf642075930311ffed80f1b09d1ee
SHA1 e76d6921ec488f4bf18ed65e9fc288088e199ecc
SHA256 5de053de2a141c1addf4e82a0822447e5d78e029f8dd31bccef972c56d4aa806
SHA512 2be44b074ef6d65d6574c459d08140bb4ec24d8c8b4bcd57791c30955badb9749b57cfd744b3b2aae508ee42916e9f134da9c33bb34c3be720932538f1b4b272

C:\Users\Admin\Pictures\InitializeDisable.tiff.RYK

MD5 d05cb3b13ce40952603e3013e9f66c88
SHA1 8b330ec0e8c75afaba28ca3f0579fade25071563
SHA256 6914aa6c09e38679eacfb9b17fd972128cbf0ac6092f771c3c9f11a463875dc6
SHA512 e9760f511680b8e96969698370bd5d646c879cfd1cf4bedc9c1e8d622f6df1bb3e5cd69ff1fb52005cc6d555c09bf1320c2f2e5a2608b00118ab3525ccddd2cd

C:\Users\Admin\Pictures\FormatExit.crw.RYK

MD5 b2e127b5cf9592b777c70bc55b71b9da
SHA1 ac3060151b904bd25823a008d7ce29add496595f
SHA256 02e9fc6466f5860eb24494c2fb3e0ccad713d1afbd6a8af16c4ecf036be214fc
SHA512 3845773cc879037b795324686c06d0fac4d9ca1755c4e5c236f6afc6f771e47b173ebeaa96942620bf9b784171dcf2c8bb1c901e5ef048c126f7a32f7a087dfa

C:\Users\Admin\Pictures\CompressResume.emz.RYK

MD5 553bea2e0edd49a0eccc68162d075bfc
SHA1 693b1e122bb112e30a59a5137d1231e8381670e5
SHA256 cb194e74cd35a3a9624aa75a87e6a2695550d4f3c5a072180ffe2ed1ada08907
SHA512 7e08f0f0c6d763b6dae8ea4e446e9474b8bbef386f5e3f815b1b80323171ae677669679e929cc35083253e788f4831b3daf0e8cf8ed6031acca4532b5b4d1daa

C:\Users\Admin\Pictures\AddClose.cr2.RYK

MD5 53647f94c476b0a13ae0b38115e4077e
SHA1 34115942bf4b8960425cbe716dfc6d312e63679e
SHA256 684efe5eccbf83b427b68577e3287c8c87c19c6746ddc398dadb9ca5788008a9
SHA512 94fc5869ccec2b1cf454c477218ce7e93df6e694bdc59d6158bc73bbb73035252f3f408288f2335d1e433335f6093a88f8ba4d368108086b6312d0cdfc0dfde6

C:\Users\Admin\Pictures\UpdateClear.dxf.RYK

MD5 0f6ba02b47d2d5d53b109d3e83fde843
SHA1 fa5b37d61216a6ac4cbf29060536eda2d0a31206
SHA256 8474b5afb8dcfae3fde7193882e902382d95071d958562e0022dcbe1038ccc42
SHA512 941a5d564cb392a72857a3c21bdd570d685dd61278d5a9e95a163d0e47b244fc8f488bee31f00385775bc6692d6e87cc8a185103c5d531ee0d038b724a26f28f

C:\Users\Admin\Pictures\ShowSend.raw.RYK

MD5 6f709b0ef3e01d8146a7ef6416eecebb
SHA1 6e098132011b7c7618cadbfb8f312a593b9dcb85
SHA256 ad800b3dddfedd4cec843e6f4d2176e3b8b5d7b311d2f6694bd654931cb23698
SHA512 2b67f6bbc569808b604ed370faf2e63224365c4b60bbf7e32688ad4ba76903630f04796afa91c78d21c7d52e6b8ccd38510704fbb3c9dc14f65776a459552dc4

C:\Users\Admin\Pictures\SaveExport.crw.RYK

MD5 6e0da962fb33dc9bfbde6f9eedd88744
SHA1 0163dfec4960ac208aa3da1f4f9968b98d721a3e
SHA256 c601901762d93166aae65be8b5da426697c6829415c43fa4565c6e937b3c9c00
SHA512 87b307993512ad0a67c12ae81508243e77fbdb3cd59553cd83fd7e67d6ae363b1d4c7521f03fd32bf021d5e9ac7569965a968a934877ad747e967306709df495

C:\Users\Admin\Pictures\RestoreSave.eps.RYK

MD5 781793b88179031f40e276a888d6c8cb
SHA1 ad86e61fe8377ec02aadac1255318b1467ac5659
SHA256 79e729896eb5e74f2b3af7ab65928e698a992c3bf70370bdf61f65a20d602484
SHA512 d5b8a69237f010b960a6f73191b8769956034cd839ca34ece786aaa731b71cd339183ddd5329c2f5d0d447ec703af4aae5b6f0af6d8d6befb8d7902b8412c993

C:\Users\Admin\Pictures\RepairReceive.jpeg.RYK

MD5 f27fd533cd5e0ce01fbfb2f3730e35b9
SHA1 982bca1ce83892b3e3ff14d33718747fabe3b36f
SHA256 98d9f26af48de4906216d6472968eadf04a66c8669f2800258812ab6cc5cd8f1
SHA512 c83cd6bfc782cc3bd3df458fe4356ecb16753b47fb1c5b72f996c6647db3d51a91d367ea0f65ba4d6efd34c9546944b2ee704859bf4aef8f1bb96f5bfad4b8a9

C:\Users\Admin\Pictures\OutBackup.jpeg.RYK

MD5 eb1a76941e0897d7b40e7c812dc9ea34
SHA1 0e34ccf1653025c0398593da18fb673e462cc2dd
SHA256 bdcc422135e796a9ea74f0f567484c06ef38b923335e4a916a38337408c1c71a
SHA512 b4d519a9df98827b9285792b0aac70e2db9796a46ef19c60086eeeec321f89cdeb68844697e7419b0bc235e8a6f1e5ee89ca778ddf2cd4d1deee25f3d52c69f1

C:\Users\Admin\Pictures\My Wallpaper.jpg.RYK

MD5 4c171eb85df5fe4159b408c46a554716
SHA1 c8ce9ecf1f2d2592917605dd0e66132cfab68478
SHA256 fe935f5091bb757ca7af10ec096ebad3f5116df57f09bb34dfecd7e6b34697cd
SHA512 538a5017920cf7b2a3be2da81dc5b60ae2906324e681a525e03b7dbe346f4d154c60e650eb3351a066625a5ec34e27746391e379882ebb6c81e29ee912dc054d

C:\Users\Admin\Pictures\MergeResolve.ico.RYK

MD5 5a012878a48d4d3d726e7e7fa6b800a3
SHA1 3994d5bf26e932ffc93cf7146886c80dfe627917
SHA256 036a0eb97b0d5e059ce05eafb4594aae13fbcc35a3d3ceff4ba38aa6bebc8a60
SHA512 132254599f3ac84c94b76945598c2cf4838059f00993e80dc156fcd1e551a54437790345cca6079c3d45a42d07c871fed3deb506188175bf03feeae55e888984

C:\Users\Admin\Pictures\FormatRequest.jpg.RYK

MD5 e60ac57d8ccf7889ea85130b626e2e09
SHA1 8e68acdd5f344a9a672d238b30dae65bfdf207a8
SHA256 87da01d11adf90772e422b8f3e93adee54838e50243386e200ed24d00a04731d
SHA512 40336cbf7d84b06c2b5f31180ed770422893c0a60d28af837e906f519f9a308f69bf7782ef311fe1ffdaa2ae773f8c679ec41fe8fc3be94ea290ae48246e0356

C:\Users\Admin\Pictures\DebugRestart.pcx.RYK

MD5 b1a1a32bb7e377c59f9b680f42f829e7
SHA1 c1d3d73cca5f835c397f5c39584a4b373fba2238
SHA256 a4f32a3f712b52fc5b7c4cd2cc8e2d60ede3cb10f4e8b347131748db2a0d6782
SHA512 3ab48d867f4a6c5e514b2663855c8b47fdfbad15ee91160d57f7a4a20034f9214816e8bbb0822067b76496d4eb841b7bfcc46de31b9b3bc146e10451d5de13c3

C:\Users\Admin\Pictures\BackupSave.bmp.RYK

MD5 91062e22578f1611332c5ccd2e228491
SHA1 cc6748681376e09b2e477639facdeb1e45812624
SHA256 b0a4b4cfdce8cfad3ace3371674d5da591f9bc37efe9101d48780165f2581aad
SHA512 e8e55cfc0f1fa5d8ed934905c34d7cfecc2c51abd242c6ad390c4e80786ea6e3435c98e230256517eb11aefe64747bdccde9bab96fa95d06c731014bd52e528e

C:\Users\Admin\Music\ConvertToDismount.AAC.RYK

MD5 ff8a2295fc87337680d825f39f0e4962
SHA1 065188c90f64a99f389a72b3fefe91103cba32ab
SHA256 cd3f9f25da4083961394533d13b8ddc5d068a54f6b547b66933bfa7ba99ffb10
SHA512 2a473444df3c5f384b43bf16dd9863e92a4b4e5173f527a76195886998494ad520b6932c8bce992c284753f9fbcc52c1443176cd7266bccbb0baf38c68ce47f6

C:\Users\Admin\Music\TraceSubmit.3gp.RYK

MD5 aaecc6e62acd6cd9ea8560561b2e2c16
SHA1 9cddab4c0a1bfd4ca594621aba6ab2e9ac9a9179
SHA256 2ad259384f68b9db04669dcebeaab538305914f8e76cb5e109a3fddd769936f5
SHA512 81f3c19d1b4742165d9cc89d08a3c1c40bb246edcf8ef26f89539f59ce838a831057114578b44455e29122651b2a32e8a2e73a39ba27fd0a1f1250875e8f2c4c

C:\Users\Admin\Music\SaveRevoke.asf.RYK

MD5 e4971dd4248b7553ff3fb3156c267a2f
SHA1 64c3faf7811ad7edaed96cbfd43e91fb7c3567f7
SHA256 64c7ed0399628b15a1735cbf127e8fcf4d92d9cb81c1358be63a816c37a4ea66
SHA512 e0203f92fa51ae6c1dfa3c9e8f12d08c2b4ddc89c031e68fb6d2b7f9b8cfccc4b53ff29be76c0d6d0d5916200d70d8e60ab504756deb47ebdcf3c425e1196a4b

C:\Users\Admin\Music\MeasureWatch.dwfx.RYK

MD5 6c3e92c7068f9d0393530ea0c4736252
SHA1 809d3f9efbefc47332d7c2eedb56433879732e7c
SHA256 8bbd2848b44af44b30b899632903bab6b5ede57e3aeaeccc117a8d0fc1e0f227
SHA512 29b997afd1c77b5139b026be227ab146b241a1cb72e367ca40163b894cc1a4689df274f60abe375df7fe6c3da581ba273198ac60899134e1cac68c4c93c7bd07

C:\Users\Admin\Music\DebugClear.vdw.RYK

MD5 da580ce97f8c95fa0a09330f9c925f26
SHA1 cf7af9cc58bf6b8191e7d774bf0b883f3448bcdd
SHA256 212ed50e0c755b4bdca93a18366d8d10dd3c0cb2d6a7ba0eb1c37b1533922708
SHA512 92838bbff1aa582c164f38fa145588d22375cccc44985ffd37f538911cb44369fff360153e7a27e2b36e2a683b3ea2151336ab31b118e7d343ec4b4849400c92

C:\Users\Admin\Music\ExpandSuspend.mp3.RYK

MD5 c682c734810efcf82ad59931f496a84d
SHA1 b982c19ca902a32dd9365b277e034b183fed9680
SHA256 66d105d0425a9889c85a7f7cbc67fa536a71063d489eedfb6fffcb1923eb66d8
SHA512 e349905a789485ba99c436851ba599c80b01fa77fcf9b86a82884129e6fea6c49198bce55dc8e8ee75111d16416978416a15a7a0fbb76289760130064d40719d

C:\Users\Admin\Music\UnregisterRestart.m3u.RYK

MD5 c2a775e736217348dfe71050ba9af766
SHA1 93f159ce0a961e18648494e740b78bfcc2089dca
SHA256 d813e35fec19d139efce3ed2d6d3a35237d81d9299b111b653faf7f9d0e163fc
SHA512 c70d94a31fce6cb0678b7d09f29ee9513ac3a31d80e00004ad2ff7c75151b6e9dee7ed0a8ab5ca4b1d9a59fcfbfda281c5b2bd4dc208ebebe331499453922505

C:\ProgramData\Microsoft\OFFICE\AssetLibrary.ico

MD5 5ffdfc0cff9e21c16e2d3275a411923f
SHA1 f807b199128e5a0cb181aa779088bb7811c759c7
SHA256 dbd8a06dfd5aad48a22f6b320f8dad067a4d4108c46a7ad64c06f5adc99ce109
SHA512 489e3fa743ff0e6d55e81f7436e894d426ff13ff83db172d62044d4265548a37f3c5f2748bbfd2816037560c4a0fe53dcecb028e5dd4b8b07bd5684d47d0b03b

C:\ProgramData\Microsoft\OFFICE\MySharePoints.ico

MD5 2fef1cf2248652ceea709a359379861e
SHA1 395498be26a6e40ab09011e79c4b359d6a02dcfb
SHA256 93895cf55bf2a968b180e85cd31c653dc25df8e154351dee22f950e86eb4e347
SHA512 8a93506a0ae192885878bc7f9f6f22e70ca9fc6112aaca6fabecaf27eab0bfee93f567dd4454997f3409934720f6db56f44b52ebdb6f00e34c71942be2d51810

C:\ProgramData\Microsoft Help\Hx_1033_MKWD_K.HxW

MD5 8b523fe276f73b49a39921a18302ee80
SHA1 b5277dd175ea1923f59a51eb3145a1626b15567f
SHA256 9367c25d124d8f742828899294bc95f648d0f27cea02b910b7dc1a5037cd9289
SHA512 612cf57ef3987dfc03eb54fe07d139e4a9ab8b59dfa9eaa419c5edccdc6c81d0fb485004325f6eeaae16320e089968e4d44e0f6166c5c0f4a36c4ad00e8825fb

C:\ProgramData\Microsoft Help\MS.EXCEL.14.1033.hxn

MD5 57b1604d8f47a03c5bc2b25ddc925687
SHA1 7994d60dc42fd516cb6f4d863cf20128cd9abb6c
SHA256 e4dcba99185982b5130b46772be064cf841c60889ca8dacfd5517daada3f3216
SHA512 613132814c31f271c74e5d03970382fbdf7034fd2cd2bf27f6dee08d95306772015a2bf7db95bcc3e0f6d6a73c380eef4fccb8553932c810431781b4339abecc

C:\ProgramData\Microsoft Help\MS.GRAPH.14.1033.hxn

MD5 7ffc956b34f69afd089dfecc50ceacc5
SHA1 89c532388e7abde818835d5b010120006cc19622
SHA256 3314c39c0a05d7a8fb3144567d67ca94f4a0f33ca3ec7972d46577e4c7faf15b
SHA512 c91c6b390d668cb7adddbf6a572fd0905034d72f38e99fd1c055f44a72d6611817d43d67a023f3fa1e991323af4adb59d82eca9a85ea396a89d6f12c1c518ca5

C:\ProgramData\Microsoft Help\MS.MSOUC.14.1033.hxn

MD5 0430f4839e76c0c1dec4fc77d0cddbde
SHA1 0d9807cdbd78dfe4ee46c99bb5fce5fd6b2e37ae
SHA256 6628d32d7b35840dd23839e5120c7df1d9e8f9d7f3415022a8ae1db78110e2f0
SHA512 3b1759873256bffac59ea1667de445f78a4d0678b559721cf3063d2e6fe1ada8dfb01d0934bfec81e563f1078f8a61e0e692cdaa608a977c223d0df1fa1cd14e

C:\ProgramData\Microsoft Help\MS.MSPUB.14.1033.hxnr.bmp.RYK.RYK

MD5 0196fde964314f27bb2e75d065199151
SHA1 8fa306bac568552968f19ca7d1fbaaade71f67a9
SHA256 ade3056af75fc5ba3a6042034e8b2b63bd02faaf741390488a06666fb5daca56
SHA512 160be6c8d997dc8f9ce19b57f528ba912cffd7e8df5a7148fee4d84f7b67c6dcb319a95f0c236618d6ad7cb48a14db2639f9d84c7de3fa3a1322167e9bc0d728

C:\ProgramData\Microsoft Help\MS.OIS.14.1033.hxn

MD5 f87aba4294c60bcceb9ad1be25ad35c1
SHA1 4b3581a3a47db9fd26a4bcfea911e52fb71fe343
SHA256 9749f020479c19a39d832081f4f0a72351cbab335d3d0156514763c987b204a9
SHA512 037ab7a79c457bb500af53867501b01534c24b0cb7d369220b150e81ed84c9a1b93f8dc0915115fc62280d67573158119c352f6f5272c38c71dcb55a3c704192

C:\ProgramData\Microsoft Help\Hx_1033_MTOC_Hx.HxH

MD5 303641909ad94319788307d29a5861df
SHA1 8a40b40b588a593dd949d7193aadac10dc0ca510
SHA256 6520f658083cff06a97ba592e3d6c2e0fd2ae1b457480a8530e1011605534b3e
SHA512 2dc9f80a1ed780119bcc4b9e5f4fe6c31b63364cda2103a8aacc0f4e13824526235a382d715bfb4903d19e690e4e888fbbd09cec16a27058307546a7f412021f

C:\ProgramData\Microsoft Help\MS.GROOVE.14.1033.hxn

MD5 91ecf078a6ec16ff89972d59d5846a68
SHA1 1a49a8afc02e2d8a2b61a4edc542b6ee2072f325
SHA256 98964f79d68e9d34dc52ae44c562154f20e097612d019b31b3f1beed13b8d9fd
SHA512 d0a6c46c3afa4777d4976e214400a9ccaaf3f621da906afcd2937afbfe974d7ab16c29e5d7253959fe6b6ff85f98a10fc00c4512263cf5ed4221b582bfbe7aff

C:\ProgramData\Microsoft Help\MS.MSTORE.14.1033.hxn

MD5 e1abe5d34cc4b47c8fae0f077ce6601a
SHA1 4277064a0b460907f88309acff2ee63d456b1f49
SHA256 15cc140c9b5608afc6549c527e3a89a7b4e96fb9535ed0dfc88b6e0443b75f6a
SHA512 f88984cc137ed8c3e8ec19569fa92ba50750df8dc20aa74304a4215fa983922c816f55dcba183e2a53267c477d664587e7c882264024ad0d18dd74bc4346a8f9

C:\ProgramData\Microsoft\MF\Pending.GRL.RYK

MD5 4ccd2b48a6f1945ce245c872a681d93f
SHA1 a7f28951b22f481a2fa2851d9f1b9c66e1d7ebe6
SHA256 b22a6a9edd816e791fde7394af296080555295f62bdd6349dfe398f0451fe048
SHA512 5fe21535577c42fe2d6b3e79d8a00cc13b03c7632099df80bf53b8cea24c8c16cd4c11125a650fbeb61a6e006df61dcde05c824aaf28e6f33b427354ba83dc99

C:\ProgramData\Microsoft\MF\Active.GRL.RYK

MD5 3a232ea55a98f9a47af331c5244d5590
SHA1 c86d29aec6268da9f04953edbb0ea5147015f81a
SHA256 2c014863889996b20437f0d531da2f6d01ac4017d60fc00b7eb9a8cba08a3fc4
SHA512 948b56e24910656eca33d6108095bb807a18bc3ac137cbea0b51c35de51bdf53e956144e668d3f46ef3825fd7fec41b35ba251b6f83efb8bb830ea7136691de6

C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg

MD5 928ae5c05c32225f62d804e571998878
SHA1 be2db3688a311bb6931c327bd994cd1dcea645f3
SHA256 b60f4414387c85c757ddfd74aa960b980d73290b41e87472f9db4ecb2048fa9f
SHA512 245a759c1493d4111fc1bd14d99297b66f0108b64247e0a4181045e9e82c6166462e0b3d3d720875f84adca47684e4e885e1e1d27d76542e5854a321ffe18803

C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpgeScan.jpg.RYK.RYK

MD5 e96c80f7a858325c17638a2733006abf
SHA1 876c9f15c71ede63eceb8b2447dddd8ebcd44d02
SHA256 69fd3293159ef2fd008d4f4698ae666e29635716aaf11d04f7a222fce53f7783
SHA512 54657095d132becff4a431645e6619227be5a1c54b990b2fd86f2706dd37f7a1d83bff6b3ca79c677a466a26d7689e2929df47d85a6bb08c5d693cbdca308a2a

C:\ProgramData\Microsoft\OFFICE\MySite.ico.RYK

MD5 fc5195fdf87f20b6a177ecc38083015e
SHA1 c9cd6ba30d7d4b62f8c346f1108fab221cdc7a0a
SHA256 6ce3b35727b67dfea4856b997cc911c06de25325b88a59165d158d12994be828
SHA512 558f6681389166c9da36577084180976f8c5d70262460bf3df2a625353960e5c1e6c228db2d0c78138f48532f662ac5379e274c21c700c39d3b6416186fd234f

C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpgYK.RYK

MD5 526d99348917fed2e5768db4cf8cecbe
SHA1 b7d75ce23d7191ebbeb19cc5b6029c2cf5dee010
SHA256 511410ac392e5fb6759fa66450cf841ccff25f29599cf6f37deffb343bf5eb31
SHA512 6ac0db9e2995e1904b0ebf1a61fac5cad307108760e26d6edddfbc0e526221b29ddd404a7991e25a6814071a5c0f1608aaece63c5b53a00ed04d573187885278

C:\Users\Public\Pictures\Sample Pictures\Penguins.jpgURL.HxW.RYK.RYK

MD5 73faca973fc3c2f7bcbb8a8c6f697632
SHA1 3535d0f0048769e6084a3589dc2469144df8e2ad
SHA256 cc9da8e288e6521da14ba67caa2a883ed79e7d680ee4514633ca732be73dbe87
SHA512 9529775f28e338bde2e216da06c343db07b37afd6c8f047e969439d5b5988e372d01f885c3613263a16dbc7ac05b4a470d2d71a6692d0cd15747a205babae7e1

C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\tokens.datHair.mp3.RYK.RYK

MD5 8f72cb2ddc736760d8299d9378ded00e
SHA1 a857378dbb8372c63d7a629541c3441c766141f6
SHA256 a313b67bca93a9e72f1f26b142268373a8841cfb012a12dad5a0f8fc49669428
SHA512 3998db268823f61ab36e94e05033a20311ced8c8fa2b0b2e45f0f54dd9178e70186e7978239a1fd3f4ae8ef43f9b175b090ade9af0b69630d077406e594ef6fc

C:\ProgramData\Microsoft Help\nslist.hxl.RYK

MD5 45b653d0dc8489ab90ef3bcf980fceeb
SHA1 99bd0c4b17f71cbadf627bd18e3fd731f0c7fe74
SHA256 55215f8d1283293ef26e4e83a2d08953a531372814a5bb6e7c433ccc4940b90b
SHA512 10602188326dbf4a2a5c345e7f215ac95cf59299e8116092c5d4afdb8ef1c3d7343ab62fb42d9d0ab980bc593ead10695242d83f1a748069eaae0c739ce98fd1

C:\ProgramData\Microsoft Help\Hx.hxn.RYK

MD5 028741886d4dca3f61492aa4aab786aa
SHA1 e71d8c6f5fc80beb9f7be2a4c65a25b1a9ac3301
SHA256 f6041a5816a0c5fdfaf5571e844bfab35a72304d0cd479943a05e01b8fd407bc
SHA512 280f8df6594e9b0f154071281b1a51d1cb39b87a3a46ea1a68d1e406f34bf5e66755b395d02df344dd2cf312946912617ac75091fd9cfa9943a5e9a25dd28dce

Analysis: behavioral2

Detonation Overview

Submitted

2023-11-09 12:49

Reported

2023-11-09 12:51

Platform

win10v2004-20231020-en

Max time kernel

8s

Max time network

17s

Command Line

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1096 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\system32\sihost.exe
PID 1096 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\System32\net.exe
PID 1096 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\System32\net.exe
PID 1096 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\System32\net.exe
PID 1096 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\System32\net.exe
PID 3736 wrote to memory of 1644 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 3736 wrote to memory of 1644 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 1096 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\system32\svchost.exe
PID 4020 wrote to memory of 4724 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 4020 wrote to memory of 4724 N/A C:\Windows\System32\net.exe C:\Windows\system32\net1.exe
PID 1096 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\system32\taskhostw.exe
PID 1096 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\system32\svchost.exe
PID 1096 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe C:\Windows\system32\DllHost.exe

Processes

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\sihost.exe

sihost.exe

C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe

"C:\Users\Admin\AppData\Local\Temp\RYUK RANSOMWARE.exe"

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\System32\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "samss" /y

Network

Country Destination Domain Proto
US 8.8.8.8:53 163.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp

Files

memory/2412-0-0x00007FF787C10000-0x00007FF787EEA000-memory.dmp

memory/2412-1-0x00007FF787C10000-0x00007FF787EEA000-memory.dmp