ryuk | 56831ca7d36b4c44b0730bc0fde49fd3fa4a626c04e90334022312f75fcebd95

Analysis

max time kernel
143s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
Size

202KB
MD5

9694a757610e36c089f6a67bfdb9b7bc
SHA1

207d8312e9bcfffb4b8b3e616b23b9996d1ebb00
SHA256

56831ca7d36b4c44b0730bc0fde49fd3fa4a626c04e90334022312f75fcebd95
SHA512

49257d7ee75e423f0121a72fde0f7c3b8157985e841cb066b412d78cd107c6f7db6f745889523bc123958682a7e66518eaba7b7a6f11cfc0b521ac0478a5f728
SSDEEP

1536:mGpouhuhkoWnR16e25SEhTMSj/kwgDmVKfY3wKEp8EgIbsW9d7B9dleMPQUlRH6:khkoa6ebEhoSNzVK0wKEpf19VMMoe6

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each network host have been encrypted with a strong algorithm. Backups were encrypted too. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. Only we have exclusive decryption software, suitable for your situation. More than a year ago, world experts recognized the impossibility of such encryption deciphering by any means except the original decoder. No decryption software is available in the public. Antivirus companies, researchers, IT specialists, and any other persons cannot help you to decipher the data. Decryption takes from ten minutes up to several hours. It is performed automatically and doesn't require from you any actions except decoder launching. DO NOT RESET OR SHUTDOWN SYSTEM � files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions. Send 2 different random files and you will get them back decrypted. It can be from different computers on your network to be sure that one key decrypts everything. We will unlock 2 files for free. To get info (decrypt your files) contact us a [email protected] or [email protected] You will receive btc address for payment in the reply letter Ryuk No system is safe

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Detects command variations typically used by ransomware 59 IoCs

resource	yara_rule
behavioral1/memory/1148-6-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-9-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-12-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-26-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-19-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-31-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-33-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-43-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-34-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-77-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-68-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-67-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-65-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-60-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-51-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-388-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-387-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-50-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-383-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-48-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-382-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-381-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-213-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-204-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-203-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-201-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-196-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-187-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-186-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-184-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-179-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-170-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-169-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-167-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-161-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-151-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-150-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-148-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-143-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-135-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-131-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-130-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-128-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-123-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-122-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-111-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-110-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-108-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-107-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-106-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-105-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-102-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-99-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-94-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-85-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-84-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-82-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1040-3371-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/memory/1148-4178-0x000000013F620000-0x000000013F9B6000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware

Renames multiple (2584) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Documents and Settings\Admin\Downloads\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Videos\Sample Videos\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\Recent\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Public\Libraries\desktop.ini	taskhost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Saved Games\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Maintenance\Desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Music\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\Searches\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\1PJQWC5P\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\SZUP0XFR\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\SK0QRJKA\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\N2LZJYLW\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\YK6DYF6H\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\SZUP0XFR\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\YR1SPOMQ\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\SK0QRJKA\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\Contacts\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\YK6DYF6H\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Music\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Links\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Public\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Favorites\Links\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\Favorites\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\YK6DYF6H\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\4I7XWM59\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\System Tools\Desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Default\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\1PJQWC5P\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Desktop\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\4I7XWM59\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Desktop\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\System Tools\Desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Default\Start Menu\Programs\Accessories\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\YR1SPOMQ\desktop.ini	taskhost.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Public\Recorded TV\Sample Media\desktop.ini	taskhost.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Music\Sample Music\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Startup\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\IS6UL1FQ\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Contacts\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\1PJQWC5P\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\SendTo\Desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\desktop.ini	taskhost.exe
File opened for modification	C:\Program Files\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Startup\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\N2LZJYLW\desktop.ini	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tijuana	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chihuahua.RYK	taskhost.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie.RYK	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyDrop32x32.gif	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\RyukReadMe.txt	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Windows Media Player\RyukReadMe.txt	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\RyukReadMe.txt	taskhost.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Vancouver	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.RYK	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_zh_CN.jar.RYK	taskhost.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Riga	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.RYK	taskhost.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml.RYK	taskhost.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.png	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\RyukReadMe.txt	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tallinn	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\de-DE\RyukReadMe.txt	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm.RYK	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html.RYK	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\RyukReadMe.txt	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_ja.jar.RYK	taskhost.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\RyukReadMe.txt	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat	taskhost.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png	taskhost.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-services.jar.RYK	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\RyukReadMe.txt	taskhost.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\blacklist	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\RyukReadMe.txt	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\ConvertFromUnprotect.jpg	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\RyukReadMe.txt	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml.RYK	taskhost.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\RyukReadMe.txt	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Google\RyukReadMe.txt	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.RYK	taskhost.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar.RYK	taskhost.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Easter	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\clock.html	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.RYK	taskhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
1040	taskhost.exe
1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
1040	taskhost.exe
1040	taskhost.exe
1040	taskhost.exe
1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
1040	taskhost.exe
1040	taskhost.exe
1040	taskhost.exe
1040	taskhost.exe
1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
Token: SeBackupPrivilege	1040	taskhost.exe
Token: SeBackupPrivilege	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1040	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	17
PID 1844 wrote to memory of 3052	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	28
PID 1844 wrote to memory of 3052	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	28
PID 1844 wrote to memory of 3052	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	28
PID 1844 wrote to memory of 2612	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	30
PID 1844 wrote to memory of 2612	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	30
PID 1844 wrote to memory of 2612	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	30
PID 3052 wrote to memory of 2716	3052	net.exe	32
PID 3052 wrote to memory of 2716	3052	net.exe	32
PID 3052 wrote to memory of 2716	3052	net.exe	32
PID 2612 wrote to memory of 2736	2612	net.exe	33
PID 2612 wrote to memory of 2736	2612	net.exe	33
PID 2612 wrote to memory of 2736	2612	net.exe	33
PID 1844 wrote to memory of 1148	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	20
PID 1844 wrote to memory of 2688	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	34
PID 1844 wrote to memory of 2688	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	34
PID 1844 wrote to memory of 2688	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	34
PID 2688 wrote to memory of 2684	2688	net.exe	36
PID 2688 wrote to memory of 2684	2688	net.exe	36
PID 2688 wrote to memory of 2684	2688	net.exe	36
PID 1040 wrote to memory of 2148	1040	taskhost.exe	38
PID 1040 wrote to memory of 2148	1040	taskhost.exe	38
PID 1040 wrote to memory of 2148	1040	taskhost.exe	38
PID 2148 wrote to memory of 3352	2148	net.exe	40
PID 2148 wrote to memory of 3352	2148	net.exe	40
PID 2148 wrote to memory of 3352	2148	net.exe	40
PID 1844 wrote to memory of 2816	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	41
PID 1844 wrote to memory of 2816	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	41
PID 1844 wrote to memory of 2816	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	41
PID 2816 wrote to memory of 2632	2816	net.exe	43
PID 2816 wrote to memory of 2632	2816	net.exe	43
PID 2816 wrote to memory of 2632	2816	net.exe	43
PID 1844 wrote to memory of 22216	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	47
PID 1844 wrote to memory of 22216	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	47
PID 1844 wrote to memory of 22216	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	47
PID 22216 wrote to memory of 33296	22216	net.exe	49
PID 22216 wrote to memory of 33296	22216	net.exe	49
PID 22216 wrote to memory of 33296	22216	net.exe	49
PID 1040 wrote to memory of 40128	1040	taskhost.exe	50
PID 1040 wrote to memory of 40128	1040	taskhost.exe	50
PID 1040 wrote to memory of 40128	1040	taskhost.exe	50
PID 40128 wrote to memory of 40324	40128	net.exe	52
PID 40128 wrote to memory of 40324	40128	net.exe	52
PID 40128 wrote to memory of 40324	40128	net.exe	52
PID 1844 wrote to memory of 30688	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	53
PID 1844 wrote to memory of 30688	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	53
PID 1844 wrote to memory of 30688	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	53
PID 30688 wrote to memory of 39780	30688	net.exe	55
PID 30688 wrote to memory of 39780	30688	net.exe	55
PID 30688 wrote to memory of 39780	30688	net.exe	55
PID 1844 wrote to memory of 64872	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	56
PID 1844 wrote to memory of 64872	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	56
PID 1844 wrote to memory of 64872	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	56
PID 64872 wrote to memory of 70888	64872	net.exe	58
PID 64872 wrote to memory of 70888	64872	net.exe	58
PID 64872 wrote to memory of 70888	64872	net.exe	58
PID 1040 wrote to memory of 76692	1040	taskhost.exe	59
PID 1040 wrote to memory of 76692	1040	taskhost.exe	59
PID 1040 wrote to memory of 76692	1040	taskhost.exe	59
PID 76692 wrote to memory of 77428	76692	net.exe	61
PID 76692 wrote to memory of 77428	76692	net.exe	61
PID 76692 wrote to memory of 77428	76692	net.exe	61
PID 1844 wrote to memory of 73572	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	62
PID 1844 wrote to memory of 73572	1844	2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe	62

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:3352
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:40128
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:40324
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:76692
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:77428

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1148

C:\Users\Admin\AppData\Local\Temp\2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-26_9694a757610e36c089f6a67bfdb9b7bc_ryuk.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:2716
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:2736
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:2684
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:2632
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:22216
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:33296
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:30688
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:39780
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:64872
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:70888
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:73572
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:73600

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\ACECache10.lst.RYK

Filesize
2KB

MD5
35ce1113a1d041fde3f05d5e49c8d75c

SHA1
5c1878d5e165ca9cb5a281c6b86e7cad63d3b980

SHA256
b528a42189ebd3af585c07898f3d510ec7ebc6bcc199bf86cd2de0f0ae0757f8

SHA512
47a3c038f50afc3842bc681963148558dd0f6440737b10bdb9f2ebc214e5569dfddce5134f4073153866dfffd2384af2840ae679c421de755d92b897613496a6

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.RYK

Filesize
2KB

MD5
3897358a2eddcce4307df5d2b428dfb7

SHA1
a3ac1864f73a03c3d396f7ed603b55f70bc51110

SHA256
dc50c1c5557796cb33dc99c6de8f696f994ed0f3fd36713cc6ca6d84f6283dde

SHA512
42f877d99d83c0479980fd73f7510a1910705a646b6b196025378a0d078a3de1f3bf2bc59fa926e1e14bfc6b43f958f70778848291a607ad0760b3de0db8a431

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini.RYK

Filesize
434B

MD5
46e67bcd1117fcca6a2df6ea9c07a723

SHA1
a13b71a821513e72a4ed703472b18645cba4d223

SHA256
5796cde2c55c38471b8567314e86a5b9a8ce5cc59038df4fdec6a8dabed0f56f

SHA512
356197924c6f4be57e7efb8a978e0bfc39e7b76245377183032c37cc012b5914d30879a7f8b213432e339af3a63535f9e83c11ea40e0af13f007bd4296050d63

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db.RYK

Filesize
763KB

MD5
16984323d3f7d5da9db85d7f7402c1f8

SHA1
b7fe2ca96115b6de9d654db836d1120894d92108

SHA256
a59ba4a7bba188959c5aa96e4bae6bd95ecb340ca92fdcca51a5187cbbfaea0f

SHA512
c0c52addc86142e8d267e2d29924a6e0247a5597a79183cbe85e80702dd4593dd3c49d4f4ca5bc62a34359c9c9d426b8cdfad8646c3361cd3cddad2ace1c7ebd

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ASPNETSetup_00000.log

Filesize
4KB

MD5
ee80135797d81dd904d3c5af9916a717

SHA1
6f5a80ec7a3d55656e4ba47a7f54a96a0486f850

SHA256
1acca1f7e2a070163e87c939ce46cdfa1d48c56a9b80e49d978db3cca9ed472d

SHA512
03933c72271939e198fbc1861723ab4fc111b2fe1d615c7cf6f1f82091348f6a755d96312989e30907ae28e6352241d209328887148ca7f5bd05a9a76b87a767

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Admin.bmp.RYK

Filesize
48KB

MD5
96089c20d8cd7a91746c50aa88bf08a2

SHA1
824760824ec1c5f355781d03f3e2cf5bce0ddf0c

SHA256
d331aff065cbe9d33356eae36d60599d2fce4f3182b75aa7e509950c21743915

SHA512
cfdddace6951f062200babf7a1c0fc1c805399dc980bbe90316b6b85e6cf349b5003771d6268e1fdadda4e1ec12ab31cc72fc2ccec4a455bb0ed1d7ab18bc9b6

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\JavaDeployReg.log.RYK

Filesize
5KB

MD5
b7f9942e00ea663ff2acdae3e1ae479b

SHA1
f006c561fbc08449dbaf103587437564e297e751

SHA256
7af2576e07ad02b1ea62dc0462f02aa0923a4eb8d671be963178cf14784f965c

SHA512
ffd348693e92d7f4a28aafc12839a98d30b0ae9bc90db7c029704908bea07d66d9307adbf90444231de0f0d03016f636b2c344f74f77b6178d57000d7d5faa57

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RGI2730.tmp-tmp.RYK

Filesize
9KB

MD5
54e55a0fc389002b1501eb7a00faaac1

SHA1
e61bb132376f3ece00964655f42621a9b03d583d

SHA256
672800b6d79dc8eed2abf41f2754fcbd5e5ae0e5a4ecc31db571719deee65a51

SHA512
247ce28d6abd30fc5f8f6c6109b0d35c18d53a58fd14b8ce7137e98ef0b730878b06759eee81fca268d62b832cc84f8f2cf9e31a3f244069e457d10903d005fa

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RGI2730.tmp.RYK

Filesize
10KB

MD5
767c388827e69c44733b727806dc1c52

SHA1
642a85d9eaa5aee546a778140153191accb3ade7

SHA256
5cd997f9331447859a83cda4d8fce701b3a285d19dbe7499f6bd4baf9fe1486f

SHA512
6ba08d8d31453e6465f57f430a650e3c57af1ebb32b9869482bd929450d489af54900aaab82e6dab06c13db59ab3ac0936408f4c389829ad25818ce34ddff9a4

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\chrome_installer.log

Filesize
4KB

MD5
ad65f86b977586ba00fec08eb9b8cca0

SHA1
ec0226505fd5a9b4dbb53eb7251b8858c846d0c4

SHA256
4b37f69afbd32b07c81d590caa327b9b0f61d17e57daeeb5829439b0600f6d42

SHA512
03f4e212b8949357f0aeb17ddb09bb4ea669ba103a891aba608dc136baf62d28ed7152dc047212221be14d31b2d5381bdc73c2935a8fd56ceb5ba5d0fd97c98d

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dd_SetupUtility.txt

Filesize
2KB

MD5
019b5d46556b4a508860a561f4cd8ab6

SHA1
06cb29494fc71463c3c9ec21573f579cad3d2684

SHA256
45b4c5750592ab375467321a640b23901ba5f443e93bcbe11affb8e583999769

SHA512
4a31b1cd1473131a316f1966ddea663db09ec62a497ac7dbe3d36c9ce688285a2f77654343ee8ab98639d24d5c8c8e792778c2240c64d3f4f2b504445f3a6a58

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dd_vcredistUI12BC.txt

Filesize
11KB

MD5
e95cc7e9fa096c2f225897d36eb753be

SHA1
aaace298309455af833b8a09c2613f83a3c43d0e

SHA256
b73dba871b72253038f39fdf082d87c9ab9128b2ebcb5b0ae82d22d14863dc9b

SHA512
279adf9772c337081448e5250c4c8a913eb22486ebfa6d5e1d12c606e87b9d9b4fd4b9921176e57325bc35ccb2a205fb321eec55a08761df4b67cfda23a30a6c

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\java_install.log.RYK

Filesize
170KB

MD5
ea6cd62246236458f7a70c943614d21d

SHA1
3f2c3200deaa8ef8363e07a683bf3c13e54d8a76

SHA256
ec89645d475cd5f23371e2ec80032bf967088ecb6c6df3721ef85541300454a6

SHA512
2d49c885617f176ac2e84fb4ef100852afd51c4e9339b89dd05d63bf7ecca0aceaa2b40b3c65724f74eaa00a115462c60b68bb0633a405923442ca09c2d56bfb

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\java_install_reg.log

Filesize
4KB

MD5
446941ae0498547183f507f3e2e69a21

SHA1
30c20dc039b33b4c700c07483812a6d5ceaf85e4

SHA256
2d10a3e09fc0591b60f82a404970a58640bee1b35a7b7b84e2e33b0996a755f0

SHA512
d28ff702ae397b6c924c0077e72c5b2f5c6011a1466931ad3aa980a7fc41656f499a3bfbd8a30e7e615f394f02ffb2350e7f8df11dd6061747801b31311940ee

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\jusched.log.RYK

Filesize
626B

MD5
e5de2d7a198281f2b8f628f0d077fd9d

SHA1
edb29dec2d701b1adfd67edb3f4aefea38402764

SHA256
663840209b140388e691246e2780232a2d7756e1feaf4da05a2d953db6b1e2cd

SHA512
adf5a8a04c8d89770e35f857fdab014eae977a2ef3edadfae2bd1ad8c6ad2712d291b34b16199c9cc777f00ffede620433275fa0a0e09f18b7f3012951c7aa62

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wmsetup.log.RYK

Filesize
1KB

MD5
91e723db54015f7bd6f75161fb2be425

SHA1
74f0925e7988f0c956a114e40a39e5e3ad1df189

SHA256
3289409cc8805b44c45694d378431717200ab76036cb30aa083cc72cddb816a5

SHA512
79ba20e124f7cdd3c3c7387fe0f1937e7f7d1399329df45f018dfcbb46379c822b82434082c10c4badb64fc2919a1e3c4d6b17e74250d33008a30f7765e756c3

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini.RYK

Filesize
434B

MD5
aa4d2db8ee88a66e2552668130eca7d7

SHA1
c3247b303b29d361c2dcc6f42d2913e0ea5ba29b

SHA256
566df02d30846133b1c74fa396c994c8ffddcdbd775a4e34bf92039947b18e83

SHA512
a381245319ab68b2f7a4ea07c7550dc5d82811c1ed1d36e39f4a25b0c4ba872705212e47b8631ef00c787e6b8f9e7f2d8d6395600c2773e95535684fe7d51456

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\1PJQWC5P\desktop.ini

Filesize
354B

MD5
9cbcf84d5b40bff0102b223dce774f1d

SHA1
3c44462986d6b252279fdbd715a45494d0f310c1

SHA256
324d081e2dbc3609f262c78d48bc68e2188d5abdea89f3ec5add76ad8a976d46

SHA512
fad13f9d7b61523bd872302e47485e26f94421c8d6b684a30b71be61e3a7fd73090034bb0a82bf4b60b72e1e95cb6841775df33949541c7e7b47cebad94e1408

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\SZUP0XFR\desktop.ini

Filesize
354B

MD5
9a2d78f6deed429b53437469318e1ba5

SHA1
e5b1cb89faf20e494faa1de9462627cb8b8695cb

SHA256
8a07f7035dbc7226e75da3225a1f54d5b1c27231e5b56cac5b7f607b5d7bf774

SHA512
34a3df670dcd41f1ff86d48c78364b7d8e31d5c42a255ffe3056303997c62622ff49334497eeec3654659ac0d53254feb9cda0c9aecb4d2a784625b13b542c42

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\YR1SPOMQ\desktop.ini

Filesize
354B

MD5
eff33f6df6a6635b992c8a8d2778c199

SHA1
479b005fc356364e68d06a7ab2fbbe16d638382e

SHA256
97e33b847fc255a00c48ddf28baead3cc33ab8835e68a22819aaee6e4c03605f

SHA512
6287d61a99b7ae176787b95e1365befef9385aaf7eb6d25890b831de2ca371050608f5683a5ccdedd55c8ccb1d1683d13c354861285c310a062795acf886423c

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini.RYK

Filesize
354B

MD5
41e15fe53999fd43bc95a0e5c6a90d42

SHA1
404847c6be039886a2b505d497f9ceb1f5fbad05

SHA256
c1372a40e795d955702100ec84c43794e3f6f59ad028faa2290fca8b281dcdd1

SHA512
7638be4fdf9147b9fd741d504745b52130d01249af99ad5109ae7be5b38cbfb01d3dc744bda4c17f7868bff8f30cf0d890d082309f7ed6dfb50655080623f100

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK

Filesize
7KB

MD5
0d5c3d64f84bae9f75f687af5de3fc18

SHA1
8a1c16b464828385b415435486fc178a7d3fea40

SHA256
f9ad70b4a79819f085a006409589df17a65c727157ec287672758c7a24012793

SHA512
abc2a3751a9acfd1c1178fdd567b1bdaf91ec38e732e2e6407519febb42ecdaa60fbb3763fafb76f52cf7169d155d88711632c563edff5e613720575729fcb17

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.RYK

Filesize
6KB

MD5
c40c9fe73edf0e9883db6ff2e73003a3

SHA1
0ff8f93094edfdeecaf5e4810e3058cd44402822

SHA256
442a9b056700dd118134d294411bc726c82c2e298187abb61c97f00feddf9ec8

SHA512
d21a2ee616c8c932471306c0780e47503de47a4fc7406b6766ea45ab3349393c9968f790830eee7e81c6215a80a0934014b2a3dcc4a3cabf9196670b41f7f45c

Download Submit
C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata.RYK

Filesize
754B

MD5
2f86553d7dd40f32190bf5c3b25903bf

SHA1
b431126796db04b4c59bac96dab38e0108df3fcd

SHA256
0bb8500c4815b2af5b07635a2a1a9bd81cbca910049ce87d8b7c3c7efe2b456d

SHA512
b23637aa3ee4588e76b72cac3bb536b3e09886edebba27b394111af07c19aa3a8ba12cdf2f112ece059aef0cf459799d38d130b8b3ff7c680a0d2635376848d3

Download Submit
C:\ProgramData\Adobe\Updater6\AdobeESDGlobalApps.xml.RYK

Filesize
562B

MD5
aa4c2597ff736f586811354dd988d2b8

SHA1
f21eafb75c1dbfcdecae5eae7d32df725427c1e4

SHA256
73a907d9bbdce037bc125b53821e427270ecbea0f37fc586634878025bca3b81

SHA512
6814ccb0c778e9e8d608839f1311a86e54d23ada75cfe0c77e2e382cba6f0b462c6a0285600ff3665e7dd5e2839007cc2f9cd55cd482aa3fa5643add25171ccf

Download Submit
C:\ProgramData\Microsoft Help\Hx.hxn.RYK

Filesize
674B

MD5
86381a578343f57625eaf7be64a00aed

SHA1
992684e1b7fb9c5af160e6f36a31f7206cec8785

SHA256
81ab90c9f9b13644a3fea12ee9f885e5d8138b5a25e312f9dc34720b5fcef133

SHA512
f629ba2534a26420222067fcd65624e0bbd8babf72104f12cef2dc37fd83fbac0c65491204821d2798986a4441f908e0a8d08a064473944397c66bed8dac5870

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MKWD_K.HxW.RYK

Filesize
13KB

MD5
5e772ee65d466abe785af4161d071f8e

SHA1
eed303532dd5fa76837b39ca8911cd0cec927f5c

SHA256
c4ad28630d1bd81634ccb1da086f29c20108e319b3597aa2f64a76da1f7c6cf6

SHA512
4fc94cff3dd1bd3bd5ef8db814c3470f32e19e58033f1706efbc6a5b9e1987ebd18ea2b27b120b01807824008baf16f7d51413bcb0354d434e9f48c30f664d91

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MKWD_NamedURL.HxW.RYK

Filesize
13KB

MD5
d2427c7a8351b0370f353ad5d579dacd

SHA1
574a289e19263ea1a159380298d4d05269fe56e3

SHA256
b1aa46811ad05f0023e17b3a758d8822fee542435faa9e04edb2d57376fa77a5

SHA512
cab6f17ba094b745aadb6dce439f543225bf2f4054e5898b13e1bc59d966ba6ce9f8724c1f58e31b4def6f1c2b8e5d7e11186d24940ced079ef9c10a48316323

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MTOC_Hx.HxH.RYK

Filesize
10KB

MD5
d792b9f3c4b1cc37851afdbec4b13e24

SHA1
c1e024ef7a0bd8d69d00a1660b645c2bdf5c6655

SHA256
b403fa41c814320d212591c6fafaa73924490578c26bca2c31ed1e70e25f7fee

SHA512
ba5d27a5b01d5351a764e673400118968e1fe95f53996f658395e62e6878c1fd1f2d30352f4253208974382176428bca6884c2ae3d3dc9711259982787a8b199

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MValidator.HxD.RYK

Filesize
9KB

MD5
3558ff6b1d7c4cb8b9c836f41936d4b2

SHA1
c36552e2684ed06062bc3b29b05d56a263c1b363

SHA256
091d5d12bdc3278076baa8fe4ee335b4e2d451e9ee12e07434ce3357b214d525

SHA512
c6223764435153b250aacf72feab50bf1035da7c5ec480b20d8a77ce3078e61153118d76b65c29fc2ea883266b0c309c53e3043a28aeb7740a510101e36e0d6d

Download Submit
C:\ProgramData\Microsoft Help\MS.EXCEL.14.1033.hxn.RYK

Filesize
626B

MD5
f06596155be61e00d9d9424a5ec36b24

SHA1
ce12bd3775aa836065513a5f2d877dd5a9a88bb3

SHA256
a5214df85767fab2e21bdf2a9f981df0376509977adb1d9451c1bfd7ee394d31

SHA512
7e8dab0879fc180329edc1de962f9834da1bd18b27f9c404003b2fe21b52fc1c7c8449d1da91e9481b0d43c626b5bf09a63fd419d885417a3a46d37dbdb5574e

Download Submit
C:\ProgramData\Microsoft Help\MS.EXCEL.DEV.14.1033.hxn.RYK

Filesize
658B

MD5
1fe76469785eb8c57de8c571e515c502

SHA1
5a80e3e4071e93cb987534af7ed371b0efdc91ce

SHA256
5e6dad5bb044e987e5ff2b30f27a5af8d0c639a16b217878140241853554de9c

SHA512
6ea54fc0414eda46dd98155e26d44674731969256e19443c3e15d4a2ceaf599ae39308fe12ea789bcc76405f232e04e2a5d05c4c45c995b99da82727fcbc2617

Download Submit
C:\ProgramData\Microsoft Help\MS.GRAPH.14.1033.hxn.RYK

Filesize
626B

MD5
928466f9de6a2cc1923e0bbbe11dd4d1

SHA1
80f91bf717f370ade2009db1e9eadf17beb9f26e

SHA256
d848fc65d9cd15b4db838c13cb8b255e7026173c2f2cdb8a171ead712a364580

SHA512
051b0628da96df05eb8c42850a5b9153127c4c5af0816b33a120c2d687cf7bf3beae1caf39616078084ba8ec67474fadcf26fe5d6863efebd7e669792eb31844

Download Submit
C:\ProgramData\Microsoft Help\MS.GROOVE.14.1033.hxn.RYK

Filesize
642B

MD5
ac613dff4e019dc0f2b866f275b03624

SHA1
da4390a2371811be7f1db45d7653a7535d2073d3

SHA256
073a411c89c0c245715dc5bb1b140a8273352ab8717e8d8cd2fcfcedc7632a4a

SHA512
9c1977daa9db37bd25e670ac62dbcbd31f9122634f25bb08e38d66509fd9850e003334df4e501148435ccbaa9c4fa244c885460521d590db2a24579afc146cca

Download Submit
C:\ProgramData\Microsoft Help\MS.INFOPATH.14.1033.hxn.RYK

Filesize
658B

MD5
5e3aaa8d3ed41c7181b7085c37cec9f5

SHA1
52f30f4a7256860aa072424ecb083e908be5ddb2

SHA256
b6ed0f30cef2020496d94e4d535cb7c4c15dc96be726bb8caa3b9dbd1f41090e

SHA512
f6dc3364868236a3c11f2f24510e480b72d66708466fe92776ebd130587911b6e1fb529c1e8ce556bdf87684b091eba2194563ad925eaa0fbcf32cd0e6ccfdf0

Download Submit
C:\ProgramData\Microsoft Help\MS.INFOPATHEDITOR.14.1033.hxn.RYK

Filesize
690B

MD5
f8f4cba49892c1577d3eafad648a2a9f

SHA1
d3e5211c27252614417610e4c281aff2bfc76c30

SHA256
b9301227f31b781a30a802d4b1a0b184811a7381a0d68c5d2f10616446828743

SHA512
e3d5a2afc74bd4763b5b6d21da2bf8bc69d6215725d1e0b9dc6604cc2a39546e1f7c29fde5b1eabab6e578b8e80e0ff950f26ca25312ef6b9f4868615ef20dd7

Download Submit
C:\ProgramData\Microsoft Help\MS.MSACCESS.14.1033.hxn.RYK

Filesize
658B

MD5
d23e356319fe4450651617f3c1a276fb

SHA1
2cc0305de7cf07ccbea7ec48277fd3220eb700da

SHA256
0f375f45a042ab74a53a3f7cc15084ec44390b258b37266e4668b0b3ccf86c33

SHA512
d310050979b5ebff360c77b9652923baf874aba8ee8d5567fde6ba6e9579758531c74b75b78995961e1ee250d50463ced08b9cdc5b1add1ede44ec4c9f995767

Download Submit
C:\ProgramData\Microsoft Help\MS.MSACCESS.DEV.14.1033.hxn.RYK

Filesize
674B

MD5
5f0785466321172b3ce7bb1bb5955f77

SHA1
b9b902d76aae7e2bb03bef07af12f869ba41b04c

SHA256
37a5cd5969d8f28a26a2ac0d638febf2bb4d1887b6fad6c520524bfa8be62d95

SHA512
9a1996f9031f1a47fcbd0787a22709b80749f062f4f5031266c0ef5bea556eec356847ea144a8738e9007d1c49c7261df05307568e5ef494db0e6461717dad70

Download Submit
C:\ProgramData\Microsoft Help\MS.MSOUC.14.1033.hxn.RYK

Filesize
626B

MD5
e869f7cc929b4b6838e1f895d79f7096

SHA1
b16313e10320d3e5267ff0554abe5d4b9f1d4cd6

SHA256
ccc1e3316181f918d7eb3715e57e7b4b4c7f05ecaa76b652b4548c28795541f6

SHA512
bda7a72bf79b2c411f6884cffc3826f8f29e8ac33618cc33c24504e64d6161e0c1df610afe6c34d97461a8af457fac9288da9221f72e31ba495f6a3859af2c75

Download Submit
C:\ProgramData\Microsoft Help\MS.MSPUB.14.1033.hxn.RYK

Filesize
626B

MD5
2ed0e93337000ee090942615f932f268

SHA1
8f591650c5fd43882c21033cd51dbd03c3352aac

SHA256
8cc77bc18897ad3eb071c85a10048df5a80afd36a37c498f40ce7ff2349090ce

SHA512
81a1d4df229690d7536c0e0134929b12cc4f4460e7dc09140bd7a8bd5167121a168cd88aa61bca6f7a005a0687b5af9c8aaddc9344a736e13c3c79e0b0710463

Download Submit
C:\ProgramData\Microsoft Help\MS.MSPUB.DEV.14.1033.hxn.RYK

Filesize
658B

MD5
d11a191604f6b382a832f5f55c112ea1

SHA1
b109f4c1f1abd19239ea5781c93252322890a597

SHA256
d95e35c665b582058a140e094880ca9bc2aae5e688ff1b8d750ea703270ca344

SHA512
b7446a4dbf199138cf7372493b56ffea6c48a2c8efb08dd401bfd1eb96fb7fbbbd7f3df28a686a62e997514ee5dfee6bba21ae5ff113efcd741e62931a333fa8

Download Submit
C:\ProgramData\Microsoft Help\MS.MSTORE.14.1033.hxn.RYK

Filesize
642B

MD5
47ee8cd4a5db24517b3d39b191339172

SHA1
28291b67cbc9ae56183df4d716db5443e04b99e0

SHA256
f76825467d500ae17536bef8247f084a7844df5196bcb4636a062a5a7c84ef52

SHA512
97cb1ed58749aeb324fae1f2a7f9f31ede9d1b812983d8383a02916d2e9803dd12e7a79e9a649f0bac98905eff261c2e34606fc060191fed0873d081798807df

Download Submit
C:\ProgramData\Microsoft Help\MS.OIS.14.1033.hxn.RYK

Filesize
626B

MD5
55c9e336d35d12205b471920e925f1d1

SHA1
de466939a8ec9353b3c1f7625686d21c19ffc6c2

SHA256
bb876f54083d1bcc744135a5c9919b8c32db356117e50850eec196a713f609cc

SHA512
d889f5386457bd128c4ecc689eec7836e5dd1355bde2acd3734b92e808b06fdca9387c811472d3d573ef2e9ae58c0b69d2e3dd9440a197d9dea90ada1e259707

Download Submit
C:\ProgramData\Microsoft Help\MS.ONENOTE.14.1033.hxn.RYK

Filesize
642B

MD5
64e3168a21396f0b007c98eec65577ed

SHA1
b643e8fbd521ca4995c0a1b8fea4781e1a679d9a

SHA256
b22aae49b33fafc72bc911d773d04444bd8e0354e3458ae98887073365e55642

SHA512
fd31de54dd8d2622539a9936d75b307766ffc6e000a0dc9c97d96390894c0150729dd17962cb5d7f573d72b54dd898cfe176d5def8c245d2ad807182069d0461

Download Submit
C:\ProgramData\Microsoft Help\MS.OUTLOOK.14.1033.hxn.RYK

Filesize
642B

MD5
60a384abfedd3f848d6ccad75c403ad2

SHA1
bccdd4a248daba99db310892b3d1f6b9a5b29696

SHA256
969f9a71ac63f999487d7cabc8bf64a70a8f543cf212ba6b90397b803c35b335

SHA512
7118a286c5397c0fdab3bd79f9c228be01ec3132a6e5ba3e8775375b3e412d8c091640f7e75f09044a6efc8d49e16f3e744a17081bc53b50aa28a9b34d692e68

Download Submit
C:\ProgramData\Microsoft Help\MS.OUTLOOK.DEV.14.1033.hxn.RYK

Filesize
674B

MD5
a4c3da3c38e2c6588d05bfc424e09306

SHA1
7d64fdc9600f31fbed3dabdfe75cb54999e13e31

SHA256
f2a0e5986cede9c90c866668ea8d8879e3582b7a2ffcd122d1ae0c4a0f793173

SHA512
f31ab1184918bf8a984272612bf199d9870753ff56b7e927370516e7f06496aeac760fb30859692fa302f1ebb7f933d9b28a2e3ce5b36541bb5e6f68e970b31a

Download Submit
C:\ProgramData\Microsoft Help\MS.POWERPNT.14.1033.hxn.RYK

Filesize
658B

MD5
437e9fe0d78aa388ace699ad169d29f4

SHA1
53fe25841d81856d9f9af5ee17a2d8adcc4f3c1d

SHA256
e348a7b8b287474236649e538e1ca3c2d58c2bfbbd2d04c39c8edde68446d9c5

SHA512
5f1415d34c422bf7aff204aa9f42105f9bfca37268d59ab263eb34c9414fef9f669d2012449b6652df461d1d87c1e70cb468eacc5b64793ca17efde62b37ec8f

Download Submit
C:\ProgramData\Microsoft Help\MS.POWERPNT.DEV.14.1033.hxn.RYK

Filesize
674B

MD5
9fed5693d85c09f2ede266e6237ca9b7

SHA1
e7228bd7e2ff65e6a96e4aad621acce65aa2ae6f

SHA256
f9143087fa119c031e045e475fa5b8df0fd6ddad24c8051b881cec5bc72fa706

SHA512
a2bcf1c37ea24671fbe940af11243579b04cbc69366acf0050e8a116206d0298167de58cf12a7aaa2c296b428a88cdcc82bfbccb4d6bae9c176c5da7dedb1ce0

Download Submit
C:\ProgramData\Microsoft Help\MS.SETLANG.14.1033.hxn.RYK

Filesize
642B

MD5
43a1ad54d5b88968cb1e6c206b65d5b9

SHA1
69d750e33a977d4c86718cb3a4c91dcfa85fef16

SHA256
928601c197858789dea0b18937e49f0e3b276400a18513836b914ab51e409c76

SHA512
c3c254190a1ed2f8bd60f6927147ff1ef85ea7981e3b0a4d4bd73bcd0163afe111a0c8bf522bdbfa08c73176c000fffde8979e6e209b2424999f68e29a211592

Download Submit
C:\ProgramData\Microsoft Help\MS.WINWORD.14.1033.hxn.RYK

Filesize
642B

MD5
746391f41e4019389bc46986ddbda514

SHA1
9874c5001fef2dea67581227a0b0a60bc59dd8c0

SHA256
40185266b46827f11b42e51e40b1b15580e6a042ae39f713c9bded1e6390d22b

SHA512
f236d45003f893fc6881eecad23ad055b53a15523ce3083d6bfc49ee15d20998219c8c862be98a80f11981b6c1d6b47d295dba5f43e0b3ed8566fe9313ea428d

Download Submit
C:\ProgramData\Microsoft Help\MS.WINWORD.DEV.14.1033.hxn.RYK

Filesize
674B

MD5
ac11c2043b2d5d92ac9ef0f37586b50f

SHA1
7ec0c2e924b1b6b5f042b682d56d380f656b6998

SHA256
3fad90d3393dc56567a97192a657724b60263703d3eda161641aeef120f4b559

SHA512
84c0619a02af69dcd2446bdffbdcbe92f8ff806cbe4e52ade6b8e8278765833dfdc3808eda7c669515467cfb7768151ffd6d6680128b0a48b2e8bf035a0afb99

Download Submit
C:\ProgramData\Microsoft Help\nslist.hxl.RYK

Filesize
6KB

MD5
4c64889e580953e80dbbadddacc753ce

SHA1
7b7233c884c6996c3a3cee06cb0a4abef961e4fd

SHA256
9a5857a82aa4c98d42b945d4ad519e7f7758cc58ff701eedc778c880e2bec478

SHA512
2660bdcece40f7b5f300fd0b1f06572f33b3d3a7094371dc423788fbd891ab391f1be3814143cec41c501a784ff5bf9c24e3bd8028ae8ce4e847c1c3d69a7f44

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_CValidator.H1D.RYK

Filesize
12KB

MD5
c946fcf528c4b736527e037e72bda696

SHA1
ffd20922084d726a7a652ad5127d03577c04ee82

SHA256
9977881e7f71645cf9026b1084bcd552ade5c23ca507e2dd6cedab4517ee73be

SHA512
46b631cf55b7c3080a1f9516f0898db6d63e5576bb40a6646266f03bc3c16cbfabe91b378015ef5354f86557225382eb316d7292a79bec2ae93e4db150deb5a4

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_AssetId.H1W.RYK

Filesize
229KB

MD5
8002cbff6ad4c28dec0a4991eac1cd70

SHA1
1f8bf35ad994068aa14e3f0e6b7265be9d98142c

SHA256
d7ff94e449ca2efb92ef2dfa7666fb2ae8f0b04b7b160f5ce4f5a88f71f30846

SHA512
d8eda9b3fdcf87ce2093bdbf1db5e9255174f051d19c8b053b59958cbba8ac656d2996fcbaef000dd360e0de6b118937ef4a1b049f7b1119a024a2fe5a09425d

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_BestBet.H1W.RYK

Filesize
409KB

MD5
c2c564a14afcfd79ee25e159f0f917be

SHA1
218a4fd4b436ab415d8993280541ac6db7f0ca82

SHA256
d9d1d1fca3c9debefbe8ec7b2010c5ea2018a95c1ae771949ae5fbe1d0ac7c08

SHA512
543b8254a611ee740b99e6881fce97696ffee8d18edf17bfce4f47b297d8eaaa538b08d5c65019d5bf9c0faa3342f93fd67ced104be3d314f8d3b2b962cb3f02

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MTOC_help.H1H.RYK

Filesize
531KB

MD5
ad7abee0425d6180adb62230b411fcb8

SHA1
66eb332c4b70752b222d70861c394be161dd4690

SHA256
819a49d658e0eb277dbc91f14e56d503ae1afc09a78b6a0e4efece5b2687ab39

SHA512
f873a623a66bbc37f63f130089b1716c213b0e6dbd11ec05d53367f44aa25eb68d4b20bc19c137ad081bb225e8090be0a2d65066afd42e6d616d6bd7dd7644aa

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MValidator.H1D.RYK

Filesize
14KB

MD5
c0190a55f74c6ff6135506dcfb9dcbf8

SHA1
48790692b8d3247bb0a0bcf67b7c0337ef5016ee

SHA256
170e7f57d0d2675b922dc2bbaf1d3044426cc0c013ceb5c6dae05fb931d9ab84

SHA512
bf597129dfb64a20a405a6c24c93ee21d339cd0360c2a32f35aca7eb1240c1112717a5fbb9429d7312c5c1fc6db1f84c8edbdb0083d9c2e4e77e62b07ba10df4

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help{45EACA36-DBE9-4E4A-A26D-5C201902346D}.H1Q.RYK

Filesize
1.2MB

MD5
d4503094cd4c8855116fbbfc536d0103

SHA1
4eacda005e63c2797b08fd35a9b6b4310897f757

SHA256
8d99c807ddd487211ee8b0d371c3e96f6e03bd00a79ad81fbe34c78a6baf207f

SHA512
361fd61d3ac7d4a915a2644e9eabde1851ddaa5a091024bdfa4fb54ec0a01f65dd6bc0971ec0cf90ac4a27871b8458aeb43425b34f397e8adb4f4e396318c98d

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D.RYK

Filesize
12KB

MD5
53445af4a5396c7e23cb2db0011bedbc

SHA1
f9409b79ea0a9acfd036505f4e2f4a927b459f23

SHA256
c33c23ec1dbd2f629353775fd192c5a3e99a0482f61cc2154bd5c0d1ade15d65

SHA512
1e89cde152a5b43077ca47f1fb7020c5b9f91ffaacba7aac69a27c196ccbb3e83cd6efa6e929d074f4c669bb5ea18598f1d050ae0f528ed95f7b3a149a09aaf6

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_AssetId.H1W.RYK

Filesize
229KB

MD5
f5679d0d4b21c2585ab9d393e74c37d0

SHA1
7f121709d182ceaac92e992e90ce1a8846e4c607

SHA256
cc8656e2c3a4d564039761fa02debfdb5402a44e1dfe3f35079192680b2df803

SHA512
a3c8e27c849ceeb4a64a342c0f969e2decbded41f6c2f0eed1b40bc7181a10ff70e1130ac01d7453cec6537fb67a8bc773d2f950918b5be7540063772b6a52db

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_BestBet.H1W.RYK

Filesize
201KB

MD5
a4c5800e43010b64dddcf41a7f0a2f46

SHA1
94300df62ee2c33d233606788fc24342ef0a3194

SHA256
1d25cf73e6cd8c2792c4c1de0eeec6fe6104e627ba5a442a412a964946a8c5ec

SHA512
6090748a4cd70fb6b9b1f0a8951a41459e75ab34aeed244890d8f4479c3fb7a535638ab53560fff04da157264c09e899d1868ba9485405676a149a4a65cee005

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H.RYK

Filesize
491KB

MD5
234a1902bfb4922ca2b1c597d33ab6e9

SHA1
def22080702aa01c0579340639952a03389e85db

SHA256
88baeea6adad55e08d20ca851d674658aafcf61e2d374f480cdc89aeb051785a

SHA512
5680d841c0036f442ea55f271e6d5059fd845d5893b3ed1ca642d6528344d5f5338ce9ef0a1409eeb1a6099c2ea3cdfd04e989e08d45ddff96020da4e678e4f1

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.H1D.RYK

Filesize
14KB

MD5
8df12d0bd19949921bd045d275c8ab6b

SHA1
b1e86a3bf11bfcbdd801c2317d23a24705c7c0de

SHA256
4c60b875290a09244ee1daa85235c3a256ae7a388181f1d1cb27092abf451fc3

SHA512
5e0eab9a6989b1d2b64ead626f3ed2d4c7d7cf0333391b14e5585aabd4c3f638c2d6aeb19af2ee39cbdf8f97140a11d1f4611354f046be5cec3fdcab582447ac

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q.RYK

Filesize
864KB

MD5
c4118b10425262f711b289944b55b12f

SHA1
a4f54111a97b8fcd63c4cb3e0d9fe5cb7bb99a3d

SHA256
8e87ffcc3e60aa0d2727dd2fb6a5729d8ed31e612b33dc5a8ee836b1dcaf013a

SHA512
f67a7a4518e3f3debd33845a2ae9bca3579d431f651ccd75e4580975683d13c1087014023f23f3ff413bc969fcebed02e7744dbbfbeac20d3c396f8525b1943a

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_CValidator.H1D.RYK

Filesize
12KB

MD5
2e336444782e5944d77a155759fcd30c

SHA1
c5ee8156dfb683147f1f03baeda2ea892380107d

SHA256
7c8d1332a757e92dfd22a7e8e64f34bec092972d68676916933380c114c5d022

SHA512
e1b32e5259fafa0d7de77e2c085cf2a0b606dce40935e65bc1dec5288e3784b3b168c2eabc77f94cc21d2f8b1f0278cb274438ef3c7883a915ab42b359ae73ff

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_AssetId.H1W.RYK

Filesize
229KB

MD5
7fe29bbf0c8ae0c747e6ca2791e3d3f0

SHA1
c63dc7d39dcee8ce9ed01e6fdca67449649f5298

SHA256
41bced93eb07c7bf10dc5486e6811f12f866fdbf41b7555b8437fd07122c9119

SHA512
47adcbc593f038d453bc9434e7bf7b78d9c26a9c03d3363867bbcf1a7c5b07c4e9a1b753ae58686642ae34e25f9f2059ec0d8ae206b25a8dea955ce362058d77

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_BestBet.H1W.RYK

Filesize
425KB

MD5
243b1ade3983beef4585d2f1805d04ff

SHA1
d95ccc616984751123a9dd3ea00b6dfa0d940384

SHA256
86b3d5d3de98c7601bc0856465ae4572393bcdcb69502ad79bbb87ed48e91110

SHA512
c1dcd201560a34e551388dff03eb0c99bdfb00a0d0a554c41f86f38b3e1d9d667f72ec5a91d0dbb96bdd2415219140436d5ffd5dd854d47d17519f3bce191b32

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MTOC_help.H1H.RYK

Filesize
531KB

MD5
a4bd1f89060ef61ca2d910f68b76b6d2

SHA1
77536bb3b26695b8d1f008e16095d327742d7928

SHA256
8633e090c63d1e1a531d44a6d207e68297149596e1996266f6ad23a81ddab7dc

SHA512
0c670c4a428f122a80f9010010819e4f86d7ef9a7256b8301895fd7810927007c455be0d116401ecf3711cf607a14ecfafab18878d6523135e8a8c127dc70014

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.H1D.RYK

Filesize
14KB

MD5
e12e2a13ea6392ac94dcb44b1d65cb16

SHA1
b109978bde4a7fa3c2c65e2418065cd33bed46f0

SHA256
31d57a5c360e0b81fe19d9587707a4798cdcfa0eb1e9de6dfdee9d16664dc7f3

SHA512
4360fe0da08679fead4c1aafd269b52b9c64d308701e0a851d4275a9e4070727964ef919f52de2b35bc6ee025ab833722a786085194cb4dcc0cecb3bfcab0c87

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help{68DC71DC-2327-4040-8F03-50D6A9805049}.H1Q.RYK

Filesize
1.0MB

MD5
3ab935f8c0d3978621a43083e52b47b7

SHA1
0dbec9a02ad3c2b9640add205e0f18bf5588ab87

SHA256
8771766060edc374fbcb6f268e324c136be19a264d7069ba8b0ea6540172c14c

SHA512
e932311926c23913ed6341a939444dfe9ac463ef9c7c75c6f2b6a2296302198f0d3479fe5a6c922f347ec98fd68a43d0e8137dac06375e28fe2b3c78f6e82a5b

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_CValidator.H1D.RYK

Filesize
12KB

MD5
3354dc56066a3aaa25b9097903f27bdf

SHA1
46d170ccd6ac88172651e4dff6ef9ec6bdee01da

SHA256
baec4acbac81a2aecbeaad66d5e63426b0c97845833ad02b0b9be04b1123979e

SHA512
c46908e308e39c8536ff0fd9ab6a7f3181410fea0097d3a7786507b282bbfd90669e80aacc21686b4ed0944525a351a2346a3fbec5ff618408256533411359c6

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_AssetId.H1W.RYK

Filesize
229KB

MD5
6537edbe94df3be7e8db3abcd2be7cf0

SHA1
c2fd30fab03e63daf6df7405b51de68a7c9f80de

SHA256
e720dae2adafb4341c6da94323158614cd4f72d12728496bfd33a15ad1b6b1f2

SHA512
a47f65e5e4b8ca3db06e1747d7c1e6e09572b9c89744de41cd222dee4a042a19b4be1184616979ec256c21e4a1c58694ba15a4e0b0d89d2977e9a873be8ce1a7

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_BestBet.H1W.RYK

Filesize
421KB

MD5
886dbd292d7eef8c498758b3d12afece

SHA1
0a8060c9b7af2094b230442f86588da262d7d5ec

SHA256
f7ea2f41562f4759f7ede671d01ae3cf037ec20c9a5ea95329af6e84a47da151

SHA512
39ca31e55a3a7de4ba10f4c570e5099aab9c26cec2407cab5f59ae13c9b5177fb69b50a314266b2af1f0c1b7c22720be338b2b539ebdff6a0f373cb802f5e0fe

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MTOC_help.H1H.RYK

Filesize
546KB

MD5
fc211e24fcdcbc94beb8d2b1c2abaca3

SHA1
fcdc6e84b5b3ed8c8cdbda8c100878e8248b69b7

SHA256
57751097bb711309af71578b569526bee7fd983a7e415c9608f465404549f411

SHA512
4c905c806788c51b03097995f3b1b4f28f99bc7d0cc7fced4c172e894c838bd097f407207fa095402374be1fbf07aed723a53b1309c48de89cdb77f27c7a2ac8

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MValidator.H1D.RYK

Filesize
14KB

MD5
9d858d66ffba0a4ea40d534d8738573f

SHA1
0c09cadc896e5274fc3883e4075ca7ec8773fa07

SHA256
1adb6522a59be6eb15fe7f3a708635e5cc23723ca2c3b2109cb28b62c3e8973f

SHA512
549e31aaaf5e3f9a2090cbb13035c43f53932c08897f4f28a905baed3382d1fa8d6a60a7dcd6222b2dcaeee5a9dc4a827dd55417effb6f18986ae9ceff22a8e7

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help{92F2118A-E813-4A4D-9DE2-F96A9DC02C53}.H1Q.RYK

Filesize
1.1MB

MD5
a16cdc9f4ff521668b8cc080d7291a22

SHA1
340524d3c80cce31f48698a5d07254531d07c401

SHA256
0b3aeb85ccad7316283e4ae9bec9d9af58d6ea9d2fe2b8825a723eca70860c40

SHA512
0a580b2c5ca2a06e81d836581b8254f945dc69336bcd8aa30145d2ce217f51713c7bad9c206df24a206a31bf9c535758e60a57e0d26129c00a6eef1dcb7ccabb

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_CValidator.H1D.RYK

Filesize
12KB

MD5
a20fd17571775e26bd665c7804e144e4

SHA1
487a0a795d1d789abdd1c538101261c3ef737298

SHA256
7b96135009294b81bb19c3240a63ca7501c5654baf29b6b71871e1b260ac45f9

SHA512
65ce6d515a41825b90b3c84941ab666bc3330624424fae131c0a6fe9df998b7b7c04902ecf815ad576b1aead09baab03fded3c05f7353f3f5ce809f7ab6fc22f

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_AssetId.H1W.RYK

Filesize
229KB

MD5
1713e9f4d9f399438ed698543fa5f7ad

SHA1
5c48a3f055b8854247fcb50d1bfcba12e1eca4f8

SHA256
570b37c09a0d0e031e56aa87310ab03e5eb5664fc611baf775e62b5e54f67424

SHA512
01b7079e057b9f85730f18ec6aa7a39947797d02d957896195a875715e756b7d7e8150687546322a7806e7fda8c633612b4a78a59df07319b67f710b95836d9d

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_BestBet.H1W.RYK

Filesize
421KB

MD5
785eb7e77dfe2c9ec17667c5ec905d43

SHA1
41ede7680354183aaca96bedc9fae25647422e37

SHA256
eac9ece693c38e6b12ad6d531a6f5fcb7fd99a63aacc595debe7d330da742b80

SHA512
af485a734f81a72213db5bbaa663e8d2cc27d77b15ea9d87dcf916521df37a21785d1f305d2caa0f0887f55cff292067855950186baebcd042976000519041fc

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MTOC_help.H1H.RYK

Filesize
530KB

MD5
8c29bcb59d2e51059d354cf738b5bdf9

SHA1
c74e32c22b7b9f0b1e033e99e627cffb2dde7296

SHA256
ce804c3a387870464f4da2709cc1f428878ed9c55c6f47e5b92d6c6fbb850531

SHA512
94fb3e607b1318103a6720000f7865fd4db55a1d0d16ae54a7e07d4560e8693ade38c705149e79a653cbd934c738ddb37e406cb2f289b190f9013f6e961ffc55

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MValidator.H1D.RYK

Filesize
14KB

MD5
59cb06ae0589c138c0056ba144715ac7

SHA1
195be4fe51a6d4a4fc42d0211ee92f406789518e

SHA256
ba7d35716262953ac21a4178d24f9b1471d1632ac25eb8a4d90d7bf9bef4aa4b

SHA512
1893a094051b0a2d58398abd14776efda3aebdbd7bc4604161b728d7f263d98378f4df73fff9e66959389821f40051d9480e468701e5d96148a5b9745b0a0157

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help{7E352021-69D6-4553-86AC-430B0D8FF913}.H1Q.RYK

Filesize
1.0MB

MD5
eac1cb6f15feb44c260d93225b715d3b

SHA1
5065d45b3ef56598439d7758344e1973b76abaae

SHA256
ce6038ae514c0f61f59153d6d45ebf05e4f03fa544dc1ed1471b9fdf612ff8ef

SHA512
9de24bdbaa2571207809d1c3dbb4cf41c566f68b160fa34a79f087403c55465307cfa7cea06277599e65ca09ba5ff0cdfb79c8284b8aa4a34159fc3f15e36821

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_CValidator.H1D.RYK

Filesize
12KB

MD5
29e87cd5cc06ae40351f064e27099d81

SHA1
77a0674f5617a1789b2e11867dc328edae7aaf00

SHA256
8f172664581d1cfb28f414e6081f5e546e368d35e697cb473aa524dfc778de40

SHA512
702ae101edd442585f4ad03f631f4b5ac15576b368bcc36884233f05267cde3d2a70025d59ad492506e8d5b2df9ef323b5899d24d6d4a2721a4c080fc2d879a1

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_AssetId.H1W.RYK

Filesize
229KB

MD5
d6c29ea6ad4891241d6d516cacfdd585

SHA1
28ccc4ef62bf2baebd691cba3b60d3dac1399136

SHA256
57d85b744213f0ef845aa3fc6f6f1d384a2866830e55ecb64ef520eddd78c9fa

SHA512
8dc63d075acfa7d0be8142281258d6da732338027f44743c5d1babc9d52b928194dd8e4462534ca5378fdbcf6a84052ae755223ac9a3d8e425fb717547eba3aa

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_BestBet.H1W.RYK

Filesize
357KB

MD5
9739ee1669c239130cddfc3666a287ad

SHA1
5e7f509ad9aa6d829c49e8549f45765f3e7380c1

SHA256
d194f112182f481ad3d10f1ba505475930e3ad3189ea18e73bd7f41cec0c1247

SHA512
39d9e73f6207b5dab9afdeb154a75057b0bfb3de1387c2435ea4091bfb834540b823a9b4a12b0b65005aec4c2155f199ac7dc029d3787e6fa41c2f59c454efcd

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MTOC_help.H1H.RYK

Filesize
352KB

MD5
d0c5acd3281df514cf2e73f49984411f

SHA1
fa483c4ec4be9302226fe403211d14e3a0537e85

SHA256
8f412d2ed0440d5b839fa3f88a074c418a249172ee798e138af27f4f9735e90d

SHA512
a2c3809722a0bdcbe4c777b68b1454f2f611f463c63f874f53653f597814c72861f3f3f2d264b9b9dfc471ef82935c7eb4481cf5678dc5bb8eda0380916ac485

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MValidator.H1D.RYK

Filesize
14KB

MD5
8e037e4914e7d06919c4bc1f141d360d

SHA1
1bb6e2b7e2470be7eadbe03d6afb2d580b2f4660

SHA256
afcc250662e78b33fe01d0c62a89b0cbce2d7516532c22626632fb871c9605fc

SHA512
dd77e6ee78f6ca65e821912ed6121d407c3b41f7a9429655f67a8d185a67dc0b6a15ed7ad0a40f8a2b31074e921d4683021276c6ae0c2c337de35dfe29430165

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help{E1E8F15E-8BEC-45DF-83BF-50FF84D0CAB5}.H1Q.RYK

Filesize
1.2MB

MD5
90a0475beffcf791c8062d938f47d90f

SHA1
31262bf2652f0a512077d8f8bf96cf2266d27710

SHA256
99c08c896fa6a0190a5a8feca11321113d9363f4e991161418378aaaf9c2002f

SHA512
ab6bb073c53eb2e21d1b12c5b51e04c62c8b3c5dd511d2ef301a51de4f3b80ef0a9bfe0b28521d005d13d6394d1231de68670e99337007b9466fdcb30dd73f5d

Download Submit
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_a42634aa-f501-41cf-bed1-b8158857da02

Filesize
52B

MD5
93a5aadeec082ffc1bca5aa27af70f52

SHA1
47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

SHA256
a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

SHA512
df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

Download Submit
C:\ProgramData\Microsoft\MF\Active.GRL.RYK

Filesize
14KB

MD5
228680de11a1a07c16624ae63d64c8e3

SHA1
155d262274028738870c609927d870347d94a5f3

SHA256
39cb5507afb66f8cb7c56fa4064bfce21f314b312fe12987b1683313dd365d91

SHA512
2f63ae7074d937d54bcbd8444885ec9281456838779f74efae3e1ca10a4baf63f800f36c7dcde1ab375ec7ec5a463fa884c82e2461215f7545d4de484403d310

Download Submit
C:\ProgramData\Microsoft\MF\Pending.GRL.RYK

Filesize
14KB

MD5
b4f97707737ce8fa03ba3028426df679

SHA1
a64c182bd5700034a8781eec9929d879dbd2dd9d

SHA256
e2b208cc268b8f499639cbadd8774c0b855776a6210d5f3baa198cdbc75cfe89

SHA512
566c60de582eeff1d693aa7d633bdb1811a87d35c5e0b905933723ecb8df807bde4b71e6b2d8e16fdf68db64c86affaba2b069f028c589f1db63631885dffaac

Download Submit
C:\ProgramData\Microsoft\OFFICE\AssetLibrary.ico.RYK

Filesize
5KB

MD5
d22d7b8cb7691e2113b187725cb8d512

SHA1
18bed76a0a7b2a5275f7455a1127dbaa76153239

SHA256
414d26c73313896307bdadf5859e0f57b0b52c646a3c9268e4d309119750c3a2

SHA512
cbde39fd5331f7b113d074e2464e85da844ff382b04c486743728c07b4a1a46eaa76ae1f7fb34488c2eb5131afe16bdd0b00318eb85cc61d6a316ec8351541ef

Download Submit
C:\ProgramData\Microsoft\OFFICE\DocumentRepository.ico.RYK

Filesize
24KB

MD5
486535d5d2ab0ac0fe691f68a64eb20a

SHA1
f84f8fb1060ba5f8a817251d08275b2d79af8578

SHA256
f22fce7359d52a6f41f33d826cd5b31822f7d823e429e4e084031894e81fc3ba

SHA512
812c7ea9a456fdf27c99b817b5eca98764785158bdf1c1059b2cb4291c682ef4b25a456b989253f4cece724f485b2d30531e099f382da3168424e5b3fd5b5552

Download Submit
C:\ProgramData\Microsoft\OFFICE\MySharePoints.ico.RYK

Filesize
341KB

MD5
7ac2421648cd5375d8d16f15d897281a

SHA1
be54c642d96cae2684e9b975d85b4a5217270b05

SHA256
1435d1978fddb5d2b7f0fe15f8471e6304087d077273d8f645f0c0ae30e725f5

SHA512
335da2a1714e03800f09f42badc6424c62b257f6b8b3b6a1620afa2b262c92e75d023fc7a662131fb9907f5f709fbaf47fd11018d4a8ded3755524e6582145e9

Download Submit
C:\ProgramData\Microsoft\OFFICE\MySite.ico.RYK

Filesize
24KB

MD5
6d6c94cc72df2de07cc5c130867e36e0

SHA1
02d61cf4f83dd8e9ef2204ebde1a9b16d9e0ba34

SHA256
7b66a1139f48e139a25c4e47474075674a107822a90c53cd701308084f684120

SHA512
0d6ed64bcd1bf51f1f8d414bdbf3e515b1120ed81461ba86f185529b21149305b28b4d2db4b5a014aeba414470a3a1bfd60f8a96586ea761cf7a0e12e9589f72

Download Submit
C:\ProgramData\Microsoft\OFFICE\SharePointPortalSite.ico.RYK

Filesize
24KB

MD5
5ac2bb95bf263128253cecc4728e9cf8

SHA1
6efd8bdd8cc392efaff5daf399956e7df42823dd

SHA256
0e8b5787393a99d939cb6827f5aad5c78e97f1d57792af0b5cdd785680a84487

SHA512
41fd1a12f8eb4552db9bfccb967f98e047594de3e29b8e5780490a50e2ef2c9cbab2947e67a8a8897398ff99d9f4268d01747fd46ef2e0ef2453975af8749dad

Download Submit
C:\ProgramData\Microsoft\OFFICE\SharePointTeamSite.ico.RYK

Filesize
24KB

MD5
f4931fc232102151ed70b4caca506c88

SHA1
225fdb2e396dc5afbb3be93bf700a39ead799b69

SHA256
66e711edb6fc698c648b44d548d84566d86f2c4a527d884d39e7041109bc1735

SHA512
b54ef11221b5fac16182bb3e525880fda2a11e3e7c7762e5fe018914ae4cfddd5dc58f48e795a67829e50d24b446c64e4e9e57aada4f619814bd3e5bb9117088

Download Submit
C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat.RYK

Filesize
29KB

MD5
25cce1b193c7c7253e44b19f9b20f968

SHA1
a5c6fbb57514a9926daa62fe642f2b20b0e32abc

SHA256
87cbaefdfda9222670fc2db1fad36b3156d5e371d237043efc4ed6b37ebe11ba

SHA512
7128969c8f9b21895aba4c9f275d3979be2ef444ef76a8f008c5034391ee2b176cee9e9152d9ac837ab52b2d307221686a7f239bdbe1b8fb4515889a71d27838

Download Submit
C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat.RYK

Filesize
2.3MB

MD5
fd65e0b07c79bd2302f0d68c37650c5d

SHA1
9590ed976304093c8bd4ce5340bd8b04365bce86

SHA256
c0e28b97427b726e9aac99bc224d836741af1904002785346e2bb30aab13321c

SHA512
96b7c657c16f8833dccb0ea36796c5dd807524a9339257c1cd709c5f0d393808aa104ca51b4209442cfcd5384208825f5f12f9c329a0e8720f27004753e5afa9

Download Submit
C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.RYK

Filesize
48KB

MD5
9c8cb45c37f2828130a4fd508956dcb6

SHA1
645969d6467f2aca37a2f3e3ebef34059eca3af8

SHA256
39f0d0cba8999a407bfc49adfda650fe0faf888f1fac3e6336970e30752b7040

SHA512
6e03ecda7d5e14f4c9626a421d31993dfcb2d34fede6426120dd1522d55aa207763cb4d8a616df5673c5ec466904821ff71de82de77d1b1a604aa624c8e80b2e

Download Submit
C:\ProgramData\Microsoft\User Account Pictures\user.bmp.RYK

Filesize
48KB

MD5
0daa3cd2ba231bd0818737c6b6f9e09d

SHA1
7c69e3c1f64cd2a3637550fa038efe9e36975148

SHA256
e24fca5662877104009a0530a5aa74b8827b22b8384f62c103136cb09ba83f7a

SHA512
1713c96595f814215ed7b579c3bf4980040040e7c4c2dff880b6873614e0e499b8e4242c34db2ea074c4446e5c0bf0d18cd679df9072d3f65a2f10c8851303db

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk.RYK

Filesize
1KB

MD5
d58b28a3e70591e239398cb8ef20c395

SHA1
728bbff45bc90d2385ce2d64672b4298650913a4

SHA256
15ef4ea19f361a019dcb36a8d98faa85080cfb193a1e1ca4edc8fd4fe0663edb

SHA512
ac96b9a9a2f4d49b55d9291b5d0eb5374512b828152c0b769ef20a85a0f1001b293080b82d40289ecf02db062ff680a5c8343cbec1eb101a26d63c950408c8aa

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk.RYK

Filesize
1KB

MD5
8edb22ec169692433dac769cfa51cbac

SHA1
ff90f6a3c461500c0171810e3a83e5cb921d1e80

SHA256
a1d376fe1390d9631e87b0fec5e45996ca3684468df9a33af71fbaaa7ff3af9e

SHA512
82ae3bf988d3c1cb4ddeb1012726a93378583b651afa67c76d9df7db2f21ead4c98517fd5f586a939a5ac0f3c0f1c0290c7e6cbd5845cdb35a7c43fe09dd7b8e

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip Help.lnk.RYK

Filesize
1KB

MD5
e6e8968b4281670966db06f5ad5f3b2e

SHA1
4ad6f9a18f9de890d94632718286bdd7afa516a3

SHA256
17b09297809da15ebbc74ce81af10eb9ed52a6826d4bb7037db55d92b6d07436

SHA512
3ab5b7f3ebc1d1da939c5c5eee0cc695e04fedf20d29bd54932743b2ec46e7c0a343acac77b7b8a5467e6ccbf982032416b7ca18c3759a3b405d9d28f76a76e0

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Speech Recognition.lnk.RYK

Filesize
1KB

MD5
51b75fa258d5d9a88cc1c01dd1bdd421

SHA1
b9fed77ff31817e1c32588696fd8664ac824c828

SHA256
332ebd0824db4d28d5285094d79cb661c1158a76d7bf52cea5d6ccb72cd959b6

SHA512
713f5089c598324a15c6112586b01072d01d66c66e53c3ce347aef1dd4d155cfda9acd7b211cc9c1ccc149016ac3a81d4e6e62335d50cf697863564e7af0a00b

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk.RYK

Filesize
1KB

MD5
63673a46782970868c6621f9fdbd8c12

SHA1
672def6fbedb7475ce5a6dd3f4201c8742cbbb23

SHA256
e1b2e23f251afd0859c36e3531c261df5c6873ea1a95e210568cc16ce3ef98d9

SHA512
d52487cf961ebb6d0a5564e020e98c1a7a1c53aaf2e679afd66bd66dfb8768567e4beeee3ebdbcb526bdf1e0e9c18cc5594f1a25f3224ea13757d0faba5d3d0c

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini.RYK

Filesize
2KB

MD5
f718c1a33d1be4ea3671f7f411247c92

SHA1
6e7c34ffbbce907e9b414978d026f3bd55e8ec6b

SHA256
3548f869bb34ad6c24f572497b711614a67973f95b387160502f951cd8c1ed1f

SHA512
029bd244847fbc46295f7e8d39b0db58116b782fba22a2578d706f0dd9e8c5e105715de06995692ae6467d5e6b2afc411fd3487fdbec6a18cad82855ca403ccd

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Mobility Center.lnk.RYK

Filesize
1KB

MD5
34f0ccccf8b5af473f7253806a4cc212

SHA1
9080391b1dc3de4bfd30ce1644c3b3753b4306f6

SHA256
fe61a7ef3f4acd942c1d274b63887c9eb94ff5ebf24e353bff4ef0bc1fac10e0

SHA512
5d04f14c67f14d7091c787435f2f415ab02c1d5e8b71e7b3391bf389e66d58e9c5b6f14e8d903242ef2bc84e5562a1207d2b429527b46299c86472dcc01c6e70

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\NetworkProjection.lnk.RYK

Filesize
1KB

MD5
e51d8ab7ce9ca67b1ed0068766850c76

SHA1
8960625abe46b35edcec352f4fa34e29a5af7842

SHA256
49ac4324a4e41b276ef8ed2666d39114f4593bc1b22c68ddf2bfbf4b49b5069b

SHA512
d158a466059aac8c9dc1cce30ed6af0f6fd1c47aa36abdbf1304b44a1614050d54a0d3cc3819a63119c770962c2533a61d3f2394dec0ac8320ec5d0c42b9539a

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk.RYK

Filesize
1KB

MD5
1fdf5ca3c3a5fbfe5c0c9ff90935d5d7

SHA1
a7930b91f5e00008a8fc359ea5d53a1ff726a2e6

SHA256
1e07e3646e89ec47bb06d958e97fe01f1cae6aadf707837c6b2f8a1604f06717

SHA512
a207d971e72835377142e129aa734babec333c920f3def406f95c7e1f02b29d3d21fb79f774c7d72f8af74110fa118ef33477a3a0c1e6a28bd294b195b3713dd

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk.RYK

Filesize
1KB

MD5
70bdcea6ede392912a001427f7421a71

SHA1
146e9422fe96727fd8fa0d6d357a34e73b901b8c

SHA256
d07a0eb9590434fc9a1574c444cdcc0b85faa2569fa59700bae4e15f8a406724

SHA512
5345215235d75cea516851677500fa6a112ad7c321f1b7abc75fe92ae6fbf5c44f4cb135f31952700f20f303fdc36872de835e0943d3bde717edb212d16ac66f

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sound Recorder.lnk.RYK

Filesize
1KB

MD5
98d1a2ece32e0f6e582de32ac9e327de

SHA1
f79ce248c483fc8864e28ae27f328f190c9977e9

SHA256
088a3b0dcc0a2c4cbf2d3613bbd73dd3ecc1ea4f532ca82a2a2334097834ad49

SHA512
d73efa3f80a9d6dcb2e8ec62d240e7ec25048c363535b4f95788bfc52750e3560bf077dcb95f4cd82aa45d46f58d164a1b5567177b7f007e72c7a0aee06cf311

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk.RYK

Filesize
1KB

MD5
59f165a099c80c38e824191a2af5acf3

SHA1
2b31b9c2b368d0fa32ea03eb0d39c46cc44743f0

SHA256
99c6425c41838b55a4e69a63c7ab4b7d1014e22b9680660bcccd5c17b3201086

SHA512
18cc20dbd71dbb73c165b235027e76eecac018aadf092792ee56d640aa31a1a09e11e414d51b597ab89173598f63015bcb3f3cb686242ef11a81ccdedbac6167

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\System Information.lnk.RYK

Filesize
1KB

MD5
0bf3d084893b731ded6f0baa3186c847

SHA1
1729593a1b2268b9349a5c82a34e178a4e4bada8

SHA256
6fe3b4279ca29d6ce3899cd7639d7552103ccc6c5b217124da3e14c8068dff6b

SHA512
965e672daef3cccfe35ff3e593673cd9cbe3f1ad4fc4981bcc86f126559ff477997a10f42702457fc97476a915754bb6669e312343acfac4dcf5f308757b097d

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer.lnk.RYK

Filesize
1KB

MD5
0386ece211eb6d9dfe58f2720f48ab49

SHA1
13473b29de6a9faa1de9b379866981fec3368d36

SHA256
1171626d50dd46d1b021728da90b20ac4ac4572a688f15d2a6139183c6224185

SHA512
654883168fc5fca83358b2e8cb33de0933717635ab20ddda5be95dc94f390f40ec26577b75a918fa7647cde8f0ea126cf9298bb306a7d36ca2dee2f00cca1a2f

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini.RYK

Filesize
626B

MD5
793d93625d9feea5d46b2133492a10d0

SHA1
9a01f10360d7b1cc5f1567f4a56c8acb42690213

SHA256
15ef2cc2d7bec6ff2ef9e3b018d8cd4b86065423d06e52d89fa04b80f30e4276

SHA512
267e1655e7b11430734a5f0b6296162fe750e8f3a317c3494df9a46a10c477c2e8b6c0050082cbb22ea9a784995a8772a442827113c65beef08976153ac6fc95

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\TabTip.lnk.RYK

Filesize
1KB

MD5
33351325dc958c7428be7ccf61f534ef

SHA1
62ec05db483eb97603e69380e1caf5a3a0bc5827

SHA256
92255cdddf5be14299c47c9bc55b9becb980ed141749c9e80b705263366419b3

SHA512
fac18d180d0dac744603ac0b85d5c0614231857977667e4d156e46bb9512f564312dc10c35639e5be37dd4e9182e9decae86fe370204d7da4fdde8038dbc4ff1

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk.RYK

Filesize
1KB

MD5
0394f1f95c60d60a86c402ace067c99d

SHA1
c044efe0634d3b6b9bf1735e691dd555dad43449

SHA256
d64cb76485032f49d21908ad34137a58c88d6c215e7831b2e40e3d338bcfc75a

SHA512
386a0855ec6e6c9cc4a204043728defd66a8e5c696db036795922eda62a21a117f39bd7aeadabbe885595378b5805f6a810e8b1a7db18d20ec2421a5f405ac3c

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Wordpad.lnk.RYK

Filesize
1KB

MD5
3b8e98a4d5e72a0322bfbbaae87ae743

SHA1
40741dbaae5b35f9939ff311182cbc2a0425205c

SHA256
f2ec21abd2e584066dd1e29ee3ce521b16474270633a227588ba2933da4437fb

SHA512
c9ee6abf0f3bcb0737d9cf3567620b77ebcf87bbf11fd75435a4b5a8628eb79baab874238b52e80822a35a84dd20c57cdc44fd98c82cda26c0b1bb4eef7bd600

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk.RYK

Filesize
1KB

MD5
a7900af44f547b69d6424e9f4391834c

SHA1
366eb226b8675682f863078709908c26584dd36a

SHA256
90a633c09e35e46a0a15650f88e01af878f30146179fbc1a05a777bec0e94329

SHA512
b9cda4a356287a6e78f85f671c0adea6e7689660ffbc88f07e0c7b48e2e55dd80f35ffb6a66d52d005bfa0580487cda1db2817a93253b800d22abcfda0a89705

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk.RYK

Filesize
1KB

MD5
6a837e4a6af50ff9906fcda08d4577ec

SHA1
cc1aa042ec2c861f2d00002eb9db2d9c125d5ee8

SHA256
e35140ae0bb101a7413be54df11d515f5107e0ccc2c037ba0e270a92bcf541ac

SHA512
910b873d29a96a0da1fd724641c0891beaaed561199b5895c6bb37f284744ce3d57929d8d9ec15bd82cf2b78f9d3a1f46f73d83b730608e1b31d1084d02a1d20

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini.RYK

Filesize
2KB

MD5
e7546e1458cfe1963f29072f85eaa7a2

SHA1
605227f6226f32e11433d407a1e3bb00b3845edb

SHA256
056a2db63013bc55e9388889f2d9bfe1e3da1e056a499cb461cab69d45371559

SHA512
52d4ef617b9b4076ff701632d4df54b10c6dd7c7f466177dcc9f6e64e7771602ebdd12e37cc4f403c2685df23bc464d8d55e0b73c5c68400127ec410cba97450

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk.RYK

Filesize
1KB

MD5
c4664927bc74879bb2e4a9589ff57369

SHA1
a88c6af2c7ef5f0caed0be2a0ee6c28b04a08ee6

SHA256
11bc79261b0940ee6342b18ec7979cae821e3d6f43dc192476b1bfab6f32862a

SHA512
15a4a71631dd3ccf5290bb2c3e2d783df8caf50f62c061f1a7d244e979cb0347fb9fc4989cc61b63e88c83e110d62adbe9abc5f133d6d69be1a586ecfc7e0769

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk.RYK

Filesize
2KB

MD5
adadd858c15e8ec67e3d4f73d1677699

SHA1
62592dcd3c21dea75dc030f7c9929a38fb5196ac

SHA256
4ca91bfe7b18a6583ee2ab04d66c7b6e011f3b3f6b00a31c0d55599fe4cdddec

SHA512
370a9a8609e72d502623ecd789c854b9b12554a175ed9f3978a17b0686e89fa8fa58f8871ce56b8d7a59020040081bcb63752106cbaeee18f15361d301d3a92e

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk.RYK

Filesize
1KB

MD5
f5f71acb445a85dc626213a5eb121eea

SHA1
c62dfe39310d1f18ce01ed04875bf2bd657362a6

SHA256
9f5841f71bd4763d9967315605c5ba86bc587c80439951bd1923ea3a4609c00f

SHA512
4f08f9e1f0f4e552637a791ff627f94445882506628a3a28a4e1923e0a6083c3e6288f72f8fdccb4c3504bec5e1b70afc640ee0c0ec764ea16fd765b8b7f5c6c

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Chess.lnk.RYK

Filesize
642B

MD5
a6b75fe9fba6e9a61cc8813d5b7d3036

SHA1
ce7b634cc6b4c38b67d8bcbcef7397acef9454a0

SHA256
0efaa17f7e9f6d60fbabceb2ba3f230f3949e1665eb0de1fa8756b88f34681c5

SHA512
1f8de9738277d7c78399c691ac70a71ea48b8fc1fbda719d5588b7dbde6075525ae276ab08a780355853e724624c5278bd06280d7b24595e669d150182a43b03

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini.RYK

Filesize
1KB

MD5
5c8d67a2db9c92631ac1123b67fe52bf

SHA1
f5fd1659fb2256581f95416f497c7fade6a13054

SHA256
76c4a63ae2448192ccf600c1db44b05f7c6f2b276ca0cdd3f8bf824cb9646220

SHA512
1c9b5754e5a053d8eb4c1ec184fac50d85c53b9b6ace266a159029e34a3acfdb090201933b00bcf43bec81e1fa3fe940d982ca817b18294e5b10f2aee473fe1e

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\FreeCell.lnk.RYK

Filesize
642B

MD5
19abfe6f52b6e26026b5a52e622dac29

SHA1
ff3d80341646add31a7b35f9c79feeda8ddc3019

SHA256
e46ab94198e028de5605d096f8cd741bd9de66dd56e39c503fc03acb3581b397

SHA512
d1a10b2f9117bba7f679532bba032529fade01f77d7b261fa8f6311294ada5398ee2cc0a8a1ac3bf2bcd314d10e5d2b9c445c9b516ceb6cb7499efd8918c1d53

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\GameExplorer.lnk.RYK

Filesize
546B

MD5
a3d7d4e20a3888f1bbe8698bbf004e3d

SHA1
7568a64d3bade4a8d6a85ef44055ac38c5736eef

SHA256
2fba01cbf5da07a415e74b02fd50a856dda0eac0c0ca7f559ccb56b0f85a4412

SHA512
721b7cd20ecde150250819167b7a54b5514d82fa509e84d690e08e79dc3eddfb24f3ebf3bd86515a729ba141b4d70cadb5b77d36e895fdde6a3c225626933210

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Hearts.lnk.RYK

Filesize
642B

MD5
cecee4e1a72d986cfd8ac01510f2de22

SHA1
a3f0d8a409f369a726159b152bffe57cc1b7983b

SHA256
aa9176b59aad74b58889da3a4d778c51ede5f4b963c63e5e97473e00f0bc128b

SHA512
fe420bd4fc69177782586c4f6820742e6099428fbc581ad35720b4475a12e82ffb430cb48c6d9c4e198749bde267a1c224955ea7331dcd3ac324c37922bed1fd

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Internet Backgammon.lnk.RYK

Filesize
754B

MD5
95ef4232fcda37a902ccb7dc37f69069

SHA1
7279d0e92a9cc8ed1befafd7decf21a24e5592e1

SHA256
836fd72478185a6d7e402d5d539c2246f745a5eb8ca70c214d85984e8357deb9

SHA512
c187231607a1a470cdbc3adf9f378d2a2fb7748ae89393b6fb6e27bfec3cf3d8bd6265279c120b46ef11a5f08cc720d827d0eda797b90c0fa907f481639dd897

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Internet Checkers.lnk.RYK

Filesize
754B

MD5
268c6e2741250b3dde4576423d65d540

SHA1
7661aa43c7b62c0d99a830fa0010334ea42f8b65

SHA256
a51d653efdc6c37941516cb51e321ccf0507b018d068eaf79b6a949caa68a23b

SHA512
5f910dcf0893d829f7f71853ab7a469a48d4190bcb7c8ff1e36ea16b7ceaba04c28cdb9d00611e198357fec0e4b3ed56501bb602ec460401dde28bc53d237a02

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Internet Spades.lnk.RYK

Filesize
754B

MD5
ed8aba4b327864b0f9d16ce9af23baf5

SHA1
211f882551a1fec7232d4893bd01092e1462208d

SHA256
caa63572e454be34edcb21feb00a9ff057139bc980973331b3ddc90614a2caab

SHA512
00ffd81e095aa31f65dd815cabd5e23e40debc4fde9502a1c318b5c956425ee98c11702cbe7eb6bdd03ba5098d982cc9d8a21c74f73f7951002b2ce6e537e39f

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Mahjong.lnk.RYK

Filesize
642B

MD5
eb197b27d1db13381c96a6444ef18a06

SHA1
9df285b63f9d4b6124c1cc18a46a5dd16abdb5f5

SHA256
ffce3091574e69fd576dfda8cb236c87751715207f03a5f4bdec431f7091e462

SHA512
fd4c4a4001095b04bc87db31ec0d5685f416b5a590af1771a2a9505b6f2bc28117184c72aa65cf728d684847b4246070fc3302c349c1d0df98cb3b8a9086491d

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Minesweeper.lnk.RYK

Filesize
658B

MD5
a3a0e0fd99c06d6ad7de28c89c6fff6f

SHA1
f2f53a0535ea0e2160bd7ecf8c04ee7fba4f3906

SHA256
b1b66091b7a27f22fff915a9426c64828cfcae81bec915ededb83ca8e6d5723f

SHA512
d888a16d022375734faeb4182b885c2f1d9e2d86c8e6255db89d67329fcf69540e44671c4396c6e3dce7804daa0fdffd3c86d70d6242d89e4b718eda888a00c5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Purble Place.lnk.RYK

Filesize
658B

MD5
50f917e0f5c6dcdc633165d8bdef8696

SHA1
46e32e8684ed03d37572fff6735aea405f4aaee3

SHA256
c553f73687e776bc5e92492676c1ee15c8418afa828b038f3f3485d6bbf53547

SHA512
80cb33c0f78193e82f4d03fae9439ffd9d06defbc8a623d38dc21ad1d838ca138a16908dfba10a101e3739463e1585bfe7fc46f80e612ba5ce76c2f378adce93

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Solitaire.lnk.RYK

Filesize
658B

MD5
e4c7459390500628b490ebfc975da2be

SHA1
15ed447ab00ad3c16b098572b3208020d4850749

SHA256
df5888a511e67ac3f7b6ce78572db438fb0c994a06d1e55fff28f9867ebcd16d

SHA512
9a7fbb96d49ac4cea71bcaa43f80f026b45a5f2f074ad72c18379ede51776fa596300186f45e23f5538863891be22823edb0982e18dd8361ce0a0843f2afec86

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Spider Solitaire.lnk.RYK

Filesize
674B

MD5
7c1b355ab1b22ce3f37db2ed58b5555a

SHA1
79cfa43e777a2a0a957fccd686abed2a79135c9d

SHA256
e7b42f41c0f4e21d99b4751cf5103c20bb30408b713a3863d888e34ac759be23

SHA512
2fddc6803d5329f58967ca57fcb910f7eedb82807b2219e8a0a6b5c2d1e5c22c769f71d974a5a6f7beab6de168000c2df9b550e238f19840c5afa37cf70be7f1

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.lnk.RYK

Filesize
1KB

MD5
c3c7c3d6dd9bbbbfaca34b012e141a48

SHA1
597861c7c7c4a5199447fada0fc8924a68121a3b

SHA256
17fcff0868d23bb0dbc37486b260cd13ce2e8072c3c9341db12f87f7094091c4

SHA512
a4bda611e297c12f40f1a0145368e1c69f170f45b099118c7e8c6e55fcde797be4a012886a70c31a96ccc55078b32e02d82c7367ee6b16aa9a9ad72660acd477

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\About Java.lnk.RYK

Filesize
2KB

MD5
4a03bd318c042861e55250157d565bf4

SHA1
766a9ece4360be239efa8de3264f6e097c1f7b9c

SHA256
619b8d970944c4900688fe64ee121e571e00cf886ad9829a3a176f66668b8277

SHA512
ab7a588f05b42ae8b86c590c240a4cee9cf6c0df3fa8fe702bfbe4681c205760dcba70baf73a69a10609fbb6dd3da18ea8f012111d4dba31db08a3fec05fbae3

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Check For Updates.lnk.RYK

Filesize
2KB

MD5
2050cb161ded6441f2c02fe7a14648a7

SHA1
914be0e0926f99c02dc1fadb8deddb66f32cb6ad

SHA256
709553e6d59a5c4d6224aaa063ee671ec7d2a9b315e36657874479b045690783

SHA512
44602c729ddb40a50614dd89e2fd6bd14516dd2131e2c336ad63d2588a70ae373e74dc613b22ab5966be4259c5df7b3317d87db5a9686a24239a3a738c7a8c1d

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Configure Java.lnk.RYK

Filesize
2KB

MD5
be478545fde576028f44d6130a4ff481

SHA1
b1b177eaaf654f2c9c793146b681b90531e15c64

SHA256
2c8846d006e4f0f0e2eadf64a7d33bd5cbf1f9ad6fed67c0b9b25d9448b9dc0a

SHA512
3c265adc7246b283a6cd5c29ac64acb54c762b2e4d645a61b0aad9e8f42174098fe3e63dd4c3e115129307c23a02727c75cae693f4b869adbf2d67f9458095c7

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.lnk.RYK

Filesize
1KB

MD5
8990af4e92a6f6933ca79637eed5642d

SHA1
06464bf08b1733d0e9ced2c228882c9fdd0cf7bd

SHA256
3b84fd72150c730b61713739281972a28142b3b9929b9b8badac36d4161d8244

SHA512
61dabfb0fe3f55ca2d62dcce2bfd72e66b1df0d88257a4da21e2006eb7b134e562d768c343565617c6341f3011f3c6e685e7576828ea5b004bc5581dec2794cd

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.lnk.RYK

Filesize
1KB

MD5
7b191922a2a70a0bb401a119df6f86e7

SHA1
cc35e3a2414b53f0a447906ec402cb32385129b7

SHA256
1ae3142f83f5a5860d004fd52a4a6ebab9bc1c604164f94398abe5d42fd83fd1

SHA512
ee63af252f28affcd36f837023a0b539cdec83c995eec93f86a54841eda166e67892700e1de0b7fde6ce36de24cbcf0a22c44625bc0b9bb028f614499a4a3c87

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.RYK

Filesize
882B

MD5
eb6b357f0ff53a9fc6a97947156d1204

SHA1
a77b9b12c795b8a5bb6ba05668a07f366e850b1d

SHA256
473f89f5b14f68217d36d294f59d78b363c8646c13297006e0ccafaef8d0833f

SHA512
ffc972eb2eca9283aa3e6f15dcfc13a80270d147f98fe2cc910fd2f7763a444e6b0a13051d0af6395b9626fb87437152afb5828c7ac5a4af37e757f9dfd3235b

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Remote Assistance.lnk.RYK

Filesize
1KB

MD5
ff8c4a671a34f4ef2d7b8733d3950a21

SHA1
35951fb965aef38c6427de9fd917ea251a848bbf

SHA256
975025600aa510239dd164989032ef435c69583a7a1df74bd0004671a70add77

SHA512
04ab8879aa022a1a26bf23a7090896bee19b979b7f55813d857eb6f0b4631de9ac91405da1579f191e879877b5c76523184a71b8ea17887a50a14605fc50e6cf

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk.RYK

Filesize
1KB

MD5
f2870b857b9925da2a3e118136f49f23

SHA1
fc8c7aedb051318cf623b1e74c46992a64659e7a

SHA256
657acee691ef7fb7afce43ebe3bb4e49627c2666cfd4ddac4f09425b0fd82605

SHA512
b1d5e37069264cf675d184ad6370c066ffbce6f9611b8d5a3e336334bc086c4ad41ff6c922fbfd66fe260dc2450ab23fa235745f45afea0585914138bd64a62d

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint\Microsoft SharePoint Workspace 2010.lnk.RYK

Filesize
3KB

MD5
a932e943197f26eeed41398d34d7fdc4

SHA1
7c048da67483cf0f67a4a2b3f25bd38053402f41

SHA256
af4a9285634e8fc2492cb7c01113bef6e08b0373e1a5638ef6670f85ab73917d

SHA512
c7929b1322f278e7f52de7decd62718455584e16cd5f137eb9922a5a2d3728a86268b62e9cdc6603d9d8cb205b72ac7e92889f72878fdda8b4d70442e49c57ae

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk.RYK

Filesize
1KB

MD5
04389fe8fa4d2f0e75c02b5ee515e42e

SHA1
1fc707f0d3c29a62d2731298f2454cdde5a7fe18

SHA256
dcbd36e5a3e10b311b3e2211ec61183e1b7f5eed01f2ab821ff360b576f64026

SHA512
774992231c3d3789ae64553777af83688c929dfe5bb73fd9409032d0a65c2149f6be3b997cd03290ead11a1c75a186f540b06570ed92efc2bfa02c7041469f80

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.RYK

Filesize
450B

MD5
8a8685285f7ee53d023729b027459a55

SHA1
94fe1d07255383f2e37f99ad0bcc237e93234711

SHA256
05662d22db963523d007e25ace205355f5eb05734b785954f8d439a89e8d08d6

SHA512
444ddac84737419c005c8486fc3144694fcc691dc43fa586eeb29723fe01a5c20ee3cdfda6875aaaa930d8ccb92f740c4d415a41286bc7d1b709bbb08023ccff

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Documentation.lnk.RYK

Filesize
1KB

MD5
695cb17f5d3471a751770a8982c5f75e

SHA1
d3bec7684a6ddfaeb9445b6df563b65d8e3d785e

SHA256
ca2c89210b15927eeca8b5a214a550efb9a84529215f9787a8084f37eb9a56ed

SHA512
6e59ece341b2156cf8167e43b71f72eae53ebb95068c43baacf29b3c1ca9fd95f3cdca220352bb4e049a50ad05eaccd280eb40657c02f1e8421ef3952a75ed61

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Release Notes.lnk.RYK

Filesize
1KB

MD5
84f11056a47574fd5c7ed3605e7f42b3

SHA1
6ed1c0bf9123212faca07f8ece862628b880373f

SHA256
45fa4e0e16806b2f5b64716eff66aae9523b8eea1a4cf4dfdeac22e521d842d3

SHA512
34bef26f705808a788f4ee3e58b1448925d6b6bca5e7aa64576322435bcca1f2c71f2982b84cd05e738756f03c223fe3b9b24079466f070c761d6afdf853621b

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player.lnk.RYK

Filesize
1KB

MD5
be07e48a90f5f959aa1d57fe06bcae72

SHA1
072b749186778653eb8eaeddfba12d7b22c3505f

SHA256
99d1f95ab6b7ebf553841a76445208857b1ead811df3f31a2aaecfba3a1dcb5f

SHA512
b9ae3609bc125d67ac0bf21015d89ea639c1033adc7916c9ecd2ff227c9b9605632d672c9738c7b0981ab0067d5de51da835d21aa2166956575ec2d11ffeac18

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VideoLAN Website.lnk.RYK

Filesize
1KB

MD5
e59102836c12226d3d37df782a7c34e1

SHA1
b20dfa046306ca70242e1d85d790c6da67c5aef4

SHA256
191e7888d7143e9084fb6afba8c07d6c50fce1b4146dd50a04ea138988e84681

SHA512
0c3631bd3687764587f988e0ed459544f056623aae57c90c4b61b1d6f1fe98aae9698caf42775bf6c5601e45b5bd6c77e1f363a16dc0a6798e79605ecb4d80d1

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk.RYK

Filesize
1KB

MD5
885b851ace0efa72c144e3b22d60b8a4

SHA1
60df15c57cb3de51e6aa5f8be890e349584f9fb5

SHA256
18ce0fa21866e638881a04f987340c0700faaab228ea5c76fd74f2ae9c0e953c

SHA512
e5f7357c82775f35f17cd56bbbe35601449d47fb2ba54c19990d2c72164928c5b08bc4393884aaa4b5b5aa5a55456d4532c387c06515adb590562e9107fee91b

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk.RYK

Filesize
1KB

MD5
368c576eb8cc8fe295fd48a4cb3d8c73

SHA1
a4aa021776b398765ce797d75f96129780dc59b7

SHA256
5a9cc76fad88562da20d2f60cad25b74948f7d837357e669b22fb42cc98dafa9

SHA512
f75941473dacf3141fa6b308d374e2d869ea568dd7c2eb8b869064c3184afe2ad18e5a1dde50fc78cb4f6ed62f276955a6ed5cd7c962bf8c5cb34cf18fdec00f

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk.RYK

Filesize
1KB

MD5
56a2ad4971dd14b8d8b4f5c66ff4c4a6

SHA1
f6116e1f1ee35a3c561dec4d847dc6eb3f71fb20

SHA256
4805479c06f1c925fcf0ad877a8307f3feb8bbbc15f676dee98f15aeeae45f62

SHA512
238ccfe8dff6b7aec20e1eccbc651ac94c90871ec4c29afb4d5a97c4587c9ca060d2d080b3aeba8ef9c5a11d950d21cf565e4c1833d3a4c904871395687f5220

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk.RYK

Filesize
1KB

MD5
f54cfecccf83f07af705163ca8020560

SHA1
a4e53055d5a6885a8d68662fcc98b9d493813864

SHA256
9c18419ba89b6b07c15fb57e0e3249bd2fe918ebd03ca61d3e2a015f5eae65e1

SHA512
542f6fb31e765e0c7d6c9713014c34c49621186c3a1c0f4b3fe6c81ea8f9375ff69c1c8d0614706d93660a5e4a1a478131d460930946229d28604c2d3e72299c

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini.RYK

Filesize
1KB

MD5
8e2657df0da46fa7694831d3b50de07a

SHA1
b91a14d2d2a8f2b779b8d557d75d5c4de01e8928

SHA256
71c0751ad3f684cd94ce491e914703c273cda182995771a729bd7697b67bc8cc

SHA512
36f568f98f1ce2fceb30cf83e5e4fe659d80213b056e6e08353b6c43051f0ef987ec0d8a44635f2468333a78b6a2c94ea053276c5d5a4ce93febec42e9643ef3

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk.RYK

Filesize
1KB

MD5
558e5c62f1e7de1584fd8da2333cb1ba

SHA1
1eeadc23042b26c8d4c80dfa5a4a5ea4bee9a30c

SHA256
e4bbb9e2ae88738d0835bb2b5fcf689fb6fc366ff21324e8132f0c8443702677

SHA512
a6d2e792199602cd2a4fe83b53d05ee633dd2aceabc69e1e4ffee010d76af1d914d30ff8271550221f8f988a182625f833d90bccdd60ae059c9f46fddd601162

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini.RYK

Filesize
722B

MD5
29bba450c4d850c5f22ad3f2fbdcda02

SHA1
a432b290dc6296f9a3862936d8776ad49891027b

SHA256
7b9ec3ab5b2eb659c3d3bab8515fe98e2cd4033f96fd344daf23f70be47f7d80

SHA512
6a7729a7ac8c0bd5ef0c9c76067f5b81a18f86a0d60dfb1518ae0e37969f1b030fee90c7039d95fe5d9047db5ed81383cdbe0515a4890032799502170ac012f3

Download Submit
C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.RYK

Filesize
140KB

MD5
4e94523d23bcf3a7967a343d63b2d88a

SHA1
ab89d720cf81e1b0da47c75d3e33d21eee5db32f

SHA256
649ff44dff5272c4ed0dab18af5b9fd53b9abc3180ab315f061e5355d4ffa0bb

SHA512
edca1367b9dce46889565de9ed132a25490ce85659cb2b2bc9edb7d8c168f23ac82216fa7a5507bb7afbe97e576906d878f56c08897c9f19beef75fce7b3d19f

Download Submit
C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.RYK

Filesize
148KB

MD5
98c6f3f0954a122071f6a9c2de115838

SHA1
36e45ca926ef61ea5ef95170b90cdf5d897cf240

SHA256
33d3008f5aeb37934bcd7c9799381761e9e086c38ab8eeae68c5776a56d8d275

SHA512
d9ea5756f5c67f162f07f7e26643b0a4fbebab4718c20795aa4d2f86f4a46423db66f9b2c11fd4a99e00de8980f95211156e654af59f5e3d9927e4d372e5510c

Download Submit
C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi.RYK

Filesize
140KB

MD5
e09b131e566a43130c2ad61d6320b48a

SHA1
2bed8030fffe79e63f81f069583773b862acc741

SHA256
254c660b5515be94f4110a13b3e5f921955c8f6962cba65fea817c51a94e45ee

SHA512
075f5e87a3ef7e7090d658556f994da98abb780d828c506f7608b7bca74bd3c7154a3159852582f630b9d983bd1b628f17796255ae56f8387788533631798257

Download Submit
C:\RyukReadMe.txt

Filesize
1KB

MD5
5f9edfac1d31bc35195f54dc1d152767

SHA1
11ac38b76b3dda99ef283c38b5304be1f215f1e1

SHA256
b3e7ddb90e9cf0a6265392b37ce73c649958f479505fd3eb5285c858a4d0ddba

SHA512
da384973a2ea9fe7cb9ec5ef377cd42b1e0d072bf221789658ec843711580aa5fc7912e637926d17f91517ebfaf8089924a7091e11e882e9ac9cd071d10a04d1

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst.RYK

Filesize
8KB

MD5
2fc5ef6fed821b699dd301e8ec0a84c5

SHA1
1dce3a20c4644f44555942823e542c1456241e9b

SHA256
46f431f144e3311c4ddcc54473ec9e92df6f579b3a12dbc16b02c7c16eaaf83c

SHA512
1cf9e60b568bab98b6ca736e312ce1470a775b31e797dc8ee4b1f3f338e3c11ea03fee1540cb71790097c289373c10fd66749d155090f29e00c00bb82e6bc273

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK

Filesize
64KB

MD5
66383e97a0971dbb137c8cd3bd3da753

SHA1
7c977f4899846a8313e40bc31da12d5e822ffa73

SHA256
aab4e5e1e618125edc9363381dc7242234677fb77622e75cc38e3aff9d067255

SHA512
3d5b37572d6d8e322d60bae21a2ff356d2c86f79e2959ab68d201cae1eb7cb80e1ca07fe36252ecb78f23a2bf3f522f6b8ff52dc22b9b51f6b6cfa2026a881ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YK6DYF6H\desktop.ini.RYK

Filesize
354B

MD5
8520e617c92f476566b7fb4c54acd0c0

SHA1
139c4d6b3201b6caaaa75e3c412f8d332252e8a3

SHA256
12a81870da98275d55a66f43157a83f0b2a3098b690adae8a7f4c1165f4cd51a

SHA512
1bf28c8b6388d357880c2a9a2ecf09a3d2126b064498b423e5367444ce7f4be1715f804f6c4b08a62a35993601337182f2caaef902b459c2b8cd4795812b0938

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~\Popular Government Questions from USA~dgov~.feed-ms.RYK

Filesize
28KB

MD5
2bb4fea2eea17e0c32c2ff5ce816cb63

SHA1
03a5b6f3c1cfd7f78b772332578c3760dcd6e33a

SHA256
64721819ccdd5da310a92130a1dc2cdd00f346bf24261e7bf600133b6a86e857

SHA512
d2d44d2b3375b5775d204f63ac35ad8ab0cf2a6c0c5f420d1a4221fda0d6ec3cddf586b0deb00510871c3e872bcbabe399b47de37202e6216a43c01fb8e4123f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms.RYK

Filesize
32KB

MD5
fa1bb48c17285edfd8ff1f11e16f0dca

SHA1
17dc380edfebb43dc2cc18d4723e3ddc10d6b26b

SHA256
736a4fe69c7c1cc145347ad4bdd09f718587b8248c47f8bca79cf1cffac7c8ee

SHA512
9fb96b850a56e231b32ab237894d125b2e672143605f5bdc9170c1eba7cbc5d01a54be74b00f4ceafcc47fe3bd9e986c956b772d5a6d9c4765569a288f6fcc1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{716752F1-0D59-11EF-B04F-52AF0AAB4D51}.dat.RYK

Filesize
5KB

MD5
36ee35f3e89f3196cb8e076a8b3556e3

SHA1
fcb00d35396315247add9306dd691ca4f4018290

SHA256
347f627cda614f7b2fc1b547363eddb1e99394e3105acae34023fcca6cd695b5

SHA512
8eacccad6d62b6306d157802761fb37148ff76fed8b908af6f305d93418ae5baebf56570d6f1354bd57e092a5b04494620d8952b6d094de2e1d6b13f609768dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{716752F4-0D59-11EF-B04F-52AF0AAB4D51}.dat.RYK

Filesize
3KB

MD5
1a5dfecd6b9f7bfd85799de6948b62c7

SHA1
afadbdd3b9dcf4c4df6d70263e7143a062e644b4

SHA256
b12fe79395a341613b261e81758cd3bfdf5b698b77cdb591c7ea60baff011803

SHA512
195659dc6d6344fc69e88c3234188757f4c3b43168d136b46786dcd379b0875c9c8b80cf8cfdc8741659fbf12838f5c0f722e78456716b3303a2f71f42f15782

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{184F4210-0D57-11EF-9189-5ABA25856535}.dat.RYK

Filesize
4KB

MD5
d3f43c2aca48fbb75829bd151863504b

SHA1
ed30e91fdf64827e49c8dbf42e5be58e934a11e2

SHA256
116aba37b6c61601d8e592df3367c613371a9f12f2d7cdc178c942782021864b

SHA512
87a0741a75991e4c45467d8cc413b607e5f34750a1a47b16e6f1620b748827c7e8221d779bbf47182f19a0a050429c29f4543fc153c5c9dd306869c9bbd9031b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00005B0A\01_Music_auto_rated_at_5_stars.wpl.RYK

Filesize
1KB

MD5
f4f65a1e030011ddcb4643d3f27eef60

SHA1
119dbf0b1b4dbffaa523d5169b528b4a7ed2e08e

SHA256
967db236609423d93028281a9b0feb4678429de1a4c4c832c0d7227cd0b6f5e7

SHA512
53559561d25aa6b03a4587084c21c1e647c3a7336bf4a776e0e5c03f8ed09696dda64028e1b632d0f6ca8370f80c4db9e4d9ebbf2227e7882039dadc8b686d41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00005B0A\03_Music_rated_at_4_or_5_stars.wpl.RYK

Filesize
1KB

MD5
404a475152632a8f75df956063b5e522

SHA1
50bf8dd189873ad5d9599ff386402bea412a2add

SHA256
db8aeb706374acb7da182cd94fafef0d942f6fe21d79a67958086013e9c50d3c

SHA512
4982f26aaad60b0758cd5a67367a598b4c23e7c33ac350c3612502992cac67360d4fd5358ab4ad60258785deb48caaac077464e30c525009ee97dce8e9b03814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00005B0A\05_Pictures_taken_in_the_last_month.wpl.RYK

Filesize
1KB

MD5
e4c3797cb8016529585bca32824b9e47

SHA1
ed3e5f6cc52e9230f00fa385156761aa91bdcfe7

SHA256
f8e158368a44be913b2f2faf0c4afbc5ab6e7922a670fe1c0010d1d26031eb3f

SHA512
2d2820fce4002625814c5077845d570f7dc51bc6c27d014a4a2cc64f503cb729813e9f3006139ee1389bb2e9b702e5ea9d9ecafdc93ce303c40ec88f2411fee5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00005B0A\07_TV_recorded_in_the_last_week.wpl.RYK

Filesize
1KB

MD5
0d4b39c27788b9794ea9eb6a337f42b2

SHA1
5604efd0d255e3b28284bf3c9177914fdeaec7cc

SHA256
9dcdeb5eba72cecfbad5e342e480920559b493c254752711585e94c1ea76793c

SHA512
356a6731d97a547e9a6b2407cbf235b6febe4206b683373079568fb99f493a4ba4ad0b300af6b3f6285140c6b27216d73e4fa72910857db685d570f71c5cdbe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00005B0A\09_Music_played_the_most.wpl.RYK

Filesize
1KB

MD5
0a861efc0884c2df8e93adf658881cf3

SHA1
7da35d282b4afc1750d41c5f7833064ce327c1f9

SHA256
7f75a477096d99867feed8fd73781f929cf35cb27b5e9aee5181a69d906f15aa

SHA512
157b2eec52b2261e3b1237d4e0c846fee658a87fdf237d7335d080d87fd33ed71273493299ffce3ec3a5b9e3b24ca02e8de95f8926ae7dbc8aeebea82f41629f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg.RYK

Filesize
1KB

MD5
7665e6b9ce9752861a1130d30c117091

SHA1
2553771fa335026ef3e0a90102a0916bb65c71c3

SHA256
f235d2e742fb6fdd8894619765c7e6b11162fa8b69f570173b04e892edb50b09

SHA512
9da2c73c2835c55d526bfe99b5733a0c0ca0f68c5162972da02eca59909f4382d1137c8eb7045c01b57a9ea69809336bf7b6a2c94df35c774f0a915d721fbd1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini.RYK

Filesize
930B

MD5
50f65fad49bc7fb035ade7e65e4579a9

SHA1
31f133d8c23e005651a92ab9e0cbba836f40666d

SHA256
96993283a68cb50cec95df7ad2e955d45ca01a3f91be37e4f376bd597143a36a

SHA512
a16395bfb39530a1f271adf56775a59e537c42a1f5e95965f2982d2797066d9e4dab39deb048ddfaac03b1ab1596af3e081f18e63ff9e61e2ae7e25df00ad2a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.htm.RYK

Filesize
514B

MD5
e77dbd23b641390897526e674ce7e8f4

SHA1
3a5299359258c20d591b8b6a77834f7cd60e482c

SHA256
f73df8c324cac5c768c74402b7d734f31c8cbd95e6f503f10aa66f3ea7551ffd

SHA512
ec788e180cabf84434ffdc4703448187bb39b36a54d8b9129d08a423307a22bc6fb63d3d0ea0e2fe2c6b83c693ea5c6d4a2ccef406be1154f2dc15add7641fad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.RYK

Filesize
6KB

MD5
739e7efb4425a6813d4c28a77bb7c673

SHA1
6d0e416313ac45d5e870416ce022073e02d605fc

SHA256
5ade3f0fa292c0949a1165da2e84b11b62e06e9de76b3bf879c9c5738662f489

SHA512
5e64dced4065aa981e4200843cb52e78428027925d3e46e428ce518088a582104ff38dc90a1bdbf2433e98ddc63112d6cb3421b6df85fc030b732eeec441eb03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.RYK

Filesize
4KB

MD5
1b8a0223cfd6586c1089c9a67f7ffb9b

SHA1
0322829c6f115257c0f845bffe87b3b5fd96941e

SHA256
a9bac8b67715858943d6cd4d7a9640090ffface3102de84d0e8d110e1402ff6f

SHA512
9dd208ea0e9105d6d9a4a44e9085ba7c1478c6b327c9055d64d1d464223412de3e27ff2ea6ce72b197109bbf24a1f7a3d5a9a5cd6d102bfa37479cd83288c240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Small_News.jpg.RYK

Filesize
2KB

MD5
fedfa2c1907374bc4395b1a57b6ae86f

SHA1
f5dcfc362e2e68ad38474a99265ab17eb7a960f9

SHA256
711da0d89d14f8d28d7fe7039ab44688e3afbb2c8d415d23505db959a1e40a5b

SHA512
469488ca03ce15e3341d550f46032d0cd54efaab9eec1cdc21c38dcc89e9ef7c80d7397534d4ce4a4bd92cda81585b0e908e3d88f0965ffa21fb97fc254e56ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.RYK

Filesize
3KB

MD5
2661cab528eb9069ec85db31e3b74c71

SHA1
df5e654953619a9f2cab0d1a34ee1366dba95b22

SHA256
e30a77504467b6415376c6cca441d18f7d9a2ab5c004ecc3836d12fec9be464b

SHA512
1c9377d8783f34bfae935e8e3fd3025ffd8cc1793a3228b4329f963b894b37f1833123f8f94ee156b949a697575929f4f544fa5741bbf210d6d5166a168100d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\account{03713317-859E-4940-B4F1-E5A89934E866}.oeaccount.RYK

Filesize
1KB

MD5
558780e818bde955af120b9cb26134d0

SHA1
c087f00d7b9a35da2cb78be4b7ab884838c4ff2c

SHA256
a8673ecb3b9f2a92eb29a9006019224d36d24971506b708a8a2cc95b6cc0bc86

SHA512
cdd831d9e371e1d76173252326307630d9f39bffe7fee7d57a7cd5eb5d000b7e3b5edfc3b3d98d97e4849be864fa27b211d6618c652da74f9da32ef744b507e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\account{97F4E5C0-55CF-4C3F-A8F6-F488467B9F32}.oeaccount.RYK

Filesize
962B

MD5
56f1e74039e84c8b50dcbeb7714b2e64

SHA1
738cfa3ce87142d008c56834652b5272d0c40083

SHA256
4b6cb6bfeb4a6893bac1c856d36d1e1e80f7b96ba94c54414944a7ef34bec9f4

SHA512
df4843c4d2af20c241e71bc3b603a5f58df4753cbc42144048f63c77f411850bf2670cdfe16f47ff9d897505a4f198c480a2c9ec0a25ea4e63277e1e15e60e4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8SD872Q\favicon[1].ico

Filesize
4KB

MD5
4fffa97465698715cd0f727681267061

SHA1
6299286bfcc96bb6e98f9bbfa3f57fd50c39e733

SHA256
6a913d6c05ab8cba8f9688703535f894931789a2c05b543d3d13129aede38004

SHA512
8dfe00979f3826e47a9591924b5693f53d6a1f0da3a8da49b5e93cdc6505d6dfa29ce61526e2b29b650c43765e82a92e7363b8ca0748a7883364ab1a6e342f9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SK0QRJKA\desktop.ini.RYK

Filesize
354B

MD5
bfa6e7d39c61b27818c53d8a67c5fd97

SHA1
abb6a9beceb5ca918e11ab3874e23631a2061378

SHA256
80b9dc4be1ca7725b97faca4688ce356c9f9a6db6a96b8b41f8b04def301bd5a

SHA512
1442b9d1efa2aa392a18bcfc61e2f489b798d08a6b4c6547bc015a6e5b72846986f29c253ca0a50ccb3da85df0b54681e9beca45cd9903be1c190d14cc10ac67

Download Submit
C:\Users\Admin\AppData\Local\Temp\ASPNETSetup_00001.log.RYK

Filesize
3KB

MD5
20972fd0ed7bf2e50686f073df915f2f

SHA1
b8e9e837c183c3546723cdae41f16f81f17b0a07

SHA256
a5b38f46f919fafd3a21892a5f72768778f8accdab9ff348543f8dde4a9fb7ce

SHA512
4d48ed18c76e305b5754f2521ca0d09cb19e1fbbfdaa40df56578d69394b46620fa78feb408468ea50972daa89c146f7158cf26b7856465d8675f1b16cdfba28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240508_161412409-MSI_netfx_Full_x64.msi.txt.RYK

Filesize
12.7MB

MD5
cfd2aab1c3fd65800b449668b3c41911

SHA1
c6dd36c17abdbbf876f489fba958cf93e8252caf

SHA256
d09256084614114da471845c9c5ec64fe96da9c244486dbf62bbcb4292a7f3b4

SHA512
e3946f2afd41ee65a6784ac554457712fb62b9ab0d3a767a46aa7d5a963a7ac621e0bd94d47c97304bc591a59a336e5ac09f1a88b8ce857c800e8776ab5dcceb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240508_161412409.html.RYK

Filesize
1.1MB

MD5
64c23a93ae02172885eca6e178a21af3

SHA1
1aede93514ab641af7e520b4024c85ca1fbe53d5

SHA256
ffd69bdd39eda6a68c833d5bd2e63ba1558573fba1542e2af097680cfdb3acb6

SHA512
e3f05dc0c55cb5dea5842c0acdf8c64c0c0da80efbcb524d8571d149c1403d6330c28b9d5c690b41430f208c03c2e137150b1308c2ae0227a0512c6877cdc929

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI127E.txt.RYK

Filesize
11KB

MD5
61512be31ef739f45243e8ca79f12390

SHA1
627bd04c56451dee9ac52ec98ccff4945b7070cd

SHA256
6ababe3f917ff1b4015420bbafccbec6d69d3c81fdaa9152dadda898e4fe0c0c

SHA512
8e290697211cc75bc08558dbea1e39085019f9f7ef76895e0a232b970ab0b2bc20b98b600c138ca8eb29543e6107ea24387c9c663820e7c15ca8f46fb06fb439

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_53734289\2b44f826-3328-4498-990d-9d891303a1a3.tmp.RYK

Filesize
242KB

MD5
86130e6b405431bf4d385f4c064d1eb0

SHA1
c4cbd22956b8044f266e2727bcd4e9811f6c1edf

SHA256
6b434fbb3289f29a86e10866edc159c6bd535cd98a613d090da279a510f70d6d

SHA512
8bfbbc9d1d59cf594ef07bab2b454c658f67610418896841ab509e50e0d8f322d5a6d4d6388ecff9f83d9b1db8e77bf972dbc1ca5959f9d5ed3e746c0b0c6730

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2092_541400560\45f16b43-38d8-4f81-917f-40176b8b0811.tmp.RYK

Filesize
88KB

MD5
c4042bc7eb6c7a4dc1c02a4b77c509a1

SHA1
efba4e17200387aa153ac233a4a203391997bb5a

SHA256
99f21512368d961ef1e8418be91bcf86cd7e2c372e3934716deef9dd879e0484

SHA512
cf72c0f4d5ec07d556156f0ccbc65bea25c89f733782e812fae84616fe3c001ab3fd77f5860acd1f0cf32510c4727d214b911f721690dde1a69186868a058a1b

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk.RYK

Filesize
578B

MD5
18d43a66b2750e4fd2cbda70add63aa2

SHA1
4c12a2409c2bb1b6b24db89a098f16d8c9d1fbce

SHA256
3f11f7dc8e130823fe70809ccae8ee7ef9cee274c63953d87fee39cd015864ed

SHA512
a91e0d09c49905b8088a860d0086533099b82b33a4570ea4df9be6af9d74e27360379cec8f91dcf5e62f5c9c4a254608ebbbc9bdb2ad2c59d5fca09b2b71cc82

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk.RYK

Filesize
562B

MD5
e7a9dff2ef66fc0f24f370da0f7e009e

SHA1
e4aa89469f14d5a019386ed478d931134ae5cbba

SHA256
9aa271fec480bbc61a2f24faf9ea34a33a7ff733dda537caf10a8890ee4f79fc

SHA512
656212b5a010952e1bcb3edd7cabd1ecef621ec0aff6c8ea0030095d76b13958ca804e809cf244951bbdb8ab7a0f3624c22bc1055c9615bef7b1b80009c7533f

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini.RYK

Filesize
434B

MD5
d0a4405fa2df6d40e98f2cc18bd15cad

SHA1
4a2f97789ab3fd48c8515d78ed24728691afe16c

SHA256
106a35a076c44da42dfea78a1c12958863e07cab4b5aba7aa2f619388114f841

SHA512
c3beacd5ca1de38f5862f47e945c3879704f444e64653614f57e03569c701910769c006842ab5ffdfef99bac55745fb5ea5da3b5f7505d7b42fd69aa912c98e2

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk.RYK

Filesize
1KB

MD5
c494c94bfd7966ff8d4838edaa84308e

SHA1
8d53f725d2242761d4b7f22e9b46a83c32fcc23e

SHA256
93c4d10f9ba91dc605dff7b83c34700733ecd0de983f5084150c6abeccb11357

SHA512
100a581fb544d4c4b6e72b217a715b347599e8d15f73efbdaa9e4872faf42b927ef6c33f40a4cd31868235d4c04c4e4e15dee4a629d7336d136ae3d175a12f65

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk.RYK

Filesize
1KB

MD5
ea84a922a581fea4bd65e1f1cd1b5b26

SHA1
647a3c6cd8d15beed1c29e68442fc6c452f78fe3

SHA256
2dc1f2208a281ee83ce71171ae9c9386f048fcf992366fdead1ae35626c11921

SHA512
5c61060aa4a13257a1d0168ef787b26d6412086ec74e257977832c00a29709bc4e67c6617ae478948665ba4cfd01417328ec61f7e408ddd8a571a02b4addb910

Download Submit
C:\Users\Default\NTUSER.DAT.RYK

Filesize
256KB

MD5
40cabe664901f408d5cce96a621b9e38

SHA1
3d58bfc9b0259e52b71477ac28651e365a12a018

SHA256
6dea7d7d5de5fe0d7cb304e62b7c0d50932c532e3c8b3664c21f6584468c3295

SHA512
59453684fb9f3738293a16ad222b3d859d43fb315489e9fcd9f6d21f19e1c0c4f7f81cd8bff24691d01ea83a93615a6bc8e4f7580b4eb578627a18c51cdced6a

Download Submit
C:\Users\Public\Desktop\Adobe Reader 9.lnk.RYK

Filesize
2KB

MD5
20253d4b8aefe9c9b41aab6720e14fb8

SHA1
310cd032ead726dfe44eb4bf4cdd01701ff7e31a

SHA256
f8fdaff546f0fefc39b4be4c8fd949915dcee39adc7b0f0d6729acf2a666ffc3

SHA512
be898bc16d790ae03be4ebc1d69528afebed9761cfdf6ff50a25b80de2121fd011d8fb562f11feb030b216fc5ed152c0be55a6794c5f76432f5d4e41fa15b8ff

Download Submit
C:\Users\Public\Desktop\Firefox.lnk.RYK

Filesize
1KB

MD5
244fd876b4ac703fdc6a0993aca11c70

SHA1
8fcb5358c1f8817347a53a7544ce22193988cfda

SHA256
e225e2f39763b4fd0bf053e1df118a7730d5f8aa184fef05a31616739572b585

SHA512
b168c004f710f66c53ed0318d5308d70516f631f861ab99d3df434350df599a95c9ef8b2a6104796b86646936d946b6e88b341a1d9916093bdedd95f5d80e013

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk.RYK

Filesize
1KB

MD5
7eaaeb6bb220b27d72f09742dd9640bc

SHA1
7a95f1263535c09aa03ac0ca8cff61de71afe539

SHA256
df0f80733867ce8bf32abcfb7962910464af034e1d282fe034c7e9d3e084e9c0

SHA512
889963963dda6d2148780861a7e899ab63a082c6effc86187262f5686c5e555b035cabec26551d13bf47d8002650ed88bb454c8ee82c55dec8767bfeb67e9df7

Download Submit
C:\Users\Public\Desktop\desktop.ini.RYK

Filesize
450B

MD5
8dfd0434eeef5923ef3ebf9a9bdce28c

SHA1
35a411c446f80e6de42e801b40312ee6df3ce442

SHA256
d39696137badf50294e217a77eb710bc9f268998dabd0149c1842e3550b290a5

SHA512
f079a2195d4334e6d25f7597f34c16b56200370b866de6bf5018cbc6dd2cd7ca5912dd405cea7c0e5370acc6aff2f5e24a8e4b60017826a3127e4ee5efdf2801

Download Submit
C:\Users\Public\Documents\desktop.ini.RYK

Filesize
562B

MD5
24ee67f43b1c472c8be220e955ce0306

SHA1
ae4f567410464e690c9b63458d4ceb5b462c00d4

SHA256
1c441982d25bd6f80cd8d87a33b9e3470b8f381e7e3f3d25cf1900d44a14002a

SHA512
305cb3892391fc2785e8519c2cfc99f4d1be66f241f346e266b0945d1afba95c109a0e28dd664bbed6d9ec267e39592b6fad5f1560846c9a4508dc7c06dce69f

Download Submit
C:\Users\Public\Music\Sample Music\Kalimba.mp3.RYK

Filesize
8.0MB

MD5
26eae1dcb733c258403a6d92c5df9a42

SHA1
0eb790128819c55cce1cb0d9dbb11b3d6c062b46

SHA256
7f09a6f64d56895b8c86e2bd5019c6b4ecce56a60dec39ac0aee866cc3260389

SHA512
6da9732966e7a8072f815e231615d7e47f1b491ad5839b3abdf4d0200929a1029999e98b1f9ee1f20fb308077bb548ac96a7a2eee2ed4de3e030b8a0e4ab0f99

Download Submit
C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.RYK

Filesize
3.9MB

MD5
d26559754fbed358ab08c57bd206737a

SHA1
2ddd1655773773c30fb5454d6071a882cb10e9c0

SHA256
480f6a290af2488a4d1a775be9f276d156c49121a6d1f4bba4169c261fc4ffc9

SHA512
19347378b79820f88d8f1138a432e152ecc6ac039d635eff937a6d43448ab36aaaa9effed09d23b0b2e8492d8d750ca134b38de48ebe700dd3a148c93b969965

Download Submit
C:\Users\Public\Music\Sample Music\Sleep Away.mp3.RYK

Filesize
4.6MB

MD5
d6c73c83c58421ff81132ed63c2c47df

SHA1
21372116198c7d33a1b9ea7fb7ec7ed904462321

SHA256
b9f8cb889602e8b393ff33ba3157764f58f92b92132c54ee4fe3c7a6203795c8

SHA512
35d36139a71a8fa18d60b564113e720911ae3475df61c522da4fb472e1dd405c314e935bc3b7c064253b07c89fe12462b5418bea5fcb9cb2a49f29c4e44ca3ef

Download Submit
C:\Users\Public\Music\Sample Music\desktop.ini.RYK

Filesize
866B

MD5
c00f237c48b5a2cb7ee41e3bbcaece2a

SHA1
150bd50d2261eac8abbe5f8395627eedd9155921

SHA256
d323e876388218d411dece1c9ce583bc3c8249e77a2cba55bbcdb64d6d780815

SHA512
863ee7b6097ae8481ea0749107fa26872fe8ec2cce34556dd2e44e52f7a55629c149ce1349caa459aab9d8bf4f8952ab80c1a12946bd85905eeef5449654ae61

Download Submit
C:\Users\Public\Music\desktop.ini.RYK

Filesize
658B

MD5
4de228ff01efbea99fcf41d8e1225521

SHA1
fef920c392675f47e43b8f719507bdfa9ffdb12f

SHA256
15a40bd6ea10611eadcd676f4c66be47106bdc87e248127276b07081e26f2f3b

SHA512
9092ec04f1fa4e47e003f28170f22014dba7f5d49bd1c4b431aeb96f93cb24e3ac330c3ec94cb592febed8bb1f02e6a15cac5dbc28da43593f29f824431de260

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.RYK

Filesize
859KB

MD5
79984417888d9a8fda7dbc7faf736a16

SHA1
8979f0744a474e1aa9fcce0582d104140d1d27d1

SHA256
b7f8c6eba352a9390ce670e9df4c2573f2e2e5bb8db4ba0da37e301715dccb79

SHA512
cb770bc7225d26974176d5c910193ab9bdf1f2d44f6cc406fdcf0f181114560925a0af883a95d34eaca5b30069a528745c900168ac6dafa3d9ef91482fc0929f

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.RYK

Filesize
826KB

MD5
3197c04d081e9b79a98246c81ba3e7b9

SHA1
0367516af015b0794e7479f94abf4cc2e0f25577

SHA256
d4664edbec28ab1cefecf07f3f53ff06649ab54a2fd2f8aabf3c917369fae018

SHA512
82368f08d03887a935e9ce1cb2a056239864f3be5a5cdc795d3c4e8f6432899558eefde230ba9535a62ffc08ff53482f5b8da3da346292671b4ac694ae85ffb7

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.RYK

Filesize
581KB

MD5
f5c9715540448a79e588f87f518383a9

SHA1
3167bfff733191fa24ecca723dfc101c430b24be

SHA256
c2d0edb1ccb7eb3f5a2d3ec6339f4e184dee324103f90f21682bf23126bf1f70

SHA512
240f2da8192eec9577a3bc6c13cdbb09ff480bd84b2ed49745f7ddb725b279371d13cc982e8a980968df359030642f31408477e892ad2ffccb98c478653fd816

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.RYK

Filesize
757KB

MD5
15c8b54732fc16280c8d34058e732622

SHA1
f23d4141a8d46b243b34be6c5a650c72720f782e

SHA256
04ea748c83fbab3ba764c6db484e008fc3e8d41de033cd6370ec75229a08eb6e

SHA512
e40743948895469a170f265775a2e27b529591c242bea3fb13abe74cd42cc362f736100bcb86d8bce969770a6d898f88ca44d57b3e8f9c1b7c8774d9dcd36d70

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.RYK

Filesize
762KB

MD5
0d43a3e6b11ab4e5e0407deeb2f3b1e9

SHA1
e3793705444d9c158adb17424b135800534a30bd

SHA256
bf8d0e4d0c7cd9fc3c30d7c64dcd678c5b944fa7cbc489622f37c09c91c98f3c

SHA512
5e2c63b65c29784c94b51c93f8d9f5abc89de469d1ecb6955acd23116cf5f7ffadd3c4f8828d852da13cc6e468dbe1c4003cd0a617915a403b41054f1dc8f0ca

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.RYK

Filesize
548KB

MD5
7a1cd38a961cb6f58f7f12e5ca05ae2a

SHA1
3a68e8d105e39dd92f04d64c5fe3e4f4059a43e1

SHA256
4b81640186fe43f267d99b64d5d43ace2d716071190c4d10eb542703cef8becc

SHA512
518005de8826ac7813faaecc5fe4a848d40f9541da6d1a2830b345a0f3115d51fba3840dc820358bf63b7ffd417c27534fb45668c28088accf201b8ec0b2d8a3

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.RYK

Filesize
759KB

MD5
b78c4715b3e102c904511af0d7e9fe3b

SHA1
347dcf0d3c2f0a957505f2034a1dd46d5838378c

SHA256
8c7abb6cad5c5e94d813a0870eab0b6d6d1c06f367a9db2e27cece95545209a3

SHA512
ae11e74d2fc489dcef4171dc0a57d0d83bfbbbe2d21def1a6db5750a9fbdd4a9a320c9bf4ccd18d68070c4c155a8cc82d76c3b8ce654e2cd8242a0fbbad90ff2

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.RYK

Filesize
606KB

MD5
63b1332b5971d6f0604be214a69e024c

SHA1
3f92bf78379d01828858fa44eb7bfe82b898f151

SHA256
da22204ca7220b3eff1ba49e5cb7eb1c3ea6176fdb877589b6652379af4a95da

SHA512
113bae877c67a896754056ad70f680058aea7a3e3d937cf7cb2e12d0097a6ae5761ec705de87be1509ca95f50b2cd197e6b658f93b8311dbf27fa5cd7b625d91

Download Submit
C:\Users\Public\Pictures\Sample Pictures\desktop.ini.RYK

Filesize
1KB

MD5
c21a11bc7dd07266b211cd666874fe31

SHA1
eb8cd0b8d2ad8303ff84adaefd9678104f8952c3

SHA256
f469ec94a84248f4f86c6d43eed94099779128b10fc2e493937d0db1836006f0

SHA512
ae22c0c45549c16dc5c235041c4748858a373d4a83e4f36100b52face1ae092154c1bf07287ad4c9362ac4cc0db44ecc2be4cede67f32097a8858293bcf4619a

Download Submit
C:\Users\Public\Pictures\desktop.ini.RYK

Filesize
658B

MD5
2d54c05da8908494d44444daa9c5724d

SHA1
6d3165cae51e430374fd4a39610f8c6d2f7a972d

SHA256
4bd0386530fdb691b0f9ee59ff548c438d776a94b7d3bed902bf4a8559cfbfe1

SHA512
3c43e9653f0457caea358ddb702b88ff09ec4f840b4c86b7e5609132068f53f04ebd5213134bb92a8a61d0df620e28f6c1962121a9292d65304849d2d6057be6

Download Submit
C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.RYK

Filesize
25.0MB

MD5
53f32a74ce4f1ccff93d6003e8f6bb55

SHA1
f1631b39b0b8e398592005ca98f9779ca0609f96

SHA256
d451532ea8b963267865e707c10e349d01c1b40e7620ec3e6550e88ba2c7437d

SHA512
1311eac5c0214c56f5f0a9e7a4ade0d5bb6614ab25320383c90edfb8d9607abc00e8acfba8adcb8a63ba73ddd2b752427da04e2cb48f343bfeb316427fadd733

Download Submit
C:\Users\Public\Videos\Sample Videos\desktop.ini.RYK

Filesize
610B

MD5
a2d61dd0019a367186febabb68c5910a

SHA1
0fbab102f92667e51f4b37844c87a8ece382e7a7

SHA256
d9323639256b16aef9fe0ec93ce1871bd170da197d780b3a50b53743b2aa16fc

SHA512
bce0d0584fe06ac42c16ba92a5db4a4978f9f547223da8b5dc98cc422ceea3376df424a94e44b21b2f865b853971405e0da747714b6b8d6d96f3d35f73629f2c

Download Submit
C:\Users\Public\Videos\desktop.ini.RYK

Filesize
658B

MD5
7c363df52f395dfe457883e3cbcea37f

SHA1
f295adf23e18e47a3a15fcfeba6008406ac4ed87

SHA256
d8a14f967787ce11fb792612b6c0db0e4e66e148b7d4d3e76c594d15a92ca75f

SHA512
108b7b0db33b731cd030f56ccd87ccfd689c25702d3204bf4cd421a8e89572a46cfc9b9429b062d0d7cc03f1c3466f9a42ffde9220cac2ef0929ef25d4e38695

Download Submit
memory/1040-131-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-167-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-161-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-151-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-150-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-148-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-143-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-135-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-169-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-170-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-179-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-184-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-186-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-187-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-196-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-201-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-203-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-204-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-213-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-130-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-128-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-381-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-382-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-123-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-48-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-383-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-50-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-387-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-388-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-51-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-60-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-65-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-67-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-68-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-77-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-34-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-43-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-33-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-31-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-19-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-122-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-26-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-111-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-110-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-108-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-107-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-106-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-105-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-12-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-9-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-0-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-102-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-99-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-94-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-85-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-84-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-82-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-2-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1040-3371-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1148-6-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download
memory/1148-4178-0x000000013F620000-0x000000013F9B6000-memory.dmp

Filesize
3.6MB

Download