ryuk | 8862b060db997bc9077e3bece06529c1c116af379985f6138a07ab5fde61b54c

Analysis

max time kernel
117s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
Size 127KB
Sample240603-nn7dtsec62
SHA256 8862b060db997bc9077e3bece06529c1c116af379985f6138a07ab5fde61b54c
MD5 5496313b83ccce9a11fd94c70da68ace
SHA1 62a643f171d81511912f60197f062f6b1e79bab9
SHA512 0015d7342d3ae7c247bab7e7a3489b5887562c6f93e36f7483f9f2910e060680cfbd84c51df94d1bb4ba62b4d86d1382023f19e0fd1308f56bea050bcb086732
SSDEEP 3072:3jdVRK8n0oJ6RlWPSuIZuQqEbkPnZCX/VvCN:zdVw80oJ6RGSuIZP1EN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

ryuk

Ransom Note

[email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Renames multiple (3370) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe

Executes dropped EXE 3 IoCs

pid	Process
2152	fPgtiMmFVlan.exe
3872	IiGKIYRRtlan.exe
3172	hQIImeEbclan.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
968	icacls.exe
3660	icacls.exe
4988	icacls.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\RyukReadMe.html	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\RyukReadMe.html	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\SPRING.INF	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bs\RyukReadMe.html	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\RyukReadMe.html	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\RyukReadMe.html	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\CAPSULES.ELM	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-phn.xrm-ms	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\RyukReadMe.html	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\RyukReadMe.html	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\RyukReadMe.html	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.png	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\BLUECALM.ELM	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SAEXT.DLL	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\THMBNAIL.PNG	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity.png	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\RyukReadMe.html	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\RyukReadMe.html	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OSFPROXY.DLL	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXT	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\RyukReadMe.html	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\RyukReadMe.html	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN096.XML	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2152	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	94
PID 1968 wrote to memory of 2152	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	94
PID 1968 wrote to memory of 2152	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	94
PID 1968 wrote to memory of 3872	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	98
PID 1968 wrote to memory of 3872	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	98
PID 1968 wrote to memory of 3872	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	98
PID 1968 wrote to memory of 3172	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	100
PID 1968 wrote to memory of 3172	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	100
PID 1968 wrote to memory of 3172	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	100
PID 1968 wrote to memory of 4988	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	107
PID 1968 wrote to memory of 4988	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	107
PID 1968 wrote to memory of 4988	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	107
PID 1968 wrote to memory of 3660	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	108
PID 1968 wrote to memory of 3660	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	108
PID 1968 wrote to memory of 3660	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	108
PID 1968 wrote to memory of 968	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	109
PID 1968 wrote to memory of 968	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	109
PID 1968 wrote to memory of 968	1968	2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe	109

C:\Users\Admin\AppData\Local\Temp\2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\fPgtiMmFVlan.exe
  "C:\Users\Admin\AppData\Local\Temp\fPgtiMmFVlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Users\Admin\AppData\Local\Temp\IiGKIYRRtlan.exe
  "C:\Users\Admin\AppData\Local\Temp\IiGKIYRRtlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Users\Admin\AppData\Local\Temp\hQIImeEbclan.exe
  "C:\Users\Admin\AppData\Local\Temp\hQIImeEbclan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4988
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:3660
- C:\Windows\SysWOW64\icacls.exe
  icacls "F:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:968
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  PID:1072
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:3972
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:3308
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1152
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  PID:544
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:3292
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:5908
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Manifest.xml.RYK

Path C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml.RYK
Size 3.3MB
SHA256 cd37740f470dfe86944544dbae3956f5445533edbf2cd07ee24312fa503b23d2
MD5 c3e5b53942786c51c133c0d0b10d6b2b
SHA1 f9be6c3205999c9ef88d97793392633e18ab6f8e
SHA512 b71fa3a19847ce59bfb2248c0f30b2c63d5cb2bea900ca33a8cf804d2262aa1e3c5cf8c14f6320630bb247aebf76918ff21e328244746a2fc501981825d3ea5e
SSDEEP 98304:1f+wRp7VE/fQRXA0/qrD8r6ZfamyJbyaOwWbs7X2/:1+Qps4NAgqf8reamyJbyaO8X4
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdobeCMapFnt19.lst.RYK

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst.RYK
Size 1KB
SHA256 477fa8e91687c4a079d0bc88820ee14a6d67b59a4b62701c86d40f0c99cede9a
MD5 01abf1602eb34abcf7bce4d9d524d8c8
SHA1 56994087a25055f44995c4d18ed1ed008745d585
SHA512 0829cc46244d1e813d2178173988b20fd08c4c482d0eec660b2aa94a4b38bb6ff730a6af2a5650e13772250145c7bfbea6212ff74df12a594520eb6c2a16e4cf
MD5 SHA1 SHA512

Submit Download

AdobeSysFnt19.lst.RYK

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst.RYK
Size 80KB
SHA256 ef6d333fe98819422fcef1523617b25da9c5acb033b0f02e1588aec90f1c0223
MD5 717549603968d561776fe293431a9604
SHA1 042e078c5b4bd5a2f752071fcb814c4b6fab3455
SHA512 9f17d4d2b6c5a1b2b3d93f03883a107a35924c231c023ba3a294b7d2d9a6a27e55bd0248c726b15479c1bcfea9d9f4d821569c838630aacf01892a76e8f4c3d1
SSDEEP 1536:6yaMz6EJJq99vI9jCFLAIUZ4Tf78AjNegUDnXxc4oWHU/8rU1QKFIelL9Gh:6q6EnqbvCYxUmTf4AZ8DQW04DKFIg0h
MD5 SHA1 SHA512 SSDEEP

Submit Download

AcroFnt19.lst.RYK

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst.RYK
Size 9KB
SHA256 0f1cb7533d28ff02dcd8903256086c1abebee7f213e8a6aff4f342ccf6c5faea
MD5 65ca20fb0970fb7370712aaf2e9a9a55
SHA1 cfbfa638fed0d05d7a744d72a69fed2e8766fa8a
SHA512 5a95787f14ffeb9fe77ea9240fd3a8a2adf4f2e61b89448dccc55071877dd8f3e8548fce0097d06fb17debed88413197730c98f706c06d60d7e01b19b8b97542
SSDEEP 192:EH4WmNdIB/+x5sMd9jCcA9kOXTjq6DaSIXOsiyRVdi6IHdkLX5rVkhb2P17u:exmXIt9mckOKQZIX3iyFMHdm5rV4yP1q
MD5 SHA1 SHA512 SSDEEP

Submit Download

IconCacheRdr65536.dat.RYK

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat.RYK
Size 68KB
SHA256 d4d4c6a30867fcf185e33121c72e69838ff84dd4c05dc6bc6d0beaa301b2fa6c
MD5 9f7b446ed6ac85174f21ab72fca937c1
SHA1 c3339cac85ab41de4c6c94c4b811a0d515ba43bc
SHA512 09f1ec665dee213dd27e4f6828b2e20f9fa6814fdb353e40dd1962416ff9d41ef12e567ce3545d2f6a75d87294344ec93363e980dd6a7be02f14fbc3e0c00f95
SSDEEP 1536:+A5Za88q+CKPiNV8LnFLM9CPXS2ra8sZMGHaAGAiGP:B5ZF8q+C2iN2I9mXS2ro/6AGtGP
MD5 SHA1 SHA512 SSDEEP

Submit Download

SharedDataEvents.RYK

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents.RYK
Size 12KB
SHA256 6170aaf2718d0ccbec9d99393217da83abc0a8a5ff9b7634ca5199bc5528a865
MD5 cb92f40191daa1cda7935fe3e81b18fa
SHA1 6dd9b54c4374636df6d410f3c210ba5284e88dbf
SHA512 514c4b203c221e510ced23bc309b0016250000f3e2b46b1720ab0cdabff5227fa1724a6c4483fdb5f1b4787987e3f815c57fa1f8991aa55291ba3a5741daae12
SSDEEP 384:WACkiomQ2Wu9L0PK0S/pNcndyG6c7nnRrnYIPdqJqs5tZ6hQ:aoYWu10y0S/pOd1Jn5YIV6tZ6hQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserCache.bin.RYK

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin.RYK
Size 32KB
SHA256 9a0e96cb58e5e5f143c85af1120428ee3f6965018f56b1615d2651ee044cab5c
MD5 d8248bcd95e49a9693ba9702bb502c3c
SHA1 2ac93b8d20cebfcb1db05d53f0efb75ead794efb
SHA512 a775372f99a27cc75744b5d15ffa440db8cd5f809c989deca56f99e287a86888bb5f2e59846a8bf1db37ef1ef7ce594f284f4a67d8d5603ba110c0798f737ebc
SSDEEP 768:+1ZH4ka9dmjVDyLPmUu7tFVk2UZOxpxsPT4Znew8U1Z1fA1dbS:yHjavmZyLPmftkNZOa4ZnehUW2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ACECache11.lst.RYK

Path C:\Users\Admin\AppData\Local\Adobe\Color\ACECache11.lst.RYK
Size 1KB
SHA256 2be510ff61199cbe753521c3d0823c2329de1beffe50899902c5f656b7ffc7e1
MD5 9aca1a4a51f2956b200aaac7979098e3
SHA1 8bd9ef521e4773d340a8e3db5868f054870f858f
SHA512 404e85a61cb87d747dcdc919f5b4432575d4a0a26b346e4691140f50bddbe44cb5117c56e1240ecc96bc3aa77610831b0fbb5a7e97efa5548a8fc22158d1f3a4
MD5 SHA1 SHA512

Submit Download

wsRGB.icc.RYK

Path C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.RYK
Size 2KB
SHA256 64194fd9f2f8aa8ba6618ee7e03578ab89b0f87179a6d35313f9919999b9ded7
MD5 f4b8635142c1353190cd52cc6b4c2691
SHA1 78648b1aaa3e6e0eb1383c9e597d139561f14f5f
SHA512 d7f2dbf168ed7eb99721e38371384318e3af9d06427f43d735f04162cddb0f9dfd811a836350998762f490a9b8d00727f5af38d118ff6518968ebfe6754c94db
MD5 SHA1 SHA512

Submit Download

wscRGB.icc.RYK

Path C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK
Size 64KB
SHA256 3586d2e2b662ecc984287e1d1f0e220ca23260b0424586988b62dd70dc32e030
MD5 79ce0e54a58fe92bca8c6382fcb605e6
SHA1 28bf2bc31e80b892bebbb170b216a0558a4fbe26
SHA512 a90102642acab7a405f1110f2c87e2e40730141c22ad7b14106b5a8eed6f1efbd858d34691437b00661723b21311ec806a686da1e4a595af6f86f1ee367790eb
SSDEEP 1536:6fv4S+1q7PIrgwqerhFf2RxlcfFd9SsBE6zAhLjgzvm:Ew5ePaDq0iZcdfSGE6zsR
MD5 SHA1 SHA512 SSDEEP

Submit Download

USS.jcp.RYK

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USS.jcp.RYK
Size 8KB
SHA256 1fa024cf26487134aac24178ab459835fcab3174d0baa94c3b468ba8ca2207c3
MD5 34cd701e41e8c657d2872411dde5af07
SHA1 d6ed8f60ad8b5c259075e83bf21bba2c34a55949
SHA512 00fe32b98746f628d018ba10230a40242fec425b46e8a6b9eee10026db49c36cca509f98ddf8536aa66364e1f86d729ace3e41b14806f31dceeec1de22f46b5e
SSDEEP 192:80bjqP3WxsKYI7BTrecEe6vLrZAMjTEJulO4pCfUx:80bjqP3WxH37B+re6rZvDx
MD5 SHA1 SHA512 SSDEEP

Submit Download

USS.jtx

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USS.jtx
Size 3.0MB
SHA256 9dac0300d181a20d3abc913a48b7f7032715277911636b0afb5402dba761a54d
MD5 9622b4570a1e2510ac4bfaf7482a4b83
SHA1 80429a2a875bd0b5189cee42152828f27386a487
SHA512 b16beef6650c0763e05c3d64df7a69669a5e79c9b9c86e8aa31ce430a4a14f080d8ed1321da2ded0f3a80bfc06cc348baef287ce63ae0dde3b1d6766a5cd5d7b
SSDEEP 98304:zqTStV7Y+b5ltnx1aO6IY0dunrdjNb3WaziPK:za8JTDhxg1BrdRBziPK
MD5 SHA1 SHA512 SSDEEP

Submit Download

USSres00001.jrs.RYK

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USSres00001.jrs.RYK
Size 3.0MB
SHA256 542f2099c19917f273d370c90c8175895cfd4b8725b2f171f1144eda0b2b40d3
MD5 11cf094db4aa10f1460d9a98a69088e7
SHA1 023c907a6eeb4e6d73038f754bc78e4ab2e54659
SHA512 9ff24f4a09b782f1a1d28c2e49bdbdc286301042300e4452aea4b19913a1d33e168ac503b2e25438e6782fd68635d90c9152effb446339875f1f2900b98daff1
SSDEEP 98304:IGiA+xJ0ypENdmrm0jxi0aR6BufGwKL3h:YnxJiKPxi0U6dRh
MD5 SHA1 SHA512 SSDEEP

Submit Download

USSres00002.jrs.RYK

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USSres00002.jrs.RYK
Size 3.0MB
SHA256 0e6109e9b86d1fe56238b1d61dad6bfd49cadb225291acef50598ae1e502f3b2
MD5 677baa70b0dc188af2e525c7ea79c2d3
SHA1 df40bf3d837476c88ed02e53038379a4e0f3b272
SHA512 e9518d9d731cb570aec79d37b605b362b0e9128331a2dc860455d944fe2ef7f9e62e301e136b3d154bd163232ced0075159a0817644fbc760e0f2ff7e05dd756
SSDEEP 49152:JW5VgKNAoga60MpP8TAfmr9DKtbzBnS996yYBIvwoMmmXqoFDw0GjZgS:JW5VpFs2r9OtvBnSeyYBFLw0G2S
MD5 SHA1 SHA512 SSDEEP

Submit Download

USStmp.jtx.RYK

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USStmp.jtx.RYK
Size 3.0MB
SHA256 db57d4a57996f4016b6e679c6e074ba765245d056cc0ecc8d68d6354eaa20e62
MD5 6f9fc90e9955e23df4a6c3da52e27e0d
SHA1 f882198260607059a60675665d4545eb75b619bf
SHA512 d486f7e112b03be99f5e9399acfe44290c1359ab05931667281a008dd1e43f8202b6b09946324e3004e1fb535493b9b68cc01cb891e9429ca292304e115293d7
SSDEEP 98304:NR2H73t0mdPxaeBMVbDnohwhE5FAbyJdUs7vNk2clAfeWl:Ed0m5F2VHnfh9bYrCST
MD5 SHA1 SHA512 SSDEEP

Submit Download

store.jfm.RYK

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm.RYK
Size 16KB
SHA256 43b9afff54ffea8ec5313c57632059d480d33243d51be8deeb0d0285beea94ac
MD5 d0d109fbb99a8945aabdb0752eb83136
SHA1 cad32f4ec8523368d8e22a19ac0b8a6f16213b1d
SHA512 16eef934b84e9d0007c87a3c06ebbb3a58072966ecc9317e109fd0e77c73026cac4c38bea6c0fa0792e2e98b7849e9bfbb96265b8c6dcae62f5572c6cb4fa331
SSDEEP 384:d0kDWYdOnwI9JWFgQULEo+PeO9aDP1dEu6jo2jWFFGg6:snl9JWQLErDydStjo2yFsJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

store.vol

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.vol
Size 6.0MB
SHA256 26040a8ebc2ae562f1dbbe913f06f144ab2711c77b765dd5708100db91b94b28
MD5 016a91e4782d382e014aff1583b9f717
SHA1 08ba490259434ac3449f228dcfd3ded437f1f7f9
SHA512 fd7de68e9566494d3a3fe7863d223a411086ee7614806dbf970b4a79acbbe919fc97f4a34ff691d21bb3b237946d32a3aed9656552e3d67540eed9963f75e8b5
SSDEEP 196608:w6vCmXGTbC0bITDXJau3C4HywELVDsCE3P/nd3g:RKFugITDXM34Hyr1b6P/Rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CDPGlobalSettings.cdp.RYK

Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.RYK
Size 4KB
SHA256 0d4ef87b78887e6d55c9b7bb179975b9f897e0afeccc0eb3a27f7478985418e4
MD5 f45e1a294210acaa306ea3057cfeb55e
SHA1 d0f2fb79def826b155e1b487da398d1112ee1694
SHA512 3249716033df608bd074a16ff829a3dc4c9322f3d0690c7921ab7a55047cb7dc34e387520d3f63d743a669620b596430dbf0e3a710833b883642a6691de51a5e
SSDEEP 96:1JOn0LmBQfjimvD2oUl1S+I7F1OAlxkLw51jxZfNRhkrw3mc9vKZ5:1JOnGCQfjiKDe8R1OAlxf5lfNnkrwWc0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Connected Devices Platform certificates.sst.RYK

Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst.RYK
Size 930B
SHA256 6aa1c366b575fe45db029c16c02a77680485c9540b3a7515e17558622878486b
MD5 577cdfae4cd1d28ee7debc63a57a8f4b
SHA1 ac6e532b86f78549167d00598dbd0a875d33e9af
SHA512 85e4aa81eff118997aa99a11a047fbd7f973f11753bcf9229c93f73aebf6da7619c81177d5506a90baf565a5b429bc56e4d949a90ee6f65cdcebc3606882c183
MD5 SHA1 SHA512

Submit Download

L.Admin.cdp.RYK

Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin.cdp.RYK
Size 1KB
SHA256 d493464b3ad6f36ebe61bc318322bc38f2645674a7b38fc76d8dd7d9a6de6e3d
MD5 ced88d727c10e7d938362fca70f71539
SHA1 f3ed366f35d36a78a5d8ecee3493a78276bff4a1
SHA512 76a32db6bb3a0bdec2c8640f2cb532a8fd5c5903344dac7e6a7e97f941e27f49fe883b14be53187e0a039897a24f0ba981439ef1b5b847c38f1b963d3fdab3e6
MD5 SHA1 SHA512

Submit Download

L.Admin.cdpresource.RYK

Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin.cdpresource.RYK
Size 338B
SHA256 b7ea62895ec3c9efa49561f93e9e570c2eb950ee6ee83d26650387810fc2f908
MD5 a6545f0c762438e1205d25f47686a1a1
SHA1 51783c2b9095a8a1477afbb53935982edc81bf23
SHA512 a71787596ae1b59a8c693727b7b6bc574689fd8b135f2633f4bf3e3e35bb71f672d189a47a9b8efc9883d414b86712b03a5d36777e2f59a1f6df94251a0905e3
MD5 SHA1 SHA512

Submit Download

powershell.exe.log.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log.RYK
Size 1KB
SHA256 2ce6e883bb5d9f857902c341a533c8e862628fc5c4e259df0048143bc30f5167
MD5 2c00bb783634d7e81c58da2bc50f8c42
SHA1 d688784f0bb1738a2ed647defb528547d4f2c6d0
SHA512 64dcd8bcf3e6cdb7ddae8fc9341c4b474133978681c80318b67eb545f243c8de3cef85f5273c9356ffa0fd1d60dff379e37491e797461062c3763447c4383cef
MD5 SHA1 SHA512

Submit Download

powershell.exe.log.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log.RYK
Size 2KB
SHA256 9b46d24611f51d0110af183091608108ecfdb076b9e7963b1094c883ac73d8f4
MD5 9e0362729c0b3c2394c4d2a4089874b6
SHA1 11d4fb1bc7614feb17b4371040448588cd9aee45
SHA512 cf6013b6809fbc44bd2b6a1388fd8833460e82f6f9963fd92f221fb1547c157d71f95ccde4d75b8e3f0e375679788c9d2475c850db20e33a9e9ced99082b1fc0
MD5 SHA1 SHA512

Submit Download

DFBE70A7E5CC19A398EBF1B96859CE5D.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.RYK
Size 11KB
SHA256 b1b4614d109780a806f8804f61c86bfd8dffa0e706b393377869ee77cacbda39
MD5 9d0404fa03c140bcd0e38cb96630014c
SHA1 6b9635887d63877a869d12aa4a13b4224adaa38d
SHA512 1b62ecc2901e10ad2f62862d5b0e2f018fb5ceaf649550006a9fcb71bb17255228a9f288c767a5f9ce568201f781bbfab48f1a575c8a754f2df87449c1d15515
SSDEEP 192:DJTEkbBgYWAqnDkxrwxEz4ZMfWmLgb/RZew5/jZ/GfuNBBMZ+zn5PuT3oBGO3z:D5dTakmxEz4afbL8/jt1l/ntxu3NS
MD5 SHA1 SHA512 SSDEEP

Submit Download

CrashpadMetrics-active.pma.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma.RYK
Size 16KB
SHA256 4d73dc6e575d958f4ce856c7e803054ec405e42ee785639bf07a89907c91bc40
MD5 1190d2d20dbf314abdf5c3da54fd2000
SHA1 b3f73e438a73bfad21a222d17ed1c3d7498d3edc
SHA512 207f574c9453ed8bd3972c6d5141df89a20cf21cee560ecf5e7c61ee32b20956efabf592c5cb3f2c315ba36f60eae9ceeced53bd6f0178cf2f9f1040e6412f58
SSDEEP 384:dTQJPZ9YiIzWOx+QFmeBZy65hQLnYiVj9+xM4knb0ly:sXImj8hQLnnAYb0k
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat.RYK
Size 434B
SHA256 07c3af9c096a4a03f0f20405845343f30289f9093e30bbfe3c2acdaf72e20aa3
MD5 f0d2fa1cadede7c93e351d24caf0f598
SHA1 61c80eb32f584ef5c8e73f79e7ec941e6ff84076
SHA512 8415f7a5ec1601b5f9506a84c5c342a6b41f02ce34c6190dc69ea1e4d43e8f3e25ffff53d5718733d54e6109ac20bbe87bf680fa23d10c50852b8e0fc38aa99c
MD5 SHA1 SHA512

Submit Download

data_0.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0.RYK
Size 44KB
SHA256 9223f098d378fdf404545e34bb4ddb29fe00fe25367a04cce8d23c7d773242da
MD5 9afb312b28edc8ce01efccde60abda81
SHA1 df0cf646c70690ceb0716dd4f05449403277999d
SHA512 ccf82c6bae57ebe1b7d049ae8403a260c1143cb53d49d3c6b766b9a355a36d3d25e5d4b12479c7d29f9c013fa87316256c0a48aa00860811d7503da4b27f299d
SSDEEP 768:WeBzirBXzVABsONTLow4ZBTyMfi4a7PfbOc9GxDcl57w/H7O4AW:WeloVgs2TLqZBGMq93bOCGBcjOHeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1.RYK
Size 264KB
SHA256 028fcb489e984a1f89f106f8ce13aca267d598c0ea0945a70b4c82769b945d18
MD5 1944ba2ac7f22be44c161df6e41e6c0d
SHA1 7a5a3df089b152225a20b3beea99a9dacbf81403
SHA512 cf622433c9682e9fde8f0b8996e82513688d09f8eae74459e6b4718acf1999beb56abcabaf1b40ef6f68a2693643d9163bf06b0a854cc4cac97d18c2c475900a
SSDEEP 6144:NFLawe+CjJZ97Nm2hAta0+EILNzMrE3C5K1ycA7Wu0OmpyD4tmusIQm2HyQPR:NdmnJXNmGAta/DNzAKElWuAyD4MxS2Hv
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2.RYK
Size 8KB
SHA256 1810faf11bbf287f7b26ffe44cc628ebdc493268edc16734f815573c9ffe903a
MD5 0c68c47dd72278980c5b6cb8c923c789
SHA1 65a4280b91fed73a7c4f7929f1d154e7c273b694
SHA512 a70b22da7eb54081b7199dcb126fe0d8b9812583bb247329e702204c361694f3decb89450de0c9dc7534320681f5e0acbfba69574b6d26c43806328b7354ac76
SSDEEP 192:qImkC9q+TuYSFoM1v/Ti0blLas2GTaxjXaA:qIcufFoMtDpmDe0F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3.RYK
Size 8KB
SHA256 475dee5c3c9abec7b125917d8cacebfbd54ee4ca0f56c737e9267ea644d61c55
MD5 6be39e9fd10aac50044d89d424ef3403
SHA1 2b8ed2de2b2a9aaef849eb81c52fec125af6d7c8
SHA512 30902c10570fd600a9106710bfd8898bc30d27495c5ed3881da621abc6ec59f2427747ee6593ce02e3bdc9d174ae87b1cf56c8cd6514b3d89881fe40f286bdc2
SSDEEP 192:H5N2WZGSWs6hcVjR4j7LyqtEqAVcN/2MqiSgZ:ZNVYSWDhcVjRoy+Q4S0
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\index.RYK
Size 512KB
SHA256 d7dee3d24dc53fbcc72f5eb75a0d93a72794a7d9feda98d7524f5173a7489a6a
MD5 eb7508c3d5c6b6c0fc46915486e2394b
SHA1 4c839ff295a0d5412206351b3cd9f37d933a08d4
SHA512 d6eed28a0149f81cfd3cd2a87f6efa9e121bf369f78ae89ce5d39c54e6b3e5d294033886d1ee7b931d58c3d851db5ef37d7920db08af7ba1df0be07cfc62737a
SSDEEP 12288:UrxCtyQApsQCEz0wjXZo8EMatzsqLVCCnuS5CpK:0Cta5KMqToGuS5OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cookies.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies.RYK
Size 20KB
SHA256 d2d100f1621fdc0bf15ac586764cfd26569f99325ee9b4401778f002fcee1537
MD5 93eeff2af28d408eb4b0f8bf6fcd122b
SHA1 2889c52a6406bc119fb3a5ea08e2740723fcc772
SHA512 c2de70bd649f78ac19f8575f7ff78d81fc0b84acf55d8103476bec5e74fc188b7ec660e88b2310ed89698fcc63e21fb24f4b9d90d5a4ed3e8ecbeb9ff70d279e
SSDEEP 384:3wRnoPYMyHvLV/GMIBNAHpKtF7A2l09L0vOSoRe7+0rjnZDNo127RT:ARnoPwvx5Ivtbl6L0vOSqI+OjnZxo1+t
MD5 SHA1 SHA512 SSDEEP

Submit Download

Edge Profile.ico.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico.RYK
Size 70KB
SHA256 92bcbcd2c67708f9f6f8b9cf8d7503795a8aabf3e1a86c4c77a04f763ebc6b2b
MD5 d69acaf2727c7d591d5bb972b47d20ae
SHA1 60ed0b20490260576d2fb10b0f06212d7726a55e
SHA512 77666ddc9bb511fe17d424f72579e7ba999374c16f596e2bd20531d64e9d14ce4ffdcb68dd3e5365f286ff80e9b2b1c64b087f19acf2c943b7b14543aceee0ca
SSDEEP 1536:GBMczEPhHR/cRIuVnxuSJRpy1k5FCaiX4O6kCXmrd5Mw+kf5:MP43u3uKpZ7Cae4O6k9d5MXkx
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.RYK
Size 562B
SHA256 a8be8a85803c3fb308244cddb24ad9e24133431620f480d2b6a2ba1a887e5314
MD5 5c6ab0287071c37f166bf37f377986b0
SHA1 28ab209cb7880d47ee9b5ac58b3c679fa5a85e94
SHA512 0af2563c48b39d1a061e215409d4db85961e5c349bd324dd0fec21ddbcdade8e9a13da0c7b5db2d1f513a285a2a48fa964fbfad422e0814652be204755584989
MD5 SHA1 SHA512

Submit Download

Favicons.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons.RYK
Size 20KB
SHA256 02c0e1e43ccd22d99998855b9262f3d95b16c94238e7084bd1e1cb5f73bf6694
MD5 f1a0b8b667c2dfd8fca5acd90ef1a5fc
SHA1 94d03270d4bc63d416cf22090c864f5aeb8db0a6
SHA512 b1dfa23c8f5013c922f4ad0c783a21e8abd6611eef0d59007277d45386677b53b7099b925d5a4840c129d20595f784f96b1ceb902ee34297cb09a6812263ec32
SSDEEP 384:jax1+EY7WPu9FOPVja/w56vzV+76fhsXu6c1cirdaByV3urSsoEFkpRGu:OxsSBVm/VR4u6ESBQu2AF5u
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0.RYK
Size 8KB
SHA256 4cb3ef51ca40a8ae7a09efb7313a11cf816f15fe22be51e22f79f0512a676787
MD5 a97199b1d0029a032318a0b405a19070
SHA1 1e84a6dbf59dc8f0c35270055dd01d9feb282d51
SHA512 bcc3fb8de04037cd1d08de441675d85b688c1088bdb48c7985f32cf2d9ed18f2798d540db8f3d593eb0971d209928590b967bc57a5a6f339db245154803e2a7c
SSDEEP 192:bNEuWSnflb8d+3qum6V4dNMRBNXvL9hLORRbfc6KrsdwOclSJ:bnWkfJ53v4LMpL91OrbU6K2oM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1.RYK
Size 264KB
SHA256 28ae3cc9f2e74d3be1172096b3776cd8bd5f0ba5c251cffed80c15c717b595ff
MD5 a64a060ae4943399cad06245f799ab55
SHA1 8e4ca240ab56a3f989427b4a6b2d986a08451141
SHA512 aecfc745d5bf661d3e252bc68f79b104a7150b6c8405e814426004bb73652d8e94219b0765b6b63d47abb92ca9673307f2a8ab43c20b1bb2da18ea67e8a18238
SSDEEP 6144:2Dkl3XrK2Wjo5v2LZiwkujjgXwOkSrVASsXjucFu27pq:2DQDjv2LZrkuKHkQuXVFuV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2.RYK
Size 8KB
SHA256 99159b6955358cbb35261b30cdca28fcde4cf2742e4402ec5ae6c75ef664e354
MD5 fd09651f757e70889334b4481b19da11
SHA1 d7d658bb13f1bfb0042a2f617881bc8c1d6784f8
SHA512 fe18743f538502b02d728b8250686fd07f95f773875fca8478a67d9494ecd6daf05dd508dcd78ccac3293d343535ad3f18055ee1902738451eee19b185bb5956
SSDEEP 192:ncqTloOM8RrIyM3ded4lK4/wExwCggtP+lgzABwoR1vq5x:nBv0x3u4LrShgNpzETGx
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3.RYK
Size 8KB
SHA256 0374612fa1e0052e48b8c7dc4fec76cf682ee6f7d8295df2ea91b430de69fc64
MD5 c669b7b8e075c2a5bf9ed8ad764405ce
SHA1 f90f7d77b2e850862da670fca3d1da21368f0058
SHA512 fc07d7c1942efa0efc55dd2772d1072788689ea25602557d7017ce5b6704987854b84c78ecf2feadac5adf0a3d0aa9887b662cc4f66e710e402a3bd60b6636e9
SSDEEP 192:/Cezjb470obtPLd9Qm3lfOt9dWTNi7zFMYbJ:av1thW+mt3zFZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index.RYK
Size 256KB
SHA256 03f8a358b9559750b10ad4d701e927a3185f3b24ee31700d40bb3fc75cca924b
MD5 d3e27bb816cfd0b80d2e54ebdae989e3
SHA1 72f4622a292ef554ee3a6aaf95a4403b8bbed125
SHA512 e32ffb9222f25acbc013bac071558d8875f9a91511b0d8c1c24587e44117617df65a3a2ed9bf2ada774964575410a41047c6b502bf46dfe08c79421503cfa912
SSDEEP 6144:RNVO7wrX0HdBUuabi8Tk7N6CUmhch+vF7lS80Lrkgi:RNQ7MYa79DyF8Hk
MD5 SHA1 SHA512 SSDEEP

Submit Download

History.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History.RYK
Size 124KB
SHA256 648b05d59408797243892847dd9dd1c1c0dde2b2c578a4d5735e05fdda34af20
MD5 06cc575f9b39531268e60411ba427705
SHA1 d85aeeccf87b0e2126f1588d884c51ed1d327379
SHA512 d60dfb723148cd369e145935b6efa1adf174dd93e0d453f693ce9f7c4cdf72cffa9a3f57455b81e76a2f6d2bdc4d746266f15d8fadd40a5f5781ad6257f1fff2
SSDEEP 3072:QTorbNhhE+k8n8xk071lhEto3G8ce2kfi5mDXxRK2:Lrvr58xktto2zbSDDvK2
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 610B
SHA256 a55b90d5d07a1bd1739d1d08d0f302e4290f8782a6ec8899c757552436e4a4d6
MD5 dd7ed68d290cc3fc087aabe808deb0d7
SHA1 d3b3b5fbd453c172288bc31c774dd67839577089
SHA512 4b0e167db7a6d701588767108b3dac4f685f43eae8a8d71cd21e52f9956f2d0cdb19c3ba6db1897cb9a3a89145143de57a182ce6a9800a637294efcb9fc3d172
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data.RYK
Size 48KB
SHA256 9805a8a1bdda5efad481c25561c84617d9ae9414f10808e4e7e0e3de515758c6
MD5 d8ec37a5afe2a695d0377c80cbd1a704
SHA1 131452ac99d70d8329aee0e1279eb2ca743aa558
SHA512 43b5943b50ad87befeff1afba3f4795e00bbc4b3c98e3eedecb9d8e2793ee505cdfdde6dc07e9eccdd9d72a3fbcc919dc7d4b811a91c4e74d7bcb460ce21b400
SSDEEP 1536:rfuXIWqS+zzY/Ie3rIjefyTHkY9DEFk87wj:LffzYl3rIKoHXUvK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 386B
SHA256 c7017f6e95d5fb44ee05c7b55edf379100c8c2f93aa086aee893161e6b9cb0f0
MD5 4c8cbe60b78757820dd3ab9635b085cf
SHA1 4bbffd52f20b30ee83a96af8e8815db6db405a9d
SHA512 a9d1dfa44e39d01ef5c98b32facd9544b1e97bfe202d97d05fa086483663676dc0e8bc58e674fb5c1ff72db7c17f97a2f78cceb4d53b9443f4800976b8e38d9d
MD5 SHA1 SHA512

Submit Download

Preferences.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences.RYK
Size 6KB
SHA256 34a29ea76c775496d012dcfe6f6defa76d607b3642c1754cd98ceabada10b832
MD5 160090937c89638719651555fa2f5a64
SHA1 201c17373b297f571fb20754c0900f0e935baffa
SHA512 c451d3fb0e99b19c6e7786429ef700f3390c7be49e0ee34e84e7f28d20288c3483febcaa315a8386ba5f01833f5fe7ae9f96849e82d1704159ac22bb817d81c8
SSDEEP 96:5Ow4U9s6TysDpz6/JG2395B/Jzuutc6l+VFRk0BjbM26IRlfDaSLCujOEm2+GU:IOFOhFt5DeE6FRhJDSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

README.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\README.RYK
Size 466B
SHA256 40f7eda2732833014e9aadc922a15981adeb309356396cbbefd95cad47c890ee
MD5 2cb41a606393fe8afe1b5af7907174b4
SHA1 18877eaeb20fe0a4807658954ab4df00751310ad
SHA512 e56772a7b84705195e11bbba0e448a2303ce3418a322aa724a2bd2dc0bc132a2ce5f23b7a2099279e59898f4d07c82d05ef960d86d225d8fba6f7333e8506d40
MD5 SHA1 SHA512

Submit Download

Reporting and NEL.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL.RYK
Size 36KB
SHA256 6a2a354aadedd85276844cc617190a07cd791150866dbd01b042ce0b4a419537
MD5 26f3b937a976005d85784cc8730b22d5
SHA1 a6804bba07f6725e575f24421481785532e17775
SHA512 9cbf50320ba42e4caaa421ce7a12b9223445a6b7d3d2cf2c3dd951a300fc304c900fde4a33aed6a430dfd24ad016ba098bfca6301e707ea7470e6844b2a1184c
SSDEEP 768:58XdZADSmsVun+mfYwc+5HIQpRgReJ2uZ9leGdTqRtFZm:utL+frc+5HIQQReJ2uZfXWjLm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences.RYK
Size 24KB
SHA256 327e0a719f8a4c781d95785c12bad7cd9083032d17b54d558e1eb18d20608ad6
MD5 0a0635c510f793f77a4a8c9acb967338
SHA1 a32fa4559a63441d02bffdf555def1591e50066b
SHA512 32721c455ba471db2d2fd0247f5a5e98433514afbe0ec37545da2a2816e401f3ea4d5a06d24f12b0c77ab2e3808f2070f62a92c722dcaf64454d21a7cb82341b
SSDEEP 384:8uQCVDdN/tt71hU/H/UNPAXjJpRVpf70VUQvWF0CJYDTjz9GtQ2:8zodN/Pw/8epN6U2k0Ce3ot
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 370B
SHA256 08b4fbae0a23b2e8300ab0c5d3a3c52a4d3c1823b209dd292a251aaf707d5416
MD5 846e0f7cb433fb1034de0a433fc4c3ec
SHA1 770b8ecd4e70992a0fa8307e7fde8019efe51866
SHA512 851007c089feab5a9cf71e1caca4c86b6b7b99bad0eb0dbc861752705e3df1231e0ddc9099a0864ad2643ef41ccff6086f0e07fac08b30b700f208cea0ae67aa
MD5 SHA1 SHA512

Submit Download

LOG.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.RYK
Size 562B
SHA256 5b48a3f4012afdf1e5b0acb29109d86cbe47f4b43fb709c76ecbe15e94130692
MD5 08099bbba27cffa032a6f9df57beb9cc
SHA1 48bf2e449ee5d44e46fb33bb56337d74b2a8173c
SHA512 91b26333ffb37cb5c400a989cb9650a0db9fa26c34c3baf014e172907bf5883c900c5646307c03e993bf14a80ef1459e722dd6c581d961c5d5ca5a176340edd3
MD5 SHA1 SHA512

Submit Download

Top Sites.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites.RYK
Size 20KB
SHA256 93d27e2b6fa43789a7e95e01c414589b169196e8532262131562dbde99f5ce0c
MD5 28cccb653120ccbe48d874908849eb29
SHA1 abb363233d1d4a07a6ce4c5ec12a1e9b3c826fe5
SHA512 2b7923a959906cbd87256a664d33f4b24d10322e9c56b387863ecf7544eb6d3d15db6b70a65440bf1c00d1720f0b7e316db5dfcef2b653b9b6f9b1ba8fac6fcd
SSDEEP 384:3Puo1Z+jPXaLqvzldV46VziR+SdHp/g/bYjZdH/SQ4DiI7Hw0wdPM7yDyE1:tZ+iWfSdHyzYjXmpT60GDyM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data.RYK
Size 116KB
SHA256 4e4092a8fdbd83372b87e5c10acc7a0c340faa3de144938351bcab43ca937e06
MD5 5c5f6a42fae40aae93c3670c6e4fbb11
SHA1 61af2de1bde9ca5d00d975d6f645bd163fcb577c
SHA512 5d5ca8722c530d249e2aa21ef00a9c1ed5af296a1b40fe2fe968f3c6b4cbb3e21d681ce5a2e802f2dac85aab8a84e2f75996e21abfb69db32a916b0467961e62
SSDEEP 3072:ztKviGuwjkO6rdfYasz7HrbxhUmf/1eFxEWThQtIu3Gk0:WiGuwV6rdfYaAbvRf9eFCWNQtI8Gk0
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000002.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000002.RYK
Size 338B
SHA256 6b5fc057751b72f02f41de37a62f868056c4511275be25f6c125e48c255cef0a
MD5 188cea36caaaac73b61d5cf79f1446db
SHA1 6bad77fb2992b3bdf5b89d3feffc25c187aaace2
SHA512 9396b75f31bc9750fdfef07dce5214d4448b08d8d969a14959917b0b3a82f97dcef04ba3b4e0854102fc76cf7769d2ca209a200af504690352df037d09bf67c7
MD5 SHA1 SHA512

Submit Download

load_statistics.db.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db.RYK
Size 44KB
SHA256 7eabc6c8e671ba6476f8e8037901ed1e2b9be6446185261bae9c9d4833759a0c
MD5 464cd10c04c970a7c8a5fce489f8b16f
SHA1 48fc58bd7a871cfb8970aa86dd1898156567e4b3
SHA512 3fbd6b19bb3fba826f8386ee5b8dc6f02dbef02703e5f8fbdfb2577dc4bc0ece6d3354a87f6b4ebfdfcab88d37f5ec00693e91b4ff03a2b0cc338223599caf88
SSDEEP 768:k5XSUcsPS3JUhh4x9rSxgfm+lLGtxVrA3ERtY/bg5MD7QBQgjzF2RJVz4tLU:IvYUX4x9rSxge+LyVU3Q+bg5MD7Qi6U1
MD5 SHA1 SHA512 SSDEEP

Submit Download

iecompatdata.xml.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.RYK
Size 3KB
SHA256 0bf182e6d64db9cf67275b2050146e1058e2f815ebe29a64542245d69b6e5022
MD5 94e3ce55acdfab1a3732ba11255137ae
SHA1 03ef9311fd72d00eb87305c45ea61565039b54af
SHA512 482c6e26e3ca2ab26bcdbd7b2457dbcf3150855062fb92258cbca92ae762b6adfcb1a57da187106e1c020712c6d07095c8893e363a250be2b1be64d1fd2e4c37
MD5 SHA1 SHA512

Submit Download

MSIMGSIZ.DAT.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT.RYK
Size 48KB
SHA256 52fa2bb6d9f096645459d2153affe3751e43854281d2c4bff940eb9d644b1558
MD5 9a9b71507329c9b007ab98d0dc2d190c
SHA1 7402d556483d417e4ac0bfc7eca6e3dbd14a53b0
SHA512 04fac7f666fd98699fecf2cbec879648ad48d15987d681f4d917804cb529340e2b9ebbf481695d6676246e02784948ca729614299a18c370906116b271e4ace8
SSDEEP 768:HPrMB7zvBbqGROFysz4WaW6HRRfNP1ksTpArEMfB9oQhiavzKC/pn6DSdKnZ9wv:zgp/4yszCWenkImWQYczf/kDSdK0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

RecoveryStore.{64601B8F-0D35-11EF-BC9D-EEF0A8BAFE32}.dat.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{64601B8F-0D35-11EF-BC9D-EEF0A8BAFE32}.dat.RYK
Size 4KB
SHA256 18cba1ec65400fb12bb0c4726592b6d9ad2363e54ad0ceee9cd4a85f3c9f9144
MD5 6f439b762b9833524c56caba31de07b2
SHA1 f55e14228b002c1382064adf10c18a100654d3cd
SHA512 49f5ec5ac2cad716826e8ea2f5921807fe6df0cec3fb352148b6bf2076454f0d08bc310bb6163d1222fa74e1bca24debe01541a96f51129db68ab62ea1470f89
SSDEEP 96:6Tyd2IIRgeeV3VTFB4NRTdFv3aOrjmeuFcKbE48n803QjVO:F27RgfBVTD4ndRKqKbE1AJO
MD5 SHA1 SHA512 SSDEEP

Submit Download

brndlog.txt.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.RYK
Size 6KB
SHA256 448fe276e3a9d79cccb9a1cc372172b2d585ac5e6bebd3bf8340477726bc6144
MD5 31045fa47b483af4b694d1a99c255308
SHA1 a57c70964cfd3c7153456357a0ecf765b26cbdff
SHA512 fd01d241c010ae7398d9a04bb6d38e10c27673f185513458ae5dd2102c523bda78cae46658cd194b8aa49c1fa10c1cb79dcbcbc87c0a75d299da6eb13951e8fb
SSDEEP 192:evEdLWJvskunWPhLCI375aeQOQgMaLQ+p:evEd6BuIZJ75K8Llp
MD5 SHA1 SHA512 SSDEEP

Submit Download

ie4uinit-ClearIconCache.log.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log.RYK
Size 786B
SHA256 d6ae26d8fdd8ca051ecdbdad82245e5e81ae580648386d8b472c1f23698f0e79
MD5 f7f4a4a0dabbb3703d3553fa4ea944eb
SHA1 894371cd4e04f070ca1c669c6b16b70db64e95b6
SHA512 cef6de176be8897a497c8cca86651a6b6aba86146c480d69b40562ac5f0667fac2d7d8d69b7436ace9c8723f9275de036f78c85f4c72c00925d179a2ac4f7138
MD5 SHA1 SHA512

Submit Download

ie4uinit-UserConfig.log.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log.RYK
Size 1KB
SHA256 83698242d31d920f68393a91aafc4394e4a61d71b572884b14da8278aabfd200
MD5 d0c2f744f3a3ab1990085aa914bd496d
SHA1 21ed5a63ece6ae8e4d11c13161a685546130e392
SHA512 95aad34c493edbc18abc13dd26904dc7142c7ebec2b2681ca71ee2b53ea71fc50c37a38e1ccc6a119c2b8752d224b732dde2332216838fec54e956ae86c923f6
MD5 SHA1 SHA512

Submit Download

ABE5D8C6-E15B-4BE7-A318-1D31CDBE0DB0.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\ABE5D8C6-E15B-4BE7-A318-1D31CDBE0DB0.RYK
Size 161KB
SHA256 b0fbc55f2754898403af1598a286ee1dc54fef7173351fc94529d1055aac38a5
MD5 8312862830537c1666136caaede5f71e
SHA1 7a116978f6423909c5e6fad2c75092f4e38acb8c
SHA512 3727a8e2a839001841547cf01267bf8e65fc518830e19e790775b192476bad92c2400c02f2e833748f4439291f67577807f8a42347fcc8a1030c2b8e65130775
SSDEEP 3072:N3ePNKO5nP/Ktdz4w79zoKddnk1dEYnQRPiuPE17jjCK/nHJO2qQB3V4dbampp:8NKonPydzb79kKddnkjzMiuc5jpY9MuD
MD5 SHA1 SHA512 SSDEEP

Submit Download

CACCDB65-4D35-450E-A777-F916C246C26E.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\CACCDB65-4D35-450E-A777-F916C246C26E.RYK
Size 161KB
SHA256 d96a72df5c2a9b835d9fa96dbef609617164c6995cd427d6848296f22334aff8
MD5 d5a2a8470125d06715cadf5fd77d3b15
SHA1 78cb5a8569beadcd0d358b99afcad9f2c9fbda7c
SHA512 64756139a3f429c0790934f22c9bb35bc1e4af52a8fbc3287f2658d4031c3ad649d36ff0f158dad49055b81feeecdae0608468cae724106a2b4d292a5c228e17
SSDEEP 3072:0Volr9d73HW8ZczpI/XWN7hyPGchrS1N5Jk+kF4JdH2olS1Y:0A9d73HWMt/y78PGE6No+kF4Dh
MD5 SHA1 SHA512 SSDEEP

Submit Download

excel.exe_Rules.xml.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml.RYK
Size 323KB
SHA256 4bfdc17e7266c58b1eaee0d4c03c91927150284d5bfb79dcb82da0d7cfb26725
MD5 129ebff97e5dd9c703bbd68a56d038f4
SHA1 31054f056bb02be3a57d3ec36de9a427e483d4a9
SHA512 1834ccc321421f6371b71fa5f0d4c4e3af786cc93a380e9744b917fcda8a2ab78c083979e3d8a51a49c5607dede3190ead8ddf46dc69c8c3d4efac4003c5242d
SSDEEP 6144:Yq/jDZ+yaNWYZMbMI+eRyrU960g24t8nRX+akb9AaeUM0GN2jxyL/:pHIuYMLSA96WCOuakRSUvftC/
MD5 SHA1 SHA512 SSDEEP

Submit Download

msoia.exe_Rules.xml.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml.RYK
Size 834B
SHA256 c938f28567fb77f448229d5413a9930894215407b175b8765491be4d121c1bc9
MD5 1083f8d77913fa19241a87f5f21293ff
SHA1 da4ecbd0cdb46b873ef03645c3c907ee1a052d46
SHA512 f597736f185dac94aa54e2b750764171fff86634139dd0b42caa377690501649fd7f6b796abdbe4a34edb83b71bbef91fa36f0c90e9eb4d7773eaf4e4016fdfa
MD5 SHA1 SHA512

Submit Download

onenote.exe_Rules.xml.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml.RYK
Size 270KB
SHA256 3dbceaec8dff3b924ff49b340182168212d7593a048832fce9c3eba016e72889
MD5 222f3eef2e078be7587e7e706502eb2c
SHA1 f9bd6ae0c37dad0309999540393cfe1c04dcba6f
SHA512 e7929e6669cf17f571c38475cc607e661438b946ddaa8271a46df7d8784a9bec8553719528d781e44081a5c0297b17919706deaaa1d3eb985147c1873a1348ce
SSDEEP 6144:I4wss3UVag5lj3/NDEll3P8aqCf3mv3RA0gtj:Ess3d2vNDCf8aqC+u02
MD5 SHA1 SHA512 SSDEEP

Submit Download

winword.exe_Rules.xml.RYK

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml.RYK
Size 332KB
SHA256 938e2afe79c2a64273f3fa744b0bf45a8dd80caada8acb54e8a5d4bf7d923f3e
MD5 c662d207157a178b2fb7bfccd6fb9abc
SHA1 8bb32e2d4673f93f710f24cdc9e1c223c0ab384e
SHA512 1a8d1ec37f1c0b1fd8f51af7da32111c5d56c02ec1cd0243affa4129c876ad1bb5ff9000926dc835ab63829640128c654c5e2d72fc72a4b07a54e593a78f8884
SSDEEP 6144:XU08tTGDkF4nyxkK717imKjr+pedpzCeyvJWiEwx5hPnBulx3ehRAnqH:E08tTGDkF4yxkK7t2r58Mrwr+xsiqH
MD5 SHA1 SHA512 SSDEEP

Submit Download