ryuk | 9d2bcfa82facbaff874c61534ef4bc647ee072b218c4903e87012e1683e30bec

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/03/2025, 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
Size

134KB
MD5

b6b531d5477d737cb153ec5201c5baed
SHA1

fe228587cb8ff1565fbc0e825f45fac0726c4ec5
SHA256

9d2bcfa82facbaff874c61534ef4bc647ee072b218c4903e87012e1683e30bec
SHA512

c4d84ba0e25d0e8a4d694a9924183cc65168c010e18d539d2003b02ec13d43c6a2f3594266ab4dbbce7de5f769f86192e9320cd2ddee332ac0ad161de27f1426
SSDEEP

3072:4MQVQQA/chSW4wL2uY5Mfz/qfsbkPnwaT3T8uZoCKq:XQVQQAKSW4wax5MfasWobq

Score

10^/10

ryuk credential_access discovery ransomware stealer

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Ryuk family
ryuk
Renames multiple (2967) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 3 IoCs

pid	Process
1584	SplDmMuKflan.exe
2804	UDWAuuwqDlan.exe
2064	XwsjXVhxmlan.exe

Loads dropped DLL 16 IoCs

pid	Process
2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
2520	MsiExec.exe
2520	MsiExec.exe
2520	MsiExec.exe
2520	MsiExec.exe
2520	MsiExec.exe
2520	MsiExec.exe
2520	MsiExec.exe
3052	msiexec.exe
3052	msiexec.exe
2492	MsiExec.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1192	icacls.exe
2420	icacls.exe
1552	icacls.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\en-US\RyukReadMe.html	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\fr-FR\RyukReadMe.html	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\RyukReadMe.html	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multiview.xml	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Dawson	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Pyongyang	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\RyukReadMe.html	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\RyukReadMe.html	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpclient_4.2.6.v201311072007.jar	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\time-span-16.png	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\WET	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\RyukReadMe.html	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jmx.jar	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Bucharest	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\RyukReadMe.html	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Louisville	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\.lastModified	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\RyukReadMe.html	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kiritimati	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\HST	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jre7\lib\accessibility.properties	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Chisinau	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Toronto	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Atlantic\Stanley	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI6656.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI66D5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6133.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI63E4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI659A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6667.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6763.tmp	msiexec.exe
File created	C:\Windows\Installer\f7860f5.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\f7860f5.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI61FF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI627D.tmp	msiexec.exe
File created	C:\Windows\Installer\f7860f8.ipi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx\IconHandler	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\DefaultIcon	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit	msiexec.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
3052	msiexec.exe
3052	msiexec.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeSecurityPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1584	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	31
PID 2088 wrote to memory of 1584	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	31
PID 2088 wrote to memory of 1584	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	31
PID 2088 wrote to memory of 1584	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	31
PID 2088 wrote to memory of 2804	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	32
PID 2088 wrote to memory of 2804	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	32
PID 2088 wrote to memory of 2804	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	32
PID 2088 wrote to memory of 2804	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	32
PID 2088 wrote to memory of 2064	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	33
PID 2088 wrote to memory of 2064	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	33
PID 2088 wrote to memory of 2064	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	33
PID 2088 wrote to memory of 2064	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	33
PID 2088 wrote to memory of 1552	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	34
PID 2088 wrote to memory of 1552	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	34
PID 2088 wrote to memory of 1552	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	34
PID 2088 wrote to memory of 1552	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	34
PID 2088 wrote to memory of 1192	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	35
PID 2088 wrote to memory of 1192	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	35
PID 2088 wrote to memory of 1192	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	35
PID 2088 wrote to memory of 1192	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	35
PID 2088 wrote to memory of 2420	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	38
PID 2088 wrote to memory of 2420	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	38
PID 2088 wrote to memory of 2420	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	38
PID 2088 wrote to memory of 2420	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	38
PID 3052 wrote to memory of 2520	3052	msiexec.exe	42
PID 3052 wrote to memory of 2520	3052	msiexec.exe	42
PID 3052 wrote to memory of 2520	3052	msiexec.exe	42
PID 3052 wrote to memory of 2520	3052	msiexec.exe	42
PID 3052 wrote to memory of 2520	3052	msiexec.exe	42
PID 3052 wrote to memory of 2520	3052	msiexec.exe	42
PID 3052 wrote to memory of 2520	3052	msiexec.exe	42
PID 3052 wrote to memory of 2492	3052	msiexec.exe	43
PID 3052 wrote to memory of 2492	3052	msiexec.exe	43
PID 3052 wrote to memory of 2492	3052	msiexec.exe	43
PID 3052 wrote to memory of 2492	3052	msiexec.exe	43
PID 3052 wrote to memory of 2492	3052	msiexec.exe	43
PID 2088 wrote to memory of 5956	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	44
PID 2088 wrote to memory of 5956	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	44
PID 2088 wrote to memory of 5956	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	44
PID 2088 wrote to memory of 5956	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	44
PID 5956 wrote to memory of 6964	5956	net.exe	46
PID 5956 wrote to memory of 6964	5956	net.exe	46
PID 5956 wrote to memory of 6964	5956	net.exe	46
PID 5956 wrote to memory of 6964	5956	net.exe	46
PID 2088 wrote to memory of 6576	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	47
PID 2088 wrote to memory of 6576	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	47
PID 2088 wrote to memory of 6576	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	47
PID 2088 wrote to memory of 6576	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	47
PID 6576 wrote to memory of 6624	6576	net.exe	49
PID 6576 wrote to memory of 6624	6576	net.exe	49
PID 6576 wrote to memory of 6624	6576	net.exe	49
PID 6576 wrote to memory of 6624	6576	net.exe	49
PID 2088 wrote to memory of 6652	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	50
PID 2088 wrote to memory of 6652	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	50
PID 2088 wrote to memory of 6652	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	50
PID 2088 wrote to memory of 6652	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	50
PID 6652 wrote to memory of 1548	6652	net.exe	52
PID 6652 wrote to memory of 1548	6652	net.exe	52
PID 6652 wrote to memory of 1548	6652	net.exe	52
PID 6652 wrote to memory of 1548	6652	net.exe	52
PID 2088 wrote to memory of 6588	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	53
PID 2088 wrote to memory of 6588	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	53
PID 2088 wrote to memory of 6588	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	53
PID 2088 wrote to memory of 6588	2088	5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe	53

C:\Users\Admin\AppData\Local\Temp\5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe
"C:\Users\Admin\AppData\Local\Temp\5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\SplDmMuKflan.exe
  "C:\Users\Admin\AppData\Local\Temp\SplDmMuKflan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Users\Admin\AppData\Local\Temp\UDWAuuwqDlan.exe
  "C:\Users\Admin\AppData\Local\Temp\UDWAuuwqDlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Users\Admin\AppData\Local\Temp\XwsjXVhxmlan.exe
  "C:\Users\Admin\AppData\Local\Temp\XwsjXVhxmlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:1552
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:1192
- C:\Windows\SysWOW64\icacls.exe
  icacls "F:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:2420
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6964
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6576
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6624
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6652
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1548
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6588
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6704

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 86F381A4C0C149D900D7AD435751AA4D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2520
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 850893F8965E914EF1F4B15C34E8B256
  2⤵
  - Loads dropped DLL
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Windows Credential Manager

T1555.004

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.RYK

Filesize
22.8MB

MD5
14bcf06c32561316382f703270c54ff4

SHA1
d1e34c6bc82e7292f6176013adb2e996c78d6390

SHA256
75968864a85227ed3bdc3132421d0008796636daaaebd894814db90cd99bd04b

SHA512
b71f7056ca67703c57f6eb446da4ccecd11fb540da90163c0141968b766d338775041748dd0e710d4f1d566228f136623fd8206baffdb261ad95cc186309f070

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi

Filesize
23.7MB

MD5
20aa770c8435bc6b702e1bfd1f469d73

SHA1
c29c3d15ae7b7f7ef1a04c187be6a1dcceaab3df

SHA256
8dd64998fa630e25840e710d768c3e4a6fd830448b3a4b16d017e40602cb6b9c

SHA512
89ec00a3f15131db097e75ef8608d760fcdd90e78013f0b5cdbbfeaafd2c32a2d66f1d82dbfafd0dc2fff163007e00a3092b19f38988e7f7ac95481f960c1ebe

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.RYK

Filesize
17KB

MD5
88b2a4299e2f16509b03a2f920069313

SHA1
a51474cf429d0de31db0d1bb78164f056c5c0d63

SHA256
795b09ddd036ee5be3f020004d83bd17112ec935fb5ca6bfde0159133494b8aa

SHA512
45b33bfd9d7eb3d5167becf6d9c66299b519667e09ba68718bfa1cc20ff4a143c8495ba0f949a0531bdb5ff97a8dcba347922c19ba89cab076ddf7c553df5970

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Setup.xml.RYK

Filesize
31KB

MD5
0197a4260935acf25abd1d4080301379

SHA1
6ce96c89e82189373a280a155993ac1127d4ce31

SHA256
70957e3f9d73094be74a656e179db8a1eebc24f4cb08f7b2d00c4238c2b93aa8

SHA512
a7c856c590e53bb670a463d974cdea37df6e0c93b03a0f6ef359e06690ffbb6981ae0087388ba7fd837df5f94cf6834925a947c29c19d8b229a4d71c8ed34555

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.RYK

Filesize
699KB

MD5
16dd6ef8d531f95ad1463e3b1512cad7

SHA1
663d441905309bd9bb224c9d54dfec368b1b6930

SHA256
f837ae59ca386a0be3db77b394c20e70aca31daed882cc6b4ede192669adde3f

SHA512
b74c039f8d664e029c758a11aed5c4eeb1fb586c25dce06c3b8c357f5eb98f61e7cfd6df4fa4ab93e5315c9ddd812d864c62a5da76efbcd87ec1e29959289715

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.RYK

Filesize
16.1MB

MD5
f0587335173c6bdacac1be929102a402

SHA1
fc3442cc5875ef80da9cab5aaf6827b6ec21f7d0

SHA256
b7a617e5011b30c6e3681639df5283a44e081088f3e20035d5937158402cbd8c

SHA512
f0b7720c7dba99b4e0c953deb6a927b8280150806b50918ab963d6fcd0eeab55b506765062f112141a5f4182b5f79073d64d1f7cc5a8df52a9988afdd86d9f33

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.RYK

Filesize
1.7MB

MD5
516ff8afc5f7f9b90b49fc1ca7458c33

SHA1
8ce6104c5a7cbe011ffd10cf1a54841df8712276

SHA256
5502dbb7ba3510e4e05e5ea61eb45ed8bf0d17af38db35703e11628c3238cdad

SHA512
bf08484479e9ff1cf404c44d6f0bb6267a4cb2618e42ba59367936913f81f2a763049b739723bfcf12f726307bd30e555a8266a0e83ae07b573691948b71249d

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml.RYK

Filesize
1KB

MD5
29dc5be665627978dcbf6a18a76673f2

SHA1
66724e721166a51cab1eae75857294e0faeb58cd

SHA256
1ac9fe4c8264d41bf305b29e388bb089b76d0c0d56d68f3589a1f2b7963bc13a

SHA512
7810ba13d89f660faa2c6b440c790bd1a5c7031b69b982af56da25b2db0b05d0fb5e9b72474300fc2982aa47c6ad118b7cc1e83cde747c962bb65de6c1ed0b77

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

Filesize
2KB

MD5
a6d4a4e2d660484769c9194651c8b0db

SHA1
a4e8abba8fafa6b4ade7a77493932f09799137e6

SHA256
c8e02391ad650da25b4f05c2c09af6e1df4c983bf88c8c3d431423a5b395312f

SHA512
8607f4926691531c7150385a5da6def64bd995838490da1622be983caaa16b81b09c5d5a90584b4170a7d56050c70bac9a6bbdb62e1c43e5b04dd5f0b3e6a6e9

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.RYK

Filesize
1.7MB

MD5
b12d2899fc1f5b0305fd404de9c930e3

SHA1
e1c98df6ef8b69bd71e958de94d7df67c13ab4ad

SHA256
c1c2f54ca4164c4a11cbb029ed33c185d445458e78726c93a2989406c084f9a7

SHA512
c0befa3b4b7b80447bd86751ec963cd8f7972d32611e163579d1d085918999ec89c888380f119984fbab46279c3c24d8c7d5a8a2a44ea259e3a56adb1408a25f

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml.RYK

Filesize
1KB

MD5
b1a1f8654d15597453c87503692329ea

SHA1
d6f0cb2ac287b17da60070388e7015c1740c287f

SHA256
de03344a8a584f73a57b5e2c661f62f0f3c2537b7d2af7b7dbf55e16aa24e32e

SHA512
c91db0b58952eb3fde21bf2137721f37dc7802716eac85dfe7e34d37b7de8f379dd6641500cffd939d725cab13e75fd350408a5a188ddd9addd347441a1ec477

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

Filesize
2KB

MD5
c22d5064089962882e7a2da04af1e807

SHA1
cfa177e0f18b9825a67fcbe95490589e6028468a

SHA256
8afa16a22c1c0160e371386a16a5f918eb9febcbb8c2187bed31c5a9ef3cb8e0

SHA512
3685ef091609a040bb42b8c4e723ffbcc32b20a20c2a90ec9294e28d759f736757ebe20e03ccf6415618dbcf08197ae6b0bbc89adfa0f2be9cd0f124ba03b674

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab

Filesize
9.5MB

MD5
9dcc4245ef73ea27adf06da9ad49f697

SHA1
809751967ef76831c41b8f31bd3a3e0336cd83f6

SHA256
fa705e52caf2ee0d1b8bf1446aea3f62ae550ef7a960bf2445a3715085ee6f35

SHA512
17f0f90f9449dfd23d06e08d1db098891cfd00d3d5fa9730f8a3c5f186f644a2ba1314b2990233bb507416aad345ecdbd6a0358c95bf919bf22362f2d86e2101

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.RYK

Filesize
1.7MB

MD5
2546a7649aa64e090f7263ea3c5920c8

SHA1
dc85df44a329e0bb3154c1788a2e65dd57354ef5

SHA256
a9ab6f8114519d0191e3f905d8279444868f35d713941c9fd9dfb656282aae93

SHA512
69909a51fcf4311e55a289d21e862c2d9e88ceecf00c4caffa9aca1a4fc5ccc9e2f491e03b91e65da01bfd3774008d1fd02be00d5c8d69c90603c660221afff3

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml.RYK

Filesize
1KB

MD5
2e1d2704c0511b6e915ae7e6cc4d6e60

SHA1
24fbd4d8de0abdfef1c7df55fd28aad4e065c551

SHA256
fc94df0f8b2dc31c83f8d6f5d986d82a9b57e966063e717af1d0c8e2a24f17ee

SHA512
dc0037ce6626b260f0513004b54c43674725f63f47191001d1661950193cd67defafcf358d7a8c7529b13c446cc26fe36f41b6f299f5318ef04d0a860f742fc5

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

Filesize
1KB

MD5
67aa3c81b6a328b2b4557d417ea5d2f9

SHA1
cb316458b85e753894e82aabaa038cb0b27850e2

SHA256
12eb3ad4276453ed36acba772756060657d0c8df2c9bb5099db6fd818502bdd2

SHA512
960d08b4a2ab2119cdc87796c7dd1a58c85b89462af054ac23ae3ae09c1b8c6d1c80cc6f121b3f6984149553d4086535378766b65b288c02a5a17c1ac2a988a5

Download Submit
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab

Filesize
14.1MB

MD5
f5617cfaeb68740fe57a54e10ab692de

SHA1
ba2fd7b356116d885321b5d135e6c97b8f6ac113

SHA256
f63d9cc79829b7acd0eec420a082030f8335a091137e9c7dcc7c297593b77796

SHA512
9f2b71f462e27140b096f6735c894bceabaa8a96d454b7b53c5077a5b71e4d52b44ab4992808d9662c0f67f0589797d8360198d84015d6dc6a1158a8a5c74ece

Download Submit
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi.RYK

Filesize
2.0MB

MD5
176c543666e8188d489788d864600ae0

SHA1
e2faa4818bdb5990ed7a3081e97101ca79a967bb

SHA256
736641f5db96de42e75b0986624312a72dc16191f1d13ae3dee97a640bad919c

SHA512
bee0f391721156193ea6414994c37e4d6b9955367cae258b25b28152c05db0503a02a1662df63254029438501d45d1044642ecc2d936aad34c278744c42f70c1

Download Submit
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml.RYK

Filesize
3KB

MD5
5919d66553d656621aa635dd5c241c7d

SHA1
2171a81df2163e42616b7fb4861ed1b25b8d2883

SHA256
567e0422702576fc591fc5f3da7e5a2b873b42e53e1937f2e01dcbb7265a2c1d

SHA512
5dee213e71a2b94806f0bbfd7ea3f357f47d033f803a19cba96e4e210d9ade9f13fe5f6e5fce56a545506c939e17ea4ff7f57131a0626b21fb4201a0eb949fae

Download Submit
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

Filesize
4KB

MD5
e0865af9656c2263295b32af2019000a

SHA1
dc257b69db6333298b5f635ccfbaf3b1dd74b529

SHA256
eba9b9c627ecd37257775509c8d1a65e8d7a339b1a7746772a1211c84f1e7547

SHA512
449a725f19c7b79c16640ddf2aee1624cbc0de58d93d712e48716428364890591b4b1bc99eddfea10606b2b2e27eea686637fa12fc671d8949520b4b4fa8e511

Download Submit
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

Filesize
2KB

MD5
972e29372cf254a2428d266b0a6c46be

SHA1
2b861d57554ef1860ccf25fc293c53994b6a737c

SHA256
672e4916770fcd98aab09e8404a21843a4c4831378109c8875eb30bfcafdbdf5

SHA512
44c01f1cd3a29014cfca4e62f41b9048b86274323240969df6c6fe3c2b686929642211632ea2b21ee2e4698eeb56b114fb4b3e2293f86efcade75f41e7ef0df0

Download Submit
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab.RYK

Filesize
41.8MB

MD5
4478501dd86671beaebda66e576a8b54

SHA1
013829c1b25080ed94c71170476c6e7f715064ae

SHA256
9672d26f0d667071f4e6640db5d70f27ab0ce7861073f56e1c9eebb3aedb14d4

SHA512
2ff92e6f15fbbda3ebc562054813b5030d6e1bc0d8795bb11839404c0fb4e979fabe1371f0389c6224df44411e38c6aec3d7071e5cd3c1b896da7a83e8fe51a0

Download Submit
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.RYK

Filesize
1.7MB

MD5
fd9f49f231979ffd8fcade937ac1115f

SHA1
b99d875d354c89a8d3f8a10eba51b4e291842c02

SHA256
b3d34623bf974cbe17887a1349a0b1d5c7bb812e4e06a79772e096526a5d658b

SHA512
f50a0d01b8d6e28c5fd6c49a0246e48d7ef08b2192ce86e577da208d3eda4fbe6024e501de4866216b8eb1e6db82d8a0169165f366a78f57c909f2fced1b6643

Download Submit
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml.RYK

Filesize
2KB

MD5
77d825cec297d9ceeaa63d24545793df

SHA1
144f4dabbdf057df944381631782db58c39f5d7d

SHA256
eaaf38eb35fc23201ac8ab96b9d6dec3a3ddfedeac2af9ff14ffff47277de692

SHA512
574df1017a2c92b6424e6878c6c7dd8267d458756e1bc8805cc57298b23b9809b9b92abca17a69903125c2cd3bd5298eebe9fce071ff5d976995e5e7f2639db6

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.RYK

Filesize
10.4MB

MD5
706c4c02c4780e0faeea38e7498da581

SHA1
d4bf25c786cfb1bed129c5617f406248d6619e79

SHA256
afc46fae672960b96090e0ef6e91a3de1948ed84b886a22a806679781c3f8c80

SHA512
de257171c74c0c31987160c7a314a0e209d62a6eef81546e1f1946f52a5517a97f8cdd44d5b481aa72f50c3c21dbb58502e81971931c31e04b0054a2a1e950a8

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi.RYK

Filesize
641KB

MD5
c4574611f6e0e29c0e414892fb434f5e

SHA1
a561d368233dc6142279d8d38e2474daaa5098b9

SHA256
07dbbae178f89443a78bd0db7d3dd9e3bada0ef98b67188a912ef4f97176da16

SHA512
74cb95051543da89d7c6ce9fc95f95060a081273e6ee5aa3c8429b5d964e1084467771fbb61620b8b4b19bf68b7a1f9d80a00aa8661cbe022b9f3975ff8930be

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml.RYK

Filesize
1KB

MD5
c8cb5a01e4dadff32eacc702bd952987

SHA1
c757aca4d1e2b8470181b03131dd3df5962e38c1

SHA256
a80b74f86bdd0d10ce383cf25c6c0908b31693a4664eeded1aa8948fb81272ed

SHA512
eeaad1adeedd07ac63a0e9fe2253b60d24c38dacbbbfc3b3187f6f57eb6a13fdb8333d8bbce73778fcb2e741f1e863d3b69ca0dbe349ab0ecfa93cb6ef12fb4a

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.RYK

Filesize
12.6MB

MD5
49eae6e978d02e45e2a27f52fe73e906

SHA1
389502f72eaabf160e6542f8dfc8aa6e8727897f

SHA256
23195594edda4e32ded7865d304af429188f8e1fcf6bf8e3fa2866597d9efd43

SHA512
2e940aeddaef5a2ddd3c41d0fa05dd02d8aab7b3e915c17131296841f067323a292b9da30e23ecb273775c1786c11526ca4debb42f175fbc020f4cfe32500ec9

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi.RYK

Filesize
647KB

MD5
f32664c3bf63845b8c3978167dccc2c5

SHA1
5911a88e7b11c9656b262b8ea2846fd1f783dcad

SHA256
4940a524d58c67687a30f98a7ade1203b65309c3bf5b81e42dcb5323f77aa09d

SHA512
ddb4106c4871172a1e9beef7657729019eefc5a802ce8d55a52f0c1da9b2caaf6f0ef323b31a007bc677ce113823f876e4563944e2ee9e1d13e507f4d13de950

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml.RYK

Filesize
1KB

MD5
9937543c540bafcbc56fc38d9b5ac1db

SHA1
d791f1fa28677a4212af9a65123f00f507278cf9

SHA256
92f90fb92005ed6f313bfeaebfd1991f3f21338f100f9110f2fd4383034f527c

SHA512
88154dd8818a1e137688d54dde30139aa97e47da8ad6f6c0f61663bb084ea8edb6f5a158217c20c5d2bcf1c378b2dd556bb10dbb880c9a9e875c896bbcb9d312

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.RYK

Filesize
19.5MB

MD5
217d2c56a9a70be85a5adc88146e4397

SHA1
6d5161b813ac866b0ebc233a12be0b0575bfaa3a

SHA256
7b63b22e2853c2d34efa2c852470fef859b78a4d682351a7de369ce0e9e45043

SHA512
d254e71842d72988a9b1f6bea7ac56c7303f01bf796dd72a801f741ad819f63994f57ad8610859424b4667dab382dad22f2bd800a27ed134aa9345251d1f7e1f

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi.RYK

Filesize
652KB

MD5
ee934e6523348566631fbb6d475cb62d

SHA1
04e90142a146d2d849663225430298e434dc3f4f

SHA256
4e244fea5514444ffd309236475773e674ffd8f872cd42712e6a8da989f864c3

SHA512
3fbf58de2862d4210380da47e4d1fff96e5fa2278ca7596b694445ebf63b7abe5c63b88dffafe9aa022a68d052cdc7c6bc4319b383e8b80c2432442098d639ce

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml.RYK

Filesize
1KB

MD5
3f09f1c7b9e9dca3937794ed2400522c

SHA1
ea87a9171c5c81865527f0ef378f60ae50f04319

SHA256
175c0d6ca30a7e26348cefea30e800671bb88b40c34a78396a2683d72d07f615

SHA512
fb4ee5d48fa165b92a5ac5a7b338a3cbe705700ca76749ebed1741796dbc41c5a45d7cddb93a753418a1f49fb5a022b78a0232f2ae070d7bffa563942284ef94

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi.RYK

Filesize
635KB

MD5
5eae1e82811706bfb3a4bf987fedf965

SHA1
f0bd97432b6d7d1ba316addc6b5a2485afdc23be

SHA256
0f8b4a839e1e52f9e1e331ab32f136008218c704e83189cc20b13b5c32a490cb

SHA512
96e442c5008db17511c929e3a91f553e944c2d4e1f5907e6c108c7ea50a42ea7a2a07a216ada9fb8f025c80c09a2d286b723bacf4b9e6a19db43c7d310749434

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml.RYK

Filesize
1KB

MD5
fb1d1983858b5c9a7724f93a4e5566cb

SHA1
ea729e8fb9a442afeb970fc8601bc3f2df01d5ee

SHA256
1439ae83c507cf575c5659311f337be60a9e8fae6107a3f90cadd163593fe284

SHA512
ec08a02528e0a74868b7923e74742da2ae5958944844bca71f99476da911fd4446918b0eaba00ce5ff203687012fa7867e8daab9c72faed9bd0708603c2be64d

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml.RYK

Filesize
6KB

MD5
b6a2831a3aeae3048ca1e7546a8df1e1

SHA1
880ca1dce2c0547b6d90b322e13fe10b3789439d

SHA256
331982a3a5c97e092506cd2fa46df2ecf69b7283b312618172b078aa2871397f

SHA512
ac7dc7ee296fce6f0ed8d79bb46dc9270d2809b9d678a5cf001ed7df424b7d312b2b28e1baf460f90c1fc2dcaf3655a74a3b88a7ef6514a68c4f9db94e99c6f4

Download Submit
C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata

Filesize
754B

MD5
35909dbab50988c8a934443cc7660771

SHA1
7e83a2f955464e5ec76b8e45a296f67614fd8db1

SHA256
194e4872e122b28d72b411ce820298cba37f3afd58a9ec7c1af28e552309aeda

SHA512
a3c91425a83b7373bcbc499310be01bc45764f52b993038ad383f676530ae1e8a06691e60e2b773e18d034e5c08e8e1de1e00bbd7f3124563a2ad47e6c073cc6

Download Submit
C:\ProgramData\Microsoft Help\Hx.hxn.RYK

Filesize
674B

MD5
053a29c632f1efc87907e8bd26fcdfce

SHA1
9aaf950b3889c585322b9ca2c8b158c080b49962

SHA256
957721f9743129868098b7e137c7f622d528ce112cf8b6309187fb44b0639e51

SHA512
2ddc448fa29aa03c8ba1db71ea4c8463fd22d6c12f9922f8e66c98af1d14d58df8c4c5cc3fc790f96692b3080b57ed244b41e5e6e6e3454454d397267c53cf42

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MKWD_NamedURL.HxW.RYK

Filesize
13KB

MD5
0998155760ff7032d7cebd9b1d537a10

SHA1
49bf6f929f3c4441fe9fd85601d7567ee904f3cb

SHA256
4cbe50d8e972f3a0eba9da78f88bafe02f5dab8c87742c4372d3b2b5e563aae7

SHA512
7cb42d8aa05ecdabfdfe3368348e99828de746ea98c8530a754521885d0af99ce03409ea624913cd4aeb4e3c7392bb4a5afb878779452fde35c5637997145ad8

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MTOC_Hx.HxH.RYK

Filesize
10KB

MD5
f3449e2e6bc7ef0796dfa5eb78a920f4

SHA1
adb266d2c636053642783c9f7e6302daec991041

SHA256
020a79d2559030cd4cff756b3c5ecece57641622fefc43c8b5bb3c470c95bba5

SHA512
e87e231fe0eda1f5c93ce84e655eed3a7bd643e7eb244b8c3966f2869ef77a9633a750a421ae8095c076cea3ee80ac2ef4d5b9e3e01f94699d60bab858528204

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MValidator.HxD.RYK

Filesize
9KB

MD5
101ea4d96ddefc94e88d24d1930f62ee

SHA1
7a213e3c81837e1c81e4cb8d289b8736a9e86800

SHA256
e68ba433eeb4d2435d9afb33295d685bdf8b82ca1398dcbcdd055837daf297de

SHA512
65efebca077a949ca1ceb8a64085c94846696fb52cc410aa254e7f2b567fb8244d6954ebb9344af4ae3816d40145f14f66b4187e4d4dd59a65f3a8190e3d7e3f

Download Submit
C:\ProgramData\Microsoft Help\MS.EXCEL.14.1033.hxn.RYK

Filesize
626B

MD5
c56e15fa8653c7543a6ab9aca2ad0416

SHA1
4753fb3ee4df7d030b6fd6d52829ec73e975a49d

SHA256
eec108b8da0c586156e4659678e412b8d7716750d94a7f701f9dbeafb9260729

SHA512
20c25b9bd3d2d50c6cf663b12b7e46880241b55c10698eace9e7951624d9d36d5819425cfae9d933ca0d256f3fb4e0800557a0db73b7084da27022ca06437321

Download Submit
C:\ProgramData\Microsoft Help\MS.EXCEL.DEV.14.1033.hxn.RYK

Filesize
658B

MD5
1d223c568b38217895515dbcfa89f3ff

SHA1
36146595fe425f4dadfacc9484c135402a16fa6b

SHA256
f56687536bf33e5229bc7960720991a446c8393b10eb11a134ad59b96f306602

SHA512
23737ba4f1c630a8aa95295ee8323de7e7c3628d37dcb14d49ea36454b2dc9165f3f1b46e6d4adf944180b4acb363148d7961385cf49a39837bfd770ec154bda

Download Submit
C:\ProgramData\Microsoft Help\MS.GRAPH.14.1033.hxn.RYK

Filesize
626B

MD5
2802401d80782db4a31b6f64c2abfee7

SHA1
b78aa4c281d2dd3f9c2cfccb4e3a043766dfa5f8

SHA256
a271e6836f02ad87771cb9cf648f4f0f763a415b3d34a63f587df9ea4c820e9c

SHA512
0b62478d087d1e6f20cb929e3de821a6c33bba07422a15cc7d88e3ba99abf281e76db0fb34f4daa79b2f82b676592a277ef165fa4939d8ee900ec0b5348185ff

Download Submit
C:\ProgramData\Microsoft Help\MS.GROOVE.14.1033.hxn.RYK

Filesize
642B

MD5
89d0eac9fe1aac3cc3038c638d799744

SHA1
d8e8db7c7750493ff76a10426edac4f20cede431

SHA256
69f2a4d8693caf14749eddba1e72b9f93f81d1b5a947e51c0dc6895aa9ae6ae8

SHA512
4b5c0090e19e9ef87a1678a1081029af712cbe67faf24c233051326eef5dce0bd10551f5db946c300e4399f2f5581fea5a652ac74788e4325e56f7b4d9482755

Download Submit
C:\ProgramData\Microsoft Help\MS.INFOPATH.14.1033.hxn.RYK

Filesize
658B

MD5
20478ec0ee9b68901eec8b0a13fbb7a6

SHA1
3f425441e42da646853d5a632349baa92bff6962

SHA256
c2685ca4a3e88ac5eaceff9cfaca01ed349b8ae6b4b796cb95b4d42b0b9a43d4

SHA512
9ffab59ce57cd63d9c4f52340e0b29f0edf4566f460e55d1c58269686aa40df81b917605a13c5c9f9cbeb0839d87dcb6ea71019fa2678179acccc6733934639f

Download Submit
C:\ProgramData\Microsoft Help\MS.MSACCESS.14.1033.hxn.RYK

Filesize
658B

MD5
6115522a73c8b166c1df58b1e1f2f532

SHA1
7cbbce62c5444c7703920c3ccb64b97605030a8c

SHA256
3fe1ed99c11e91802a87d02685db6d02e7c2636018f5b2d5a2e9cd5888a3c929

SHA512
46a3893901aa270b8ebff5debbe49f03028f265ea2a953283f6139d5aba0536c4f43eaf00571d94ddcdd57cf0720ffb252a1703622274ffe37459ebb9c7801a6

Download Submit
C:\ProgramData\Microsoft Help\MS.MSOUC.14.1033.hxn.RYK

Filesize
626B

MD5
ae7b597b08035690b0fcb93d33b9d775

SHA1
8d518bbf1962d4733723e9a655519ae6e60ca6a9

SHA256
769462ee04b2bf22d7ef82bc26edbc79ef8c66878d07b3ca067e2537a7e8ca07

SHA512
dcf7e04b505ba8a1ffa386f1021016b2f8429d90e549242787487566fa6f65d9719a7da4f9bd15daee7961bc6d7c10a66224e827d79d9d50055255ffc380c152

Download Submit
C:\ProgramData\Microsoft Help\MS.MSPUB.14.1033.hxn.RYK

Filesize
626B

MD5
35d4a029c26a1eb1401a79a440d23600

SHA1
8c0f2f4dd59dd8f2741d99c0c3409b6ab072bbf1

SHA256
748da9a7ede3402b6b6c6f95113036da74d20e96f1c897b38b3b101eece00a8a

SHA512
58f5b807e9e3056753fdedb0d8c6d08dc072448ac2d5360d3b6632c2815e5deb5f82a3d06c482e3a475921e2cdab51c55bd0505e969321e65ff0d236488e378d

Download Submit
C:\ProgramData\Microsoft Help\MS.MSPUB.DEV.14.1033.hxn.RYK

Filesize
658B

MD5
7589c1d8c23d7de4b658def3ee719a0e

SHA1
fd5566f576cc81473b135774265562381c70286b

SHA256
3b766f9ddb586eedfb83a7a450bd5a530c0f691f2edfba5838054900e32e82d3

SHA512
88387e2d26da910977ef63c0be4bd0c049826331a69d89e1b95df3d4118b5889466e91634c3bf3f4eb096b0b8d7b6cd6ecb3b46f99b137f41ef6ea94137c3c55

Download Submit
C:\ProgramData\Microsoft Help\MS.MSTORE.14.1033.hxn.RYK

Filesize
642B

MD5
fb8b045de632c4511c031d1d41678186

SHA1
3deb876f50ec669931a4194e34f30a1a745ee57a

SHA256
994beeb0dfa9a09d500b240105699200730d10750a06fafd103e7c442b63b74c

SHA512
1527007fb40752af3cba84cba26e2b431c30212742f2e2332a68e41fc60f01ab7b2ff358a6f3892d86e762407d30d97686ed911436c12c34839577b6eea11126

Download Submit
C:\ProgramData\Microsoft Help\MS.OIS.14.1033.hxn.RYK

Filesize
626B

MD5
4211211d1ebab9622a2826af1e341f2d

SHA1
f31b790727f5a10f3d27dcd2422dbb1dd59a9f85

SHA256
8796d1477be707f21daa0455bbdf28c383244998b11cbadebfca59e48a3bd3c0

SHA512
f404a5e2ddb7cba1bcd0c9ab812d597b7717d8f300917922a66e2fc75fe5c59890ca46d41a56f08a20e1d96928d66781de1e1df1412eb243e9d22db695908255

Download Submit
C:\ProgramData\Microsoft Help\MS.ONENOTE.14.1033.hxn.RYK

Filesize
642B

MD5
dbf0743c9b87d095e57f273eb16aaea2

SHA1
f466c517802bd6f3a925764d6e1b97f41c694bd2

SHA256
09748f59dbfb1f3bd1ea439e9f070d8fb42b2f3e9cc0e39e887ae64c599fc54d

SHA512
24c0de0ffff5f89f57ec340df82acab735fc2d389948486fb13abe7fa6899e21cbb7482aa049f815138741e7735455373009990581280075a6c46e1c64f78fd8

Download Submit
C:\ProgramData\Microsoft Help\MS.OUTLOOK.14.1033.hxn.RYK

Filesize
642B

MD5
83f74b021700ce38949f2cac6b4a4cf9

SHA1
3e0756c374f67108ecd4efd5dbe9e62a2f753a22

SHA256
820f493575b85b259feb4a3712b2c2de8807cb22fdb465ad2f7f313d50114a98

SHA512
b05d1cbe54c6b523c3300d3989b3bb3019781584902984fa84d35de0da95b2f98709420375315fbcb9688e27c22b78c798247722cfa00ae043c7de9b63303f25

Download Submit
C:\ProgramData\Microsoft Help\MS.POWERPNT.14.1033.hxn.RYK

Filesize
658B

MD5
588040443ae8ee4ce5e84f2055218b7c

SHA1
69709d3cd0859f239217b49eb6d806af3b1e81b6

SHA256
db2d83ac14bd8c834755c9945a4c8bec780aed38c5a626ed1f3b28694af4cb4c

SHA512
8456d371526be8b54082a75f5cd1519e9fe9e494e59dc1cfc672e4f32e84246a6cae5d1ef443c1d45d9728dcb21306427fdee664504821afc0f0b1fdf2bf9fbe

Download Submit
C:\ProgramData\Microsoft Help\MS.SETLANG.14.1033.hxn.RYK

Filesize
642B

MD5
637f49588f5b7c1819d12c6162d83b81

SHA1
4a9240348dd25b5ec7113fb2033bf633d0c0116d

SHA256
36b0f0ada2364d26553f650e318b9cafff89ffc6c36f8a9bbe1fb15d51b7694b

SHA512
d08bb60bb8defed2498a783275905f4b11826dad63904dd81b201240774bf5a4c955d29e465ea212440199f7c64007629ea0a03c01e9895b914c0b86fbefaf0f

Download Submit
C:\ProgramData\Microsoft Help\MS.WINWORD.14.1033.hxn.RYK

Filesize
642B

MD5
a428b181ee47f785adb44724bfac9e93

SHA1
949dab4ad91a72ed5e9c5a6ca1dd136c15204d0d

SHA256
8d8d518b1ad69a6fe2736dfc3c02b0aa8f3c8de19cc11f9e3c87c30498d0bc30

SHA512
e7f4efab9b4fab5964a1fd5962b5043704bf371a4ee883f2b37a17dcd49fd96cac11830fc6ef7d8850203c3d0ac550ea456ac7faa064444be9d2bbc433c13100

Download Submit
C:\ProgramData\Microsoft Help\nslist.hxl.RYK

Filesize
6KB

MD5
c0a0b8b6ff4c0cc22d538efe98e29a13

SHA1
a26b1a7e00a2ee50330e07590c915288c5e6b836

SHA256
6c9acaba9cecc4a62600213eba772e03d15e3228ff44920b5e34d2319b127e05

SHA512
228e5417da926706d9900765a0c0e8e898689a8dd8ee0d7780b11389341833634942b6e32d77be179a3eed72706cf830c2eb9954dfbb6351828bb30b2f82bb0f

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_CValidator.H1D.RYK

Filesize
12KB

MD5
34a74a043bcc0440246c78a0d98c906c

SHA1
530a32187453afdcd21b6a551188b8860b719a65

SHA256
f28e283928b9b420596958dbbf3d3e902b3884ea1a04411c2eab34dfbff97e56

SHA512
a0528ada3dcb9e60e84fac22e015243988f6fb1233042eec44073eee1c1e0d88bf05b1360d6dceafd90ccc54ecd588bf6640a165af84e7db9f7318e21fed6f22

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MTOC_help.H1H.RYK

Filesize
531KB

MD5
f26c0d63652e118dc1782ed0f1530e57

SHA1
af38f08c28fe8b4b8d47f91d672f581a92e97d1a

SHA256
5d89aa9dfe3f479e1b2d425f08b51affc15d7cccc5ab58d975ef43e6879d9fa9

SHA512
a7671a626940a09aba88df0d78a9d9ff3a116c066e8b29863654cb0d837cf2d8270d262030bc83c53cc712901367ba57be134f2947143396a1ff7a7b9abd232f

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MValidator.H1D.RYK

Filesize
14KB

MD5
f86c708018eb644c82e9d58a684e5cdf

SHA1
38feba683285c8d14af5d853373cf41906eab793

SHA256
04daeb7896b11e853057cc6df0c25338eba40bcb8916b0762b82f5eb87c33dc8

SHA512
bfd1ff5f70147054ae0fbe01ee00d6a54fd6713df00c818f637188545296e85a28a7196c4f632d511b91d0527cbd4cdba490b7d9b7ab837f47a8d918931da758

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D.RYK

Filesize
12KB

MD5
df088093f75d36f3c64916ca7e9b3141

SHA1
a294c0b5522a17963593253a08becbf57c5f38ff

SHA256
36e7ed560d7ed36676698d1ec258e7cd4d0b1e3d311335d31f88e4a0288e1318

SHA512
445fe9b97663e51631b4f624494d1aa783b96015876f31a8bb610d244f2a520db0b88898a27f979588e4226ad8adacf4769ae5e7bc86011475b77ce123e66374

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H.RYK

Filesize
491KB

MD5
1fe85cb1242fe4710ed458a0f6bf6e19

SHA1
47e8ca95b6de29407a095c7cd04e9a9ff6d085ba

SHA256
cc87ec72b16a2499084cb92d1ce2b410896d020eed4e537b0daf5ec280baa3d0

SHA512
a4530b2fcba684edb901d52bbc682f9aa567ab7002cc6ee82ffa192f629afed3dd881eb03ff3e78d87173b442d9a757805016be582dcb523f2c600112d68db00

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.H1D.RYK

Filesize
14KB

MD5
e638dd549b6e9e308588996bf3d13976

SHA1
da5d8b0438ee91f059362b126e8181e45f6d4d71

SHA256
f20e86ef53f687785e1fdd30113fccf208eff12b7f282b941d419be042f5aa57

SHA512
652572da9dde1875dadc38d695be1b1e6355761947ac8a2b1f7c121b12a78358b9f13ce5d5310465a3f245ddb3ac166917eab7834db6e6b3443b0b982d8189b0

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_CValidator.H1D.RYK

Filesize
12KB

MD5
ac48be9cfcbe7b496b9bfd287046975c

SHA1
58e35d7de819b4cf5ef0bcb47697bb53c3bf988c

SHA256
f941006a57e50d87e1afa1ce90659d0cc64a0a0261285fdc4f228cfaa030cfea

SHA512
a1a5435a2985e281b939a1a3b48ddc6cb899315fc36902446dd3a5bcd3625faba936b9de33d50934c3dc00a63638458e61240e6c7d2e0bdd591012240d9c6a1f

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MTOC_help.H1H.RYK

Filesize
531KB

MD5
87a4710932342620565e01e42554e688

SHA1
7e16fd56fa56f9faea20bb97d701e1561a0db3d7

SHA256
ec418c1af9e039401bfecf6082b1865e45b4568637758b939fe76a83fcf631e4

SHA512
5e8619ea6b62267e1b93a354d35a8712c67316939dc02e225babb300194a4cc38a69550d557a6a8451a5e359456e1284506cf3c60784f1ce29142ac79ff2a329

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.H1D.RYK

Filesize
14KB

MD5
c2ba7e8719af50ef4d07c0258c788a94

SHA1
43e3b55ffe456120864daa853418da60ef16e04f

SHA256
7b0030968b187199518973d7f826de6cd3b987354a137f8896dc678ce17abec3

SHA512
fe42061bc1d026981e2fb742585d1e1163ccde76a3aa73a2f9c423e9efb6c61ca98435e1af2993f05521aff42e082bdf86a3c530d302490920b8d3debaedd13a

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_CValidator.H1D.RYK

Filesize
12KB

MD5
a6ba6ebd8c03449d72173307040f7976

SHA1
7e786e1997756eadfc3d0ad0610921997e896e18

SHA256
b1ea427eb48d353febcea82675bf28b7eac23982491a42b3b70a25ad3cd301bc

SHA512
89fcaad04fec525a9e9c52f44929e2250ee847f6626e735082e64a01d89bbe0e32339a41ff89a589de672f5fa5746bcf1ed86cfd2df0a3989b0cc04f4d83bffe

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MTOC_help.H1H.RYK

Filesize
546KB

MD5
8456a00ee89abbfab720c344d70d1319

SHA1
a76a2ecf25a636f22648d7a58f85ac787da966f7

SHA256
c2e18f54ff49469da63ab1fa70ae0fe4375960e598b54123160b890442675117

SHA512
009917bed1466ee6950dbcfae65122e28e1cc72d8f36f2004921d7eea6caac7c7b19c1aff9b63106364a1c74cd048673694df791e3a7f8216a555167de914149

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MValidator.H1D.RYK

Filesize
14KB

MD5
e9f140b89c40c9acef1a07133297104a

SHA1
afe76fa0e988a8b1835c43b265ae0f6e2480349b

SHA256
9dddfc3e632f7793b73c3359721e1f2edb8d70d37b5c0c5968494abd0f1d610e

SHA512
4c712750bc80fd75f9f929962449530cdd39b0ad8602ce2e65362ae95216b12602981ba80dcf4c37130d9ae57aab06d6120a2a14adce9d506d86e96e2f23345c

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_CValidator.H1D.RYK

Filesize
12KB

MD5
dd8a9be78257a8712093e0a5ce161421

SHA1
26c51a8fd97ef5a1291119779c8856404f2e766b

SHA256
b0b22e7b5b572436508011db02a39512d6d9815ce8b10cd9b08e8f263271bda9

SHA512
2c17dc5a653fde3baffd59d341b29a68bb522e1555cce668d02d38e9a01d74f4fcc26a795fffd55f9a79946bfee6d28db70dc2a63c253a7c8fd927ea7e6bae08

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MValidator.H1D.RYK

Filesize
14KB

MD5
341832bc689da0e26e03eabeebd8f9ea

SHA1
3a7bff1bc1a5de52d6bcfcaef4f2cc701ecd2e1a

SHA256
696be419cee55635967880898595457303bc81894ff3f8eb2f0a3f6b50eddead

SHA512
6c7cd25ace89bf7f671379403c6a5a0b4e23768ee668ad2df9aff92d5727bf8cef84cb5473f92a0858e5f82b756a1881fcdbd17e95207ff26d19ed4bc64df772

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_CValidator.H1D.RYK

Filesize
12KB

MD5
b1ce4a5f7ebefb6f75660628a4ab9435

SHA1
c949d361fb0c8125e93cc09b5868fc81c4a1f27e

SHA256
abfdea27798057a38a952cf429e63dfc3d3e00aa2bcae6c103a9e787c93663dc

SHA512
c7ee84627ed5705fcc72e2d1892131ca781ec17832249d2197f40bee08de9ca6d9dc047ab9e8d0b808ff1ddbefe5dfc112df39c0ee40c24c8d13fdc0ba5069cd

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MTOC_help.H1H.RYK

Filesize
352KB

MD5
9aad6f63931504e12fd9fdc9291ad7e7

SHA1
d864a7034b715060e316bd7ebfe34605c781dc66

SHA256
bfd46ac470b98089e371d21733bae8134e76733ceea760878c8a88d436c86a6e

SHA512
ae43b8a4837ac391b205b7946175094046f1777a708668f210604cd542b833a584d863df81af76fae18a4074d5351dac572091b17bdd6ca1921f7e0bc5a477d4

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MValidator.H1D.RYK

Filesize
14KB

MD5
10cddbbb6b1213fc0b92c77f9b9025ad

SHA1
8c7621cefed20523f09a203c5c97170ab426a6ac

SHA256
0da40998b2888e56fa864acab6fa8da72a94a347a6fb44f532254301ca4f8325

SHA512
7d7f9d5292c61341b69d95b51b9db4d7092204fb6294c0531c547b17b46204c948ce818b6e8a95ce91000c126bff8180b6428d0883d966eafca50e5805c0c467

Download Submit
C:\ProgramData\Microsoft\MF\Active.GRL.RYK

Filesize
14KB

MD5
f580e866e0f6ee3410a2942ad5227980

SHA1
f5e3325ba0b34e21b923f7b79fd83ad5f4d7ecf4

SHA256
ca9439d186b892d15da245a50baf1f45bdbda3e3c6651ac3b95acd3521ed83ab

SHA512
085fa2c9df3ba80be9ca46cfd5e259eec5a9290eb42666acbc512bbda65cc2e1b0ad37dbd92852f281f986026b38deb977cdaeac5b77133062a0a5835a8713a0

Download Submit
C:\ProgramData\Microsoft\MF\Pending.GRL.RYK

Filesize
14KB

MD5
2f3ba21c6a4fe239323aceb8aeff0020

SHA1
d8212862c7b243e405d997dc7952933fd534ed0c

SHA256
37c40c32c7d804bd175ec64a72112ba1a970235c1ca6d797c0a6cedec373be94

SHA512
a9ddf0b4e0de86819f16373db435acc10440d8f52ff2685b6d6f89bbb852da15b41ec29c1e4d6142837e9d3d9eb341d5f165278ff69c3ab121a06c8af9666859

Download Submit
C:\ProgramData\Microsoft\OFFICE\AssetLibrary.ico.RYK

Filesize
5KB

MD5
f1a9a80f2bd10ff9abebfda88c1a0119

SHA1
ec191ad94c129f9582f1dbb27d07d2d0e359dc99

SHA256
69b3442b37fdd5f098a6939a76dc791b7c1c784e3560cc51ca5587b2d04da5c4

SHA512
f2898fd2c13b97c996da2e5a08f14449cedfccb3dc30638aa7176f1830b7e1eed916f8ef8715db9edf2c3f4dc38e988018bc627ca41b6d3d0cb54e987dffddbf

Download Submit
C:\ProgramData\Microsoft\OFFICE\DocumentRepository.ico.RYK

Filesize
24KB

MD5
4e0929bd3c8cbc7f2cbb35a49086eb77

SHA1
4262af3176224f40d14be958bb1b8e6348e58d5b

SHA256
1415ce25f5882a67f7f5d427a23fdca3406c63c33eb938696d094903d018c919

SHA512
44c8b229ce83a597e48ae6df5053c9d43ce2af53cef502ef473cd1c0eafcd213aa254e5908d20e4ca1075c9c884890bb116163e42e2ce73e28bbc20971a6f8b6

Download Submit
C:\ProgramData\Microsoft\OFFICE\MySharePoints.ico.RYK

Filesize
341KB

MD5
7b18e99d70d0826bd6b9b39238ba25f8

SHA1
fbe7e1f5f093df3ccc7cc87d02013c0fe4492511

SHA256
3cb9d4140b01451788ec38e9efec31df4a4dc44cdcaf9b98a968c9876e66c9d0

SHA512
4952aac5bd6885959b2855028975b439831a25b65ac5bec5033381d27d8213f39dfc58163431f7f644c8960e6c626aa94e80fbc59aeb76876b049804a723f863

Download Submit
C:\ProgramData\Microsoft\OFFICE\MySite.ico.RYK

Filesize
24KB

MD5
80a65fdc59520b446a28331167762855

SHA1
ca73f58fcb4d6a17b8d405e59588daa9fa49a296

SHA256
7b660cdf568bf2555f2445919a8c17185763def3bbf19a92d02cd60aa7d9d60d

SHA512
0bfc72e2a2b25fbb2818e6e6aae7ba55befc56ba691465a91d23fe77bf89221bdf1cf8a639590e19ad48ce589c01a81744032ccaa656265fdf23f3da62d7c4e7

Download Submit
C:\ProgramData\Microsoft\OFFICE\SharePointTeamSite.ico.RYK

Filesize
24KB

MD5
b00109f89006ee7f909836bb08c98b89

SHA1
b11124f93ae649328f704a0ffaa2d799caa456db

SHA256
8ec29c3f3604499afb0bfe2157abd2cd68a95def170acf3aba2c9e97edb4ae90

SHA512
100096d5cbdc2aa21b1733f15646d68d61d68217dc29e62ac7aa626b9f0079769c81ce6f0a488f6d75db90fd17f41d4d270acba161f5a4c26a551dd9a3ec5bbc

Download Submit
C:\ProgramData\Microsoft\User Account Pictures\user.bmp.RYK

Filesize
48KB

MD5
007f6cb507f4497af8fa793197cb3935

SHA1
a42d79479e1030396f3e6a5894c62d4dbc57cb0c

SHA256
3641801036025e0d8f272c7274c36ed535018f25cf7c1ff77962115311aaad57

SHA512
ba6cac40bf4d795715e868f35419e5e2606e8f3ff58879e3ecbdd6730569c9199cc9be7594c2921a8757c192d547dc693d2875d672240ee4b1884a279332abdf

Download Submit
C:\Users\Public\Music\Sample Music\Sleep Away.mp3.RYK

Filesize
384KB

MD5
a99fa650b9197861fb59bd17b6ec7260

SHA1
dc6537aa86c6e78226bbcc67c0224a5f35bda17c

SHA256
6b75e2ca0c96c755c21d205f30ad36f2b2e8baf0af1b81bcbff75bc5f52fcf66

SHA512
920aabf2ceba1cf6004c3bee23a3f5453c8c2055163b2b737be3601503621291dc06cffae9b47787ae67ccbd532d198191c012b26c488a9b59a43c39687854ca

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.RYK

Filesize
859KB

MD5
5db547021d84ba6d91d8b0c192245500

SHA1
b4b5a337529139bf6ca2b15e2d924056308163c8

SHA256
cc35fe47ab9019df4fefc467ea55ec715ed6827db6d506c1881b27d7beee1131

SHA512
e818bef5d88e084b7ae23f5950c77f9263a1d018a3bb307fa301f2a00f7bdaa3303b742708d671db5a5b311f7c3669b37ea24dc47608d2cadd2e9ca61cf9e788

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.RYK

Filesize
320KB

MD5
66c69de99e20bc54bc9bdc576aa6e7b7

SHA1
b93171bab063d7e8463caa8809154519ef7eac3c

SHA256
7c398152ef5713d0a64ae15a54b16b0a751498893677a48a84bc1bb99e9fa6ba

SHA512
10cfb5f3c0d731d56d8cbc6395471edd90de8d0cf2b156d458b9c72c6310b979c126b4d252036a85f650463e0ccb6509ce6ee4ad68de453a52357c8e84f021fb

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.RYK

Filesize
384KB

MD5
22b76742ca80559b6f2133d67a442062

SHA1
6bb002c1866314fd7fcd8b63b381df1ecb530bca

SHA256
096b0471d2a4966c64cd5bcdb82bdc7fac4a95c36d0e27c39630e242be5f5caa

SHA512
42826b5e6683239d2452541c1ae037ceb1e32ee0b4ed8ce6cb8d7a4af97cf287d9dff2ae21384c86620f3cce2088813092275b0bac7acde5b689df13f3b49b6d

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.RYK

Filesize
384KB

MD5
0ae6777fe69a6b213eb380aeefdc9eef

SHA1
3695e71dfe1af31dcdfaecf45dfd2013cad59f11

SHA256
26215001afcfa5f276cc38d1fe938aec790fc1df95240884019235f8041bcbdf

SHA512
1f8db46b7ec14219ff4872b0b2fd06f789b2f2a7d88cd05f8eba9ffc8ca2947018c69bd0ce9a15fd1e291ef8038da16e591d1bee99c426df05b1e4cc9af4897b

Download Submit
C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.RYK

Filesize
320KB

MD5
9828f43e65eb501453a3e5602d2c5940

SHA1
a7ecb03c9906e5fd12c274d34cda90e0761862d7

SHA256
d8f0f37a2a441603680f5b33833a5dfe50e60eb37baa8103f7b7e5efcf3cd519

SHA512
7e91e93970af5403d3e321c06abda71ac28d0d99c59708cc7ace9d31f8289d0d945b8420d042ea92975a1b45129e75c187cf2e516753ddc378da689930642cdf

Download Submit
C:\Windows\Installer\MSI66D5.tmp

Filesize
363KB

MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
C:\users\Public\RyukReadMe.html

Filesize
620B

MD5
7498f7a90d67844d93be08f9933fd45c

SHA1
1df59e562d66b30c3553fa053f64e375fcaa26a9

SHA256
1b3bbf380f9edbab15b1bd538c898ab1c2c2afb94ee914b5dc7eb0d586a00eff

SHA512
e2caa2ed7c4c12faa59d351435b0ba6115ed4f8348716bef29b0809c56331843311214097928110da392ee992ef75db1ee44f3c0420c34ff2cfb35e6a3065923

Download Submit
\Users\Admin\AppData\Local\Temp\SplDmMuKflan.exe

Filesize
134KB

MD5
b6b531d5477d737cb153ec5201c5baed

SHA1
fe228587cb8ff1565fbc0e825f45fac0726c4ec5

SHA256
9d2bcfa82facbaff874c61534ef4bc647ee072b218c4903e87012e1683e30bec

SHA512
c4d84ba0e25d0e8a4d694a9924183cc65168c010e18d539d2003b02ec13d43c6a2f3594266ab4dbbce7de5f769f86192e9320cd2ddee332ac0ad161de27f1426

Download Submit