ae7d5973...9a80

C:\Users\CIiHmnxMn6Ps\Desktop\zOTcI.exe

Sample File

Binary

Unknown

»

Mime Type	application/x-dosexec
File Size	206.50 KB
MD5	beccb227b0c2661c5ecfcfc9458e6253
SHA1	31bf1c7ed44cbe20efcdc0153b895000e195a1d1
SHA256	ae7d5973d7daaa7dec7f06af80b97b5927b44521ed4aa3fe2b75d98ecd9a9a80
SSDeep	1536:gOXHnko/RuWF2SELf7ijPkjneglVDeRwBnA4aEgIbsW9d7B9dlXLPQcIuY7:PkokWFDELWqeoVD9BnA4x19VVLo3uY7
ImpHash	7392bf63e0480c44b4cad34b59be5fdc

PE Information

»

Image Base	0x140000000
Entry Point	0x140008b44
Size Of Code	0x16a00
Size Of Initialized Data	0x37a800
File Type	executable
Subsystem	windows_gui
Machine Type	amd64
Compile Timestamp	2019-02-02 02:41:50+00:00

Sections (7)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x140001000	0x16850	0x16a00	0x400	cnt_code, mem_execute, mem_read	6.29
.rdata	0x140018000	0xa508	0xa600	0x16e00	cnt_initialized_data, mem_read	5.11
.data	0x140023000	0x36e210	0x10800	0x21400	cnt_initialized_data, mem_read, mem_write	2.04
.pdata	0x140392000	0x1128	0x1200	0x31c00	cnt_initialized_data, mem_read	5.02
.gfids	0x140394000	0xa8	0x200	0x32e00	cnt_initialized_data, mem_read	1.44
.rsrc	0x140395000	0x1e0	0x200	0x33000	cnt_initialized_data, mem_read	4.71
.reloc	0x140396000	0x61c	0x800	0x33200	cnt_initialized_data, mem_discardable, mem_read	4.76

Imports (3)

»

KERNEL32.dll (86)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetModuleHandleA	0x0	0x140018058	0x21af8	0x208f8	0x21b
OpenProcess	0x0	0x140018060	0x21b00	0x20900	0x382
CreateToolhelp32Snapshot	0x0	0x140018068	0x21b08	0x20908	0xbd
Sleep	0x0	0x140018070	0x21b10	0x20910	0x4c0
GetLastError	0x0	0x140018078	0x21b18	0x20918	0x208
Process32NextW	0x0	0x140018080	0x21b20	0x20920	0x39a
GetCurrentThread	0x0	0x140018088	0x21b28	0x20928	0x1ca
LoadLibraryA	0x0	0x140018090	0x21b30	0x20930	0x33e
GlobalAlloc	0x0	0x140018098	0x21b38	0x20938	0x2bb
DeleteFileW	0x0	0x1400180a0	0x21b40	0x20940	0xd7
Process32FirstW	0x0	0x1400180a8	0x21b48	0x20948	0x398
GetVersionExW	0x0	0x1400180b0	0x21b50	0x20950	0x2ac
CloseHandle	0x0	0x1400180b8	0x21b58	0x20958	0x52
CreateThread	0x0	0x1400180c0	0x21b60	0x20960	0xb4
HeapAlloc	0x0	0x1400180c8	0x21b68	0x20968	0x2d3
GetWindowsDirectoryW	0x0	0x1400180d0	0x21b70	0x20970	0x2b7
GetProcAddress	0x0	0x1400180d8	0x21b78	0x20978	0x24c
VirtualAllocEx	0x0	0x1400180e0	0x21b80	0x20980	0x4f9
LocalFree	0x0	0x1400180e8	0x21b88	0x20988	0x34a
GetProcessHeap	0x0	0x1400180f0	0x21b90	0x20990	0x251
FreeLibrary	0x0	0x1400180f8	0x21b98	0x20998	0x168
CreateRemoteThread	0x0	0x140018100	0x21ba0	0x209a0	0xa9
VirtualFreeEx	0x0	0x140018108	0x21ba8	0x209a8	0x4fc
CreateFileW	0x0	0x140018110	0x21bb0	0x209b0	0x8f
GetModuleFileNameW	0x0	0x140018118	0x21bb8	0x209b8	0x21a
VirtualAlloc	0x0	0x140018120	0x21bc0	0x209c0	0x4f8
GetCurrentProcess	0x0	0x140018128	0x21bc8	0x209c8	0x1c6
GetCommandLineW	0x0	0x140018130	0x21bd0	0x209d0	0x18d
VirtualFree	0x0	0x140018138	0x21bd8	0x209d8	0x4fb
SetLastError	0x0	0x140018140	0x21be0	0x209e0	0x480
HeapFree	0x0	0x140018148	0x21be8	0x209e8	0x2d7
GlobalFree	0x0	0x140018150	0x21bf0	0x209f0	0x2c2
WriteConsoleW	0x0	0x140018158	0x21bf8	0x209f8	0x533
SetFilePointerEx	0x0	0x140018160	0x21c00	0x20a00	0x475
HeapReAlloc	0x0	0x140018168	0x21c08	0x20a08	0x2da
RtlCaptureContext	0x0	0x140018170	0x21c10	0x20a10	0x418
RtlLookupFunctionEntry	0x0	0x140018178	0x21c18	0x20a18	0x41f
RtlVirtualUnwind	0x0	0x140018180	0x21c20	0x20a20	0x426
UnhandledExceptionFilter	0x0	0x140018188	0x21c28	0x20a28	0x4e2
SetUnhandledExceptionFilter	0x0	0x140018190	0x21c30	0x20a30	0x4b3
TerminateProcess	0x0	0x140018198	0x21c38	0x20a38	0x4ce
IsProcessorFeaturePresent	0x0	0x1400181a0	0x21c40	0x20a40	0x306
QueryPerformanceCounter	0x0	0x1400181a8	0x21c48	0x20a48	0x3a9
GetCurrentProcessId	0x0	0x1400181b0	0x21c50	0x20a50	0x1c7
GetCurrentThreadId	0x0	0x1400181b8	0x21c58	0x20a58	0x1cb
GetSystemTimeAsFileTime	0x0	0x1400181c0	0x21c60	0x20a60	0x280
InitializeSListHead	0x0	0x1400181c8	0x21c68	0x20a68	0x2ef
IsDebuggerPresent	0x0	0x1400181d0	0x21c70	0x20a70	0x302
GetStartupInfoW	0x0	0x1400181d8	0x21c78	0x20a78	0x26a
GetModuleHandleW	0x0	0x1400181e0	0x21c80	0x20a80	0x21e
RtlUnwindEx	0x0	0x1400181e8	0x21c88	0x20a88	0x425
RaiseException	0x0	0x1400181f0	0x21c90	0x20a90	0x3b4
InitializeCriticalSectionAndSpinCount	0x0	0x1400181f8	0x21c98	0x20a98	0x2eb
TlsAlloc	0x0	0x140018200	0x21ca0	0x20aa0	0x4d3
TlsGetValue	0x0	0x140018208	0x21ca8	0x20aa8	0x4d5
TlsSetValue	0x0	0x140018210	0x21cb0	0x20ab0	0x4d6
TlsFree	0x0	0x140018218	0x21cb8	0x20ab8	0x4d4
LoadLibraryExW	0x0	0x140018220	0x21cc0	0x20ac0	0x340
EnterCriticalSection	0x0	0x140018228	0x21cc8	0x20ac8	0xf2
LeaveCriticalSection	0x0	0x140018230	0x21cd0	0x20ad0	0x33b
DeleteCriticalSection	0x0	0x140018238	0x21cd8	0x20ad8	0xd2
ExitProcess	0x0	0x140018240	0x21ce0	0x20ae0	0x11f
GetModuleHandleExW	0x0	0x140018248	0x21ce8	0x20ae8	0x21d
GetStdHandle	0x0	0x140018250	0x21cf0	0x20af0	0x26b
WriteFile	0x0	0x140018258	0x21cf8	0x20af8	0x534
MultiByteToWideChar	0x0	0x140018260	0x21d00	0x20b00	0x369
WideCharToMultiByte	0x0	0x140018268	0x21d08	0x20b08	0x520
GetACP	0x0	0x140018270	0x21d10	0x20b10	0x16e
LCMapStringW	0x0	0x140018278	0x21d18	0x20b18	0x32f
GetStringTypeW	0x0	0x140018280	0x21d20	0x20b20	0x270
GetFileType	0x0	0x140018288	0x21d28	0x20b28	0x1fa
FindClose	0x0	0x140018290	0x21d30	0x20b30	0x134
FindFirstFileExW	0x0	0x140018298	0x21d38	0x20b38	0x13a
FindNextFileW	0x0	0x1400182a0	0x21d40	0x20b40	0x14b
IsValidCodePage	0x0	0x1400182a8	0x21d48	0x20b48	0x30c
GetOEMCP	0x0	0x1400182b0	0x21d50	0x20b50	0x23e
GetCPInfo	0x0	0x1400182b8	0x21d58	0x20b58	0x178
GetCommandLineA	0x0	0x1400182c0	0x21d60	0x20b60	0x18c
GetEnvironmentStringsW	0x0	0x1400182c8	0x21d68	0x20b68	0x1e1
FreeEnvironmentStringsW	0x0	0x1400182d0	0x21d70	0x20b70	0x167
SetStdHandle	0x0	0x1400182d8	0x21d78	0x20b78	0x494
FlushFileBuffers	0x0	0x1400182e0	0x21d80	0x20b80	0x15d
GetConsoleCP	0x0	0x1400182e8	0x21d88	0x20b88	0x1a0
GetConsoleMode	0x0	0x1400182f0	0x21d90	0x20b90	0x1b2
HeapSize	0x0	0x1400182f8	0x21d98	0x20b98	0x2dc
WriteProcessMemory	0x0	0x140018300	0x21da0	0x20ba0	0x53d

ADVAPI32.dll (10)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SystemFunction036	0x0	0x140018000	0x21aa0	0x208a0	0x2f1
LookupPrivilegeValueW	0x0	0x140018008	0x21aa8	0x208a8	0x197
AdjustTokenPrivileges	0x0	0x140018010	0x21ab0	0x208b0	0x1f
OpenSCManagerW	0x0	0x140018018	0x21ab8	0x208b8	0x1f9
ImpersonateSelf	0x0	0x140018020	0x21ac0	0x208c0	0x175
OpenProcessToken	0x0	0x140018028	0x21ac8	0x208c8	0x1f7
EnumServicesStatusW	0x0	0x140018030	0x21ad0	0x208d0	0x102
OpenThreadToken	0x0	0x140018038	0x21ad8	0x208d8	0x1fc
LookupAccountSidW	0x0	0x140018040	0x21ae0	0x208e0	0x191
GetTokenInformation	0x0	0x140018048	0x21ae8	0x208e8	0x15a

SHELL32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ShellExecuteW	0x0	0x140018310	0x21db0	0x20bb0	0x122
CommandLineToArgvW	0x0	0x140018318	0x21db8	0x20bb8	0x6

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Immersive Control Panel.lnk.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Immersive Control Panel.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.56 KB
MD5	5a8dbf0cccdfb9cfba41ef35924eee57
SHA1	884ab42b21353ed4de9e042e7de93c13456310a5
SHA256	89948352961d83eb56f547b57c1005474f46d29f8e883426e922881884daed5f
SSDeep	48:iQUKMNPH+iOpxi8C2A88Hnq1EWBSgNNH7aLeuTIO4uS+qYegnc+wKzXD:VpYpmvCT8WUEwN0e1r+qYZz

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\Desktop.ini.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\Desktop.ini.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.72 KB
MD5	310bce0096c8db67dce6ee89f5ec7777
SHA1	910242fbda5faf497dc91803ca13d4599f50a82f
SHA256	441e5c75b5e30c676a4372183433593877ecd76b77b081031df6592823db8720
SSDeep	12:RpqiU+GwlmXtYW65MoPtCQDgnA7EyzNgPxv/CSaR1y8qiueMCkIy8W:/qiAXtjolCWyFIRo7iueED8W

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.006.etl.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.006.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	5d4e7f97c3f2ece11955f4a007926ecc
SHA1	0fc61dbaf90ddc65fa0886425a0061e534b093a6
SHA256	d491146bfa79ebb60930aabf8d52bf53b50ceff894ccbfa769f58c54923e956f
SSDeep	384:RS6X/A5XJK7Mhd5RIPH3X02jKUQTClDQHBiBDd+zZEYLecsuL:Y5XJK7e5RIPXX0pClYBiv6EYLeG

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.019.etl.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.019.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	4.28 KB
MD5	9b74e943e151edee8676e2b9a1fb6eaf
SHA1	27437eb933192cdc6eea4a05e9d6c5f75032a46e
SHA256	88b58da76dc07b07ac9c11e479353d569ca46fc59ba71592a2caf0942fde9f97
SSDeep	96:Zc2Oh1m8rKTwbpu6z4DqE4Q4wSHuk6LNElr5/OIYJCYLGA:ZLOtrKTwbIqSqEgF56R6rMJCcGA

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\288.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\288.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	ff9a310b8bfc40bc3c994b5bf3d4b524
SHA1	877b20b97310c482f8f2e3235c7ff28ea9619a9d
SHA256	56662159639641b3708f2589d22eb2a9f5964573dcb5038082e3c291a9cff978
SSDeep	6:5laMXVZ8/qsujvYSsETNy3595DYzYj9Wi6/i7scf+nAosHjHlF1i09MlBDIop4H:KKvJlTNu5vYzO99TfoAjF0vTDIopS

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\Desktop.ini.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\Desktop.ini.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.64 KB
MD5	8c0e38b7694b1c186aac76f0c053af63
SHA1	2e2b547d74fe1cacb6fe9174f3ef973a4b9acdf1
SHA256	e04319c67519ccb22bdaf674eaaa59ec31d3caed16ae06a00d537bd922a62683
SSDeep	12:TpopMgqTaBsaEVGeG9vPXQ1jXYabeAOgRkiU5/SaDFWQKtvw74si+pX5+y2lF5d3:TOWdatEVm9Q1caOgRJUhFZ4aBwy2lF55

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Math Input Panel.lnk.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Math Input Panel.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	1.42 KB
MD5	9a7d34692fe58732a1bc548ec0bad640
SHA1	c58b2d849e66b35ef96c66c486332cb7b776f600
SHA256	eb00e0f0badaca0d8a2073ac67581bd4a3d7e3c21d7093978b0619c8d68b293d
SSDeep	24:ILiUpsxcdji4TCOwatd/r1k0NgK+yjysIZjrobIVdM4PPJy3MyilckeDFRY3:ILiUpscdjfttFr0ymjrobWPkMyXDDF0

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\MetaStore\1\0000000000000000.idx.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\MetaStore\1\0000000000000000.idx.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.36 KB
MD5	3e9e1897b4f8995a416526e97650be10
SHA1	062ae347cd56691e3373efa06ed539ad5e5351e8
SHA256	2a4e7d5cfae92db412153d87389be20a456538f4ffb1ade556574be1c56cb5b1
SSDeep	6:3WXXQvKgnTDEtBZsdSy3knwGg5en+TTUXMeUeiFgqImCd2ujrt+qCrzzjeCE1PRq:Gn7IAdwGg5c78eUe6D1uCnmCb

c:\programdata\microsoft\windows\start menu\programs\word.lnk

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.67 KB
MD5	4cf6a72182107d794f89af9fa109c7c9
SHA1	88adb7f5a9bef403f5380139eadf5a59fae10b63
SHA256	95f3c03b03088f3a39a57ffb768e5cc887d5862030efd7c0366e35826f7bf73e
SSDeep	48:e4yN0pYoD2j7EF2kcQgPyJBMKhwzGLNQY8iUUueDEhijGc2zzt7HbcAE+ggn:e4yN0DcEFNb9NrYPe4WxOt7wAE+gg

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Acrobat Reader DC.lnk.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Acrobat Reader DC.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.67 KB
MD5	04984e83317ff1a0f952a6191df95c73
SHA1	7a4d2e5e3c6618519b206ea6ec1eec9d7f380e9f
SHA256	feafb55bd96cbefe1553b77d24b52f0b3a55a3d6ad756f9a92d9384cb4921668
SSDeep	48:VLzl2c0bNZ/dgT8dySBcaIDfBl69fDy0OX1xCfYJZ6j46A7CGfQXJADaTvZ7pl:VLzlB0f/dc8dygI9kJRi6jLAGWCQaTd

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Wordpad.lnk.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Wordpad.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	1.41 KB
MD5	77244fabdab452432b0c778287c15c51
SHA1	2652a839aea263b790931bd1ed26e9d1d097a727
SHA256	e9c626502bf607bbaf3b1d486a7a9caab72a65bdf751b8359ff49c5aa80bbf02
SSDeep	24:FcWxcHSbIkns1tgsRzkZZEaRdaQtEPsTh5dBBUSh6MS2+v2ueZF3Aj3VFQ3O6IBG:qGIbt1Rz0LdaQPT3fBUADS2+uue/AjVI

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk.RYK (Created File)
Mime Type	application/octet-stream
File Size	1.60 KB
MD5	752fadca80c4b5034c3297bfbe480b82
SHA1	5072e927f1f5cfa9a7b2dd21c516e4ee35e08d01
SHA256	d570c1ed7183392abbfcbedfce9a0c47ed0c2f23f7f33ad23a9ccd367aff9d31
SSDeep	24:VCMtD+Gh/9fM9P2H7Nt116+Vl9eAko6fJLLfnPlPvrBbY8aiQhrUkfbMj:Vt+4M9ej119VuRJfNPlPvrhY7hrUGK

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Outlook 2016.lnk.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Outlook 2016.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.63 KB
MD5	6dbb87d962637a43a1018d5ea22582d3
SHA1	581d3ea976b7dc785d49c8d02aeb7621f924889b
SHA256	0eb4d2b8dc482e5d84e1bffb57da396bacbc2225121ed69f7944c8fe34b706e5
SSDeep	48:inVE1e6zkEW3hmqk0Rv4A+XKuaaxIlzEoR260EL+xA59LfKbnSwTFu6r+Cx1:yVt6fWRl4jXTZxIOoR260EuI1SGwTFZ5

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Desktop.lnk.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Desktop.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	1.11 KB
MD5	72b12150b9e8e6d3f68ec10a822a76a5
SHA1	c92a511850977135aaf6c6e8b1439b3499337098
SHA256	0839040ee541ea5133d46a629a6cfac2f76b30e6ccbb9a0f63be7ff3237fd855
SSDeep	24:4Okf0kNSHGzIK/BE8Lle8bKAGHjGL2Kf76a1yUWKPU2uByfOM6rbQpoS:49TdXnTL2Kf76+tuByJ6gGS

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.003.etl.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.003.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	a280d8682c9d8a63897738a7459d9da0
SHA1	4f1c33ca2ae59c0a06ae549ade411ccfc420c97a
SHA256	ef79000f628c0ae436ee676ee510b4acbcf1f3feb2816482c460bb767c353a31
SSDeep	384:ohkFTkJcGugA5FX/ZAlI1amE5B0JArN0/140BSpp2+S:gigA7ZAXaJACd6p2+S

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.018.etl.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.018.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	49d4aed20bdad3e1028d5f6e047a1056
SHA1	f730330066343b5af33cf1cfa45978e542d695ba
SHA256	87ee8970b8462eefbad63a6b63cb4f8c89fe79f611ff5b3699545a7ab1c94d19
SSDeep	384:mneKtbCcgTG7Zxxb/4j3ldXGPiAjR92eD9jw7BHBPd1:mvtGcgTGNjbQsi4F6d1

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.015.etl.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.015.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	8e354e9989db795649f74f1040522d04
SHA1	d81dc841f5ba47bdf3e968aa307ff89625479616
SHA256	f66d6b90fdcd86186aa9431e0915f963f01c5488f59808b2ca4b78c21f7e8c7f
SSDeep	384:ESkSc0ixfArEhmthYuHbgEOImGHq+7HI25/5kCiHpXVlHIv:XVc08Ey2YuHbgE5vh7yCypXVlHw

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\05\191.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\05\191.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	2626fd1be39722c62f29157edb9a19a6
SHA1	ff01374de5f1ce41962443c61e538dbe10e73773
SHA256	fa6f044f4c6e6fc6133693ecffa77c472d13a411f7ce7224ed4527427d4bc571
SSDeep	12:ItIBKeZl6bumGA/KzRaJHoon9zTiLU1XUIt6:hYeZl6bV/wRaL9zTiL+XUIY

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Paint.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Paint.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	1.36 KB
MD5	99ffdf7d8f38dc8ad9d8b39477071bba
SHA1	d7f88b0b934be2b2dc66a48faefeb99bc52fcfc2
SHA256	598dc49d018530561347fb87b456b7cbdcacd66c01c37251d17e16986ca1c623
SSDeep	24:wJbKOyWR2jgVGEuL1TqZB+4Tz7QYZrb38E2qA0qIfmgHphfWUbieVZ3+vCv:wp1duBuZk43jZP1JHphfWU+0Z3j

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MF\Pending.GRL.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MF\Pending.GRL.RYK (Created File)
Mime Type	application/octet-stream
File Size	14.89 KB
MD5	9f4d5cda1dcf4791919c1b081fc4e68c
SHA1	286d788f69aba17a11ae9009bd1e60196c01ac9b
SHA256	858d55d383c8f3112fa54f77255a777440d50aabca4471638077ab65cbcdbf06
SSDeep	192:Rbl0i3wdYlwmQ9Tyv4pc4ODYYvNLxQ36AfT4U6MvKnXDzjz7mUjxs/5CnlTl5N2b:RSi3wdswDE4po9u6wZFinXnjzXH2/QW

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-40.png.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-40.png.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.71 KB
MD5	b00ec100de27322f824250102f19ac63
SHA1	a7c91356f45440b332bfbc74a8bcc761a8cbe434
SHA256	8f5a127cf495511bcd1936f426704ce1a8a64a38dd914e907616f7e9742e14d7
SSDeep	12:wM+2L0WgDS2BuCPwD4Z/nnvzxcE+aQCGs68twkfdtDlcAdiG288I6wTF9I2IsX3A:wM+YguJynntpbGKSQciiTkPFWs4b

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Project 2016.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Project 2016.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.69 KB
MD5	8e6ef7c7bb987eb4eb3c56526da48406
SHA1	40693d36241cc03755f4c94d5739383f1ff95d2c
SHA256	642b93b5009f88c22edc925e94bb5189118a5974a6d4c95f80669f6bc100892d
SSDeep	48:BPttb8KzS9JMjggty607Gq/J5B+rgikzUFKglTe+AlJsm:+KEdgtlmPJPkn/Kqml2m

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\MetaStore\3\0000000000000000.idx.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\MetaStore\3\0000000000000000.idx.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.36 KB
MD5	1ed18e9f8bc73d62cff87e08c995d1fd
SHA1	9009aff9b1f3d73fa62dec7e65c272296c66a37e
SHA256	c6a0ffd8869fef9285ab74c50d41167ed2236dd23a598d8815ef96841b7da862
SSDeep	6:exE7WKutA99DWpBu8uiTSK6RoX2v8RuZC5tP7qyo6kNUgm4LXFkTtRBFaGhnhVM:nZutA99ys8uiT16RajRgCbPuynkNUf49

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\17\193.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\17\193.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	7b76b6d74bf8004f43036789597f5c44
SHA1	c9d9d792a550a32ef135efefbf586b5aa8d4d892
SHA256	310053a94885a92b95610934e97a52b3d533e5326c602a10fe94b54dcb5a34c3
SSDeep	6:UE1oHit0AJ0BGU0HjRa0+8412JZWBCjsDaGyAqPKkk7T4Ey06seR7n:UtHGXjc0W12TWBCjoaGZWkEsan

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.020.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.020.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	8.28 KB
MD5	be9665e4d942e2f71ee29b5d6129b66e
SHA1	f18120e0989309a44f098d8927f633ba4250b77c
SHA256	09c2ee369fa7ba313d1b2fe0a5d841cdd423b90afece23b411a46fa4241ed786
SSDeep	192:xgGMWjiMiD5hbBvi7ey83cqdWa9OfEVZc8QGu1azt0abxFfNm4/ULl:x2WjLZ7eyBna9aEVZc8Hu100aj/ULl

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\19\328.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\19\328.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	897f61d6e8b523178e80232a582b6fe6
SHA1	eb8e1c28af3cbee7e8f5c14d206f2d647e00ab9e
SHA256	08c7b9b569c25bd8ab57bf1a9daa7433ea89b735c10ff60377e3c2b54602e073
SSDeep	6:naOcTFQslQQ5WW8U264WzV01PtBgWwGBIIunK8tKENij3+MM/rRRH8ea/89wf:aOQ6slmW92PtWVIunK4mN4eEE

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Visit Java.com.url.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Visit Java.com.url.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.46 KB
MD5	43f5265250440d298f772d227a6cbbca
SHA1	6f4905c1cfc9bff87c0b58e4b223ce9668dbdc3f
SHA256	1f6677f165ed45d3d52bde62b1c27a78c15b8c84221e9ba02c83cff39bc5be5d
SSDeep	12:rQAeLNI+GvuWapp8uSuurXcd0GDFV2GGfTtYwH4:rbaK+XFS9lGJ3ETv4

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Search.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Search.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	1.83 KB
MD5	5a0bc7f25bba1d8b3e1efbc2bcdc0b30
SHA1	f27382371836fe9d7e34a2b63188cd084396979d
SHA256	942f2a8e4632dd3ec53938288a33d8bad5b874711a72f7fb01ca42c28b3fa2a0
SSDeep	48:192UIhLUhSKu8a8IRQGmVJzm4ZtZO5sr1ZZ7dq+Y+84pliL:19jQLbz58IRQjzziCTZ5qHwDiL

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.007.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.007.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	80af55303cca9f656d6b5ef31992221a
SHA1	7ad3d884e32f50557bf5cf0c8470180802c77643
SHA256	f252ad4ec96e530f53745bf30dc0933d944742fd512341f5de79df483bda905c
SSDeep	384:ec5Hh4ByZgrIHKWvJlQIzUrn9bmh8iDOhfSH0+tMrk0:ec5HhuyG8HPfQACbv6Oha0z

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\19\266.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\19\266.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	8c1354ca9cacb50b80a8c315ce4de581
SHA1	9dd8a4caf5cd8ae7ec1e9a4dcc7a1989e6a1c0ea
SHA256	75f5f8b392316f9c40200a4702922f62ace55d607feb72a7c5e6cc80917b11e5
SSDeep	12:AUcA9ib/tfP2ZDYCxqQRa9OF4EZXTIqev2Yfw:AUcA9ib1fJCxq43DHV

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\09\287.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\09\287.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	4b26b66aed2b286e7e2ea4cd5f499fdb
SHA1	b47b8bfb514c172a17cefd07ed65f9d823683986
SHA256	60e700b0734398c2146f951bd1b745f6506de51d6f1fb8270b0123ab5a76c5b2
SSDeep	12:77eGVw574RJR2pWqB9xOWgGjRfQtNanqiE5R:/eGVw94R72plB90RaQ7TL

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Oracle\Java\installcache_x64\baseimagefam8.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Oracle\Java\installcache_x64\baseimagefam8.RYK (Created File)
Mime Type	application/octet-stream
File Size	10.00 MB
MD5	029143b6383fe86a454616f35803ac5c
SHA1	b62e762d0972d7226e5f8936b7091aaf4b5970a4
SHA256	52d4516f56e44a01f59e4952992ac95a422a86fe445133eefbb4e8a68a24a43d
SSDeep	196608:DShB9tJnyut0n46J7RgPGb/QfjIC3Qa1oc0kFgbQczUul9NA1B6Vdk6:gbJyM046JF1/QfXAaskFgbQyDlcb6

c:\programdata\microsoft\windows\start menu\programs\outlook.lnk

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.63 KB
MD5	2dc9cab5d1ff3af305ffb830065e55a3
SHA1	54b547d09b1b94458e398ebaf7f2e6de29ee391a
SHA256	e40be932ece2bacdd51fcb2fa83afb90a5bde6a2269874f30f491c198533f482
SSDeep	48:4wKwpTglq4go6FhnGprxTV0bkCD5cPShzo8BMTHIIoPhgWe3UwKMhmaLvQs1D8:TKeTowFFhGprFKJ5cPazpSchg8XngP8

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\desktop.ini.RYK (Created File)
Mime Type	application/octet-stream
File Size	1.72 KB
MD5	b3c185fafa76cbd0bfd7c7a0c3b11aec
SHA1	bd2749f7e93dc97b670557d98090ecbb78c82720
SHA256	ab6894bcd74a8ffdc0cb1aa688af76ca4e30755e92018a83e23e59c6e669b986
SSDeep	48:9MuF3+TyfT3ThZ2BWAdkjv3Of5hNjNfdd41oh:9MauTuT3WV+LWbda1a

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\01\198.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\01\198.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	720f139bcd011373468332faf75c82e8
SHA1	5f8dca5e8297959ff998c4334b5c5016c8f50028
SHA256	e19a0d270bd1275c99384bc6cf5a4cc0e5267f3ca61937917a10c95d1202d965
SSDeep	12:zcXexNtagriJ2Ry7qVV2g03AQ98wB41czweZxM:z1tagW0RyC23F8e4AxM

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Get Help.url.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Get Help.url.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.46 KB
MD5	f4583c59788e702a2ac5caec0c338fb8
SHA1	131ea416e79ef2cf7123b496187ec4276a2b56a1
SHA256	6741a5ca2ae4de5615280bf84f94fc659c134cc1eb12929af718a04eb2dba4be
SSDeep	12:dZ90vv8yxWLuvntQJS1csGcPahS/fG/4bd:dj0vv8XyvK/JcF/f9bd

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\MetaStore\2\61\EFAE1E6619D4EE51.dat.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\MetaStore\2\61\EFAE1E6619D4EE51.dat.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.50 KB
MD5	c0194a4b0363f78af2c8c8bde28e39af
SHA1	5d514ec45ad0508ecd41d2690e30b636645e5692
SHA256	d2135651b1f7cb3c7e8c0110b5959f1331feb2d1cf1dfa754560c5773dda0a30
SSDeep	12:PRnn3XPTyoobCV7o38vsESFtvJyURcJ+EvgH0Fjn4X6zR/+zMYre8ZVRE+3:Z3XPTyoMCVEE+vJe0rUJ4qzFwMGlE+3

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Sticky Notes.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Sticky Notes.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	1.44 KB
MD5	c9778d74f791cbc19a54cf6d214b5dba
SHA1	8eb1e7c8b7abdd680f06e1db9bca7a78380953c5
SHA256	01ca596829e509b18eb55398f4930161c942d2d027365182773a5132a098c568
SSDeep	24:i89IOBpIksX0vDgu9k4/2WMkvzQb9dQ3RlhydhnjZKduQBHviKJ2zhwlK4PjMxOk:IA+F0rZ/Vs9dAOJjYpzjMxsq

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.001.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.001.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	496c84cab32cc02a92069cae1f3c9e93
SHA1	4bdcb563d43d3c5e7131b7bbd935096649729ba3
SHA256	bbd20b0fc3c98b525ab6d8edb4f7c6c5f26da9ccb079de603cd9d33ff37a8e1f
SSDeep	384:h0bAMRrtbyTeNiyYHDB6MtNLNyEWJY8iHNkR8oz:h08CbYMyQjY8iHNk8oz

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Publisher 2016.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Publisher 2016.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.63 KB
MD5	2a9d6adbc8463ebfbc41e9213f043815
SHA1	9df6e5943255e3dbf3eed84f919ed06bd88ea837
SHA256	446ffb2b447c8311050dbee91b667dff64a4c2b81a203347f7406d6ffa3c6d56
SSDeep	48:gS5JPduUaTPHBNNAnpNQRFo6cpi0MPKdeCLOqs9MmSwQvmtDVmFdjgY2ngJBPQz6:gS5pxcBAnjAtcZMCdxGSeQvWZmT0YwgN

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\21\260.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\21\260.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	bfe4bc8c896ab61ab8c6b5da8cef99b2
SHA1	755aa0f20e3280002c5385f2266c95a0e603d141
SHA256	dabe533442dc4297e71711e2331054bd3c53699fb428ff1babd184a01f17ee09
SSDeep	6:8weXdZoR6GIWqwKhx+Ppr+QuipHtvGjgPjVF9QXv9hj2RPL02rDZX5IF2wIcYVzV:8wqZoRXWIprhHPjVOFMbrD0YLcYVzZ3v

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\17\300.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\17\300.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	71462bc52883dc628df5167475377d52
SHA1	ea30e99c4078f3a01a5870f6e781f5243bad6b65
SHA256	2b8dbfab648bb70dc67a55554aee118fdf740dd9389bd5299a7f4da9107bfa1f
SSDeep	6:COhTLUH62W37pHFUgA5m2FIDP0vD5Moh2olotyUp1iE6GxjwPtm1E9sGpkFQPOog:/J2W965IL0b5MoLqtyM1iE6Gxja/Chn

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Word 2016.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Word 2016.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.67 KB
MD5	c94cc87e57428265dfa381dd00131182
SHA1	4b663df1d21fb437d3a0e76b284079521d645818
SHA256	d1f325dc199be308a0c7f9c4fc1aaffb1ed76a58af2f58ca28446b76a94a25b5
SSDeep	48:K1JxrOFI3f5R3IDUdkt6eC0oLQGRtOKI2veVc5D:eJxyFI3MUdk1KQkXNem

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.014.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.014.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	09196d3ae7f71c556a36165e6e59cfc9
SHA1	62b017fc4f4282db3fbcf24cba8ab8adc11fbeeb
SHA256	ba03807813bb3c3e12fc7a394a50d57016bbf5e76a1bb14f60848d35d45265cc
SSDeep	384:zFnEpnWUNKjM4Yqhy7w93Q9hi39lAlSGYhvhkBIOBATLV/Epcv+:+IDLY2y7w93UW4YGYh62OBATL+8+

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\12\194.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\12\194.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	cf9ed7e0bacd06f2f67830becba4ae44
SHA1	345f16513df7a04238f1797766a10bd12116e45a
SHA256	1bde1524f167dae98c8fd57c0a3386cb144db1fbf440a05a62860f980d86cbe3
SSDeep	6:Cn8Rwm1TmxfDI+5Jhnx6D3PCQ/bww3nfNDSMwXcZ0xWQZOWkFocgrIZ5i53jgv:XyQmx7Pvx6D36QlPLZBYOWggc56q

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Access.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Access.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.64 KB
MD5	148978d073daf85a313c718ff7301615
SHA1	d2712091e0f82733684b2902a6f882d3f5018b9a
SHA256	1ba3f6a1b6cdbb4838ff32dfcc578ed6370041e27318ef1aa103206e47bd6993
SSDeep	48:KvQ1tMBmhZJTvXEj3/9GJij4KP3KjblOIB0ZITBmcfBfIwIZT10k7sbwymw:K7Bmhvs3/3j+b4UBTvBAwGLsbwyJ

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Visio 2016.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Visio 2016.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.67 KB
MD5	1f3845de82214f16013c0260afd3c4c5
SHA1	708220ed1b728c475ebf6a4d19c977494a9d50b4
SHA256	f07e5c76f281a4030019978359f9f55c369430b1eb7c7570c6d95907ae1f98da
SSDeep	48:VL6kh8urietAFhYdQuJ/gqxiIOaoyKIKxE0CswNs5jIlZskSGhKLwMM7QkwRXjq:VcueYAFhiQVMzK3xJCsr5jCZXKLw1wM

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\09\238.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\09\238.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	53e6a6d20c84315c083fdd763995b9b3
SHA1	372e1ddcb509f764c4ae96e07b0c8df6344e17d9
SHA256	6e5a9efc5083970a082b49cdacd9992a9a53cb151ae417960e9d7d9da1e42da2
SSDeep	6:6sr6o1aQnTk5ozdJ55lItI9+B+Tlv1btewppbEUA1AroudTOgLf8VLTja+NIUomD:6sL1BhPr9JTBvppgU/9L0VekcCRn

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-48.png.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-48.png.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.77 KB
MD5	54e270db7949406a75b693449878fa06
SHA1	8e5ae13bf38b49639d82194db1499a502fd0ac60
SHA256	ff4b158d8c9270d47ef1b3ffb2cdade1e2dad8da66861f54486a045053365bbf
SSDeep	12:3MC5ZoWQA3AMGhErCzra0GW5EAws2qn837WC/LmMK6nl+gWQpPpQY+XGE:xZqWAThEOPa0GDVsbkfZKPgWQ1pQYQF

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.004.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.004.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	c8d8c83257035fe5f15e0c393b6eac80
SHA1	96a5f3a4d047621cfb1a0f5c19957815a4368684
SHA256	7d6eb451c3fdf4f6f8b88a8083d4dcc95e6227b7fa7dbcb1d99468fb37d32384
SSDeep	384:amu3tBjKS2br1uNTsvZ/AMD3Y/4hF3VIg4U+uDBonq+dcfan6R:amudBjKuNTsKMD3o6+gRBQQan6R

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\desktop.ini.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.81 KB
MD5	52999f9c6fb9f1639bb1296510ed23aa
SHA1	11884d0fec6825e6695b8da04dcbd156692f7012
SHA256	2dc715398fc8a2c7df0beab3304684561fe6da3e47f90edcdfd395a5f64e4763
SSDeep	48:pnUsCx48Ut6vvEXOpd3Sfl9FIxK+u7v1cE0qA6QsawCfqPVX3:pUsG456UXOp4fl9W/g1cUQLfqP5

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Excel 2016.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Excel 2016.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.64 KB
MD5	fb4decf2376a7a8a56a3da684c561aa1
SHA1	aabde8d354e2a3ad2b46a09021c387aa8399f761
SHA256	1fab73615175e61327f7bd19b3cba626775ac430866725a6168759d41dfdef90
SSDeep	48:q5nX2KcEMJvXEtFUDE8DotC05g8z2ikabe9Ywbu/gR3ketTTae:q5X2KcEMJcFUDEc+/gA2ikabY1DUetv

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\10\286.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\10\286.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	bb1318d2f51f892ea4aa188777e1eb68
SHA1	7fcea5702b735041bec84ab7bcd694ac6a8eff67
SHA256	51a00a094a3c6541b6480f6e422c81303f7ee826a81ffdccac5235fa890fe290
SSDeep	6:4tRRs5m11r3INFs6S3j8qmjRCqoWAKde57mZbT8IJmNZu43HenJlNfGOk58Azp7A:IsbN9Sz8q5Ow39GlMn70WCIebEo

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Steps Recorder.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Steps Recorder.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	1.35 KB
MD5	f2220d3b177e5df924a3a070bc1d887c
SHA1	e786ea7634166bc97189df63a9af38fa50653d16
SHA256	6ecb1cc79301862a1a4a9ac3cae70f5c470e295ce5fd907171a3a8c1850ea057
SSDeep	24:P1Qto976XFr1f1ww5ct2ZqPMcTj0N1kL6cMpajsqqyY93NZgp2jfc:Py44z2tt2qB/L6cIajsqNY933tTc

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.011.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.011.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	92a9cfc3ebe6262674aafe5635ef361e
SHA1	19a98da4d99a734911c90809f2e8cac7373c8b9e
SHA256	6bde61f0ed11233e1dc0a40a8f8aa5c2e4ee1792c3cc79f2b712ad852c9c559d
SSDeep	384:ctsLMJAmSdl7sYIoR3Vv4GsSYRh2gy/ssCqza3:JOAmSf7Sq+bgj9Cl

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\04\261.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\04\261.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	b313413745d1cf377ee39da2b5914160
SHA1	82a595a77342973dd95dd7a56b0aad84db6e37f2
SHA256	113394ff8bf7c465d1af4b904e47c54a4cddf2ec4a30b4167a5bcc87f831a6ca
SSDeep	6:Lfg4VDpx7dfxK1uRH0y1YnAoEJT5gWqWtzyqq+BuZyikhvTyo5VIWNpmy02:Rh4OH0ymn6JyW2+BuZyHvhmy02

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\11\200.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\11\200.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	9dda03b038d3686e61c7d40d7ec4762a
SHA1	453c32e916198faaaff56216a1c3fc0c19ecb5b8
SHA256	1fdc14dbdd2a0c34bc8c0a3bbde1720d92c78226e3ce1fdb8a65195f93b97e41
SSDeep	12:teezP5OTZXMsgQiA507xltP6M2VgobK5/hqw:MezB6ViAS735sxbKL

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\06\13710.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\06\13710.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	fe04ddfe4b39b1f0dd5811adfa314c81
SHA1	ebf042ad98d21faea24f1766e0a96439a1ad87ee
SHA256	53e66ec08c94c3687839659edc64c92ee2cba62dcebad48e982685165ca2959c
SSDeep	12:vGLbycebZO8Tr4FL5AtjEUkXhOYy/XtIomrc:vGLEbLTrWL5AtjElOYy/Xu1c

c:\programdata\adobe\arm\reader_17.012.20098\acrordrdcupd1800920044_incr.msp

Modified File

Stream

Not Queried

»

Also Known As	c:\programdata\adobe\arm\reader_17.012.20098\acrordrdcupd1800920044_incr.msp (Modified File)
Mime Type	application/octet-stream
File Size	10.00 MB
MD5	96a8b7c995ee4ce88391a6eeff345b25
SHA1	97222b04aabaf1e5e66ed37ff1bdb017be6d9ef2
SHA256	0495ae6d8ff6a9f46535b7351899be2cc07b8744f3f908ed7a9cf033bd91396a
SSDeep	196608:F6aPNdhm69W1wNR5bnZzwitGRFJvW2YxWCqoM4ffR/uRVr8E7ejFul:FRjhm69W1wL5L6tvhTCqSIGS

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.017.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.017.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	113973c1c3b2426fdc11bdfa1fd983ca
SHA1	dd42ba0a3265fd81c51b8480c46b6ae97e749ca2
SHA256	eb948d84c1bb3de04f0cc00fce46837246ce9e68ba284595e4a120d34a74f1dc
SSDeep	384:CjX6uJIPk6cZ9mReyeAr87JFvK+ASvTOahtYq97M9Vq8/v:CUSUleBJo+ALagA7qYG

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Check For Updates.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Check For Updates.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.35 KB
MD5	2be63d3e8b90111158de45b4d2fde09d
SHA1	5d01bade251126f7749526a81e7547101d39639d
SHA256	be2a6aa83967a62e83740bcdf6e16bcdd18715c2146b948995d47e7b7c218acd
SSDeep	48:CVzxyaE6X1fit+v8xmRksHcMZmj/WGn36jX4fgoM7/kZS46eKvB70BJ7N:CVz4aESALxC3ZI4FMZS4YvB7aj

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedScenarios\Windows.Uif.static.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedScenarios\Windows.Uif.static.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.83 KB
MD5	492d95c58a73c1bab21bfee107762df4
SHA1	b81ccad64e0a1561fa326c4bac57792b71298eaf
SHA256	c55c1a6eae189541c80c61ff9439a24d3974ffea66f7466612885a032d0a2b11
SSDeep	48:07FLo9wUWl3BvzCK2w3MWxge9krlhdc0aSWHRYULUU5W2L1GXCC4E:t9wRlxvzD2lWx3ChaSIYULUh25GXGE

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\03\324.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\03\324.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	350a5cb5f71468efd09c4236024ba106
SHA1	42776de1a4e02ec43682e6cbb13fe9e622eaa623
SHA256	d7cd79d324e4656642e877077e990fbda1119d07c8a96a8f4fe2589ca81e6144
SSDeep	12:/Sa+JeFU9cPqiOBSr7JoPx3AhcAFfUqvLXua27j:/SzJf9yZO+7JOSSSUIDfyj

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\About Java.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\About Java.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.33 KB
MD5	72cc412c36c756fe0385ca704ef99a9e
SHA1	14bd5841328565fff0eff77b558b292cf1cdd9c7
SHA256	b5d14a2c4377215820e0ea71db18111903bf324123110957a30ab9a06073b9cc
SSDeep	48:BkKMsvVKe1KMS8Vl2PoVVbUyJ9rSyF1HWeQ3AnCyXIFxB/:BXjPSlPoVDLlF1fCyX2xZ

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\services.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\services.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	1.41 KB
MD5	d1d0252dff6f2daf498325c8ea1a9b9a
SHA1	b773956d1dc6d9a4401335e2c27e5192def734b2
SHA256	8939044ac7b81e93dc8e11495970fa2320e24f80dbc4b36c0719a12e2ca9b4f8
SSDeep	24:Njuho6QrwlR6HRxQ27FRl6MaJBPoHeYqj1d6fp+h/ZtTZDLwqIs2Eg:Nn6EwSH7HFRAjJBg+rj7954q6Eg

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\guest.bmp.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\guest.bmp.RYK (Created File)
Mime Type	application/octet-stream
File Size	784.33 KB
MD5	95f2c5da12900bed58473ed12fdc445d
SHA1	0e397638e17901a4a85e9179d752ef564f3273ec
SHA256	a6efb68654db862dd703d3292d53872e0abffedf576e932402774ec665f7d203
SSDeep	24576:YLETE5vJJzvXjjdBIM3MSkJm446jpGrfY+Bl:0vJJzvzjf3R44wyBl

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\18\107001.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\18\107001.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	660769dd42a641946cadd10f756f617e
SHA1	8e3c848f07217d3be8e7d5ebaa3ed2c87e11995f
SHA256	ef0c58edc7302f739147b2bf963495e2a96bd490276c2303d0e12e21ed0f291c
SSDeep	6:ZtMv30QSeBGHWEv2kHkvtfvto58W0PtlVyQOpeJXHlM3c/spnA+BwbgsZytiav:Zav30QSupkHkv9+qFE+WFpA+BYFZycav

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\PowerPoint 2016.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\PowerPoint 2016.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.67 KB
MD5	4d04d4d283cf8ee72161d904c6b52e1d
SHA1	1fbbd5d2e17d796da8a88f8c4d0df11662c910dc
SHA256	48122524643d7a57acc76da2ff7a29e07d4bc84a3c95ddca95c3ab7b9a5aa978
SSDeep	48:z44Qye8L7F3293JNwlRI+330UHScXddsnRoDO1QZhGY4QmeX36bhsMsw:z445ey7FekISTycXddsBQZ4Y4QBUhss

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.005.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.005.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	bb9f5fb787cb68907b25dac51a58ec07
SHA1	2df36d84b71d8778c65fb428837cf056a58f94bc
SHA256	c15dd387060bab5496878fd500c90872e0f575c17362a6723f51b5683b0204b9
SSDeep	384:CUk43vB09Y+rKQS8U+OZrZwGloyuwxjKQru1LbtGqOn+vm6bn/c:CUlp0CB8UpdZwMoUKQruBtJwOF/c

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Devices Flow.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Devices Flow.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.42 KB
MD5	dbdc989ebc175288df25567e6574d141
SHA1	35a3a154e640ee74323d1784d5a25c29bf522709
SHA256	265cdb5b26ad8a6f366c102d8887992a80b103a199bf5e38948383942019a93f
SSDeep	48:hFra3ssHnWKoHVi5GJ1JNPUC6TCus6ibPMXVYSWi1vBiOCIc:zOrHnWq5Grz/UjdiAVYSgOfc

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Skype for Business.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Skype for Business.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.67 KB
MD5	1e5cd8013147a54bd3a517a6ef645641
SHA1	0eecb08bb574fecf311e136728811f53f4696283
SHA256	1a4a9fb770a2aac8158ab3b863c2618337be450cc389693a4bdbcb3820d3225f
SSDeep	48:ZD4T2uzMxJuEpPiVGWLWx+X216KeBS70ym9AEZBb+11ttIbQOzXr/kz:ZU6ukJu1Lu+X2167S7fm9lSnHIbQWr/q

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.021.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.021.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	8.28 KB
MD5	939f5e483b99f1d950c1af7d64c2ee61
SHA1	a5d960f7fcde6ef8e0691af983b0f8761a745e3f
SHA256	a01540153f2895001dec437796a1e7086cf37af880dcfd10230773b15102bfdb
SSDeep	192:vcFy0rnut9b6rTC6IlABo9sa0zRC07KVpwPkp5IaS+djL+cSF9IoDU4:UFphMvsauGVm8p5IZaj6vF964

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.46 KB
MD5	74b1dd76b67464adcf5e839d8f9bac4e
SHA1	b1e0a3ab0e13d7504329ae90efa15569ee5347d9
SHA256	7187ebe0df8e255d964921f0ec6f9703cfd1f25600b6dfa85cc6af5c3415eacf
SSDeep	12:c8jhkKx6ufyC169iv7twiTvL7shRzat91:rOq6e1gfi7L7uRAv

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\guest.png.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\guest.png.RYK (Created File)
Mime Type	application/octet-stream
File Size	5.55 KB
MD5	0b58e672201877415e53a45c0af4e5b5
SHA1	fe7c8e6ebd9eb2660cf0549a023cd63edb1d6972
SHA256	e9adec0efbeb47065822523337c031bc60e1a7c16b93ff609d11c777018afa6e
SSDeep	96:mQbqYYRVdSIJ6mnx3YK3/aI5KmDWRoIYZ+9zRzWoNP5W27HDAgffB1abUPA7AiP:mqqZVdHJDnx3l3/pi17PwccgfZ1abNB

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\MiracastView.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\MiracastView.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.44 KB
MD5	648dee50c826b458787c577263837f74
SHA1	b16ed45419ab89023e4d852df40f8d27c529e924
SHA256	05bdd6573f70f0ce18342d71473c0623ec27123d169ad34a1a9f72ad0f41429b
SSDeep	48:Z7KOOTaX/r/iL98CegLeFQNReuJBcAjyzHIVl/yieuv:QOO8/Em5AeFYReecjHCeuv

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\desktop.ini.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.44 KB
MD5	fb505abe88344d21ffafa9303772837b
SHA1	c8d88ba934dced5a18a4d7eb3b569fd2ebd73d61
SHA256	afc3a5e3efd138967743381b0e6f6b6e235dd1c28c514aa8ec68fb09d3a05c7c
SSDeep	12:Pe6cta7tVtICTeknwgDYgyNbmkleuy06gGVxYn:PeLa77SHknwgkWz0jGVxY

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Excel.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Excel.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.64 KB
MD5	9de2b061032d3a1e9e3d18f22d7457b9
SHA1	e4590b393a962f5ea1f12b2df7589891fc6c945d
SHA256	dbe74a24ea05cf2382d399ff4a1e40c6e922ccf320910aa2ac98c177dfd7efe7
SSDeep	48:RbqrJ8yaRlDSSCFRQ/u04Bq/ce/l7KP3+zwlU4ArtMjNVxBEnGKUn/qgX7nYn6bQ:Rbqr+bItq5lGPOzwljfrBE6y+yD

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\13712.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\13712.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	79df0dc76b1d7483be90a72367373113
SHA1	0433c0bbfed1fe61ed09b41b518c96c948696cfc
SHA256	1f5fda8f45b17817c46fc636f13404bf9cce7763585b3beae51e4d1db134f698
SSDeep	12:4CrquXyiJnrHjVBFtw/DAAk0mBihh8oRd93DQ:4qXfJnjxBP2JuvoRfU

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\22\323.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\22\323.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	cb86281727ea3943a558084b19f55123
SHA1	c0c21cc7662337b283862a09b3b37bb2dc598e90
SHA256	aba72fe58aa17accaa77bd9dbef02c880c23dd580e52ab91d06a15e13d5e0704
SSDeep	6:+7gXCdlLuuJF5/0dADs+GdRszKlhCL6wHMZDfwgFq3xviwMXdYEWt1COY65c:Q1Lpf/VDqdrlhluMlwGwWd5W+OYX

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.bmp.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.bmp.RYK (Created File)
Mime Type	application/octet-stream
File Size	784.33 KB
MD5	90a2e4498f6135d4babfe250358578da
SHA1	47fc80a76370b3071d4049b655c3bcb4eea6842a
SHA256	5d3567d7e8939ea60b3e5ca5f5f2d44356d24ba4b2c4545d391ffdb78311f9b1
SSDeep	24576:qrofIkcxN3mW8bMVf/pGjW2BxybQyvHd2QbT5T:qMQ33mW8bM1/wq2B8LxNT

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\20\189.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\20\189.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	4c990e65ee2cd50f38c36f62c3751eec
SHA1	578d595a782ab93a29b964ab645cef29aee90c5f
SHA256	2548b0c34e6a1eca11d1bb6a1746045bc6c9c31ec6f7e595268f7bc534573b0b
SSDeep	12:b1rY+uH2DnPliAOnONizytJQG39HdthXKl8Bo2V:bRI2DPl1rJn9HhXKKu2V

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\14\9664.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\14\9664.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	285b49375336c31e3b10b8cc7522b7f7
SHA1	e9846fdeef152bc41c99bcb08212b9379ca5fa7c
SHA256	2d5ab8ad7e06796dee978ed0bd04c4e4de8ae32d837f44abe71de48cb5386b01
SSDeep	6:JvmlPTkqpgiXGTdc/0bca6CizNwSxVcvZOW8BRTfFIcd707ixctcqtf/U5WB11bA:klLpZXEdccYRbpNDeZOl3ICCv/GWBmUi

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\18\195.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\18\195.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	bf9ca786b74ef58a3ad2634e846753b2
SHA1	8554cbde6c0141a9afa5d9eb7cfd967dbf689c2d
SHA256	780950cfd48e0eef042f6e145b1c0133f2d6c7d80710b8b5c7b83ef0f650a4c4
SSDeep	6:47hEJKgmO04l4CEli8tpXDtiTOEWV7FiZHoQgPLoWcKKhcBBjKjNqtjtgAYDgq2o:VJl50YQPtpTt8PWCeFLoKKWB/jMhHL9

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\196.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\196.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	6b3817a926f64c8492855624a29a004e
SHA1	e9c7a2d88e305bb59d5ed79a88d72bd8a239fcd6
SHA256	1b03b2fcc46b2b4213e714f59fcb641419bc35772ee271e32f4e963fbe1b12ef
SSDeep	12:G3MS2Gx3gpx9sAmtc6+Icea8LneRKc7We6lkNvyS79VeDkd:G3MS2GxQFsXO6Ike4tlkNvyS7LeI

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.png.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.png.RYK (Created File)
Mime Type	application/octet-stream
File Size	5.55 KB
MD5	52165d4f97524bc73bab34f69e5f0130
SHA1	0f483d6d9a0c0aa86b6e64a4b9be7fdf8f948644
SHA256	ebd00ac3f49456ce37f99d75aaa8e74951ea1d32eab4e44b13ed7caf68c07b33
SSDeep	96:4vzAXkOWyiHd9QPrmCom6KgNeqRx6FTYRMmd5l7x/ziFGa8sPQmlvNKZOyQC/Q:iQ9yOrEXeqRx6FYXl7x/+FVhokEOG4

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\05\199.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\05\199.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	154dec0b3fda6ff6e080e361779f9418
SHA1	00787022c0c3123160275a73e646c9866136feba
SHA256	6db5a2c81b36329e7684602c052f335d46d6ee6d076de16039a788f031cf9d97
SSDeep	12:Qu9Ug8/hxQ2wptwIjIFio24neXnzAEEv2/:V9UtzBiycIFioPeUE+2/

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Project.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Project.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.39 KB
MD5	4bdc3598145ec973e4db8215601a6370
SHA1	6e3ed67dbf72b0b9ccb0950fb530c9b4362c5292
SHA256	b4f2eba0706bcc5fc0f2644e62cb28953f38e7bd8a2d63b1447aa647750f7963
SSDeep	48:fXg9Bd4oAEJW5Tks96zOvKdz9pHPhhkMH3aCmpDxWp9T0QVi8E4Xc:fXMd4wJW5bKHPhhkMHKCmBxWP0SE4s

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.010.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.010.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	12a3a8468899ae4fb1ff2886c32f7138
SHA1	f41bdbbca2d8358fd9ee3949deea1c6486cf6a38
SHA256	21402673b864602d8cd36b27898cd69cefb37962b3d1277cf1009824820de193
SSDeep	384:2TYblOeyap3oVA3HW+LG9EEO8O9Zb8WuG27PrMNy/tL:7lJxNoyWmGUbVuZ7wMtL

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\02\303.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\02\303.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.44 KB
MD5	9af8836eb2cbe793fbe2d7fc9eca4a40
SHA1	6ab266485e1278c23b9cba548bcea91878f5214d
SHA256	31774574d99851c4973356d102de9a7158c074d047dd569fe1bd738c4a521596
SSDeep	6:sypUucT0zZbOjT0bhLVl8W3ooGTmv4mCki+rWTxeAunb6yaklWHeULOEQ+eIn:n3HzZbMyFLoohvSk6cAWb6yakY+UjL

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\01\263.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\01\263.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	b6fac1c69937387bab7ba1006e98e029
SHA1	9da4d1918aa42cbe0f4cf3a0b91a732a28e053d6
SHA256	1e19f6ac4217fef68d7c7f35a727fb20c337d03138052beedab26c784368a439
SSDeep	12:YymV/qGve9UNTE9Vwmh6I02ur7W5G3wEvJHB:YHV/qh2u9VJP0/rS5ewEb

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Live\WLive48x48.png.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Live\WLive48x48.png.RYK (Created File)
Mime Type	application/octet-stream
File Size	4.83 KB
MD5	6f45a70523a04b4a4b0fae69bf99c8dd
SHA1	5128ff3caba5ca6ce777d522b5a44db9d28a65cf
SHA256	ae6dc037c24031db07056f7185bf3208c8cc755368028d1315a6daa41be320ca
SSDeep	96:4yBEgu6YUE2rqrIFF4Dijqwo/LNxr9kIvRE1tTmK5qFg:V8OiYuWDo/5xJksRGtT5L

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-32.png.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-32.png.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.67 KB
MD5	d710bcc0c380a7006a7a972df300c940
SHA1	31c944a9ed8bb9d8372402e35008a47bd6b613c8
SHA256	77d00168f976eb2c11a21f62226789e5431995c9efb4820d15b4dc12c2d6a639
SSDeep	12:kPBZg2ILGwLR79AF4w18GLAoQh7glJ2fCJES5ud1HihfJKOOM+2bP:WBWDFKpPQ9K2fCWPrCjKOPrbP

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\PrintDialog.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\PrintDialog.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.42 KB
MD5	f0897a7a54fd3affd7b66f91090050c4
SHA1	ccfabd1d77f7f51849c8280441cb7a0186562f22
SHA256	dffd7959987fc6c4e3afeff219bcd5b518fd468d5cbb1d90b4e6cef4e8f4d9db
SSDeep	48:IypcGBz9HECDsQTLW8NxpnngRlWMRv6sRrCPRb9dBnaHHX/G:ouZkCDsQ/x1GisRrCp5neHe

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\Policy.vpol.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\Policy.vpol.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.71 KB
MD5	d2ad0fb44819d965da98b741894dbc9f
SHA1	e0846919cfc513771a51a7771e4797b2e950f351
SHA256	8f4ef08ff5ede81c56e574565df1a225caeb0903da7753b522d4da6ab7a1c857
SSDeep	12:Cpzjs2lN41e+3pwFy7OzfV8iZ6kXo4AUOXDYZA4x5ivsgXE1kiJBEY:sns2lN4/Ox8iR4jU1+vsgX0TJBt

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft OneDrive\setup\refcount.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft OneDrive\setup\refcount.ini.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.30 KB
MD5	d5f76ec42c89319670e43df91477467c
SHA1	0ca62bbdfd1a5d8a9dabc3b6a62fc6d9a6a50bf5
SHA256	13556e3e718a993d78f75149e44fb0d9b49c9a100874b2d594a01d427a11dc14
SSDeep	6:j83dO5VZluhpSezQjyuDoXhs8jVHW2JsIlCRw8q7rA19HXL1n:o3dOvZlunQjyuD8sUwzIYrIrA1lJ

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\07\273.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\07\273.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	b386af410192b88af513ae8b485270a7
SHA1	5a72ba2b5682ef3e390d7bd1851e18e29a46d49f
SHA256	3dedf987e02209e45a0d23f926998adf37d1bb3766b6ff2f9e38fafc46d2bcd0
SSDeep	12:4O7is7G4CCigJrMOnIYVENFbGUXcjhkZtFrmBS6j:DBG4BiaQNRXcjyRyBj

c:\users\public\desktop\acrobat reader dc.lnk

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.36 KB
MD5	8a8bf0e9e88d8934aedda839881161d7
SHA1	43f01c44a3d5b46cfff90086179b512786d823fa
SHA256	1c0cfc91b3a5461dcd54ba706cb0d537f3302beb5bb61fc93f46382aca967c82
SSDeep	48:FDb/0ukJPLjKDNcoRi3NR7syWGO09wI3BcP/xbEyqKd0rhvtteEfG++v4+nn:J/dYfK2o2DAkBcPBzqKd0rhvT5GNvn

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Videos\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Videos\desktop.ini.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.64 KB
MD5	8bf58f675186a3d01cd87096e02d2904
SHA1	6e479f7a85b86603fdb6dda90220e5bef3274e4b
SHA256	c1bde4767cbb559ff635a13fbda741a2d84073cb6e72b11dd7a689c64daf4429
SSDeep	12:P8iVDd4InUgb/QRmNFZfcVPapv8te5RIkRQK3g4iAlmMafQ8o3aG:NVDaq4mzZIiHRrhpBl31

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\19\272.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\19\272.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	7629a12eef49800a328e619448e1fe07
SHA1	cb657c65e6c9ca07cf539b3f135b6b44d24cc7f8
SHA256	770f02ef462c58e8c1fbac9be2dfa70043f9ed04bf388e2b05a99495d68fa727
SSDeep	12:nDDEs7oqV2mz35ztsocrMAHmVP2JzjP7tEv:nDDEoZj5irtHx9tEv

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\desktop.ini.RYK (Created File)
Mime Type	application/octet-stream
File Size	1.27 KB
MD5	d9a3776691ef46f21fa9e978105c6e9b
SHA1	d3d01c188811334cd6c1a5e610e71fe5bd5e037b
SHA256	8e1ef41d2047db0fe8d0d85b38ba6d6ca516ea1284e20c1ec4373cff42cfd6c1
SSDeep	24:T7KdZCwBK2aUQMicwiutSnO3fqljgy/7zGbVJw/A7XU6mGn9:iXCwESQMhwiKSSyPGbV2JE9

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\OneDrive for Business.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\OneDrive for Business.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.42 KB
MD5	10e25a547f7b3cabb4164258d60a1c23
SHA1	b7f99d0b01e078a6a1ef2482dd84edc12786f637
SHA256	5993f204ee9c29edf264ff80a81d76a6602305a7cc2ceede45a177d64229f839
SSDeep	48:hWEjaOladIbu4dTTz3X8mPYxfmRVa57bgLtW7G6vwmXHxT8fSs6:hWE7cdSuoLn8VuR0T7GFmhT8S

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\10\197.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\10\197.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	ecc3604008f93b30130c986cb447e7f7
SHA1	5e2da6f95873cf812264ca8dbe796660adee7440
SHA256	76aa3120b15a65910d35226ca19d16ac52597748493accb106a47c74b372fc11
SSDeep	12:wCQT/5Hwqa3JwZ69kSWM7HEbRGmacAPT4UPNd0mXzdeyAw:wHTBHf6JwA+M4b9A7PNdJeBw

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-192.png.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-192.png.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.63 KB
MD5	a0ae83d0475f6aacfbe71322e94ab9b4
SHA1	0974b5d847a3423d1b59c6b126c108fa9e3f40a6
SHA256	72727a49a0e782d716d9bf7130b9072532488a5a81f03c7c8f7db85eb6c577a0
SSDeep	48:Iqd8pz/VHIvoPF5rkiWX4TSDRKfqI1gEnNCrHpYyIb:MHIvqF5w3ITyKN19Nipfc

C:\Boot\BOOTSTAT.DAT

Modified File

Stream

Not Queried

»

Also Known As	C:\Boot\BOOTSTAT.DAT.RYK (Created File)
Mime Type	application/octet-stream
File Size	64.28 KB
MD5	702aef55d4213f91cc1c01432223f600
SHA1	966746a354830a2b728eb006130e2555b9868a9f
SHA256	d74ec45c0cc70afc3a274682972e41f8e86161fc6294cba467f1b7ec7bbfa365
SSDeep	768:qe6gt6WFO4F9Nm1YCUvnuYDf4ov4ZsTwkhD1R6dTSXUczJE7U3CPljfXcawWLaQ6:qexPt0kvnBfUsEo27U3gj/cRQXQhmjU

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Configure Java.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Configure Java.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.30 KB
MD5	0451cd8e5ad3e3ce7cd51607ba0b2edb
SHA1	15abdd04867894e5ad06f94c483d8c82e582ebd6
SHA256	389b55b662032427e0be1b02fe15360fa16b7ee85cdd5362fd3d9c3318c23e61
SSDeep	48:aU3il2X76oEUl0cWqu45QDZ+7yJMlXWh1frSJ1zgsBqutluQ4:aU3i4mTLq9+Z+BlXWh1fszgyluQ4

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\desktop.ini.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.55 KB
MD5	9bd5df84207eb6c41650ed6da87b4a3a
SHA1	a0f8d78bf5e889bafe75126c0486695b0ce018f3
SHA256	c01616bd776e84c888e1eb55b0e7d15b566193d91f7d61ba0896370b495c77fe
SSDeep	12:Vgz3EO36ZNc20PR1yVl9P3FTc7cKMsi+YZi2ZY9S/8/Jn:Kztqo22R1yV3vZUMsinE68x

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\18\107002.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\18\107002.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	80cb14e8a1a2b23893be7dff600837fb
SHA1	2850bb19aeb721f46f7ae97f9c3ac5a944471e26
SHA256	412f526da238dca1b6ff322da07b5acccb3c44aae3ae60e1ecc211b95a7fdd12
SSDeep	6:rJEBtItuK9zhvqlD20h7kdJTWvso7+dttfmU9Upw14od9LEn/eCpTKC9MEU49UfM:ksuK9FCdWdJTzo7wtttBVE2YB4f3AD

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Music\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Music\desktop.ini.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.64 KB
MD5	43857b91f40a580765dba15b43a24993
SHA1	54ddb105e05d3f2173bd3f483c356edaf1ce5e6b
SHA256	c760b60ec2cc1814193f3fa77dbeb6786d64fb9b0caacde16379f079a4f93bdf
SSDeep	12:w512u2OXqCpHrdo1rRjXUm4nhvju/dc+2NXSpgkcZLyjWjLBp:wZXqIdMVL1Mhvju/G+2N6JcmWjlp

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\05\317.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\05\317.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	35a19702037a706566f310a887b43c25
SHA1	5dd6cf95941ef2a6e3f99d57d43fcaa15d5f5ef7
SHA256	3b229e6a98e6c411a63de597896f58d5e969c63f6d5e40cd27ca8ea6c96c67b4
SSDeep	12:Nb73AzlEK5piQeNnAt/awgtIt7c4gwae6cx:RAze2gNAN1gtIaFw5x

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\13\278.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\13\278.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	b3f85e51c8a34634a008fe6dfc9c5914
SHA1	51e418fe13e612516c19a874a8d7af9c732f19e0
SHA256	6f3d87f86129aa5ffb1f0acd475c549593fc5183ac18093960dc13a211be8179
SSDeep	6:5Z6+GCyLiBYAn/mTkla7ReueoEbmLupt1mwEfO9yBBtIctzxt9oMpyu4vBjJn:H6+GxiBFviReVaLmZIBBBtIcNxfX4v7n

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.009.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.009.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	3dc217c394623f6347c4cc2d1c04461b
SHA1	ca1f61e3fcdecf8e4da8dd1c00a961c166e850d8
SHA256	943cbce40b8b5de4fb4cf40f17559fbe67e9749ce5ac494ade32194fbfd3a8f2
SSDeep	384:PblSCnyjLOTxgMObnlqyeWUU1tHSrTbNqgz6dey:DnSsxgMOblqyjiAgu3

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\desktop.ini.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.64 KB
MD5	af9e225f5c805ece5624412234903d0c
SHA1	8a68be8c3106c088d9f7a1daf3da956a7df73ee4
SHA256	7eefc929c7a5a291eeabbeec58c666f2a7045e6fa2f9adf337d745123a9343e7
SSDeep	12:QvA4glM8zY78vKc3EQcDdUNFDShSQ9dKKhhjc4Q2kHjEZzPGB5QhM2IYVGgj+ojG:QYtlMUY6Kc86Dc/9dKKzrpawPs2IYra5

C:\BOOTSECT.BAK

Modified File

Stream

Not Queried

»

Also Known As	C:\BOOTSECT.BAK.RYK (Created File)
Mime Type	application/octet-stream
File Size	8.28 KB
MD5	bf3e8cf77d7e4c61c060a656634bb1d3
SHA1	b89cad86cf0d7062c9bfcbfcc5c97eba63363bc4
SHA256	fb3ea50e58762538170de2cbaf4cbc808572b8230c8ca92325238fdcc229798e
SSDeep	192:LQ94zj7t3Y5zZqu/3kkE8LWo5PUyPq5FQA5nVWpqhX:Cw/t3QkkEyCbQ2x

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\01\271.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\01\271.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	b3336d741499b7751de89c91a3945822
SHA1	a1c4d3fee482dfae56bb5e3db160eada6b438360
SHA256	6ed2ded9b8d9d55699347d7e5e2e8e2cbb5c122693410ebc0a59ad7ba7853fd5
SSDeep	6:MyDrub98iS0pwKr+/46PDYgPZxv6G7A6mPRp8p7nHvrOsAk1smebTT00/kOawQt9:ju58iNdcYgPZxvlARp6p7nDDA4evAcJ8

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\MpDiag.bin.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\MpDiag.bin.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.39 KB
MD5	a37e1f85525fc3dcb18ab17629e31b90
SHA1	85c2f813d70e841fb3fd4b7a3e205e93843944a3
SHA256	7e006f2a421f14ae365e707accffb2eb3f895f56be1ea8ea43a6759be2ed4cc8
SSDeep	12:KJx0Bbc4f3fqJ5/uksyn9XxeeYDSdhZV9zl:SxKiJlJ9XMPD2D7

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\00\192.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\00\192.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	582b5373e9adc3d3e6890b204266f7bb
SHA1	880bab8d42c6fa2484a596e2bc7994292e55b2e9
SHA256	930e144147c4519f5b42bc97aac98bc6859eb95c7e9753382310b68059f2d786
SSDeep	6:sL0ILjcm0t77Yl8pQPLIuc8xA42AqJXVTsZypheD2dlZuAqnwYJmP3O:sgIXr0t78gQPLICqQqNVTJluAqnwM8O

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\OneNote 2016.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\OneNote 2016.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.61 KB
MD5	685ae223a9d670a6e06a26b3dafbc8cb
SHA1	a6aa2fe1b5dcf4511f636b97c1a5a21cc5b8a583
SHA256	d5257ab4158b4e0aac4ef185406ad52792a498bfb4ef4917d05101a25769c46e
SSDeep	48:8TzdGgdIRKhocOb48k7Y/lPIoZJLnQsrvQzYbfsilamI7ekKzEJ+3ypLZAJmX8uY:UrFgOwZZVnQ8vVfsiUdqUJEeK2P57yt

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\Desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\Desktop.ini.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.44 KB
MD5	8f0bd2751d8888a0c3091cd76b37546d
SHA1	27ac87845d4737571358c527cda3fcf774f96b92
SHA256	95362dc49e96d0c6d1acc12c5f1b3ec48f08460c0c268726d95176ad7f473b21
SSDeep	6:ezw9Cd3SYL6/KQtv8POKK2NCVfwF3I+/aapmT9vR17v6XLENd8j7wVRYl27Bgzx4:eCCEYotvSRooF3JCOmT9vTpk7vxETv

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.0.xml.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.0.xml.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.21 KB
MD5	e1ed4fb520fa9410fc3c8efca74265ec
SHA1	1c1a877cbb077f6b92c0f0d01c4eea2a8aeecf08
SHA256	e0f78f776e1b4de63537b1dd2798b900d054db03b45a71349818e42daa4fc852
SSDeep	48:fBH1NaYMppJLkuFXTsFUB2y9g/rew5atT2EFLh8j8s8uZcKq6bh7Vwom:5VsYPu5Tkgt+DeGatTnFhI8s3ll7Vrm

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.012.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.012.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	0b6a2c3f4092cb37d838c5523bfbbc47
SHA1	4cd2dd6b349dc67ddf2f828baa6e07f84e574cf5
SHA256	9d669000dc09e385f6efc78f65dad4a51abbaa03f215790dfb8a31ed7bb029c0
SSDeep	384:LT+zVa9px+mMoIEjXjQgnlnEJr27KDAj2JSZHpTEokQKM7x:Sa9fsHEjXjznZi27KMKQpkA

c:\programdata\adobe\arm\reader_17.012.20098\acrordrdcupd1800920044_incr.msp

Modified File

Stream

Not Queried

»

Also Known As	c:\programdata\adobe\arm\reader_17.012.20098\acrordrdcupd1800920044_incr.msp (Modified File)
Mime Type	application/octet-stream
File Size	10.00 MB
MD5	c07efece4d0d44f8c6284eb43066f45e
SHA1	ba9dbe8c2553ec95c5945004a0251d2929ce9583
SHA256	010ae2bb6c236e2fbe5a8f58d23267a66b6ddf0d81d8b774f07d684b783e1e75
SSDeep	196608:F6aPNdKvwNR5bnZzwitGRFJvW2YxWCqoM4ffR/uRVr8E7ejFul:FRjKvwL5L6tvhTCqSIGS

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Skype for Business 2016.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Skype for Business 2016.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.67 KB
MD5	c824da5e042f3957d7ab654663bf11bc
SHA1	ce15d10dff28236f795e6e9af5ec5a1aade2a12c
SHA256	19a055c97665e55aebb8d941939cb8f69f66050180ceaf7efff20d699d8273b8
SSDeep	48:RuazFyYXXJUW3zn9anYIxL0L/LhIUjNAnVSxBG9YoAJem25:RBzFyiOWEYVWTVSO9YoAwm25

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.016.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.016.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	d2d38885dd49b2b6f642e87064b7fde2
SHA1	26ec60a3a6ea4aa47dcb5b06180c57ba666940c1
SHA256	1758238f8144547d64112295f0cef1d5fd8cbd83fe637c889abdb2a0bf1efd2c
SSDeep	384:JBqCk77o2+F1orwu4gbMBeQ+zVbsc6Axyf:Jy7o2S/bBZyVn6A6

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.1.xml.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.1.xml.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.21 KB
MD5	ec6bdcdf00230fc91f34cbc500a50be5
SHA1	ffd0a3348c159606ce8f5cd7e6e236e2b14abd4e
SHA256	4ce5ae7bdc6692b854dbe0aab69650da1f1e0d1fbfab3c7c4e94432a54310da7
SSDeep	48:UXYQswMypu9Ksnikh4Yl9TSgc9tEg8XqclyAqh9NrKPuoZG+/Q:Uhhzpu9Ksik+OTSgc9t8aEBqh9NrKPu7

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.2.xml.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.2.xml.RYK (Created File)
Mime Type	application/octet-stream
File Size	1.63 KB
MD5	81fabab16451653a28ebef487db022a2
SHA1	bb820caecaa3c39f6e68ed754e86895370337b42
SHA256	9d334b7737a39a370db1c87ccbee2fdbb24770320f3fe5cb6ab4436c4bcdd841
SSDeep	48:tiHTazf4lGiD4Ox23bqOPZJQz5SH+MIN7Sb85s+IYd:OGzf4siD4Ox2zPZJc5H24f9

C:\Documents and Settings\All Users\Adobe\ARM\Reader_17.012.20098\AcroRdrDCUpd1800920044_incr.msp.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Adobe\ARM\Reader_17.012.20098\AcroRdrDCUpd1800920044_incr.msp.RYK (Created File)
Mime Type	application/octet-stream
File Size	10.00 MB
MD5	83f9060c4e4f5a09e21fd91393da6d21
SHA1	052b35ea11fe33b6dc01b8447dcf9fe139b66b18
SHA256	148774551c19317a2c577572ce16d8ba8723d8780750f7718c0d9e73124ba216
SSDeep	196608:F6aPNdKAVKIQtgzY9EyjVx2YxWCqoM4ffR/uRVr8E7ejFul:FRjKAVqtgzY9dWTCqSIGS

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.008.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.008.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	0f2f7d3974fa9c24e7870bf7740b22c3
SHA1	1fa5bf95d8050d8790c36e1205dcb972a06d9ce2
SHA256	0cf59335bae48f528d795d1c0c49e600214c4ec5aba7be76befa30f58b1fd124
SSDeep	384:Xq00gJbVRG1JO3p/DKQWz1kq+b/3nszn3FlDzQH9fvr:XL0glVRGP20+b3sznQH9fvr

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Access 2016.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Access 2016.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.64 KB
MD5	a451dc4df9d263df1d01a3f5551599a0
SHA1	7bc83ef2a6c74eaacfa38c146a278234dce9d2f7
SHA256	6c1cf2e05de0a94c29e84ed5a8414c93ccbc163c1eafd90a14e6ae1b433de3c7
SSDeep	48:aa71Sq5iP9QPchgrXHIS5UfxNniv0sgQKOCzD1evcrTfyTFP:dl2wHrXoSoxkvv5CzsEnyTt

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\dfrgui.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\dfrgui.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	1.41 KB
MD5	777316fc48e1857257e66ecf6715262f
SHA1	c082d854b8bd43ce1c379dee2979ad0ccecc7ca0
SHA256	668020e005935cba1e277a0242df8ab34fd742fef50676dd14fb3d25454e137c
SSDeep	24:B44AqzxaQ7gconPQc/dczojk/RcUHHsIGCFIAL3IuFT9ppZo8IF3DpClyv41B23K:B4vqFaagco//drA/RcecCTrIuFT9jZoo

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\21\13719.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\21\13719.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	42ce4be818377bd65e970f4749562abc
SHA1	028c68a48795066f6a0ec0a86f97db1950b97c2e
SHA256	ad538458497141aa1a4f13e47742d4bc870eb7223e61c01db66d56a23be6cecd
SSDeep	6:8eIPxsSkopot4EV6FffSsrOFl6ZAWTXUKNNsKJ15+dOiuD3C0UX1Kns6lSx:uJzXGPLsS2AWrUI+KJ7+dODO0UlKs

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\10\267.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\10\267.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	53c971c11a197483cf3e854f5578b030
SHA1	b66341b360c29e02535890c7c003d7c947975396
SHA256	c1dec170ca8681be4ba886f42d5719e79eea8811dd2b24e60522dbe99ff418bb
SSDeep	12:eYERfNWkyVjhJ1A02CXkDnHHKDhgXR6LJHinjYk:eYERfhOjhTn2GMnb69HwL

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\09\13711.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\09\13711.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	6cf57aa8093cb78a9c0dbd1cef4a5b87
SHA1	081d2e9544e4305341f9d4da9b647f9992ddbcde
SHA256	fd1ed3b5864a53e645b96d14cafe618d9a9b24b13358531104ac6159932d4e6a
SSDeep	12:UdntU68Xub9WWZclUDszAoeUgIBFUPbw9Wcq:untj8XO9DZ8yvUgpbwsf

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateUx.001.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateUx.001.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	4.28 KB
MD5	495fc4c3037e26ac0b8d748bf4053f73
SHA1	afe563ba6e23bf69c9000669c10e15d51ea43ece
SHA256	20e2f95b3bf91acd2209a9db6d6b450ca90989130189c9d2753c1911fdc33b4d
SSDeep	96:VKRBDOg8xmyx11EcWCtiOsrh4nclTraSV2BNGZTjRHg1/Ep3W:ARBD38x9j6VCwbuERxg1/E9W

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\MetaStore\2\0000000000000000.idx.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\MetaStore\2\0000000000000000.idx.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.36 KB
MD5	65deaec14db12ceae117df46bd445d57
SHA1	a85a8df49b09a729a22a3754b016f63bbdf95dc6
SHA256	f29c68a4ba02189535302cf2dfe4c476d1afbd671d8361ebcff5e2933233cdfc
SSDeep	6:AJlQ822C1pA3VOEPSGbgd8U1AkJBcnTndgrGyydSnFx0hYhTOBZ7Dhk0iZ/RaO4V:AJW2apIVOMbgd8U1jCnTnSGybnYihuZV

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.002.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.002.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	5ba99386d83aa5d5d1421e09d94cfdf1
SHA1	6e1444ac8c5611957809dce09d962b9d45790433
SHA256	5124c4fb80afd1540243c8a8d7d032e97d74f4fd051d5c21d5be89b2e7f58c50
SSDeep	384:JT5D4BNKlm6UdARaBJr0MHBDBl4xfdBYPVjI03:JtDUNKlVUdMaJNBl4xKl

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\desktop.ini.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.44 KB
MD5	818524c9fb868422fa0d98f7b64df9ad
SHA1	02d9737253c2690c6cfbfa2260f46be87ac27b99
SHA256	2551ad99f1ed5216f8e3504c61e7f01d32212540cd044943e6a92722f64df1d0
SSDeep	6:oTf5bRLroP2967ObbqKYwbvYK/QFpByop2eH+5rEvc+nF1ZEVfMAu4THdxCCL0IW:oTBFoipyDd2eetE0GF1ZE64THd8CLNur

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Publisher.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Publisher.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.63 KB
MD5	937b5b75555746e39e86c81437453305
SHA1	7e57f216ff4b59727fd4e9ae17dc2ac48987096d
SHA256	26e05e88d52a09fc59ab8ec57738fed9a10cd9f147a60910b45e8dc16986ccd8
SSDeep	48:H72NomybBAnFzPAW7BjwRHxoiUP7BXjnCWcR74MHed4PI:Hi5LAYoHu5PVznCF74MeWg

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\04\259.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\04\259.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	8bc6de009595a0abff15f2a63108ce19
SHA1	af87ec7fd4fb5d861e09c260ca13374c27d7cb45
SHA256	f02bcb736dacce3c1f52b3493380af928accf57d76a5c13e075806c946adcd04
SSDeep	12:RFPDDtkCMxMuTLVrWI3sSy9E71MtWYLIXrWgNbqDS+Yr:RFPD2K7IcSOE71MtvLIyqr

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Snipping Tool.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Snipping Tool.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	1.38 KB
MD5	5fbfd9e6ca52babebdfb56e31006c0b7
SHA1	b89c577fb58071e4d6aee00e313f61cf3422bcfe
SHA256	b0ec7cf45ed8c4ce236aea20e6fd4f3148bb31f5b458d0d95ac9b6c5a2196387
SSDeep	24:lCPatxHXWn3O81QOfouUtdljiyewUYTZBD4nA59sakuuH7aSYcwZtEa9M7hlB87+:ESDn81QtRlepu0nu9ssIYcsO7PG0h

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\262.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\262.RYK (Created File)
Mime Type	application/octet-stream
File Size	0.41 KB
MD5	8401d089bc4389826078003313733efc
SHA1	1dea16b945f601e762a19adaa6b6d9c338b16df2
SHA256	748dd14bc0a0db9fbe472450ebc7f16fdb37e4e52f62bfdfdbf4990002ce25e6
SSDeep	12:m/y5Wv1Q9gaWvGKWQXdjQju42if47zlqJqbN+dO07l7e:rWv75GiXCjZ2D70JuwTy

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MF\Active.GRL.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MF\Active.GRL.RYK (Created File)
Mime Type	application/octet-stream
File Size	14.89 KB
MD5	bc0c16eebdbd42680a61f3b726842724
SHA1	ab026ecd252d5733daa60863a1cb4cad597e3e8e
SHA256	c0c4436b6f328426f8cd1098898f37cf0888f371608f932a245c8a7350693bd4
SSDeep	384:AFQGrD1PvZtJEYWjuRaDo67CjN09MfkCnQ1b/jK/i1h4Gxwt:Ad1vZtJr5RadY09A7QVh1h4GWt

c:\programdata\microsoft\windows\start menu\desktop.ini

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.44 KB
MD5	364c30ef6340b6d56332ec20bbe4844a
SHA1	f6ff0f7b8bc133948bd5aa6b72f2568a0fecdb53
SHA256	38308000a0277e33207112fa6f6ff6fd818c4913320f70445ace59c339da9b8d
SSDeep	12:kgYkCw5cZbPPWk2Yj+w7a7b3bP2B3O/HPZ9:kRtlY7fP24R9

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\Task Manager.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\Task Manager.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	1.38 KB
MD5	28b0f6e23d60939b47109bc9e7aa46b0
SHA1	2ee1d72b0a47d6a16770a20f2c30a0378a1facc7
SHA256	93c14fe789473a8d445a3999cf59440e2662ea883388922c89173e9e2de3fe31
SSDeep	24:572zM5zAgXp3IQeyxlkMOp9F9X39pNhnDt2nOfG+6BBeYq6Z8OzSknMCw:5yA5znXlIYkMW9FhtpNzDfGnnHpqOz9Q

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\Default Programs.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\Default Programs.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	1.50 KB
MD5	3473528fd1fad87753436fe5fbfb5204
SHA1	92e9670f52b6ee4708be28c73c65e50727727a7f
SHA256	f9aa2fcc3216f862dd416eb61e232d7ab2323c9f9af5ca682c1551f82c9dc834
SSDeep	24:P0au5Qdj256Iz0bI+6asjo4/lS5zEBdCKyIlQeFVT2GoZqkNRK7uWTiESrm:P0anj25Vw0+6aA/kEB5NFVTDQVWz

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\PowerPoint.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\PowerPoint.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.67 KB
MD5	6c02d874ee7e2c1c82c283b62ae921b7
SHA1	51aa72baccffaffb504c54760972912646475d08
SHA256	55ce0399eb0312536948d194e18811e9780bd597b9229238967e81dbaa75ee0e
SSDeep	48:468N7BrHbnUfr4ey9568XL4CT7DG0Zz6Jr8+B6AYrR7GAP0MArSfg+uJbW:tw8r4eO88b4QGT8+B6NAZM2t8

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Visio.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Visio.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	2.38 KB
MD5	1a7b99f7737e4eac1ea2575907760f1b
SHA1	275e110d65b62f98e22daf3a9d6b0754030bd6b2
SHA256	77afe45d9aad1fcf0dc1f1ec3b4d612a2308f3b242af4848d973f9c4b64e59e7
SSDeep	48:BtGnQLvAijkjFznmXplByB1sRd5cgkfqLhEgNCpOsiU3/947V4NUo:BtGnQLYWIBmXrQsRfkZFMszV4hwUo

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\XPS Viewer.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\XPS Viewer.lnk.RYK (Created File)
Mime Type	application/octet-stream
File Size	1.38 KB
MD5	041b1af554d37feba91cd96999254c1e
SHA1	7941712d840bcce5a48e2a78e5b21c9f6f4d83e4
SHA256	1732758e455ec764f9acf937a059c4025bbfbcdf1cf4bc45f3c96355c5bea1f6
SSDeep	24:pDOfnt8l4L7HgcAwTy8ow7h61BuymmuVJkMcagRRqh1jxUVBX/m9UuMJr:pyVlL7HxAwTfNaIbPJo701jiVBumuMV

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.013.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateSessionOrchestration.013.etl.RYK (Created File)
Mime Type	application/octet-stream
File Size	16.28 KB
MD5	002c877d7a885646c29c5fe511bd2afa
SHA1	602081fd56e01318bd73d85efbd3c109e60d83a4
SHA256	437510eb5e735465d5fbb67059ed085b024f916dc3a607d8609f53922d776cd2
SSDeep	384:4I76vCipxo7y5RZURlDdkyzc1KHCi44ysbzsxlQM4wlMHl3azP:4IWaipxIoZURdjzc1WAwbzaaHd8P

C:\RyukReadMe.txt

Created File

Text

Not Queried

»

Also Known As	C:\Boot\RyukReadMe.txt (Created File) C:\Boot\bg-BG\RyukReadMe.txt (Created File) C:\Boot\cs-CZ\RyukReadMe.txt (Created File) C:\Boot\da-DK\RyukReadMe.txt (Created File) C:\Boot\de-DE\RyukReadMe.txt (Created File) C:\Boot\el-GR\RyukReadMe.txt (Created File) C:\Boot\en-GB\RyukReadMe.txt (Created File) C:\Boot\en-US\RyukReadMe.txt (Created File) C:\Boot\es-ES\RyukReadMe.txt (Created File) C:\Boot\es-MX\RyukReadMe.txt (Created File) C:\Boot\et-EE\RyukReadMe.txt (Created File) C:\Boot\fi-FI\RyukReadMe.txt (Created File) C:\Boot\Fonts\RyukReadMe.txt (Created File) C:\Boot\fr-CA\RyukReadMe.txt (Created File) C:\Boot\fr-FR\RyukReadMe.txt (Created File) C:\Boot\hr-HR\RyukReadMe.txt (Created File) C:\Boot\hu-HU\RyukReadMe.txt (Created File) C:\Boot\it-IT\RyukReadMe.txt (Created File) C:\Boot\ja-JP\RyukReadMe.txt (Created File) C:\Boot\ko-KR\RyukReadMe.txt (Created File) C:\Boot\lt-LT\RyukReadMe.txt (Created File) C:\Boot\lv-LV\RyukReadMe.txt (Created File) C:\Boot\nb-NO\RyukReadMe.txt (Created File) C:\Boot\nl-NL\RyukReadMe.txt (Created File) C:\Boot\pl-PL\RyukReadMe.txt (Created File) C:\Boot\pt-BR\RyukReadMe.txt (Created File) C:\Boot\pt-PT\RyukReadMe.txt (Created File) C:\Boot\qps-ploc\RyukReadMe.txt (Created File) C:\Boot\Resources\RyukReadMe.txt (Created File) C:\Boot\Resources\en-US\RyukReadMe.txt (Created File) C:\Boot\ro-RO\RyukReadMe.txt (Created File) C:\Boot\ru-RU\RyukReadMe.txt (Created File) C:\Boot\sk-SK\RyukReadMe.txt (Created File) C:\Boot\sl-SI\RyukReadMe.txt (Created File) C:\Boot\sr-Latn-CS\RyukReadMe.txt (Created File) C:\Boot\sr-Latn-RS\RyukReadMe.txt (Created File) C:\Boot\sv-SE\RyukReadMe.txt (Created File) C:\Boot\tr-TR\RyukReadMe.txt (Created File) C:\Boot\uk-UA\RyukReadMe.txt (Created File) C:\Boot\zh-CN\RyukReadMe.txt (Created File) C:\Boot\zh-HK\RyukReadMe.txt (Created File) C:\Boot\zh-TW\RyukReadMe.txt (Created File) C:\Config.Msi\RyukReadMe.txt (Created File) c:\users\ryukreadme.txt (Created File) c:\programdata\ryukreadme.txt (Created File) c:\programdata\adobe\ryukreadme.txt (Created File) c:\programdata\adobe\arm\ryukreadme.txt (Created File) c:\programdata\adobe\arm\reader_15.007.20033\ryukreadme.txt (Created File) c:\programdata\adobe\arm\reader_15.023.20070\ryukreadme.txt (Created File) c:\programdata\adobe\arm\reader_17.009.20058\ryukreadme.txt (Created File) c:\programdata\adobe\arm\reader_17.012.20098\ryukreadme.txt (Created File) c:\programdata\adobe\arm\s\ryukreadme.txt (Created File) c:\programdata\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\ryukreadme.txt (Created File) c:\programdata\comms\ryukreadme.txt (Created File) c:\users\public\desktop\ryukreadme.txt (Created File) c:\users\public\documents\ryukreadme.txt (Created File) c:\users\public\music\ryukreadme.txt (Created File) c:\users\public\pictures\ryukreadme.txt (Created File) c:\users\public\videos\ryukreadme.txt (Created File) c:\programdata\microsoft\ryukreadme.txt (Created File) c:\programdata\microsoft\clicktorun\ryukreadme.txt (Created File) c:\programdata\microsoft\crypto\ryukreadme.txt (Created File) c:\programdata\microsoft\crypto\dss\ryukreadme.txt (Created File) c:\programdata\microsoft\crypto\keys\ryukreadme.txt (Created File) c:\programdata\microsoft\crypto\rsa\ryukreadme.txt (Created File) c:\programdata\microsoft\datamart\ryukreadme.txt (Created File) c:\programdata\microsoft\devicesync\ryukreadme.txt (Created File) c:\programdata\microsoft\diagnosis\ryukreadme.txt (Created File) c:\programdata\microsoft\drm\ryukreadme.txt (Created File) c:\programdata\microsoft\drm\server\ryukreadme.txt (Created File) c:\programdata\microsoft\identitycrl\ryukreadme.txt (Created File) c:\programdata\microsoft\mapdata\ryukreadme.txt (Created File) c:\programdata\microsoft\mf\ryukreadme.txt (Created File) c:\programdata\microsoft\network\ryukreadme.txt (Created File) c:\programdata\microsoft\office\ryukreadme.txt (Created File) c:\programdata\microsoft\search\ryukreadme.txt (Created File) c:\programdata\microsoft\search\data\ryukreadme.txt (Created File) c:\programdata\microsoft\vault\ryukreadme.txt (Created File) c:\programdata\microsoft\wdf\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\drm\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\sqm\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\wer\ryukreadme.txt (Created File) c:\programdata\microsoft\windows nt\ryukreadme.txt (Created File) c:\programdata\microsoft\winmsipc\ryukreadme.txt (Created File) c:\programdata\microsoft\wwansvc\ryukreadme.txt (Created File) c:\programdata\microsoft onedrive\ryukreadme.txt (Created File) c:\programdata\oracle\ryukreadme.txt (Created File) c:\programdata\oracle\java\ryukreadme.txt (Created File) c:\programdata\oracle\java\javapath_target_5923062\ryukreadme.txt (Created File) c:\programdata\package cache\ryukreadme.txt (Created File) c:\programdata\softwaredistribution\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\start menu\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\start menu\programs\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\templates\ryukreadme.txt (Created File) c:\programdata\usoprivate\ryukreadme.txt (Created File) c:\programdata\usoshared\ryukreadme.txt (Created File) c:\programdata\usoshared\logs\ryukreadme.txt (Created File) c:\programdata\microsoft\clicktorun\machinedata\ryukreadme.txt (Created File) c:\programdata\microsoft\clicktorun\productreleases\ryukreadme.txt (Created File) c:\programdata\microsoft\clicktorun\userdata\ryukreadme.txt (Created File) c:\programdata\microsoft\crypto\dss\machinekeys\ryukreadme.txt (Created File) c:\programdata\microsoft\crypto\pcpksp\ryukreadme.txt (Created File) c:\programdata\microsoft\crypto\pcpksp\windowsaik\ryukreadme.txt (Created File) c:\programdata\microsoft\crypto\rsa\machinekeys\ryukreadme.txt (Created File) c:\programdata\microsoft\crypto\rsa\s-1-5-18\ryukreadme.txt (Created File) c:\programdata\microsoft\crypto\systemkeys\ryukreadme.txt (Created File) c:\programdata\microsoft\datamart\paidwifi\ryukreadme.txt (Created File) c:\programdata\microsoft\device stage\ryukreadme.txt (Created File) c:\programdata\microsoft\device stage\device\ryukreadme.txt (Created File) c:\programdata\microsoft\device stage\task\ryukreadme.txt (Created File) c:\programdata\microsoft\diagnosis\asimovuploader\ryukreadme.txt (Created File) c:\programdata\microsoft\diagnosis\downloadedsettings\ryukreadme.txt (Created File) c:\programdata\microsoft\diagnosis\etllogs\ryukreadme.txt (Created File) c:\programdata\microsoft\diagnosis\etllogs\autologger\ryukreadme.txt (Created File) c:\programdata\microsoft\diagnosis\localtracestore\ryukreadme.txt (Created File) c:\programdata\microsoft\diagnosis\sideload\ryukreadme.txt (Created File) c:\programdata\microsoft\diagnosis\siufloc\ryukreadme.txt (Created File) c:\programdata\microsoft\diagnosis\softlanding\ryukreadme.txt (Created File) c:\programdata\microsoft\diagnosis\softlandingstage\ryukreadme.txt (Created File) c:\programdata\microsoft\event viewer\ryukreadme.txt (Created File) c:\programdata\microsoft\event viewer\views\ryukreadme.txt (Created File) c:\programdata\microsoft\identitycrl\int\ryukreadme.txt (Created File) c:\programdata\microsoft\identitycrl\production\ryukreadme.txt (Created File) c:\programdata\microsoft\identitycrl\production\temp\ryukreadme.txt (Created File) c:\programdata\microsoft\netframework\ryukreadme.txt (Created File) c:\programdata\microsoft\netframework\breadcrumbstore\ryukreadme.txt (Created File) c:\programdata\microsoft\network\connections\ryukreadme.txt (Created File) c:\programdata\microsoft\network\downloader\ryukreadme.txt (Created File) c:\programdata\microsoft\provisioning\ryukreadme.txt (Created File) c:\programdata\microsoft\search\data\applications\ryukreadme.txt (Created File) c:\programdata\microsoft\search\data\temp\ryukreadme.txt (Created File) c:\programdata\microsoft\user account pictures\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\caches\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\clipsvc\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\clipsvc\archive\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\clipsvc\archive\apps\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\clipsvc\import\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\clipsvc\install\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\clipsvc\install\apps\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\devicemetadatacache\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\devicemetadatastore\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\drm\cache\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\gameexplorer\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\lfsvc\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\lfsvc\geofence\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\parental controls\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\ringtones\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\sleepstudy\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\sqm\manifest\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\sqm\sessions\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\sqm\upload\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\start menu places\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\wer\reportarchive\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\wer\reportqueue\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\wer\temp\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\clean store\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\features\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\localcopy\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\quarantine\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\support\ryukreadme.txt (Created File) c:\programdata\microsoft\windows live\ryukreadme.txt (Created File) c:\programdata\microsoft\windows nt\msfax\ryukreadme.txt (Created File) c:\programdata\microsoft\windows nt\msfax\activitylog\ryukreadme.txt (Created File) c:\programdata\microsoft\windows nt\msfax\inbox\ryukreadme.txt (Created File) c:\programdata\microsoft\windows nt\msfax\queue\ryukreadme.txt (Created File) c:\programdata\microsoft\windows nt\msfax\sentitems\ryukreadme.txt (Created File) c:\programdata\microsoft\windows nt\msscan\ryukreadme.txt (Created File) c:\programdata\microsoft\winmsipc\server\ryukreadme.txt (Created File) c:\programdata\microsoft onedrive\setup\ryukreadme.txt (Created File) c:\programdata\oracle\java\.oracle_jre_usage\ryukreadme.txt (Created File) c:\programdata\oracle\java\installcache_x64\ryukreadme.txt (Created File) c:\programdata\regid.1991-06.com.microsoft\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\start menu\programs\accessibility\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\start menu\programs\accessories\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\start menu\programs\java\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\start menu\programs\maintenance\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\start menu\programs\startup\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\start menu\programs\system tools\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\start menu\programs\tablet pc\ryukreadme.txt (Created File) c:\programdata\usoprivate\updatestore\ryukreadme.txt (Created File) c:\programdata\microsoft\clicktorun\machinedata\catalog\ryukreadme.txt (Created File) c:\programdata\microsoft\clicktorun\machinedata\catalog\packages\ryukreadme.txt (Created File) c:\programdata\microsoft\clicktorun\machinedata\integration\ryukreadme.txt (Created File) c:\programdata\microsoft\diagnosis\downloadedscenarios\ryukreadme.txt (Created File) c:\programdata\microsoft\diagnosis\etllogs\shutdownlogger\ryukreadme.txt (Created File) c:\programdata\microsoft\event viewer\views\applicationviewsrootnode\ryukreadme.txt (Created File) c:\programdata\microsoft\search\data\applications\windows\ryukreadme.txt (Created File) c:\programdata\microsoft\search\data\applications\windows\config\ryukreadme.txt (Created File) c:\programdata\microsoft\search\data\applications\windows\gatherlogs\ryukreadme.txt (Created File) c:\programdata\microsoft\search\data\applications\windows\projects\ryukreadme.txt (Created File) c:\programdata\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\clipsvc\genuineticket\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\clipsvc\install\migration\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\devicemetadatacache\dmrccache\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\devicemetadatastore\en-us\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\devicesoftwareupdates\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\parental controls\settings\ryukreadme.txt (Created File) c:\programdata\microsoft\windows\power efficiency diagnostics\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\definition updates\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\definition updates\backup\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\definition updates\default\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\definition updates\nisbackup\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\definition updates\updates\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\network inspection system\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\cleanfiletelemetry\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\cleanstore\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\cleanstore\entries\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\cleanstore\resources\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\history\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\history\cachemanager\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\history\mput\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\history\remcheck\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\history\results\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\history\service\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\history\store\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\metastore\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\metastore\1\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\metastore\2\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\metastore\2\61\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\metastore\2\90\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\metastore\2\94\ryukreadme.txt (Created File) c:\programdata\microsoft\windows defender\scans\metastore\3\ryukreadme.txt (Created File)
Mime Type	text/plain
File Size	1.28 KB
MD5	fa0637a3857a2f258f40883e1cac3074
SHA1	0980755aac03e8f24f3a040384fc61f43232f56a
SHA256	45d75b8692d29f35b6c36a00477285c5243251e33af5858c538fb80f1b68cbdb
SSDeep	24:iVeUE1sLlHgPsoWIeTt2Ww4OFGdqvWDbbOyxGSConbildyspzRC9XYcsHrDjn:xUE1sLBTwx1Ovblglobsdxu4rDj

C:\users\Public\sys

Created File

Unknown

Not Queried

»

Mime Type	application/x-empty
File Size	0.00 KB
MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep	3::

c:\programdata\microsoft\crypto\rsa\machinekeys\08e575673cce10c72090304839888e02_427a1946-e0ff-4097-8c9e-ca2c1e22780b

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.05 KB
MD5	93a5aadeec082ffc1bca5aa27af70f52
SHA1	47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256	a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SSDeep	3:/lE7L6N:+L6N

Notifications (2/4)

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After