f871e78a...9605

C:\Users\FD1HVy\Desktop\raEMQ.exe

Sample File

Binary

Blacklisted

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	207.50 KB
MD5	0d194b223e038d4c652484549f613763
SHA1	19d367df7f0c3530c6650fe6355e3d9da3378419
SHA256	f871e78adf4f918eed72ba7938c010f74197504f0a04febdb35a9f4f10c49605
SSDeep	3072:+3wjyokoa2mPEc8Mwo8Y4UbADMi19Vi/+8BCouGM:Gwjy5pEc8MRb3AA2f
ImpHash	7392bf63e0480c44b4cad34b59be5fdc

File Reputation Information

»

Severity	Blacklisted
First Seen	2019-04-17 07:03 (UTC+2)
Last Seen	2019-04-17 07:35 (UTC+2)
Names	Win64.Trojan.Ryuk
Families	Ryuk
Classification	Trojan

PE Information

»

Image Base	0x140000000
Entry Point	0x140008724
Size Of Code	0x16600
Size Of Initialized Data	0x37b000
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.amd64
Compile Timestamp	2019-04-14 21:18:10+00:00

Sections (7)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x140001000	0x16430	0x16600	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.29
.rdata	0x140018000	0xa510	0xa600	0x16a00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.11
.data	0x140023000	0x36ea70	0x11000	0x21000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	2.11
.pdata	0x140392000	0x1128	0x1200	0x32000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.98
.gfids	0x140394000	0xa8	0x200	0x33200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	1.4
.rsrc	0x140395000	0x1e0	0x200	0x33400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.71
.reloc	0x140396000	0x61c	0x800	0x33600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	4.76

Imports (3)

»

KERNEL32.dll (86)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetModuleHandleA	0x0	0x140018058	0x21b00	0x20500	0x21b
OpenProcess	0x0	0x140018060	0x21b08	0x20508	0x382
CreateToolhelp32Snapshot	0x0	0x140018068	0x21b10	0x20510	0xbd
Sleep	0x0	0x140018070	0x21b18	0x20518	0x4c0
GetLastError	0x0	0x140018078	0x21b20	0x20520	0x208
Process32NextW	0x0	0x140018080	0x21b28	0x20528	0x39a
GetCurrentThread	0x0	0x140018088	0x21b30	0x20530	0x1ca
LoadLibraryA	0x0	0x140018090	0x21b38	0x20538	0x33e
GlobalAlloc	0x0	0x140018098	0x21b40	0x20540	0x2bb
DeleteFileW	0x0	0x1400180a0	0x21b48	0x20548	0xd7
Process32FirstW	0x0	0x1400180a8	0x21b50	0x20550	0x398
GetVersionExW	0x0	0x1400180b0	0x21b58	0x20558	0x2ac
CloseHandle	0x0	0x1400180b8	0x21b60	0x20560	0x52
CreateThread	0x0	0x1400180c0	0x21b68	0x20568	0xb4
HeapAlloc	0x0	0x1400180c8	0x21b70	0x20570	0x2d3
GetWindowsDirectoryW	0x0	0x1400180d0	0x21b78	0x20578	0x2b7
GetProcAddress	0x0	0x1400180d8	0x21b80	0x20580	0x24c
VirtualAllocEx	0x0	0x1400180e0	0x21b88	0x20588	0x4f9
LocalFree	0x0	0x1400180e8	0x21b90	0x20590	0x34a
GetProcessHeap	0x0	0x1400180f0	0x21b98	0x20598	0x251
FreeLibrary	0x0	0x1400180f8	0x21ba0	0x205a0	0x168
CreateRemoteThread	0x0	0x140018100	0x21ba8	0x205a8	0xa9
VirtualFreeEx	0x0	0x140018108	0x21bb0	0x205b0	0x4fc
CreateFileW	0x0	0x140018110	0x21bb8	0x205b8	0x8f
GetModuleFileNameW	0x0	0x140018118	0x21bc0	0x205c0	0x21a
VirtualAlloc	0x0	0x140018120	0x21bc8	0x205c8	0x4f8
GetCurrentProcess	0x0	0x140018128	0x21bd0	0x205d0	0x1c6
GetCommandLineW	0x0	0x140018130	0x21bd8	0x205d8	0x18d
VirtualFree	0x0	0x140018138	0x21be0	0x205e0	0x4fb
SetLastError	0x0	0x140018140	0x21be8	0x205e8	0x480
HeapFree	0x0	0x140018148	0x21bf0	0x205f0	0x2d7
GlobalFree	0x0	0x140018150	0x21bf8	0x205f8	0x2c2
WriteConsoleW	0x0	0x140018158	0x21c00	0x20600	0x533
SetFilePointerEx	0x0	0x140018160	0x21c08	0x20608	0x475
HeapReAlloc	0x0	0x140018168	0x21c10	0x20610	0x2da
RtlCaptureContext	0x0	0x140018170	0x21c18	0x20618	0x418
RtlLookupFunctionEntry	0x0	0x140018178	0x21c20	0x20620	0x41f
RtlVirtualUnwind	0x0	0x140018180	0x21c28	0x20628	0x426
UnhandledExceptionFilter	0x0	0x140018188	0x21c30	0x20630	0x4e2
SetUnhandledExceptionFilter	0x0	0x140018190	0x21c38	0x20638	0x4b3
TerminateProcess	0x0	0x140018198	0x21c40	0x20640	0x4ce
IsProcessorFeaturePresent	0x0	0x1400181a0	0x21c48	0x20648	0x306
QueryPerformanceCounter	0x0	0x1400181a8	0x21c50	0x20650	0x3a9
GetCurrentProcessId	0x0	0x1400181b0	0x21c58	0x20658	0x1c7
GetCurrentThreadId	0x0	0x1400181b8	0x21c60	0x20660	0x1cb
GetSystemTimeAsFileTime	0x0	0x1400181c0	0x21c68	0x20668	0x280
InitializeSListHead	0x0	0x1400181c8	0x21c70	0x20670	0x2ef
IsDebuggerPresent	0x0	0x1400181d0	0x21c78	0x20678	0x302
GetStartupInfoW	0x0	0x1400181d8	0x21c80	0x20680	0x26a
GetModuleHandleW	0x0	0x1400181e0	0x21c88	0x20688	0x21e
RtlUnwindEx	0x0	0x1400181e8	0x21c90	0x20690	0x425
RaiseException	0x0	0x1400181f0	0x21c98	0x20698	0x3b4
InitializeCriticalSectionAndSpinCount	0x0	0x1400181f8	0x21ca0	0x206a0	0x2eb
TlsAlloc	0x0	0x140018200	0x21ca8	0x206a8	0x4d3
TlsGetValue	0x0	0x140018208	0x21cb0	0x206b0	0x4d5
TlsSetValue	0x0	0x140018210	0x21cb8	0x206b8	0x4d6
TlsFree	0x0	0x140018218	0x21cc0	0x206c0	0x4d4
LoadLibraryExW	0x0	0x140018220	0x21cc8	0x206c8	0x340
EnterCriticalSection	0x0	0x140018228	0x21cd0	0x206d0	0xf2
LeaveCriticalSection	0x0	0x140018230	0x21cd8	0x206d8	0x33b
DeleteCriticalSection	0x0	0x140018238	0x21ce0	0x206e0	0xd2
ExitProcess	0x0	0x140018240	0x21ce8	0x206e8	0x11f
GetModuleHandleExW	0x0	0x140018248	0x21cf0	0x206f0	0x21d
GetStdHandle	0x0	0x140018250	0x21cf8	0x206f8	0x26b
WriteFile	0x0	0x140018258	0x21d00	0x20700	0x534
MultiByteToWideChar	0x0	0x140018260	0x21d08	0x20708	0x369
WideCharToMultiByte	0x0	0x140018268	0x21d10	0x20710	0x520
GetACP	0x0	0x140018270	0x21d18	0x20718	0x16e
LCMapStringW	0x0	0x140018278	0x21d20	0x20720	0x32f
GetStringTypeW	0x0	0x140018280	0x21d28	0x20728	0x270
GetFileType	0x0	0x140018288	0x21d30	0x20730	0x1fa
FindClose	0x0	0x140018290	0x21d38	0x20738	0x134
FindFirstFileExW	0x0	0x140018298	0x21d40	0x20740	0x13a
FindNextFileW	0x0	0x1400182a0	0x21d48	0x20748	0x14b
IsValidCodePage	0x0	0x1400182a8	0x21d50	0x20750	0x30c
GetOEMCP	0x0	0x1400182b0	0x21d58	0x20758	0x23e
GetCPInfo	0x0	0x1400182b8	0x21d60	0x20760	0x178
GetCommandLineA	0x0	0x1400182c0	0x21d68	0x20768	0x18c
GetEnvironmentStringsW	0x0	0x1400182c8	0x21d70	0x20770	0x1e1
FreeEnvironmentStringsW	0x0	0x1400182d0	0x21d78	0x20778	0x167
SetStdHandle	0x0	0x1400182d8	0x21d80	0x20780	0x494
FlushFileBuffers	0x0	0x1400182e0	0x21d88	0x20788	0x15d
GetConsoleCP	0x0	0x1400182e8	0x21d90	0x20790	0x1a0
GetConsoleMode	0x0	0x1400182f0	0x21d98	0x20798	0x1b2
HeapSize	0x0	0x1400182f8	0x21da0	0x207a0	0x2dc
WriteProcessMemory	0x0	0x140018300	0x21da8	0x207a8	0x53d

ADVAPI32.dll (10)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SystemFunction036	0x0	0x140018000	0x21aa8	0x204a8	0x2f1
LookupPrivilegeValueW	0x0	0x140018008	0x21ab0	0x204b0	0x197
AdjustTokenPrivileges	0x0	0x140018010	0x21ab8	0x204b8	0x1f
OpenSCManagerW	0x0	0x140018018	0x21ac0	0x204c0	0x1f9
ImpersonateSelf	0x0	0x140018020	0x21ac8	0x204c8	0x175
OpenProcessToken	0x0	0x140018028	0x21ad0	0x204d0	0x1f7
EnumServicesStatusW	0x0	0x140018030	0x21ad8	0x204d8	0x102
OpenThreadToken	0x0	0x140018038	0x21ae0	0x204e0	0x1fc
LookupAccountSidW	0x0	0x140018040	0x21ae8	0x204e8	0x191
GetTokenInformation	0x0	0x140018048	0x21af0	0x204f0	0x15a

SHELL32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ShellExecuteW	0x0	0x140018310	0x21db8	0x207b8	0x122
CommandLineToArgvW	0x0	0x140018318	0x21dc0	0x207c0	0x6

Local AV Matches (1)

»

Threat Name	Severity
Generic.Ransom.Ryuk2.84BB3536	Malicious

C:\588bce7c90097ed212\1029\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1029\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	3.91 KB
MD5	af112af8655f620f9d0f57ae178b7712
SHA1	4d93186b3dbab583a10e5b8422df888accdb8fcd
SHA256	e35aa9215a63699e978b75526d6021025647e867e864e6259c13508d027959a1
SSDeep	96:PltUHPetZi6q83TwZpLbVhivq/x9lVChicbwdbkSioO6Nl:PjUPVZOSZzVQbYbfA6Nl

C:\588bce7c90097ed212\1044\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1044\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	77.72 KB
MD5	3aade65afbaaa2cc6e0a84ce7b6d7a3d
SHA1	d75dc62effc3d33fbe4960b3aa2a09c34d486925
SHA256	44c045c43b9aafdb400cf88627b205310c84420df9f6ac182ccb7b76b4d96aa4
SSDeep	1536:OS33p3T/v0X/0Qq0+7xTir5TPcKumi8d4B5mW/ErUHi9cK9h7J4asImU9KP:R5DvK/1+7xuZomis6EQErUHi91hJ4zrh

C:\588bce7c90097ed212\netfx_Core_x64.msi

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\netfx_Core_x64.msi.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.81 MB
MD5	5ebd4a974ac11fac7295cee6a1a89249
SHA1	b7a701b93ec0ae2a4cf5e0f94871a85300e3d53f
SHA256	7b5a248ed30fa151634c877f815d6c6b91ed6928eec3ac5b8fd63bded2ca3285
SSDeep	49152:cQbsQs12G65EDZYV0m507DUVn4l5zicvOUw9j3xRe2PKpA:hbrs12G9k0/D2n4TbvOUqe2iS

C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.09 MB
MD5	6e4b90fa1e55b9323b45a863072c0a93
SHA1	ebbede98593d1373ad73b38aaa1e73e2a6557a62
SHA256	86e780dffc7323758cc46f080ed497c94f473d922a367b221ed6401d5c98033f
SSDeep	49152:K28b+dTRF0ljVQa5N0CKXsfyg+voq45Ts/5O7GmayrnaYL5:fd93a5LKXmygYoZU5fma4aY1

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Music\desktop.ini.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Music\desktop.ini.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.64 KB
MD5	73ea6c6c788354c9836f137bdb7ed9e3
SHA1	a1b5498e4a46a64febc66df06436095abf0a5046
SHA256	364ff2682cc94fa6d5b7ddc19538f36bfe8c08fb1f7539579f0da427043887b1
SSDeep	12:IRI3xPNJOgz/LVJ0Id5LMYj99Y95HYdIAnAczxU+6j:5W4JVdxx9Y/aHxzGj

C:\588bce7c90097ed212\netfx_Core.mzz

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\netfx_Core.mzz.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	173.08 MB
MD5	88cc29919734d2acd224b62e1a70e33f
SHA1	a9b4c4621beef8f784202f1c480739f57ab64d8e
SHA256	d35b1d83a617352096ef3e528a34f186d1cc5d874904cd226d5c581f15bdde95
SSDeep	196608:Y6YwrI+y961Vg3Evra/MYK3fHPBfE3gBqjY48IQG9up5iGbNOuCNggf:Y6VrIn9Z3Ej4ofvNE3gBaUID9upM+Iue

c:\programdata\microsoft\user account pictures\default user.dat

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	588.49 KB
MD5	a6603cb557358aad3e5025c2c5cde1de
SHA1	83822de63b362966481b608d417631fd566fcc1e
SHA256	7d11e66b33c23acf0a4c6e904deff1ce250bdd828f5fa517e781bc614aa69401
SSDeep	12288:A/md+w/l89peKBlZzSXFy33naaFc4tprKhEat7a1XHJ:h40ApeKHZzSXw336QxzacFJ

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.bmp.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.bmp.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	588.33 KB
MD5	7eeeef0fbbf6620fa9eb51a022b536aa
SHA1	6764fc062baa2924c71ef5786ae7c34abf8a8e87
SHA256	91d38850c1065e19515d6108a184fa7936e733860c86f95a300fde26f280a62d
SSDeep	12288:og3nNE4RtVyw7d1LubXWQBhNO82XhgvvthcQu2Rm95h:oona4Rqw7vuVwgHthcQuGmd

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.png.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.png.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	5.55 KB
MD5	881ae20b4e69ccf608aef756c7e281e7
SHA1	86141bc83af780e897b00846905f89ce36737107
SHA256	6f9e3e329e7ea878bddd7cdd0d8a36c0f8271628f389114fe144748fa1dbb56e
SSDeep	96:T3ubqP3sMBidgxNlzeDUvPxGI9mhgPrU9s37a4DGAdDEPX6VQ4Wz1Ps+xxdjL:Luk3sMUOx0cPxGSJPIqrlGAxSX6Vc1Uw

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Excel 2016.lnk.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Excel 2016.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.64 KB
MD5	f67d933feb6b1862ddb63fd500dcdd1b
SHA1	b0afa5e185f03154a85b0cca7ce23d103a947b00
SHA256	5796c9c9ac2a20e7e1b3fe1fa5a4c14a919cebe4f297f479bcfcbbe6988f94d9
SSDeep	48:0qZDAxCn7oEl7W5UnEcrQf7Yuv/2f3R9J7exwmtvoBAi5/RL9KZxDhokEYiBnch:NZMxA7ocy5UEcrkYumfPJ7eir2i5/Fkz

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\About Java.lnk.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\About Java.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.33 KB
MD5	85eebd1fe165883c0500a10df95aa487
SHA1	7c18f159ec82662e02687eed1a38f3adfcedfc6e
SHA256	0ea421e79de045d46c0740e05f0c884e97afbfa93cf493e8b499703f18faacf7
SSDeep	48:E9yz43JucTixPXznTdfChxzYwslZjxjkwjZYcZocHrvx:Eo4kMGPjTdKhhY5tj/ZLJ

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Get Help.url.RYK

Modified File

Binary

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Get Help.url.RYK (Dropped File)
Mime Type	application/x-dosexec
File Size	0.46 KB
MD5	3be2286b94ff41857b1caf4ce4a96d1c
SHA1	9d2707d2051fbfbdd5dfa3d7d50e15cd6b0d1ae1
SHA256	2f3a70a87e93b4e35b42722ac96633d410c0fb4d3606c2a803a97e977490ad19
SSDeep	12:tlSsXGBDKpZJoB4lwiduAd2Q0qDXl5prZrh3QDKzuIVn:tgsaDK7583Q065FJh3IPY

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Outlook 2016.lnk.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Outlook 2016.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.63 KB
MD5	d89ca72936ddde3964562ed50acefa8b
SHA1	e6bd4a43b24ed9e8dafa3b3e46db4d4959b45a0b
SHA256	29ba71439b47ed811114b508d4401bb8b8554a29eca7a58bdce937f54e9e6fe6
SSDeep	48:0vvex7glx8Eu9QhC0VbTMpK0f+pHRqQlxrYlc/+8j5CmsHxH1XrNyy/32Sy:Iex7gn8EzhCed02pHDt5tsvXRHPq

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\PrintDialog.lnk.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\PrintDialog.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.42 KB
MD5	9993371487a08ff66559529f5f3be4fa
SHA1	b8e1013bee6eeb5b55382d8e359ccbc202d701fc
SHA256	cbac5309b202f17dc79846a6a17d34c5abdc60ceac32d1d06dc3c4fd2212104b
SSDeep	48:B7fil85+le7ALbeuaNPMkqHqqr6tl6DeVA6CoVYuSikL:5NMzbe3Ukitr6mq269CuTU

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOPrivate\UpdateStore\UpdateCspStore.xml.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOPrivate\UpdateStore\UpdateCspStore.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.30 KB
MD5	5104e712c7dad1d97bc7ffb7c88f05a3
SHA1	7a194811bc1c0e37701ac3409ea269aa89df905e
SHA256	f725904920779e2cc3a7034bedcda04db609b7614882e5583ff68fe2fd7c7876
SSDeep	6:iOG1IiwItFT3EX1qr9X1zY2Lt/Nc1p1SClACI7DcU+o:etFO1qhX2qQp1SHH/+o

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\NotificationUxBroker.003.etl.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\NotificationUxBroker.003.etl.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	8.28 KB
MD5	eae688cafa7b97d6fb9c53eac351c069
SHA1	91391ef1e1727b16e07ebe79198a10d6c78abb9c
SHA256	09da1d88539c7808331fff5f610c9a7cf43ac77077bc50caee01eb27b28e396b
SSDeep	192:k6SG0uDxFWDVESxrHIGtI5FHfWtnp3/yYSGBA8QhZlM030WbZ+v:nGVE0HIGjpv1jSWAsv

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Math Input Panel.lnk.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Math Input Panel.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.42 KB
MD5	9b788c3d008bb3995b17279102a9e92c
SHA1	a39249b1f06ea1b47369a5673fbe0c8c529cdb1e
SHA256	5dffb28acce446acdb63aad0c789baf359794cb61d247c2a4f3ceadaf8e90206
SSDeep	24:g5X7iwf6ft+SH9/YLBHbqxCbDjM81Fx6EPkAk0/8hTIGs1E9sN2+2Rx2GM+f:g5XGwfe3YLBHugbDAiHJCAIvFTM+f

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows 10 Update Assistant.lnk.RYK

Modified File

Stream

Unknown

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows 10 Update Assistant.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.00 KB
MD5	45820a03b7780f4095abfdc262e04fa4
SHA1	407171020bb40a5008af13c592d2e4066972d68b
SHA256	0727f2f5cd6a391d4a405929feef38f50e21c3c8ba2ba70ee19b5dcd34ed258e
SSDeep	24:NSxgWhvi3nVr/zXGTPLJC0lIeb6fHNjg/RNkzrVDr1n8du:NygooVr/zWDlC0ao0Auxn8du

C:\RyukReadMe.html

Dropped File

Text

Unknown

»

Also Known As	C:\$GetCurrent\RyukReadMe.html (Dropped File) C:\$GetCurrent\Logs\RyukReadMe.html (Dropped File) C:\$GetCurrent\SafeOS\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1025\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1028\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1029\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1030\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1031\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1032\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1033\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1035\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1036\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1037\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1038\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1040\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1041\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1042\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1043\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1044\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1045\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1046\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1049\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1053\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\1055\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\2052\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\2070\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\3076\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\3082\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\Client\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\Extended\RyukReadMe.html (Dropped File) C:\588bce7c90097ed212\Graphics\RyukReadMe.html (Dropped File) C:\Boot\RyukReadMe.html (Dropped File) C:\Boot\bg-BG\RyukReadMe.html (Dropped File) C:\Boot\cs-CZ\RyukReadMe.html (Dropped File) C:\Boot\da-DK\RyukReadMe.html (Dropped File) C:\Boot\de-DE\RyukReadMe.html (Dropped File) C:\Boot\el-GR\RyukReadMe.html (Dropped File) C:\Boot\en-GB\RyukReadMe.html (Dropped File) C:\Boot\en-US\RyukReadMe.html (Dropped File) C:\Boot\es-ES\RyukReadMe.html (Dropped File) C:\Boot\es-MX\RyukReadMe.html (Dropped File) C:\Boot\et-EE\RyukReadMe.html (Dropped File) C:\Boot\fi-FI\RyukReadMe.html (Dropped File) C:\Boot\Fonts\RyukReadMe.html (Dropped File) C:\Boot\fr-CA\RyukReadMe.html (Dropped File) C:\Boot\fr-FR\RyukReadMe.html (Dropped File) C:\Boot\hr-HR\RyukReadMe.html (Dropped File) C:\Boot\hu-HU\RyukReadMe.html (Dropped File) C:\Boot\it-IT\RyukReadMe.html (Dropped File) C:\Boot\ja-JP\RyukReadMe.html (Dropped File) C:\Boot\ko-KR\RyukReadMe.html (Dropped File) C:\Boot\lt-LT\RyukReadMe.html (Dropped File) C:\Boot\lv-LV\RyukReadMe.html (Dropped File) C:\Boot\nb-NO\RyukReadMe.html (Dropped File) C:\Boot\nl-NL\RyukReadMe.html (Dropped File) C:\Boot\pl-PL\RyukReadMe.html (Dropped File) C:\Boot\pt-BR\RyukReadMe.html (Dropped File) C:\Boot\pt-PT\RyukReadMe.html (Dropped File) C:\Boot\qps-ploc\RyukReadMe.html (Dropped File) C:\Boot\Resources\RyukReadMe.html (Dropped File) C:\Boot\Resources\en-US\RyukReadMe.html (Dropped File) C:\Boot\ro-RO\RyukReadMe.html (Dropped File) C:\Boot\ru-RU\RyukReadMe.html (Dropped File) C:\Boot\sk-SK\RyukReadMe.html (Dropped File) C:\Boot\sl-SI\RyukReadMe.html (Dropped File) C:\Boot\sr-Latn-CS\RyukReadMe.html (Dropped File) C:\Boot\sr-Latn-RS\RyukReadMe.html (Dropped File) C:\Boot\sv-SE\RyukReadMe.html (Dropped File) C:\Boot\tr-TR\RyukReadMe.html (Dropped File) C:\Boot\uk-UA\RyukReadMe.html (Dropped File) C:\Boot\zh-CN\RyukReadMe.html (Dropped File) C:\Boot\zh-HK\RyukReadMe.html (Dropped File) C:\Boot\zh-TW\RyukReadMe.html (Dropped File) c:\users\ryukreadme.html (Dropped File) c:\programdata\ryukreadme.html (Dropped File) c:\programdata\adobe\ryukreadme.html (Dropped File) c:\programdata\adobe\arm\ryukreadme.html (Dropped File) c:\programdata\adobe\arm\reader_15.007.20033\ryukreadme.html (Dropped File) c:\programdata\adobe\arm\reader_15.023.20070\ryukreadme.html (Dropped File) c:\programdata\adobe\arm\s\ryukreadme.html (Dropped File) c:\programdata\comms\ryukreadme.html (Dropped File) c:\users\public\desktop\ryukreadme.html (Dropped File) c:\users\public\documents\ryukreadme.html (Dropped File) c:\users\public\music\ryukreadme.html (Dropped File) c:\users\public\videos\ryukreadme.html (Dropped File) c:\programdata\microsoft\ryukreadme.html (Dropped File) c:\programdata\microsoft\appv\ryukreadme.html (Dropped File) c:\programdata\microsoft\appv\setup\ryukreadme.html (Dropped File) c:\programdata\microsoft\clicktorun\ryukreadme.html (Dropped File) c:\programdata\microsoft\crypto\ryukreadme.html (Dropped File) c:\programdata\microsoft\crypto\dss\ryukreadme.html (Dropped File) c:\programdata\microsoft\crypto\rsa\ryukreadme.html (Dropped File) c:\programdata\microsoft\datamart\ryukreadme.html (Dropped File) c:\programdata\microsoft\devicesync\ryukreadme.html (Dropped File) c:\programdata\microsoft\diagnosis\ryukreadme.html (Dropped File) c:\programdata\microsoft\drm\ryukreadme.html (Dropped File) c:\programdata\microsoft\drm\server\ryukreadme.html (Dropped File) c:\programdata\microsoft\mapdata\ryukreadme.html (Dropped File) c:\programdata\microsoft\mf\ryukreadme.html (Dropped File) c:\programdata\microsoft\network\ryukreadme.html (Dropped File) c:\programdata\microsoft\office\ryukreadme.html (Dropped File) c:\programdata\microsoft\search\ryukreadme.html (Dropped File) c:\programdata\microsoft\settings\ryukreadme.html (Dropped File) c:\programdata\microsoft\spectrum\ryukreadme.html (Dropped File) c:\programdata\microsoft\uev\ryukreadme.html (Dropped File) c:\programdata\microsoft\vault\ryukreadme.html (Dropped File) c:\programdata\microsoft\wdf\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows nt\ryukreadme.html (Dropped File) c:\programdata\microsoft\winmsipc\ryukreadme.html (Dropped File) c:\programdata\microsoft\wwansvc\ryukreadme.html (Dropped File) c:\programdata\microsoft onedrive\ryukreadme.html (Dropped File) c:\programdata\oracle\ryukreadme.html (Dropped File) c:\programdata\oracle\java\ryukreadme.html (Dropped File) c:\programdata\oracle\java\javapath_target_474984\ryukreadme.html (Dropped File) c:\programdata\package cache\ryukreadme.html (Dropped File) c:\programdata\softwaredistribution\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows\start menu\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows\start menu\programs\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows\templates\ryukreadme.html (Dropped File) c:\programdata\usoprivate\ryukreadme.html (Dropped File) c:\programdata\usoshared\ryukreadme.html (Dropped File) c:\programdata\usoshared\logs\ryukreadme.html (Dropped File) c:\users\public\pictures\ryukreadme.html (Dropped File) c:\programdata\microsoft\clicktorun\machinedata\ryukreadme.html (Dropped File) c:\programdata\microsoft\clicktorun\productreleases\ryukreadme.html (Dropped File) c:\programdata\microsoft\clicktorun\userdata\ryukreadme.html (Dropped File) c:\programdata\microsoft\crypto\dss\machinekeys\ryukreadme.html (Dropped File) c:\programdata\microsoft\crypto\keys\ryukreadme.html (Dropped File) c:\programdata\microsoft\crypto\pcpksp\ryukreadme.html (Dropped File) c:\programdata\microsoft\crypto\pcpksp\windowsaik\ryukreadme.html (Dropped File) c:\programdata\microsoft\crypto\rsa\machinekeys\ryukreadme.html (Dropped File) c:\programdata\microsoft\crypto\rsa\s-1-5-18\ryukreadme.html (Dropped File) c:\programdata\microsoft\crypto\systemkeys\ryukreadme.html (Dropped File) c:\programdata\microsoft\datamart\paidwifi\ryukreadme.html (Dropped File) c:\programdata\microsoft\device stage\ryukreadme.html (Dropped File) c:\programdata\microsoft\device stage\device\ryukreadme.html (Dropped File) c:\programdata\microsoft\device stage\task\ryukreadme.html (Dropped File) c:\programdata\microsoft\diagnosis\asimovuploader\ryukreadme.html (Dropped File) c:\programdata\microsoft\diagnosis\etllogs\ryukreadme.html (Dropped File) c:\programdata\microsoft\diagnosis\localtracestore\ryukreadme.html (Dropped File) c:\programdata\microsoft\diagnosis\sideload\ryukreadme.html (Dropped File) c:\programdata\microsoft\diagnosis\siufloc\ryukreadme.html (Dropped File) c:\programdata\microsoft\diagnosis\softlanding\ryukreadme.html (Dropped File) c:\programdata\microsoft\diagnosis\softlandingstage\ryukreadme.html (Dropped File) c:\programdata\microsoft\diagnosis\tenantstorage\ryukreadme.html (Dropped File) c:\programdata\microsoft\event viewer\ryukreadme.html (Dropped File) c:\programdata\microsoft\event viewer\views\ryukreadme.html (Dropped File) c:\programdata\microsoft\identitycrl\ryukreadme.html (Dropped File) c:\programdata\microsoft\identitycrl\int\ryukreadme.html (Dropped File) c:\programdata\microsoft\identitycrl\production\ryukreadme.html (Dropped File) c:\programdata\microsoft\identitycrl\production\temp\ryukreadme.html (Dropped File) c:\programdata\microsoft\netframework\ryukreadme.html (Dropped File) c:\programdata\microsoft\network\connections\ryukreadme.html (Dropped File) c:\programdata\microsoft\network\connections\cm\ryukreadme.html (Dropped File) c:\programdata\microsoft\network\connections\cm_old\ryukreadme.html (Dropped File) c:\programdata\microsoft\network\downloader\ryukreadme.html (Dropped File) c:\programdata\microsoft\provisioning\ryukreadme.html (Dropped File) c:\programdata\microsoft\search\data\ryukreadme.html (Dropped File) c:\programdata\microsoft\search\data\applications\ryukreadme.html (Dropped File) c:\programdata\microsoft\search\data\temp\ryukreadme.html (Dropped File) c:\programdata\microsoft\settings\accounts\ryukreadme.html (Dropped File) c:\programdata\microsoft\speech_onecore\ryukreadme.html (Dropped File) c:\programdata\microsoft\storage health\ryukreadme.html (Dropped File) c:\programdata\microsoft\uev\inboxtemplates\ryukreadme.html (Dropped File) c:\programdata\microsoft\uev\scripts\ryukreadme.html (Dropped File) c:\programdata\microsoft\uev\templates\ryukreadme.html (Dropped File) c:\programdata\microsoft\user account pictures\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows defender\support\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows live\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows nt\msfax\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows nt\msfax\inbox\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows nt\msfax\queue\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows nt\msfax\sentitems\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows nt\msscan\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows security health\ryukreadme.html (Dropped File) c:\programdata\microsoft\winmsipc\server\ryukreadme.html (Dropped File) c:\programdata\microsoft onedrive\setup\ryukreadme.html (Dropped File) c:\programdata\oracle\java\.oracle_jre_usage\ryukreadme.html (Dropped File) c:\programdata\oracle\java\installcache_x64\ryukreadme.html (Dropped File) c:\programdata\regid.1991-06.com.microsoft\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows\start menu\programs\accessibility\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows\start menu\programs\accessories\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows\start menu\programs\java\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows\start menu\programs\maintenance\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows\start menu\programs\startup\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows\start menu\programs\system tools\ryukreadme.html (Dropped File) c:\programdata\microsoft\windows\start menu\programs\tablet pc\ryukreadme.html (Dropped File) c:\programdata\usoprivate\updatestore\ryukreadme.html (Dropped File)
Mime Type	text/html
File Size	0.61 KB
MD5	b193dfda39d19928ccd7b78cbd78ce18
SHA1	69f26c8e8eea61433de9fe892dd6201c4d993af8
SHA256	97e84fd5d5695c998662d0c9d3aa45d785063ddeb35858f19c012c3732734ecd
SSDeep	12:kJlzq+jG2/d2/MbHeIH/GJHbr+OsKXUM:kJllGmdmqHzbM
Parser Error Remark	Static analyzer was unable to completely parse the analyzed file

C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	41.96 KB
MD5	3d4a38f6fd14266233feb72e3418733e
SHA1	78977ad3ddb8a27c565d296fef7c518aebb0418b
SHA256	da3e2899737d04b262727983c4feed0471eab3fc64643482a640fe29c1318f6d
SSDeep	768:CYUomZMvShvHRwrRp63hkJVuH/zwATzUl4QbCendzDCMR55xFNdQzJOqCgV2HEV:BmWAPRGp63mLuLl/Uhmen5CMR55/NdWZ

C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log

Modified File

Stream

Not Queried

»

Also Known As	C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.31 KB
MD5	2116e99313f9496ceeef8dd58081bd75
SHA1	a22e0639b92da1f87d98aac6cae41d41733832ba
SHA256	9d59c55dd49e2302861884b943d1783a325c3ac41a64514069b317d7a3e2ec41
SSDeep	6:GR5dPJy4U2tLW7BEorVG0alddBQ0mzL1xBke3HC4CX61i42aMokeiA6I7v23b5:svy3+CEaalzB5mFiZ7wX7+r5

C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log

Modified File

Stream

Not Queried

»

Also Known As	C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.RYK (Dropped File) C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	6.14 KB
MD5	d0f41af349daf199ed94877b145ad357
SHA1	d1d42ac0240e43ab95948e59708a8a691dbb3c38
SHA256	7a7fce53d62b788e55869763b0c57baafca9f96b24201dec4e2f445949a2eaf6
SSDeep	96:sLmpPXf6i9IOEXiSsiseTQ+UaKL93rAJVSjjiQ3N2QN4+J9EhQ7KucASEXzy/:wmpPSAIOESSsjr2wr4M4+YQm8SQzy/

C:\$GetCurrent\SafeOS\SetupComplete.cmd

Modified File

Stream

Not Queried

»

Also Known As	C:\$GetCurrent\SafeOS\SetupComplete.cmd.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.58 KB
MD5	74c03d0c436fb9dcb23158ed0878eb71
SHA1	6f00e68fa0669c0d592bcd53e8c14cdee1835f05
SHA256	53af36ab43728a5306ad8076bed7826e4e837d8362d950fbf939d70b391008e8
SSDeep	12:gcm/1yCR0k/zosQVBlGU/ENW9acocQampaxoN5:X+DALT/39al8md

C:\588bce7c90097ed212\1025\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1025\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	7.66 KB
MD5	85c1ce5c4522f8b90f72684e71b4073e
SHA1	4f06f5029b91f3b790617a1de0cb1f29ea669152
SHA256	b6eb532a0dd23bbadc16ee927ade9535074d9ceb8e00ba0e1c35b3a2d7334a1c
SSDeep	96:olldhoazzDLxeG4kZj3uxPCAvAkauMIuKzipl1742bBYk2s0YcV7Sk9NZUngsDs6:W9xeGnZj3U9awsv58ZpNigsD0dzq2m

C:\588bce7c90097ed212\1025\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1025\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	72.75 KB
MD5	2940910b9aa777d992d619f84c8c21b8
SHA1	8dad4ab142f6148064531c89887a0382cb55e85f
SHA256	12a083199e866a57796b9768ea534f1232f832bf05ac03d155e240b4bd8c34e2
SSDeep	1536:H/izbFwYNEcDH6/8Q0G3fncEhriIq2g0qrwS3wKuElyUHW1:H/OFhTDH6kQv3PfeX20rwYeElyx1

C:\588bce7c90097ed212\1028\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1028\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	6.44 KB
MD5	34837bf84407104f37ad315d14c9bec5
SHA1	73b5504332f19fe6320b6e039ba5e6e39828a190
SHA256	7d2d8a0f274de28b53905a85b1a77278449d8f9e8b4541f6f5766ee744b1fcbb
SSDeep	96:mNiogmBNuXbbTYKN5Un+h63sWY7dTZRiaGEgAN3xOPNdsmQiPdW5I7GKGaVB4nKd:msjhN5WzkNgPz6iFWSVGxnKlq3ij

C:\588bce7c90097ed212\1029\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1029\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	79.35 KB
MD5	8047eb42653ed6763afdeb0b85f6b817
SHA1	1ac71b0ef04820d2552b57c8f1e13a61de6925ac
SHA256	734e198e1fed3e8a7e99105f362241525f5651ab86c90fb99617a1969b2dc3a2
SSDeep	1536:iw0kz7nKwMw+xUKBpeJ0PaddmRS/ZTi699D1gZTBbWeL+46t/fYp1+OjaX9I:sYKzWUpM0Padm0H951HeiBt/fY6gB

C:\588bce7c90097ed212\1032\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1032\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	84.53 KB
MD5	d99a1072fb03db61db61c04e40dd1796
SHA1	c6491075891e90e7aab064d5766971ca05ee829a
SHA256	a2eddf758dd0cb09119e735312f901b94155bb4feb0da1d0c42e3c701f3af3b1
SSDeep	1536:bde4Jo+3ybU+TvE0Ahez5CXhf9TAyoUimx2wmt9UNvQZ0InJ31wAzXsQ:Je4a+3yrTLye4p9ga2zANvQDnJ3eAzd

C:\$GetCurrent\SafeOS\preoobe.cmd

Modified File

Stream

Not Queried

»

Also Known As	C:\$GetCurrent\SafeOS\preoobe.cmd.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.35 KB
MD5	3294dba62ee6ea69b1d3422ee9fc9f58
SHA1	aaddda69e3f269135495dbeb4d083488afac95b2
SHA256	d3c9d96b8757f7b6c015b74735d3f65589e88e76d010aac07f5fac6b058ab0df
SSDeep	6:F2COVVUY6YAOSQwf7E4H30MAmMAbvY/rDyK/Diq3SQlgGKHF/OBLNZCWETz:Pw0DQwf7fXdP8/nZmq3SQncO9Ny

C:\588bce7c90097ed212\1031\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1031\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	3.61 KB
MD5	d03919a2fb6aafa79968c5030700d682
SHA1	ec70ed268ec802c2211c922350508bf4d542cfc6
SHA256	9f3032602a2c9388c3a4dc2fc43e6cfccf5a1683c67e6554789539b8a5cf3775
SSDeep	96:6EcMdXEYUI/H9VBpaRPdUlqFdWxii6WRspMvFNhE/L2nFNR:6E1ERGTzSPdeqFYl6WPvFNhsynp

C:\588bce7c90097ed212\1032\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1032\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	8.94 KB
MD5	40e3549528f2d8a87af5fb813cdffb83
SHA1	ed7e33bc3543fd6b60d7e85645f0840607109559
SHA256	a2efb0d1571aa7aae4e55cc09d210e995cf208b0e2d1acc13484fe8f152a9c68
SSDeep	192:TnUru6WhAFRH22fpgYdZqvuE0U49LxWgihvrhBcllFL:4ru6WhARfpd9U4VxWgihNBclv

C:\588bce7c90097ed212\1028\LocalizedData.xml

Modified File

Audio

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1028\LocalizedData.xml.RYK (Dropped File)
Mime Type	audio/x-mp4a-latm
File Size	59.67 KB
MD5	2d5f7a655cd0273730ea909b71f23702
SHA1	3b339af77d341d194ff71185afa31d3bd9a660ba
SHA256	fdd3ec50f98295c765926315f98d861b693e7931e177b46e92e9420a0c837be8
SSDeep	1536:2gF4iAH8ZRVLWoDe7zxyCgrmFjP244Rs1/UUYs3DPE:xFG8ZTZDeICiejPwRKcX4DPE

C:\588bce7c90097ed212\1030\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1030\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	76.21 KB
MD5	c521c5d94cffd12996f8beb02a5a33fd
SHA1	a0796fea4b39dc7243a0ae4c763938781a8d5f88
SHA256	0b0cb9f3963f30bc8664cda6aadc5e2b7e7024a30a3e8e3b6c0768b9ed984779
SSDeep	1536:GFWeQkPbX4CHlDW3Z8AY2Al/K5xwhWCS0xQJQFFfgrxiPvMGFFRFuK:OWebr40Cp8vK5+WCSQHgrGFz

C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd

Modified File

Stream

Not Queried

»

Also Known As	C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.85 KB
MD5	decd162944b88c5d91db15ea57722f77
SHA1	c500e734f6c26cf66c8b677392d62e7c126937e6
SHA256	4ee9db1a051361ff8bf130d909d629cea7f76fafd0438d771c0b1efb9ecfac68
SSDeep	24:0IBqkm6vMlg4XdXZaCBmZbVpMQfVzSo9U:0Ig5l3LaXZxpMQf9SB

C:\$GetCurrent\SafeOS\GetCurrentRollback.ini

Modified File

Stream

Not Queried

»

Also Known As	C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.42 KB
MD5	4eb5c8c042672ec44a52411900ba70f6
SHA1	2b1651f4d8c22b11af7c496a3a1f255581999b7b
SHA256	367837d139364b25f414cb984f4214fc0112af01479d44f20eef66d0ea2bc26c
SSDeep	12:4z54ZshmN3hoe9XF9vBZvpgAGip3AAH4XriUNfgnMsZzR:w4Ba0XF7FpDwO4bi8fvsZzR

C:\588bce7c90097ed212\1036\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1036\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	3.72 KB
MD5	edc3cff42afac2a495b8651e18b2d53e
SHA1	ca2637e1815fea9240ee777032e7637cb3662ce3
SHA256	c9d2024deaa72cd54e4c849352079b002618bf07f5cd0a4e025227d9a7f27dbf
SSDeep	96:qxm7JIuE22gl4F5MVq2+kfYt4qMQNvsuaKK4jK+HWTO3L+4a:aXQlPq2+/MQNKqFWi3L+4a

C:\588bce7c90097ed212\1033\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1033\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	3.39 KB
MD5	6a4fdf77bd87fa2347afc7b52651d697
SHA1	f2d4dc07647c06d10f9101a5a33dfe1e4f8a44a7
SHA256	55335277b8a0c40df43824ee2d868a9ee71d1623c6608ea109d968f991097056
SSDeep	96:Ncvb27oUvRbs/MdtqOJnLIwMe4pMIfPnUQluW:Ncvi7oapXtlLIwK2In+W

C:\588bce7c90097ed212\1031\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1031\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	80.69 KB
MD5	8413bbb00b2099725b8d7d3f60757534
SHA1	c9416cc04f5719571827b11b41d4a86456c6d249
SHA256	723ef27b0ba9051a9df98da6f101b689ced424494a29bb534feb286ed6bf0613
SSDeep	1536:lsAUBO+RNYcsJFg30cWtk80z3av1p0Dmy7dIYGwu2NOc2UMHsVLKyDwb:lbN8NYcsgxW4zEX0Dt5IYGBS32UMHauR

C:\588bce7c90097ed212\1030\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1030\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	3.52 KB
MD5	e4a26223214bb90db837923a0299c3f5
SHA1	ae6cf3a8f56f3e7ba0ab092254a34428df831742
SHA256	f866b5cce6fbbb24ab9aa8c70f3a28e240f579c8bb702bc1d1272c5c3f09e575
SSDeep	96:KxRGWe938ph91BtnvubUQKso3p5HGyrA8u:MRPl1f0Kso3p5ls8u

C:\588bce7c90097ed212\1041\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1041\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	10.16 KB
MD5	4ecb5cde9d4fce620e3e87105fc8fa17
SHA1	905d4447b6d6c8102b6d24657b36f7250946acce
SHA256	5377325923ffff535282d2fabbead4897fa683ada11fc61a7663bbc62418b166
SSDeep	192:1gRjurO/0F4lXVZcgew4sMQFaNqmZangR1zyRqCSGrRCWagvcQTVvw:mX/0aT61qmanadE8xg0Kvw

C:\588bce7c90097ed212\1046\eula.rtf

Modified File

Compressed

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1046\eula.rtf.RYK (Dropped File)
Mime Type	application/zlib
File Size	3.88 KB
MD5	b38cc6bd5197a8fe62872e10c5e934d5
SHA1	056839c5706cfcdc1d14252db55443873533dd8c
SHA256	da036775a38909e3ca0730710777b032570fe6c16920c28293d7941bf537e275
SSDeep	96:OWzShGTvHJ6Kv95XErrM65Uh0yboaxTOMLnsvTjl:OpmxvzgrPUhx/Lcnl

C:\588bce7c90097ed212\1042\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1042\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	12.66 KB
MD5	cc4c8545130a44d1f58103508132647b
SHA1	d92e9ebedb68cf3715ae4f8567c41bed069ba9e0
SHA256	8def1fb2d715b472d1a750be754e5c2766bb8964ce241062399ed23222a90319
SSDeep	384:oDFmrjjICUfMORqNZfebR7ZtHRGYPEzOehz:FNUfMORqNZfebR7Zp0eEzOeJ

C:\588bce7c90097ed212\1040\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1040\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	78.46 KB
MD5	8f00ffbbcf6daf0b75208dae50905026
SHA1	6cc642c4b3da4c8be04db1c20767b8feff2c974b
SHA256	d4ae7693bef4f1e757fad3a9a8d3d5a0ab8eb1920bd03ff300731100cd5f95c4
SSDeep	1536:YgQT/KnhFooQ1krBoqs5yuR7Rtt60sfmPzgLkjhcncE/jQ25HX:Yaoogkrx9I7RtttsfmPzMkjhEckP53

C:\588bce7c90097ed212\1042\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1042\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	63.99 KB
MD5	f54fd83ecaf8201ec9a4f7236fd1b973
SHA1	0a9167b20b6616b0d76891dfb52e3c8033a69de4
SHA256	645c2cfbd848f4324d1cc166aa5655ef41328634a64d1ed4da11935daacaf2c4
SSDeep	1536:Qw04z5GM2ZB4sVn3PX5EXmMFxjHU21kgapbHoctV+KyuhTbqvh:Qw3+vt3PXy2kjHgHdZAPwmZ

C:\588bce7c90097ed212\1033\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1033\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	75.71 KB
MD5	e691f10b17acf6e98c7fb6495ae976d7
SHA1	9231cf57839dd8902c507279e0dd19c393b5936d
SHA256	39f1b7185cf0241341027b8a4005d2430746b616f2dc6a9b4856d7e5e655bc42
SSDeep	1536:tI8QUASmjS2BIirvDUkct/lim4fwVTzCd/C4m36yLG:t1ATjSYIYbqt/limgwV37bqyy

C:\588bce7c90097ed212\1045\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1045\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	4.22 KB
MD5	8537474be535f8dd227d8ce040586a22
SHA1	c01a6761dc77fd62ef2fa2983c9602b5e7ca264c
SHA256	575ee81ae705a37f3036d2c1bdea2452a64c27bf41f0777f264cddd4e8ed9781
SSDeep	96:zgyvgdk0wQ4yX4+XhoEdVEaLb4k5cxDrarpMbvq6:zrgdxo+KMEauNmrWbvP

C:\588bce7c90097ed212\1037\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1037\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	6.97 KB
MD5	b00ba2b18caaf4aca4412b8b722de273
SHA1	e110907a534c1076a40572d14755e9dec839d3fe
SHA256	2aa36be14c7b473895c5dae3e6e3526c543dffa1c2159726422493c0d20f1c36
SSDeep	192:K5IjnF/5m+GwmSpu7vVU0e3LzNoYkt1ly5:Ksq+GwmSE7e0edoYkt1lI

C:\588bce7c90097ed212\1038\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1038\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	84.69 KB
MD5	2246dcb1441ae7b2440ea45311453edc
SHA1	faa4bd4e2c2293b42a562245cb666b98e5b14b6a
SHA256	46b54264428fba7cfe933bb619a2eb166f828e2b6de2d7cc92910c967d539046
SSDeep	1536:5wXOeqaMJXdTt23PBIQ2WoLutYl6g62CsFv4c6lJObF9a0a+2lrs+GfzSQjkiQLN:5aMJXdTY3PBIbZLuil1N4cwJObWr+Mrj

C:\588bce7c90097ed212\1038\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1038\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	4.42 KB
MD5	82cf96c92cf27a4b8abb8a090cb9391f
SHA1	fd1a8d668cfd407c7b082898c02ad5aae60c60b7
SHA256	492b0a1151728e1943682cb8b7a85997d02d9a19249bcab62d0061e256288588
SSDeep	96:P7pbDCU3OEkpc14g0Ijl9cDIzxoOZizqfnAdsmzlX/X3q85KJcRXfz:jpbDzv50WMEpZWYnMv5v522fz

C:\588bce7c90097ed212\1043\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1043\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	78.05 KB
MD5	afab57efe7c455175a162ce1be352396
SHA1	f702a9f71951df1bced3fbda0d5f3040d991f381
SHA256	fcd3757843c8c302a7d17636e6708abfefae294f1759cb1d7a0690921d561963
SSDeep	1536:iPzEzMjj8PvSwCP9FcW6Rxa2jy/rmIGHXVqK319ANnnNUq1sZrYHk+kpjZUdgNW/:i1jj8Pv9CP3cLz8JGHL656qOZrYMpNo/

C:\588bce7c90097ed212\1037\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1037\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	70.66 KB
MD5	da95ea1b4590df467277e3f4fe3bfb01
SHA1	3cda9637d6d3507c1f93d8604ffa6839ea18b3e0
SHA256	943980a31384cb0c579bdaeef45bb582c669a24f2cec7b8cd8a0977bd9bba278
SSDeep	1536:BqUaCn+ZYnB3sjlGQcs0NeDMfrslZnVVBN6jk9dwu/wF77CjjKnlSXy:UUYqFs5HcsskMfrs/V3N4kzv/wB7CIl/

C:\588bce7c90097ed212\1046\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1046\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	79.13 KB
MD5	74018edda6a03ef5148fce4c0d519296
SHA1	c104b90da432b82a197c59d218b170150c01c75f
SHA256	0b32f8ef28d8587a966bfe3d5bd3b36342907ee001a6b2b6bca101952a79207a
SSDeep	1536:ZA9HMtLQLvN798r7NBoJd1TIhIyggoBy+6CRsykbYejoBZS3IsFhwNN:ZQKwvNB8tCJnkhIyPMkbYe0wfFm

C:\588bce7c90097ed212\1045\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1045\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	80.72 KB
MD5	6aa17a3661ca97611bbaf0ccf487105f
SHA1	a986f02eb33ea686daf1ae6e746f5fc87d2c703c
SHA256	20c54e0e88ae08a7d55b5a770f350151fd18917f9acc6523c9e7487189fccc1f
SSDeep	1536:wGATRwRvn7OHXVAUhkik6AlOmZx0JdhmLneFmz3aZcX2t1sQ9yI1rIK2:ytg6AULk6n3JdhmSFmz3wcX2rsq/Y

C:\588bce7c90097ed212\1041\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1041\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	66.91 KB
MD5	ddf84941736c6cbf68f9fd270f9afc2b
SHA1	d9ff67790b16e4b8f187917f5d52e52b1624e7f8
SHA256	dfedd82daead99ab1f3501433e2132858a9dc93ba58360d8b7018362edcfcbd4
SSDeep	1536:XNLGstwIbVZV1EYtspcGKr9N51R2m/4O/Dhf/lUFp8ldDvRlSNDj3c:FG2rbVZViYr9b1R7/DhXlUFWdlluXc

C:\588bce7c90097ed212\1035\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1035\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	75.49 KB
MD5	cd53f6da6f4890d50ec8269a95286747
SHA1	055ee682bcf9f689f5917102f1b49dec9bcbc8f1
SHA256	b37378e929b85b2e8de3e35d0f29d70b461a79e92df9a769ee503e816ee0e649
SSDeep	1536:IZzDm2zyGitFCdxOmYuv8bu+KgBupWRQrMkr5zSKV:ihuGiEB8bu+sQkl1V

C:\588bce7c90097ed212\1036\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1036\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	81.30 KB
MD5	498b72c35c67e91317e4cff18a05b89d
SHA1	c6bc5a05b98c34a5a3a750f486bbc8b91df6786f
SHA256	07462f5c428b027bdb387dd159e87a7c838c5b963bf41e571b26b7a1dab5d76d
SSDeep	1536:0bQwldD9UyGL7RXxhtJMlQyuW9b0sRTZSXSYV5mxqMJiW6KeFshpP+:0bQwldZYFXxhtJAQuZZbSBK9J42Z+

C:\588bce7c90097ed212\1049\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1049\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	53.46 KB
MD5	a4bf538ca23c6394533555871c33f5ea
SHA1	b03742e3c26d440519e4ecc4efbb07c0b4076e6c
SHA256	1ff80407a8718291bee18ec3766c357492313dcc2d86a423c0cc2f500750409d
SSDeep	1536:hN/9hQmwPD2wu2QvPpK9YwE2lrIwjsWt+cZq0:HTQP/Ivo9YwEQx4WLq0

C:\588bce7c90097ed212\1049\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1049\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	79.85 KB
MD5	d413fa4d4cd09422d056bb685ec13f64
SHA1	0e422a75c08f8d365e19928246158c68a0c7eb9f
SHA256	f9d60591affee91b150fc0d70fa2c7f59c58949af8dfcd11f935d1d7e88c6f48
SSDeep	1536:96VgNxvZZnv3wDpc887uN2OL/2moe9+KRtFPL+00sz18ozGdNBDu:96Yp3wma2OL+mhsGtJL/0slUNA

C:\588bce7c90097ed212\1044\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1044\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	3.25 KB
MD5	69f3ec5fa656977a6afc118b53ff8968
SHA1	27504e4e3648a19b76c80cba41505de15221a846
SHA256	418a1bad50b53b8498576021abc7615c0e85f7eade81703deae4521525fbc317
SSDeep	48:2sE4oqLLZSyJWZ9v5SG4Alf+asEU59EHHtDcAYWePr90YeNkAX6HkNPC+kM:LDLLJWZ9wA5s159EHNDsWieNaVM

C:\588bce7c90097ed212\1043\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1043\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	3.74 KB
MD5	649a62d48e201e407a9ed28fade02278
SHA1	81f5db70fb0339d93adb6fdb56e35ba8ae3dde62
SHA256	1f500ce5642b32dcba32494e5801cd9ceb63a24c5bdf9927b991d740d757d433
SSDeep	96:ZqoQAMXZa8qODiEhCUSalUJ8I7pDO5P2c4k6GBN2MXxZvf:ZqoQAMXZaDYCUSGyz7Z0j4k60Xxd

C:\588bce7c90097ed212\1040\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1040\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	3.83 KB
MD5	ca852cdccbbc3bff7f18f2989211bd5e
SHA1	b8a6ea9c42ddfcbaa84f9c9884125f29c96fad85
SHA256	6ba1868fa55d8f17a84087a8ee1dcb2c5404ee6e470e269a6a4e3373cb36048d
SSDeep	96:XWv1K1H2CRhMlrCWHL1PMONhIf7R2RFmg1fRsm:X8sHRorCWHLCONhucRF7xRsm

C:\588bce7c90097ed212\1035\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1035\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	3.89 KB
MD5	4349f9e12a0f8040548d59ad0050bc9b
SHA1	dace8a4691cd9645376e3640f35f452ed3a956bb
SHA256	67d9391fda533b8da8ae36836446959abd66cd386f427dcdcad56bee73f817e8
SSDeep	96:U3WN6Nb4aFHD2N8ghUcx+a+OsSvL4BlwL3Ips6l/KMZ8DM:U3WN6NsaFHD2NOc4a+Opz4wLI

C:\588bce7c90097ed212\1055\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1055\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	4.05 KB
MD5	7d44722a802dcd81a4407a4e4e6435ae
SHA1	2833cc12a957a77b75ea30f689e99a97129891e6
SHA256	c3fdd51572d572d5921c31cee21fec93e6d3591b439d677f94553e53fc797c5c
SSDeep	96:VaZERIOcuk84bDVgyQ+5JV4ghEGchRSl48egDBP8T:Ue4uk84bpD4UEGi4l48egDd8T

C:\588bce7c90097ed212\2070\eula.rtf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.19 KB
MD5	b1b25f278f9249f1a5296259b1e83458
SHA1	07d1142ccbd4fe7464da0a2e1fb43f69413a52b8
SHA256	15ad2370b1e3ce728648688ee60442c4d1c702754606b092d8c59b27c59f4365
SSDeep	96:+569gZ2eESLj7sjMLGEEVzaE34CUmeaKrIyQ+Z2dQ6:79gztLPs0GLNALrL3yP

C:\588bce7c90097ed212\1053\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1053\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	4.05 KB
MD5	8f08b16962b0a0a6538179976fca5924
SHA1	9dbbecb74e0da534d2cf0785ff54d5b57e2483d4
SHA256	3e345415302d619ff54bf146d61a0992f091f8bd682b72a367554240cdfea859
SSDeep	96:29z9+Fl1QgGeCshIIhzZQtlCXNqSix5oN:29Bs1QglIIhet4XYSiH8

C:\588bce7c90097ed212\1055\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1055\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	75.30 KB
MD5	0dc925fcf3c249b806af73eb488c4c6d
SHA1	39aad4238cbce99ddf0d0bbfc850953ef29db2d0
SHA256	11101ffaf189c05faa6571cb0172b60fb6124013a77aedd47fcf55897721a7bb
SSDeep	1536:lguS3otWElqCBlsl7qRrXJ3OJ7ARRp2EmYJY+t2hrQzJgM44rX2OwdS:1ZflbE0hcELfarQz+4COws

C:\588bce7c90097ed212\1053\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1053\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	76.14 KB
MD5	3d09c0769742a3c96697cbb9442f16fb
SHA1	2109f95522feece25c7d16702435a575c37d7f18
SHA256	0aed23bad0dd7b68115ee2c507d84d14d9aacbc85daae7ffc87b78ad30bbd790
SSDeep	1536:cRoTQHFjt2GdGE9rrQgn51ngjlg4fm30VguxBUIC9IjHRA6Ttinz/OWdbq:cNv2GYE9rUYbEg4eEeE7RtTUzdq

C:\588bce7c90097ed212\2052\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\2052\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	59.53 KB
MD5	6e41be960e161774f17cfb7ba83ecf36
SHA1	b5cde5553e9dc91960390e8cb3d5a42839ffb5cb
SHA256	95bafe9a9232ed61a683c3216e7365212b71def0a928571b89bab231520bb0e3
SSDeep	1536:ANq3zfNdkZrTBVGgGoz/QpAdJ35RyDnMhlF65LtZLFXcmSb49:ANGzfnkfB4IDb75gQWZMtM9

C:\588bce7c90097ed212\2052\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\2052\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	5.97 KB
MD5	452a28e69eb464c914940c2076187c41
SHA1	ec7bb4126e2f817df2e23551326ae4d039bad80b
SHA256	ba4e0d096cd6fce9ae4e7ac23a12086ff09609fded2ee227a3834ea49c356807
SSDeep	96:j+1o8Vb7NZug3uocBRitIA4B3w/J1KXwWCgKrq37uiRQYfug+acmeMAXcTzLTsK:j98lug3u/BghcgWCgKrqLzQMug+asM1X

C:\588bce7c90097ed212\2070\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\2070\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	78.64 KB
MD5	b77cc87b161506dc9871fc8dfce543bb
SHA1	2b43e5abc20cc37d5f9d51ffff4666f4212e90b0
SHA256	6034d4ccdf6c79a1a459f9e6db73fe333f146097c79d7465f9721928364b76e8
SSDeep	1536:4smAGXIeLlEBNkIn3tWbebAKrTl16V5FaoAPmPec232TYmmEpvW:+DFkkIn3tbMKrS2o/f2EfmEpvW

C:\588bce7c90097ed212\3076\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\3076\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	59.67 KB
MD5	dbb30603cd4fc0fcf2fb88f01c7882d1
SHA1	8b33954ba6b41fc9d18224e7d130c3b4db5b2fd4
SHA256	bc439c153dd15a303ace6a5fde5890b97be6a9092bfe7b5f287332396cc930fd
SSDeep	1536:zQHuZ2VNGBqamFtHZqNOOd1ea/cabZcodbpGykrf:zQHukVER9JdOabvdOrf

C:\588bce7c90097ed212\3076\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\3076\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	6.44 KB
MD5	3961c342cb5871e5f658c252c14d49cd
SHA1	3aa37287b456bbb754c44434a39c86560bf3c076
SHA256	56d8b96938c46323f35f5f99332282b54d0a3718ba9ab9560682afab04280617
SSDeep	192:OMuRc0Rt7IgOno9/HerWASf2GhIhChMTLR:OMec03IgOno9/HerWAmWBR

C:\588bce7c90097ed212\3082\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\3082\eula.rtf.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	3.27 KB
MD5	76d7ec6f3283568b2bfce9b5c8c41059
SHA1	9549e22efeede54ee31a024bbd1fa098af342a3e
SHA256	f62fcf9a32011ae856e433942eccac026d3b6ef6b8d3b5f60801ddf2e1b288b5
SSDeep	48:qrQtQhYHGffezWQNjYGQueBdr6fBDdr7lq01ibF6ee+e8uJg2FS6/wLo:qMtQhLWzWJGzgWfXJxOF61rFrv

C:\588bce7c90097ed212\3082\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\3082\LocalizedData.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	78.39 KB
MD5	f53c0a24c1c4b5b6f669359f6944362a
SHA1	199c13b7ab35a8880867861bff8f3035140dbc1f
SHA256	81c9b10d20e0cf3568e2e7db424111a3d1e7e9e1d89023bc73b8c6cf27f1c027
SSDeep	1536:/GEzW4PT4CjCKtI0aTX3fc5LUQSqOOeJMtiQsAz01qW/ZakEkhna5RhBLEMPFP:/GEzRPTlZtf2nfKPe6tiRmsaNkYHLEMh

C:\588bce7c90097ed212\Graphics\Rotate8.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate8.ico.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.14 KB
MD5	211a7fd87b0b641d922dca3f38a872cc
SHA1	45222d847cae602d688da110d8dbb16e3702cce1
SHA256	1f68bcb453d50c7be4b47d7893e2780c810f4108df4922d182875a2769a07bb3
SSDeep	24:fSM4tF71eNiu68c2BdZut/bIFZMB0dDfqht/m6Js8j2/OR:6Leg57CdZFF92hvJlj2WR

C:\588bce7c90097ed212\Graphics\Save.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Save.ico.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.39 KB
MD5	5598492fca64ae8f4c0144ca97d6ee47
SHA1	90345d992a149375f8f4ee95ec82d6fe8d75fce7
SHA256	60dee60e45ac3f5ac2e8d9c06e632fcd6a40bd3bd9243c51ecd01b2997a4a198
SSDeep	24:Ihd/5ydwkA0btKBclW9mbMGbQPkKA1iCKRL1ZMIpKskEJG2vE+T0/Zu1+svr2xkx:IRN7b8bksKA1fY4I9kEJxdzdvc2UJw

C:\588bce7c90097ed212\Graphics\Print.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Print.ico.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.39 KB
MD5	ed21559e2c690bc4561742ebafc182af
SHA1	1f9042836645b55d7f57a8f98d8fdddcbbb0f647
SHA256	750008350cf039c623ad59164125b022ff096dad9bf5b012b9bfa966ad14692f
SSDeep	24:kgpRZUDf9cetkVwwdh6Emy4mXr3o0TFk/dHVpcuvxPhBDn9oH:/RyyjZTXMMk/dHVKuvxPhBb9Y

C:\588bce7c90097ed212\Graphics\Rotate3.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate3.ico.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.14 KB
MD5	73926f4d6f84a34c32bf9d6b68b38f10
SHA1	4077767d73759691d3af990ec7f4785e548a4d8b
SHA256	ff0cbe6f7bc4d81303419c63a6848fc7bc2a5bd74edff1c7a47a32c3f5b25053
SSDeep	24:4kkm4vLia2+m9I8qATJhTa2Lo5MXAjL+m2k1DBoMvwmvhtlV:45mqP2+KI8rzTacEpf+mpRmMLX

C:\588bce7c90097ed212\Graphics\Rotate2.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate2.ico.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.14 KB
MD5	12795a9da7fbd756c0d12d4786b03133
SHA1	4581c349e7c722c7346a9bb2bb8df16f17db821a
SHA256	1ae7cc8abf891de973113e21640cd4d33e9c2bb655fa7d328f9a1df01217a554
SSDeep	24:K0iDtw9DJ+3DE5NA1elrXZuxKTDP/d61yswROSAyIrRjwnQB:K0WtSCDE5NMyTXX+ysNyLn2

C:\588bce7c90097ed212\Graphics\Rotate1.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate1.ico.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.14 KB
MD5	8038068d25f80ecbed2123f91640861e
SHA1	c1e1261c5982bfe7b19bf09c7bf3adafa2898299
SHA256	5ec9a5bb6431e78773463bebe3ed245abc36e0a19fc5c32f52405b36bc416237
SSDeep	24:4a1ykWD6KoAdu405Z8l06ARBwebomjr3UKi+cavdsFKGW2S:7uduZ20LC+/P2aH

C:\588bce7c90097ed212\Graphics\Rotate6.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate6.ico.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.14 KB
MD5	14ca8dbdab55796f30934e8e04706edf
SHA1	a329a4a878b0cbd01c4cf01db1b2ce99b9d739c9
SHA256	aa283a149d8788016ac931f211a85b517633cf3f4db9bf02de3b90231cc747da
SSDeep	24:QnY5R2x/bqKmr5S3oNitbmaUpVRiAGm5/U6Bx4WQj:1i/bq5s3oatq/UCx4WQj

C:\588bce7c90097ed212\Graphics\Rotate7.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate7.ico.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.14 KB
MD5	69d15bfdcaab6b4c3aa855cf31aa2dab
SHA1	1d89c38e251dd22c41491c051107eed5f2c8bef8
SHA256	4580e91f3a049a6308591408260926232b35e88603e104c35c06fbe50d970600
SSDeep	24:xPxEm4jK4daRPiQQmyJNXO2Nl5YQoB4QjqK4w0drfZmwIY1B:3F4TatyLXOgl5tijqBBrfU9Y1B

C:\588bce7c90097ed212\Graphics\Rotate4.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate4.ico.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.14 KB
MD5	e65c4481948ca0dbc412c4e8827cdcfe
SHA1	513bdb897b84027ae8a39ea38d464ed5b778f289
SHA256	fcad16aba1663b0a062aef05a052173bb2e5c4b80566eb85df298db635e8e865
SSDeep	24:lp+gdcj/UvMpT15Cb3s7rJWOiixat3TcPS6URgWgYje3I1zOKuwlQcG:lpsrUvBb8Tiixat3TcaRaW8iOKucw

C:\588bce7c90097ed212\Graphics\Setup.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Setup.ico.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	36.13 KB
MD5	96db62766cfff386b7391fd5d725fd13
SHA1	9cc7f54bc728ee5a25310510544280d13e551e52
SHA256	bcd62e777dfad26b34e5bc267323b63ccedfc2169da27e35ea3a108266ce521c
SSDeep	768:vjyDHJjeKyaw4nGDQKZGMviX3tyq38cGohQctuoH3jGhc:vWbjyf4nG+McGoNuoXh

C:\588bce7c90097ed212\Client\Parameterinfo.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Client\Parameterinfo.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	197.35 KB
MD5	2b1fb1345344467b34d9b6818db8381c
SHA1	2b46c16131d5466a8ed0c9f65cdbc8a0551fadc9
SHA256	0d50876cde23a5d5a2c410f92791ffdbfe6c5a616c8549406c96be63bb1b433e
SSDeep	6144:93dfdBkNsbLON5ixcuz0vpblxp2ENZdrZWITiTK:FdFB2aO2aTHf/zWITiTK

C:\588bce7c90097ed212\Graphics\SysReqMet.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\SysReqMet.ico.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.39 KB
MD5	506148331bc13dffa6ff20df84e3875e
SHA1	75ca8b5234a8be2b148b7618e7f9041dcc503f42
SHA256	d45cd749345caee69d3a58353fe8bc3aafdb589505d47ff8ae746f2ebad3cca3
SSDeep	24:bzEl7HiCkISf8So8MKqSCroBgZjg6DisNmuqW/VM76Wg6DlH0U:rCkI6JpCrN1OWVPWgyr

C:\588bce7c90097ed212\Graphics\Rotate5.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate5.ico.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.14 KB
MD5	6f0be1f8758e49aace0a220d28270388
SHA1	8eeb80e2a8bd3f515bb9348bf349a2024feb3976
SHA256	38f0ab9108506f4406337818ebb2fae84d5a4e866fefb7474cdb94320883eba5
SSDeep	24:Ga5t1yZs2X9tnKjpzjb1CNVXfWyvXEGGre5n8YX35TRSn:GSiZC0WyfE1O35T0n

C:\588bce7c90097ed212\header.bmp

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\header.bmp.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	3.81 KB
MD5	0515a539dd2173563bd59fc434ce4e1d
SHA1	ffce54f7085b974caa5dedb4c86491b0678c98b8
SHA256	51e83febbbc1693d49323f15e0037af36cbd8b4c4f3d759d8fdf724ffedfa805
SSDeep	96:3bmZCA8qY5IP5ZOwuafRZPDfuriw5uDp7NPes0XzORL:rpA3Y5u5/jPDEi/d7NOC1

C:\588bce7c90097ed212\Graphics\stop.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\stop.ico.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	10.17 KB
MD5	add3e2fff03e1bbb36c59d6b162cd9b9
SHA1	66a173e10ce37761e4089d0f2c4cc9075e1410c5
SHA256	f461e23bf54f574bfb9111894b19cf9fb7919d0a21c2f668bf85d2a6848cc47f
SSDeep	192:Qsk1zuODGwsjZbcYa2ppCX5etF+kqyzlsjAJ9eGHDycLYWELxHTukEzp38uKe:CJuODU4V2ppW++mxujsspn638uKe

C:\588bce7c90097ed212\RGB9RAST_x64.msi

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\RGB9RAST_x64.msi.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	180.78 KB
MD5	07940d49e123eee02d89eee17f7e2e0d
SHA1	61c80859a41c6c3b0578519ec01ef4c5a89f85b5
SHA256	5488aaabaef2e023942efd5d0025e9705339d6d5fe0c012a66bf75f17d82699a
SSDeep	3072:B74VXqTi3PAKkqhiSRiKWIbY0SvNuYLFdURTtSaiklP7ZnJ90Y7BX1zcF4V9Y4Bl:R4hqTi3IL8Co7SvNuYLFdO13DjX1o4

C:\588bce7c90097ed212\DisplayIcon.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\DisplayIcon.ico.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	86.74 KB
MD5	1bdc97c259b213f343b7b494758700ab
SHA1	9f4c1847cb3d36c4f19dbb30001e2cbc6981a7e5
SHA256	8d55ebeded65cf3c16592b27f5e1cbe49225a189461840fd096c4e302d31f04d
SSDeep	1536:Z51b0kIRv50UyUEA1E9fZd+1XxjdXHNxBuIAAtkkH03vwPUzCGbonwylxRk:Z52x1OoW9fX+zxXzBuCa+mwPUzqnwy7a

C:\588bce7c90097ed212\DHtmlHeader.html

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\DHtmlHeader.html.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	16.02 KB
MD5	bb888a62705125c733e2a004b0eb79be
SHA1	9cd100f961a704121ec51ae4ef952e97d7d8bbcd
SHA256	94e3327350a010741b6995b25f610fbba77a3da03682b286faa18630bd849fa7
SSDeep	192:DOfd9UXB+Z4JMiAf68HGgdJtd4onT31NowRxBimZNk8WqNjs3iBXbPqY/6YGMXBO:md9WL8jVfr3BicHsSyYkOBxlM5QYh

C:\588bce7c90097ed212\UiInfo.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\UiInfo.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	38.27 KB
MD5	ed10c5ff824c40d3e87d93696c39e682
SHA1	48a1b805efbda72a3de043e60e79632dc8f28940
SHA256	032b376a09c9cb4500cde4beea363f5bdeffcf89fe5a5d77509ad3b82e152232
SSDeep	768:No8dh41xJV/FgZ/Q/EUrJge22ciUxUJxSe0jY+ET72otA:NoiSxvt0/ivrGe225SrYT3ZtA

C:\588bce7c90097ed212\Extended\UiInfo.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Extended\UiInfo.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	38.41 KB
MD5	6be6d3d4cea9e09a81a868266d93f566
SHA1	ed5c5ed3f9c29ac52a8a7cc8432270e08a2ef12a
SHA256	d66b7e4cd4dc65f93a5393289982bed7dfe2803e9e513e48d2dd31d53bf8193b
SSDeep	768:ccWVJmZ5UXzmSzq/0W5wZDIk2NOJA9AWlCFLPoSfBtsb:c5Dyh0lp0OJA9AqCFMSfQb

C:\588bce7c90097ed212\Extended\Parameterinfo.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Extended\Parameterinfo.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	91.41 KB
MD5	450e8e6cfd82c1b6dd0f56cf65472a6e
SHA1	4770b85629b99074d8ef51ed8e013bc9534e500c
SHA256	807691f9710cc7cff8d7dc62df5e6ad421533fb83499f3970f19a1c1db422eac
SSDeep	1536:Wz5NhzZlK7ASTaRm9LbXt0p7u3euiL0P1KgE+cN56vlFOh8bLza2B:Wj9qt2Rm9b9M7dLO1KRnClFOh8za2B

C:\588bce7c90097ed212\ParameterInfo.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\ParameterInfo.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	265.94 KB
MD5	ad5d67a7a4e024e9b5937371a3fe57af
SHA1	4c35d54a454309c8e404d9056a32ef6f5fff8b2f
SHA256	4cdcb45c4ecf7f55e753b0bae7f4e8c55ca7db5b1dc72e90b28a51fed130ab09
SSDeep	6144:hX4pPqEeqDWGhv//BVZiUJrpHku0hFhAliU4khkXig:hX4pPZH//r0UJrBkuuhGhkXig

C:\588bce7c90097ed212\Strings.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Strings.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	14.03 KB
MD5	a5b69e8e88a483e15880774149fcb0e3
SHA1	b784512128e2c6401c5c5fb7212c92aa2d73ce39
SHA256	6c5c75d5b1e3ddd816be90a0ccc47f7345c0d48e8ca2c31a91ec86acf2891860
SSDeep	384:eXYpQd7nFIgLMSCAOLOzzo+GuV1cj4wZQ4ng1910nG:7pQHMSYn+Guk4wC4g1j0G

C:\588bce7c90097ed212\SplashScreen.bmp

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\SplashScreen.bmp.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	40.39 KB
MD5	b798322f5d0feae9bdefc4624d8800d1
SHA1	f2b9fc67f3731c0da42fa38603b2d669d9a7528b
SHA256	352ef99ec3cfbbbeaf5700bbe664248ee6532e8bd5ba53adf3a431ca5de49625
SSDeep	768:VRt45SjpIlDMPHaD8UFHSQooZwa/UnDRQpJKQD/kQBgU821R/:VRWsIiDUlUXnD4pD85UNR/

C:\588bce7c90097ed212\RGB9Rast_x86.msi

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\RGB9Rast_x86.msi.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	92.78 KB
MD5	e5980174560d24945e3656247bcdfc5f
SHA1	ff4fded5f63683b8b53ce8609d62ef8445b077f3
SHA256	550fd7bf0c1ca11466765439d233fc90413898d7102a383bea8cc375f10eb261
SSDeep	1536:mAGnPSP09ExrVgExgeqINg6my4BQ57EHFT/Kb7t1azI8uvbATC2Bns2WgjEDF:QnqPCExg7IhH/5IH5/Kb7tYU9vS6Tgk

C:\588bce7c90097ed212\Graphics\warn.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\warn.ico.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	10.17 KB
MD5	5cf39d9041e835430fc213c4410fe52e
SHA1	f49377db0be422556a8e809a9208ae891d13f1f2
SHA256	250dce63bf95dcc46902c9bf2b36235468c2f952b373c462f9fd8d634df1e4a6
SSDeep	192:P3WN8BlDW72IWa52TR56xHPqeBInwLQ15Fnjm7fUANDfjxERCJzY9MESS:u+ByTWtRSqKLQ15Fnsf/f5JzY9MESS

C:\588bce7c90097ed212\SetupUi.xsd

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\SetupUi.xsd.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	29.69 KB
MD5	8af1388927f9fc7ab9bf27a9c5621aa5
SHA1	d7f0cd96e93a5ea5fb3497f1f2251d5628007163
SHA256	f1f11109f6a42122cbc89de31a4a48d43c5801aaed0affcec06da1410ff3a198
SSDeep	384:pWFugS6zUJkcpnHnJLLQiRDOxWusAanfwM/z7/x2iCi9iJ6sv7EMVJ4H820PHjdT:soV6ypHnCIK4zYMn/6i92nvYac8HHTzt

C:\588bce7c90097ed212\Client\UiInfo.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Client\UiInfo.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	38.41 KB
MD5	4ab53c44f1843b3291a433f8d11a1200
SHA1	604c8be8cad24c619fb76bae425f263a589abb79
SHA256	b16f891f9720da8a35a3ec053a39be8706f3aafabb1b96b4d93a471ad84f2ed9
SSDeep	768:1D+fEYpmx7hNnrSx3dlMQu1lmewKkKMiXBQPwLI/txiAjU0E:1CfEqmxNIx3dlNuo3eBtLcU0E

C:\588bce7c90097ed212\netfx_Extended_x86.msi

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\netfx_Extended_x86.msi.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	484.28 KB
MD5	ece4b2de7a366c97984c33e0e00272d9
SHA1	905525b1a463753b90cc7c54dc2509090294e38a
SHA256	aa4bbeaca260d07367244838147eb23bb4bd57339673c03efb35199f5061dbff
SSDeep	12288:iaPXQpICQSAd54B6razfDBFTcOQtkVu2HKccJ:jPMcdRrm3wnmcJ

C:\588bce7c90097ed212\watermark.bmp

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\watermark.bmp.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	101.91 KB
MD5	7a79d87b6d564220e5853893a62cd6a7
SHA1	1c45553f5fb4351b69b21f17658c987f335f36fd
SHA256	e8715428f83981a7958974783bffc979fc07b30f25267227a14cb3a533ab2a6c
SSDeep	3072:auU0Cn3iv4Tn5XhpWvHz5QVBm8eGeAKz04zu35IFmo:vU0MSATcEJgAKz04zQ5Zo

C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.39 KB
MD5	e7efb211d774517515b88ac385a8defe
SHA1	8d6184d930a7723b1366aa5c7dd7fbb2c27901f4
SHA256	446fccc09eba6182e4f0c06798f6fb34814729f6f3748eadc390a156b5648a93
SSDeep	24:D0QSew8pv/gAs/BlBIwab8ldkQ23pAo4DhOENDCISy+UO0A7th3vwCuy3H:gTopv4AeawTXkJd4DhO42+2h3Im3H

C:\588bce7c90097ed212\netfx_Extended_x64.msi

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\netfx_Extended_x64.msi.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	852.28 KB
MD5	75096f78c80c0ab366a1a08b44be1b13
SHA1	35de2e157e8a49b2e8143aefb49dcee443ef9b45
SHA256	273551fd3eccb8f403b6e9206cf58e1be4e8821bbea407faaece83bddffedf78
SSDeep	24576:pLN+eWfO1eyyqzRlGCPxajPQe2WW6oyeBoBz0d:pL5WfO1h7RAC5aZoTd

C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.04 MB
MD5	1c1768f02646d80cc7d6c63e5319f9e4
SHA1	bdcb6c50a636af316c7b8a61a040fa17466ed24b
SHA256	d6f0943ab94fcd3df055b97eea21f151f1350aec9f67d182a6c80348baa93eee
SSDeep	49152:DztcDbdYumUZsitydApfwzRxgYePce94lIweaIzHwy1Qd:DztQRYumUZs0ydAyWh9IYjD1Qd

C:\588bce7c90097ed212\netfx_Core_x86.msi

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\netfx_Core_x86.msi.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.11 MB
MD5	4f2415f85c3838e4242a9517b27f8953
SHA1	8b45924a0e6f4d23f8f358eb7c3e1178c5bc737c
SHA256	25d95ce4694237912ccf16419a5d97356a76f1e7b06af0c729b1860168bc85cd
SSDeep	24576:f6cmppJmdHQZr2Fl3zp6ruhrpNhCGIbMIYRQB2GIn0hnJx:aF2FlDp669pNQGVV/09b

C:\Boot\BOOTSTAT.DAT

Modified File

Stream

Not Queried

»

Also Known As	C:\Boot\BOOTSTAT.DAT.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	64.28 KB
MD5	5708170ca5ce0048c39af15446ecfce5
SHA1	4e6860a939795c14594a9d6f1ad92d159d1c6a23
SHA256	22da009551fe61edff866e0c6a8404125e2a1057c17f1824f1172060ee522104
SSDeep	1536:223VHznX7ifDmoLCKhu1rAbpNdSba66HOU/orRGLXJ1j:nX7cBHh2stNQ6sGrj

C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	4.96 MB
MD5	07e83f54ae4ee7f164cdf90249c23fcb
SHA1	2919deb52cfd16e6401d0b3bf4ec01f414dd07ed
SHA256	cda454f7543a28a3702dde5aede0ae06dcfb545b5a5271516a07f0067b95742a
SSDeep	98304:R1GSmgldhrCOUjX57BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKJhlV:qhOdhwZBkOK2Knq45mY4H5OMKkKzlV

C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	4.86 MB
MD5	dbd9eb2234c2dbfc5b1dd47b8e6d59f2
SHA1	92f845c61d14ef71b5b10f11f13703da17aabd3f
SHA256	786ff43ac2b5e3aec6999445e82e07a7a59639b0bb357239c5844cf59855e324
SSDeep	98304:0+OPGv4bsumB7c8pKy/aBHTKYzKXH54UuFe1kBpHua/KUKcs3DKVDK6rCj:Qa44IBBHTK8KXZ4UuY1kB1iKFKmo

C:\BOOTSECT.BAK

Modified File

Stream

Not Queried

»

Also Known As	C:\BOOTSECT.BAK.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	8.28 KB
MD5	13929a59ca541182af1bbf06ac4ef742
SHA1	9eaf10d5134dc590984c4a9852118d45dc0c5f8a
SHA256	64e6b3b5d018a6dac3d2714278596185f8dd02440adc2a767b9bc4746a4e470b
SSDeep	192:uy87SpVEwuHlk3VykyRaRBEoctY5rDsj8s3Mi+R1FjxSzqzKUXTZaFjYqOWytn:uxSpVCHlklmUutOPsjpyBxSzq+UXMsq4

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\desktop.ini.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.44 KB
MD5	588cf4223833e9f31f712c09ab278ce7
SHA1	b897db6423322ab3e28009da1028cd7fa820ee65
SHA256	4b644e199de81093041fa0db17974e468860a4712cd1a3b3b8e6a657b30aa227
SSDeep	6:2yg2wkHzIj0hooA7zxnD7Z7u3Vo1Ow+2li4qTqmAFvHhNSEw06Y0ZTKMjWU/buds:vTe0hk7zxnDM3VikD9pu57UDuFXw

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\desktop.ini.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.55 KB
MD5	9fa911fa26eb8325be8b6403bae7e5af
SHA1	1b7a4eeb72879271201626b41a28cc7d28b00656
SHA256	c9b253edd6723e6ae66d6cf1d20484add670f6c16cc6af1e61bda70a8a22820f
SSDeep	12:c0qt5JHQ/ThkjyftXvPy6LVaNm/dV9LJPn:Nqt5MThk4KcX99n

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Videos\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Videos\desktop.ini.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.64 KB
MD5	b2ebe09f969abe8479ca9f0fbebe9dde
SHA1	f0231eee7461834d2ffac82b399263c8c022c81e
SHA256	2bceefebcd166def242500b4e2703ef0c7b867e5083c3568a6d29d5610d9d7d4
SSDeep	12:ptfjlPEP1UZbDnSfVylItK3/ny+AHjJE/x4mhtlVHiO/40th3:ptrlPxbDnStylmKPnCHjJE/+mhjVCs4O

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\Acrobat Reader DC.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\Acrobat Reader DC.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.36 KB
MD5	0c8ba948d45b069e79e46f671234a6e0
SHA1	73b9e9306acdc5d3560b1c3b0adc66f48faefdb2
SHA256	b85dd032363411237823494a8df08a06e016b5448a65760c67a106dc17752cad
SSDeep	48:f8986uFbe9TpG18+WZOMJ36SkUWOhgCTY80X2ZNwVbQ2L:0986uFC9NG1mAMJQTOhgSL0X2ZNwbQ2L

C:\588bce7c90097ed212\netfx_Extended.mzz

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\netfx_Extended.mzz.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	41.13 MB
MD5	505791b7fa2dac44479a5a17cf614465
SHA1	4faebdb9fbdfdce039aea8c08e66963f89c8d57e
SHA256	b0cd9a2fb66d5949ea1bc985e55e6632247edff88c330358874fc82aeb03d648
SSDeep	196608:ymjCWWbi+uvx5roS4stXIcZXdxts2bdgx43PAMfQ:3jX+uHroBsietPxYcQ

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MF\Active.GRL.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MF\Active.GRL.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	14.89 KB
MD5	f9dbec24791cba6b1cb0920b5813d887
SHA1	9c70db2a52faa6bcadd773cd479087218539959a
SHA256	e982b76d46ba8f22a20d6c86579e18332c17b8d01922b0261736b31e58d3045a
SSDeep	384:J/H1NKm5VHHI2k29e3+tw9ul3cyka7ZK+d2WSa:J9NKm7n9k29amPEa7ZhY4

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MF\Pending.GRL.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MF\Pending.GRL.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	14.89 KB
MD5	6e7d56ec596698fe3edbd9faad348e09
SHA1	eb37a588cbd12d5b999c9dbd605b7dd8ca0b1448
SHA256	cf46d1edd1f5a9183b0b2775ee61e9b8dfbff0a911d6af8711c53ffc8b557a59
SSDeep	384:iSt82sDT6sI+q2wZGnE30PDFd5e38oVo2h:5CvTz9bwZMqiFrfEo2h

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\desktop.ini.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.44 KB
MD5	4d9c94ed548bccd6f5e925a605c60552
SHA1	51f8b04ab870cb68630a19680d1619e2cb94ae8b
SHA256	f7d7bcc0d0a79e60ea664285a04726b183f128c03f1d8d2776470a633359a08d
SSDeep	6:KKA2o4+1NMAtoqpqRra8CmaIA5hPEgQebdX1updssykHhL9bve+olhFqFEhu34Z/:Vuz1NacKS5ERm+pLK3YEhu3w8C

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\desktop.ini.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.05 KB
MD5	0d20ca3fa8c03a1ede6b1a2db6fb583e
SHA1	49491096a2fc10885bf313cb3a67ec25c4c31014
SHA256	d65bfbd499eed132746cf29fb97c104d973d16ae490fadb47a012f9999a86b37
SSDeep	24:26G8yzRKLZp0fLtsTi470fu1UDUdzo96iaVTz4UH:2qoRKF+Ltsa2cO

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateUx.002.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateUx.002.etl.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	12.28 KB
MD5	43e216895fbf847ef8c365a21efbbc60
SHA1	74fa21fdc672dedceab20e7ff491ff89352fecd0
SHA256	448ee4efd6ae05213fdfbc22c04fd9b7bcca5037947eb5b2dd609a406b083ee1
SSDeep	384:wk35xLCbXCTZLqT6KsIQgcTp3yb+4Srjisn:wmL+CoIpsSSc

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\desktop.ini.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.64 KB
MD5	2146fe12ddcaa53194de37ec67c13673
SHA1	af22cb996402ddc8c8f445fe353d0b236daec20e
SHA256	833b368087a046b010c5ae1dd2a6fb32467a6445e57f943b5a04472658f97a4b
SSDeep	12:wRVhX63fq5HZUrSTXC5EYTtQXEUzzu2b4WQI8j532xIrQbvG7h/VyU3jANB:wR/XcilZhTWTtWQIqZ+BU/yU30

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateUx.001.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\UpdateUx.001.etl.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	8.28 KB
MD5	9b36bfb3333ca3aaacb5ed18fe3f4e12
SHA1	4321bb333d4e7f2e5321051d89976e04a94c2379
SHA256	f1386438fa1d36ef13418aac5d7ce6aac35e2a40ac8a80591f152d30ea39c171
SSDeep	192:skIKMgkiWhMj3lBRk3ug3YsPhFiUIk1M4aVMwI14tic:skHMgkFhAwu+hgUpM611Rc

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.1.xml.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.1.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.21 KB
MD5	8b807aed2bafdc3db1c51cbb4f143ef3
SHA1	e58a72e41f1d6e4d4b88928ba622b103cc11eb34
SHA256	f07f0dd5effd4f91134913d05543a0be7bd622349c7a3aef592027a90281a089
SSDeep	48:kL2rj+h9JuyS4g9k0fc8rARAdL7D2jVzY7tEAadr11ewkgC4v2Ef6:h+DzS4gVz0RAHDUSqL+wkgnT6

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.2.xml.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.2.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.63 KB
MD5	34852d724c1471a67e567c8eaa0fd931
SHA1	4ef4feeaa20820bc7158c6c1e8f10a8661701612
SHA256	5a78266aded7090e543ef474451efd148b6b1388bc09d754cc6f0f976709a995
SSDeep	48:c+Nb6vU3gmeU4C2cuu/YiNzfAxdNaAfSg:cqCQgq4CUAYiNzMdNrp

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.0.xml.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.0.xml.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.21 KB
MD5	1e979dbc2be29ce4ddb946277c636c50
SHA1	b27a7dc07889190702247da2d48f8e4542e83d44
SHA256	fe7d9e0190759600edb2b0ec0cc947919c3d04deefba65286c4ef6b65c0ad36b
SSDeep	48:QKgXKEN774FZQ+FRfe7irnYQPQTarNiP8ukVd6VPv:QKgR70Q+Pe7iLbOaIErVYv

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\edb.chk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\edb.chk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	8.28 KB
MD5	01fa518b9d7f3912668118dffb62b1a8
SHA1	31d5de2d685d97614c3a7b6875a1dd9d23affc37
SHA256	a2dd671bd2dfa7887b2fc79e0cd09d39199fb3f661d327ed58d5c8630b1f9cc4
SSDeep	192:6GOPQFdSQ5xgB7sPwIrRpl51YnJ3mm76WOnN/n85jIHIoinDufeO8GK:sYX9xgC4EplAnp7ON05jQibO8R

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\edbres00001.jrs.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\edbres00001.jrs.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.25 MB
MD5	128f31b6a13aa4a9bb722804c4f140fa
SHA1	bcf7c7442abdc5ac9275683771c9dfc824defdc3
SHA256	0c2bff09707dce36e88fe2232a8eccb26c6b2adbfafe5d39e026ef534be5d9a2
SSDeep	24576:VT3RA8mJ2Q2TyPRmUL+m8Xr4Mal/UVQduKr8cPGT/NcVAddbwLo4I0e:VT3686qyPMULn8XEMa9U8fNOdhwLo4Ne

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\edbres00002.jrs.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\edbres00002.jrs.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.25 MB
MD5	9dd1989a10da7155e4406a972e5d9798
SHA1	d5f6c8faddef192bc37481213c440246884e5eb9
SHA256	2177bd0512a5e21ba02b762fb9ee57c5bbbececd6689cf53036b96801d23f64c
SSDeep	24576:sfwwmGJnCjzcBzNspeySlgf+NAMZO7oSKd+122Q1Sac0hSZW:sfrmFcwejafoARd512L/h7

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\edbtmp.log.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\edbtmp.log.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.25 MB
MD5	edec118a409c93de84d08df06c3bfc9e
SHA1	93dee75f050e23ecbe13823558ebdd0b2b8d88fc
SHA256	44aed22ed78e1bd3444ace56cd61b0bb833de987abd80b3c4c13e51e1d713da4
SSDeep	24576:4frLHHLGnby7hAinjcX7ZcB1ZhSC9Hmpu5ZMCLVPZxzAyks42pshCBF:YvWkABg4WH8uPTFb1tuCBF

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Storage Health\StorageEventsArchive.dat.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Storage Health\StorageEventsArchive.dat.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	5.64 KB
MD5	3e259d7ae7d7c78137367622298a2b75
SHA1	7dd649b9b04d3d347f14609249d1fbb251f5a0e1
SHA256	2fcf25901e8380106a6a8d72a76bb6184364c89af50ca475a942f8134f646e9b
SSDeep	96:d1c4HC2Qn3Xz4MAPq16hxU1p26MxoeSPY8kdZOOWHvhf+h6++gvuOT:d1i2Qn3h91yxU1pCxWNAOOWHpWh6++LU

c:\programdata\microsoft\user account pictures\user-40.png

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.71 KB
MD5	302b1cc244328cfe11fc04d244d6f153
SHA1	52c0edfc367a32d77569948e40bf1900b932e43a
SHA256	9f497b1126315e3ac53b7adaa61542fb5cd1ed24539f1ce2247afa752e425958
SSDeep	12:HCEgdvD+lZFIBc7qtU58un/jkQmMkLyT5GvdZpnvXCzSk/vCX234YLHlfMnhOmhA:HC9dLOEv08un0VGT5SvnvXCzS66X2oYX

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-32.png.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-32.png.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.67 KB
MD5	d178204934f8a42d4c23c736cad37dc0
SHA1	27e8fe4821675700b3340ffe34ebcff936559d1e
SHA256	81b73de4ccbc3eac83e6141a712ba7fa744f73cfef1ea22cb3b305d8a6779581
SSDeep	12:YLllpMVaoEr2GnLHgUNH5elchCHhX6JwwJoIV+KOGB8S11E4aUBs6iFaOfZvpgzj:WrpMVYdH/IlchCHhYhJ15p11ErUqhkSq

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\guest.png.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\guest.png.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	5.55 KB
MD5	8f648e7bc6be8a867294f5cd30c45dd2
SHA1	56c541d16f719d6bd09ee09daa44843cc12cb0f4
SHA256	f21e5834295945d70233c481d9f890455813fba9992b49d641ad334d0b13d0d5
SSDeep	96:T8FZYKJb1D3Q6oweofyXDC5gAto3hVnLOAAp85VVLJrwZjIV74UIC7bXLt1JaK1Z:TgaaNQ6owaXOgJUibJHt4cXLXJDZ

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-48.png.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-48.png.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.77 KB
MD5	79e528e0f3a107e07d8df761fdadc8e9
SHA1	510d9a69704fbf68cd7725df0fa9191cc963aa78
SHA256	e214b46ed91daebb47dbbec6eec4e64cafd549dbd5223c03d7fe584714e72070
SSDeep	24:7kkF3n0gaP4fs7MAuJx4RVdcnv+Jt0bCYacKPmtd95J:4kF3n0n4fs7V8x4Pdcnrb1Amt35J

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-192.png.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-192.png.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.63 KB
MD5	4b3486e808b42e2f2bf9adcf721704f5
SHA1	d0dc439dc7fcf7a69b7f667bb141ac94733d47d6
SHA256	c3766add9b47f389634393ceebedf5cfd832a69dd9818523bcc97c4352450910
SSDeep	48:YFGF2QjN5GlRZ84tXvtffET2yOnZ2eEP+IwyqOZvTrl0Mel0b9mOg:Bb2lo4xF3Z2eEf1Vjel0AX

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\guest.bmp.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\guest.bmp.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	588.33 KB
MD5	ec0899685c53759f82c0ac041a9be521
SHA1	392b59bb87ece83365dd1fe2bab7d559f72e2de4
SHA256	2ee0e24ffea35a7d1314b461e182e3d310ebd8a819c725ccc4de36d73b7f89db
SSDeep	12288:eTDNWxmxSYzhvPqjaeRtjJGO6+7ERhxbmOwaOLaE+sTOb5Pz:kbUjlvtGO6+7ENxwazbBz

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Live\WLive48x48.png.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Live\WLive48x48.png.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	4.83 KB
MD5	41d09cb7e1d6098609ee0bbc77a19976
SHA1	99d21db1638e66412c979a1c671d50ad7f088289
SHA256	5c56f04b59d131d05c6c22e7b860e4b2662d2a950235eae6e25ca2e6714d46f6
SSDeep	96:WRMj/inzfc2D5uwseJ9hL252wwesIn0vZbmq2ud0tFQ3x4Zd/NSIaq:Mm45bseJrC52QsDddh4LxZ

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Access 2016.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Access 2016.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.64 KB
MD5	5f8521df735635a1f7da85005646198a
SHA1	43442613cf2a2fd29ecbcbaab34d1ad210bc6771
SHA256	b06369cdd77d32fcb1f34d077710dd8d290361c35030759a403138892e85dd83
SSDeep	48:4M1fiJwpUidbxy4u7NP3PKLa2zL4K8HRcFINWQ9ipWycNkAB8gcOWto:51fGo9JulPKm5K8x4AnA4Nwgcho

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\Desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\Desktop.ini.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.64 KB
MD5	9f7ca12d6a066f49f2b97b9a792a7de9
SHA1	515a587655fb221abfab62f6a500cb229eafdffa
SHA256	b6bca87dd2393105664b6364fea8ff90e4dbe4380faa7d52ec9a6d5b4fbdb150
SSDeep	12:vXfzylZ4UYs6e1gam7VuX8VLL2NLfLgXaFdHHjVE2LEFCokgxpBwAAoL9Tfc+tdy:vLyjbm5K8VL+Lf0XyHHja5F4CveOfc+m

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\desktop.ini.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.72 KB
MD5	a285aea44529378985a85b597d775634
SHA1	f1b9c078c0d93c2439dece8738c1b3c18b484ab1
SHA256	6e84d34bf611943c165683ec3220a0c2a6777aad21af61e75b212566015d5169
SSDeep	48:auoxPMEQX4AkOJNClxFauBwf9exh8XqroTu+Ljj:aNtMEM2OJNCbB/h/H+Lv

c:\programdata\microsoft\windows\start menu\programs\accessories\paint.lnk

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.36 KB
MD5	5d4905c7ebe15102426d709f66d69f70
SHA1	65bf8f3bcb574dc88c5faec558454bc57841cd52
SHA256	03857f524f7737a9773fa0d668e200030c46e215f3d7e1c1aa537eb6ee7351d3
SSDeep	24:ObKWoMa/V+l2H28mkyhNrPIjlOOPXxg55QADXRD/tIp3FTTAnfRV:Ivot4rfr+OCq55QAbRC3Fmn

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Snipping Tool.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Snipping Tool.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.38 KB
MD5	1e4c80c3de4ea6a914f1f8f55e650717
SHA1	ebb8f61256b8cd1d531ecd2ffb3f44e01503335b
SHA256	46fcef2cc041d4082eeb73605f4c349e2c93e64c9c7ce08492fd241a9d133a3b
SSDeep	24:iokKLUtPcco5kDnvCrvlvyE9a7YCj66er5dt/0YW/yViywt4VtflshpSqn:WKLP5Sve5eYCjLe5/jWputCV

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Quick Assist.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Quick Assist.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.41 KB
MD5	97abbd4fa5b410b096d4424d3d239838
SHA1	889d942effbbc9d7bae2fe62a48c8209e957101f
SHA256	80e90067995303839441f8bc3294db448fd8257340f37e557c673ef9ce446096
SSDeep	24:S0YOJXVkxJAdTIQY9wompXGeojJ3YFO7SpA/JfCI8NzfZc8LB0/sYeY508EiWVDC:S0KxJARIQYfmP9gMA/FCI81CEYe6EiW0

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Wordpad.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Wordpad.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.41 KB
MD5	42d1d4e515c9899939478f46c6e44729
SHA1	8e3cfe228a5610db5967104264a1dd30029caa2e
SHA256	d54518119bd8ddee2ca68bd2a54661182b6abcddb4293cb1a8e4c0a16c1f8627
SSDeep	24:7CH3vUR4g0KYc9sVxZIk9p42HsjCLKBypnqEaHuN2407SekXAtPvTGe2stW:7stDKzsVxlGbcMtON24Cw63X2sc

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\XPS Viewer.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\XPS Viewer.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.38 KB
MD5	3c951f7605a6a8a443856ff3da342670
SHA1	10ad671d203df701cdc1ed2a4fd9677c705d89b5
SHA256	bb5e4371f0f68b549ba9fa34a79b49e5affc400ec7c971b93aef9641cbd2c578
SSDeep	24:S/a3Cu6OlMYYXdbVygm8W/os7SrrgbETVPzuosMn9ItcQJxZqX5w:maCOo5Vzmros7KuSfb/QJh

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Acrobat Reader DC.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Acrobat Reader DC.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.67 KB
MD5	d5a7436386f8d9099c959c6c981bc789
SHA1	3969163bee0a6592f4d76985468eb7cc6940087e
SHA256	73b17840a996a1e532d5330ca74e12ab8ec4b2000774a7ae21eec07555f01acf
SSDeep	48:7B7u+ATal1cU50N8dhlon92EKTvah1TveXqondSbz7BAwbVU6o2otjA:7BmTU50N2Sn9xKTihVveqond6HBAmU6J

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Immersive Control Panel.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Immersive Control Panel.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.56 KB
MD5	d148ade7981519f340dde1bfbbe6dc25
SHA1	bf893a4fe8f7dace2687bd0368023ee417ea412b
SHA256	d3d39034e7352699bc7bb74475714390b509f48470b05c8cd685070ded74377f
SSDeep	48:o06Ig0xUsTRpPfwDV54KifG3V+l9mdTvOkNI5xyWGUpGX/ma45R1b9d/vHMWk:ZUsTnwR54Kif9mdbrNI5MH2GX+bLz5bk

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Visit Java.com.url.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Visit Java.com.url.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.46 KB
MD5	05730c1b046fbcdadff5280c07b03726
SHA1	8ed79a88a273709067219a71b181ceb79a719d54
SHA256	5e3fd39be902dfb643c2a60b4c2bf90ff14ea0de2959054feb48477c85d28ebc
SSDeep	12:WnW6axF28/M1Aze8Crk65/8dRPO9Wo9RmPIYDBQCq6g:WnSg8RzTCD87PO9Wo9RMBDI

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\MiracastView.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\MiracastView.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.44 KB
MD5	ce902179851572cfbcaf6de7779e204b
SHA1	18ef2eb17f615746fca74504cea1f48313585eee
SHA256	59dacf5a68dee1f7536134305c806f1ed83bfed9eb3dd82927f9607f5f1955af
SSDeep	48:jCD5T6SJIUN+SJrCgjUe+28n07JrwDRQo22Mtch4s6h7:uD5uS9tjzvEDRQoOx7

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\OneNote 2016.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\OneNote 2016.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.61 KB
MD5	570bc3c0beca4b872a8fbe44013f3b4e
SHA1	12006e6e20e7bb008f5781c90798915e4a6e2218
SHA256	c769d1c7e2c2ed5a099941063971df89ea24462aeef55910a16d179a97ab1bdb
SSDeep	48:XBWKZ9vyI4mYDxC/sN6sZtIb0z3tlexNTIAesLD5PfoOAdjb:XBBZ9vTs7b3rDAesLiO+3

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Project 2016.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Project 2016.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.39 KB
MD5	425312dead06522078f166f0958805fb
SHA1	1482a7b24d1fa96beea003bef32c7da2caeed491
SHA256	ce621bf2b5934df2c43005f8479fe4be5a468655c8ef0407fa1a52eaceb162f4
SSDeep	48:SVvDExEh2eTDHNaQ/ghwcL1F63NLziUNaUtk6ODi7Wca6PvSdJPDlqiCby:SRYsBaUgCcOdCUNzt/2i7WcvS7AiKy

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\Desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\Desktop.ini.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.44 KB
MD5	327c6e95c761e66d96f7b75acf855cb4
SHA1	7fe24d5028131966c397a6c55c43e7349fc8fdbf
SHA256	804a2ed9774f870a9e78804de94eec092f9d0bcf419aec4cca27657f88cdbc1d
SSDeep	6:uX6mc2tivxstN0NGLQAVol0Bl7kLxg0wfSWswOk90yCXZHMo5e5Frhp7IBWHy7u3:Rm7tN0NGLQ6AGuwOvHhe3rTjQu9fgi

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Check For Updates.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Check For Updates.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.35 KB
MD5	91887cd20f2678b9e5837681774b5b90
SHA1	5b5a71732484c026d1ba8afed060a26da580d642
SHA256	61fca6fae7cc9e0bcd80fdf9395a56ced578f11fce86b149589aec7d26564a8a
SSDeep	48:g5L5sO9Kggw0Fk4DZPXuFc98HBYN4Nmur0Un/8Izpy007WeDn2f:gl5n9VSk+ZPXuFo8Os0Unpyn7Wew

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Configure Java.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Configure Java.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.30 KB
MD5	7dc2e38a668b27238216e46a46ad881d
SHA1	2d5b72409d0f04843536c2da7c5344f9b8c90ce2
SHA256	7e008c3d4bfb77f95510484323b03035421d7aa26b1d0392b3c24d8c6974817c
SSDeep	48:n99Nzw0jqKHBcjXv1zulEqfg7/5cI3FYkpx9G:nTNOKqpzKj2/51FYoG

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\OneDrive for Business.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\OneDrive for Business.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.72 KB
MD5	45780ef5fe71ae7830e8c6feb872702d
SHA1	b22bb0a86438c4f3bdddb86f8248d5d37b4c3b15
SHA256	acb697bb06f015fafd042d7b4100734d54abe87b0b7cd436f1156cc759158381
SSDeep	48:+xJn9EkHvl4auRZ59bnMgo4NEhWtm/et/Ry6zozvkk4dYo6m:+H9EyzSdnVVNwWtmu/RHzqkkY

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Startup\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Startup\desktop.ini.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.44 KB
MD5	e327aea7eb9679e0d1b185cd15f7ca9d
SHA1	5acd9f94a2d8c48a217c2880306b7e58437bafa3
SHA256	2e0f07e034d788f5c74850d98710aa7858c070a5999c44c3cce7780354df242b
SSDeep	6:V8+N6YCtToYKjeuaJJ3UGOjUy0fLi4UQrnBZXrvqajKYdPzMEVpP:6ACtTopjeuaJpUGOgNn7ryHAzMEVpP

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\PowerPoint 2016.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\PowerPoint 2016.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.67 KB
MD5	dae47680a6120be6965ec618ca91755e
SHA1	b935e49cf31f9b8c3d315ed1d9597a96f2984be7
SHA256	f0ba259254fd742cea344ffb2bed372e4e634201fbaa4ac5380659b936f08ff0
SSDeep	48:0yKbtcxrRBSrftXRt7pQ1E5h9K2H6Mq+DqFsosRIZw0j5evr4gHzYvwjYEYqf:0yKbYBKt7p9Acm8qFsrRIh0r4KYvwjpf

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\Desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\Desktop.ini.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	0.61 KB
MD5	f00f75b8b12c1150ca9236b21d557ec5
SHA1	fab7f1dd10a1f005cc4f07868b2222d0a48f9850
SHA256	670f30dc17d42d17f4b7cb129fc2510848a63c469c9c4bd38e80dd6279306180
SSDeep	12:zfljdFZm8Le4jpyqiQhY6Es2QpawSzy9fLsd0rllPdnPjl12Dn8tRtbmvsKZZN06:zlpXNe4tyqz2Xc0wDfYdwlP5l8CRtvA7

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Visio 2016.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Visio 2016.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.38 KB
MD5	5276808241d911437b76ebcb26b3d6b4
SHA1	e1bb63f86c2223188e1492aee9142cdd6359c60d
SHA256	42d4f0b132a1fa9306731357c108c4a6e9524d451210f0ea8e07b61125d0c2dd
SSDeep	48:CqmANm1nBnnQgYOc3pjkHyLOoXZzUA8sn+40M1NjBLpyVC9:zmNn9/opAHyLOoXZ4D41PjByC9

c:\programdata\microsoft\windows\start menu\programs\publisher 2016.lnk

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.63 KB
MD5	8ff2c7943fb5e24912e79f5882f0336c
SHA1	2f72c575f999816e9aa162fc858266979f1316c7
SHA256	46a1131d6754882b0ea5e59089e46f11b9c93f7be8cd21f5f8d28f7bcfa9a8b0
SSDeep	48:hiaqxfpFLgfnepohOBTqz5pgGwl4nhmyOl98+dj9fC5tFGYopnRC:hia8cf9OozTgGwwmn9qHopnRC

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Skype for Business 2016.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Skype for Business 2016.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.67 KB
MD5	3107d9181bce0d23c36117258607fbe3
SHA1	11737e1e6bdad53c376315e74c9753b5159e86ca
SHA256	3af5e04c6a3e6d015735b056c6f7609e9a1e420ce0b3e2ed0fc7392a27799f68
SSDeep	48:mWgPkOLWuiKISi2vfb/EAP1t4dn2nJFWi9qrXKdB+hzREklzukGbkercQIc:mkcqXAThb4lPrWB+RdBGofQIc

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Word 2016.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Word 2016.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.67 KB
MD5	821c55f083e11c7a940f4dc412bfb752
SHA1	95ad70f5584b4c3019ae204d60d0f4f6abd9d84e
SHA256	f17773b738f1266ecd884842988c994558af32112be03486db77e47933c0db43
SSDeep	48:j6REZ33TakD/mXqqKPSF5fN1ZrkwXGjWxszH1bWW2YJK0:OEFjaym6qmSFf1VkqkWmyGD

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\NotificationUxBroker.010.etl.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\NotificationUxBroker.010.etl.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	8.28 KB
MD5	6c2de741ca066263ede2a4363202f60d
SHA1	85e94d22813dc9fc5ce83d0f3d7029245a2bcb29
SHA256	752741fb494e5bcdd694b3d65589c7d977ab86486873c5c62c00ca452fb3f338
SSDeep	192:C1tpVy7k/pJIFZR6zBETzIWFcqCaoYy16xG1uyeWvi5p:Sfy7kjiIBE/nFcP8yQExe/H

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows Media Player.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows Media Player.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.81 KB
MD5	0cdd5955409bb8a08e99b272c9b196d4
SHA1	b5697e31f0987e08ca0858f6177bd05b212727c5
SHA256	7292b1fa6bc0c78ed2aaf69d68966958fab51478bef059dff37ca563ca55bb6a
SSDeep	48:ztnuRp6g6eP/M4lijS9YVvxhvHw05KerUY10dwSisD:BuR1vEyMP/L02UY1/VsD

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Steps Recorder.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Steps Recorder.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.35 KB
MD5	53ee6604bc60b19b4ac26753d776cf29
SHA1	d3b3053465637ce62f313ecd62b7c938347a1786
SHA256	2b2e2e4bf9378f463a4a74ba3df78fc314fdf44b2c8b8b8aca94848e2a395dac
SSDeep	24:3IXA+8D5AxEz6LWXJG7TLzDps9Ser1Tw65rsI+jKV2XENeli5:4X3uAEyTLzDpuS0b5RRVxL

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\dfrgui.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\dfrgui.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.41 KB
MD5	00d6032622dabc1634978798361e4ed3
SHA1	11233e8a736610f7680a3b5fa9746656bc86261a
SHA256	bf93f3b5c8dd724be4a381b9ec92f077b9403d22bf59b44cbd5ca648082d8b77
SSDeep	24:F0td8CAq0rUpTNoKV+/w+R8Ggl9ucyoqbPHSYh+xUaqsMSEvWdINlugB5+WmVDg:F0dNfpHy8GgucDq7yY3ptViIUNV0

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\desktop.ini.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\desktop.ini.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	2.81 KB
MD5	f7937f52b0a443a47d62db960226972f
SHA1	5d8006efb5e7692da45a22a1ca243893391ef186
SHA256	54c79688078e9bfe879a08a35a3ed1c69115deaae27a092f468a238a7f57b257
SSDeep	48:G0h7Qxxtx3UOii4VSSOLm5riJYJrSuGXzqGXuYn+fFuavYh3Hl5AfyAeYL+h:G0sxtKa4VSSYm5iYtFuzHXuU+9HvYh3J

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\services.lnk.RYK

Modified File

Stream

Not Queried

»

Also Known As	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\services.lnk.RYK (Dropped File)
Mime Type	application/octet-stream
File Size	1.41 KB
MD5	b89bcd8696368919c5df661c0c6a8591
SHA1	b894890508984e4d9037cd14260fec448c7120d9
SHA256	242825bf72fa227adeae0f8407a5510d7999cedfacd3f3f1f492df134cd50a93
SSDeep	24:u5Exls/N1Khw8kNq6Iveg9Dn4Pqc4UwZgrtkG8RUyf91OzbhgR0IhO+Ru8J7mNOT:XHIrKmrNcTpnf/Uwm+Dy098JolRlLZtj

c:\programdata\microsoft\crypto\rsa\machinekeys\08e575673cce10c72090304839888e02_33d770d0-06bc-47c5-8714-222cdac43a71

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.05 KB
MD5	93a5aadeec082ffc1bca5aa27af70f52
SHA1	47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256	a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SSDeep	3:/lE7L6N:+L6N

39ac1a828602e9dbc4dbf0ba68a4a570d85e9bf6b5ed1f3ed4a5370778a7ca7d

Downloaded File

Stream

Not Queried

»

Parent File	analysis.pcap
Mime Type	application/octet-stream
File Size	1.47 KB
MD5	5fbed1b24c448641ea020e400fc02df8
SHA1	09490f18ddf74c78d38a8ab2d426c3cbb06e75bb
SHA256	39ac1a828602e9dbc4dbf0ba68a4a570d85e9bf6b5ed1f3ed4a5370778a7ca7d
SSDeep	24:WG/mS+sORBsN8+DPtxnsDuUCG7yQj01oAho/0p6ruXfxBcxtBehU:WG/rSR0Z7/nsaUDj0No/0IujQP

49a39c4522da2873995ef6fa737fc071ae84f07ee7b506a7c1aa21ad53d0017b

Downloaded File

Unknown

Not Queried

»

Parent File	analysis.pcap
Mime Type	application/vnd.ms-cab-compressed
File Size	6.38 KB
MD5	1d58cfa769ed4a8a240be2a6d60457fa
SHA1	e60da9950c27d9b7e0a987e5ff96badfd819221e
SHA256	49a39c4522da2873995ef6fa737fc071ae84f07ee7b506a7c1aa21ad53d0017b
SSDeep	96:X5xIEktBYkem16ggBJxiVUTf+DHJwIxnDxPWv3hY3j36xREb9poDJ7CaIGso:JGikem0gvVU4JbxDyajKve9pQJ7C+so

5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61

Downloaded File

Text

Not Queried

»

Parent File	analysis.pcap
Mime Type	text/plain
File Size	0.02 KB
MD5	04c3fc4a88588ee47d33d066920ac410
SHA1	c49d3bb4c93b31e2ce67fa23e93464adf902e9d9
SHA256	5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61
SSDeep	3:RGXKRjmKLLtLzRn:zBLLBzRn

ebf3e7290b8fd1e5509caa69335251f22b61baf3f9ff87b4e8544f3c1fea279d

Downloaded File

Unknown

Not Queried

»

Parent File	analysis.pcap
Mime Type	application/vnd.ms-cab-compressed
File Size	7.61 KB
MD5	fb60e1afe48764e6bf78719c07813d32
SHA1	a1dc74ef8495c9a1489dd937659b5c2875027e16
SHA256	ebf3e7290b8fd1e5509caa69335251f22b61baf3f9ff87b4e8544f3c1fea279d
SSDeep	192:CPTIWKvNnUBBBL05O/b0evl2G6AXK+KMlYX82:CbevNUBDLlz0eN2dAXlKH

Remarks (2/2)

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After