33352a38...3d0e

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qEjdLfskd47NI5BG.exe

Sample File

Binary

Malicious

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	160.50 KB
MD5	d8fd19fef4605b4217cb2546c470a918
SHA1	79786955d426945054e6d02050b8f9ada01e39ef
SHA256	33352a38454cfc247bc7465bf177f5f97d7fd0bd220103d4422c8ec45b4d3d0e
SSDeep	3072:WRDVJnsys6q6q7U9jVse9yuqO3acuKk+huzeVgjedzFgX4t3YbSdV:4DVJsysPbIvse9vqM7uZEuzeuX4kSdV
ImpHash	3dfd6c1844e4962d112479d58d5da410

PE Information

»

Image Base	0x400000
Entry Point	0x40a2a1
Size Of Code	0x16000
Size Of Initialized Data	0x12a00
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2020-11-12 21:20:50+00:00

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x15e55	0x16000	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.64
.rdata	0x417000	0xf704	0xf800	0x16400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.58
.data	0x427000	0x1790	0xc00	0x25c00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	3.84
.rsrc	0x429000	0x1e0	0x200	0x26800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.72
.reloc	0x42a000	0x1714	0x1800	0x26a00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.43

Imports (6)

»

NETAPI32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
NetShareEnum	0x0	0x4171bc	0x25e90	0x25290	0xde
NetApiBufferFree	0x0	0x4171c0	0x25e94	0x25294	0x51

IPHLPAPI.DLL (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetIpNetTable	0x0	0x417030	0x25d04	0x25104	0x69

MPR.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WNetCloseEnum	0x0	0x4171ac	0x25e80	0x25280	0x19
WNetEnumResourceW	0x0	0x4171b0	0x25e84	0x25284	0x25
WNetOpenEnumW	0x0	0x4171b4	0x25e88	0x25288	0x46

KERNEL32.dll (92)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
FindFirstFileW	0x0	0x417038	0x25d0c	0x2510c	0x182
FindNextFileW	0x0	0x41703c	0x25d10	0x25110	0x18e
GetCurrentProcess	0x0	0x417040	0x25d14	0x25114	0x219
lstrlenW	0x0	0x417044	0x25d18	0x25118	0x63e
WriteFile	0x0	0x417048	0x25d1c	0x2511c	0x614
FindClose	0x0	0x41704c	0x25d20	0x25120	0x177
CreateFileW	0x0	0x417050	0x25d24	0x25124	0xcd
SetFileAttributesW	0x0	0x417054	0x25d28	0x25128	0x51e
Sleep	0x0	0x417058	0x25d2c	0x2512c	0x57f
GlobalAlloc	0x0	0x41705c	0x25d30	0x25130	0x32f
GlobalFree	0x0	0x417060	0x25d34	0x25134	0x336
CloseHandle	0x0	0x417064	0x25d38	0x25138	0x88
CreateThread	0x0	0x417068	0x25d3c	0x2513c	0xf5
ReadFile	0x0	0x41706c	0x25d40	0x25140	0x474
GetFileSizeEx	0x0	0x417070	0x25d44	0x25144	0x24e
FindFirstVolumeW	0x0	0x417074	0x25d48	0x25148	0x188
EnterCriticalSection	0x0	0x417078	0x25d4c	0x2514c	0x133
TerminateProcess	0x0	0x41707c	0x25d50	0x25150	0x58e
GetModuleFileNameW	0x0	0x417080	0x25d54	0x25154	0x276
LeaveCriticalSection	0x0	0x417084	0x25d58	0x25158	0x3c0
InitializeCriticalSection	0x0	0x417088	0x25d5c	0x2515c	0x360
WaitForSingleObject	0x0	0x41708c	0x25d60	0x25160	0x5d9
GetEnvironmentStringsW	0x0	0x417090	0x25d64	0x25164	0x239
GetLogicalDriveStringsW	0x0	0x417094	0x25d68	0x25168	0x269
GetLastError	0x0	0x417098	0x25d6c	0x2516c	0x263
SetEvent	0x0	0x41709c	0x25d70	0x25170	0x517
GetDiskFreeSpaceExW	0x0	0x4170a0	0x25d74	0x25174	0x22a
K32EnumProcesses	0x0	0x4170a4	0x25d78	0x25178	0x39c
SetFilePointerEx	0x0	0x4170a8	0x25d7c	0x2517c	0x524
MoveFileExW	0x0	0x4170ac	0x25d80	0x25180	0x3eb
ExitProcess	0x0	0x4170b0	0x25d84	0x25184	0x160
GetVolumePathNamesForVolumeNameW	0x0	0x4170b4	0x25d88	0x25188	0x326
CreateEventA	0x0	0x4170b8	0x25d8c	0x2518c	0xbe
FindNextVolumeW	0x0	0x4170bc	0x25d90	0x25190	0x193
lstrcmpiW	0x0	0x4170c0	0x25d94	0x25194	0x635
GetTickCount	0x0	0x4170c4	0x25d98	0x25198	0x309
GetDriveTypeW	0x0	0x4170c8	0x25d9c	0x2519c	0x231
DeleteCriticalSection	0x0	0x4170cc	0x25da0	0x251a0	0x112
QueryPerformanceCounter	0x0	0x4170d0	0x25da4	0x251a4	0x44e
WideCharToMultiByte	0x0	0x4170d4	0x25da8	0x251a8	0x600
MultiByteToWideChar	0x0	0x4170d8	0x25dac	0x251ac	0x3f2
GetCommandLineW	0x0	0x4170dc	0x25db0	0x251b0	0x1d9
GetCommandLineA	0x0	0x4170e0	0x25db4	0x251b4	0x1d8
GetProcessHeap	0x0	0x4170e4	0x25db8	0x251b8	0x2b6
OpenProcess	0x0	0x4170e8	0x25dbc	0x251bc	0x40e
FreeEnvironmentStringsW	0x0	0x4170ec	0x25dc0	0x251c0	0x1ac
DecodePointer	0x0	0x4170f0	0x25dc4	0x251c4	0x10b
SetStdHandle	0x0	0x4170f4	0x25dc8	0x251c8	0x54c
GetStringTypeW	0x0	0x4170f8	0x25dcc	0x251cc	0x2d9
FlushFileBuffers	0x0	0x4170fc	0x25dd0	0x251d0	0x1a1
HeapSize	0x0	0x417100	0x25dd4	0x251d4	0x350
WriteConsoleW	0x0	0x417104	0x25dd8	0x251d8	0x613
K32GetProcessImageFileNameW	0x0	0x417108	0x25ddc	0x251dc	0x3aa
InitializeCriticalSectionAndSpinCount	0x0	0x41710c	0x25de0	0x251e0	0x361
ResetEvent	0x0	0x417110	0x25de4	0x251e4	0x4c7
WaitForSingleObjectEx	0x0	0x417114	0x25de8	0x251e8	0x5da
CreateEventW	0x0	0x417118	0x25dec	0x251ec	0xc1
GetModuleHandleW	0x0	0x41711c	0x25df0	0x251f0	0x27a
GetProcAddress	0x0	0x417120	0x25df4	0x251f4	0x2b0
UnhandledExceptionFilter	0x0	0x417124	0x25df8	0x251f8	0x5af
SetUnhandledExceptionFilter	0x0	0x417128	0x25dfc	0x251fc	0x56f
IsProcessorFeaturePresent	0x0	0x41712c	0x25e00	0x25200	0x388
IsDebuggerPresent	0x0	0x417130	0x25e04	0x25204	0x381
GetStartupInfoW	0x0	0x417134	0x25e08	0x25208	0x2d2
GetCurrentProcessId	0x0	0x417138	0x25e0c	0x2520c	0x21a
GetCurrentThreadId	0x0	0x41713c	0x25e10	0x25210	0x21e
GetSystemTimeAsFileTime	0x0	0x417140	0x25e14	0x25214	0x2eb
InitializeSListHead	0x0	0x417144	0x25e18	0x25218	0x365
RtlUnwind	0x0	0x417148	0x25e1c	0x2521c	0x4d4
RaiseException	0x0	0x41714c	0x25e20	0x25220	0x463
SetLastError	0x0	0x417150	0x25e24	0x25224	0x533
EncodePointer	0x0	0x417154	0x25e28	0x25228	0x12f
TlsAlloc	0x0	0x417158	0x25e2c	0x2522c	0x5a0
TlsGetValue	0x0	0x41715c	0x25e30	0x25230	0x5a2
TlsSetValue	0x0	0x417160	0x25e34	0x25234	0x5a3
TlsFree	0x0	0x417164	0x25e38	0x25238	0x5a1
FreeLibrary	0x0	0x417168	0x25e3c	0x2523c	0x1ad
LoadLibraryExW	0x0	0x41716c	0x25e40	0x25240	0x3c6
GetModuleHandleExW	0x0	0x417170	0x25e44	0x25244	0x279
GetStdHandle	0x0	0x417174	0x25e48	0x25248	0x2d4
HeapFree	0x0	0x417178	0x25e4c	0x2524c	0x34b
HeapAlloc	0x0	0x41717c	0x25e50	0x25250	0x347
GetFileType	0x0	0x417180	0x25e54	0x25254	0x250
LCMapStringW	0x0	0x417184	0x25e58	0x25258	0x3b4
HeapReAlloc	0x0	0x417188	0x25e5c	0x2525c	0x34e
GetConsoleMode	0x0	0x41718c	0x25e60	0x25260	0x1fe
GetConsoleOutputCP	0x0	0x417190	0x25e64	0x25264	0x202
FindFirstFileExW	0x0	0x417194	0x25e68	0x25268	0x17d
IsValidCodePage	0x0	0x417198	0x25e6c	0x2526c	0x38e
GetACP	0x0	0x41719c	0x25e70	0x25270	0x1b4
GetOEMCP	0x0	0x4171a0	0x25e74	0x25274	0x299
GetCPInfo	0x0	0x4171a4	0x25e78	0x25278	0x1c3

USER32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetKeyboardLayoutList	0x0	0x4171c8	0x25e9c	0x2529c	0x168
wsprintfW	0x0	0x4171cc	0x25ea0	0x252a0	0x3e1

ADVAPI32.dll (11)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
LookupPrivilegeValueA	0x0	0x417000	0x25cd4	0x250d4	0x1ae
CryptAcquireContextW	0x0	0x417004	0x25cd8	0x250d8	0xc2
CryptGenRandom	0x0	0x417008	0x25cdc	0x250dc	0xd2
CryptReleaseContext	0x0	0x41700c	0x25ce0	0x250e0	0xdc
AdjustTokenPrivileges	0x0	0x417010	0x25ce4	0x250e4	0x1f
CloseServiceHandle	0x0	0x417014	0x25ce8	0x250e8	0x65
OpenSCManagerW	0x0	0x417018	0x25cec	0x250ec	0x217
ControlService	0x0	0x41701c	0x25cf0	0x250f0	0x6a
ChangeServiceConfigW	0x0	0x417020	0x25cf4	0x250f4	0x5d
OpenServiceW	0x0	0x417024	0x25cf8	0x250f8	0x219
QueryServiceStatusEx	0x0	0x417028	0x25cfc	0x250fc	0x251

Memory Dumps (2)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Point	AV	YARA	Actions
qejdlfskd47ni5bg.exe	1	0x00A30000	0x00A5BFFF	Relevant Image		32-bit	0x00A39C60			... Memory Dump Actions Go to Process Go to AV Match Download Dump
qejdlfskd47ni5bg.exe	1	0x00A30000	0x00A5BFFF	Final Dump		32-bit	-			... Memory Dump Actions Go to Process Download Dump

Local AV Matches (1)

»

Threat Name	Severity
DeepScan:Generic.Ransom.Cuba.4D0E95B0	Malicious

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT (Modified File)
Mime Type	application/octet-stream
File Size	3.50 KB
MD5	301dcc04b45003e9af1f2a7dd320f5c9
SHA1	372db6c3f49a9ba319f9fa440d92d0836ca68c36
SHA256	9981566e2d3aa46dcf6ae6b2b6a97dd246567e9a423155a48cd5077b59157f4e
SSDeep	96:7GZTOp7aKOOg1/c1N5dEuuzVE/i1DAAGZQn0:2TmpKc1NLtuzKsD+S0
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest (Modified File)
Mime Type	application/octet-stream
File Size	1.55 KB
MD5	f3487dfc3aac71817b2c626030a7b793
SHA1	25698c0647576ed777b13de816408bbc19b5cb8b
SHA256	91a07285da8a052812927259b6c5a1af3862245915fefebd82151454a2b1d0fe
SSDeep	24:7lNwjjo9+tZdWLI5ICntSQZKd65V5v59VJhSY:7lOjjoBLI544KU5V5v59XoY
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	173.18 KB
MD5	75661f2e7209da3c760303cb86443a49
SHA1	eb89ecb2362569efb9f5420f441e6d7c353d23bb
SHA256	623bbd863de75c98e7258587852c6782ec710d4af82a1452331b0be1f05130fe
SSDeep	3072:bnHOyUI7no9uZDoQEx1sCgiCYcBgjPFa0Y6f+5rQtqhoLTKlg/cl:bnHOLEo9u1CZh4gjjJ+1KqualWcl
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	8.48 KB
MD5	72e43b81d327b11a89707da6095a7647
SHA1	8ed3191a88417d84b1d173a4f6a6a88df0db18b8
SHA256	73e1df9f7e4ae49f1ead0b1acdc2a2e55d589e2c685d3fb4b92bfc79de816e7e
SSDeep	96:7g3LYT3nkWiZWSZLNoHEjjkPy5YfhY+vZLHsQ3fmsQyVgMiEYXzl0/WhvQZLu2hY:e8TByWSDr82KuyVyX0+WHad6LRIRScb
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	317.34 KB
MD5	776120e0a29d41648acbcbdff5e09f21
SHA1	c602db0c510c0826fc1a281fe7aab7aa51d767e0
SHA256	6affedf9224f56dca6392c86a86d0ca2af61b6a6e13251bf21627af2f3df2a19
SSDeep	6144:Ziu8a4vYXGMwMCZqMRyL5yWkWKu9CM6jbsuauTbukk2ZImOvz8BHNTdwngsUn7Ci:4a4AXGPzqMoL5159CM68uaG9zO0TdNDr
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT (Modified File)
Mime Type	application/octet-stream
File Size	696.89 KB
MD5	18f3c4f88f78a5ca275e4707ef26f108
SHA1	b7d40bad5b24897f040bc6d20152cfc675cab9ea
SHA256	bf2d3cd47ffff22b83c86f1c3050b6b4238e3abf1b4bfb07c4185e7fef5632cf
SSDeep	12288:YGfxyqUOeTfDx56Vc17y0xukschUNfJ/dgkWndUffTJb1P9+JUSist+cv91EY:YSyDOeTN56VslM0KNh/t6UffT39MiO+a
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT (Modified File)
Mime Type	application/octet-stream
File Size	313.88 KB
MD5	fe1e0ce44b0c1b8195014a4458001117
SHA1	b4dec9966e824ecf4d92b765dc424bcdfb7498b6
SHA256	c0d7b7fac1f4de7a687f51ea194735aeb4c55e62ef033d19148989155e0f3fc8
SSDeep	6144:E8xzoWI1OHA39EDjCBtUXz/VbEiU5fqMnvoG4dDywHOvWma8Wc6o:de0Ha9yjCLUD/dIiMgtWCMWP3c6o
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT (Modified File)
Mime Type	application/octet-stream
File Size	236.38 KB
MD5	a7b7f7be46ddc62c248590693a22f39e
SHA1	c2938ea6aa068c64787d0b6040500cef2c41a004
SHA256	37bf3bdb5075cb99c70f9535d9da748ff1e57aedddd4a5517ed331cc1f40b016
SSDeep	6144:tQ4uX0nTcwakMvgHdg027TwwOTowpHb1ABpjS:+0nwwakMeG7fOTPph+I
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.04 KB
MD5	43d4aae5a530c1dcbf00f712fb8b23fa
SHA1	ac83097300d2483c4d63e07f24d361dfef9a6c73
SHA256	02d7cbe664c81d5931bb10af9ca8380d0f5b5d503b1941fc372c119716ef5436
SSDeep	48:7l0s9MEP+C8pDxyNG8LPtOmX7ef0O0OSZc0fd:789DiztnWgcu
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.04 KB
MD5	4165962ff6b8a73a781db772491e25b3
SHA1	9a01a1a7f5265b03ec9887e020ed81b4bdfdf388
SHA256	dc29fd8c2d922650c518e81c45a4f23c17982b57c6cb8096604e7a0fe3bacadb
SSDeep	48:7lzxpnHQ1p163ilCfors8+7iwR8dWr24pLXhtWH:7hx5HiX6y+j17iwBrh0H
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.64 KB
MD5	848f8c65b8d13d31d905d7ca5eca851f
SHA1	2efd984c4320425686451100051b2764f217a9ee
SHA256	56fd4b8fa192c23074bf4f878202ef0ac4e533907a305426940ace83ebb217c3
SSDeep	48:7lAhnA08G+jFzJQ9PW+ljAOW0JDGosEIFRbPwfoYinlEc71XsBIPDE1FmKVZz6bf:7uhnEG8FzJaW+iOTDGoPIFNXplEcaIPd
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG (Modified File)
Mime Type	application/octet-stream
File Size	2.35 KB
MD5	7bbed03de3519156f5661a92fbea22af
SHA1	083e556a400e0e30c46b2eb4ae43439106850b16
SHA256	fa3f0b1b5522f6d5722f5e0aa601e295ec7d902c8913689bbb47ffeb6c975d98
SSDeep	48:7lot2MB421Qc1viJVveD4YeGpSz6mqc3j:7iZB42et1ecYeGp66ej
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT (Modified File)
Mime Type	application/octet-stream
File Size	72.37 KB
MD5	2a4d3337ab4737d45f0aa0f4db4e5171
SHA1	2caa9cc7620f1d27f6ee590c1271266191edd0a9
SHA256	65b5bb19debefef4e05b636b2a352b924e35faa684e119c61f356ff51058fa93
SSDeep	1536:4Hb5ROHXYoKtAFuC6ZUMgV0fv5c5mss5//WVFa4:4dROHXYox0CXMgov5v55/O/
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	55.38 KB
MD5	29214bc8c5827edc3bf61065de106df9
SHA1	a76d18de09f2b78cc3b447aef27453e4eaee54cc
SHA256	c337f58de1d32085bf1b86b95e8eb1c7f6f2770c9435be2814d7a326112ad5c4
SSDeep	1536:dUUj82JMJ6Dnwq6VvJ1pTO8QxKZLCBNEVuOuo:f82JYW16Vx1cDvNoV
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.33 MB
MD5	9f25d21c267736154f046f31aa2f16ed
SHA1	4f0504965a1ea462a33a6a45edb36b14bb04ada2
SHA256	8541c8bfa32385d00f8d82b0cc07c1198711b33e4312e8fe95ddf7c404a82d0c
SSDeep	24576:Av6nNrCUlClLlX3/AeOumu/81x/8B4rl+S1nwHMqOXfo0/I:TNmZLlXIJL/wElTwH8fX/I
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM

Modified File

Text

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.cuba (Dropped File)
Mime Type	text/html
File Size	2.90 KB
MD5	c718ac3f6823a68ffb8f489209b67d45
SHA1	bbe029c5edf1e31eeb75369a6236b93ad0140f5f
SHA256	a2d9c28e91ccb0bb114ef2e106695921656227ead766562b3315336f499cbedf
SSDeep	48:7lOvn73pRDhDdDJc4V63vx8wcNFd1lq24n1DK/3XyUd8n5rQZ53D0:7QpRpFJG3vGwMvLXQ1maUQ183D0
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\MUAUTH.CAB

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\MUAUTH.CAB.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	7.59 KB
MD5	f09f770246e08bf76d2f44368e36a8bb
SHA1	38bdefd10f486a4a1a1848b56ae1cc8b177353ec
SHA256	b78c04be4a800d74a203e100c171821b8ab3a3c83e3f5dec3348faff09f1f89a
SSDeep	192:GzWw27WQz8NemP4pM8MX6aCN2raAcUoMrI5np2Y:GawENYemYACNqoMrI5npP
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML (Modified File)
Mime Type	application/octet-stream
File Size	2.32 KB
MD5	1706bfbf9e01b7757e005de1d5b27d83
SHA1	fa1e04ab9d754f4a32061b40924ef1da0a2de0d0
SHA256	247278721d96b6229596a42fdee7c10ca3d404b196c5c41a95c5d941496880e8
SSDeep	24:7ltwmQepppNv7QV3fYimWp6rVAvhMR6lRqgO9XpxkI3i9EKMbwzOeAcn65iOEmM2:7lDQeNxk9wWWuvGPZFYVMbwfn65ANi
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	3.56 KB
MD5	2c0990df51e89779ac68c7f620004bbe
SHA1	cbf2de0c7b8f92c0dd9dd81f722143d16d65b7a8
SHA256	1075bbe66633b52b4673397853d643bba5b0bf0e677592316c11dc2ff3de8894
SSDeep	96:7joDWtqM5o/vvsFYbbZ1fPZX7lLDkXE4z2pb/:IDh/vvsFY/ZNZX7BkEVr
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.53 KB
MD5	85423c3e245783ffe44bf7ada4ec2693
SHA1	39973fddf0f478b333d0a9d8179d9121693d8cb9
SHA256	7f8100cfc85d2c001ec557f9c3a512366b187d8764dc3333721db2621328df6a
SSDeep	48:7lU2SNdAejHeRbfKY604Wme8/jqKIW8J2tAaw+C/ASE9hHcl+K:7UzAej+pE04WJ87qKiJQAn+C/tLR
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML (Modified File)
Mime Type	application/octet-stream
File Size	1.89 KB
MD5	aed16659901f853bcb0ff5fab6748b8e
SHA1	5c14d521cc9db486c4f6837844e7882cf3ac937f
SHA256	c8a84af1c56da741afde9633b8b9dd3c624f26ba33af50dd82199c4a2eb63632
SSDeep	24:7ldq0d/EHP1GF6z4MZJ5YQuPlBpkKNhhecYm1K+LDk/9KY1YEtMP+h1w8L:7lV/Eggz4ailBpkK8T+LDkkyYHwms
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.42 KB
MD5	18c436e5191515e99a51f86030dd5a0c
SHA1	8902aad473b155374d33c727ae82165dcf017664
SHA256	5fb486df2b69000fd0f435881329861685c8189ea79dd058e5a76b817026fdbb
SSDeep	24:7lSqKNN5UPi4A+n5VPz0I15VRu+OAJBWh1HMeuY0g1hJOAXvKqCf7xKcCLqATzRT:7lSJg7pH1REkUvMeX0g1hJNcVhCecx
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML (Modified File)
Mime Type	application/octet-stream
File Size	2.20 KB
MD5	2f6adb97ae4185632f2ac93a241e83ce
SHA1	d1de48f5643f4a064688071ec03b962c46d45d59
SHA256	45ca5be434e3011eebf389925c5c98c86c625c303865385c64cfdee530863931
SSDeep	48:7lbTKXVYJ/xerIOk9agVfcFEpAAPyQ24EvWhjpvdb0BopO+:7JTKuxer8agVnaAP0Gbb02l
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML (Modified File)
Mime Type	application/octet-stream
File Size	583.36 KB
MD5	d26ac1ee9735e9f63058dd7004033f2b
SHA1	d9741cc3feafdc9a4fa9d73bb0ef8a0f4e791a2d
SHA256	0881bcee583d1c775f4741ba84a525bf9b7a207d5425d473b10fdcc6bf75dbca
SSDeep	12288:047ZUEoorCBLHJs7nzOGRvFu/G6WF5XQqapvYldrZzox:022k8J0DFu/D45KvYrax
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM (Modified File)
Mime Type	application/octet-stream
File Size	70.57 KB
MD5	59837e80130673457f43dbdfaffb215c
SHA1	195fc3620c902deeda536f8d7f61e3891cd1d6a1
SHA256	5e47129bf69bc37f14495f9c32a01ef4c8bcb50835a298cdceb26b53ab4fc9bb
SSDeep	1536:NvYNq8m3fMuOR/03lZMbRxXFXi4TWyFU4C5DtsptMbO712aRjqkMn/:mKfMuW1Xi4TWyF8KpZDpUn/
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML (Modified File)
Mime Type	application/octet-stream
File Size	6.43 KB
MD5	0c73c5a7adf2839af5442056ebc9b23b
SHA1	77576557a3539f25fc2a531340550d2891d4b605
SHA256	774a280617f13fd4cc5d4356c6ea5460e0608a861a9ab4aad338ea87c532274b
SSDeep	96:7HQVhU5yr8YAJ0DiAqgNykWUFHr6pD5dBkqrcd4OrCTSUIejk1iiiiPiFb7Z8M:J5yr+eFqin7V6p7BTqun1j2NPAb7t
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.80 KB
MD5	fb1a4a480da6bdf418713dcf43595aba
SHA1	95f5701376b74948b45f8f2b82ce307b452ae205
SHA256	6ed76ea64cf49706afd1f5660298f52dea00f681f2d4981e55e0fb76e52058b4
SSDeep	24:7l+L0ZjCNIl5ViFqRCYS96nJKw60/GvnvYrnBpTrjL+GEWZM34dJ2/J:7l+LE+NJq44JKw+vnvSnBpjDPZMy2/J
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	37.81 KB
MD5	4fe7a2a397da89ea6da74705cd5a7b72
SHA1	8db8db41eba834ffc2058848e949f4d519b8bf59
SHA256	7e1fdd9039c50ab9e03496a3fd83f794cf4ec7b21acbf002276eeb6cfc151828
SSDeep	768:aillxdWfxVmBVAbGvOmFcvqazgbblaBrASeADvooT17qkdTo7EeXXHkm1F:ZxExVmBVA1vq/bwrjeAMoTVlorXXkm1F
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	27.30 KB
MD5	dfd10ef88c22721301877aa6e7e8de3f
SHA1	ac8d42c76b339b10688ad7c73ea57171ae46817c
SHA256	b566d3a5bfd91f974f79a04070ff4ef60ff957d87750e5d16a2de2b597e94c74
SSDeep	768:W1BPnW9LTkvaBbjMuljNKy807Mdh/F7C4x:W//WXbwuIL/F7jx
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM (Modified File)
Mime Type	application/octet-stream
File Size	66.62 KB
MD5	4789d8ce5d25e87ad8ade192e6b4302f
SHA1	c9ac70f82502dec2165869b5eed18405eb680b03
SHA256	d07910c6ab70af2165055a198d813ec2ce72bfa4bad5ff883fb3e1a58fa72c02
SSDeep	1536:ENwI8yeNUiNKe4BkC4cqux8MQKj9H3URQJlla4D+g6qgM:ENL89NUiNKenvu+MtjREKxr+g6NM
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	10.13 KB
MD5	87df9469227668eef875316e2bee44a4
SHA1	77b22e318368d1117d3a9dbda8e330da4fb09208
SHA256	458058b37980e0f47afe53617e1552960855e4be600b9231ab35537ab0bde54a
SSDeep	192:QcEKYIGddNpPwu8BDUS08zOZIpyADwVZeHhODlAt1ElIvtXRb:QcEsGTjoND30TZJADweMD+1T5Rb
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML (Modified File)
Mime Type	application/octet-stream
File Size	2.35 KB
MD5	35beac76a8d05c99bb8bfc8f37933f68
SHA1	f7981f8f28c4db2d96c8b2f9e6ee927959c14f9a
SHA256	660e53c05f428c4c392673a6e552a799b1c4162c78f46694c1e0de00ec16bcf5
SSDeep	48:7lzthhvrWd0jFoPCJFA4itcYaKeMok2oFb98qOFvW6lFnf1Nk25pa:71tvrhdJGVtcZLMok2GB8qOBd1Nk6pa
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML (Modified File)
Mime Type	application/octet-stream
File Size	3.31 KB
MD5	6b8685712f6a888db73c45b04f4e90cc
SHA1	18227de998852664418fbbd5212bf35e1fc9a5b8
SHA256	a42cde0e337f21cdf5daaa9eac074fa8b096fd2436409012cb56aa4339781071
SSDeep	48:7lNLCyGGwa5NVG0NXGgio7pNBk0O4enzWkAifW29AUqwjgD/eFJEDUx3IrpCyT:7nLCqwa5HMG7JkqafvPqFewIC
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML (Modified File)
Mime Type	application/octet-stream
File Size	4.11 KB
MD5	fc46e5f746c80e55a085a0a77ad4700b
SHA1	e1b03d54a1ac1290937328838550c8ec8f4cfbe6
SHA256	fa963dbd562e52b257b16f23b4e23de4c7c51f20c96fcc194981fbe276ae4c45
SSDeep	96:77qW1ySe2nzmuDtaR74oTGSPc70Sa/CEzVwrGWiuJmOc:qWXzmuDS42U70S0VwrBiu8H
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	7.27 KB
MD5	554f8002b566cd27f1193505f716a0e1
SHA1	9894cfc2b84d6e566b26e7069e8a727996e585b8
SHA256	33d3d8d66a823da2f00c551657a1364aa9689c2191f6d8863b845acf66e9dc66
SSDeep	192:2tMb0guxM3C1RwY4N1YbZuMu04ETuXl3QE/Fd7:2cExkC1RwY4NYqETuZ1Fd7
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML (Modified File)
Mime Type	application/octet-stream
File Size	2.42 KB
MD5	d87ec82fc26095e748f64ee0025f9aa5
SHA1	1bcbd207759b400b98c77dd7526696123dc0729d
SHA256	c1b43989704e4b9b1c680a9245bf5630173569e35fd49a6ddff0f3645d0af519
SSDeep	48:7lrsj7mMnxtFmN9KgseOd6COqv9660fCFq+M8g5OxCIoduQ:7VU73nxzabs9POqF6sF+5OxVquQ
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.32 KB
MD5	70c597c45d849076746dc98c268b5406
SHA1	ccd5f2254703a3372e3a337f097c86a39ef607fe
SHA256	4bc6dd8a7399914e67c88500ca9db823418f546e48ff575f14594aaf71c3a28a
SSDeep	48:7lqOD3J6tgbjo20yCm2rUShuxklyBwQ+/lYGc:7d3JZxCexkG+Nq
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML (Modified File)
Mime Type	application/octet-stream
File Size	2.42 KB
MD5	050716ee4e92c3cb51ce03462cbd0ade
SHA1	7fe5c45b39c501429278f04367b3440cd93c4059
SHA256	227ebdb1f534c0df0018bfacbd30a6287a65eb1745b12e2800c24f056be17d0d
SSDeep	48:7lkoIOm48+tXcbnuumS6I9CiC6tLXDv5exBXW+4oQV1XaCh:753oPmdI9Cifxj5asV1XFh
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.42 KB
MD5	8951417851d0df081c6dbbbf18ad91d8
SHA1	6bf83c5f371a0b6f16b309d85caafb5b2771af51
SHA256	263a1971857b6f9bb568644bacd6a5ef27c6bcba197c5a770c85d2950b2c322e
SSDeep	48:7lWFF+oinWYcOse6E/GzdPIrt3VI+B18PWHhBPUSrV:7EzenWhe65zdPYVzBCPWHQSrV
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.79 KB
MD5	6ba4d0345eabe4102dfafb81e48187fc
SHA1	0629261dabffc6424865d278119cad1f86c3869f
SHA256	b0de85fea6f35a9d0dc66d66b66e487bc6cbb94d4327a0b655be342823fb9c6a
SSDeep	24:7lazb6HoUylVP7yYHxnrbyhE43/D5WgfohF8w2QJf2Ep6Nn7pon76:7layoUyrRHx3e93/D/QFfJ6N7po76
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML (Modified File)
Mime Type	application/octet-stream
File Size	17.46 KB
MD5	abb37131b08ca5ab29fd48775e5e47db
SHA1	41ae90b663aaf20238dd9b821b0f76c2e962887b
SHA256	b330e82d675ac5143bc8942af9a6441498d9669ef93a2c2944086a8a9f909b13
SSDeep	384:B2u/p4JM//VIf5MDo8QKAY2gsKBEtvQQWrWmUP9PlTPG7hfwD:B2Yp4JMVIhzK4IEtvQQh91PGFf0
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	31.37 KB
MD5	12201189e91413aedd3833e4e9d0e3ed
SHA1	903c9455a3074a353a39e9766b75bfd83f9dfa27
SHA256	42acf30ed54d9f5471bed50b8f9ced351c120c73030dab0cba01b12ee9498efd
SSDeep	768:VTEvwpLcaUldbrA91yoz4kunnetwIb/QBfhZm1GqN+g:V4vSLsdbrA90oz4k0eCAUgwg
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML (Modified File)
Mime Type	application/octet-stream
File Size	2.42 KB
MD5	35f98f94a866c166f5a5070c918d3bba
SHA1	51deb49463bafd38a17b2bd50015bff0aee5d424
SHA256	acaf25b64212199b37570ccea8ff87a1814a41d6d51d02f3fd07182e6ae5ca31
SSDeep	48:7l8l/tNexvzZHqSAhkILnwWdz8ERQC9JKtD9gDc2U:7+b0xvFHhAaILnwCp9Juh2c2U
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.57 KB
MD5	5481dad60c73f9a80da7c408de2adca3
SHA1	c63c0897310b43edb93306278f74e19eef406793
SHA256	308f8db71cd12b18bde4e85af00624dd93e49254c1695fe7a413726e25c1cfda
SSDeep	48:7lSXLXDOdVcnXeEzz2hmIGR84eL5of6vvGltMpIS7:7aTIVcnOEjqJL5UzJe
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML (Modified File)
Mime Type	application/octet-stream
File Size	10.28 KB
MD5	afcaa70fb2b305601fbf8dec0a0b21d7
SHA1	972414b796cd357271c3396ac85f92391f901d81
SHA256	c583426fdac1db04fc973509c0e24e0ab6c10b6db16c0dd6975d738c8b462a8f
SSDeep	192:3OoR/gxG0eTnDvTZV5ITYwGHsY2R0Mcmj7g5rgJbb4vII:3Oo1gxsXzykz/2R0M1j7wNQI
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	21.09 KB
MD5	34c9b5f1ecc1d887ca134f0b380f1dfe
SHA1	59c7229524144674fa76dbfa155c033102aaebd9
SHA256	1cb73eef8aa28b973ef10ccf72140d27c1d1c0927eeaf2f8c553d444615a8db9
SSDeep	384:itwI4jFGqHkZ7SKlP2qHRXR8xVc17I+SK5vzhZYCmCvq14NGsPrDvTUI:MGjFwZ7SKlOWz8nI7Sc7haCmIPrDTt
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML (Modified File)
Mime Type	application/octet-stream
File Size	9.52 KB
MD5	4d8f669202d2040596f8ef09c04fbaed
SHA1	cf764d743c493f0b00ecc64606cd0cab14025605
SHA256	90fc6a060afa4131f986299ffcd5354f5c5e157804d3752a8785b81b282627fe
SSDeep	192:tc/fvumqv2koPUWHZqhAVLG9ogp1e8viyF8jYElm5NZWjQWFGESzcFZ:sf2BeX5zG9rdujrlm5LsFGfzkZ
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML (Modified File)
Mime Type	application/octet-stream
File Size	3.37 KB
MD5	a8116a924c1244fe8136cc5090dc06bd
SHA1	c94ad3a574332492ba7aac03ce769bd0a223d924
SHA256	a2820b2f65f1d15e752d78e70044e545e0c79d97b03c80e77034ad4bed9d6c87
SSDeep	48:7l/KF01YrDzYqmErFklodSWG7+/ktTUlBKoYpVZY5nDviCWhCyVeAjy9YV:7cq1o3klodSWn+UlwdG1+eSyG
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.76 KB
MD5	89bccc1df99d0e51b41efa7095c14dff
SHA1	ec13de6b9881b83347e6dd69e4f671268adf1e51
SHA256	fd2c1b4476837dfab80378922b9ec717527cecf40d251f236093630f5f1d50e5
SSDeep	48:7lf93OTbHeVEJnx6NfujO95mIfqGkJeh+KMrQMj58jpm806rMP0+Mk:7KOtf9titeQKs58jp7eJ
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	12.37 KB
MD5	1d6e12926dc4526a008faaedd35c8a6d
SHA1	36527d9b4424eeadc8222acfb611f7920563cb36
SHA256	c9eeb2013244803e635f4685d9c85deb0f8d5940b87d4d4fab61896b23faaabf
SSDeep	384:/VQxnr15gZjFQPv+l6U1nonHid6jOArhyJxWFZH2j:sRKjFI+l6PHiVQQJxWF5s
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF (Modified File)
Mime Type	application/octet-stream
File Size	47.59 KB
MD5	6c26b72ed6c5cd75ee8d802b5af4dbbd
SHA1	edfa498a5508428fde0579be3c9c75d542f90404
SHA256	84984407bb4adefa1b9df43aaebdb7f25d142c5544a2d886bc45722c39ff30cc
SSDeep	768:eiJgrpN8jFijLXQ4RbslO0H8MM9hgRnj4FheXyFLzu1BzvjUdGkF5quGovHb+fg+:eiyUjQLvX0cMMYRncFA6q1BzEtHXF/Gn
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_EN.LEX

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_EN.LEX.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	434.62 KB
MD5	3cbc96410724483945219e70ee301a6a
SHA1	c26383d93b438d92061e7a3cdb34c6b9eb068c6a
SHA256	e92676b6a79391400a322ff4601aaf9f0035d9b473a32b891c255954794c2eda
SSDeep	12288:WwcTKmKq7V9mHQMbOKMl3BjqSgCMd67s8mD:WtH7m3OKMHzLMdGs8c
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_ES.LEX.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_ES.LEX (Modified File)
Mime Type	application/octet-stream
File Size	387.38 KB
MD5	1a5b23b6101a2e383c96b94267bd28c0
SHA1	d1fe9274cf707b03c0e1ba4be959cd3b8e9034fe
SHA256	1132ee89e2f14243561655b9f25f11fa967a55e1d3653bdc1c46e606f4c66bc2
SSDeep	12288:rYG1Rn6kZAtRRrYYAMI9N83TXZgNYKKNVAi:rBT+tRRbW6TXSKNVD
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_FR.LEX

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_FR.LEX.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	289.73 KB
MD5	78f304278576ab1bfee5db3a85b2a4cc
SHA1	a171c95cdec6792713093320026406cbe946bac7
SHA256	1f303f2fc42c89cf2bbd6fa5d17b8e95ad5b23375c2fc6983813d78de471d44a
SSDeep	6144:PYW3mDeHMYJF1cSFlknrl9MFwkcLdHaatirMJeSkvU2ogwoU:Px3m0MUknrouh3JNd2dPU
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.cuba

Dropped File

Text

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM (Modified File)
Mime Type	text/html
File Size	12.19 KB
MD5	cd0e98ab7b94112dff968c0790900494
SHA1	ebe542f92df93619bd1ec1f484aaddc825a1ea83
SHA256	48084afd4a2d2dfeae8a27cb19dc9a4aff13d7ac159d5a62b70ecdc951c187df
SSDeep	192:IYW7KD0CzTuxSDa6qwbQflk3wn8E4FMkrfMFHZ+8E69LPyUrgh9RY:IYWsGxSDaiQS3wn85BMFHa8Pcj+
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	9.71 KB
MD5	c46c61af0a05fad9b2dd7e2b2528c822
SHA1	7e41a61c556efd528f2cfeae3998a299c93d36ad
SHA256	a891ffa669aeb950f6055d36e956261f0f32b6529f95235f70ee861df946d782
SSDeep	192:bc0HCtZi2szdKn0q8/mgr2vqpm0x8hsgpgSRq5h/tI4alM3cInmw:bnGqK78/mgr2SpmhsYNWFI4Sw
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML (Modified File)
Mime Type	application/octet-stream
File Size	2.80 KB
MD5	dce34b555cf91391259e490588ccf99f
SHA1	d6b590566cbe9137a31d8f28a6a0f4a1f989ebfb
SHA256	6443ceeb8e8082ac0b4b865567d0bf0d85eef250ef8687296b8d64cf37ff6418
SSDeep	48:7lWM2rd87f8K2DZ73VBL4ao2+on8SGuA+gyPnJ/cLnDV74Cj7Mg8:7Odg+plB8aoU9nJULnDV8n
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	39.10 KB
MD5	2df9f7c26287888e4693a172f894c13e
SHA1	34f37bf1091946ea011abf9843e755fbed41de0e
SHA256	1ac6a5be3c7e84c25138803054eeb93762453c70e809eb7845b2f442273e2201
SSDeep	768:MswrArGL6x8WhW9tCiRuHZY2ZhpeeZ0OUSKmo1HeThfM4vaKlQTBeSIpq1mX+JOZ:pwIGL6Rq+60Z0AoxiC7KiwSmFXes
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML (Modified File)
Mime Type	application/octet-stream
File Size	3.62 KB
MD5	5a0ff41e3fe06b0230b65e964a6dceff
SHA1	80e4c4a6e809b3834f23154a9d8be7ef17afbe6f
SHA256	3dd7ff1836b767091c0fce038fa5c14f9f3132d2267c75862589abe905c6b25f
SSDeep	48:7lmEeYOTITX+jk8RJYntUrjHUV9stOntE1puBQqSIlFuaakGpeFbrHyZCauQeKG4:7zh+j+aHUiOe1vqX+aakGpYHjam3lVcL
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	222.98 KB
MD5	d36d1d2568acda0fa9542b948baf3266
SHA1	fde8c1cd41fe50080d034508e31279d58535fffa
SHA256	421be3f8af45f5beb769b9719dc4fd35385379a51317d5069506494c9e7ada0f
SSDeep	6144:k4gWID+3777HvithGtROEJqf07LlEMlj+jUMG62KTcGqwq7MNcWC:jdn7HviubOEJ407Lhlj+QMGYTnqw8MNg
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\MSTAG.TLB

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\MSTAG.TLB.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	14.36 KB
MD5	1c504c89b504931bda1bbb797b805765
SHA1	1a14097988b6a92894d37f9308c819c8959abdcd
SHA256	d6abeb848fdc16a5edfc272e6656cc649c9514fe9ca63a71c71c61a8ab1a43bb
SSDeep	384:clwEmV2IbHwqbr5POVLZ8rZeEjx6zO7cgQ2riaCK:GvzIbHwXytzjx6zOpZj1
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\TextConv\Wks9Pxy.cnv.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\TextConv\Wks9Pxy.cnv (Modified File)
Mime Type	application/octet-stream
File Size	56.91 KB
MD5	7baa11d4a46103a51889deb054853529
SHA1	2a3fd256f012b4a5557378e7bb49cd61b574a5bb
SHA256	6581114f7fad3538de8b36aba9ea5128d8ce9c537a82b4a231c24cef7a62a556
SSDeep	1536:S+0jW5H6SGKAFHmMY+rzrq47m5S0smGM1fhMkl3WN9f:lVGJm52zdO26XMklG/f
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\TextConv\WPFT532.CNV.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\TextConv\WPFT532.CNV (Modified File)
Mime Type	application/octet-stream
File Size	193.36 KB
MD5	937afbab833e60013c723a0667c1e25b
SHA1	23661d2e234d4aabcefc3e3fa9d4cc74fde12c4f
SHA256	3309d52155e33886d4ecb2f8531327b8bf0f6a8d95a4d5c2f8421bee317f1ea3
SSDeep	6144:VbWI+ERGL8H2f9dnEXyIzRXqxKNlZeuOkJK9w2rN1:VH+ER2zfEXyAFEKReuOkJaw2x1
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\TextConv\WPFT632.CNV.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\TextConv\WPFT632.CNV (Modified File)
Mime Type	application/octet-stream
File Size	283.86 KB
MD5	7839a0cb06d04c4a8331fb9670aac298
SHA1	d2c1990570e25de68dae87aec799a855145b8243
SHA256	2079600af955c530249698f0bae8dea0316dd98e15e46b227e7d6a77c6552633
SSDeep	6144:t0FIdvgfOPwlhTfZBnLIBisG/YYwUyAo9hOz8AvToRDA:HRPKh11Lij6YYdy9hOAAvToRDA
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\AFTRNOON.INF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\AFTRNOON.INF (Modified File)
Mime Type	application/octet-stream
File Size	1.54 KB
MD5	e9b257136bc7309d0212db6dc557b199
SHA1	e22b65a931fac7d1c21c215a5ec1684baf6566a7
SHA256	fe5cb8edd732d7213c5a134d7435236ccf443dc9c380481dc2e4ba9d6659b20a
SSDeep	24:7l3nIDF744uVBoL8x0OqpKg0BJWnuSzKzCAaJkTr9frrZETEv:7l4DF744uVBoAu6TzkWuvyX9fnZEAv
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF (Modified File)
Mime Type	application/octet-stream
File Size	2.53 KB
MD5	ca47e854be5600decc3cdccd2c7cf379
SHA1	e86c2102f8ef9ea21ac8083228e52864bbd82f5b
SHA256	3c22f1ebbc25fcb77ecf2e9626b55815f1dfb4944a4d37af59f82daca0d3308a
SSDeep	48:7lkyEaOZwj4NrD6qKUhQ8DL0dPOVlzf9MCm7uDhQSszVVu6P4fh5T6l/I4Td:7a7DwjQSqKU9L0lElzVtmqDZKVuyehK9
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	25.64 KB
MD5	cbaa25c3a1749a00efa0d8e12f874c69
SHA1	1436dcbce8bad071c99f57bb0b7acc78eac2dbe0
SHA256	d71c62af53f01ae3c778abd6e48d31b19991799dbe7bb361f0ed018c38af7306
SSDeep	768:t+6uaXlU/b+hQEHgXhZ91VR1u17FNdLMq+3:t+6ua+eQEHgRV3AzNdLMqs
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\ARCTIC.ELM

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\ARCTIC.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	68.94 KB
MD5	0298956a9abfdeab945793ae5017bd16
SHA1	370809480449f9d12e4c55ddec848d7d5e6f69b8
SHA256	b168d326140a02fb580dcbe05a17580904766a09d725bf7483a6cbb2794a2169
SSDeep	1536:p+hFcfmgjI2VPgcBN+F61WhCE2SN491CPqpg/dAgm:0IfE2VBNnWhT4CP9/Wgm
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	3.92 KB
MD5	233928737bea19e955ee549ae628974d
SHA1	739174b2bbec79e913d1f1672e6abdec50cbdef1
SHA256	825ab2875cb49b2070e279b03f2cb8b64985f7e2abdc0a31e45a00b53a188184
SSDeep	96:7apdZrH11XUfKqH3ym2c7Qua0Cvl48PxvCZZb:aNH12fn2cXCdNKR
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	20.32 KB
MD5	89c8b0e8d72cdb2b4bb30384e2f6b1e8
SHA1	8a8ab3bd1e2cc7ed3bf9b4cd3d4c9fe748bdccbf
SHA256	96474b3140309da697ad9bf44d92eac071edbe3afb0473dfbc439ea4b898e090
SSDeep	384:vdNv/0TzCwQAGoKd6aQVmecaawgnnjMY1XVKDH7de:vdZ0CwrHKdCoCafnnjX1XViHxe
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.ELM.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.ELM (Modified File)
Mime Type	application/octet-stream
File Size	99.44 KB
MD5	8a88c71282237252df18a003a5e1859d
SHA1	192a8edec36d039fdd307724c6b7246cfff505a0
SHA256	0cd4293df4ea53b4a33d12ef0fc75a86c9f9237a71c0eafc5f76d4004c335b97
SSDeep	3072:Hva9xZCrIdYB7CBVTG/YfU+mVqKt/nLaLYvR:CTZCrIdYBWBIV5dfLwG
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.INF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.INF (Modified File)
Mime Type	application/octet-stream
File Size	1.52 KB
MD5	32bf9800204863f24eef76de448dc972
SHA1	f215f46526742aa2c3d0f6630d267af8eeb2aaff
SHA256	635f9878c6a8f63d22c5a4c5c8e0c2f3a6edab875170b653baa4210a691edca7
SSDeep	24:7lbjhIUtVK5BcdTE61XG35qKbD/UsDW940aLKgHRXmJG+U6H:7lviUtaidT835qKbZD7BmIKH
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF (Modified File)
Mime Type	application/octet-stream
File Size	3.78 KB
MD5	453a147bc9b1d766876d897d8ecbc78d
SHA1	8eb838c29031bc41f85a5c9198a02384ac2fe1ee
SHA256	b1efcaadcbd24445769c6b2b398365e1c93c7afb1cc2a2b1f92c89116236af2f
SSDeep	48:7lfazul71LhMWvdlPBKtN/yrP7HFZcmzUxR7Ho4RJhycg9ZFg9byxqtYGFgI:7MqFJBrzHxKHoMJSZSuG
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	35.10 KB
MD5	9762efc1ec582b5d66cb2cb0b064ab16
SHA1	9b3e9fb752fa3408b5be79ec3f945026c9357e98
SHA256	0f0e80f266255474393e5b35516723c11ce8057e39777f31a3dae2c9f3a8fa8f
SSDeep	768:u6nNxZj/MUcPWg4C7ezttdzxvfWyKApIEi:u6pb9cugMzBN8cIEi
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\BLENDS.INF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\BLENDS.INF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.52 KB
MD5	114017dfaefa0da09df98078fd02afe0
SHA1	c94151b5c0212262bcb90ccc293fce5002e6e7d6
SHA256	35a682bd69dec236905153eaa67903f3a1548c26f4fc38af1f91f6074584239e
SSDeep	24:7lcc2OHExIhpZgiKlI1EJx+E8E+69GY68+kN+vo:7lN2OkxIhpZgiKliGx9Gh8+ib
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG (Modified File)
Mime Type	application/octet-stream
File Size	21.14 KB
MD5	429ae2b0bb618739c8f5c0e7afd52cdc
SHA1	920a5f8507f3caafe87f84511fdbdaf3e6c76d11
SHA256	b8c8f479c1b0a3084fbdcfac853044ad827db096b4266d6f275580870521b74b
SSDeep	384:sGdRPZlbN66FswqhTno659RmL3Y282dGfw81d6xtGfGNOJjPRd+Cne:DfzY6FqNn3zRmDufw81d6q+uR0Ce
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\BLUECALM.ELM

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\BLUECALM.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	49.68 KB
MD5	bca8c309bea364305bc7f89c7a9cc5b6
SHA1	46ba2f763089cdaf6f5c6f152f88604deba5078f
SHA256	61a5921687f7ec6942f2135f599d1246558c754e562537f88678d14ceecd9f1f
SSDeep	1536:sse5uEFI9oibp8DcrRmsn4M4nIWhDvoykkSx2EaU:sxRFI9oCfVn4M4Nxk/h
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\BLUECALM.INF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\BLUECALM.INF (Modified File)
Mime Type	application/octet-stream
File Size	1.54 KB
MD5	d31dfe1018c24c1a23d4408e33dce365
SHA1	a40f1e49d9cb0ee9fac1901ab5b44caa149f185b
SHA256	2a3194188c02eb83bc49ccaae86c14dc51c29e3dbe41a1c0c1c0ee26f10737cf
SSDeep	24:7lk4SgDXhG09bUPFGNDBoyaqXn9UZ0gnPAGnmyBesZdFoq:7lk4SQUPFsp3yZdPzlZdFoq
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.52 KB
MD5	2e2f367fc68bab4e7d42dbf231d626d4
SHA1	8c9176d830ac47cab0063dcebc45847b4158fc0f
SHA256	13443044a51a1d8e142116c0ef36d2c20f89b7d4fd8921a1837bbab72158cf31
SSDeep	48:7l2jICvPpB/fLq1VYJIgVRx8EdoxmAasAumK6dTmD6eRRuRBu:7poxB/fLq1mJIgVRaEdgmAaFTK6diD6A
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\BLUEPRNT.ELM.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\BLUEPRNT.ELM (Modified File)
Mime Type	application/octet-stream
File Size	55.63 KB
MD5	6fa488f302b6df7dbd21ffb96a02b405
SHA1	651987da2f74025b86e351a6c68e9a031ee3eba3
SHA256	34fe60411f0a805125faae1ca6ef8b7849154ac7ae616361fdabee1d0959cc22
SSDeep	768:m1N3ZSH1mtkLOC+ujyPlrhqNp9db60H1JzrblJg3KvSiiQce+YIveIsYGbO29:yN3Z9tU4i5XJ/kmIve7RbO29
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\PREVIEW.GIF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.88 KB
MD5	56e4cf7c0985c704fb7808dea88d52f0
SHA1	5bb7a1475ad70ad4a2c35014f2bb60a3b7c3a6a0
SHA256	3f488da997bdfa9aa1ea42d73882a8c2dfb4d8c3871315fb28e36b269a115214
SSDeep	48:7l7/1Hve0Ov1l8p7MvQjlVYOUv2Fc4ySSYQezz0qFE78pFVOy0lL9n:7d/Bm0O07MvSu1GC2QezzVFEQpGlL9n
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\BOLDSTRI.ELM

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\BOLDSTRI.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	59.74 KB
MD5	07a5ec468a9923fa5bf6545ed3663a0f
SHA1	c5e5431d5fce073140114615d88fc25e95402ed2
SHA256	2a78bff163cb1e17d4152fca9efa0205787e6a3f4028bf656e1d8d4968ae0612
SSDeep	1536:bGvMy2GN+TlsP3Rrk/apEKdPTpYhFj7PNsw8Ifn8PacfzPv6WYy0VB:bNy2G0Jspk/apEsTs7lC+8PV7Hw7
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\BOLDSTRI.INF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\BOLDSTRI.INF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.58 KB
MD5	169c05bb220dfaba2b461ee99b011171
SHA1	1a41d4f855f746af7e78fc13655aec5d1abdb403
SHA256	fe82f10365b22c39a338e2dc4157159ba1b79cee9b72d941801a52e324e72538
SSDeep	24:7lWlpf6alHhIUcp9Ao/+yFr9wPkHTQZ5AC1WQivdxSP+6teqQdvCMWY:7lUialtcfW0waI5ACsSGQep0M3
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG (Modified File)
Mime Type	application/octet-stream
File Size	32.09 KB
MD5	8a392193d6bd88800785de6328eb8503
SHA1	e3f71d4bd508ed8d3ed7af3c317b0f2ab80ba7c5
SHA256	b5bf636a04696f4d4d172d2c38839835c035fbc5949b148603bf23109ba7110f
SSDeep	768:FYglmJxPeOLEmdf6Mi7sUH6EOl9Dol4kIf:GglWZeOL5dy5T6EOlzf
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\BREEZE.ELM

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\BREEZE.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	106.30 KB
MD5	943b59e8bae6711064fa98f4689283df
SHA1	c7882bede5de5eb9a487ab2cca339730536aee53
SHA256	3247360a59a6656feaff5212a4690e086e4f993b55d079550e9b04a439d01faf
SSDeep	3072:uT762oSXXUyDN2uHC3PXwRmRTsV7VSM+U8IFNnaDet1w3:+m2VXbDiT1g74MrpFts
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\BREEZE.INF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\BREEZE.INF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.44 KB
MD5	971e21b6ac8357e53775c05d786a177f
SHA1	14bbf36bc48856433d5708954a59f8818b768cf7
SHA256	305e426dbc5c0ea99e7c39f56632679c1a3a8426aecf373d54725fd4f6ccf846
SSDeep	24:7lVZbArtn69RVZtkj8gRnAcyvASPb929QcBMM4Pa:7lVirVgR36j8i1K929JMs
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG (Modified File)
Mime Type	application/octet-stream
File Size	43.26 KB
MD5	143eb37710229a14a4ba408254490b3b
SHA1	49dc472ef18272d657a4cb6cdff595f904990fa4
SHA256	12755b7f2751482182769ff904d8441aac4cd99cc39298d041b41b74202be31b
SSDeep	768:BaFE3wMb8kGE/6LyIsnDXYg4n4jf8VfyFLqYsood4WaGpUoiw:BQuwMIkGE/62jDIB4jEVfwLqDooWWtpZ
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\CANYON.ELM

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\CANYON.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	44.70 KB
MD5	6e6da44fbb394a8831315a5eff86246a
SHA1	567e87ff091fdc96dc1b096b33b043712a87d5a8
SHA256	f6a0bfd28a7b5ec1f075ade9a705203d0b5762c30c966f7d0dc4a20db9dd4279
SSDeep	768:0zKYN16nyhmyi9bZYerW9D14b6b2w4uzWCwXt9dbh9DT0SWZlVjJ:0Z6nG5i9NJQD1ry6a9rMlVjJ
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\PREVIEW.GIF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.92 KB
MD5	9af76cb6be8d861e66fd8290f548b7b2
SHA1	5ad758defc304d213398c242162da5a45150b030
SHA256	56da1a8ccc6dc08bb55c6cc5d72c81a4a87a3a45f861c2801a5ec454966f4841
SSDeep	24:7lELhne9VplpGCyscBQ0Sn5YzDvHJMyOoWx5RO2hL1Eckvzjo6zITFOqpgPj4Q8o:7lwsplxys0+8HCr/1jEckvzjo60TFAP
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG (Modified File)
Mime Type	application/octet-stream
File Size	32.84 KB
MD5	f05b91bba2519f0f2082f26652636aaf
SHA1	7c7933daf21069eb4ec364e214801b4b4f2c1063
SHA256	7b1435e807b158d7370ed0130298069fce2c828da28c7f9e5c8eff676317a4a8
SSDeep	768:xUCbz9HQ6d0hc1A8+l2aJJ75M0Ci0IKusRLBr:xUCZF2cm7TJlTgIKuEVr
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\CAPSULES.INF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\CAPSULES.INF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.49 KB
MD5	10d2971e9545832a26dabd76fa39f183
SHA1	0ca6848fb7caeab2e4009adff90b0e001e11276d
SHA256	5e72fa40d0d62e27f07d94078dfb21bd7ed6e97e4bb9886d261e614e84c07bee
SSDeep	24:7l9jzeBJI50qO91ohwSIiKzH7tAMNmeBagvOT3y:7lJzeMbAiBIPzH7tAM0gGG
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\PREVIEW.GIF (Modified File)
Mime Type	application/octet-stream
File Size	3.00 KB
MD5	9e5047cdef56e3c8696992a853aa2ca8
SHA1	e41b8fbdd6373c3517c0b11ebdbe818c8dc946d4
SHA256	d1502d763ce699fae2794f1109613c886af06417c512d5621ab3ca6c6297e53c
SSDeep	48:7lRwNwxdhm+DfEBbbJ6YYnKtNFO38HGHGzh4yDKDWQK2mxmb6AJrc7Lu4nvPyVI+:7YcHPCbV6YYoNFO3ud4tBK2igknyVIhQ
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	30.22 KB
MD5	cfd7e484d445392fae95b4260bcf2e1d
SHA1	baf1cb6db40a37ac85410ae5ce6e50dfb1bac8cc
SHA256	0e618398e7f695e46893daff1517e2a1d50ca034232a475887989d9134104f05
SSDeep	768:yIxzS9ov83zpBihywRwpsy3ArD4Zi2PqcUK/1A/RieOkUJx:JKoE3zqytpa2ym/16rUL
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\CASCADE.INF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\CASCADE.INF (Modified File)
Mime Type	application/octet-stream
File Size	1.60 KB
MD5	489d9b6cbaf8526b8199fc606924e59e
SHA1	7ae442a53fae79d7ada59445b0ebeff7c6be441e
SHA256	6e6511827f90c8e6be502839cacb379b4d0d65f9d3a8ece0c37d6e8abc33d32f
SSDeep	24:7lZG+7W6GBYAF4++5py/apvsnIEoPKZ5hRwGjMlBQtAZP3BjYB:7lsmCY04hCBnIEelmtAZPxj2
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\PREVIEW.GIF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.33 KB
MD5	745946f881bd60dd2bfd629d03281c7b
SHA1	2e61a5fae3cb5e3d2ced2dd3cf632e9b7033b831
SHA256	8653df04f3838cb89c12cb79c2f7e09cd8dbe0c2bec1d01e21560ec2991880d6
SSDeep	48:7lSJr+ZYsYBY3XkcZgeRPC3HDZSxZsP4oGXmWdN2:7Eh23XlZ3cZSkmzY
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG (Modified File)
Mime Type	application/octet-stream
File Size	20.89 KB
MD5	7b3400017454ddedcf4afef64aea2d32
SHA1	9e994db3762f9bdd921ada7106dbb3b3c39fd449
SHA256	a2cbae47617208ba2aa0bf23accfd3e34d9428d9fa832e516ae1eefec3a9fa7f
SSDeep	384:y3kYTvqC4rlfxKDGD88bsL3ZMvQe1TxRqCShcwXmyvgZBl0Qbi6PPz/PgTjANZjj:TYTSlJlAbNc1RpShcwXjEdd8oNey
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.INF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.INF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.47 KB
MD5	45213c7724d27fc5b663a4d659ed0148
SHA1	2b9fe86be31c0f979beb38e407e415ab01497616
SHA256	ab43131931ea32440c7e9f86a59bf5bc5ac42d88ba771ba1a10796d550195517
SSDeep	24:7lCqdZcNO8UaJtLJjqtwSizSl4zS5UdzIMW1d7H0:7lCqdcxJtV+1izSlMdzxWPA
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF (Modified File)
Mime Type	application/octet-stream
File Size	2.26 KB
MD5	1b7133881f1408244ebc28e995669be0
SHA1	4b00470480c7ab1235ab0a1dc5bd13ab57035a2a
SHA256	905986d5892f2a5d86effa683545861cb5ab16e29ea005bdeb1248316c64771c
SSDeep	48:7lt9lRHd9/jkmTGBykgdwR/JM7RqejW3Eyxi:7/9lJdRjxTgGC9JGYejWNc
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\CONCRETE.INF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\CONCRETE.INF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.47 KB
MD5	a9d4c8fc3debca814992433ece822c8e
SHA1	fc711eddbaed67435dd2aed9e96ab5d9da340918
SHA256	ab1d4a6b7f6eb0158e38f6be2923e12ff00597f11bf97995bb885e9107156850
SSDeep	24:7ltqB14DPUT6doHPm+N1ketZhgvlZ7eAWM6jGHvoHn:7lw1UPF6Hu+NxLUXr6jwoHn
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.26 KB
MD5	ba626c06e102f5c086390cf5d0435255
SHA1	76fbd9330f6c3149ebc9504d6df2d1a6ad8c34ba
SHA256	5739719c5fde8013d6b2a833b3ef0351ce34cec48b9fd19cd1e55c53dad65c29
SSDeep	48:7ljh2iotJikh9FPSoQ/El3SGeGraPv480B4vQMD:7Fot0kbFP8EXXah0B4vQ8
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	28.92 KB
MD5	c4b86b5fd8e1e04f96b20b5e3fa2d25d
SHA1	ef74e39626cbe51f5f053b6187cc19071d6e866c
SHA256	a546a3dfe9b989b56c730ef5b66a89107a12513372683c3e26c9e07066e66d09
SSDeep	384:a7Nv+SYDZWgiYb+odgNcX7XPBKngF5777tCdesT1GhlODnq4ERJD2Srn2vncfCaE:aJ7Fgi0gcjUngF57778pQhm62w2v+E
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\DEEPBLUE.ELM

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\DEEPBLUE.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	70.71 KB
MD5	3b702659ee7c8495a020f5c26a03aaf4
SHA1	3654e44b867c574dcaea54f8dccbc7f5a2021347
SHA256	852989983d42e7cfb8cd45c0817cd0f8ca31b3c8aa13b47e752618c7317d2187
SSDeep	1536:M1XlQmP7tp586Dg5icmoc6P/iJyTQAPxKjeW1v9i:M1X3PDDg5icm+P/OnPHVi
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\ECHO.INF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\ECHO.INF (Modified File)
Mime Type	application/octet-stream
File Size	1.49 KB
MD5	b48cb2d30693753080e85c025bfd2937
SHA1	a8eba5877d8387814fb37cf595ad19f7fce9dc32
SHA256	820b00ef2a2b1e3241f8ef7662faa71a2f263caa0af601bd3999bea37837f700
SSDeep	24:7lfnCVF6aj5nCihS5SEZNvqH4Hwxt2OjoC2X6f95NVImD1nv6YT:7lqXthCiS5RUrKOjofM9H2mxnyYT
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\PREVIEW.GIF (Modified File)
Mime Type	application/octet-stream
File Size	2.42 KB
MD5	f1cf2d39e6e85c437188201dabb80c16
SHA1	5ead8ac62d13da195f87efcf65daafade02c94a7
SHA256	723171bec77190bf91b4b9f1cb2717558515e6f62358689227595728f4d79a46
SSDeep	48:7lxxIaf5zpYpI/9FmD75mVptB188gfkiIbnKEyqFcanYi:7yaf5dYpI/L875MtB+PHITKEtca
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\ECLIPSE.ELM

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\ECLIPSE.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	116.80 KB
MD5	0c05bb13038bd0153ed386f390692d7e
SHA1	b94cb4ec19fa08e05f2a87acb93f06610bda4e21
SHA256	ded1b749c00843fc732562cb40432362d5ad61c48b7ff6df333dcaaca272d4ec
SSDeep	3072:HDtuDnEXsyX7AzceKLBacG4fINWZUaEef:joDnEXsYcMEcJCKUaEg
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	32.64 KB
MD5	272804a0b364c1d91504246ca63c214d
SHA1	4b215417f840ba88e262fabc37700886e04f27f1
SHA256	5e3e2b8d7ade1ff7253ae8a8e8306ba4eaa28ab95fbeca81aaea27680ad2a1e5
SSDeep	768:UnTkhen2LpqddU3clv8Dm/gRVIgaom2q8ziT9v8XTrEVeAnyflvZ:YQUnm8ddUslkDm81aoRq3RCTrEpyNB
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\EDGE.ELM

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\EDGE.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	47.24 KB
MD5	1c8a1b6d388c108eb8b343982cde3b37
SHA1	b5ea7fe62d8e94e7e7afaab4ef1427ddc786aed1
SHA256	5daed507de6f887c7cdfa7aa6ca21b769f0c5972bf52245967715b65ba695c12
SSDeep	768:DvQLqVnnrsEfyweEI49wAHTdFM9WXywo03XjvGNI5R1xl9QVwCbox:4qpwEfy29wExFMMXySnjONgR1+whx
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\EDGE.INF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\EDGE.INF (Modified File)
Mime Type	application/octet-stream
File Size	1.52 KB
MD5	57814202f03890dded8ca33dc9a15d73
SHA1	bf655c2e8caab5e28e89b9b17d83097603664d7a
SHA256	a59ed77d8d916aae5c7998045da10e76131c5d8b4a1434a988d0a0f6897229da
SSDeep	24:7ly0kUc85JsGhiFcUh9/YB6YXH+3x9YOL12XyKJQUBLeLt0GS:7lNs0iHhhY5hVyKCUoLt0GS
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG (Modified File)
Mime Type	application/octet-stream
File Size	26.78 KB
MD5	cb2f12d816290deec704d7968befab60
SHA1	8c01708ae35757a190b3e214020129b390baca51
SHA256	9b50c3a650b5e0bc558d3dcc0a5400eccff89bc46deca23dfd2e2ed95a0eb964
SSDeep	768:01q/ecvYfE19ksNPyJgu0W1FkpU5y/bf/:0+ecvKE1aVPT8U5y/r
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\EVRGREEN.ELM.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\EVRGREEN.ELM (Modified File)
Mime Type	application/octet-stream
File Size	76.48 KB
MD5	94c3e62e7b3bcf1198133d75891da081
SHA1	2c5aedf44861282bdde63a414f665a1817667c1a
SHA256	fb6397f1d6d265df2476c8e0f697677025e6b4114c58f9b4d2b09b83fae5dd90
SSDeep	1536:8Ca6/AdvJuLY40feGnodYd9pM+VP6xroosKFlylIcOYQLdQhr4ScHp:X/CvJbGGn1m8oM7QJwrLi
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	32.67 KB
MD5	eb7916cfe41ec0f25b66731ddb43b329
SHA1	0f0385cb0ecf12d423b3d0f17f1d89159bcc9d45
SHA256	1ba5e1904b269b8f2c4bd5b9e740bc6fa385da5ce30322aeeaf0143e18b4f541
SSDeep	768:IgYh8PP1ZQD0GMPJ1NEP6lxAtUg8he8po:qGH1ZQD0dL60U8po
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\EXPEDITN.ELM

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\EXPEDITN.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	102.31 KB
MD5	a9c9a8aad654a61dd68a1432fcd8fd5d
SHA1	f90bcb182d0f6545b2f5b2a903adafc20bafac86
SHA256	cd2f035f179fbefeadcb8cba8c6e8b19d64810d1a04959e31858095aee6f691f
SSDeep	1536:RMx4BTjlW64EP3vSV2cG/wq72KjDWX+lWnAHKHkOqbUb7j8nJls4lHVvvT6joZB:SOfPu472KjDWXEWnIY5neTDHdT6j+B
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\EXPEDITN.INF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\EXPEDITN.INF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.58 KB
MD5	037000fa86c03721c9568d268f4c026b
SHA1	374804ac059704aabfe796a145cd01aba0ecd84a
SHA256	bb49612d95baf96b959dbeff85080719d5b23e90828f02584e7f26d0d184b171
SSDeep	24:7lTJTIEXOPtFhgr3x2dm3MmcYLm5lJ6MnpZr3hZeZafnt8DX:7lTJTI5Tqr3IdmZK3praZaft+X
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	60.30 KB
MD5	694f4ef5157bd1533d1263b513227ccc
SHA1	8fadd922e97fd1ae141317d22e2ff55e59532c8e
SHA256	caf193adec2259dcc9821e8c48917260e3c6692eaeb65dd02737bf7ebaef9109
SSDeep	1536:jKb2BEaN0A+NlQZ8iGnmvZfMEXscgIGQAcH6N+Hm6Q:Y2BPmyZPGwZfdsXcFHmT
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\ICE.ELM

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\ICE.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	67.45 KB
MD5	b288c320ab6729219aa7b1bf3e16d85e
SHA1	5a71b2291e3ae84ad79769bf4592adb0c5e66605
SHA256	a6ffe0e68757151ca2bb17cccde07b3dffa6aa0d4e96b9bab70905c910942aed
SSDeep	1536:THWZJbUBXIQflRvhZ/luY5+84yLCgVwoCpjFQFVLzWqEee:OpIXvlR5J1+8a/oC0LEee
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\ICE.INF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\ICE.INF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.42 KB
MD5	c7eaa734a5a8f74eabcb2ee51a787cbc
SHA1	374f67159af228ecff2ef83524c3f90d372df63f
SHA256	49ac3c56c5c91653b1b2d52d3d88562b3a05d328bdb0e6a2fc865e15058faee2
SSDeep	24:7lBp0lO0ZoYlpGFq/CResZdi6WIr2HxNTJj1z47pKW:7lBpcO0Zokp2qKUqYVTJ5z4VKW
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF (Modified File)
Mime Type	application/octet-stream
File Size	3.49 KB
MD5	6cc381ac0a4c89fa2742a6bae7bd1a2f
SHA1	53e8ec59c0df0224ea1c6d379a57617e2798e1d3
SHA256	1d181d3827d72c64bd667967e3c56879b58db31cefaf1f3ecc7d0a2623495258
SSDeep	48:7lJ+hehXY6fnKyAUujVT8RtGolVf8o856w7bBhQCzF7MXyTp0+8/rRcFbEWo:7PZhXY4nOTAwaf8oTw7NrzFUa0/TRCRo
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG (Modified File)
Mime Type	application/octet-stream
File Size	19.38 KB
MD5	e7d3a98e7ee1f37eb8f8bd0ff62a2015
SHA1	a10c4bc1516a93b3c0c7b4dda7b2564d8c5244c0
SHA256	3bcdbf5b0059b62cd289f977f4e20644ededa0f3fedc2cb25a47be090ebc877b
SSDeep	384:2menE2hLaNmsDCIGgYDpxiQVBW40BYx7dO5ys/xWr68yslcEaN8HoqcjVc:2ZgDCjlBW4So7KRjE6V8Iqc6
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\INDUST.ELM

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\INDUST.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	98.23 KB
MD5	99b89a06a3e7da592553cd53960055e5
SHA1	ac2d66a8199be5513f5e9aaa52ad94b733abcd04
SHA256	e31cb13044a60d477f287874357db31bf7e4aba7504346492b261b14684ccd43
SSDeep	3072:gu5qMVXz+ia6KgTwrP1Hb89LKcKp+0LAMPbmVLeUt7:RPVxa+TiA9OcksM6HR
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\INDUST.INF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\INDUST.INF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.54 KB
MD5	d4df3c55a4157bac647f496237625bea
SHA1	7194074e46c5ddad23b6f303cb886220dc5b8fe0
SHA256	bff50454c707be864c9d07db17f9f6bdd7dda5781d18ef048f260a54725571ba
SSDeep	48:7lPBSBKW8kBz5B7pP9KkEVbkhTiPZTlRjEjTAk:7WKWzB372kKbKTMZTvFk
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF (Modified File)
Mime Type	application/octet-stream
File Size	6.06 KB
MD5	08cd8045fb9288839e6b8161725416bf
SHA1	efcdb339163b25f1e8a494dcd9d76b726939db0d
SHA256	a04d0556cba8d2dc97278d01363343a05da2f474da55c74419752253eb88c371
SSDeep	192:i76bE2rQHmFVNiHWMQYnyl9/JpHKY38z1:iIEkcmFVNi5yl9hoY3k1
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG (Modified File)
Mime Type	application/octet-stream
File Size	33.77 KB
MD5	3ae1093d5fe059116ef9c5629af33ba7
SHA1	741c1f336ef8e188e31385f379428925f8d156a6
SHA256	bd6bcf41138310cc86242d97f981c672fba2fb74ea4d3c1c31f261080aa83432
SSDeep	768:HjDjYiXct+rynuWWsLrObL+/FGPzpzX01Am77fJItbkUEpbH:7YiXcorynuWFPJNGzpgH77fOtyH
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\IRIS.ELM.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\IRIS.ELM (Modified File)
Mime Type	application/octet-stream
File Size	65.34 KB
MD5	64b73249638f983c88a3561b45f22bcf
SHA1	18e25461f4003593cd7860feef68c584afa475fc
SHA256	9c63c5007940255d8b6a03fd49f8352145602ced43340454fcf5e804cc8c60b2
SSDeep	1536:4kxjKlCrT0vGuceXzSBSeiOduttlztPmsm90XLwFfmZWXMLZUBoi7DOu7w:4kxjKlZGzKSBS0mtlztPmsm2XUf4WAUi
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\IRIS.INF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\IRIS.INF (Modified File)
Mime Type	application/octet-stream
File Size	1.45 KB
MD5	9f92a81c50a88532259d568c928bdec6
SHA1	dc9c297275f1a0eb8b0bad848d6de5768b8c3422
SHA256	231a4cc8d89a28ca1ae3fab4c4a360d53c62d3daa7e7dbb21580ce9ddd869390
SSDeep	24:7lq8UL79/t27Xp/VtSnoyM1LyBzaaAXEkCycBy5zR:7lqV9Al7UoRy83XtR59
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\PREVIEW.GIF (Modified File)
Mime Type	application/octet-stream
File Size	3.42 KB
MD5	086f8469fe5b75b2ea2158437fa9d440
SHA1	20bd4d5f385c1a7d17677dbf99f2fcafc6c6d54c
SHA256	b4f4fb3c24f7a64d872c48ee8ae065c6c86dd9a6ed1cb5268ed2750b929db3e4
SSDeep	96:7s79Z/egsoL+xwRLCbFdpJ7M9YeY8kg2oG2c0BM:g7PzDAwBCbXpJAYn8knoG2c0BM
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	18.98 KB
MD5	0ce042a7334cd2b86e3aaf1a3541e82e
SHA1	8dc63daa433826cf9f8eb3279de9ccff82e3b249
SHA256	6d171a3c169df09e5d9bf2127089c6c3c114077c8b227576e6a021efaf586578
SSDeep	384:B5vLupJ5uz0AfD3ZPKX/XcFHs9AOs/WpfUhNst8g/uGeY1cOB84:BIi0y3RAXcxsa3yt84uGezOq4
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\LAYERS.ELM.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\LAYERS.ELM (Modified File)
Mime Type	application/octet-stream
File Size	58.82 KB
MD5	148c6b82ea1a802e3f01f5dd165ab037
SHA1	63117843e6c3770e9bdce7e14f0ab61cb4dcd1dd
SHA256	b4c3938f755a6010301f4d99d4aaddd0f6303d324990749bb684493297eda1c0
SSDeep	1536:WTqHDAGEtQ1xCtLaLjKUZQEnof84Qd/phNiZzssRSgO:WWHcGP1UyKU6Enof87RhMZS
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\LAYERS.INF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\LAYERS.INF (Modified File)
Mime Type	application/octet-stream
File Size	1.52 KB
MD5	88505e406234f41b800126b7e38119f3
SHA1	f149567f419ca8c789f87260d104e8b16ebc9965
SHA256	a85007a13a76e5e3b5a03d9e032ab8d7b73ac979dd1cd3a62ad694ca2fa61127
SSDeep	24:7lP/07+6s7agEumWM0kRPj5TzOD5Ahd9pCL2h+PXUu/J:7l96N/RPjJz2Ad9pv+n/J
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\LEVEL.ELM.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\LEVEL.ELM (Modified File)
Mime Type	application/octet-stream
File Size	57.73 KB
MD5	91595233c9581f56163beb8b43f26da4
SHA1	f9e69ccecfba188d5335092f0c42ab40aff83519
SHA256	7e9830745b49a9f6897aba6bfc7d86932814b1610ec36f81d3536b1b2b90d185
SSDeep	1536:G9z6cuZf8rBJurvRYdqjYC27MF+p37XcBZLrLp84BBFFcK:SZuZwU727Ma7up50K
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\PREVIEW.GIF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.35 KB
MD5	8cc55bf2811b2a6acc968acd458cf6e1
SHA1	2ddec2dc8cba0103bc35f59af403baa26c570271
SHA256	f40d7bb3965cd0d7172baf2c1176282aae94050a07ccc89522cd823555e708e0
SSDeep	48:7l/0laS7a/QQ/3YriJJTZgCBrvPMAmHTeyHPS8:7FtQQv5TZjrnPqPS8
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\NETWORK.ELM

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\NETWORK.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	50.57 KB
MD5	3a38dad794732a6d197157bd96223e92
SHA1	89b8532ec0dcf59d6c0bb79bfe88818774d5601e
SHA256	c0c69b593130239d1d0ddcf10801767797a4677fa203ce1a1bf0ab4012dbf834
SSDeep	1536:HIe4fCh+3GdIrx94XMyDcqZF+sITZpEQFO4ZKnpIcEC:tuCMGdI12pDpr+npV0npIcEC
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.33 KB
MD5	6cfb5d26c88cbce2dcb36491d9497f9c
SHA1	48e29d71fc352e93148ac349deaba32461470908
SHA256	314d02dc9c7c8d5ef952b2fb47b9ea1015391a2b175767fea8a7bc295de7199b
SSDeep	48:7l3olRI4mS2e5aV7w9hfRChYB2va4oU2yw6E3BYk6Uv:7NAI3S2e5Gw9hpChO2Ci7nExYOv
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG (Modified File)
Mime Type	application/octet-stream
File Size	12.30 KB
MD5	8c474f2aac548cb4ceed7bb76ff20729
SHA1	f714c79a53275adbabb1c20dd3bf980c3a3abb8e
SHA256	353b88d4003d15e2c396db3308e395defc4d8c8c386a81f14aad89850d5cc3a3
SSDeep	192:3eSlrWuS5zNZ/ovG4eEvbFfybZinG7lTQIEF4NyxAbJ6JV5slBZ3VeTekup:3ekW/5UeJmxfsiOa+Ss8VKf6ekup
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PAPYRUS.ELM

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PAPYRUS.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	90.71 KB
MD5	a2ef5b67fceb9e96046930f0b99174fa
SHA1	954d51ec09e0ca7e657b2e615d69fba8a26552a0
SHA256	2a70bb36705c2acf7fb89c4df243c4744525b94f8a86d120cc7a4c7db8eb8625
SSDeep	1536:k4K3ccK4GPOc+fNvanoS4n7PDXVvpcU26hnG3ha9BzrQG1HEKZvTg+M:kbrK4+4i54nTjlpcRQG+BYG1HEKBTxM
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG (Modified File)
Mime Type	application/octet-stream
File Size	37.56 KB
MD5	4b2e950c6b016bd40214c33cd2ef50c9
SHA1	581b20a3056417b885995d7fb507074822237707
SHA256	db9c4ad2081c47183d0d58eef85a62a8727f98d57bf59c96ae5267be9332a83e
SSDeep	768:syLF4aeZIu9pP1F08DDKDccM6GYdUr/q6yKRDeTYRFcheGrZ:vh4aYvX7fw/M6G0UcKU8a
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PIXEL.INF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PIXEL.INF (Modified File)
Mime Type	application/octet-stream
File Size	1.53 KB
MD5	1e5048b6a32adb7b5d3f70dbe06ffc8e
SHA1	cde10e850f14ed9b6c017a9e66b7a3ba928449e1
SHA256	d22dc351e13271b7895d1e87caeac1a5d83291acb234c59d3f7d85395f0daa6d
SSDeep	24:7lW/A7WUonr6XAZ2hDQhdjMIluyqiAQI6fChoEr:7l8A7PonR2a/ILSEr
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\PREVIEW.GIF (Modified File)
Mime Type	application/octet-stream
File Size	2.56 KB
MD5	ab2faf15ef208260fe8cb0663f9caa23
SHA1	b087d4059585423082cc1e7f9864ac44e60460ea
SHA256	0ffd079e066bc8029f3ae0207634646715abebeb175bfb7c6cf4c0ac0533c559
SSDeep	48:7lKotbbiire+ufFvv0/WI1XgJ+/f65I4f6FVdeCuUSMi/3v7:7cohH6flM/Wak+/f658NtE/f7
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	22.24 KB
MD5	ad5a82b0c2b1cd1c108a038c9df2a6cf
SHA1	734be95a3e27c07fa266382c2372d3861d7221ff
SHA256	263e8ede5ef8e99112711aa22a958169e31586a9ec7453c9877bb36fecfce588
SSDeep	384:N2dGe9Dmkb2cQJGNqWddTQlxnWDlywCG/to66VPaqiToxyVHCoz8E0TSj6Zyu:u9C0Qy/dd4Wx7CGh6VCYxQb0wu
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PREVIEW.GIF (Modified File)
Mime Type	application/octet-stream
File Size	2.31 KB
MD5	00026cc2a370653834630da2506bcacf
SHA1	d4c5d10315a5ef6eba5df41d7b954c55f53a4c87
SHA256	86be25f015da4faec28fb3e37ff9fcd9a00167834679d990fc67679a060a2d67
SSDeep	48:7lGPFpSNFLs+Da2slmdsXxa11wqmoaSqA26yCwS:78evs+Da2slJh+16/f6kS
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PROFILE.ELM.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PROFILE.ELM (Modified File)
Mime Type	application/octet-stream
File Size	45.51 KB
MD5	c13a0af371c9d83e54a248df3ef5bd91
SHA1	ead17a9b2fee7fe3c37f1033c0b0e134b69918c4
SHA256	30820fd6078fa5ee198a88bd8fdf62f1e2aac8de87bdb9fc67d566ea96612f5e
SSDeep	768:/U10yvEe+PIhhUZh+eBiD/At1w2hDKRw5r2M1cgr/NBuKQm5My1te3TwoGFN3XEg:LK+P5ZIeUkp91Dk5kr1Q3TwRpi3aP+0R
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF (Modified File)
Mime Type	application/octet-stream
File Size	2.41 KB
MD5	3d7f160166cc46f1a2a9bbc9a05738b1
SHA1	dd39c0202b283aade5101ed6cd28f920e9a95942
SHA256	aa1df7445b8c6acdafbc7c318fbfab480fc8bb85a5a34f018eebc4dc2cd521d1
SSDeep	48:7lOkctMJgqw1Q7pR/5oU1m73wF+EnYZ1ufJ5Y3E3n:7o7tMJgQ7fJ1mT2uqJ5Bn
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\QUAD.ELM.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\QUAD.ELM (Modified File)
Mime Type	application/octet-stream
File Size	47.91 KB
MD5	18b08bdf97476c5e28765702502777b0
SHA1	94f2c20d437ef16331c7a4ea9ec11f60ec541379
SHA256	d8b6a2d8acd6c6ec4ca942f29a38546f2cb161141850f9d8ce24d2fa8f60712a
SSDeep	768:zouZJG7VG5ATTdpyBivGBTiv5xrOupFZ7x3ZxTz1N6NySAG5zYCcJ9/lIabZcwiT:sMY7VrFRvouv39Z7dZxTaxACzYjJfIaK
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\QUAD.INF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\QUAD.INF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.59 KB
MD5	d4ba562531b0a2a851cdb8477990062b
SHA1	ff130cfddce560e738804df44a00282f5e8f4973
SHA256	9438113cb9908938630019c0a77be00e43e90b1c915d8983e83c77035f55971c
SSDeep	24:7l6KBaCvpFOjjemIE+13gT2WCYPyRDcl+pN+vGkWT4Sxb6YrHar5R:7l1BrFOpIVlc0YPdIj+vGkWT4ip65R
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\PREVIEW.GIF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.63 KB
MD5	b256dfe27bb42ad760771dc42c0e0af6
SHA1	a2eebdec5a488fab535518828a32dcc86a9a8bfa
SHA256	e93feb440b30ab94a60a0f3d75f52bcbf7ec9362642d3be42f7ec73d143adeb3
SSDeep	48:7lPKlSHDxjwEaooCwd9D8G2JPFFzM4vddVzvRTWKzaXDMTNqr:7ZySj5aDOJPFFg21noDMZqr
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG (Modified File)
Mime Type	application/octet-stream
File Size	20.10 KB
MD5	5279416b25ae6bc68d1320bd74272e43
SHA1	5c31af38d72fa0a79eb735a306b7d4d56790b1d2
SHA256	110a5089ef2d31a2dba6057c4999ef9a7acfa1427cc1f902b6b74bbc39941c61
SSDeep	384:fDGUXSA/t3JR9LlORPYXAcu11+0Fm5ABEcD2IgZf38p+T:fqqdJRj5K11rgABE6m9
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\REFINED.ELM

Modified File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\REFINED.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	45.76 KB
MD5	cbd245422b30a4213b5cfe7b0cfe2b63
SHA1	53b545771066248e3bee00dfb87664f782028809
SHA256	110e0d69145706f652d3a9ddab9757dabbc7801ca1c5bafc6969c34fd4c8d15a
SSDeep	768:G38YOTtUTn5FvTOAhC2LPtYu2XJkSeOwbgn/gOa5PA/F/z63iporWiaE:GupG3fLPux3eNoCIJwZ3aE
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\REFINED.INF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\REFINED.INF (Modified File)
Mime Type	application/octet-stream
File Size	1.57 KB
MD5	f729fba59fcd3cbedd848088c2821119
SHA1	a03432806551fc4b399aa413ee5bcbefe05a40a2
SHA256	0802e8c3149f329a035b4181abad03cf32e23948f482279a872c64656342b91b
SSDeep	24:7lOUfO7b2VoP+7BJOdCBlAAIGRX7VQcVhRL:7lVfKDILOABztpqcHRL
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG (Modified File)
Mime Type	application/octet-stream
File Size	16.37 KB
MD5	ec1e3fcfff20b5ea1fae95dea87c78df
SHA1	d39e1689791f086a6fb2a6cd7aa98ed492c9bb5f
SHA256	7ffc514fa2b3e7a68dea3bab8df4f83ad0c4a6103a85a39075d622a1410ae835
SSDeep	384:HhZjx87LcLekugHvZmzAidiP5jAh+/vcVyHfGnPxLDSNT:reLcqUPZmsiEPE/VyHfGnPx/6
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\PREVIEW.GIF (Modified File)
Mime Type	application/octet-stream
File Size	4.88 KB
MD5	17da2fab5c96a61ca20be741d8bbc9cc
SHA1	0aa4db97c67659a27e402a2003d4bcc0165f0956
SHA256	0197ca27f3a9b9c28b8eb184d97e038f5e308f0dd7ae0fbf75e687d0b0805bed
SSDeep	96:7FhLs1g7v+eSWMliaCau59+Mn3IwU8LWwXzjNWf2F:rLeqvxSWMOIQL1XzjNK2F
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\RICEPAPR.INF.cuba

Dropped File

Stream

Unknown

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\RICEPAPR.INF (Modified File)
Mime Type	application/octet-stream
File Size	1.56 KB
MD5	010f928f765ddc7511b3c55a301f5f9b
SHA1	09b73e83590b8ecb65d008e4b5b206c225129b16
SHA256	07c5b8f189adbd2f24df32de7a25590b74c951871e3e4e638b2a10d36f2341fc
SSDeep	24:7lbFWLnms4ihbaCUuo3O7Y3x5ly/f+ExA5sNxpnEplC3G6Y:7lbF5s/hGjECx5g/fVAkneiGL
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG.cuba

Dropped File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG (Modified File)
Mime Type	application/octet-stream
File Size	7.65 KB
MD5	b84aa5f0de34ca88c51ebbc00f53d33e
SHA1	e99cf254d80e5ad31c5c1ebd1e35c8fd9dfbf909
SHA256	2b671e1707e4f3fe8dbf0ee76281f946e8027acb3bda9e6dad7793ab8db5dba4
SSDeep	96:7Q8h6SRlvAwqC1bbJG6v9j8FBhZwfIqvd9GgIoVJWk1tT0JWjg3+hUJC4YyxZF5Z:wSv4s1bQFNyIo4kog3hACHy7F5mnvRw
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	592.86 KB
MD5	2ab27472f63a06aebc2948ac67884f01
SHA1	fc3d84e375e971d121b45680be13b00f16e81737
SHA256	0eb48951b46635f897c1003860f48be62136b08222e7b22fef1bbe651f6baaf8
SSDeep	12288:NKojwBhesFaeM/0eSuPqeGBOoFCWcBxGa3wajDwEbpme8v3/ngh3c2amRhI9ol:NKKwBhFaec0R/BOCCWO9rfwQIvvghMlm
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.86 KB
MD5	0c63a5f74a3e726172b1d92231ba1bce
SHA1	0a4bc14662270697af8365a1a438611e79b19bb3
SHA256	23ed1082c74f2c097b84455830c421c56e7251b5bd85a44dc08f9914c385fdf9
SSDeep	48:7lVA7p283P2H7rY4y1PlCgw+rgVTI+ONORzvtHDxcsa57E:7ju2GP2H/KPlCvMgV0XNClDx87E
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	15.71 KB
MD5	1a5f54807bd816ec39079b71236ba9f7
SHA1	1d870f29a1f30e1809a63552207eae504f22e9d9
SHA256	ac115fa4d4cd3cd9a9ac727ab9b4fa72578aeb5ad19568f01b39f5ad9a4604f8
SSDeep	192:A7UMo09BVZdXvGgRuWo+R1xF/yGlk1RH8V6hISgP7Vu5bcINgVBWwI982T1qC6qj:YhvdduL1WsbgDV0/iBDIlqmKgPlSDL0L
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	296.88 KB
MD5	f977de46f58268b3536f6cc2a5d8b475
SHA1	15988790e255f0ed8fbfc84f12081ce358f3554c
SHA256	3fdc894de765402c118e2a2378ab6f0659cc6d6a645e31a4c0cf3da8b0c26b97
SSDeep	6144:oT/Xg5l8FlCzYX7idhistBRWsoHoBVsI+F6qe4/TzIgZ6mb0kEH:q8lg0YLiXiJgB6Inq5rZ6S0kEH
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	3.24 KB
MD5	afca9546e7b3d042d93cb8b881bee81f
SHA1	c9bba0f85c3a195c4a7d8b23312eec2b7449dc8e
SHA256	b6a08a5ae3e474daf67d8807144e535aa3d5f43b6bad92a685913dbf9cc48d3a
SSDeep	96:70KRjICZEwJDDoJvxoW/wPg8Zl085WtWfl:nCi/eJvxal0QWU
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	5.17 KB
MD5	8936745d2f42316c32801333f32586bf
SHA1	e34f9d774385003242c136086436b94720c15584
SHA256	ecca304b2f8ac169ef45ba5531d2a543644339bb111820f6aab246f946c91d09
SSDeep	96:7c62vAkUfBop1SkoyRcaayb6wQ6+cPJCi0xOnTBt3ha4jcKt:I6STUfBo1Rf+NGCiRTB/lIKt
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.57 KB
MD5	6211ae6fed2f615abbf895cbd980bf66
SHA1	aa14e23f5b96d10052ae57c2a28b53f70379ce74
SHA256	d60b98ced8068f0e0cbd484be09550dc6c9b8de14b3b5f5d6fd23086fdb920eb
SSDeep	48:7l8ybCJGtFBjP0eMAZcHRSl+VTsFQ5qlBy6N0u7oyEzLg:7+EC4/5se1cxzUy6Ec
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	5.11 KB
MD5	2b98508fc9da3cd3619957de123edadf
SHA1	debbd3458e3296aa87da0bc7b456539697097dba
SHA256	ed42c689e042a9b76ea1ac0c690383ddc2021473ad47bd51dc82d367940fb42e
SSDeep	96:7dywyfPRkv2X0i9f9DUeGUVUKmSa2tTsSp251ZkYsDMTG:5XyfPRC5i9qeGU+KmSaATsr51ZkRv
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\pkeyconfig-office.xrm-ms

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\pkeyconfig-office.xrm-ms.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	700.06 KB
MD5	b66ec29e135bd5a7689076613e880970
SHA1	c720ae72bf9fb7698c18df7202cd88b19abefd04
SHA256	78cbfb565404877e78798b657a41c71b438ab9aec53b12285d253fbd965fa2d0
SSDeep	12288:eo15fiBcZB0flKsSsVKFSj+NZqqR6S1Q19oXXNt3ibSQ6PnYwPhLgBQV9OOJc2D0:eoXfiBcZB0NKs9KEj+NZVI6zZ+EhLkWU
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.42 KB
MD5	635d7a34a22be254be368fd4d5d9493e
SHA1	08b06d544f36fc337fdcba94de2da4545bb0faa9
SHA256	c180c599d61084a3aa28e58275ad7c88730e90f4ba50239ca032e89cafc83358
SSDeep	48:7lRjsjTbGg0Jvzf5MTKBnKU0QgIzPdqKF9GXkAW5GKmddwopan:7fsyzxj0DKzPnFEnWBmddNan
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.84 KB
MD5	3320d88c6336e89316cded736b636bb7
SHA1	1396c7d6c1315c6d3f2c535194acf58a13b5479f
SHA256	c8ddcfd7d647ca5039c374f5f725f7758361f1b69fb35014004b6eb3377f4648
SSDeep	48:7lzUKt046YtztxIl6Lgn0I075vU3bD5GILL1iYQp7vWYi2gRI5tb0:7Vo41xe6Eng5vKbtGGLQRORI5+
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.cuba

Dropped File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML (Modified File)
Mime Type	application/octet-stream
File Size	17.29 KB
MD5	fb75afa5d795319a0a13f0e4427a53f9
SHA1	8acdd5c5f8e7fe7e69bc44da5a36caadda0798ab
SHA256	15aa26473d3a1d66d836e2dd1b8d6b4acb3ad3c243e29c6cb6a91db5c9c0c4b7
SSDeep	384:Dntun8gCX+ySlgR2S4yp2DIa5Fd4Uo1POsr14cNpBm7SymM6vt:rk8UlsBp2DIaP4hrrJmud
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.cuba

Dropped File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML (Modified File)
Mime Type	application/octet-stream
File Size	2.83 KB
MD5	a41f0886be04d065028158bd01998691
SHA1	2419bf6e2b501597f8c32c408f4e54019a7b861f
SHA256	3249369d9322c7cb53deddfc7bb5b5a31841dd416148180884c4ecb09029a4be
SSDeep	48:7lXdctXzQmVAocV+iurPORaF8wYH/yzUUFXi8qB+JbUAGyXFG2:73ctUEAo6EC9UFGB+JQ2
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.cuba

Dropped File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML (Modified File)
Mime Type	application/octet-stream
File Size	6.75 KB
MD5	dbc4f41dcaba6cd436ba459667e16a8a
SHA1	177bd70168dad9f9d65c7f9914dd413ac448663d
SHA256	c1626977880e874b8dd6f1e7b468e7656f720f760b9e4b4967fbbf135520c744
SSDeep	192:xaAtAXML6CviNShzcciTHlS1Z8CeWS8AScSJiVavn:BL6CvIShuTFYOf8RcSaen
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	9.36 KB
MD5	abbfeb7299f11e6116d3036a48eec13f
SHA1	60ed10d90653122573021964aed1cd2b66da9a55
SHA256	35c284b763e82cf67717eb564a6a8a6248cc138efc27f9a96ac44266d594bf15
SSDeep	192:z2dIn2vY7aZHj8e8u/VJWwdGbeKbleblUYdnC/vk9c:6K2+8D8/wdGbeKBEUYlC/vT
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.cuba

Dropped File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT (Modified File)
Mime Type	application/octet-stream
File Size	1.13 MB
MD5	4b27b84d7ed25e020f20d4f5b2aa1c9b
SHA1	41203fba8e6dfc01e309e1dbfb11db6f9305616c
SHA256	97bff8850c363817b00e1d40fc5a278dc1f2ced5970b289b81420916496c60a7
SSDeep	24576:vX3q0z74Oy7FLJ7EWF+3G+SAmPLwgvR6JulorSAmGOyzIkB39uF:yRf7FLlbF+3x6LwGdEOyzI1
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\AFTRNOON.ELM

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\AFTRNOON.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	58.39 KB
MD5	e648d92d2a19cc9c30ceba6c849b1e24
SHA1	131cc87e420fca84b90988922e8111a842afad21
SHA256	1adee83116572adfec9f47aa046e8d3096ee71f94f633062b65c284092319cb7
SSDeep	1536:uFFuMYDqY21jQyrqRdfPQuElPtJtM97H6PwMNBn:qFJo21BrqHElPz+97aPth
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\PREVIEW.GIF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	3.13 KB
MD5	96c73ec6255b0dae46761518ade7eecd
SHA1	628b96b757f029ad962f5bfd9f8bd002046519d9
SHA256	32abfc612ddd5ecd26e695c200387511ee94e4e9811a3745d3cdc23ebaf7e8d6
SSDeep	48:7lDkd4HXezAapswDp8D/ejD6RPkqe8CuNPVD2/NeL6FiTGOlt2NU0WKlVRuIdPQV:7xu4HO0ws0bjcCWtqqhn2N3UIdPQV
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\BLUEPRNT.INF

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\BLUEPRNT.INF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.54 KB
MD5	6a8279459e189eb1b3d91aa279a55d44
SHA1	71545841e2d7fc9581f37fb404284a32082bf5ea
SHA256	41f98c8e6d954e556d17f13fe125645eff79f95319480b0757be7b849de8d2f9
SSDeep	24:7liSW1igUOI+o8yN1+zVaZgjhoN0YCBo80/KtfBt:7lx4DUOf6INh9Yyo80/Kt5t
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.cuba

Dropped File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG (Modified File)
Mime Type	application/octet-stream
File Size	27.76 KB
MD5	26dc620e1f8182999bb66dc0d9b842cd
SHA1	9a97b8d4cb41feb7799728f9b8e77d86c7435cde
SHA256	7e142fbb468349cf69a005a52791b34f62ed4ff9266b4edc46684119f2dac718
SSDeep	768:EVgr1R3TpHCyIh4VBLLT8yjzS/vOiXnXsS9Ng5ty7C7:EVMHpCBh43LjCrXsHty7C7
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	3.66 KB
MD5	7c01b6c73ad18803f79dad4a2a2b6894
SHA1	5c1f18d8505876af40eee89184cce8e3257e3016
SHA256	c06c47e37b2e26849f065d398210a7d39cbded4a4a944697ae1759c68043a529
SSDeep	48:7lyOK4y7EhTRUyc3aHiLvJYvXyFx9pqBmQmNx5PUcDPXlc6eY/Hpy0Pjv93GsWm7:7cjgjUyODQyb/hVUcDPpJjv93GsQjg
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\CAPSULES.ELM.cuba

Dropped File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\CAPSULES.ELM (Modified File)
Mime Type	application/octet-stream
File Size	57.43 KB
MD5	09bedac667f2d8a05d8d1f979665ca0e
SHA1	c702702cf6d5f00b39b68feffa261c20264b9edc
SHA256	939cc9feed5192e1496efc8cf45868e96a2bf77b6f73b4b11bbe58db206bee5f
SSDeep	1536:OuOWGD4DTpup9U9AUoDq8ui5HbM+sVLf8cLf1:fOhQp59lo+PiS+sVVLf1
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.ELM

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	54.52 KB
MD5	ec95974196b2e37f55e977ff29c6f58f
SHA1	3efffba093ad17846a12e399582596d7fcf0d19e
SHA256	791ce67f75e5152bf92b1c0b23db9123050282aa54f459dc7e4dbcbdf90cf91d
SSDeep	768:yFfp7iypm9Qobf8bOfDyaI0GTiDQ33QXCEVPmAuVOw771/V/SnRMRdIIjTX0WB:sfBTgobOfDyuTDQ33QXCTcut/SnScMDB
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\CONCRETE.ELM

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\CONCRETE.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	45.46 KB
MD5	97d1021d34655679dfc134a97ae6003a
SHA1	8adc02044c7a4cafb5fba5f821660adcd4a4b726
SHA256	f0595f4bc07a22d38c35ea0fc9c516d5cf1fc683e050ba0e61c644dfa93b0a8b
SSDeep	768:LdEjte79m6KH79VJdKd33qNHJpArXy5Lnn30ShNPv6LuyX4SVq/w:REBG9hKHhzdKg9JpArWnkqN3ifTKw
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\DEEPBLUE.INF

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\DEEPBLUE.INF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.56 KB
MD5	7d433b1e59673ec4aaaadd973a089025
SHA1	42558e29a04e3999a360c603b9b5534dca6b9b9d
SHA256	220f56bf8485824658aa7142f04a8df46937442621031ad0057665ee2e5e06ca
SSDeep	24:7lzjAbPqgjePzoCETjuA4wITsvG3RF0gVNtO3OoEsnTecs:7lzjAiP8TjvIT6WH0KsOnS2
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.cuba

Dropped File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG (Modified File)
Mime Type	application/octet-stream
File Size	33.50 KB
MD5	57dc254cba0a9698fdd66c987bde8a6e
SHA1	724bce8ca3cfb9f9e26d1028fd0bfaf1fa52dacf
SHA256	72dd03c22b43502a39b6c8c658dcdc5f9477107bc9861da16954abd340866666
SSDeep	768:aNPFU3qlwKdsN/OjHnfoJGhC2k8ukNB26gK:4FU3OjdsgjHfUGhs8ukr2ZK
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\ECHO.ELM

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\ECHO.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	45.20 KB
MD5	f492a1a033bdea6ff21e346329c35357
SHA1	1d22567a7ccbddc24ff3ad135e9761c6257d0404
SHA256	c0e685479f299b694f4cd6b4134135c5a678cf19cd1ae5b7e3e10bc3f92ccbe7
SSDeep	768:gVc1uORYTeD6aKHWmN5Llg1Cu4G/dfZj93lLl92Lf7ZqfwtMOwNjmz96YwGoKUjP:/RFSNN5LSoBG1L3pl9roaOu8JsjwHe
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	25.52 KB
MD5	35fa48476ceb02aab7b9dbbc04544637
SHA1	833964a310c4748389b9bb3be86f47e47e57b3b1
SHA256	61aced85751efc8127b712589560a10c91c68756c81cc8809097bebae36a691d
SSDeep	768:vWMk0nB0T0BYcOZo+1Ay8V2WxsfJ7D/2duGbLiwL:vyOBYch+myZWShGgwL
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.cuba

Dropped File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF (Modified File)
Mime Type	application/octet-stream
File Size	2.32 KB
MD5	9cff764e9e5692e6a717972a5d165da3
SHA1	267d9a56ee17265d0a977da94eecdceab277275e
SHA256	e795c5d8095de18dcc461c5b3bd4c70ff9e5c86928f62f83dabfd10987230dc5
SSDeep	48:7lfTjzA+4zcQfHevbVNTVxl2Kia5z9JjjTt7Jqfv11:7NfzUcQPevbVbxl3z9F9Q
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF.cuba

Dropped File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\PREVIEW.GIF (Modified File)
Mime Type	application/octet-stream
File Size	2.32 KB
MD5	1268e34e60bd4749622a0358d393e5e0
SHA1	82c41859edd02ffe82efe0c52c9e6d0c1229ba39
SHA256	167de8889761319eddd2161ea348b336e13e22e9c3d4c76e42971d251f7b131c
SSDeep	48:7l3KVTJD8AaW0Xl3WYt5Hl8DliyKqJGGZeifcveH7bj:7RDAatmM5ItKqJD9fgebv
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\EVRGREEN.INF.cuba

Dropped File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\EVRGREEN.INF (Modified File)
Mime Type	application/octet-stream
File Size	1.53 KB
MD5	542d24062e344fc98c505787e3a2efd0
SHA1	5f98d7b1e4e514c31ad20383db076bf55dd4d733
SHA256	4568fd50abb2bdd2d524274b58a85cbbfbf595dcb0bc0ce2f2dccb2b38ec62af
SSDeep	12:7lUidxd/XWpDLSNl0j5IjT8GebICPl8KEjSgR220vJzu5goVALGJH/iX0uwO7Omc:7ldxRGp46j5Q8G+qf12XvpYYIKX+oJK
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	6.00 KB
MD5	f0697a75b5fdb544ba35251443c83dff
SHA1	7196a87c8e73b73c5be9d5a24083f7267fb85ed3
SHA256	6b79902f2d2e9f159040b8f4f3bbb2c1f3199eedd432df0ca03b8fece8d02d4a
SSDeep	96:74NeXRrwHjp4MoEJgbcMYOCJzjS81B4ki89mbRacuECtCM8oBrfhH:MIXRrwu9sgbbCJzjI589mbVuEg8urJH
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\JOURNAL.ELM

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\JOURNAL.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	47.55 KB
MD5	ea721f0593fd468fa5b6f03b242207d4
SHA1	34706f6f79775d13b6f8b76fbf9a2cb10346451e
SHA256	7e15ec374bdefbc677600039d88fee222c726c7e43deea9f575a1a8a13f64951
SSDeep	768:3MyF+PY61Qmd2MpOnOR/rzQfjFrgj8tVcQWTjFYuZVHYqDQFZ+oGnskvZ3Z4hNCv:8a+PNGvGwORTzkZ4RQmFxQFZzBkvZ3ZL
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\JOURNAL.INF

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\JOURNAL.INF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.49 KB
MD5	57c15b03a6851196bb79391b471ccb99
SHA1	b6d667c6f1c7afc35b96619970d0c8c7c44a7846
SHA256	628b10c927dbca0a98959203b37c3eb40869ca353dfd381bf9d8895172cf338c
SSDeep	24:7lraRgPCE02PdNQQYAA5ek76ZQACQ73VIfSlrt3:7lraRgPf0SHQQtA76uACQpVh
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.20 KB
MD5	2d701f4994d3db21a2317a7f51abaacd
SHA1	410b9cb55629476ce933c06f919c61c442c01836
SHA256	b31ca50f17c434c0d27bb14801f4ad3c936ea86fd2b055f0d457672730e1df14
SSDeep	48:7ldXsHWMaS8sNZXBtDmMQ4BQsX1ybC5Upq:778zPHnXLDm5a8bC5U8
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.cuba

Dropped File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG (Modified File)
Mime Type	application/octet-stream
File Size	44.80 KB
MD5	6f0eb8ec2048aad2bd9e79e688cd8d85
SHA1	bc2acb509bf6c4f0f662cc8df51c9f52f95ea92a
SHA256	9781f5a09417345eaa230bdc3bafec9c2017ef26f685a70bc3a16a451d4b73cf
SSDeep	768:l6e1sTZwmUFf+faeVmks//3bD+ysqUrwe9N4vsaoMDplzESIaaq1Wz3Z:l6nTZwmm2R2//LD+5qMwe9oSMDfZaq1k
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\LEVEL.INF.cuba

Dropped File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\LEVEL.INF (Modified File)
Mime Type	application/octet-stream
File Size	1.51 KB
MD5	e6af1290182a576b7ea4409282bb5fe0
SHA1	e76a3101ba4de505eeca77e9553f9fb644a280fe
SHA256	978a7cae3b5805b97b71f98dc08f63484ab3d8bdb4af67986aab8e73a37f8bee
SSDeep	24:7l5umVuEQqtScifbe8J2NgaBVX+8ZOIIpxrN3dZ5yQ:7lYiuEQqt8ee4vb0pxrN3dl
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	47.99 KB
MD5	afdfae1a4d84298188b0988fd46e4d9a
SHA1	a2a276ddba80beea3a7819141c4bcf85867d2c5a
SHA256	0346651cc89dfc925edd3ee74f7d2d2255344a5b5dc59b8442c46ac01f2648a8
SSDeep	768:NoHXiPolswxbmbCOaQ1JAmDf/N8/1xHonpBi5C9fIyc+MXm0i:NYX02bm2OJwmz/N8d9on3zfI9+Mm
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PAPYRUS.INF.cuba

Dropped File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PAPYRUS.INF (Modified File)
Mime Type	application/octet-stream
File Size	1.49 KB
MD5	f061e3bc7b5068635666a0bc3b0b985d
SHA1	01b9de13e71c6c01a7d83b9c7708193608cd6b98
SHA256	3355a912dee471b28463f401241b280bce04bb35c9a319cff55a0f74629d6a66
SSDeep	24:7lr2/zPLoNpSRC5zRTFokyLFe1LDTtR09r2AHExOHm7zsRYzCXdl2:7lr2/zTISRCt1OF6Y9yAHa7zil2
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF.cuba

Dropped File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\PREVIEW.GIF (Modified File)
Mime Type	application/octet-stream
File Size	3.51 KB
MD5	2f26a8f2ef27dd5aa42076dd910c5172
SHA1	e53296450cbe940ecb1106c0482c8badd0c610df
SHA256	f9f0c5c3ca681233ed7235541271989b84eb947f4476edf3d1b197e9d6cb3859
SSDeep	96:7yLk9uD16vad8F+7D0rmP/Yphh6R+0kCS2:2Y9obh0ryEj6E0w2
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PROFILE.INF

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\PROFILE.INF.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.57 KB
MD5	585b2d0e4e333cb9e86261a038e0e460
SHA1	97c1c7361872f287f0622ed2906d9c1b2a6dd363
SHA256	68137f0147334551adb14cb1f80ba82d493ea3dec2b4c067f3482c90d4c82e61
SSDeep	24:7luKbVUK6Z9pMmCZ5G1xyP94vCZJ9hn4Dc9OkvTEjy4t0v69vKzMbiRDf:7luKZUK6ZwmW0Q79h4GQwoGRb
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG.cuba

Dropped File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG (Modified File)
Mime Type	application/octet-stream
File Size	37.24 KB
MD5	d2d59df3a1f0c0597d0308b94db9c8d0
SHA1	bdadba2da29bc0be2351a4f948624794cbba4e3a
SHA256	d9bff9ae1f4eaa2f1193e3418249deebcf585b54f1121ce7a5f6b5e3ec4eae3b
SSDeep	768:lslXC64+OR4/tM6XXzPZoU/plza2sFK469x0Gn/GgWxBrUVdoTdxGUnZ+MI:lslV4ZRyqwpvWV692GnFW3rUfoTdxGw0
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\RADIAL.ELM

Modified File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\RADIAL.ELM.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	46.84 KB
MD5	eee21ea495d2c42ad7b8024ce77efbfa
SHA1	e274f317c64687807617fdcc8d252cfb0f31e98d
SHA256	2003eba84932b9877ca8a9f5f0f4c5971b4210ebf041348e59011f08a71f6722
SSDeep	768:rGlPnodhS+Yb6YkWNfShGzEHYEWRHRMBfuZHrvDx5BwQpm72lf:rGl/odhS3OYDfykEYEsxMBiHrvNK6f
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF.cuba

Dropped File

Stream

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\PREVIEW.GIF (Modified File)
Mime Type	application/octet-stream
File Size	2.39 KB
MD5	c123d1852dc57975a2c0e2188045b4c3
SHA1	68541073074ba86e46e5aa49031719c6916ba753
SHA256	39f38aa9398309086d4266b28fbf70bf1ce093fbc44add95474f09690e61529f
SSDeep	48:7l2hZjp2sXWuX0goO+TwXCbandYhzph0ZmpuogjQYXw1st:7ij5OOdugYhzz0opupzw1st
ImpHash	-

\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\uk-UA\!!FAQ for Decryption!!.txt

Dropped File

Text

Not Queried

»

Also Known As	\\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\tr-TR\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\sl-SI\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Filters\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\DW\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\pt-PT\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\GRPHFLT\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\ro-RO\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\ja-JP\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\en-US\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\pl-PL\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\ar-SA\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\ru-RU\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\sv-SE\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\zh-CN\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\it-IT\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\de-DE\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\EQUATION\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\th-TH\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\el-GR\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\EURO\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Stationery\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Source Engine\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\DESIGNER\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\nb-NO\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\PROOF\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\sk-SK\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\nl-NL\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\da-DK\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\ko-KR\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\zh-TW\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\Help\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\MSInfo\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\EQUATION\1033\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\lt-LT\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\bg-BG\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\lv-LV\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\fi-FI\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\hu-HU\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\TextConv\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\hr-HR\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\es-ES\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\et-EE\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\pt-BR\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\he-IL\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\ink\fr-FR\!!FAQ for Decryption!!.txt (Dropped File) \\?\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\!!FAQ for Decryption!!.txt (Dropped File)
Mime Type	text/plain
File Size	462 Bytes
MD5	2d98abedc07579cb01fecd5f4b46a099
SHA1	b253443b779329404ba1168eadba0888e5893794
SHA256	feebfb5ad1b2a7c6c7f80d0a41313eb788b9d6087afcd2abc19fe947147c6afc
SSDeep	12:KzeYI4I82pIHM066v3VMcze1JpN25E8fDO:EdI4I8UID64qjkE8fDO
ImpHash	-

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After