46c8e192...aa93

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\update.exe

Sample File

Binary

Blacklisted

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\544c4f6e-08e8-406f-ae98-d88505d8a2e3\update.exe (Created File)
Mime Type	application/x-dosexec
File Size	449.50 KB
MD5	99d4feab94f7cda70110a1dc98f470d3
SHA1	6b5a3ac7431b51298107d7818f2c2cd126dd48fd
SHA256	46c8e192bb6e37452c1b8029987a7c05f64b7766ff692731b050c402d91baa93
SSDeep	6144:HpipZ4DRWlF6pYiPFWsj9O7yHfMi1toNccQ3opDQvbQiCDiexJgq:JiwWPi9WsjEYfNKO3j1CDV
ImpHash	5e769eecb01f420edb2b267bdad8de97

File Reputation Information

»

Severity	Blacklisted
First Seen	2018-11-17 18:34 (UTC+1)
Last Seen	2018-11-19 11:45 (UTC+1)
Names	Win32.Trojan.Gandcrab
Families	Gandcrab
Classification	Trojan

PE Information

»

Image Base	0x400000
Entry Point	0x40475e
Size Of Code	0x1c000
Size Of Initialized Data	0x7b600
File Type	executable
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2018-05-21 06:30:02+00:00

Version Information (4)

»

LegalCopyright	Copyright (C) 2018, aeyezsgisza
InternalName	asdgeprg
FileVersion	1.0.0.1
ProductVersion	1.0.0.1

Sections (4)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x1bf68	0x1c000	0x400	cnt_code, mem_execute, mem_read	6.61
.data	0x41d000	0x73b50	0x4ba00	0x1c400	cnt_initialized_data, mem_read, mem_write	5.2
.rsrc	0x491000	0x7108	0x7200	0x67e00	cnt_initialized_data, mem_read	5.11
.reloc	0x499000	0x1564	0x1600	0x6f000	cnt_initialized_data, mem_discardable, mem_read	5.65

Imports (4)

»

KERNEL32.dll (99)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCurrentDirectoryW	0x0	0x401008	0x1c550	0x1b950	0x1a8
FindFirstChangeNotificationA	0x0	0x40100c	0x1c554	0x1b954	0x11b
AddAtomA	0x0	0x401010	0x1c558	0x1b958	0x3
EnumTimeFormatsA	0x0	0x401014	0x1c55c	0x1b95c	0xfb
FindAtomA	0x0	0x401018	0x1c560	0x1b960	0x117
CloseHandle	0x0	0x40101c	0x1c564	0x1b964	0x43
ExitProcess	0x0	0x401020	0x1c568	0x1b968	0x104
GetTickCount	0x0	0x401024	0x1c56c	0x1b96c	0x266
GetSystemTime	0x0	0x401028	0x1c570	0x1b970	0x24d
GetModuleHandleW	0x0	0x40102c	0x1c574	0x1b974	0x1f9
GetCommProperties	0x0	0x401030	0x1c578	0x1b978	0x16c
GetThreadSelectorEntry	0x0	0x401034	0x1c57c	0x1b97c	0x263
GetCPInfo	0x0	0x401038	0x1c580	0x1b980	0x15b
GetSystemTimeAdjustment	0x0	0x40103c	0x1c584	0x1b984	0x24e
GetProcAddress	0x0	0x401040	0x1c588	0x1b988	0x220
GetLastError	0x0	0x401044	0x1c58c	0x1b98c	0x1e6
GlobalAlloc	0x0	0x401048	0x1c590	0x1b990	0x285
FatalExit	0x0	0x40104c	0x1c594	0x1b994	0x10d
SetLastError	0x0	0x401050	0x1c598	0x1b998	0x3ec
CompareStringW	0x0	0x401054	0x1c59c	0x1b99c	0x55
CompareStringA	0x0	0x401058	0x1c5a0	0x1b9a0	0x52
GetLocaleInfoW	0x0	0x40105c	0x1c5a4	0x1b9a4	0x1ea
HeapSize	0x0	0x401060	0x1c5a8	0x1b9a8	0x2a6
GetProcessHeap	0x0	0x401064	0x1c5ac	0x1b9ac	0x223
SetEndOfFile	0x0	0x401068	0x1c5b0	0x1b9b0	0x3cd
FlushFileBuffers	0x0	0x40106c	0x1c5b4	0x1b9b4	0x141
WriteConsoleW	0x0	0x401070	0x1c5b8	0x1b9b8	0x48c
GetConsoleOutputCP	0x0	0x401074	0x1c5bc	0x1b9bc	0x199
WriteConsoleA	0x0	0x401078	0x1c5c0	0x1b9c0	0x482
GetTimeZoneInformation	0x0	0x40107c	0x1c5c4	0x1b9c4	0x26b
LoadLibraryA	0x0	0x401080	0x1c5c8	0x1b9c8	0x2f1
WriteConsoleOutputCharacterA	0x0	0x401084	0x1c5cc	0x1b9cc	0x489
LocalFree	0x0	0x401088	0x1c5d0	0x1b9d0	0x2fd
InterlockedExchange	0x0	0x40108c	0x1c5d4	0x1b9d4	0x2bd
FreeLibrary	0x0	0x401090	0x1c5d8	0x1b9d8	0x14c
GetCommandLineA	0x0	0x401094	0x1c5dc	0x1b9dc	0x16f
GetStartupInfoA	0x0	0x401098	0x1c5e0	0x1b9e0	0x239
TerminateProcess	0x0	0x40109c	0x1c5e4	0x1b9e4	0x42d
GetCurrentProcess	0x0	0x4010a0	0x1c5e8	0x1b9e8	0x1a9
UnhandledExceptionFilter	0x0	0x4010a4	0x1c5ec	0x1b9ec	0x43e
SetUnhandledExceptionFilter	0x0	0x4010a8	0x1c5f0	0x1b9f0	0x415
IsDebuggerPresent	0x0	0x4010ac	0x1c5f4	0x1b9f4	0x2d1
HeapFree	0x0	0x4010b0	0x1c5f8	0x1b9f8	0x2a1
InterlockedIncrement	0x0	0x4010b4	0x1c5fc	0x1b9fc	0x2c0
InterlockedDecrement	0x0	0x4010b8	0x1c600	0x1ba00	0x2bc
GetACP	0x0	0x4010bc	0x1c604	0x1ba04	0x152
GetOEMCP	0x0	0x4010c0	0x1c608	0x1ba08	0x213
IsValidCodePage	0x0	0x4010c4	0x1c60c	0x1ba0c	0x2db
TlsGetValue	0x0	0x4010c8	0x1c610	0x1ba10	0x434
TlsAlloc	0x0	0x4010cc	0x1c614	0x1ba14	0x432
TlsSetValue	0x0	0x4010d0	0x1c618	0x1ba18	0x435
TlsFree	0x0	0x4010d4	0x1c61c	0x1ba1c	0x433
GetCurrentThreadId	0x0	0x4010d8	0x1c620	0x1ba20	0x1ad
GetCurrentThread	0x0	0x4010dc	0x1c624	0x1ba24	0x1ac
HeapAlloc	0x0	0x4010e0	0x1c628	0x1ba28	0x29d
EnterCriticalSection	0x0	0x4010e4	0x1c62c	0x1ba2c	0xd9
LeaveCriticalSection	0x0	0x4010e8	0x1c630	0x1ba30	0x2ef
SetHandleCount	0x0	0x4010ec	0x1c634	0x1ba34	0x3e8
GetStdHandle	0x0	0x4010f0	0x1c638	0x1ba38	0x23b
GetFileType	0x0	0x4010f4	0x1c63c	0x1ba3c	0x1d7
DeleteCriticalSection	0x0	0x4010f8	0x1c640	0x1ba40	0xbe
MultiByteToWideChar	0x0	0x4010fc	0x1c644	0x1ba44	0x31a
ReadFile	0x0	0x401100	0x1c648	0x1ba48	0x368
RtlUnwind	0x0	0x401104	0x1c64c	0x1ba4c	0x392
Sleep	0x0	0x401108	0x1c650	0x1ba50	0x421
WriteFile	0x0	0x40110c	0x1c654	0x1ba54	0x48d
GetModuleFileNameA	0x0	0x401110	0x1c658	0x1ba58	0x1f4
FreeEnvironmentStringsA	0x0	0x401114	0x1c65c	0x1ba5c	0x14a
GetEnvironmentStrings	0x0	0x401118	0x1c660	0x1ba60	0x1bf
FreeEnvironmentStringsW	0x0	0x40111c	0x1c664	0x1ba64	0x14b
WideCharToMultiByte	0x0	0x401120	0x1c668	0x1ba68	0x47a
GetEnvironmentStringsW	0x0	0x401124	0x1c66c	0x1ba6c	0x1c1
HeapCreate	0x0	0x401128	0x1c670	0x1ba70	0x29f
HeapDestroy	0x0	0x40112c	0x1c674	0x1ba74	0x2a0
VirtualFree	0x0	0x401130	0x1c678	0x1ba78	0x457
QueryPerformanceCounter	0x0	0x401134	0x1c67c	0x1ba7c	0x354
GetCurrentProcessId	0x0	0x401138	0x1c680	0x1ba80	0x1aa
GetSystemTimeAsFileTime	0x0	0x40113c	0x1c684	0x1ba84	0x24f
FatalAppExitA	0x0	0x401140	0x1c688	0x1ba88	0x10b
VirtualAlloc	0x0	0x401144	0x1c68c	0x1ba8c	0x454
HeapReAlloc	0x0	0x401148	0x1c690	0x1ba90	0x2a4
LCMapStringA	0x0	0x40114c	0x1c694	0x1ba94	0x2e1
LCMapStringW	0x0	0x401150	0x1c698	0x1ba98	0x2e3
GetStringTypeA	0x0	0x401154	0x1c69c	0x1ba9c	0x23d
GetStringTypeW	0x0	0x401158	0x1c6a0	0x1baa0	0x240
GetTimeFormatA	0x0	0x40115c	0x1c6a4	0x1baa4	0x268
GetDateFormatA	0x0	0x401160	0x1c6a8	0x1baa8	0x1ae
GetUserDefaultLCID	0x0	0x401164	0x1c6ac	0x1baac	0x26d
GetLocaleInfoA	0x0	0x401168	0x1c6b0	0x1bab0	0x1e8
EnumSystemLocalesA	0x0	0x40116c	0x1c6b4	0x1bab4	0xf8
IsValidLocale	0x0	0x401170	0x1c6b8	0x1bab8	0x2dd
SetFilePointer	0x0	0x401174	0x1c6bc	0x1babc	0x3df
GetConsoleCP	0x0	0x401178	0x1c6c0	0x1bac0	0x183
GetConsoleMode	0x0	0x40117c	0x1c6c4	0x1bac4	0x195
InitializeCriticalSectionAndSpinCount	0x0	0x401180	0x1c6c8	0x1bac8	0x2b5
SetStdHandle	0x0	0x401184	0x1c6cc	0x1bacc	0x3fc
CreateFileA	0x0	0x401188	0x1c6d0	0x1bad0	0x78
SetConsoleCtrlHandler	0x0	0x40118c	0x1c6d4	0x1bad4	0x3a7
SetEnvironmentVariableA	0x0	0x401190	0x1c6d8	0x1bad8	0x3d0

USER32.dll (11)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
PeekMessageA	0x0	0x4011a0	0x1c6e8	0x1bae8	0x21b
GetRawInputDeviceInfoA	0x0	0x4011a4	0x1c6ec	0x1baec	0x160
ScrollWindowEx	0x0	0x4011a8	0x1c6f0	0x1baf0	0x258
UpdateWindow	0x0	0x4011ac	0x1c6f4	0x1baf4	0x2e9
LoadIconW	0x0	0x4011b0	0x1c6f8	0x1baf8	0x1d7
GetNextDlgTabItem	0x0	0x4011b4	0x1c6fc	0x1bafc	0x153
GetMonitorInfoW	0x0	0x4011b8	0x1c700	0x1bb00	0x150
BeginPaint	0x0	0x4011bc	0x1c704	0x1bb04	0xe
GetParent	0x0	0x4011c0	0x1c708	0x1bb08	0x155
SetThreadDesktop	0x0	0x4011c4	0x1c70c	0x1bb0c	0x29d
LookupIconIdFromDirectory	0x0	0x4011c8	0x1c710	0x1bb10	0x1ea

ADVAPI32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ReportEventW	0x0	0x401000	0x1c548	0x1b948	0x289

MSIMG32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
TransparentBlt	0x0	0x401198	0x1c6e0	0x1bae0	0x3

Icons (1)

»

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\desktop.ini

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\desktop.ini.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.39 KB
MD5	573c4619283bea55f656418e7a47ef9e
SHA1	379b24e22bc849ea329b64b550e58ce04bfd7fc7
SHA256	55726745cfb18de18b1e5d3538663389b1dfb63e1e779af5c8714ff8806b6f1a
SSDeep	12:ilZ9RF+tHms0asc9uG8X09wgkvhHp6rD6QlJZd:il32hsPTX3gkpHiflJZd

C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat.INFOWAIT

Modified File

Stream

Unknown

»

Also Known As	C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	4.00 MB
MD5	edb32db28bde40a9b075f0d12bd406be
SHA1	a3cf38ad0f54b2bb2678ace2b6374ff01b551da8
SHA256	0562f6e831db7346b85e6445922a33af9f74116f3a8b0989de50af44277629ad
SSDeep	3072:OZhWeFD2G8ILChmRZ6hFg4RlqCJbiatNDXxAdZ1dfGZn3Gqa1ZH+p2I7dxz+tET:OZhSlSZSFJRl3BrDXxAdnIGqa1ZGz+

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.13 KB
MD5	8e6127837f2a4036b90fc231d50da1c6
SHA1	03e61efc62ad73289bde84dbc3b3787830442730
SHA256	932067b496f0085b72cfefe27eeae1f322a13d40527ac7724826795f109faf47
SSDeep	3:afwSkqOCAPkOfaO7dvjYPDz58Q0xz6vtkdzN9exub0Trzr7s:afwSkeMRRkPDz58dz6vtkhirw

C:\ProgramData\Microsoft Help\MS.GRAPH.14.1033.hxn

Modified File

Stream

Unknown

»

Also Known As	C:\ProgramData\Microsoft Help\MS.GRAPH.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.32 KB
MD5	c87b5630b7c3ee1f0392836961bb0bb0
SHA1	3bb7af6c1d663bd3b732b11aa94e3faaee6c058d
SHA256	a790e488e5b022f07458075bae29470b7eb097f8f0dd099f401e45caacf72306
SSDeep	6:gnGRZO9XioszlMvV0xzNPn2JXq3K9fNIamKpCiGSOxje0IAZLcjEWHSFmOltPR2:K+LlMvyxzNvm6aHIamKhYje0I8cAWHSO

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\desktop.ini

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\desktop.ini.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.39 KB
MD5	6f13f9a17e32b7ea7ecc13cce3c4cb03
SHA1	a195f790f49ff3b7bf2b8a4cff4719f033712c24
SHA256	3695731322c04a7865076febcc41955cf80dc77b456d4f97ac4e66d1270ebac6
SSDeep	12:ilZ9RF+tHms0asc9uG8X09f2kvhHp6rD6Qled:il32hsPTXtkpHifled

C:\Users\5p5NrGJn0jS HALPmcxz\Music\nvyg\U0AZd0ivGrf _Re 2c.mp3

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\nvyg\U0AZd0ivGrf _Re 2c.mp3.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	55.25 KB
MD5	8b5bfb556ac1b276766db5ec90771e6c
SHA1	fa87deb21ab7f30af37b9b7febc7a0be32339004
SHA256	529dd33fe0e56a110bbf4406e19f3b9a3faab00ff87d30cd23e65fc8cc9e7411
SSDeep	1536:CHyKFevRkuqybWXMjdEZqvylguWl07wT2pAFFSrlyDqZ:Memmi0EZqDVS7TuYyDe

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\hT-SqtZX\c4-yyhR.ods

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\hT-SqtZX\c4-yyhR.ods.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	85.10 KB
MD5	70085e0ff8d61ba37ddbe968f10364fe
SHA1	4633f3e6d090d2e1215af3bd14211107fa5d57ac
SHA256	e17765a605cf4c4a9ada67b3cc95f17be5e29b034f4248360b5a52206c4cd9cd
SSDeep	1536:4MAOukWUxy1DBV5i53F8zxhYPzVu03YIF8KWmhuKEaEKLVYojcO:RFuVBVk52+VDhFbWMuKE8YoV

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.13 KB
MD5	7df9521906640f9f933b5e70b0a054e7
SHA1	111554ed345b6fee98657c405a3c2d09a35431e9
SHA256	e4bdad8f42ac5b8a8fca4650b85c109f691c31a0876652c6dbe167dd284d3b1b
SSDeep	3:afwSkqOCAPkOfaO7dvjYPDz58Q0xz6vtkdzN9exub0SnHs:afwSkeMRRkPDz58dz6vtkhjM

C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	1.15 KB
MD5	223d6267f0d5f5d1b3e7187e186247b5
SHA1	9ba501a7cd2464e6bbab4f6261815cd61577d966
SHA256	57cd880b6013d5364e05222248c242251a34afd7eb40eee1df5c9baec1c823a6
SSDeep	24:ILozN0UmhL6Kusu9l0xqZAhf4+M2D+j8/q3Vy5nb4Lh:IgLkCX96hej8/q+nb4Lh

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\l8fJ\YeV-uPfMbHLLcGMe_f.odt

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\l8fJ\YeV-uPfMbHLLcGMe_f.odt.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	75.51 KB
MD5	9d86a757963431f62ed65ca6b2aff33c
SHA1	504a7f65ad899567368069bed6eb59ba9902af85
SHA256	2f26018960333efb6c08ddd1c371e59ea6adab7a04c257609c89ca7afa8f3bac
SSDeep	1536:cqd+hAJT+19H2EPjwl9imUtujyGIhsB315LYtT3EslCwZcxtrKet:fd+hT1VE9i5t4yGPYx3EwCwZutrK0

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\2qDES9yWeof3.wav

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\2qDES9yWeof3.wav.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	9.97 KB
MD5	56256c58270d95799b7cb9c4b5909b4b
SHA1	d0f5b6069bc9ea5d05ad12d6fef59aaca0a3b4ef
SHA256	30e567a0ced1635fa40c87828b72a998df442f5d34c05eee6f75a15c27f87211
SSDeep	192:DgWcOH+aWpVpXvu3zkAtB9Jwqq8323PqqtWxdJK3AjcF9mQAdkcm:kWRHf6Vw34An9Ju8uIXu9jGlm

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\skaVx\EoZDJddZ6evy.pptx

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\skaVx\EoZDJddZ6evy.pptx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	59.50 KB
MD5	4ebc9bb5e37285c0409369e65abcc957
SHA1	edc79f442793c2fb934ecefbdc2fb0c7e4f85c18
SHA256	151a0a0b4071841816c6b5e12379e01de4e86d350a399b29b9177d0be1d23919
SSDeep	1536:oxPecUSuxu7IAMhdzveNSaO5epGedpNp6XaoZN:Iuxu7IAMhdzveB9xdpNsd

C:\ProgramData\Microsoft Help\MS.OUTLOOK.DEV.14.1033.hxn

Modified File

Stream

Unknown

»

Also Known As	C:\ProgramData\Microsoft Help\MS.OUTLOOK.DEV.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.35 KB
MD5	6fb715b464aff6e49ddcd5dd751f5d6a
SHA1	b698130a3bed8b5ad15233d0d505d1bb5290d73c
SHA256	ae46538af467c5d029af5644ce0eeaed5f00d1de85c45e610976d669f7c720a3
SSDeep	6:gnvUEg6sbDtpJ6K7pD+ZifNHZnHjNQseFu0+VQ+DypUqwi92y1MeUqd1:K8Eg6sntpndiIFV2sezB+DJbi9V1qqd1

C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\zDJHX2UBtq2jNGLqtNRG.mp3

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\zDJHX2UBtq2jNGLqtNRG.mp3.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	47.75 KB
MD5	f921b641e6b27ab366b820ee6c4d5079
SHA1	0d98085940b9ade82e131443ad98fb39218470c2
SHA256	6ffc65fae22ca431396bb18a34c3c699db9eba70141eb8f5c87b8d222f9b010a
SSDeep	768:q0Uwzbxp2WgKcmiNYSnRwxOd9SnwEizX2UEQE0cZuoGcpgN47jKK6Su6Ye:lxbTZriNYSneObIzi9E04RGcX68Ye

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\I_5X.xlsx

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\I_5X.xlsx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	67.93 KB
MD5	af9a57eebb0bb5f0cf760743d390c3d8
SHA1	8312750d410f09d391ff4085e8c02ceada062319
SHA256	4465a041bc44b2d75979a485eb7fd8a25e9d6b6e7d103486907fb97119d29202
SSDeep	1536:6KsmNCbBhaPwCCRts4ogT0IZLes8ac9l6+kwTLlyN4Mix++F6V:1hQbBhKAUGT0YKsU9rBTL4/t

C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp

Modified File

Stream

Unknown

»

Also Known As	C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	10.00 MB
MD5	2ec3fdcfa2ed1287163b43cf36ab604a
SHA1	32d555ca6e4784a1f9109f7c0c622c1d30681b68
SHA256	0b29cca75fd26391ea614b2b12eb95fc37bbf80b63e7cda6857e3426f09f26bb
SSDeep	196608:C+vjzyOui6r+Qo4iT6YqQitS7+KgxUzGVw9vV+Ud5CP46ZjNK:FrN67xdBISxUzGVw7+YMggK

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\hT-SqtZX\U9tSiBmpae-S.ppt

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\hT-SqtZX\U9tSiBmpae-S.ppt.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	77.17 KB
MD5	b6be1b223d05269aa39da5fb8fbe1d3a
SHA1	991d9e2d3cd6c496ed9d09a8a320f4bc4485debf
SHA256	1de7893586d38a19157bcb70d890a673e3fbcf5d3173284a13f466b3e8468386
SSDeep	1536:n9FV37gTqP0y1f+dbK8fxteFA/ByKZGCjI9pkL9NiTTr84syBX7eV8:NgTqPB1fqbDxAApDNjb6rnjreV8

C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.28 KB
MD5	436b5c9eda5f59dd3ba6cb306e72ef19
SHA1	d159de7699ba26507f9ccdabd10a9af1085a591d
SHA256	0d69074af3649d15488c9a581c0636cafeaf1441cc4036f4967545e4214eeed0
SSDeep	6:Chp3bZ9tz20guqtHO7oxR+asti5K59q5GYigX1OPlL:ilZ9RF+tHms0astiA9uG8X09L

C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp

Modified File

Stream

Unknown

»

Also Known As	C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	246.00 KB
MD5	9c7a1894da76029cbf9ffc995c5bb62a
SHA1	71845d6e90551ed90521c31170d954b4d0f3041d
SHA256	7f35b49c07ebd864efcf8b1ca5c1c2a4d19fda69a6964df3e3c8c944a4594cc9
SSDeep	6144:EfexQRnQ3FKZ8tUOg90gLDIaNbyp8ElSRDVEB2cAFHxdvHPmA09/P6q5dA:EfDt8tPcIaNe8

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\ubh3Kx_A\_NTc8TO6LpPJ5zXjg.gif

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\ubh3Kx_A\_NTc8TO6LpPJ5zXjg.gif.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	83.08 KB
MD5	5563980f61c18a89f2f23f8133c18d65
SHA1	e9f6074211a015eee6be3a4f85f7c5349d34cb1c
SHA256	1ebf51bc9c44b14c6857bb244b84615ffc821f6ad95ac7a53e3c0f7a0f3d2f5f
SSDeep	1536:MGKwa3zn3h4YqeYwC05psbibrKvOeimjxXFerIhmCuk3oIA:MGCzn3KYfhC055udFVkIhHf3o5

C:\ProgramData\Microsoft Help\MS.INFOPATH.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.INFOPATH.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.34 KB
MD5	d014dde20e3ae271afc73170d993dcf8
SHA1	38576c28a4c7782fccb5184bb55d0a2af6a59e34
SHA256	a8dffba703b4612ec1ec3da3dabf07490deb326cfb30dcfe19c67a17e002a370
SSDeep	6:gn9p0BLjFu2LZGckH6WM9356uawQkCqvm2f7jDbDy8JImcI35mWTap:K9mBMuJksY9Nqvm2fPDbDBXnTap

C:\Windows\System32\drivers\etc\hosts

Modified File

Text

Not Queried

»

Mime Type	text/plain
File Size	7.92 KB
MD5	360d265eddea8679c434a205f7ade7ad
SHA1	e17d843f610e0283904e201195360525ae449a68
SHA256	5a1597c0d29dd475e33cd8889d7d848037a8c17bad0f3daa022fb889e0db7ead
SSDeep	96:vDZEurK9q3WlSyU0FXmGZll0TOHyF9fAHLmttA/ZKTKdIlMHqzoCGbXx:RrK9FU0FXmGZll06m9fAH6AhKTK9Cax

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\r7-FdG2eJ6-ET_j.doc

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\r7-FdG2eJ6-ET_j.doc.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	23.69 KB
MD5	9208d9048e1447774b512c3d2dfe0111
SHA1	d677d238cd417469e816a003affc770dfdcfa564
SHA256	2ab61c0c519bbcf8031721a7096836fdaad4f2af6e7cc976af1615716deea84d
SSDeep	384:1oFuLERcCJ9wO1Iz1sdSfdAEfUTCrHNcbZNHcYhLZH0FAksqVue6mBeCreTHUKQf:1oFIUZ2O1czCEfNcbZ5cYhLZLk8hmHlR

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.13 KB
MD5	89c6a97cd067a0ca538e17acac7a7563
SHA1	5aa3f2cde3d1f5f9aa4e4f65299d08c9e5186b9d
SHA256	586cb74ef5013973bb9775cd4c14c52cae76f336091e037d9ff96c5f9f3f54dc
SSDeep	3:afwSkqOCAPkOfaO7dvjYPDz58Q0xz6vtkdzN9exODqQKs:afwSkeMRRkPDz58dz6vtkhnd

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\desktop.ini

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\desktop.ini.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.21 KB
MD5	da6a43268d24113ab42bd68ff9a1cd37
SHA1	d0bb61453d0443ae1c50b7a028be7e4c89d778a1
SHA256	489c4c01842875dfc869795baaec0cf3cdcf77aef7b58af6db7a194e146340e0
SSDeep	3:roL5hucUG3nlBFZx9JJCUzKEETUbi+wVqDgU/FcZgIkHShlEMKynH0DfbY40+:Chp3bZ9bZoUG+19cZzkHSha4if847

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\ZEsdNS.jpg

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\ZEsdNS.jpg.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	27.63 KB
MD5	06b8c6b26bd8079d22afc99c5489fd46
SHA1	c794609ad41874e67b6e2d8c95cd16154522e783
SHA256	e8e8fd8ae12e6e5d171db13875f91adfc64c79f8fc73625cf2ae0c5315d021b2
SSDeep	768:UndHo1JSVUpa9w5psMr5uuQvQyB7GARXRIKc6v:i0SVmaFMr5uuQvNRhdc6v

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\hs9eu0cg_VHy7\shTUZEa.ppt

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\hs9eu0cg_VHy7\shTUZEa.ppt.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	58.94 KB
MD5	760c0a8fa3bf6cbc95d050d30def9ca0
SHA1	714746a8b8accec7404bfc9a18f18ed973bc7155
SHA256	b30d59cb361d0951e4aa063c82b5522a00a7138edcd681dd4d531cbc2299fc97
SSDeep	1536:QPnFgYhumDDx/TUyCCbpL+xJtEWkCs0l3Bs5LbfuCV:QvFgY88x/T5FEEWkL0hCtfd

C:\ProgramData\Microsoft Help\MS.SETLANG.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.SETLANG.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.33 KB
MD5	a627b84625714b4b311063fd4d1070e6
SHA1	ab25c8a0816b2fc8d873cbfb68ba6520427c5182
SHA256	93ce6f596e290e558cdad9f364dbe9266960d18837fc1b9be31cbdf838399e12
SSDeep	6:gnlmWgpdq78pROxKpbZq6SmGj7fdiGIdzjAz9Fz9zPk2n+8vNpSKbkm:KvwPp5Gj71iGI50xJ9zc2nzvNpJB

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.13 KB
MD5	8230430a05cf63da9268dee0a2b1f1c8
SHA1	3385f29007be055ef1811ffe3c8a38c3c51610a9
SHA256	f18180edb6796a812dc81e77d54d7c1a5ab4990718ea545f8d9bf755c216a160
SSDeep	3:afwSkqOCAPkOfaO7dvjYPDz58Q0xz6vtkdzN9exub0XWSHs:afwSkeMRRkPDz58dz6vtkhmW9

C:\ProgramData\Microsoft Help\MS.MSOUC.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.MSOUC.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.32 KB
MD5	1a3018299118e95db33c9c1dbe653ad0
SHA1	2f05213d2a13f7502ffa50ac2c77f9d9bb1c88ae
SHA256	79a220102359dba6ab8fb6e6d82859225af3e2353145cd9f6574f99ddca01325
SSDeep	6:gnG8ABxaw2UtohMvV0xzNPn2JXq3K9fNIamKpCiGSOxje0IAZLcjEWHSFmOltPR2:KKWNMvyxzNvm6aHIamKhYje0I8cAWHSO

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\QaUjhe\8q988doXb.png

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\QaUjhe\8q988doXb.png.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	60.05 KB
MD5	2d3b9ea8f22c5afbeed5c81a3c9a222b
SHA1	14db5bf44b1a81675cfa8ffdb4899002d3eb9ebb
SHA256	2e338af6734aac0a84fc68da62bacaab3aef91f72cecbb0675cf2707439e893b
SSDeep	1536:ybGFjShz67uVXxOaITJHGq06dVqpMz50EKrAyswR:ybGizmuVX+NGqVqy3xY

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\fpsQYKF MOi0MA.flv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\fpsQYKF MOi0MA.flv.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	2.33 KB
MD5	3bf92e6642fc5eae1019c3b7e30f15ff
SHA1	6319fe4404de5d20e8e528620e625d5f307f6598
SHA256	36da7558173e970b8b66d76c686a0b5fb10ed07e12e1fe5f6c251569d21243c9
SSDeep	48:gpqk2cw+R1OkVVKawB6OycrElautUCg+oaU8tmSC4DEAO0mv2/3/9d74:g3nOSxSru+Kw8tB9E9+/3nk

C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.51 KB
MD5	d5e80eef3f50fb317b6eed39ea0aee8a
SHA1	637b72b3ae9fa509e8e30f2d7ffae40eaf73efbf
SHA256	0aa3a0e5032b595baaef93c36660b8569ce2a626524e505dfca9a692257863f8
SSDeep	12:ilZ9RF+tHms0a8T3NxnmUYq409jxdnr0KGhKS9P1x2hc4vv:il32h8TTz4GdngfP10hcSv

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\8ctUF06 2SC36xX7cR0\luqHM\l7-qaXxV0q.gif

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\8ctUF06 2SC36xX7cR0\luqHM\l7-qaXxV0q.gif.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	62.68 KB
MD5	7b60e5d3d38102d37b187b36f5eae790
SHA1	1afc20dd713d42d8f35d0e853c2511c081df8df8
SHA256	86a7f917c431d4f56cb3e6aaed9af459250bba4ab48c34d2616ed019ead47245
SSDeep	1536:cPeqW/YTJzS5NiLCu3JfCPicHaU/YQykTXceDddh2j6JqI6jlONP:cWq5wPiL15fOVaUfbR6mgzhyP

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\hs9eu0cg_VHy7\d8R9rMlCN.odp

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\hs9eu0cg_VHy7\d8R9rMlCN.odp.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	9.12 KB
MD5	e5c025a52b3cf3cbf116bd55d68f988c
SHA1	00873e6b62bc2422bc7286bb4fcb4f033ed86d66
SHA256	2dd07a7566d0377e0ea9729acfac6fae99dbd51e1b2102865fefe3766d8690b4
SSDeep	192:DfupTqMR3mNUImyQPfTsku+/f5qwXnJ7EUR/aSMdqwlVrI1Wl:TVMR3mNUImyYTsNkAUVXalV81Wl

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml

Modified File

Text

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml.INFOWAIT (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\www.google[1].xml (Modified File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\www.google[1].xml.INFOWAIT (Created File)
Mime Type	text/plain
File Size	0.01 KB
MD5	b7fc855b4810f0d20cfa328da83e22ef
SHA1	c04d8472b055c9e2d6cc47b7242b303a57393187
SHA256	0bceee388ddc1eac759296c53c33570937da6e04f4b0c4eb745f1f3be69deac6
SSDeep	3:MyE:zE

C:\Users\5p5NrGJn0jS HALPmcxz\Links\Downloads.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Links\Downloads.lnk.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.91 KB
MD5	4c6ab99642f36538a6273507c1c7d03b
SHA1	66dd79c17ab4a1497e826a1653c3c31b66a0cea7
SHA256	9412f1062553ac3914a021db700eb5c6d131cf1b8f7444a37a6eaf8ea51df49d
SSDeep	24:p3GQ6mbEp/NwPxcu3isE2uAZGtrgwabg9:pWCW/NqxcZp9AAJF

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\FLEcvhR.xls

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\FLEcvhR.xls.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	68.37 KB
MD5	165ed90e7cbe51ed69fd68ebcce5a23f
SHA1	d880fe9d067fd8ede6467be4da7e5db02e6b3ce6
SHA256	e1525ae5c14c46d7680565aa5b1400a202f4f3c18c115832e2e22f79f63fb5f1
SSDeep	1536:LHsNH/6zJqUDqe3nXjjY2Q/eGE1vEbHEh3vVABcqp+q8F:TsB/6qUDtnE/eGmukh/VABzxk

C:\Users\5p5NrGJn0jS HALPmcxz\Music\nvyg\5Lx3KHr.mp3

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\nvyg\5Lx3KHr.mp3.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	69.14 KB
MD5	dc09071a8e469163629b7fb6a13959ba
SHA1	5be9a2724f0ec1c592e21bb9a325a0d3bcfd314c
SHA256	37ed08445a0f44154eddedf49178acc0e9683d0a0de1e638a9f27935b8f20138
SSDeep	1536:o6e2unE3c6HqZgcM+nj4jD8VIzf6XwwTkKNY0hrM4GLVDNiY6:o6nsVgr+nk8y8TkugnVYB

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.23 KB
MD5	866ab23c3a31ccc2a21033f862b0d8e5
SHA1	706d94bc254e8b3b3269ecdc85cb0aee26ba4025
SHA256	1796d73aa9ea7b3552c0b74fceb677954bbf2aef7e580a0a503332d7b7490051
SSDeep	6:afwSkeMRRkPEUKwKTrWe7MjHEmx76XP3YJApF1AKTcN2ONWareNb:qx0HkMUKLWhjHEEmXwOpUKQNRfr0b

C:\ProgramData\Microsoft Help\MS.POWERPNT.DEV.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.POWERPNT.DEV.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.36 KB
MD5	3e8e251a76f604d18454de05d436de11
SHA1	8efbf0b90d15192ba7299e07a04d6f8f99b30364
SHA256	21e0094523482ba5701f6ca4177c267c935505e945ccf87b4c8c09e4af688106
SSDeep	6:gnpdHCGmROG4AuReiwuBgeAU3DyY2a4ZRAuyR/CQPz7SzPuu9DzFfLCr:KpdHCjYG4IMBT72awRLsZKPuiz5c

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.13 KB
MD5	19e0777d0d1cc57863e57a9a9ea704d8
SHA1	cc87b36707b5736a9e49cbc52c6c36b805683adf
SHA256	9fef96aba45269a95fc803bd2539960ebb0a798d1af016d3576564ccd7620103
SSDeep	3:afwSkqOCAPkOfaO7dvjYPDz58Q0xz6vtkdzN9exub0cSWszr7s:afwSkeMRRkPDz58dz6vtkhsclSM

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\skaVx\4xdI4OMOFBx3cqRfxwA0.xlsx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\skaVx\4xdI4OMOFBx3cqRfxwA0.xlsx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	43.21 KB
MD5	93c8c11216be79b0db9015d1df7b534d
SHA1	f4b358aad1855d1545b8b4f0b3e555fccd7dd463
SHA256	ed17bfb7180e3b03b9ef95a65e23d328d5a23d4bd794dbe3d25b1faae173e799
SSDeep	768:6LO50uCUBQcE7i36+l+FW/tbITwjU4XgG7e9v35Q03bzU76P6sp8bKdOmP/+gplA:6LO50PUB67iJ+08wze3Hcxsp8bIX5lA

C:\ProgramData\Microsoft Help\MS.WINWORD.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.WINWORD.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.33 KB
MD5	cf49eea4ad5e38250e45a3c772051bda
SHA1	152bbe66e5974b625c76434ca62a42bbdf08b091
SHA256	ecf86183341598c6216050d88d1e5e0f3dd112cf6f4a9e9cd2e2724a7379d1f3
SSDeep	6:gnl5BV58u8HZthnFmxKpbZq6SmGj7fdiGIdzjAz9Fz9zPk2n+8vNpSKbkm:Kf5Snp5Gj71iGI50xJ9zc2nzvNpJB

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.49 KB
MD5	cd9b253f57aec6718a63f6cb1cccf4ad
SHA1	7735b4c1c3bd3cc059d1ca8f144c0f21de6a3e0a
SHA256	2a255b315f7980bd5191f91e7d9505e2cf3ab241184f6899dfd99439f5029711
SSDeep	12:ilZ9RF+tHms0asKmkNKZK0Le+qYGRO6Pc1q3NEWSw:il32hsVU0iHcs3WWz

C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.Lck.INFOWAIT

Modified File

Text

Not Queried

»

Also Known As	C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.Lck.INFOWAIT (Created File)
Mime Type	text/plain
File Size	0.00 KB
MD5	62844323a4b7d96693287ba03fc234c6
SHA1	3f511685ef8fb140118aa10c1c43e026a2262443
SHA256	c4fb81f5bf1132f2df6094aa4094ecf05b750c041086477aa839738c73449fb7
SSDeep	3:5n:5

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\BflhCY_h.mp4

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\BflhCY_h.mp4.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	24.26 KB
MD5	8225e00e8e78c5c04819343bdd20ded1
SHA1	01deaaa100a6a3bbdb56d17470129b509d0f530d
SHA256	d35a7b46521b71257fc32490ddf2516f35f9c87c6dd518955b2cd28416337332
SSDeep	768:RtQ/D8aW/7ebNqCjx7Pk+llTqRsD+wdj48ADRAZ:RtQ/D8anqCj5c+7qWRp48AyZ

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.13 KB
MD5	7e4be9e940bb241fbf0e950fde52eac7
SHA1	8d6e61ae3717b0d6e0a94351d3e9806ce2f77fed
SHA256	82bb6e6b8d597dabd23028c6c8f0c85b8c2d87a147171734e613d202a3c6bcad
SSDeep	3:afwSkqOCAPkOfaO7dvjYPDz58Q0xz6vtkdzN9exOZrWbV:afwSkeMRRkPDz58dz6vtkhlra

C:\ProgramData\Microsoft Help\MS.OUTLOOK.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.OUTLOOK.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.33 KB
MD5	8a1f7b069d3715df19de5b70757acce3
SHA1	853b41df1029a0e852d58353ae6601a42e391af8
SHA256	c65bb0ae210df9f0b2674d4a873d7e6b4e2027b906d01fcd2588754d7b83332d
SSDeep	6:gnl9sTD/LDFtuJIxKpbZq6SmGj7fdiGIdzjAz9Fz9zPk2n+8vNpSKbkm:K0TLdgJ1p5Gj71iGI50xJ9zc2nzvNpJB

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\xsTHwcnuDqWQ9Jfwv\5NOeuuWGic W5vSvZ.png

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\xsTHwcnuDqWQ9Jfwv\5NOeuuWGic W5vSvZ.png.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	18.90 KB
MD5	e70878281a0c7eec509c4fdf958b2bbd
SHA1	7d2068e22345fce77f6b47c736daed8753cd2864
SHA256	70e7983a81a1402255111bd49aab691ad21120106b5bb5f53160e35e4e905f3b
SSDeep	384:ZNVXyvvYe0my70yMvz31jOkRR5lx1vrnG24mF7I04uGL/E9T:VivvYnmmMvzZOkRjImdsuGL/K

C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.H1D.INFOWAIT

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.H1D.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	14.32 KB
MD5	de4e862f03283db89bceedf31cb9d1ba
SHA1	f0d299cf47776903a06c1cd9b1b31ebc6dc0af3c
SHA256	1182b0e64da6b505ca97335bdfcc3c610bd01418d67d86373021970bd2f6d817
SSDeep	384:pIAWVh37e0ZIMl2t7ne38gF7ysx9TGSEn61FoD19gpYXMzh0s:lWr37qMWe38wDxUwg192as

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\rsqxo_hm.pptx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\rsqxo_hm.pptx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	23.62 KB
MD5	635596f110d9668745eff4ee6c06154f
SHA1	5acb9ec6b405705c46b3534b1c4562781919a97c
SHA256	c6abc4ee70b1fcd581981a810cd637b9dad90fc951798c3e01cac053d3ea1f7e
SSDeep	384:of3hi+NcRYJNvOOjp6Md6IrYJ6fWG3x0GhiGk8pIR/sVNACcQblwhdJifwrt6BjD:ofjNcRYJtOap6I6lYOG3GGsGk8pqU7yM

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\86iUKOznOtmWr4FTVK.xlsx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\86iUKOznOtmWr4FTVK.xlsx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	83.35 KB
MD5	f6e2035013a6b9ece80c91c81efaf98f
SHA1	e679ecfff167d0fa0c89c8dee2b4f3274f50bfd0
SHA256	b73a93d5fff5aaa9475aab9986ffd501e345b5df3ba96803c9b0f985788185d7
SSDeep	1536:6wgPy4gBNC+14b/iOcZN5JRZ4WQ3a78DFTRdTcu7dWJR5Bznnk:YPy4WNC+8qOiPJRZ4WQhDXdTciWJRzI

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.13 KB
MD5	2f10f67b16694d563570958de876db96
SHA1	6810e6f8a68c6c07483513a985e2c94b5dbc166e
SHA256	7789491a2c7d614364d16615a3d7888f12a6c28efb66ea36355a73b868bd0cfc
SSDeep	3:afwSkqOCAPkOfaO7dvjYPDz58Q0xz6vtkdzN9exOBPs:afwSkeMRRkPDz58dz6vtkhu

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\xsTHwcnuDqWQ9Jfwv\RCe6gFP9n8QcDK.gif

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\xsTHwcnuDqWQ9Jfwv\RCe6gFP9n8QcDK.gif.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	37.10 KB
MD5	0282303f4d4c72d2041074c471323c5e
SHA1	9adb8261fd40d33610f3e8bbe9a8dc994384e973
SHA256	e7e084352cab1e538fde425703f274327edc487aeb8a7000f568e2bc187a04c7
SSDeep	768:CTybEFNB5ayT+xXBASkqGp3KE0tV7/6TW/AS3wdWeirY7r0:CTpHTEBa/1aVvwdhr0

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\SNwh\2L5Mp4CJ.ods

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\SNwh\2L5Mp4CJ.ods.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	54.44 KB
MD5	8964107e84cd6c58c0f06c47edf65a53
SHA1	b7a53ad9547272f28514f7d5836cdadf6d4423e2
SHA256	c491399f98685e43b0a09b0143fc811bfa8c1700ba91d00b6049840f7da37341
SSDeep	1536:gBIlQE6vdGqnI+ODT9L/SG+y2YCMzGI9/GH:AIR6vd/nfg/cy2YvCS/GH

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\wlnli51d9s.mp3

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\wlnli51d9s.mp3.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	51.54 KB
MD5	32f4f75017db4e9958956982db892ba5
SHA1	9876ad92dd7feaed95f8b67f556f65bc11670ffd
SHA256	dde02e9ae4e7d3788dc8c53a1b0aef1139f1e09452368b797d93d5c251b53445
SSDeep	768:fMdGUhBvWIzWAoTlwG/UZG2uZtvfF6bLRT7gPRQ3W7//twnrDSEWLx:fMdLGuo6G8kp96bKPB7dwn6VLx

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\CZRVI9TRu5syJMCnyOV.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\CZRVI9TRu5syJMCnyOV.wav.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	96.70 KB
MD5	f0463f1d6d848bb95bc05d80497baeaf
SHA1	c0ac81fb8da8757009e4ffb5286d30a525daacac
SHA256	5619dd0fc57de3d08fbba7aae814ec31febc90c8b92a89c801de95b22f264140
SSDeep	3072:32W73k16R3jfBmUJ0xGBhQ+ILYelVKM0voA3PmoQgIQj3:GWb06iUJ0xGBPILYcVKM6E43

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\qRUUXSSNmlOJdjR 6U.flv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\qRUUXSSNmlOJdjR 6U.flv.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	22.17 KB
MD5	fb8240c0296445b21905895c2fe144ff
SHA1	41b531f2bdb1dc4165f53eeb447b8caaba2bc8bf
SHA256	d2e080894adab1c1ecc9c575acc494ff7fbf7f4c9019ddeff84fefeef832c484
SSDeep	384:g2ZGKbB2SMNiM2nUDOqH8VsGBw+rWNfIgtDWGSPm7BMQ07Zaj0KOhtp8ndXCFfJp:wKlR+p6UDnH0s4zgtEO7B4k0KO/p8nd0

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\r0_POyzPZT.pptx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\r0_POyzPZT.pptx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	77.23 KB
MD5	fb8916b65dacb440e199a1fa18629213
SHA1	42dbe34ccfd73f67f690fd6bb37e56eb8f4caa6a
SHA256	da968741cf87fac484f10a6ba2bc538c19dc46a4a6cb5020a8c968b9eee1c0b1
SSDeep	1536:oI7ZPVxgmxAM/8DVpOx2bG6n/N0u2MnESde1fDT5RhxvjxbvxewmKXs2C:vZtxxt/YVidgFKMnncfn5Rr7FgwznC

C:\ProgramData\Microsoft Help\MS.GROOVE.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.GROOVE.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.32 KB
MD5	fa3affca4a7a54c9902a8b557bd6363d
SHA1	218b9b2196a5f338380442ab8844120e9bb45c00
SHA256	a64ea930cafd2114240322b1619d342783ed93af022c0183ab1af7080dbad156
SSDeep	6:gnOfc7i7YHffBRt0t2bm3PA++eipFPMszjVftQGaWP2TU5S9l0rPpNa:KOf9grVbIN+TpFPMszJfiGJoU5M0Lva

C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\XRQKbLhwuLoes9nMF eV.m4a

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\XRQKbLhwuLoes9nMF eV.m4a.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	80.65 KB
MD5	f41329825d86dd23949b152f9120cfe6
SHA1	cedcddd4d7940e2ae597e1b36bd33e54a283f6c9
SHA256	181dba1a31fd1b332691de7c2a88aa399d2985e5a432300bf06984277940f2df
SSDeep	1536:f6wmFvxFaVO6yvDTp75DGdnn+sLIiK8XHtFkRGg5/a4nhj5yrb:Zmlfai7Tp75+nn+sLM6HtFw5/aM5yrb

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\unlt.docx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\unlt.docx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	17.46 KB
MD5	0ea13b9e1889ed7fd9ca14869c455665
SHA1	2e7741cdfc2474be1c08dc0421b03381a40e42ad
SHA256	8d7f42fc81358abc70aef5c435fcd006fe97798ec4e10942c5ca6752a2db5082
SSDeep	384:L4AAQif/LyQj6lOTTajBxYYZYgM0UperSlW0hf4cu+ttyHu4f3Au:LsVtai0w3U1cuRou

C:\Users\5p5NrGJn0jS HALPmcxz\Music\_ERMKi.m4a

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\_ERMKi.m4a.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	2.62 KB
MD5	1f8f970c2fbce0d0fd18d0dc7dd64f5b
SHA1	f86f31453bddfbaeef88f456df83c08b8d8b9e90
SHA256	33c31cc947e9b924cdbcf78fd16aafe34319d4379c418fcd0b3a3b7bf4769d7c
SSDeep	48:z13Dtp62PjE5ent0vk8h2EmNQ9cKQH7ZK3wca5f+gvS5:z1vE5XZTGd7Kwc0f+sS5

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\P-MyT-xFsgCgO.m4a

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\P-MyT-xFsgCgO.m4a.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	27.16 KB
MD5	cbaea3eaa65abcc118e94a81281d11dc
SHA1	ca3452ad6f0c5d91a2a94e340a660f04ff74f164
SHA256	c95569ebfab63b9a9f954ab003a54fe8f8514d115869c47c216efc6db8e87062
SSDeep	768:RY9Ft5/gRyUsU+oz37aRSB2x88gkEM8DUwpd7eSmIHq4cxK6z:u7SIsz37asAxbqvDUwpXmELcxKM

C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q.INFOWAIT

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	852.77 KB
MD5	5300899e6d9a7f1ade9d4935bcd6c084
SHA1	028559db4ae2abc85b24ad4074965cc3649df898
SHA256	9de290428bcdf0eab7672e4c7e76647ef957fb1bfc64afa8c1e0d5e374c0ac8d
SSDeep	12288:jL36lpuntP6ZWH72qVt5XpG+qx1IiFayg90euNM1JU7pPzDj9aNEJrM:jL3NJaqVzXpG+qx10vwcJKPJKEJ

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.13 KB
MD5	9a341727a24e448453308654730c46df
SHA1	e7b1705ed7ea801c4f5e18f76a948596b7696870
SHA256	73c156345fff55f945105e5f941e8f51207e2e81bdacf30f43acc2ca694b98c2
SSDeep	3:afwSkqOCAPkOfaO7dvjYPDz58Q0xz6vtkdzN9exubiOn8us:afwSkeMRRkPDz58dz6vtkhVn8R

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\Kgbiq-5bFu_gdXcNS.csv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\Kgbiq-5bFu_gdXcNS.csv.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	36.04 KB
MD5	f4085234805dff5f1b1569b7c34984b3
SHA1	ee20fd4691b683e75874cf0698bb1af140f75fa9
SHA256	582c2775b85a0aa9e3d1bd686196c99993d4da8fe8dc6d4f46e15e4207d1bb5c
SSDeep	768:e4W72LF8MaVgwJf+uttuB+fPeJ1KtcP+5DQ4Yk:e4WE8dizuSBwRI+5DQ4Yk

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Yvz8Ck.xls

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Yvz8Ck.xls.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	41.66 KB
MD5	503a7251d6959daf79067ee4e55fec08
SHA1	a3fe43f8b8351cb3d7eda8ec2ff6b0607cbecf2d
SHA256	5a93f177afce0bd3035078d1c9cede199d6e08bf6cde663cfd3ed823fb87fa98
SSDeep	768:/VNk1VIdbFKhbmFKxszyXNnnx/CwHH6tHSKWgOYqTwYFkwCRfHI4v0:/Q1qdbYhiS9nx7HWyuOYWzrCRPT0

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\q93T.avi

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\q93T.avi.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	22.21 KB
MD5	14011ffc8785fae49320350518b9d947
SHA1	0bb432a8889ea525007210dd1b992d76ab3bf4e6
SHA256	e4d44be7ecfc7a93ea68e371befc08eff2aea1690d845debb9d27782378cef1b
SSDeep	384:75zQo14gVyoYaMxGKdNg3YtwHFnZj+nUIxhM3Qc2GIJ4rEtg7izN76LP:758oCkYaMxGKne2gg+QcXy4B

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\O89VrUgck0WGUK_Y\g1B3M3.avi

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\O89VrUgck0WGUK_Y\g1B3M3.avi.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	92.32 KB
MD5	fedb48a3914425825b9d1b4c20b32f75
SHA1	029f47447f579469a2a4dcc46ea19f2ff69e3986
SHA256	34b1219c81d2470513d279929699b53b7c9629decf9209b0a951e630b28dd960
SSDeep	1536:ymBjOL8tRyrAGPswu2M54muunGGPacb019r5kYGAdQO9WYpl:zjO4yAGPs72M54mUce56ACO9xj

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.13 KB
MD5	d9dac31e811d04eb99ccf1baf197380e
SHA1	21f6e20e0e6608ab702b3f38e307fd5ac81c01f1
SHA256	6f3ee2bfe7e8973e882bc87d1fa579f66f0030447f26f1e1e4bfa85c4b53c7a8
SSDeep	3:afwSkqOCAPkOfaO7dvjYPDz58Q0xz6vtkdzN9exO1r8+7s:afwSkeMRRkPDz58dz6vtkhy

C:\Users\5p5NrGJn0jS HALPmcxz\Music\VmQaguirc.mp3

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\VmQaguirc.mp3.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	41.57 KB
MD5	880110920437c422909509dd47cfa7d4
SHA1	a27e340cebd03fb6b1001b83b0899a706bef9158
SHA256	e524ac385003b50ebe00f13ca06a4efd705128821f1a791013532ec91b73e9b5
SSDeep	768:f6b26s4QMuWwlV6lprbmBZyeHwOvkEzySjHT79CqXw2t8WILYlo5vubVBz6:f6b21hMmVgwZymJxjFCqA2t8WILYYCr+

C:\Users\5p5NrGJn0jS HALPmcxz\Music\nvyg\pkWtVne.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\nvyg\pkWtVne.wav.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	18.28 KB
MD5	5b56e7c482c5cf791e37b69a23e65b44
SHA1	e066f6af69e674e8c37a831e6d004e4585eef19a
SHA256	fd1dd07f6c30232cb63a54a99b771aa70839639d37d354a63b49f8434c546fb3
SSDeep	384:nKGNczUEFG1dtZzplwtV1U3jFO0jSIZ+nsU6pudsVTYavoIcEHpcOFi:KGNctITpGt3U3RBjSwosZpudQQIcEH+/

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\hs9eu0cg_VHy7\pplpY8py2zNIuuEmOh7.pptx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\hs9eu0cg_VHy7\pplpY8py2zNIuuEmOh7.pptx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	90.19 KB
MD5	58a8b00a4b6c9ad2c79f080033995752
SHA1	86a474f54583efcf8589382bb8ecab0c210cfcf1
SHA256	31412f28eb5fe7a2939976f27a95d6847a77678074f6e61b5f472e3465ad5170
SSDeep	1536:oHBa8LSYvly7PfqynN8sOzXH4/TxY/Sg6huLdjULgMLMyCv4TjeXj8XJzTI3dE+t:ezHvUfqJXYMSg6aCgMQNXj8XJzTIv4U

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\desktop.ini

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\desktop.ini.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.08 KB
MD5	427e8f6cb1f89e67f07072375ec15530
SHA1	050f80144db2f09b8ed8bb03329af547986637af
SHA256	ed5af0792e131570051f1c0515347ce841bc9f3e8204bf2887f527b62adb155c
SSDeep	3:sbgNoTKDUwCau9gy+uekfun:sEB/Cl9Fun

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	10.00 MB
MD5	24bf4c01d1734547c879cff2aca3e05b
SHA1	c12ed3bf5ed57ff57d73f689dfa8231147d475a0
SHA256	161a33a080bb9a1153ceff2810d3c1a8d5e782e4a2d37d903f351da2e464d521
SSDeep	196608:hpWdNm7l//upum9uxpfp4uZ8q7zEqaZswqLhQTcvlj9/z2H7DLKH8:Fl//upum9QtEqaeqc3/iH3mH8

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	41.50 KB
MD5	71c6c61642e84e5f85e10935659a3300
SHA1	6d5d6756e006bb6e78c0edaff4ae5d7972bab29f
SHA256	2abd76b8a7064154905aee12063e9ee01f16a77d088b5a6152157a68e3841738
SSDeep	768:V4Y7MikXkcCjUQb4qiZesKi8aHoAzehkB5bHXnss0Dj09++pf:V4YVkajUy4qhsB8aHoAzehk77ssl9++x

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\QVNDMBKO6iJXOO2h3\xjB5_nJ6.flv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\QVNDMBKO6iJXOO2h3\xjB5_nJ6.flv.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	19.68 KB
MD5	41972ad9ca88ce308ae510b64c4057eb
SHA1	c1610253de71ce9f3e405b0a8ff0a446870bf355
SHA256	a34ec57362165e9105ab3bd1c3bf3a2c7541a5e9140ddd254953e3050044c5e4
SSDeep	384:gBI/U0UXBrdDjye68rPbeF6iy4IRDGNyL8HIwvJC4gvrM5bi:GkU0CdNRP4y4wqALMvJDgvQti

C:\ProgramData\Microsoft Help\MS.INFOPATHEDITOR.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.INFOPATHEDITOR.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.37 KB
MD5	11c27f181606d672c230b6b53e6ea994
SHA1	7b472d38b45fa2d34dd57f9133a00a1def86bb96
SHA256	b21a856445aaed1e7651fa6e82a93f7b0a3714c81e71df836a39f36daddee5da
SSDeep	6:gn9dH/0BLjFj2UAguHfniBBjHePVUbZXU5ImmfJvMSke2VwcVRTfxmzBMQ75ts0N:K9dHMBI6UiBBCPVU9k5cMSXzazxmz77l

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ztTnKYuZ\wKKlBy5ZmIsI.flv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ztTnKYuZ\wKKlBy5ZmIsI.flv.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	87.11 KB
MD5	f387df9d27cc59e9dc383d18d29650ca
SHA1	b9d5524b259ed293114477e24f0ca59b6905a8eb
SHA256	2ae9c73b632d132541fa32a2550e736dbb757f399277082e93bfe0cedc60f8c6
SSDeep	1536:gXisTAO1Nt2mNBXDvyb6MQUjZWCt5sHbUr6rJFfuk8DU67Rd0hdSpff+tECW:7sTPVv9UjZWkW7rrrf2n7R8dSpffEECW

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.49 KB
MD5	05c0e2fd98e1c027872e8d83d19f33bf
SHA1	7ded9a4a157b7c3f7dcdd8a7196427ad564053f8
SHA256	dba439916406e7161bfb73a79357414a3b17b2663263359acc2b7d2a5b7cf755
SSDeep	12:ilZ9RF+tHms0ascmkNc0Le+qYG8e16Pc1q3NEWS+:il32hsZ0KAcs3WWx

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\ubh3Kx_A\rtYIqoqrRvq.bmp

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\ubh3Kx_A\rtYIqoqrRvq.bmp.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	21.14 KB
MD5	df4a9d02a9b40f03b3f86931ce8c3b82
SHA1	3772333df43c120af578529bb16d48b018b70c26
SHA256	ae7400599a24ebf4c9c6b1f4dfb5e879745a973f53208649e609bf8831f13d06
SSDeep	384:nndyzdAQcgygKFIgAEmtAVGkBu16Ozp6SeanMb8iUwVceB5YqBFnI3lVzUE/V:d7bT7IYm+gkk16SUacJTBAlVzdt

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.13 KB
MD5	3f508c5552765c3342d4a749c119ac54
SHA1	9b800fd0841412f38d4bda6a239c4fd4f547435e
SHA256	2114e05b7c43f1fab51dea98df10396a6ecc2d608f5c52813f543ecc380acf24
SSDeep	3:afwSkqOCAPkOfaO7dvjYPDz58Q0xz6vtkdzN9exubr3Hs:afwSkeMRRkPDz58dz6vtkh4

C:\ProgramData\Microsoft Help\MS.MSPUB.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.MSPUB.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.32 KB
MD5	fb508ca57d92db40bfb0e287cccdf911
SHA1	e81220439898b91af720702ba713fb18d71b0ac4
SHA256	d61b8541808bd1075e3dede7f1feed23e0b19a0d17433bb0e4d8a2a9dadb3ad6
SSDeep	6:gnGi1KUNhFSoHMvV0xzNPn2JXq3K9fNIamKpCiGSOxje0IAZLcjEWHSFmOltPR2:K8wX7MvyxzNvm6aHIamKhYje0I8cAWH9

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\8ctUF06 2SC36xX7cR0\FN7 jccu.png

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\8ctUF06 2SC36xX7cR0\FN7 jccu.png.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	36.77 KB
MD5	d15e925370eba5f5d4f1573fda47c44a
SHA1	edd754cd69ed0d238d98b07a420a452f8a4cb8d3
SHA256	483583b38cd445fec89c8d60c641bc006ed1e71ae7a0269647e1e4b64c8454c3
SSDeep	768:LVW+DNcl1j34vu8B4U1iCreAryzpFqpiEfaSmA1t4wDB78P1UUVXiw:Lot3uuY1igry7qpiymA8EOFiw

C:\ProgramData\Microsoft Help\MS.VISIO.SHAPESHEET.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.VISIO.SHAPESHEET.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.38 KB
MD5	65d57120fa4eff4cdcf8411cd3386aa3
SHA1	0a2a553ce16a6d31400feeb75acad6155125e1fd
SHA256	610aa9aea0ab25ea3bb8b40eddda84ad955e354c0ba0887eb1cde8db9b169e37
SSDeep	12:KxdRza59ACJxB+vLqjtBomu6SqJLYE+gpCOn:Kxds0LmtBomuhqJLYEOOn

C:\ProgramData\Microsoft Help\MS.WINPROJ.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.WINPROJ.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.33 KB
MD5	9251c4899da1873f70b72fb967c9effb
SHA1	fc39595428ad91702183bce0ed28bf702a780a74
SHA256	80aa76e90c4e6693704da73bf7f39f26ba9d8427fdab74c6f78f93d2b7e26207
SSDeep	6:gnl88unJJThY9+xKpbZq6SmGj7fdiGIdzjAz9Fz9zPk2n+8vNpSKbkm:Ky8eW/p5Gj71iGI50xJ9zc2nzvNpJB

C:\ProgramData\Microsoft Help\MS.WINWORD.DEV.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.WINWORD.DEV.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.35 KB
MD5	fa4103567a27e3f5146c15d9caea3615
SHA1	29b234922e2f18e0b74f18d28bb7b3940d1cb401
SHA256	82e021f60e52df8afb915c7cc68e872a95fdf850ad2ec2c5bf467a838fc6450e
SSDeep	6:gnjBVhy29UC0qEADtpJ6K7pD+ZifNHZnHjNQseFu0+VQ+DypUqwi92y1MeUqd1:KPhy0UC0qEmtpndiIFV2sezB+DJbi9VD

C:\Users\5p5NrGJn0jS HALPmcxz\Music\fWq7Sf.m4a

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\fWq7Sf.m4a.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	2.28 KB
MD5	2a4a79a06cbdd90e617b7e16068eda07
SHA1	e9126b3b585d288782ad2291c5c556ef2eeb9cbf
SHA256	95b362268262563fc99575f59507b487af7a0957077b10f2fb8297e33f3bf703
SSDeep	48:zC2+NdSA+azaTohn2IXVy3MsIL2Ni7UpkQhPIGphT/mEO9/jDtiWkr:zQNQLazl/sIS7kO9hTVO9/j51E

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Hy6vDgJFghnTAj77.xlsx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Hy6vDgJFghnTAj77.xlsx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	10.61 KB
MD5	41903efd1c809883e4fbf16d56b7d0e3
SHA1	8dbcb70740275754402f630a7862333b85a800f7
SHA256	d30fb392accea894cd0a2de376cd3d31f63383218f7c9568a1bea6c27344719d
SSDeep	192:651eKd9HTyJuu+nu8EYLxCnaBeFLITdPAs+LY6dOEl18flFzyWdwa0YCosUKFag:651eK/HWJuu+tEYLxBB80TdPAsYddv8O

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\-bVmT_XCtJmzFCE.png

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\-bVmT_XCtJmzFCE.png.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	47.14 KB
MD5	b383ac65b9d25af49866b1999803d00b
SHA1	7a0bf335dd60d0d21df6b0c30e471f1021ce7755
SHA256	ccbe28f6223a3fa50a5c6bb49c9a4d0da7ba27f3433e4c4ed4763ea4e67ea883
SSDeep	768:vxvpip8WcyxL2Vnp1qT3MoVLNopAemlPqKTJBg5RNxmdfitwkf4Pq3wLQR1McgmM:681DK3lLqmemQKTnCvxmQWNPq/1McgmM

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\hT-SqtZX\obgiME5jO2.docx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\hT-SqtZX\obgiME5jO2.docx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	50.46 KB
MD5	297d88ff64464316701c8be5668c7095
SHA1	2d50f6614c526aad3e584b42fb3a6c6e80bdfcee
SHA256	c216b8414bf2efce6768752d1ab70fafb7e72d8aa12bf707fb8d60a61a687f1a
SSDeep	1536:LCJiK8CC1QsQJ8XrkyrmtP9ZFX7jtjD+e:9VXrkyri9DLjtL

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\QaUjhe\B-lTUwZlpVSP7x8c.gif

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\QaUjhe\B-lTUwZlpVSP7x8c.gif.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	64.28 KB
MD5	da3aca7f020e13c27d9747245931cb86
SHA1	05eddb51a914efd53a2e187c662dd4ad317c4a30
SHA256	217eb986399667164f03b62cbc938b1c1aec2c5cf0dcaf709ae76f32ee7f0b77
SSDeep	1536:6dEY2WCB2B9XD1HKSk/nD7z23vKW3MVP7PnGtaiQ:6iJmXD1mQvKW8R7PnGtaiQ

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-3gHp4i8DBQd4Fi.pptx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-3gHp4i8DBQd4Fi.pptx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	85.22 KB
MD5	c2dc2367423e286dcd521610fbc982e5
SHA1	9098d365199c21589baf32757408c1cb9916b1c4
SHA256	a22e1f81555e58dd4b608379b2f4c3b0ae9813f9c4561ac874bab95114cde97a
SSDeep	1536:oMV6RcFyDBDEvO3OzZfMIfRZKt49jXyxwFY7UZ9ZDSZ/cScT2r/CAxqJq6f+f2U:F8RmABDEvO+Z5Zf94sY7UZb+/2T2DCA7

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\cc0AC KvAZVVI8uX.gif

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\cc0AC KvAZVVI8uX.gif.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	30.29 KB
MD5	1ebafec902eed504a7cfb6721c669056
SHA1	8c4f273e56d19275a879a92077ba6fd2baccdd97
SHA256	a2bef4f75457eceb17de55ae950e4f61c445efbf54f4d70b8c4493ed9441da2e
SSDeep	768:5AW9DmZQSsFFFf2JkZcCUXuBARUi6NPu8BztB6l:+W8ipZc/XuBACix8BJB6l

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GkFwBZ26Jl.docx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GkFwBZ26Jl.docx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	7.29 KB
MD5	6d93782ee9978fdcac19d92f830d200d
SHA1	406a051b7d48259cb61c5e48e3cd6c8f810c7eaf
SHA256	c30dac4f9a42c2b6405d25d34a0a0ad7547cebd0d29ad2468ca32bcd34d93fdd
SSDeep	192:L5WMABylzncxrURkDxON385Vp9T+6M+B8FgV:L5WMAYVIwRkp5RaD+Is

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\QVNDMBKO6iJXOO2h3\kuUk4.swf

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\QVNDMBKO6iJXOO2h3\kuUk4.swf.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	74.14 KB
MD5	728cb8a1d93817fea702465b1f8c9a86
SHA1	fcae8735a5974615b721b363a8f990f1f5fb2bad
SHA256	9149fc0022e51388353b7db461f541a8b5837c1955f0993d9f347a0548d9d2b3
SSDeep	1536:duy5B3Jccvzoi1bFFrCeJwio+TCin7PVI/KMmD/u40Y74Do26Qghb/f38mCv:8yxs0bj3Jw+PV+Wu402ucD38mM

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	181.00 KB
MD5	49a86c0ed098ae60dfa66c5b959bc3b6
SHA1	12c31e174cb0f17205b1080fe8c0c8f07aa5bee5
SHA256	ffd0cea8ebd7e55200ef906edabb8976a83fa22fabb533a4c86317262802895b
SSDeep	3072:deAoIoh1PP9XFTZDgAbL6qr+VnrtBowm02haKGDBmjJBKzAD3FaOuBlTvo54Kms1:cAvoh1Pp0xrtBINWBmjJB7FaOuBlTw5r

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\YzRpjUWu6VDm3TLDV.pptx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\YzRpjUWu6VDm3TLDV.pptx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	50.41 KB
MD5	85e3b48c4eb5f104c634675842f1a99c
SHA1	cb047a7a82213c3b252cde5fd4a81a0e7467a2c0
SHA256	db31e9475e7576ef9517e1c6e8c2de9c534a12f2230607b585ade4dc2dbbf47b
SSDeep	1536:oB2JabNS8u+1bnJ+5Iba55QJX7Mus+z+hkwqiAY2DCAj:82J6N9X1bn4IbL1s9hrqHDCAj

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\skaVx\aI-hq-hLGIh9RDS.xls

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\skaVx\aI-hq-hLGIh9RDS.xls.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	91.83 KB
MD5	fbfc4dab413a58ae90139411ba25468f
SHA1	4a2b155668e6626e6d9d6ecdb56facc5e46f4859
SHA256	ddf4ce8d607b526954aa89bb363a7b3334373de6421f16d4e955dfb8523942d5
SSDeep	1536:D5VvuZxqmJ/nnc6c7s0aLjSAn2EPUiW8CY3TeXJZsWG4LbKzrsShwpWC5S:lVWZxqK/c3dayAoiDC2eXzNMMSCdS

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\CrDx78k.mkv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\CrDx78k.mkv.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	80.92 KB
MD5	c5c12d7e2aa948d13ee6169a32cc3039
SHA1	8f2d344c72da2a0d124274f8f763be6020115758
SHA256	0c805eeea776413dfffd0e8a030c91bca7cf8974fc1f1ad9ad82e9997680df62
SSDeep	1536:ukI7/ROOCpIuXG/5jBnOJlZL+3fmMrLdpxzRVusCICHUVjQ3kZaMAzhmt:vgROOCphXG/9BI5MVPzRVuNBHakvMAze

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\v7CbnDwOOLwRsSR.xlsx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\v7CbnDwOOLwRsSR.xlsx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	2.08 KB
MD5	652580ed29f9410bf70682557851870c
SHA1	640de85cf1593f968a8f8bfa9b5914ec319c1179
SHA256	adc65ba9ff3316d2b4f7e72035f7b6baa2f4491fedfc30211c9ee52c1ed31919
SSDeep	48:6UzmvFACTXmEWN+c1PfYes1a7ynXi6XXJ3N9g6aS:6UzEuIWEQ+2nVs1aeiqhh

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\laJ7 XG6mvY9a4Oq.mp4

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\laJ7 XG6mvY9a4Oq.mp4.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	46.41 KB
MD5	2230b222113558c2396c9f892fb34813
SHA1	f820f883b27ac32bd0c2e8e65b1fba518f66fc9c
SHA256	ed92faf2d38435b6649bdb10e0c788decebf59f925f795a3c3fda30a42be1738
SSDeep	768:z+clsVlP8WahWbFMVAPFHePzZorbN/+DvJGhzWxxDqA7qXEIF5HScP0:zRsVlP8dYbFMVAd+bGx+1GegE+5yL

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\QVNDMBKO6iJXOO2h3\LcNIbb5Xdpy1cT0Voq.flv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\QVNDMBKO6iJXOO2h3\LcNIbb5Xdpy1cT0Voq.flv.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	60.32 KB
MD5	7173acbd08f95d2b2b0298c100ea8271
SHA1	28420cff594bc55df7d36d7e3c35b5db88c7bc80
SHA256	7cb226702e4f3abb2e61dcbfed7d1542d4dc0e0a10f7c78c6b6d80b32c811eb3
SSDeep	768:DXmX0m13Kb/4KgaQsa9jqGEg9nLXi30BhRO8egLQP4ABCKxMOeRguvANGOz6wbLV:T0DcEKFQsIjYmnLSEB51XYYdvADzlemJ

C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	10.00 MB
MD5	493d0abc21f77c01c73e8e65bf6ca6e8
SHA1	5bbe66e6b92a48948a78a25ace875c2394c067ae
SHA256	62562987168930eb3a3d131ddc343910c0ea2221bdb6a46860aa1dc7c675ec89
SSDeep	196608:0n680fUIyyPHgvDXadSLsS8nQsiAESOsYnwZrja9segf:0ndkUaovsItAqpnevIu

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.13 KB
MD5	0968f6bba2ef99cea85be449cca4613c
SHA1	b951eb79543439aa49d73eb27a7f17f6b64983e3
SHA256	54b646ed7ed60e410d779fea59411ce2affdeb1d4c91235d8011d0c6c14dbe30
SSDeep	3:afwSkqOCAPkOfaO7dvjYPDz58Q0xz6vtkdzN9exub+TnHs:afwSkeMRRkPDz58dz6vtkhGY

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\8ctUF06 2SC36xX7cR0\4DWhN6RhpgdCQKemK.gif

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\8ctUF06 2SC36xX7cR0\4DWhN6RhpgdCQKemK.gif.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	6.47 KB
MD5	a285241789dfab34520126dc722c18ea
SHA1	62dfd9e5925a717c7694b7543e3b68f2f8d00ca0
SHA256	17cb7c540c219508415cd0ea5a98981e8db1310a2beafdad4a87f69a68013667
SSDeep	192:/pAk29Qgb7d1/Il8DmdPzN6r63eYwoRZcpFPe:7Zgvd1/IWCdrN6u3RFRmvPe

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.13 KB
MD5	5dc6e3b7f639899d29b173e41710326a
SHA1	e6e901c81425d539473a9238fe47befc29834a34
SHA256	2beaca35fcd496ce6b48016677fbcc97622067ab8b4694833700fa9ebac71d76
SSDeep	3:afwSkqOCAPkOfaO7dvjYPDz58Q0xz6vtkdzN9exub0UQ7Ks:afwSkeMRRkPDz58dz6vtkhKd

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\ni0Jgy12uVbTOlRR.mkv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\ni0Jgy12uVbTOlRR.mkv.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	3.49 KB
MD5	277ceb669acaa0c932ec66d476a6c649
SHA1	7af0a6b8708feeac73df39277d39c11be4ca05cf
SHA256	4e525e1171c99e4293130a389ecbb01ba1a626e56ed591c2d6cecee6d5dbc04a
SSDeep	96:wapFuCySjWOhM/zJb0B/I5Ng1Ks3AIWu27Gm/PQcxw:P+OaN6Ivg53AHuAPQca

C:\Users\5p5NrGJn0jS HALPmcxz\Links\desktop.ini

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Links\desktop.ini.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.57 KB
MD5	9a13388d39edf84eec1b5d5af41f96b1
SHA1	5b00ae3fbdc0c32de83c3ce2a1493a70cdd3cebf
SHA256	6bbe6d1f1cb399732f360661c658fee6bf0ffd0aec7934918d5948345b97b897
SSDeep	12:ilZ9RF+tHms0astiM9uG8X09MbQggUC5+u5f2K/YfMsSyY9rAYwFtiljA7ey:il32hsaTXdDmku9GfSyY9rFwFtL7R

C:\Users\5p5NrGJn0jS HALPmcxz\Music\y1mkaun.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\y1mkaun.wav.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	42.47 KB
MD5	f6e8eff2b3c0a6bbe6533439a6c0b9b3
SHA1	ec215162b5f78d7d10f7ad6dfc56495b6f9396dc
SHA256	faf1f771f3391747b951e80146bf2544990c053d2d33a77de5f53359e582bb65
SSDeep	768:5vhF+eyQw1JhBGE9xawosPvN4CBg+4ICt+7ogT5zazjEnnHT0tX2txyL:5vhgQwxBDxawLPvN4XRHwogT5zwEngtH

C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	66.78 KB
MD5	d322e6d604c9d3e06c8173e70b7841e4
SHA1	165f3a8f91302369343713d6d4a0f53cc6afc124
SHA256	77c6b6b39759379ec9c49d99f93973a256274e11e44652a7b3ea73b31d1edd2c
SSDeep	1536:yFSYM6nag0DTjuQx91wJIQvkbY4SVykUPRhd2YXNDAT5ya5op:yUYbfCTjB1wJIqVo7d2YX1ayaa

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	885.50 KB
MD5	5e14fb212c9979fc3e4d07851dd2840b
SHA1	ebc4c334102756ebbf760b7edf235eef2eb90314
SHA256	a8943a3d00f91a7d4d5db49d8987503126546fc6b27196f6af01dd2219424fba
SSDeep	6144:NXkD5gFG9dKsduN2sCWctvCQ0OGj2QELvMYI2q3ksedyPs3ETGpyIQEkmt3PNXM1:N0DOgduPFcZCQ0OnikseAPsJpfjt3PE

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\SNwh\3-Cn.ods

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\SNwh\3-Cn.ods.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	12.73 KB
MD5	614de1af37a3e3ac5b4e9078aea20d9d
SHA1	2dcf544e68074e954bce8db7ffba8ed6b8b5c1e2
SHA256	5bcefe145b62b78676af1014ed422a8e844164b76dee29d04be6cf20e3f4e0e6
SSDeep	384:D7YNAGgSQu7pJ5MLPkm/mXHoPrPiW76WmER+E:/YoSQuFAsm/oIPrP9Nm2P

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ztTnKYuZ\f 1Medb.mp4

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ztTnKYuZ\f 1Medb.mp4.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	93.59 KB
MD5	e479304ef879519247b6b0fe6a93b7e8
SHA1	12f06586ed3cf077b9efccbbfbeafc7eb6b244e4
SHA256	0f32b176276954afd82673230fd1411264c9da08547c7cac260c63d1a254173a
SSDeep	1536:9aJzi19mG5iwcFpnsg2Le182jhtU8W31uPUu2xcPDT5EYYNZAJHSV:9ag9m9V3sg382j48/2uPDT5ViAJyV

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\_Xt1XKuQQyohA.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\_Xt1XKuQQyohA.wav.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	56.10 KB
MD5	a6f0df8e140dfd3ee68f4f744d3162c2
SHA1	93dbfbc023c0745314ed4ecde3b7e1670365ebb5
SHA256	c83b89fd7d3bdf3d1fc06253ab714b07baf1e3554929870937dadf5d04f7e1e3
SSDeep	1536:6QnGbs4SFkdYf/mDFKYGxSlZLRP6ymJmV/cpswDpId:X1Oif/mRgkZLRLDaRi

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kDhx0.ods

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kDhx0.ods.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	52.15 KB
MD5	f59309c2d20ac22b11c106fd2d4e35fc
SHA1	3a621f217aac3ba4ceb3bac258ae671e294f5bd3
SHA256	07646c7c67c4071ffbf0659de98640afe5ce7ba278007c17cd4c2c807e599491
SSDeep	1536:DjOGsXdpcrrmR3TBpAODDhcIRmEcrNzyurr1:DPr8cyFirRhrh

C:\ProgramData\Mozilla\logs\maintenanceservice-install.log

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Mozilla\logs\maintenanceservice-install.log.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.16 KB
MD5	e5033f8478a1a2c442362efce2d2e52d
SHA1	ddc3da0f732d030aa1b3a8fedd202a1e9e9636d2
SHA256	37dc58ad9f37062a700599d815a9f1ca2514354104a8244bb44ac12a4cb0e9c0
SSDeep	3:ZWxgyb+0V9XMrHD+t4iI9m7OluCQFDDz6iRD23FoDbv9An:4bPaHmvxKlNqDDz6ic3FeD9An

C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	1.15 KB
MD5	ae8ff95e1dca3ffa22d4f443ceb19453
SHA1	e42a68ce7d3c0ca08b7fc57d3027e5f9f06a93d0
SHA256	dd271d93d515f1649d5ad891e67cbf29808b08ffb62040287b79fc1d5f8ed82c
SSDeep	24:ILozN0UmhL6Kusu9lsBMcvfRpr+M2db0Wb2LzbxOdgpQ1K:IgLkCXsBLpMAWaLHDuK

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\hs9eu0cg_VHy7\FIhr5H47kz.pptx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\hs9eu0cg_VHy7\FIhr5H47kz.pptx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	56.99 KB
MD5	32de629b63eb7cf8678f3d8d6178f735
SHA1	b408f4e9a79f03d9ae07afe8c8dbe2e96e1a1571
SHA256	2c728e1750ba1fc63c51cddd188615cfe7f9de8d7a07e59b6b68cc8e3548a4fe
SSDeep	1536:oqDc7/Bt3RwPMa2coxki6G+hdYEjJ+gdNwe:ZDc7/dMTncki4hCEjJLD

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\QaUjhe\7FDM.jpg

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\QaUjhe\7FDM.jpg.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	98.77 KB
MD5	4b5905695813ae52f8d3bff26fb6c353
SHA1	adce055c8f142396487cf1d1884765c9a1f1e736
SHA256	e9e2cf558995d4a897c7fd27bbd6576493225dbb54cba6f55994ec7a34dc9739
SSDeep	1536:pEnhu3XQibXr5TOv41Brvffturuvj7bPxxi+dXhFkKvO+kU6sosh9FRUT61ZO+MC:ptXBTOWJbfiaXhmKvONUxKTWK43N

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\OaJupVjMV.mkv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\OaJupVjMV.mkv.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	57.22 KB
MD5	ee5e2ab500d2caaae449a578bb34be38
SHA1	60ddf8864423e2f8614a5707ddeed17ed70b9e68
SHA256	6c064fb55cb4d542030169e6c3ffcaee8af9f7445b27df8f6a088a6804cb9d81
SSDeep	1536:32zxMbGsK9vu28dZx/QkpnsZoJlvWDloS5yPdpoy4:3MqGsKdSx/NpwYvWDloSIP54

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	265.00 KB
MD5	07250040883684ea3a6a673a554f07af
SHA1	3c7e633884f61753d081a72c6cb0250aa877489b
SHA256	e729b421005415e34b134277262f731bad7dd9c67ba09d71f729c9a7810abef2
SSDeep	3072:8WJWeFD2G8ILL67JF7orRo1IwBIeXSg1dfGKn3Gqa1ZH+p2I7dxz+tET:XS5FFUr+1IgXSEbGqa1ZGz+

C:\ProgramData\Microsoft Help\MS.EXCEL.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.EXCEL.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.32 KB
MD5	74c20505ae2b8fa9539dc1d2f6695928
SHA1	f5e72ece1641afeaca2d12215be55132bc85acbe
SHA256	3f190d5dc52134563494f960d69463197e53f0d338649722b036f401d82174ad
SSDeep	6:gnGbRY5SoynAMvV0xzNPn2JXq3K9fNIamKpCiGSOxje0IAZLcjEWHSFmOltPR2:KcRuyAMvyxzNvm6aHIamKhYje0I8cAWd

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\rRaXTMp.mkv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\rRaXTMp.mkv.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	82.47 KB
MD5	ee04047116edbe1108bd0d8613b00499
SHA1	1f210a8836a6760db347cdc0f6d6efed6b4fb534
SHA256	25120f747c8607dcf9c186273c8073482d3fc04e20592d1244492a51ab5b300d
SSDeep	1536:uCGsgX14atVUOJPKOyXXf9lt7j6OpKPDaPUwoVZrewx2q2q:uUgaatVJJPk+OpKPDaPUxZLx2qV

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.22 KB
MD5	9aa7beff69eb1ea4b633bcd5cd6b2fcd
SHA1	b2b7b56481a66900caa24136ca29b6388b0a74d0
SHA256	689a36e501047514f0628abf34edc77d7ee81b8ea233a015b1cff8b56d6b3864
SSDeep	6:afwSkeMRRkPDz58dz6vtkhxcstYS3ePZqBP8bwAgO3h4:qx0Hk7z58Nhxvxvqc

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\POzUPkpR60DTM.xlsx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\POzUPkpR60DTM.xlsx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	46.74 KB
MD5	547e407b0afe0196cf73bbb52f509cd8
SHA1	988292f1f9ea1caef35f9db45dd9059b51660f55
SHA256	8ff1afe8c3cd546a4c434414aa4425104362785c35f048bf284e9a0de8f72d00
SSDeep	768:6G0Dy5V/nno6zg5iINDNmBAArcZkm9gtDC4m8xkVgHeI1UMbuJdzHW0K1sYaBqPh:6G0GX/no6zAOukmlz8xHu+uvL020c2Xx

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.82 KB
MD5	ec7078f4002b29e214aeb966614c2bbd
SHA1	20381d7fb985b037b8e8ac07dcc4dedc520a1204
SHA256	8a5078fab5b4d6da866c34b03cce5c6e521268948ee24b1b99c738c659b6d7f7
SSDeep	12:A7+RjscLXG7HscXEdTtpRAohXORc+D9HM7s2HC4B888LsWWNS0D8L8xdz/j:327McXEdJpLhXO2+L27B888+SZ4

C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\8E9H31N.mp3

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\8E9H31N.mp3.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	39.80 KB
MD5	990abfd7e9084d1a3debf0ffbd2f29b9
SHA1	fcc1baf33e2861b6241dc60d42e5ef42ed97dbcb
SHA256	1f750a44ca8065c7d0431622986c1b8d9e0702a0bafcf2e3af3abd0081253e53
SSDeep	768:8h+Dh27s37XQmeMfi4R+ohFzeY0PN4HGmmlRKB862yJYkd5Wo9Od4yH:t1XQm364NLzeY0PNmdmq862cYktx4

C:\Users\All Users\Microsoft\OFFICE\MySite.ico.INFOWAIT

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\All Users\Microsoft\OFFICE\MySite.ico.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	24.62 KB
MD5	7d99554b26dad5a09d87d60feec7b79c
SHA1	970aed6e9e2d8d0a96b999193f3b6ff5c392adc7
SHA256	adda5d3201da9d01c34fb00c5c2fc51add5511fe17cdf21c0ee3ef7924c43362
SSDeep	768:Mu0Qp6Zdjwn7AZX+1RFoaYAJSw2n+v/kF4soh:sQQdjw7Al+1RilySwp/kF43

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\O89VrUgck0WGUK_Y\Hz-AF2m p5AxcZJOR.mkv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\O89VrUgck0WGUK_Y\Hz-AF2m p5AxcZJOR.mkv.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	46.88 KB
MD5	034e3460aea5973c8ef22f36895f5d15
SHA1	8629ac2cc3be8041a68bfab0c825c6d6f9049b6e
SHA256	ace4b7cdf930e7fbf6c566a7736241ff0254402edc69d262596aff4f040a3ccc
SSDeep	768:YKtLUoNuuSrjkP2KwAag7H5U2E2TcK8+Xl+UB30clpDYzCmUTib6BedIxQGAVjU1:YoLVubkjD62Um0E0Sq6BD6MHh

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ztTnKYuZ\JAPSpnBZPTk8W3utGB.flv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ztTnKYuZ\JAPSpnBZPTk8W3utGB.flv.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	80.49 KB
MD5	d5210b0575fd77695438be74990b281c
SHA1	9fd302e941d5c85db5567b018c719f9c3bbf2549
SHA256	dfa395608619ec251ec2a2e16d00a0c8c3059669263f8251ac7b5f742f2853cf
SSDeep	1536:jYfsUbWUOBgIBTFjruiJ0qa5zN6iQW9KBsvJvRCq/s8kzevcCBOL6:sHuR5JSpNcW9KBsv5EIs8kzi66

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\mF_q7P7.swf

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\mF_q7P7.swf.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	4.63 KB
MD5	e523db425153a5798acf11c823785e64
SHA1	6f30c16af0ea454fcd8d9fc59718b564ca8bbfc7
SHA256	63f417a3be51097c2f1712083928583af8ee2767a5ed233c9de0b29ff3e07bde
SSDeep	96:d6LbsPAlpBryteDKDr37y/wW5m+N4WDkvcrvJyoFAQ2asT:d6LbsCr3DWy/vhN4Gkuvia2

C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_AssetId.H1W.INFOWAIT

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_AssetId.H1W.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	217.50 KB
MD5	3a5d120dc4aca144e7d94e0fad97fa36
SHA1	754b5f4644b7f29af6bc879e411266515df1b64c
SHA256	4e429fb68ae26e8839246155a7f6c49243aef74126587a51ba1c26c56174ae23
SSDeep	3072:cWJWeFD2jz05HswZjZ/RGhFvWDflEOp3UFOF1C3v6yLZSDYu0YiESYad/A51G6t:329wZl/iFODEFOmSsZi0d/JA

C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\kJFrd7NImQEQs.m4a

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\kJFrd7NImQEQs.m4a.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	89.85 KB
MD5	f94cf9584a7ea2195f9b91ac4d6f9ba0
SHA1	102262910bd16a28647866c43f8097af6957e876
SHA256	72f8f05e03fea3fa1b2aa74b49c58caf638d60a95a8a73db1efddb46ceafad15
SSDeep	1536:GjjeFzBeEsOoEcFDD+l2v1UAvUfI6pPOr3xrafojy0Pv3CjCMhkZNjWZO6OdvLw:GHew5Ex4v1Tvg5euwjy0Pv3CjCM0jW0C

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\M3mvj.m4a

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\M3mvj.m4a.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	96.67 KB
MD5	3bb1fd8a83d11cc1586c99cf8bdd2916
SHA1	32db97bed36e0682a35bdc51231a85c2590a6d39
SHA256	a5978ed963a5230f860cbb56c0d903af3297261c7d85dc5e6f73a519302d7f51
SSDeep	3072:cSJYgGMCsMXtEPAI9xnbyx9w198Gmi2l68e7:+tFtEznnbyx9E2wV7

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	32.00 KB
MD5	af313f0bd66b8a14613509d051ad4e9a
SHA1	93a043e3c39ae0d83c4fb9a91826ed5d7fcf982c
SHA256	4048636eb5c6462e8c6c095802ae85741cb2224ff2cc0e424f7bd33f5d6a5087
SSDeep	768:t8Wr37qMWe38wDxUuKugphTjO9yF52bXmqaohC70COE9O6LvEYsTcR:t8Wb7qMWe38wD2vu8VjO0WmWC70XicZA

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\8oeI6XU5 vjIz.avi

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\8oeI6XU5 vjIz.avi.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	51.28 KB
MD5	5bc4314510ce1691bebdc5a8df6fa25b
SHA1	e800902a8f1219253ffa6072c94aad7dbc84a99e
SHA256	b2a41a6fdd9a805af700156e2c7bc0523bb8c18f9b87641e615bc175551195f2
SSDeep	1536:zottfiUrADsBBqTPfzEfwytQAL/OaMW6D7qf7SnLjFzb16PCRS:zYtfiRw2ExQA/OJD7qfMjFvICc

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\IEv7z27qsVTekHpr.bmp

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\IEv7z27qsVTekHpr.bmp.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	83.15 KB
MD5	70a930d0db315e7b839eee7f667328c5
SHA1	a514d352ffe517102437be7f6749ba7517f6a6ab
SHA256	e8aa0cf5b165875b3dd2cc5b0786d77631eeb1976ca4b473083dcd94045aefa4
SSDeep	1536:eHeB4nvqIMjRyjt2E8ZVpX027vENcVkg6VzvkBjaQsSLrZ8qQ:eHq4nvqLR0ngV9l7ecmg6hvkFXJR8j

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\hT-SqtZX\tkO6bl.odp

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\hT-SqtZX\tkO6bl.odp.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	72.50 KB
MD5	0dddc271422c44b67cf0f7da4f15d87e
SHA1	32a4d30a349deafaf15529017b53b61479ee3a6a
SHA256	866058b5158cae85bf11e47816ae06d670b3b98d124c25ac33140f02a06ab2c3
SSDeep	1536:bp/YCvbYwH1BpNW17vqI11AknFVL7hUkuacPCRqhAagqwT+jIvOIJTWjMLU3p:t3DYwH1BpM17v/3/nFVJUkkCRvqwT+JV

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.13 KB
MD5	3226d49b2e883791c8c235930573aef1
SHA1	495dde4429f150e6e258d81e742e2854c0153891
SHA256	3c22216e7e1f1d867375f055022bd8fabbdffef2f838883815af74507f135168
SSDeep	3:afwSkqOCAPkOfaO7dvjYPDz58Q0xz6vtkdzN9exub0VWjus:afwSkeMRRkPDz58dz6vtkhkW9

C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\0XQBmq5ckaU.mp3

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\0XQBmq5ckaU.mp3.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	51.76 KB
MD5	c1c15ab2218c229daaa135a50192d6f9
SHA1	8881dd50423b5556a7ae2d6234a48a50607667c4
SHA256	56ad5b2d265ff4e957f6fdd5db02df9e28ddb2557062b33a092c4d34bc855f40
SSDeep	1536:hWBjuaMtDlrVIH5MLXHRsQpQH8QdxPf98HOuCX:hWBErVIH5MLXHRDWcQdhQMX

C:\ProgramData\Microsoft Help\MS.POWERPNT.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.POWERPNT.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.34 KB
MD5	ade501aea2d5c476561c5d38f2d3b036
SHA1	1856432c18e61a43c5a6b9013ac757e77a62825a
SHA256	a07deb28a292a02e1a6feb40ba9146e041e81efbf013999a59acfa987dfc70a6
SSDeep	6:gn9+R19FKs6MmH6WM9356uawQkCqvm2f7jDbDy8JImcI35mWTap:K9+XF6RsY9Nqvm2fPDbDBXnTap

C:\ProgramData\Microsoft Help\Hx.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\Hx.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.38 KB
MD5	a1c2a6f5427cdcb2b9b808f8de27e6c2
SHA1	c5e79634929589b0494c3ed2dfae3b61193d77d5
SHA256	ec5edb69f46d5ebe76ec0f6766bd1acde68997c97015d41aeaf15c494142765e
SSDeep	12:K/B7SZkjamfW3P6WZcMiDm5EKCAP6SWmVlXQu6f:K/BYkjawCF2FKWSpif

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	568.10 KB
MD5	2362eddbe4b922880af9a87d2f984f86
SHA1	e03cb27404dbecccb13843f2613c0edc68a7c374
SHA256	cd5075db7d89a7ec60acd45eb70e7b2a4a83002fc9cc3809e4e12b53b44648b9
SSDeep	12288:iUivUNxhsOOQCSHvf8Y4hyMPezVNK9TcS5RyjDUI6Eh/MOhTh:iPehWsMPgyTx6jDUbE2Id

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\ya4k9CP4ga90mFZW.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\ya4k9CP4ga90mFZW.wav.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	18.91 KB
MD5	b710f71efac3345d7f735163da61db66
SHA1	8ba69f7d6792f9d4cf953158e92739c82aeddcd6
SHA256	6fbe14f82b523e0ec2001e5d13086362b69dc3687eb15ba17d0d710f9eeeeac7
SSDeep	384:g9vZyn0s/6j8oAF4H8BOyKlIyab5QV+BOqDuKk6Wj+id1ToC7S:g9vZyBijRFdIy6LBOIWKn

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ztTnKYuZ\SXoi3O7UHlm4-KqaOQbg.avi

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ztTnKYuZ\SXoi3O7UHlm4-KqaOQbg.avi.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	86.52 KB
MD5	3cec3b51778fd1de3bbfe97ec879490e
SHA1	bec57f13001e596d1300f0c79baab6eabb314e64
SHA256	854da9ec0d29746f61364059ce15d62bb7058a4de2c3079c73dfe1766a856c80
SSDeep	1536:XnSEO0U3iraz6kV+S+HKz6/s4wTtXAAbP2PHjItYJyy1LxCAjFdmO:3NO0Uyraz6e+HKtbX1CP8tIyy1xh8O

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\8ctUF06 2SC36xX7cR0\luqHM\IMEhPArBi5zDx-qN3xQn.png

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\8ctUF06 2SC36xX7cR0\luqHM\IMEhPArBi5zDx-qN3xQn.png.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	74.21 KB
MD5	be7a7b0639c35531d68b178d2c88a34a
SHA1	b2080ffe2ceb07866955018f851f04a2eee17690
SHA256	50f211134e2595550c06c7338187078b714cfcd28d510a9568e25e3bb9be9312
SSDeep	1536:BOnHpf9jjp86UfdbGiQ9z/tyGok3o+Weu6MTuhNwCXGI0F8FEXWF6d:2TqVs/tyGm9/TuhNLXGZF8FEXWg

C:\Boot\BOOTSTAT.DAT

Modified File

Stream

Not Queried

»

Also Known As	C:\Boot\BOOTSTAT.DAT.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	64.00 KB
MD5	cc231cdcce8e6badfa43782c660b14c4
SHA1	95174af3f15c23c2045c57bcfc42c29d50b6901c
SHA256	079c79bd6ec580c88c316e38e5aa3bc514055872483e91deb7c7496c444e59eb
SSDeep	1536:kbWb7qMWe38wD2vu8VjOLCGi9aWcC70XicZMAqhFgOfYEhJrqC9V8:2WJWeFD2G8ILChmRZ6hFg4RlqC6

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\xsTHwcnuDqWQ9Jfwv\u8Rrvn5zJ.jpg

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\xsTHwcnuDqWQ9Jfwv\u8Rrvn5zJ.jpg.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	93.65 KB
MD5	19ca4ce9fc1ed17e5a48533007fc82ab
SHA1	752e79a46bd55d7c16b1cc19be1d126057063c25
SHA256	96bed7a236ade6e5bbcb0a2410a0b6eacd198094628a42df5cba7e359a9f8959
SSDeep	1536:yYkZu+J5Btc3erUmqyn0tiJ3Yx99h8enApADwQ/2nA3nIuFuDRpXGKxfM6IwfWmZ:yS+jBMerUq+ixKsuDwQ/9YiujxZDWU

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.13 KB
MD5	b37a690685351a81b58d98e0a4422eb7
SHA1	8ed08db4c4f84e974fe30335dfea1db89c0e4705
SHA256	898e566dc179706c475ea56ff31f9e3df23c83931083d48b91650b8cd879ec2a
SSDeep	3:afwSkqOCAPkOfaO7dvjYPDz58Q0xz6vtkdzN9exubR7s:afwSkeMRRkPDz58dz6vtkhpw

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\H2j6tPl2-Uy7a_CTb.docx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\H2j6tPl2-Uy7a_CTb.docx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	68.63 KB
MD5	61499e565c02f1657e098969493c7db6
SHA1	5a9323987308780f65533d90e1ec1b6098bf4245
SHA256	88fe931104af8ada1ab7e8f9d03b0ba9121841a6f94ea022e0e655c4fa7ae772
SSDeep	1536:L5y/YyjGm4JAHrF50NzBA4Nv3YpGW30f+LWfmJEENEMwX601L+RQ:o/YyjGmiAHrF50rA4Nv3Ee+GJMwXl1Lf

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\QaUjhe\rGw15KQUy_H3LYwN5\8B9CArYYR-k5_6.jpg

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\QaUjhe\rGw15KQUy_H3LYwN5\8B9CArYYR-k5_6.jpg.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	7.78 KB
MD5	c32ffbea4d55745b851a9c7a0da598f1
SHA1	878a3ad223f3ff45ce77ae3dc8cadf02f70274d0
SHA256	1ab9b9c436453ae8e2f0189d133cb28b336e933e2b2742681225fc56e5b49e40
SSDeep	192:Yl7+wtneN9flQIAPpDh1/LB4Hzy9HteUUkAg0ovxx4Xs8O:/KebfxAPpDvLiy94kTTvxx8s

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\U eCzQsa89w8ys.mp3

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\U eCzQsa89w8ys.mp3.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	31.85 KB
MD5	58d7135077b810fed1354c2823ae339b
SHA1	60e89aa79860200758226c7ad759033a6d3474bd
SHA256	feddbb4cb9de6c01fe5060a40b46f1e6ab65a321f5da23e148be32eba38e3161
SSDeep	768:osVYDdXOXduivoD3MthAKdeUHavl5TKH+oBdXlPnbEIr/JiFs43y:os6qw2t6iavlwH+Izbbr/JgC

C:\ProgramData\Microsoft Help\MS.VISIO_PRM.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.VISIO_PRM.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.34 KB
MD5	8cb1c44b04ceb4483e246a13f9bf27f0
SHA1	a37eabd7d9217bbfcfd2f391ac60f953b4d3264c
SHA256	229eb38d7a293df3bb11b041ca14e82ab5ff40be51464a67de1072109a7a9f11
SSDeep	6:gnZ4mzPHnfhYqeuYq3WPm8eWZcmIDTn3eb4zCp7zJmTSR08DRUS:KvzfsutWPOWZcz/C/ApUUS

C:\Users\All Users\Microsoft\Network\Downloader\qmgr1.dat.INFOWAIT

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\All Users\Microsoft\Network\Downloader\qmgr1.dat.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	4.00 MB
MD5	6732b6ff214d6ff85b552c42ec2050ee
SHA1	ca686f4a781ce9c4b5e2851cc45f5005fc9b4cd1
SHA256	9752674a39b1e38d421e2fce6cd89107878a81e28081b41af4b7603c58624170
SSDeep	3072:hZKWeFD2G8ILChmRZ6hFg4RlqCJbiatNDXxAdZ1dfGZn3Gqa1ZH+p2I7dxz+tET:hZKSlSZSFJRl3BrDXxAdnIGqa1ZGz+

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\-x3FnD.avi

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\-x3FnD.avi.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	32.72 KB
MD5	49eb88520c604609e829d24ea15c8705
SHA1	cae4aaf39f5374ebe9259a4a3a16f9840899f8d5
SHA256	f5d605a285a2f3760e2d9c1d3e04313e48546500f18c23ff22c8b3d8f918f617
SSDeep	768:pb3WbSxq8qR1QMVBaGkajpuJ6K3K1dUKNYnAdFBvVtWVJLXoH:13R1MV49r3KMKNYAdF1yLDs

C:\ProgramData\Microsoft Help\MS.WINPROJ.DEV.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.WINPROJ.DEV.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.35 KB
MD5	63e208994b1dfe7690ea913a347bd8d1
SHA1	f39f4871ec8e9206c745c05dbeed7442303702e0
SHA256	8f995038cb125a309989c6235c8b75c43f4d8a264d64652feb9861efba307d7c
SSDeep	6:gnCa27/re0qMlDtpJ6K7pD+ZifNHZnHjNQseFu0+VQ+DypUqwi92y1MeUqd1:KCai60qutpndiIFV2sezB+DJbi9V1qq3

C:\ProgramData\Microsoft Help\MS.OIS.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.OIS.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.31 KB
MD5	c55cfb77b6b499dad4583d484795dbc6
SHA1	58d806b7145ec06496aae7fcb1c066d4d6c2e039
SHA256	f357f6355e0f0f81e7738a1b324d356bf4eea89dcd69e654e110d9e67b8329b4
SSDeep	6:gne3CmLS8K4UDUVCQp2AVcIiHsmyUSvjzvCtCTnNPG2Cm6hlov:KBmLS1UVCnscxsDtPBXCDls

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\Ukc9zVsmz.xlsx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\Ukc9zVsmz.xlsx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	50.64 KB
MD5	78959d5277f8f6aba168ab09d6c7569e
SHA1	22c4ca4f5b6f34726037d2d026df695f6e087e11
SHA256	923da694f294728dd497b772ad32b93d9d5c211756bd73cb9926de651c17d0b1
SSDeep	1536:64g4AFhChTzqHrvboWv6FHcxigRoYr/kiEIlhjw85:lrAKhAbRvjxi3YLkiEIlSQ

C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\NBd6m3qs3.m4a

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\NBd6m3qs3.m4a.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	72.48 KB
MD5	c33accea83444beaa147454b5013e00d
SHA1	fafbd68143ff22c473a76337e55f163c8ecd2a82
SHA256	e2f33118e6a0d7150086f9a34944e42fdb20bd969a611c2686d410fbd496ad2b
SSDeep	1536:xCgH/wrHny0Rgiwd/qs9jo/t56ZK/K3RySBpPUf+FjaW:gg2HyllLaBKBy4usjaW

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\QaUjhe\rGw15KQUy_H3LYwN5\4haF6sPbyW_.gif

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\QaUjhe\rGw15KQUy_H3LYwN5\4haF6sPbyW_.gif.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	26.67 KB
MD5	6e2ced5d820b8ae55616e549a902b00e
SHA1	beabce8c47433d97cc0a2eb9bd9427727d9bb21a
SHA256	5a87286909339cb1fb15a9f9fa9391fdecbcd77984429ac979d46ce77741cb1e
SSDeep	768:diHCpYJG/k5whI6yu1Sgq3CA1a/eWBAvEhClnZ6cS4Kt:diHyJMwhI6p4r1yeWDEZ35a

C:\ProgramData\Microsoft Help\MS.VISIO_STD.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.VISIO_STD.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.34 KB
MD5	54700a5400b79473481ed7dfdeeefb5a
SHA1	16aa9439cb9236fcc9041fd39023de94b4c03ecd
SHA256	15a2307c7ec48bedace193641db66f02d1b9385448e0fcb78bf1ed02b5d7d22c
SSDeep	6:gnZ4m9DmDqYX/Q0q3WPm8eWZcmIDTn3eb4zCp7zJmTSR08DRUS:Kv4j6WPOWZcz/C/ApUUS

C:\Users\5p5NrGJn0jS HALPmcxz\Music\y1w5ZZtxeCJCqVDGm8rd.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\y1w5ZZtxeCJCqVDGm8rd.wav.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	91.82 KB
MD5	60a46b6d6b9d71c66b7eb3e497603f99
SHA1	a18cbc8a7b5345953805dd062accb5f386ca154b
SHA256	0b111920d7fbeb143c0754776efbaf61ef87698acbc954fdf28c9d88ae1bade4
SSDeep	1536:Oyji3b4sKcKfkj8ho2auyfG5BOQYWJ6j0uNN+cbaQYEdxUssKqBM:OQi8sKPMoorGzhJlA+jbEdxFP

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\QVNDMBKO6iJXOO2h3\5EP3zi8p1_ R.mkv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\QVNDMBKO6iJXOO2h3\5EP3zi8p1_ R.mkv.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	53.58 KB
MD5	924364df9b9bfff8a3cf594b5c8661db
SHA1	d30d14761f4f812f818dccfd8899a0c6bfe58257
SHA256	eae44aa7a8e63b5598fad18aab6c746dad0c27aa55b4ea27bf3ebe393749761c
SSDeep	768:eFbWK3F+YVxtnAqjfi0QISRRuHtZkNZa+mYwVX8Y2m5ETOTDiUZJkAO+igJvOg3:g1hAq+0xLNQZa+mlX8Yz5nTWUrkoHv53

C:\ProgramData\Sun\Java\Java Update\jaureglist.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Sun\Java\Java Update\jaureglist.xml.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.12 KB
MD5	9bbe5e2553f61466dbd6ddb5bc1b636e
SHA1	eab023b4d06318e2ea8bd77b6f88e4f4c5a73125
SHA256	a7efc3f4f3b217d2d2b11b332390f210c04c90479dc35d69d0e7e06aaa69d592
SSDeep	3:9osouP+bCIzdcd1YrLN5l9kL/OJdMF7VMMEJvLLrOU9Q1n:KuPWLziSflaLqMBeFxzOUq

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\YfljSHP679zr.docx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\YfljSHP679zr.docx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	60.42 KB
MD5	e12b12d231be20c27a2822674cd161fa
SHA1	411d430242ef3d3e885fc33c5b6daf5cf43683fd
SHA256	7d89f7bff1a4e9c8dfff5171e368dde64c5ca8d0c7cdb0cdb953032dc6dfd2ca
SSDeep	1536:L6l+eNpMk7vcwAGvArzv7zUR5CWKr3tUHHJpKWDmpzp:be/MSvPAiavPMW7tEHyWDuzp

C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\b ZEoraAV.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\b ZEoraAV.wav.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	1.86 KB
MD5	ec638692fb2b6b221737428b6266ced6
SHA1	0928b978dab83f3552fc9967fb32f331aec1b87a
SHA256	37f822aec1e0df7352b583c76d332bf3d7782764da7f6402e9f7441abb61b6d7
SSDeep	48:ZdAC+NdZH55aITdUh9Yog6Invyb4iu6XWviO169:ZdA3ddvvFn6bk6vO1O

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\O89VrUgck0WGUK_Y\Hq-306b65BqrHoqbR9.swf

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\O89VrUgck0WGUK_Y\Hq-306b65BqrHoqbR9.swf.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	47.56 KB
MD5	0aaedb5281d160e74a6a0a6d513164ca
SHA1	8813ae7dbe082339e5597c471ce5e4547ff98d5a
SHA256	04d945bcc6b461e68dc3d2c547e85f43d454fa5045cdac16c0d1e937cc61277e
SSDeep	768:d5fAQ/m7AFTYFa4fQYEx/GgKxtGZpdBYAt/Oc+/o4H0cMhTme9rdCKjv+zZ3cmRq:dhNjFT1AQ5JwtSpvFOc20coTme9rdP+g

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\l8fJ\p2jEbzbiEY.odp

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\l8fJ\p2jEbzbiEY.odp.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	31.41 KB
MD5	4a0e85af3204bece69e4c3b42a64036e
SHA1	f3ec830d7baeda51c9a4ae06b82eec78dd822b0c
SHA256	b70c5ac51f8d52e61a846aaac6ee62acd0c0f87a957d6c236e0b6fb35170ef34
SSDeep	768:mZptnPW0h/1FbaZ0ikmZDi2vxbQ9unerUvK:mbtPn1FbaSw02vxSdrQK

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\QaUjhe\rGw15KQUy_H3LYwN5\k-DDYba4e9vKH.png

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\QaUjhe\rGw15KQUy_H3LYwN5\k-DDYba4e9vKH.png.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	31.27 KB
MD5	1a4525a565813e07436bc8ad3f7b07ca
SHA1	0ad0c7aada2d9e0bdb4fb550027bf88a69a61bec
SHA256	19b096cd983bccd4d4ab2631be69deed023fafc97f2f8fa45d9a34f9e3fa6761
SSDeep	768:BriPo+JBF8UnPgMaOdzQe8iTvd6rjetpC/gEceuQ:Bx+lvmO6LrjetpBEcg

C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	1.15 KB
MD5	7c3d9786819fde0950c60f96679e2777
SHA1	64f987414fd5300166847000d680fe5fd17cc7a8
SHA256	636b7fd1fe098ca99e29f6bfb010deaf3550aa211f4bd6bc6d9f5c732e92fd63
SSDeep	24:ILozN0UmhL6Kusu9lhItm99VJPs5mfEXugaV2GpXKP0k9h+VOB1a5Y7Gy:IgLkCX0Srt3s+gSvql9Ig1AY7d

C:\Recovery\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\Winre.wim

Modified File

Stream

Not Queried

»

Also Known As	C:\Recovery\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\Winre.wim.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	10.00 MB
MD5	5205d14da671fcf74a39ce3bf98b53b7
SHA1	dd53b01868653ff10040f8b1b25a6e58cf20da8e
SHA256	99efe9a48a960a728ef50134f3abc2844fc20af4f5382b26c67407bd836e40ee
SSDeep	196608:xQbHCwJ1oXgdL+PUl6xqojQRljrffo1feRTC+JO7MAVgqBpiTGWs:xUCwJ18yL+cl6ZjeljrffowRxMMGciWs

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\hs9eu0cg_VHy7\FiwjPlFCBQK4Eudei\S6KMJ lP85NJg.ppt

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\hs9eu0cg_VHy7\FiwjPlFCBQK4Eudei\S6KMJ lP85NJg.ppt.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	58.49 KB
MD5	82683f778633cf84d510550a2eba6c91
SHA1	e71660c11b52f112828ed408cbfb5800f8e3da39
SHA256	a40d1ea26bd0d50806ce4b2a25ad6aeb895517a9e1e7d1978131cd6763fac547
SSDeep	1536:f0F5Y28UuQTf2EwgA57CPm+GihK6T8T7F+npZLl:fn285wfWQm+GihKpfF+Z

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\3w7z.flv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\3w7z.flv.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	36.89 KB
MD5	92a6836b01eabee9bad6815e7adef281
SHA1	0acf46fc3291e71cae4aaa5506ae2eb0a181dd7e
SHA256	a2eae14a1559043931addbceef6e9f80a5861664af29e1ed42c7bfa68ed5a5ae
SSDeep	768:he1PhxpRUX+UcWbCGq194Y6iq8IYUmliN4Zuc2vzdM/Ih:haRUOWbCD1949iqvYSvzdxh

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\C0QT-PiM3F.pps

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\C0QT-PiM3F.pps.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	10.03 KB
MD5	07eaafec72821953476f1ca0bfa1b45c
SHA1	7d62290140691eccb36d8342c10667e293e201e8
SHA256	7d8e8b1c9b22f9d1c3c043b6f2870709d678073dae42c42c3ffff076c5ed5d72
SSDeep	192:xXQhIGijLhwMWE3E5xjyMYDCbViPgsYxFzVBZncDL1rNw1L:xgAjWE32YDCbcPmFzVudE

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.70 KB
MD5	bc80aa5e7547e2f617b274760cf267b1
SHA1	98725574c03e001c9d14d4feb4882e706cdd898d
SHA256	f37e4d6cff7e86705bad0fb6ed475c18cef8a9c55c46b88dd487c2b3a195e504
SSDeep	12:cEXFFrkAk6FlMOfHA8cT9SmnoUHDUuoQSNBLNcAxpAx5xuTXCMKIngHKP9SnjS:cMLwwFZHARxSJCUT7NvjAx5xuDx+W9sS

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\QVNDMBKO6iJXOO2h3\6R9e9hJWmT-aPrPe.avi

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\QVNDMBKO6iJXOO2h3\6R9e9hJWmT-aPrPe.avi.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	54.44 KB
MD5	7047bb60e8cd06b95fd1126f035c77eb
SHA1	e0c0dc3710f42c2b133b3034d40e8e21728ceec0
SHA256	99f2eadeb6e87682cb5d8a46f390bbe2757e4fa5a028c82e10354bff97aa9b70
SSDeep	1536:auMr9IcLqDmpqSICa8qtjHpPiPrMM47uXy/fwbTj:auQIcLbFIOqSPrOA

C:\Users\All Users\Microsoft\OFFICE\MySharePoints.ico.INFOWAIT

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\All Users\Microsoft\OFFICE\MySharePoints.ico.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	340.79 KB
MD5	f40123db79995301ea73cd6eb473b722
SHA1	3d382f2d3d0ca2c70289327a7d6f4876fda9ab0a
SHA256	0f83363ee8882d969f41cc7b815a9c2d9927612242773adef9b3c458ee64aa6a
SSDeep	3072:led9G825X7QPjp9i/vhxbJVV15kL31VJhGgPfPeGVYRJRAETGr7t0uSAAdZdAd/x:lejAMkJxbzV63G+Pelvk

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\frr7vMqqzTzgf.pptx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\frr7vMqqzTzgf.pptx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	29.55 KB
MD5	fde99c456904308f5a6167ad369223d6
SHA1	7a3ee56a4b7636ae91b2cd5c38becbcebd0a0c79
SHA256	ae8186578d3a7ac3a7bdc5c616cc9320cacacf60cad7f0439ee1fb7809f712f4
SSDeep	768:o5l+T2d4Uax/T12MRWjkjcloTqa89VMejysrH6v86RO:o5FdEtqjmc6TqaGdOsuEr

C:\ProgramData\Microsoft Help\MS.MSPUB.DEV.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.MSPUB.DEV.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.34 KB
MD5	eee43f198379ad5fde5605d860789b15
SHA1	73d5d7548da18731e08627d59602ce9a277194cf
SHA256	9279f4858b1a383d7d444e2b2eae2e31d2659567898295d5e9e82fbd3aaf519a
SSDeep	6:gnZ4i1+HWtGMctUnYq3WPm8eWZcmIDTn3eb4zCp7zJmTSR08DRUS:KA2MRSWPOWZcz/C/ApUUS

C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H.INFOWAIT

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	487.78 KB
MD5	8658ea533fa864226b63b9a68c97c390
SHA1	fef4cbf9418e773235940bce35fe6a7a496e0299
SHA256	1b48c158de05aa3dc1b37c0decc4428d061ff8c3c7331f436304c0458e69c823
SSDeep	6144:nG9b5hIcCIh+o2hUaQORfgXWtp8+n4rpv6daM62rb8WcK:nk5XCIDLNOFgX+n9

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\LB1Vquw6 amP SWGL3zs.flv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\LB1Vquw6 amP SWGL3zs.flv.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	41.77 KB
MD5	ff3e4261f258f0cb82a5201e2f39c652
SHA1	bad029317e09f2f9659b4d1fe98cc0dfb15d6249
SHA256	0bef2217f0365e73b9bab0df4ba65a5696d095adc9ed0eea0c41b0cc87955499
SSDeep	768:pKShUS6QFl7lRpSb5CjfUNWtXxXspvi9IVEzZmcvk2JXttU/au18IFCh:pZUTQF9Dplj8NWBxXSvi9WQmcvk2JXSO

C:\Users\5p5NrGJn0jS HALPmcxz\Music\6G5yHmu-I-1.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\6G5yHmu-I-1.wav.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	94.47 KB
MD5	522dbdf31bda6cd050a211b780f4f838
SHA1	8c37d9245dfc0b2c97b27d13a23ed3338408c8da
SHA256	d2b24afe4722477af47bb88b9628e8966f83db1c56556e3208e26e3bccfc78a2
SSDeep	1536:fkYGZLnat2IGTqjlLkXqI0xTXAoLJ8JtOzEIuH/wch1gzGUjeDrRxZzWpiYdDeiP:cpJ9IYXqIiGizELhqL6Dx+dDeiBt

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\QaUjhe\rGw15KQUy_H3LYwN5\ni-jXUyMmKeOU4Zi2aIU.png

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\QaUjhe\rGw15KQUy_H3LYwN5\ni-jXUyMmKeOU4Zi2aIU.png.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	7.30 KB
MD5	e019373103f708ecac9bd8cc16394a0c
SHA1	f533583d8c046b95892accd93e548f85e39c2381
SHA256	4406eb469e948d979be5fa9f40355c72dd0b0376a5b87a090cce56134d14cd94
SSDeep	192:ZNXBjH3uOklvAt7Jk7rwHSE6cCjhmxJt8RMMPVa:ZNd+PvAtNAUzcVytfMg

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\_PnpDAir3.mp3

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\_PnpDAir3.mp3.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	64.84 KB
MD5	8fab69d75b6fd95d81493d460c311fbf
SHA1	9723359fe7debc3d5e6c6d97a406fa10742058d6
SHA256	5a292841047874608ddb64de941229bae4b33d6a96e7e87b38df6037e712f277
SSDeep	1536:oOa4g1PSvpmtPI3SUEqj6wqbnptW/A2OgAuxFcbCRG:rXg1PSBgWSUEA6/b3WoIxFPRG

C:\Users\5p5NrGJn0jS HALPmcxz\Music\nvyg\tEL2.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\nvyg\tEL2.wav.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	37.91 KB
MD5	caf646f970ddb5d36aa342ac6d21765d
SHA1	d8efd7273a651047c548c861baaf385454492e3d
SHA256	4ddea53cd9baa33a0814b146d21c7d30bc944936d1d5d5c5f0cb64d5eb7ff3b1
SSDeep	768:cDQIZnMvgiCdjyoCqc8oEgFm4g8a7DAzaGCM8Fqg97T3BzOqoVMk:cDQQM4ZdTCq2Egzg8aEahNf97TE

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\skaVx\F0LyAv7a.xls

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\skaVx\F0LyAv7a.xls.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	18.50 KB
MD5	b616feae1a3dc6ae78cf8dddb794e3dc
SHA1	5a2a39d7b27c2eec52673a128588f76bc6421e41
SHA256	2da9067050b6208d3cfc23af0b669146c1efa5dcb28e7d4c2d0eecbc56159455
SSDeep	384:o2KBkTTDcbdEz1QCHbB44hGXkh9qxY/ie2BVAgPpBGeJvISc1EE7:7TTDc8XbBJhGXcqqqe2BVx2iw3P7

C:\ProgramData\Microsoft Help\MS.VISIO.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.VISIO.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.32 KB
MD5	32be74bc2779f44774e1258a81ef2c4b
SHA1	ea3410ef6ed51444d10e41cbc32d826ae5def4e2
SHA256	8b41b3e3f8a7c56194fd9366057c7bc68edb4fa7a452ceee4881c493f8222bf7
SSDeep	6:gnGmDxhfkto8MvV0xzNPn2JXq3K9fNIamKpCiGSOxje0IAZLcjEWHSFmOltPR2:KPDHYMvyxzNvm6aHIamKhYje0I8cAWH9

C:\Users\5p5NrGJn0jS HALPmcxz\Links\RecentPlaces.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Links\RecentPlaces.lnk.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.35 KB
MD5	c837f63f8a2adf4d16c974f9b7cb9f03
SHA1	543dd98977f70379f29e18c532eccf9ebff9d1c8
SHA256	fbd61819add5aa94fe205ba42c627a7b4e4a0b510bd38b47330ea51cc46a3108
SSDeep	6:AUk2Gp2jl/aedCE5W3gJ0+G6ussFyoWmxKCotng3/6WAwm/XYpw+Qc9s6Qr0:Anp2BCedCE5W3gqPkozxKCOlUEGLr9X

C:\Users\5p5NrGJn0jS HALPmcxz\Music\JfvP6S4i2D.m4a

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\JfvP6S4i2D.m4a.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	63.02 KB
MD5	716e4499ab811cc889e10a77efaf104f
SHA1	7768e1e0bc7e593e7318f6afb3d05c5341629e9a
SHA256	15ef64e4d1ffcec8da80b5ef21f91cfade9fbb61c02acdf86e5f2b1824c05b04
SSDeep	1536:LCAXjub0uekQROXBWDYYNChtH/Px+TLdBcvoS5uN:LCAXjLHRcS5itHnx+TLdB8X5o

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\hT-SqtZX\wLIFp9Xlr__Upjp5BWpB.xls

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\hT-SqtZX\wLIFp9Xlr__Upjp5BWpB.xls.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	74.40 KB
MD5	4c937a80530213e5c6c56600ed58d566
SHA1	bc1a40780fafa1b02adcb21b1d6a316480306276
SHA256	0493b9fce7f55a9de04b191b486115652da85c5fe205c8b79c77faf29fd30b08
SSDeep	1536:eFuOpH2y4RUhFy3VTR0S9mw5+3bP6cosF/ie5ny3aMKFk1lkeC+/esd5iX:ez2zUufXA3jzoUj14d+gm+2Ic

C:\Users\5p5NrGJn0jS HALPmcxz\Music\-Fn54ZOPOU2DZgY9Xjjc.mp3

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\-Fn54ZOPOU2DZgY9Xjjc.mp3.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	3.71 KB
MD5	78b0e37903c546b9b06303ea313b5b01
SHA1	546c02eacac67dc2393e7e9324cdc3e650939d92
SHA256	9e5baace53f9bc303796f9e02bc9b2e64f3a02ebab7f2a935ac01d273fea1a8b
SSDeep	96:iXyD3A+2n8eivRNjyjK5JdqdKD7e8oTs9:iXybg8dRNaK5vwKGhT2

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\QVNDMBKO6iJXOO2h3\l414QV7S1.swf

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\QVNDMBKO6iJXOO2h3\l414QV7S1.swf.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	31.67 KB
MD5	b5d66beb22067c7c5bcebf9601ddb038
SHA1	45c88b136badab198d40afb5f585f5f162481128
SHA256	b0a66c4fdc4178d0b4264ad456f6d5b3848d1ba101ae00ad90e2da4e7c911369
SSDeep	768:qk2e1kLbxfZPAuEbihnOro2W3Lqb3BHp/s+s:qk2rbx1AuSEB2m4TA

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ztTnKYuZ\Tloxb4BEF.swf

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ztTnKYuZ\Tloxb4BEF.swf.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	53.39 KB
MD5	df32398ea8327576bab1e896e2cec7a1
SHA1	bc2ee2b65cda9e335388af0b384256a1ac0d3f1c
SHA256	1ffdadb7f1469fab5771b780d8d41d6b8326770d76799a9b2cc8b7de391ee9d8
SSDeep	768:3tdfk7VvOYGYdEatawQIV/MLjRHr+AgT/Sy9aSehU8fHx4yul/Hg7zycGOB:3/fk7ROYRtbn8KvTtbehJfHxHuRgfhB

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\8HC y_m_mnm8.swf

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\8HC y_m_mnm8.swf.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	5.14 KB
MD5	04698eee609ce464fc9fd27d0f6e3de3
SHA1	80341ff0d942abbf699d050c5d831cd25474d6a1
SHA256	bbbbf596b7e9f97745083da4dec59687767737fb4f9414e04b48f22977bac145
SSDeep	96:G+LbvhwZnAaOEXXO/mtsYYIoSco/R9ykZ8MCkI152RGBif:zbkrnrLcopIk6MCkI15EGy

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WBCuWSQzDcN3.xlsx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WBCuWSQzDcN3.xlsx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	89.59 KB
MD5	3d6314e4bc22b14faa01b4f196691ba7
SHA1	e8f6d15987ab731ba3f829663d293d255fcfbaad
SHA256	2aa36cceabce9bf66f549ab5b8838b422a11262b3cc67855a8876b217c340bb8
SSDeep	1536:6qn8PTdkaeKpTVvvzuMwlPpUYzDEq59ORp1nSQeApQgDARJBgy6+ua8+l0g:Z8PhwiTVSMEUCYq5Y71n3p1kDBgy6+u4

C:\ProgramData\Microsoft Help\nslist.hxl

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\nslist.hxl.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	8.46 KB
MD5	1ea363297a6d311fd6d9532bbecbb49c
SHA1	e39d0b9d2172cfe4e9a79b3e567fcc2d93e68425
SHA256	0b5f1ded324aedbfdba1894d33ed3db0d1e750314c85cfb907a0ea44fadd9514
SSDeep	192:CO0qqe9oKN+cb5yrZa65+Guzs5iqaPCOagqwvRwRx+YlJ5Pzp/1Yr:CGqeSK0+yo8duAVcC5tORgxPp/1Y

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\32XcKJ-k MnUkqXRq.pptx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\32XcKJ-k MnUkqXRq.pptx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	99.97 KB
MD5	b30a5f8af552cdf1c2e64694dfde83d6
SHA1	bef4ad498809419b2f298b08d9bac95bc576cd37
SHA256	ca9e731a0c2427726157911c59fa5b1e145f9ed2bf4aa62b572e282edf30e794
SSDeep	3072:lP33GO3174lb6Sgfg3eKRnUeOUYP2RqTnqz3XJoNw:MlTcqRUTKqTQj

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\Vynkb.flv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\Vynkb.flv.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	2.13 KB
MD5	7e7a79952d82485af0f6e9f743ad6d87
SHA1	e586564358f8ecb47c3ce069ab5911b8d199ef56
SHA256	5712b0bf911a7b90c7d6def100a813506491db4df5140a864208623d2f7adaa1
SSDeep	48:gpwNolelfUd27UlZ+Mp8Ci8CzXMbCHDPtzSfo6MUV04EegdVayWO5E/t8VE:gj8tUlcRzPjMbqDPwfP0FyfO5s8E

C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\r7FR3hZryb5hq9Ud7NX.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\r7FR3hZryb5hq9Ud7NX.wav.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	29.26 KB
MD5	14a385d782573581d6c586ccfb9cf9dd
SHA1	4cd2dd58560d318b8f4d07da79d7b85338974dc6
SHA256	691ad17332f93629ed89b78e99aab4913bce7afc9dba568faca6a1fe90c17d09
SSDeep	768:ezHzQOkTuqinYgOuasB/IiEjLyJI6uIwi:OzQ9uqxcL/IHj2eBi

C:\ProgramData\Microsoft Help\MS.ONENOTE.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.ONENOTE.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.33 KB
MD5	7081c18e37653e1c38f21b61486ca58c
SHA1	ddc052c3f3a5e57dc6f3a78ce61a322e98c3e2d9
SHA256	7e611816ef2ff110ce484d3ebf63f853612547a9b57fce1930d63d434170ce08
SSDeep	6:gnlYeUtEz1dxKpbZq6SmGj7fdiGIdzjAz9Fz9zPk2n+8vNpSKbkm:KhNCp5Gj71iGI50xJ9zc2nzvNpJB

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\KCFGl8AGb.jpg

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\KCFGl8AGb.jpg.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	71.45 KB
MD5	88db278b4f6398cfd023f84527b17f46
SHA1	2fd0b8be6415bf69ea5e2e0761b360574ed5dad8
SHA256	142cb61adaa082d17f7912e81fb6d990e104064a8ee71f3a510d454f217fd0f2
SSDeep	1536:U8UPzSykh+43AIlQDSznrdYz87bSuQPdWyWkGQMS:U8jykw4wIKStI8/SuQp1MS

C:\Users\5p5NrGJn0jS HALPmcxz\Music\nJqpjpjhgkzg.m4a

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\nJqpjpjhgkzg.m4a.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	85.61 KB
MD5	ec0bb775e4f7303a39bc1f9ca51fe589
SHA1	e6ec03b8f1d19206d1bb2aac80b49f163956b364
SHA256	04ae18dd2b397b1d3a495461efcc9639ade4dbe35b7258f8cae41d1a03f5f30b
SSDeep	1536:lUaWhYkVcy981FI6YtmarVVebXX/TK7Tad1zY8vOf/cQQLal8DCMWF:HyYkVcQ8PIZiyy1L+Eul8DI

C:\ProgramData\Microsoft Help\MS.EXCEL.DEV.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.EXCEL.DEV.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.34 KB
MD5	15d3c2447aa539fd4ee1880bc892f498
SHA1	5485758e87e13dd1d1bce98b7e19fc3a5867de9c
SHA256	27cf4b8a1d6510b42df62f3dada8b2a822d6946c69f17ec69502bc711492848c
SSDeep	6:gnZ4b1HWXCyGMcyxYq3WPm8eWZcmIDTn3eb4zCp7zJmTSR08DRUS:K8kXC7ejWPOWZcz/C/ApUUS

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\hs9eu0cg_VHy7\FiwjPlFCBQK4Eudei\4aIc13i42g6djkDS.docx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\hs9eu0cg_VHy7\FiwjPlFCBQK4Eudei\4aIc13i42g6djkDS.docx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	18.67 KB
MD5	b3b18e92a06d31652e0ac8347d5ba470
SHA1	41fb229209b8396918a301f221a4efc551561d21
SHA256	6cf9e5f7e1eaf87ffa1de35731a157c2213de7b9e7d63260059ef0c949cfc3ae
SSDeep	384:L7kW7RWQ3ufkSVMMeZRmgMUSq+rI177A+6d4D55Ud8E+vgDx:L7kWNWQefkSVeZkgm/I17q855E6va

C:\Users\5p5NrGJn0jS HALPmcxz\Music\Au5gZJs3.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\Au5gZJs3.wav.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	59.68 KB
MD5	21d2d8d88b47f18c928b0bd0d179430f
SHA1	234d6209881cff2e79ab44767a1388c747b54ca7
SHA256	2e6c4b1277119a234affddcb602db679d328508045fdf8d2f22a71b96179c380
SSDeep	1536:Vk0IjrtceK6jfIaSJ5Kd9cH5AbwdN7AcJGEQJ44+/LF:S5jrtcyLC5gqZmiN7AgGrJA

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\A3o-tRWcczzg.png

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\A3o-tRWcczzg.png.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	13.77 KB
MD5	5bae8d01d521aa3fbec6f4d841bb3007
SHA1	93f2484f66c46a47a148c2bf1fe01c612be6321d
SHA256	52b10369c65c2d9a87a325ac1ce8311a5848b65ff169bcd74cc6656dcdfe5f03
SSDeep	384:ZNA6pmvaEfSIDmJcA/PXaycIvVE1q8Pr8LynGzUzLXB5UU3:lpMaE6IKPPXa8dICynGzUz7UM

C:\ProgramData\Microsoft Help\MS.MSACCESS.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.MSACCESS.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.34 KB
MD5	c92e7e556283ca241511bd76410c5f1d
SHA1	40c60114c020fea6a95379682a218688b117e6b6
SHA256	d4ff77f9facf205d0bb4feb249add9d7d3e4733e3a5a1e2978c16ad17c5529bd
SSDeep	6:gn9LwsYNrjXH6WM9356uawQkCqvm2f7jDbDy8JImcI35mWTap:K9LwLxsY9Nqvm2fPDbDBXnTap

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\pjRRywz moQN7y4K4.ots

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\pjRRywz moQN7y4K4.ots.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	7.90 KB
MD5	b1ff948732b667bde0e7f1d12e86fd5b
SHA1	722c9fe94631d03b0c33933d6e82c08549b2778c
SHA256	057e04956d2d18c65774ef69ee5e46ab368545d3a2970ee8b0fb39b44cc5b3c7
SSDeep	192:x71zdA/cNkJuABy/PyXuP3U8rmuLlKZFjj0:x71zaKWuABhXu/lLuFjg

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\k7CM6LvXyF9LPZI6yh2.mp3

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\k7CM6LvXyF9LPZI6yh2.mp3.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	46.24 KB
MD5	5cdd4ac19bb82e0389f75fa2cc9ca522
SHA1	8e8a453dab1141ae52daebb8da75f977d38eb506
SHA256	bfeaea90c61bede5535b045f4d21d50c9693638b6dc0867ba55383e63b2ad843
SSDeep	768:gWzR0VEDdtlLt0T1r/Nwd9Vzgb43U1UHenlLAdibKZbHH5LMeHZigJI2S1pKuXB7:gmR0EhtlLt0BG9xyUH+AMAb5LMe5igOF

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\GYnW7LZ.m4a

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\GYnW7LZ.m4a.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	4.10 KB
MD5	550bb1f621c57dbe28ebdd1687a0f8fc
SHA1	216676bac4a3eceb5d905d38250f25d45805b934
SHA256	7e795d5db900f2ce8083426af20d0945f8b5e983cee285513a51c3ba755bc40f
SSDeep	96:zsfgxlWrx/a9LEZ9DcI0MljrVYiJK/b5QMTgoZqSBSai6tRre036a1Qm:vI/aREZ9DcI0+HVFK/dZRBY6p3em

C:\Users\All Users\Microsoft\OFFICE\AssetLibrary.ico.INFOWAIT

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\All Users\Microsoft\OFFICE\AssetLibrary.ico.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	5.30 KB
MD5	a2515ff3c0deddd713ead5d0fd54ba28
SHA1	60dc752dc8ce3164375eb83e276e8e80c2446524
SHA256	2107f33f6fce1d4b9d4f975643dd1c91e02c86716f34b7eec48bd494f7252b7b
SSDeep	96:ypqJivNqqXmVRlEqMIU1cQl9rUQO9D5ddMlR9mdKiHVuS:al+VU7UQmHdMlz9YVuS

C:\ProgramData\Microsoft Help\MS.VISIO.DEV.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.VISIO.DEV.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.34 KB
MD5	dc2a14a8e14166196be78264210134b9
SHA1	a027b7192f5041537bffbfed29b3a46b8684162c
SHA256	99dcedea96c119223aaae5373999fed18baa875742f9b15ea9c2d46c42858393
SSDeep	6:gnZ4m5dxpWwJVGMcFVYq3WPm8eWZcmIDTn3eb4zCp7zJmTSR08DRUS:KvDxcwJkxPWPOWZcz/C/ApUUS

C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.49 KB
MD5	5709f46fc5404967b760e238fc183c9a
SHA1	d55329fe74d71df6487e9d35245cefed8a78ea3f
SHA256	d50793f8ebfd65fcaf16430ab326c4a786aa23f1910d6744c20101578b3566b7
SSDeep	12:ilZ9RF+tHms0as3mkNF0Le+qYGQO6Pc1q3NEWSJUs:il32hsX0Lcs3WW0v

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hjEoNe.swf

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hjEoNe.swf.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	39.33 KB
MD5	a4b603ce4cc4320dcf2aa37e59b8aaa9
SHA1	29d29ec6b3799d6ee8875a72f1d1d9a103ed514e
SHA256	c9e37a09bd68be7135f76a37569e5c62943cc15f4662bd7bd9da67cad77205ec
SSDeep	768:g6ulZFD8G0JBsMGpxw/P0YiqdBbHY8Og3RzI9Wi/VKpyasraYbk:guG0JBs20Yi8bHd530NLayxI

C:\ProgramData\Microsoft Help\MS.MSACCESS.DEV.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.MSACCESS.DEV.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.36 KB
MD5	f9bce577ecb5373d5f6d893d3781bc35
SHA1	b336093e115f2fe0a6dab76be84f603a82d0461a
SHA256	f0b5c4e77e42aad6823000fcd7eb23c9a8a8f4ba76f4fa2529e70dc1a420dd62
SSDeep	6:gnpdHC/qGFVdiDRRbBgBgeAU3DyY2a4ZRAuyR/CQPz7SzPuu9DzFfLCr:KpdHC/qGloWBT72awRLsZKPuiz5c

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\O89VrUgck0WGUK_Y\8RjZdKR.avi

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\O89VrUgck0WGUK_Y\8RjZdKR.avi.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	31.46 KB
MD5	660742f7874e8e5839568065ed0bc849
SHA1	0cbd89192f54c7371edbc7357c0599109682d70f
SHA256	904a721b1f8c0ef69ae8ce6421cd3fcfe8a186a376d7363c8381047591269635
SSDeep	768:f1z8Yljf7+UBl2W6F6LsEZDsJQindyXpq2Xdwd/w:dzDjViF6LaJ1y2d/w

C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\UrqJ.m4a

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\UrqJ.m4a.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	13.04 KB
MD5	a610c325abd4a799cd1ee2235eac182a
SHA1	15d808ad90953cca4e7ff9dacb641a35f6953a88
SHA256	79030d79da65892fad704de85dbf1e3ce3d824617b3b49a4a35d95909940dcd8
SSDeep	384:STkSGqscIClEyRPf8WvNzHKddAm/2RHP78W3:OkSWrCfnlzHKzADV78+

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\Lkq3 EjT.m4a

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\Lkq3 EjT.m4a.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	4.09 KB
MD5	b858496adacddd886f4bfbfdd42d5ee8
SHA1	85a82c7f718cbbe6a271f898628c5be0261cbf83
SHA256	d54f801d0380106571659e4fc895f388367072e908e2f6d567678588d7a03156
SSDeep	96:zrK/CVMMUEpcpMTdcU01u3E+V5sK87ziNocMjfp7ro2iho:vIbG0MRcveLqz5c8p75Qo

C:\Users\All Users\Microsoft\OFFICE\DocumentRepository.ico.INFOWAIT

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\All Users\Microsoft\OFFICE\DocumentRepository.ico.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	24.62 KB
MD5	4dfee7c36519992d9d244d72a5fd7bdb
SHA1	2b3478cabcf89df66b2719fbf08133fbd5fd1a38
SHA256	8069952609a80c8653e76712f7f6b5fa5563b357af0ee6376c08c1c228299e1a
SSDeep	768:MOpQs6B47hJ3PPfDzG+1R+Cu5M4m7AnGyDbvQ:NpQsn/D6+1R+cJsD8

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\O89VrUgck0WGUK_Y\kpXaWD.mp4

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\O89VrUgck0WGUK_Y\kpXaWD.mp4.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	9.03 KB
MD5	6bb6c40fc446c4c5979e17adc212e9fa
SHA1	f32de785c16051bd7b762f93ecba7c263866f6d5
SHA256	595ccd08c3f2221972ea8d6f7a454264a38f20587968a5c2bf47f63046349aff
SSDeep	192:CyPQ2sHU6WxTSx++FEAuHV80yMfcto44Jy7mIwj/cor24r:CyP6U6Wx280u180yMOiw7mv0Wr

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\gwCCr5SN1.bmp

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\gwCCr5SN1.bmp.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	12.32 KB
MD5	d8f6b45a153da5b9d92113a079279184
SHA1	520b8eb1cb4c0e72987ad02b1a63135b45a0b88c
SHA256	0269cf6d2995e25dfd12cf76b06d9ced78510f2f25b555fe92f9accaaedf5dd8
SSDeep	192:gkQ9PY4VeXqKCCKoktBeltLB+EHi1SKiDPydjZeMDIlK2m/z4d0BJVeB6AdspjDa:7tM5KXGT4UIsdjfoi/q0BnDa

C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	1.14 KB
MD5	3a5352e28f69a73b88426b38ebc33845
SHA1	05d62bd26c54167673150a9e82df0668a78f0a15
SHA256	94ed089c46170e926b00b54f3cbbf9dc42d4379c8e5aae594f842a12361fa350
SSDeep	24:ILozN0UmhL6Kusu9lyJxrzyakf+qvc+lzWLZtkY15GG4CgQ/EVh:IgLkCXyJZ7kGgc+NWLhwCnQ

C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\nxKQUQU2ESS.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\rXoVxt3oiS\O5g4jLerSHDy3Pf8Z8r\nxKQUQU2ESS.wav.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	18.25 KB
MD5	5c69255206e4027834d62e9273285134
SHA1	9e5180d2f65049956b09afd7fecb53acde273f33
SHA256	e1518b7ee81051f755c2da7dcc4eedebb9a6032f200d44a8beac4c1b6a493a4b
SSDeep	384:YvAS1uDGXhSXLDsO7i0GwFV1x7pOyE2MrKAKYyj0fJuyG0:WArShSXnsaigFlpOXrKAHfJuF0

C:\Users\5p5NrGJn0jS HALPmcxz\Links\Desktop.lnk

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Links\Desktop.lnk.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.47 KB
MD5	4868f86d06bc1b586ebe49f6bf84ee45
SHA1	69cb6c99f716b6c6a8a957f02ae5cd48b8a60763
SHA256	675b45cdc16801ba74999ee0d3b50ed7b94e808f46b7f896ebed900fecfac472
SSDeep	12:jOhedIEIFS6u0MLmkZLc+GoSXHA/63mQ+E:/L6u0M6kZ9iXc6qE

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\ZVtPiW.bmp

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\ZVtPiW.bmp.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	42.41 KB
MD5	5c4b035192b37554d74a7c843f23ed3d
SHA1	c101ec96b6b232679d7f47b99dca42276e362978
SHA256	8736d0b86653af3f4f8e88a5d2ed5316e1f33f358240ba6b35a72be2db393dd9
SSDeep	768:5zxAAYgZfeFxoHiAS0yv38crQRpN9eeFz8DBNjpWTSaYTGiTeNW5un8ZwC0C:5zxP7ZW4H/uvvkRpPee0/joTSTGikWA0

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\7UQS1.docx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\7UQS1.docx.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	79.46 KB
MD5	29648d3d5c25818e9a44d443323d7ae9
SHA1	e592f0a711d72e6aedad9317a9dcf8de975e7926
SHA256	a6ea90248d8dc2eaaed5c84372c8f17df553c647a333be3e0077baa0c470e849
SSDeep	1536:LDJ9exrGdahWorWgDyGzaEqNhFG2AdOJ3nzYFfTVnQ4bY0a9btx0txho+wNRZwNp:fJ9g0agsZDyGzaEuhA20OJ3clVnQ4PsI

C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\desktop.ini

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\desktop.ini.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.40 KB
MD5	9095947b4accd8e7cc8d4ee798c45667
SHA1	d5fa56c198f021eacafa7dccc135837956e734e7
SHA256	4feafa99292984e5f6eb37b2b2ce8eacc103a5f89fd7866d25e34a912756160e
SSDeep	6:Chp3bZ9tz20guqjlcYlP2M3haJa4pYBITHW3mVkTCEAV6KthnNa3hYN7GNZH:ilZ9RF+9tcw4pYBIT+OE46Kthnc3nL

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\hs9eu0cg_VHy7\6qkqye2rCRGlE5P.ppt

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\hs9eu0cg_VHy7\6qkqye2rCRGlE5P.ppt.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	61.96 KB
MD5	94f0bbfd7d7856d610cea13168f18288
SHA1	cf73b23671e7e85ec0c24fcb6a95fd655e492bfc
SHA256	5a15635194188c753a7b8d8a1a966b5cef3659361844527d52e3b97871445bc4
SSDeep	1536:6XwEJMDrk/LuJKk9ypidNp88h0aHnMdk7UJR:6XH454uypizXuaHZUz

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\EEWWiY3V3RdCY.gif

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\EEWWiY3V3RdCY.gif.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	51.05 KB
MD5	1bd7ef846047b672a45c3304b077f96a
SHA1	1b85428cbb558b8db1ebde70e3d1b60b1661aff6
SHA256	4f06baffeefb03da708a838ba2e47c9bacfebf6360758acd3b679e20efcc5a62
SSDeep	1536:PyWDe8nRUtk5lpuUMHGdK2/qRrutBrqyhAd4eNRuh:+8nRek3vK2/ZxhAd4enE

C:\Users\All Users\Microsoft\IdentityCRL\ppcrlui.dll.INFOWAIT

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\All Users\Microsoft\IdentityCRL\ppcrlui.dll.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	248.26 KB
MD5	1a438d0e2cd956b89a0931d88fed8e38
SHA1	f313ca6d13da180c9ec93b23c71baebb5df477f3
SHA256	bece19ca7b0c56cea9f34d5e7088248a86e84507ad9dc6b2a55e3c66235e732c
SSDeep	3072:TL+pFSleOPQBWTrHUMFiQ6YmjVv0rIFgpbba2KJDbmcADTmvK/WxHHsD3c072tTe:mpUlFXlF34Vv0EFqnozAL+x+n

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\baHs2DdbqE.swf

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\baHs2DdbqE.swf.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	33.42 KB
MD5	e3a00552f11f2eb6e1aed9d53863862c
SHA1	a48a0f5300e54a5d374919a6f369f1ff2da7327f
SHA256	5b3c1e77758bc5a6187d0d3e38ceb22a95526420e9659c2dc0307672d1fb67b1
SSDeep	768:YzEMR6ch1HHm1vAbA82LvP6odgNn+lY/idLJwR41nE+tK+6sW:YwYh8ZAbA82Ln6oKN+lBLJQ41nK+tW

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\hs9eu0cg_VHy7\MGAfBc25T.ots

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\yqgAGD0mq69zIZ\Dkb64er\hs9eu0cg_VHy7\MGAfBc25T.ots.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	52.03 KB
MD5	16269cf484155f9c913884656da351c4
SHA1	18b8c2d73e0403a9b1198d533e9c4710d1cdad33
SHA256	a33d6fcee5aa8364da9dbf40a700267c8d69e5e9c4548ce469d77ac34e4e1a14
SSDeep	768:suVeOJIXvK6fwxfKGqaPX5VjmqdwHPbSfZEzPGxeBsVe1T0uxkN8YZ2eHpqz36l:3VewIXy1frjxVjnfKzuxLVequaKBeSS

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\QVNDMBKO6iJXOO2h3\hCecQC2.mp4

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EXInUgGRa8IXEf\QVNDMBKO6iJXOO2h3\hCecQC2.mp4.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	91.65 KB
MD5	05e0030df14c50f351f72465d856f137
SHA1	1d0344698f760fa7d4d53678ef97abd97e94f6f5
SHA256	02deb4e0773daf1408a1ab9d4fdc4b1802e30660c20af72df3a1447ef22b8911
SSDeep	1536:hAjLHY9STFHrEYnaoKTCiivQH+FaG7VcVrhC1sHpyUxn7d53UQ:mjLHY9wFZ2+T4H2P7q3Dbn7nUQ

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\-l0TaG633wu CFDx3Y-.doc

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c30-G7I4Ib7Y-VxrTcg6\-l0TaG633wu CFDx3Y-.doc.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	83.93 KB
MD5	e36dee5879ecdbbb956d4b84c1eecb61
SHA1	a0d7c12a9c858700e8c534864f54a5bc3ee45643
SHA256	12722183d24039ee2fd97e1aeb0b7384b56d8660a5bcb306cfb0d006a05450e5
SSDeep	1536:YBzzTsCIzEARqHzJkXHyaS/KNR1mfNDKhdTqgTLwsv4LB8mBdlSNAZGk6O:YBzzTsCEEm0zyXHroq1mGdzgN8mfcVa

C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\desktop.ini

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\desktop.ini.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.28 KB
MD5	3cc774c46b7f0f5d4024736f90ffeb22
SHA1	ab6c40da423a8a3e662eb7a8d4b4323191466c9d
SHA256	a6148c8700f56f60e8005c9def160b887352dde74ff01fdd4f6fb5ad8f60c760
SSDeep	6:Chp3bZ9tz20guqtHO7oxR+asK59q5GYigX1OPl02n:ilZ9RF+tHms0asq9uG8X0902

C:\Users\5p5NrGJn0jS HALPmcxz\Music\nvyg\X8qNDeYP35alh231JX16.mp3

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\nvyg\X8qNDeYP35alh231JX16.mp3.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	18.50 KB
MD5	09e26b400e5abcf9c5128aca1480ee0a
SHA1	01b80fcadbbbf222bdc755dd7bc565c4bb706b53
SHA256	635776c4e9dc2e452d17bad0d9ad2c28085260f2943d4149745b4dbfacc34429
SSDeep	384:ikABJpJz8+z2O2wnW3KthxPD8qMXV/WsP/KMa/VRpCwUn/CoxfLiunbHF2Vj+:aPVBW6thiqMXVOKyd3wn/rOGbEC

C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_BestBet.H1W.INFOWAIT

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_BestBet.H1W.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	201.48 KB
MD5	c001f49220eefc8b8cbef5a35bba2167
SHA1	5dae52581ad09b81faadb048fa415a746af40d9e
SHA256	f35bb6e75e696b09e385944a21249cce6e718ae504af2adbb12cf994691952b7
SSDeep	3072:DWJWeFD2f8koZr5SwCgODjI+TIRMmBQ58OlSNAyskQZWkXqHMF/QjbcJ5KUOIsLH:aw8bZowCgODjBTIGmBQP4AXck6sC

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\8ctUF06 2SC36xX7cR0\luqHM\znFXRDcUkqphQAEI4ui.bmp

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\n7JpqV\8ctUF06 2SC36xX7cR0\luqHM\znFXRDcUkqphQAEI4ui.bmp.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	48.95 KB
MD5	78663eb0675a322cbaf8affafba0f7c5
SHA1	19313cec234ca0d527cb65ebd23cf7003b3a8a67
SHA256	9183692957a216914e22b00c419d6c1dcb68ef39aefb42c64124a2e3c7df3cf2
SSDeep	1536:g8ZtsqudICkjz++gKk+D6bQA1rA0m/CQG/5:hZtsq7CkjS+WddECB5

C:\ProgramData\Microsoft Help\MS.MSTORE.14.1033.hxn

Modified File

Stream

Not Queried

»

Also Known As	C:\ProgramData\Microsoft Help\MS.MSTORE.14.1033.hxn.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.32 KB
MD5	b85d78d22d5170ef033f0e2e47336cc5
SHA1	a37e7fddb55c8b1cdb30fb117f089d8ccf23a4f1
SHA256	5a299d9deef55d087395774c774f85366a13f8999f7dd27d958804f08d6c7c72
SSDeep	6:gnO/aNSEfIMWgVbm3PA++eipFPMszjVftQGaWP2TU5S9l0rPpNa:KO/aw5abIN+TpFPMszJfiGJoU5M0Lva

C:\Recovery\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\boot.sdi

Modified File

Stream

Not Queried

»

Also Known As	C:\Recovery\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\boot.sdi.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	3.02 MB
MD5	69da4a98a727eef7d9d4ae85f16cbfef
SHA1	6881ab9c233c39905107e81cd7a07350abc59880
SHA256	f11a005806ce78fb98b390c6f312b1ec40a6b72dea4a099eaf4ded168e079d78
SSDeep	6144:edUZSFJRl3BrDXxAdnIGqa1ZGz+LcRn7y/EouH/cpi:eqwlRfhAd9p1ZGzjcRuH/c8

C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	0.13 KB
MD5	a08f4b4189dc3cfa3d75189acd7a8826
SHA1	dadd1631abe9ff229109649caaae1ce35054c1c3
SHA256	d1b9b65a3802a4dee2c74f3cc4fcd443e2010d6bcea56541d0ca24acae640b05
SSDeep	3:afwSkqOCAPkOfaO7dvjYPDz58Q0xz6vtkdzN9exub0RQus:afwSkeMRRkPDz58dz6vtkhgM

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\QaUjhe\rGw15KQUy_H3LYwN5\2QiXDoa8V yuTWH7Q.bmp

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zu1 _on\QaUjhe\rGw15KQUy_H3LYwN5\2QiXDoa8V yuTWH7Q.bmp.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	37.36 KB
MD5	db61b118cdc63807952a4a961aaee34f
SHA1	84a66d97559c49c8215e817e38e69c27e67cea91
SHA256	37611355a7e7c348dc0dbcfb3116995425359e6c559546b8a906d163afdfb818
SSDeep	768:hgBtVB5jyHooPPEA8domiMqrBq2XIITqVz8ov1orri2svV:CTyIoPKqrBZIcoCvFAV

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PSzsrL7.avi

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Videos\PSzsrL7.avi.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	52.21 KB
MD5	c946a9e49821c576e1f56827cdaddd31
SHA1	8ee6e40a355080603bbb777d047dd1e22ba53114
SHA256	e1ff22327c5ff5d80634d7b1521e77b8b95ca11fc1cd85ddbae3adfeb43440f5
SSDeep	768:KZ6OdLS9zk4vr0L/3AYVDLhqo7ScgcV7EG3qrK72WYZw2eGW6s9j8ot1HEE40Sr+:K4OJS9zkEIfhl7SU7EG/RGvs9j8otc+

C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\Qj0Bxz9rAG9Fja0Mk.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\4fONS\Qj0Bxz9rAG9Fja0Mk.wav.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	34.97 KB
MD5	a2ff8e8da63a328a65573720a972ea62
SHA1	3d2b8d14ba596fa583c7043e3557f562a682ea25
SHA256	bc7974856885f4c50aa4e174a4077c4920c16d8d93c001b878c507dd9f11d1d8
SSDeep	768:zHWfGvO9C69M6QIQxZDg+76sQ0htUJlLGKCS9tg2DDdWcn3XVQ:zHWfGF6iKGZN5tc5PNEyDkgVQ

C:\Users\All Users\Microsoft\MF\Active.GRL.INFOWAIT

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\All Users\Microsoft\MF\Active.GRL.INFOWAIT (Created File) c:\programdata\microsoft\mf\pending.grl (Modified File) C:\Users\All Users\Microsoft\MF\Pending.GRL.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	14.62 KB
MD5	2b1fd3109100b588af650c90de327ec8
SHA1	441f51adc82da0660cb9a48645a3fa6158ed1548
SHA256	32ec922815c8c31a57ebec344be4bbc2f018b3c5de55124c0601d973e88782e4
SSDeep	384:Gh4DIiAWVh3ze0ZIMlXt7ne38gF7ysx9TGSEnpQSNoKGIASMr+6oso:GbWr3zqM7e38wDxUpQSNoKG4y+5D

C:\Users\5p5NrGJn0jS HALPmcxz\Music\w52qqQUsQntD6lz uu_3.m4a

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Music\w52qqQUsQntD6lz uu_3.m4a.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	37.39 KB
MD5	e80919e6beb75f3caaab683f49dbfe71
SHA1	111f7230e210940edbe032b7b847662f8bc9c017
SHA256	96c801a31ace1bd9d62542ebee16b00df89b8ef9d7d38bb63423ea017ca38f7a
SSDeep	768:OdrYENkMOgdQUtHfuhMpHrJJWctxbAHRqsJomfRBgmaMdQNprT3haK1Ng/IcXe:OqENIgdQkHfuhyH9J1AHRNo+uNV3hH1d

C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact.INFOWAIT (Created File)
Mime Type	application/octet-stream
File Size	1.14 KB
MD5	b810cb40a9c6a75806e673bbdf5aff45
SHA1	4a79fc6b5e3c62c66e7b16f270d18f20e608b0ae
SHA256	831f79a0bef79e46b92a0343822bd96c2213037f7dd39592eb31f46845edd793
SSDeep	24:ILozN0UmhL6Kusu9lU1yCzPfmZTqYqeG5ECyh07B98onrhi:IgLkCXEetVDG5E1O7B9Dk

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\script.ps1

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	0.05 KB
MD5	f972c62f986b5ed49ad7713d93bf6c9f
SHA1	4e157002bdb97e9526ab97bfafbf7c67e1d1efbf
SHA256	b47f85974a7ec2fd5aa82d52f08eb0f6cea7e596a98dd29e8b85b5c37beca0a8
SSDeep	3:uIHeGAFcX5wTnl:/eGgHTl

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\544c4f6e-08e8-406f-ae98-d88505d8a2e3\update.exe

Created File

Unknown

Not Queried

»

Mime Type	application/x-empty
File Size	0.00 KB
MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep	3::

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\ac0fced0-d42a-4728-a9f2-bdfd4590c238\1.exe

Created File

Binary

Not Queried

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\1[1].exe (Created File)
Mime Type	application/x-dosexec
File Size	180.50 KB
MD5	3aebd4ff369d3a09905a73b94d83cd69
SHA1	4528b882dafcbd5039f3c6cef1ebc54a23855e8a
SHA256	362209793fe1f5a3bd006639ed8ca3ed1315823bbb36557ed5546109ae181b21
SSDeep	3072:S5mBBAQLszJ0dYqqnSDCYi/v2rwXxMTAIC91+Z:SIBBgtVSQxGA0Z
ImpHash	7f0c9f56cfb9c356d7677415eb8c9518

PE Information

»

Image Base	0x400000
Entry Point	0x4023f7
Size Of Code	0xd400
Size Of Initialized Data	0x20600
File Type	executable
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2018-11-06 14:23:02+00:00

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0xd2f5	0xd400	0x400	cnt_code, mem_execute, mem_read	6.61
.rdata	0x40f000	0x6b32	0x6c00	0xd800	cnt_initialized_data, mem_read	4.79
.data	0x416000	0x155c	0xa00	0x14400	cnt_initialized_data, mem_read, mem_write	2.26
.rsrc	0x418000	0x171e8	0x17200	0x14e00	cnt_initialized_data, mem_read	4.03
.reloc	0x430000	0x1028	0x1200	0x2c000	cnt_initialized_data, mem_discardable, mem_read	6.2

Imports (4)

»

KERNEL32.dll (76)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CreateFileA	0x0	0x40f01c	0x15358	0x13b58	0xc2
WriteFile	0x0	0x40f020	0x1535c	0x13b5c	0x60a
FlushFileBuffers	0x0	0x40f024	0x15360	0x13b60	0x19d
CloseHandle	0x0	0x40f028	0x15364	0x13b64	0x86
CreateProcessA	0x0	0x40f02c	0x15368	0x13b68	0xdf
lstrcpyW	0x0	0x40f030	0x1536c	0x13b6c	0x62e
CreateProcessW	0x0	0x40f034	0x15370	0x13b70	0xe4
WaitForSingleObject	0x0	0x40f038	0x15374	0x13b74	0x5cf
CreateFileW	0x0	0x40f03c	0x15378	0x13b78	0xca
lstrlenA	0x0	0x40f040	0x1537c	0x13b7c	0x633
WideCharToMultiByte	0x0	0x40f044	0x15380	0x13b80	0x5f6
MultiByteToWideChar	0x0	0x40f048	0x15384	0x13b84	0x3e8
GetCommandLineW	0x0	0x40f04c	0x15388	0x13b88	0x1d5
WriteConsoleW	0x0	0x40f050	0x1538c	0x13b8c	0x609
SetFilePointerEx	0x0	0x40f054	0x15390	0x13b90	0x51b
GetConsoleMode	0x0	0x40f058	0x15394	0x13b94	0x1fa
DeleteFileA	0x0	0x40f05c	0x15398	0x13b98	0x110
HeapReAlloc	0x0	0x40f060	0x1539c	0x13b9c	0x348
HeapSize	0x0	0x40f064	0x153a0	0x13ba0	0x34a
GetProcessHeap	0x0	0x40f068	0x153a4	0x13ba4	0x2b0
LCMapStringW	0x0	0x40f06c	0x153a8	0x13ba8	0x3ac
GetStringTypeW	0x0	0x40f070	0x153ac	0x13bac	0x2d3
GetFileType	0x0	0x40f074	0x153b0	0x13bb0	0x24a
SetStdHandle	0x0	0x40f078	0x153b4	0x13bb4	0x542
lstrcatA	0x0	0x40f07c	0x153b8	0x13bb8	0x624
lstrcpyA	0x0	0x40f080	0x153bc	0x13bbc	0x62d
GetEnvironmentVariableA	0x0	0x40f084	0x153c0	0x13bc0	0x234
GetShortPathNameA	0x0	0x40f088	0x153c4	0x13bc4	0x2c8
GetModuleFileNameA	0x0	0x40f08c	0x153c8	0x13bc8	0x26f
GetConsoleCP	0x0	0x40f090	0x153cc	0x13bcc	0x1e8
SetLastError	0x0	0x40f094	0x153d0	0x13bd0	0x52a
FreeEnvironmentStringsW	0x0	0x40f098	0x153d4	0x13bd4	0x1a8
GetEnvironmentStringsW	0x0	0x40f09c	0x153d8	0x13bd8	0x233
GetCommandLineA	0x0	0x40f0a0	0x153dc	0x13bdc	0x1d4
GetCPInfo	0x0	0x40f0a4	0x153e0	0x13be0	0x1bf
GetOEMCP	0x0	0x40f0a8	0x153e4	0x13be4	0x293
IsValidCodePage	0x0	0x40f0ac	0x153e8	0x13be8	0x386
UnhandledExceptionFilter	0x0	0x40f0b0	0x153ec	0x13bec	0x5a5
SetUnhandledExceptionFilter	0x0	0x40f0b4	0x153f0	0x13bf0	0x565
GetCurrentProcess	0x0	0x40f0b8	0x153f4	0x13bf4	0x215
TerminateProcess	0x0	0x40f0bc	0x153f8	0x13bf8	0x584
IsProcessorFeaturePresent	0x0	0x40f0c0	0x153fc	0x13bfc	0x381
QueryPerformanceCounter	0x0	0x40f0c4	0x15400	0x13c00	0x446
GetCurrentProcessId	0x0	0x40f0c8	0x15404	0x13c04	0x216
GetCurrentThreadId	0x0	0x40f0cc	0x15408	0x13c08	0x21a
GetSystemTimeAsFileTime	0x0	0x40f0d0	0x1540c	0x13c0c	0x2e5
InitializeSListHead	0x0	0x40f0d4	0x15410	0x13c10	0x35e
IsDebuggerPresent	0x0	0x40f0d8	0x15414	0x13c14	0x37a
GetStartupInfoW	0x0	0x40f0dc	0x15418	0x13c18	0x2cc
GetModuleHandleW	0x0	0x40f0e0	0x1541c	0x13c1c	0x274
RtlUnwind	0x0	0x40f0e4	0x15420	0x13c20	0x4cb
RaiseException	0x0	0x40f0e8	0x15424	0x13c24	0x45b
GetLastError	0x0	0x40f0ec	0x15428	0x13c28	0x25d
EncodePointer	0x0	0x40f0f0	0x1542c	0x13c2c	0x12b
EnterCriticalSection	0x0	0x40f0f4	0x15430	0x13c30	0x12f
LeaveCriticalSection	0x0	0x40f0f8	0x15434	0x13c34	0x3b8
DeleteCriticalSection	0x0	0x40f0fc	0x15438	0x13c38	0x10e
InitializeCriticalSectionAndSpinCount	0x0	0x40f100	0x1543c	0x13c3c	0x35a
TlsAlloc	0x0	0x40f104	0x15440	0x13c40	0x596
TlsGetValue	0x0	0x40f108	0x15444	0x13c44	0x598
TlsSetValue	0x0	0x40f10c	0x15448	0x13c48	0x599
TlsFree	0x0	0x40f110	0x1544c	0x13c4c	0x597
FreeLibrary	0x0	0x40f114	0x15450	0x13c50	0x1a9
GetProcAddress	0x0	0x40f118	0x15454	0x13c54	0x2aa
LoadLibraryExW	0x0	0x40f11c	0x15458	0x13c58	0x3be
GetStdHandle	0x0	0x40f120	0x1545c	0x13c5c	0x2ce
GetModuleFileNameW	0x0	0x40f124	0x15460	0x13c60	0x270
ExitProcess	0x0	0x40f128	0x15464	0x13c64	0x15c
GetModuleHandleExW	0x0	0x40f12c	0x15468	0x13c68	0x273
GetACP	0x0	0x40f130	0x1546c	0x13c6c	0x1b0
HeapAlloc	0x0	0x40f134	0x15470	0x13c70	0x341
HeapFree	0x0	0x40f138	0x15474	0x13c74	0x345
FindClose	0x0	0x40f13c	0x15478	0x13c78	0x173
FindFirstFileExW	0x0	0x40f140	0x1547c	0x13c7c	0x179
FindNextFileW	0x0	0x40f144	0x15480	0x13c80	0x18a
DecodePointer	0x0	0x40f148	0x15484	0x13c84	0x107

ADVAPI32.dll (6)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RegOpenKeyExW	0x0	0x40f000	0x1533c	0x13b3c	0x28c
RegCloseKey	0x0	0x40f004	0x15340	0x13b40	0x25b
RegCreateKeyExW	0x0	0x40f008	0x15344	0x13b44	0x264
SetSecurityDescriptorDacl	0x0	0x40f00c	0x15348	0x13b48	0x2e8
InitializeSecurityDescriptor	0x0	0x40f010	0x1534c	0x13b4c	0x18f
RegSetValueExW	0x0	0x40f014	0x15350	0x13b50	0x2a9

SHELL32.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ShellExecuteExW	0x0	0x40f150	0x1548c	0x13c8c	0x1b7
SHGetFolderPathW	0x0	0x40f154	0x15490	0x13c90	0x159
CommandLineToArgvW	0x0	0x40f158	0x15494	0x13c94	0x7

SHLWAPI.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
PathAppendW	0x0	0x40f160	0x1549c	0x13c9c	0x37
PathFileExistsA	0x0	0x40f164	0x154a0	0x13ca0	0x47
PathRemoveFileSpecW	0x0	0x40f168	0x154a4	0x13ca4	0x8f

Icons (2)

»

C:\!readme.txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.15 KB
MD5	51844619594311f8f98385fa601ca7b7
SHA1	c7a29add814f2af4d84e23776fdf447c0f8a2f87
SHA256	61538dd0a1732b6cd0dba2266b30bd8879b30cd8bd04aef465d22df2e1fd7ce6
SSDeep	24:Xn1O0IlrjFgcYrJyoFRj3ZiaSj10SAzzcowhf+yPyDYj:lO0wl+4khmmXzcjSMj

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\ac0fced0-d42a-4728-a9f2-bdfd4590c238\updatewin.exe

Created File

Binary

Not Queried

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\updatewin[1].exe (Created File)
Mime Type	application/x-dosexec
File Size	128.00 KB
MD5	71f57d369f6b570521cecafe57685ac1
SHA1	b271e976c42233872cccbbb8bffb9baa0f148578
SHA256	827116c338d4521729ec25d67c2a7acaf1295922de828f600d3dd4a41d001d22
SSDeep	3072:R5gPfJ0y76KyOoUjLFfiDo6YKV8aW2DW26JF:R5gPDmpgbS8axDx6F
ImpHash	c514b0944baa377cd68083b912c093ee

PE Information

»

Image Base	0x400000
Entry Point	0x401a9b
Size Of Code	0xb400
Size Of Initialized Data	0x15600
File Type	executable
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2018-11-07 15:49:36+00:00

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0xb357	0xb400	0x400	cnt_code, mem_execute, mem_read	6.63
.rdata	0x40d000	0x5f30	0x6000	0xb800	cnt_initialized_data, mem_read	4.9
.data	0x413000	0x1458	0x800	0x11800	cnt_initialized_data, mem_read, mem_write	2.0
.rsrc	0x415000	0xcfb0	0xd000	0x12000	cnt_initialized_data, mem_read	5.07
.reloc	0x422000	0xeec	0x1000	0x1f000	cnt_initialized_data, mem_discardable, mem_read	6.36

Imports (5)

»

KERNEL32.dll (66)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
FlushFileBuffers	0x0	0x40d028	0x12624	0x10e24	0x19d
HeapReAlloc	0x0	0x40d02c	0x12628	0x10e28	0x348
HeapSize	0x0	0x40d030	0x1262c	0x10e2c	0x34a
GetProcessHeap	0x0	0x40d034	0x12630	0x10e30	0x2b0
LCMapStringW	0x0	0x40d038	0x12634	0x10e34	0x3ac
GetConsoleCP	0x0	0x40d03c	0x12638	0x10e38	0x1e8
GetStringTypeW	0x0	0x40d040	0x1263c	0x10e3c	0x2d3
GetFileType	0x0	0x40d044	0x12640	0x10e40	0x24a
SetStdHandle	0x0	0x40d048	0x12644	0x10e44	0x542
FreeEnvironmentStringsW	0x0	0x40d04c	0x12648	0x10e48	0x1a8
GetEnvironmentStringsW	0x0	0x40d050	0x1264c	0x10e4c	0x233
GetCommandLineW	0x0	0x40d054	0x12650	0x10e50	0x1d5
GetCommandLineA	0x0	0x40d058	0x12654	0x10e54	0x1d4
GetCPInfo	0x0	0x40d05c	0x12658	0x10e58	0x1bf
GetOEMCP	0x0	0x40d060	0x1265c	0x10e5c	0x293
IsValidCodePage	0x0	0x40d064	0x12660	0x10e60	0x386
GetConsoleMode	0x0	0x40d068	0x12664	0x10e64	0x1fa
SetFilePointerEx	0x0	0x40d06c	0x12668	0x10e68	0x51b
CreateFileW	0x0	0x40d070	0x1266c	0x10e6c	0xca
CloseHandle	0x0	0x40d074	0x12670	0x10e70	0x86
WriteConsoleW	0x0	0x40d078	0x12674	0x10e74	0x609
Sleep	0x0	0x40d07c	0x12678	0x10e78	0x575
lstrlenW	0x0	0x40d080	0x1267c	0x10e7c	0x634
GetLastError	0x0	0x40d084	0x12680	0x10e80	0x25d
CreateThread	0x0	0x40d088	0x12684	0x10e84	0xf1
FindNextFileW	0x0	0x40d08c	0x12688	0x10e88	0x18a
UnhandledExceptionFilter	0x0	0x40d090	0x1268c	0x10e8c	0x5a5
SetUnhandledExceptionFilter	0x0	0x40d094	0x12690	0x10e90	0x565
GetCurrentProcess	0x0	0x40d098	0x12694	0x10e94	0x215
TerminateProcess	0x0	0x40d09c	0x12698	0x10e98	0x584
IsProcessorFeaturePresent	0x0	0x40d0a0	0x1269c	0x10e9c	0x381
QueryPerformanceCounter	0x0	0x40d0a4	0x126a0	0x10ea0	0x446
GetCurrentProcessId	0x0	0x40d0a8	0x126a4	0x10ea4	0x216
GetCurrentThreadId	0x0	0x40d0ac	0x126a8	0x10ea8	0x21a
GetSystemTimeAsFileTime	0x0	0x40d0b0	0x126ac	0x10eac	0x2e5
InitializeSListHead	0x0	0x40d0b4	0x126b0	0x10eb0	0x35e
IsDebuggerPresent	0x0	0x40d0b8	0x126b4	0x10eb4	0x37a
GetStartupInfoW	0x0	0x40d0bc	0x126b8	0x10eb8	0x2cc
GetModuleHandleW	0x0	0x40d0c0	0x126bc	0x10ebc	0x274
RtlUnwind	0x0	0x40d0c4	0x126c0	0x10ec0	0x4cb
SetLastError	0x0	0x40d0c8	0x126c4	0x10ec4	0x52a
EnterCriticalSection	0x0	0x40d0cc	0x126c8	0x10ec8	0x12f
LeaveCriticalSection	0x0	0x40d0d0	0x126cc	0x10ecc	0x3b8
DeleteCriticalSection	0x0	0x40d0d4	0x126d0	0x10ed0	0x10e
InitializeCriticalSectionAndSpinCount	0x0	0x40d0d8	0x126d4	0x10ed4	0x35a
TlsAlloc	0x0	0x40d0dc	0x126d8	0x10ed8	0x596
TlsGetValue	0x0	0x40d0e0	0x126dc	0x10edc	0x598
TlsSetValue	0x0	0x40d0e4	0x126e0	0x10ee0	0x599
TlsFree	0x0	0x40d0e8	0x126e4	0x10ee4	0x597
FreeLibrary	0x0	0x40d0ec	0x126e8	0x10ee8	0x1a9
GetProcAddress	0x0	0x40d0f0	0x126ec	0x10eec	0x2aa
LoadLibraryExW	0x0	0x40d0f4	0x126f0	0x10ef0	0x3be
RaiseException	0x0	0x40d0f8	0x126f4	0x10ef4	0x45b
GetStdHandle	0x0	0x40d0fc	0x126f8	0x10ef8	0x2ce
WriteFile	0x0	0x40d100	0x126fc	0x10efc	0x60a
GetModuleFileNameW	0x0	0x40d104	0x12700	0x10f00	0x270
MultiByteToWideChar	0x0	0x40d108	0x12704	0x10f04	0x3e8
WideCharToMultiByte	0x0	0x40d10c	0x12708	0x10f08	0x5f6
ExitProcess	0x0	0x40d110	0x1270c	0x10f0c	0x15c
GetModuleHandleExW	0x0	0x40d114	0x12710	0x10f10	0x273
GetACP	0x0	0x40d118	0x12714	0x10f14	0x1b0
HeapAlloc	0x0	0x40d11c	0x12718	0x10f18	0x341
HeapFree	0x0	0x40d120	0x1271c	0x10f1c	0x345
FindClose	0x0	0x40d124	0x12720	0x10f20	0x173
FindFirstFileExW	0x0	0x40d128	0x12724	0x10f24	0x179
DecodePointer	0x0	0x40d12c	0x12728	0x10f28	0x107

USER32.dll (31)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetDesktopWindow	0x0	0x40d134	0x12730	0x10f30	0x142
InvalidateRect	0x0	0x40d138	0x12734	0x10f34	0x210
wsprintfW	0x0	0x40d13c	0x12738	0x10f38	0x3d5
DrawIcon	0x0	0x40d140	0x1273c	0x10f3c	0xd5
FillRect	0x0	0x40d144	0x12740	0x10f40	0x10f
SendMessageW	0x0	0x40d148	0x12744	0x10f44	0x30d
GetDlgItem	0x0	0x40d14c	0x12748	0x10f48	0x149
PostQuitMessage	0x0	0x40d150	0x1274c	0x10f4c	0x2a9
EndPaint	0x0	0x40d154	0x12750	0x10f50	0xf3
BeginPaint	0x0	0x40d158	0x12754	0x10f54	0x10
DefWindowProcW	0x0	0x40d15c	0x12758	0x10f58	0xa8
DestroyWindow	0x0	0x40d160	0x1275c	0x10f5c	0xb5
DialogBoxParamW	0x0	0x40d164	0x12760	0x10f60	0xba
MoveWindow	0x0	0x40d168	0x12764	0x10f64	0x28b
GetClientRect	0x0	0x40d16c	0x12768	0x10f68	0x130
CreateDialogParamW	0x0	0x40d170	0x1276c	0x10f6c	0x68
UpdateWindow	0x0	0x40d174	0x12770	0x10f70	0x3b2
ShowWindow	0x0	0x40d178	0x12774	0x10f74	0x378
SetWindowPos	0x0	0x40d17c	0x12778	0x10f78	0x367
CreateWindowExW	0x0	0x40d180	0x1277c	0x10f7c	0x73
RegisterClassExW	0x0	0x40d184	0x12780	0x10f80	0x2d5
LoadCursorW	0x0	0x40d188	0x12784	0x10f84	0x244
DispatchMessageW	0x0	0x40d18c	0x12788	0x10f88	0xbd
TranslateMessage	0x0	0x40d190	0x1278c	0x10f8c	0x398
TranslateAcceleratorW	0x0	0x40d194	0x12790	0x10f90	0x396
GetMessageW	0x0	0x40d198	0x12794	0x10f94	0x183
LoadAcceleratorsW	0x0	0x40d19c	0x12798	0x10f98	0x23e
LoadStringW	0x0	0x40d1a0	0x1279c	0x10f9c	0x253
LoadIconW	0x0	0x40d1a4	0x127a0	0x10fa0	0x246
GetMonitorInfoW	0x0	0x40d1a8	0x127a4	0x10fa4	0x185
MonitorFromWindow	0x0	0x40d1ac	0x127a8	0x10fa8	0x28a

GDI32.dll (7)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
TextOutW	0x0	0x40d008	0x12604	0x10e04	0x38d
SetBkMode	0x0	0x40d00c	0x12608	0x10e08	0x352
SelectObject	0x0	0x40d010	0x1260c	0x10e0c	0x34a
CreateFontW	0x0	0x40d014	0x12610	0x10e10	0x44
DeleteObject	0x0	0x40d018	0x12614	0x10e14	0x16d
CreateSolidBrush	0x0	0x40d01c	0x12618	0x10e18	0x59
SetTextAlign	0x0	0x40d020	0x1261c	0x10e1c	0x378

COMCTL32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
InitCommonControlsEx	0x0	0x40d000	0x125fc	0x10dfc	0x7b

WINMM.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
timeGetTime	0x0	0x40d1b4	0x127b0	0x10fb0	0x94

Icons (2)

»

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\ac0fced0-d42a-4728-a9f2-bdfd4590c238\2.exe

Created File

Binary

Not Queried

»

Also Known As	c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\2[1].exe (Created File)
Mime Type	application/x-dosexec
File Size	182.00 KB
MD5	6f1afdaef8479275a54a64ae20a3e505
SHA1	811506c83addd943da13257c831be25288614ff7
SHA256	dd312fbc6f5ad4b04841a2636b6bbf2d75ca73dcf7fd32f5a3c710ce5116fb5c
SSDeep	3072:xLhuMU5azUoeYUbMZdislQRnm97Czjw3:xLhG1Zg0m90E3
ImpHash	af0ebbe5540f0f27dc9c73953ed798f7

PE Information

»

Image Base	0x400000
Entry Point	0x402350
Size Of Code	0xd200
Size Of Initialized Data	0x20e00
File Type	executable
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2018-11-07 09:31:02+00:00

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0xd09f	0xd200	0x400	cnt_code, mem_execute, mem_read	6.61
.rdata	0x40f000	0x74a2	0x7600	0xd600	cnt_initialized_data, mem_read	4.98
.data	0x417000	0x1544	0xa00	0x14c00	cnt_initialized_data, mem_read, mem_write	2.25
.rsrc	0x419000	0x17200	0x17200	0x15600	cnt_initialized_data, mem_read	4.03
.reloc	0x431000	0xff4	0x1000	0x2c800	cnt_initialized_data, mem_discardable, mem_read	6.52

Imports (4)

»

KERNEL32.dll (66)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CreateFileW	0x0	0x40f000	0x15e64	0x14464	0xca
GetFileSize	0x0	0x40f004	0x15e68	0x14468	0x247
SetFilePointer	0x0	0x40f008	0x15e6c	0x1446c	0x51a
WriteFile	0x0	0x40f00c	0x15e70	0x14470	0x60a
CloseHandle	0x0	0x40f010	0x15e74	0x14474	0x86
WriteConsoleW	0x0	0x40f014	0x15e78	0x14478	0x609
SetFilePointerEx	0x0	0x40f018	0x15e7c	0x1447c	0x51b
GetConsoleMode	0x0	0x40f01c	0x15e80	0x14480	0x1fa
GetConsoleCP	0x0	0x40f020	0x15e84	0x14484	0x1e8
FlushFileBuffers	0x0	0x40f024	0x15e88	0x14488	0x19d
HeapReAlloc	0x0	0x40f028	0x15e8c	0x1448c	0x348
HeapSize	0x0	0x40f02c	0x15e90	0x14490	0x34a
GetProcessHeap	0x0	0x40f030	0x15e94	0x14494	0x2b0
LCMapStringW	0x0	0x40f034	0x15e98	0x14498	0x3ac
GetStringTypeW	0x0	0x40f038	0x15e9c	0x1449c	0x2d3
GetFileType	0x0	0x40f03c	0x15ea0	0x144a0	0x24a
SetStdHandle	0x0	0x40f040	0x15ea4	0x144a4	0x542
FreeEnvironmentStringsW	0x0	0x40f044	0x15ea8	0x144a8	0x1a8
GetEnvironmentStringsW	0x0	0x40f048	0x15eac	0x144ac	0x233
UnhandledExceptionFilter	0x0	0x40f04c	0x15eb0	0x144b0	0x5a5
SetUnhandledExceptionFilter	0x0	0x40f050	0x15eb4	0x144b4	0x565
GetCurrentProcess	0x0	0x40f054	0x15eb8	0x144b8	0x215
TerminateProcess	0x0	0x40f058	0x15ebc	0x144bc	0x584
IsProcessorFeaturePresent	0x0	0x40f05c	0x15ec0	0x144c0	0x381
QueryPerformanceCounter	0x0	0x40f060	0x15ec4	0x144c4	0x446
GetCurrentProcessId	0x0	0x40f064	0x15ec8	0x144c8	0x216
GetCurrentThreadId	0x0	0x40f068	0x15ecc	0x144cc	0x21a
GetSystemTimeAsFileTime	0x0	0x40f06c	0x15ed0	0x144d0	0x2e5
InitializeSListHead	0x0	0x40f070	0x15ed4	0x144d4	0x35e
IsDebuggerPresent	0x0	0x40f074	0x15ed8	0x144d8	0x37a
GetStartupInfoW	0x0	0x40f078	0x15edc	0x144dc	0x2cc
GetModuleHandleW	0x0	0x40f07c	0x15ee0	0x144e0	0x274
RtlUnwind	0x0	0x40f080	0x15ee4	0x144e4	0x4cb
RaiseException	0x0	0x40f084	0x15ee8	0x144e8	0x45b
GetLastError	0x0	0x40f088	0x15eec	0x144ec	0x25d
SetLastError	0x0	0x40f08c	0x15ef0	0x144f0	0x52a
EncodePointer	0x0	0x40f090	0x15ef4	0x144f4	0x12b
EnterCriticalSection	0x0	0x40f094	0x15ef8	0x144f8	0x12f
LeaveCriticalSection	0x0	0x40f098	0x15efc	0x144fc	0x3b8
DeleteCriticalSection	0x0	0x40f09c	0x15f00	0x14500	0x10e
InitializeCriticalSectionAndSpinCount	0x0	0x40f0a0	0x15f04	0x14504	0x35a
TlsAlloc	0x0	0x40f0a4	0x15f08	0x14508	0x596
TlsGetValue	0x0	0x40f0a8	0x15f0c	0x1450c	0x598
TlsSetValue	0x0	0x40f0ac	0x15f10	0x14510	0x599
TlsFree	0x0	0x40f0b0	0x15f14	0x14514	0x597
FreeLibrary	0x0	0x40f0b4	0x15f18	0x14518	0x1a9
GetProcAddress	0x0	0x40f0b8	0x15f1c	0x1451c	0x2aa
LoadLibraryExW	0x0	0x40f0bc	0x15f20	0x14520	0x3be
GetStdHandle	0x0	0x40f0c0	0x15f24	0x14524	0x2ce
GetModuleFileNameW	0x0	0x40f0c4	0x15f28	0x14528	0x270
MultiByteToWideChar	0x0	0x40f0c8	0x15f2c	0x1452c	0x3e8
WideCharToMultiByte	0x0	0x40f0cc	0x15f30	0x14530	0x5f6
ExitProcess	0x0	0x40f0d0	0x15f34	0x14534	0x15c
GetModuleHandleExW	0x0	0x40f0d4	0x15f38	0x14538	0x273
GetACP	0x0	0x40f0d8	0x15f3c	0x1453c	0x1b0
HeapAlloc	0x0	0x40f0dc	0x15f40	0x14540	0x341
HeapFree	0x0	0x40f0e0	0x15f44	0x14544	0x345
FindClose	0x0	0x40f0e4	0x15f48	0x14548	0x173
FindFirstFileExW	0x0	0x40f0e8	0x15f4c	0x1454c	0x179
FindNextFileW	0x0	0x40f0ec	0x15f50	0x14550	0x18a
IsValidCodePage	0x0	0x40f0f0	0x15f54	0x14554	0x386
GetOEMCP	0x0	0x40f0f4	0x15f58	0x14558	0x293
GetCPInfo	0x0	0x40f0f8	0x15f5c	0x1455c	0x1bf
GetCommandLineA	0x0	0x40f0fc	0x15f60	0x14560	0x1d4
GetCommandLineW	0x0	0x40f100	0x15f64	0x14564	0x1d5
DecodePointer	0x0	0x40f104	0x15f68	0x14568	0x107

USER32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
MessageBoxA	0x0	0x40f11c	0x15f80	0x14580	0x27e

SHELL32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SHGetFolderPathW	0x0	0x40f10c	0x15f70	0x14570	0x159

SHLWAPI.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
PathAppendW	0x0	0x40f114	0x15f78	0x14578	0x37

Icons (2)

»

Notifications (2/5)

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After