63b8a0fc...a28c

C:\Users\FD1HVy\Desktop\5-436.malware.exe

Sample File

Binary

Malicious

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	176.00 KB
MD5	9e44305c3e6f66db3a0e1b142f6bb088
SHA1	1f8dce63618475f34d583ffdebfe3de962ba7425
SHA256	63b8a0fc17f2c36d24294d46ba6b7a7d38726e4519ab11b759dca7fa8485a28c
SSDeep	3072:1jgaKcGA5zR7gExANUuPCnl8PiCApCxdi/dHFKHmdsWwxk5Sxz9o:5gAGm4KnlXYdEFK84xxo
ImpHash	66bced479338b200c114ad7caa7046ae

File Reputation Information

»

Severity	Blacklisted
Names	Mal/Generic-S

PE Information

»

Image Base	0x400000
Entry Point	0x41773a
Size Of Code	0x21e00
Size Of Initialized Data	0xa800
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2020-09-04 12:27:56+00:00

Sections (6)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x21cf6	0x21e00	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.52
.rdata	0x423000	0x60e6	0x6200	0x22200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.88
.data	0x42a000	0x2be4	0x2200	0x28400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	1.76
.gfids	0x42d000	0x11c	0x200	0x2a600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	2.31
.rsrc	0x42e000	0x1e0	0x200	0x2a800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.72
.reloc	0x42f000	0x1518	0x1600	0x2aa00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.5

Imports (5)

»

USER32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
wvsprintfW	0x0	0x423124	0x28b10	0x27d10	0x335
wsprintfW	0x0	0x423128	0x28b14	0x27d14	0x333

ole32.dll (5)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CoCreateInstance	0x0	0x423140	0x28b2c	0x27d2c	0x10
CoUninitialize	0x0	0x423144	0x28b30	0x27d30	0x6c
CoInitializeSecurity	0x0	0x423148	0x28b34	0x27d34	0x40
CoInitializeEx	0x0	0x42314c	0x28b38	0x27d38	0x3f
CoSetProxyBlanket	0x0	0x423150	0x28b3c	0x27d3c	0x63

OLEAUT32.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
VariantClear	0x9	0x423114	0x28b00	0x27d00	-
SysAllocString	0x2	0x423118	0x28b04	0x27d04	-
VariantInit	0x8	0x42311c	0x28b08	0x27d08	-

WS2_32.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
inet_ntoa	0xc	0x423130	0x28b1c	0x27d1c	-
htons	0x9	0x423134	0x28b20	0x27d20	-
WSAGetLastError	0x6f	0x423138	0x28b24	0x27d24	-

KERNEL32.dll (68)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetStdHandle	0x0	0x423000	0x289ec	0x27bec	0x264
DecodePointer	0x0	0x423004	0x289f0	0x27bf0	0xca
EncodePointer	0x0	0x423008	0x289f4	0x27bf4	0xea
WriteConsoleW	0x0	0x42300c	0x289f8	0x27bf8	0x524
SetFilePointerEx	0x0	0x423010	0x289fc	0x27bfc	0x467
GetConsoleMode	0x0	0x423014	0x28a00	0x27c00	0x1ac
GetConsoleCP	0x0	0x423018	0x28a04	0x27c04	0x19a
FlushFileBuffers	0x0	0x42301c	0x28a08	0x27c08	0x157
HeapReAlloc	0x0	0x423020	0x28a0c	0x27c0c	0x2d2
HeapSize	0x0	0x423024	0x28a10	0x27c10	0x2d4
GetProcessHeap	0x0	0x423028	0x28a14	0x27c14	0x24a
GetStringTypeW	0x0	0x42302c	0x28a18	0x27c18	0x269
GetFileType	0x0	0x423030	0x28a1c	0x27c1c	0x1f3
SetStdHandle	0x0	0x423034	0x28a20	0x27c20	0x487
LoadLibraryA	0x0	0x423038	0x28a24	0x27c24	0x33c
GetProcAddress	0x0	0x42303c	0x28a28	0x27c28	0x245
CloseHandle	0x0	0x423040	0x28a2c	0x27c2c	0x52
InitializeCriticalSection	0x0	0x423044	0x28a30	0x27c30	0x2e2
SetFilePointer	0x0	0x423048	0x28a34	0x27c34	0x466
GetLocalTime	0x0	0x42304c	0x28a38	0x27c38	0x203
UnhandledExceptionFilter	0x0	0x423050	0x28a3c	0x27c3c	0x4d3
SetUnhandledExceptionFilter	0x0	0x423054	0x28a40	0x27c40	0x4a5
GetCurrentProcess	0x0	0x423058	0x28a44	0x27c44	0x1c0
TerminateProcess	0x0	0x42305c	0x28a48	0x27c48	0x4c0
IsProcessorFeaturePresent	0x0	0x423060	0x28a4c	0x27c4c	0x304
QueryPerformanceCounter	0x0	0x423064	0x28a50	0x27c50	0x3a7
GetCurrentProcessId	0x0	0x423068	0x28a54	0x27c54	0x1c1
GetCurrentThreadId	0x0	0x42306c	0x28a58	0x27c58	0x1c5
GetSystemTimeAsFileTime	0x0	0x423070	0x28a5c	0x27c5c	0x279
InitializeSListHead	0x0	0x423074	0x28a60	0x27c60	0x2e7
IsDebuggerPresent	0x0	0x423078	0x28a64	0x27c64	0x300
GetStartupInfoW	0x0	0x42307c	0x28a68	0x27c68	0x263
GetModuleHandleW	0x0	0x423080	0x28a6c	0x27c6c	0x218
RaiseException	0x0	0x423084	0x28a70	0x27c70	0x3b1
RtlUnwind	0x0	0x423088	0x28a74	0x27c74	0x418
GetLastError	0x0	0x42308c	0x28a78	0x27c78	0x202
SetLastError	0x0	0x423090	0x28a7c	0x27c7c	0x473
EnterCriticalSection	0x0	0x423094	0x28a80	0x27c80	0xee
LeaveCriticalSection	0x0	0x423098	0x28a84	0x27c84	0x339
DeleteCriticalSection	0x0	0x42309c	0x28a88	0x27c88	0xd1
InitializeCriticalSectionAndSpinCount	0x0	0x4230a0	0x28a8c	0x27c8c	0x2e3
TlsAlloc	0x0	0x4230a4	0x28a90	0x27c90	0x4c5
TlsGetValue	0x0	0x4230a8	0x28a94	0x27c94	0x4c7
TlsSetValue	0x0	0x4230ac	0x28a98	0x27c98	0x4c8
TlsFree	0x0	0x4230b0	0x28a9c	0x27c9c	0x4c6
FreeLibrary	0x0	0x4230b4	0x28aa0	0x27ca0	0x162
LoadLibraryExW	0x0	0x4230b8	0x28aa4	0x27ca4	0x33e
CreateFileW	0x0	0x4230bc	0x28aa8	0x27ca8	0x8f
WriteFile	0x0	0x4230c0	0x28aac	0x27cac	0x525
GetModuleFileNameA	0x0	0x4230c4	0x28ab0	0x27cb0	0x213
MultiByteToWideChar	0x0	0x4230c8	0x28ab4	0x27cb4	0x367
WideCharToMultiByte	0x0	0x4230cc	0x28ab8	0x27cb8	0x511
ExitProcess	0x0	0x4230d0	0x28abc	0x27cbc	0x119
GetModuleHandleExW	0x0	0x4230d4	0x28ac0	0x27cc0	0x217
GetACP	0x0	0x4230d8	0x28ac4	0x27cc4	0x168
HeapFree	0x0	0x4230dc	0x28ac8	0x27cc8	0x2cf
HeapAlloc	0x0	0x4230e0	0x28acc	0x27ccc	0x2cb
FindClose	0x0	0x4230e4	0x28ad0	0x27cd0	0x12e
FindFirstFileExA	0x0	0x4230e8	0x28ad4	0x27cd4	0x133
FindNextFileA	0x0	0x4230ec	0x28ad8	0x27cd8	0x143
IsValidCodePage	0x0	0x4230f0	0x28adc	0x27cdc	0x30a
GetOEMCP	0x0	0x4230f4	0x28ae0	0x27ce0	0x237
GetCPInfo	0x0	0x4230f8	0x28ae4	0x27ce4	0x172
GetCommandLineA	0x0	0x4230fc	0x28ae8	0x27ce8	0x186
GetCommandLineW	0x0	0x423100	0x28aec	0x27cec	0x187
GetEnvironmentStringsW	0x0	0x423104	0x28af0	0x27cf0	0x1da
FreeEnvironmentStringsW	0x0	0x423108	0x28af4	0x27cf4	0x161
LCMapStringW	0x0	0x42310c	0x28af8	0x27cf8	0x32d

Memory Dumps (2)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Point	AV	YARA	Actions
5-436.malware.exe	1	0x01170000	0x011A0FFF	Relevant Image		32-bit	0x011887E6			... Memory Dump Actions Go to Process Go to AV Match Download Dump
5-436.malware.exe	1	0x01170000	0x011A0FFF	Final Dump		32-bit	0x0118A5A6			... Memory Dump Actions Go to Process Go to AV Match Download Dump

Local AV Matches (1)

»

Threat Name	Severity
Generic.Ransom.Conti.57C16005	Malicious

C:\BOOTNXT.AWSAK

Dropped File

Stream

Malicious

»

Also Known As	C:\BOOTNXT (Modified File)
Mime Type	application/octet-stream
File Size	535 Bytes
MD5	093f357bd52b9c1a139c9c6dfa36a985
SHA1	27a7c2b0d40e4fbf96edd25a6b621fcbc1787682
SHA256	009ae3576e1e2074c3ff65b433a1a00b0d5369899466cc20d192acf7eba84949
SSDeep	12:JSEh+dHjw+ljEfZsMDDgHYPUsxEgG/R3/mnVbWxKz21gE6XF:AhdHjwmgJMyxFG/x/mVbMh1H6X
ImpHash	-

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
SodinokibiEncryptedFile	File encrypted by Sodinokibi Ransomware	Ransomware	5/5	... YARA Actions Show Ruleset Show Match

C:\BOOTSECT.BAK.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\BOOTSECT.BAK (Modified File)
Mime Type	application/octet-stream
File Size	8.52 KB
MD5	7aea4c41d360c6ca36ab2973ac1ba5e7
SHA1	13adfb4d4c820ce0d2683ff5047f8e62d02cac8e
SHA256	48e5a1bc790f38023f58216d7bd06177a7a1933d41ee8938541428bb5dd434d1
SSDeep	192:itzzybSyQqlO5qTC4ssPkIFDnRHCFJldLheq8UyjJKBtiloQ5r:iJAOUCPdIhRHCFlhefUrBUd
ImpHash	-

C:\588bce7c90097ed212\DHtmlHeader.html.AWSAK

Dropped File

Text

Unknown

»

Also Known As	C:\588bce7c90097ed212\DHtmlHeader.html (Modified File)
Mime Type	text/html
File Size	16.26 KB
MD5	27caf88cc18e67f9a79ae9698a3cadb9
SHA1	b1eabf7e6e919eb83028517534d493e99b0df86c
SHA256	f61526f82c9bf446153597020078e0550f4d4a326c51a7fb8efb80134f4882f8
SSDeep	384:RtUbYV7efweLC/fm6TwtdfMfxFEPuTAHM/GBZOHA8gWgNi0C:RtU87efLLC/fm6czfMTEmNOcWZi0C
ImpHash	-
Parser Error Remark	Static engine was unable to completely parse the analyzed file

C:\588bce7c90097ed212\header.bmp

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\header.bmp.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	4.06 KB
MD5	35c9e3e545c73a7d0d06fee24d996c7c
SHA1	a696fac2d48289cd13749a9f978122ca54049289
SHA256	e93787bc7d40144c6f1bc091eff380f17859710d77f8f3bf55545d260f75ad28
SSDeep	96:hQonjISAW5aRpgxeprU1drNMJ8+9nSyJwloqO9cQMsukph/:htUdW6pqeprU1dr0dSswoRbMfkph/
ImpHash	-

C:\588bce7c90097ed212\ParameterInfo.xml.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\ParameterInfo.xml (Modified File)
Mime Type	application/octet-stream
File Size	266.19 KB
MD5	6364dff92d22f049604d5365517a4578
SHA1	34dbd6b2b94981eafc2ae5b38129aa82120c6e77
SHA256	9b0452ff1f03e2863076f4956aba0e1c992ebdae566da05f5abd11265a8849d1
SSDeep	6144:/70pA8wWFXR8xpAg14BeylL/imowN5r60Fnv4H:/IpApWFBGN4Be4/5zHr7v4H
ImpHash	-

C:\588bce7c90097ed212\DisplayIcon.ico.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\DisplayIcon.ico (Modified File)
Mime Type	application/octet-stream
File Size	86.98 KB
MD5	3102666651f5bc832e69ac8c161d0033
SHA1	b8cc2c03bb0ad4a541604690ac4e770f019bce5f
SHA256	b3bd628732d6c6b5fa0f0f4d8abe5334394a24fc8bbb57a001393af6d1e49878
SSDeep	1536:3VcKdt3dLLSrSRSVHSrLRMytuCUk4XBLxZ1qbaFMPFPXXM6NQLCNO:lNt3dPSrScVSaaBm8tXpQLSO
ImpHash	-

C:\588bce7c90097ed212\SplashScreen.bmp.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\SplashScreen.bmp (Modified File)
Mime Type	application/octet-stream
File Size	40.64 KB
MD5	43694e305179f446b01477580f20475a
SHA1	5cf3943616e191aa70d6b8a7e223315f4647cc91
SHA256	f0165862fec8c37791e8e8e5c93a32894c5bfb1b93bc79ecdc8e0b38ed067a21
SSDeep	768:2YEDVDhqqu83vtX5eYwjaaEZwatAvDl0Na3yxTe9:hEhdqo/7eYHK7UTy
ImpHash	-

C:\588bce7c90097ed212\SetupUi.xsd

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\SetupUi.xsd.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	29.94 KB
MD5	76f508ea78af0ad65f2efeda8e6401a2
SHA1	a32ebb5883e0fd487bf4f02a93b4f7a95d0245ae
SHA256	0055eaf700425dd7586c38081bfbeaa50c345ca2e624add3db90b812d78cc769
SSDeep	768:aHR9zV69baMfBlHS6dS1MglQweDW51QsbOBmcrK3US:kjB6k0BU6EiglfRHbNES
ImpHash	-

C:\588bce7c90097ed212\Strings.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Strings.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	14.28 KB
MD5	706ac1ae0ebae2a221baab495cbaf017
SHA1	b3debd367a8ab0af63271e8dd46f4e5cf2288cd8
SHA256	8ce23bb61f318fb1a62b95a63f26a1408fe2264988fe974aa9d39d0aac46d85c
SSDeep	384:uHRt7eoQ49vJHQKaDiqqUAaeiRN2QgipAjpB:uv6OhaFpL2Q1AjpB
ImpHash	-

C:\588bce7c90097ed212\watermark.bmp

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\watermark.bmp.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	102.15 KB
MD5	9c3f713feffd41d76b9982a6e7f590d9
SHA1	599658def3224720f15234b5b181d3c02a6646ef
SHA256	8776bc9b28794edabeec689c3c1ae73d63558998dd445a717795e84d70700eb8
SSDeep	3072:NCqHBLYFfSpPvYLEd/ArmL7v25NkVBjLCqHphDyZpzVh:9BS+YLYYrm25W/LCqHphDyZdVh
ImpHash	-

C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	2.09 MB
MD5	8f4e6bf6e430b61d043d3dcec2c8c61a
SHA1	52a8213115266c013a33d87d5a6c1869fd571b39
SHA256	4fd864707e86a943cc9dc52fbe8940f30866e75dc0ba1ecedef0a8966ab0a953
SSDeep	49152:3Ccd7EQcnfyhMqNKOS5k5DumT1r7AdXZy9KU2KUYxs35DKZ3OIKxWh0eS:ld7ZmyNNKOykB1PAdXZzKUYxs3pKZnKX
ImpHash	-

C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	4.96 MB
MD5	b7a3f3c007ac29c17c63afcf8cbfaa25
SHA1	03f495b958a2163ae262bd11f42d7568d695e974
SHA256	e3d2daf6617eb6ee15c390ce710e1e9ae46daf58806914a31518f9dacdf9ddc7
SSDeep	98304:nKPVcRyXfMwmqUjX57BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKJhl3:naVcRykwYZBkOK2Knq45mY4H5OMKkKz1
ImpHash	-

C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu (Modified File)
Mime Type	application/octet-stream
File Size	2.04 MB
MD5	cd0c0306ebd0614b142d1981d201eb57
SHA1	4e7501f2f1027438e6619ed6512ab878e5082be6
SHA256	fbfa3476271e02e244b432fc8d1a461da04978974cac4cd71440830a1eb2003d
SSDeep	49152:OIBnA12vZUTSq9l6epyODuv7GuMRau8yuXQFKUYcs3HVKf3rhKzdNv:O4ZUOqcGnRau84KUYcs31KfFKzdNv
ImpHash	-

C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu (Modified File)
Mime Type	application/octet-stream
File Size	4.86 MB
MD5	7af197c4f4efcc8513e5aac6e5db1839
SHA1	48e3652754645555ce2b278f44a22c9141042139
SHA256	b6a5320112d39e03318d03830a1e052b026b29be85fe183c67ef380426bf1c1f
SSDeep	98304:QHzmi7QiKy/aBHTKYzKXH54UuFe1kBpHua/KUKcs3DKVDK6rCE:47QfBBHTK8KXZ4UuY1kB1iKFKmP
ImpHash	-

C:\Logs\HardwareEvents.evtx

Modified File

Binary

Unknown

»

Also Known As	C:\Logs\HardwareEvents.evtx.AWSAK (Dropped File)
Mime Type	application/x-dosexec
File Size	68.52 KB
MD5	105ce7d051447b4956daff659a998c06
SHA1	d3b72d91b489dfb9636ebf2699af8cbebfa4faef
SHA256	a516b6b63c756066998fc8d787d7e6f404136a9ccfa02d91a57049a4821090fa
SSDeep	1536:k4v6N32/V/8F2e+VLLXG/TvotvtF/h8sq9agluEe98FsIctON:k4is/q0e8hO5squT9uHT
ImpHash	-

C:\Logs\Key Management Service.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Key Management Service.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	64aa8b130e49846e74f63066efbcc8d2
SHA1	4843366f7d2aa71c9ebcc3002ec15a85cd7e3ef4
SHA256	2275b086010ed2305d624f736c0c6787d3a1050d871b9c1594c22be5c02dff99
SSDeep	1536:cqu70JZtFLuuCcuznxLI8o892HB94n1uWO5/hW6ISaRxVTp6K1P:Ju70JZfVKzl5D2hGn1xS/uRTpV
ImpHash	-

C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	0a1d6c840b68503ee1f5b3231e2baba3
SHA1	c3d94e0bc682b4199488e43ed9cb540871ca863d
SHA256	fe239b4d7bee517d1f1fd3bb9ca4ea15698adc42db3a0881a95a4782214786d5
SSDeep	1536:JNJnf2NpB4Hd2aEcomo9gSoQ3DTbZOxmb3uycN5UaCidX2tiX:df2NpOHgaEbJzB3fjb3vcHUDil2M
ImpHash	-

C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	7c44dce2a4c2b0c81e0e0268771ebf69
SHA1	ca874642482f6a4c1416ad8cc44588a4dd9d2237
SHA256	530a49e39baf6151f3621f1710230ed55d6e909173680a74f3a241d395a32b5a
SSDeep	1536:wIgqxzqA4gpAvJqPV/D7uOHuXKy6Cq5OtG:0iq4jV2OHuK5/
ImpHash	-

C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	ed999cca8a6d6f20b2aa11caa545c1b3
SHA1	020632e901ceb740f4f87227c580d5ed9bdb894c
SHA256	d9bdeb714d883b1017c130789dfaf5b41ac6300534d7636c82004cb8caa5466c
SSDeep	24576:HjrKC3XdXPH8kgUQ4+Z2erVqHStd7TA4ewFolULE:H3K8XlP8zUKqHy7TA4eRlUY
ImpHash	-

C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	08f8352e73519655c7bbd0b3dc1034de
SHA1	9aeb8d94128d6378b90b6ae7b13b2a489abe37a4
SHA256	02fa78ce96615b7b4b90e79fb68ae818662928b23004a186d9898ada8ef15642
SSDeep	1536:/uWDEwjSyyp32nlWshxWnp05yuix9ZcgngFYj/QboieVVdZC9fXQv:/uWD7Syyp+epqTiSggFYjkQVdZCFQv
ImpHash	-

C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	ebc955478bfbe78e05c8aa57ffc25e32
SHA1	42a62494fe2f20c544170cbf617dd771747054cc
SHA256	06ad93b3d2064211fdab09503da5a44cc26a4799df12cdb421059ae72c7abce7
SSDeep	1536:iiEKQcxEZLk7cAIlTd20SlLQykKEogJipZt9Sj9Ig9vgq:FacKZIgplo0SEKyiz+z
ImpHash	-

C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	e0f9ec993e40e66be4dfe01c8a555363
SHA1	e38b2e886d64eeb8690c268304cb11941d7b4776
SHA256	8e1635fcd9bb7127f7625f098dedf5f1412414427985e8c47bec9ad7d1f9e19f
SSDeep	1536:8NSIpLkR+OGN6fVFc7ENk9KGsHSMYcf2USjRVUc+wkLyzy6jFjKQoBn:5IaRwmVF3Nk9KGsHFYqQ4HzAjFvI
ImpHash	-

C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	697a09d3e9f4bb77076d5696ac4c7475
SHA1	3cc857b71ae21b75bfe89b489293dd8de4096ea1
SHA256	ab23b06a68789cdc59d8abfa969e672647cc1ec1024e7a5ca1dca80f622ae290
SSDeep	1536:PwKpfVYVmtM07Q9YWlhfBx5Y1RDMAxWMI7Qtdq0/z1wfgABDnwPr:oiM0s9rPfBx5YDxEstdq07xAVnC
ImpHash	-

C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	1.07 MB
MD5	849bc4908d8fc8ae0d85b974c59158ab
SHA1	7bc1bfe2634b8de74deb59c6ce6aeb26c2fa3a6e
SHA256	af9ca026d49d14d36ecc7bba4a282cd5d0376f8ff20c1d74ddb13aa65d48183e
SSDeep	24576:U/0DI7QeOXdpbO7Q5IwZYN+G1qqw52U5UHxI5ZB:lIceOtLHAaURSz
ImpHash	-

C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	ae04dbaf0e94892202745a66baf8c146
SHA1	5dfe5301e6b2c5b5e5aba1c9e44c55a6d6a1c5e2
SHA256	a20525e6e3556485c7b98c49bda66a397fecdedef1d8b02c41222e727aabe9d7
SSDeep	1536:Xi4j8QZTCnms0blroIEzTKuf0H9+ckg99rAR:78CTWmsi0IMTJ0HbbS
ImpHash	-

C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	8a8eaf9a46c71ad5f4962cebec563b0c
SHA1	87c8e39ae17bf9b7b50d0af131b77722a6d05462
SHA256	a876ccf462ef679ca8fd31d3aa04f54cd75e461a26545e411244afbcbe8b967b
SSDeep	1536:+x974Uwvn0tgAHDmr7OsvdqTVmllAns2VGi3+b0yYP9cHdZ:+j747vU1mmsvdb2VGiF2HH
ImpHash	-

C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	2461eddb473145ecd91b04cb22ca662b
SHA1	ed11b390e32379e6ca3df34d02ca3e56ed9646a5
SHA256	3c2028434870633fa916b9591b824d21b6b084aa98961631c705e77d61c24f52
SSDeep	1536:gqbyWogmZP/drwBy1jr9lsp+0KBEGELgkcBoZrKSe3x5ST73:Xbybgm4Q/2+59EeacfS33
ImpHash	-

C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	7d2121b4f953a213632ef9d0cc5417c6
SHA1	9329693b515d6eddc65b300509517541a30a5855
SHA256	a357ae9657c848ea947d8db874f506dbaff2266f61cc00c31b56a22e87b5e681
SSDeep	1536:eFchwsMOLu2kOfrw9oWYJw7Z0fqLkI3S45W+EQBGCAkMgQGy:xhwszLhdUp7ZJX75W+EQBGCrMOy
ImpHash	-

C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	2.07 MB
MD5	b12bd48998dc9f70e733a0f950cd6d50
SHA1	6ee10d4604a9b9380dc26d34d97a6d47af98a5a4
SHA256	e87b4e14d373625c933301213637031cf08bf99eee4f332abf43e69da4177fdc
SSDeep	24576:L4WW5/0bdAr7yo3wY6KNWI3/7wtHNuu8q1GTW1XwIf:sWW537yE6KNWIP4Nuu8q1AWlff
ImpHash	-

C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	3cc56ae50a01dbfe43e30b7f5923553f
SHA1	95a5c2b16c265b2df372ac1f01a0b9f85a1af8ee
SHA256	e47286d6ab97bb7f551bf0bd620b867bad6251433a4a139a3eae4d1a5d725ea8
SSDeep	1536:ngJzm1z+mEsKEGbdPsfHQls0qFU3vxq64QIT8pmGuAr:5b3JfHQO0qFcJ95yg/uAr
ImpHash	-

C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	1d252411b8214edb3dbf2661053bc076
SHA1	aa3b9c2cdee68a4a1d73537e686adad71f9fa25f
SHA256	764f7bd1acd3cd9da4bbd9809fa122fc08f423d8f69ae90b0729dfac4a5ae956
SSDeep	1536:aQymuocccH1HivPTw1IVcuDkEdKRwKSnsoXjT/OP62uUbq+Fr:aQsdccVCE1IVcHkKRunBX+g+p
ImpHash	-

C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	629e18e9e9a00c6c3145cc8297434cee
SHA1	9d255b2bd1d30bb34ac57b08f72cb3b276e4eb6d
SHA256	e2452a9dd0c10e6c26d175edfe71744718a680b1a8bc4546ec09ec291ba95e99
SSDeep	24576:NU5YfEV4yPKFaiu2RuTz+DbRukq2VTX//wby7vNn1BE5i:7fEV4VFaigTSDbskpTX3j7911
ImpHash	-

C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	59c086d9b7a1dd565ab56c12ad0d3567
SHA1	3269a7004701b447be4fc6a712d164b7c9ec7a63
SHA256	ded1b5f105ce82cfe179f68148013d6e23151f618b7198e1cdb963ee0a4eb33f
SSDeep	1536:qAdzu7MRucKwLTNGmCvTbeswCLpPsy1DJooubY0p28AV0:PdSchUvvTbeswCLpPT1F1Whwg
ImpHash	-

C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	916b52fbc68a0f3fd63017a6441b5e6e
SHA1	c03b8e462fa96e354c9385fd1912b97eca31957f
SHA256	77389952b075373f62cbc021047caf814359d30671b9606a207bb9bd6a5939a2
SSDeep	1536:0C9hvB1BAMHEInI1cg5FmmLGoy7OjP/U2ia5fN2lmsGrMhMu:FvDVnIOMGN7OjUm5cByu
ImpHash	-

C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	9b12c0a8a20fabc07355f4a1b82234e4
SHA1	a43c851085ba7f746be5064e1bea0389a6f9ca66
SHA256	9d1b3aefb53f019e553604035f7f5ac0a66d61ef234136b4d9a9e6eb1f537953
SSDeep	1536:xUvfEpK/xcX4D1i9vdVbeE8bcd4weHwD83jo4jqBfrLX3uCBodwO:xUvf7/xj1i9vPbV8PweQYztyrLHuCBoR
ImpHash	-

C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	78de84219593b25618115c8bedf1fc52
SHA1	4899c172bd7d7bb5f662d82dcff72af852e8646e
SHA256	6dcb9545eb4b628a22aa5098d7594603502d4c2859ad9912e18f6259f1acea41
SSDeep	1536:6Q2FAIbIcmie4oEM9wUPPI7sPJiAcPxAHj0BPN+u:OqJcBAP9wWpPkAcJAoBPku
ImpHash	-

C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	a11658889e507c97b9ac5a1d19d23db4
SHA1	a3ec6c9ed5224021f2c65db9b263140bdf9c266c
SHA256	d2f8e001445fd2b7acea5044c78dec07d3908f2b0a13845b69da66cd5cf079c7
SSDeep	1536:ziVcrpigTxchSEOCXr3iN/vzxU5zLLEoSL9NTSBKtjp0rNfUW:WqigWh3OCu9y9LLEXL9NAKtlENfL
ImpHash	-

C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	b1a59a1e4b66713bf90d68de383a6ab6
SHA1	1d27d19609e225fd1d44f00e30e947cf9d6defc1
SHA256	2dc7aa92ceacb09bea6bd121c24b8ca599cf8bf630ef3474bbb94085a2aeef3f
SSDeep	1536:4+09luZJxPxcHAwIdxo70Qh/oFlgmmRdyVEFtONQRgl0yXav:v0/McC8oi/kiLzTt7SXm
ImpHash	-

C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	449030435dd831987fced33ddfa6fb2b
SHA1	a5834c6478b990293cd9edfdad7e9e4600351b49
SHA256	4a3a055a200488e9a96bd529c715236a822805b402beafcb0e1aaf7e98920ec7
SSDeep	1536:7fZ/d5CUTjM7zheAXCnsmtf6cu13S7HiS87iJEcvKonftBGh:LWzKsOif1wHnTEyK2fzI
ImpHash	-

C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	19fbffa4e25d1a29b305c16ce861a588
SHA1	3a542122611dbaef4c609dcc590fb339625f24f6
SHA256	d450b8947ab9e66a9a5069a7eef0427e8d58b1ce448f28ab842f477dc67ba14c
SSDeep	1536:kqbzG1ChTLlSoKdHY4KguAPBjLEswkjoGi40j8QyLNL6lNG:kqb6cXl6uAPNwsw5/40j8QyLNWfG
ImpHash	-

C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	a30a4e13b4bb00ecef938d3b5087c101
SHA1	2f53844e4b540c16f8c335c2a2fbfc88a5b9e7e4
SHA256	a247273f89409c9dad841913aa3a51a28f1acf2b86d3327ce6d11f1f17ba98f6
SSDeep	1536:i2uy/MKAFAxRTykMFKF33vq8tuDc6Mz8W9r09/cHTX1DVNn5pY4M5gcJ0u+3u:i2uy0H2jmKF33vq8ycVzI9sZVV5pY4MJ
ImpHash	-

C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	bee4aaa0cacf80a1d120e18684462417
SHA1	b4ac5662d58ec0ac002369eff666414e5dbd290a
SHA256	2c709157ba77758cc65b20dc6afd3a0be33b336989a4a4f2d0db7bbfbd9f5f0d
SSDeep	1536:T44+9UmvNeM+YpqrOHrCcTD2Cw5D46znWlohrBinFHfRsdU6:rAUqNelYRHfr6znjDinRfRv6
ImpHash	-

C:\Logs\Microsoft-Windows-Known Folders API Service.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	21803f9e6c9a7284bb290645cd8505a5
SHA1	72f0daec905ab9d0cb7a6def81cf769ac46e55bc
SHA256	02d55708102df9129fc6bccb5b3340d8f244a7c26b8469aec2d473d6e3f77b6a
SSDeep	1536:EnetEqbeyOAzU9AitRIak8vfPRXsCQfyfF6bblKm3T3bw:IetEqn/KIb8vfpcDa0lKaTk
ImpHash	-

C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-MUI%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	3b16211d242d5256097e45255d141f4e
SHA1	6cd721783efc9d7fe3d644f8b7f70b30accbb5c7
SHA256	b26b469fc9cfe14fd9577f8fc447653931fcbf7da624e716c49782024bc791a3
SSDeep	1536:D3SeWG2OB2YbgHIBHs1Zbhrc9faQkjL2JLaQ+SAP2F:eeJnBb+xQWSUSio
ImpHash	-

C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	c7fc245df703cc5383831cc9cea742be
SHA1	24ea5d46ef106c1c88bc1fb15edc428cdfe14557
SHA256	4f1689a48bde48f09de4e15a59fe5eca8d9e2f212112e3838776ab1037b7358b
SSDeep	768:w+2znC/r2N7uVKXFZLV25sSjd7ZoadVBoDeskDD1u9z0GyKw7556dOLafzKq71Oi:crCi73TV2BFZHdHzHDolIV+zT71Oi
ImpHash	-

C:\588bce7c90097ed212\netfx_Extended.mzz

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\netfx_Extended.mzz.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	41.13 MB
MD5	1c6f7ba5888a99515b934f61c21d5370
SHA1	5cfdd0f23e0cb92717d685ce202ec297f88055ca
SHA256	bf684f47fbf45b033e07e2dc051bac14de0576e7bd578c2dabbe3967381c818b
SSDeep	196608:v01IzKKwi1rT6Po15v0mtL2q6NTwgZmK05vc4e+6VS:vWIwi1aPoP0SL2q6NTwgZAvZew
ImpHash	-

C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	4cb5ceb371bb822f666a624523b65b09
SHA1	bd5667d788a40536a067123a23dca23100a2bd18
SHA256	168eb411389941571655b03bd82717068e95b2897a725bdeb41484fecf74d9e9
SSDeep	1536:j7g+xscn9ck8Gh2Ts7DqoYT+NKGIEwkS30oHZJCgY8MbbIJWdbOYen5:/g+G+h8sS6KAwksFZJCnZbbA1p
ImpHash	-

C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	ce0a5dcc6bfe0e9347c2f0af6aa6c931
SHA1	9c1ec1b5ceb8f54f14985b220276d4d9bad918d4
SHA256	32ddbcd4ed6be3e6471c73d2481bc9aff95e9d6d15e4523057d761e60fb6b629
SSDeep	1536:WVHDfWmVSS7SNQ/tHAQXRHaZ1CO2VpHWVblR0Q7zvgQ8/ii4+Ik:wiXSeOVgmR3PWxlR0Q7zvU6iN
ImpHash	-

C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	0036908e3fe61c4795303947525c76aa
SHA1	9e3a7e67eee36c87b68e6e7dbdf5abac3c1060be
SHA256	6ca71b76b0699ce7d173fcafb2084af98eaa59275a1f6d0a03e2977f12d42059
SSDeep	1536:28Xuzf6sTYZGTErnW4OIdvEgAbTnghZWU8QYasIn:5XEpSGTEWrICTg6x96n
ImpHash	-

C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	2d636c6640874f1d57cef350168c479c
SHA1	645e9f20f3e68230871501a4d42e3e029307a65f
SHA256	6bf31909f41582e05310cfca6bf5137df5d3cc80eb0036bd1e2488441b499eb4
SSDeep	1536:RZ6aULQybSk0vPGEG3ZcMWhmGAqiDRCdu6OGH/joq+gpKB5yg:RZ6pLTVEkmMWhmGfhd1H/jouJg
ImpHash	-

C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	238f444985ee7e2df596c13f851d4378
SHA1	764426abea3ddfb88ab5ca56a337121da18e6dee
SHA256	48c66d2bece5d4c6e2956a58c7d60b6d38964757e8ffd717e6a6cfa883bca7ee
SSDeep	768:mqxu+RvSQLLZTWqRnG52fnDBMz5A6J86+7BWF/g3Z1XlV4Y9OdcmFXqe8IahbtgW:mquUWqRG52fn6JLsWFs+dTwjkkSHPtYB
ImpHash	-

C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	976b0eb411318d4b2c178937e0082fe1
SHA1	1b3c824624b62de5c2115ce7d4ddb49652108b18
SHA256	ee8f445eceb663802fb9f6aaed0ae3891cf5cda23ecc03978278877a4922d597
SSDeep	1536:SwMZ43cOXeHy1U7B+S1n3LqHkp93aYcI0q:SwCROXeB7/13LqE69Jq
ImpHash	-

C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	65decb5c8961c8495b946b9d22d374ba
SHA1	8f1b8980c52a96b4d45d01f70419f58472ecc41f
SHA256	65d23656ef33fd38f482aa9f0b091d8a8bd55547a326d59587f34095824b49dc
SSDeep	1536:QAxgMuR7FrfzIPkEFF1yGrH0oZPaqRZF7Gx8Fa693xXC:QAxgHxcMEZymnPaqfcx8Lm
ImpHash	-

C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	15b7950ef5b5c48d8f34cc0d5973e3eb
SHA1	016774bcf54dea43a1aa8fe3078ac665e50d8a87
SHA256	2f79df5747b75dfd4a415ef65a46344214e2bc24ec278249c0adfa86d3c66686
SSDeep	1536:97RxInOceKq9vSuJa7/Hhu3bZ/ac5cwsn9F:nxInOceKq9vSuJarU3bQcu
ImpHash	-

C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	a43069faa9cc585d4e7ad4dc56f13512
SHA1	bda2fc8853be21590f172276084ca186cc0fd97e
SHA256	2f93027d9c3d66a65ff222f7775e00e2aa11c0e1db8ee95d77e3497850cdaea1
SSDeep	1536:NFPs1EkhqNuwvNFqYvZqsrGt+vvABlEiIDE+Xup0BCox:NdslsNVikUsrpMlEiP+ep0cy
ImpHash	-

C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	ad8583a333fa7e86e2b7f6d02af60a71
SHA1	03db168b4e2a5c8f93f6baf24b6c15c972759a5d
SHA256	cecfe3b77ff3e5a1eb509ac1ff9c7be3e4fb567e9177ea15445249d8fc2c6881
SSDeep	1536:+S46ke6D9Trb2CRHPE37tyrCwBTiLbTkc9XvgNxkwaWyMR:+SxkekrbBPEqCRL9pgMEyG
ImpHash	-

C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	af9e08eb93c31e90938272eb2491f96c
SHA1	fdf9d561b0719cdc5a42916f57336862cd58785e
SHA256	150843cf42631beea03d1af0ff518b7447335551acd03a7bfdd8666cf2c042de
SSDeep	768:fobWcD648UVDE2U54k+CrVCQlr4IYSCWNutwYnH9yOdmtqIkJyy7KbqvMkT04Buu:Epf8j51+CJ3ctwYH9oe2qvMn/rdjTM
ImpHash	-

C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	41003dbd9f61ffb9d789ff25706e2f62
SHA1	298a03688efa34a396a86c8e1157873066db3ee6
SHA256	c9e20ea7f70917d47bb9a29b214c3cd04eb32f5a0d8988f9ceaa94c4ca1a812c
SSDeep	1536:+OzmtKvKYnJF+wCVPO0Hu5e4ojSzFanOMghVKvsxAxrRGsZbpo/:PmtWN+RPO0HTzjS7hD+HZdo/
ImpHash	-

C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	6a8ebfc58a94872b61ec4fac981c4eb4
SHA1	ed62fb4a79dc4c3cff3976d1714bbac08e6b82ba
SHA256	652d99b97c8b6cd68ec1c9b692ad8d5a588d228e1c57bad66efddf6542b58fae
SSDeep	1536:8h+5w+RM4Rl5MMizDkTzYDmDwnN1tBP5IlT+IF6/7K/mU18:8c5lxRl5nlTzYDSwnDtB5IlTGm/m3
ImpHash	-

C:\Logs\Microsoft-Windows-Store%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Store%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	16bdef2168798081d787b13401fd0565
SHA1	2950d84978f85b56abd7382c77954a7fe10d858a
SHA256	d3433cc8349eaa302fa50c074ad8537ca98a9a972bd4b249dd7c7840fc9bc52e
SSDeep	1536:mG5Zgu3j8D0ca8nyDloKhVnzpmFmJA8y6R7bx:b5CuSZa8nWzMkA8y6R7F
ImpHash	-

C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	aac7f4ca8d2edecb3a91374302a58699
SHA1	cb1cd3f16f4b685d3a41eb3908cddbc61853aab3
SHA256	c3a21ea6018384e769a69d71ad0971be0a972bb20d4be249ec051c6fd07ce8fa
SSDeep	1536:rFcTBnKOsTM3L9D+H6oz8ze6OAFQmkBvHOra3iWXcJ+s2EWHXstXPNAGLqRx:sBnyTeZmzT6OAF3+oEcEEiMPNlqRx
ImpHash	-

C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	616b88d9d12e5fde71ad39b830b7b434
SHA1	61d2190f1e49a5eeea1eb5f4e17b41d84bc30f0f
SHA256	2e7cc8560972cc85942370d5d7d70987a82e7112e89bedb5f0ffccc66787c34e
SSDeep	1536:UAPUEeKLOACTSW/JnxwKSqAPof2BM0rI6Ydp:NPDFLCmW/XwKb3ON6P
ImpHash	-

C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	bc5e90fc3c2ba32861adc53c5933b538
SHA1	a6cce031edfdac88324f4b0df87fb23b47034cf7
SHA256	1b0fef691cf6e59d84b1ad2a39fbd64642148cf1d7c5ee4a85399e0e44ae4cdd
SSDeep	1536:STGL5qYVjutmL79VNU9Q6BuytbUg9fs9P:7qYByBuYRhKP
ImpHash	-

C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	fda61589a345b41a4a3e008286cd5a01
SHA1	943ba5010afaaaa7804dcf7789d5c4e5a3579793
SHA256	6b8a743ee698c37d4066c9ddb02ebe4a159d1727053427ecf5ab2ed93d8979d8
SSDeep	1536:5Tw/q2QmipM9jlMTMM89Xf6F5WjlBwFcGX:sDipM9j2RKSF5Wjl5GX
ImpHash	-

C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	709c8e257eb74cc14827709bb1db03d3
SHA1	74ef0ad44cb7422ec02a80715c484ea1b53f008a
SHA256	4a32939f653ee4ef285d3e6263d45b87d739337376eafecf99aa7e6445859326
SSDeep	1536:JgWaYGopDTOdPsj8u4Bvm8FuJAEIhXDqEfP8m4LlnqmhIrcx:+yrdqqj7488FuJAh5DqEMm4LltV
ImpHash	-

C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	26e794a82c2e62a1b2af132b70384b22
SHA1	f8a63a45dd0b16106a0811609c275cfb2e398b20
SHA256	4d32bc6c859e57ba69ef6cb84ddc1a20be973d391eb18bdf2daa400ffbd54795
SSDeep	1536:VqeJ2mD9BDPDHTgtmVpXj6MlQlnJhbwBvTymI1jYlk2RU:Vpg4/PjTgtmVXAnJobswkd
ImpHash	-

C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	51d69068fcd4a1d4ec41574c8b1fa776
SHA1	3293633223b2ac9534ea3e76c1d811521a688810
SHA256	33da90f6b08d1a26a592b66a0b57cd34047823df1b553266fd148d8abb0a9d41
SSDeep	1536:I8naJMaT6IWYufRKlVDgXNVKWr6CCa3TSMotgJaNiZEHQ:IE+6xElVDgXNVKW+C/3TSMiiZt
ImpHash	-

C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	02faa84fa428977a77d1dcaeb3cde732
SHA1	0df5e947b81512079b3d15f115303eff93104fe1
SHA256	f1fcddb20922ee7c86db0b9cddafd99520fceb56b1e61f9e5e7c8261b704bc53
SSDeep	1536:i8TRmA+2UEpN0toj3aaAcjDcilQ3qVXzGBt47JAh6qfmvotIg8:i8TRnHpb3aaAODciNVXzGc7JwPisIz
ImpHash	-

C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	191d78330f4dc4b030e8a6227987c097
SHA1	7bed0bba228ebe08e823ff42ac59013c4042e796
SHA256	c680066770f5f92c792c16d593be988bb8f5a80e2b376fe4a535136108413ad2
SSDeep	1536:gkRHyZHuJtePi9Bas2+XzY7aFDgurordAmKTNZnwfhA869bj13CR:yZOJtOiI4JgukCpYW86FjpCR
ImpHash	-

C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	ee83bfddd7a7a21300dddb4369eed79b
SHA1	0ad486ce95725d126d9f426f16e0d99d2fb40652
SHA256	57c75a598596200c622df9f9ea45f79d101cc162505e0ee464f0a931dbb44a35
SSDeep	1536:OqHOBCJCDTvaRutNtvK0iajE2jyO+BONqNVZyU1gjzY:BHMDjeePXFA4CvbyHY
ImpHash	-

C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	083b3fc467387edf51f912f8a5a37a59
SHA1	97fc6cdcf420120f33ca21ae98292dc4c6719ad6
SHA256	9a888ec57c29a4264102dfa4f89ada35cf994b5f907898da2bdc22c32372d6f1
SSDeep	1536:uqaRiLU/ZyY3ondJUxMoOl3y3OYXWpQLjz7hZkYEjpKZ6D6gBDifz9xV:uqaEU/kVT+MoOc3OGk+zVZkYEjB6ADk3
ImpHash	-

C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	162ebd452659c9704e1b7e0871ab9b6a
SHA1	5d345f4875a8020a4e2472446ff8edb45f67e525
SHA256	58a1c0faccfa08098c8ca3a240ed0daecaf29f9afd66b49a2289986fed17bc98
SSDeep	768:H8G3iCahttLX+1VTd/qnCjIb7Wgi1Bk6MAxQD83vkTz4lCi08Seh3V1sCBT7AdNO:H3yhSzinV7kBTXSCF1BZAC6iCJY6U
ImpHash	-

C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	dfedc74714ec0c39615c3a008077909c
SHA1	499a9ddd3b32fb859b9f5b7e3cb4b36704febcec
SHA256	20d343c46cc6380962fc086b5981a514faf513b878c925312c6f6149050b87dc
SSDeep	1536:xB6EljqzNzFGqXySPY977B8eClTPqHJv2EGifWGS8qdtXF6Mqf/8e:LljYNOoeUGHJ+EDi8EP6Mk
ImpHash	-

C:\Logs\Setup.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Setup.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	d50640c9a891c148dbaad527e9128272
SHA1	0c258f7d5094993bf21760170435fba766749d74
SHA256	396e6c4c8cfc6d65e63a6f4ddffaac81267fcf18b51dbf1fb1d8caa033c7228f
SSDeep	1536:GZL1UmX/C8WJ+8d4I2xLmy7ZpN8y6o6aGs9o63m7:8Ld/CnOkcZt6oemE7
ImpHash	-

C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	d598fd75f15af3aaa36011639288191c
SHA1	7bdb651e36f411a32d5a6acb85e7e3ab64f5fe73
SHA256	86c680e832460f22e888409999b203868ccffa45caaa025c461cc867cad8345a
SSDeep	12288:VZnZBA/DTUbwSNdnnlGXvkgQ78p6OkaonbFCBY3QdAUZ+nZ0/s6BQw5Ulf0SBJ7S:D+/4jMXa7AhupCB2aZaD1RORYvVoiGV
ImpHash	-

C:\Logs\Security.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Security.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	1.07 MB
MD5	66f5c286e14b0e836d9347f7056a9cf1
SHA1	75c7ce2233af488f587f6c1d03e8a50ff829be4e
SHA256	e9cfc82ef2b7ddd486fc84ead224233c6aedee1d58d9860a1455394d3813565b
SSDeep	24576:ymbHiSKr0E8XTlSMAR+lIUUFSKeJjCFwSPSAG6E:vHiSrToMAR+lIUUF6CjSAG6E
ImpHash	-

C:\Logs\Windows PowerShell.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Windows PowerShell.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	b15cc4a1af71f8574ca85aab31495a40
SHA1	8eec3c9686198f1f69cd0e9d55ff55e492d4408a
SHA256	fd5dc3a2b3e18b2c648799b9017575daf46b683da0b22e8d7c3ab10ec10c658e
SSDeep	768:RTmTXKNffQM6IJoqcArc3Pl7OPKmKQBFJLGKoWzXrFH6B5gciU4GDYVW33CRWam8:OK9YwXiUBzLLz7FaHgK4hoQNmxF2r
ImpHash	-

C:\Program Files (x86)\desktop.ini.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files (x86)\desktop.ini (Modified File)
Mime Type	application/octet-stream
File Size	708 Bytes
MD5	f251dcf18be78a25898ab1547d9fabf5
SHA1	0b287f5ed47fa30c9d734fb86336964131753dec
SHA256	5473f37e1165e368f83118f69c28a1df82fdef30aad6149d0b6d6fc98dac1238
SSDeep	12:ZVKTiJ9NiYr1SI0zCUsQJob13M6g2Rk88jsRlXcbS54gKnma7+1py4:Zp9NioSNzCUsv13M6g2R18ofXce59Gmv
ImpHash	-

C:\Logs\System.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\System.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	1.07 MB
MD5	f185114581434a4b0dbbc87d70f5acd3
SHA1	a928e3c39dea7c3aa03309342f466f16e5f8bb75
SHA256	35f612e0abbdf404944e5328a3155b7dcbd1393fbb383cb4531d0f505d67d354
SSDeep	24576:aKOo4mBju+/c+tWw4SwqmVB8nBAf2PGGOxIt:z71Bjl/pteENPGDy
ImpHash	-

C:\Users\desktop.ini.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\desktop.ini (Modified File)
Mime Type	application/octet-stream
File Size	708 Bytes
MD5	8554125bcd7ddea7cb1566d25b81dbbc
SHA1	3b36b3239173e0614c0ce10a75213237b6dea066
SHA256	3c4c12d4e1ceea80f86916ca319aa15f3ef75079c5c1ec2d59e086eca47bcc41
SSDeep	12:1r1BY4zOEiNTrnYS2NCC2EV/6Ej8kZCM8ew1ARmKNryuCW:1rLYweHf6ClEj8y8ewbKNW
ImpHash	-

C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log (Modified File)
Mime Type	application/octet-stream
File Size	42.20 KB
MD5	0ac7f52a4b815d283f78b248188f1201
SHA1	2ceb83624398b4bb6a4046b1c75695b464939a75
SHA256	106165cd561992025dd5c719c082debf6e1885fe7885beb91da2613cc6f1f496
SSDeep	768:BrNIoZ11UygcNx7EhZWvMYXR+SDgOCW/TZtPj5h8tYqc256g2ujENwFcNlJ:BJIkUo5vM+qO1bL5qN5vbs
ImpHash	-

C:\Recovery\ReAgentOld.xml.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Recovery\ReAgentOld.xml (Modified File)
Mime Type	application/octet-stream
File Size	1.50 KB
MD5	62e6e3a8ce7920baee188d58f2f47c3a
SHA1	b262a2bd83151a7e94c85cd25369cfb11ff5bb56
SHA256	fc040f82f4c92a8500ac1d7033bc2f1ee6c5f7d2e8fd1eac5eb6fcc923c322e3
SSDeep	24:cgn1itsd2sQjBh7/lkcBGuvk30nEOa5emg9uxftlpTSI8WNCRuwJnGXSnQCgUFCj:dncmQth7/lkcBnnEJeNmftrqyCo9SCJt
ImpHash	-

C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\$GetCurrent\SafeOS\GetCurrentRollback.ini (Modified File)
Mime Type	application/octet-stream
File Size	690 Bytes
MD5	711067ce2cea7efedd565dde439e406d
SHA1	ad9fcf59d5cd58f3600e2d142c8b6de27a58088c
SHA256	b948eb64f9e67879d33177706144576dcab6a40ca4a49f35272e1a3a87ec481f
SSDeep	12:ajCtOL90/ZHc2bDqrdpP6HlxmUUSRnmZz8fjCMjd1f9+rMsml6F8Jmu:9h7bDQdOlxmUUSRnQDypLsmlu8Q
ImpHash	-

C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log (Modified File)
Mime Type	application/octet-stream
File Size	574 Bytes
MD5	e4675087f4b7b637457da3cdecedf101
SHA1	7c7f28a63045e2a15bb67d4a7e00c9ac656e9b82
SHA256	8abf164068f7676683d5545c6ea1065ab1bfea690f81dedb3d1669d3962d8ffd
SSDeep	12:wq4Rt//1p0yBazy0y2cz6+p1Xykl7TE/3Zsaxmr6W6t1aI8V:wD7ND5ecQz/3ZsaxmOJc
ImpHash	-

C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log (Modified File)
Mime Type	application/octet-stream
File Size	6.38 KB
MD5	f49703f48f8e1c29b30490a5d6b59e74
SHA1	abd4fd3205f2dd726bea35edee36af75b4bd125f
SHA256	da0fb43f0c6c77c93d14bde58d966778d96ffa71f8850259876d885a86ce0b21
SSDeep	192:kNgJecQCpyQHsXb9vYoRRxdMDdBnGBIB3GxckBL:ygoTLWoRSdBt3Gp
ImpHash	-

C:\$GetCurrent\SafeOS\preoobe.cmd

Modified File

Batch

Unknown

»

Also Known As	C:\$GetCurrent\SafeOS\preoobe.cmd.AWSAK (Dropped File)
Mime Type	application/x-bat
File Size	608 Bytes
MD5	801d5fd208d65d66ef07302bd6d17582
SHA1	ee64e6a3c7a167b68b21bf08df9a9d54e13d14f0
SHA256	5ca4852abbfaedadd0b4e6352915b70b283f050083555c8a385a9b9b5bfe33e8
SSDeep	12:+fUDFqmx1M3jISdMUI1Cd9vffKMT0fUAUISryyfpQLSRQa:nx1EjIKMPo9v6MTfTrhR0A
ImpHash	-

C:\588bce7c90097ed212\1025\eula.rtf.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1025\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	7.91 KB
MD5	022aebd2e54587d69366f220e41b09bb
SHA1	db7b983685a5834d453cfca3efbde282bf723c9d
SHA256	ed12201bde67372b6330102559977aeb76b29b2e1097b1f44884130b28d2426a
SSDeep	192:oPpy3Sait49vw+WXI/qwIY2Xj03ECcakAk6qjinQRLUjwhg:oPg3945XICwL2XjEhDQRokhg
ImpHash	-

C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.AWSAK

Dropped File

Batch

Unknown

»

Also Known As	C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd (Modified File)
Mime Type	application/x-bat
File Size	1.08 KB
MD5	7d056c04fbcbff9a00e6866539399db7
SHA1	da9b435415d0770772a477266fd23c922c5e4331
SHA256	2b95fe69dc8c9d9df76aa574a92e36898ff8bd3f79926e82f2c8af9a5bae9af4
SSDeep	24:C/U4zATajtwd70nb5QtxDJXMaXiBri+fI1Dea/rnJWxPeX:C/PAGxfutxDJXMaU2qa/rJsi
ImpHash	-

C:\588bce7c90097ed212\1025\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1025\LocalizedData.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	73.00 KB
MD5	990ee1ecb95c99aa52da44aa99d2f3df
SHA1	c88178be6dcee2802fbbe8caaa238a0f097ee44b
SHA256	2567d08ca445c8d9e5afd43431f168d322685daae9e3f7998afca7490f1da62b
SSDeep	1536:Iyl3nP1ExWdukHaYnREJzkuB2kXOAzhwj5FRKL:Tl3n9Fuk6EREJzj5zhwVu
ImpHash	-

C:\588bce7c90097ed212\1028\eula.rtf.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1028\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	6.68 KB
MD5	81b0601cf310122bf328916f956a47d9
SHA1	5c6c65cddc304875e70dd8a65939498489fc7015
SHA256	2b063d800b6c8bd65070dc29bcf1f590a89e9947be023779ed1178e2ccee1d41
SSDeep	96:R1UR9UiWu0gPd1/gZs/yXgI7fR4ZNiKLM4GKs3sUVPXXOf49OUHzanUPspMA+:k9ULDud1/gZ2pI7qOvHcyfXOne
ImpHash	-

C:\588bce7c90097ed212\1031\eula.rtf.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1031\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	3.86 KB
MD5	9a60f7b2bd086abf96d9c760e3a3d71f
SHA1	6a60252ded64399c318848286b9f8081ff32c38c
SHA256	646d1df20820a198e58aebce6ca05b97c24d4af6bb316d6341253e31caa14d0d
SSDeep	96:sB2AjituMymWby7ejPZkRT/Y9Hc05uIa5BADV:yH+ImP6jKpDdyV
ImpHash	-

C:\588bce7c90097ed212\1031\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1031\LocalizedData.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	80.94 KB
MD5	81151e3f85b17edfded031e1ef0016ed
SHA1	669ae52c5227a721d189be4e084267980d0a0905
SHA256	f18d526996cddbaba733d07c41a029a972fb1f1f66a56595bd8fabf55ce33546
SSDeep	1536:lKnxb7p/Yz2BQ6p0w2gdf9VMT8EgJvCERFzIRy9kCjG/a2u2n9JT:ENp/04nV/RCEjzBNC/aqnfT
ImpHash	-

C:\588bce7c90097ed212\1030\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1030\LocalizedData.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	76.45 KB
MD5	a2929944119bac70453e1d77ca74e771
SHA1	cf978c8d3ca00e49dd56ecb7930cb5d380cdbcaa
SHA256	06e16b1d1703e4574e404cfda426aad869c786487b18d0fb9ef8d6c59dab2df0
SSDeep	1536:RH39K9g7EELPqFQ28Br6tvsw7A5NratgYA88ncxNSpR6D0OAfvgqhjq+7i:RXD4ELiyrhD5ktg88cxNSpR6Dfqhu+7i
ImpHash	-

C:\588bce7c90097ed212\1032\eula.rtf.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1032\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	9.19 KB
MD5	53c2343d9b3e71311634bf2634b23818
SHA1	bcd4210621d7720c9c7df491f8a29216e31714ff
SHA256	3e96d472d70147b0ad314103a6a2c5c898a621e2389be78be5403234f02e4baa
SSDeep	192:ZrD8xkYvzT3Kr+Siv4YvyJq9obBdC7zU/1+RgP6NXh:ZrDP5oK09qcwwOOXh
ImpHash	-

C:\588bce7c90097ed212\1035\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1035\LocalizedData.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	75.74 KB
MD5	51f1416d891f1e5480836a019fee9312
SHA1	0565dbcbdb10125348e71eaac991674827520685
SHA256	1b80cc519095e2847e68a142167cd073d17a994d950fe9e51f32fca3ec113854
SSDeep	1536:EmZVqqmEZIk9vtJIxj7A/w0/mSxA07UFbH/i5E1Fp1WfsHkuhujr6t7MyORtn:EfkvGu/xgDfiC3n0s4jut7Sn
ImpHash	-

C:\588bce7c90097ed212\1035\eula.rtf.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1035\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	4.14 KB
MD5	90a3d61b61efd0fbfa952d382a918a82
SHA1	f92b18a5ea1d1eae9808aa28cd149c8bb29a06e4
SHA256	22b9231c56cc4f40cccb52d90c11ec7891283a2cb4bed2de0901b74f4129a59c
SSDeep	96:uIWapzLaqV/rfnKNfSLQVAT7E0G4N3szgyP2aDHiqR/ET4Hj:/tLBV/rfnKNfTVIG4Bs3biOcC
ImpHash	-

C:\588bce7c90097ed212\1036\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1036\eula.rtf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	3.96 KB
MD5	2fb91cd76911be8c766069de35188a30
SHA1	f6907fd7ef970853dcc1b160f9f4620a6b229505
SHA256	dde12578d220c7e7a3caf8dbd4434bb55d755b6dd76f2ff644429f636e3a4275
SSDeep	96:dXE/81Fi0hlzU2IRyqB12oAAr/IpJnkKeC8QTL0Bcw+w09jpLaNteF:dX681YVRyXoAAr/SkTC86L0SvjENMF
ImpHash	-

C:\588bce7c90097ed212\1036\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1036\LocalizedData.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	81.54 KB
MD5	2add7312602146576f66ea9c36bf7223
SHA1	5fbf35a2432cda3c171a73af86b083e3aa7b5b25
SHA256	024dc05282fc6d487d673790e58e1d9a7f3e8867425c7b9a5251f6d9708a0da1
SSDeep	1536:UNv/bG8dnNCEqNLE8CcAu8cK7V8AyBTQQ+t+oJWlqKd/TDHnHtXcW:UNbG8LCE3tYKxUBOt+oj8nHtn
ImpHash	-

C:\588bce7c90097ed212\1037\LocalizedData.xml.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1037\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	70.91 KB
MD5	914843759d61118e0bd300a14446235d
SHA1	0cf3df59850cbf0045005228373d5bc0bc28b5c1
SHA256	bb770e8dc3515b657834035810e860a1d449a1763e7d1553151c86266eebef51
SSDeep	1536:rOlJ9LjD77thwjWIUpSlNYdaZQG/TpAV72s+S4N5BY3L:rOlLjpOCZpST8GQq6V6R8L
ImpHash	-

C:\588bce7c90097ed212\1040\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1040\eula.rtf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	4.08 KB
MD5	c99a51f3556ed37141140a0f608bee29
SHA1	35531e07b1372939aa174cecbbf60e425af12949
SHA256	ad9a0dd4509dea8db12e8bd77250a4f2609bbc6e8bd4cb64b97e17b9dccbc434
SSDeep	48:QFPKihZrcRYSvrKb/7aI0v5VhtjB2Jey4lzGnQ6DCwnw3o5LSKmqPilIVsjLwOGe:Q93GYSGJ0VJBZkdzyESgPqw+RlL
ImpHash	-

C:\588bce7c90097ed212\1038\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1038\eula.rtf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	4.68 KB
MD5	586e81fbb4db869af37b989101def39b
SHA1	8ed0acb4670445cc43da7f821e674f60adbe8f36
SHA256	ae8898ef1338efd34eb1275c3c0db7145856c19e2a0b3e82c66b62096a84fe53
SSDeep	96:84+/cXAr37xHcjuisjzeH34EL0Zye5rIPANU1Hw7oD0/NlUgvwWp:84z0318jojzeH90Z5IINUpyoOLp
ImpHash	-

C:\588bce7c90097ed212\1042\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1042\eula.rtf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	12.91 KB
MD5	2234f3b670233f71558ba0291001e02b
SHA1	7b42123a6c6cb9190072794b6b3468b9b6cbb49c
SHA256	e4f175301713fd87e8e9326c912154037c566357ad2c91a7ebf779381a4b5d8d
SSDeep	384:Ik/SOBZA0QO0dltkHjqjWeBoyx+Kr6IXe:ICSOPA0MKHWj4yxHNe
ImpHash	-

C:\588bce7c90097ed212\1041\LocalizedData.xml.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1041\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	67.15 KB
MD5	bfcad4ec5028086f1b1477de7a486163
SHA1	f5b1f158136c0e36708b2c32fe2645377ac99192
SHA256	0bd8015bc30b2d2b6a7b3ada8826ef6c4f42482672d33d0eaacc0f8dd7538e92
SSDeep	1536:RXaWTJLpcnoWM5cryamZ3tJcTsBAS90umxA+bWtpZQZjLKE:RX7LpcosrnitJysBASsAzyeE
ImpHash	-

C:\588bce7c90097ed212\1040\LocalizedData.xml.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1040\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	78.71 KB
MD5	bf90b87c5305f090ba69dbf5f0c09790
SHA1	c95100c98f155628de29332caebe82b7f9253b33
SHA256	e19a671008b2a21f0f5e3e7844c78be56670074014dc9cfe6dca151861ad20d9
SSDeep	1536:yfswb7FBNsOzcNMiC23Qf9zcZknRTJBhtCLVfgflAHdF6:Zw3bTiC23C9aknR9BhtC5Yfp
ImpHash	-

C:\588bce7c90097ed212\1043\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1043\eula.rtf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	3.98 KB
MD5	5e335811393f29788a3170f373d40d25
SHA1	8b27df1dde53c9e3885408409c7df1444993108e
SHA256	48a4fffa28144d814cb52a0888f9cfdd5d62921dc93e4a4d8ab09dda4a82af26
SSDeep	96:0ub8Coaq5MrxZWxRLeASD//CWzYCwZV4JFAztl/cRkG1vgEnAuU:Bdq+9h//nzYJEJ+DcRkgna
ImpHash	-

C:\588bce7c90097ed212\1043\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1043\LocalizedData.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	78.29 KB
MD5	f8c2dc79f38671d3a2a7d27b31b71056
SHA1	b24da0e09ffb0765c57a123da9e553da39c94062
SHA256	18932f1ed8a7d0be4313c8aefabaa23161bbde8c3887b946e24e1b3096841a86
SSDeep	1536:H0JWCL6Go6pDoGoVbj0aYQYf4QJIdAIpsYoAgKY/ud6dvxZd453:H0ov6CldIQY1JISAOAKd5Tg
ImpHash	-

C:\588bce7c90097ed212\1044\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1044\eula.rtf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	3.50 KB
MD5	7bf2efc12cab0d272c7903a822f3d664
SHA1	66a0b5e00bf2d0dc04795530d25278e4bf1e0048
SHA256	8c83287f8c49fe593c5794aa37aa5c1b6911f1e21506c829b861984542924403
SSDeep	96:sU79GEZWGFxqSeq1/XGN4Nt7t202gA9EaWqTJsopT:sW91ZWGFxqSx1/77k02gmEabTmoB
ImpHash	-

C:\588bce7c90097ed212\1044\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1044\LocalizedData.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	77.96 KB
MD5	09604566e6d236e2c57f09b362567dba
SHA1	c302ea85354f7e64c9e2d0c90da28e5f4d72750f
SHA256	e72e24c71c78ba543f9ede96067df5c218b8b18500547e0676c64492c6ebf80d
SSDeep	1536:4fq8OHiBlUmdXvTvSmXiHbXcY6FboTAz2sajIyK0e+NvSRY5g2UoZ+JhyNiB9qwq:4fNOCBlUmdXvXX4jcY4XIjIR+oRY5g2l
ImpHash	-

C:\588bce7c90097ed212\1045\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1045\eula.rtf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	4.47 KB
MD5	fb49041c65850050daca27044347de7a
SHA1	eacf2e7e6bb880c6b180e7a267fa2a401112e21a
SHA256	472b8ddb5daf1172c3a44beac17556dbc85fd6126a9aaec2e16a796c01ac896a
SSDeep	96:qusLPAX++NRt3KAD1YX93QYpgqV7BPvVNT9nMpnMeVpyR13oMLag:qus0vJ3/1u93QYpgY9vVNGMeVoR13oa
ImpHash	-

C:\588bce7c90097ed212\1046\eula.rtf.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1046\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	4.12 KB
MD5	aec86a91fcd167d6474ccf702e13fc62
SHA1	c939985929695c7f5e2f901ab60585015f40848f
SHA256	d3fc73bf18b9a3c67c84135c6317c966b9479aa0fc2175a5e63fb5f3102fc412
SSDeep	96:865vV3y2YhWZC6rvAiRlKSBmOs4qX1dvqtwT+k:vN3ynZ6rvdSSXpi1we7
ImpHash	-

C:\588bce7c90097ed212\1053\LocalizedData.xml.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1053\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	76.38 KB
MD5	aa573dd5cb633a63d8ffc708ce66b538
SHA1	b9165b819c07b42e77f0b8bab0d012caa2d0f5e2
SHA256	8ac1a959a437a20cca0a9b933d1c75ba3398127757dfe5347f710dbeac2c762b
SSDeep	1536:jw74gxNd0fJAmdX1Ic2iIiZj3sPs2l/Ov+blYnu5bZGJrvtMaC3a86mV8U:jwU6afJlXSiIl3Ov+blJwLP/U
ImpHash	-

C:\588bce7c90097ed212\1053\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1053\eula.rtf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	4.30 KB
MD5	63e8509f47465f4547b239e64d9cfe71
SHA1	1f6a7c8e1012808d0af63f903a9a5fda4a7318eb
SHA256	5a5a2cbbe2ccf9b67abbd016fa4b83a65ccdfae51d5357472d1c2a268e7bc08f
SSDeep	96:7vlfSnQfAdcqihOskFO3S3S2rixlNpFJadhGERYZRGvNwQAIYdr7HV:7yQYdc1QFO3SC2exfNhERYZRGvNw1d71
ImpHash	-

C:\588bce7c90097ed212\1049\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1049\eula.rtf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	53.70 KB
MD5	ec1de45787fc347d453b7263736558fd
SHA1	04fd932e20698212211c912fb8a25d8e8d1a5e01
SHA256	644beca01c241e4b2980c1b4d75cf9863ac2136d6ff6fe95c1df9c77adfce617
SSDeep	1536:2mzsl/kQ4da4uyP+Y1P8dTFdc4aDIkasqMrQ:2mzikQPOP+Y1P8dTs464sqSQ
ImpHash	-

C:\588bce7c90097ed212\2052\LocalizedData.xml.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\2052\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	59.78 KB
MD5	387a18c868edb47a2cd36934c15a23a0
SHA1	2b8569fb6e492cccee32c8dd422701aaead89cc2
SHA256	209e39f7c9a6a4e6ffffe68b1033b5366c19224c0544636ec2fe9f3151cb3823
SSDeep	1536:XvfJ5v9fDjPFd4iDyBTPJeHPhoTDeWwvIk:ffJ/PFdtyBTPJeHJoeWaIk
ImpHash	-

C:\588bce7c90097ed212\2070\LocalizedData.xml.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\2070\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	78.89 KB
MD5	4412ab05adf15335adc1091d2e875472
SHA1	3024c7bb47095c8ffa6d9cdd021fe70482f4cf65
SHA256	0d8329a75712a7584292e7da33b525a8817b23adbaa718e364a1b7e5549eadd5
SSDeep	1536:Zo2DDvzLJS0PoC4OV+FfMj73Rt/eJKp6vM6m7SC8dJd9O:Zo27zFS0Qpkp5QfM6Hli
ImpHash	-

C:\588bce7c90097ed212\2052\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\2052\eula.rtf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	6.21 KB
MD5	7544400c9ce654c9eb72ba3a31150618
SHA1	e4a25af6ca78410144cff000e67ce185289c5c1d
SHA256	bf6fb3a79fdf92b67cd65796b74ca2aac22cdabbdaa84b2ce8ab32ee3431ab75
SSDeep	192:U2KyHMSPK8LOm3IL/Y7a8GahvWa3PM0/GZRCT1yQ:U98TyYR3IVahBMtZIT4Q
ImpHash	-

C:\588bce7c90097ed212\3082\LocalizedData.xml.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\3082\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	78.64 KB
MD5	7939f7417290ac6aaeb8f748bb21dc27
SHA1	06f3fc97e390aef817fd2c5d90966a9510d21a42
SHA256	8a51dfdd962544292278d381bd231fd47574f4e7426da82729c18ae9eaccebde
SSDeep	1536:t5m7ue/+iczcpAALFHrJ+SLZVbbcAZpFD1yWjcRdUeDbZulcoi7Spa+N:eD/AzcpAwFHN+SLPbbFwWjcHUeDNYg7A
ImpHash	-

C:\588bce7c90097ed212\3076\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\3076\eula.rtf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	6.68 KB
MD5	b67ceecd0a2eb0922cfbcf879ae3ce94
SHA1	328b867efb49ce3154a14cfe2a85a4908a026378
SHA256	c3649642cf97d74c70abe953647728bc3335d40338fb9d752a2e42e4b049097e
SSDeep	192:fot+CR/RaKkBzfUg4dxjuBPRry28b4zht:gxR/RSUg4/+8et
ImpHash	-

C:\588bce7c90097ed212\3082\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\3082\eula.rtf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	3.52 KB
MD5	34bd1c96ba82b01ab7fd6df31009ae8b
SHA1	2a10afc2f65062bf10d01a551c7e19f4b3bfa053
SHA256	8cd6bae4de1bf24717e6a9d30791c8655b00726298db33000edeef4f82d9c241
SSDeep	96:X+m9RUijcaNeVirk0z2Zdb8d6CB9ViHvp82lNorTkT4Uvk8/hPfJfaB:XZFjzN4NK2ZdL+ViHqYOPUvrZPk
ImpHash	-

C:\588bce7c90097ed212\Client\Parameterinfo.xml.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Client\Parameterinfo.xml (Modified File)
Mime Type	application/octet-stream
File Size	197.59 KB
MD5	9c4f38a76d077b446b411fa1cf0f9736
SHA1	b8485be625d5bcf15333d4f87648c41ec7e9cde6
SHA256	876f404fdab7621ef53792fe8d65a5fce75c150cba2d0476cd25ef40eddbb446
SSDeep	3072:noyjPuSP5acTxtYNru1LiWLpISiQGRfnqcyvJMjy+6OgN9xzlMD6pivM2zc:oyjPusxYru4WOLfL2acbzF6Mcc
ImpHash	-

C:\588bce7c90097ed212\Client\UiInfo.xml.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Client\UiInfo.xml (Modified File)
Mime Type	application/octet-stream
File Size	38.65 KB
MD5	ff82d7cb4f45f175331c007b7dc00d18
SHA1	f2b964f9eeaa54cb91bc5ab5e0a6534f36cbffe5
SHA256	e8d0310e0678f06dab50b3ebbd421e0c5a89dcf1f795f80c582ed53d5ba8bce4
SSDeep	768:y/Njg4dRJZtecfkarUT8zEjXk1cdyovgvj6X4i/Rgy6H4Pc2aIH5:qC8bjJD9gjkvGXpK2U9IH5
ImpHash	-

C:\588bce7c90097ed212\Graphics\Print.ico.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\Print.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.64 KB
MD5	b12d12d424f61e1acb1fa7c20e107d8b
SHA1	b7a0acc64ec1f91253b9d75ddc390cd374fd51a1
SHA256	745581cd140f957b030c7e2978e652cb065ca3fc6b66b0a518e16384e6d86fcb
SSDeep	48:GwA9QPfb+H5C+COrPf9W/S+hA8lBbPmVLp:3WQnf+CI8NS877mVV
ImpHash	-

C:\588bce7c90097ed212\Extended\Parameterinfo.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Extended\Parameterinfo.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	91.65 KB
MD5	30f2d4250f21655b9f074043cf97b0f3
SHA1	1cd3b52b6f8eecac84c4505d2d59e65aa7b8e2b1
SHA256	b81bd350ce6f32b35e8b37ff1b541217674a555856e6cafdb9fb4fc6503df170
SSDeep	1536:4MPzr77U2jKDpg52IT5Ppz0zKDt9jUuYiPeq+pQuT6RPgAb8d5HN/qQm:VzrPBkpg52+wUTjz2ZO1gAbwHQQm
ImpHash	-

C:\588bce7c90097ed212\Graphics\Rotate1.ico

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate1.ico.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	1.39 KB
MD5	026c5a4ecda5b42bae4bc9ea8d078e18
SHA1	5fee4670d6dcf2f05727c390072c0b9be1a8c514
SHA256	5f5578b721d3fa17c436fc48ceb6fb9f513218c1dd9bff9b5aed12b2e26749be
SSDeep	24:B9e9QoYIfoDOIPFlFFzv9eMmVUwBpTiC8hrO8KgTA7XPNY:6jYIUtTFFpeZVGCOSXC
ImpHash	-

C:\588bce7c90097ed212\Graphics\Rotate4.ico

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate4.ico.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	1.39 KB
MD5	e2c4efcc5fc99291f8507394d0457dfc
SHA1	90c3504555be6d019aaf9e487978cdd8802a1ad0
SHA256	39f3b56cb346b69fa628f69c442cd38af4e4f89f6f0c4477c95cddd0e5416683
SSDeep	24:NGzfPSuW18Sb2X/ePm2Y2OPA7t32wIU5EGBDqI6Xjhq+ufbpacnNk4AfgmJ:qPola/eO2Y2OPA7t325CEYDqIzdzpack
ImpHash	-

C:\588bce7c90097ed212\Extended\UiInfo.xml.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Extended\UiInfo.xml (Modified File)
Mime Type	application/octet-stream
File Size	38.66 KB
MD5	6f37d5c39018144cda0ff4265b4ef4a9
SHA1	5892f751304147e89c9d02bd3ae8ebdeec82d53e
SHA256	e60a6ace0fab585e11b2c7a11510df70372d8e5481309f0ad13b6451fe78ab58
SSDeep	768:aKYAHnCDsZs5Co0B6FqEc/PibbZ/EjPJIDrD0gwXnKnndH7RcIc5p4p/ueEd5rM0:jRiDsZ7Bd0bZUtS7Rcv4spd+0
ImpHash	-

C:\588bce7c90097ed212\Graphics\Rotate5.ico.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate5.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.39 KB
MD5	8f69b78e1a9b9576c9c2b8cbc2e36af0
SHA1	aa23ce17c52af3660996d91f68bc52876055826d
SHA256	9d94261d2c32b69ff85cce21aa3dbc03ffcf397e972c3d3c06267eb1c980b887
SSDeep	24:CnRAjZkfpEr3xUvKQKrICxk7ndmnvfg0v08Ah2Cyj2xXXmrlJ+FjPkzaPZjG:CnRXpOhK2x86fg0c8YrA4s+PZjG
ImpHash	-

C:\588bce7c90097ed212\Graphics\Rotate8.ico.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate8.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.39 KB
MD5	d1f6c874908ca2410b883cc512a68556
SHA1	2acdf4302722be4567a74fd7ee52ba247858c36e
SHA256	9c152cc6b8b289385765bd48cbfbd43ac4e3d207834ec0b86dadb17e2fe360c7
SSDeep	24:MfGAVdoeDVK7ZuyZlT5UuUyigbZ7HF9bIofur2XVBlT8watw7v/1z9DSwytTao37:0doeD2uEbUfGJHF9bIof+2XVBlLEwMZ7
ImpHash	-

C:\588bce7c90097ed212\Graphics\Setup.ico

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\Setup.ico.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	36.37 KB
MD5	6b21cfc472b3d73bfe0c7079cf39de57
SHA1	79c47be15a422440a46dac9ee86f8fe223824f70
SHA256	998d3e9a872587915e1f0289250fa5867c5ea3a82d16c20b793ce167144c58fd
SSDeep	768:vmyAq1cDSlMA+IklzHNvgVtzTwNpcwxGo2CrYoro8yrPpCw+8icyFY3e:vReDnA+xlNIrkNpcwvVO8yrEj8icyFYu
ImpHash	-

C:\588bce7c90097ed212\Graphics\Rotate6.ico

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate6.ico.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	1.39 KB
MD5	6f58a609bc432c876daab9bba0e9ed3d
SHA1	c07912a6eade2b9f1779c47857cb298e401442d0
SHA256	ec75d946c8027113516a0a7f52c7c8f44652295403034540c9d8b772a1ad2090
SSDeep	24:B2/qLMr7L2g+OzsOa+QB1B8ug01L68VcU6SYyYOaUiOUfd0MnIP2:B2iKLJz1a+0/TG2d2yYCQFM2
ImpHash	-

C:\588bce7c90097ed212\Graphics\Save.ico.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\Save.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.64 KB
MD5	bc873809e8625238ed747307a624dcd6
SHA1	d42fbc89ff5e24e8674ca6f5ec7e78fed0f66ff3
SHA256	856c04bd70dc93ecbebe4a0a7b062e46102b0ec428bda50f2fb6f700536099ea
SSDeep	48:qHGzMfz1E0oGtpmDuz5rhPOTX6UTEzlzCZ:GaMr1VnSSFmX6U4JE
ImpHash	-

C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	1.64 KB
MD5	ae048d0bd820f46617ce3bb4d441a887
SHA1	5b1b396d98d28b8aa3c27a8b732657e6378462e8
SHA256	5684da96582a6af94bc6ba7fe7cd309ce54b4afe167e793c3398476e70d8c135
SSDeep	48:ytuaCzMDPL3ImR8DaN3j7FIm0W2Gpo3x18JQkSy2:yoavDPDvR8Da/ImDo3x1S2
ImpHash	-

C:\588bce7c90097ed212\Graphics\warn.ico.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\warn.ico (Modified File)
Mime Type	application/octet-stream
File Size	10.42 KB
MD5	753eafc546379988bc3abb0dd8992921
SHA1	144cc5faecaf12700435f1b14be73e724de7bcd5
SHA256	c48412ea2a320c782574e9c61c0187e1c0997e1d953702a979552bbc8e72221b
SSDeep	192:1RC1RFh4GbRdogm/2F+kIdudOjgIqmSe1mkuf7n03hzRWi0i+k4EzbCA6U8Pa2qT:1R4hRVmQ9Cj1Ie6c6UKxIt
ImpHash	-

C:\Program Files\Mozilla Firefox\application.ini

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Mozilla Firefox\application.ini.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	1.22 KB
MD5	5cdb75bf40f5b19e791d60d91efae073
SHA1	18ebbdbb5eb42a3927929d680170995dca31aebe
SHA256	1f67d807193b7069de78c5b3d60e7a96f3f637f2086786d8110bec80c544aa59
SSDeep	24:KKODdvuGBshPEv2BoUjmo2D6otm5zwSvdRvKBMiwD6UnFQjD9Hwf3U:vODEVh8OBpY6oY5ESvdRvoFQTFU9R
ImpHash	-

C:\Program Files\Mozilla Firefox\crashreporter.ini

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Mozilla Firefox\crashreporter.ini.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	4.43 KB
MD5	2516f651c81b4c3accce75ba033c6ed2
SHA1	068e5ec410a9b8061f78e9c0b3c76041a69bd5cb
SHA256	57420e0e1139d9e3d93da5aba3005c1b1ea7ec6604dccc5d33b0c1e98767e561
SSDeep	96:Ays0vy2XndJCm+ESgHnhh/BBn5Q5fxnMrcmuEkhS6NZcxQKxlXK1dAAEUU/t:AmHnv5ofxrSkhMxxXK1dAgg
ImpHash	-

C:\Program Files\Mozilla Firefox\dependentlibs.list

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Mozilla Firefox\dependentlibs.list.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	1.00 KB
MD5	686c743f890083be830deb8911d87e7f
SHA1	11cb708ceae8ceee311f19a856435eab7eef2f50
SHA256	8ea173062446b14f41a86e656503679d83c4935276748e344eb2c1548d1f5b2d
SSDeep	24:zatkkowZLfwOTwM6664epwQWVVeQP4rjaPvEIPomNFNL:SowZjVBApwQ0wja3EIFDL
ImpHash	-

C:\Program Files\Mozilla Firefox\nssdbm3.chk.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Mozilla Firefox\nssdbm3.chk (Modified File)
Mime Type	application/octet-stream
File Size	1.40 KB
MD5	a284756a9673b1985d8f91d8dfadb6d4
SHA1	bcd2de8aca9863a1edda55dd6a32e014ca45706d
SHA256	d37328fe87efc317ac2dba9890c5501e3f099c15e03bcfb6ca77980403e27d5d
SSDeep	24:wC1gCkHxeolGNimJ5lBKGSh0gWUAwFg3PUVdFDBqYpj/j0jp+OIFxipVh71:wClkHxdN05lon2gbFsPUv9oYpjcpf6iz
ImpHash	-

C:\Program Files\Mozilla Firefox\install.log

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Mozilla Firefox\install.log.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	29.66 KB
MD5	dccfd4ddbf53fff83129a177637fc989
SHA1	d98c95f16069445a2902e53ae540dce5345b0ad5
SHA256	d7389c245f84c6e04c6b5cd1370ec0061d1da68b4ec0f9c9eaddedd6be7ccad2
SSDeep	768:QBP2g93XeyRZHurr+75KRaldhVx6uD5AalI9d9:QVhoy/HuHDwbVkuFAPd9
ImpHash	-

C:\Program Files\Mozilla Firefox\platform.ini.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Mozilla Firefox\platform.ini (Modified File)
Mime Type	application/octet-stream
File Size	700 Bytes
MD5	033f9d91f6be78a2bfd9069fc0151107
SHA1	16d0bf4e178229b1350841fc9e1e0d6b66724f3c
SHA256	b2609d2fd818bf6dc10983bedeaa6cd03493707fb5dc05381c89c4d1fc4e0693
SSDeep	12:MOuIU0iWs/90EyC2kbOOS/q1wMzrCkdhbwV/aq4nSXFoXKrt:9Hbi3DygbOOSy1nrbrbwdaq4nS1Wut
ImpHash	-

C:\Program Files\Mozilla Firefox\precomplete.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Mozilla Firefox\precomplete (Modified File)
Mime Type	application/octet-stream
File Size	4.47 KB
MD5	ea5513f2e5f73edbfaa7d98d968510bb
SHA1	3d7d98c101b185a9b1deb9a620cd900b289f9587
SHA256	fee668daf0064dd700cda38d0006a09531731cb2056e69068eb4bc27011561d7
SSDeep	96:j+1iWfegX1tvrVnZVRVwLh7OMSGoALEaxfSmH7kk:j+1x1BxtVwLtHDthQk
ImpHash	-

C:\Program Files\Mozilla Firefox\removed-files

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Mozilla Firefox\removed-files.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	1.15 KB
MD5	a8053e3eeb8c7c3f88299fbcb4dd0435
SHA1	61fe11aba19208319ac06c122dba54b9332a754b
SHA256	9cc1222bb8f061f1371475fab90c03725015a1a1a5ba4824f2ce17f6821b5a0c
SSDeep	24:GZYG29TAtwqvKSfm7FUSnER2vbin7M15OCHLiI2LyTW/oLw10UQ2:GaRAtwqvY7uSEczi7MjHB2LiNLsQ2
ImpHash	-

C:\Program Files\rempl\rempl.xml

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\rempl\rempl.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	4.31 KB
MD5	7ab560cde098c07bbc28d54285be0a64
SHA1	2ce821983c2e352639199878262d850f2944f62e
SHA256	b4beca858ae7969816ad1637fc50cc31ed8dc9aea722f19ddf795b778751428d
SSDeep	96:naV5cu3b71xjvik5CxqBudOc+eYCotbQKCxSX2OsM8:3+xjXYxiOOcjWnoi2xM8
ImpHash	-

C:\Program Files\Mozilla Firefox\updater.ini.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Mozilla Firefox\updater.ini (Modified File)
Mime Type	application/octet-stream
File Size	1.74 KB
MD5	4d14763233c0cbe44f198973e69582d3
SHA1	25bf6dd7423e5899deba88d32db50a0bb596cb30
SHA256	2edb822e02063980e4c5d7b3da08897016b22e68aea8bb97ee2ddc9b4cfc2a6c
SSDeep	48:kOv6tQ8en8f8e1zmYP1s42jLgYMgG+fMMAeWXA:kOv6mQ8Q6ysrgOG+fMMAeWXA
ImpHash	-

C:\Program Files\rempl\Unlock.xml.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\rempl\Unlock.xml (Modified File)
Mime Type	application/octet-stream
File Size	2.03 KB
MD5	1affdca0c82c52b69f5f3cb689588e42
SHA1	aedfeabc0d88507c9a46295cbe5d56af408525ee
SHA256	53ecae0035cf872cede29761a45f93ea32db77a73b8211be165d6784e2b2717e
SSDeep	48:Tah/OcstGSVhk45d0TSRraDPZfaKtdU2U9TCs:Taoc+Hk458SRYaq22s
ImpHash	-

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag (Modified File)
Mime Type	application/octet-stream
File Size	1.57 KB
MD5	ba4f7d8f4b6743ac819acc9fd4cb92fd
SHA1	6d2848fd2f25703d59fca4e3605a6893e059a695
SHA256	83c82aaa4587925fb8d466d00f0bdfda3ef91d986157bd2574065ebc216e5740
SSDeep	48:jLPzrQ7ZRY76Ezhhrbk/xie5BYXWERr52:3PzrWZiWElBbkpi6Ymm2
ImpHash	-

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag

Modified File

Stream

Unknown

»

Also Known As	C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	1.56 KB
MD5	9e280335b7a680ad702132716871eb6e
SHA1	61a61294078fea06c95baee9dbf71b0371f85d13
SHA256	80e4145b5030f35110cddd0ccfffe604a8b26bd1e6f653aea4d72edd43238a2c
SSDeep	24:pmsqdYsSPi8o2gdXx2gD2BB5fTm4lMJ9otRQFuS4ZXGbmUHCiqUCfLpmqP4MB4B:pvqT8fATU5fTmS2Fp4ZXGyUiiqXfQEU
ImpHash	-

C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf

Modified File

Stream

Unknown

»

Also Known As	C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	64.52 KB
MD5	303f819f3ab47eeec4c626555bcff06b
SHA1	82e3244f4a0b96d7077dc2255b2870a3e231ab9f
SHA256	f7ad959b67a778fc7fd63dd2d04c0581e35aa129cc6fe59f648f512980d1239a
SSDeep	1536:nePrQ4riGpzDS5qGTIG4IYuCRMDUSAPQ9sfQ31meGDB5n+43E4F9t:nmiqzDS5vfYRaDUNsG+5KT+431D
ImpHash	-

C:\Users\Default\NTUSER.DAT.LOG1

Modified File

Stream

Unknown

»

Also Known As	C:\Users\Default\NTUSER.DAT.LOG1.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	24.52 KB
MD5	5d90361cdbac28b83c5db2bb2788eb67
SHA1	6a109e7195f23bbabf31643b24c2ca80a74d3a2c
SHA256	e813ff481f09f67cf51a970babca1093b727540060ee4869703201bd1169c8f1
SSDeep	384:loz7R6dWGJCXLlhNKO+J+JSUQ2zNABf1TpSpx2+mJuCOUR8d51H4+EV2:et00LlhNM88UQso11STiTOy8f1Y+F
ImpHash	-

C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf

Modified File

Stream

Unknown

»

Also Known As	C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	64.52 KB
MD5	c3d4bbfa8ec3fcd3cc0ef1c4ae2d62a2
SHA1	fff9a3c58ea29ff67636301a0d266973976ce22e
SHA256	9016b5c239c633782838d84fedac9dcb10c4410ef86bd8d9c213c791e3ee9e58
SSDeep	1536:eRit9jEn2HlGYHx58U/Zb5WBTvyjDz4KALBFaHeaX4Hq:hPY2HlG2/VwBTq74KALuetq
ImpHash	-

C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms

Modified File

Stream

Unknown

»

Also Known As	C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	512.52 KB
MD5	060bfd5a3318e0258dcd87ac82a608fb
SHA1	a1880e9122970767a80cdcefb5633036a1d67901
SHA256	f645a266bd02b357a23ed0769fe5962c25d746ab55853e41650d07b19ad290c4
SSDeep	12288:cYOBx3IzDUSFXTCi5wjJysYcJlI94/wRbjXYRIIR+6uvhtt5QmK:cY6G/jCi52dJl74JXWhUTHK
ImpHash	-

C:\588bce7c90097ed212\netfx_Core.mzz.AWSAK

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\netfx_Core.mzz (Modified File)
Mime Type	application/octet-stream
File Size	173.08 MB
MD5	597c445aa8e328897d80c14abb423be5
SHA1	2da1ef17cb1f5b24e70d3e6a8866cfbc7b649566
SHA256	a1e0a58c6b149eb4c11a5f126a69aa260cf93079d2fb3ab09cfff289c5103157
SSDeep	196608:8XOse200vJ+ReHJebFru/v2IaHCcU/vbKoTtYCw0DomP3cwkmNN1+oxPsn9DLgPk:8XOse4J+Rf5VlHCJKZCB3Pszu1+oqnt1
ImpHash	-

C:\588bce7c90097ed212\1033\R3ADM3.txt

Dropped File

Text

Unknown

»

Also Known As	C:\588bce7c90097ed212\1044\R3ADM3.txt (Dropped File) C:\Program Files (x86)\Microsoft.NET\R3ADM3.txt (Dropped File) C:\Program Files (x86)\Mozilla Maintenance Service\R3ADM3.txt (Dropped File) C:\Program Files (x86)\MSBuild\R3ADM3.txt (Dropped File) C:\ProgramData\Oracle\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1035\R3ADM3.txt (Dropped File) C:\Program Files\MSBuild\R3ADM3.txt (Dropped File) C:\Users\Default\R3ADM3.txt (Dropped File) C:\Program Files\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1032\R3ADM3.txt (Dropped File) C:\Program Files (x86)\Microsoft Office\R3ADM3.txt (Dropped File) C:\Program Files (x86)\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\Extended\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1028\R3ADM3.txt (Dropped File) C:\Program Files\Java\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\3076\R3ADM3.txt (Dropped File) C:\Program Files (x86)\Adobe\R3ADM3.txt (Dropped File) C:\ESD\R3ADM3.txt (Dropped File) C:\PerfLogs\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1041\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1046\R3ADM3.txt (Dropped File) C:\Program Files (x86)\Google\R3ADM3.txt (Dropped File) C:\Users\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\Client\R3ADM3.txt (Dropped File) C:\Program Files (x86)\Common Files\R3ADM3.txt (Dropped File) C:\Program Files\Uninstall Information\R3ADM3.txt (Dropped File) C:\ProgramData\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1037\R3ADM3.txt (Dropped File) C:\Program Files\Internet Explorer\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1030\R3ADM3.txt (Dropped File) C:\Program Files\Mozilla Firefox\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1042\R3ADM3.txt (Dropped File) C:\$GetCurrent\Logs\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1036\R3ADM3.txt (Dropped File) C:\Program Files (x86)\Reference Assemblies\R3ADM3.txt (Dropped File) C:\ProgramData\SoftwareDistribution\R3ADM3.txt (Dropped File) C:\ProgramData\USOShared\R3ADM3.txt (Dropped File) C:\Program Files\Common Files\DESIGNER\R3ADM3.txt (Dropped File) C:\$GetCurrent\R3ADM3.txt (Dropped File) C:\ProgramData\USOPrivate\R3ADM3.txt (Dropped File) C:\ProgramData\Microsoft\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1045\R3ADM3.txt (Dropped File) C:\Program Files\UNP\R3ADM3.txt (Dropped File) C:\Users\Public\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1029\R3ADM3.txt (Dropped File) C:\ProgramData\Comms\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1043\R3ADM3.txt (Dropped File) C:\$GetCurrent\SafeOS\R3ADM3.txt (Dropped File) C:\Program Files (x86)\Internet Explorer\R3ADM3.txt (Dropped File) C:\Users\Default.migrated\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1055\R3ADM3.txt (Dropped File) C:\Recovery\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1025\R3ADM3.txt (Dropped File) C:\ProgramData\Microsoft OneDrive\R3ADM3.txt (Dropped File) C:\R3ADM3.txt (Dropped File) C:\Program Files\Microsoft Office\R3ADM3.txt (Dropped File) C:\Logs\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1038\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1031\R3ADM3.txt (Dropped File) C:\ProgramData\Adobe\R3ADM3.txt (Dropped File) C:\Recovery\Logs\R3ADM3.txt (Dropped File) C:\Program Files\Microsoft Office 15\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1040\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1049\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\1053\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\2070\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\2052\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\3082\R3ADM3.txt (Dropped File) C:\Program Files\Reference Assemblies\R3ADM3.txt (Dropped File) C:\ProgramData\Package Cache\R3ADM3.txt (Dropped File) C:\Program Files\Common Files\R3ADM3.txt (Dropped File) C:\588bce7c90097ed212\Graphics\R3ADM3.txt (Dropped File) C:\Users\FD1HVy\R3ADM3.txt (Dropped File) C:\ProgramData\regid.1991-06.com.microsoft\R3ADM3.txt (Dropped File) C:\Program Files\rempl\R3ADM3.txt (Dropped File)
Mime Type	text/plain
File Size	213 Bytes
MD5	4eea03a736f9d5be9e7fd0b0b67420c9
SHA1	cfcdf7227d330a3e254c18f890638d6e8b696016
SHA256	f59d74f347b734ea77e5e122044cd458b6bba5ee1dbccba21ac5eab090f54ee0
SSDeep	6:lovhOk9NA7XPYhxDvove2WQ27HweTWWFyekx:lovFiXgDDwG2Z27HVFw
ImpHash	-

C:\588bce7c90097ed212\UiInfo.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\UiInfo.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	38.51 KB
MD5	d88c7cfaa1c647b258f4d6734f25e98d
SHA1	c9bf7ed0fe9cb0c9416b1f13160fa2aec83f6aa1
SHA256	5b527a29210a0ffced0d69ff629a7c2e269818054c9d32fca53a04e355dcced1
SSDeep	768:x4NDGPo8xxMpk28JN2q40Ea/a8rv0uPtl23sssSNUbVthDXmS/RDzOoMRL+Sw:o5GaiJQoi8LAQnD/ReT8Sw
ImpHash	-

C:\Logs\Internet Explorer.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Internet Explorer.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	8a16a05ecb06ad62adb92c69e8bde7ad
SHA1	a611ba060ae6ec7b90a18ab4b9375f33a5e6b31e
SHA256	e638538d8ac477cfcaccd47d73386eb855f4e58b2ea4c0d06e244f4f157786ef
SSDeep	1536:pZy20ilU9ebkFz0x2q+u1Cvz/u/hERSR3XG7jSzEMWT6mW3l0:pRFzbkFGlpAMXGaEMWTy3l0
ImpHash	-

C:\Logs\Application.evtx.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Application.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	ca94620c55b770b1254f2d1a3da372cb
SHA1	af5e4e63218bd45c77ddfae047227a67ebfbdccc
SHA256	3ff860a85c8e74673a44fdf34629ff19d8dbb5cfa9fb132af0ae0da3f761991c
SSDeep	1536:rZWkKOZgRALENkDKV9zYynD2tj8HI7ioJtg18QrIp:NW6gREby3nytj8oDTY8ag
ImpHash	-

C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	a6e639cb448f3608afb54cc3fb701614
SHA1	71b3f1bba7f5d36af1848c3c3c9bc57b182de02b
SHA256	410db4defd03a0c68ed61bfc434f23765620d2d2d176d13192ee4d75b4ca6560
SSDeep	1536:relpVAT88VZAZkE/nH6zTaaElNE6wtmagzaSXqlGt:r8vi8HkF/ablNvWjgza0z
ImpHash	-

C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	d84633f900999637fbeeb4771bccd1e6
SHA1	3ab66fbfd62a4a700ef9a4bbd0d90feee049dd78
SHA256	9d70abd44a28e85aa2a8598b44e60283a74e93af70516448356398e3f7be993d
SSDeep	1536:AoAUPKHPs7Xtsx09IshyOezKzbtqkTpkbcH1YoVkxFJtr:A4KPYXtG0R4BmtqwpkAHuzFfr
ImpHash	-

C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	2ee98bff5cf7cbf119e2d9a5f354002b
SHA1	c74c7c197ad13fa22d33b8e67f5108df24db8425
SHA256	5d75d2bce99ebe0d525427b3793c3070985cebe4812b8f36e5b0bdfbe0e616df
SSDeep	1536:QRXysWvcH+HPUSacChtLTyEjetl9qLnQTs1LdlCf5beu:QyvceHPhEjetl9qLywu
ImpHash	-

C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	e05592b18acc5d2cd5bc250d96a39d32
SHA1	41624ab27931424d1cfc26aa14476921f7036a10
SHA256	1aa05b0415b8747be0f15a30e7f8b64b6d89785d98e0cfe82c1a593fc1ca9be4
SSDeep	1536:5l02OinE1i6sapGhcUEpWPdzGQuVqBpQxYniDB4fWrL8485YP4j:T+NA6syGhcUEpWVr4qWYniV4f8L84Vy
ImpHash	-

C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	37225264db9b7b832819e7c7b11f7382
SHA1	a55dafb69de17409c7160b6ae012e556ff3126b1
SHA256	92a5179a75eb0beb7f69985d5145684d424f5f228a119ff49106c13a27c1f057
SSDeep	1536:8CMNgp0t/IGVsNTOQY4sddN78hCNN5YhUOKxIQfBMdLyA1Vih/x:AnBiywhC3aAfBMdeA1VihZ
ImpHash	-

C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	10e2fdbd4256d751a10f4f4c114cfd09
SHA1	e350437c7af5149960eb34e0377f5acc89d2774e
SHA256	91519e57383939a278d6448129652d78b699edd7118d21cb20395c4e2a1607c2
SSDeep	1536:w4+f3gJ5BPoILhaFcwH1BrvbvTOsmg92bthNIxI14CpjB:wbQJnPoILXwVxjTOrgUbtaIh
ImpHash	-

C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	3455697460ec7df217be4df580fa4b57
SHA1	6d253fb273f9a761eee1106e6acc0acdbcf0e1b4
SHA256	316f91a4fc1cb370c3214b81e023f95ab1b8e697c9ea3bdc4d0b8327a5ce09b0
SSDeep	1536:+rXvuWfsRnpr/1HrraikW9cbqnRmVtiPjoeEYKdhhNyiG:EfuWfsRnV/1HrtI6cVti7XEhhNY
ImpHash	-

C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	7b197ab56a16a00b698abd77b35566ca
SHA1	e4c15f9d74d070f39e9ce4942f40d41b0d6463d4
SHA256	bf1a3635f7658e1f5018d456d55d14edd07439251abad2f3ba86abb87662998b
SSDeep	1536:S6oIOiEhKg6w7EnQgoJUZ09GtX1hk4tmSSOnFj4SgBvl7uOwwx7+Ay6F:SCa5/ehoJUu9glh1f1F8tBR/p06F
ImpHash	-

C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	69eba9bc3ffe090dd379d4d17440e7e3
SHA1	fdfc40bfe9238779fcd942fea14ca7a5b9144403
SHA256	573c7a20f1fd3f46f212e8cc59dc4b60da31842f74b4c0a496a5356573658803
SSDeep	1536:SRkAfduY+8zNYGC4jXBR8BtRysYbn7FGVS0pokErcRkmnBm:Mk2+8xYYFCtRi7XYoDrcRPBm
ImpHash	-

C:\Logs\Microsoft-Windows-International%4Operational.evtx.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-International%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	4fb781be3f3fefa76b6cda21ef94c917
SHA1	eb080952876823c0707c9916c844d948c40ba803
SHA256	97c188baff53b568c8e233ecba581378352ff88d5330e97f598d845053d840c3
SSDeep	1536:squJ0ay5gWMrK2U6CDrEPFfKpf+LMFUr1AR3PMHycl:sqhgWMrY/hMaR3kHBl
ImpHash	-

C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	360a7d3e337eb85ce8727d7e9fec61f9
SHA1	7757fe0aa8aac7e8ca085dbada7d3d5b42b720ca
SHA256	6d09c97f502dd83b7c29c750dadd6636ea5ced709be7594bd76d09b8e99ffd8f
SSDeep	1536:l0aqqMYivZbhkZrYKXDqAzyAf73fsWIWuBWpnFopLIbLiPwfSgBj03/SYcM:UqMRvZbyFYKryAf7EBgYp0KSLgPSy
ImpHash	-

C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	08e359eb928602040e32e42dd8028c73
SHA1	f78fff9eb52012003acbc6a2a7e59803dfe80bd3
SHA256	67b88871ee8a243d5c8562cb8834ec33b82ea3ec427eb963f8ab928626d4756f
SSDeep	1536:q+85giDBIop7N9hMmf4CrfM987O0hpKLh+7Seuu74BQFpEjZ2:rH4ZMMfM9KO0hpKs7SeuoFpEjZ2
ImpHash	-

C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx (Modified File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	9cf9fee17dbb0e17693767f275e1a5f2
SHA1	b6ec6699c73a30276e75dcbabc7bef00e44b62af
SHA256	6dea007cbf8fbbd1194b1c0233248ac7e865736de31c954bbe264511bbd95d01
SSDeep	24576:uUzB72S/Gf54pVYx1YRQ6fJXxH421TD33p4u/MiWQi9:Tz5rU6YERLX9R1f3uQMiWb9
ImpHash	-

C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	a8a53df158328398fb83e029bc3d43fe
SHA1	2d44ca35c13bf98b7ff06ffac6aa917b9a062473
SHA256	743d1c34e6bf2d0cd31daf370fcd468e9ebc7193549f5c50173d5db64abe9d1c
SSDeep	1536:5sd34x7t/PrS3lMA3wRgjRdRnilzht6XGNQw:c3IBnc3SgjFnAkXGNn
ImpHash	-

C:\Logs\Microsoft-Windows-MUI%4Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	aa010aed365683738ffa02169c537195
SHA1	11d48b85c8db090c2e99c16b9985413068968543
SHA256	ec366907c6ffa0a162abed3ede92122faa144b276170b94e9cba9cf6be2e590e
SSDeep	1536:O5jjbYiD7T7OsmGMlXuG69SXol7wQiXZ265Xo:mLdTJmGMlE9TwBXAP
ImpHash	-

C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	8a83c007f14dc11a28a397c5020cfb1b
SHA1	49e1e8c043328218a1115bdc12f2113c1ec398c8
SHA256	a4c3aa36de74f27909cfd496df520e5f0600850d89d2c4f9214903d6c0f7ab92
SSDeep	1536:sRvqNc73kfyd8hFKMwTzuXHzvz+BpqQ6OhNHY1k/hDbXj:sENJfjPBSaX2fqQYqZbXj
ImpHash	-

C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	45e85ea16f042e10ff08c2ce8529ad5f
SHA1	0e7ffcab8bebd6c5def5a183e6a1911001503d47
SHA256	b857f9e3778de2f1c410d0e2f311ffed2afc9b2e8457b6e8007904760aa33d36
SSDeep	1536:WXKltldCjntZOtZ9rOCLgIhiIRCUk70X/S4NNyvHN:EKlDEjXcZlOCLgIhiIRraY/tEt
ImpHash	-

C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	69980c1728fc1b028fe7fdc759167ea2
SHA1	d1625976901fff7c7fec9418ea2bebc7eb656b7b
SHA256	81ad0328164a1d94543d5444245ade07127da7585fb7962515071b0bf2209c65
SSDeep	1536:Afs/ZMvc+kx2j/IUNfZdYS4DDmVlOGS7M3IvdSAYwAmzIG7mjo/eyXX5W:AE/ZMvE7UNfZqbD6VlOm3msHgyjo/emg
ImpHash	-

C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	a024e5513c11d0bbdaac06e85a9eb349
SHA1	528216424153fcb4c4ba06e04cf28b898f8db0de
SHA256	363e31abf40a5a60aafc9bd1de50bf316708554b21a01eac5cee346a4b8c9337
SSDeep	1536:htdJy2DIoPJ9xtJsthszeQC0O1vhpzI9XJxleWYwPJlZDH:rdJH7xETszN8hcTQDSp
ImpHash	-

C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	447b0f259b3fd105cdc2fb5820c6d737
SHA1	04b43970ccda128b5e28aa9039e4a26d2c1e5646
SHA256	438b71ea475fa63facf14ab41564e295f2d8c64eac9e2bc8ceaa2c2d1f692480
SSDeep	1536:XMMFsqaP7r2KYUI62NXRPbux7IgLzw+8XPA6:15aPfT8D6v/w+8XPz
ImpHash	-

C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx (Modified File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	d3858a0d6e945d3e2d738fe5bb73f5e4
SHA1	59531290b96425722e9200ceb822232eb4aef296
SHA256	22f1e63a0b8977be5a8ebe67922ac76f94078df44def741330d7569b0d45af72
SSDeep	24576:Esr8BfNVbJXjxkpeykgbMd4LUY2qzDiWElU+j9HN5cfc+MWY:fr8BlPGZW4LUMTED9c0dWY
ImpHash	-

C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	68.52 KB
MD5	74fcbdd152726251233cc93955fb1ca8
SHA1	9729c980cb78a1c6de3c104a13ec2188a377528a
SHA256	d84cdbd4a188158b69f47ad26d4062d4b83979bc947c864ad35f8b523e12ea9e
SSDeep	1536:yDAtn2BjxRZ0hoN/1IsQPNvzVlSdBhc7b4kzaaXZJ9:jt25xRZ/d1NQlKdBh88MZJ9
ImpHash	-

C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx (Modified File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	4bbc1e84bc044201998c9e6fe309c307
SHA1	0a39070142b1a3f03bfbeb9f8dbc9dff29178bd5
SHA256	06893236034cf3ed6681de54b8928f4dcb43c4f18736a5a1f87d09113412480f
SSDeep	24576:09EBRIXlbrEqwX0x++9PPeE4xjLDKSBVh5Qua/++sd6:WSImqwX0xX93r4dKSBVy/vo6
ImpHash	-

C:\Program Files\desktop.ini

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\desktop.ini.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	708 Bytes
MD5	afceb9d0dfdf8402d07c419750764cc1
SHA1	6726156e5a15af07955bab4d6306b03dc27e5fe1
SHA256	34bfd5553371dfe8c065ef2cfaba657e0042bdc9989ad824264f74278fafb32e
SSDeep	12:EUCU2OZJ/6S+HoeAONafehOyiQIjmzEkY1i07EdsQG2jlnQOwaql/mymyuCyg15h:EnUN6SI/LafehPAmzrY1bSse4mymymKT
ImpHash	-

C:\$GetCurrent\SafeOS\SetupComplete.cmd.AWSAK

Dropped File

Batch

Not Queried

»

Also Known As	C:\$GetCurrent\SafeOS\SetupComplete.cmd (Modified File)
Mime Type	application/x-bat
File Size	841 Bytes
MD5	c6b65a51a3cbc2a2a0af1d8b5cc35f41
SHA1	b4df7d7c096bc6cad1527f2f0f1ec445905505c8
SHA256	0a05be76f8082d75e37ddfc53860b7b65deba6c9cd9ced59aaf4cd7b47c70a39
SSDeep	12:6/hqu7QYidvVsWNTFJZ1Y497gSCMzsQFCLu+JYxHanuCzksL4+v9bWm/oBEvSwMI:JMQdvFNTF7L9oyXFTvLsLZ/oBGqlri/P
ImpHash	-

C:\588bce7c90097ed212\1029\LocalizedData.xml.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1029\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	79.59 KB
MD5	773eb826f59685decbe58b1cb4cef643
SHA1	d51433fa4cfedef00b38f22d8eb735b7d7ec723f
SHA256	5f1090ccbc71994516b8ace14dc9a9c7394388f0033d7ce83cc286d0c7b50e94
SSDeep	1536:8KRPJozngzksu8snP4kIaMPbMta1xBLds0n9nsaWSLVQpFacc9ESGDhnP:TN+znCk9HgkR8ca1xBqo9slSguTG1P
ImpHash	-

C:\588bce7c90097ed212\1028\LocalizedData.xml.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1028\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	59.91 KB
MD5	f2b438ad6151cd3ca01177b3fd6fc29f
SHA1	daa8f033b89b3b55c225a341e95459f54a6a672d
SHA256	9695d19239f5bf4054b0c9f48c22f9fe158833fce861b8bffb0486fe4359c1ec
SSDeep	1536:2HRId5fYSSCQX3xYZfRsngTzPfPYqh3ktcYbl:2HRIUHGJsng/flqcYbl
ImpHash	-

C:\588bce7c90097ed212\1029\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1029\eula.rtf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	4.16 KB
MD5	ca6774e4b43a2ba527fa7bb94092ff37
SHA1	b54e10d0cfaf93a4d3bbb94c688a324b3470793e
SHA256	ed5bff0889975394505f656c2e8c1cf8e156c974023d0aac614b7479c71ae165
SSDeep	96:3pvi4dfgRcOw3WOjqsjR7WX5qXcqQ+s0O6XtRkvTVz:xndUg3WOjmpqMqQ+sP6QbVz
ImpHash	-

C:\588bce7c90097ed212\1030\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1030\eula.rtf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	3.76 KB
MD5	30391118e9ec09e888f315aacdafb5b2
SHA1	ebadd5aa82f2b8763c5952c814868432cc92ee98
SHA256	f0eb76df29ab008a4305e40be74ad942961600a7e2ac64d53e7b9de5e24b0353
SSDeep	96:8mDvwjyBdPFuSBlY4l3jMkcQQq9uXgLZFSLpurxTz0VQ4neUI:5DWyBdPFPpc2ICTSBet
ImpHash	-

C:\588bce7c90097ed212\1033\eula.rtf.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1033\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	3.63 KB
MD5	99133ed94f0e7838c184db59ce9a3edd
SHA1	75f5416b386cc92668b25c07acfc497fd9b8dc84
SHA256	32ed59f730fc2025f39535b4f8b4b46782553c2207cae9ed69d222b26d1a0f9f
SSDeep	96:GiG8MdSEZypPAX63K7zY63QPqEq71H7kTch8gQ0etbd9/XWyN45VLV:G6qS0OB3UY63XEAH7kD0etbdxX3yjLV
ImpHash	-

C:\588bce7c90097ed212\1033\LocalizedData.xml.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1033\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	75.94 KB
MD5	f85d5c2bfb50f0c0da7ee17ae382dbda
SHA1	eada53cd77b06d3ea23572a680d8837828f39fec
SHA256	64a5c1d06abfb5746f0a62e840324f704261b3a6270960eec6e7562dcbbf5c4d
SSDeep	1536:YTXWh5/fhxbG9MRE06+mfJvxrlMxhz86p8iz60F1gUJL5rcQOnJldf:YTXW/p01RZZM3zP8iFFCi1oQe
ImpHash	-

C:\588bce7c90097ed212\1032\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1032\LocalizedData.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	84.78 KB
MD5	8e4a695e8c27b4627bf36d42bab6aae7
SHA1	803ff6be52c73c2d56c2750ac27161baf6a76386
SHA256	603aab3af282f2c957274d43921b06e98af3269ff15b4b633b314edae2ee7918
SSDeep	1536:YAfQG7Qwp/ZgPWpnWeqHyAJ0PS2BfJzaGDmG9h3I478tJwookwnb0x9m5:BIwFwOpnWeqpJ07Bd7DJ3I478UomnbIw
ImpHash	-

C:\588bce7c90097ed212\1037\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1037\eula.rtf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	7.21 KB
MD5	98dda1232428abba50a40a7ab4113c8d
SHA1	3f6a3060026c4db2962b41dee552f412155622a5
SHA256	d1301bd3ee2430f821319d9a643fded8453473d11441d48dcd6cf092d0aace22
SSDeep	192:VkRjWzSLgV09qPZOsor+LhHyxiOMWbZRZVGOwz20:VkR9qP/or+lHyxi9GZp7wl
ImpHash	-

C:\588bce7c90097ed212\1038\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1038\LocalizedData.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	84.94 KB
MD5	32aac134e78911c176ebe81b80150660
SHA1	e19bbac3e1cfeb3ed12f60556ba82bd1be99530c
SHA256	b9555cd07c2c9cf2bc9fb61c9bd5a0da1cd3a57f2cf37d6316f0530f5f2eb6dd
SSDeep	1536:Zokeps0+gNBdiZEAqZ5g9fn7jU6hBg93Kj7ZX+SD21PDlDunTBZUjfKo24gZcOT:ikepvFRZ257ggYU7ZX+TbyBZatgKOT
ImpHash	-

C:\588bce7c90097ed212\1041\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1041\eula.rtf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	10.41 KB
MD5	0996e6a00d938c6a2d4a5eb7b4e93c2b
SHA1	0e5b998b37136efb16c6081310f699a948347d26
SHA256	00593252d958a4589b3e7c7dfa4076303a64200b53ee129be695659fc0a79e68
SSDeep	192:GO1L5ufjsSUCNg2O4cIZeVPIufk6EdOfX0cdTazzg7Piaqjo8IGS:H5gNg2OZFPfdEEvmv8B8I5
ImpHash	-

C:\588bce7c90097ed212\1042\LocalizedData.xml.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1042\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	64.23 KB
MD5	a5994402d885ea25a2dabf7d36ecaeac
SHA1	2dd54e3320fafcd14852b9e9611c03b88078582d
SHA256	e9669c34448d8e7179e02f907c53e4634025dd1ae8537c492fb994f0026eedc3
SSDeep	1536:zfm6MqhSuCVXlwcgstNErmRWuTytGFkxm1ho/F:zfmXq7C1lwKnErmRJFkxm1Y
ImpHash	-

C:\588bce7c90097ed212\1046\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1046\LocalizedData.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	79.37 KB
MD5	bc1276f55a15c40b726435daf9ed4f22
SHA1	4b86da64d4baa49788ea4ae32213db2584fe1050
SHA256	66bb8fef5da3d3b50e1610b258a0e46d9e63a93c95c98ffdf661d06906ac0929
SSDeep	1536:ezeG0bJ3RyVsMCIJM8b6dvg73NysQxk9oKKbovPyveW9UbEYnrfGHQKdrfe:MuJByTrWNg5H9oKKbovWeTFs1e
ImpHash	-

C:\588bce7c90097ed212\1045\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1045\LocalizedData.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	80.96 KB
MD5	032d2e7cc74327784f3ff471f0a471bb
SHA1	01d61bac6ea06e632bc3f058432acb3b4454d1b0
SHA256	9cbcd18d1a070ec85d3c26b7cd74dec74f25cfda07c8ac2d9df429aed0578c9a
SSDeep	1536:3hvOikeO0zKVzps2+605vf2fA4NaBre2YM52wUiHD/PO:33+0eIJ5X2Y4NaBre2l54iju
ImpHash	-

C:\588bce7c90097ed212\1049\LocalizedData.xml.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1049\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	80.09 KB
MD5	f044946dbe04931c1bac39ce0599194f
SHA1	c36f17638d17cc31e280e7a5286a2ff849dc16aa
SHA256	d09a65de1598a40dfaf5976e7cfc852f7b2889a5665f79ddc02a6ec6884006be
SSDeep	1536:3uFzlWAujdOff0mqKplAIg7gfTyg38ILfB9s5AEiYNaDh+QvPatV:3oRWAX0mqKpqIg7gfn3lLfmAE1a1vitV
ImpHash	-

C:\588bce7c90097ed212\1055\eula.rtf.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1055\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	4.29 KB
MD5	03ba732765772bac14bd2fe63fa0b5af
SHA1	33bd8da527605d613bb447e276fbd3d9f46f00c6
SHA256	21cdb61e7dd6daf339fedd5d15c6407f8dec2e08d93ed1eb59aa4c34536fe7ba
SSDeep	96:dmtIHPK3V9FHmvPyGkahHTQ277si27k0uaWiQcyJKGB020YMiwZ3t:BQFHmvnk277d2gHaWBc1EV6d
ImpHash	-

C:\588bce7c90097ed212\1055\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1055\LocalizedData.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	75.54 KB
MD5	c5be86008f748bf41360ac6e4895ca75
SHA1	fbde9c0b90feac51ffec42bd7bf1df57651ab0d4
SHA256	1151316d73c0f4c2a1166e2f6d312678cc8669475f565e8f3c9b7c0410a69eb0
SSDeep	1536:MSA8/JiBmIVgZj/obhifke5cMfgsp+0bS5GMR25kDfaC7vGKe9rS2L:MSAaiAIVM/obhifPcWDbgFqkbvGBrp
ImpHash	-

C:\588bce7c90097ed212\2070\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\2070\eula.rtf.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	4.44 KB
MD5	a19a90f16ff0ca390498cdc0a2a361aa
SHA1	49beca4b674859df6dea4fa86c4b7cf84879a70f
SHA256	a3670aab5fdea4fd780c858dc94a7200919f9d1a438d2203662c99c91b2f1215
SSDeep	96:iFs1CRAFIK4c1GDknu260Dc1kIRYOl6gmRWt/t2Rojn3XJy9:D19C2hU7Ytbyt2RG35S
ImpHash	-

C:\588bce7c90097ed212\3076\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\3076\LocalizedData.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	59.91 KB
MD5	59ba130d770c815d3dd1b1a927217e67
SHA1	f7c467bfb9f8052984601c1abc7b4dafbdf3afd2
SHA256	f47df5d38f11219d7fc6120a3629f4179ce947231f8eced8fc5474300f423195
SSDeep	1536:jGy4hIl5Z51DRmz3syyQrN7bkErvsagDUfKgW:jEOj7k3tx7bkZagB
ImpHash	-

C:\588bce7c90097ed212\Graphics\Rotate2.ico.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate2.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.39 KB
MD5	3442120e94a359e646d968073e2b56d2
SHA1	51a8af659b9e5170fcfb5fdf0dc5b32e4af9df8b
SHA256	d5ea9a5118d78333d672eb92561632203d39f30a031791ab2c0033d695f550dc
SSDeep	24:QI2Nz5X3H/R63B3/p2BZfMxmXqnKyzXAdIkqaoXyPP6NJG8af6HawM+rPKTEl5lj:d2NRR6BITpewdtn6i8O6HNtLKoos
ImpHash	-

C:\588bce7c90097ed212\Graphics\Rotate3.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate3.ico.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	1.39 KB
MD5	168212540bed6899f3b546ada4574bdd
SHA1	4df8eeca320f1aac12b916724c2e77db28d234cd
SHA256	2ed0de5e061ff6f825760af45da37cd2e11a5cb9fb28461b65723dcba8c18da9
SSDeep	24:uLNv65xdXtoRrJ2k0PXnhbk8ks8Jyulvx9DDeWea+CdrbJ2K5GMduIxtJYE7kiMd:uLN6x9DhQp9lvjuWeaPdxo7YZdm
ImpHash	-

C:\588bce7c90097ed212\Graphics\Rotate7.ico.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate7.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.39 KB
MD5	9c4d8341c8008fcf63c91787ccce8c72
SHA1	5093eb1b71e048914bbed89e1877e3b74d244053
SHA256	456865e183257067d67351599fd11003a3394912ac42719087b6bb09f2916001
SSDeep	24:09UiftWm/DvbjrP+5yBQ7LR3fxZQS+gu8H0/QvOs8khmML/rCu1+W+H6cFS:2fEk/jrGht3vB+H8H0/6Os8khNuG+WcM
ImpHash	-

C:\588bce7c90097ed212\Graphics\stop.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\stop.ico.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	10.42 KB
MD5	39d1ca51a4ec121186f96723d2487fb4
SHA1	58979fae9474999643c4e20c74107bc26b5831a3
SHA256	adf367f3d1c67b7f1d30531b4b76419d0dd5445a3b878078fdd2a5d8e10f90d5
SSDeep	192:44WBiIRk+6pXLHO17IwSCvgIHCzu5tzqZuJ5w+l539qT3CMrDsEPq6T:44X+6pjOqwSCYVzczqAJ5wk323Phy4
ImpHash	-

C:\588bce7c90097ed212\Graphics\SysReqMet.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\SysReqMet.ico.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	1.64 KB
MD5	95a8b49ff8653a592cef2abd93110c9e
SHA1	7175effc66d3e877950220648a2ee026c18cf5a6
SHA256	237b248af18f82add6201c6e423e8b197c753b3e85649e8ce606c33fe9eda517
SSDeep	24:zRNTVlAlE03qnxhVv58VdG3Z3iaM+CPugaFsal+QsIL1vAv5RmOu5y0GZ:lNxl0ES0Pj8I3ieEugaF3LdAvOO9Z
ImpHash	-

C:\Program Files\Microsoft Office\FileSystemMetadata.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	815 Bytes
MD5	ea633dee0dc07593067737653752bf12
SHA1	ff742bed6971e8519f44d7b4f2fe406a362b78cb
SHA256	4f98fc3a72746d7ee1efa8293abc69c7285187e8fbb6bca667f7a6bceaec1297
SSDeep	24:5SHr4xmdufKeD00nNQxwnlwm+7L6dtnYF7xaOcX:50r4xmduCeXQqh+Sdtnot9cX
ImpHash	-

C:\Program Files\Mozilla Firefox\Accessible.tlb.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Program Files\Mozilla Firefox\Accessible.tlb (Modified File)
Mime Type	application/octet-stream
File Size	3.46 KB
MD5	0e13ed224da30525bbdfbfa0b6417e53
SHA1	58964c92947a8a71f3b01bbbb57e154c10e2a2f9
SHA256	cf65f68babd31023d2ab4b4f57b1636c3dc3bd3c9d1cb95be3bb90c5f6a40248
SSDeep	96:+L4EyNr27zS323E9B2rLugDtVTClsjrOSmnEzVwCWrSt:+cNrpsE9BEVP33mnEzVv8St
ImpHash	-

C:\Program Files\Mozilla Firefox\freebl3.chk.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Program Files\Mozilla Firefox\freebl3.chk (Modified File)
Mime Type	application/octet-stream
File Size	1.40 KB
MD5	4fd4cb3336f77ff9dc6c4bbf7ad2a9cf
SHA1	865ef8eb41d5302a6e3da8931ba8a1986a3c2ba1
SHA256	4c0e147fd57b79dae02907886388a953f754f1c7379f2124261e592251d34c4a
SSDeep	24:rjKg6p5gtKlXcOJ0QkUF9QWKX4s965mHJqcEXp6Kl5XVYqb3YcXbc7AccWOygVut:rjKg6ItKlcmv9QW048FJHMp6UyqkSbcR
ImpHash	-

C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml (Modified File)
Mime Type	application/octet-stream
File Size	878 Bytes
MD5	07a2360902f60d2d6e41f9eade806a67
SHA1	64df6c47526d260a6c09555978dfead392beeafc
SHA256	c28560bbaeb2390a839e3052c9ee3e90135d7f89c6b844339964adcb580ce67e
SSDeep	24:m56jvUaB0skTjU2xmVvRCKvRF3uiJIerZTq22Z:A6jMskTjPoRFegrZTqX
ImpHash	-

C:\Program Files\Mozilla Firefox\softokn3.chk.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Program Files\Mozilla Firefox\softokn3.chk (Modified File)
Mime Type	application/octet-stream
File Size	1.40 KB
MD5	0d96197e969cf4f89a5ae5ce8ea2e396
SHA1	03c26b1e23c02eed75ee9eeeb101b18219a99848
SHA256	8e70989b873cc6c00bb13e51a1c9bb871aaf16b8cdf3d83f922207bcb999dbc5
SSDeep	24:05OZOpvoq5ArSrrbw6pFLjFk0QWP0voB7U/oQWv1LIrM/tb2MSziUD9JZPZgGJHK:05O8vX5lbw6jZUqQ/o5RIYpSzLDxZgG8
ImpHash	-

C:\Program Files\Mozilla Firefox\update-settings.ini

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Mozilla Firefox\update-settings.ini.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	666 Bytes
MD5	690a69001bf4a23a85783d5af3d7f437
SHA1	d871938704abea42b4c5ea99afb808ae4762a3ce
SHA256	b16708bd3339c0c8c02fbfc26be2e0e9d465af882e8b7a3cec974f68cde12e93
SSDeep	12:XBTiOGdmId44eTjDl5J8MDBBS4L7fTj+vV3yZTm2uI+WH:cbkGcfl5JnB04L7fyum2u4
ImpHash	-

C:\Program Files\Microsoft Office\AppXManifest.xml.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\AppXManifest.xml (Modified File)
Mime Type	application/octet-stream
File Size	5.67 MB
MD5	22e2e0abf7d05747713ab29fb5a55fe5
SHA1	bea6b00ebb7f4732c09923d049de46dfe32dac17
SHA256	cbebf6522cd9e1dc10e447c9946fdc16a861a685db718221af6dfeedd6c5ca23
SSDeep	98304:XnhSyqZM6N1rRgg/L4gRjyk08cdxhY/ORmcGgc:XnAyqG6HncgR2Si2ORsgc
ImpHash	-

C:\Program Files\UNP\Task.xml.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Program Files\UNP\Task.xml (Modified File)
Mime Type	application/octet-stream
File Size	3.65 KB
MD5	bf34dee348dee7f6db7c5781b708f6ad
SHA1	dd602d3e9404856dad5f8ac3288e4f52c004c96a
SHA256	54ba8fbef88fbc349d451459a8c32beec21058dbcb03dc43d97d7e0ad774aa34
SSDeep	96:y9LvJQDO9iZJeUktW6fmy7sB/9XN7q59zplsCeCeowgfDv+:yfQTJe5tlfL7sB/99mzpGfCeox7v+
ImpHash	-

C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini (Modified File)
Mime Type	application/octet-stream
File Size	1.74 KB
MD5	1dd8beff44d1e51549c24a8557841fe5
SHA1	c091dbc345831b80b0bff28995d3154d5d7ea0b6
SHA256	2a9276d509cfbcc7cbc964f45d0ff2431fb6cf78006172330f02803bbb189a77
SSDeep	48:3XW8tgZO0XORt4eX6btj9YPw8fEfjgW/TTmNoLN7EnH2:HW8ar6+KCt6PfCfqdH2
ImpHash	-

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag (Modified File)
Mime Type	application/octet-stream
File Size	1.57 KB
MD5	4b38a7fd7cdad5715aefb02b76197bb4
SHA1	90e138921192fbec9bfc17499bfbc4a5094878bb
SHA256	3c6f4a5c2f053a4e4846c84f321268584ccf0a03a6a7a9bb1e768a34ebd44672
SSDeep	48:oGJu89JTGsWqzQftNh84vsHnmgEjXVDHpd:3V/ThhQftNhxsnm9Vrpd
ImpHash	-

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag (Modified File)
Mime Type	application/octet-stream
File Size	1.50 KB
MD5	748ce7a54b5dda7c7b5a1fd5b6fcd0aa
SHA1	d673d1450bd4cbd30b00819067ce79fc11e0b3ba
SHA256	f5770d226482d4ba1aefd22fd3ea78617e2792bfad6ec82eeca9d4ac7e713093
SSDeep	24:CC7ljXpdNpwScCLf4h8CPAphYEsVYruvauGlb37V7N5U5p0Dl5rR0LAAoixEBa9:CWljbNC44hwsSixG5LV55U0V0LAAoixR
ImpHash	-

C:\Program Files\Mozilla Firefox\omni.ja

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Mozilla Firefox\omni.ja.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	17.59 MB
MD5	45322c8a90f47ec43a98e36e63eaa0bc
SHA1	6f7fca33858cadf5921514cd64ba3b9a462c85cb
SHA256	e8d758064f963c8246ed496304079176cfdd218c01af2e0ebdb37b9cc18e94b2
SSDeep	98304:HEAOcqDFWTAspMPxyDrLcTUQeDyO28jBg9Y+vpvMR8MyJFi0tAvLs3Af1VcCOf2V:avDFWqILhjjsvk8MQiuAjs3SVcCOf2V
ImpHash	-

C:\Users\Default\NTUSER.DAT.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\Default\NTUSER.DAT (Modified File)
Mime Type	application/octet-stream
File Size	256.52 KB
MD5	ccdd72a2dde369aeed7d8844a61eea54
SHA1	1f324c7f4ca411eeabaf4d8f95f8ecf4745f6b55
SHA256	9d5f69d26fef2ee0e9fea3e89985bb18cbaa47af0c740bcbf3ea7c0bcf1117d8
SSDeep	6144:YZ3P6wHeCKIw/meJKuwNtObcMBQldtesjRZx23vhae:cPV+IQKuKtneQldJve
ImpHash	-

C:\Users\Default\NTUSER.DAT.LOG2.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\Default\NTUSER.DAT.LOG2 (Modified File)
Mime Type	application/octet-stream
File Size	20.52 KB
MD5	b3489e824b12feaaa94d5ad39d8d17fe
SHA1	ff84ea55986dcfa0fb491516fab6029e266f5742
SHA256	b337ee99b146028503c358c0ac6e37daa1c29571f8e64fb197312e227f22d466
SSDeep	384:mYTxcMk7XoYFVSeZT/GThIufm/7M+oSNOQBe2OKmaxK/hHqBNm:pVsAeZ7WhIwm9oSFeVKmaxK/EBNm
ImpHash	-

C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.AWSAK (Dropped File)
Mime Type	application/octet-stream
File Size	512.52 KB
MD5	bec04c323982b302a1ee049abd7e3ca3
SHA1	65c6783f78e0af97a66c62e961e7e4621d74f0ed
SHA256	93ed4c2170335297cd228c47e02cb13a070aee125c113557fea8e86041f2b1b0
SSDeep	12288:Zu4CnispgpetBfhglrdEXfXNRK7ETMZfuOF3/QvxgUaXkKCV:Zu4CnJphFXK7ETMZGe3ICUs8V
ImpHash	-

C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms (Modified File)
Mime Type	application/octet-stream
File Size	512.52 KB
MD5	ff6567ee305fbb005623ca956b32d363
SHA1	d1e213102b6901d53878adaf19afc5c07931e205
SHA256	6b99f63cffc3abc46fb39ba3eb58641f1e8316c0c4c46b0222ce3a396cd5daa7
SSDeep	12288:c7P0bYVfR/tBuuQAZO9Mog6emqe/KthoPyU2m8TODLFlTrEM84fBomOY2FqmJ:c7P08VdiZ9Mog6BH/Kt6PyU21TYFNwm2
ImpHash	-

C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.AWSAK

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms (Modified File)
Mime Type	application/octet-stream
File Size	512.52 KB
MD5	5c1c2f0689af7b6c9304aa8b1261ed84
SHA1	4b3ce383104da1136b1c08ffe2e592f4fa28ba7f
SHA256	506d6bd2966d24c90669150a34ca77c9e06fa882f16a0c9c4e5d9528957f387c
SSDeep	12288:6YIGOMf7nuWMHZzpZZ0Yai6ag2rX3RKsBbZQg6:/O47GHZNZZVI5sBtQ
ImpHash	-

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After