672fb249e520

C:\Users\kEecfMwgj\Desktop\672fb249e520f4496e72021f887f8bb86fec5604317d8af3f0800d49aa157be1.exe

Sample File

Binary

»

MIME Type	application/vnd.microsoft.portable-executable
File Size	472.50 KB
MD5	b8018958476178596817f734894ff64c
SHA1	e1cae0d2a320a2756ae1ee5d37bfe803b39853fa
SHA256	672fb249e520f4496e72021f887f8bb86fec5604317d8af3f0800d49aa157be1
SSDeep	12288:nZqE25BWr6q6zNPrSyg8A7YNpQH/vRoV:nZqEGBdqirVxCY4HnRU
ImpHash	d9dc90dd06110fc79f0b74983e7fb09d

File Reputation Information

»

Verdict	malicious

PE Information

»

Image Base	0x400000
Entry Point	0x420e36
Size Of Code	0x52a00
Size Of Initialized Data	0x2f200
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2020-01-21 19:38:09+00:00

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x529e8	0x52a00	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.62
.rdata	0x454000	0x1c13c	0x1c200	0x52e00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.68
.data	0x471000	0xe33c	0x2600	0x6f000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	4.77
.rsrc	0x480000	0x1e0	0x200	0x71600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.7
.reloc	0x481000	0x48a0	0x4a00	0x71800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.6

Imports (4)

»

MPR.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WNetOpenEnumW	-	0x45420c	0x6f714	0x6e514	0x3d
WNetEnumResourceW	-	0x454210	0x6f718	0x6e518	0x1c
WNetCloseEnum	-	0x454214	0x6f71c	0x6e51c	0x10

KERNEL32.dll (122)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GlobalFree	-	0x454020	0x6f528	0x6e328	0x2ba
QueryPerformanceCounter	-	0x454024	0x6f52c	0x6e32c	0x3a7
ReadFile	-	0x454028	0x6f530	0x6e330	0x3c0
GetModuleFileNameA	-	0x45402c	0x6f534	0x6e334	0x213
GetFileSizeEx	-	0x454030	0x6f538	0x6e338	0x1f1
WriteFile	-	0x454034	0x6f53c	0x6e33c	0x525
TerminateProcess	-	0x454038	0x6f540	0x6e340	0x4c0
SetEndOfFile	-	0x45403c	0x6f544	0x6e344	0x453
CreateFileW	-	0x454040	0x6f548	0x6e348	0x8f
lstrcatA	-	0x454044	0x6f54c	0x6e34c	0x53e
OpenProcess	-	0x454048	0x6f550	0x6e350	0x380
GetLogicalDriveStringsW	-	0x45404c	0x6f554	0x6e354	0x208
Sleep	-	0x454050	0x6f558	0x6e358	0x4b2
GlobalAlloc	-	0x454054	0x6f55c	0x6e35c	0x2b3
lstrcpyA	-	0x454058	0x6f560	0x6e360	0x547
CloseHandle	-	0x45405c	0x6f564	0x6e364	0x52
GetWindowsDirectoryA	-	0x454060	0x6f568	0x6e368	0x2ae
SetFilePointerEx	-	0x454064	0x6f56c	0x6e36c	0x467
ExitProcess	-	0x454068	0x6f570	0x6e370	0x119
CreateProcessA	-	0x45406c	0x6f574	0x6e374	0xa4
GetTickCount	-	0x454070	0x6f578	0x6e378	0x293
MoveFileW	-	0x454074	0x6f57c	0x6e37c	0x363
GetDriveTypeW	-	0x454078	0x6f580	0x6e380	0x1d3
GetSystemTimeAsFileTime	-	0x45407c	0x6f584	0x6e384	0x279
GetProcessHeap	-	0x454080	0x6f588	0x6e388	0x24a
FindClose	-	0x454084	0x6f58c	0x6e38c	0x12e
FindNextFileW	-	0x454088	0x6f590	0x6e390	0x145
FindFirstFileW	-	0x45408c	0x6f594	0x6e394	0x139
SetStdHandle	-	0x454090	0x6f598	0x6e398	0x487
WriteConsoleW	-	0x454094	0x6f59c	0x6e39c	0x524
HeapSize	-	0x454098	0x6f5a0	0x6e3a0	0x2d4
GetLastError	-	0x45409c	0x6f5a4	0x6e3a4	0x202
IsDebuggerPresent	-	0x4540a0	0x6f5a8	0x6e3a8	0x300
WideCharToMultiByte	-	0x4540a4	0x6f5ac	0x6e3ac	0x511
EnterCriticalSection	-	0x4540a8	0x6f5b0	0x6e3b0	0xee
LeaveCriticalSection	-	0x4540ac	0x6f5b4	0x6e3b4	0x339
TryEnterCriticalSection	-	0x4540b0	0x6f5b8	0x6e3b8	0x4ce
DeleteCriticalSection	-	0x4540b4	0x6f5bc	0x6e3bc	0xd1
GetCurrentThreadId	-	0x4540b8	0x6f5c0	0x6e3c0	0x1c5
DuplicateHandle	-	0x4540bc	0x6f5c4	0x6e3c4	0xe8
WaitForSingleObjectEx	-	0x4540c0	0x6f5c8	0x6e3c8	0x4fa
GetCurrentProcess	-	0x4540c4	0x6f5cc	0x6e3cc	0x1c0
SwitchToThread	-	0x4540c8	0x6f5d0	0x6e3d0	0x4bc
GetCurrentThread	-	0x4540cc	0x6f5d4	0x6e3d4	0x1c4
SetLastError	-	0x4540d0	0x6f5d8	0x6e3d8	0x473
InitializeCriticalSectionAndSpinCount	-	0x4540d4	0x6f5dc	0x6e3dc	0x2e3
CreateEventW	-	0x4540d8	0x6f5e0	0x6e3e0	0x85
TlsAlloc	-	0x4540dc	0x6f5e4	0x6e3e4	0x4c5
TlsGetValue	-	0x4540e0	0x6f5e8	0x6e3e8	0x4c7
TlsSetValue	-	0x4540e4	0x6f5ec	0x6e3ec	0x4c8
TlsFree	-	0x4540e8	0x6f5f0	0x6e3f0	0x4c6
GetModuleHandleW	-	0x4540ec	0x6f5f4	0x6e3f4	0x218
GetProcAddress	-	0x4540f0	0x6f5f8	0x6e3f8	0x245
EncodePointer	-	0x4540f4	0x6f5fc	0x6e3fc	0xea
DecodePointer	-	0x4540f8	0x6f600	0x6e400	0xca
MultiByteToWideChar	-	0x4540fc	0x6f604	0x6e404	0x367
LCMapStringW	-	0x454100	0x6f608	0x6e408	0x32d
GetLocaleInfoW	-	0x454104	0x6f60c	0x6e40c	0x206
GetStringTypeW	-	0x454108	0x6f610	0x6e410	0x269
GetCPInfo	-	0x45410c	0x6f614	0x6e414	0x172
UnhandledExceptionFilter	-	0x454110	0x6f618	0x6e418	0x4d3
SetUnhandledExceptionFilter	-	0x454114	0x6f61c	0x6e41c	0x4a5
IsProcessorFeaturePresent	-	0x454118	0x6f620	0x6e420	0x304
GetStartupInfoW	-	0x45411c	0x6f624	0x6e424	0x263
GetCurrentProcessId	-	0x454120	0x6f628	0x6e428	0x1c1
InitializeSListHead	-	0x454124	0x6f62c	0x6e42c	0x2e7
CreateTimerQueue	-	0x454128	0x6f630	0x6e430	0xbc
SetEvent	-	0x45412c	0x6f634	0x6e434	0x459
SignalObjectAndWait	-	0x454130	0x6f638	0x6e438	0x4b0
CreateThread	-	0x454134	0x6f63c	0x6e43c	0xb5
SetThreadPriority	-	0x454138	0x6f640	0x6e440	0x499
GetThreadPriority	-	0x45413c	0x6f644	0x6e444	0x28e
GetLogicalProcessorInformation	-	0x454140	0x6f648	0x6e448	0x20a
CreateTimerQueueTimer	-	0x454144	0x6f64c	0x6e44c	0xbd
ChangeTimerQueueTimer	-	0x454148	0x6f650	0x6e450	0x48
DeleteTimerQueueTimer	-	0x45414c	0x6f654	0x6e454	0xda
GetNumaHighestNodeNumber	-	0x454150	0x6f658	0x6e458	0x229
GetProcessAffinityMask	-	0x454154	0x6f65c	0x6e45c	0x246
SetThreadAffinityMask	-	0x454158	0x6f660	0x6e460	0x490
RegisterWaitForSingleObject	-	0x45415c	0x6f664	0x6e464	0x3f5
UnregisterWait	-	0x454160	0x6f668	0x6e468	0x4da
GetThreadTimes	-	0x454164	0x6f66c	0x6e46c	0x291
FreeLibrary	-	0x454168	0x6f670	0x6e470	0x162
FreeLibraryAndExitThread	-	0x45416c	0x6f674	0x6e474	0x163
GetModuleFileNameW	-	0x454170	0x6f678	0x6e478	0x214
GetModuleHandleA	-	0x454174	0x6f67c	0x6e47c	0x215
LoadLibraryExW	-	0x454178	0x6f680	0x6e480	0x33e
GetVersionExW	-	0x45417c	0x6f684	0x6e484	0x2a4
VirtualAlloc	-	0x454180	0x6f688	0x6e488	0x4e9
VirtualProtect	-	0x454184	0x6f68c	0x6e48c	0x4ef
VirtualFree	-	0x454188	0x6f690	0x6e490	0x4ec
ReleaseSemaphore	-	0x45418c	0x6f694	0x6e494	0x3fe
InterlockedPopEntrySList	-	0x454190	0x6f698	0x6e498	0x2f0
InterlockedPushEntrySList	-	0x454194	0x6f69c	0x6e49c	0x2f1
InterlockedFlushSList	-	0x454198	0x6f6a0	0x6e4a0	0x2ee
QueryDepthSList	-	0x45419c	0x6f6a4	0x6e4a4	0x39e
UnregisterWaitEx	-	0x4541a0	0x6f6a8	0x6e4a8	0x4db
LoadLibraryW	-	0x4541a4	0x6f6ac	0x6e4ac	0x33f
RtlUnwind	-	0x4541a8	0x6f6b0	0x6e4b0	0x418
RaiseException	-	0x4541ac	0x6f6b4	0x6e4b4	0x3b1
ExitThread	-	0x4541b0	0x6f6b8	0x6e4b8	0x11a
GetModuleHandleExW	-	0x4541b4	0x6f6bc	0x6e4bc	0x217
GetStdHandle	-	0x4541b8	0x6f6c0	0x6e4c0	0x264
GetACP	-	0x4541bc	0x6f6c4	0x6e4c4	0x168
GetFileType	-	0x4541c0	0x6f6c8	0x6e4c8	0x1f3
FlushFileBuffers	-	0x4541c4	0x6f6cc	0x6e4cc	0x157
GetConsoleCP	-	0x4541c8	0x6f6d0	0x6e4d0	0x19a
GetConsoleMode	-	0x4541cc	0x6f6d4	0x6e4d4	0x1ac
HeapFree	-	0x4541d0	0x6f6d8	0x6e4d8	0x2cf
HeapAlloc	-	0x4541d4	0x6f6dc	0x6e4dc	0x2cb
IsValidLocale	-	0x4541d8	0x6f6e0	0x6e4e0	0x30c
GetUserDefaultLCID	-	0x4541dc	0x6f6e4	0x6e4e4	0x29b
EnumSystemLocalesW	-	0x4541e0	0x6f6e8	0x6e4e8	0x10f
ReadConsoleW	-	0x4541e4	0x6f6ec	0x6e4ec	0x3be
HeapReAlloc	-	0x4541e8	0x6f6f0	0x6e4f0	0x2d2
FindFirstFileExW	-	0x4541ec	0x6f6f4	0x6e4f4	0x134
IsValidCodePage	-	0x4541f0	0x6f6f8	0x6e4f8	0x30a
GetOEMCP	-	0x4541f4	0x6f6fc	0x6e4fc	0x237
GetCommandLineA	-	0x4541f8	0x6f700	0x6e500	0x186
GetCommandLineW	-	0x4541fc	0x6f704	0x6e504	0x187
GetEnvironmentStringsW	-	0x454200	0x6f708	0x6e508	0x1da
FreeEnvironmentStringsW	-	0x454204	0x6f70c	0x6e50c	0x161

USER32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CharLowerW	-	0x45421c	0x6f724	0x6e524	0x2e
GetCursorPos	-	0x454220	0x6f728	0x6e528	0x120

ADVAPI32.dll (7)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CryptAcquireContextW	-	0x454000	0x6f508	0x6e308	0xb1
CloseServiceHandle	-	0x454004	0x6f50c	0x6e30c	0x57
OpenSCManagerW	-	0x454008	0x6f510	0x6e310	0x1f9
ControlService	-	0x45400c	0x6f514	0x6e314	0x5c
OpenServiceW	-	0x454010	0x6f518	0x6e318	0x1fb
QueryServiceStatusEx	-	0x454014	0x6f51c	0x6e31c	0x229
CryptGenRandom	-	0x454018	0x6f520	0x6e320	0xc1

Memory Dumps (2)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Point	YARA	Actions
672fb249e520f4496e72021f887f8bb86fec5604317d8af3f0800d49aa157be1.exe	1	0x00DE0000	0x00E65FFF	Relevant Image		32-bit	0x00E311A9		... Memory Dump Actions Go to Process Download Dump
672fb249e520f4496e72021f887f8bb86fec5604317d8af3f0800d49aa157be1.exe	1	0x00DE0000	0x00E65FFF	Final Dump		32-bit	-		... Memory Dump Actions Go to Process Download Dump

C:\!!FAQ for Decryption!!.txt

Dropped File

Text

»

Also Known As	C:\perflogs\!!FAQ for Decryption!!.txt (Dropped File) C:\perflogs\admin\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\clicktorun\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\ar-sa\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\bg-bg\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\cs-cz\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\da-dk\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\de-de\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\el-gr\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\es-es\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\et-ee\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fi-fi\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fr-fr\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\main\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\numbers\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\web\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\he-il\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\hr-hr\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\hu-hu\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\hwrcustomization\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\it-it\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\ja-jp\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\ko-kr\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\lt-lt\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\lv-lv\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\nb-no\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\nl-nl\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\pl-pl\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\pt-br\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\pt-pt\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\ro-ro\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\ru-ru\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\sk-sk\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\sl-si\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\sr-latn-cs\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\sv-se\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\th-th\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\tr-tr\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\uk-ua\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\zh-cn\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\zh-tw\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\msinfo\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\msinfo\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\officesoftwareprotectionplatform\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\stationery\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\textconv\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\textconv\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\triedit\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\triedit\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\vc\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\vgx\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\services\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\speechengines\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\speechengines\microsoft\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\system\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\system\ado\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\system\ado\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\system\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\system\msadc\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\system\msadc\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\system\ole db\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\system\ole db\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\babyboy\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\babygirl\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\flippage\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\full\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\huecycle\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\layeredtitles\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\memories\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\oldage\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\performance\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\pets\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\push\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\rectangles\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\resizingpanels\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\shatter\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\specialoccasion\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\sports\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\stacking\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\travel\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\videowall\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\dvd maker\shared\dvdstyles\vignette\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\internet explorer\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\internet explorer\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\internet explorer\signup\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\microsoft office 15\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\microsoft office 15\clientx64\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\msbuild\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\msbuild\microsoft\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\msbuild\microsoft\windows workflow foundation\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\msbuild\microsoft\windows workflow foundation\v3.0\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\msbuild\microsoft\windows workflow foundation\v3.5\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\reference assemblies\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\reference assemblies\microsoft\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\reference assemblies\microsoft\framework\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\reference assemblies\microsoft\framework\v3.0\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\reference assemblies\microsoft\framework\v3.0\redistlist\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\reference assemblies\microsoft\framework\v3.5\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\reference assemblies\microsoft\framework\v3.5\redistlist\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\uninstall information\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows defender\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows defender\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows journal\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows journal\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows mail\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows mail\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows media player\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows media player\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows media player\media renderer\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows media player\network sharing\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows media player\skins\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows media player\visualizations\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows nt\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows nt\accessories\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows nt\accessories\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows nt\tabletextservice\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows nt\tabletextservice\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows photo viewer\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows photo viewer\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows portable devices\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\calendar.gadget\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\calendar.gadget\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\calendar.gadget\en-us\css\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\calendar.gadget\en-us\js\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\calendar.gadget\images\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\clock.gadget\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\clock.gadget\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\clock.gadget\en-us\css\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\clock.gadget\en-us\js\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\clock.gadget\images\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\cpu.gadget\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\cpu.gadget\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\cpu.gadget\en-us\css\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\cpu.gadget\en-us\js\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\cpu.gadget\images\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\currency.gadget\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\currency.gadget\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\currency.gadget\en-us\css\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\currency.gadget\en-us\js\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\currency.gadget\images\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\mediacenter.gadget\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\mediacenter.gadget\css\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\mediacenter.gadget\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\mediacenter.gadget\images\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\mediacenter.gadget\js\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\en-us\css\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\en-us\js\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\images\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\rssfeeds.gadget\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\rssfeeds.gadget\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\rssfeeds.gadget\en-us\css\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\rssfeeds.gadget\en-us\js\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\rssfeeds.gadget\images\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\slideshow.gadget\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\slideshow.gadget\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\slideshow.gadget\en-us\css\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\slideshow.gadget\en-us\js\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\slideshow.gadget\images\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\slideshow.gadget\images\in_sidebar\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\slideshow.gadget\images\on_desktop\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\weather.gadget\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\weather.gadget\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\weather.gadget\en-us\css\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\weather.gadget\en-us\js\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\weather.gadget\images\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\weather.gadget\images\120dpi\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\gadgets\weather.gadget\images\144dpi\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windows sidebar\shared gadgets\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windowspowershell\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windowspowershell\configuration\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windowspowershell\configuration\registration\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windowspowershell\configuration\schema\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windowspowershell\modules\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windowspowershell\modules\packagemanagement\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windowspowershell\modules\packagemanagement\1.0.0.1\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windowspowershell\modules\packagemanagement\1.0.0.1\en\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windowspowershell\modules\powershellget\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windowspowershell\modules\powershellget\1.0.0.1\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\windowspowershell\modules\powershellget\1.0.0.1\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files (x86)\!!FAQ for Decryption!!.txt (Dropped File) C:\program files (x86)\common files\!!FAQ for Decryption!!.txt (Dropped File) C:\program files (x86)\common files\designer\!!FAQ for Decryption!!.txt (Dropped File) C:\program files (x86)\common files\microsoft shared\!!FAQ for Decryption!!.txt (Dropped File) C:\program files (x86)\common files\microsoft shared\dao\!!FAQ for Decryption!!.txt (Dropped File) C:\program files (x86)\common files\microsoft shared\ink\!!FAQ for Decryption!!.txt (Dropped File) C:\program files (x86)\common files\microsoft shared\ink\1.0\!!FAQ for Decryption!!.txt (Dropped File) C:\program files (x86)\common files\microsoft shared\ink\1.7\!!FAQ for Decryption!!.txt (Dropped File) C:\program files (x86)\common files\microsoft shared\ink\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files (x86)\common files\microsoft shared\ink\hwrcustomization\!!FAQ for Decryption!!.txt (Dropped File) C:\program files (x86)\common files\microsoft shared\msenv\!!FAQ for Decryption!!.txt (Dropped File)
MIME Type	text/plain
File Size	371 Bytes
MD5	f6840147bf11d66844cc7c0f192e3be3
SHA1	fee4d5326a0e0ddee40623013de905ac86726737
SHA256	36b34162ae4c570c441bfb09c81fe04d23cf752bc7a488de45d16961b7a4ba58
SSDeep	6:8q7GxCSfmYXYF3WAFkJXpgaZLgakVZCFckUCyEB9guLmVMcKHke1HrND4RydpN9:KzeYI4Xgugd66v3VMcze1mipN9
ImpHash	-

File Reputation Information

»

Verdict	malicious
Names	Mal/Generic-S

C:\users\keecfmwgj\appdata\roaming\microsoft\word\startup\!!FAQ for Decryption!!.txt

Dropped File

Unknown

»

MIME Type	-
File Size	-
MD5	-
SHA1	-
SHA256	-
SSDeep	-
ImpHash	-

C:\program files\common files\lcl0t-.gif

Modified File

Stream

»

Also Known As	C:\program files\common files\lcl0t-.gif.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	48.54 KB
MD5	af96be44c3635201bc58310b953ced68
SHA1	d9cece8b533e2340c7cdca33aad7b83a70493c61
SHA256	725215934615864a339da52c471d3a59ec72c57f36a6e389d95326d9cfed07b9
SSDeep	768:TQAsliDKULIyvVs8rmcYukkJ3JnmJEnFyMW167VnG3qDBSCzNSAoFzx6ay6vujrk:T1Jts8rqujJ30ayyG3K4CzNSAeZDujcV
ImpHash	-

C:\program files\common files\microsoft shared\clicktorun\c2rheartbeatconfig.xml

Modified File

Stream

»

Also Known As	C:\program files\common files\microsoft shared\clicktorun\c2rheartbeatconfig.xml.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	5.04 KB
MD5	a58feb9f487f71cf0f1b8a9c3bd78efa
SHA1	6a480c84c29254cd80e814abd48f8fa69481932f
SHA256	fa339e3dda5855c1affb7bc1a0c45f120219ce1d28c09689221b72a094fcc39c
SSDeep	96:7CJRvLfJyBRqwyHX5V3jsfaq89GkfCwHRlUV8K4WDdRpnlr:2JRToxkEapv6IRa8KBDp1
ImpHash	-

C:\program files\common files\microsoft shared\clicktorun\i640.hash

Modified File

Stream

»

Also Known As	C:\program files\common files\microsoft shared\clicktorun\i640.hash.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	1.10 KB
MD5	7dfff6c4361073002ced5c11c832cb89
SHA1	211cbb12936dcf719dc9a16fb72ba79a60268338
SHA256	ab51ba0dbdf5e2505c1bf494981d5348a0ee08d8124d5465e8340e7cd3c0d6d5
SSDeep	12:7lg+7FlMGrhdIsjRXsuCUcN5ZHCEtjrxO3JQhCwD8YU0liQOLLpk9sIKd6:7lb8ehdHtXsrUc7ZH/vhFruLpA9
ImpHash	-

C:\program files\common files\microsoft shared\clicktorun\i641033.hash

Modified File

Stream

»

Also Known As	C:\program files\common files\microsoft shared\clicktorun\i641033.hash.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	1.10 KB
MD5	204738b0c269a39b8a826cbed329f221
SHA1	99a794270472a60faeb2ea866fa33449e14b0052
SHA256	47540f2d77a351813e18d29f3f39c2843d7c6da5eb182d4ea125b4627b0c78c8
SSDeep	12:7lsJlpAlrYVWbK4ZdBoLBEa349EkFcn/rbEbpDgRkeySmvEo8rka:7lsJlp7SfrQ6M43FcDEWzySmslrka
ImpHash	-

C:\program files\common files\microsoft shared\clicktorun\officeupdateschedule.xml

Modified File

Stream

»

Also Known As	C:\program files\common files\microsoft shared\clicktorun\officeupdateschedule.xml.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	5.67 KB
MD5	f78ae31522478fb2d5eeeaec01378e1d
SHA1	bb73cd68a17f2ec5c52fb0602ccf9d01eb332b2a
SHA256	45bc6e00342de41c3470d478c0cd9987128556384c8eb156e5f73bb46dcd75b2
SSDeep	96:71ioXuzPvr+uYGqN8zHSvCXEs4aYbVuvxsgVsZzVXL/mbOyjmPJe+Bc:hubvrJYGHSvIEDpObOfPXc
ImpHash	-

C:\program files\common files\microsoft shared\clicktorun\servicewatcherschedule.xml

Modified File

Stream

»

Also Known As	C:\program files\common files\microsoft shared\clicktorun\servicewatcherschedule.xml.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	5.35 KB
MD5	07c464033c50a0ae0b4fba610766e14e
SHA1	ac925de21d39fec69a61ad3beec27bd0e279d66d
SHA256	6d65b64503fd83244ecfe948a3cfe7c9c1e309bb2441488a7a241a7b2eee954a
SSDeep	96:7d7wZXinhnSFcLHyKeZwsXce7XgAzzRinjMsE/G0i8fAu3EQK6XTjXi:xEVo2CyKeesXcyvYoswG0i8DDK63y
ImpHash	-

C:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppobjs-spp-plugin-manifest-signed.xrm-ms

Modified File

Stream

»

Also Known As	C:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	10.18 KB
MD5	e30ca0e6b6fea763c038ea7b71cc3685
SHA1	1fb43e14e58ce53788a6d4a591a10ced270fa0a4
SHA256	ec00958de5cd5b5124941bd1224e6b6c714d03f7dbe613d2e82a894d5831d3a3
SSDeep	192:8JANSqGwAmoK70qscQOGDQ6SMZUjqFUdc4KPNF3ZQ9hTji6D4:OqPAmoKJFGDLZQ6F3ZQvjv4
ImpHash	-

C:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppwmi.mof

Modified File

Stream

»

Also Known As	C:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppwmi.mof.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	47.95 KB
MD5	d343d52cbab33bb62ace04ca7ff69273
SHA1	68a5c98314c59f28295d75dc012eb8a2769ef5eb
SHA256	0a3ab4af117961c4bc867ee1286ee59b975accbb45f8e494cc06bd15c1c2b509
SSDeep	768:q6O2DaNuKBf3YJMnBg3iWHoxnl73zz8Yg7Kg+RHC+xL:KhjRICnBgHIx1zzi7j+V
ImpHash	-

C:\program files\common files\microsoft shared\stationery\desktop.ini

Modified File

Stream

»

Also Known As	C:\program files\common files\microsoft shared\stationery\desktop.ini.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	1.63 KB
MD5	a40c0765498b2e0a2986668369c83baf
SHA1	41d5ff13b9b17b39a99e58d752044e8a2c0d66eb
SHA256	9cf370a508a1a040c5ed263516e815771f08832f53f62b6bc1ff715e3f06d564
SSDeep	24:7lTuOdIhhetKJYhbvVJUlBIlI9GnDjCl90iXJ36o4WfF07aYoUn2npBCT:7lT9/eYhLVJ7G9G6l2i5/nF0xoUqB+
ImpHash	-

C:\program files\common files\n94j0b1q.jpg

Modified File

Stream

»

Also Known As	C:\program files\common files\n94j0b1q.jpg.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	65.36 KB
MD5	6d6549b3bb6a66941b89ef523d06384d
SHA1	b97302e167322e33017c4e77175fbf5fcf5ba1db
SHA256	421cef89814f9a0eebd26f117bf3a833c00a9e56e424994eaa57c898b3aa4698
SSDeep	1536:zuJC7SeqnG1zXhkE28s4W4lOY/gIzqf7Da:zOeqG1zXp2KlOzlXa
ImpHash	-

C:\program files\common files\uxvb6tnruw.bmp

Modified File

Stream

»

Also Known As	C:\program files\common files\uxvb6tnruw.bmp.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	12.50 KB
MD5	af9b132b0af9608a097522346e158ba2
SHA1	7dbcfa074074704cab0da304eb4e87fd4b638151
SHA256	ccb041fe02bde7248cc037272bf3e912be75f8d5f5b0094fc610961501d9052b
SSDeep	384:jBYSRPkKKBxkiGkyRsYFflOsUZdN2WBcStFDsEbxY0225r/:1YS27ZJvGfEsUZdNfBcmCEVY09j
ImpHash	-

C:\program files\desktop.ini

Modified File

Stream

»

Also Known As	C:\program files\desktop.ini.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	1.17 KB
MD5	b049dd5096b4fc2634cb4e373dbdc644
SHA1	1031a88e581a144076c6f07feb8ad56c190fe775
SHA256	a5525c7ecc0de611a2e72949aad658bf806356231f741672a24d7683a6f3df0d
SSDeep	12:7lMRn+6oURH8rOlqvpZZ0X8tr/6CNQ7QG2GdaO6MYRLAZwNmP55PKhDky6:7lM4bU2LPFeiBRLAZSm55PU/6
ImpHash	-

C:\program files\internet explorer\signup\install.ins

Modified File

Stream

»

Also Known As	C:\program files\internet explorer\signup\install.ins.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	1.45 KB
MD5	9768ec57b68d4ec6198b213729374ff3
SHA1	39114f2cdf617d7e92cbfc2fe399942154193a38
SHA256	bd4ca842a622f7dde309e719e4c714b938755d81d7bdadeaa5f89dce645c1a95
SSDeep	24:7l6TKjX38ATPbzny0xISnTNBN36iLMSUdFRUKa5LO/3FthN8Y:7l6TKwA7NFx736ZTPYO/3VN
ImpHash	-

C:\program files\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets

Modified File

Stream

»

Also Known As	C:\program files\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	5.62 KB
MD5	8b25db86f8bbd28e20b5e3f28e68bc0b
SHA1	b3c785240ff0cec0950ea244a164d8b4b8633ff8
SHA256	85dcc930c6fcfe7b127115ea57e95e4437ce38e226d4f36f4767cfbce1f965f8
SSDeep	96:7zgHxrKjC8dVbfvRIbDBRRwv1IBG9h7+Lgm74dGQfSaROZvXiXKoSSW8oRGMD:gHAb7vRI/KVzmU0mCvXiSC4D
ImpHash	-

C:\program files\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets

Modified File

Stream

»

Also Known As	C:\program files\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	6.06 KB
MD5	22a7b2f83ebfd177b0bb2c1ac838bf32
SHA1	a50fdb9f0aebe8e3449296eac0deca939668fd0f
SHA256	6c560480596281720b28e65e161307f75b286353d91cb2c2f0494dc5a2937bcb
SSDeep	96:7yCKoOra/fPcPG5xewBhaRi9Jb4BztbGamAdjVJTgLGD+qLUJjWMM4ruI9Z:OCKH8H5x8REcBz5GamcpmLYLCHM4ZZ
ImpHash	-

C:\program files\reference assemblies\microsoft\framework\v3.0\redistlist\frameworklist.xml

Modified File

Stream

»

Also Known As	C:\program files\reference assemblies\microsoft\framework\v3.0\redistlist\frameworklist.xml.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	7.96 KB
MD5	f098024dec691d15457b7f408125d4d2
SHA1	247e30f21f7b8d067dde6c9f8929661ac073e83b
SHA256	1b2b29f0080e5a16bf1bdf988fd7ae8b25a1908458c19aa2e6b4c107cf9a6d3e
SSDeep	192:31RnlUoIRXBIcn/38bgQ/1NlfePW5PZDHj:lRnlUofcnPNQ9Nltj
ImpHash	-

C:\program files\reference assemblies\microsoft\framework\v3.0\winfxlist.xml

Modified File

Stream

»

Also Known As	C:\program files\reference assemblies\microsoft\framework\v3.0\winfxlist.xml.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	3.52 KB
MD5	7f987c155c7602899fda87d92ce5ce28
SHA1	a02d5cf0e0db8fb486475c3cf91933a5e4a70c28
SHA256	76909e52a55b4a18fc4ea99032ebc5692c2484dab09d131be1530b5bbb535fee
SSDeep	96:7E5k7du7eKLwT14MHtVo24MxksIyhUqn86tfzv3:AcdtKLw5dtC4xks786tfzf
ImpHash	-

C:\program files\windows sidebar\settings.ini

Modified File

Stream

»

Also Known As	C:\program files\windows sidebar\settings.ini.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	1.08 KB
MD5	8b0762baba5faad0069419891f70bcb3
SHA1	e4b4b997ca433717c366b03de5b85a99bb18d8e1
SHA256	1d3fcb3f39f7af8e6313fd4f051e1fa9c7cb4652e2beb5164198780bd4201dfe
SSDeep	24:7lXRWSedcie7eaEAdk3o5UVVij5IK7wyk0WK:7lXREte7Brdk4+ij9UyeK
ImpHash	-

C:\program files\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.format.ps1xml

Modified File

Stream

»

Also Known As	C:\program files\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.format.ps1xml.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	17.09 KB
MD5	6984d51222d7dd1dd0f57bbe886a85a0
SHA1	2e28bd06c73b6e401fb6b23cc9b2cbb9433b1ea8
SHA256	3d4e0ebb2271f113c9f5ac8bea00383d243be3a99deec487092698a0de6902b6
SSDeep	192:7Bl740/CzbVqETvTURZ9OmlmCw0UKD1I8FOu7/7oScr3kSGCptJU4mj71MZfcg3V:w0cVvTL+vs8PzcKBO0gARWPHkQjxPzZ
ImpHash	-

C:\program files\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.psd1

Modified File

Stream

»

Also Known As	C:\program files\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.psd1.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	3.24 KB
MD5	0d33659c0c09fd3a54b9b6f2816e401b
SHA1	55554b076d442fc067a4e82ad39a431ef4fb4014
SHA256	2db4e7f44507f5f96351a099bb0aa7966d91f509e9d3c4f01c4b230f1dd0d85c
SSDeep	48:7lYtE+niCPPUkNAZ2s1FrZ748avYzZPK9FkYASYeYaAlfKDPPtS7yT:7CtX/PRE3Z7haweqe/+Otb
ImpHash	-

C:\program files\windowspowershell\modules\packagemanagement\1.0.0.1\packageproviderfunctions.psm1

Modified File

Stream

»

Also Known As	C:\program files\windowspowershell\modules\packagemanagement\1.0.0.1\packageproviderfunctions.psm1.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	11.40 KB
MD5	2bba06e5f56e614c520ae5ec40e5e1d3
SHA1	e5fa453815683ed87b846affb489c10a2ba4707c
SHA256	8786dbc313abb52b4c55176e8aff23878cc86cb94abc16e86408d1757626ffb7
SSDeep	192:rjh83cmQb7xFjAaBPuohLLBt1u5TkyZHDc5NoXPQ9H2WAvX:nh8wb7xF/sUBqdkIjsyX49WWA/
ImpHash	-

C:\program files\windowspowershell\modules\powershellget\1.0.0.1\en-us\psget.resource.psd1

Modified File

Stream

»

Also Known As	C:\program files\windowspowershell\modules\powershellget\1.0.0.1\en-us\psget.resource.psd1.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	74.59 KB
MD5	47237bf05668ad26e7c68d1eeff6d5e0
SHA1	c0f75c835fb3e1957702330bbb32eb7580cd27ed
SHA256	7b554cab2b81ccb010510c5a612eb0c2a03bf509cf72ec2658ed2b073c55ac97
SSDeep	1536:S3Xrpu9l1H8QZqTjV4p+vkeXXSxgUrxA/oiikxnvsSVKopDSp617wxd:S3X89bH8m8x+/MXcA/UkxtVJpOps7gd
ImpHash	-

C:\program files\windowspowershell\modules\powershellget\1.0.0.1\powershellget.psd1

Modified File

Stream

»

Also Known As	C:\program files\windowspowershell\modules\powershellget\1.0.0.1\powershellget.psd1.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	5.22 KB
MD5	5daee1cacd889cf27f53d0937744f5dc
SHA1	08d90641f44af4f8e7e16c85064858941401163a
SHA256	1bf8d441261b194ce6b30d814eb4932a9924c542d6a5fb7433c118b1c8d0d915
SSDeep	96:7+vcsJJ/GInGcBCSlcfbgtagS3tbaT9SL8k9jzbyby1X0fKiGR:Uc2/GhcBBlcjdPmT9SgkKykfKiy
ImpHash	-

C:\program files\windowspowershell\modules\powershellget\1.0.0.1\psget.format.ps1xml

Modified File

Stream

»

Also Known As	C:\program files\windowspowershell\modules\powershellget\1.0.0.1\psget.format.ps1xml.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	9.06 KB
MD5	8bf1104289c88d5b29a92d83a39e271f
SHA1	6be05ff51c95e458dfdf85514e6e1a0928f8c4c5
SHA256	18ce9fd1d899b601e6ac09c71851d6e66e14f236695dbe600952bb4e41ad649f
SSDeep	192:s11HDtKcEAnmfMjXGL47HdtAi7tFb6VtslUyobhC0haPYTw:GZPnOgt68BotDCd
ImpHash	-

C:\program files\windowspowershell\modules\powershellget\1.0.0.1\psget.resource.psd1

Modified File

Stream

»

Also Known As	C:\program files\windowspowershell\modules\powershellget\1.0.0.1\psget.resource.psd1.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	78.26 KB
MD5	56ff75b4c53af1a466caf829288fba52
SHA1	c782d7dec30d5e19d576a6d608af56e8d04d8d83
SHA256	c2fc2590e8c890310005877fe068ef60656716345e11d78deae6491463bb4966
SSDeep	1536:Au1VLDzkjK05/TsXqJnx/R1gmeJgL09u/+bhpp8PeiRoLq7qQSEX5y/n:AeEZT/zgmq/9E+tP8Wiyh1EJq
ImpHash	-

C:\program files\windowspowershell\modules\powershellget\1.0.0.1\psmodule.psm1

Modified File

Stream

»

Also Known As	C:\program files\windowspowershell\modules\powershellget\1.0.0.1\psmodule.psm1.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	563.67 KB
MD5	cc47c31ce3906190b8df92d2d262668b
SHA1	1b067e055c2e3287dab59896a04bddf6ce9547db
SHA256	9a82ba8fa54cdeb2a8d4ccd84e83d78d287ccd9175cc8fe10b60706b5457cdef
SSDeep	12288:2yJx2H2GbB/lc1SdxYHpxUFQHDaIZ7rHTLEpTicNr+zC0Pbdru2WRl7:FslB/lc1IwIFQHOa7M1rEPY17
ImpHash	-

C:\program files (x86)\common files\designer\msaddndr.olb

Modified File

Stream

»

Also Known As	C:\program files (x86)\common files\designer\msaddndr.olb.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	16.61 KB
MD5	e943335569a4c36218f8798041f536fb
SHA1	3f883523814b3a01f56ce94742b70cbc500e5401
SHA256	346e0b63c5850b023e0c2524fa5f7f8245cd909b7168040ebe3463c899c850b0
SSDeep	384:kA/vxG5TaSAMfg4VzC5BD0F307JzXBBK+EOk:keU8z4VUBD0F3iTBwck
ImpHash	-

C:\program files (x86)\common files\microsoft shared\office16\office setup controller\pkeyconfig-office.xrm-ms

Modified File

Stream

»

Also Known As	C:\program files (x86)\common files\microsoft shared\office16\office setup controller\pkeyconfig-office.xrm-ms.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	577.68 KB
MD5	17afa4e120274d84fc54c2ffa7bb746f
SHA1	2089971c80e6c88f3ed2058d063200789026f3ed
SHA256	de836d1bcf0b4eff8ece81c514d97178327bc40648536f4fa02cd56f98544431
SSDeep	12288:WIUq9FgyVBeoIm+VvjNa5hMYKAeKWNAIykHJGxPS0QO:WRqXXhINgh1HWqyev
ImpHash	-

C:\program files (x86)\common files\microsoft shared\stationery\desktop.ini

Modified File

Stream

»

Also Known As	C:\program files (x86)\common files\microsoft shared\stationery\desktop.ini.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	1.63 KB
MD5	85ec39e3407c85c8cab553d79a8701a1
SHA1	41cb7a96467db37d763aec3aa9811fb33652812d
SHA256	e1a4f6b07cb66e80c9131d9581d6a1e8bc7873d12d5831350148db3181f63da3
SSDeep	48:7lakN1PwMV+JBBlzwzf6vfF4ZGP2EyD1VUd+FMuD:74krPwMsFzwTEfFUGHyD1SdVW
ImpHash	-

C:\program files (x86)\common files\microsoft shared\vsta\appinfodocument\addins.store

Modified File

Stream

»

Also Known As	C:\program files (x86)\common files\microsoft shared\vsta\appinfodocument\addins.store.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	10.43 KB
MD5	ae201b817d83e025ceaab58987930126
SHA1	1ee4963a7bdfba2d77b1c511e0f6d9a44822bfb9
SHA256	aff8c7535bcde8c4b692e36bc2237d4ed7c89a79ddafb9e1df75dc4a7561269b
SSDeep	192:FmMY+ZjJ1XdKT6JuBh2998Q8yWnxn9i763RF3kfHae5aHieyxx:FxY+Z9nKiAho9/8ymcpfn4iTX
ImpHash	-

C:\program files (x86)\common files\microsoft shared\vsta\pipeline.v10.0\pipelinesegments.store

Modified File

Stream

»

Also Known As	C:\program files (x86)\common files\microsoft shared\vsta\pipeline.v10.0\pipelinesegments.store.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	128.44 KB
MD5	5df0143cadcca43e2e9b343e213fe211
SHA1	1aef763e3d9ab05c4febd7b253dc4ba4645588c0
SHA256	023e8260e5cf0034e47dc9b18a865c325245de4bab7fbcf1839bf90f5c7d45da
SSDeep	3072:Xtozj5Z2UGYRvw3llhSjPj8M3n+5sfJIg0:9ozPGYpIl+jbRV0
ImpHash	-

C:\program files (x86)\common files\microsoft shared\vsta\vstofiles.cat

Modified File

Stream

»

Also Known As	C:\program files (x86)\common files\microsoft shared\vsta\vstofiles.cat.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	89.94 KB
MD5	a11b8900766248658b4249449471ab59
SHA1	dd46f3cbae247ba47386904d79ea68f503128d53
SHA256	36688f3c93ecd0e56da3b3766a784c377e86f8f333ccbb370513366722c6babb
SSDeep	1536:b4FTYSZCnNhfbFMylXNeG2AKSAAQcoXJMWrpiVGq07+BJrylixnxamirvWIWE:0FTvZKvfZnlWABAAQeWrwVGq0KPgygPt
ImpHash	-

C:\program files (x86)\common files\microsoft shared\vsto\actionspane3.xsd

Modified File

Stream

»

Also Known As	C:\program files (x86)\common files\microsoft shared\vsto\actionspane3.xsd.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	1.13 KB
MD5	046fc23a118298eff148c024f31f104a
SHA1	1fdbd0a04e0cb03ad449ff44976bfdc7cc51231d
SHA256	24967d460039578df6937f2a9f60f402cb55adbac04c931dd7280fdd9a621420
SSDeep	24:7lh5fjDH5ALGb0zhrm4cQkoHNqsI+4/jR6:7l7fHHPbPVtKV8R6
ImpHash	-

C:\program files (x86)\common files\microsoft shared\vsto\vstoee100.tlb

Modified File

Stream

»

Also Known As	C:\program files (x86)\common files\microsoft shared\vsto\vstoee100.tlb.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	17.15 KB
MD5	937a22c169212b9a89a9ec4ee70f77af
SHA1	551dee9e330d5e20b7e379b77042780384bd6c82
SHA256	79cdbe99aa18e3539c12c28d92f402c6c834ccea34d215f19f23970627ef00da
SSDeep	384:5oATKLmbgV9WlwtSi0U3kiitvf60Sq1GoGMONw2nWQww3T+Af3:5bKLKC9BtSLUUpZi0Sq1IVnWSaAP
ImpHash	-

C:\program files (x86)\common files\microsoft shared\vsto\vstoee90.tlb

Modified File

Stream

»

Also Known As	C:\program files (x86)\common files\microsoft shared\vsto\vstoee90.tlb.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	22.14 KB
MD5	6b486d4ae8bedf545f9586b1664d003d
SHA1	383ba2afc6b47c99813c4a9c8d62e5f41193c793
SHA256	793e2d0333dc5d5cc30f477058fbf53cf01eeae609dbd7244db61aaf84af44cf
SSDeep	384:SI3HCXiKNt9qI7wVjTheKL9wxqE7UZjn7XF1L4aaUEbTHHNojTzINuArOOtySFDQ:S3yK/wImAZxCZjfL/0HHyjTzAfOOHE
ImpHash	-

C:\program files (x86)\desktop.ini

Modified File

Stream

»

Also Known As	C:\program files (x86)\desktop.ini.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	1.17 KB
MD5	1855f240c9d784c213e5cda9d92c2fd4
SHA1	defb61a0ea7ab87e79b747fb22adedd7d7e16474
SHA256	45c528e0a53b1e9714b5f399dce5bc3db594b0960eb5c58d2acd68518c647e61
SSDeep	24:7l1uBBRvPsemFTce63jBCfwfGuBONbU+M:7lGBlzuTcmwBQbpM
ImpHash	-

C:\program files (x86)\internet explorer\signup\install.ins

Modified File

Stream

»

Also Known As	C:\program files (x86)\internet explorer\signup\install.ins.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	1.45 KB
MD5	5c43f2a228e3aef814dc13324b97245b
SHA1	4d666edc84db431b9db55c21c77e81c5dc90d9ee
SHA256	491de445c2c943fd5fff88dbf997ed78624fd470cd275f3ee7b6e852306fba3a
SSDeep	24:7ly6PFkx2UhqteNF0cRCpQFIFgfylP57uuvh:7lzFaNmckOIFgfy95Kuvh
ImpHash	-

C:\program files (x86)\microsoft.net\redistlist\assemblylist_4_client.xml

Modified File

Stream

»

Also Known As	C:\program files (x86)\microsoft.net\redistlist\assemblylist_4_client.xml.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	16.35 KB
MD5	0f98bad8cf5b47fdd652bba049e436e4
SHA1	615905919a6264bda44e6e65bd9fe62136cb8713
SHA256	5ecff5f9a8628cd14054f6be1f89d1d1eb5a47b194d7c00396ce8df754691b7e
SSDeep	384:IEyybPQGTbziWG5jbW0KE35lmlscK8j6yMBvmsATX:dyioGb9uoE35lmlscdj6yMBusATX
ImpHash	-

C:\program files (x86)\microsoft.net\redistlist\assemblylist_4_extended.xml

Modified File

Stream

»

Also Known As	C:\program files (x86)\microsoft.net\redistlist\assemblylist_4_extended.xml.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	9.03 KB
MD5	4767972a3c3799139c40087b5caf7455
SHA1	33baa8435bae2e44930a0cdd42f8f97569f893f3
SHA256	d259c6b40cce002d6d878280cfc73bf5c97e412671ab6573b3b406d7dc2f2d1d
SSDeep	192:iXw/01iulITMbkgIJP0Jke625p49A0WCTVGhkjQmd:ak01iyITYZUP0XPi9BxGgQmd
ImpHash	-

C:\program files (x86)\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets

Modified File

Stream

»

Also Known As	C:\program files (x86)\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	5.62 KB
MD5	bbcf369422f729842702bf0f5fc5d00c
SHA1	13198a92cd703bd892c59621925d0d2bfc8dd24e
SHA256	401b12bf141485ead1d6aad315ca921c42bdd25294e0b231df356c8e0f1b55c6
SSDeep	96:7V+dTV+SLpwTGOw7MiLPuvQwQdRL+bqb+WDn0ze8KDe6ZR8Nt3xcubI:GQUgfiL2vQw8RL+mbtD0zDKDe6Z6F2
ImpHash	-

C:\program files (x86)\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets

Modified File

Stream

»

Also Known As	C:\program files (x86)\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	6.06 KB
MD5	719ae69058bf4ab2c65f1080bf3f7079
SHA1	d82c3f57e05b8cb6fe10444b10301c135959ae9b
SHA256	75a02539cab0a4c6dd9de69744e5e56bef49a87552b075705fe49866a63ba1cd
SSDeep	96:7WXcM6wLruY2hZ/zBYT6vGJW2BjJkqsA6SLuYqI1ZiOWZaFAd9C64AoBtNVCJ:CXawE/zvvGJW8CqsCLu+1ZiOWgE4nVC
ImpHash	-

C:\program files (x86)\reference assemblies\microsoft\framework\v3.0\redistlist\frameworklist.xml

Modified File

Stream

»

Also Known As	C:\program files (x86)\reference assemblies\microsoft\framework\v3.0\redistlist\frameworklist.xml.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	6.55 KB
MD5	28ed73f25645102207acc5d7eed0d9c7
SHA1	020370602bdc3619c6b47d440902199be89368e4
SHA256	02c8f444c4c148cd276e2c9c40d2557d8b757f55c48fdddd9a5e7ae348d054cf
SSDeep	96:7XRUfCd2LbP6VAChCBfuKFLQcwoGETSGVIOK3CCoStSiWf2ZNcauQauZCPk:ACdkPhJltvDK3kidQQTt
ImpHash	-

C:\program files (x86)\reference assemblies\microsoft\framework\v3.0\winfxlist.xml

Modified File

Stream

»

Also Known As	C:\program files (x86)\reference assemblies\microsoft\framework\v3.0\winfxlist.xml.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	3.52 KB
MD5	7590218c9a5e5b3c5c2c23bc2e0408e2
SHA1	6f0007ef061951ad86a0dcd717074179f903a970
SHA256	786e8497fcc8be68533454b88a811c4a0170cbef516723221a9686c6ec5f4169
SSDeep	96:7upN6IkFqpfKpjx6R6NGhGixR5qYJqVRqaSt:KkkfKpAkohlq7qaSt
ImpHash	-

C:\program files (x86)\windows sidebar\settings.ini

Modified File

Stream

»

Also Known As	C:\program files (x86)\windows sidebar\settings.ini.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	1.08 KB
MD5	4d6a122a2ecf1dd2ab1ca2f7488af265
SHA1	60c1e8c7a7141348afd7d4e14572bab8dc5052cc
SHA256	57134596fc4840d0bfd1896877b07e415003bf2dde32431caf82135e201098ee
SSDeep	12:7lkcbs5cm5rKUsNRZ1I1neM+kuYf7w9AnTqMnIm8F9OqS:7lDl/sJ+kZf74CGMnINF9OqS
ImpHash	-

C:\program files (x86)\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.format.ps1xml

Modified File

Stream

»

Also Known As	C:\program files (x86)\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.format.ps1xml.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	17.09 KB
MD5	470a4fff10d43892b1748719048889cb
SHA1	c7895324ba5e182980a76a082cf3605c9e445a68
SHA256	4f9f9523e6f08f00dcd83c4eb33d6dc3440cd82490056d2649000beff1661f09
SSDeep	384:6DVYWRMi04BM8fRrMX1Ziv0OotjpewHCWiM6J+Ca:6SWRe4Bh2X1gvPotjQLBVJLa
ImpHash	-

C:\program files (x86)\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.psd1

Modified File

Stream

»

Also Known As	C:\program files (x86)\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.psd1.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	3.24 KB
MD5	00eb193bef159b9923e96d0a864bc92a
SHA1	2e59e671ca709ef63d2686013dfca0aec2d91444
SHA256	ce62b4cec6826b2a3f977101f43eaf591602592be6fd320ac72264f8c8ab3c80
SSDeep	96:7kp654vWLYEbHONIi57J38pEpJNjQzGb6g:oQmWLvbHgJ3YEazGWg
ImpHash	-

C:\program files (x86)\windowspowershell\modules\packagemanagement\1.0.0.1\packageproviderfunctions.psm1

Modified File

Stream

»

Also Known As	C:\program files (x86)\windowspowershell\modules\packagemanagement\1.0.0.1\packageproviderfunctions.psm1.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	11.40 KB
MD5	8592d8adf03015ac7f29a7f83ca8e0cd
SHA1	0db094c934117dbcee5ba4be5c9b90ffd9596850
SHA256	01e9b775cdee876bac3c7091d2df8f6474cf87e07a736ce0a1866bda6d44e7b4
SSDeep	192:zMkEhkjpRQHLCTZz1ePD7zJHZPUzH4y3KwNXRD4u5b7G+HsnA711sFPuGtRrJtdk:4R0LqCXs7zRizHFDm8snw1YPuurJvz0J
ImpHash	-

C:\program files (x86)\windowspowershell\modules\powershellget\1.0.0.1\en-us\psget.resource.psd1

Modified File

Stream

»

Also Known As	C:\program files (x86)\windowspowershell\modules\powershellget\1.0.0.1\en-us\psget.resource.psd1.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	74.59 KB
MD5	ca502457eb0a5e944580c419acf594af
SHA1	9b1f8cb6a9a452699e73f9f98589ee3d6bf2c43d
SHA256	f8c874633176cbab75c91a42c6e12bdfad4ea56c484778e048706239e4b4402b
SSDeep	1536:q17Q+G8gOU1AzGla4aTAoxeN1DLdgXLbDF28ESOqXpV:qWL8gOIla48RO1FgXLbx3ESP3
ImpHash	-

C:\program files (x86)\windowspowershell\modules\powershellget\1.0.0.1\powershellget.psd1

Modified File

Stream

»

Also Known As	C:\program files (x86)\windowspowershell\modules\powershellget\1.0.0.1\powershellget.psd1.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	5.22 KB
MD5	a7e974183c9eccb64c7f7cca88890686
SHA1	df056922d40dfcaf764bf0ef4e27a7e08d9c3191
SHA256	dfc11fe224c1bba531de057f0ceb83ef68ef72aab1d2b8443080d98c1411d968
SSDeep	96:7y0YA+e64oVZzpl80WdiGCXj5tFr1bHk/swA8FLB2z246dKOeiTQjP1ya:LWxDZpWIB5t11kJLxvFei8Zh
ImpHash	-

C:\program files (x86)\windowspowershell\modules\powershellget\1.0.0.1\psget.format.ps1xml

Modified File

Stream

»

Also Known As	C:\program files (x86)\windowspowershell\modules\powershellget\1.0.0.1\psget.format.ps1xml.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	9.06 KB
MD5	8ab979df5ca5667bab8b370f8370947c
SHA1	e5b9312f56109150d92895530360e72b879f4d5c
SHA256	c7a510c648ec48d9273b16662640deb290b5e19423e921b9dc2c436851687452
SSDeep	192:K0LVYeTXvQteR+bPLNApoYbJL6Mx4Yra+NsI95C/K0rW6:pLCR5bzNARbL4yNsILC/Dq6
ImpHash	-

C:\program files (x86)\windowspowershell\modules\powershellget\1.0.0.1\psget.resource.psd1

Modified File

Stream

»

Also Known As	C:\program files (x86)\windowspowershell\modules\powershellget\1.0.0.1\psget.resource.psd1.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	78.26 KB
MD5	85e2ab0f970e91c17c7624e005286918
SHA1	a6a4e305b6f96e25e490c83f1a34dc05f7694a9a
SHA256	bbe162ef778005d79ee17b3ba0ca61ff72511d30de6b1ab9ca04670a019e67e2
SSDeep	1536:fthRXKaU/ArSOX+SwAcRezudkI5SpvV6WqDtoKlR62+pFUHf3LBzeQrc8EX:fthRXFU/4PNQRjdkI54vexoK/V+m/VnS
ImpHash	-

C:\program files (x86)\windowspowershell\modules\powershellget\1.0.0.1\psmodule.psm1

Modified File

Stream

»

Also Known As	C:\program files (x86)\windowspowershell\modules\powershellget\1.0.0.1\psmodule.psm1.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	563.67 KB
MD5	9965752fb730eb3bc14032ffc60693e9
SHA1	fab79d861981f55fc4c0b50d9702d7c4e4d28e76
SHA256	4b83656aa7dc7f28aa530c3b76fba35bf515f48489ee91ffc51b96494a73f208
SSDeep	12288:eJg9/RKrDL79K2TexcaPJcYK6CGLehIS2DGJR8PwYdYa9q48g:D/cf7TdKvKRGLe2zDkR8PBdvR8g
ImpHash	-

C:\users\all users\microsoft\assistance\client\1.0\en-us\help_cvalidator.h1d.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\assistance\client\1.0\en-us\help_cvalidator.h1d (Modified File) C:\users\all users\microsoft\assistance\client\1.0\en-us\help_cvalidator.h1d (Dropped File)
MIME Type	application/octet-stream
File Size	12.78 KB
MD5	d4c53954161a368afb8eca38f0231f2a
SHA1	c78a85c59168de8f5c90a5f816286e9693189d1a
SHA256	9931fe1fcd2c046c207c1deada4240b268f41de10a25589ed733c706d6c39f2f
SSDeep	192:gTzymhPu96xOaXMGCuVauUO+FaBD8hP0Eg8FZqZcgU2kTAseLsK0gWJ6WgxAktow:yzh5ucxRE1QU68hP0Ela4lnK0t8WAvtV
ImpHash	-

C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_assetid.h1w.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\assistance\client\1.0\en-us\help_mkwd_assetid.h1w (Modified File) C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_assetid.h1w (Dropped File)
MIME Type	application/octet-stream
File Size	218.50 KB
MD5	6140f7a95bb50d1158f6d5159f4f6d32
SHA1	4104a0e1e7245255c14e950b1666092cfeb20a11
SHA256	b9495a9726b9e57fc523a9ecef5ca0176ec254981adea8e2c17f4c82ee6319ef
SSDeep	6144:NFjvAQCFYzH9smTllvVwLoDXHwOl9OdR3PK:Nuj4xTlRGG3wgOdR3i
ImpHash	-

C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_bestbet.h1w.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\assistance\client\1.0\en-us\help_mkwd_bestbet.h1w (Modified File) C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_bestbet.h1w (Dropped File)
MIME Type	application/octet-stream
File Size	202.48 KB
MD5	ff7c612bf58778e9bc45401ee8bab9f7
SHA1	e800de1ead92c54aa487a7e6c565b9f768908773
SHA256	15d5d9716d231e17d8f4d5df0223c15795af7aeefaac6b5cb1b0c6f596a3f354
SSDeep	6144:LaZKGpKnGRmLDSvd5LyidG5tTWm56cpCdDO4vkStP7Z:iLEnJLDSvd1yidGzTWk6cpCZO4Z
ImpHash	-

C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mtoc_help.h1h.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\assistance\client\1.0\en-us\help_mtoc_help.h1h (Modified File) C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mtoc_help.h1h (Dropped File)
MIME Type	application/octet-stream
File Size	488.78 KB
MD5	0691298c59ceb1fa8b642bb2c14f4b11
SHA1	fb96318ce7b8800e3e3de75cf0cdf09a63d85d82
SHA256	34623495e664bf1ebd5c78d2988796936a8ab21669b467f551a2c818409294af
SSDeep	12288:A0//KMwQzDka/rXGiTuHurmZVwSACoKZLal2J1cJ:R5DBWWkfDa2JyJ
ImpHash	-

C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.h1d.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\assistance\client\1.0\en-us\help_mvalidator.h1d (Modified File) C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.h1d (Dropped File)
MIME Type	application/octet-stream
File Size	15.32 KB
MD5	3b92b22788592831d4fe40f5784e436d
SHA1	017f64f4198a987f6a900941b6657fcc085545bd
SHA256	c271b5e1066889d89c43c0d452cc03ef0b76392a9f7506dc137b993267d30097
SSDeep	384:wM7Q3SeyuciaaEERqRoDF/itLX+Ee4XYOCy:n7W7yuciaBERjgeny
ImpHash	-

C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.lck.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\assistance\client\1.0\en-us\help_mvalidator.lck (Modified File) C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.lck (Dropped File)
MIME Type	application/octet-stream
File Size	1.00 KB
MD5	fbe1cfc36bb6cdb15579cad6b0e60d22
SHA1	c29853817431003b987ca8fdbad08ac9d0b9e062
SHA256	78d54d107c1bbd6a43e3362144c20ce303c3523726f20486ea12c91553f6033d
SSDeep	12:7lKeEdu0alIGXOHOv8/zN1Fh/La/Mknh7GRaf4wb:7lVMmb/Aa/MuYi4wb
ImpHash	-

C:\users\all users\microsoft\assistance\client\1.0\en-us\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\assistance\client\1.0\en-us\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q (Modified File) C:\users\all users\microsoft\assistance\client\1.0\en-us\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q (Dropped File)
MIME Type	application/octet-stream
File Size	853.77 KB
MD5	b292f02dbbd6ba7811a65cd7b20f496b
SHA1	6a300201205ba488025a12923714d41c8cb7973e
SHA256	bbacc1dbc419a84a90cd948015a0af72e6cac7ebec403fa2724c2c6840cfcbac
SSDeep	12288:Ik6Ryllu1bE5Aw+GqKXV+dCpSiHaihM1SzCOdf56Fe3OQO3YLe4bvT8tWwdeY4yp:ERaAwHdAlyDM8OOdfay23YpbT86MZ/
ImpHash	-

C:\users\all users\microsoft\clicktorun\deploymentconfig.0.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\deploymentconfig.0.xml (Modified File) C:\users\all users\microsoft\clicktorun\deploymentconfig.0.xml (Dropped File)
MIME Type	application/octet-stream
File Size	2.93 KB
MD5	e39030cb8753f52afd04be9f3de3977a
SHA1	a7a35efac8d0f8f97c0314548ec173efd45f4eb1
SHA256	806c1b95f7c46dcebdce2936e55944381238bae67d86ac0c5060bde0f0091776
SSDeep	48:7lXdreRUwZM+bf/GDYm8bVnvBTfZ29c85ExCuukoDm2OL:7Z4M+IYLbZJTfo9c8SFuk2GL
ImpHash	-

C:\users\all users\microsoft\clicktorun\deploymentconfig.2.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\deploymentconfig.2.xml (Modified File) C:\users\all users\microsoft\clicktorun\deploymentconfig.2.xml (Dropped File)
MIME Type	application/octet-stream
File Size	2.35 KB
MD5	df9fc7a356e0cf39de0131ba0fa4649d
SHA1	a94905b7504972609465f42e101da7dcf894cae8
SHA256	ad71f6df064fd63dfa065e290cdae17f7f397414fbb68eac2d9b387be59c7dff
SSDeep	48:7lTUsDDIB//vl8PUQClrSq3ZiA/aWR9G63VWtVWj0wB:7DDDCPOMQCrv/a6c0J
ImpHash	-

C:\users\all users\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\en-us.16\masterdescriptor.en-us.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\en-us.16\masterdescriptor.en-us.xml (Modified File) C:\users\all users\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\en-us.16\masterdescriptor.en-us.xml (Dropped File)
MIME Type	application/octet-stream
File Size	22.85 KB
MD5	9de1edc5e22d6bdc4ec4d0418b7a96a8
SHA1	6801fca95a1a85f55391576b3b65f5f5393c67d6
SHA256	ee2d901b29d4132bcc3a63f542c4c8ce4829c339a9491e926c1d4eb71270ecc6
SSDeep	384:i4/yi5ecv+0CNf5EvLYxi2KYVbX5N6/kbp1SqJXDBt6VY2nz85SDugwCbiUz3sq:R/p5Xv+0CBevLYxi2KQzRbpg+XDn6Xzb
ImpHash	-

C:\users\all users\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\en-us.16\s321033.hash.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\en-us.16\s321033.hash (Modified File) C:\users\all users\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\en-us.16\s321033.hash (Dropped File)
MIME Type	application/octet-stream
File Size	1.10 KB
MD5	214b37a6aa32828dde96a6c0307d8339
SHA1	8149e0d082e00f258d27ad3e37ff94b819f79dde
SHA256	f12e0db3de540e832fa65189ffb4f72d7648d3736f3c58c45e126dfc2e03c434
SSDeep	24:7lUCRGXXvSVf844ODm6AhznkdVK3FFm4NR8/:7lNGHvS14ODCLkdVyFm
ImpHash	-

C:\users\all users\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\en-us.16\stream.x86.en-us.man.dat.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\en-us.16\stream.x86.en-us.man.dat (Modified File) C:\users\all users\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\en-us.16\stream.x86.en-us.man.dat (Dropped File)
MIME Type	application/octet-stream
File Size	865.46 KB
MD5	7129af8f37bf04bac0dfeab97eeb9a8c
SHA1	da2d0df24684bdfd7db4664be8fdddee4e3909f0
SHA256	521057a9c3633d63ff6255375092fb46e77421cc1f542301d9ad2f2c179a8999
SSDeep	24576:+GWW3gsvj35yA1Mls7KBTLQvVBccdpzmf5YLd:RR3gs4A1MlsyT6cMBmf5YLd
ImpHash	-

C:\users\all users\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\x-none.16\masterdescriptor.x-none.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\x-none.16\masterdescriptor.x-none.xml (Modified File) C:\users\all users\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\x-none.16\masterdescriptor.x-none.xml (Dropped File)
MIME Type	application/octet-stream
File Size	21.53 KB
MD5	36d140e5346fdeb68cd28d4e954191df
SHA1	68e35ec367d7af3083eebeff609ba2daaa0eee11
SHA256	888d509b4f130633657c6104d2894dfc7401bf4fc93db5974f94c51da94c8e2c
SSDeep	384:SoOPfa/BgYR2U462KZ1mccExFmRNyg0XefArzXjgjvxEn5lMitz:rE4BgYEU4VPcpFmRNlfA/U+5Oil
ImpHash	-

C:\users\all users\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\x-none.16\s320.hash.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\x-none.16\s320.hash (Modified File) C:\users\all users\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\x-none.16\s320.hash (Dropped File)
MIME Type	application/octet-stream
File Size	1.10 KB
MD5	0770127dce8e5ee4e6821728ccc15056
SHA1	91d5b656e4b8097a885094a98b211b3099476e43
SHA256	924486ae97c963f6ebaf437afac9d67c90d9eba0916c82efdabd91044e957495
SSDeep	12:7lHbmOUQGxmA1R0OJ6ajF87Tam09FV6ascE14cpmvhi6vShQgMzqVjBWiXHM:7l7I5mA1WBa5YK66Ej2Q66hQgMzajBs
ImpHash	-

C:\users\all users\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\x-none.16\stream.x86.x-none.man.dat.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\x-none.16\stream.x86.x-none.man.dat (Modified File) C:\users\all users\microsoft\clicktorun\e728f99d-05d1-4020-9ece-6de2ec414166\x-none.16\stream.x86.x-none.man.dat (Dropped File)
MIME Type	application/octet-stream
File Size	3.55 MB
MD5	405909921dc04506ef4bd1cc07e4d054
SHA1	9743134af5e5665554fb050acd4269696622d27f
SHA256	54f6592be3606edea2c3433263135c47459805cdb2d68805e4db48b28ebf1da0
SSDeep	49152:CuSciUczfl/NicTzDiGb5QHQhK25pQhUUf+RRM1/KqK0Ef:CuSciUK9Vik1QHQhKsQhUU2zOqf
ImpHash	-

C:\users\all users\microsoft\clicktorun\machinedata\catalog\packages\{9ac08e99-230b-47e8-9721-4577b7f124ea}\{1a8308c7-90d1-4200-b16e-646f163a08e8}\deploymentconfiguration.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\machinedata\catalog\packages\{9ac08e99-230b-47e8-9721-4577b7f124ea}\{1a8308c7-90d1-4200-b16e-646f163a08e8}\deploymentconfiguration.xml (Modified File) C:\users\all users\microsoft\clicktorun\machinedata\catalog\packages\{9ac08e99-230b-47e8-9721-4577b7f124ea}\{1a8308c7-90d1-4200-b16e-646f163a08e8}\deploymentconfiguration.xml (Dropped File)
MIME Type	application/octet-stream
File Size	1.60 KB
MD5	ee3a6ee625ae0ec3844b3cbb63c99a26
SHA1	2dc0b815dee879dfc3552160eb49c3b8e1034e6b
SHA256	9c0b12852dae83e841950342705ae67207fe12b7d8ecd200a5de643323375743
SSDeep	24:7lp3gIbiysUcIchjCAdzzyUakKEKv6GHk2xQfZDZRWjbOlUv30aMJw:7lp3VsCY+azafEKPLxeZRWja+vkW
ImpHash	-

C:\users\all users\microsoft\clicktorun\machinedata\catalog\packages\{9ac08e99-230b-47e8-9721-4577b7f124ea}\{1a8308c7-90d1-4200-b16e-646f163a08e8}\manifest.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\machinedata\catalog\packages\{9ac08e99-230b-47e8-9721-4577b7f124ea}\{1a8308c7-90d1-4200-b16e-646f163a08e8}\manifest.xml (Modified File) C:\users\all users\microsoft\clicktorun\machinedata\catalog\packages\{9ac08e99-230b-47e8-9721-4577b7f124ea}\{1a8308c7-90d1-4200-b16e-646f163a08e8}\manifest.xml (Dropped File)
MIME Type	application/octet-stream
File Size	4.71 MB
MD5	03a3aebd2110714b51c84b26f6e4ffe9
SHA1	412ca12d0278e153c67b9e485919c7f7db32d533
SHA256	62754e2c26093b69fed1b760c61d5a29cb0ff34b77d17b2f6afac6fde2ca9584
SSDeep	24576:EsTk4mxr0SlxALfn8rQ3symaHgwOQw3NIk2e3NIw7w:E/GjtszaH9OX3NIE3NIwk
ImpHash	-

C:\users\all users\microsoft\clicktorun\machinedata\catalog\packages\{9ac08e99-230b-47e8-9721-4577b7f124ea}\{1a8308c7-90d1-4200-b16e-646f163a08e8}\userdeploymentconfiguration.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\machinedata\catalog\packages\{9ac08e99-230b-47e8-9721-4577b7f124ea}\{1a8308c7-90d1-4200-b16e-646f163a08e8}\userdeploymentconfiguration.xml (Modified File) C:\users\all users\microsoft\clicktorun\machinedata\catalog\packages\{9ac08e99-230b-47e8-9721-4577b7f124ea}\{1a8308c7-90d1-4200-b16e-646f163a08e8}\userdeploymentconfiguration.xml (Dropped File)
MIME Type	application/octet-stream
File Size	1.60 KB
MD5	80f111dce765a87d7b36a2fdd6901d14
SHA1	43e51a7ebad44d62a251a9d3a0c9024a81220638
SHA256	77dc45b59b2a402ea20424c5e3d1ca8f06e4aaa3b12f8f5e3b0077128b1a7cf2
SSDeep	24:7lSQbE2bDOMxQvsAjXBlYX658Q0zRqvjNBpE1P3qBH6doHWt1aNn:7lSKx0bBuLQ0Mjf21PqwdoHOG
ImpHash	-

C:\users\all users\microsoft\clicktorun\machinedata\catalog\packages\{9ac08e99-230b-47e8-9721-4577b7f124ea}\{1a8308c7-90d1-4200-b16e-646f163a08e8}\usermanifest.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\machinedata\catalog\packages\{9ac08e99-230b-47e8-9721-4577b7f124ea}\{1a8308c7-90d1-4200-b16e-646f163a08e8}\usermanifest.xml (Modified File) C:\users\all users\microsoft\clicktorun\machinedata\catalog\packages\{9ac08e99-230b-47e8-9721-4577b7f124ea}\{1a8308c7-90d1-4200-b16e-646f163a08e8}\usermanifest.xml (Dropped File)
MIME Type	application/octet-stream
File Size	2.95 MB
MD5	c880d073f2a1a16a6eec3ce761580d8b
SHA1	4926d896e15f159cecda1dbe736f9b8a4adf2d89
SHA256	7a768c911f9e08dfab8c8f38a02bfd659a0a073b1a6bdcb58546facc546f0e1c
SSDeep	49152:rtXgwCV6eV0y0fuJmgqfhT3RLwON0wONYR97SA1AzzmJvQx8WMJ8dlgJvyMSOx2J:1gRVjGy0rRpTRfR97SA1AzzmJvQx8WMI
ImpHash	-

C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\airspace.etw.man.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\airspace.etw.man (Modified File) C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\airspace.etw.man (Dropped File)
MIME Type	application/octet-stream
File Size	276.53 KB
MD5	a36b1ecfcd579bc7e2df672841e9ae41
SHA1	abd02e5a03bb8b6fcfcfcfcb203d049b5d29e459
SHA256	d858d3fe165c1dda7337749dcc85153218b70e95477a57d640f8bcb372af536f
SSDeep	6144:FR4SsPmkHYWNCRLo8zVGEftS/V+LqWC9enliOE4PTNPUl:k9m0YGCRLN5GEftS/4I90li4q
ImpHash	-

C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.access.access.x-none.msi.16.x-none.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.access.access.x-none.msi.16.x-none.xml (Modified File) C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.access.access.x-none.msi.16.x-none.xml (Dropped File)
MIME Type	application/octet-stream
File Size	38.88 KB
MD5	23de330723357af65a530c3fbdbf54ca
SHA1	76ae44986d4f8bdf86c8121c3a53d272c3332265
SHA256	404eb33fded46d8cb5fb45e0ee22e7f24dc53d4efb837e94133027b10fab8f68
SSDeep	768:OYMa+Cggkk0djTvfbLjc3jQAwiidmQ5cfJFZFB6d3JZqPRY:vJZqDcZiE9NF4d3JY6
ImpHash	-

C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.accessmui.msi.16.en-us.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.accessmui.msi.16.en-us.xml (Modified File) C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.accessmui.msi.16.en-us.xml (Dropped File)
MIME Type	application/octet-stream
File Size	57.07 KB
MD5	75c65068f0fdd38b099de017404c6a81
SHA1	5c0caacd5924d900b95a11122556df3038e1ea38
SHA256	de8e8bccfd2559f681ea13667876fb46c22af8d5d91a54ee8ae32821480bcf33
SSDeep	1536:UvSVGRU+H55XNniHsLavTbKqU3/O1nQ7KiPC7C:UKIPniWaCqUUKKiPMC
ImpHash	-

C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.accessmuiset.msi.16.en-us.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.accessmuiset.msi.16.en-us.xml (Modified File) C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.accessmuiset.msi.16.en-us.xml (Dropped File)
MIME Type	application/octet-stream
File Size	2.99 KB
MD5	c3097d550b9e6196602c9a3da021072f
SHA1	6c0438309cc744cfef7014835daf16b4ccb7412e
SHA256	82a4824675b26fc4f7aa54555983d7389ec58e4c949560501ef09b9be21153c8
SSDeep	48:7lu97d/lB4mDtb0wzyYj94hicPMaHSgzlm/MaDv5UCSwTnpK5VWWI0zpPwbx71:7s9tlB4mDxO1hiJOUnVUCSwTngy/0BwP
ImpHash	-

C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml (Modified File) C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml (Dropped File)
MIME Type	application/octet-stream
File Size	17.26 KB
MD5	4696336209f55127922ee90f0a16c948
SHA1	2ed8b53ef994219d6c0df8a30a25fb25ebc4156d
SHA256	366b7836fa80aa991230aa48d21f34084d13d8256457d498ba7adb07d49617b6
SSDeep	384:ojcgsbUHW8qAl1/jJV/PBr79pU7sHZhw+vciokj2nd:oI/QHdqAlhJlV79igHZhwujok2
ImpHash	-

C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.dcfmui.msi.16.en-us.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.dcfmui.msi.16.en-us.xml (Modified File) C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.dcfmui.msi.16.en-us.xml (Dropped File)
MIME Type	application/octet-stream
File Size	10.58 KB
MD5	826f39ca79030b82ea17afa6467baa8b
SHA1	f445ed18591b4c315d07545f001d1248868f025d
SHA256	16d5852bce39628dbe21eec6313b6d0f2f78c48140f47fb4bb410c15d6fe9187
SSDeep	192:9XTKSGksYX0WywGnl1RRCmo0hifWGSYQZITQ1MdWWCp3Q07L+wD3sV:V/Gdn5l1RRCmoIiJ/QZITQGdWWCEYcV
ImpHash	-

C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml (Modified File) C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml (Dropped File)
MIME Type	application/octet-stream
File Size	233.30 KB
MD5	b86b0546abc0d69d714a9c93eb3968cd
SHA1	fa257da62f5733be1f197b094bed715af4a4e121
SHA256	cbe62c3d3941e889b25b92833ab5c3b1d0749b62d2fecdb2c662d21a33d5ee5c
SSDeep	6144:+MzpJOCOFHYRhZ3zN30CCh5Q8v+eG7bDshiVn:R1JaC/ECChya0B
ImpHash	-

C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.excelmui.msi.16.en-us.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.excelmui.msi.16.en-us.xml (Modified File) C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.excelmui.msi.16.en-us.xml (Dropped File)
MIME Type	application/octet-stream
File Size	35.20 KB
MD5	4498c41180e69942180a4003493d61d6
SHA1	046cc9aebcca717c373c9eb486836e45d8cdcc70
SHA256	0b03a61e39d3eca72b4b82cb3080578c27a1cfd83d759efdd5412d8fdec96a8b
SSDeep	768:WJ2Vxiiy1YTW0K+M2ZvpodyJIj/tlMtggumX3:Wqoip3vadEI/gomH
ImpHash	-

C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml (Modified File) C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml (Dropped File)
MIME Type	application/octet-stream
File Size	36.76 KB
MD5	2bc48eaa67bb117783826d35a5fc590e
SHA1	ae004022975387ee6802fcf617a37e1556a622ad
SHA256	cd7ff67ad6fbb413b4b9bfe98bebe2859c0d199567cf7c7d1ff8756d4accfc33
SSDeep	768:a1EtdIk+2IqmDDz3JdZzPqEczUlpSZ/Gbeu52kPdg:a4dIVYmDZOEq+EGCC1S
ImpHash	-

C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.groovemui.msi.16.en-us.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.groovemui.msi.16.en-us.xml (Modified File) C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.groovemui.msi.16.en-us.xml (Dropped File)
MIME Type	application/octet-stream
File Size	6.99 KB
MD5	3a5ef2e9fe390de22b0331eff599c2d5
SHA1	e81cc8ac891f0868c314a4339cb8c4a4abee5cb4
SHA256	c14eac01de8ff23469ee086fc7e6550f8f41d69d4f90a68a9490104e107c6d82
SSDeep	96:7bQZayGpxV4Sh/DZCImhzg/d40p5Oj+glU3xlAirXq/02bxHeT4p0wrwX3yvmIM7:kHGprVVChhzgZ5MhU3HAlFu4rdOMm
ImpHash	-

C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml (Modified File) C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml (Dropped File)
MIME Type	application/octet-stream
File Size	88.46 KB
MD5	0b07110f6ceea94a9352e40cae3ac4b8
SHA1	ca35df46a0a45aadb4c6265a2d0dc630a9f0cee3
SHA256	888493670841c4c4b4702f8d91532134662253acda96d475fa9109342c4ed92c
SSDeep	1536:BOiTBygwiffEFCUVSae1KdG7NlSFSPKFhXGS9JpH39pjD6jgHF+3OH0yVXLQnhXi:BZnwVVSv1KA8SmG6HjDlSO7VCu
ImpHash	-

C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.lyncmui.msi.16.en-us.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.lyncmui.msi.16.en-us.xml (Modified File) C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.lyncmui.msi.16.en-us.xml (Dropped File)
MIME Type	application/octet-stream
File Size	23.78 KB
MD5	ff60914d172e92122aad290041bfcd78
SHA1	eacf34f1294669140b54c9c3211a185ac05a779d
SHA256	019c4e7c4a042ef8a28848583d0ab499cf76d686ec40d114dcb63e843afcb293
SSDeep	384:JXE6DTsc2V10XI0RQcLqdUrAXDvtjUkiVb5KHidfIOQLwA8rwfHc95nbqBd:JU6DQdV1OkUqMMUkOb5MEwGAn8PneBd
ImpHash	-

C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.office64mui.msi.16.en-us.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.office64mui.msi.16.en-us.xml (Modified File) C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.office64mui.msi.16.en-us.xml (Dropped File)
MIME Type	application/octet-stream
File Size	22.44 KB
MD5	d74ad617e6116ee91a2120443aa3890a
SHA1	cbf9100cc5357dfbd1b659d33e361ac24a79a140
SHA256	feadb8bad767f4e35e561a857cf34c1fa842afd1be9c18a56bf0e27d5234017d
SSDeep	384:bkafSsekRG22Bgc5SFQ03bpc7CyLQvgnuQoSVQbzjShq+U8HG9s7NVgxsE3pGWCh:Q41REec5uQMbCzkv7Qonjuq98nsxsmYh
ImpHash	-

C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.office64muiset.msi.16.en-us.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.office64muiset.msi.16.en-us.xml (Modified File) C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.office64muiset.msi.16.en-us.xml (Dropped File)
MIME Type	application/octet-stream
File Size	2.99 KB
MD5	584894ddaa9f8be9e7559a3cff83ba76
SHA1	0c5bd3eb0888907ce68a8f89fa13d5be84c81772
SHA256	e240a236f6e06519809c898cfbe5ea8a6717aa858421c5164eed1cc0483aa57a
SSDeep	48:7lwTM3Gbcj/wG1Wcyfzyxz3Bvbv8oy0CReZ65M6VTHkwKhVWHE+qkwOHqHxl:70M3GAb16+xzxvbv8oy0h6J1Hk9N+T9e
ImpHash	-

C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.officemui.msi.16.en-us.xml.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.officemui.msi.16.en-us.xml (Modified File) C:\users\all users\microsoft\clicktorun\{9ac08e99-230b-47e8-9721-4577b7f124ea}\c2rmanifest.officemui.msi.16.en-us.xml (Dropped File)
MIME Type	application/octet-stream
File Size	105.38 KB
MD5	1cf859fda1e9b7aab240952cf075fb99
SHA1	4432231bcf02ab25bce820614764db101cf16b13
SHA256	31b4c74282ec3845623a86d47ebb00b2ccf7206bad38280f0fcfd02bdbf92bf9
SSDeep	3072:isZTI7iqMt+9Tall9F/8Jd7L6ZCsfPvxW:igTIe3t82XqJ9LcBU
ImpHash	-

C:\users\all users\microsoft\officesoftwareprotectionplatform\tokens.dat.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\officesoftwareprotectionplatform\tokens.dat (Modified File) C:\users\all users\microsoft\officesoftwareprotectionplatform\tokens.dat (Dropped File)
MIME Type	application/octet-stream
File Size	2.68 MB
MD5	9034ecc502bf9fafd5b2814187dad9ac
SHA1	795c73ff59b8222e7644935870439dacb27cd802
SHA256	74e422c61807d2b99c8551df45b2f2cd1b039eb9b344cf5f9f896d07b3d7517c
SSDeep	24576:G0TiS7EKyZOfduK5XJkdM38E80h+sRUNxK7+mXOpauYFbKSr3lD30:qb8rZkdVIh+syQydpaD+SrlDE
ImpHash	-

C:\users\all users\microsoft\search\data\applications\windows\windows.edb.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\search\data\applications\windows\windows.edb (Modified File) C:\users\all users\microsoft\search\data\applications\windows\windows.edb (Dropped File)
MIME Type	application/octet-stream
File Size	10.00 MB
MD5	22b7c9c0747e28c05c5054e056101994
SHA1	ab6ce468fe63cffbb4ece381b31541b3486d9bee
SHA256	f724af1bc3325d26ff26b1fbb25ea718a1ceac9afaf8b93addc28f503cdf25a5
SSDeep	49152:0MVdZEOaddjPMLfhbb0d99yNp24KE7vw9vbb8sGZtWYUASkjRCU/r74AfzVo+VQ:DVPKddglQI+S74ZfGuYUAXoUTfho++
ImpHash	-

C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasbase.vdm.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasbase.vdm (Modified File) C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasbase.vdm (Dropped File)
MIME Type	application/octet-stream
File Size	10.00 MB
MD5	29ad96d6e1a6ec8f4c48adbdc670aad0
SHA1	88e277b63c7c5983f27e4d772527976e24c31a80
SHA256	b10b561fa53dcad4f8346f3d4d764841a1ec801db683c9c2ab3e5aa9fb2f3d95
SSDeep	196608:2+T/V81X/hlW7kovl24DcuZekLyMPsVZYOd1PhOto4RKe9m:xTMnz8H4uZzWCsViO7P8tHh9m
ImpHash	-

C:\users\all users\package cache\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\packages\vcruntimeadditional_x86\cab1.cab.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\package cache\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\packages\vcruntimeadditional_x86\cab1.cab (Modified File) C:\users\all users\package cache\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\packages\vcruntimeadditional_x86\cab1.cab (Dropped File)
MIME Type	application/octet-stream
File Size	4.97 MB
MD5	7b52674eab8892fbffdf99e5665929aa
SHA1	35ba74321c2f63a9cbbb1dbbe0bea695b2ed6fe0
SHA256	9ecebb04e6adb22fdc8ac15076040a20abcdaa73db015b0512812400f92ee3dd
SSDeep	98304:B4i5yZJPLmfjBvRxMh7vhetajX6x0XSvrTBEbwwF0XVsvufy:B4i6MLBvE8xuEebw6vu6
ImpHash	-

C:\users\all users\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\cab1.cab.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\cab1.cab (Modified File) C:\users\all users\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\cab1.cab (Dropped File)
MIME Type	application/octet-stream
File Size	5.53 MB
MD5	d20ab1a3919a82d4a95a392437bc71e3
SHA1	b199b0bf67ee2cbdbd6fb11d155464689a283dec
SHA256	bf5b5b6dc76fd38cfcde6453062c6ef3936b89df5374c152cf6b7e2cbc5f3edf
SSDeep	98304:d4rURqVWslFFdZAI+wyxiGoJLD8BgCoHeaSchw3wLe9n2AOQqhzX4Cr5RzAc2JP4:qARYvjFu1xsL2gPYgLaHknmRS
ImpHash	-

C:\users\all users\package cache\{7d0b74c2-c3f8-4af1-940f-cd79ab4b2dce}v14.25.28508\packages\vcruntimeadditional_amd64\cab1.cab.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\package cache\{7d0b74c2-c3f8-4af1-940f-cd79ab4b2dce}v14.25.28508\packages\vcruntimeadditional_amd64\cab1.cab (Modified File) C:\users\all users\package cache\{7d0b74c2-c3f8-4af1-940f-cd79ab4b2dce}v14.25.28508\packages\vcruntimeadditional_amd64\cab1.cab (Dropped File)
MIME Type	application/octet-stream
File Size	5.37 MB
MD5	d0a6e536e7e4f18e17c70788f0c710df
SHA1	0b2a06a2d52a57c38834ea04dfbcdd2154c70a80
SHA256	f1eafcc020518f96baf4dc7a90011664b56c014aa92c319625eec06e6a014d97
SSDeep	98304:6mntMVxAjNXHfqf6i8TDpd1LBEQxijqwbZrHnZLFJ/B57TshEhVLi/zjtPMx8M9L:6mSAjNX/qf6i8JTBLi+w9r9z/EEVLinI
ImpHash	-

C:\users\all users\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\cab1.cab.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\cab1.cab (Modified File) C:\users\all users\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\cab1.cab (Dropped File)
MIME Type	application/octet-stream
File Size	5.33 MB
MD5	017d770d16f92cad63bdb74567aee4b7
SHA1	3fa49fa52ac57be83842428fe562e2da3195418e
SHA256	a882b2fb55c47f9078f835b46e3c1fa41dfc6305190bbcb52a1c1787ee767597
SSDeep	98304:qjP9Wnb5/ed/0jHDSSBEnOEEYiCh36RawfXnZGZ+O/nBymG6YvO3ukHkEV6ndqT:qP9wbEp0CKCLE7ChqRawcZ+Ensf6OYhb
ImpHash	-

C:\users\all users\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\cab1.cab.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\cab1.cab (Modified File) C:\users\all users\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\cab1.cab (Dropped File)
MIME Type	application/octet-stream
File Size	4.92 MB
MD5	2facfb234e9785b19f9106223b8d8a88
SHA1	ebfeb0ca4b411bbcdc9b37c48d9f7cefb5a6761c
SHA256	ea8ff2b3ea80003adb6055255d73fd06b78664225a24c25f831d931380636bf3
SSDeep	98304:4TDJUHvaDYkEd446N0EAtixRVekINbaD920wR35u/N8F80aVUyO31:mDJUPaUkXlmtGvbIQwdYcJB31
ImpHash	-

C:\users\all users\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\cab1.cab.cuba

Dropped File

Stream

»

Also Known As	c:\programdata\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\cab1.cab (Modified File) C:\users\all users\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\cab1.cab (Dropped File)
MIME Type	application/octet-stream
File Size	4.71 MB
MD5	cd29f11a580c3bd7666dd15e6f9c9160
SHA1	43cb43d4147dde59ff721040e272c87f9674b7fc
SHA256	06fe60f9080bc0a07318dfd79d789be573796baac518e16671099931fc2418a2
SSDeep	98304:m1B/s5GAEK/vzPRtKu3LJs4QGHYl3afvVoqjXxK47Idv6Y7Ffxa/2CNyZ:TDZ/vzacLJJQOy3Mv6qtey2mHNm
ImpHash	-

C:\users\default\appdata\local\microsoft\windows mail\backup\new\windowsmail.msmessagestore

Modified File

Stream

»

Also Known As	C:\users\default\appdata\local\microsoft\windows mail\backup\new\windowsmail.msmessagestore.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	2.02 MB
MD5	6db491fd38bfdc0109312b7be8c7d3f4
SHA1	2e8fe2051e3a7cad988f53400f4edb0d10ac5cdc
SHA256	43643d78420f6aea28603cb94cdec7bd81121cc528c1d53c8298f18a26926b9f
SSDeep	24576:lOAxwUx+EYACtEN7fN4nM6zhxDQAlOvS9cEkl:lwUxDZRf67zHUAlO
ImpHash	-

C:\users\default\appdata\local\microsoft\windows mail\windowsmail.msmessagestore

Modified File

Stream

»

Also Known As	C:\users\default\appdata\local\microsoft\windows mail\windowsmail.msmessagestore.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	2.02 MB
MD5	d820d198c1e8ca690699dc8a24bce6a2
SHA1	9e4da95d9dd699bf8d5635e6a06a9c7e7751a6fb
SHA256	4b3b548746cb98e4f5ff91dd19805b3044c1b84e6e32b6afcc9d80000a770da6
SSDeep	24576:wXOv6pWjr6PUoTvH097vumtVloJuexjb09XyqtmYie0lCrAicesp:p6UnQUoTcLlozYjfkice
ImpHash	-

C:\users\keecfmwgj\appdata\local\microsoft\media player\sync playlists\en-us\00010c6e\03_music_rated_at_4_or_5_stars.wpl

Modified File

Stream

»

Also Known As	C:\users\keecfmwgj\appdata\local\microsoft\media player\sync playlists\en-us\00010c6e\03_music_rated_at_4_or_5_stars.wpl.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	2.24 KB
MD5	6aa6c842a51005ec25349c9709b616e7
SHA1	48857198ff61fd0ac72af2e1351ee3e33c46724f
SHA256	53d039416d22a51357bd8f050f38673c3241adc457f1bab8013ff862e6a3188b
SSDeep	24:7lz+OPE8QUlkt6Hl+F/1J5B1TpAw65kHbM8697ge3MeT5Jszimdx2BSYDGIuEAVb:7likBlLFCT5PKk7MP7gwMM5ox4BKShAR
ImpHash	-

C:\users\keecfmwgj\appdata\local\microsoft\onedrive\17.3.4604.0120\pt-pt\filesync.localizedresources.dll.mui

Modified File

Stream

»

Also Known As	C:\users\keecfmwgj\appdata\local\microsoft\onedrive\17.3.4604.0120\pt-pt\filesync.localizedresources.dll.mui.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	76.66 KB
MD5	72070dfe3927c7f90e2cdde036859f32
SHA1	a1bf6681b6298412d06ae580c7ed832775e2ef8f
SHA256	259b239402eaf9c7db3771069c323022ce4e70b9ab7d126d46fcaec7d4968298
SSDeep	1536:Oebcp06R5q4Ay/eFQJ8OWIyEk9jVXLlyzWCWbvLF+7O5Owp6VuO:Oebcp06RdWFK8OWjE2XJyXMj1EVv
ImpHash	-

C:\users\keecfmwgj\appdata\local\microsoft\windows mail\backup\new\windowsmail.msmessagestore

Modified File

Stream

»

Also Known As	C:\users\keecfmwgj\appdata\local\microsoft\windows mail\backup\new\windowsmail.msmessagestore.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	2.02 MB
MD5	3bb188f038406bca37641f2c838403a1
SHA1	7239ae6829b3d25c3fad855bf7290f761472bf8c
SHA256	96e3455913a04103445637e380fcfb313f5dd25ff2e6bfe42bc329b8f4ba31d4
SSDeep	24576:xf4W3f0eXBTU5WcIH2Fu79vp9qe23tAY9bTgcSwsJZ:xf4W3f0KxQuW039qeJYNM/JZ
ImpHash	-

C:\users\keecfmwgj\appdata\local\microsoft\windows mail\windowsmail.msmessagestore

Modified File

Stream

»

Also Known As	C:\users\keecfmwgj\appdata\local\microsoft\windows mail\windowsmail.msmessagestore.cuba (Dropped File)
MIME Type	application/octet-stream
File Size	2.02 MB
MD5	123ba07f568672ba8dfb569d066b5b4b
SHA1	183245476d476edb5b4929a9f7ef8deddad54d16
SHA256	05709736aff4af770675940046c5c69cd577f08e33a9c809aebc9d4be83fd6e7
SSDeep	24576:/cqGW2YMKB2ZAA0RyeleemOyX9MsnAvLs9UVWGdv7:/9ie2ZorYe/yX9WRZ
ImpHash	-

C:\users\keecfmwgj\appdata\roaming\microsoft\document building blocks\1033\16\built-in building blocks.dotx

Modified File

Word Document

»

Also Known As	C:\users\keecfmwgj\appdata\roaming\microsoft\document building blocks\1033\16\built-in building blocks.dotx.cuba (Dropped File)
MIME Type	application/vnd.openxmlformats-officedocument.wordprocessingml.document
File Size	3.54 MB
MD5	1135294b8b22fbdbae321d6db710d644
SHA1	530634ec5eb15fbb7825aef508a76077386bd219
SHA256	a888d30db4fa9eb6f9e3f2ae4a1f7b949888bc362e522fd56b52db82b4e67df6
SSDeep	98304:AA171z0gjg5b08e3mBQlqZ7kNEeEukdHe3mBQlqgNsf8P854annqjGaGahPO:X7Ggjg5o8e3p+7kHbkdHe3pDsEPuDn93
ImpHash	-
Error Remark	Could not parse the sample file: Could not find OOXML main document.

Remarks (1/1)

Remarks

There are no files for this filter

There are no files in this analysis

Classifications

Threat Names

WHOIS Domain Information

Before

After