7bcd69b3...dd26

C:\Users\FD1HVy\Desktop\zzbdrimp2939.exe

Sample File

Binary

Blacklisted

»

Also Known As	C:\Users\FD1HVy\AppData\Local\Temp\zzbdrimp5619.exe (Dropped File)
Mime Type	application/vnd.microsoft.portable-executable
File Size	1.19 MB
MD5	7e3f8b6b7ac0565bfcbf0a1e3e6fcfbc
SHA1	b2a701225c8c7f839be3c5009d52b4421063d93e
SHA256	7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26
SSDeep	24576:VnJVtmfwkmE2j2uD3bMUPMGOc0dfe3WuEK2/0vPY0uZTp+Xksy:jVtmfwkmE2jrcHdfelcYPMZTp+Xksy
ImpHash	39a85c613973fb6d8d786a3deb3c0666

File Reputation Information

»

Severity	Blacklisted
First Seen	2019-03-12 20:57 (UTC+1)
Last Seen	2019-03-22 02:01 (UTC+1)
Names	Win32.Trojan.Lockergoga
Families	Lockergoga
Classification	Trojan

PE Information

»

Image Base	0x400000
Entry Point	0x499bcb
Size Of Code	0xe4200
Size Of Initialized Data	0x4de00
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2019-03-09 17:50:30+00:00

Version Information (8)

»

CompanyName	ALISA LTD
FileDescription	Background Tasks Host
FileVersion	1.4.4.0
InternalName	zzbdrimp
LegalCopyright	Copyright (C) ALISA LTD 2019
OriginalFilename	zzbdrimp
ProductName	Service zzbdrimp
ProductVersion	1.4.4.0

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0xe4122	0xe4200	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.66
.rdata	0x4e6000	0x33f9a	0x34000	0xe4600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.01
.data	0x51a000	0xb6dc	0x9000	0x118600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	4.91
.rsrc	0x526000	0x508	0x600	0x121600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	3.72
.reloc	0x527000	0xdfd0	0xe000	0x121c00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.56

Imports (6)

»

SHLWAPI.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
PathIsNetworkPathA	0x0	0x4e62c0	0x119188	0x117788	0x60

KERNEL32.dll (157)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
OutputDebugStringA	0x0	0x4e603c	0x118f04	0x117504	0x389
InterlockedDecrement	0x0	0x4e6040	0x118f08	0x117508	0x2eb
TerminateProcess	0x0	0x4e6044	0x118f0c	0x11750c	0x4c0
WaitForSingleObject	0x0	0x4e6048	0x118f10	0x117510	0x4f9
GetCurrentThreadId	0x0	0x4e604c	0x118f14	0x117514	0x1c5
GetSystemDirectoryW	0x0	0x4e6050	0x118f18	0x117518	0x270
FreeEnvironmentStringsW	0x0	0x4e6054	0x118f1c	0x11751c	0x161
DuplicateHandle	0x0	0x4e6058	0x118f20	0x117520	0xe8
GetModuleHandleA	0x0	0x4e605c	0x118f24	0x117524	0x215
GetLogicalDriveStringsW	0x0	0x4e6060	0x118f28	0x117528	0x208
MultiByteToWideChar	0x0	0x4e6064	0x118f2c	0x11752c	0x367
Sleep	0x0	0x4e6068	0x118f30	0x117530	0x4b2
FormatMessageW	0x0	0x4e606c	0x118f34	0x117534	0x15e
Wow64RevertWow64FsRedirection	0x0	0x4e6070	0x118f38	0x117538	0x517
GetLastError	0x0	0x4e6074	0x118f3c	0x11753c	0x202
SetEvent	0x0	0x4e6078	0x118f40	0x117540	0x459
TlsAlloc	0x0	0x4e607c	0x118f44	0x117544	0x4c5
WaitForSingleObjectEx	0x0	0x4e6080	0x118f48	0x117548	0x4fa
CloseHandle	0x0	0x4e6084	0x118f4c	0x11754c	0x52
GetSystemInfo	0x0	0x4e6088	0x118f50	0x117550	0x273
GetWindowsDirectoryW	0x0	0x4e608c	0x118f54	0x117554	0x2af
GetProcAddress	0x0	0x4e6090	0x118f58	0x117558	0x245
LocalFree	0x0	0x4e6094	0x118f5c	0x11755c	0x348
GetCurrentProcessId	0x0	0x4e6098	0x118f60	0x117560	0x1c1
CreateProcessW	0x0	0x4e609c	0x118f64	0x117564	0xa8
WideCharToMultiByte	0x0	0x4e60a0	0x118f68	0x117568	0x511
CreateProcessA	0x0	0x4e60a4	0x118f6c	0x11756c	0xa4
InterlockedIncrement	0x0	0x4e60a8	0x118f70	0x117570	0x2ef
TlsFree	0x0	0x4e60ac	0x118f74	0x117574	0x4c6
FormatMessageA	0x0	0x4e60b0	0x118f78	0x117578	0x15d
CreateEventA	0x0	0x4e60b4	0x118f7c	0x11757c	0x82
GetEnvironmentStringsW	0x0	0x4e60b8	0x118f80	0x117580	0x1da
GetDriveTypeW	0x0	0x4e60bc	0x118f84	0x117584	0x1d3
GetExitCodeProcess	0x0	0x4e60c0	0x118f88	0x117588	0x1df
ReadFile	0x0	0x4e60c4	0x118f8c	0x11758c	0x3c0
GetFileAttributesExW	0x0	0x4e60c8	0x118f90	0x117590	0x1e7
FreeLibrary	0x0	0x4e60cc	0x118f94	0x117594	0x162
LoadLibraryExW	0x0	0x4e60d0	0x118f98	0x117598	0x33e
CreateMutexA	0x0	0x4e60d4	0x118f9c	0x11759c	0x9b
ReleaseMutex	0x0	0x4e60d8	0x118fa0	0x1175a0	0x3fa
Wow64DisableWow64FsRedirection	0x0	0x4e60dc	0x118fa4	0x1175a4	0x513
HeapFree	0x0	0x4e60e0	0x118fa8	0x1175a8	0x2cf
OpenProcess	0x0	0x4e60e4	0x118fac	0x1175ac	0x380
HeapAlloc	0x0	0x4e60e8	0x118fb0	0x1175b0	0x2cb
GetProcessHeap	0x0	0x4e60ec	0x118fb4	0x1175b4	0x24a
GetEnvironmentVariableW	0x0	0x4e60f0	0x118fb8	0x1175b8	0x1dc
GetCurrentDirectoryW	0x0	0x4e60f4	0x118fbc	0x1175bc	0x1bf
CreateFileW	0x0	0x4e60f8	0x118fc0	0x1175c0	0x8f
DeleteFileW	0x0	0x4e60fc	0x118fc4	0x1175c4	0xd6
FindClose	0x0	0x4e6100	0x118fc8	0x1175c8	0x12e
FindFirstFileW	0x0	0x4e6104	0x118fcc	0x1175cc	0x139
FindNextFileW	0x0	0x4e6108	0x118fd0	0x1175d0	0x145
GetFileAttributesW	0x0	0x4e610c	0x118fd4	0x1175d4	0x1ea
RemoveDirectoryW	0x0	0x4e6110	0x118fd8	0x1175d8	0x403
SetEndOfFile	0x0	0x4e6114	0x118fdc	0x1175dc	0x453
SetFileAttributesW	0x0	0x4e6118	0x118fe0	0x1175e0	0x461
SetFilePointerEx	0x0	0x4e611c	0x118fe4	0x1175e4	0x467
DeviceIoControl	0x0	0x4e6120	0x118fe8	0x1175e8	0xdd
GetModuleHandleW	0x0	0x4e6124	0x118fec	0x1175ec	0x218
MoveFileExW	0x0	0x4e6128	0x118ff0	0x1175f0	0x360
SetLastError	0x0	0x4e612c	0x118ff4	0x1175f4	0x473
GetCurrentThread	0x0	0x4e6130	0x118ff8	0x1175f8	0x1c4
GetThreadTimes	0x0	0x4e6134	0x118ffc	0x1175fc	0x291
QueryPerformanceCounter	0x0	0x4e6138	0x119000	0x117600	0x3a7
QueryPerformanceFrequency	0x0	0x4e613c	0x119004	0x117604	0x3a8
SetStdHandle	0x0	0x4e6140	0x119008	0x117608	0x487
FindNextFileA	0x0	0x4e6144	0x11900c	0x11760c	0x143
FindFirstFileExA	0x0	0x4e6148	0x119010	0x117610	0x133
GetTimeZoneInformation	0x0	0x4e614c	0x119014	0x117614	0x298
HeapSize	0x0	0x4e6150	0x119018	0x117618	0x2d4
ReleaseSemaphore	0x0	0x4e6154	0x11901c	0x11761c	0x3fe
GetCurrentProcess	0x0	0x4e6158	0x119020	0x117620	0x1c0
GetCommandLineW	0x0	0x4e615c	0x119024	0x117624	0x187
MapViewOfFileEx	0x0	0x4e6160	0x119028	0x117628	0x358
GetTickCount	0x0	0x4e6164	0x11902c	0x11762c	0x293
OpenFileMappingA	0x0	0x4e6168	0x119030	0x117630	0x378
CreateFileMappingA	0x0	0x4e616c	0x119034	0x117634	0x89
SwitchToThread	0x0	0x4e6170	0x119038	0x117638	0x4bc
UnmapViewOfFile	0x0	0x4e6174	0x11903c	0x11763c	0x4d6
InterlockedExchange	0x0	0x4e6178	0x119040	0x117640	0x2ec
AreFileApisANSI	0x0	0x4e617c	0x119044	0x117644	0x15
WriteConsoleW	0x0	0x4e6180	0x119048	0x117648	0x524
OpenMutexA	0x0	0x4e6184	0x11904c	0x11764c	0x37c
SetEnvironmentVariableA	0x0	0x4e6188	0x119050	0x117650	0x456
GetOEMCP	0x0	0x4e618c	0x119054	0x117654	0x237
GetExitCodeThread	0x0	0x4e6190	0x119058	0x117658	0x1e0
GetNativeSystemInfo	0x0	0x4e6194	0x11905c	0x11765c	0x225
GetStringTypeW	0x0	0x4e6198	0x119060	0x117660	0x269
EnterCriticalSection	0x0	0x4e619c	0x119064	0x117664	0xee
LeaveCriticalSection	0x0	0x4e61a0	0x119068	0x117668	0x339
TryEnterCriticalSection	0x0	0x4e61a4	0x11906c	0x11766c	0x4ce
DeleteCriticalSection	0x0	0x4e61a8	0x119070	0x117670	0xd1
InitializeCriticalSectionAndSpinCount	0x0	0x4e61ac	0x119074	0x117674	0x2e3
CreateEventW	0x0	0x4e61b0	0x119078	0x117678	0x85
TlsGetValue	0x0	0x4e61b4	0x11907c	0x11767c	0x4c7
TlsSetValue	0x0	0x4e61b8	0x119080	0x117680	0x4c8
GetSystemTimeAsFileTime	0x0	0x4e61bc	0x119084	0x117684	0x279
EncodePointer	0x0	0x4e61c0	0x119088	0x117688	0xea
DecodePointer	0x0	0x4e61c4	0x11908c	0x11768c	0xca
GetCPInfo	0x0	0x4e61c8	0x119090	0x117690	0x172
CompareStringW	0x0	0x4e61cc	0x119094	0x117694	0x64
LCMapStringW	0x0	0x4e61d0	0x119098	0x117698	0x32d
GetLocaleInfoW	0x0	0x4e61d4	0x11909c	0x11769c	0x206
InitializeSListHead	0x0	0x4e61d8	0x1190a0	0x1176a0	0x2e7
IsProcessorFeaturePresent	0x0	0x4e61dc	0x1190a4	0x1176a4	0x304
UnhandledExceptionFilter	0x0	0x4e61e0	0x1190a8	0x1176a8	0x4d3
SetUnhandledExceptionFilter	0x0	0x4e61e4	0x1190ac	0x1176ac	0x4a5
IsDebuggerPresent	0x0	0x4e61e8	0x1190b0	0x1176b0	0x300
GetStartupInfoW	0x0	0x4e61ec	0x1190b4	0x1176b4	0x263
CreateTimerQueue	0x0	0x4e61f0	0x1190b8	0x1176b8	0xbc
SignalObjectAndWait	0x0	0x4e61f4	0x1190bc	0x1176bc	0x4b0
CreateThread	0x0	0x4e61f8	0x1190c0	0x1176c0	0xb5
SetThreadPriority	0x0	0x4e61fc	0x1190c4	0x1176c4	0x499
GetThreadPriority	0x0	0x4e6200	0x1190c8	0x1176c8	0x28e
GetLogicalProcessorInformation	0x0	0x4e6204	0x1190cc	0x1176cc	0x20a
CreateTimerQueueTimer	0x0	0x4e6208	0x1190d0	0x1176d0	0xbd
ChangeTimerQueueTimer	0x0	0x4e620c	0x1190d4	0x1176d4	0x48
DeleteTimerQueueTimer	0x0	0x4e6210	0x1190d8	0x1176d8	0xda
GetNumaHighestNodeNumber	0x0	0x4e6214	0x1190dc	0x1176dc	0x229
GetProcessAffinityMask	0x0	0x4e6218	0x1190e0	0x1176e0	0x246
SetThreadAffinityMask	0x0	0x4e621c	0x1190e4	0x1176e4	0x490
RegisterWaitForSingleObject	0x0	0x4e6220	0x1190e8	0x1176e8	0x3f5
UnregisterWait	0x0	0x4e6224	0x1190ec	0x1176ec	0x4da
FreeLibraryAndExitThread	0x0	0x4e6228	0x1190f0	0x1176f0	0x163
GetModuleFileNameW	0x0	0x4e622c	0x1190f4	0x1176f4	0x214
GetVersionExW	0x0	0x4e6230	0x1190f8	0x1176f8	0x2a4
VirtualAlloc	0x0	0x4e6234	0x1190fc	0x1176fc	0x4e9
VirtualProtect	0x0	0x4e6238	0x119100	0x117700	0x4ef
VirtualFree	0x0	0x4e623c	0x119104	0x117704	0x4ec
InterlockedPopEntrySList	0x0	0x4e6240	0x119108	0x117708	0x2f0
InterlockedPushEntrySList	0x0	0x4e6244	0x11910c	0x11770c	0x2f1
InterlockedFlushSList	0x0	0x4e6248	0x119110	0x117710	0x2ee
QueryDepthSList	0x0	0x4e624c	0x119114	0x117714	0x39e
UnregisterWaitEx	0x0	0x4e6250	0x119118	0x117718	0x4db
LoadLibraryW	0x0	0x4e6254	0x11911c	0x11771c	0x33f
RtlUnwind	0x0	0x4e6258	0x119120	0x117720	0x418
RaiseException	0x0	0x4e625c	0x119124	0x117724	0x3b1
GetCommandLineA	0x0	0x4e6260	0x119128	0x117728	0x186
ExitThread	0x0	0x4e6264	0x11912c	0x11772c	0x11a
GetModuleHandleExW	0x0	0x4e6268	0x119130	0x117730	0x217
ExitProcess	0x0	0x4e626c	0x119134	0x117734	0x119
GetModuleFileNameA	0x0	0x4e6270	0x119138	0x117738	0x213
GetStdHandle	0x0	0x4e6274	0x11913c	0x11773c	0x264
WriteFile	0x0	0x4e6278	0x119140	0x117740	0x525
GetACP	0x0	0x4e627c	0x119144	0x117744	0x168
GetFileType	0x0	0x4e6280	0x119148	0x117748	0x1f3
FlushFileBuffers	0x0	0x4e6284	0x11914c	0x11774c	0x157
GetConsoleCP	0x0	0x4e6288	0x119150	0x117750	0x19a
GetConsoleMode	0x0	0x4e628c	0x119154	0x117754	0x1ac
HeapReAlloc	0x0	0x4e6290	0x119158	0x117758	0x2d2
GetDateFormatW	0x0	0x4e6294	0x11915c	0x11775c	0x1c8
GetTimeFormatW	0x0	0x4e6298	0x119160	0x117760	0x297
IsValidLocale	0x0	0x4e629c	0x119164	0x117764	0x30c
GetUserDefaultLCID	0x0	0x4e62a0	0x119168	0x117768	0x29b
EnumSystemLocalesW	0x0	0x4e62a4	0x11916c	0x11776c	0x10f
ReadConsoleW	0x0	0x4e62a8	0x119170	0x117770	0x3be
IsValidCodePage	0x0	0x4e62ac	0x119174	0x117774	0x30a

SHELL32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SHGetFolderPathW	0x0	0x4e62b4	0x11917c	0x11777c	0xc3
SHGetFileInfoW	0x0	0x4e62b8	0x119180	0x117780	0xbd

ole32.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CoCreateInstance	0x0	0x4e62d4	0x11919c	0x11779c	0x10
CoInitialize	0x0	0x4e62d8	0x1191a0	0x1177a0	0x3e
CoUninitialize	0x0	0x4e62dc	0x1191a4	0x1177a4	0x6c

ADVAPI32.dll (14)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
LookupPrivilegeValueW	0x0	0x4e6000	0x118ec8	0x1174c8	0x197
CryptGenRandom	0x0	0x4e6004	0x118ecc	0x1174cc	0xc1
CryptReleaseContext	0x0	0x4e6008	0x118ed0	0x1174d0	0xcb
CryptAcquireContextA	0x0	0x4e600c	0x118ed4	0x1174d4	0xb0
CloseServiceHandle	0x0	0x4e6010	0x118ed8	0x1174d8	0x57
OpenSCManagerW	0x0	0x4e6014	0x118edc	0x1174dc	0x1f9
ControlService	0x0	0x4e6018	0x118ee0	0x1174e0	0x5c
EnumDependentServicesW	0x0	0x4e601c	0x118ee4	0x1174e4	0xfd
OpenServiceW	0x0	0x4e6020	0x118ee8	0x1174e8	0x1fb
QueryServiceStatusEx	0x0	0x4e6024	0x118eec	0x1174ec	0x229
AdjustTokenPrivileges	0x0	0x4e6028	0x118ef0	0x1174f0	0x1f
OpenProcessToken	0x0	0x4e602c	0x118ef4	0x1174f4	0x1f7
SetSecurityDescriptorDacl	0x0	0x4e6030	0x118ef8	0x1174f8	0x2b6
InitializeSecurityDescriptor	0x0	0x4e6034	0x118efc	0x1174fc	0x177

WS2_32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WSACleanup	0x74	0x4e62c8	0x119190	0x117790	-
WSAStartup	0x73	0x4e62cc	0x119194	0x117794	-

Digital Signatures (3)

»

Certificate: ALISA LTD

»

Issued by	ALISA LTD
Parent Certificate	Sectigo RSA Code Signing CA
Country Name	GB
Valid From	2019-02-22 00:00:00+00:00
Valid Until	2020-02-21 23:59:59+00:00
Algorithm	sha256_rsa
Serial Number	5D A1 73 EB 1A C7 63 40 AC 05 8E 1F F4 BF 5E 1B
Thumbprint	AC B3 8D 45 10 8C 4F 0C 88 94 04 06 46 13 7C 95 E9 BB 39 D8

Certificate: Sectigo RSA Code Signing CA

»

Issued by	Sectigo RSA Code Signing CA
Parent Certificate	USERTrust RSA Certification Authority
Country Name	GB
Valid From	2018-11-02 00:00:00+00:00
Valid Until	2030-12-31 23:59:59+00:00
Algorithm	sha384_rsa
Serial Number	1D A2 48 30 6F 9B 26 18 D0 82 E0 96 7D 33 D3 6A
Thumbprint	94 C9 5D A1 E8 50 BD 85 20 9A 4A 2A F3 E1 FB 16 04 F9 BB 66

Certificate: USERTrust RSA Certification Authority

»

Issued by	USERTrust RSA Certification Authority
Country Name	US
Valid From	2000-05-30 10:48:38+00:00
Valid Until	2020-05-30 10:48:38+00:00
Algorithm	sha384_rsa
Serial Number	13 EA 28 70 5B F4 EC ED 0C 36 63 09 80 61 43 36
Thumbprint	EA B0 40 68 9A 0D 80 5B 5D 6F D6 54 FC 16 8C FF 00 B7 8B E3

C:\588bce7c90097ed212\1035\LocalizedData.xml.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	75.36 KB
MD5	a01e82d9b401d5d2a3d6573f3fd21c78
SHA1	0275467fe16ec200e6fae9a17dcb5c02296769c1
SHA256	906c9cf141af4e2c8ca5c61e9c306da9a9737a91bfdcc75f9d4987939e1109be
SSDeep	1536:FMaMNFMU76q+alZqlUv9B6ChfqVwoJo7BogsYY+4PftJ7qDy:FhMDMu6W9ffqVly+h+AVJ+Dy

C:\588bce7c90097ed212\Client\Parameterinfo.xml.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	197.21 KB
MD5	7167a128706e0c7bcf12c636006371aa
SHA1	1f669a65f4c6cc7e50c046c7afe3690503d54d5d
SHA256	bb59a94f12e08217a86bbf7402b37fe056f9752e79d0250c9babbbfff5310961
SSDeep	3072:MsGYiuk1G/0l7nmlEbkMrcWMlMEHrxWxq2yLexaYkpHYhW46Tf33Tj0XtVAZMA:PYn/keVmMEVWq2yLedAb33X0XtmeA

C:\Boot\hr-HR\bootmgr.exe.mui.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	74.99 KB
MD5	5aacbdead6ab7243dca92a3c72b21ed4
SHA1	71bbbad89709177f7e141c8282c30eb4d9d5c79b
SHA256	13fe22637b0d4b529a2809acfa66e0bb576bcaba49e149ff51968df17d810882
SSDeep	1536:QUDBSdm6j86Nguc8WhQcvgYXQX7wzW20blCAn4d81VjXuvQ83Gj30RLoxN8:QUQtj86NxdT1XUzW20wAn4dmw/u30RLV

C:\Boot\ro-RO\bootmgr.exe.mui.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	74.49 KB
MD5	24221727da85ae61468b1618b052444a
SHA1	33d1f625a7b3703bcd2ca0ba14b9e09921bd8554
SHA256	97d17287f1e052028beb2bcc27aee9cdcd523c2ef0f7ad8fb87264b7cfe079bc
SSDeep	1536:AWKaG3fl0ZVnBvZZNlscRC1NqFbMYCJAkOK8n8fB8uf:TPwWZVNRRy2bdCJAkdRfB/f

C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	5a2a9923e4dc4fa2253d248093b8cf00
SHA1	10fba45c38e2310923c004248450bacfeaa948db
SHA256	f09545ee411b12c64036bc8e4e52402b35d6fcd52e9a77d980ab1c9cb4514f41
SSDeep	1536:lLmxRrYL/5Yhs40dC4iP4v/u44kLGV5Rj2gUKc1zWyBf5Vxr:46WhwdC4iP4Hu445Vfj2drHBfl

C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	5bd7b65603e116b007517207d1ed0535
SHA1	1e3dae5c5606ea58a79634520c68afac0139fe0e
SHA256	9b96ee4e2a5899552e950501e013aad5177e413e22ebdb9efb90e3c76a3e2b66
SSDeep	1536:d09gvFsC7K7WSnEIoYyBv4xYWX1zGKUmM6:d09gvFsC27VDKAxnFfn

C:\Boot\zh-TW\bootmgr.exe.mui.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	62.49 KB
MD5	7bd7e1f032a222c3e55fa4bd3db38c47
SHA1	385685d9a0794bba8f46d0744d7b1578a136b25b
SHA256	c949fa5ef906bf1041df34e979aa9dbe7f66746042b39e9b8adcffa5b1460fbc
SSDeep	1536:sL/d6aqCl/1LQL/iPXEIqPSAVks4GZAPctPOKSu:4/P7hY/2XEIU3Vki

C:\Boot\zh-CN\bootmgr.exe.mui.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	62.49 KB
MD5	e66767a71a7a195040ec5c09055937ee
SHA1	c5ca7f32dc9887a7c29cc26613b471587b611644
SHA256	24b465fe8f2dcf62fdbb9656f2ca40173d811d27719bb17d7db5fd060f07cb20
SSDeep	1536:1lv49pNGOaTXeYh8UYZtBEKQ/tVt9tNS2kgmNrbHL8H:v4H8XzqUOtBwlV7tNSDNrbHLi

C:\Boot\es-ES\memtest.exe.mui.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	45.05 KB
MD5	8a83aad2b28c1f3655810d174786d3a1
SHA1	da7889cb8aaa20f4d8f7307f966219e3dfc0b0c6
SHA256	c7a37f97ec140071dee281e9d5fe4be0a881d833983a37cabd2976cf636a14d6
SSDeep	768:ZTEdbn5WaqBOcTy75jLRxHbcU+vKS71VfbBffCvs/L24lc4Bs7+Uq1riKP63zc44:+5nLqI75Rx4U+SSZxbBf6k/L24lc7EY8

C:\588bce7c90097ed212\1031\SetupResources.dll.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	18.48 KB
MD5	b60ada9e37f84c3d7596bb15f39d8a2d
SHA1	5fbecefb4ebe83ceaa62de23a04497e019723289
SHA256	8b1e42bc175eedeb1cd5a3f89e77845d544d608507e3334a977825e44d62a1e6
SSDeep	384:sSmB1r6TnWwVEbpmt0EOyRmx1B5q5FOgqR4+GG4SMjaI5e1shMsyFPL+1:LQZsnfh0TBx/exEP94Zze1sh3SLk

C:\588bce7c90097ed212\1046\SetupResources.dll.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	17.98 KB
MD5	61c0f69b18931f02a6320146be2ad7f0
SHA1	48555bd97dc8d896c0cc4f8e8ddb701bb2c0d602
SHA256	1b956f37a18a5a3de8a34507f786d6175853053582622201242c53293be7b6db
SSDeep	384:Hd5ZkSDO65E6NFs/u/bj3GbJvJ23ZX6VHUoNlnpQ5OtZlWyFxDF:H/DOb67wuDj3GFvYg1JmOt20DF

C:\588bce7c90097ed212\1029\SetupResources.dll.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	17.98 KB
MD5	a1e355ea0e2c59e8f24dabb70b3bc84f
SHA1	c983630941fe732e27464b9d21dd675fc5ac211b
SHA256	db1cfdbc69a77e3d7315ece0aa905f743a94fcdb60ce5d318bcc14bb734ea376
SSDeep	384:cQVkO2FtsyHyQc4HcB1SbgLU5+zhApMvH77mSWgkbFjL2yFbh:cQVkBtsySQc4SS0sizCSr+j1N

C:\588bce7c90097ed212\1036\eula.rtf.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	3.59 KB
MD5	f159fb3b14bd60df135c374473335aa5
SHA1	5c365e7e64ba246a9b69988d34bd5ed9e4b8b564
SHA256	ff2d0908cc938d86da782efca16ea4d6857f17c48d4ef7a6fb1d0d6c844d70f5
SSDeep	96:1HUls7saRgk6wFeThed098aUje7Xzg+sSLkA7eO3FX+tMsBo6:al2saRjucaUje7XzgtSZyOVqo6

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	12.30 KB
MD5	33663b04712cbe463737449d2b73ffd0
SHA1	0850f2358edd5d8695054e87f9d98c4a6639a55f
SHA256	3cc60c29727fd137a73b652264bb1c03d10411e8416da683653e7c4c198cdf09
SSDeep	192:4NBtXMSlIgEnkxuRKaB1wU513aOY6wU5GTGeq6+nvknNE/JcBYaCAe6plits:W3X3GKuRVB1L5k+wUC/q6+nDcJLhuts

C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\110\SQLDumper.exe.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	108.22 KB
MD5	917e321b5b355d2d6cb31e713730841d
SHA1	119af296148878628d74f04ea4decc46e451d0db
SHA256	531e0073a76a3551423ce2aab8d4abb0f4427c371b13067d06b972a08b41364d
SSDeep	3072:lvRtZxlMEhTimocpn0NWPAuTR/YRDoF/39FMYgkba:lrZDT3RpnkWPvd/wDoN39FV2

C:\Program Files\Microsoft Office\root\VFS\SystemX86\vccorlib140.dll.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	251.84 KB
MD5	91bc52836103cad9fff8a07ebb2ee39f
SHA1	63813d16e3fb13d4dc9e4a7b4426b92cbe90ae08
SHA256	18f6d6f9af33a476130f293058fb053f2702a547197dbc694dac2720ef3224aa
SSDeep	6144:tGml8ZFf51mMjLpiXOLb4aGzQYSDc0d98alzUkFkm:tXl6ZPzcOwaGzRmfd98alzvd

C:\Program Files\rempl\Unlock.xml.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.65 KB
MD5	3915dc44ddcc29d23bdb02d34e4709ca
SHA1	c33b5d16a98da717cafd384f0a06aa39ab7d3e33
SHA256	72dca340c00dbfd602b8cb75e175efc63815b73001ad2abe6e76cf1b537e3442
SSDeep	24:UH2CWNqXKk+kOTRDbPbmgv6BVHZrWktSNiwAQies90v6kc0gGbgb30pBEqQ3zJWW:e2C7XOTxjyxZr3SNfk0v697b3TU1mB

C:\Boot\Fonts\malgun_boot.ttf.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	173.40 KB
MD5	c8519c76956fedb44ac0bd690f1f0db8
SHA1	111ba61840e588a5d9a0b774cb5ab1f936b557e6
SHA256	0253b417a3501bb95dd75fa051d9dec615b827e43dfc82794f3f35d6a9ff610c
SSDeep	3072:+o0NJG0XZoDzS7vByuVlEwYH/yILcZsCY8DbcaK3jXIh/a78GCKpTxxo:+o0LG0XZZyaYfyILK06K8hy7zCoS

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.locked

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.25 MB
MD5	e8ecba79e88770107e02d59c312c7359
SHA1	f2b1f962f20306ad7b97ad9d96f8129b3ecde8a9
SHA256	be8d4e4ce74efc8c5c95e9c72e007dacd6ba353c59450e0cef10f80992a2510f
SSDeep	49152:4b5/Hj4Gp+oSqlX2MJyss4qreS07WLrgdE8TuFB4WXBBm8RDVrg4:sPPqqlGJFndBLrg+8epCwg4

C:\Users\Public\Desktop\README_LOCKED.txt

Dropped File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.39 KB
MD5	cf3282d6ad1dce954e472722979f3bde
SHA1	a2a9501fe1c525702ec428b8c4aa35be954424b6
SHA256	b686c88bce6629088ce1044b30ad1d5b978fd754601b8b463bc1f611b01d05d7
SSDeep	24:KaEhwBlovLLI5lgbspz6wT5Ud3xHH+++y3T6kQHKMyqYmVUI+O:KwBlovfIbgYpsHkGhmVUIp

C:\588bce7c90097ed212\1025\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	72.62 KB
MD5	8255af954d5339b86fd2967fe2c12a35
SHA1	d741d8377c2e14996a820b155ba7fab6098b6fca
SHA256	b11b282d34042e5c5904708f79630c2b83cf55d1c2438514ec91c418fd154692
SSDeep	1536:fvNH7gH4KLDI+QChFnjzNjeYgrXeBXeA24KkXpuULNE6NFV:fvxkiCjvNMrXeBeAznpuUNV

C:\588bce7c90097ed212\1049\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	79.72 KB
MD5	24688cb5f8891709f6459e3a12ca243c
SHA1	6df2f267c985828fe5181ac73fc2461528ea72cf
SHA256	fa3b60819a23169467277152de64083300dada373539b9726563686d8a0a957a
SSDeep	1536:kXIRRiuX9qJGyBLjRNkFaTaXN43+i8bKNPZ1275ghgF6zryWJlyKZ3ZnOK:kXeiuX4gwLdM9X3i8bKpc5g/zryWJlys

C:\588bce7c90097ed212\1036\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	81.16 KB
MD5	33491937002243eb17a5e6ec70dd9c1b
SHA1	10602d61916b1bf1fd59f7fc6c7936d1c66874f9
SHA256	e99143e7c6b3ed28139cfb522ea4b6bd54dea5a69840b691e6fc44b02f53f514
SSDeep	1536:TPEyaC+mz7kKiS2GnAGAVod6ebYjIAl+maCHBmttiiskg1xDzWv2acJgjAHB:TP4m2Yuo6gAl+KEttiisZPetcJgjK

C:\588bce7c90097ed212\1029\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	79.22 KB
MD5	2333489f0911ef6138f1297d21985663
SHA1	6df6a644604aa5d54162717975ebc8731048e158
SHA256	e074ac554e3c815c4113f45e60e0114e10ce6f6c524e606af1226be169d3a7f8
SSDeep	1536:DYpFk0uzSaLysqCelMxKa6DyVmnsbwpx1ojfkX652Jq7h7XcXOv:DY3qzpLynCelMx96eAsljfk3M9CY

C:\588bce7c90097ed212\UiInfo.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	38.13 KB
MD5	6468ecea7f1dedc8f46f57c9843da913
SHA1	0fb9e737c44352b407ec76d2a907b6e26ad61be4
SHA256	6fbfa21970183050bd207623a6331b32be9467a3edfeb10f3f4dc907fad4bdfb
SSDeep	768:Urs3fR7MC3bdU+x0YK2E+HSqbarfJN8MWQIOOnNXPtyVLqwZ1k4eOx3X:UrsaCxU+aYK2KZXORGqDQn

C:\588bce7c90097ed212\Strings.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	13.90 KB
MD5	af2aace707554526756144e6880c6fc4
SHA1	5aa793d59818a949a606552c46bdb05c9d1b36e4
SHA256	875972973af30522c536c9583d7e0c822dceeb68480d303aff052471d18ef671
SSDeep	384:y8nnNOYoSV5eduZBA77NAYteMAiiFRBqm/y402:3nQYoSzeduZBW7+YtenJKe

C:\588bce7c90097ed212\1046\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	78.99 KB
MD5	1edaad5d067b17b019b1acd526ab0481
SHA1	456b931b86c5164ed70a86bfa2e8a29ebb2c119f
SHA256	ede2a0e030adeafff0efec390729a7b907af69e534f63288c81540e25265d9f5
SSDeep	1536:xB1sajh8YPjK0HTAw7DpscxTZwPpIVlosGdCaJXf/mLGc7RqHI:xbfPm0HTTfdwmTGEUHmLGJI

C:\588bce7c90097ed212\1033\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	75.57 KB
MD5	5745a34d7acada4c7c0c5aba4161e872
SHA1	d74c4b41d046f352ad9ba5a3ee8b91658acbfb22
SHA256	59b400a5c4ded0279ee8af6f0817a5f20d99df97d44cb283a4f398384c73e5a4
SSDeep	1536:fAzF58zdIv6ECBE3GrT8KBUvayAFg5QbuvilTFQlTEadyAl77Hesp1cR7:fqbCECBy4BUvzA+Qbuvw6dEm+sM

C:\588bce7c90097ed212\1044\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	77.58 KB
MD5	ae94d2e65d429d27159a1fa5f1450cad
SHA1	9a815cdd6e08370510e758c18fa1dfe8f23ccd17
SHA256	e5d1ae55a9e2e4c6bde5d2ad45728bf4aa45f1b1ffe410aff72753e1e0d44560
SSDeep	1536:RYj/IrRsckHF9ScZ5i4Fm90qfTAwVG764gJ6UaQk2cY9lgABU3KwfBr/BH:MYeNbdq4AOkTA4GW4cVaQkTClgABU6wD

C:\588bce7c90097ed212\1045\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	80.59 KB
MD5	cc01c841d4dca719904ad5df11ed2e9f
SHA1	223eeb4e1a69e1a239233586d4053f5b6c588102
SHA256	a4d52af905292382815f4088dfc32c9d57570dd9f5233ee049342914a615900f
SSDeep	1536:/Dt6iNXCG46DmDbi2SWSGcn06hM6si9JoPGQQfRx6r+Xwb:pTSN6DmDbi21U06hNsi2GVfRs+o

C:\588bce7c90097ed212\ParameterInfo.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	265.81 KB
MD5	c6473ba5b7e2309c15d808ff066684de
SHA1	2de6cda5f6620bb857c800c1e8b56e19ae8d93c7
SHA256	224133c611a3a5e135ed88286e0cea6596d9a7b8df10a908a64558025f3d0afa
SSDeep	6144:QeEuc8zdULq59s5SJCvO8/Z25DqbbRPodjz6PwYfxWEzjJS3dEBa2kjZf:RJzmLq5ehvzM5eHpyGPwYFLBMZf

C:\588bce7c90097ed212\1028\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	59.54 KB
MD5	c7936c9373bc22e66c02458c12e10086
SHA1	ef92165b906905b43314b9a6599207646f541100
SHA256	9bcd379087742b00a681cade23bcaa06028c2a1cc118a39b777261db71706029
SSDeep	1536:Fmavz48xbcS6xwHr8KdqncBqiN7a01jyM+XBKW3fPkqTDziwFY0sS:tv08xbcVcEiNPdyiW3XTD9Y0t

C:\588bce7c90097ed212\1042\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	63.85 KB
MD5	5608d3bf4f4f17efc774889223a1ff41
SHA1	4d71b97a165a4be971126e5eed835c496a76846b
SHA256	753b0ed7710d91c61a8d8f1f42586eeffcbb248f110e4550673eba4997e5a893
SSDeep	1536:frkWRalvQhUo7W/X3JVcbgNlTgvVEnDNMCIel2E:TkWRair7W/X3JVwWe+hMCIi7

C:\588bce7c90097ed212\1032\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	84.41 KB
MD5	4be8f479b9eb2c621c579c052a5cb41a
SHA1	27efa77cb108865148f1a73e400b62aff63bd56d
SHA256	b723ab345cb0ce9ce63d832be073341bbe1ed2f9b3244838a925f82bc5957a57
SSDeep	1536:NlTYg7K1AnM5G+Ib2SZIvtgL2qDVZtnTxEWjIDBQMCxovY93sE2SKnQ1Er5V5M:rTJ7aEDhK1gLPZDTy5DwSGiHPtM

C:\588bce7c90097ed212\1043\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	77.91 KB
MD5	7446c682ef180107de74a29c2af016be
SHA1	990303b888dd22ce632cdb5a3aa5c77d1b8d09e1
SHA256	5e30207b410fc7d2e66405ddd817f289862c2aee9615e82ab9653b3ecf23b579
SSDeep	1536:t9GenFn3NknAITUs3BveV13iufxkGKNqAleDXGiGP/s4o80N:20cA+B3Bv23iuf6GQqLUPU4wN

C:\588bce7c90097ed212\Extended\UiInfo.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	38.28 KB
MD5	8b954c30e25a0925da6804f39b2d3173
SHA1	09fcd9dc028885c6f2faf755643dc372d2951d41
SHA256	39de200bf6a88c1c0316aabbab0de38a10625695bbb2eac9606c8900b426636f
SSDeep	768:4gsnoTs39SE2zpayJooLY+gzw3mTTJuLG89NksGHywSQ3iDPBEXX:4gu9SE8ioLY+iTTJu8sGS0SDPBEX

C:\588bce7c90097ed212\Extended\Parameterinfo.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	91.27 KB
MD5	3786fb3e70d55ee03e11f565a6afde7b
SHA1	f86fb44e15376484735019759551c4527260e32b
SHA256	e0aaa3bc6344f60803c3f8391ec9d31550f60ac775efdddb186667fa97ca46db
SSDeep	1536:DQFT+lV57ZwG79g1TLP50TtvVE80bjoGKP2yp0RNkeiQ2VJSJsmMzFa:HVFZw//PmSnqZpgNklJasmMzFa

C:\588bce7c90097ed212\1041\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	66.77 KB
MD5	bdd8833a4905912bc486d6e1c469d3ac
SHA1	ea3aa3005ceece13b1fa674e15ca870b0e85d53f
SHA256	edc343c01ada78dd601cc6eff5a26f602bbd448598dd911d011cd2dd2b380f99
SSDeep	1536:ej6SUE6xSnj8ci8jtv3OjZ1F1cbIBLOXvwBhjOW3cVErRXG:2eSnj8cNjtvejZ3eM4XvwPC2l2

C:\588bce7c90097ed212\1040\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	78.33 KB
MD5	fc93abdefb5f18cdbe35c074c5ff56bc
SHA1	b1c1557b310ab055150414b543ef9051da4640e7
SHA256	a032bbefb832de9699cec00ab7d3aea5d96865167c551e77d9bac48a14072fd6
SSDeep	1536:6HHcJiuSEpDOcueNkRWl4A+x51lhjzWqgLnQmZTyatujiAmsmtxDO0vJ:6HHcl1acuexl4A+T1lAQmZT1ujiAzmtV

C:\588bce7c90097ed212\Client\UiInfo.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	38.27 KB
MD5	079b2b512c08a368af9105a19b3a2b58
SHA1	112285fde5a98df407b8bb219b398ba24488fa4a
SHA256	512e81318d7c0173e8cef87bfbcca51d064a1eb622f80e2b242e5fd289bfe20f
SSDeep	768:yN3Jzg3/RIJT0RwyIxsJ5Uc31GtE6HF4x5SgVQB2+U/Tk8TD8OhF/m:azE/0T0RwyhA+1B6ajSQQ4Y8Td//m

C:\588bce7c90097ed212\1031\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	80.56 KB
MD5	afdfd049e0878043e62de433463ec6d7
SHA1	e31d3ba4ccd1e1e32edf4d897dbd984a450437d8
SHA256	b996646c30037b8020a2d31e2d8e1db4391174c0d863f9b58598a9ba5c37bc05
SSDeep	1536:hTqjmy1YCf4pwbyMygw1M1TLKmRiDO0uLMQhohON7uKatY6CKu45tg:hqj71YZ//ASvfuoQhYON7uKUNCp45y

C:\588bce7c90097ed212\3082\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	78.27 KB
MD5	5add446f0b53013be98fb70a85dcf2d8
SHA1	0deb9c7f8735cfb3db64c78fcf5c20e60c073590
SHA256	59d60289e865af8b4371cbb6e4eebd3ca946efd2be764a571a4020fc6459cbbb
SSDeep	1536:NYGMwFhBibY4eTfxjfD1ulL32RAliqjHfBwUSQwLTmHs3C8gCP:NYGM0YY4kZXc6RAlvqxQwL6HsS8D

C:\588bce7c90097ed212\1030\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	76.07 KB
MD5	8b0351bbb83b2965ba92201289a25213
SHA1	3854292e7f7d3c27a3b0658bead55ba863e0c7e1
SHA256	b67bd63dc20cb49d55a1d2f0eec9176770ba82ea9bf0a7bdc63ed20a59cd10f9
SSDeep	1536:o1H42meqEyapWpFmg1hb5WM8Kfq16CVBDmWK+pv+PJPmS3pKmzLr11eSQGgCGryF:WH42meqEyKWjmgdWMdS6UNmX+wJPRpKc

C:\588bce7c90097ed212\3076\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	59.54 KB
MD5	1a31f83ece553db1f816095e4165eecc
SHA1	d2e9fbebc3acb143d564c65df59959d348197fbd
SHA256	44dcc7836048ffd5eaf5eedf190b7f256fe139c55d24a204f32e771710cc551a
SSDeep	1536:BuEAaS8Ki5KF48jlxPQtJd6l63/AABICAlFxaK+KDf6j:BFAZY8Y643/AABICtK+4ij

C:\588bce7c90097ed212\1038\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	84.56 KB
MD5	7cc4ebd6a20f0410eb36f0e8debe1527
SHA1	653cb2ccece6a5c439c660a92e0c06e50725b81d
SHA256	e230607e2cb88f972d9b5218f97b036e3cbff28901376429632d317ca0bbb321
SSDeep	1536:yQrL01RDFwW0zcjcqC8xNgN3dMKnGj9GrPL23E3BWf6Odw35hDnV7ZNFYGiFCyoN:3X01xyncjcl8vg/jQGP2sofpdw3rJ9bL

C:\588bce7c90097ed212\2070\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	78.52 KB
MD5	3be8c5bd7c9040f7e38322db4a450a97
SHA1	b3e49fc2b2453a4aa96c4650bc44724e4aa54369
SHA256	92d52f6ffdd7de657203b438157661f78c0409439c583d623934a47492835047
SSDeep	1536:npB5T6YycrGPfWiZRJ6ItUwY16oHemxly/Hml2DKENJfx:bl62QfWi/7iw1EM/ml+Kkfx

C:\588bce7c90097ed212\2052\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	59.41 KB
MD5	56a94f37e4881984eacbdbc2f8dc0198
SHA1	a482c63d3099f2094fa29dac59d709fcdbd53706
SHA256	e4697ad7c36e78dd8300c97f5549992500ec748c40e7533b38f4eb4df3b0befd
SSDeep	1536:9OHkUe70je09VgATXSW45j1vDUSzWUX7m2aqOdNE0t:wHssFiqJcvN7mPHnt

C:\588bce7c90097ed212\1055\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	75.16 KB
MD5	20b80aaf52d9fcd077836ee779fb4cb3
SHA1	34bb86c9dff6e9e11fce577616cea4c2f9ac7d3e
SHA256	fada9e8e82e163a4cfb4655e2adf6879f130b863aa68d558f1c84049ab8bc149
SSDeep	1536:TcXOpA1SsGy9GqydU2WeuZTi8KOzaz7mt2MsrKpb+:TcXUKGdF8KrCQMsrIS

C:\588bce7c90097ed212\1053\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	76.00 KB
MD5	0d4e62e764c57080a9d80a2d550518be
SHA1	4edcd2eb89f2d8fb6b588aa74f15d42b3d5c0216
SHA256	1bb03169600ea90390db13ec1bad60927c3f61be219b298f7b159ee99df25d2d
SSDeep	1536:Gm3C2aobCNj10+N5TlHCTcMIah7kUA+fLZl1XNRG3CxZTOkoeumHlZXi5DgJX:GmS2I1005TMTnIapFA+DDdiyxZTOR2Xn

C:\588bce7c90097ed212\1037\LocalizedData.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	70.53 KB
MD5	85b82a1050abd371c77ad72903f6c966
SHA1	bc1e6da3f16ecff0200d6bd40251f5e66e7b7076
SHA256	606cf7bcabfbcdeb49c2c91044141ad2671469b79fbfb3dc980dce391a04f0d3
SSDeep	1536:uiX9PDFL8ahDu43dGEAPwEVOjerR3NJzlaPkrP9:uSd8au43djApVfBN1QPkB

C:\Boot\Fonts\kor_boot.ttf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.26 MB
MD5	f2f5edd4ec26b242a86b1a7c18601ace
SHA1	16a73aaf2035cbb8cf4bc3419793b190b85241dd
SHA256	307b8d0cc2336fcb6dcd4d327ab8bf5804870174fb532fe0e52fe2c6bfc184cc
SSDeep	49152:nUU2GV6XnnKCWLARvk+QsVVDrrc3DGb8LLu0c5ygG1svJM:np2GcnLWsZ5rrcm8etvvm

C:\588bce7c90097ed212\RGB9RAST_x64.msi.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	180.64 KB
MD5	d989699da1ff62e7caba7899c0c40c85
SHA1	da3c8f9e72f00b57ad34d8a91711eedcb87126d9
SHA256	a62be2b01b6842c1283313544a732e02661aeb885e2e4c3391cd8e883719353e
SSDeep	3072:LwI8NFev1lhLm0qhSKX0IPQdAkXET7guPQfucaK7Ig2agIo62UbBhDzd44ioB:LwICQ1l5m75gETMuPeucrIx7Ixbu2B

C:\Boot\Fonts\msjhn_boot.ttf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	158.67 KB
MD5	5bb5c7ade89560765232c2c8752252b1
SHA1	37ca3fd29c7c192ac380cbe57ab3564ce98b1bad
SHA256	249dd92d34458c5dc409c847834aeb50e87cc6b1bb7f71ac8fd61fe78e9ec7fe
SSDeep	3072:0S/EvoFt4zcMiIY/7jFFs0gCzayFk/R707ByT+Gv7xVll:05vmmY/XIqza5R709y6GvVVll

C:\588bce7c90097ed212\sqmapi.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	141.18 KB
MD5	e7f1fb32831de1fdc9ef4d48adcb54d6
SHA1	b977b5da05883be602117f3d9ad10976c6484f7d
SHA256	eacbe519e633be768c017a01d7cf202bfcef39d9ea5bd1e900507ecb4ddb7399
SSDeep	3072:hZ2/kCbUZXcfXY/BMi5PiZBystRs5yWKkm9bw51yZeQ5NM7nW:hZ2/kHXqEBBiZTR+1KkucqZvzM7nW

C:\Boot\bootvhd.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	97.55 KB
MD5	173c443c202a981099f8789855e2a9ff
SHA1	819ffe2ea5e026fa10fbd67e3519c231b3cd24e7
SHA256	9f4a6240486959568cface01c4c085f39e5a7059efe79d233bb7574243714730
SSDeep	3072:oxXpTzCIS+z0ia98pZbXUQfwO7O5eYjbnqluOH/X:oxRuIg8pZjfwUAbcui/X

C:\Boot\bg-BG\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	75.99 KB
MD5	e179f3ba30b0b04d6cddbf0e509040e1
SHA1	50847cae010d14c4be3d4d249dc4254ac46ee39e
SHA256	2f88cb4e01e6d3b5f01b193c50ce4f85a2124920cf282c5e8ee56375b94e743a
SSDeep	1536:NN7pRnXclOHqKJmHYfJA6N40nlh7Rml+yrFvUMuA+npmfRlQ:NlDslEhkHELRmkARkATlQ

C:\Boot\uk-UA\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	75.49 KB
MD5	833ffb73799aa0ccbd215270d5c5f94a
SHA1	b3df65c67d37a7a6cf32d38988be4f513c1ca340
SHA256	528976d4676cac1611f73e80dcd2142efebf729636d7d0749041b46471d3153d
SSDeep	1536:rXYPF+cb/tOOuHiLg0D+MsHDrpdHfBckwAed/jleNmD6+Aon6KKle9fIcYI:rXYdPUOuC9qHDrLpGnd/jMwD6xo7KY9/

C:\Boot\it-IT\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	75.48 KB
MD5	bd0f1b5697c61e1b1c2e4b69e9669f00
SHA1	8fc50f91dd41a1e0fb4d5c10e20b37462e47b888
SHA256	08289605835f46df4f0273227933b94f4a6ab586eae4181815994bd745d27612
SSDeep	1536:l48XzHd0P2dWD3BjdW/xGQLzdhQUTuliVARTFmLzXVzhnRV1ptab7UJT:l3hkO6BjduUQgtKKEhNnRZ84

C:\Boot\sl-SI\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	74.99 KB
MD5	a6e5715adc9b5de334632acb0ce022be
SHA1	1f4f48a81d5e7ec0798fbb36f6b3b611eebe5039
SHA256	9d8399fca0643eb055915f6ee812757fa253e948941df5bdde8794844b0701a8
SSDeep	1536:UVHc4ODctTbtS250xUy27jInMRFVgJRC6wyYyUwYKbw3t07BZJ2Nwyk0b:UVcbctTEgt7SM3OJD6TrKs3t07B7yk0b

C:\Boot\pt-PT\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	74.99 KB
MD5	d7dab973f1e44096ba4cd0204a2e9375
SHA1	06b5cabfc45174b3fa349c30cbcfdb264759f5ba
SHA256	67d35150ff0c9b1eb2bf2140efd836b9c440c83d96ed6aa182b42b8de06097e3
SSDeep	1536:G8lWpWQC8oJgUCCzm1EBlD7W0FjsGkEH6Bts+794rIzNxK4r8TvlR:1wgp8Uzm1aPtFdkiksesIdrCj

C:\Boot\pt-BR\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	74.99 KB
MD5	bb7cc5d06817f43fadbb6547c90754db
SHA1	f3845216daecc532009fd116c77b55a982a25690
SHA256	5dfeeca174e7d3685d832447bd95938208a06b7b454e9d823fa6936c3ce21d1e
SSDeep	1536:vl56zA7swK8U+379wmVXbws6yA7OGkB3defVyErsk2visSBjCaOllSp:v7bU+379B9bj7ARkBgrsksSBeaOlY

C:\Boot\fi-FI\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	74.99 KB
MD5	33a9d524d6e3fe59a29f864a4f851188
SHA1	95405a18951d75474c9241ec467a8bdff6f5e87d
SHA256	9a77b48c5f76cbf8065d041b9ecebb3b2eacc25a3d62f775a2fc813b844e8fac
SSDeep	1536:SisvPpBy4M9pKv56Nx7DuwC9zmHOR/nNa5Mv1F6ToSh:SiIpByj9i56NtdCIuRPNVoZ

C:\Boot\cs-CZ\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	74.98 KB
MD5	fe6b72d5ade0e80ba20c8f56378e97a0
SHA1	c4f0b15253acd0da0f3c1710c1623e5b6def420e
SHA256	1700513fe0cf2342f9ce9d7dd47de793aa5293cad9b1ac241c159c8d6ba33bcb
SSDeep	1536:np/L7Dj3bc4NPzjzjChuKbDCBVHLJ1fedR3eikB:pj7X3bfN7jBKbYVHCeX

C:\Boot\sv-SE\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	74.49 KB
MD5	1827d49457f81b844961e95f0576605c
SHA1	b9b4773c904c6b93a11c75f9726146015c6d4aca
SHA256	9bc66f4dde823d5bb09d0e5d4bbb7fb0b7d53552c1ba8008b2023a8d89293d9b
SSDeep	1536:CsjqLVOpmPYnV9++gupJFxu97hmul8XoteNeP/zWW3egpLguphO:CsWLlPem+gu/kh7CXNeP7xlNphO

C:\Boot\lt-LT\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	73.99 KB
MD5	cee1f57ef072b851be88c237ce7c262e
SHA1	57dd67d57f98af3144f1886eca25e29c52e077df
SHA256	cba0be026e721e6dd3792670bc17dd98d974603d30fd15f1b203264dc3919eff
SSDeep	1536:jGFRgyxkIWedP6A2s/g4ASlkAIlBkf1xger0JMn+1fBbcb+IYngh:jGcyxk8diA2iPFv4B21megLu3Lh

C:\Boot\da-DK\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	73.99 KB
MD5	aba4c56672c49afbf365e16f95b06459
SHA1	e06b60ec97f362d055a327e3a5f893c30d9b9047
SHA256	dc4da37510a83a5e471555416e2aff6193020648df1e5e31fe0de5fbf3e46ee6
SSDeep	1536:acUXIt/OVYcxE+SeN5L9HtOjkCIDFKTd7cxS/r3xrDl/Juzc92Xwd:acUXItGVYVPeN5RtOoCIDFKjhrDl4zct

C:\Boot\lv-LV\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	73.98 KB
MD5	1f6197bde26f0b2fb1b4521acb761a48
SHA1	f87920eb7805349aced4f2d55ace0d29e6354173
SHA256	6bc4d44ad897344e5d1094aec6cc730e945e6927253e35687a033f7c2a3f456a
SSDeep	1536:Om9CVcFwRMpUen4rJdFKWXsu8MB2mv0zSkME/KV5+ZBBotcdg/Nu8nsuC:O7VwqMpUen4rJdFKfccmv7NV5KB1d8uT

C:\Boot\et-EE\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	73.49 KB
MD5	69e99d1888fcdb7249a746d66e268c11
SHA1	0e3fba81a2fd7a8c5e18d72a298499f4288f16dd
SHA256	521b903e1e9ad877c7462572497f090f80abe235e6d977b3ba2650e2eb0c940d
SSDeep	1536:EQj+4CSWiW3QDu5BgnoVVkv5EynRhp7Q2UfoQOaWvunIIyF:U8QQDixVkvWy582JUrq

C:\Boot\en-US\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	72.55 KB
MD5	9ba9829f624174358fb784d19c5eadc3
SHA1	8d217bc52cc352ebaf4e4e2b33f266c6356f268c
SHA256	536c1372ee1d7aa236ff376ea3a461b452bff7b3e6a5cc3dd713223e2c05063b
SSDeep	768:iRH2OwTM+zPILVtSSKVMQgckJkg2YQkzIyOlfuG6e+/m7WeaxWS4MvwGNQlO6HjJ:mHICtjGMQgJlnzSfuG6eX6PPB+Dj/eI/

C:\Boot\qps-ploc\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	72.49 KB
MD5	4bc76ae36fc92e3045a8b53904f35bd2
SHA1	fce94696aa59d5205315327815cbbab70b1da2d9
SHA256	0c0bdf1afda557cad792cc248eb1b4e43a72b80a3bf3c5da1eaf423059885dbc
SSDeep	1536:BkSkZutbw8JfrBlpNLLVKkzQlepF3f6h+84mhIuFMsY0n:vkZ+co7plLQkclQFv6hx4CFWc

C:\Boot\en-GB\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	72.48 KB
MD5	98b52acd1819e3f389483f3e01f6776a
SHA1	3feac40a72f12ed9661564a38c42cf6f78fd553e
SHA256	9d3fd5faf514060923878c7f2179a749ea6298952ec85c52bf49ba5e0339b958
SSDeep	1536:VoyLLi1ibnwUTkcO1Z2jhKgOCjvccrYBSgRKZuM5c++JWZqv2TdeBERW1:7WaTkcsZUMCjvccrYKuMd8WZpiR1

C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	5b49953365775ad23e907566b2de8d89
SHA1	b9a573b56e1585021c9c7f80492b82882898b178
SHA256	7033f0d0923f02d72f203ed5ae0dfe678c2fdc07d55c5a486965d3200f78be46
SSDeep	1536:0exnkD4JxsZoGgly0o/GgsdpCKb3S2CA6l4a3bAyF:0an9xFA0qCJOZVF

C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	310b14d2d841224d1467bf90001f08e6
SHA1	9ea3c2f08f6f465ee2b782229b1837e70614d294
SHA256	69ca342f973677f7f3eb1c1d2d4dac34e596d4aae79f13cea379e9ad57c766c3
SSDeep	1536:QqATwebYlwPuHKM1AJ7RvYwhAu+1sMBorTnsGfJ+F:QhslEM1ALv3GuQu8s8F

C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	7cebe15e363c3329ecb8e17d6dc7e88f
SHA1	4a7511accf1acdcd98bc93d57ae4f2f5f5914ff1
SHA256	45737a9ca9c256b22bfb9141d69ad2166169067ef29c75a26716b5978d7d9fd2
SSDeep	1536:n5OBD5FCUwXGdCTB07JbMT1lvpBJJNQAp8IiWY4ZGdiUfTkWSp/vTmQM:nopW24TKJbMBlLJb9PZYi+TVR

C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	55832d772cf0bcecfd6edf2935ae4ce0
SHA1	87456d45c176381a5aaeb89cd7f7eb9bf3a7b5f3
SHA256	80b84c85414eba1ca0b8c2c783004bcb9f0a83fb8d79bf204c9138e0c1f397e5
SSDeep	1536:pMlNUsL/JYtVmDGAi3VdQybMgqWhge5oFJJtWT12hQqVOM0W1dEhwoYOVH38o8H0:GlNUsLBYtVgGvXQhgt6e5OD0T1qjVOMa

C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	0343920b300ccd5d025f1680ec249e07
SHA1	fa4dd853a323b4f0e614d21a2c15349b30bc601e
SHA256	6c010a8c105a95501d14ef5db9d04b62485f433313e87104060d95ef96ab8246
SSDeep	1536:TArEQrEtvDNwdOc5X4Y/Dk5kvfHFOm6+GAYN9FKqm89t7zA:0rEtbNw/bCkFwTjFKl8r7zA

C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	b81f155db9ab8de62454ef7f2a518e8b
SHA1	5084bdaa67972023c4a3a8f45d5ce963b92a7fed
SHA256	a87e2826c9c67669f8db8fdc466a91867d1ef07191416fef46d24cb685e14b11
SSDeep	1536:SqNqzQmliXGnIxcq7HeEDXhHylu+LEoEVpeg3s1wSYKfpEsnYb:BN43nY7HeEDXhY2q+1fKeCe

C:\Logs\Microsoft-Windows-International%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	82598d4521c8c7a0b0556d28ea1d0dd3
SHA1	1d2bc5564dff247ba3ed22285f06f37cd474714e
SHA256	8e11af9b6eeea50ba00643789d4c21437e58f4d56d60d67b527a2298032fff64
SSDeep	1536:QP7FIULW0waBo0C/E9n7pJPnjP58WZevz19qafl9CJkuWEd:QzFIULW0waJ0Ed7pJntjyrRl9GNjd

C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	e5cb5ffcfa15856738df9070c5175106
SHA1	d2d5164febc475b1b6b80ebbee4bedc65934cccc
SHA256	aa5a796503b768dc3471e92a9d92872e45a5c74badeab7d0b348bdfde71024e0
SSDeep	1536:hGebDaCt4e5MtF1r4xnJQda3HdW0LASMpLO0dnY3mWJvTPzN81x7:uQ4vtfrkn0iIaKE0BYjTPzS7

C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	6844ee31d72c1dbf181e1db670c02a87
SHA1	90b9a634247d858ad586bc665324a7af7dd839a7
SHA256	f7f90765fc63fe0736948cdaab1881c4b5104a7c60afa2f23f3bbea2bb38a9dd
SSDeep	1536:D41frGaBGQs0QKmJwSr1B95teALnuTuj4Xfuwl/WoCFxF1:MFZBGQoKyz1NtPL14vubdx1

C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	bbe6d041077ed963416dbdd0a7779d9a
SHA1	5a35def0dd96a8192447a93bcbd66a6dd019147b
SHA256	ca769f5db6c8bb902fb8907ecf249d8aa027db60ae7e41317791b77cce95d89f
SSDeep	1536:QCDM+3WreNDBi95jiALNDnEN9q07n3YLy3doIelP:QSlBM7HLNDEN9q0r0y2Iep

C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	e079cbb96384904dfb661222cbb28d82
SHA1	5e3e258fc415c850c8ff4723635823831550f84a
SHA256	eaf9210aa7a87f1ff597aa41d3c70b8e89f110c47b94b18cc09440d51453413d
SSDeep	1536:PkNol4BaRegV9YX7/yvLelpmORRIudov2GYlCsVaGlc4uKYJAR/ex:sNhBLgVu1frj6vtYhVaeGKYeR/0

C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	cc44b06a44b48e63ce8718b3e876e839
SHA1	9b19be25d38414c983e7d300d693fbffcf6adf31
SHA256	dc983afce30f8cb6faeb947cb0b6516013adda90ce30c83bf34fb5160d350e23
SSDeep	1536:LEcs8xGzL93wTLU7wSgORBxU1EVpfIDO4QxmVgtwCNGQN:LEcBM13wXSg2BIDO4QxmqKCHN

C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	0f90a22945438c84d947a286d9538d78
SHA1	42f59a6e001a221850c703eb8e445a39b8cea0cb
SHA256	02766aab0a4a67cf02925cc1e09631410cd51413e6474e36060f580b10454859
SSDeep	1536:blXRJvJ7/LROTVNmcqjyequa/ep9wZ4ygBQOJmg91Xk2Xne:BXRRV/Levlv+9yYBQGF9o

C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	d1a93e73e1a31c3cdc27943746323c4f
SHA1	24ca472caf0dafe8613ace275d8769500a6f6707
SHA256	ec9154b8408f91f637316054a1e40f0acf0e6894cce7f949c1f056929a27e679
SSDeep	1536:hwSFFyEXQPp3GItL7q5S6yzVj1w5qxX7EWyw9K06dKC9R:hDQPsw7iSr5w5qxXgS916Tr

C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	85a1bd12fc696139707bc709a66900ae
SHA1	e5b5f2f296b836bd62da3a897965488649556846
SHA256	f229fdcaf2b2b318a738b19fbadbfa794e78bc863fc33580da156cae2f19fc30
SSDeep	1536:i+LhwQSRFYfBk5tEcnnEbAAGTpF3Atmprqv9wXbczpsNMCxG4P:i/QSR6oWon/r19liLKNMO

C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	1735880341cc160f3c249523f76af51e
SHA1	8aca9ed70bdcde35fc959d2d6ac5d4e0c3906789
SHA256	ee93dd6af3924c921820629a3505cc5f46e089be0d431645eb1a0a3fd4aeeff3
SSDeep	1536:T6pL9u/nz8vH1kpbOkKG5HvggJp45bEItji8SHKPLQqH3Qxs2L8OpAj:+ru/nIfqpbOozp4SIg8AKjQzVL8kAj

C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	92afa29f6e82dcf22e65dadaaa9cfa9c
SHA1	a5d0d70a24043839f822f5f84be7d495855fa6e1
SHA256	f1c435e27f1228b35fdf771d46d98763a566fd1a990acf3c7bab9f29e8e7c75d
SSDeep	1536:iMRaxDf0GX90ErXWeNNLYdkMn6I7N7tBfpzZCw2QNxbSd:bADffXeANLBM6I7tLpZxTpm

C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	04ca6d276b688a971b5766fbbeaaa87c
SHA1	792beaf701546d07cb3c8d421a3b5c01266e29b9
SHA256	3f248412de7a170f7fc859ba62971eb82c51f2a0a1127c66571bc530baa94126
SSDeep	1536:fhiC9Q7K2ca4K6R1Ib8cvn3A6ygJrSEfujsz72:g5M7ivn3JyOLmg72

C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	6fac8aaedf67f1762e35d67338ec50cf
SHA1	a6bfc81a641c2ceebd5b8ab36c272e4011df63a1
SHA256	a5dafe0a09466ba9bf16088d0baa1fe9d2783902f3e9756e5d468f32d238d92a
SSDeep	1536:9jmkFICRpLByVzeOv2XeeSzVAckohL8L2Q1vMo5sJ:tmuhyVh7eSzeckVLFEoOJ

C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	bce11f4949c46e482d5544503e376e3f
SHA1	4ad4b4e06f6aa8f8d20033242849fdc205ab438f
SHA256	a3f4afd57faff9436112b6f04600a734ea912aee85a78dd8cabedaa744318110
SSDeep	1536:RicX++xLKt9MHWRVsW6S+Tr1H7mo/ALgJ2Klr:R+KO7sWsio/AdMr

C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	f697af0c4cad0f5adb04370f3b83bb99
SHA1	b956112733206266d4cf95c28be35ff513896a05
SHA256	6577449cfb8e327064d27b8339db6c6dc4498cf51bf374f7941b41570694af20
SSDeep	1536:KHsS1YbO0oGldHGw5xNzfRkbQUafn6nreAmBxViGRxLOsS:YZubQOlBkk/n6nyAmzjL3S

C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	79086a82908bf6c936c1048a34b7851c
SHA1	8a8834fb058f217be722523e0c21f8a7356c51c0
SHA256	8cd52ab01198792be1089468d554d694f622b6017899ca95334bedecfd84ff7d
SSDeep	1536:PsQ8vKYew5t7y1IKc5EVPstKcq3Q8Pdpb:PaNeM7y1Ir5IstKcqL

C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	ec64d0c3b2a615fc71e43ccb9182fa2e
SHA1	96019a2d178450f6e1e8330a10acfd92c9b77e10
SHA256	f1ea8c671ef4a7bbbba4c824f244c9cf71253e61ebaeb012121cb4b2cd6cd1c8
SSDeep	1536:fEkqfyS3GPKr5100LGV3rrGY6KNntSKKvV4ShdE1Q3YBV:f7qqS34KD00LS3rSSS94SLoQ3YBV

C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	23b35c5734b3fbb35a7d8eed588ab2ed
SHA1	bfe3533a59b7ae33df608a3c7451bcfbf8990bfa
SHA256	2a0ccdf805bf177af198df014ff3d7df52c15231287d050f4fd97e39b2a33f9a
SSDeep	1536:b8oc83ipDPUBU6kGSd28dxCzuvwDHP4cyaV/ABDCC:bV3i9PqHkGCrbCivWW

C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	72e433a2e38afa7b68d3ccce32bfe111
SHA1	08cd34dd26730ed68560b0003e68ec8c2b358fa9
SHA256	701de0d244741489bc86b3bb48fa0d58979f39e25da714959dc469821e57549e
SSDeep	1536:MSIEHh0tDdcYW9mxZ3rp6bEFNlb8CKIRP6ieBUdqxqObk9INpOcxHe:x3h0tDdcYHxSbEFfb8CIBUdqoObvNe

C:\Boot\ja-JP\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	65.99 KB
MD5	66234c3586a68df708657534cb9b341a
SHA1	801925dbbe27b21ffd9fc0789a9b3106af12533e
SHA256	96642b562b0671a65df0d42ff9386596e2f012a6cb388e1c1163234a1c2782ad
SSDeep	1536:LXg9gfkwNbJMS1X30jbE7u0AY5flgWHisVM5AnV82divGFj:j/xbJp0Q7tAYNlg4HM5AViOFj

C:\Boot\BOOTSTAT.DAT.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	64.14 KB
MD5	38d2538dfaaa40bd8526118efcfa4b55
SHA1	72cd278be013d34f01b6c3b089dc0e294480235a
SHA256	e3fc3ff68cd19283436382cb2dda5cfd905a0440d49128d90bad87571ad8d25e
SSDeep	1536:qPnGZKWlcKA87ESTpUI3H7rAob31hHeAw78Q1TfyxPw8eem/0:WnGZplc787UAhL1gZ78Q1TfyhFPm/0

C:\Boot\ko-KR\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	65.49 KB
MD5	f2baf94e7368a751332cbfed867baf19
SHA1	b0fc4b511b7419c2f2c125b5be13caed44d063cb
SHA256	89907c1b69d08de0dd72231235d512b48069d7d7a46f0e3f6890b5ab68a6738d
SSDeep	768:sUS69+/pUmgiJ4Jg++rPx8/q3v0mTB1jbIQKFUfLl7oMyhp5jHxNXNMTJ11XHJ+C:sZFgiJ4O+r/BqBVbSWfG3lN+hHJa+OaV

C:\Boot\zh-HK\bootmgr.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	62.48 KB
MD5	5615779a3cbb90c4ea740af18dcd0ee5
SHA1	741c2fc6fb2499122eafd820c0c7aa28ef842947
SHA256	eacf27dedbdde7b392f9e0d0301ad26b7c5db31ad119370994709a956f331ad6
SSDeep	1536:zehqulAHlzFT9GMaN/R3N1KGAOVx0J+Lg0h7JbDQzXAgnqg:zjuCHfMhN/9nKF0hNb6XAQ

C:\588bce7c90097ed212\1049\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	53.32 KB
MD5	2291594db6af7496628799cee0972e0c
SHA1	d1c59aa11c23bbec99b53a3bbe20953b2ced7f15
SHA256	b824ce65cc688fee0762370d0726a02111d87e6ee9e4d68842ffce2c0e1fe323
SSDeep	1536:15LzYSBHv1B9ToDpsK1LJfSY/JyBICBSPEQngBb:15DBPpUj1N3/gIR+b

C:\Boot\qps-ploc\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	53.04 KB
MD5	bfb49cba7c6113c28e32a6c5b8b811a7
SHA1	81742574201b22ef95202459ff3ebb7b74d20d98
SHA256	4661cf83e358f11d26fbb85c99e166adecab38f80084252bc8ff8cec10165d79
SSDeep	1536:/vg5ZtUAZms8dZ5eVovDKQBPxjjPhQmqaa:3uZtzMs+OoLKQBPxh36

C:\Boot\fr-FR\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	45.05 KB
MD5	4d3c0e2a09690aba079e8fe9e2320006
SHA1	ebee09c4407b39889861313d8f38be32adb90a3c
SHA256	8ce8e1ca83fd4af5770501d3b279cf487c7f8fbb9c245079e00e9c8da06d227e
SSDeep	768:/wYS5uL40ghkRHEnkYmZJt8hUadDT5iFe68kJUtP6AJvxz8mRFY9xmFpE8LZ25pg:Ip5uL40gmRHEkJZoKaJkJUF6AxhhR+9a

C:\Boot\pl-PL\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	45.05 KB
MD5	7847394d0e65496893fede1a941b582f
SHA1	ecab2c00449e84da85df3199f4b0be1e87ccef9a
SHA256	c026df7aeb69184322200b471dbd11511fc84377b14f600b667c152db6a78412
SSDeep	768:rm7mZ+Sbo/ykAYPuc0Y/ObcZwfid2tJJATXnDhTRD4x4704SB9TNrl6fmcq+5:rRASbo/ykAYPuc/wk7DnDhTRD4C6BNsh

C:\Boot\el-GR\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	45.55 KB
MD5	348d2e3bb16d19750607e5d1605e2635
SHA1	20fefa37ffc267fa9d25bfdc3eeb2312806e98f0
SHA256	ff4ac21bebb37caee9dd530a271bc8edb84040715ed8e8b53d18da4ab64974d1
SSDeep	768:xrqeoEtbjxHwDCvjOeFNMmmRiWVAzZIrCi81uNmjn3V1vBweXNON1/YUaFXAWB5W:xmarvieFeNiWSZIk0mj3rvRu1/baFXAX

C:\Boot\hu-HU\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	45.04 KB
MD5	cc252567d508c95050bf4430184cacf2
SHA1	10507eb6da549c97cf0d6f54fa936e4af5ced98e
SHA256	1b32fc69207d914857526451ee4a2bf661ffdee3bbb6541d6371d65a5bb813a6
SSDeep	768:Tmymf36o58nnqL4Nr5uKuvaPCcJg57cnzyy6p9FaM9FC8ZvA6rFVvvuXSkOx54vp:Tfy36o58qhva9e5ud6pHaM3BbVnuX4xQ

C:\Boot\pt-PT\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	45.05 KB
MD5	962023c97fb24539eb2f087c4ff283ad
SHA1	b60c738e3ed2154c0466b69507bc542360632316
SHA256	885f329ab0d9b46404ac4233375d12aa7f11c64da3acdf0e2a69308071a693b4
SSDeep	768:+mvYyGueyNYCNZDYArnq+ZfRocByiDEi3dftlagUFo0UzgFzh:iueyaCNZ1rnl1vByiDEi3d4emFh

C:\Boot\de-DE\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	45.05 KB
MD5	f1704e0abff0c8f25b9dad2c783c4924
SHA1	7335870c0ff8bed523d93ee4679757f6b27d68fe
SHA256	5443edf6bfd7e2ee8e96cd6721900f81146d9b8577a24535c888be01c99f7390
SSDeep	768:N7zJnse8xR68XqzLm39xCcPhU7BHFwa5oJazGWV5/sMbstODdUNxeBVBFTy:7seUXsQoj7BHFNeJazzVPbcODGNxerBs

C:\Boot\da-DK\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	44.55 KB
MD5	a9a2f4eeb1d81c0f8940b5d51f7a21dd
SHA1	a6ca3b4faec7f683281cbe4362265e4fe89de103
SHA256	e7ae5e9567abc9947fc501792256bc3beb763978154543ae6e119ec1199c8561
SSDeep	768:h6Zk81fgMWxejacPoTNXiLQPswZ70eNcaYKCCUBJpl+HWNM56qU6AMSKkP3:h6Zk81ITgjavwgsw+QcaYGUlCWrqWMo/

C:\Boot\it-IT\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	44.55 KB
MD5	167f41cc74968a2c0ff174982b739029
SHA1	148d53344402fa809dafe3c12fc4decbeec95c1b
SHA256	90cdd1ddba3b11ffeb36f15d219a65aeea81ab3f6fdeec73969d001be87ba63b
SSDeep	768:YmYndhTcDM9B98JUIgFCABs4mFCSOqCXlKcp2n9eB721Eg7ZgE:YmYndN+MKUIgFCA4CLqCVJQnoBYbZgE

C:\Boot\pt-BR\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	44.55 KB
MD5	5f355ea8e95d660ac7aa5adce59a63e4
SHA1	33c4461bd32b8e64dbc8bfcf72f845936cc2be3f
SHA256	37831f357fa594699931c826139ea36c1fbaf49a5fc09e021c8ff388ee47b329
SSDeep	768:nWRoHYod4IwxieArm/FIUojZwZC6GaYf4U+wY5+7NDClCYSU8uAdgwR:nWR0V3+5otYaaYf+7cUInR

C:\Boot\nl-NL\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	44.55 KB
MD5	d9c755f58af0d7756dd462e7edc1f7b1
SHA1	842d561e246b88e48ba270268304e97a3004135c
SHA256	8a5dcbd4d10a2bd0291384c41c5dfa5d8a42146954672f32a3526cb3166007fe
SSDeep	768:Z+h8n6g3grmgXUeuq3K+ZN6xuqyfpJOuTOSaUE/OYStAmMfwQPY+L75qdti++SU2:ZU8n6WgSmXhZNSyhJOuTOSaUE/OYStX1

C:\Boot\fi-FI\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	44.55 KB
MD5	ad7fe88d1e941398d7ae24a8556490c2
SHA1	b1e687eeb9b280d5a0d6349f45b22eb13a40392c
SHA256	cc4dc4354404cfb1c1ccef81d5edb54be8712f9eec61374163113c210d80cb85
SSDeep	768:rK94J72HG4cMJ+Zczq25mLMYq1CG4R4UEN6r7CRAqnQG+lKQDy7WLX9kEZCndZ0k:rYKXMJrtDJxUK02mqnUlXD6WLnCd6P8

C:\Boot\nb-NO\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	44.55 KB
MD5	bc65baea2ad2b0d7ec6d51d13633394a
SHA1	2c9c479330bfac0ec9762a7b1d8212429bdac1aa
SHA256	02e3b5e5d59bea4b2007936b61e3f807e9c8a574b7f1369917e636b29e3c8869
SSDeep	768:Vx/KJnwHN688i9p3cq1nP0kdLWBq1bj6mSJmA0lgPRvwK2FpXacXK3GSpFEh08Ib:VxZbf8+LnitTrPlwK2yc+GSpWh0jEy1z

C:\Boot\sv-SE\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	44.04 KB
MD5	2a600dc2c08419c5689a5bc8ee61e045
SHA1	18d45dd8a432e11dba534c89d6fc30a4df7d1ff8
SHA256	d7212347c8a96c3212358d6d314f045818a1bb68d2532cdba019d8643ef2d7a8
SSDeep	768:9CySwqli+TnQbK2zAUXV0ZDp7txehJZBMH/JXS/aWiFEpuG54xEKdD7w2:fSikQbfbKZxtgZSH/JXFLguGiqKt7w2

C:\Boot\sr-Latn-CS\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	43.98 KB
MD5	9dfbdf694045589753712e08b24c031d
SHA1	1d8288897cbb85d6f30b23191a793c61faf49bd8
SHA256	4d10e86cbbd9910685b766680ac0574755a6c8fd1ced70f218ac043fd093cfdc
SSDeep	768:VKXIMBBQMwdZ33qMnJWfCEYZWoIXZX6KL2SXN25k2njJgJqvXAdpQ6PgW6P0wy0f:IrBiMwdZKMn8fCEYaZX6S585k2VAqvXN

C:\Boot\ru-RU\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	44.05 KB
MD5	eab299592b4a5ceeb4d5a3dd1b51c91d
SHA1	070e485f89147069a0faeb26b9e0825111eb4af4
SHA256	4ad254f1a627c6b09f53c843e687d536f5860c0717b4dd0479f4e8ee158cfa86
SSDeep	768:qEbJkvg1SNdZagfrWrTVIeAMD35SYtxm6oQaxiLVva45hweqz/L+S88Z5NoqCp:bJfqYiWr5TDAK3oQjIOofb8M9Cp

C:\Boot\en-US\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	44.05 KB
MD5	5bc8c12af3bdfbba26d4fa50a3c86147
SHA1	11abad404f6d668aadd1cdeb3b8493520a18ce17
SHA256	e2e261bdd6a60db27678a0ce683a5e3c281ea652f0fccb50c5f3836683fe7f2b
SSDeep	768:zwe7uq9A+quFeBNsu+ynNjqs8EbLNeEj4ZgaDaBLP52:cw9BYS4pxgbZLDaBLP52

C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	41.82 KB
MD5	4c20af57b2e5cc35965164b63303aa6b
SHA1	7b185028cbc1780f159442a3aea3400deb49e885
SHA256	2bd1c5311062cfee83eea4f4d2fad02e6ffc9f1c6fd5e9f0f3486f28dfc4f40c
SSDeep	768:gj24PdO1Ap71txzeSZ6rDPlVAQIQASpKxlpuDq2xhZawUesT:gj2Ko1y71Xzt6PA+ASpulp0PZawUesT

C:\Boot\Fonts\segmono_boot.ttf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	43.95 KB
MD5	376ac34a15e8fea9d0dddc560f92a42a
SHA1	b3cbde11f428a299a1238873580ad66d810c1fd8
SHA256	ac999b8b4e128f803c711e419ad3d05126150f75b6031ef54342f87c25c28951
SSDeep	768:6kLbx5989zVOX74r4w+EIQ/K4Q0HfMMP+d9P306Wg3hWet5SYvdQt1A7tNgvEps+:6kx5WoL4r4AIQC4Q0Hv29P3fWg3IeLFp

C:\Boot\ja-JP\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	42.04 KB
MD5	9f0c21bb95782be9c22c9093e3364389
SHA1	89f6f92004e42cf5c2a825c5c4e60508a825afd5
SHA256	84be4037ab64af50f3e8f1e32bcc20a16153416b5c5de6d93cd5abc6a93710b6
SSDeep	768:PiasXBjwLZ7dTKPD80O3FUeRxxVll1n2sgF8RJgiqPL2TwkrGPhiJuJyP:Pia6BMRJfHas7Jkcwkr2J6

C:\Boot\ko-KR\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	42.05 KB
MD5	d22358bb89cbbda2dde5d20a5a5950d2
SHA1	c0c19ef2c38efdbb068b9616b0d1c47b189bd63c
SHA256	053e3153b71e462313f292d3fdf5beec1d1d281676a735f734a9c66014583060
SSDeep	768:Vwp7DRM1dgH8Lev0Z+ZyKfbc++spEY9vdiGLZqPzil48q+teEn84V:Vm7DRM8HbsgQKjtEYm60PmW2hZV

C:\Boot\zh-CN\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	41.55 KB
MD5	30a7f18a4b5ac42375cf01b4b1f2d08f
SHA1	d12d6a6990c20e1c06c3c495fb7b7fd4384e1c0e
SHA256	68073ed670144e7f3db2e6a5feaf35c7ffbdc6a71f0ddead2655c61e95befd8a
SSDeep	768:wsA1Sm9QqHOaLeonmDtYNuS/RgqPN2oneqeClQzOceD5G92BugYesH5awJOVykz:wsA1XQqpmB4JbbCSceDk9ntQwJ8z

C:\Boot\zh-TW\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	41.54 KB
MD5	42bf686db62440e174257bff0b7fce04
SHA1	0b52d23df8447bf9defedeffc603747f6137d53f
SHA256	30021ae64e53643734033a3072c8307a330a5a9b4654e19ead87ca76f8810678
SSDeep	768:ZfTrikXE3L0XZtFu/YAnlTln5b+ADQxyfAxfvJ7OuKjG57pDif9Si:FKkaYXCnlRnJ+AEyfAhoG57pQ5

C:\588bce7c90097ed212\SplashScreen.bmp.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	40.26 KB
MD5	d3989d90a9f04f95a5633648e46eefd4
SHA1	9270c277bc263b137670df836cb8aac99b9d419b
SHA256	25b42c40e01e59c9f5bd2be0b622dfd441331638ad4cc14abae7ba71b783400e
SSDeep	768:5kBc2YhXGnhKnL3NTHRqGRCHPyt7bFGSLBIriNEuRi0YmQUolsSoHgQCBxodvwsV:5sYh2nhKLdRqACqt74SLWriN/Q0Ym/oc

C:\588bce7c90097ed212\Graphics\Setup.ico.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	35.99 KB
MD5	b022890265fd92603b41f2542080194b
SHA1	0d7ecde272ced36e3e0ec9fc497d97db934012d2
SHA256	c9b1dd9b7ab5470f90292c50df6c523e10707840c8524b54f2de4b16d1e113cd
SSDeep	768:hznHF8f1sVPgvz++l35BTER+7Bhy3ecUCMwSOOD64tr0wkygJ:hznHFE1sabz5BTEY7BEe1C1xRwu

C:\Boot\zh-HK\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	41.48 KB
MD5	9d837fa361cf1718033ee7a01abe06ae
SHA1	81e175c1dfdf3f34512e16c657f4f0b77083309b
SHA256	403d8f779ca308fc94a51788eaa5b28f5e027deb6eac09c0282a621d2538e085
SSDeep	768:hSiZjMvZ1XsC8WiNKGUNw+hoL75To2Ss+K7bR+FAz+yK29UkiJJ38npYwbCuP+VZ:zZQZF585KGUNToL75TRSsHMFEm2mkSMo

C:\588bce7c90097ed212\SetupUi.xsd.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	29.56 KB
MD5	e6f03e92e01c501b1247a88166f7f069
SHA1	24e4beae665c814da631ce036748a824b47f0a87
SHA256	3707b0df06f33584ab352f2a0f080c55f5754ea0601cf8273ae6f06563ec31e8
SSDeep	768:pzDvkFxoLa1SyQuh5at+jUi+Uw0+3TMDDVJv9W7zLFIF6:pzDvknoO1+uHIK+jMXVJU3Fz

C:\588bce7c90097ed212\1043\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	18.98 KB
MD5	2bf4c841aa928736e560dcc5dc65e1d3
SHA1	5ef4f1d33bea7587227c722e2f41a52064255b15
SHA256	2cd6442a82dc3a2a5fea15ee12faa6428a0dc8569b8aedbc634eca546cd87dab
SSDeep	384:2v6rWS7BQb5nRaiafEkL/GinpkrSCGgn0HLId6cU2w9fD0NvInOVA:2vMiJRbYfiypoSH4agM2WD0Nv2OVA

C:\588bce7c90097ed212\2070\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	18.48 KB
MD5	7517e39d02963cccf393d9bd99b3bab6
SHA1	1c2d712ae87f7e7a922bb09425d6759b67f2c4c8
SHA256	41e6946fc3a7225223e8bbe7a13d9b2508786b6b903dd1fb4c7a24d4376ef3ca
SSDeep	384:gXsUvob4kHqTVEgSOaW45rpKRZNqoDdiId28kW7s3I:7Uvob7IVzETjQoIU8XuI

C:\588bce7c90097ed212\3082\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	18.48 KB
MD5	6fcb5fbc69fc68d4d1ddd8a2169605c8
SHA1	754b12882a6422cca92f13c443e0f73635574a21
SHA256	9a663e5994fb1fab96cf385f3c4658113bec1e01f50e7b9a8335b126c27b6c02
SSDeep	384:jSKywp8R9bodReu/oDR4b493k+KwuU15db83lxA4eVEHkFtOisp5Gs2/:Wec4euubpSUHdb81xKtI5Gs4

C:\588bce7c90097ed212\1036\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	18.48 KB
MD5	872a120d22f4b27915634ffcf3bac109
SHA1	5cbda1706a26fda06091606a22db73cf055f1458
SHA256	14dd9da607bcebb2a73d0737f9a655b35cf92330e0d2b4d052e3cae776ec0b0e
SSDeep	384:KoD6ZzX0TpHu0qzULFZ6eQVbByyDf5ObDTGjUqFHe0K5dvoNjJyVEHRkw:KoD6ZAu0RFZbQOyrIDT1AeDdwNj0ERkw

C:\588bce7c90097ed212\1035\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	17.98 KB
MD5	d56f9dd99053ee61742d7ef72494b854
SHA1	ccc76115cf50f8e1fb865290c5d4a12f0088e6ba
SHA256	82687c87417a123243d0d0d76be9ec3d677844d6d2ec32244b5c3ec6a36f620b
SSDeep	384:kAgPUXXSpF1582Xgapts2tiMMa7TE6gUh5IhRw3ONUNt:jgPSXSpO2rpDtiIlgU7yw30UH

C:\588bce7c90097ed212\1040\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	17.98 KB
MD5	11496dfdddfb5029f124c1371bbd09ca
SHA1	d861902ec7e6c601b416a804139b89b954143795
SHA256	0afadfcbc1734820862dcd28208e5fa830ba09f7c3678ff1430eebc18db4c0cf
SSDeep	384:nbKhDB3n+ykgqhCa5rhn5/2SXk3ULiKgtL5d9W9Wbj7v1J+TPkWHdzB0z2mv:nKBuP/rh5/lUYHgtLr9W9qJ6z0z2I

C:\588bce7c90097ed212\1049\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	17.98 KB
MD5	65a58d7ee33c091720d31a81dde07e41
SHA1	74ea6863bcba23d2e985212e98e7346d9eebe746
SHA256	149a8f1d8b611693dd0d3f0e66655cdefeb5fdbdba699ab51fbd1ad645a5570f
SSDeep	384:H3O1w4oGTS4aM3LUjs/kxjuYyrsDICkwG96xy4S8Mq2J87:H3O1w4oGTS4FDkcr4AwVxy4rMqw87

C:\588bce7c90097ed212\1044\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	17.48 KB
MD5	9effa7d58ef9fca6b3fd90fc5603fdd1
SHA1	55dbca20b13d32ca4b5fcbd08dcfc7e139291f81
SHA256	1fbb43ad013bab99917138e759e1e2b2f286cc7e48ed1671a670a0bf058f76d7
SSDeep	384:DkAPrzZBsdkTrid/JK6QJWmmxWxQ/mOwpagFkmfN0CaV7VpAa9:oAPTr+Q3cWYdgFkcB47VH9

C:\588bce7c90097ed212\1045\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	17.98 KB
MD5	d8746bdf3eeeb8b2da24a834ae2aca89
SHA1	d22e02cbe55d626a75cbf0ff8d821df0b8249950
SHA256	a61aa1f2ef10b1006e6d90330c9cb8ce80d5deeb361d21630de694ff0e70d2cf
SSDeep	384:uDCug6ljjotH4X/sDLMC0/kBkGutJaZ5RO5+YZ:PugijCD34cyGut25RO5NZ

C:\588bce7c90097ed212\1030\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	17.98 KB
MD5	250c427bd750619b1a021823dbad2959
SHA1	31564f92e7f69ec184a48fb9ab3edd56a86dbd8f
SHA256	89ef159cd75fae0019d026db45e8ed36702214419b1dcfd0d51a73b18a4f87bc
SSDeep	384:PHyjkNLUPyqDIkGBG45ObaVyXAMQ/05kyZYc9yrgfTRJsIn:PIkNIyqczG40jXAFu99yrgfTEIn

C:\588bce7c90097ed212\1055\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	17.48 KB
MD5	8cc69601ab2e4ff342b58b7be9c05822
SHA1	ca5c77ed70bfa05d467c7d0fe2abca996b33214a
SHA256	4a87abdf1e5475a62f8273c1e8a736e45d2de38383b1f23500390c943f1bb5f5
SSDeep	384:vBvqhzK5UFrMv0/2SaaD5GlHkeCzqcE7LIFMO7nzYwHOydfQSc:vkz0yt+St1YkeCzqb4METnu

C:\588bce7c90097ed212\1053\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	17.48 KB
MD5	c6fabcc11a48bd7246208d938f7b4669
SHA1	3df37aab90f981ac54af851c3d88bd6caa435e93
SHA256	4b5aaea5d11a310a7cc575dbb81abef601e152689819a30ffb06ceaf99c645e7
SSDeep	384:XTmS4eWqRzy4ZmyeKMgivQI5EDtkQVPgzvMG8un:DXzzy4ZX/MMdgz0cn

C:\588bce7c90097ed212\1025\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	16.98 KB
MD5	d31d5b54434f8c8ee5d45737a1b5f691
SHA1	dee9a88fc9ee41faaa1773dd4af7373bfb4160a6
SHA256	ca9ddb547b3f10300bd74a491105aedf63fba5528aefc7a85989ef9e4028e2e4
SSDeep	384:htrDMTDbZkayGorLEyDp35rsTHoR2HsYhwhHFiU:DPMTZyprNnrIMYehliU

C:\588bce7c90097ed212\1033\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	16.98 KB
MD5	eee9654831a6aa4c47fc14ef0baef6a1
SHA1	f0ffafc157ab8ca7ef6cc3d6657713f36594c0f7
SHA256	d593d05afa8c9d60b90fe83a66377ace88afffc387b1017da4e04feb98f1e053
SSDeep	384:al/r7m8oyYjG5SZg++Fjx3ZUuI6U11R6MYqIxe+8Tt5/2qami9YQCa:apr7mBjC5OgxFjJDI6e1/zami9v

C:\588bce7c90097ed212\DHtmlHeader.html.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	15.88 KB
MD5	b89f7a3563a9aaec038247313eb4878d
SHA1	5c3b1fdae6fc4e8617e48c4b3379750603470879
SHA256	a1088b6669bde2f619c1f8e114ef56b0ed1f2d9071703bfb387d8a53068e69fb
SSDeep	192:jRC8Dz3OSUlmZ84rAL89k3Poyg1xxswNKwedjTWbuG3RH6FJUSK9Ta255yAqiPL5:jM8H3+o8BhGktXvG0TK9IO0sK8Uq

C:\588bce7c90097ed212\1037\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	16.48 KB
MD5	6fbc861616aaf7d04d4365599bbdf832
SHA1	e50ee665b348864e7fc297062266b7cd2291db9b
SHA256	f7fa50e678dc3ce51ca80300bb69f0f5bbb597073e58de2484607912b82aa8a9
SSDeep	384:urom6vFsQLf53n7k8IeGN3tDcWlHkD1fONGmFTfYojnqfe:gIvFZLhr5K3tQWlHkJfUeoGfe

C:\588bce7c90097ed212\1028\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	13.98 KB
MD5	488663a780bfbace65d81982cdbc5cbf
SHA1	f22a44df6c9fe0c27bb24a0b8f468fc932f4a090
SHA256	feadd9ab98c978b8469dece2c8dbe6c909b8a883f122c3439a6081a59a575960
SSDeep	384:9jhi04JTFjJX4iom4Rgxk/TCmqhQ8i6bBf:9jhmPoTga/GmqhvZ

C:\588bce7c90097ed212\1042\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	14.98 KB
MD5	5f767a9f7b06071f9e523d35f2d71804
SHA1	6072463822073b8db3891740862357da72f9e943
SHA256	33a4abb7d08976c737e2e8fd136398960587e82cd96c5ed026d3ea12d02b4aa0
SSDeep	384:H2a65G7paSvh31gRRbTDGdwaUFRtio23vwSfxNjWgA5P:H2aIG7ll1S7F3tY3hq/5P

C:\588bce7c90097ed212\1041\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	15.48 KB
MD5	bf1433919149b4a08cebf23e3affeb2a
SHA1	d2b57e7ea03753fe0409cfc1f71536b6694c0a27
SHA256	c6e7227a2c44ec93cd0ac5931fd39c8bfb09a001c56107fd1aece519e5cdfc89
SSDeep	384:/s52E2K6gRTgXDmyeXQUU66aILwrSeowhRId:/02qlTQmy6QUUbpLcSpqRu

C:\588bce7c90097ed212\3076\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	13.98 KB
MD5	5316605c3a4e87c88906303858a881d0
SHA1	fddc53ce8d70b01f8a244438d1b5cffbf76f516d
SHA256	4301a7cb61c3b7b36219af126026db07f4bef03d67b4401b445439c7ca4606b9
SSDeep	384:LmjKMuTAdazHM6e53gt5hGmOWKGsE3SvIFgzI4gil:Ah53U5P1sMWI6c4Fl

C:\588bce7c90097ed212\2052\SetupResources.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	13.98 KB
MD5	9bbd578f9979ce279b311bd88c7ac60d
SHA1	78e25963c80f72034c3776c9d2123fb8e52f0487
SHA256	6b6054dfbcf432b95257e7cc705cc950a196d0ae291ce06480096a373999c325
SSDeep	384:yU/MW6k5h+jIbJDO4xhdX9QeqqFEMsc50mds51DH8FhsIecm:QkPGcE4pXR0mC2LsIC

C:\588bce7c90097ed212\1042\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	12.53 KB
MD5	fc6965aae0de996ed1fac55a6f63b0d4
SHA1	29538a777c6a1dabe5ab7c54066f747dee89c4b6
SHA256	3fe73f6afc08119023383750ae153ca76a5805caae51a9d68bb8b4fbed883f34
SSDeep	384:Vr7CozefCV4o/7KbMeVaCCdI1BJgSz7j2:Vr7zV4yXe0mV3zf2

C:\588bce7c90097ed212\Graphics\warn.ico.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.04 KB
MD5	55c3dd517cce68d2824ed519860466e8
SHA1	29e45c010c10d09f762e8f9366625c5d6a7d5e40
SHA256	d15847581fb6a682e2341076d4ad1d4a2d11c9d66d1ccc5cf5b9444299168386
SSDeep	192:2lEeuQwYCnMVJ50khTepmXiNZTs3fWGY6H/Sg8y+Ppl6yk:rLMZ0khq4eZYPq6fEXle

C:\588bce7c90097ed212\1041\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.03 KB
MD5	88f8b5bb2163fe833ab78fb801a8bd36
SHA1	865a840f6ef1421339dc43d0e5b290bb1d7ab5f6
SHA256	fe6eaaa26346de5dab8ab0f2f4b911331e05e642ed8f679a60062542eae7d095
SSDeep	192:XFuPKFAwLHPgu3JdkN1NgNdc7XqkCIwNo65biVEQWi2V:XFDvHYuAuLIXqnIT65QE8+

C:\Boot\Resources\en-US\bootres.dll.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	12.05 KB
MD5	5888cfa952f334d1cdc54e4e5a6d5915
SHA1	2501d18887b289fc92c491e36f102176299f5a80
SHA256	6a63e65bb2662f3f04821ab164c24b275a545f7703fa8cf0d5b15481a9a9abbe
SSDeep	384:x7ae6K8Qampe+c89TBZFgERMlG26+8NSb:VUITBvqGNy

C:\588bce7c90097ed212\1032\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	8.81 KB
MD5	244eaba75203f645746c5d1b8b54836f
SHA1	2d8c4b6fb5d949a7dc7bffe6651fa438d48c5e53
SHA256	7d129311d30383da1340134170b175e1afdbb10a83262bcc3d300186762b96e1
SSDeep	192:QqUn1cHtpx3ungprY3n9V9ItN65+ixcATw+TYwcJpp+c4pB8:vuGb3+gprqdI76IixcAMUYky

C:\588bce7c90097ed212\1025\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	7.53 KB
MD5	e22e60ef0d1e01e836111c9e2ebff843
SHA1	4fb6eb20a6f5dd84113203b68b8552913ea366ea
SHA256	0a1028ac296c9f5293f5329b3a9efc10da5df3086c8b917e61baf9f21634845d
SSDeep	192:taS2M0GcsqclKroVUau0K3d33g3KjRoW9SIZzAR/cqR4:TZ+s50rGkXg3KjGW9SIA/PR4

C:\BOOTSECT.BAK.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	8.14 KB
MD5	30e0e120068bbe156b146c41ed63299b
SHA1	a8737a15e020f563542ddc390867da439c39936a
SHA256	324a2a9db74e077e979893b22298560450ee9b1328bf2677de74ca4cfc6f5288
SSDeep	192:y5kyWNmm5x/FuVo4S7KNgoOByHZTEN4J03At8RO+XDzw:enm5BF/KNghb4JxmROUDzw

C:\588bce7c90097ed212\1028\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	6.31 KB
MD5	7b781edd5e5c0a54db47ad984b28520d
SHA1	ae8a3ea575a93f6f9d13d997164485cb78d703ae
SHA256	7713b76d30ef544f2c0ab225e8242bbe4c6d141ec301dd3478050fc00a5660b5
SSDeep	192:Ep9AywvY7YDCItVh926dRWc5Tkx4TnfewOmF8Eu:Ep95qclIfD267Wt+nWwOmF8Eu

C:\588bce7c90097ed212\3076\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	6.31 KB
MD5	4a1881e6a75a0d5b3d78e02fd67d10ee
SHA1	765744dce0962a208ec96ce24fd09a86c365b5e1
SHA256	25c72b43170ad3b8a867e8ab03e7fa2865814c48cb4473a608f13ef395341333
SSDeep	192:fQFNU9bGFayNbFuF3g8xmCCZHx2eJmqsikp:fQFNqbSayDWgQrPqnS

C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	6.01 KB
MD5	2f4e7e7c37c70fedfb8891ae60b6e450
SHA1	1d9bb92df16092a76a692a13d2df33a77d6fc8dc
SHA256	8d7f5291358ed06da71c8782c8a3d3437fd770dfc1fecee764aec4864cb87a0a
SSDeep	192:FKuOY4ThU3ybIgDSN/h3QRI7PGZm0HR30BBYLLLf:FK24t3EgeN/hQRAPGZrHR3Tbf

C:\588bce7c90097ed212\1037\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	6.83 KB
MD5	bb5aaad9cb4c5d3ef9fe69353db08701
SHA1	005a9a1ddc591fa1e50575ffece3b3c55b095ad8
SHA256	c1660e13083f15b03866d59229b10cd6d0a88f63f9dfb4228b8d20329e5fc7b6
SSDeep	192:+B0Cr4Rep+32ETF+sFgXn81bTL3dUs3T+g0Bhr3:+B024hxF+e8n8hPdOBhr3

C:\588bce7c90097ed212\2052\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	5.83 KB
MD5	7f314164372021f234bf3dd650c64533
SHA1	81faf7d675dfa19947e69da34cd1bed2da0d56d2
SHA256	4ec2272a7402606fe4ffe9b5eb33e71200fc01790c677f82811f4e3f697c1e12
SSDeep	96:EFkE3zUCoQcJZQ6RkA7fzhFtEprqcLwcwquzBhDc+ObKJW7ziRjyy2DIgjpoTmJ2:EFkAYscJZv+AvbtSgLcqJW7zLEmJqT53

C:\588bce7c90097ed212\1038\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.30 KB
MD5	8cead3d2c97ce32196c0dc5a5903ef2e
SHA1	c5f52d46de21c883a451efeaa100ad90a41cd515
SHA256	bccbe889e51f82ea3aecb30c25b09a602013310df0be039903150cda5439e032
SSDeep	96:0ffR7dXcKbXHCL5kzDVUhtQbA/zy/JISgSO:0NdMkTDauAry4SO

C:\588bce7c90097ed212\1045\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.09 KB
MD5	cd029746449595c540d2600a30f71ece
SHA1	e362c33b13cbe960b90461e430eeb7eac9bdbaa0
SHA256	11fc6c46cab470a0118687651d474007478b48ba9dca203e825160c5bb19da8d
SSDeep	96:Z923LUD39JS5JIHECBUGEFHCnD8ncgujcDWfwcrAnVG/Z:30qsJIHECmV+8Cc6YcrOG/Z

C:\588bce7c90097ed212\2070\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.07 KB
MD5	62655080ea161f2cc3efe252e992d5a0
SHA1	92880171ac4677b18663b5597445fd5561d52935
SHA256	364b4e72d69b9118aec58a2353ded313945b2e43bb1dbc919281ea8dc18cdd8f
SSDeep	96:S3627MEJwD0FOqdqYnSQdLfxF4+RcVLuuTV:5K99BxFDmVLuu5

C:\588bce7c90097ed212\1053\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.92 KB
MD5	4edbe8539edc95b71f8b572dde4fa7f2
SHA1	56efe68107b258e00eb9fa40f205a68ec66f2754
SHA256	aa29d0a7754f287618d24b5035f9e3cd86f1d1042cae64c9c057db58b072be8e
SSDeep	96:6qe70E+040n34gSRmRsUXwrSoER2lrjXkR+fueO:w7340nIgi0PXzoERwAgfuz

C:\Boot\updaterevokesipolicy.p7b.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.70 KB
MD5	d37122c1ccb36d4c883d5285a8082b2a
SHA1	0dd0bb4bbc064c30cffe6d60f07579f3c0118d34
SHA256	029374db97f14757d2a054b586d4f4c8318c6e2b433b7343725b51d4b33abbd7
SSDeep	96:+n9HC7iA6w2ahVRJpD5em7mYDt1w5OQhClEphwhK1ekVJ56YCYP7:+pCJ6X4TDtNDKOXlEphokVhCY7

C:\588bce7c90097ed212\1029\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.78 KB
MD5	24e08fd9c9189e8746ac015fef612787
SHA1	07dc31a92e03da6e8ddb4577c295e0ff1a57e5a8
SHA256	573bb89d0e2a2dde35f59b0d9fe4c3be4b4047e15a3dfc73e9274ab2c999a107
SSDeep	96:vexy3Mg+w6d1zvOF+uDFeXe88D9gywDpx4njCEYjr:v53RoDzvOocIMnw1YIn

C:\588bce7c90097ed212\1055\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.91 KB
MD5	3880b8ed3ae9663cbe2afdfc305ea375
SHA1	1bd036aaed5e67046d39cd105131f15a4ad5f2a4
SHA256	3610045a06718bfdfe5229ab3268ac4fd56b41beb7422af771a7de9753a457a5
SSDeep	96:lnKorSsYkDJQiwDCo+n1LDqKHplwnJL+cTeB54wxRwtE:nZLDJbwDCo+nRqKPeL73Y0E

C:\588bce7c90097ed212\1035\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.76 KB
MD5	0e157a1cb87740748dd0ce7a268f09c6
SHA1	f91d2b1bff6e51f08fa5aa9f26d2551e0b0d6c7f
SHA256	68a06e8d88b615afe829b1b599afcaf8acd2af2895b2228a343d77218c8e1568
SSDeep	96:lStmhqxn2SKQwvA2rhowF0xyVdnwD/PDwnrFU5h8rGfT:lStmhqx2SEvAYhZyy3acrFC8YT

C:\588bce7c90097ed212\1046\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.74 KB
MD5	e6f2a19301be64c47b6014407901566f
SHA1	7a2860ffff03c856d115d3f16adbc81534e9194d
SHA256	806ba6c27a9b0a841f060bd20f1f90ae122966be8d96101150f70124e240a326
SSDeep	96:i4zUGdJPCRAPQqw5yoBZXbMHlwIG+B9wE2qoH:FzUGdJaaWHbMHc+B9wioH

C:\588bce7c90097ed212\1040\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.70 KB
MD5	5094c6196587e578983277dc7c9fd833
SHA1	2b7032adfdef9a8f8c982425c37e2b82f2398f3b
SHA256	d14881fe7a46d60c639776719cf0a17a589610cf4048346163c4ccede596f867
SSDeep	96:o7jd68oBG/+IO92PljUS9T2hP3n50fnNzG2FodsP0hvq:o/d6A1PltTxfnN3CThvq

C:\588bce7c90097ed212\header.bmp.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.69 KB
MD5	d5deb4872c84bac4d07239f334fe6a44
SHA1	427109e393cd990fb7c9305526bc5a4b41bb5fd5
SHA256	69cc16ff5e6a5ed673478e384a037cff29ca249052fbe64240893422b794636f
SSDeep	96:Kx44CcTscUgUDF53XvAI2nYT10CQS43mvUUTK:Mv4cUVF5/Ta3me

C:\588bce7c90097ed212\1043\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.61 KB
MD5	ef0657700153c98b21db03c4272edf3e
SHA1	604b7aa77ff29466af76234400f522cd0712dbcf
SHA256	29430e1d56d4ca7ee96b814880cd9310d24f06bf9694dd22b6635b4e885d553f
SSDeep	96:WqeBqWtZW9YmIfy9rj/GT9zkBlZtknjPuiHqxi1iEZ:WqgqWtZWm4rjOT+DZwSi6i1N

C:\588bce7c90097ed212\1031\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.48 KB
MD5	e7a8b20d1d507b9137f384259c7a744f
SHA1	e2866f4ffe4eee5c8b3a406c2a2fe4d83e7af43a
SHA256	e74d0a59390b18934109e8daf60cbf763f050649123a81ff8e1e96a4841e8c26
SSDeep	96:wQbZ55DsiL6s47DAWm308Ynq9iq42WH75e3:waZLsiWT7D1qxz3

C:\588bce7c90097ed212\1030\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.38 KB
MD5	eebf598c2bebe9124eeb40860a708621
SHA1	91fb90f5d6d6c3197172c3b26d6e09db0d07a68f
SHA256	71ea5f3014ee009ac2bc6b52dc03a083da2c8ef73e281b27445041d5578314c6
SSDeep	96:wLkOy5sQD8KGRpj85395ac3zBWbPRoOsd7oM3s0b:qktD8BpQxJoPRYd13s0b

C:\588bce7c90097ed212\1033\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.26 KB
MD5	2b1a272069de40868c4247342f089dfc
SHA1	118ab38046ccebced830af21083210ff67af641b
SHA256	cf8ec17492f54b669ad0d937c8bddea2f70309b1cd9db590878e366c7666122e
SSDeep	96:c6YegL1g2FC0ld8jYOHwgUR7DvHeVx0kzRAwFn8W6UytonA3X:lu1g240jdGUN7evhzyWu

C:\588bce7c90097ed212\3082\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.14 KB
MD5	e707e1ea6c18037207df76706125bbbc
SHA1	65e5c36b4073761168c3f9b9302be88cfc1a3147
SHA256	8ace0d40f8363cc8c05d07f984bd51c28a7508d16cbefbbb6e50d02609e3f328
SSDeep	96:7/iYg+/FGk0uO2eUaiX7ShzhQcUuPzEhm:LvgOFGkfeUazhQIzP

C:\588bce7c90097ed212\1044\eula.rtf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.12 KB
MD5	312341a407b5e5d28dd9510028c3f4f8
SHA1	13d15dffa34c96e9dff42011c23690a2dc57a1a3
SHA256	2db07f8fae4124d3fbe65c004f947432118d8c1940a1307a0bf5477e2e97f5d6
SSDeep	96:163CSwaKh4RXaX/Lz27VqDTMmVtrovVlme:0pU4+zjTgVse

C:\588bce7c90097ed212\Graphics\Print.ico.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.27 KB
MD5	410d01d1f6ecb9ef1762c8247a620602
SHA1	ef104854f0d573bd66bb63c8baa025d087f8e8dd
SHA256	718fefe46bd06fbe82d838f6633bbacb96dfdd230d9509fb5afe975893125859
SSDeep	24:FtyBLSV+SdEjF3LdKtzDoTkGKWQQ9Uvr0PGuRJMqeDwAulsuF6HwnVKLoQ9ZdfvG:QLSVPA7SKO8R5O9uvJscQ9/fvfxqX

C:\588bce7c90097ed212\Graphics\SysReqMet.ico.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.27 KB
MD5	47fe63207f44986d61f0cc3e452f45a6
SHA1	c557e0bf8cfd9c9aeca8267cd6a3845ee0855257
SHA256	0186000b0431eb6b2eba3f20b6bd467f16989640d66b2f388ddd32873ddb4666
SSDeep	24:180vZ/6IBZafFIannJ3UEepNmKawrXEQXiqp5TKP2RM:K0vHkFHnKnN3aww1qpgPb

C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.27 KB
MD5	bb5ee8c99bdec6ce0d87ef2b927f6cfc
SHA1	a48369d60acbc628ab0b521bf3eb91830655aa05
SHA256	d5d86031166b8dfbd8b2448950b7f92be36054adf88c4e9ca465d4ee119c749a
SSDeep	24:lULlmFsWqeSQqLPqdMq1cVT6I7nNOx2FS5v7nfmX6LnXQYbl:lTeWatJ6ILs2FqDn5LXQYB

C:\588bce7c90097ed212\Graphics\Save.ico.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.27 KB
MD5	7b8d10a55a299a4a61dbfe091febb52c
SHA1	168912ae516f433c8f8dbefcc88a3d76ad2e25c5
SHA256	ca2741afdddc2f2f64ecaff8bfec8f1bf565df3874508ed2994bd330b780ae1e
SSDeep	24:abia/zagU85yuLF4vB3N15A0+bit9hya/aaxNtd/B8ntGPg:Y+gXyk+F5A0Nt9hxaaxNtd/BEgg

C:\588bce7c90097ed212\Graphics\Rotate7.ico.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.02 KB
MD5	4c35de049b7504a474d90a7a439798b5
SHA1	a282a65d16ff7648af77d285a0afb6f0262a827f
SHA256	ccdcd002c691a031285b8b42d19dae9595088064fec71f31aa1caa24ea88c080
SSDeep	24:1MypeDxtDbyTXYtME8QMOQX4UeOg0bIhuug/seBgzu1oS/xqKVIQ:1FkbDbIXYWE8vOnULbIJeB9oixqKVD

C:\588bce7c90097ed212\Graphics\Rotate5.ico.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.02 KB
MD5	49905b559626e963472df72fd72dc889
SHA1	53fda7d5a37b3bca3a40dfcbea4bfd1f2590650c
SHA256	6512b9f738fd7abb2be08d35f168fa4c41b1cdfc7a89fd0792bb3dcd38c44e80
SSDeep	24:laz2qX1zPLyqtvoNvBPrIkXGtDqboS/sWDbBlYv:lGrX1zP+qtvCvBDIpteUisW3Bls

C:\588bce7c90097ed212\Graphics\Rotate6.ico.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.02 KB
MD5	ba2ad8610f8e7180de25043cb7010db2
SHA1	51b1bfb4fbc2b41ae7ee86abb0c55c818eed2db5
SHA256	7c54bca594c54c2e90012f133d00ea898086a8ce7e11263a7e2551ddc250ca46
SSDeep	24:FiR4C2MFePWY8G1cXQiuzrKN84KZCNS3S/qHCf:EFI8G1CtQkAiqif

C:\588bce7c90097ed212\Graphics\Rotate4.ico.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.02 KB
MD5	76ebef9b0d632f32008b84834e5400eb
SHA1	8075b3394cc8070fb644d95201cb940f450100b3
SHA256	24e5a1fb58163c3ea6babb0c59c7c663a12249924a19d7c08dec485500e231f7
SSDeep	24:+yuXupZi5TY+O8uqlFFT2zHURYHfLuGJ9BIdx3faRihMm0iS/g4iAKItl:iXupZGT28PJRY/Lug9Bqx3PhMbiig9vi

C:\588bce7c90097ed212\Graphics\Rotate1.ico.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.02 KB
MD5	8282cc585bf4c800e45996aa6ab3702d
SHA1	bd28cf03e8df8df303706bfe60ac878aad8dec19
SHA256	60344ebe9ebbdbae2bff036c9f67ffa66fa3aae8501fd08b35bb264e0598d08f
SSDeep	24:T6xbVE61CSeTS2CLNua+TubAi9POQr3S/l0Zl9An:ixySyCZuynZOo3ilQc

C:\588bce7c90097ed212\Graphics\Rotate3.ico.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.02 KB
MD5	abf4fe48090af7af377cc2af33fec6eb
SHA1	7a4b41ede2e1024195b35a5729525570ae4759ae
SHA256	5e158e333f229a78017246751e731548fe0d5e52de81387eb7ac450e4021961f
SSDeep	24:1SLb97dv714fPG+NHW6su132QLoUnz1bSsS/GcDYr:qtp7+fu+lW6sG32QsUz1bSsiGUYr

C:\588bce7c90097ed212\Graphics\Rotate2.ico.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.02 KB
MD5	0065fb84b120774f5ba53a2157880ceb
SHA1	b225ca78b0770606217cd75fb3ffbce9a6cbdbcb
SHA256	fc67bd5ce401504bb903ef944549f9abf395bd054322ba703b6ec7d4dcd28ae1
SSDeep	24:36ACe0ro9l2/zTxD2C0JlGI8zkKAQ8kPEtJGGvNaW8XDCS/CQnvNwBG:3609l27tyCIlGI0NqGGv8WqDCiCQnvWo

C:\588bce7c90097ed212\Graphics\Rotate8.ico.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.02 KB
MD5	a7b0c9d303621b5a42571e22290d1ebe
SHA1	7822a2c6d518fa352c8ed8624e324c919cabae7e
SHA256	8318512f739a82c5e143d8172202c8e2ee8b465ee718d992c59d8c014158eb18
SSDeep	24:/fIz1eF/9Zr/iYPhC0ZT+EOdATEeV4TE8mzrZ/BS/StKPVU:/fIz1eF/9ZrW0ZT+EOmDViEBrlBiMKP+

C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.71 KB
MD5	d1b4c93613409080c0d62f710a194e35
SHA1	bddaf71fe6d3c9faa212a60f44c1234bfab9b2ab
SHA256	a6ba4e00256552306b122287ec9ba25d1021ef6e7371eb2e2aecb8d21ab4a9e7
SSDeep	12:KcTSuRWup61r59DpkxcgJA0aw3fGAPU2XCMgDiZzao3eX75j0HXiTNtMo1xrgm3r:JTyup6jkL3fGAPU2XCMgDi9urtcEV1xx

C:\$GetCurrent\SafeOS\SetupComplete.cmd.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.44 KB
MD5	95dc1fa0fcf5b39f2576d8493f3ca7e9
SHA1	3fb03556cf0566d0435d2b71be66b8d093539d6e
SHA256	87ff0dbf9ed00bced2fd8c0182224e5cec7aff5dc4efa28870f052caa64209b7
SSDeep	6:6O5VDLkLiaMm9wLoM5HqVNrUxYbn/fEXxWMqwGylJ9Got85xJ/FYGI1JkeXCmiqq:6OYLoK+BgrTEBawLsPN1I1RymynNFhUM

C:\Program Files\Java\jre1.8.0_144\bin\decora_sse.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	84.21 KB
MD5	a7fd3c5c67052c0fb8f46b86f4975bec
SHA1	80d0380eee23c720aa37e9289172e2d4f882ae23
SHA256	84df9b510bb9293ca6dadf3976a0e2170d2c18507226f8a506c72c5b6298c558
SSDeep	1536:9ssNUZDoVEGqwUbPfVZf0H5KuWYkYomiqyyJBz5B/sKd7P6XIbAL4EtxcCn:9s2KDDwUbPH0HpOvtqyy9Ge6XQAL4EtL

C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.00 KB
MD5	e6bdcecb7882379933a419864cd84c31
SHA1	88e44c46d8ef3a34ba77c286f2c0375d8d010b4b
SHA256	180cc10c1601669555f8ed19fb6915fce014682ec9f416b0cf8c23faef736c5a
SSDeep	96:V71NhBEtE7EFI3itXWXOEmfcpgSSLFchn:F1NvE6Y63mWXOEmkpgHchn

C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\NA02407_.WMF.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	8.09 KB
MD5	66ef419f64a9df2a7c5f5cb59e46252c
SHA1	bfbaf09871f44974c0b26c9725c79b5d7d5692de
SHA256	11e06ad68b309accdc3ce884d3a7c06b844bde032ea977ba54da28492b4d6738
SSDeep	192:fsyPGb7iHxYtJWHKaDse+ss9JT8RRGoHRGSqUGp/IIG4Vo7uCH:fXPGb+itQnsT7ARRGoDWtSH

C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\STUDIO.INF.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.71 KB
MD5	3431bd7cd516d3cf8cd1b42fed0c95ea
SHA1	522107d277cc779705a8123bbfca54b7434f8880
SHA256	ab544c84bae39c33e038d56b1e1768a9a1f8e8ff7c1ad0eb5ccb59190417ffaf
SSDeep	12:rg2aISHQfuU7BXbu+3qLiCvBUqFNwFTwJeiwYnj2Y+B7W/rBoipeH2ORWuSacLFZ:rg2LXb7BXbBqLnviQe6JezY+9W/rBvVr

C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\msipc.dll.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	22.29 KB
MD5	a605bbcfd7a878b4947782c292eae992
SHA1	96ac97a4756d9962e2682e925b21b69b6732ce58
SHA256	fabc8625af0fbd72e8f19a425717d008c0fed796dfdd6bda3ac6d2578ea3efa9
SSDeep	384:s/0NkI98I5I7lchu5UqcdQNT9t4MRDaukGCEjjAkP/o72XKB4/RWE4M:s8NkI98II72uRTYMR+ukOjjAtqnx

C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\SYSTEM\MSMAPI\1033\MSMAPI32.DLL.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	64.74 KB
MD5	dad5c4290da74fe7ddf7b7c79e980b73
SHA1	2d58e4de6faf226fd09460e5aaf160118b93367a
SHA256	d3440ddce93c29fed9439a94f70110dd9ff3f8678b39c4cc8ed9d53e89791219
SSDeep	1536:56eiEN89V5khD50jZ9h9VKHuaHdg7ylA4ktYZzeGZ:56ebC9jXjZb9IHd6ylA4kWNh

C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\SYSTEM\ole db\xmlrwbin.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	184.79 KB
MD5	f49e506845097dd1757cacefd133dece
SHA1	6d2f2895f4c2678e286e1bca691a7d3600093491
SHA256	9c2e93b833a6841fe807a08031412261d2522cf8a36d78acdbf8f1a96735fc3b
SSDeep	3072:+U6Hoij4PmM9gqZlbbGnunoYF7bWJe+UcajW61w61eAONwTCOenKFrwh+xN:wH3j4PA05zz7bIe+TYFS0ONFOkC0KN

C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\110\msolui110.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	289.32 KB
MD5	1d4d7fceac77aaeaf4762957a07d6bed
SHA1	de8d4a456df6c79d5dd87c9fb27f5d95ae32c3a1
SHA256	f35b691050a3264eae710115623ce75a4610e10e5dd4b1a9d6c3a70595630321
SSDeep	6144:2S/MqHrzAbvnH0Co+TmTuRTlBINGIP8M9e4GCS9TGKfsJ9fKwMOe:R0irzAbnH0f+TmTu9fkGIDeD9TJ09fKL

C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\110\Resources\1033\msolui110.rll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	13.93 KB
MD5	2af6706ab406e196a754023bb5b08f8e
SHA1	a9cdc13ee9d1bacd6839add5f81ab82de5e7e5de
SHA256	f72c3bd337b5202b2adf059582fdd1b177205b75a42f82dcaa329ec13f53a549
SSDeep	384:YFGWS3CbeK28dde7rbtrjBMmQwNX+bhTg:8GWSSbbs7rbZdMJU+1E

C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\110\Cartridges\trdtv2r41.xsl.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	27.21 KB
MD5	956b7324ccd15398f47ab7477f483832
SHA1	1bbc5839575b6bc8e1399ecf33649b8c8af0e5fd
SHA256	b01262e2aa6c432e232bb3b6afc64408ea36e0debf887ac154425b16a4abdeeb
SSDeep	384:DGiHHls3NJsJIfVERbzD0L0d/drLpKQFtUAM9WNJtzrTf0AqlNLu304Twx6axua:JHFs3NYIfV+UL0fX/Ftw98zzPDqltuDo

C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\110\msolui110.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	273.92 KB
MD5	b0e95e34825c8d5d71b27b0a6a9ac483
SHA1	9035326384d0a2ba6912d70aaf1f9f51022cdea4
SHA256	b6059546bd63a560627e7c7311e3b75497771bdfd7c13b6d2b1170ffe7e4c572
SSDeep	6144:MmlB/OWIreKsf3LPyzYH/6Gt/M3ExqVNp/biDfW5WFa0tXI:Mm/mFeKsf378k/6K/MxVzbiDfWQIEXI

C:\Program Files\Microsoft Office\root\VFS\System\VEN2232.OLB.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	51.75 KB
MD5	dd5996e6424f5876b058cd1f326d77b0
SHA1	8de7ff7413262b8e499231c054daa52e401f4fec
SHA256	d558485ddff586964f8ddeee04e0cad5e311d7bfb4555a1f96b330d833a08ae5
SSDeep	1536:ZmUrvT16hgxxIehrYf+NHabQk7Bi0tV1uD:wUrbwOVeE0tSD

C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	7.77 KB
MD5	b857dc9bf3b06f523c1ef53ed7f4325d
SHA1	2de640f58c41000623aead1aa859af8e376f290a
SHA256	023ba95c5e9382c6d7e833467600a205c0557dbe5616e4d6026ad13830fd7696
SSDeep	192:wbjEGMgMB/ojjRlIubpHGMFx32h15Z1lGbrSpf/qHT:2jXyB/ijnIubskkhjZLGbW6T

C:\Program Files\Mozilla Firefox\browser\chrome.manifest.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.14 KB
MD5	4f35228e68624384e78607293e19caee
SHA1	72ea42cb4cd7c2a819aa15e186bd5a8676217280
SHA256	8a46158ef80e24331f2cc08e02c6ad09982814a790f0203ef89effaa287df66f
SSDeep	3:sdRJ//PWIOAiq5K6ErKRgoZQdCefXfpB33JnyB80d8ArzEGIn:uRJ5OhehRgBCAvpVJyBf8GEGIn

C:\Program Files\Mozilla Firefox\browser\blocklist.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	273.75 KB
MD5	612f273ef5913769f7fb5d07971ed739
SHA1	00eff021ee806c31c19366226bf5e54e0bd58c34
SHA256	410af6b5b25bf5ab716958b3a0990d301674155eceb5a5497d3db0fc26e43764
SSDeep	6144:gNt7ACqsK15sPd0Z5kMrvl8PQUwiUJi7++K2:OMCqp1WPOmel5UpUU7+I

C:\Program Files\Mozilla Firefox\dependentlibs.list.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.63 KB
MD5	3c14f93bb72414124716b4686c8cec97
SHA1	fc6bd596596b60aceb193ece8d549a13dfa7b51a
SHA256	4774474aba978750c0596edf745d1900468b3e6b54cb12a5c6a237308a365442
SSDeep	12:qEri4QeoeJvD/Hyall93amLdrnbQoNMeE7Qt6ylAs6eIspHBMd:t2EXTHyan93FZreyihspH2d

C:\Program Files\Mozilla Firefox\freebl3.chk.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.02 KB
MD5	b0d2177749004ddd878a90b1b97cc33f
SHA1	cbf405febc581bb770c0144784a81168193ff396
SHA256	bb8af61cc7b77a2e6c5036241e8e3c66e4c0a4a380718159353fd67b79ed4d86
SSDeep	24:gGWE34bnAURJly1uv6Pxkb8QPxTzrEv6po0n:gvK4jAnxVoEipo0n

C:\Program Files\Mozilla Firefox\ucrtbase.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	973.83 KB
MD5	6b404b648fb671ff4ba0cfa008c92ad4
SHA1	60d1ba77023cf5f04b48175860efb09214e32e8d
SHA256	4eaa894f45658cd1ce508760d039608afbde1449cc5301f8cde882c73d63ce20
SSDeep	24576:h2Yg9WoLfA36uCNrQ+J1UCB1Yb1sKUiYeNzyJ67GQ4:h/b+86uM0+J1UcYhs8yYI

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	5.21 KB
MD5	c4fa7be76d0db28ec7d5460a7b7fa4f6
SHA1	1334fd61e30fa033583773ef2f14c86365b1fdcb
SHA256	1aa9b332b9487ccb3bf9d316e7314dab61e739a1e2ee858e2f40f13e742b7694
SSDeep	96:ccgcgnmK5AY6/F5UCpYiOjYsq/rrncASPRm2FjMVb1IKHeAOSov8B9wF5mIn:cnl6d5dWiOjYbrc9PRm2U1IKHiv865r

C:\Program Files\rempl\remsh.exe.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	404.15 KB
MD5	701c873d6986dc2a51dfb925ac53afe4
SHA1	fb93d3d3356c3d39e03eb66c7a5650b7905f6850
SHA256	f789a8f7a2224be0c32038b2659174d87fd20b77f8a280dfe500a09e32d27548
SSDeep	12288:b9skxfyvUT3VserzN+WdjZIzz4tmlAir2qtUo2ZH10+:ucqSFseVi/N+ir2qtkZHy+

C:\Program Files\rempl\rempl.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.94 KB
MD5	252a596e8ac46861693bd57c12077651
SHA1	85a0761ad5a282258e95e1942d09c72edca9ed43
SHA256	b0548d2562362d04787f1f7603240956025f2eedf2b6871b807f36ba534c59ec
SSDeep	96:d3meNxuY4bsuQvV9nsLebvuzabc+cqIQwla:JtxuY4bspdtsLea2bTInla

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	42.14 KB
MD5	8cc2cef1162ae8d7ebcca7261f45694a
SHA1	73fd1465661156c15c280c126137276e1d8abe46
SHA256	69858caf966cf9d99dbfd49da84e7ba4695a7c9967c36d3112c31774eacff87e
SSDeep	768:p5beGwdOx+z+ThKQAcw1vl0OUaP7fPGjWJY4UTlDziLhVdqIiCmLO+e62EM:XQ0Ext1vlLUaPrQWmTT4VdaLOr6U

C:\Program Files\rempl\Logs\Remediation.003.etl.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	128.14 KB
MD5	9eff8affd8cbc5f12b46195af7bf5295
SHA1	094e248cb75e0439e919297c4a70185c3043479c
SHA256	98b0f393be1cd38e272a50003d2da6503172d33748f3d22f9bb3c7d46c691a1d
SSDeep	3072:HZnS7huxgrRqEZ9z5QRNIIPGf7uy/dLtmhVKgZv1VAiZUDLxnIs:yIIQT3Gf6ynNAFZc+s

C:\Program Files\rempl\Logs\Remediation.002.etl.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	128.14 KB
MD5	363725a63ab48cc05562bc06c4e1c87a
SHA1	1b78148dc8f462e9c3c565ebe3985a802afd8e2b
SHA256	35b0ebc1edafab5a19ffed47a59582a1c120c462cc63483fd41df8c949b86c25
SSDeep	3072:tpzZPOehpB2uvBCZ3F8rR6pK0D7w8PeKfeTNSRQ:XzZ2e8uvQNKrR6pf/TzGIy

C:\Program Files\rempl\Logs\Remediation.001.etl.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	128.14 KB
MD5	d446b98dafe82e4e5242cc474d0eb2d0
SHA1	b975f4f5d111fe946c4e1291fca88fb56702fbe5
SHA256	f06176085f2df7c8b6747c4403826a3b0196cee34e1635eff4c53476772ce23c
SSDeep	3072:qnbltcxSY4L+Zx6AGGI/WoqWZSZiSb5qqIQQl:CltA8+Zx6AGg0ZeipqItl

C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES\toastreviewsettings.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.58 KB
MD5	939924c5d7082fd632e14bb0c3306eaa
SHA1	17ee599ccad99479555d219b12c4759eedf73d45
SHA256	28a9fdaa42e84e22becc7711ca08bb302f59fca82bbb63ab72a888e976ad07ac
SSDeep	12:JOOCDEPJBWjUsoyMK5s1OtL82TLM3hSg/a5eLeCwBSR:J5PyjUfyi1OtI2H+hSiaAhESR

C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Config_131491847713900000.json.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	36.35 KB
MD5	3b90dd22ffd3aad9240a3653dd4e2b41
SHA1	b8dfde0a97578c22f71cf356c45a3dd962a083d7
SHA256	fc44dc30987d406909878290c7c61fb387531c96f3452887a9830ee2b4be3d08
SSDeep	768:NEmmsbE62a4vBuTyxESxHUqCvUtzpUz7HCSsjWw6rjKTKSWghD:N7fV4JvxDpUNvaWfCbw3KEgd

C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES\toastbeginupgradeth2.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.55 KB
MD5	077ce77055a7df78f7697bb18f1dff31
SHA1	3dca90ae1f17a57267d18591c29b3efd3591d0e6
SHA256	3c38e3931ee7e4c2883d882b44556a80a7336ce326c007656c11d82a9ce46392
SSDeep	12:53oYoNAjkWRYl39TyU5mk0nKlaTlP1NiHgM6MyTlsLfYm9cXQ1it:5W/WU4pnKlaVjiHgMc+LfYccDt

C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\el-GR\toastbeginupgrade.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.83 KB
MD5	ac41d08bd01d9ceb3aca037db20b4a8e
SHA1	53efcd02aa98d07d6bfe7e04a8bf15040b812055
SHA256	fcc61e548bce9e5e1a53a708867105c40deb9e1a85cb36676f7b2e4db0ae4ea9
SSDeep	24:6fhoWkzk53AIHgxj8zdnEiFodji2FvdXAnPOCkAS:MFCk53Jm8p6FvdXNCkAS

C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\el-GR\index.html.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	57.33 KB
MD5	185298aa051e0e86b4ec9fc6d5e9e67f
SHA1	c68a3e6add6f7cc4a9655305f6f70b7b28504a53
SHA256	3d84d64f1c28e45b12a0956e21c8242aa167a2b0f0f76a4f754ebe55b9e21d7f
SSDeep	1536:wYhB5Tn7Zw4W5cvtyAsSSdNwJC8OQYcXMOl:9B5TnlW5cvtXqNwJUQrMS

C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\el-GR\toastbeginupgradeth2.xml.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.64 KB
MD5	00ef1bb8f6c0e4a9e1498b3a22ceceb9
SHA1	65c134418b7615415872cee104004133af683678
SHA256	0513dd9691c8d2ed1de3f3c46621ed595c1586a29f0dbea39ecfc7c5f79bfd8f
SSDeep	12:Q4G5TI/baXyYvfqrbOVDvb1feyBYiAVL9VNhJlwjzgSyRKihbxkrj:CIWXyafAbOBvbcVRVNhrw5qZSrj

C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\STUDIO.ELM.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	48.13 KB
MD5	426e3e5bd08700800757e515be10f337
SHA1	c6e4471cc6a18d9e49b51c266632f0c3014ac04e
SHA256	05808f44c76a2d9aa79bb918353423213441c3896996bea74c8eb4f0e4cd27ec
SSDeep	1536:jgrsCPDGnR75An5Fqs/qQ1yPkPoIrr2ako:jgrsCPDse7nhwYP

C:\588bce7c90097ed212\netfx_Core.mzz.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.00 MB
MD5	a0fcf69d07a5865b6ee8426bcbdd19db
SHA1	27db3f1b54a5d54790a10fc8c1c717f6446a51b2
SHA256	54e4d5a428ed96b5b6a928bf806f5d2a173df2911ed41830e3ca1f713d1a01c1
SSDeep	196608:jgXn3FLHgFmE9t+h18uDTUgby7NTh0Pb4upG2fX9sDzI0EHi2UJSyU9bTEsao1wT:ja562Gu0gbEmlLXO/qXkSpV51wXpG5g

C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.96 MB
MD5	c88642eb71361228c771f31183c2459e
SHA1	6dd7d1cba8d5b4637b834dbf0fe64c1becaed511
SHA256	2e8484ef47380ebc19647bb7d82942c5677192ea80862c567448d84fc6d5b204
SSDeep	98304:GV9skpNVRSRHzaork/+NSDCL4HfnQ+GL7ThMduGjt:G8+RSRTk8N4/9GtMddjt

C:\588bce7c90097ed212\netfx_Extended.mzz.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.00 MB
MD5	7574c7030184fbf28672d1ba0ebc05e3
SHA1	78af4d76c1de5eef4d81f8385d4c6a771bbbc787
SHA256	58059542dab990fc9269a95e80d8c217f6ded08ffef46cd17be8830089c47918
SSDeep	196608:SPvzGTWbpXlnTKjdnlwR47POM3iC8fMRsmQ2iz+OUJL0U6gRXCwPrB7mTpGll:SPvq4TKx24OBgsxz+T50U/S+rB7EY

C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.86 MB
MD5	e185214bb1119ad0ec506421301755de
SHA1	2786598eb8d472640ba4c4749d64432e64f2e37f
SHA256	766c603a90b57842a1dbc5feb46c819be718e7bb9c33d790b18a142f36b0bfec
SSDeep	98304:S6+8eXkmZfFN4EQ5VJ76qAWdounjnVFaYczc9UI+isMfCDx//u6ye1lo06EW+b4m:S6cXkmtf4EgVJ76qAWdjnjjaX8yzt3yo

C:\Boot\Fonts\cht_boot.ttf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.70 MB
MD5	3949c1c630edaca6bbfade8a594d1c70
SHA1	d64e212f152cc73f67213f10fbb437583a12bbe3
SHA256	9112fcac46d78ae73df2072268f258c8b83850b1b144f4ff8a45a0b95a439d45
SSDeep	98304:pvkrV2V/CNUEKRfIslduS84JxW0TD8ayzxUK:pcAVpEGlduSHE0nNyOK

C:\Boot\Fonts\chs_boot.ttf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.52 MB
MD5	1df25f65f585519e0300afd249238d8e
SHA1	16766a5772604b324d0951ae00508af243809a5e
SHA256	8b694849e3b78d6b4fb901975f310f02de786da4cdeef92a344525102b087fb3
SSDeep	98304:T2B2W3XER4PMd5icPJCVGsMX4kRtsOauHR:CBR3G4PMdrhCVGsjkPsObHR

C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.09 MB
MD5	85cd2c82ae7e1c4407c47642324a82c3
SHA1	76fb0de7178388a9796b3334c45cc49407a7a117
SHA256	855512900aed33edca5817e1b2c825788699f19314698d0385f979abc51c3dee
SSDeep	49152:TY573Z4y+QZMxJ4oviicwMQbd8MZbJDDS30pNibDe5tdJ:s5eyVMxDviicId8MZbRDSDDqHJ

C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.04 MB
MD5	f16ebdcc6ce1d54710e69f2cf849efa1
SHA1	95598770a339745a53d864f768f44dda0867fbed
SHA256	6984caaaec516cda5e6e170049f9c237ae35ba4ee970c162422cee9a5341fc30
SSDeep	49152:ijSPyouCYcA9zPMoVpEd/aRXk+jf+TdytteuYDN/wb3au9kK44:go1sjtV2d/a1k+jfBttefDuv9h9

C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.07 MB
MD5	967d4220e827ccd52aec90bba3a69ce9
SHA1	bfec072e368347ccf039589fea45d8f11118b50e
SHA256	42d77992896422f54a1e44782abc2e62520833978f04e9553a8898bfe6978ac4
SSDeep	49152:Whp3u1Dl+5akle3aPZYG+KFM3XttX/d0nwxDVx+CTf:2p3swPYs5S3XrenWDVR

C:\Boot\Fonts\jpn_boot.ttf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.89 MB
MD5	c35283998f7928f20b725c80898b0dac
SHA1	d4ca6a213c551ab677fb08a5d9f27f4ff65c9845
SHA256	c512da1294d344d73d02a191bf3647f4afb80777d2b07615014642908619eb48
SSDeep	49152:fcCSWzpkpsHl0r3pJuXJyNuOK+aYXQJRhrj2jxx4rCCB:2Wqpbr2JmuDsXQfhr69arCCB

C:\Logs\System.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.07 MB
MD5	7b02aedf88fd1a3e186ecdb0e8007a9e
SHA1	2d998bb9c93c8b2f17376ff2b071527bd3679147
SHA256	7f77cc0eab8ffed8696b65bed2ac304467a47709f2edc37e9c997217b7934052
SSDeep	24576:31WY3vNwkVE/ZnVE7042KlJ0c/9c+7NuaN5J:3EH/ZnKac/9/Xx

C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.00 MB
MD5	4e82f6e65fb946405bdde112b52ea707
SHA1	d1adfc3775c54dedfe51e2029114b68551d8ecf8
SHA256	ab5cb58cf85942e94c0a54b4828f2d9fb404f77c3066b1e3ae0c54411c2b6755
SSDeep	24576:tZQU9p+0mtzOIaf7IXly2/NxKewF/WA3s8Qtl9q:tZQ+pXmtzOIa7IlXRS/dsTtu

C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.00 MB
MD5	b988196df071840ddd049f1823d89966
SHA1	31f3d15ad5e87fce85e82612f23b497cc2735117
SHA256	7b7bec1b48e90f0654752da015a7f7089b2de2976e680af7e994e2e05a8fee45
SSDeep	24576:/uHZKnr9LZKO+Y1JS01o1l9/EC+f6kO9rcPtZ4UserFigg71y:/uHZuhZD1oj+ikKA7serMgy1y

C:\Boot\memtest.exe.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	793.05 KB
MD5	660f608036f9d24153e11644b5dea537
SHA1	800f37757a57542095aebf3a4c014c92b1fed1b5
SHA256	a40242b06e5c08f5c1095654df97b95dd62beee3b4b709ab7db30960c7d43974
SSDeep	24576:VTArxom81He/vNN46D4QgNg35PSvtvwasFeVddTh24UrewZ/z:VTUxoHmN46v0gpPyZwOddThRUrewZ/z

C:\bootmgr.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	386.11 KB
MD5	08d12c35e6f02026cede69d3816ef0fa
SHA1	892a27f0011ce74b9f69a650b89cbd084d154288
SHA256	3c2ed605ac7ef39bbbe63445bce5bb673a6283c751975a01173500589ced79a3
SSDeep	12288:ynk3KsxE3J57sBiIVEzy4+RHBqn3Yx+t1:y8rGJ2hZEox+L

C:\588bce7c90097ed212\SetupUtility.exe.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	93.98 KB
MD5	b8feef7eca627e817d50e4ae3b306cf6
SHA1	9b79c29d6c07c60eeddcb075f2970946c39fea00
SHA256	a8a8f4c3960586c9b4e56c216c9c91cd36347d6dc571fef050c18af210554e4e
SSDeep	1536:JWLmXzba6E9kOxPMccL2h9+xQqvm2C9mLiSWbamCR9TfzAz1pMB4nltcVOCApYu7:wCE9kVHLM9I+2hLz3Az1pm4nsMpYuDsK

C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	4d757e6df9852062ede2ccc3999dd7f2
SHA1	643fd378a0c491fc3360be70b5d1dd147be804cf
SHA256	3a03cecb324b6b160b897fb42c9c800d7dff71d2f1f3fea35fc7fe640ca7a6d3
SSDeep	1536:83CTAd3U3au7imkKxThrq7uK8DObs+I49cRqgLFln:8STAdQ7kAThIADOb+49czFln

C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	436f7e067731aa15efd622c8f4c270c2
SHA1	bcfab66cca5515351348bcd8e0fe0c579e0c2a24
SHA256	a4edbfc8002508ff9324ed84438c74d1f41536ec1d7dc6aa164dc9bdd34028d9
SSDeep	1536:Uix27LV1C9ksIpwELYualcHoIPNcmJbxKR:mRI9ksqwQalcIgyGxKR

C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	d3d8c0d5c2f5e3bfe47b503a59141edd
SHA1	c4035492cf8f47f1a98abb9d65f6125c3c529e72
SHA256	d02eb2ee9b83e8324fd3383c614c1b6648345101455a6652fa2d562fe01ca780
SSDeep	1536:0Nb5zf6s4kjAxg37N59+KiG8Hs5fdZPFp8fBYDomvN:mdzf6x/xg37N59+T/mdeWP

C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	74caa354269294387e4638121a7d4729
SHA1	ffd800ef4b9ba91c15e445c705541c334609ed2f
SHA256	a8ef0a2167372975fa08cf3341659d6c440dbdd0517b3721ba925210713d2300
SSDeep	1536:3PA3r/LGszODg7YZAOwksZpGgg6bwOgFAZQZNOmPWTs9sbezSFh:fA3r/L9N7KUl8VrOmP/Obz7

C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	f97acc3a49a4d5ff91fa4c1024dae84d
SHA1	08927b8c2fcc0fa5f7a64e6389a6a7a12092439f
SHA256	e17a75b9122e90981339c11b7b65f909d2e103bb9a18ba08e53c5bdcf8427ce6
SSDeep	1536:490IFMk4EvQT3vHA1Gs0i77+tp737XWIkczUvYH:y0IP41T3vHV3tp73iIJ/H

C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.14 KB
MD5	9efb609b44e9fc360b38ba5b16d2de28
SHA1	922c0f9c2aa50b5398b88f6fbede8b68063898b2
SHA256	50ff0590e4f67adcaa5a55b8149ec26e6f8071b72afdb95898783e6d444e90e3
SSDeep	1536:dxRw3fIkVPeMiB5qGB0wduWic8kQdJQdas/lLO8DNDiBC9Iw:NwwmPePB5ic8kQnQdbLTqC9V

C:\Boot\Fonts\wgl4_boot.ttf.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	48.08 KB
MD5	af23eea0481257fccb9cdfaefdb4db9a
SHA1	5c8132a837bf7c4c42aa73b72a1d42de7c98f4a7
SHA256	ba4f4714c846d3ebc82b118121dd9e8f1f5ced0977899ea5a26e5e00763dbb68
SSDeep	1536:34C1vcGSJ9+yRTjB1BwxRCIEejook7skBSDOlOhU:3zv9SjjB18RrNjookYUWOlOC

C:\Boot\cs-CZ\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	44.55 KB
MD5	fce01a7400cd3bf1a0fbf1998fee1563
SHA1	9a64b0f01e4fc0d5538538622e5f73a19daad4b5
SHA256	d14335b4a93d580141e6a49949849a80619b227d5db67850150ccefaa262f941
SSDeep	768:5rYKwmunbaLO4ht8KECbJH5BWPELYzZDU3a2uc2Zh6j6XfU8Sa:OKwfbsv8KcELYzZDUqF/ZXfUO

C:\Boot\tr-TR\memtest.exe.mui.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	44.55 KB
MD5	705e42ff1a409e4fdb19bfca730c5c4d
SHA1	112d11d19307452742631e92188568764c0e47a0
SHA256	9b9e7ff56e2d4a4954593bbe1c82266337fa2e5586fde304ea2214d60a779a11
SSDeep	768:AQVMKnUaRHEXej7ukRJkeGS12ooXgxP4wTGzxHnpMSovLFEkDszn05:ALK3t1jvReCxwnZ2SEDg05

C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	12.09 KB
MD5	512799f1aeb32191cd7b9eec683e553b
SHA1	5dba8827da185bd06dc25906e1fc730cd8203600
SHA256	011cce94073b31ba9ac0aea6c0986dc66b1b2aaac49017baa05731ab3382fa0a
SSDeep	192:adI273qkZWSJoZGirUtskJftrlR4Q+Nu1SqJ3c:aT3qkIE2xrURlpKu1Fs

C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\VBEUI.DLL.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.50 MB
MD5	b5b3e13ff632f042d1293cc612b9a82e
SHA1	a5c7d1d2ecb5c6811cebffbbff2c7d70885e68ab
SHA256	f16deac4b3bee805493c39819132a4add2bd5eef076509a68ef9568e0357943b
SSDeep	49152:xi2jCITiVK73Ohjo3pn0W0fN03k7cO6huvUeK32x8m7YOOkXljcUM3gu:xi2jClO3OVo3pnt0keUeO5m7YOJpeB

C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\VBE7.DLL.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.18 MB
MD5	654af4ab686e82198c2f10137537f0a2
SHA1	fda9388dd1d24429c7203fb68f83f0f5ef7d8bf2
SHA256	a9a07454eba135665f62ea7d97f35de974f74a9f9361650c726fdf4a0c72ee54
SSDeep	98304:o6uT1MugaqUqMwWXGxSb1nPkI16jiPPhbwNz4:g1McqUuWXGI1Pka6ywNz4

C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\OFFICE.ODF.locked

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.72 MB
MD5	f1239868449b8c2d157373c72fef28ed
SHA1	f61ad71aadd30fd532624902a92d3c142a3cba11
SHA256	b2cbf6a7622e4476542ac5021e25dd3dc30c5fb182cd4b3e7072773bc689b248
SSDeep	49152:Xc/s4HqQKFx6S0jAHk2CKrX9YPqbj1wB3:s/Lce8kZwO2M

98881805af50c26f79c1bc073dc578979c46bb4f86051011a3799fd8b6b01c63

Downloaded File

Stream

Not Queried

»

Parent File	analysis.pcap
Mime Type	application/octet-stream
File Size	0.46 KB
MD5	dbcbb5e200f3fa07f2bd5305a6832fec
SHA1	a7030aceee1e050a26f1becd5ae9e9f47ca7da21
SHA256	98881805af50c26f79c1bc073dc578979c46bb4f86051011a3799fd8b6b01c63
SSDeep	12:JBD35x+Jx2VtX3YtPQEulTEWx0FiHO2dBo:Jp3SqXItPQEmEWiAnDo

ebf3e7290b8fd1e5509caa69335251f22b61baf3f9ff87b4e8544f3c1fea279d

Downloaded File

Unknown

Not Queried

»

Parent File	analysis.pcap
Mime Type	application/vnd.ms-cab-compressed
File Size	7.61 KB
MD5	fb60e1afe48764e6bf78719c07813d32
SHA1	a1dc74ef8495c9a1489dd937659b5c2875027e16
SHA256	ebf3e7290b8fd1e5509caa69335251f22b61baf3f9ff87b4e8544f3c1fea279d
SSDeep	192:CPTIWKvNnUBBBL05O/b0evl2G6AXK+KMlYX82:CbevNUBDLlz0eN2dAXlKH

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After