7ddbd9d1...a18f

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1.exe

Sample File

Binary

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe (Dropped File)
Mime Type	application/vnd.microsoft.portable-executable
File Size	156.00 KB
MD5	55030a1c4072b1b0b3c33ba32003b8b5
SHA1	dd0c8fb141b27a9bc0f7c3c21646c0ef6b503632
SHA256	7ddbd9d156f58969e172c3ecc91b230ac1dff4c185fa7db0cf07aa2c4e3ea18f
SSDeep	3072:HEX73H1IPfe7ng9UfmeUS1ZQb/LvmL6A41q6FCCBXnOMkm6Hl9B:kX7m+SUay+AIq6YCoMkd/
ImpHash	31e19f3bd1157ddfc48e33fddad1f645
Parser Error Remark	Static analyzer was unable to completely parse the analyzed file

PE Information

»

Image Base	0x400000
Entry Point	0x422314
Size Of Code	0x21c00
Size Of Initialized Data	0x5000
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2019-07-03 16:57:59+00:00

Sections (9)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x20cc4	0x20e00	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.67
.itext	0x422000	0xccc	0xe00	0x21200	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.11
.data	0x423000	0x16b0	0x1800	0x22000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	3.93
.bss	0x425000	0x5234	0x0	0x23800	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
.idata	0x42b000	0x11ea	0x1200	0x23800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	5.01
.tls	0x42d000	0xc	0x0	0x24a00	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
.rdata	0x42e000	0x18	0x200	0x24a00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	0.2
.reloc	0x42f000	0x20c0	0x2200	0x24c00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.58
.rsrc	0x432000	0x0	0x200	0x26e00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	0.0

Imports (15)

»

oleaut32.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SysFreeString	0x0	0x42b3e0	0x2b140	0x23940	0x0
SysReAllocStringLen	0x0	0x42b3e4	0x2b144	0x23944	0x0
SysAllocStringLen	0x0	0x42b3e8	0x2b148	0x23948	0x0

advapi32.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RegQueryValueExA	0x0	0x42b3f0	0x2b150	0x23950	0x0
RegOpenKeyExA	0x0	0x42b3f4	0x2b154	0x23954	0x0
RegCloseKey	0x0	0x42b3f8	0x2b158	0x23958	0x0

user32.dll (5)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetKeyboardType	0x0	0x42b400	0x2b160	0x23960	0x0
DestroyWindow	0x0	0x42b404	0x2b164	0x23964	0x0
LoadStringA	0x0	0x42b408	0x2b168	0x23968	0x0
MessageBoxA	0x0	0x42b40c	0x2b16c	0x2396c	0x0
CharNextA	0x0	0x42b410	0x2b170	0x23970	0x0

kernel32.dll (33)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetACP	0x0	0x42b418	0x2b178	0x23978	0x0
Sleep	0x0	0x42b41c	0x2b17c	0x2397c	0x0
VirtualFree	0x0	0x42b420	0x2b180	0x23980	0x0
VirtualAlloc	0x0	0x42b424	0x2b184	0x23984	0x0
GetTickCount	0x0	0x42b428	0x2b188	0x23988	0x0
QueryPerformanceCounter	0x0	0x42b42c	0x2b18c	0x2398c	0x0
GetCurrentThreadId	0x0	0x42b430	0x2b190	0x23990	0x0
InterlockedDecrement	0x0	0x42b434	0x2b194	0x23994	0x0
InterlockedIncrement	0x0	0x42b438	0x2b198	0x23998	0x0
VirtualQuery	0x0	0x42b43c	0x2b19c	0x2399c	0x0
WideCharToMultiByte	0x0	0x42b440	0x2b1a0	0x239a0	0x0
MultiByteToWideChar	0x0	0x42b444	0x2b1a4	0x239a4	0x0
lstrlenA	0x0	0x42b448	0x2b1a8	0x239a8	0x0
lstrcpynA	0x0	0x42b44c	0x2b1ac	0x239ac	0x0
LoadLibraryExA	0x0	0x42b450	0x2b1b0	0x239b0	0x0
GetThreadLocale	0x0	0x42b454	0x2b1b4	0x239b4	0x0
GetStartupInfoA	0x0	0x42b458	0x2b1b8	0x239b8	0x0
GetProcAddress	0x0	0x42b45c	0x2b1bc	0x239bc	0x0
GetModuleHandleA	0x0	0x42b460	0x2b1c0	0x239c0	0x0
GetModuleFileNameA	0x0	0x42b464	0x2b1c4	0x239c4	0x0
GetLocaleInfoA	0x0	0x42b468	0x2b1c8	0x239c8	0x0
GetCommandLineA	0x0	0x42b46c	0x2b1cc	0x239cc	0x0
FreeLibrary	0x0	0x42b470	0x2b1d0	0x239d0	0x0
FindFirstFileA	0x0	0x42b474	0x2b1d4	0x239d4	0x0
FindClose	0x0	0x42b478	0x2b1d8	0x239d8	0x0
ExitProcess	0x0	0x42b47c	0x2b1dc	0x239dc	0x0
ExitThread	0x0	0x42b480	0x2b1e0	0x239e0	0x0
CreateThread	0x0	0x42b484	0x2b1e4	0x239e4	0x0
WriteFile	0x0	0x42b488	0x2b1e8	0x239e8	0x0
UnhandledExceptionFilter	0x0	0x42b48c	0x2b1ec	0x239ec	0x0
RtlUnwind	0x0	0x42b490	0x2b1f0	0x239f0	0x0
RaiseException	0x0	0x42b494	0x2b1f4	0x239f4	0x0
GetStdHandle	0x0	0x42b498	0x2b1f8	0x239f8	0x0

kernel32.dll (4)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
TlsSetValue	0x0	0x42b4a0	0x2b200	0x23a00	0x0
TlsGetValue	0x0	0x42b4a4	0x2b204	0x23a04	0x0
LocalAlloc	0x0	0x42b4a8	0x2b208	0x23a08	0x0
GetModuleHandleA	0x0	0x42b4ac	0x2b20c	0x23a0c	0x0

user32.dll (12)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
TranslateMessage	0x0	0x42b4b4	0x2b214	0x23a14	0x0
PeekMessageA	0x0	0x42b4b8	0x2b218	0x23a18	0x0
MsgWaitForMultipleObjects	0x0	0x42b4bc	0x2b21c	0x23a1c	0x0
MessageBoxA	0x0	0x42b4c0	0x2b220	0x23a20	0x0
LoadStringA	0x0	0x42b4c4	0x2b224	0x23a24	0x0
GetSystemMetrics	0x0	0x42b4c8	0x2b228	0x23a28	0x0
DispatchMessageA	0x0	0x42b4cc	0x2b22c	0x23a2c	0x0
CharNextW	0x0	0x42b4d0	0x2b230	0x23a30	0x0
CharLowerBuffW	0x0	0x42b4d4	0x2b234	0x23a34	0x0
CharNextA	0x0	0x42b4d8	0x2b238	0x23a38	0x0
CharLowerBuffA	0x0	0x42b4dc	0x2b23c	0x23a3c	0x0
CharToOemA	0x0	0x42b4e0	0x2b240	0x23a40	0x0

mpr.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WNetOpenEnumA	0x0	0x42b4e8	0x2b248	0x23a48	0x0
WNetEnumResourceA	0x0	0x42b4ec	0x2b24c	0x23a4c	0x0
WNetCloseEnum	0x0	0x42b4f0	0x2b250	0x23a50	0x0

kernel32.dll (61)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WriteFile	0x0	0x42b4f8	0x2b258	0x23a58	0x0
WaitForSingleObject	0x0	0x42b4fc	0x2b25c	0x23a5c	0x0
VirtualQuery	0x0	0x42b500	0x2b260	0x23a60	0x0
SetFilePointer	0x0	0x42b504	0x2b264	0x23a64	0x0
SetFileAttributesW	0x0	0x42b508	0x2b268	0x23a68	0x0
SetEvent	0x0	0x42b50c	0x2b26c	0x23a6c	0x0
SetEndOfFile	0x0	0x42b510	0x2b270	0x23a70	0x0
ResumeThread	0x0	0x42b514	0x2b274	0x23a74	0x0
ResetEvent	0x0	0x42b518	0x2b278	0x23a78	0x0
ReadFile	0x0	0x42b51c	0x2b27c	0x23a7c	0x0
MoveFileW	0x0	0x42b520	0x2b280	0x23a80	0x0
LeaveCriticalSection	0x0	0x42b524	0x2b284	0x23a84	0x0
InitializeCriticalSection	0x0	0x42b528	0x2b288	0x23a88	0x0
GlobalUnlock	0x0	0x42b52c	0x2b28c	0x23a8c	0x0
GlobalReAlloc	0x0	0x42b530	0x2b290	0x23a90	0x0
GlobalHandle	0x0	0x42b534	0x2b294	0x23a94	0x0
GlobalLock	0x0	0x42b538	0x2b298	0x23a98	0x0
GlobalFree	0x0	0x42b53c	0x2b29c	0x23a9c	0x0
GlobalAlloc	0x0	0x42b540	0x2b2a0	0x23aa0	0x0
GetVersionExA	0x0	0x42b544	0x2b2a4	0x23aa4	0x0
GetThreadLocale	0x0	0x42b548	0x2b2a8	0x23aa8	0x0
GetStdHandle	0x0	0x42b54c	0x2b2ac	0x23aac	0x0
GetProcAddress	0x0	0x42b550	0x2b2b0	0x23ab0	0x0
GetModuleHandleA	0x0	0x42b554	0x2b2b4	0x23ab4	0x0
GetModuleFileNameW	0x0	0x42b558	0x2b2b8	0x23ab8	0x0
GetModuleFileNameA	0x0	0x42b55c	0x2b2bc	0x23abc	0x0
GetLocaleInfoA	0x0	0x42b560	0x2b2c0	0x23ac0	0x0
GetLocalTime	0x0	0x42b564	0x2b2c4	0x23ac4	0x0
GetLastError	0x0	0x42b568	0x2b2c8	0x23ac8	0x0
GetFullPathNameA	0x0	0x42b56c	0x2b2cc	0x23acc	0x0
GetExitCodeThread	0x0	0x42b570	0x2b2d0	0x23ad0	0x0
GetEnvironmentVariableW	0x0	0x42b574	0x2b2d4	0x23ad4	0x0
GetEnvironmentVariableA	0x0	0x42b578	0x2b2d8	0x23ad8	0x0
GetDriveTypeA	0x0	0x42b57c	0x2b2dc	0x23adc	0x0
GetDiskFreeSpaceA	0x0	0x42b580	0x2b2e0	0x23ae0	0x0
GetDateFormatA	0x0	0x42b584	0x2b2e4	0x23ae4	0x0
GetCurrentThreadId	0x0	0x42b588	0x2b2e8	0x23ae8	0x0
GetCurrentProcess	0x0	0x42b58c	0x2b2ec	0x23aec	0x0
GetCommandLineW	0x0	0x42b590	0x2b2f0	0x23af0	0x0
GetCPInfo	0x0	0x42b594	0x2b2f4	0x23af4	0x0
InterlockedIncrement	0x0	0x42b598	0x2b2f8	0x23af8	0x0
InterlockedExchange	0x0	0x42b59c	0x2b2fc	0x23afc	0x0
InterlockedDecrement	0x0	0x42b5a0	0x2b300	0x23b00	0x0
FreeLibrary	0x0	0x42b5a4	0x2b304	0x23b04	0x0
FormatMessageA	0x0	0x42b5a8	0x2b308	0x23b08	0x0
FindNextFileW	0x0	0x42b5ac	0x2b30c	0x23b0c	0x0
FindFirstFileW	0x0	0x42b5b0	0x2b310	0x23b10	0x0
FindClose	0x0	0x42b5b4	0x2b314	0x23b14	0x0
FileTimeToLocalFileTime	0x0	0x42b5b8	0x2b318	0x23b18	0x0
FileTimeToDosDateTime	0x0	0x42b5bc	0x2b31c	0x23b1c	0x0
ExitProcess	0x0	0x42b5c0	0x2b320	0x23b20	0x0
EnumCalendarInfoA	0x0	0x42b5c4	0x2b324	0x23b24	0x0
EnterCriticalSection	0x0	0x42b5c8	0x2b328	0x23b28	0x0
DeleteFileW	0x0	0x42b5cc	0x2b32c	0x23b2c	0x0
DeleteCriticalSection	0x0	0x42b5d0	0x2b330	0x23b30	0x0
CreateProcessW	0x0	0x42b5d4	0x2b334	0x23b34	0x0
CreateFileW	0x0	0x42b5d8	0x2b338	0x23b38	0x0
CreateFileA	0x0	0x42b5dc	0x2b33c	0x23b3c	0x0
CreateEventA	0x0	0x42b5e0	0x2b340	0x23b40	0x0
CompareStringA	0x0	0x42b5e4	0x2b344	0x23b44	0x0
CloseHandle	0x0	0x42b5e8	0x2b348	0x23b48	0x0

advapi32.dll (8)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RegSetValueExA	0x0	0x42b5f0	0x2b350	0x23b50	0x0
RegQueryValueExA	0x0	0x42b5f4	0x2b354	0x23b54	0x0
RegOpenKeyExA	0x0	0x42b5f8	0x2b358	0x23b58	0x0
RegCreateKeyExA	0x0	0x42b5fc	0x2b35c	0x23b5c	0x0
RegCloseKey	0x0	0x42b600	0x2b360	0x23b60	0x0
OpenProcessToken	0x0	0x42b604	0x2b364	0x23b64	0x0
LookupPrivilegeValueA	0x0	0x42b608	0x2b368	0x23b68	0x0
AdjustTokenPrivileges	0x0	0x42b60c	0x2b36c	0x23b6c	0x0

shell32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ShellExecuteW	0x0	0x42b614	0x2b374	0x23b74	0x0

kernel32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
Sleep	0x0	0x42b61c	0x2b37c	0x23b7c	0x0

oleaut32.dll (8)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SafeArrayPtrOfIndex	0x0	0x42b624	0x2b384	0x23b84	0x0
SafeArrayGetUBound	0x0	0x42b628	0x2b388	0x23b88	0x0
SafeArrayGetLBound	0x0	0x42b62c	0x2b38c	0x23b8c	0x0
SafeArrayCreate	0x0	0x42b630	0x2b390	0x23b90	0x0
VariantChangeType	0x0	0x42b634	0x2b394	0x23b94	0x0
VariantCopy	0x0	0x42b638	0x2b398	0x23b98	0x0
VariantClear	0x0	0x42b63c	0x2b39c	0x23b9c	0x0
VariantInit	0x0	0x42b640	0x2b3a0	0x23ba0	0x0

wininet.dll (8)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
InternetReadFile	0x0	0x42b648	0x2b3a8	0x23ba8	0x0
InternetOpenUrlA	0x0	0x42b64c	0x2b3ac	0x23bac	0x0
InternetOpenA	0x0	0x42b650	0x2b3b0	0x23bb0	0x0
InternetConnectA	0x0	0x42b654	0x2b3b4	0x23bb4	0x0
InternetCloseHandle	0x0	0x42b658	0x2b3b8	0x23bb8	0x0
HttpSendRequestA	0x0	0x42b65c	0x2b3bc	0x23bbc	0x0
HttpOpenRequestA	0x0	0x42b660	0x2b3c0	0x23bc0	0x0
HttpAddRequestHeadersA	0x0	0x42b664	0x2b3c4	0x23bc4	0x0

shell32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SHGetSpecialFolderLocation	0x0	0x42b66c	0x2b3cc	0x23bcc	0x0

shell32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SHGetPathFromIDListW	0x0	0x42b674	0x2b3d4	0x23bd4	0x0
SHGetMalloc	0x0	0x42b678	0x2b3d8	0x23bd8	0x0

Memory Dumps (2)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
1.exe	1	0x01240000	0x01272FFF	Relevant Image	-	32-bit	-			... Memory Dump Actions Download Dump Go to process
1.exe	1	0x01240000	0x01272FFF	Process Termination	-	32-bit	-			... Memory Dump Actions Download Dump Go to process

Local AV Matches (1)

»

Threat Name	Severity
Gen:Win32.Malware.jKW@aONj6oc	Malicious

C:\Users\5P5NRG~1\AppData\Local\Temp\6124AE08.buran

Dropped File

Stream

Whitelisted

»

Also Known As	C:\Users\5P5NRG~1\AppData\Local\Temp\5B51C018.buran (Dropped File)
Mime Type	application/octet-stream
File Size	1 bytes
MD5	93b885adfe0da089cdf634904fd59f71
SHA1	5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA256	6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
SSDeep	3::

File Reputation Information

»

Severity	Whitelisted
First Seen	2011-05-31 22:44 (UTC+2)
Last Seen	2019-03-29 06:26 (UTC+1)

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\11nhlZ.gif

Modified File

Image

Unknown

»

Mime Type	image/gif
File Size	78.55 KB
MD5	c2191766218f94c3e6adc0a57d378dd2
SHA1	6021b36b1db4b383766eb65731b8ce53fbddc451
SHA256	b0523184c4670db45152c568cccbaee2dac4300de04630e45922c9c20c516479
SSDeep	1536:DcnrhvEq60cSlw+qYCRy9wpWwfIr3j3OVlVhI8OrIDrA0sgJLh4E2SUxRoDBOLv:DYrhvEVOwFYIy9EIrz3OHTD00sKhzKRP

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\33vpMx.mp4

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\33vpMx.mp4.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	75.37 KB
MD5	6a0a9a84836d9122a5e9585403efd3b5
SHA1	ad8a5948f89c76688df30743709b2f63c491bf2d
SHA256	6ae1047e7d3f1777134e9b3458f67b299c06efc16fcab9e4e61a4e8dd5126e6b
SSDeep	1536:p6ZBghLR8Je7Ai4QexhLkGzYRTdfhMb1aYu03aO1ozi:s/ghl8JIAiWX+Hcu0Azi

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9Mso6b_nb_o.mp4

Modified File

Video

Unknown

»

Mime Type	video/mp4
File Size	44.83 KB
MD5	f9847b06a28ab467f51f1af9629fff6f
SHA1	7e465e49d2ae362721fc1abed9f51d0c03e46dfb
SHA256	954a538b2b66dd3ab7be9ce0b363e7b24591299f862c85f0321bd3dd498992b6
SSDeep	768:MNAC0ZfGaRvohrWPtiCfgEMqoQEnkzFeU1gLh7IT56vKPNH6hOsZN8EquI:pfJRvx0wno/EF5gd011HaZ9I

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9NKpH1B.mkv

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9NKpH1B.mkv.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	79.16 KB
MD5	36d8cb5e13116e0602974ac0bcdec62d
SHA1	fe1e4c9eb09969df5652f1f15d8394130972e931
SHA256	a08512dbac8264aa2ce4abf281786296c730a9453c0fd9769597b22308bb7fd2
SSDeep	1536:EatVl83MuCnOezx1Z5JypbxU+ZvTwLez5u3QR/zpMwvZrd/Rs:EmiiLzbZ0bukOelNlw

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\g4m1iZMon7WNzzs.m4a

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\g4m1iZMon7WNzzs.m4a.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	50.58 KB
MD5	58adacee6e8190f1f666b89b4fb983ac
SHA1	d7cfbe891b4ad94f51cc6cd0bd524996f9beac3c
SHA256	e2ffdd59e5a186e106af05475182602af9c1f36531d87b6d5b0a465ad42b61a6
SSDeep	1536:8q+MsBjNt5H0KmWKkh/9CZ8hMP6xk2uzvRsb:8qOptmbFZ87klvy

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iQ8cRb.swf

Modified File

Unknown

»

Mime Type	application/x-shockwave-flash
File Size	72.16 KB
MD5	687bb00c30fba5ecf517164c3acbf613
SHA1	d940d241c97631d5c888f934476e66eb0cd17e36
SHA256	65c6e63d9cf97f54f178194e43ad1d4f79ca0ef4b7a6e64bff2f53c9300967cd
SSDeep	1536:oJbr2xT++UJFryigqgeramPSU833HDDiou9aJ37ihuFK:cbaxTOlyigqHtP6n/fF7IuK

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iQ8cRb.swf

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iQ8cRb.swf.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	74.60 KB
MD5	26cdb9995c975341e7457cd4208298dd
SHA1	ac207c786c958dbe05b359ea16acd7620bb12eae
SHA256	65e03af172db8beaf290f06cc4a20f3c65ef20f0a66a97fbc8b197322ef14f0f
SSDeep	1536:ZPKYhb1OidoHgwNIIjcnx6m2AfvkSEoZ54sgduFf:ZCYF1OHHhmP/hkn44Nuf

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\IQQvEa9LKqFrocRkHwSA.mp3

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	58.47 KB
MD5	e20b19b68eeedde13ad9ad319d551bbc
SHA1	209c9954c8df3d565dd0d4701cd32d36076bab6f
SHA256	ba312d2ae703a1c73e9545e9a84a5c5e502b3a1b99801ceb4de03d9660173f98
SSDeep	1536:1gJYbz0Uuu5fvRhbIH6FygGXoLNcYvj+iBV10xOcvGs:1gWC2fvRRwHoRtL+iBVifh

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\IQQvEa9LKqFrocRkHwSA.mp3

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\IQQvEa9LKqFrocRkHwSA.mp3.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	59.94 KB
MD5	672a4aab810f290a17f1855d1b152e1a
SHA1	82dbcc94b9286ae70a99486d1df627a91336a271
SHA256	83511b47f400da752deee3da86b9a9e83baf24b9dab8377794fc229ca4f8ef7e
SSDeep	1536:4XN+qcK4HZF8TsYIfs4IoWxLN6J8Cd4Y1kstP4Lt:+N+aIJw4rYseOksRA

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jKiEkt39-u1PV3Nx9z_-.mp3

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jKiEkt39-u1PV3Nx9z_-.mp3.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	44.31 KB
MD5	ca1e272e34d3c9ea35acbb0932c4a052
SHA1	109fd27cb81d7461d85d593863ec639ed1f4acec
SHA256	f6480d0f1044b05fd5a0949f3375db879525ef21f5d93070cf9fcf92a9e67491
SSDeep	768:6efS3KYLKn3V0y6Qp2kell0wo5ox3yDpbOZ90BZmpFnf9FdGpK:6PHWn3VeZ3ro5rlBZwFnH

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jseX.mp3

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	9.34 KB
MD5	4d7e4d3dcf52141c01dd2c703732959d
SHA1	c5015b32611983fe9437ba983593387f134443d1
SHA256	edc635bd47b9072e949d769d96fa9543a8f10f9e8459b60804ef13a21da16032
SSDeep	192:19O1dL6lV4cQTX8xYthmPeqpao6z1IbyOIfaY8AP87YN:19odGP4cQwxY/wTYzz1IWOIKA074

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\md5VFN9dnMfucSUS.swf

Modified File

Unknown

»

Mime Type	application/x-shockwave-flash
File Size	90.01 KB
MD5	6c460133b9a32def9a1ccc3b34949697
SHA1	2baaf1dc879c3dc0392144b4cc8ade85dcdfa0b1
SHA256	81772d4db2b05cfb072a639785bc56c93a677dd17d9bfe3d6eb019726172e7d4
SSDeep	1536:WmQcQF9HLRw0Xnd24hb5hnqw2OwkTY9PbWkPaISF7zxJ27XPr6TYO2lAGIF/4YUr:mcQf5Xn7xTRkPjSF7z327XXOQBimv

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\md5VFN9dnMfucSUS.swf

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\md5VFN9dnMfucSUS.swf.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	92.44 KB
MD5	9fcb873e82e86f54798937a39a2d1791
SHA1	086a84bd3c23cd326f3fd39d85c3efc3616873d1
SHA256	365482c3ec726aec421ba1a7ff477453238821238f7188a44dba333d764d8f4f
SSDeep	1536:3kP65DSmY4F9UJcwDAKTx+JDncIPEM0vVB+DldVnyO2lAGIF/4YU6RREd2O2o:3q6VSmP9n6ILcXM0qnyOQBim2OB

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mTCQS_uALLGLP.swf

Modified File

Unknown

»

Mime Type	application/x-shockwave-flash
File Size	54.30 KB
MD5	33f73586fd3d7cce77001963719ed215
SHA1	3e5cf52052fa1c75d943d6e9e88458530c3dcefc
SHA256	0e48b62a4c236ba24d04b9990e9f8978ede1f6f14e4b34112f32145939fdec34
SSDeep	1536:QoifqN4Og0dYqi2gJ2Jo+IIx6SirUzw9anMqM0:QFj0y52gJ2h6SiokWp

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NCu1a1hRn9a9rx.flv

Modified File

Video

Unknown

»

Mime Type	video/x-flv
File Size	10.15 KB
MD5	812f0734c71d700bd028b1b4560e58ab
SHA1	9c2d954e2296d0b8c6ca1db7b676ba74b6c6d8c4
SHA256	cdf171a51ced09d40064cfdf35ab954adbdc879eb10df7d0a37e135e10bfb18e
SSDeep	192:FjMeBMcanaiciWk02DQlVQe3pTG3LCCyuGoGuI3tA/d4h4jps9F:lNBMcanVWpHMDyHor8664ji9F

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Oi9KwC ZNDO96cizq.bmp

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Oi9KwC ZNDO96cizq.bmp.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	52.35 KB
MD5	3493d8382583b0e86a5712e482558ba8
SHA1	a661902ba72f3d58d58cb543d85ab90310a99f5a
SHA256	bf53ad77412751e02292d78d6d9fb838337d46d6f957e9299b1494519099eca8
SSDeep	1536:TpX/WVnuOb8h2RzS0eeeP/wP3tpT4s8CMo2gvD:ZIzufUXT4s8CP2gvD

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\om3K2NDA.avi

Modified File

Video

Unknown

»

Mime Type	video/x-msvideo
File Size	20.19 KB
MD5	241f3db47d7719d43c2762effc9b8396
SHA1	37fd6cc698d66b319a0419406995ed7d6494c7f7
SHA256	68ad833173ee1db2f415eea62d8f5bcc9157967361023294df147b8108aaa730
SSDeep	384:Dn9mqTUirF3BYxOYB9tKe8IPVWfTMzkJ3IzudQvLveFy26ItXbeYOnFQ7T:B7wkF3BYxBv8I9W7eudQvL20jWX6Y0+X

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\oQkQcG.mp4

Modified File

Video

Unknown

»

Mime Type	video/mp4
File Size	11.15 KB
MD5	f433ebd5d61ebc909bf1368fa4dcce10
SHA1	e3af1e330bce325c9fe682e700c362255b1ed870
SHA256	289ec7543142d8822a495073e2c34b62162e4f65728964c7a74a52d63eb8519f
SSDeep	192:inVBdX6UcZa5X/7nu/t2/swlf3sP5Kg7583lmUa8g0HKNNUP63YHsCUf:CP6UcAZLWsgK481mUa8THKxoHsCUf

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qOe_KF9 w7F3tIPBYk.ppt

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qOe_KF9 w7F3tIPBYk.ppt.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	70.94 KB
MD5	e944acbe5b5b689b2d7bd69de8ecad1a
SHA1	a0449cf1baa3ad7e30adfbb501faf31ba0cbd909
SHA256	ad1ec60be9b139391b6258deda063874621fdd9dd406c6d92dd1af1dbb1d7db0
SSDeep	1536:bwd9lxRJ6RGC2Vr89cWSSvtc0nkPs+ovZ4vY9TfstZrWS:0dTJwYw9SSvewkgUGTfsz

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\VwnTtvq9wJJBcMj_c.ods

Modified File

Unknown

»

Mime Type	application/zip
File Size	67.07 KB
MD5	ffe07c2cd7337953c6a6f6b62a2fb5bb
SHA1	5db2f54fcd31655e0d15d4d0d85fd63c3690b3dd
SHA256	1e66187be892e3a834b2842cb7d8722285d6d29cb58113f4f35e2800913673fc
SSDeep	1536:61l1IMBtuFgHV/vHpzRQZ+Z6EUGFpcN9LiCeUHUTpgs6Av:61lbmFgBBeZ+ZFdHcTiCP0yAv

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\VwnTtvq9wJJBcMj_c.ods

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\VwnTtvq9wJJBcMj_c.ods.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	69.50 KB
MD5	098fdaf61429610e2d6fcd73fa5000c3
SHA1	c26430a3e79a59ac2ef974b9d31d2688d523b932
SHA256	32e3e2ce413e5e79c850ff292770db0a11a4378a9bbae917582c8ced7bdff516
SSDeep	1536:Gaca/7j/A/gt4lvkLdJOTPREeLLVCj7B7p4Md6Att:GaFTjkILKtqBN4MQAz

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z85puxI.odp

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z85puxI.odp.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	93.94 KB
MD5	708c6490861b8545818c8b38b93ad155
SHA1	11e1484a7b2460b7cf56ff986b2efcaa349020a2
SHA256	db133e4b91af0b507241a759da070483f13dcc7f4402adf68ac2e2f1b7466571
SSDeep	1536:a1RTQRzRn5rYrC9vIhgWqzpqFNbzhga1wCdUXlRdB2P2buH+OWTGIBLygnV:8RTQRN5rcCNRzQjhJ1FUbdTuH8T0gV

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZP_IA.bmp

Modified File

Image

Unknown

»

Mime Type	image/x-ms-bmp
File Size	11.43 KB
MD5	228d079a25b4d853b475f6fa422c0f9e
SHA1	7c88ba11c81c4b4073a80e457bf90c607085836d
SHA256	9f84b0c71f7aa798dddba1382c142e1c892194da1a8058b09b712e03ef4372d5
SSDeep	192:i8QYAzET+gvJ+L2mpfYwHU6s3v/3lsAws6tUQqtCjyvcR8ltbV1eWUasz9DERVx3:iKUE6gvJ+L2afhMX2s6tUQqTve8HbVMK

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\EfHAwob- yAmz0Zs\J2EIO.pps

Modified File

Unknown

»

Mime Type	application/CDFV2
File Size	59.31 KB
MD5	3c0930df46650979f8735c785bc7452a
SHA1	c61d514b8e327dda9c48b0022ff0e5fcd5668113
SHA256	0587ed01e54b875cd18e2d27f6132d3bcdac832f1255aaa8e824ac49df73f766
SSDeep	1536:j1WzgIHyDX1jl2xLkSZX8RMYQUwbGnL2UZJ:j1mgJOv8RMYQzGnLtZJ

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\EfHAwob- yAmz0Zs\Rh5xR.gif

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\EfHAwob- yAmz0Zs\Rh5xR.gif.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	57.52 KB
MD5	7bdc87aef759c00877e9489f40931641
SHA1	08e34a72662608647716996457a0fa71a33f4dc2
SHA256	0f90f1246c65c4cd321bfa8d5a5f4a78c0495097ac096988db92fc4e15a51d8b
SSDeep	768:xxMozsu0MwHIPYwrMoF43WqrKCq3pJQIYuc5ShESIjLFTOFn3p23AO5ABiW138+p:wogukjJmzpJQI/nE9at3p2Qt0IM+aM

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\EfHAwob- yAmz0Zs\ZiYoyNTehZ RL.png

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\EfHAwob- yAmz0Zs\ZiYoyNTehZ RL.png.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	53.35 KB
MD5	69e5fa06579a2927eb186f84cea7f73f
SHA1	81d240f01932b88c06a49171c0619e003d5dd503
SHA256	fc99c63d2edfa424068210d2cdd50bd92ec2a58a5e1143b1bfb4aee82838cf49
SSDeep	768:mjv+69eL7fuBNyzLULn+knHyU7iz0330rYX1G1VI954V808H6FZtg9NWv/K:mj268Lvf6nzSU7xUrNVk4V80Q+A9NWa

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NrsahiM\vKPGd4dlGi.flv

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NrsahiM\vKPGd4dlGi.flv.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	100.00 KB
MD5	e0bc851299c8cae3680fdffd80511433
SHA1	5c7c61fa6179f3899cc3294009d981091caae10f
SHA256	0978b2491a9c5f629d301b83bf2f4698a4a7527a3247f750c9f5b5cd96bffd56
SSDeep	3072:ZL1Xxp7wB7DvcfB0FKTX8SVT1J5tZYhIQeU10:F1Xx2DEpvTsSVh3qNHi

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NrsahiM\AarFF35ax\ts-tcPTiCMyDK.ods

Modified File

Unknown

»

Mime Type	application/zip
File Size	15.01 KB
MD5	7c00d979fd034b59b85ff59dbe8a8fcd
SHA1	331f2ffbafa65ca8013856798d6ee0561952d438
SHA256	245dc6fe41af5810ac838b6ee5037b5ec07ef592158431f29c960eeb84477779
SSDeep	384:l03D/BSniKSVPzcccpvu5X55pE34GlwkxkXwcc8pYOYS:liDEnWV7cg9gHlwkOgcJDYS

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NrsahiM\AarFF35ax\ts-tcPTiCMyDK.ods

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NrsahiM\AarFF35ax\ts-tcPTiCMyDK.ods.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	16.47 KB
MD5	d3f955e4d9e7fe44563833f588ff5a50
SHA1	407e92cd724caf38cb2d79463691abdca43cd045
SHA256	33436b48ee1d7708f0b69129605ac21b8a651fc8f479f143625c43d687a0fc27
SSDeep	384:zQ/KKZjAJC3teirryEuFIoTaCZzlxLodRHTs3B3k/e2G8bZS3K:G7ZUJkwAjuBTTZzDUH43cG8g3K

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\VIJimfAmuxwtczsBL.mkv

Modified File

Video

Unknown

»

Mime Type	video/x-matroska
File Size	96.09 KB
MD5	4b34a390b70ba4206327917b90eb78c6
SHA1	e5cb2dc69bb221a68f82bf540d142eafb05a8e10
SHA256	3764cd803e0375cc4a6cb5945e4a8c5a14e2715b79927479b57c13157accc8cb
SSDeep	3072:27Vx1OpvykDjgStXbZTn4tQRRrlWa3KSyBz:27Vx1OpqQz4tQRrl5yBz

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\0twkzH6YEHET IEuLj40\0-Zf0yDlTZyn.mkv

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\0twkzH6YEHET IEuLj40\0-Zf0yDlTZyn.mkv.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	49.63 KB
MD5	0a7024cc7ee678fcc369aa6848a6df2c
SHA1	d9804b4614f7d24856e95ab5744072d48fe71499
SHA256	fdfebca92f72def63551656396d5eb83a12a44d238f41b568db8d974ce008d7f
SSDeep	768:c+s3EJDNLRkCHW6pP/+xcKk4JXvOfezHNjI8V2qsFBx+j7pK:SiNLRpHDPGxcmVvuezHNjI88qsFBOg

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\0twkzH6YEHET IEuLj40\P0qFzkQOn37Z.gif

Modified File

Image

Unknown

»

Mime Type	image/gif
File Size	58.69 KB
MD5	7725a6429fd6d0aa52bf287d66dfabc7
SHA1	ee86de2a8dc678bb177cee63a39ed76f3da5cb04
SHA256	3af624a994dd82cad8a5fcc6c12f7320a90b9796b7851a890a7ff8438b6f52e2
SSDeep	1536:2+81xzgv5E44A3B3IAhINTiqwKdsnmwOfJRM:2z1xUv5D4AumIoqwkTJO

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\0twkzH6YEHET IEuLj40\P0qFzkQOn37Z.gif

Modified File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\0twkzH6YEHET IEuLj40\P0qFzkQOn37Z.gif.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	60.16 KB
MD5	17419fe4229428da44531158d0b7d28f
SHA1	3879168e809a40b32795b1c81387eedccb62b58a
SHA256	2ab08d2ddbd4e892ec83fd224731352dc8215325610a377adf153421bd8a9e15
SSDeep	768:yruUWIfBxcTykG2Nw3R87SKcgth2sknA4XaSQOZY1upUYx+CcpLo1HrdVWpbHnLJ:yfWIpxT8xluskA4qyY1m/EFeHfWbLJ

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\as90.xsl

Modified File

Text

Unknown

»

Mime Type	text/plain
File Size	18.30 KB
MD5	defc1aaa024f7807c46451899bb0e9bf
SHA1	93a015d916f97961a4a7576bba35f03293bc0541
SHA256	50c7b34bc395431f47c4859f572d9ade55090cb53f9badb2e35de7b36f920d0f
SSDeep	384:fWvnqiHr3iHrnFBbs5z7l16VKubGGIibHj:uvnKK7l16VK5GIibHj

C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	19.77 KB
MD5	eca3abc799b3ba26e75e3d5fcbdc9ad7
SHA1	de6c2a62886f1163e5efe6d67598d9ae50131cb8
SHA256	7929418955f29f41d258eed9bf7fc926404562202a655104ca00bbcc7d5b5979
SSDeep	384:8lcQ2g2TwNR499xrrXaTCV2pdrCKwXZDNj5daUh47aBu3H9gi8EQ/WhNXbz1bK:CcQ2g/NRixfHV2DcJBj5dae7A39GHkPE

C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	31.69 KB
MD5	e190597889a22342f09879a6872404fb
SHA1	d91687c419b22c84368fed444136bc659fb5426c
SHA256	cba630d764dfe1515b4e346591384351ae861ea3bbb47ce7210413d969306da7
SSDeep	768:eImIL6bWHf6v9/NjcHjFUi0fMffpZWW7ke+faF2NlnzK:eu16l/tcHjFU+Wve+SAfO

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\sql70.xsl

Modified File

Text

Unknown

»

Mime Type	text/plain
File Size	31.39 KB
MD5	ffc9ac044a5b32a4bf00dd811de02d51
SHA1	1f32fa8b0ce0b57a1db65f03cdc5bca4ad46bbf5
SHA256	5d50b6ea07b65c848424b65d850dff3f82a246d836f0a81d8fb9f9c001ac0f8e
SSDeep	384:fiOOrJnkpSlKpNeJMu/yvAqiHr3iHrnFBbs5zs0wVyuK90JnPnKzsxcV/mGk/T/i:KOGyvAKMs0wVyuK90JPnK7kcIibHb

C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	32.86 KB
MD5	66a1ba851cf3b732c2d97fe1a6329b53
SHA1	51133941439741382fc2d3923f471e35e8011c21
SHA256	0e5828cc64fe3a326343898f01ed6991cfbbe168c92aa8f430e746b68c8c1d32
SSDeep	768:Pic6Nvo97gdELhCmWZsCQpnmc9fdVpZwTvy7K:Pr7emLhtZmc9lVpm73

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\sybase.xsl

Modified File

Text

Unknown

»

Mime Type	text/plain
File Size	29.09 KB
MD5	994d59c43f7b46e5f3c8bdfbf0a4b3c3
SHA1	8faf5dc3160327c541267a6b8f4bb33ce8557d00
SHA256	5d40b295d339b25a85b078091296e9ff6940751c1ca4f52850bbdb8c5f27d62f
SSDeep	384:N5mCDmlqiHr3iHrnFBbs5zs0wVN3hEnPBKzsxcV/HGk/T/VIibHr:N5NmlKMs0wVN3hEPBKekpIibHr

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll

Modified File

Binary

Unknown

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	650.84 KB
MD5	65ef0a8e5cd8f60dc5c1c5d28d123267
SHA1	d54c2a99d29b18680fe57970c802d761ed6e6d61
SHA256	09b4fba0fd89a5f1fb966bfe1cb1143a64d2e56ea8b7b080afb82ac4385e19ff
SSDeep	6144:GVG5g4GLrhwG4AQWmi3fMCBJCDr1QN4bULE:GVG5g4GLrhwG4AQWmi3fMCBJC8/LE

PE Information

»

Image Base	0x46410000
Size Of Initialized Data	0xa1200
File Type	FileType.dll
Subsystem	Subsystem.windows_cui
Machine Type	MachineType.amd64
Compile Timestamp	2009-03-29 18:20:10+00:00

Version Information (10)

»

CompanyName	Microsoft Corporation
FileDescription	Microsoft SQL Server Analysis Services
FileVersion	2007.0100.2531.00
InternalName	Resource strings
LegalCopyright	Microsoft Corp. All rights reserved.
LegalTrademarks	Microsoft SQL Server is a registered trademark of Microsoft Corporation.
OriginalFilename	msmdsrv.rll
Platform	NT
ProductName	Microsoft SQL Server Analysis Services
ProductVersion	10.0.2531.0

Sections (1)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.rsrc	0x46411000	0xa10a8	0xa1200	0x200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	3.97

Digital Signatures (2)

»

Certificate: Microsoft Corporation

»

Issued by	Microsoft Corporation
Parent Certificate	Microsoft Code Signing PCA
Country Name	US
Valid From	2008-10-22 21:24:55+00:00
Valid Until	2010-01-22 21:34:55+00:00
Algorithm	sha1_rsa
Serial Number	61 06 27 81 00 00 00 00 00 08
Thumbprint	9E 95 C6 25 D8 1B 2B A9 C7 2F D7 02 75 C3 69 96 13 AF 61 E3

Certificate: Microsoft Code Signing PCA

»

Issued by	Microsoft Code Signing PCA
Country Name	US
Valid From	2007-08-22 22:31:02+00:00
Valid Until	2012-08-25 07:00:00+00:00
Algorithm	sha1_rsa
Serial Number	2E AB 11 DC 50 FF 5C 9D CB C0
Thumbprint	30 36 E3 B2 5B 88 A5 5B 86 FC 90 E6 E9 EA AD 50 81 44 51 66

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\resources\1033\msolui100.rll

Modified File

Binary

Unknown

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	14.52 KB
MD5	def966b4398d0bf3855c98442a592404
SHA1	747b96477e92791e069b7995822b53416d7dd1a0
SHA256	e1104e6d3e4f993043ac126c8f3d2c2e48d2bcd909e5066e6e6f74b1b6000b85
SSDeep	192:gKWdcO1jJ5WO05MsaYOF4gavfo6oEQKPnEt2yt8mJz+jaIhjTH/S:ZWdcEjJ5WD5S4CnELKt8Cy/j+

PE Information

»

Image Base	0x429f0000
Size Of Initialized Data	0x1400
File Type	FileType.dll
Subsystem	Subsystem.windows_cui
Machine Type	MachineType.amd64
Compile Timestamp	2008-07-09 21:50:46+00:00

Version Information (10)

»

CompanyName	Microsoft Corporation
FileDescription	Microsoft OLE DB Provider for Analysis Services Connection Dialog 10.0 Strings
FileVersion	2007.0100.1600.022
InternalName	OLE DB Provider Connection Dialog Resource Strings
LegalCopyright	Microsoft Corp. All rights reserved.
LegalTrademarks	Microsoft SQL Server is a registered trademark of Microsoft Corporation.
OriginalFilename	msolui100.rll
Platform	NT
ProductName	Microsoft SQL Server Analysis Services
ProductVersion	10.0.1600.22

Sections (1)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.rsrc	0x429f1000	0x13c0	0x1400	0x200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	3.43

Digital Signatures (3)

»

Certificate: Microsoft Corporation

»

Issued by	Microsoft Corporation
Parent Certificate	Microsoft Code Signing PCA
Country Name	US
Valid From	2007-08-23 00:23:13+00:00
Valid Until	2009-02-23 00:33:13+00:00
Algorithm	sha1_rsa
Serial Number	61 0F 78 4D 00 00 00 00 00 03
Thumbprint	D5 7F AC 60 F1 A8 D3 48 77 AE B3 50 E8 3F 46 F6 EF C9 E5 F1

Certificate: Microsoft Code Signing PCA

»

Issued by	Microsoft Code Signing PCA
Parent Certificate	Microsoft Root Authority
Country Name	US
Valid From	2007-08-22 22:31:02+00:00
Valid Until	2012-08-25 07:00:00+00:00
Algorithm	sha1_rsa
Serial Number	2E AB 11 DC 50 FF 5C 9D CB C0
Thumbprint	30 36 E3 B2 5B 88 A5 5B 86 FC 90 E6 E9 EA AD 50 81 44 51 66

Certificate: Microsoft Root Authority

»

Issued by	Microsoft Root Authority
Country Name	-
Valid From	1997-01-10 07:00:00+00:00
Valid Until	2020-12-31 07:00:00+00:00
Algorithm	md5_rsa
Serial Number	C1 00 8B 3C 3C 88 11 D1 3E F6 63 EC DF 40
Thumbprint	A4 34 89 15 9A 52 0F 0D 93 D0 32 CC AF 37 E7 FE 20 A8 B4 19

C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	15.99 KB
MD5	c04bd097f0bc7ce25df80c25ba685883
SHA1	cf040e31714a79435119f59ed61d08f9fc7253f3
SHA256	5e6acefdfc6ebd4946871f458072f22e910f6ff4c31d37a3e5abd4c10e66ac32
SSDeep	192:xLnh2nZOv01BDMaDOT9k3o1rx8h2ZIo9he2BTPjZaxLmt0z4wfVhdT57Uorl+LF5:xLUnZW0zDORk3o1NO22shNTecor6CscK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00004_.gif

Modified File

Image

Unknown

»

Mime Type	image/gif
File Size	8.81 KB
MD5	b7a0d1b81ea08e046193e6cf1a93141c
SHA1	9327a14cf5cfba54faa88b688256363aed21d4b5
SHA256	0ddee161ee17f276791e89f05331236276c1dbf6b8ec3e3a29acb06fa5477321
SSDeep	192:D/TCj+tFJu5/8pFWXeWAFY6xNSPVjdUw0VVNntG9iTVvM/QWdSPVjdUw0V:D/T2EUSFWXeWAy80VBUFVdNU/0VBUF

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	10.28 KB
MD5	9a9e2d1c1477d9e056ba29c97f2f445f
SHA1	a8e053af79e9f63fc8db3022e5efa504eba860f0
SHA256	cd3735c9611641c0bd9c6314df8399266b3df1827491f153ab68a0d14e102915
SSDeep	192:3u397JE/SVaYZn42KJgAJ1kgo2hzcEOvHzujxBNoeowulrvEqXhA9jz:3MJdVT1sgAJ7oJEOvwRZlKRK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00011_.gif

Modified File

Image

Unknown

»

Mime Type	image/gif
File Size	7.05 KB
MD5	eba08318eb8296274327a65acff25d5f
SHA1	af9e13e8904f68c030831e45c60533f5c0c6eaf5
SHA256	b242b726e8b7be708a2bdb4232c460a760e70c7b490ce2f3bfda9383254bdd9b
SSDeep	192:0nsybGduWvD72oug7BAUo6TyD8VUJqUGLx5ED1GLx5qc:0nsGWL72ox7BA94yD8KJqUO5EhO5qc

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	8.52 KB
MD5	a833be8841575f808b2ae2ea7acb5d04
SHA1	b4929a7a2bd1be094b78122ba33269653539a376
SHA256	838da05f603a8b74da7d26dbbf6e92b13ed693a11079cecf5966df51eb4673ad
SSDeep	192:HmbFRXRzvHJBqQvj0OtslcGQCcG9nSU7auHm28YVWnEhA9jz:HmxRXRzvHJBJvj0IG+KSU7auHf8Y1K

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	15.99 KB
MD5	6654fc144caadc9b0eebba0abe7b7274
SHA1	198e91527a093d13038717e85db466701e501e72
SHA256	1d46261f539e0320742e5999ede9d044aaa9e655b8f240dc240c73d3a32cf01d
SSDeep	384:PFYO0nHLh3n+CVLTlp0pVbfpK1V6/DqntJkJEpNAY9BK:PWO0HLDdD0fbfpK1V6/GntJkJGnBK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00038_.gif

Modified File

Image

Unknown

»

Mime Type	image/gif
File Size	3.18 KB
MD5	03922ea646ede24e221d0c8bb097864b
SHA1	5cfd068f8503c81ee7023f71fb0cd7b651e48557
SHA256	a2bd2aa4d4d6c13d4018b79fa64bef439961229368e0c939e1805d087850ae18
SSDeep	96:vofQSxliD1zwiZexIClxRLtXHJKmsLYdJ:UQSxliD1zw1FNLzKVIJ

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00040_.gif

Modified File

Image

Unknown

»

Mime Type	image/gif
File Size	7.91 KB
MD5	da172b0f7539b3b273ee17b6c4004741
SHA1	33f5ed103a93acd2c37272b57871d1c288fa5b4d
SHA256	4b84504818e0156605a91464a184456589b817e6ee2adf6dd5c6943938290927
SSDeep	192:bopGhtbnNKAPd7jeTJAAG8mNZuTGa1rAdBzsF:bQObnfVje1AAG88E6adazM

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	9.38 KB
MD5	f7081b50a6e67186197d07281853abcb
SHA1	164c0c294f81fb8cff6a213e3f3177ecb1c52b8a
SHA256	88cbbc2f3665ef6d0f6982ce016ad215617140d1c94b9ee66c725d2a6407cd38
SSDeep	192:SXwtwfkowUPKRHRiXKin+m2HEA+pck1ybzlAeMzJhHqcnpE0hA9jz:SZf9bmH6fPOknUnmDXK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	8.97 KB
MD5	260644195f831d9aeb45089c3adaa4fe
SHA1	91bc97ca4b4c538c6f2a00c8e369af8e23a780be
SHA256	0b47f0b5df3f0935f0eb6e3bb23bb11549f1ce2552c9e1fc492d19be9fd39acd
SSDeep	192:DZDaf23NEuRGhr7+qpXzD5qpQZfh/CYAtYbtDIZhA9jz:NDa0N5ghfxpP5qpQ3jAtYpgK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	13.08 KB
MD5	d9ff745be2f2b9cc5932456ec60fbd01
SHA1	834ae86d73e53d358832eb3d97e39db1ae83c5ce
SHA256	8a87016fda737d23d1a93112b2407fbec31324fae2b0d90de152e6fbfbc59527
SSDeep	384:YmzBXmH/bn6sQqwUZcc37W3lrgyH26oNinbHEK:YuG/b6sDw9mygMnbEK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00092_.gif

Modified File

Image

Unknown

»

Mime Type	image/gif
File Size	503 bytes
MD5	d40477f54ce372a2d6950da881863022
SHA1	330a1b255840efa5e710a17d276c2de122b6b2d0
SHA256	ff09de98f21606d39455fb6e478aa11c8d8739856eb841dbaa788736eb3f896a
SSDeep	12:KDTSs6wV0IBYFQK0/qpkA4fqo3wl4/qpkA3l:K768FBcQ/ci9wlCc3l

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	1.96 KB
MD5	1a7dad140944093bf360b896cfd5a277
SHA1	2b72bf46ad95ef13de7b1a42ada3a6f5c6405bce
SHA256	f1cd62a5ca5a9519bee382375c82634f219fb8945170167308fae71d3c367a1f
SSDeep	48:CPLCAbiBSfG7eCGsqo9wuEon6Ek+s4mwt:YCAwqhA9VfnKAz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00103_.gif

Modified File

Image

Unknown

»

Mime Type	image/gif
File Size	12.41 KB
MD5	d684d9a72fc99ed04dff14f7cba1a31d
SHA1	409c9f244666fffe3cb80c5fa0e7153ee5e4809d
SHA256	777c417316e2bdb1e6a2d3b6117a095239d4bbde77f7f2b5972ae4f8b7c133dd
SSDeep	384:0MC8SOcnsgNYMC8SOcbsgNQMC8SOcssgNe:NC8iTzC8i3rC8iQc

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00126_.gif

Modified File

Image

Unknown

»

Mime Type	image/gif
File Size	3.07 KB
MD5	de82e4f1fb31bf6a2e0ffd597ee18e95
SHA1	aa4d4081b4da402a9cb79cb76a45b11519b7dcdd
SHA256	2a24bdd5b97d56bac01e6e268d36f26e87cbdc2e4c2a8c20ef4cfc57dde171f1
SSDeep	48:3Zxuzhg9NICc7JAl/4HmeJcfRKKVaxiT9rn9MASmM6CZ7K0h6:32gX9qo/BfJIiBDBXCZ7Kb

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	4.53 KB
MD5	6ea0cc81fbb4b48e274fdb99b8b3928c
SHA1	d92540284e4acb87edcf1fb849be3484962d7147
SHA256	f68eb822b229b23cfc839811df5e3eea757c1c09beebf83bef3267c8e42a2578
SSDeep	96:/4lk3OdOI9Joh9R8VTt0ZK2njwNggtiPr6FitqhA9VfnKAz:taOI7oXRcp0ZmiPGF/hA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00130_.gif

Modified File

Image

Unknown

»

Mime Type	image/gif
File Size	5.13 KB
MD5	690a632128c8452f3bcd4fc14d11c518
SHA1	61efcc0a42e0d1bd6f0dfe29894dde8afb087aca
SHA256	9b60853bb7f178f14897f2f2d5e60f6acc6c601adf0c736a8e5b6980107e188b
SSDeep	96:DE6+s+/hMds+s+/hMdHtmDOPv8EI9wnr+Qpkyv8EI9wnrtmDOZ:DE6+bhMW+bhMZlP09u+vy09ulZ

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00135_.gif

Modified File

Image

Unknown

»

Mime Type	image/gif
File Size	2.54 KB
MD5	4b39dc4b269cc1517b63128d21e1b992
SHA1	d9233138764cef93c784acd48a68897d8f5ecf85
SHA256	a5d027ec50b84a7eb2947886c9842ff98aab7f27a6b68e5182d75d15c63b6f16
SSDeep	48:66X+RwpX6nRwpX6zsp2qBMrW5Iw+fBkQEJvX:d+Rw2Rw2sp2efIw+Zkt

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	4.00 KB
MD5	fe63b38b1a0d62aa8098e60abdf4bac6
SHA1	de49c342ec7139a8c21db9031de61784622ed247
SHA256	f5ef104cc5864652b8a2f6a9bef89d92c823378ab8abc975c1580bff8e0e419f
SSDeep	96:zAvGWNLas93rzvs5evXw7fp0fCH+P4nGi6mqhA9VfnKAz:otR3Xs5Tf+9QnGiAhA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00139_.gif

Modified File

Image

Unknown

»

Mime Type	image/gif
File Size	10.36 KB
MD5	5411235d42cf2cf31f7e39f993df7aeb
SHA1	e6e7ccdba1628e12993af309718acab94005c03f
SHA256	31d504ce631c0eb6e187649d40b808ffd47ae0daa655ac44b796e68ae1a53a70
SSDeep	96:0C6dfaPr3UdWkZmNUpCoIpVIQXHt00SHs5684TR/nbLGSHs5SXHt04oIpVIUNUpo:l6d0OZypVIQXr41//1XDpVIEZ5

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	11.83 KB
MD5	249f94caa49fb509226734c0011e9d1d
SHA1	9ddd4af88d9e261dc16c58b7c7c3166b5f222ad1
SHA256	aeabf0e7bd56765d0634478f007e0431f6f01755d90e210908dd8e085d5a849c
SSDeep	192:c0l2Ei1DqXv7jKKkzJtsKisz5M6oHQzfEattJXr33hr1NV2ShA9jz:cCGuv78sKZNoHKcKtJb39MiK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00142_.gif

Modified File

Image

Unknown

»

Mime Type	image/gif
File Size	14.95 KB
MD5	08fd30bcabc7e925e4c9c6a2ad81159f
SHA1	96b072dd7933492aac05a6f4b72eaa6505f24c0d
SHA256	4b2dbe47eafef62288bfdac3d4d2b2c3f940e28352d17fcb93c946b7eacd79a7
SSDeep	384:pAD2kMBFSNqKFSbbFSXfFSUFQPM0aLFOU56Fi8F7w6NFSm:pFkg4qK8bSNuaLvkk8Jw6ND

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	6.66 KB
MD5	4fe47096d5b3ffc34722d92b22cd0222
SHA1	81239de99ff9c48540acbfe3ac0294a82c844bd6
SHA256	b95f5d7ae226534530a538bcc53ccb675b5ab4cbc983b7d2f3566476d388f035
SSDeep	192:N6QnBAV+cMKVmjV7a603jpDIAXmCmknshoGhA9jz:nnBVcMKVmZ74TNIQioOK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	6.30 KB
MD5	b2184e704139f5082c1042a9967134c4
SHA1	ead888538fb75ef256ef16fb68facf87167b9783
SHA256	0ec8ed91988721293d35f6d8a75d280b324104945428515857564702dcdce80d
SSDeep	96:6kx8dsJ16JKjD3vE/E8hRmVumn1qu+DDcJq6bdD8edLq4QqhA9VfnKAz:9Msz6DsamkKg1Hxql8IZhA9jz

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	6.38 KB
MD5	430c480a8f46bb2a7bd911227c6a2840
SHA1	9bd7e6b97d916248fe433468189909d181746f31
SHA256	4fa395fe9ef2caebf3c660cd2d14be05c9e4d9c406bacfe12d4edba424f99bbf
SSDeep	96:YvlKGsz/1pFh5d/kZtJUzHkgLBiQHXDg0pYWke/tzsrnPsPFvBJ6qhA9VfnKAz:YKZppYtOzjZH9iWke/VisNbDhA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00161_.gif

Modified File

Image

Unknown

»

Mime Type	image/gif
File Size	7.41 KB
MD5	b0850a804a6b393e02617d5f8719721c
SHA1	9c0b1015c730f27ed09aff5e32aca0e0532b23ac
SHA256	bbf3bbd95796c7d8e2bd34a5fb8df2a9479fd2427d4bbc4cbc5ab412442f5856
SSDeep	192:mMAKvdOr+g5NzUUWAWCVFkwM3qN0qbQcNxXGDOGoDG3xh0Z4G:mMAK1MpHU3AlVuwB0kxCOfCxh0Z5

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	8.88 KB
MD5	3340d3b5bddf7b4e8fd941a765d56257
SHA1	7fa08079b8e3f92031a888613eadf5325e6dafb4
SHA256	4158d56cba01ff30a78dbdc85d6a5dd2327a56f5f6195695a770de677ad1db6f
SSDeep	192:gDWy5yggbYvJ8jX6soKRTc9jElISUsQV5hlmzHB56xlEwGHLhA9jz:3yBgM19jElNg5SoV2tK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	8.28 KB
MD5	c7fd9dea6b615c03fc194067c5455480
SHA1	563dff4d1e589fa603390dc1aa1959d17f708686
SHA256	0aa2888ffe40e987e66eec0d7292e4f239059b626684af857dc591fb0de598ad
SSDeep	192:UIb99tcRf5ix/TtGkfAS6xZIXcURDERTMXMfhR8jO6EOKhA9jz:19qR4xVAPaXc6QkMfh+6zK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	14.41 KB
MD5	3a7db10ebe680d8d2d4d981093dc81b9
SHA1	d659059be4f55c16e4694ab8dcf9ed7c5db796f8
SHA256	0342402a13ff87be7a088c9fe178af214437c0d01fb8691d143c92ed6dafd029
SSDeep	384:cbclYJWGRb9G/5HQZ0a95/mVQQQgHvK3qzK:cAQW4bsOZ0e/mVRQgH8qzK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	9.85 KB
MD5	7177a2fee75b8f2e7fed53fa84880442
SHA1	20490aaf5d179c33b982a0841d1c2f2c52427be1
SHA256	0b2c22ddc895aa0e8c190a988efe2f477386eae3e21f8b0dcb074b15dd4dfa19
SSDeep	192:scdsDNQFMFJRzj51Yw69YEsp3aY9vbT1/BahJaFC5FpZJei4+BKVDhA9jz:scdsDNQyvJjTruYRp3acvbTBBaaFC5Fd

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	6.25 KB
MD5	f437ee8c00599f72a2dd7d91b4068f56
SHA1	23846c273827328512946f5e91805217315bb877
SHA256	5a68b3a332f7e42e8273f630e7c0cbc59c1a5dd0c75c7738e9611987258caa6d
SSDeep	96:hXpIJexjgQFLVrRUfcKdt+I8K2nyDUUjZl5Mrth+WAWV6HQR9RWhIqhA9VfnKAz:hXpIY0MLdRmJR8SjEsW+ushZhA9jz

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	10.50 KB
MD5	24926deeeeba97424e32e74a6871c3ce
SHA1	bc1d1c42c443f089fb46bda9dae49ea5d203b846
SHA256	ed4ed3c6c17a725ba88bea368a1b61e3142d31de6b63a74927444212cc82d2e1
SSDeep	192:3aBAHmvZsphGtYHSkG9/MBZCDRwUgrEulAp0v/Lpsjtxcd2JaGt6P6FLhA9jz:3WXvmbO0SkjZCNMEulAMpshx+Sr6PyK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	6.36 KB
MD5	94cd604102b82d1b2f217238fe2ee9d5
SHA1	463cc3beafeba0912be3c283c37160cb54e36d80
SHA256	34534ec2055f14aafcd98059a9842ad85655d98073cad54f6c669a700a326ee4
SSDeep	96:9FcHPaq7aBQ/Z6QtbC5QuQ9QP4DRDKVrNuAlhdizB99bvqhA9VfnKAz:je5Z6QWQ9TZKVXlLeTbChA9jz

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	5.75 KB
MD5	e0c1501e26ec8adf3c0e869b44c1549f
SHA1	d9b632b607ca9863354cfbc2eb4148e080cb464d
SHA256	f3a87aa48fcbe1499882154973bfd53bb703cc20996a6136774eaa4ecfc02aee
SSDeep	96:cD9Vb7lRxC6uEWdPcFxBRNz7nnUNNY5GpLYLgFyE5T0AxJeATurWHdK/GH65Lrq4:cnXZDFxj17n6WGpMLg/YgVTu6HdK/Y6T

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	4.52 KB
MD5	3716aaa94f75529b09c592bb599aa973
SHA1	94f708e666ddaa60f442fb2e3fb84009d398f90e
SHA256	3b936e9ad2e85e90852eb57635713aa950364bd9b8cd1222c09a4147857958d1
SSDeep	96:45N4kzhS8oLDd9gUNgYsSpuTwd+Q5AggtgAfUQzqhA9VfnKAz:45qAM8o/HgPauT2js+AfUNhA9jz

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	4.42 KB
MD5	af587e3ebaf608b7cfd74bacb77f800a
SHA1	a7bd173016442449685a513ec007f43184b38fdd
SHA256	1459c8a1c1d2dc5aa1724848305b9803d79f25c0b32045d2012e5d66c888fb50
SSDeep	96:U/KGihFAANlvX34ROqaWyWc/4BJp0KlExtdfM+qhA9VfnKAz:UPiLAO934KWWXKlExTM/hA9jz

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	21.56 KB
MD5	835a240964d3f9d960b23f4eb9100a91
SHA1	c9121357c5339fd7e8495521c71d9d8aa398ef92
SHA256	5147bf00541ea672823d4dcba6a04416b32b772515cb4c67c8d5a793ef1ad2e8
SSDeep	384:uN86afPRx6bWUumCExxqABYHoEqfBdauT/lZgkt9Sa4o3l1dJ++pkK:ugPmKUumFbyJqfBdauzl2kt0alHxpkK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	12.05 KB
MD5	451c46c5bef7d682331ad004a9bdbbd2
SHA1	fb7410d019dfcb19c95bf71cc0efd8b23637951d
SHA256	b881ce2e38b392f048bf6129184e0981be49f2c8c6d26f2eeaf15a3758fb78a8
SSDeep	192:WG5pjQ0+caFllzbPTt0YpVoRGkLCihjIsFFdeSbJ0yZQxCXhA9jz:ljQ0+caFllzbFbGUihjNJmafRK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00932_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	14.09 KB
MD5	a6707fe694bff9914c85f6f050d510cc
SHA1	8469a3f4a01109ea0680476e1027b07f9b3dd35c
SHA256	edf958924b2d0f401666a02f84a2d439bcddeea8b05014dcb007d8303192c119
SSDeep	384:qjg0QL923IgqRYVBri7ITlAZrDTNuVXH+Xi4hb0IoaV5KdxTkYs9NBcnITG9tYh7:qjnQx23IgqGVBrWITlAZrD5uVXHEi4hJ

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	15.55 KB
MD5	35328454bf0916eadbd795cacb561887
SHA1	2f916213473bb4a88fed77c0891c0944b6cb96a4
SHA256	8607d8f86e612a4244d14724b5cffa90dcf5a3701b8fddac06f57275931dbe8b
SSDeep	384:IOm1RuIbof+3IZIO9dCNRqFnOpVex82P5K:xm1RuIbGk5OwRMOpVC82P5K

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00965_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	6.91 KB
MD5	cd7ac3946dbd7e40aec469deee1a3d83
SHA1	f278d031fb531f1bdef804aedf30e5da241da0f8
SHA256	699266855ff5957496412c5225e0d3088e19b19d114f19f49c4f78fe9f6d6db1
SSDeep	192:a9v0YlK4Fbw4KYxhi4s7x6FoGf3BFGJ+zMRtiGy/HAwW8uE8JtHZzTv/zEPAQbB5:a9v0YlK4b/KYxhi4sVkoGf3BFGJ+zMRu

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	8.38 KB
MD5	085968cb1726e7f5b99e513314017293
SHA1	3dbd8c20e93638d4757a97f23ef4d3dfb338c523
SHA256	649c2a35db23edfde7cce54fff2fc25e22669d56efbd8183fa4d0b21bcef151b
SSDeep	192:lHegPYlv2SRlsFveykWJNEVtWLxX5Tk5KEAGsR4PhIYrNTnp+hA9jz:ZSpEFveyJQWxX+cEAGsu5IMTUK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01039_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	3.27 KB
MD5	dbdabe4a3100b18bf1e70c83144c24ad
SHA1	79b958867c3ced706d6a73b54d550a57e9b6a101
SHA256	69f6573587cbfc0f7a1a597c281282764aa18352314009ed53f417f1f45486bf
SSDeep	96:s1WWWYQ16tNGScAE/IdmOVZmllyrwpLtsm+ruuYk:m1WYQ167GrlAZmllyqhsm+ruuYk

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	4.74 KB
MD5	827a2fabe26b1ec532c3c93a114a96c3
SHA1	74391a47530d505062fbe29c2036043172e59b70
SHA256	36303277ee6a280b1e00ebfb665d156d8d25048379a6e8b392fd5d7eb400501c
SSDeep	96:8flQqx846HxJ0sGd/ZIgipE1BHFKDBqhA9VfnKAz:BPnJopZepE1Bw0hA9jz

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	3.02 KB
MD5	93d2c15600f846d4fa31d285925010ee
SHA1	c527eb3b15c656282e3e4501b9cd52eed7193444
SHA256	94ae9d7f5fdcc25385717667e669c162bd832588301f17eeeb0a242100fd3ed3
SSDeep	48:B9UJq7nT8hbH8yVOvISpbpsgFTcaG/5LuL3sZ/xE7BSfG7eCGsqo9wuEon6Ek+sU:rZ7nT8ZLOHpbqaw56rsZ/kqhA9VfnKAz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01060_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	7.78 KB
MD5	3bcba746a50f552521131eacdf2b38f7
SHA1	cbbc8f09dd5e922683eb663b34512b71a06e1a2f
SHA256	de68d15b433aab451ac74063265af5693ceed4086dea2ee53f6d9489cdfa93ae
SSDeep	192:TOSB0q9J0QDaZ8vO1O9/Dl8McpjWJ+46uW5fh1SS4hIukUBBTvxPnx+y:TRd0QWZDO9/Dl83RWJ/k1SSNukUHTxPn

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01084_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.79 KB
MD5	c5612b2d5032988549aa628a7d54aba1
SHA1	4caefc3b8957df523fdf5489bab39f2e0e227015
SHA256	ddd5850c945b5dec1a1ccb707aa4cb7dc5340d642069ddd2b820dc4e4878537b
SSDeep	48:xBK4/rhS0SnQHOmQ+W0nWhUYkKPRotkLkYl0LkyLkOBwTLkYANc:xB1NS0SQeN0UxNubY3jaYAm

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01174_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	27.21 KB
MD5	0982265ced5c29c25e2c40f542634e83
SHA1	c521c366721f0fc760e9259dd332876687782c19
SHA256	825078be018ccf7ee1cd3938b0d540e92e3f27eb4fad4a1723654275ffc54e18
SSDeep	768:UBjDy6SwZAzBGiTZpn3l9AEc+gNv3GL7rOgec5yBZxmP5n7CNWj6pZ/WDrTGV6QL:Mo/12SeDKA/XoL9byR8PyqM

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	7.16 KB
MD5	16287b493d9ec207cf7f112bdef521ca
SHA1	742b1fe3962234364c9a57960179b419dd5ad28f
SHA256	2861e196c96d8db5e9cae02488627f79642f4abbc31a7b165ed6188369c44f7d
SSDeep	192:RG1zqWQGuT+SLI7r1IOUYdm0hkSsLW5oVwhA9jz:RG1z8iSLI7r1IGlhgzVwK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	4.41 KB
MD5	278d7f28ac8e8bbe11a4b8a1708412a0
SHA1	24e30eb66fb28eaa115c0917c5ac7792822c369d
SHA256	dcb6ff9363e11ad4496738512b9b9cf9975befd47ee291393b3930b406f76902
SSDeep	96:xnTipgCMLjRvA/DBrBIrFeXkCr9lqhA9VfnKAz:Jip+dvC1r6xechA9jz

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	4.16 KB
MD5	fe64c1bce06420087554bfec866d406d
SHA1	6bb1db97fc9441885234833effbe4697fc43e16f
SHA256	738750c2936a42095256843e40e4d824ff6bdf24bc34313ed08b49350462dcb2
SSDeep	96:WIQiKrizdVdwECoQGFpcpwQdPNnrC47hq2qhA9VfnKAz:GjrijdL7pcpYHHhA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01545_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	7.20 KB
MD5	61c3b39b97bf884633ffea6e43b8fd2b
SHA1	d4d87da76dc975022fa1f7113491d77bd93983a5
SHA256	7e29edf8556b08a41e53488e28de2f1598bb7e75c3fec5be24e8f143a41ac28e
SSDeep	192:ElCp76lstfENbDKl52TxX60LkS9NaPI2+Q3v7TB7CGY50AVTpTE:ElU+lufo3Kl56p64kANWWQ3vPB7CF505

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	7.94 KB
MD5	0842b8fec102b3fca641710d9a9aef50
SHA1	469927b95b8791db3a3f1ba72d1421bb4efb5eaa
SHA256	63016c86c66df39637a44cc95737152c1bc55a1f29d2bb771fb8275f89df8423
SSDeep	192:fouIwg1EERcv4umLuQKh7SoRZDnAqNhl0N69QUwyX5hA9jz:f9ghcv4um5KFZrLhl02wyrK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an02724_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.06 KB
MD5	3d2a5710958580181e9c6a7dfc65c062
SHA1	51aa93a32f635188889830e25b619509feada393
SHA256	dc8b3fb3b79b8d2731cddebab1fcb126c7bdf87ea46d4618fe52dc995685d942
SSDeep	48:FJCsK4/yiLpzESd0UdUZN1GKgBzC9aA9qTm2JKa5Rc:Fn1yqzB0UO8w9aAITbKaU

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	3.52 KB
MD5	58f3cf023fe3632cd21f71f23bd61e7a
SHA1	35d11863d001f64fe8d6698f555ce63a69f5dadf
SHA256	61fb5bf8c7f74a51e3489b21060f4b31c433a4a935db54a64670e38221ef39f8
SSDeep	96:zOT8VNBRRyZYKMd7lATYcbl1HjtqfdnyqhA9VfnKAz:yMR0GKMd7lAzbMFnLhA9jz

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	7.38 KB
MD5	9f45df57b62d254dd5e445cf332c262e
SHA1	0ba7bc4ea18e307d4369d800eac56035dec38a42
SHA256	1518bee912cd40cfb1b48fe50af0783a00c90c6a6d6561689fe0ba3248d9daf5
SSDeep	192:ChmQ4v3ZwbURSF+wLgsFb2V0pwrPcMJQPT8hA9jz:TQ4/ZoURS80b2RrPtQPIK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04134_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	3.34 KB
MD5	96f6b0f79668d0a59a29d032d5a1c10d
SHA1	fc783609aa3dd81ed5ad2e91ae9e157d39f55847
SHA256	5af783d1ac5364a7e69c2e8a0989251cf966028ab709d0c463eedd132ef7fcee
SSDeep	96:maf/aghCkXAph3Ua9qfYTy0dDIxXXJCHdc:fHBhCthkVfAddDIZc9c

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04174_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.58 KB
MD5	6572597301cdd8bfc23042e39dbd9eda
SHA1	d6ef1e4afe5ca24caa47f4f36667849a17e46393
SHA256	60249cd48030be84fbd609ba7e35287aa0ce42df11a769c7079f87376fac9334
SSDeep	48:1GmIB4gYT84daVUZqnf8pl/kOibPj9rk6kgwrfIZDQ9ps304oIW:kmCJq6GIfgNkBb66pwrfIZDMs304ot

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04196_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	3.07 KB
MD5	d7420f1d216a1ee6c38cd703f3b5fb9c
SHA1	a65ec985fbfec647fddc9d105288ed57035f6a3d
SHA256	d2a1a0683b7ad593a43b1b8022a40b16768f62fc9e55ee193b5e7ad916191973
SSDeep	48:1GiaB4gYT89iZay9P/4rVzu/8JuCOjImlW1rQfEOrxVz6OdeZcZ27/Nch/W4/+jW:pcJ9WFiFu/8XmIhQxz6zZcZ271CO4/+K

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04225_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	8.29 KB
MD5	426664157cf73294ef94faebc0369fdb
SHA1	99c46876ad5a1be398f76895e12b2c2c6a27617d
SHA256	ad4efcbf04f32c59e181b7e6d3a14acd821a0202eff0d99775699087d358dbb3
SSDeep	192:WlrRZlvQ8TO0NdCSCeLT5CQKMpRm8q7YE8tMoGu+Ya7CcfBba/b7ES586Jt5dcYc:WlrRZm8TddHCeLoQKMLmd7YpuE+t7Cyh

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	9.75 KB
MD5	1d06dde6ec831d9eeb0bfb6668df583b
SHA1	d8f330579ff3b17298f8fd4822f9ed219d6ed479
SHA256	c1721c65073730f194bc59aba3b8d04ce20d19ee9bb1b5f7f885b3dbd4bfea11
SSDeep	192:GssgoIvPesYvtAEtfPZw062fchswB4NdStm3Y+jtZXjS6MRggbYA2hA9jz:psgoIvPe7vttfPa0iS6I3xj726MKgbYC

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	3.44 KB
MD5	5503861addaca55563871676677ada55
SHA1	d13d8e590ca3201886e1165bb4e66361a82a05eb
SHA256	915292453d3c2aca9bb20790e8892f93da0778ec45d6fa540aef106ca9ccf4a0
SSDeep	96:yaGrXccF3VrAPOez7H3s4XvhxYqhA9VfnKAz:8zccHrAWu7Xs4XvVhA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04323_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.43 KB
MD5	5057dc96c71ce96d0cc86909aa487ed8
SHA1	6b39868cd021bf6ed98dbefe5430633b482c8f8c
SHA256	368eeeb7088e8d0f1cacde574fa57342fe83dcf631b1e2844a81ff0fd4f569ca
SSDeep	48:1/CB4gYTvi4P/17q3ljlWpbKbVd53lQ/ch91QqjD+UjwlB+oDWaZW:yai4FYkluVdxlQ/X+CUjwVfY

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04326_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	3.27 KB
MD5	315ff0927abe1a9230efc6c0065dcfe5
SHA1	d9ed2c558bb26926b8ee00ee6e01d0d4c8a988f3
SHA256	4accfd7672933767f868128eb0cad3b0c8ccbf1e04ebe0996ab4e29a69dfc0e8
SSDeep	96:RJY/npm7dNyrZKq7KFXvObgheMQHeCH41xrTY:7qpmpNy0q7avCgheMQHeCH41tTY

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	5.66 KB
MD5	609003f3b51ebd4a1e65c4a2823c2f64
SHA1	2a03ca633c5e70fe1f238e45be0ed8ebbddfb0b8
SHA256	5871391246922c461b7a734572cd4ddd2fa8ddb743e5cfb4c71448f3809bb060
SSDeep	96:OQK81/z6tUDK+oJLjc7xAU399ps7d1iY/wlypMG/qhA9VfnKAz:Y8EiK+G3cGa2jicRyhA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04385_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	4.89 KB
MD5	6df6ff8a87f8b668d56c210f69e7194d
SHA1	843ec667e0330e925fedf1cb11d5ba8703b23dc0
SHA256	9287105539bc59ce2c25b84b500c1c92ad72d12264e05a93dc8060713c9f412e
SSDeep	96:KJnGwkn8L9PlWxvCDhb0dIUlcePYJFA5da5oP24IjCW0FUJQzlIuXoxt:QGd8L9COyIULPYza247FUgl9XMt

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	6.35 KB
MD5	b63dcf6775782991c3ee712e9d32ac82
SHA1	894735a01208958ad16aacea4a9f5ffdbc7a8b1a
SHA256	1c7acbdd929c1e535eed5881c39bd6ae83626a47500755a55a5e3f631a5a9c0a
SSDeep	96:quVEI9nK9WTiH+J+E95DderWZrOgntLKVGiLeYtxMUzcIrWBESfEsxqhA9VfnKAz:qQJw9C+EzRerwDt2tTzxrWG1sEhA9jz

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	8.67 KB
MD5	411379bc1d902369f8d55088ac0d5af3
SHA1	6bb981f4a3b3786b1e22813d0fbfdee5d62812bd
SHA256	5abe7994ce6e367b8b78394a17cbd8d27c630f17ece529807f29b3c834101c36
SSDeep	192:vWB4iQZ8QiZSzTD0mDoyjPK4swGDH09l94/GhCNRh21hA9jz:vWOGQ/D0mDx+42z09/Yx2vK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd00116_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	4.76 KB
MD5	0d1dcdf9ed0a94e7148e445df2bc4de6
SHA1	c27a841ac5658568d003c7e5ca260456bff68bd1
SHA256	3f7b2f380055056aef9617a6b80646ae79e2e07f7db2bf2bc43d6e5d261f385c
SSDeep	96:z/JM0o/ci3Nwx4VJd0KjDediZmtyRVxpST4FQRd3L4FQRd3EVwFl02UqEYvTBR39:lMVyx4VJdfjDediZmt2xpG44b44UVKlx

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	6.22 KB
MD5	4d33dcd7856f9233444001ff7286159f
SHA1	f98c1d21c2dbcf2e3d0141fc7a1beccc32a6cd83
SHA256	9370f9a0911325645c70a5e48d36a193afa07000fdcd1cfcda978db0e2482fa9
SSDeep	192:Ncb2DimlpMxEtZaxZwZlH9ReIsiN041whA9jz:uw7axZ4lHxUMwK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	27.72 KB
MD5	fd11eed331bdea9c480b3ffd25eefba3
SHA1	1ee0b189044434f0100a7da47b7cc4d0e3ba9a8c
SHA256	f00b8f10d461b3395fe5eb2d3711af7fe96b024e04cb8ec08d235ff5d49665aa
SSDeep	384:pn45Qo7VR4XgHPNo1A/6A0sp3hhfTCHBTMF359g+Wr5cHXx7zsTvIlK:NwQqX36106A3p3hSBTMFTgpGXx7KmK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd00146_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	28.27 KB
MD5	64f243084cb9d15d295efca4064f82dd
SHA1	69ad5db70247bc8cfe069515473bd74e9f4f41f6
SHA256	14edca0786bf28a31127b8c40255d2adc0f50c0f0ea38479987e7d5389e1248a
SSDeep	768:AnC2KLqmi5AfdzGi3bHCQc9yM2XvlomvoK+hlJZFAf5iUnZlh+LiakoAstICYF7T:1dNBQ0mhyXCKG62wNL/5

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	29.74 KB
MD5	a1e6a02a5006c09512c817cda9826205
SHA1	767a2fda81f2f73c91a23de5c9149cfc039916f7
SHA256	fcbe62429df68bcd03041b5ed3e63e7a141d25b3cee2bb0fe39cd924e632b272
SSDeep	384:e2MDh+uwLgkbxtp3dhwDfqNfxuQLfW5z1Y/xys59ug8f6G4TJIgn/1M0IIgkulZt:YDhcLPPptsA7Lfcz1mxSwPt1EZuiEA2K

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	12.83 KB
MD5	518de083736ece94c7dad24ed420dd47
SHA1	9580272450472d70da22bb3cb12727b5ae41e996
SHA256	adebd71ad0acda731a7a44afacf2d3233a9c44fcd4641a44c229514a9cd6be7f
SSDeep	384:Kcm1flreJMRJFmn3lp1vCi3TpabtMu/8DcFyWu5K:0YJe0VvlaJWDcYK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd00160_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	21.99 KB
MD5	d73e5293af5cdc261f1ed60a0bbdbc7d
SHA1	d4430fdb810a917dc5e59a00274bf766b80e0be3
SHA256	9aa10a7767b264ae1e9243db8130e018bdae1d919096cbe22d430c6ca9bfc189
SSDeep	384:Is6r8M1mJk/dluq9s76GmW8BxdvzeDVoa5myWKYba38exzRui7c6JCuRKeSCz8Pu:I7r81Jk/2q9s9mW8Bxdvze5oaYyWKYbE

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	23.46 KB
MD5	8ce14d05613190bc97d7cc5106c6ecbb
SHA1	6d499499a8e73701826e66ae283bf337a4ed9f92
SHA256	cfff2c01e441f18690736be204be0b0c683b566129d40e724e7e8d9ed752faf8
SSDeep	384:yJuyrU/zw6Ru8+8gOyPftB3xCwEHxlRF6hth6/zP3zMGZUiJBFjSRu4rxCHwWiK:suyrU/kVSMftB8wERlRMczPjPU85SU4s

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	17.27 KB
MD5	d4a71581e8a9ef957ec2b3eb4c2c6329
SHA1	670cbfd3c1955b786ca48cb8192c9c884cfacc7f
SHA256	28f5f3e55dd38c79c733a575ae2820d6ec7536a83495b1d27cfe3a2bcf3fb1b6
SSDeep	384:UdaPmP+7g00E/+9Ms7UzkwEGsQS6IAYFkdhSbRK:Uom2M00EsMs7UzPEGY6XYsKK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	18.30 KB
MD5	c4315b8037ca204e4b4edaf479d7bafd
SHA1	557c07c40dbc3cdbc782d7ca16292ac119532b0b
SHA256	e3b983fa760af71e891ddbc369840c0410c204917a3f7f36b5f5e0a77b1d09c5
SSDeep	384:xtiopyyryNdrYAMOJGaNwrSSQmijQ0k+3qINE80+Zbk9wswrY62CmdFMu/K:1RyT5Gag30kXIu8rbk99wrY60dTK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd06102_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	15.74 KB
MD5	45f08ad773790dec024123b71e6153a9
SHA1	4502ca02be53f0b59eb1b5bd9963110dba8d297d
SHA256	613f497fb0b3d8079071183ac80942ebbb0dbee4eaad3fbf4a0db92b2fa135fa
SSDeep	384:i4anifAYOE4INNPGMrvnA6/vJ4md9LmsHpBtYviXRIdRpYVkLWqRCwKdxMqivf8f:i4auAYOE4INNPGMrvnA6/vJ4mbysHpBd

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	27.58 KB
MD5	f80c5f591eb8bf4fb3c4f8c4e61626eb
SHA1	a2183e0e557266caca923d2ea61a5f08f02014ed
SHA256	884bbe76f85f4a77754dde40096fc626056ed13ae3d015a104895fc358421a19
SSDeep	768:R0BMKKYq2lWrF/bOGIEuAp9HO2XY74cmFA0wJKjRkQK:R0ArZOaZdpFAijq3

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd07804_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	4.81 KB
MD5	714977129caed5cfd38159c16830a7ea
SHA1	a2108a5236929c8809c8a8767fe1bdbd2d2bb17f
SHA256	761fc87339ee96737c22125a75a2c0f76a0e4d0580b41a993ff720235d1b7afb
SSDeep	96:0JQiGD3QayRZmJUdsYUHnIsSmLw0BhQLHC2ysjTYdlmQD/qorR3jT7d:6QiGsayRZGUdsYUHIsSms0BhQLHCtsT2

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	6.27 KB
MD5	5fae2776803f7517e801f0c6c729387d
SHA1	fd584ec10d9dbff2af9882ac7e89f3083c918488
SHA256	c94c16598a4fd274dce3b295b638ef8fe33265bb7ad02cb62d1b02bee4a346f8
SSDeep	192:14fIv2g8HzsLtblEFqrs79lN91ofzhA9jz:19eg8TsLPqQe6K

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd07831_.wmf

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	3.97 KB
MD5	85c3cf87edc67a9ebbcddd17a3ded333
SHA1	cfe2bb790e47e20dc2aca9b2bf2b562c68640e0f
SHA256	a90d54883ae20ed153b315da22f924b3bec56705e6c63454e86bc8c9a3aaf6eb
SSDeep	96:wJ1V0urvwKkSiZ18kjV9YtmBy+s5tINZCZjYPP4Zb6tmzcr3m6:G304YnSiv8SXYtmsXtgZCZjqPA6tmzcp

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	39.26 KB
MD5	a33c32182ab424a0958ae1bc6df3738f
SHA1	ef6c144549ef6d53260d3ed08d75540310568a25
SHA256	b00519c20905ec40e2e0ffe7f9368095d9adfd233bc0a16d620033c0a0d5ff4f
SSDeep	768:PzD607BWZBPz43+ZS21BYTpvAPCP0zwITG/wBWOKEe3Jqhc:P607YPNql4KP0z9S/i7QJf

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	46.67 KB
MD5	16514f3fedac5822de85f4e735f509ff
SHA1	1a270ff242ab2f16a5697a19352c24b2a5f78b17
SHA256	428a4838e436533b62ff7901f36f880f0ecc9f9690909c2184d40f14a34d89b0
SSDeep	768:GNf5Co/PqvU+Dqf/f+BQ7kCHEC+r7lHuAA08lMHojdJhm6RqweaB59h0Vj+UGbQf:uf5C8PqszP+5lrhHumHcdCKqwwPGbQf

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	14.20 KB
MD5	0538d56c7bf155c0c65174c61c7618ff
SHA1	716a79bbd28cc58193e760423c4ac53f0de84ca3
SHA256	1e1a5e151c478d5aedb5f7a4632559372f120c5fde73ff6ee19867791dafdac2
SSDeep	384:x6fzQrQR2eIr0tYyM0znUO2UaPOUZGufMSDBDyKAA:x67QrQR2eIr0ylYnc5fxDFyw

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	20.07 KB
MD5	23531b1a2b7b409fae00423b602c235e
SHA1	3080909c100de9840e06283769aecfa0dd486709
SHA256	3e65f98fd96adfed1e0211fd914276815c346f57ba4b40c693c1743d08cf3cb2
SSDeep	384:BtX9FpZF++LJhfUsdwwfYOiof8plbxXJl8M74KpXzlmWJH9RyYwzzmOI+RNdkhlT:7X9Fpb38+aOLf8VXJl8M0KpXzlmWJd4s

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	7.78 KB
MD5	085e9a0d621b2a9114e11ca7f7ba7d46
SHA1	95c088ab0759414a50b9d805055b13f37d9ff88e
SHA256	f1ba747428d5aa69e54b75b9985db636e440efd1733e8aa16526f1f37f2fb587
SSDeep	192:iiph805wfAH4nf3CJlT4WHr3BSFOEzWvkpOkJWHfSNx31GzEJ6YUoy1kTQirr6iJ:i08Rg4nKAWH1oykpOk3x31Go4YZy1kMW

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Image

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	image/gif
File Size	13.20 KB
MD5	a774d8a65fadfbc0b683002b0c13b6cd
SHA1	5577eb6498c49e82329efbd8b5e235c6c09a8bfa
SHA256	0ab9172ce5baa34b07a2f8fe18af4b56f12df5e5f702da8d7ee166bd1e66116d
SSDeep	384:LSZCWR+JO6ePsWR/8JBBpxtaMwisArcgw:Lgv36ePsWRkdpxta5isccv

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd10972_.gif

Modified File

Image

Unknown

»

Mime Type	image/gif
File Size	19.72 KB
MD5	df6b2f1be0e9dd21ff7cb42f2639971d
SHA1	9e00b4a5c6ae90844e9228e84fe8c032ddfd674a
SHA256	dede6b3a4dca308660798cdf5f17f3d0db8fb9a555a7541b6195893f40e9aff8
SSDeep	384:lSIX013bX99oje/jtXiM7t3acqk3tTHB2uuj9yhyqCVtK:ltXYgQtXiMB3xqkdTH29KGvK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Image

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	image/gif
File Size	19.98 KB
MD5	4efd0644dce706fee1b7cd965a2e0c2d
SHA1	78f9a8165217d44f4a87b9d769680bf89cd6e94f
SHA256	b45c9476110e1715fa656fc97c17276d1ffc56128b83ccc643ffc494b0355cc9
SSDeep	384:hNKdZYYB/S5MaxgNEb6UP14JqkH2oBiFs1qg0nR8OL7vDaXU9YlpNUOL7vDaXi:h0ZL/eBxgKb6a4JVkFav0L/vDaXqc//N

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Image

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	image/gif
File Size	15.37 KB
MD5	364dd13bd0cd076e301d4fc20c765a5f
SHA1	5088136c7ef7284f1088a0523a62d22cd35f4ec1
SHA256	66984a50e786c35154daaa07e668436bf8230d2ff5f41dfc29268e30df3becd3
SSDeep	384:hjWFWvfXmurlgjcFxGtz9+md+kQb/hVXiGPgmBBkU+YRZ:hjWFWv/1l8cFxGh/EbhMGPgoKUpD

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	12.68 KB
MD5	42a5242306dfa010c322b38eb620c650
SHA1	3f015ba404fe483864a7c4b5c5c4b84ed62713cb
SHA256	476980e04faa65d6925c55b96c41ad3f0f7fbb849c466416b9e6010c1c83d122
SSDeep	192:HnEnwBqoXGaeM10mJGXnRMVySHx2JTfY1Yy13PPT78LbfZuPsNi7cBhp+Ew5e:HnEwDyM10zXkCfk5pP8HfZ+i+s

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	10.96 KB
MD5	569919244f46fb1992308185bec6d572
SHA1	f6badbf157af94ef1f6023801b6205fe077b0953
SHA256	cb5a16c8161d8edba7556b6da4a54ea1a1b82db3b2cc8453beff33075ca3e019
SSDeep	192:X+es/BTqR7ztJ1Q9ec1abrPUGvaXkBgv+SwRgvXhu4gwRmVwhA9jz:XMZ+5Xyw4y6Phu4XuwK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	8.57 KB
MD5	c00d7aeef3cbbebee5fc330ec4b02e0f
SHA1	cb695d312f0173123b439c65a83b8773f30b6915
SHA256	d7c715de84b4baab39d08787d292ea42dc625954a11d52c7259bf89d9c135823
SSDeep	192:mHB57C6c9OC1oVtPsjC+ps/wDRCkqjaG4hAkhzJ7W9FRj:mHXCRyDcHs/GR2xA7hsFRj

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	17.88 KB
MD5	bca899532ce58632c12fc1d60f835395
SHA1	24b58e7b9f93443049069e8b7e4554446f2e735e
SHA256	b3fc4c6ab96f88f4216532e891c33f9140285e8d28a6903a26313031e0b7a32a
SSDeep	384:pdgr5nrHzn6Lhe9cr3OZqPVwfy3ErSHDsVunkrzVDM9x+iWXjP2v:pirTMzVqEE2A8nk3VI9x+vXjG

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	9.59 KB
MD5	aeb0b32638239613dd1347d6bc9cf6a3
SHA1	1bb0773274a4ecfabcea1d164256ccb6c262b67f
SHA256	7f8144784b4466723357dfd7295acc5f27d1df59683939f04606d62467d95e38
SSDeep	192:/Q7fS2NZqFDqsV1gFkoa8miLtheZTJ9G15PP2AG5f:orSs+DXqmotwZTJK52xf

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	7.68 KB
MD5	02d823725fea61ea4451c5f4780886e0
SHA1	5f26a0e88b02f4308b59c5a720a9092773a7be31
SHA256	eec7524ea932c34361b744207c7ff8b61a6e90bab301c29d011666f751f7e600
SSDeep	192:Q57T2KT+SZ8/FvK+p6WK0hCNx8LymnUSoiQiL2WRCg:Q57T2KT+Sq/Fy+U508oNnUSoiQid

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	1013 bytes
MD5	84834136ba6dbbcf80350dda9309f6ad
SHA1	c04dacb89d3258d8313545051b59f4473c7f4970
SHA256	995c44d40c9a2b676558fcc5675e63858dea60d9443950a4129152809bbdba34
SSDeep	24:t/g6IBA3Hih+KmH951CYVizA4+dNim+H6+bt9tl0C9lPlpPdpFZhvH:1gd0ltdri1mNim+ac9t7jpPdppvH

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	1.66 KB
MD5	4ce0827a7f45a45c08b2a0fd60b25647
SHA1	db7df5cde4330ff6dc95e9cad33f5f05b6e69f18
SHA256	f12de134086e807930175a19566680778928208f779d7907d3c208ad40577e0d
SSDeep	24:t/0fbE9A3Hih+KhZmhC8U/NdhCNN1w27+9hCTUhCvbjSxGIoK7Qh5YLx4VQuHlsx:1020lJSd2190NmbjSxGucvBQuSrio

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	1.48 KB
MD5	c27fa18b7f7bc45a0790a7352a579d7a
SHA1	9b5c3f5645ca1f67597818d01d34c2900ec3bb28
SHA256	5c6c9aa794d7ad032fa81d0422654d9bacfd6b53dedb4ccdba095e6493b55ba0
SSDeep	24:t/BeTxVA3Hibjh/WPuTh/NY2OerMkxCslGlpXeLzGfViRBPfsmtYIhY55QCCMjQy:1BeTn0uJWPwJOq4kEslGCn88ndtYPICd

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00242_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00242_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	3.93 KB
MD5	d1aba12c9f5c22950ec568876d37e76f
SHA1	4a82e4a634bfef8c8e45e35fd6cca6ae13ffe5ba
SHA256	66b79ebf08f37ba0be9c9eaa138159b4fd7c577bf2b937c4be655cb699308284
SSDeep	96:Femu1JUOBTYS0Ln8ax67h70pC+dtlHxS+IjwEQKEsdhSu:M7/BXUdwh70pC+zlHxS+Ijw1ASu

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	15.56 KB
MD5	02f61d52662486b6744c9b12fce73dd5
SHA1	88ce7b970389dd382ec65f09eccd183785a8350f
SHA256	44c91baf02a28aa816560e6d7fa109f3a294f4b1da51ff303be2f67bea998fb4
SSDeep	384:/C51ld/IpWVEiMzH6vPTGDHnuDvnjOR5+sGwo7Oaa3YK:/EbTVEigH6vPTQHoifLGD1K

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	1.50 KB
MD5	3f84f8c84daa58c5fd714487c9682446
SHA1	fec395f951eaf33b1b39026bfc768ba6ee264edb
SHA256	4ad09a4bedb8c637289bbd0778801a6c28a19f30b0b21eaf4315deb03c3bd1a7
SSDeep	48:5i/K4/otLpNODHXqLpSGRZyOELk0sLkiLkVcYJLkG19Lki7K7c:5Q1orNI3iSE0Rzit6

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	1.70 KB
MD5	729d8f5acdf1ccd33deb07f21bf348c1
SHA1	047e7008a2aa5ba25d0086e38268e716b1ae2048
SHA256	360f4fa39d2c8671085cdfb1b85d07c953dfc51d41fa392023f5511f92a63f08
SSDeep	48:8WOK4//yiLpSLphPLpGILpSbLplLLpDXLpaLpOLp4Lp2vLp7LpnbYik4FLpoBCIk:xO1R6zlSRnRyuACxnUxgoBZba7

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00261_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00261_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	12.19 KB
MD5	7409e687a32d7f7e47b2ea6afea25a04
SHA1	a9cf10d31f5113b721e820aa4c033cbe8e512924
SHA256	faaad4ff1fca3c764632d10669195c832d1cc4a46473b79473e4eccfb8247bed
SSDeep	384:lVxXbY7jcr40iIpT5hyvzTHrspmk7JzlkHfxabRu0wy2abpJD0/6MtetQtht6tI/:RXbY7jcr4rIpT5hyvzTHrspmAJzlkH5j

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	5.62 KB
MD5	dca843ab0bf1f9734ed30647fcbd1176
SHA1	649d783cace815a3c6d81c6782dc982937645a2c
SHA256	6280ef26290ce684217294b2c4b7f68c9c2cbe7b0e8030c74d96a309c3244f39
SSDeep	96:P1pAUlgayDymByxKj4BJWm6PaBkWl1+9sdpDP2YY2ySTRRJY0/sG4yyab9mspe86:tpAugaODBy0j4fWmMaBkWl1+9sdpDP2J

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\11nhlZ.gif

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\11nhlZ.gif.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	80.98 KB
MD5	c9302d607957facb26fbc60dfe9656a1
SHA1	645c28ad119c05682fc9afaa3d1837aa7ce5a51b
SHA256	11aacc5009a0dfdd3239a1355efcbd0d00173503732e0cef326eff258a1febde
SSDeep	1536:oLPobg3pamh23IQf3+RviiZcdBNMIN5i9GJLh4E2SUxRoDBOLq:oD5ZXh2zf3+RBuTNxiahzKRoFO+

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1ikNpKUkCd.docx

Modified File

Unknown

Not Queried

»

Mime Type	application/zip
File Size	55.15 KB
MD5	5c9d7a8cd7473ff61bde358dde8b556d
SHA1	f0f1d1f99954777e4031fc63a120568788a8167d
SHA256	bba3620d1eb85ab52bb86eb5049f4eaeedfda4c73cfd124d00e7009b4ee3a922
SSDeep	1536:JoeLLYMt7vCjlUTH5WcvgJy+0IquzU+Afqfb:RgO7sOHgwFH1uzfAfqz

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1ikNpKUkCd.docx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1ikNpKUkCd.docx.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	56.61 KB
MD5	110a2ce172514ecee09ef71b5be70482
SHA1	4c0dead6c3b15382ed4999bd7c683c9f4fb7b53d
SHA256	4f1107474df4870c81c3af8d459f0e2d14e4278deafb18ce7a9067f0a18f651b
SSDeep	1536:rSm4gUBpwTiujiInI5CV0mLUTnIaE4VraMIHWilDQCX:wij/I5CVBLUTIaE4haMI2ilD7

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\33vpMx.mp4

Modified File

Video

Not Queried

»

Mime Type	video/mp4
File Size	72.93 KB
MD5	287eac10c4421be8c4a5a3e1aaa5b67e
SHA1	e8801ec751a213fb996771b48006c9393dae3827
SHA256	3a84a97b723f417644c2b4d1f630f2baa798aa710b738ec1971add46a2afdd1c
SSDeep	1536:Gp7JIgxiF159NC/4+amnAaSPPepf7w95/SAudlsFAm3O1of:GHIg4HNm0P6f7w9Zvf

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9lD5wfn2SW-cPuO5.mp3

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	64.75 KB
MD5	916a159700216f6ec9ee323049ea64a6
SHA1	e061c2449436be16b1ad42f0ee3d9db9062befe3
SHA256	7c70836f36a6a5f7203658a837ac708efc590d6b866e253a9e1f9c3b1fc6683c
SSDeep	1536:1tqwSZskPtM1163IHE8uLcY5bihV7l1QdyuEaTkYzz:1jSrPtM116a9UcYlEVUfF

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9lD5wfn2SW-cPuO5.mp3

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9lD5wfn2SW-cPuO5.mp3.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	66.21 KB
MD5	680dd3b9ea5ee295acb05c010ffab118
SHA1	24b062684f7f2a8ffede2a847ea18ac67a5df561
SHA256	027b3a338991df827b373279a66cd4be60ef1fc28a4b21805aa7ff052e1c0d13
SSDeep	1536:PnCYXZDec6lxjUYUkMIROEo12aU87Rzyw0zsrOueZGLpd:P5X9JsUYDMIROh117RGHwO/ZGLpd

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9Mso6b_nb_o.mp4

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9Mso6b_nb_o.mp4.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	46.28 KB
MD5	a6c672dc6acc1aa2d8b711f62bc0c95d
SHA1	9822f821c3e223232d4cd6ba2bcb2cae555130f8
SHA256	cee8b489b80a4d32b5ed4f62d060a024388949e0558103336847712598221df0
SSDeep	768:AVw1NBn8jruE8b+NWKIADYju75V1yEQbvAzhwNhOqZYxXQBhSR7vOGFcemwJl/nB:+w1NB8jyEoAWKVDY4SbvmwNcaYxXQTSR

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9NKpH1B.mkv

Modified File

Video

Not Queried

»

Mime Type	video/x-matroska
File Size	76.72 KB
MD5	c91977eb7b0193c588a48af7df7d05e5
SHA1	6320ef728dab44364a19e36343ded72612e063fd
SHA256	1914b4ae6f639ce8c5ba3f24a2818950ddda45f99daaed6f6de1c66d534b6049
SSDeep	1536:MhBRJZOv0xm7k6RMjr2vzKqc3mryn5dzz66t/amR/zpMwvZrd+:MhvJ27Cr6mWryn5xJJlc

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ByIlT93fA.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	34.43 KB
MD5	0083a27335c2d19d19c77d6690db49f2
SHA1	a84a5ab1ba406b7ad4cdfa3cc4f534aab67288d0
SHA256	994383d851188611c16a84742e49115dfb99a8fecabd3e910610456a1ebf9fec
SSDeep	768:88gguEId1uIgyjw3p1RjfDHok6TFgVEDST2moiJ71I4vtzqCRp:Lbo1rg3xDH4pgVuSxog71ntzD7

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ByIlT93fA.gif

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ByIlT93fA.gif.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	35.89 KB
MD5	d53044dd04e154ccd73160501e32d4b4
SHA1	8a27bbc83826d0463b3a266de54051671f3f4983
SHA256	695e40126b17a845acb7b6240ad9ccb3f0f4d2374167b69dd12f6fbfe74c4f00
SSDeep	768:I3aX8TLRH98Z5MJfQDerqZfS+KExtH2uwsE/ezfLP7K:QgaRd88Jf4a4S+K8tH2uY/4P2

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\g4m1iZMon7WNzzs.m4a

Modified File

Audio

Not Queried

»

Mime Type	audio/x-m4a
File Size	49.12 KB
MD5	182ff6309ee5256fb4825a935fdd18ab
SHA1	c433d964f66f31fc95a1aef612f55a887983d4a7
SHA256	2534ac5cbb84ea4385fed4d330b12fa74b9f721522584605f710e622323fcc17
SSDeep	1536:fGUH99I298pTa5jyX3ap+ePWZTdxHR3AulRq:hLGOjdrOvAu3q

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jKiEkt39-u1PV3Nx9z_-.mp3

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	42.84 KB
MD5	78da0c0a0dd526ef8a444c1663c1d599
SHA1	a553920b4aad8bb352a9c397589e085838379f06
SHA256	e306fee9517f120f9ac83807e007c3c913c7332d7a6aab0a250e4dc92a7d359e
SSDeep	768:1sQ2njZCe3kh59i6kSXYCU4UoQE0X028TFPRBUDNlF7b+wJeOf3IO7Mchmde:1nijwOkHnk974OE88hPk79bikOchx

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jseX.mp3

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jseX.mp3.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	10.80 KB
MD5	21f4dce4ed4def02d5e6904b6dc80a28
SHA1	fc47272bf677cdce9f1d0d6c63a49353436010b6
SHA256	2b4baa00abb4fab324b61d25e915e93863581c930992a0f52a6779a16b674a7e
SSDeep	192:yGFuq5ZVt6UabrYcEEtw5azUZjQUffttO4zF89ZBbCtvuP/b9Z/35byhA9jz:yJq50UIXEEtS1jDZyZBbCtGPP/JOK

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\kC0KRUxdNe.wav

Modified File

Audio

Not Queried

»

Mime Type	audio/x-wav
File Size	10.43 KB
MD5	a7fbc77e7045196f371e62d7234d0f68
SHA1	341adaa05983a1b5a7b1e14523c23a6c68861983
SHA256	534c2653502a90c2fcec8946305617d1acb6b112b9c04054612ee10b9a4d5313
SSDeep	192:nR53MAK0IdNeRLloCdcM93JFGcDeOu93fNh8PRKRkwMm4Xk0qMfdwvXbILCC:R5X5lfioKD93fNh8syXlX4M2bQCC

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\kC0KRUxdNe.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\kC0KRUxdNe.wav.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	11.89 KB
MD5	e23e83a56edeea602d6c4341dd976818
SHA1	c9f6f8f8b0172a32b02263e1ebff6a01607575ba
SHA256	75c2925ab4e2a77f9003a06f2e54f798614545f05c270e88b576edaef1122c27
SSDeep	192:9gjes6oqMJIqnauN9xnASPx5a6v8lGm/4b51RRQDKU4ApG5hA9jz:WjaMJjna6PzBvKd4bnRRQvrMbK

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KfmQi.ppt

Modified File

Unknown

Not Queried

»

Mime Type	application/CDFV2
File Size	51.02 KB
MD5	3b13b0662049a05b4e9877159c32a318
SHA1	65fcadc88d36ae67e4c863592e8642c8e9c7b1b5
SHA256	f0a9520cf818655ca9188ad31c951fb6c4d74d2a4cee1d08ae0d0120a7ba6bd6
SSDeep	1536:mR7mnsf9vsXSsgAGycAccT857vyzvFihlYeYXnDFYn:mRysf9vsXSs9tc0S0tizYZnhYn

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KfmQi.ppt

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KfmQi.ppt.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	52.49 KB
MD5	874d52b06b7f88b2fc3c8781a69cf5bf
SHA1	92ce815aca8e76822e200eaa7dcce20f5557725b
SHA256	dcbcf42c3c7cb19465c6eb42e96ec9d3ae157ae9c9c8653f83622e6962c3b48b
SSDeep	1536:Ubw6TbI83tvbZjym/WNpKPghVpTALRtabW4Afe:Ubw6Tc8Z1ygb+VpTq4WNfe

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mHXjNqy_afSdsOhs.jpg

Modified File

Image

Not Queried

»

Mime Type	image/jpeg
File Size	72.31 KB
MD5	2fb39bb02fcef8f9fb66861bdfaa0b8e
SHA1	c14dfcd773e637157ef1dea1acc8a763daac670c
SHA256	034fb296ff360ffc8be9aa2f759035da8df7e772d8038bd0c16f4144b262202e
SSDeep	1536:yRpCWPZE9fKErYDlX/citTv32t0DnM2WMnK07woYQ0HYabLXoa4mKIKwQM:CC198lPzTv32o/9nFEHdNSZM

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mHXjNqy_afSdsOhs.jpg

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mHXjNqy_afSdsOhs.jpg.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	74.74 KB
MD5	39274f00821ec2b239cdc9de69fa3903
SHA1	950ffc250b6d3e641053c9cdd9df5452213f1b17
SHA256	a280fdb2cca413c8e6056a1ddd03cf22d705f24da23b57c9d5f138fd3b4db335
SSDeep	1536:77gYuND6EVw7SjFFWS30txmitltmzTmovvHDMnPXeGf5B3fr7yabLXoa4mKIKwQR:ngLR4SrL3sxZWm3/3frjNSZ4I

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mTCQS_uALLGLP.swf

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mTCQS_uALLGLP.swf.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	55.77 KB
MD5	cabf5fa18e38f51795930030523e5c2d
SHA1	6fa2da359c52e20beaaff5973ef3561e301dca36
SHA256	6c385711d413d2c4eca4ade489d8fffd2f5d74ded624762cb9a3edc0feff72a2
SSDeep	1536:5Qk7Ag5fZp3V7HbLoUEZtQNIUUEZaFr9PCC27:6gNtb8VPQfUEwxE

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NCu1a1hRn9a9rx.flv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NCu1a1hRn9a9rx.flv.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	11.61 KB
MD5	95432a55ef7f06399eac0458071a7ead
SHA1	70b0c8d1c5db199e4173a4f30990dbc51a5b1b80
SHA256	95577547a1ce266ae32fd036338138866334a5a7d16bb377fe673628387ff44b
SSDeep	192:gPBWWvSY1UBKKYeaYgcTvSDliTAwBqgrkfycIkVyN0b/2mFefs/+IYhA9jz:68upZeicOBiTJ2KdkVFb0f9IIK

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Oi9KwC ZNDO96cizq.bmp

Modified File

Image

Not Queried

»

Mime Type	image/x-ms-bmp
File Size	50.88 KB
MD5	a21ee3819482adf0aa84020d43382764
SHA1	aac96db6e72f1e2dc557477aebc40c1957d9acde
SHA256	6bdcce1935c5ced563acf7a56e9887114aed06bdc8e3d3f3729e9a4320def166
SSDeep	1536:1/jwHz6ajHqICE2YwmXGDYfV2Ku2elfiRtLO8WRjV:CHmajH8ETGDYfkKuTlsFAB

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\om3K2NDA.avi

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\om3K2NDA.avi.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	21.66 KB
MD5	dfd5060052f385bb682e9cf7ad29bbd2
SHA1	c432b7935254004a48768c8e01f6a6376d792b89
SHA256	a0321f90a27bb180aeafdb9176c89125c797a115d3e35378f53dd559018a8c3f
SSDeep	384:J585oEtD7JJVTfXx56DP9q4o80sjWXNhU1pOfWGK:w5ownlT+z91Z0sg+GK

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\oQkQcG.mp4

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\oQkQcG.mp4.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	12.61 KB
MD5	3aaff428967168b535056e030dd2c810
SHA1	7ec604983f9c9f938707129af081ecaf56557603
SHA256	d86176f88920efa97f460180587edd7642604e7da98de18ed9a0e3b19c870a61
SSDeep	192:WL1rk0u5OpNuTE/tSPFHQ/eHVrUOMzJzbCeIPHJwmZBkw9etdRRhA9jz:yj0MNufdQWHV8tCJBZBzYDK

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qOe_KF9 w7F3tIPBYk.ppt

Modified File

Unknown

Not Queried

»

Mime Type	application/CDFV2
File Size	68.50 KB
MD5	0f585a0ecc2e24e00c1384129e5dd14b
SHA1	fe350e94121684ed9bbeb515229160c4b5e1df71
SHA256	0f8dcf0d4863a3d0f761a25e12f402edae008b1d6e0f536f5060ce907bbbb942
SSDeep	1536:jwZQ5QMuogWgB7g7tVm1Ay+fwrLVR1DRJqAvs9/2qZrw:15BuSe7g7i1H+uLTYosV2N

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\QtLRVGxm1Fk6yQX.bmp

Modified File

Image

Not Queried

»

Mime Type	image/x-ms-bmp
File Size	15.96 KB
MD5	286c0c0364bae300f7fa77b09472e152
SHA1	08758ba37ddfb19f9a1102d0ca7ec75d5cabab80
SHA256	d5584b94f4aa848697567124de3e0a297beb1e6118001eafe5298580037da4d8
SSDeep	384:bRaRn7837udCcBiV90IhAIe5GBFum8kcsSLhJTeAqx:1qn7836HBQ1eI6Gim8kkLqx

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\QtLRVGxm1Fk6yQX.bmp

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\QtLRVGxm1Fk6yQX.bmp.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	17.42 KB
MD5	72ceb02ec485f21cd362c5da6bcaad27
SHA1	c8220dd308bbe69c61b453ad16328a659c547c9a
SHA256	3ab93c004a631d51ac08d19088ec435941aec2ae202ed652d6daf92b97ca55ba
SSDeep	384:OQhMZ+puNjgqc1NITrczmHFsAM70Q9nSaElp7B00okgdhyK:9m8pejgVNm6OFnHQwBpiRvyK

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wy1dJ0yNM1Hq.mkv

Modified File

Video

Not Queried

»

Mime Type	video/x-matroska
File Size	70.33 KB
MD5	be2d9c922fcdaebaf6207acb126f9efc
SHA1	a925655e2835457fa9350f2fa4e62dcda9d0430e
SHA256	39f5ac9c5d12d29fa46bc3f0ca14def67b290ded6c07c1f7a8d2ee538b365b17
SSDeep	1536:iNh+zaowAJx3PHSEXOSpM91cE0zsL24lhI6ZFHEGqXdz+Vc1Bkpkqu:0+1LJx//XTM91WW28I6ZFHqEV4Bkpkqu

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wy1dJ0yNM1Hq.mkv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wy1dJ0yNM1Hq.mkv.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	72.76 KB
MD5	8e95180f6091e0687b245e95176e00c2
SHA1	fb74652100534c2bf09a51b97190efcc4e74193e
SHA256	7fbbb9f77e8bbed600f40c8ffabad96216fe4bed07ed8b35eddd609f3d636274
SSDeep	1536:rTSFLJ9T6HG+yY92xqvKf4IZuO6ZtISZ3u+FfzXcYEH8jya+45Bkpkq/BkX:eT6HGzY9DKf1ZitIce+4H545Bkpkq/BS

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z85puxI.odp

Modified File

Unknown

Not Queried

»

Mime Type	application/zip
File Size	91.51 KB
MD5	e8b387a4b1cb39dffbe7491043a88b77
SHA1	44ff71032b1d925a16a581cdbae79bb2e972af62
SHA256	18b85643f39e476bb1c5b8eecbafe8f42963b899ed5bad8ac24748d7b26c72c8
SSDeep	1536:ibjV853To57gLffC1aePf3BY/ezjESrevksiYicPyA12P2buH+OWTGIBLygc:yKRk1aeBY/6jEAevksiw5uH8T0gc

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZP_IA.bmp

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZP_IA.bmp.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	12.89 KB
MD5	2a2c2bc32b8e07a6356b081a98482970
SHA1	33885a7e3645b2581fefdb97e4bab01a78830635
SHA256	da8c45f5336a83723e561da1fbefca40f1f7e8e4b005e04bda2b4b2f32d812e7
SSDeep	192:mHAEo2e5hph+Q9yWAN8ZPC5GO3NK1xgAeR9BRwLW/SDlu/n6ZC1WmR5hA9jz:mHm2O19yWASZI41UBcySDlu/n6UbK

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\EfHAwob- yAmz0Zs\J2EIO.pps

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\EfHAwob- yAmz0Zs\J2EIO.pps.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	60.77 KB
MD5	0b79ea78aa208713c6deea5330336303
SHA1	3eab0ac2b67a0ae180abcd0077a2233cf1c01313
SHA256	5f78a8f0be756ae2c170114c8193881400336783cc26c9e019ba13a78d9c3e65
SSDeep	768:H1TnNJ8l/fNVYhQhLD7EQMx5eZ5VA2rKVEsB4D2S589Nd7m/9c1NXjefedtQzXZf:Z/8tfNVrv7Y5WEVEb2SAYcvSJbZ1B

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\EfHAwob- yAmz0Zs\Rh5xR.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	56.05 KB
MD5	520cafb89a59f254ab72088b37678a1f
SHA1	a125b22d7872ecfa67737ae5d57687b345831ef0
SHA256	74fb7d4da9cf144d3e07a8c3c84f65e0d083208507c6dd3c57fb7f3fec211c14
SSDeep	1536:xdxTlHeqAUIEuHRy1drjgq8m7oiF/QfUEwCGrEwk+BhCSh:xzB7xpuHRaKq8m75V8j3iEwkWhz

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\EfHAwob- yAmz0Zs\ZiYoyNTehZ RL.png

Modified File

Image

Not Queried

»

Mime Type	image/png
File Size	51.88 KB
MD5	419bc3cf02d87faa7322ffe6a20ae737
SHA1	195b8b11b8a46a5ca44ff7fb1aaf18b33995d87a
SHA256	487a9964fb6b90c4a1569e7c60e4145982494c7213e3afd7dfd0808923ae9458
SSDeep	1536:Ta8Frt+yNZmw2kDvSi/kAwtBTxYvPsgHUS5a:TaO5JNZmw2QvB/kAWTisgHV5a

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NrsahiM\vKPGd4dlGi.flv

Modified File

Video

Not Queried

»

Mime Type	video/x-flv
File Size	97.57 KB
MD5	7fa634ac68c495c9081826599a265838
SHA1	c40df77c2ec95f314179dd981ff7feab43e7b806
SHA256	cfcd8338805dde1abd03f664a1daab892bef59d246dedd9d1bc175bd551a2106
SSDeep	1536:gCynXFrLNykHvHMjWhb5ZQWs9tQ7JWxdrz5z1Wp0Nt4eYv5IQp8C+fhA1g:zAFtykEjWrZs9aE1J5tZYhIQeU1g

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NrsahiM\AarFF35ax\-kLUbzB1v.mp3

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	58.53 KB
MD5	902b4ed9f7a0b587d0f180c591a33a30
SHA1	8702a7b580c6b3aa91fdca350dd315f06e255129
SHA256	a857763bb1025ee5cf83d3d2879d11ec7e1d6562b976313c1c9ec9be16732a79
SSDeep	1536:1y5YTxDQKB3WKh+mmJpa3uV9trn4yzNk7IPmR0ZMd7:16If7nmDa+btVzqIhZMp

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NrsahiM\AarFF35ax\-kLUbzB1v.mp3

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NrsahiM\AarFF35ax\-kLUbzB1v.mp3.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	59.99 KB
MD5	9662d05a4b1b5ccb4ce2d0275404e2e6
SHA1	e811a02254be6e0922f1b3991610b76f47e948f3
SHA256	ba70609b045d52d65053bed944b865c264ea6305fc0d94d202d8c3f56cd0cb88
SSDeep	1536:A9CwjXi5jhF4cVvDO7vNFLs1M5HzxsHPNnyNrS7XO7rkKtu:AljXem+QvfTSKC+7Aqu

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NrsahiM\AarFF35ax\vn8X.xls

Modified File

Unknown

Not Queried

»

Mime Type	application/CDFV2
File Size	57.26 KB
MD5	21221c0ff0f53a1e4fa8e79b32a265ad
SHA1	cd6c92f09e501cfb8630423f925278420fcfde27
SHA256	045980808a94850d757c9da0964d9d8ea4786581e0dbd30ac115e660625e9a14
SSDeep	1536:Onu36Pb2HFg/SzDyFLyz1DoOAWrRhL4OujGvbfE:4DMeSzDXWOV9GOzQ

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NrsahiM\AarFF35ax\vn8X.xls

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NrsahiM\AarFF35ax\vn8X.xls.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	58.72 KB
MD5	da871327ccdcdc074ec0f785b6a29d33
SHA1	90e8fa8b81db0ee813d772b272d223c1010b212e
SHA256	b86545a0179258494961b01210ffd50dd67545965dacf52fdcddf6ee8d9cf9be
SSDeep	1536:5F/CgIgilC5mrPvxW3c9A7rGNtd+gN01+Nxuc:7qgdis5mzos9AvXR+Nxuc

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\5n0mANZBznMtrrHnVKE.flv

Modified File

Video

Not Queried

»

Mime Type	video/x-flv
File Size	75.04 KB
MD5	a7ddf776f7fb1490c5eb32a7b5b49e23
SHA1	3d962d3dc7c0a7cbfdf6d11f6667e15e97ee52dd
SHA256	d3d79f20a2639d6d979d927e6a5249d1b22424fb705dabd162db4569c8e38cbc
SSDeep	1536:GjmlDqayVwLwmpNrNqiR2kjFDRioLsE3qEbnJCEyoz7NuOJ5FyN:GyhdyyU2BFTqEz/7NdFW

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\5n0mANZBznMtrrHnVKE.flv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\5n0mANZBznMtrrHnVKE.flv.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	77.47 KB
MD5	bdd0ba4cc443d4e316610dcad922f194
SHA1	db132fde2efd11f19900c784c94f7f4caedab681
SHA256	b469dd0ec98bf64af33eec08b154d84682e90cc308d56ec6e107e8bbc8b3ab21
SSDeep	1536:HoJlBs1bdIvilAbyD2/y/9QZZ2TQIhgZ7mDOJ5FyI:aBebdIvilAHy/qZZ2TLi71Fb

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\mCzFXvanYhVh5UnlR.ods

Modified File

Unknown

Not Queried

»

Mime Type	application/zip
File Size	17.29 KB
MD5	2b1b7df099bd870bae1f0d641b17d24f
SHA1	aa5f31bcb826d1c499c91e70501dc3d5f3f0e5ab
SHA256	9ce867ef66d61fb39eba84962dc2d0402fe8e070ea11f64e9f2a4b05f858ecc2
SSDeep	384:1nNhAZa2YXd3aCM/5ZqBtDNzr0/hfbB2qDTzfl/xRIGHrOw5O:ZNhAvGK/UtDN4TTRnIEr2

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\mCzFXvanYhVh5UnlR.ods

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\mCzFXvanYhVh5UnlR.ods.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	18.75 KB
MD5	b204d29dad9b55a40b225b9d3ef7a9c2
SHA1	bab9388b2c611c36e070527e956ac483ddb7a74b
SHA256	1b787f9aaaad0ee36fee18dc94b71e3aa0c85790c7f670aa60bd63a3a3b0397c
SSDeep	384:dkpVfvJpdV0jQdTmW+peamYdYmAVHWCZXn8Xd9Rrjfa6KK:+PdV0TW+Dfd3IHW8XoPdjfatK

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\VIJimfAmuxwtczsBL.mkv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\VIJimfAmuxwtczsBL.mkv.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	98.53 KB
MD5	2e87d0a10b3e7470ec96538c96753764
SHA1	db669779e4043cc80857911ce2b8599249233c25
SHA256	47abab2d65e7fd7ef298f34baa850180910bcaf8fb150047980051bd29e642a4
SSDeep	3072:550TZ7hg0ZujQ+NrTbv1eqR08BtQRRrlWa3KSyB5:byZrAbDi8BtQRrl5yB5

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\0twkzH6YEHET IEuLj40\0-Zf0yDlTZyn.mkv

Modified File

Video

Not Queried

»

Mime Type	video/x-matroska
File Size	48.16 KB
MD5	b347124a3f23fd09aadcf0bf86980708
SHA1	0fe1c4a2eaee967b7b9c060cf1c3c9eda2238bff
SHA256	6b838db0cbbced80cec830a52b1756f65937737be0f8cb4118bc2de56722b80f
SSDeep	768:6NLh17Ky5VY7ZmIapJs953XgjOhqNipu/cKW9KQX6c9HFBxVi9sLEvVfo:6NLfnYZmIB3XzhIi0UDDlBeesfo

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\0twkzH6YEHET IEuLj40\Agve9.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	49.42 KB
MD5	90b23ec3e7b36d5e05fbac4724a887ff
SHA1	3268c35c1735391d329b145ad9cd75bc5b84d6d6
SHA256	b6d7a2cc739a192ad3f9aa4e5dada7bbf9f11c91be312fb9be4871b9d3ebcb32
SSDeep	1536:FC3GuJs24AGPddn2QHy7cJnXZ4L1DG8NCkWD:M3A24AGdRiYXZ4L1D7NI

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\0twkzH6YEHET IEuLj40\Agve9.gif

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\0twkzH6YEHET IEuLj40\Agve9.gif.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	50.88 KB
MD5	75008fc4060e477f435828850b37390d
SHA1	b0bede2617149ad35056536e2963fb85eef4763e
SHA256	cb245291192f5f371a879f86f65fa509ca6541787d8e9349a5b06d263134d168
SSDeep	1536:XpEILvtLpFe49pOCZwLtHNbIEFTmhT0pGTbjoMtQu:ZFTtLzj952LtHNHTmJtXyu

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\0twkzH6YEHET IEuLj40\k4slwJUvmLj0y.mkv

Modified File

Video

Not Queried

»

Mime Type	video/x-matroska
File Size	46.05 KB
MD5	8d41a5e884c4d8c0d30e6db9aaec6e4a
SHA1	2082cfdb3aa272130bd4568e2a93cb223298ab15
SHA256	956aea45109c95d286a9b9ae8244c3f0359deb5ab991d60dba88c185a6b11596
SSDeep	768:dWzHOJHOgq8w13aJLzhGBRLsqFqi9r9Ql+q5EWH/7XgnnfaO2GP7lqxid3fHzYEt:g0Og2BMzhCt+Cr9Ql+qGKzXafaz6wxiX

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\0twkzH6YEHET IEuLj40\k4slwJUvmLj0y.mkv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\0twkzH6YEHET IEuLj40\k4slwJUvmLj0y.mkv.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	47.52 KB
MD5	6b6b54f92209cb40b97f561f0b335743
SHA1	0028cb264dcc19d5d59bdb6c567205f377568265
SHA256	3742abe10b0eb90ade8e132f66029bdb2ec0a55a9670992dcf7290d0b887318f
SSDeep	768:KpbGKwn9+AYcBWHPbda23oMG8NEaFAVQxNUCHruLCaV0QPVYQE/rqlv7FgVf7XHK:K4nAgWvbd8MG8NxFHUdpV0QPVfBp47Xq

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\0twkzH6YEHET IEuLj40\SJ4o5h1N.ots

Modified File

Unknown

Not Queried

»

Mime Type	application/zip
File Size	70.72 KB
MD5	8f2cd49db0ebc8c1ea07a60d23e787bc
SHA1	b3caf24cb6844064e546833dc09f5477a072e5d9
SHA256	9ee63aad00ef5e5a67193ac87d32878faa4dd4a682fc2a69ae9449370ef7d944
SSDeep	1536:U89C9xb+naCPOOpHpP8/w0DdwcwOImL4S65kod0kRFJXXbYx:Uu/zTJE/w0Dcy4ood0kpy

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\0twkzH6YEHET IEuLj40\SJ4o5h1N.ots

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\0twkzH6YEHET IEuLj40\SJ4o5h1N.ots.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	73.15 KB
MD5	1a00a2e1648aa755576f1d4cb404a622
SHA1	8d4b25be4d7a721d07768664b7377629dfaaf465
SHA256	212397d855badf273695486196645450febcef9478901039fb971c31806fb3d0
SSDeep	1536:YFVTDSfsSgb5WpH9DQoxWJt58UwMW1FW6OlKLyXXbYB7:wTCsSVdDZot2UwpQ6AKLQC

C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	18.31 KB
MD5	19bb5c9f32f34b714e2f49f1b67bf81d
SHA1	e39cc89e6fc1af32ac8ab573551c46c7a8838a27
SHA256	31403377b20b7e76c6f63c14cb810adc77b7c8477ef5427801891bf0b01b270b
SSDeep	384:SCH5oqzVRM1dI3trHi1mpxH70jKjCDX/eDxoIryfAcRE9K:O+YjGtrHi1mpxH70juCDPe3yfreK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\informix.xsl

Modified File

Text

Not Queried

»

Mime Type	text/plain
File Size	30.22 KB
MD5	c5d87a5511f54cc0c0328af33266b7e0
SHA1	efde6f9fc91a1baf6eb5df2e5ef39dbb68e6b8cc
SHA256	1535c1a1f223e670dd9005cc0b33cc144435c6b8afb2507f2984064e570c28cc
SSDeep	384:3ByDmvqiHr3iHrnFBbs5crEnP5cV/EGk/T/VpQrIibHz:3BAmvK5rEPGkBpQrIibHz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\msjet.xsl

Modified File

Text

Not Queried

»

Mime Type	text/plain
File Size	28.30 KB
MD5	efa6617fad71e6496c4ba467d34f4a5a
SHA1	3a2cbe3a6c37a5bfec3545367c0cff6571423de9
SHA256	a89995d7265bd4ef9370f133e20391ebcaa4722f939487ab79f1a0457a2a448f
SSDeep	384:fdMOrJnSprJlKpNeqrJQvnqiHr3iHrnFBbs5zs0wV0nZK3JnPnKzsQbGk/T/wIi3:VMvvnKMs0wV0n83JPnKOkEIibHb

C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	29.77 KB
MD5	9d9248c3e8ba2954da46883ef796e345
SHA1	f1e7990f06ba4e4c7f93faa2244a724ca589797d
SHA256	207599225bf58af92680114d55cfc956c77d380fed8b1297c3f80d04200e24ff
SSDeep	768:2zNcxmYeatdUuvdm+j6MhpQvPtRhU1HtWuu019EbUgK:aOjtSuvdpfhpQdRoNWJ01zn

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\sql2000.xsl

Modified File

Text

Not Queried

»

Mime Type	text/plain
File Size	33.28 KB
MD5	6f2c94f4b9c1cfc70c9d67b31a0b0894
SHA1	4a3d4e48217388634284d0f32411b3dfb451b462
SHA256	4e19571450fa29b62e82786e8ebcb1d8de307e2f8a0baca384cc18d998bb932c
SSDeep	768:x0QGyvAKMs0wV0xD8E50hnPnKekcIibHb:xv8KMs0wV0xD8EGhnPnKeksb

C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	34.74 KB
MD5	fe7dc64805890be3b64ed0c7aae9dd70
SHA1	8ebd430a18d6f1197f241ae6ca6526c7c37db85b
SHA256	4923319cd98c609a8905fa44f45957738df998ccfb605985c642769f196b25ef
SSDeep	768:2ZawAfgzF364NNx2ErX80X88TMRYaqPs8rYvME85DnBZBkiYI2D3pVWCMW8K:xfQF3j290XgjhMTJnBZGiYI2DZVWCM8

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\sql90.xsl

Modified File

Text

Not Queried

»

Mime Type	text/plain
File Size	38.59 KB
MD5	b83cee1b3fcbd3f34d768191dd8331d0
SHA1	882955922761c86f3b59ddb523d3aebd16239b76
SHA256	81af20daa874492b0bdb15415151ad01ad76acb7b2604d0aa6d6ad5038fe8ab5
SSDeep	768:GIfVV29KMs0wVEcu8BraQG5Whn7nKekcIibSJ0AKbTe:GGiKMs0wVEcu81aQGMhn7nKekLJ0AKby

C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	40.05 KB
MD5	2ffddab7163b6b1468c9878360ba55b8
SHA1	2a63d5527de34b0b97576247aeb84a6af6a8c7b5
SHA256	b446d4f3c21e688797964e031588bae0447927bf5488c2bc6b4618694aaa275b
SSDeep	768:fKNzT/sqfdEFX+s87mxwdnNP8Q/Yhez9CJMIfVgsQ6DsEi7VLiCK:kzTEiEFX18iypNPhYhs9YQ6DTiJLK

C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	30.56 KB
MD5	42c0889662e07eef67bdad7e392c9a98
SHA1	6688fcd469b15728091e0ab808aee619fe6e925d
SHA256	eb1d382865b97389fc44f81f7ad7573955863aff1c971e0acce4002764d953fb
SSDeep	768:uYX+Otp3zDNwJnK8n3cmJ02s2e0DduYTwVp0/ypGAz8K:ug/zZw9K1Y+oDXu60J

C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	652.34 KB
MD5	00ab0cd89a32b159216a3f9aa80a8b1d
SHA1	d25200cf3029ef95099e361d79b53f4e9c738f2d
SHA256	eaf017ab7f4a9dcf691b3ad9b79021b4f804676c2e38bbc1e9ff72fdeb55a4e9
SSDeep	6144:NONVG5g4GLrhq4AQWmi3fMCBJC9Ir1Q64bULJ:NONVG5g4GLrhq4AQWmi3fMCBJCS/LJ

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00021_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	14.53 KB
MD5	6b4814db5a6dae003a34215cc7233688
SHA1	7f2b7b3aa60553c246177384b34f63ef2e4065c0
SHA256	0dafec9f47640bc23ac83e0b6a9c539617adc9e735944ace3ee5844367fc8680
SSDeep	384:kRFG8Fjt5X65VpMXD+7XM4OEWlvKGxNNSN/0Y54OEW5:ki8FRLDo84/WlSKN2/0m4/W5

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00037_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	6.53 KB
MD5	04ab4e31eeaf26717a16fcf4010470df
SHA1	324dcfc905f950cdb47e0487528410fc674e0992
SHA256	2d079e7dd0a737fc88be9a5cf7cd7d9c0e21acbb5ce43135d338c97c8eddd942
SSDeep	192:22acBRn658GECWSmP9r2mMJTQQ8aMcQQhE4Xrs:22DPn6Wnr71rDeXM6lrs

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	7.99 KB
MD5	3e68c16fa5a24636c85c1d029e783acb
SHA1	6bd96c77b4e6fab516792469b8d79b8f402bbe93
SHA256	96f81fefcabaadf3c2bed773b685c033c8e80c7582478c02dac70f8909ee8cce
SSDeep	192:jvby6oXgjCuIBq5l5MfkuCAPojERl7hA9jz:jvbyidIc5duQARldK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	4.64 KB
MD5	5d0820e8f17e08794a56462e297c49a0
SHA1	2dabf1b132b0589c20e06515482c786afd77e1ab
SHA256	8300affa5f512605d214be3229c0f071585da9a0fcbe990a5911e06b4cd0c459
SSDeep	96:qWjGoXLeP/In98Ph9B6QnGs3rUNyGoxGV3UmZ9QqhA9VfnKAz:0a1mJL6CGs3gkGV2mnxhA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00052_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	7.51 KB
MD5	83da96423fe8f73a6f388b3a7214e0d6
SHA1	bec0b2646575ba7f3b15325998298badf8300607
SHA256	58df7eb225d924b2d88b19b937840191d65cdf65dcf9a01b61e6c39b3f3c4f3d
SSDeep	96:tCcNHHjAt9W/BWFoLXo89BXJ9MgPXjTorod0ZZlJueFj0Ld2HbEPgf33UhGc28ZJ:ndHUIDY8zXXXvoy4RHHhuP2vT2VIw8S

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00057_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	11.61 KB
MD5	1235bf1154712a915cc815eaf9f2b40b
SHA1	fab1255e284283a3276e8e8cfe570cd259d0ab61
SHA256	c59bc540b111be2bb7ffd39eeab555c56bfaf7f120708544449802426b4bf416
SSDeep	192:kkhgkvIbBm8OBVkuYdLrVDsG0oBjxyrKiFIfY2JQ1ME4CKIatOMEX:kkhRvIbBwEuYdPVDB00qNFOYs2MEtKV6

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00090_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	518 bytes
MD5	18fe1d8284d3f3ceed271d10250ec77b
SHA1	82a9ea064eff7c0d2c9a41c5cbe0aca4fc5bfed0
SHA256	ce2f9f2c0b6a177e4d77624feacb97cc1c011cb76e73533434801747be68e83a
SSDeep	12:y/TSs6wKfzGhBpKtKsPLvJi9JYnJAWKIeAjpUUKsPLvJi9JYnJAT:w6pzKP2QJK606mQJK6T

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	1.97 KB
MD5	e06cbb29f5798bc109932a5dfc385a77
SHA1	8bcbea5dea7f2343543b5d7a03c303011869faa5
SHA256	127231a3e5840b2971a70fc0a5eff39a9d5ac14c3166101311172b653d57e80f
SSDeep	48:hkvs36rtpJEK1J+zACBSfG7eCGsqo9wuEon6Ek+s4mwt:KY6rF+c0qhA9VfnKAz

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	13.88 KB
MD5	814f68fe01fa120a5dcb979cd35a3b93
SHA1	7561ecdda3495b64451e2ad17c5db17fe1bec8ac
SHA256	75b1c1f0ee83bb7af7a1c56f9ed9878cea48f6124df228ce467ec2f5322f770c
SSDeep	192:Cvb3t+GFw7eGdtV2Em6iVD8qQk8wIlurLIODSONa44DH7Uo3+tBuCPb6LNhA9jz:e9lKVH6wqhfIsEODSdDbd4uTK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00120_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	3.40 KB
MD5	51a85817591a784253ac71eafef1df24
SHA1	8cb906e785f98f656808f96c7aa3d4e37541ee5f
SHA256	325d15a8136b1fb416847321d49c870e305f22fe307eeb881709336d92fb358f
SSDeep	96:0evyyQq0J9b+W/zRQInzOy4MiqzMIU6Mz:0eayQxLjiqzJUdz

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	4.86 KB
MD5	2ca2c84488ce564e0abc6a224b52bde6
SHA1	415a0bb47e99590000e470c4c048541e83c17065
SHA256	64bef905034f467abb175e1617649c65cde755fa0c05d1c4a1312bf0ecbe8e6b
SSDeep	96:CHFEEgwW97hCph1A0q7i5G4aHXAARV0whMMhqhA9VfnKAz:CHFEEg397YpU0eAARV3qDhA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00129_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	12.19 KB
MD5	b49b0e4456705b0a313192f226a8df79
SHA1	c6e58070f2fdd40bfe90cd6329cad0ff18ccbf59
SHA256	936e00106dc94df96a5f5b33c46fedac649fdcbb3ae27a882a6ffec0b57d6b0c
SSDeep	384:kRPk5cf+ejgTbCgsm7h3XKw1h4D3KAy7fWlVdzlRrc71g4VU:kRWzejgTbCg/96WuD3KAy7f8/7rH4VU

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	13.66 KB
MD5	a1dc7c11155ad2c10498f201753bc8f4
SHA1	b04a0244c3c24b98d51bbc78ab6a20224a3ae6f6
SHA256	3c4d646d59272ef69d39dfa0e32b841bb09d238171ef24e4a20d8299501cdd0f
SSDeep	192:0EzeySGTdoLqZE9t6jweJWkPlWmD26++a/I8khb4mGMTPS0Ix+6H4O3S9d7SGqBM:0E6yp6qweJDlWeJ+vKZRi+Bz376cFyK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	6.60 KB
MD5	7bc5091549319e88ae94861e38e6a688
SHA1	f671add9e78538d534ba55c13b4e4148816c88ba
SHA256	2c25158003a2806237317c3cef6c28b6e870da34e55a52c26f2ad7cddb56b7d2
SSDeep	192:uMNyyr6DbbxQo/zYaZ6E/F6X0GOXbaykihA9jz:uMNObbxQo/zzZ3VbadyK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	16.41 KB
MD5	efbd3764b4090f1de7f16dceb970e576
SHA1	c79bb2f061e2b0734e77649f0e0beb3ce50b510b
SHA256	bc483f01f615d1cab21ff2274b9563dfddb6734717e5a918d7a3a3b1aefa0988
SSDeep	384:VmDNCNycru7LoMcaPXq4QGaWu8aOKkLBu/Ph7K:VmDNVEu7LoMcCNu+jMh7K

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00154_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	5.19 KB
MD5	e1279769f3cff9ed859f82228f7fbaa5
SHA1	c6ecc70cd36b3d55df617b80c33261932db15720
SHA256	04056983aa58c525a8a2df874f1d04efaa929ed4441e1eacecebd230d615c608
SSDeep	96:P42ZQz2ec4hBwNl/oR82ZQz2ec4hBwNl/oRyprALxlarZb:PjIJMNpo5IJMNpo0a9AF

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00157_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	4.84 KB
MD5	cf223f86cbcf920d38fc5376df5401de
SHA1	e8f4208833a4739dcfccfa981ca2c762080790bb
SHA256	8173ee7de361a05e2863dc4b624bdd3e5a58f3650c451258df4a08630b17e322
SSDeep	96:z2gG0QU5rFX3xFe1OEs2ovYJSqae7mcdiov9xFe1OEsyFX9:aCQs/ooMovZqYovDook

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00158_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	4.91 KB
MD5	2dfd3972afef8c566fa65a739b425322
SHA1	03f2f283e96a74f52fd18331ee6280e9aad39c7e
SHA256	7bfd9ce75a0f9556ec18c5ff700e387a2f195ceb97b45713b90fa62e73495771
SSDeep	96:6fDkHDB6DYMhVvfDkHDB6DYMhVrlp6vVXmwl2F6ATrKs16YzeZymwlX3DTXlWLzT:4D0BF0V3D0BF0VngVK4uR1kUlWhRyWtT

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00160_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	1.12 KB
MD5	1f8eca6feb06914c7e33b508d82343e6
SHA1	db69a892479ec46a8e417cb93f42a2cb69eac0d7
SHA256	6008fb7fc1e08c4870d4386f192fc28e13311d70774590a4d43bb2adbb622b11
SSDeep	24:Es6llT3bPct1d6ZqbYjs30lT3bPct1d6ZqbYjs3oslbcTKosP9MS3Q18M6slPjQC:CPPeJ5sPPeJ5bbvo49VA9PjQe7FoXExT

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	2.58 KB
MD5	18c57aa4cc3796e93b2893c57c184600
SHA1	5990909c9df6fa1c29b5ed03d0b944f2bcfc7d31
SHA256	23f88d8ad001797727fc60917be76d351b913dcc539b2de51e02aa72831695f5
SSDeep	48:nHN9Xorm8YPEpe0k9FddA4/mQS6rNc+WBSfG7eCGsqo9wuEon6Ek+s4mwt:HbXor9WEpxkZdDLPJAqhA9VfnKAz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00163_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	6.82 KB
MD5	2a33cc608dabc48d315e76176ee9c1bd
SHA1	581ddfd8a28f22d3be43f94c39195882f18fae2c
SHA256	898940b679f296e73a05f5fad7e6561d25a4a7b406b480f9103687fb1c5e19f2
SSDeep	192:5MAKqy88HEa7oQ1qwKDYdGzwGzKy885uE:5MAKQwDoQUwwrExE

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00164_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	12.94 KB
MD5	86e4595e9624927514b5a7156fba7d1a
SHA1	286c0a8dd51bdd388b668bdf8756a71b7adeb924
SHA256	b2c97fec7aa801123dccc6f383fb6fd31964e03155180ab36147074ecbf3373c
SSDeep	384:yMAK0MAKYWkxfCfC/d4DMAKv85kyuYXMAKh2DGw4XwFBT:yMAK0MAKYWKqCmDMAK8kyHMAKh2D7c0T

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00165_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	8.38 KB
MD5	f3b5bc2a12b94eb8be04cbf72e958cc2
SHA1	6abc907ae96db439a8363382adb7c78a965dbd53
SHA256	5f1eb007ed9d5ecb24f2a8d43d5ec4c2a278eafdee127b709005dce842ba5202
SSDeep	192:4MAKJww9ZL6PHKuu6smEOO9W9jbGqSpP5huCBTFGpqzZl7XVN2Xm:4MAKJwwXOLJfEOO09HGqOjuwf7z

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00167_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	4.78 KB
MD5	a3727b2e8c9da4d59cf9a4f3829c4923
SHA1	3d424c4958ec102abf08ff960f05087da6c6bc0e
SHA256	2122de23c630c61219ed90ca0892805791e10df84847f44047cc462896feac5b
SSDeep	96:1OAIMAEMQ7weKnbnL6KvZyl5KVoNKvaM33K8K6HXSNxG:8MAKR6n6NmoNrM33FKoCHG

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00169_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	5.25 KB
MD5	55fe9db031fe62ca6693d9b0856253cc
SHA1	8ac2cdeaf0ebcb5416d622dddc80e9a4a569a12a
SHA256	95f66e46c724222060e6569d1c054013c1bd596ca8221d803d4fca79f71b1de9
SSDeep	96:4AIMAEMQ7wUYQn1WHaefAZQ27+Qn1WHae4ZZ4tAE0R5njJlQn1WHaeTFykxB:oMAKn1n1W6efAZQ27/n1W6e4ZGarjJ6Y

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	6.72 KB
MD5	7ff880f27a7d0b4cfe6a62dfe48ffbec
SHA1	234d251774161510c7794014de1bee0d97e09ddb
SHA256	3bea3c6a0c8271a18a61efff8863e983b5b4784cab72af3380671b33768f475a
SSDeep	192:PHNwmh2Ll8IknrQ9KvtDzVdjIIDq0/sapgj6hA9jz:vXGan6KvtDLjTDnrpbK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00170_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	9.03 KB
MD5	ce72e16ad99f40592ecfa8a1b84d2b4c
SHA1	ce5c2b7da4eb631170a63275497d77d3a8b90cce
SHA256	e36a78baf6e3606418007a720504c442c6510c9b86803cdd034b36e20ea7e318
SSDeep	192:32GGc1VJxWNMSZV3AAPHhHl3WAgf6IlhQBM1FaXX9YAjzhwdMH4b:ZGcpxWOS33tPHhHFWAgf6IlhQByFadYj

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00171_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	4.90 KB
MD5	937eee75923f2c8a4da2f29cb53b1c26
SHA1	e0af83b6204bf5d4f4f11c328b822713b9dcb9af
SHA256	8d3c1d0b5dd2d5aa0f9c1c63bc3eee57b66cd9fc4ae3eb095735fa6ba1cf24e5
SSDeep	96:JAIMAEMQ7wfKqJu9ibRwBNosQvAa24zKkxS9w1HiEoq3VrWUxe9x5:tMAK1qci2GufmOct3hWUW5

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00172_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	4.29 KB
MD5	b7ce4543f7438d163a6de7ff91a89ba8
SHA1	bd6d467ee8fe36658c3fbb6ab567d8faa8afbc48
SHA256	cf508a8bac5460924924e5858739c959588f4639d2350742f3318c0b8380942b
SSDeep	96:1lfNph7zHShwvi0AzHShw7r4gYk2zHShwZ8zHShw/0xM9Qb:9HzHSKHAzHSJlVzHSy8zHSI+Z

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00174_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	3.87 KB
MD5	66d6a49ea4dd3aacc379a7e38639d579
SHA1	83ffdf15e16b7af312700ce0db3289df6969fd52
SHA256	4af586f5485c10fb69dcb61bf5c1c8e4fd6c01a213c73a199e2413dc5ff2cc51
SSDeep	96:fDspSXIDfGFDft4slDfkDfXdSXzDfReDfBdZDfeEDfczFDfLfaDfGXuDf3m+:uSX4ct4spsgXR+BdleMczJLaG+3r

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	5.35 KB
MD5	867e3808d7e83fa5ecced9f102c61fec
SHA1	4f49e17a521582811c145cbebc7d0a26c9111ed8
SHA256	9fec468d7a685ff0819747f0e969e4a603780bbd2842a631b135bb022e2c1a2d
SSDeep	96:AYOkgYtDMmQ8HHerORDgQG4rqR85E/wOwWzDdW533xzqhA9VfnKAz:ALN87RDI4uToOwudW5HQhA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00175_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	3.30 KB
MD5	af8324028e2f56612a407f2219bf94d9
SHA1	098fa9683375bc93229ec20bfdf83fd74089e6a3
SHA256	24a72fa325e322809d4edc1a9250b44b7aac211ce5baf7a21a5112e78d65070a
SSDeep	96:vlfNprrPO0sxPIb3BvP0EKalLdan2U/79xs:TxG0sqb3BAn53s

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	4.77 KB
MD5	a2c343b4ec289d7dafb1468993cec826
SHA1	d5092ce9c7a56533e765c6279b736196635ac93b
SHA256	f0fb0626bfa9c43209dc2cec44b4aaa8fa530a63bdddaf74b982246ef55c8454
SSDeep	96:jricAD9JrWgcdZ7COJ7DHxkxaxq34Vzy6jG4olDRX3sSQsSFrzOJqhA9VfnKAz:nicAJog4Z7COpTxQauizbj9oLMog7hAt

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00176_.gif

Modified File

Image

Not Queried

»

Mime Type	image/gif
File Size	3.05 KB
MD5	7d92dcb769dce80020e6015c526578cd
SHA1	935e94bf84c7ccf8a932aedcee4751b895ddb4f6
SHA256	71da069fc7662d5a91d665a4ccf675c5645e677121a98c278a3f74e38df1462b
SSDeep	48:m9WRIBPzGEWRIBPzGjJ5yaEiAgNNOSFLBI3RaBpvP2qk8iro+pjEAUwTRoW4t:iP1dP1y1EJO5FL+6vPpkzk+o8Rt4t

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00010_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.96 KB
MD5	d2a9f602572f31b272954975cf50eea9
SHA1	3a2dc3d5ecd57409aae228b024befdb88d919244
SHA256	a93ece3ad7fc01a0bd0c29c27b75f1954999ccd01b5497517957ccf6cb46e3df
SSDeep	48:1ZT0UflP/hcobcDavUk+BWJSh6PvMDFWv/h8cB05bBdLnBo39LHFVy1eaUYmRY9G:n77bg+Ssb0DFWxB0515BeFsAaUYmSq3

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00015_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.62 KB
MD5	b213e94ad969763e66e6bb1ed00b6d51
SHA1	dbd158fa0305446b28cbe1eaf2dc5b36721d061d
SHA256	1a69f23ef60ae979fbe478660bddc8cbd5cc6e6ce86ac6eee3f2d00592b8390f
SSDeep	96:GPESShRLN7cgXcmAa375cOL/AcEPBirT0CkM7EO:G3+Fcs0k/zEiTjn

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	6.10 KB
MD5	24f5d1dfd6a9a32931d1dd4e16f52610
SHA1	ffb488db052872de3dfea7cb530711941934fa2e
SHA256	7c75d27810bfee23a15e1f6d6a5593d2e59aa5c0944f073987ae708a6e95a7a3
SSDeep	96:mqESpeJqAHV3OVzwJ2ef5RzVCb1FWAWqfxckmU7Z4Ngs7evsqhA9VfnKAz:deJqAHVQzKEbDWPkj7BhA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00790_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	5.55 KB
MD5	f31c33c0025db3b5620c809299c94f48
SHA1	405188a3fec6e2be1a65725118dd7aafe35f796c
SHA256	3b30d10b728302e6e0db544d34a124c48175768a83e54a28bdedefb702e4cb73
SSDeep	96:JVRPeywwyHx3jEsFyOl03QkKUVAuhjj9UzXTie6CeHpgstQt0SrcS:JVRPdwasrmjJUzvLeJTtQD9

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	7.02 KB
MD5	af5bf08237f685753e6e57b90e7e829b
SHA1	ade95501ffcb380118b09dcc28661e4f102676eb
SHA256	0ee7273699a1796a7c2d562c7b7fcaca77fd473b8d13d89ac676e138ed216cf3
SSDeep	96:30TumjhuTdliJBhw3Hrj0O+sqi6GGkBJAEL+Xw7HQaEUqiwWgqhA9VfnKAz:3muZfyBhwbj0O+sPXvJz+XrtUhhA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00853_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	20.10 KB
MD5	d9484dba80b5ad24bb464233681f7236
SHA1	168fe8d2e3cb0cbf5d3636b664230a82201ba758
SHA256	63ffec002c6c7c0b768d013c48a73c34d3b7856b4105777a2c25594e6f6932f6
SSDeep	384:X5be/I9XLsZFmYyGPFWE32Z7kKbrwaBFa9ji/rW9i4S3dF46kHyDHML7oSD9:XdUG7q0LIV2Z7kEUaaA05S3dFnRtSp

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00914_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.58 KB
MD5	5cc34de1e9c9d796627ea544e1321b15
SHA1	48fa967e87de84a029d465ff53c758b66ffb766a
SHA256	b093207c97cb7411da05699bceec879b1a58a6397e12f6e57920aad4e67dae8e
SSDeep	192:i/ikeWqGWTazAQ9GbekT9BKAX3MudiGLL/MzCPO0FEeiwvu4JepEbMzmjyaK1UpF:i6keWqGWT2AQkykT9sk3MetHUzCG0FGE

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01044_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.56 KB
MD5	1d486b58cce27f925ef552a5b7777f96
SHA1	16468e1c6d700e6f80571dfa4eba4d9c3dcc4bae
SHA256	d7f5a1bdeacbb4d2fd587b7f523f540ea0200db9a31da0eaafcc4f585b7d489f
SSDeep	48:uEsK4/Aw9Vp8r1N453kWoRM8k1EPVyyz/p4c:o1wpN450Wommyyz/l

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	9.25 KB
MD5	5ed4c742cb7ab43b27158333e366501c
SHA1	4f4914b01fdb6a9e690f672a0fff5d3fb7ba56ba
SHA256	8b025e509843e5fa7407051bd178a5c63096df7a0d204c0c48b0070a1d354835
SSDeep	192:n+9pTGrOkPjK4DOK8M8dhguu8jyQro6hA9jz:ngVk++OK8M8dh+AoaK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	3.25 KB
MD5	fba4b287eaf7a9f0aa9ca7cec1df8bcd
SHA1	f7948d4b6c965ea3347e7dd16dfb75dfee9ba873
SHA256	697997963b3807276618599b9f65391010a483158f1724353563cfd21d6c6aa5
SSDeep	48:e5Auw2JVh+HQbWjj5omePnac1ZZr6/rZ5vVuYkRXp6nBSfG7eCGsqo9wuEon6Ek8:Zuw2Rm9ePP6TftujR0HqhA9VfnKAz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01173_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	25.72 KB
MD5	a55b3d333cf3fa4df944cc13301af5b6
SHA1	c3995c31d233e2660cc6c47e56f498b3ae650cb6
SHA256	4232786f3f6515adcd13a6f733792c0b8f76562e1e4a57e37fb4b651863238a0
SSDeep	768:tm7L7wO+ec57BM0aRxDy6SwQAz4GKUZpqjsk5FcjZUSang2CB7eno4C7+GLGVrQ3:QTJK1AoOTPHAbDEayR8ECfQ

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	27.17 KB
MD5	fb2034d44faf1e905b1f825ce7410ddd
SHA1	b77e40bf88f8d903391b196aa1ecc9eb460f3957
SHA256	6d6e3b8a00fccb2b9eef5b8325a8e685eb6cfab4210b13ea49198b7cc5c0b8f3
SSDeep	768:SUGesgm6JGRGZZKAY3UPmFPd2HSWMXlls8K:fTN5J1YUw2HbMX6

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	28.67 KB
MD5	f6e5569ffa9d9437307cd8f74c269457
SHA1	f919600d81df9e0fc44372a3191bc37853a41da9
SHA256	5e05882add68ef86b2b4fe2a3cf560e7b7985c0298ee498860400cc6f23e2375
SSDeep	768:swgzHKEEEw+OSuKbbAbtriyjpgbYlAtoKDhfOhHjAFu+K:swkmSHnAxOylgbIAphfOZSe

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01184_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.66 KB
MD5	c2b79d6102c7746b2dcc75bc9328a849
SHA1	3ed5481e0e0be982cea5a8ff9aa32ac8742b1e47
SHA256	deff1ba7370f3119b660bc471d7c94727ce088cb3ea6ed8b158be22748feee1d
SSDeep	96:s4U7yT436IJ3XvgYyPBOJARsXa8bWOZFXrsmg9M4E4x22OAvn:HU7M4KIJ3fgvPgJAwa8bWAFXrsmg9M4D

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	5.13 KB
MD5	6daf34b9d8fe1cb429ab34f163ed51e5
SHA1	399607da245810b071dba026eace7b1e727f5f4d
SHA256	21d6078e2d53c460f41b6f8bffd5376676879ba1f111cd23e282c8193648eb3a
SSDeep	96:1Cf1e8rq41oZQCDHeTAlVP5bSO0rMKXe3FyeqhA9VfnKAz:wf15+ZQCD+TAlVP5S3rCchA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01216_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	5.70 KB
MD5	814fecc38e98e50122a7985c9ffefbc8
SHA1	3e99b20356b70d864d2691f2f9f52e271a636363
SHA256	fba81e3d475814bef77fa2d1cb4a8a7fdff55f5fbe17d255c1f2f62b4c0480ad
SSDeep	96:eP15xV7KmcNgcIUosyf/ebFmSz2GVFXThlGPVUHXy1FG2UHXy1FGnjVsBkL8cWeO:e5xVGm8g9T/f/5S6GjXTPGPVJ/XJ/mlS

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01218_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.94 KB
MD5	921bfc4a21e938e4357f0421ef4e584c
SHA1	ae2849f9c16d3e8eaca1cc201a703505738b7d9e
SHA256	5cb6f31a06795da6b7fda3a3cd63deaf7fb53d2883d9adc4cdeac0aa726b75d4
SSDeep	48:IK4/oELpo2/RLkBLkqOLkHLkkLkxLkRjALkDLk9LkoWLkL57LkKLkIhVLkOhXCL8:I1LTm2ooZGrkSuWLO6OXTfSqQlFrhnHq

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01251_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.69 KB
MD5	5ff7aedc7657a2eda5855dcf404813e6
SHA1	5566a81e187068e899969841f3bf55575dfc49f3
SHA256	5bed0a5e29e8624c267ec9a2894f6b52c1478b97cbae893524a74dfa0655c668
SSDeep	48:OK4/1fCrneMOtbsk4u8LplGiTC2+LDpFjqqLpo7MdZX1qVBXDJRcXY0Wfc:O11abeMob64iTC2+LjN2MiBFRcXY0WU

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	8.66 KB
MD5	c85e7fa4bdd775af292850ce82cd046e
SHA1	fe82291bb1c363695445de4c5cd95ef66cb6bd0a
SHA256	bc2c4c8d09f364c8f9f5e03246f680d5d2a281fc18b21aa06efb551031158f81
SSDeep	192:VF+9SuiB4QmZ/tvE1S+DLDEgLY/VK0m/QiwnXOQPV0X8hA9jz:fbeQmZ9EQ8Egk40m/QiwnX6UK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an02122_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	7.36 KB
MD5	a839a7edc756c1e23730fab4966874dd
SHA1	559ecf2a4182660945e94c6df8e9700c55b5be5f
SHA256	2ab179a87a40f130333cedd289fa9f733181184b59004d5dfbd933cd56c04306
SSDeep	192:n0LUL84GibfbPE1cRMhvH8bTdpM+KsbTKjjN6qNcBC7d:nGULrGU41cRMhvH8bT4+JKHN6qNK8d

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	8.83 KB
MD5	a98bf8ab8a76d78b404655f3ed965af1
SHA1	f23859035c0dcaa0cfa2f1c80c58f313993cec17
SHA256	f387e76aee2fccc1bbe3dc03a3d9b9f90295c24a975cecd279f5c43d1dbcdd94
SSDeep	192:ZYg354vXNqXPnZsZaU+/zBM1uKNJi1hmdhA9jz:p3QqBK+W0KNJi1mK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an02559_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	6.48 KB
MD5	ca4944faeb416010b52f992502560f00
SHA1	fdfa760f14e9102a2d8073f85f37f4994577ef1b
SHA256	7d8a15726bbd6bcb83c9ef7f240e84ede2f21202554d89f15468047568865d44
SSDeep	192:US66AOGAPivNkywd78jomSXuONYCxKdaKT0iqDq:r6IzKvO1HHzKc60iqDq

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an03500_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	9.02 KB
MD5	e79832691f1d665b4108b20889c906d3
SHA1	0a65e4a860f1ca5701a5b3c804e17136f3eab325
SHA256	80602b4ce0caaeb6b99fdb41c3303aa155114d70490ce1bdb29d79332e6a9b54
SSDeep	192:pPLbk6rn4tPpw4hUmQj/ZFU0jACkUJA7cjRLZTak62WrTNKWZiH5mK4aKrZKryiG:pPnF431hUV/ZFU0ECpocl9mk62WrpKWL

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	10.49 KB
MD5	d9b2749ef4e7ebeb689b384f47ee2e63
SHA1	03d3a50e2749bf8450b8ac0d0eb039d6e315feff
SHA256	0ce37409f3dc0cef04bbe0952f7ab56058939cd57d90b3df963469bd7ed171be
SSDeep	192:oFz6ZeSP32h8EpTVj32DPJTXrbBcqx23UFU0EQDNBvon8Y2krWhA9jz:W+MSjErwBjrlcTB0fBAn8Y2UeK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04108_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.29 KB
MD5	4e9ff40c70c6ace922ab1fea084c1f80
SHA1	e890db0f08853559f4afd8ddd159e4b2a20a7e03
SHA256	21c37996a0fa76637f90a4d1f684268fadcb3ba1b02fc3d7c82b1765a893a4ae
SSDeep	48:1CB4gYT8YNXpQVkMtkxPEU1DLQ1YRlKwqjuUyYyW:iJ6XiVkxPQ1OMw6uw/

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	3.75 KB
MD5	c10561cf4e3f0e3fd3588ec80fda62ec
SHA1	da3f4b1c383843c9edf1817911dbb9c815b69acd
SHA256	5647823758e45fe1724900bc7a15167c97f203eed93598695c7a54551f2acadd
SSDeep	96:7HmexpRGdADI5OV0BiFnO9gVqhA9VfnKAz:7H9xS+IWnmgghA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04117_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	5.92 KB
MD5	0f2f007a02fb84a4708f7eb9c0345d9b
SHA1	5ed66b0a32e782c501ff0f4a674958b1d266056c
SHA256	979784b3f04f5a53764965154e3f42a6e5e4aaeb45b7f4fabf84effe3cbbe61d
SSDeep	96:sZJpIcnoaD1CF1aq43mXyBLS+2yq84zBhr4lb5aY6jM+qxaZ4uDT5GgboBTDCTAw:szicnonF1fXULX2yJ4dhshj6jM+qxaZh

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	4.80 KB
MD5	563697b20f44349e3b4afb7be9f6c248
SHA1	85f468ac6f0afd9c77bac3593f810882d917d61f
SHA256	cdfb5105f69bc017d2bcd48eedcaabce3dff29df3bd6e8a24f619f38005159f6
SSDeep	96:6pCfHpMsBhsqOg9Enc+x1b+RiznD+0l/elJXiRZRmFaqhA9VfnKAz:0RsBSLgqlVzq0l/eTi90hA9jz

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	4.03 KB
MD5	08ae0d2a2a268709f3e70bdbc811e7b7
SHA1	982f825326cbbf36ae34835442eddcf2bd97fb75
SHA256	67a42774b096d17bdff68a3bcb79248613cf63791715c6323b2bc1c38aa3f4af
SSDeep	96:itJCYbWoZW4fpdAh+78okKbcXP3AO+qhA9VfnKAz:itJxbWoZfhdAhS8oknAchA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04191_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	6.48 KB
MD5	2deb4ba29e04f999b73472a3f7986b9b
SHA1	583e51310636cffc29f7367d436c4ba972c2ba8a
SHA256	d8b02558cb9740b341b7de10d104bb685dff12ad5289fb2bba8cb9712f959c3c
SSDeep	192:7jLxPK/OSdZFxs13MkWhaoURKk8cITyGx2E9q8zqslsc2/04McgW5m+m:/LxiOSDFx8ckW0oUQk8cIHYE9Vqslj2+

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	7.94 KB
MD5	885b4733754034b360df0dcc318e4858
SHA1	afb9c878d570a5675abea179564b2e77c4139ec0
SHA256	100940621928adca68f11b77942c954d4f004076b85b71ac61b54a7880946f59
SSDeep	192:ELL5FsPm02Lzh1QCgk7La/Ov5NebWQhflhnByhA9jz:E/fs+02/h1QCPaELebWcflaK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04195_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.50 KB
MD5	bbd99f92bf08d5737d517226806fcc0f
SHA1	515a8cac4221b2d9171ce28378e033bdba61f668
SHA256	28d7304fb03403812cdadba9b8c6303c03014d09913ed20d5eeaa4a0f770b8d7
SSDeep	96:bJYOWqJF9c0pEcZloazkMXviveifrPzLKAKoMBrA34kuKj9EnS+TD0xsen:dvVpfZlVnq9z3KALMBtkuKj9EnS+TD01

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	5.97 KB
MD5	269ef701448db7abab5f36805646ad30
SHA1	1a6715c2846200b940ea96b430234900c4c68355
SHA256	3b34033ac941dbca2b3eeb75f9aee3db009ceaf9af5f93c7761b3ba48f73d1c9
SSDeep	96:T4zIKHQ1B1iIk7LA+ntgc9xTVVf6xJGlF2HVP08A72qhA9VfnKAz:TcIKg1Dk78o5DfaJGlAHpsHhA9jz

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	4.53 KB
MD5	6adfdb15101be9e3a8b47c12b58badc0
SHA1	e4f0641ec279350d09b2c908bad60d7307cdb550
SHA256	e2f2d302e9c4fc028a85250a7bf6d3c91783a2e8f344d08c71791ead84cc20d3
SSDeep	96:Cjkqa7oyYW2pArkdtz4R94bys6KD20ZcxErLP/WC8Tf5qhA9VfnKAz:CAuArgg4yKiOc2/04hA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04206_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	7.49 KB
MD5	b8a045cb3b99d6a8c38f0841c513a06e
SHA1	7661458f34a6d4b0260bd46c6a8519b2d2bebd40
SHA256	6a9a4bb70e7271b38b7045381e5ae7696946b748a8cf9b482536b57ba023ec01
SSDeep	192:DuMel1Qt14TYnnvuCl661ilrXLiHWKUsN9iPFlZfDTzo2vVOgQh9UqeQJc56Ofz7:DuMeXw1kYnnvuS661il7Li24zMFltfdh

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	8.96 KB
MD5	47b9f13a830a6b22bdcc99c51f424419
SHA1	c819f513d29f4c94bad6b41e708153382e26b802
SHA256	498587ebbf4ca30b9d0ff9f87c2a7d34479f45688fa8afa84bfac4bbd7edc6f5
SSDeep	192:I4cTuVtfsah4gYOn7i5/ezrRsXWltIRx+x/oUXHIpgddJ2oG5wWdhA9jz:I4cTuVtjZfa/ePmG0rx8HUBoG5wuK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04235_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	7.62 KB
MD5	210809bfbe0a2b4342d51a2188e9d137
SHA1	ad4885ae402d88806adc2eee341b0ad47fd4f50c
SHA256	620b6a2a5d6e92edd845a1fb4e9560110cfbf7e40eeb9e76c7a78f7025858ec5
SSDeep	192:74ux7g1lzq9rpwB9LxD0KQymhrFM93TE54VpIdmMLKzxgL8/84RQlTi8Ip3:7Hxyzq9rWfLxD0KQyyrFM93TE54VpId6

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	9.08 KB
MD5	c1eba1a0d35f07de6dc4e3c5561bf7f3
SHA1	160af902cfb644e48e2526680908ea361eb1514c
SHA256	d88b801fadbc434549aa2840f0fe41f1c84e0ff33ff818c6517ef1801c123677
SSDeep	192:5tWY4qJNK9A0kTQF1yGka++v3ovIPdeUUYo+GScEhA9jz:cqJNDtTQCGt73NFUXVSfK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04267_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	7.62 KB
MD5	d636308683435714128a1a41001f5fee
SHA1	d4c8b5b80c3137b4a1eac6198c0c71ab571795be
SHA256	60a245b3aaab784bd3c212c8cbd5fca483f1bfa843e8edfa9f330f6b12aa48bd
SSDeep	192:HErtsB1wI0E3ms1c400OFQ39XqQ88mCY5nBFq7vIRZOFAL7Z5X9iJlzpISFoliD:HErt8wI0E3ms230Oy39XqQ88mf5BF4vt

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	9.08 KB
MD5	20babedd6210828e714be5c658fd0d1d
SHA1	65c857385532f7c15e8e60fac8f062e30fe79713
SHA256	2b522cd79d2d8b97a8d08116cfd06c0a8d4fcec36331c5d73e0c976525dfa3bc
SSDeep	192:tOGelJasPvYbYQpzrr/DT6qJInlyf8AyP7hA9jz:txKRXHezrr/6pg8AylK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04269_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.97 KB
MD5	76fdf2ceb0ecc63802f61b807736bbcf
SHA1	ade2149a95dea7ebd584667c53d54c17358f7bb2
SHA256	155c8434b0437a97bfe9de65b4c9388314802eed2751f5a882a3c2406a415acc
SSDeep	48:1eaB4gYT8oKoCEAEHMK5YT2XMN4MDi+anW:QcJjpHT284BW

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	3.89 KB
MD5	4f99a00a89e077254c79c3be0121e3fa
SHA1	70b4160e65b0f0e723ca55d902d4bd2246e9143b
SHA256	c322218808fc92da2c4d5a02e87d90abf4f2c631807abca107bccee70d04e54b
SSDeep	96:ABnasZ5eCR36pB1XLrU1wYvGwYRaLAXcPWD7qhA9VfnKAz:cnv5xEb1rdYsaE8WShA9jz

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	4.74 KB
MD5	373d5419ecf3b147d2308d376cc356d4
SHA1	c8475e9d7e45e2b01a27d808506886f154f850ab
SHA256	3a97a8575d993e9ad424a0a41170a1dc7f26b72d5019db21508d180b6f7b4c46
SSDeep	96:4p0U4fHUli1eG548s1Z7ThVuuWl5NrmtcWmc/+cvK1Fr0qhA9VfnKAz:S0Jdc8s1Z7VVol5NrmtbmcRKFrdhA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04332_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.20 KB
MD5	1f24029d8daff1819a99c36c01edbedc
SHA1	2d99c44d76f320b5aa32af2fa061afd72f37c338
SHA256	5ab2fe1a1d27e75852737af33d073ef57411d84fd9f340cfd655953ad8ffb58f
SSDeep	96:vJGRqy/SRERWnmFwIBHuO+q6bxn0OY278dB/YXmCYeQYshWfLlTJ0gTQ14Tk:hFytRWmHHuO+qQl0OT7OlCmCVQtOLlTi

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04355_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.15 KB
MD5	e3af6ec3a4acaa5096387012c521e242
SHA1	6258e991437d04940ebdda2d8a2a0d5bd1b9feb5
SHA256	92c57602505a815b9812dacb6090cf95cde23320ca627bd089cb889703879355
SSDeep	96:sJ1bQxSlZEZvJtq4ByHyBBYewRdNVJ25+eyg:i1blZW7dgHgBYfJe

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	4.61 KB
MD5	876af5abd09648a3b556982d38ef9e1f
SHA1	eba79c90709981f4782a45f6021fc6ca9ae3beb1
SHA256	979a4ecb80789d9ac91dab0483aea6084d67204e1d3f557d3bdb139dfd7aaeed
SSDeep	96:sfhxtqEAyIVagnkHaqXoqoTuJmL+xeqhA9VfnKAz:gtqErIVnkHo2JSgfhA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04369_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.70 KB
MD5	00a08a02bf393db5ea393ed98a724b94
SHA1	4429c13c3b9166c66195f10fb06d52c11effe574
SHA256	b04bf2ac764992c1c02f672c32a214f3faed2bb5e3b679027c7722180a1b5818
SSDeep	96:AJVLoxQRq3WDtrqsWB4MKAbd2gULwgI8PZmDn:WZoeRTtrKiAxULwH8PZ0n

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	6.16 KB
MD5	0486b1315ea7c8a0f0007d19b4415993
SHA1	18e1d2d8ee85bd3d5acf924be428d33e07384506
SHA256	0c08b42b5ce944364e645dd33b15a27e529100c3ca5444cd0c36a0cb7b3feba9
SSDeep	96:cXc+L06amFq588nMExzoKbcoYxf/ISRTPB4GeZpw5a7wmBWBqhA9VfnKAz:UL06amFqnfont95eZpwsjW0hA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04384_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.88 KB
MD5	e7908036a7686a1f62a1df26c9db125f
SHA1	07efd7472041248f994d1e08f08e98f071510120
SHA256	b778b471c58c9d9182530b871120e62213872bae2c728f13beeb3576e4dfab74
SSDeep	96:wJtus2ysn2bF59lR8Lrwry8UEbIRjMsudJsc20Tu3g7fpB3z7qc:GQ32bF59lRi0ry8nItnudJsc2Ouw7fpN

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	6.35 KB
MD5	d2183e03ed6aa62e4749446e044b5068
SHA1	d78002efcf7bdac5872de5ad7d92a3029805ce5a
SHA256	b6c5f457e07a6a9e7dade7297f9ae70dccc99b6e7fa277c26371623aeada85df
SSDeep	96:5k/ZsKIet72doR8/LvQzzjHCG/8OQLntINg06DvxZg0Ws+K+crqhA9VfnKAz:yehMoUdLprEnwg0avxTWs+K+cWhA9jz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\baby_01.mid

Modified File

Audio

Not Queried

»

Mime Type	audio/midi
File Size	7.21 KB
MD5	800cafc58c686ea77cc690f694d1077f
SHA1	8c282e0203907f20e2382fe1f8d450e610d06438
SHA256	80c4faf77b998423fec4f3e8c6dd7a06f7c2af52464cfc25a323b876ab74bb34
SSDeep	192:RprCIC+CUC+CUC+C8kYJQQQQQex6KLRvs3DMA9WCuWCp:RpOIgUgUg8kYJQQQQQex1R5A9gp

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd00141_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	26.26 KB
MD5	e17493b59f429483d0e4f82a009e3574
SHA1	6a6378fdcb35d8e5d0771c4575161695f01337f6
SHA256	1885dd12afda150c65493807a723585f966ec374bd62887acc59f6e16bafcdc0
SSDeep	768:GiwsdfX0GPPXlHM6OBQImAcm03LvQb3TiRt35MwRPE1HhYigq49/rsiTxmIEyqV+:wifPDVvNHQKQ1BCWBEd

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd00155_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	11.36 KB
MD5	cd42411c780fbee9a182da468cacfd7d
SHA1	ec10c6ee28bf6ac9118dada9b988c325b938580a
SHA256	d93fcfb3ff53bffdcc22351fad95d4d9e7b11074ed1f8d79b83cc74842fb9fd9
SSDeep	192:2xtAOP927mZ8OuHNRDgXjXIGInt6RVIMVM4tu6kYoF7DUuFN58G4xcnScxPsfDlf:2xtDM7mZ8BmrIGE6RVIMVM4tu6kYoF7s

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd00173_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	15.80 KB
MD5	72f40f0f42540debb1cf088e9dedd3c8
SHA1	711dd5ff2a063a94e7222559f1cdf0556cfaf640
SHA256	c3133ad7fe3dac30578040210e9943c4d2d5c18864f44fdbe02488c13558cee1
SSDeep	384:3oVk2+VIKj58FUO8u67wmmHqNc5XTfe8eLZAzy/X7RV4V+RX/Ldh0llj1/9/EY7S:3Uk2+Vt58+O8u67wmwqNc5XTfehLZAWD

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd05119_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	16.83 KB
MD5	361ec42b304d42bb30c82157fc4876ac
SHA1	07b49dc5ac0b6b477a54b48b866a0cf53c791fb7
SHA256	26b57cee23b72c0223a47228382c2e5ab549c144240acd64998a61b9f18cd491
SSDeep	384:xL55ROgj/lrYyB8AqyFlxjM4bOzAAI9fTguitwCX7L:xpLZrHuAqGxHOzPjtwCX7L

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	17.21 KB
MD5	f39a16b51feb4dd5a07cf0b38f5e3fa3
SHA1	ca5df8774add6e04a03d9aa3862fbc6689ca01a3
SHA256	87fcca386bd0ec33872e9c344b48432bcc0a2ae1226850871a0732de4cf8b300
SSDeep	384:TO5SCs70qSG0pK6xbh4bef2TXedxH5lbiiBnr2u7aXaqXK:icCCf0Yiube+bmH3bP1KaqXK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd06200_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	16.29 KB
MD5	fc8f4c8dea257aba885ecfdd76e7253e
SHA1	a63f3c37c2c3667431c87593bdd6fa27b5022bf3
SHA256	9c8693aa92c5470d95bf5114d4740c9898b1d261c92809872b922e6c6ca02bda
SSDeep	384:81vmFtzk0THj4Y3lC5GZ20wLi14cVVeixCUS0oWMD7oKSXWqOWMHgJBoq1Baqifp:8pm3Q0ff1C5GZ20wLi1HVVeixlS0oWML

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	17.75 KB
MD5	ee645e6d097f7dab410314b0e9bd658b
SHA1	6069bae9aa26b42ea1bb829ba8918b4e5ccc062b
SHA256	b7472e4e04c9c87a7a023e335dbfefcfda8ff8894f5fe39ad2fb62a4a0034970
SSDeep	384:7Y/L/d0VVGtBbKO9VIlA1AeZSziGuiS9K2x7jl+pw1bZYMyl58qgK:7YT+VVSBbZ2USO9G2Q6Fyl58K

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd07761_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	26.12 KB
MD5	ffb35e0a38d3a22db194f3b055a6c001
SHA1	1a1f39e3ca78359b3fa9652627626be31a8aeff8
SHA256	dcb08bdfb295454b506f022ab3cb36ec72df9e1caaa66e6bf6145c7b2dfd5b89
SSDeep	768:6WFXaxMFxivMfSi3RGGKrVJ0EgKzaeM9jKqE9Bx8KF7bnbkYQwXtFYqvZTPs/2sZ:hFXMvCiGyAmygtw48Ox4

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	5.44 KB
MD5	797ab6b6f69165eaa281eca75a1729af
SHA1	addc3d982483053073d64ca17957c58d72bf2fd4
SHA256	ac675f1c2a06386ef9771853d5601cadaf3bf0c1fd65857a35779e696902417b
SSDeep	96:E//j0Ni8b7hFvUehVjiBcYe+vHe2yFH5vdQnqiIclT5wP9D0N4WPyAzgyqhA9Vf5:ir0Ni8ZRUqVjycYeKK5vdmj5KQdKhLhK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd08758_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	23.75 KB
MD5	3a8c52d21d97339be5905f00ed087ca3
SHA1	376ec4f01f85be88e22e2b67e2e2c39bd88ac47e
SHA256	29bffee6857972608033208c349cf575f6dddd0544c84bca59247bf98f123751
SSDeep	384:GmB5ln37wvmxuD1ZBwpbg91/sPJ3OdKi7VjDWs+JHByL0SgYJzQmrmH985rbAR6Y:GmBHn3UOxUjaEFsPdOdB7dDB0r8zQMax

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	25.22 KB
MD5	aac33ed4ab5a028880e096186e15ec39
SHA1	f3daf8dd16dd3fd56cae5d7fd951aeabef1a9fc0
SHA256	37e6da05ef88bfe5eccd5e69b22c6341da02137e2233fcb52b5988182b95b121
SSDeep	768:q70LL0xOqfT2oWhjTmdyU518heq3Z3zzxRSWNHK:q70n2fT2oamdjFozxHE

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd08773_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	24.20 KB
MD5	f38cb32b56d41a35535c120e46e81f19
SHA1	ee8ffedf44349856bce3d760f1294ae83bd12ea8
SHA256	960cc07f35ab745818a404f13191389a3f43a210f7adfb117ac256692d723172
SSDeep	384:yyf+LkSDlfTCbv7A8varAuKXNfVcIzF8M2iBJ3UBx359EgBSBUmEnAw07SSs8m:yc+HpqE8veAuStzaMvJEBxp9RSB2n46

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	25.66 KB
MD5	7318bbe538551bb3e62fc783e54e245e
SHA1	102415175c7b93f5a5c03a385fc0678aadbc78a3
SHA256	513731099d963335fe06af8cbf4849b50eb5473eefdafc3c7865e73f81c6220e
SSDeep	384:X9cVydv1+vEb8tBrCK2UCagmQaZMTXcR6szR78tASAz7NbKrdTzYXtw4IqkK:tiSt+cboCaq52PSAgBTzUq4IpK

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	46.87 KB
MD5	6a1751879a10e01a57faf90b0e2deb11
SHA1	dff7279a1448376c21e251dd9edd280ee9efebad
SHA256	c27f78dd557548cd62d4810afef68a64cd4759b84fb0c6eeb30b8f2805b8cb7b
SSDeep	768:Kqo4MS13fndvHfA0vRHxgOeM98GMg0PCXzo1MhD7XuxD0w2a:dbrRz6so1MhD7exD0w2a

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	21.17 KB
MD5	d122823f36ec28b0d249cde2b31cc7eb
SHA1	46823d6c045d601448ef3285446c27682d9ec3b3
SHA256	46caa62c625e30be724c173fd18be076d35e636e43a74fe0ad3ceb4c7ad9cfe6
SSDeep	384:wDAOPDwmQkKu15mDUGvGI6FyFfqQhQ10gwPUv0ZskvRMdY+CK:Skmt5mpvLsoh2Wgt4sMRM5CK

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd19827_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	9.48 KB
MD5	2b47156c17773cc132d9b3bbbce0c4e1
SHA1	079fa051d90d53930fb3c7386b1f7b15774dcd4b
SHA256	f8efdd42666356deaab8d00d7fcf57b01a5efe1ee028f13f01cefec9b6204b2a
SSDeep	192:HOquE9PxA/YD43GYCoSTmBgSyapCY1l5kYzoCQ1JMhkptm56g/:HtnPxNzoSPVMCYRnzQPMuG56g/

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	14.15 KB
MD5	f47beb5612aa13fd016912500151bc5c
SHA1	ed0ff09cac0d747c5a088bf866e019772ce68113
SHA256	60d42ee9427756f2a04e224f9d64e98f68ea3e09f079a0344350df67bd9325bd
SSDeep	384:Jfudn5zFOLwfy6QTW3/ZGLyKNngxLynkc:JCVFOLwq83AbJkc

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	10.80 KB
MD5	0f72d5bfa65af6a93147ca8b9907f3c0
SHA1	ddab3d5edd0267c1691994b5c09c8fe52dcb5991
SHA256	49030d0018254293bac703c01ae2a67500b32aff521d9665e7545629f4264127
SSDeep	192:JeXwBfsnL4eKmltkinujbS0oQ33Oe/k5uWRB6GLpwA3uLsnMeHLDiZuRAFGBg:JIwKnL4evtuXOes8S4qUfUviURAFGe

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	12.23 KB
MD5	f62e23a49bbe0e7c84ea0db5c6b9a517
SHA1	9a19e35393a7e617f89546de39c9086be4a94e8c
SHA256	6b19388f44525428175da26742fbde26501bdade6f8af13dad3d45c83f8cccf7
SSDeep	384:Er1JEYGtq/MZA+JrtVHn+YJm1m5vooeyF:ErDEYnwAWVH+fQolyF

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	881 bytes
MD5	9365ec0d3462e2e46ae3fb414f904a50
SHA1	41b7947e80af0ffaafc6ae6b3e6064ddf21f689d
SHA256	21e262fc9dc46986ab07e80800a56cc2405b684e8158ea04c88fb272ed792b01
SSDeep	24:t/zjlcnrA3HiyAHhN/GAW6Q5250+Sp24f+v/8Aal:1zj20Z0N/GAhQ450+4f+vUAu

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	9.91 KB
MD5	821478b614389667e51e4e8c9f394be0
SHA1	8b909fdb406d92f38c4b409f1a230a62eb5e39a8
SHA256	69dc1f240839c9d6fc9bff3122252afb7cdad3775372f8d8348edfd980d9b0dc
SSDeep	192:JvrxDivoiNY+4SzhTUBVbdqGYx3WIDSYo3OQ9QxOWS7LNbh0Kk9odGCGlyOoVM:JvrZivoiNbBhTUBVZMo3OQ94OWS75bh6

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	1.43 KB
MD5	83f03388a1d3efe70d5b166fe6c2a2a7
SHA1	0eef8c9a26fd16d44f15746956d381104d57298c
SHA256	48ae7a8fbb74a0a1eac4491a347faeb4863c0a5ed4da1cf2a2a3dcbab7fb7ac4
SSDeep	24:t/nA3Hi8KeohCF3sFnRhCty/luqV2eRhClYM9Klr+NhCGQWoq6ukveL6ntdWtcbc:901VoE36ec2urUB+VveLKQtcIUG27eyw

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	3.89 KB
MD5	fc6f5f7580641a3ddb5dd51eed9c3df0
SHA1	b8e6577314e094e30811c7aec1829464bfeba5b9
SHA256	eb72554fe779bbca564f45408e2f5f55891ee5b7c522f0c1ed2a0495167a44af
SSDeep	96:ILWn4j+IEQuPr8eM/K2T5jVVSMbzhALJ6oA0lkb0:ILC6Arw/K2Vrp/Xoj64

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00195_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00195_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	7.88 KB
MD5	a1e0da2296f63a64e33a63adeb27bbba
SHA1	b9eb1f026ea10a6b9bbbcdd10fcb727afa9e2a35
SHA256	dc5847e7a718c4156aa369e81e575f390ac83fee13c48ad20926eb0a71bbc04c
SSDeep	192:ds/dAUljFaAa41ikUeJwet5MQAkWwpAjw6W5sb21Vqwj:ds/OUyAaMHUcwRQA4p4/Wl1Q+

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	9.09 KB
MD5	01c54bad539bec7d5f5d7931a207fb2a
SHA1	fbbc6193bb4ef408203fbd5047d4f233d4dcef4a
SHA256	67dd91154defa536b8f9f911717f25659bd0f58d760c6604082e9b513e6e3627
SSDeep	192:b/5GtyQvXOQ8/YZkqAsYkENiiDknyXhtYB44wNZDlsK1VbsgGoALmNL1EPS1M42r:b/5Gt5vXOQ8/YZkJsY5Ni8knyXhtYB4o

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bl00247_.wmf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	14.11 KB
MD5	73cf1e415913541ea1484f619d21f90e
SHA1	024a9de6cab55f3e72d7e01a15439df83013af72
SHA256	27a82c228abd25a4a23b29541dd654762c3a730e9052e0802a24f1699e187a0c
SSDeep	384:mhCTyCuuRMm9dLQBpK/XmjB39FqMV3qEb3R9WJfrox582uKm42S+ab12eCgUjYu1:mhCTyCuuRMm9dLQBpK/X4B39FqMV3qE8

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	4.60 KB
MD5	d532df7640dd7181640215eba285627c
SHA1	fa36d3604e8a1d9278be52f9b0368c0d62976ecc
SHA256	83b1578c11a75a713b90b174d2fffe73ec418758ecfa4158a3e76968880ba7ed
SSDeep	96:cezmWx9OOhxF6gIngLo/vdMC3fxBtqzQuKyV2DW4MqRLJKLM9YdbMloL3m2sggfh:xyWx9OOu9ngLo/vdJ3fNqNK+WbMq5JKc

C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00262_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6

Modified File

Stream

Not Queried

»

Also Known As	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00262_.WMF.-F9CA61CE-4A99-1351-7294-4D5474716CD6 (Dropped File)
Mime Type	application/octet-stream
File Size	2.50 KB
MD5	383ad56c8dbab5809905ad1720abeffa
SHA1	31cdbf690a8a1312aeaaa7b34a4e93d3a5a67d62
SHA256	980c108663f43af9f9ff63c40daf60712a48812c888b26d37b416403e116f579
SSDeep	48:ngK4/Ntzm/BKCuWQLpjLpSLpYbLpXLpVsLk6pml7LkDLkb3iO6ELkOLk+LkJLkga:ng1jm/BYJ6O1H6pmlskTOfvuVxUj3b2r

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\!!! YOUR FILES ARE ENCRYPTED !!!.TXT

Dropped File

Text

Not Queried

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\EfHAwob- yAmz0Zs\!!! YOUR FILES ARE ENCRYPTED !!!.TXT (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NrsahiM\!!! YOUR FILES ARE ENCRYPTED !!!.TXT (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NrsahiM\AarFF35ax\!!! YOUR FILES ARE ENCRYPTED !!!.TXT (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\!!! YOUR FILES ARE ENCRYPTED !!!.TXT (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\thkFy2X22bxPo\0twkzH6YEHET IEuLj40\!!! YOUR FILES ARE ENCRYPTED !!!.TXT (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\!!! your files are encrypted !!!.txt (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\resources\1033\!!! your files are encrypted !!!.txt (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\!!! your files are encrypted !!!.txt (Dropped File)
Mime Type	text/plain
File Size	959 bytes
MD5	e68a8d10f3b62cf7cce3e6351efc0674
SHA1	0d96d59af8dac699a22294e7e49be9cbae95f986
SHA256	9f42283e0c1c40a46b6e2b0a639105e4f0b67c18ac3aa38e97e1db44c6ba23a3
SSDeep	24:mu8yNUZVJMWFeiQLXeAOAY1vcxAOAz0lqVJP0av:mCNUzJQVbfvuUGvpPVv

Remarks (1/1)

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After