9b86a50b...0ad2

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xhcdxx.exe

Sample File

Binary

Blacklisted

»

Mime Type	application/x-dosexec
File Size	174.50 KB
MD5	86c314bc2dc37ba84f7364acd5108c2b
SHA1	ad20c6fac565f901c82a21b70f9739037eb54818
SHA256	9b86a50b36aea5cc4cb60573a3660cf799a9ec1f69a3d4572d3dc277361a0ad2
SSDeep	3072:DOx8sc7Lzr/W2X3hMrP3WeGzZWkIVLjzCQ9tou:y61Tr/W2HarP299QY
ImpHash	3d84250cdbe08a9921b4fb008881914b

File Reputation Information

»

Severity	Blacklisted
First Seen	2018-08-14 21:41 (UTC+2)
Last Seen	2018-11-08 19:34 (UTC+1)
Names	Win64.Trojan.Filecoder
Families	Filecoder
Classification	Trojan

PE Information

»

Image Base	0x140000000
Entry Point	0x1400086a4
Size Of Code	0x16400
Size Of Initialized Data	0x1a600
File Type	executable
Subsystem	windows_gui
Machine Type	amd64
Compile Timestamp	2018-08-12 00:46:34+00:00

Sections (7)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x140001000	0x16270	0x16400	0x400	cnt_code, mem_execute, mem_read	6.43
.rdata	0x140018000	0xc620	0xc800	0x16800	cnt_initialized_data, mem_read	5.55
.data	0x140025000	0xbe18	0x6c00	0x23000	cnt_initialized_data, mem_read, mem_write	3.85
.pdata	0x140031000	0x11f4	0x1200	0x29c00	cnt_initialized_data, mem_read	5.21
.gfids	0x140033000	0xa8	0x200	0x2ae00	cnt_initialized_data, mem_read	1.43
.rsrc	0x140034000	0x1e0	0x200	0x2b000	cnt_initialized_data, mem_read	4.72
.reloc	0x140035000	0x610	0x800	0x2b200	cnt_initialized_data, mem_discardable, mem_read	4.75

Imports (3)

»

KERNEL32.dll (84)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
OpenProcess	0x0	0x140018048	0x23c48	0x22448	0x382
CreateToolhelp32Snapshot	0x0	0x140018050	0x23c50	0x22450	0xbd
Sleep	0x0	0x140018058	0x23c58	0x22458	0x4c0
GetLastError	0x0	0x140018060	0x23c60	0x22460	0x208
Process32NextW	0x0	0x140018068	0x23c68	0x22468	0x39a
GetCurrentThread	0x0	0x140018070	0x23c70	0x22470	0x1ca
LoadLibraryA	0x0	0x140018078	0x23c78	0x22478	0x33e
GlobalAlloc	0x0	0x140018080	0x23c80	0x22480	0x2bb
DeleteFileW	0x0	0x140018088	0x23c88	0x22488	0xd7
Process32FirstW	0x0	0x140018090	0x23c90	0x22490	0x398
GetModuleHandleA	0x0	0x140018098	0x23c98	0x22498	0x21b
CloseHandle	0x0	0x1400180a0	0x23ca0	0x224a0	0x52
HeapAlloc	0x0	0x1400180a8	0x23ca8	0x224a8	0x2d3
GetWindowsDirectoryW	0x0	0x1400180b0	0x23cb0	0x224b0	0x2b7
GetProcAddress	0x0	0x1400180b8	0x23cb8	0x224b8	0x24c
VirtualAllocEx	0x0	0x1400180c0	0x23cc0	0x224c0	0x4f9
LocalFree	0x0	0x1400180c8	0x23cc8	0x224c8	0x34a
GetProcessHeap	0x0	0x1400180d0	0x23cd0	0x224d0	0x251
FreeLibrary	0x0	0x1400180d8	0x23cd8	0x224d8	0x168
CreateRemoteThread	0x0	0x1400180e0	0x23ce0	0x224e0	0xa9
VirtualFreeEx	0x0	0x1400180e8	0x23ce8	0x224e8	0x4fc
GetVersionExW	0x0	0x1400180f0	0x23cf0	0x224f0	0x2ac
CreateFileW	0x0	0x1400180f8	0x23cf8	0x224f8	0x8f
GetModuleFileNameW	0x0	0x140018100	0x23d00	0x22500	0x21a
GetCurrentProcess	0x0	0x140018108	0x23d08	0x22508	0x1c6
GetCommandLineW	0x0	0x140018110	0x23d10	0x22510	0x18d
SetLastError	0x0	0x140018118	0x23d18	0x22518	0x480
HeapFree	0x0	0x140018120	0x23d20	0x22520	0x2d7
GlobalFree	0x0	0x140018128	0x23d28	0x22528	0x2c2
WriteConsoleW	0x0	0x140018130	0x23d30	0x22530	0x533
SetFilePointerEx	0x0	0x140018138	0x23d38	0x22538	0x475
HeapReAlloc	0x0	0x140018140	0x23d40	0x22540	0x2da
HeapSize	0x0	0x140018148	0x23d48	0x22548	0x2dc
RtlCaptureContext	0x0	0x140018150	0x23d50	0x22550	0x418
RtlLookupFunctionEntry	0x0	0x140018158	0x23d58	0x22558	0x41f
RtlVirtualUnwind	0x0	0x140018160	0x23d60	0x22560	0x426
UnhandledExceptionFilter	0x0	0x140018168	0x23d68	0x22568	0x4e2
SetUnhandledExceptionFilter	0x0	0x140018170	0x23d70	0x22570	0x4b3
TerminateProcess	0x0	0x140018178	0x23d78	0x22578	0x4ce
IsProcessorFeaturePresent	0x0	0x140018180	0x23d80	0x22580	0x306
QueryPerformanceCounter	0x0	0x140018188	0x23d88	0x22588	0x3a9
GetCurrentProcessId	0x0	0x140018190	0x23d90	0x22590	0x1c7
GetCurrentThreadId	0x0	0x140018198	0x23d98	0x22598	0x1cb
GetSystemTimeAsFileTime	0x0	0x1400181a0	0x23da0	0x225a0	0x280
InitializeSListHead	0x0	0x1400181a8	0x23da8	0x225a8	0x2ef
IsDebuggerPresent	0x0	0x1400181b0	0x23db0	0x225b0	0x302
GetStartupInfoW	0x0	0x1400181b8	0x23db8	0x225b8	0x26a
GetModuleHandleW	0x0	0x1400181c0	0x23dc0	0x225c0	0x21e
RtlUnwindEx	0x0	0x1400181c8	0x23dc8	0x225c8	0x425
RaiseException	0x0	0x1400181d0	0x23dd0	0x225d0	0x3b4
InitializeCriticalSectionAndSpinCount	0x0	0x1400181d8	0x23dd8	0x225d8	0x2eb
TlsAlloc	0x0	0x1400181e0	0x23de0	0x225e0	0x4d3
TlsGetValue	0x0	0x1400181e8	0x23de8	0x225e8	0x4d5
TlsSetValue	0x0	0x1400181f0	0x23df0	0x225f0	0x4d6
TlsFree	0x0	0x1400181f8	0x23df8	0x225f8	0x4d4
LoadLibraryExW	0x0	0x140018200	0x23e00	0x22600	0x340
EnterCriticalSection	0x0	0x140018208	0x23e08	0x22608	0xf2
LeaveCriticalSection	0x0	0x140018210	0x23e10	0x22610	0x33b
DeleteCriticalSection	0x0	0x140018218	0x23e18	0x22618	0xd2
ExitProcess	0x0	0x140018220	0x23e20	0x22620	0x11f
GetModuleHandleExW	0x0	0x140018228	0x23e28	0x22628	0x21d
GetStdHandle	0x0	0x140018230	0x23e30	0x22630	0x26b
WriteFile	0x0	0x140018238	0x23e38	0x22638	0x534
GetModuleFileNameA	0x0	0x140018240	0x23e40	0x22640	0x219
MultiByteToWideChar	0x0	0x140018248	0x23e48	0x22648	0x369
WideCharToMultiByte	0x0	0x140018250	0x23e50	0x22650	0x520
GetACP	0x0	0x140018258	0x23e58	0x22658	0x16e
LCMapStringW	0x0	0x140018260	0x23e60	0x22660	0x32f
GetFileType	0x0	0x140018268	0x23e68	0x22668	0x1fa
FindClose	0x0	0x140018270	0x23e70	0x22670	0x134
FindFirstFileExA	0x0	0x140018278	0x23e78	0x22678	0x139
FindNextFileA	0x0	0x140018280	0x23e80	0x22680	0x149
IsValidCodePage	0x0	0x140018288	0x23e88	0x22688	0x30c
GetOEMCP	0x0	0x140018290	0x23e90	0x22690	0x23e
GetCPInfo	0x0	0x140018298	0x23e98	0x22698	0x178
GetCommandLineA	0x0	0x1400182a0	0x23ea0	0x226a0	0x18c
GetEnvironmentStringsW	0x0	0x1400182a8	0x23ea8	0x226a8	0x1e1
FreeEnvironmentStringsW	0x0	0x1400182b0	0x23eb0	0x226b0	0x167
SetStdHandle	0x0	0x1400182b8	0x23eb8	0x226b8	0x494
GetStringTypeW	0x0	0x1400182c0	0x23ec0	0x226c0	0x270
FlushFileBuffers	0x0	0x1400182c8	0x23ec8	0x226c8	0x15d
GetConsoleCP	0x0	0x1400182d0	0x23ed0	0x226d0	0x1a0
GetConsoleMode	0x0	0x1400182d8	0x23ed8	0x226d8	0x1b2
WriteProcessMemory	0x0	0x1400182e0	0x23ee0	0x226e0	0x53d

ADVAPI32.dll (8)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SystemFunction036	0x0	0x140018000	0x23c00	0x22400	0x2f1
LookupPrivilegeValueW	0x0	0x140018008	0x23c08	0x22408	0x197
AdjustTokenPrivileges	0x0	0x140018010	0x23c10	0x22410	0x1f
ImpersonateSelf	0x0	0x140018018	0x23c18	0x22418	0x175
OpenProcessToken	0x0	0x140018020	0x23c20	0x22420	0x1f7
OpenThreadToken	0x0	0x140018028	0x23c28	0x22428	0x1fc
LookupAccountSidW	0x0	0x140018030	0x23c30	0x22430	0x191
GetTokenInformation	0x0	0x140018038	0x23c38	0x22438	0x15a

SHELL32.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CommandLineToArgvW	0x0	0x1400182f0	0x23ef0	0x226f0	0x6
ShellExecuteW	0x0	0x1400182f8	0x23ef8	0x226f8	0x122
ShellExecuteA	0x0	0x140018300	0x23f00	0x22700	0x11e

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\09_Music_played_the_most.wpl

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.28 KB
MD5	7f27bf2225642a9936aca940126177d3
SHA1	b544a88ef320f3e561fbb779bfc33e298e9bc48d
SHA256	604a81c49a0ade7abe5c9fe661246e5f128831a6cea7cbaa792a09ec6d2e0fc5
SSDeep	24:0yeEFJ//HDwEQ9z8HeLo4CH11nk/gKc4qzxVdq+hFWBfV:0lqJzzQq+Lo4CH1tkoK/qFV9FWz

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\CREDHIST

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	0.44 KB
MD5	12a8e3668c8adf2ef092bde5437344c9
SHA1	17e928bf0e8adc04f1e5951d644ebb72074ff76d
SHA256	b72934c2766d5b6463666298778f3f605670fc4c8a66f228c23ef26313956dd5
SSDeep	12:tV78bv3M0rx+AoAp8MHa7lrygO9x+lXzPjpGN0I7:P78bvM0rx++8M69ydcPjpGuA

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.91 KB
MD5	cf0dc4913731f8ebe0884eae12392320
SHA1	77309319b3acace0e404092902596bd88183254f
SHA256	a073c9d1da9a123cc0b9ffcf612edac0571a4fd4a3b86109aaea0b6c825516f0
SSDeep	48:c4+64/qHjt/yycXdgsC7GtGKWGdEDQRoU4+fYMhIE2q:ld4/uIyadgTKFWfsRLH0ER

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\aYwgxqz6BAssQOg4q.gif

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	42.22 KB
MD5	239e07b5679e67bb719e3d3614a7c537
SHA1	8065c9d979f63438d9229c1a7c5b8b117b6ecf05
SHA256	6af56eb83471c02318735b331cf3a76fee298b35a600fbe4f701b242e3ea6048
SSDeep	768:jeE9emQC3SKqkIJD6BIwz2CZYCIrXcGnNPdZS/scUQ/JqaNh8kuCh10fq7XFEX:z9emh3SKqkI8Hk7lNF4U3Q/JnhafqpE

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\jss_J-w0YpDsHpPrs.pps

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	59.63 KB
MD5	782f9f53791f23bd0b3a259d99065116
SHA1	a1fd7bea6519ce807e1b9f27f7810cf82a5fa3a7
SHA256	b85f4bdfcac7a56f04ceed5adf79a9b0e6554de3dbc210f9fe66f91f449f9b2c
SSDeep	1536:uyhwLbkyBAyEW28vV2xEtS7ED1u50R8Wd5eheIJM/Gm:uyhwfkyBCW2G0aG6u5Aah9Dm

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	0.99 KB
MD5	05e5309a924dc81d4495ce93992390a3
SHA1	74da1df66e6c5899187086d6f74ac0ab15d5ec37
SHA256	e607ca36afc2333a8688edc120bd89caf54c733f7d78f1be0ad7fd4c79d52547
SSDeep	24:uaPnIimEER8H3giCoaWTgjoa/YtYCrto/TvFOH8gYYoao3HvxfaMfTeqA:RnIi4R8H3xQegjR/YX8F+8nYCXJhC

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\7332KiZ.jpg

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	42.13 KB
MD5	4ecb5e1a999a6e9a78e73958bb512da6
SHA1	24565d93ea4150c87ea533649e012eee9ed9282c
SHA256	b322198dbbff8aeaee5e2c2a38ca9fe6c6a87694f6f9aeb60c252c8a52a616d3
SSDeep	768:YavWVam9BPMQBmgxxTS81mkph9BQ5rvqtShCkbuz30aAzJ4YnK9sDaMMIr7WyP2I:AVam9hMUmgxH1mEOIShCh3uuYnDMIqI

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\SharedDataEvents

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	5.28 KB
MD5	057a2630c9c6c8b54ddc8cdf51b6c889
SHA1	78ee51b2b39bb5b2260bd5f2752e053001e210bc
SHA256	970ccc49455d8f0a7dbe566ef06fa4d3f9e4b94fbc219dc949a48bba78261fef
SSDeep	96:q/pHs+/i+K7qZC2eUUjFApfLO04VqpRZ/3zo+t4sso/HyuTjx5:qBs+q4Cb6z2ydo0DX

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.00 KB
MD5	fdfe7631059f4e760614a3bd224b324d
SHA1	132f5bfd53dd04c766ca2b7c8ce10ce4d5e9b0f4
SHA256	d3c7e17a4ac63b7e584975e5567b92c1f24af6cfcc835b904c0a18cf96d71c65
SSDeep	48:e6leryfTyrbVFStU0dbjzZcGbd8b4/4meCiQ0ayhF:eeeryfWPVgzeId8c/4meCiQ0D

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\10_All_Music.wpl

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.31 KB
MD5	c7a115c492faf5465059838be784ed8f
SHA1	875a8fbad88236feb2af520920ef0aedce2b397f
SHA256	1479f2eb8536fc267ab2f4a09a0e5427c1376b6b629f78c021cf7f86a710fe33
SSDeep	24:X2/7k8eAQVk+xutwiMaWGpMdrxCCjSt2mQozaTJhmyKO3Qfcil/u:I7LJQV3xuCiMdoMza27waGyBgfcgu

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	9ec4ce3f02d5844566c9d7adcf067b6f
SHA1	b4fd63e1822bcc6f3a98f09b5c517e76fb05904d
SHA256	c99b1f9df625572ee45a4e7d50ecb0fedb3cbb9646ad344a8370bc7d6dfc2fb9
SSDeep	12:oAdB7zTomjAEHNhBlXlnCOQhuXwHGJ6mn4SZxkh38QFS2CzkBhqXn:bdB7zrjBpZpCOQoXwHm4Ci88SkTq3

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\0e15476d-d8fe-46ca-8099-ebdcf80f637c

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	fa88712fba1431205fb95f6559e5469b
SHA1	8981a5c5908c3170c7c9c7e88a1c87a9940556b5
SHA256	ed81a65994e7f585a56c207649a44974043cd061a32a8f6095540813954073dd
SSDeep	12:WNPuQiodsqo1elKDqoFEFhhmUu4iadzvMg6nNeTkDTvyideGGemwKnuSSCi6C2Iq:WNWQioGq26tmUzz4NykHvyiWeNKnuRC5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	0.69 KB
MD5	fae30a75a6a6ff4aadd23212b2eba32f
SHA1	1d2c1c781ca22b75d629fef249d56262dda6a158
SHA256	3cda79e9eadb8ebbd8211cd15997f0a7535d236c11b295266625f74dbdf11367
SSDeep	12:4WySUWzV/7apxO/QHSIPf+ybe6N6SMwaeqxV566u5mY2SNiE4vxttDlTRdYmbx/0:4Wy+xGTOIPfq6MwarX56XojS+pTTd/Af

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	ca420b8df45095683d13c782f4b5dc24
SHA1	3ebaff20a05a038cf5d466f2101682893e25a336
SHA256	6beddf231ff478f7615e16ac53feab2994c706e44babe2bd3c76027a8b2ad78a
SSDeep	12:t/R3NlcUfl+CyTkcML7pRYLSjGtBp4DnnJPIknR3EvkewPC34O:ZREUfY9TTMHCSEBp4Dnmyh2Z

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	0.33 KB
MD5	2cb0aa735bacfb5eeec4225ca6e8d4b2
SHA1	29819d019cf58018a3f21e1a9474f541121e4ead
SHA256	9090b5238a6538b5efc78d0a5e66f207254393cc82f27b7b6dff42b361ccdd7f
SSDeep	6:zfpep1I4h5Mj72fJ/IZzhalxmTmACFM58BFOQ8w/b1glhgdORaWkNLj4miZs:zxep1X5MjSVIZYlITmACW58BFDzClhg9

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	3.13 KB
MD5	6cec177425fe2ff6703fcd35e372190d
SHA1	53cd35503766097f9b1f31db1db551fab7f80d40
SHA256	bd86e2d2a59bc35c498a68d0448b23de123eaf6410cfd37e0163febaecacb641
SSDeep	96:0JH6EwA34eKC/yAQO691xO5EK2SHC8b3kPj2rl:WHfdyA01xO5EsC8b37

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f

Created File

Stream

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\08e575673cce10c72090304839888e02_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f (Created File)
Mime Type	application/octet-stream
File Size	0.05 KB
MD5	93a5aadeec082ffc1bca5aa27af70f52
SHA1	47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256	a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SSDeep	3:/lE7L6N:+L6N

C:\users\Public\UNIQUE_ID_DO_NOT_REMOVE

Created File

Stream

Unknown

»

Also Known As	C:\users\Public\UNIQUE_ID_DO_NOT_REMOVE (Created File)
Mime Type	application/octet-stream
File Size	1.41 KB
MD5	9f6de4ccbe4f4d15e66545fde095b799
SHA1	3c1829dcfe45c6f46ea70c90cdd8dfb79e1b7ff2
SHA256	bbe66531a9c4dc9576e2645ff26cdf551e67562b942c8761e2d7787ee6de942a
SSDeep	24:QKvn1H/tMgLvcqAXbrAh+mJckKtAF3SqJfCSRIE0C0wyFwFpjm2pOKp+lZstKCWl:hv1fta0gmJPBIE1vyFwrjmh8Zi

C:\users\Public\PUBLIC

Created File

Stream

Unknown

»

Also Known As	C:\users\Public\PUBLIC (Created File)
Mime Type	application/octet-stream
File Size	0.27 KB
MD5	186e664ce93f20fef1e4b509afaf24af
SHA1	5c8250300a05253454aba5472e83584c78fe0090
SHA256	3e4829387c720258cda0cb27703e11efbb595f60da59d007261d99fe683f5702
SSDeep	6:mtNmVWpJtTTGSVJTVM7ef4ShKksxuU+nhRWRsZ05LQlH0hejj:YmVcJBrJGyQSgksxIHWR0ULIYKj

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	52.99 KB
MD5	cd6735013985aa25edd6d096fa8b6fd1
SHA1	96251f8c9153fecc5f31ae0a3a235e47de999868
SHA256	7c77f3c037f0223006b8654902e1dc61857c29b11f2357f77ac1e9fbe305df94
SSDeep	1536:3sGoQtv6zA7fmNxTJ8c8ZTcdTS8UJOHGfOljMT+z:8GttAqmNxlCF6uPcHGmZ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	9c082b7b2fa90fd4c47cebcfabbb2c00
SHA1	67a97ff1cf5f4e63a38ee69a1d22bbade78982dd
SHA256	6faa31b00e98bbf8346ee2628cc60168322439ec493b463ab5f4945ae5de172e
SSDeep	12:m97Bu/YkVTK2iNdrBCYPlzNemYb13XbWThYwNk6WyU1vjXEDaPy/fPxIGY:q7Bu/YkBUr46NemYb1HqYwNwyU1vnKpm

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.97 KB
MD5	64556da5481f1f26195723eb43c9db81
SHA1	b9589e80beb27520f3d32bb228c235c08685db1f
SHA256	e84b393e888f79c1e0f25deddaeaf0ba6040c5af9b3d86e85b522d548fb87d86
SSDeep	24:qGAi1M44oA25VK9thdUZv/ZUAza5TBZvntlqs7MVJK07kx/b:qYes5KrKWb7vntlS17Q/b

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\lblfFpjevZDdPPe.avi

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	21.77 KB
MD5	60352f53ae775143b118d1652c61417e
SHA1	63fcc1602742e8a038f5d0d16fe88d3d0e99300a
SHA256	e1472828e22643421a48a027147572bc7bc6835c308740f350fe6ec136d53a3b
SSDeep	384:fN+DKj++1SIK51ZBctyyaWS7QjrOJXBRk5RkQ08J1vMzv+tDNk9sbmmhEhrWlmGW:fwIjkZB94S7W2XS08J1++tDNk9469omd

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	afeae6a2fa3eaab43335b00ba005577d
SHA1	86803aea0f147e2aad0cb7ac5532b8ec4f54be38
SHA256	0f8ce6295bced1da782acad7c690b2b1a5aaddc1b17a53a633c62af88ef252e3
SSDeep	12:jDNioVC04BkT0LVW7/fwUKxKD5jM8ByvnxoGH09hGO1zJsNhhAu5oD5NeZYjbFxD:jDNno0ukTtKxejM2o6GAIbNh2u5oV0ZC

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.00 KB
MD5	2c8ea9fcdf0d9850de5a080172310154
SHA1	5ba013b5a8b99d7db396982891e01380ec0006a9
SHA256	3f28f5d34f16c03c59908d80b2b6e9f7200ea4b9c854565178f5295e4c5ad938
SSDeep	48:S2zSfe2+BXzzY/IV0fThy5z0w37382rguxjh77:S2SfeTBDE/IVPoSM2rBH

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	92ca60a347b11669c21807413270727f
SHA1	093136c7488ec473a22cacd3bc4abdfcf858e95b
SHA256	cab9defbc46444b4887c15c4dcc43eb1256639b1320bc165e4385517b8b35d1f
SSDeep	12:gw9pR6EBK4c91ZVxsQsW8urSYEae4zshYEOLn4GkYW0vhbfbixAwrMHzeji9N:xpR7K4c91ZVxzZ8nYE4zsqn4Gk0JbWaj

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\index.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	32.28 KB
MD5	59de546469f3fd5d5687f8ecc7e91173
SHA1	48616d358862b872231b06d583c26f21ac90d78f
SHA256	565d83aa01ab16a727b6947f42d90dfd83aa2c1610125dd55bd44fa73a3e4b3f
SSDeep	768:eivkfo+Bj0YAulzcQeAwNMMWvUIaI1UZorkfOKne:eicfoWdyAHvUelQZne

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\05_Pictures_taken_in_the_last_month.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.05 KB
MD5	fb4d7f7c2b268fd00e28edbbb98aa955
SHA1	799459c4e72bb041c16e23e6eaceb34b1e919ae8
SHA256	344f6e711af9a7623faac1318d893975ea2f158df40f45e0312d34030ed5f076
SSDeep	24:YwW/tExklXGykRiKvY6GUqOix7YuKzgv8FwCILq3jEmZseWapou74:u9/kRij5xMuKkDhLAieWKoZ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\IconCache.db

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.15 MB
MD5	61e275b31afdbf609f2895fcec2348fc
SHA1	147dd6e8a297d7d39de67b2164a99f9631bb9657
SHA256	ae71bf7435e54069033eb4d2394bc2aa6c2471e084a1837de33b6e8ab9f1c9ba
SSDeep	24576:rZ50OwgQivJFHl6BIuRa8yEbi/eAwVNV8/RDeaHYB1KIdNiy:vugQGJKBt68VNV8/RZHnINL

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	64.94 KB
MD5	1b29b937cac9f74eab9b957dd186ca22
SHA1	4dcbc339777f87f9a6187c7053749375caeb9eb4
SHA256	a345cad2de04f3e36092ec85ff6f280f6b9efc8a0252301a20c599918972d1c8
SSDeep	1536:Gz7AqpK8ZpmvbmVAlNunHI68kXzUFKa3EIFN9PauOfuxUBpfxVXiIzPYlLcB:w7AqpsCVbx8+QYy9PauYpfXXhgloB

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\ZnnPZcdpTi1bKopC39.jpg

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	99.89 KB
MD5	116811e50c2f28068768fb661333151d
SHA1	e0dd603860a5a918847402e4d610c18f2146f76a
SHA256	2548e22307e1cd30afa98261a381d0ac8417fd0cb65e5792b8349b4e36b32f4a
SSDeep	1536:EBKRnuNYIXnAxTwl7Fn++bd1vBe+D4R5mfazBLPM3E2UiTPaiXT2LwYPZGYey7:MKRnOtpFnpbd1vBe+Uw+Zf21TP/IZGBU

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.manifest

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.63 KB
MD5	59f5beed342484321ea5dda5a71fad0b
SHA1	059d29329c45157e88018f800fd12134462a3ba7
SHA256	1576874f0af1b0f24f5291c970447a1f406c95a3e1f85a18a4a6a80920c06f31
SSDeep	48:E1tdpuElcocWPsWpC09IIUN45naA4B9P+aP0zH0CI35:IT70IRHUN45naAYYhPy5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\index.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	32.28 KB
MD5	451f6f1f3b13d1bec82b115c4e877624
SHA1	c6c3d82a5745dc2894eb0ee73b93b20b3da0221c
SHA256	8adf4b20134405c5b42a22c5fa2decdd8970dcdf30109e47014cdfe7e44d3328
SSDeep	768:+Rm7zaw6TjWl5/7oIEhdq7gGAJmxejUbOwlPFOCia:+Rm7d6/EGI+mxeIbO87ia

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\3sfUL.mp4

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	34.67 KB
MD5	578157568aa8c6a1312d8e8dcaad605a
SHA1	16aa31a0a3ff2eb79132f4c31aaece2f0ae3dd89
SHA256	7bf4fcb3e0a9557fa3432088a8d93bebb27acfac8339b8db951dc5e773f9225c
SSDeep	768:Roi6WirvTaU+SSLTl9vLieZXM/Ys3dzhmy1aRmWlILOj2:ivafL/8wstIeWlILOj2

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	32.28 KB
MD5	469da4d15e152036ea2125fd685a0ee6
SHA1	37a118a12bcd6236b1e5a9135ed9b41b68f690ea
SHA256	0bad977e9858eb8efe9740aebe3dcc4b3ddb972c72f6f4ae0b35e4f2a765d43f
SSDeep	768:QQvRe3bgwiCChHlYo9gjKgY9T0ofrc0ycLSkUZ21OGo:nEnFC0O19TXfrwcLSr2C

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\SYNCHIST

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.35 KB
MD5	6dd123cfc926722d6832437ebbf2bf8a
SHA1	ee3be33299a1d6086ca5e1db964dd1373a159df4
SHA256	df574d2b195f32322f01cf178f0b253afe38244ac342700da8d056db48c875f8
SSDeep	6:gNBq+i3bq2nMgJjHNAGkp4nnNauteuMc2HBKMXF0J2z9l77Ck3n:8qUpkjMp4nn8uM1B5V0Az9l7Gk3

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.75 KB
MD5	671d062323b94adfbaab17dfb1aff5b4
SHA1	fd957cd99c23c9de65e6923432bfe5e9f798ea5d
SHA256	6730b4db758ab9e6a6efc9951f930a20bdf5a76edd0c18e02cb64a5c42926bc2
SSDeep	24:fhm38KSu5pXfZEzQlQ3hz7bpTc1Bm5z1t:fhSSu/2d79TiBm91t

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	14.46 KB
MD5	909d9a56ecac0e4e3a0683bf65a22fae
SHA1	225ae12ae7aef25719dd1d8ae0dca2069446e144
SHA256	32dd729dac0a123a719c425deea9c0a57f6bd8b403c4f441b3961e1a3da28df7
SSDeep	384:5LMr+vJX+N6IK4LE8ZpUl3o76U2uIg2yKA2BXo6940:54ioNlLvZpP6l

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.78 KB
MD5	d495b8ee131a9e6f76845984617231f5
SHA1	cc0b0d08b51472a918a165b4758d3d83798b14ab
SHA256	f0125a8166af6dc443bddbb9a24823f3e5f762c85125f9bc82e5ebc3ded7d993
SSDeep	96:2wBS++NhfHcIVwQYpPbE12rgZaojRvgn88xDlrQ6P3sCfEomhLBiYGckDv:/r8fMQY+jZaojRvgn83JizDv

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\08_Video_rated_at_4_or_5_stars.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.27 KB
MD5	46df8d7485c35a25be360e0346c7521c
SHA1	98555e5ac033769f3bf28f8d98c7a9441a103439
SHA256	42879d5e25e4be38422db693ee690790c10f5b2b970958fd337163880c97a4fe
SSDeep	24:fojuoaM2oqvaFn4265akEInR35C44PDzhrlaMQxp7WGud3F9Yiwr:fA8Ra142oakZRJC48BxaRxp7Ki

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Office\Recent\index.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.33 KB
MD5	a3a2aad6f2c499ee3ba967e16d2c9c00
SHA1	7556bac4a48aed6c7780621fbbb6f594e3cc40b0
SHA256	4681eb41245be2e689aa41f5b147356376699e517bc704599455814be872f996
SSDeep	6:X/YQjmmLJNoX1Q2ltWZg0a2ZqYiUq4+Sec0qo2YM8C3isovWTaDZhxFXwDTj11:v1CggXatZlzJqJ9qo07zTYhEj11

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.85 KB
MD5	42bc4c546057a643ae8857ee81c93169
SHA1	c20ce3405abcbb91a3454740f08f1b6a3962e478
SHA256	8616941f30815be7460f2f89548182238ccbd549bf2a37166c26fa1fbebe2198
SSDeep	48:aUliVlzXlHENUo/hy2MypggtUQ+s805J44BlHcX7P:/UVlzXlHENh/I2jpg8/8d4Bl8rP

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Cookies\index.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	16.28 KB
MD5	b83fc9821453ca82678f818dfb1b5b58
SHA1	75ce2d478473c0830fda15fa5c35d50c0ae35ce2
SHA256	9c409a4dd4622d6d7a06a70c7dec44f5edb401bc9c35ad02b64a67fb8b4222bc
SSDeep	384:Vn1FAfOiDNGMZO8bX3ITksSZXm+ryiD/S0bdpqeW:Vn1FWNROCYTkdZJ7rSRX

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.52 KB
MD5	a6163cc44e5cbc09e57ef763631ba6ac
SHA1	200643aa7bbda57e79c3ba971cf5859146e5027c
SHA256	6ddd08158dc78be3174ec278f01ef3386520d7c2471cd2d08f1f98d781917cd5
SSDeep	12:Yx/9Mj+aTQXa5hOe9yq0rNUsFbCFv0KrhKHOcDo1fkpv7spT:U9MKacXsHwkrha01fkx7spT

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.75 KB
MD5	60ef6dd21fe66f65958a535bd21f7319
SHA1	cda90e2903ae911beb6281038a6f4ebcbe49276a
SHA256	f1b4890c79e70dfb39830ad90af5f02bc36b2587cd3e490cf99bb46df0f421ae
SSDeep	48:JyAibk553KDvw4txjdRSK7/9ye3fkVQOAfhzIe61ISLMaiVt:JFibI3KUWRSKUy9OAfR+IOMr3

C:\ProgramData\Microsoft\RAC\PublishedData\RacWmiDatabase.sdf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	148.28 KB
MD5	730ac69b811bc9d18c327bb979698a7d
SHA1	d619b3548670d605cc922c47cc40d1972d951e32
SHA256	6736efc7b53b5222f6bac47206b39b82f7a9ae8710ca5ef66053392a7d3c3ccf
SSDeep	3072:rYBgWYpF4Zak158sxIuw+IM3rB/Veuj6W5uFNahC555a0womIZrDA:rN4Zak158wIuoM3tVeujxqNSC5rac7rE

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\04_Music_played_in_the_last_month.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.53 KB
MD5	58eb4f3927b8708930f04cca21ae69d0
SHA1	abafc0818287b833bfe2b5ddf79b3a245833327c
SHA256	e77cbf3faa58705db25f6a1c135460612f3d97ef4ded3e075fd391ead2775d5e
SSDeep	24:+Dxat8zFk0tYSktzZT06YLhZjZhFenloSsg65dZyVh2gciU7MywFWreAVMOpJ:XOzFkcT7jNSsg8ZyugfoiMeAasJ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.69 KB
MD5	cef15859372bf467182af8d00184b3e0
SHA1	4f39152840fdc9217bdeeb37658fa43749daaea4
SHA256	0a16adde534f6d574ed01ca11311ca6472ca73e1073f097e51301294267532cd
SSDeep	12:MJi6cfSWtvM4H5HTPhFzFm1DbFGYjl04VQW9yF6qlvCzLoMsVVi6Ns5unF9EKX0D:qhES835hKFFGYV39ovCzEbVVrVnFmXNZ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	128.28 KB
MD5	ef19efced177025e3004ec738086067c
SHA1	c8d0d3a7d26709f2dcacab706301021062cb393c
SHA256	4245e592aaf68da28e764c2b18d67b76452608e851f85055ac74915543b830ea
SSDeep	3072:yyCXyuj/Ar70cZ2OmWtxR+vPUvFlyVZTCAQAIeE:yyvcArYcsORxR+GF+G27E

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\hlot18E-LD.pptx

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	36.72 KB
MD5	751cdae0709475d734632062b5f8cba7
SHA1	a430e5aabb68e85e7c4a7d3fd50844ab3ad24564
SHA256	28a4beb6aff848937c115ef547619ebac37654746f769c2a41dcc5b56006a8c8
SSDeep	768:b+CqGOso9e2w+ODokRMMvhWJxekK+4AFw5dKHzXKjqW:b+CqrKo2xAxekHZOTEzXK2W

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	106.55 KB
MD5	56328bed130ee6e22948e1470bf2e37e
SHA1	3a9171e26aaa20078f769ba23292f3fde41386ec
SHA256	59d0572f326b06a410e4ee948a4940f91654d82498739141bd7e44658cfadd07
SSDeep	1536:0MV/+DV36sU4X7OO1Ll3rQTVCT4/7TibsCc2uARxXtZs8JxtuAaVQnZo5mWZyMqN:uguOO1LFnTi7Tib22uA7dRJnuoiN3Gh

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.xml

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.25 KB
MD5	7d3474c38c87783de12f41c24a9f6e36
SHA1	9fa28d36646c4f3d4b18a6013c4542eaeda12f1e
SHA256	4ffcca52fd4c50ce9dd5fbd2f95e7a53568d565f5667f34ac543e169fc237f1e
SSDeep	48:OC11mFlgQ3azZX2+QYAxrm129k99xqXKn0SXgYYW2ValQyE1:P1m0vQYGmck9fqakYvU8Qv1

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	6.78 KB
MD5	2531730451fd3548f0b732dd061a4c45
SHA1	98b593ac7ee3881152f37cb3caa592069aa485cf
SHA256	fc2cd425f3eb1d7f76ca486c73f1daf5ae5a5807b959064e077610403020c385
SSDeep	192:aZoJ/ZhoqAV+Keov3nt7cu/rUpZaYtgR4sl9WMTaiIz07q:D/5Ap3Phcu/GZaYtgR4INTuzp

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\jashN -VayPDgA m-_.png

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	60.96 KB
MD5	fe29cc12556da146be5e2a140f61f5ca
SHA1	f38e4eeca90cce375956424b3e2d4c33a6e4b558
SHA256	f0a3fef2b9b8e671201ae6a98e91a866b4cdef3fcc648d6a78cb9825c1a48c4c
SSDeep	1536:SnQ283BIcOkfUatXje9C4vvZd1zf26yTIa2cyaEsekiPk+6X19q:SH4CcOkfUCjjuvZd12f2cyX9JPgXq

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	7d91f90886012620ddcf4b5886875f6c
SHA1	7304098d5fc8e53f6313d64a7e0430e2c22fbd43
SHA256	08a00c1c5153a2164ed108b6349181ad6b750dda0481982f4e8a2a202551c084
SSDeep	12:sSH1/1KiCgihm+ZrFkj9/SI3bq3UOOFl4jdI1Eu5lYO+SwDWRFB0s3O0ROoi:X1/1eZK1SENFlrCMlYdSwyVf4P

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	32.28 KB
MD5	f519504b0e49f52912c9caa8ce43e579
SHA1	327fea8b6fbf19672133bdad7d82f9859fe607d6
SHA256	1eae2dd353fe5b2ae31819c180f39fd1d1801dcbd41bb8b4231c15f0ae013188
SSDeep	768:yum0Jt6nGIvHJIXcX1b8+F0xXDfAEfR1nrRWGPYWzQP:73JgnvpIX+L0xX77fR1x7zQP

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	6383c16834e455ce6b8c1f44959a3a1d
SHA1	d290ab17f0bb620a767ec180f8c632e67038461f
SHA256	a7062638fd46f64e19580b5c2d2c55621149372881d3971cbfa338727f922f80
SSDeep	12:qcubr4FObqfgX3mVNala4W6X0XcZbcY/zIvt5JFESyZSkk0rqn9W41Vc1GMgC9NP:/ubFm4n/a4W6X0Xc5xzIV5ElBw9uNl

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	2fa56c49ef06f2ef3745d0dd2c016474
SHA1	cc26eb99c407f4b8e3e7b0dd27e274d60c118a16
SHA256	2a08b329168506ac62fdaa40458efb48ef1e4ea225f5e974208dff128dcef741
SSDeep	12:oCNJg3zQby5NBd18XIpmmmTI0DI115NKMOOWOMzyHKQxdJPi8hA8suwnO:riQbQBrYQtgI3IOWOMzyqK0nO

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	dfcda8fc1e417f65c74144b27f98465c
SHA1	04f54a661aca4db4a4380275eee7bb0ed9762f73
SHA256	94bc265efe4647c3ef1820f674d6b92370aef69839b0b9bce53c11b4f88608ee
SSDeep	12:GS3nbIk8HKElxKEEdhT4v9op5IFvSlIbO+b8ldZGaF2C7vKNo4uV61IcQuEDSvm:GS3nMk8ZlxrEdO9U5Ioy38l7FhLyjScE

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	28.28 KB
MD5	a019696cc1405f9486c809a756055fd4
SHA1	204373d86729fb461b3f01ccd70f7e019eab4d5a
SHA256	95e7ba0c2a62b269f4b0ed2eb3b593aceb3ce20a08d66070f22a02b96b7b11c1
SSDeep	768:RxxYYWkg8zAVzP5bJSK+ouO+q4vgvbZG4dU0Li:RxxJWMkZ9+HObVGVyi

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.85 KB
MD5	d2697f888ff4b69dcf9bfb5b3237ad22
SHA1	522350ddfc88b73d83c4e9f98a27ec79ddc03c2d
SHA256	b00e2037b0b2e958b4db3b38da82e51bf919e4540e8f86b27021a73649ac9153
SSDeep	48:h3S+obqRlakIgGkc+BAGZfhg8XWTtS1+O2qknVqXvWPw:h3bVRYkIgDWTxNmN

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\1qNgFKhx2-6cl.m4a

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	73.53 KB
MD5	87cbf00abfb7d1b2b75b352c90b58808
SHA1	603d6c848d3a8b71a304a011cd44276418af59b8
SHA256	9fc0f83e294488d0d63ca92d4a5b773932a81123ff0f5fdc9aa68c1c9ea5e2af
SSDeep	1536:YstW7ezHz0Lb/lyTRrPezh+MDTbh3oY8/eVtVAfzlMx:Y6NzHz8dyTtPezh+Q3oV/oofzl2

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	9515e816d07e585a5d1725fca8af47cd
SHA1	8842ae2f2c89b92b52c2656f03c5fff2a9bbc531
SHA256	ddc48d7a607c788a255b62cb8ff2e4bbe0021020362bcb44d6c04c761ae8dfea
SSDeep	12:QMj8sY+BsoXn+XbpTDqOp3FJDDKc0bU5xMkw3ZSvWVVnIW67learh8:QisEsoXncxp3FqsMv7I9kara

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\01_Music_auto_rated_at_5_stars.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.30 KB
MD5	38be3b0a69b6a1772fb317c4294cab82
SHA1	76b1edf8212e0474e95ec5f773f0a33e0044f36d
SHA256	6607453cfda2a6b9751eac9e9c2f474d20da9b186c8dc3a3f9f4bac2e251d08f
SSDeep	24:6e2LRtnzGRcH3z+tcuHkD5IAx3s6ArIiuOuagZ6LNjbB8xF:6e+9WHC5IcfAr716qNjN8X

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	28.28 KB
MD5	e77a663b0bc5172536e2c817bd649d0a
SHA1	9918a3a1e8a4b16b6c891f7264ea57b298c68a7e
SHA256	33589ca1df09d2f3a628ac42a52b9d664b67c27bd6875d73cf4198fb052f21ae
SSDeep	768:zNr13IEvrhoh+d4lFOKsPNrgEqxos9ITmzU2R/BtX:16qqlgyas9xzxftX

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Visio\thumbs.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	125.28 KB
MD5	720732af05f515c836d67de93c5c00a2
SHA1	554d8dd7a229f556012086639c0e79d1147be3f2
SHA256	5d9eeb03f83e009178fe37f968fb273ea30f5b89cec168ce905da4193b43fd7a
SSDeep	1536:5N6TMWSOhHwqUbs4b+AOQYJpfsU303TmIH2Jf33gIwPZywqRrVEpaEq9iQyPfwBu:5KStq8zbtgUUkHH2HlrH9iQwfz2bbmx9

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	36983d8f55c9a5e383d581a2fb63ca5c
SHA1	95525f10b96b41c967e587f1d574ec95911fb321
SHA256	72027b1c3c4ac176c70fca59ba9005963f185cfe44fafe403462986b345b543f
SSDeep	12:SOV3P+85w5Pkou6jEZUiSKW/Qb/gsEm0ZP6q48uzpOiCM/p5ov:SM+iohQSQlb/uvxQzpOc/8v

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\1E1dS6vmH VPJ2.ots

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	89.38 KB
MD5	78153427187dc8646297eb0d50f04fef
SHA1	adbd85f255fef5379accf946737e5ff743850ce4
SHA256	d59ef5522b265573925884ef57851752e0b2d2880052deff6e766f72bdb02c42
SSDeep	1536:XLaU3a9xENatNiztpQdRQSpRV+0gRkxFrCEvgLbd1mV9e6I7R8oR1mvalXW:53jNxBuQgV7UGtCUgf/mLI7RAaRW

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Cf2gB2yGZCbU0T.mp3

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	76.64 KB
MD5	a66569de55259832a554390c54c4c9f0
SHA1	eecfabae9c7dc9a23bdcef51aa136ba04e03c04c
SHA256	7583a4b7aab6ffeb0af90113eb274f4e645b1d700c5734583ad1ad2933db9998
SSDeep	1536:ndzJdUMjmiK6lvhZh+9NRq+tQHMoFO7HtV9ypc/4TswthTkJx:hWl6lvvhs0+aHMoFO7NippTfhS

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.38 KB
MD5	8cd0421493008055778669f29c88319d
SHA1	ee02ba1b5d0f7405e75f5789b3ab33fe73f2b191
SHA256	8624d07a3bef91ef82953e26cb5d49ca3999a81f0529b8987e0c81ae4cfcba87
SSDeep	1536:ja52FK/folmroxWRNsLhBgN39bEn0UnezmMGxMow:ja52Afr8xWRNihBoin0jmm

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\History\History.IE5\index.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	16.28 KB
MD5	fe830fab1abe8203aa1a8323d2fd3243
SHA1	ae3f2c40a07090a3fefe747649f2467346d55a96
SHA256	e8a029fb530bb611b7b3746222b59e55bbb9291e46722688177fc839f1d50b83
SSDeep	384:7hxczwWREt88BNEvwP7Ox9rdGOYtXvySTk78g1C7fm:NupREtzN36x3YlaSos7fm

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.78 KB
MD5	5bddd9dff81ae5e79c19a0da4efec0e2
SHA1	5ca3302fe0d19e50b588b13e71f8b81140580a38
SHA256	3398c6500f0354b8eb3304f0a15d2d89c238e5d3ebb1c16c782300e363296312
SSDeep	24:hLSQc3PVyY5+unqvRnbkIYk4x/CLD3qWMBtQ:e3P0epabLYXxqLbq5Q

C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.00 MB
MD5	bee2244b1f0f2ec25e0648ce2c1eb980
SHA1	abeef3357a345474bebd943108438e4956a57e3c
SHA256	a8641dbe257b60cc74c6f52c84edbc911ea949aab7377b3cd21b4ff99f453e86
SSDeep	196608:+prUEIskXlgnV7wmfNvDXadSLsS8nQsiAESOsYnwZrja9segf:+pYEhtw+vsItAqpnevIu

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Security\addressbook.acrodata

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	5.55 KB
MD5	00d3da2f266de9d5139b2664a013a65e
SHA1	60cd3727487a1c9fb207ff6370c3e4e565a558fd
SHA256	952523e0141267b0d26ea31263e91e1d108911ff97cec26d41638872ba9ebe97
SSDeep	96:LhXgUinZMhTkMXsKL5y+El7rg3tduzbxzeU3wWrqbGqoDOo0qat0eWwgC:LhwUIOdXsKk+srgbuxB3w2c1huTwgC

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\F0TlXw.mp3

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	49.55 KB
MD5	d22424bb585d7f436f962c633da380e0
SHA1	d926950180474e546e55416a9651998a7b7393b7
SHA256	2c800ca7d2164e69db8e60cf1623d41cd16c340c409675a078ffbd74bbb372d0
SSDeep	1536:+K7gIhZRYOOG6zYdrZC4zn9q83HjURkHfHmYA:zhZRnOGpzn4cDURklA

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\QJTzqf_AiR6AdQv.wav

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	46.55 KB
MD5	6c017b69d2703784b787a0cf9f786425
SHA1	2928819d00a48049fffa68fe7b6d0ebf4e50cd15
SHA256	617eb18546addc8f79e017956bbf3fb09158dc733a371b1bf9f327751ee4a4ec
SSDeep	768:OdyYQ5s5yS4A9fP5nZQhIY5DRtI+npOBxZicj2vqNrDjIgdv93Lu0USLCr:6Q5s5ygfP5ZOjLARDkABu0HL4

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	909ec588296605c9e25e631b90bb047d
SHA1	fa1b3a88f5e9370f79d703a14e66c1cf8e585b61
SHA256	c909f746a8f578c21511a1427200fbae11a3248fb9d8d33610890bc427452080
SSDeep	12:yKUI8R1IEKwIXaY5yUeivqKS5tyUdsMRz41dTLkRUEFq0z2t9rdJqxIhnKX8PnDy:jq1IEKnR5yOS7SM941ZkyE7GpdJqQl7y

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	3685dccae15b75a35cab36dfe1d0aa96
SHA1	090fbab11001c023ecbb08047b7374e95f49b2cb
SHA256	88bd4f832e1ab307ae36aa06f7a03aa8b57b8d7e289c9e238ac635619ee227c5
SSDeep	12:6kTpv7YmsXxeScisKqrtjyZKWfhxZ7fL/KR2nIeXrdLhEutk3rjQTXB3:B7ZAxrBIWflDKiIe7dLquOAjh

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.86 KB
MD5	42277b41f81ff805ee3b80757fbe3b33
SHA1	c1c765fe5782ffbf85ff673ea0d4d4b66e5df986
SHA256	9298c5546c117846c3465a4993c2669fe3af682538bb9cc63d8650d185aceced
SSDeep	48:jtLl8UIatp9546qXQop1TgMI4+rqLR9wpnniaTgk7foAMh:jtLzIo5wrkMLkErCniaTgkz5S

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	52.22 KB
MD5	ab52caa4af314d6e3b85ae0d76d7d8d6
SHA1	46343ce5fe0b22a0a1e6de0c03a58ba9a6da19d3
SHA256	ae209b6edbf78c0fe853705a998f8fb7afa53e7320ec809b29f7ef05a0baaf96
SSDeep	1536:/lJkT/65TGjkG/yq9/GN+pavpwlNIITfPpBKne:/l36kG/yq9/GZvWl26/Ke

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\mJ4 yRHwC_3TL.ppt

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	25.25 KB
MD5	d00702a76b57e365cffc7cd96d0f3221
SHA1	575de96babe99e5dc922def432a574fd8930706a
SHA256	b906730a1c161db4825e2643281e7dbdba9cd9d58a4f590d593148a5cdce9bd4
SSDeep	384:EZ4dQXH9MhJSZ2CAE6/LcxXa50m6AktHTr1efdf8DwwilUwvjq0pgRMS1o5v9A:5XJSW/4qD6AS1iNkklU1ZRRo5C

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.00 KB
MD5	440bbd18f18da81cd9e5d4819aa64005
SHA1	66c3fdc9f3f00e9ce6c5edabe803060b91a73008
SHA256	333a84bee341d7047da25b56187c00a3585b3fbdab879510a4ab63bf2a8dcdb1
SSDeep	48:/6aRMNGLkiiSiBHE5cjC4JUOIJAPkUlME0:/6aRoGLI+5wCS3PkUlME0

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Templates\Normal.dotm

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	20.42 KB
MD5	fde03ab9ee074413d78e066182a1ab53
SHA1	6b6a3b0c74162f9dc06d2e45432581b1b9d1b939
SHA256	a7833839865f5f5b3786766c8a67e301e4ba4aca2a86c790de0ffef2aac5a202
SSDeep	384:v/qBt2odFPNnbsz+rf28b2WHSmsakxbMEMyt5AWmyEfPG5ixQtVpHfbXeALeNPOT:viBAoD5bsqz52WyVAyt5Lmy06ikHfbXD

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\01_Music_auto_rated_at_5_stars.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.30 KB
MD5	c6bbe9474f13839cfc60ffb58be667f1
SHA1	af5f253bb412052460af486199b23da5a888b0f2
SHA256	15adc4136a10fafb9ea265fb7fbdd6a1cb548194f7388ece9aa5a1192c2fa63a
SSDeep	24:9sQZmogJFVvZd2pTlQhDIbLMup2Qjp/u0Lg/8/Uv40ImFS3cMga6xTlzBju:6QZmoE7ZAp2h0bLFv/u0LW8cg0Rc3Vgy

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.81 KB
MD5	5bb5d37a09f76d483406145d736b7e95
SHA1	a0fd94afeee03b9f24dd1c7d352e1e2d2848af85
SHA256	74ad465b77e0e5f807e20af51fb0c2a558d81505c5b151bd16f2740e4c02daf3
SSDeep	12:yf9lX4GTBh/iE2Y6zVMIJivBlhPq+uM8neHB4yY3yGQ/Ow3sF2CwJZxx1c93jyWQ:alpTTXAV8ZqI8eHd+bw3sFb0ZxzATyWQ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\frameiconcache.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	9.27 KB
MD5	2b8d559c6c1f989f356577f91e2b3617
SHA1	9d2080ce7c52803d892866cbf4a4cc58479508ab
SHA256	8b62b4e15225be37b303a025ec925b2529f0b5883ca19ac39f6923c73de79f84
SSDeep	192:6qJ/BJLbgU80TKa/vSwVkPEWc2tDJLB03wt+pqSY03o+/kG6:6sBFbx80TKWgE6DJNTsBRod

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	32.28 KB
MD5	d797277a8078c9cc67160555656d912f
SHA1	29e35f7d3fc520134e34b0c7736dc40221a59b40
SHA256	c4725657afa859276005838d78961857b9a73a03c5605777dd8cfa5cc13e81d8
SSDeep	768:m+Y8SToMeW9NCGXqSwMdYo4C9wUBL+6BjjUmATcYRPB:5YbT/rXqLofwcLNsmLYRJ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\3MWCQdlfuvEzl.mkv

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	26.81 KB
MD5	091ee194452abdb80fa21b17b7a71297
SHA1	906920dcab407c879b31882fadad4d7279a34159
SHA256	ac0935a8d4ac9427d5d47d85770fd7037d56ad0b16bc036bc7acb3f33f42dc19
SSDeep	384:8cPH+AR0gTVt3Z0oiEpdylagMnDV9yKr7WRplpSpj4Zk9U0LfHjTvgBDGsobnfMC:lHVt3SqYUgcJhWrTJCbsobfYe

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\ITY-CIAZN62NhyYq.m4a

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	43.13 KB
MD5	d0d1417bdf6e63c539e7082098b9fcdd
SHA1	b679640b8650d75e0f562f466a29462fbf5ce401
SHA256	20c7f3be945d13c7bb3c08e8245677dca8519c9fcf919540f5aa8ec974458a22
SSDeep	768:FnxretFEicRQ4Jkq+Hc0vlvBH9TH9sgceKJz0nQkdew9OcYMzLPBYwAGDBjXd:Dr6T6Q4J9Ic0vlvBphHKJAnLp8cLYw5L

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	fa569ee1f31873114acfc4a74803eaa7
SHA1	b3bce3d00a2a04b9ffb7ca4b82477bcdb7418b20
SHA256	773dc178eb6aafcba5266377fbd5c9b253a941888412f7854cb148d605d8e51b
SSDeep	12:N78DpV3P2n/fjmkbKNqcuerhuh5qzU3c4XzjcVZTJsHTy7c:l81NA/fjFbKNqaObc4XzjOZS6c

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\0ir7Ld.jpg

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.19 KB
MD5	964440bb07337c2bd8ec30acc94edbb0
SHA1	b3e802f831b75dce341a4359c946e1ba840ffdef
SHA256	df57b7ad9fffaa8fe04b11a41b872275bac69fa2feb19da421745095f0cc8dac
SSDeep	48:nu0zG+3NmRHRpueACmji3Jz/E9+MO7A9CezzDdJdYbwY5xvG:nRyRHRpFmjKJzdMOc9CezzDRpY51G

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\11_All_Pictures.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.85 KB
MD5	cecd2a0eb021dd494d34a98ceacd0303
SHA1	49fe5c9b44e458b3a73621e14cdd893d57d19557
SHA256	c04676e16a11b2ae3ac1ed486b0479e2748a165c6b1904a7a488e323e6282e4d
SSDeep	24:Oj8M8Q10/ZE4BSfsTpvqkoZGExIb3Pi+pQjdTtn:OUQ1GO9fsTproZS7lOhTt

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\ReaderMessages

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	8.28 KB
MD5	72e3723d6f8f65d810bf955953150b35
SHA1	fd6a6fadbbb9dc99ab380a0b3c69ab364f9519e6
SHA256	3dc7fbb13bde2e7f5b5e4225c30eef6c378d642e8f4a0d6de03737623890d525
SSDeep	192:U87t4LJs2vG8puKZl9ONmW1fXz0XGzDSPsz:U87Ys4GJKZeN5XoXGz+Uz

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	c35063dd7d962493378723bca314cf18
SHA1	7fd41c7e958949227686e713093bb0bb2e1bb7d0
SHA256	cb4150242d42e83b7258c18fbc12481072631d95563d593965ae795604fa6edc
SSDeep	12:SKTsLqlp5CBC509m6CaKTMg8dD7tXNq/Hk+cYcEvHIQpaibPDaugQ5HLKn8r:ZT5Yc52saKTEB7+/E+cYcE/IC3bPDane

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\f9-JCP-XCTviVeReJ.png

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	92.72 KB
MD5	6c0ca3c8b179bfd23488f1d5adcea74d
SHA1	947750732b364c01b5026623e0d4876a510bb952
SHA256	b19e4d960f816476d17dc1f3ff22d4d2566fa1531a34f2aaeac2195b15153667
SSDeep	1536:HmjNHULr+2lCHx66LZDp5r+2+9jknJ6rbaczqkApLzvEP4/JYY4hHidgpwKf/DgY:H6HU3+2cZL57r+n2wHaczf2EgSYmidgn

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	fea9bee232e6635d8c2adab1fa9429d7
SHA1	2bd6cb10ddcd194cb8d3263d301ef40a92df77bd
SHA256	2f19c99c02d1acf4bdec6ad3a87780c9eebef6048a0ad79e27d658d66a52acb2
SSDeep	12:obp8zre99yHVWOWK+hewd6G6QQrIRTEESVbdS9+25U7S9xfc/wp+n:oiBH+hewd6GxQcRTEEkoH5zxhM

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3130B1871A126520A8C47861EFE3ED4D

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.49 KB
MD5	3e14795c0af8b211f1b3fb8aaa2a26e9
SHA1	2bce19e57ae8ab076cf20e69fb125bbeac3bc9c6
SHA256	6e4ef309d5008050382d7fad7844218e74ebb7a6a7d3bcccdfcec75112bc418f
SSDeep	12:h2uPbMbUwL69PKWNUamMSAUKYy/dgA/dIaQD+ZBBskSjn:hbPbMr+9PKWxCAUOrduoB3S

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	5b09ee03d34209c828772348c5b6d4d2
SHA1	90f6006c37356a50133d33f6118e512ed2f37f94
SHA256	027e82a90bf4ff10f9782cf1a38c91d2cd75e6df527bc780099fb4a13388642c
SSDeep	12:BCyug+71DmAOkB2eWXlVIKVlAUmsdlHIK6d19upC3oL4VcGWraopcZNKZwyjq:BC5jDmAJ2ekwUmwHIPupC3okVKNc7Ewz

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	6914f675811449d7b9590e57f4d8f39a
SHA1	7288c2d1e4c72543db9a1516bdd83adbd7d0f7a1
SHA256	5c360489c064b77c5a06a8751e1653a2ff3173f355d54604be0de0b24feb2fc1
SSDeep	12:5g3+FCeNAAz1ULcdTDvbQwSv3peq+rSFKqYlwbjZhbtDleTiqbKeikaT9fpfL:m+NAAzk6DvbQwSv3gX8zZhbx6iqb8TNl

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\NapLd2DTycPw BeAC.odt

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	53.35 KB
MD5	ca48fae4e5de4fe88fe693e5c2559b47
SHA1	1c0eea0d21ec7da4bd25e96e0df3856a03442333
SHA256	ab14ebd54f11fc0ce70be8c36a967e46e2f13cd48206746a437301b3636e2104
SSDeep	768:PrJbhwbbf1crrVZgAXgXgihQHcTrTPIBt+2eQ61FQXXJ0gAaOmscT4F4z:PrJhwbqrrXK772t+2v61OHagTT4F4z

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	f83062db10898fc79e9bcccad895481a
SHA1	5eab9485460ed8b9516d779e32900be64a194352
SHA256	a9726755338057bd23d2b2a0c37055b1db75252291c650dfeff01a39a54a7212
SSDeep	12:4Of2QMq01F04+J1jtUiynQGEL+K3aNVv0emRyh6btUrYPNXgzdLP2k+RlD32lGl:4w8b7/+JFiWoNV8UetUr+QzZ+k+Rfl

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	d41384bda0859af4e434003ba62b43bf
SHA1	fe74af9217bbd2a3f341c7c988068a1e7d1d4392
SHA256	a7905ff1ca98daa5adeeb3627f2ad205c854ce494c1d64b40f91453a94acc7e8
SSDeep	12:VzI2+jqj9uhC8d3k0f2PSMDxG+GtTlbgW3u9iTfeARulEzQhXyaDYNsc23xN/6Zc:VzIX2j6C8dAPSkG+GtTlbfe9Efe4ulEO

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Visio\content14.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	99.50 KB
MD5	8fa9a2a5be53c3baad1c39e24169e85f
SHA1	9e128948b96799640a5857a64d8489b3cdb96ceb
SHA256	887adc2cb68ff40449118b13093f52e5442331ab85e7562b5c6e6c2852ae6820
SSDeep	3072:STuPKdEaevScLTtCyBRxx2PvcUSFnibo1KmDQGb2D:STuPKdEarYHXnLKpE2D

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.69 KB
MD5	c6dfa29bfa8f717623ff1b5031fb017a
SHA1	315781b116b8f98bb30ab7495e8c68de39634582
SHA256	594b92c122b402a6137a0bae4fdcee708680fef86ed24d685a0e0fba606125cf
SSDeep	24:ejkAijsrJDMevWI0hsOG016j9XDHSysM2vnTCa+IOCjM3MIpJfRueKfX58rs5TtB:BzMhOI0hM9TyTJ+IOHLpta5FlvsYT

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Office\MSO1033.acl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	37.16 KB
MD5	529d3706a2e1058b303a16d695602cc7
SHA1	0b51eafcf51b6b39fe53af63fbb063964a9a53ee
SHA256	b4cb5bab288cc896a50e70418616343f20c9d13f34db6301ea196b17db99c1cd
SSDeep	768:sgqWVPrdsKLA4LiD8+sJThXMVfAyFBPmT9Rwq6yzt4rF5B:3pVziemDNsJhwTjPU6yarJ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\09_Music_played_the_most.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.28 KB
MD5	acccd8e458ab4708fee4fda066ff9a56
SHA1	47a906fbbbcebbdbb13a998c1dd08ad04c4a3f8c
SHA256	bfd2889b24ad93a30ce42be04e898106aa64f82d29fa4b7ff8048082d3b5221f
SSDeep	24:bqCtYxguDaHsD7jyPcItAoq6O0/trau2PFDavP1uAEvnbOgTomlSdq:b3tYSPHsbyPcIt5z/tX2dDDvbDs4

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	bf1a2b22f3cd7061ced7ac67c043ec01
SHA1	f61fed6d2106496686f39d9ff5e8accc74cf1bb4
SHA256	ee37ac1133aa2ae9bcbe30a6d98ba82eb2f1e239bf0043e76785c57c2f8d7217
SSDeep	12:Jwb8mielEEGxI6+sRvInfhQs0AxgVMualp7b7vlKY7aMR6htiTaf5mL23EVP:W612CvkV0Axgolhb7gYmM9uf5mLii

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	66a1ee094dc12ce7d45a7d127b664304
SHA1	ee6a1ba049ecb3534d08e1e81c2deea80ca7b6c4
SHA256	de2ce91c18841993ad55adf5598309ebad575c1852f19558d6cbe006a2785782
SSDeep	12:H0Ig2Gpr2l/xYeJ3dMIrMUZFnuj6cubd4Elf2hantSOOU5:HY2oqj7v+NVEltfOU5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.78 KB
MD5	deec410482f7bda2b9d34b18790554d8
SHA1	33bb4268364b61673254bfea2a0b67006172577c
SHA256	89163ef708035b6e9c53a3efafd7c7e820bcd19ae59072497a9b5c849de1624f
SSDeep	96:wG75x5hB4khwRCzVuuFhNhhhSy55O1UNm6qJLHp5AN:JVHPjwRgFhNhhhSyLO1D6Up5AN

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\SeOx9Vq35cBW0Hf0.swf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	22.50 KB
MD5	442892e13da6322810cb16dc745d62f9
SHA1	ee103ee43b2e8086fd64499ef244ae181e1f0b30
SHA256	ad43e7a2e96cd6da8482aa3fb5e75c3bd271db60d88668563918768e893857bc
SSDeep	384:iKSSnoa/fkj5nqRGJfSfXFpV82ixgPd8tbfsYz+0W1gDuUI8YFMrEikShzn2Bo0:iOo2fuhaKfUpV82kDsYzTW6Du9zqrrk5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.69 KB
MD5	c8caf3938f868615550fad65194578c5
SHA1	995d1a2cdd788427ed990f4b3f2d1f2e51885219
SHA256	de9210d3744629b2c213de17db07c6a2ad8868205d12278609f209d9a183d2d9
SSDeep	24:QzZO11y/B0XACjH4krlG/WYABToGd+bgrEdHxAT+6TMmeEqLWp8DZia0puLtvOsY:cZO1rwCjH4oGXABP+bP8q/m1lMZndZ+V

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.39 KB
MD5	7344237f587293da73a53279eec3cc7f
SHA1	cfbef72cceeff9faf58c2d51c14049fe163caa6d
SHA256	b59faec78b0e8611acb2a247d068bc8e1d51cd6bb2a28a251e1fa6d3dc171a6c
SSDeep	12:hgABDndWpFgJ9L7QOMohyPOiYht52ac+e7Tv:CoUOqOM8yWthJG7

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\bB8DV.wav

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	69.19 KB
MD5	2183b16f8234e722e6aad252e2abc114
SHA1	1f41ba73d42e8e8da9bd9fe169949024f029c980
SHA256	a301641f4d960287df5c8e5da7937ab20035dc45abc5bea7414451263f69189d
SSDeep	1536:h4xAg48jbPffki70duJPPY5ftaiFwtUSF3zYOtRE6U:oAefPnl7Ou8fta2DSF3zzdU

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	cd427b23842be67b0756ed73bbf8f89f
SHA1	4c1334b887eee66c2273471c4ac9db9f7226e825
SHA256	6d7f5116451fcae73ca063cc69033ea5bc68577aa83815bdca09ea3a5c610e26
SSDeep	12:OJt+ERkRNEzWY8ldhtIBTn9y7iaZRYkbPQ4Vwco/PLxPB:QLkR2t8jbIBTk7bLIYo/lZ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7396C420A8E1BC1DA97F1AF0D10BAD21

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.53 KB
MD5	60f892b79f2a193f98b33fd8c9c51df5
SHA1	365996fc0eb4158d665e2644bff1af83ae5f7bb6
SHA256	2347d13ab8797102c611a421b94d83b08910e6b37d3f7251af5f8c4bb3cad379
SSDeep	12:6K6A02gR9ahgaVbB4zJuNmIoCtDVb8NIcm8r8HF:6K6l22CbB4UNroCtCIcmPl

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\vjSrSm.mp4

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	58.69 KB
MD5	45fb64fa3bb3d0d4a73463aa1efd9078
SHA1	1d6a2d08ba8f9dc8be6aa31a6c6d8cc52982f2dc
SHA256	d72b41b09426ccd8be89c42654c94a15279f84beb9cfc7b5bd1e1eb16245129d
SSDeep	1536:cgLsQpf8LU8ix9NBx8wCOQeLhxdFBOurwn/tbzK1:Zjp4U8MNBNEOhxQv/tbG1

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	b7115e1486fdc3a038c4bab9e37a1610
SHA1	31a94c3228d47e60adbfde4df7a6723372e58645
SHA256	70d99895ac6e725ce4240224560f9f1d71357a3d88043cd8a7b18f08f365ce17
SSDeep	12:DnNG6Etn1VHSSAARKZ5CEGf0QSzcn50twSZrnju7+Kz9eI1fGWiUGDzJBq/JWcr:DnNDEtnACJSIn5TSaL15Knk

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	16.28 KB
MD5	3f17ceb391a5f359991f43177e8c7a9d
SHA1	bffec6a8a773c8e9bc4b2f0a325633e91343fbcd
SHA256	0c056fb0a04b690ee6eb33dac68e56a888074cd63a63e44e4848121bba3022e9
SSDeep	384:6GHSvGEBXYvaDAWNNkUhEoNk7gFes/L1bP569rFwO3K/6oWvB:6GHSvGqX08NkUhRakF7pbI9FB3K/y

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	27e9c7d61d0be6abf9c532369daa7615
SHA1	953bbe9a2be241fa643e55a5deffc19b0fe5e31d
SHA256	fc4d7c5737b5d19e198900985a0fd94300dc71685752c614d5a1604736876e38
SSDeep	12:0Q5soODd0IgAGmDF+S/uUBUtCDaTstLId1l2AuaUroJaAV6llRSYOGJi0zAKqF6X:VsbZ0IjFZfGRstLq2aUJZsGJi0cKqF6X

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\02540a10-7eb7-4b20-a8c7-470f8986389c

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	021198e7befe971ecef1e18faec6df95
SHA1	a12cb131bdb81d5503c689af02676a6be91c297b
SHA256	f7f4ba6b6b3d7ee590de80052a171c70c468418144d09611b09f8a82dc7f9422
SSDeep	12:h+ZxKGzfoC5na8ATIMLcK/22lQh45eiDTa+40YmAPmKTT4loF/BUUbUbc0duCHtX:oZ3xi0Gck22lQweqYmA1TT4leZUJc+5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\10_All_Music.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.31 KB
MD5	f7d5e1b111c80e440c2f4bf85b068cdf
SHA1	96fc669a285b1a4c1573afa0f1ac844ee5299709
SHA256	ceaf2561989988e31bb116a22352c05c42afc2e3d88ec3403ce1089289539452
SSDeep	24:iPdXiuK4E+UcMZd/Jvu6DktHH3EktR6EzedXG06uGmpqE8i:iPdSuKyWAn3Eu6l20vGeqM

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\e4a9vNOEt.avi

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	70.81 KB
MD5	aac95ca1b8ac191dc193e0d0d56225f3
SHA1	bd1c4763e8d4932f5f2ce0f5a2fa515b518dcf7b
SHA256	96fccc6c515a7f966aee5d12e44a1bb23d6f3491d3d812b5ce6cee609b813428
SSDeep	1536:g7vd30DvlBcZwoTNTwqWi/V+96NBfKqWMditJ0vh07iqV:cvcMZJTNTx3V+96uqDNW

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.69 KB
MD5	9628a2e341e0a62d73a5e3dc56aa1894
SHA1	ae1764daa05cd9a259ea30fccc66d49674ab4746
SHA256	3267dd45d4e117d7a18b19e790f6dbec13c488e376ec93b56390eb65c3ce3acf
SSDeep	12:n4OvmSgY68Ib9zrBrWsFJHJTr2bMrwBUON0WUf+MtMANT8gJ+2ra:OY6VxvpTrPrtkTUmM668g7a

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.63 KB
MD5	4577e50f8d3919396e6821af66dccf04
SHA1	e3186694f806380e7d0b65ad29f5e8951f1ac112
SHA256	5356a5d9ca5b579fbb19b34c455c4d11c9e3ba769dcd9ecd2d1decc2037ac6b9
SSDeep	48:pn+6g+PG2L3t8FdwuDZTFZuUE3joNKDMEaY:pvt+zwuNTEzoNKzj

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150

Modified File

Unknown

Not Queried

»

Mime Type	application/vnd.ms-tnef
File Size	1.75 KB
MD5	6cc8994615e127c820644c8d30b15795
SHA1	dcd75efa838513bb7a158ce975a9b47070095bce
SHA256	da3ee7d055647d485092422d7bb15a4be07cd3eb1ed51dd641cc753b7868152c
SSDeep	48:siJd8VqLoFAZS/RYda1SRSQjgZkl/inpr/2Ts4a6HgUi:9JqVPyfQnZ2TbLHgUi

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	04ded97832acdddf673b782a5b0f6f3a
SHA1	587f4043080e52078f27558203e0c9d57e1633c8
SHA256	ae7eab52d7b7b081de38e2eff7358b1a32f873d04bc7f7c618d51e7141e5de63
SSDeep	12:gXTWJ9MxqhJGsmxmory95jrNyhcu6REfcKTECOy7nVq7URzdM3kK1wFCDkq7N1A7:AToM7Q95Ehcu6R2HJ1nV/MpCFM1D4

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\D_4_1U.m4a

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	30.94 KB
MD5	317936039822c8fd9ede02e3d9a592f6
SHA1	860f68ed9f58dc16631fa55cbc986a6111fc8006
SHA256	e85b8322ac129c4347f9c7866ef404218fb0cf805e56db02f779d524b3e799c1
SSDeep	768:6PQVo3DLtb83L1vFcodOa8McvulA/hlLRoB3hsP8N:6PQVyDLpQL1v1Qa8McvQahV6BmEN

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.00 MB
MD5	8209902bc5c5170398fd730143228207
SHA1	7510d930c52c56be5ac8ec99741f072654219639
SHA256	d209d3e66599629bc5b0fa403f56f94378420f41573d5185875153d75ce23a3c
SSDeep	196608:/cTB5nIacvEws0Bl2YTLNuq7zEqaZswqLhQTcvlj9/z2H7DLKH8:/cT7ItEwhBlnEqaeqc3/iH3mH8

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.86 KB
MD5	49e4f64ea9895d06b496c0fcdf2a199b
SHA1	a681fc0e7563dfcf1088ef763c197f101fb64b08
SHA256	8e8d7451f66198078f934495de8bbd8add2870cb6057eacabc645fc2412fc15f
SSDeep	24:POnL0cJe6yREohK72Gz1ZllFqf6S/g9MhJnsDTBID+7GgjUUv4FVxUOEjLR86O7M:QYZK7hlIfn49sJngCgOFAOEjLRYQ3

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\brndlog.bak

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	12.19 KB
MD5	72307cbf5fa22d6c6e8091d76181b8b7
SHA1	6e5bf02c13c01e98ad44f170dd3e318cfa5fe918
SHA256	3ac6039261990b10c51f5d52963f23328b3328d5f2bd6973000e078576dbfed5
SSDeep	192:KV0UOS6S47qTNfI7mJUnB076KdX3kSmhsZHLoCIm2ItAW0v+wa3Ufi:Hi6SVTNgmJ0cnTgsZnIby0Vakfi

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\04_Music_played_in_the_last_month.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.53 KB
MD5	7592cb82ffaf3c7f57b9dd96fc0f5118
SHA1	e75ca812c54d08fd686c989305b05e29c841fe68
SHA256	b70fc9708d7d98f120d66a01219bf45a8f038b47a9eb49e3508754fd1efdf565
SSDeep	24:VHvgW4Wz8Odt8tCo54SZ21pep1mvURwK9tEuW/eTD8X//Qb0a:VYW4Wwut8tCoGSZwe5RwK9aeD8Qb0a

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\Built-In Building Blocks.dotx

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.99 MB
MD5	7544a9683e32ec38a0229f668e79c0c0
SHA1	73c488984c914ab90a5c156c8b7413106c2dae5a
SHA256	067a1922c67494372e1f836dcf159021c5353fe0abccd7f24cc26f858eb8454e
SSDeep	98304:NsGLwm5n0c4HTUkU3mt3KoFvEJoH9pGfTRDT8Mj0zQc8v4EwTc:GGv5n09HTRPvsJE9pQjYhERwg

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\02_Music_added_in_the_last_month.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.52 KB
MD5	f9b364613d219a6e04a97dacaaf12c7b
SHA1	31467b1c528ed4c05dd8332023a6723d70d94783
SHA256	d1f4c1a7ff88ac945d7013eb2613de5b92a86ba1d6e1b061d6106347f8ff51a5
SSDeep	24:EjIodA/32jJT7IJOFUjxVOv9Lr7V8R8Nx9Lq24JUa2+Ck7cRbPP91XpSrfG8Vun:EWUT7IJIWEt7+Y9+24aazMTPrss

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Outlook\Outlook.xml

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.69 KB
MD5	2305a14ebea65555c6fdf78af4002be7
SHA1	947550db423a9c752be37a3664e76eca4d694b06
SHA256	07289f602f8e60f6d405ad86f6cd0ab72fcdc4063656599057c205b7c5e8da2c
SSDeep	48:vGiqPzuT106c87VnBT1uTRTn5Rl+/ntBVW2j7UlcjCvf6kbfTJEh2OzE9FAO4Z1:izuT10oBT1ulTHQ/DNcf6oKp214Z1

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\79-9QkC.bmp

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	19.83 KB
MD5	81fff173794447943504988185ba1940
SHA1	dc4f2d44944445364e543682058a0ebd1abcd768
SHA256	223247f494460bbe4a6ba7ed4e31594b68fa91b20b55b0e8c59b40e026ad620d
SSDeep	384:b2YHnSBCvis0v25w823CKebfYkKtr8cxtng3cpoGtqQ7XWtoLJuLVXHqW:3HnF6sbwlyTZUr8c5kQ7XWOLOV1

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	d9705c9aea91aa34e576e49be1131133
SHA1	7f1a582d733c5185f17f6a00322400810f56bd89
SHA256	69feed5171f4296e57adbcf3b6ca45293a12d71eb08090032f71532da62b2f63
SSDeep	12:dFKsc/ysAvlN91rJ1RZiT6wjIx6y2Vz2zZu6E/WQ5p/xkfMGHeCedmQgP7MpKH/+:nKTmvlN9FHIjIU1z2Vu6EZ/xWMGHeCeH

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	fc82cd11b5574d19968a6b8fb5b087bf
SHA1	e87415be764d56ce8d069d40f3f30c9287173a66
SHA256	896c7023dfdd9221ee536f3c7aec09e039ddb4cb929488d2f382a00394489439
SSDeep	12:hdbv2UASx3AiwIHlc0qW6RPBN/Ob3FX1onbivrguUWfikFP0looK9f:hdJASxGIHlc1x5N/03FqnbMrguPgd+f

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.75 KB
MD5	adc49e11ecdda1066a07ccd03ca7776a
SHA1	6a8bfd041a365af03f68da76fe933557b8356333
SHA256	1b26c0e12f7bafc792d0e8cb29c911e3b1a558382e58b0aceffbdfe64e86ad72
SSDeep	48:EskJ6OZLMnAEwAjdCVzdI953vJZSeFzNW:rOzELj0Vg5vSelNW

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.icc

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.89 KB
MD5	6c1f2ef13a16828dc65d2f079a8255cc
SHA1	21d85876a4eb0bc3626e549f59cbf188ef68e3e1
SHA256	2789708469fead08be3f1c78b89e4eeb6fc2a7b7a67fada7f7d42c6acd83a3b6
SSDeep	48:Y4BZDiIaYwsVC6i0SWvWcM6Uj+m4C93P+Kje7xeX6PF3wDzCnhsus8odJ1fbLbY/:YYwIHhi0TNMZ+sWKjAkX6twDzm2Dz/Y/

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\dZW Jhv3BGLQxFR.wav

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	47.35 KB
MD5	0600e37f69e9606a285aefaad390a855
SHA1	0b57803587ff611e8cc6a2e4086deb6868efaf50
SHA256	ee86496d8e653daa734d0c9a755e0c81773c30beaf31c96707f7705216fcd294
SSDeep	768:noSWw0eLgnaKz3F42LrNDPrBzrLvgJzi/hLjJAyXzDGHm6zI7KBB5PIzHGK:noSHX8aKz3Cw5XBzrzgshO6GHm6ccB5E

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.63 KB
MD5	0d1257e8f7fe3ce2b5036a64c8bffc71
SHA1	f46e4b02ecbfba88d1e8a08da6871ef8eb0a4739
SHA256	05bdeee81ac2cc6371f1b6295cc08427784c6007cfbb2e7f1016a5114598a72c
SSDeep	12:4ZUk5IGczs4d1wZAL6VABautlPtIbmYn46icgsWn74lG:wSR/d1w5kPtlPtIbmo4XcPSUlG

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.69 KB
MD5	1d086a21a3a39ca3ce9ba1b24ddc1dbe
SHA1	f43b2d285e60e9283fae20c2abb8fb80bc8a21bb
SHA256	dc4bcc5593099a77fdadaaaa8aa558f091b7aa5d696bd2afbf4c0e573b54e74d
SSDeep	12:CJuCkYsA+RO2scuHP0dXM2fPIwhpLdaD0YdW7D/mmp:CpjsFOTvwM6JaeHp

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.31 KB
MD5	cd854ac7d46f3c401da01ee142843e66
SHA1	f5d4d8590a0d090fff656d95a2161aba3444e31d
SHA256	a3b02b6bf6f3cbda45c1ac9413f30fccd892515872409d6d376725f663c3fd85
SSDeep	6:dXm+tV7VeqOVECWyVLF9CQJ10kNCpa5T7Qt8Tz2cyjuPaEVxiAUFWU5XbKki6YKd:dXJDVkWgLF0QJmECagOH7ydN95LE6Y6l

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\05_Pictures_taken_in_the_last_month.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.05 KB
MD5	36610d53154aacff1edddd8bc95c5d40
SHA1	f617f05fbb442bdb776c72137ae3a3829e425da7
SHA256	56e26a1806ec7835d2a98818323201855cbad17b79ce203dcf3423ee33a5ea4f
SSDeep	24:zie4dox63shgJXteltCBRew0P13Yjy62/g6xVvGf3N3vYIHJp:FeVcmMtCTWd76z6xVgmo

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	98df39d7223e29bb4698c2e10b1e5650
SHA1	85041aa251252ddfa7b0e42fa92ed647db076bfb
SHA256	a4700ed7aa01f69b38da036a341ce928cff6360a7f1635884f446ad196039a24
SSDeep	12:cr1ByykyeOCefcX8sgWgpTURvPfbbVGx3yxnloOklwDf3umLy5o9m5w1h:caXy88ssM/bbV83yxn6uVLy2450

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\F88zOsP5WvaL7g.bmp

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	67.35 KB
MD5	a29b7fac4a0405877b15e3a70bc20fff
SHA1	3811a30bcff4c9da851446aa20c160a25ee55e31
SHA256	c58cbd76d50dce16bc88266baf33afdc91ee97b9342c841f7cf6232029b197af
SSDeep	1536:U2nZ3M0pQ1/ET2Z8t7c+nLPRcW+ljluJWNnNftf4W5:jnZ3HpQqimTRcVAJWNbb5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	b4cffe92308b1a714c946fc751db91a1
SHA1	a22c7b670e93281303440c80aa99bc099296ad39
SHA256	d5b1cab04ee5edbf21a991669915cb6ea98174803b205270ce290cd10bfb43da
SSDeep	12:6qFjI6fZNia9hK7oUWqannZ7eJFLaeV6Qr2cR2Bcgxp+WsKAnJp5weyQFXNW:VEaC7oUmnZ0bVjR2GWsxpiez8

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	885.78 KB
MD5	ed9c7b93a138c1c068472b037e3b0bfc
SHA1	6a14ca3308bf4a52055c78310b3ac18c933d449a
SHA256	566d9a1b01a2fa0f8a17d6345d706d12c76d0e41d5eb095b7eb4bc050f78765f
SSDeep	24576:GHl941hWo0XkcgJ3Jm0lLat4KNgtjfx+IiHnFsr48lJ28G:cQF00Lb6abRpiWr48lJdG

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\mapisvc.inf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.38 KB
MD5	1b45dcb9e2e8673b55dbec7662171673
SHA1	65208fdd6d8a65b565d0523c7ea0560674d2b72b
SHA256	0001855567f1c9a53e4091c2be474a8b6a2bd18b38f69fe1bac5a9f2e03feb12
SSDeep	24:dnA+QLSrxJEuWHst11Zdfl0QHtJXedWxMgkjerj+rsnKFsxdLGMQU2K6v/:sgchYVkxerj7nzXZQUYH

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.89 KB
MD5	87bbf931d19605c107b13e9c3722d798
SHA1	e4c3590d883f968894edcec85668900a802714b7
SHA256	31070684baf6f5d55de01007420c09c2abc6be0ac6db7d0ff8cec84f65fe834f
SSDeep	48:Fs76zWHB/KsQR8ELsZfsKIm7Pa7eCXWQCWS3SW58MbdzmlUgoXkiE:Fs7xH1ZEKIm7P4eCOnU3KvfE

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	28.28 KB
MD5	4d96426b472e52017b4225b0bc08cb14
SHA1	d79a8f3e89b363dc7e57a9c86666d8180a657111
SHA256	9746d4f0d20b39bad9a6a73b9ce029b89eeda3bb13d764da356f124f6d839737
SSDeep	768:3hOoQqG22UcmCNlANW+Zbk6phoe3kiNOrxXLR:ROoQl22NmCNSQ+1p+9WidR

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	52d7e15bd02f64d7a8ab1674a56d9b3a
SHA1	e3d39334600c7a10958c825cae6d528369ded159
SHA256	9392d200132e89d740010cf9967292c0ba50eb245b67fe8884ad172860c85cb1
SSDeep	12:YVVS8gfbgwqga4njAWSxuvVRQFnVnHV9HWRursuPu0Qvz2zP/UdGn:SVSfZi4nMWSxuvV0z92Ru2/zEnUsn

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\ZokWWlhWpdCTwCQftX.bmp

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	81.05 KB
MD5	7659d58e070cd35a954e89fc794a1672
SHA1	9e991f0f28d7ad18e845f44e2c9e16890033e625
SHA256	3a9031816ab9a9015c30bd00d84d2237e472e0cf0252b92d722e119c4ae43693
SSDeep	1536:TT1XLMt1uyHcRgP7mYxDwsbT96CljXKliMyHwLm6ftPJlRDsVUrqI1YmeS:TT1XLnacUx1X12MMkat9cBmV

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\4BiFrslJ-KXrZhd.flv

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	72.60 KB
MD5	d147c4dd4b33cb7ca06f116d86ecb2c2
SHA1	c804f89db8adafd80b13b22e79c5421ebaeca927
SHA256	b6a38f962412ccca77cbb1fba0bbeddde11b7abb3388395f412407d7c35d7dc6
SSDeep	1536:+UlIEFioeR4PFZ32CjPwYUD9mhuBv4vHJXg/FX8pwgV7sT9hR5cfq:+ToeRSFJ2CjPwYUDGuBv4+/WppGhnEq

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Ch74UvQlC.png

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	58.35 KB
MD5	e7d0f8550bd2dcf670447381f497e446
SHA1	2dd521b4cb59d5401e3a1c6f91dbaa743816350a
SHA256	30f5d8797cd0ef9f0ae306c11a4dbaa50d39e428ce595bb31863ec821b5c7287
SSDeep	1536:mz5kgxd3E4ZRXLSw+OjrqDbOb2uSWvwEuKcsVjxg:q/3tZD+ym+lSWoKxVa

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\1QW23kUKzG_G-0v.pptx

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	88.91 KB
MD5	ed49482ef07807cd1470437dcfe71816
SHA1	ecea4e68f94854f26715865e38f4ee672faac28a
SHA256	23438f3e958d1d7883798cb6aed7a0341a724736e4a5d9e1be1d86546ae060a2
SSDeep	1536:wEk3eP0/uXfWQElYfgppZcTKmp6dD/4axhEaiMinnYVJBvq7T3gZSS:w/uPJWyWcTz8D/4aXPiYVrITCb

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\31k449TTNPE.jpg

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	49.53 KB
MD5	30389ed9de02b93422a521c113800ad1
SHA1	69847d1a0d21a14b0e722aabafffdd129f73de54
SHA256	1c0c6bdb8a1045c8e8e316c7c1a398df67c0df4b26ce7a41897155a419884a4c
SSDeep	1536:Eyd7nsRnflUbidfIFWARN46/05XUyJJm2HrJ:z29UbidGxRNT0K2LJ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	41.77 KB
MD5	3ca37bcbbdc30bc0861d17aac6b26d3e
SHA1	b84283c87143dc688da858a3eea196284def402e
SHA256	ae077dccad35d16a51cdf4dcd8c4a698bbda0e9a36091c7e504835ed461db5d0
SSDeep	768:8pqbnh0qjMsac+9uVkYBBy0EaF/3/UCBzXXGNpv7KG3Y:8p+0IMsahKk1S1P1BzC95I

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\03_Music_rated_at_4_or_5_stars.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.52 KB
MD5	bc3a2c5c3dd985b63364bc30284eeff6
SHA1	01e30713c2e9d6a096646f203a6d5c4684c77951
SHA256	28098987829f90e3f42c372b05f47f8960af088419295be500820d406afceaee
SSDeep	48:1s0Kvw2f491G2mbhcsXO4gbboye1aqfFECt:1s0HmjXO4HXMqf/t

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	11.83 KB
MD5	de6e9fdea961e067ba38df98fa075a0e
SHA1	2fdfd89a3238ed22194f2f1b98a35824209b1306
SHA256	4e96932c7a0031d1ad86eb8224e8cb59ec0a7af3b1d2eb3b0a8c37768067b70a
SSDeep	192:7RQekrtW882SxWP0QQUFFRD82qnnV20Hyhp5fN4s3CqfltXvVHgGWQ+Ag2ruYsZ4:NpkrtWDW0BAInVdQp5es3CELRQE9s9hK

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\mENX.png

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	61.08 KB
MD5	57f0743ee3347d80f937ce8e1903804a
SHA1	1edc3cd00204a1ec68440b33bac8a8c29ca3042e
SHA256	5f98f8e8c41d4761edfbb31f45b9d9ffb6416fb231aed4b631a3be50d6da9813
SSDeep	1536:v02oxfg6VPn5VLJXkBwLpujWUG3AjwiF6+H1VU+Ot/z:v02oFfMmcyUG34TZH1V/Yz

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\kfGzsrdqo_r0wo.mkv

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	60.78 KB
MD5	5e300b3ab312362404a56eeeb0f5caf2
SHA1	0b0af0aa7d285e211191461e048de5af461bfdf0
SHA256	d8827ea8d6ac1bd974898a26c2fa58a7c9ad6812112d1dd91e3813a1912b7e77
SSDeep	1536:PgrE0cUXGU5V238uH8Vx6LEzp1Muv1Geb1:PgrE3UF5VU8uHAV1doeR

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\AdobeARM.log

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.72 KB
MD5	95771b515acae86d70eee1a3d0372c9d
SHA1	7167dc860d460899e46ac02a25a57760ef4000bf
SHA256	5a78d65d27dd7b3ce17dc641ded4a63d294508a253acdc3b16346621cc5d8521
SSDeep	48:cNb45WdwOPjdPjDmlwFk5v/dYZb5dbD+zx82KJ:cWjOjJSlwC5vFYR5pO82U

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\C- nMrMwd.mkv

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	72.63 KB
MD5	80920484cb911226f1a63dddf4dac70c
SHA1	950fbfd3d9c914f62f652824e73d2da60babeff8
SHA256	4c0a2bea3554677b283612f16788d634b7fc660ad148032b6a944247b66ddc68
SSDeep	1536:GMYwHn4CYzGb1bZofSaNASdFwHB8LiDxZiYmFD/2lNQyZgaSxK:GMXVof7AucBqiDvgFaraK

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	5fc86e894d345733abbe80bb11801845
SHA1	ba84dd931901fc843b6a9a7d3f2dcf6bd2eca6f0
SHA256	86e6c49dc010114e1640e8b76cea407a68ea422d3579ef03ced591917580e384
SSDeep	12:VJQmOLQDuzL7doNrEiAHl54PVvApOFkRFeAt/0ovxZr8DOAw7E3lxDngqC:VJwLf62iAHl54PtqOFkRYAt/0oZZEw77

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Outlook\Outlook.srs

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.78 KB
MD5	0b8256db02ee17d014e1a93097d5272b
SHA1	d8c302da369aeebf834baf2e79fe7448249a5f8e
SHA256	73aa7dd594fb5ec9cb42b6a011433b0eaf7409c776175ba73c3865d68c1e4095
SSDeep	48:8NP+yVnBlIIbPyxBaTlV2qcoSK9AmNpTRPp+53auzGnzGuq+PsVErkfZw2mgt/Tu:goIjyxTfod9dPpea4GnzGtc9kRXVxcqM

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	181.28 KB
MD5	3683ced7d57ece3fb413b5474ccd8827
SHA1	95ff6604b1185e5ac2368254b77b686258ab70ff
SHA256	8fa308fce8fc3a6b9804fbb551afbc4e192b5c3b304b2f9239b6a961115e721d
SSDeep	3072:b2y2Wt99mVeDUJCQ1RySd7tF07Fb5vHpFjQONN1776QTw6sCq3vufzRuJ3gfuyKs:ztvmVeDUJX1RySdjwFlR1zN76ButuJOB

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.00 KB
MD5	fcc3e3898a8596fc940edacc396765a7
SHA1	18098f0c8746fcaec6edc8fb86975d3b90fe2c08
SHA256	0fac8efe0441aee43b20c9925e5688293efc1f4be4baf972308b30e09b106303
SSDeep	48:tBDyH47DILq3k0wqnQpmmiC1IvpAYyve8CSbQL/:P+6DbU0w2wNiGIhwWybQz

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	8a33ad8940903ed056413f90a8870562
SHA1	42f0b3b760c3225c267360b917b70c48a4f40f4a
SHA256	2047bfb46eb10e2d3e67c296ba2770f1b33627ddf3ed8bed5c8487d5138d91ef
SSDeep	12:f6bdJlDMbjzhKCIdQ2LL/lMjBkiU95Skk6LqAdWPYds3biEUBlyld99aVroVqnYh:yPKF/ISML/lM9zUBk8IPYS3AnylTQVra

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	9459413bf092755f90492f39c4f27edb
SHA1	e61558363727134145dbc07c25f22de7bf55bf36
SHA256	31f3ada352128ab9c4f0dc53dc627a0aab816832ae7f82919f7e8e77eb4158a3
SSDeep	12:ntZaWuoKwLmqXh5pNsIeQ3oh+YVCxJI7uF6o0n9276z50D:tkX+1x5pNs+36Cx0o0k46

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\02_Music_added_in_the_last_month.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.52 KB
MD5	20d01912f7bf2cdf1d41b6e845b879de
SHA1	5cb22997b79a7289a55079245e6df6bfcbcbf13c
SHA256	773bfd053bf667bc19b07979fd9207b741be8a97bbe101e72a1c095d01056bf0
SSDeep	24:cR9H1UtNzI2EwO0fWCa0NHz8f1HeZ/I9HekLCMULjYvn18lofEuma5UG8MEb:wViNcn0D5z8f8CULEn8ulG7Z

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\03_Music_rated_at_4_or_5_stars.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.52 KB
MD5	918ef01b78f891f7aa359ed7a6fd85ed
SHA1	65c6f0112f2d707fb349987494449ee6f7ac6156
SHA256	9cbb360f91094c4c75aec3c9b5cda048ade066a32c16bfda1943fd3bff277712
SSDeep	48:FFQaogBoe7nibpGucWofg3dbTx+DEdZDnudy:/fog5isuctfQhOy

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	90151cfca843ad4b3199d6218ee18f12
SHA1	194b8214e447d7635f235bc9382a453e0636bac2
SHA256	ef9c31c4b39dc0dce07224168adbfaa0093c33338a8dc044eb7234226eb0c6d6
SSDeep	12:nq9boY1vVchJcERtkpdZstGAGLXpqaPkFTJVtGSn6FC5nBmTO0cOJ++4w4K370Ae:q9boY1vEJrtesJyXMdJVDWoBkOaPp37I

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\ePJJOlStTcqgNK.doc

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	75.11 KB
MD5	d1fd9effdca63cc37bc07c244c8eb61b
SHA1	3e5191bc3f6b716aece22861f0fbe4dead5f776f
SHA256	0246b21c071dac0a4e5f5060b1d85c907fbc5b27b84c8b20c8d555e02abd3a38
SSDeep	1536:AgQYNHIod62UDdxtl1aOcPKaBzyD/aWf5y5MduNo5eRRbheBaff3:AkNood6X9ba3lKiWwM/iVWaff3

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	1627704a30a83dc7b30366b2300b9b08
SHA1	49cba1323be795d4c860a90197e736b1d5e57ec0
SHA256	937e6cc1d00f413e7e20269bcaa5e17ee04132e40ae8258b0bba5efcf130d6cb
SSDeep	12:s4J/5DSRQdYqDgh/z+PRrK8VY37Yh/KrEPtiK5hhqcL3uGxG39E3akZ62ffkYarF:sWBSRQCqDgh/iPpKCYEh/AEPoK5hNjuj

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\fbbe72db-afd8-443b-88dd-64b20388700d

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	a53f6f7d9cee83907ad63767efeeb32c
SHA1	072de27c57ff9d0227ddbdbd6337f952e0a70f0f
SHA256	e4ce5e8ea67ffd49f129fb5a703f3ad888d6d3a28be3c4f36e1b3e874064ed0b
SSDeep	12:+KSxwqsbSi8lvRIj8WzJbnqsjFQPZuewMH6zaAXMR8eZk9DyGPeX+7ivdU8Xn:YwpS7p2X2sKRueszQR8emRHPuACu8X

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	75.94 KB
MD5	d5e45fa5b0a6962e07d5c784e196fc98
SHA1	6b35f95a0d44e84347c83190f902d4ba175de0ee
SHA256	c06f22148dacc137fd1476b6406be0bdeadd2ccfbd8aae5c324e7fb2a2669549
SSDeep	1536:kRwE9HYv8tllf5bJyJt0D1o3bmLKVfzs83LFeSMl6eBnv9SGb:kiE96Y5bJwEoFp06e59SGb

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1DAF2884EC4DFA96BA4A58D4DBC9C406

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.53 KB
MD5	0c266bb8e36c26981e4c47ad4067ede8
SHA1	aad763b3c59b2bb4cf76dd83c494838dfd742fed
SHA256	22095ea3dcd1bb494099879dd34b30027bed20d1f6ea5e5f1e13e7cd8dd48379
SSDeep	12:sirCUwrjm0eYmS3adJUx0C5FcuOURbk+hF0doAQJRZO5P2n:s/U2xhqdJUxH5mu1A+hF0doHg1Q

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	f62ae104f0459c989b314a24acac9f05
SHA1	d1e5cf030cb08659315cf0b0348b569c21582f14
SHA256	a557beb3f6ff0c2d527e26797f08f4a6aac00b6a4765ef2368e6db5b0cce70ea
SSDeep	12:vA4wEmjYuM0bBSFAKADiZ9bfKKuCFrGp5BjORMgNhRjh1eaoFt29zh8O4ykCjL/e:Qx5MGKAKCKbFrQwNh9jM7Mzh8HTS/mB

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.00 KB
MD5	d1a64a7b1b4638e2c92077216627ab9a
SHA1	03448afa2601a63c072237f8f1b05409f82acf0b
SHA256	26674d821926fd7df6d50e0c8c718783863c867e88a63a258869e187387dbc39
SSDeep	48:RfVb3DMrf1hYAeyZF0jDAeowmLFeRYa51N/Bfz3xTyAbO:Rdb3Dw1CAeyZF0fAd5LuYkNdz3RDC

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.78 KB
MD5	920ecf87a63b7bfdba5c37d8c0e50463
SHA1	0eb80dd7ad1f7be8c370cbf3973b0c1c921e21f4
SHA256	d628d223f0ede319a9bd53f8d92ed635eb60ee23cd54ce97542748560b07e335
SSDeep	24:lLPB17iWwj71vO77sRCF9uLE9lZQV5yf1ESMz:ljB17ABW77se92slZm5O1E/z

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\07_TV_recorded_in_the_last_week.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.30 KB
MD5	2232d6e32b8fd6150964e1222c58c87b
SHA1	2bc6b6aadada56f010a4e18f25633afa5a383a0d
SHA256	89ec4486a8cb047f1bc7c1ce7ab27fa9cd68ecb175b149ce216dd78306cb9279
SSDeep	24:XeqFn+vFWcYWMNnA8ivSrK74iMgPgj/4bxNLcVeE0ws03pP6y0AGQaI3sGw2trNb:XeqFgFsWMNn46q4d14bxtJERhb06QGf/

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	3fcfb6c87493806bd9480b85b8e03cd5
SHA1	39f44938bc195b40d69136171a7c10427699a25b
SHA256	6391ad8d786ca72b049f286f3f771fba1084536b82c5885c4f08e4b1bba613a5
SSDeep	12:/h4K1+lEqWGGkcC1uwOlYx8/4mWNQpT0yy0KQjWdXgeqEAy0YDwtNfxjx:GK8lbPVcwJOl0dm6QpT0YKQjWdXgeRA/

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	32.28 KB
MD5	59168e57f56fba53a592717e25b9a502
SHA1	17ffae800dbc6af28cd059861694f3b05a916337
SHA256	85ac10192d8269f9ae53eec1c47974f083c178deeb03934cb5100df2f8ea2fe5
SSDeep	768:VHKM0eZpoLC4sBdMazggM1JXMkO/2Zv5d22QX4mQ4:UCZpP9zr0FaGv5m4mP

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\24L7aMD.pptx

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	85.49 KB
MD5	6729d6f8671da1884ad69ff3838fd43f
SHA1	0074d06611d88c5e1985499c7f9be51cd34534a7
SHA256	161efa11011e1c2d14a479140c1ff5c717233c133893c591cb11e4c60d485906
SSDeep	1536:EesLNW3OJOKPHP+dwjWnG3tPMAgplA6OaceVfbkWr2ueAQCkn8b/aYCMMN:BsJW3EPHP+dwjPtEjpC6OCfAWr2unQFD

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	9c0b8b976f7e0e9b2e6b438d17a5816c
SHA1	4f61d4fe34cec1af3ee6aa5fab33a8ae9a02866c
SHA256	edc1462b9921482601a0135b78ac89b52ee4b6dd4998445eedd5179ada2d68a5
SSDeep	12:NwnsCIQc+WakoZUuftLkl4yud1dA7Aah1f0JpCXErXB742lb:NZDjoZ11LAA1dAVW4XCB77F

C:\ProgramData\Microsoft\MF\Pending.GRL

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	14.89 KB
MD5	2ec65b9302acfe1eab9afe36337d9b12
SHA1	71da32ee72eaa44c9c4a72b05a2a439dbf981dc6
SHA256	38c4474b1296caa28ce156629d614a772f73f764108053ce81d95a0a1d39b052
SSDeep	192:SHz4S/sB+A54JZhWRa5DA2a2y+EmTptYRy7lKKBjq5egqhROABJ/nxnYU+cuDr:SXhH2RMVEeptisleiHLr/naU+cAr

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Xizw92iHqmCzA8.avi

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	25.97 KB
MD5	5662af7ffa67d491121ed70d4cffcbd3
SHA1	e3e957cabefaefc55b6f5e26466b6ce693a774b3
SHA256	48bfa59d1c026ff3060d971577d87668157836a9989454cd3d5d9e0e976afb69
SSDeep	768:gDAds+LwkgAS1Mj5KWE8RzVe+QN2/6i9rgmTZ:gD8CiTQ+S2RgmTZ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\brndlog.txt

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	12.21 KB
MD5	16e18a43ea1887e9706a530eb5ab287a
SHA1	b7c4c5f69c8dc30b3f0449f1aadf846b9fb2ac6f
SHA256	61a5eae08babbd7bf1a7a74f6135bc2acd9ecda335216f90c10f2b5962f428db
SSDeep	384:5A9/OSzSdtLT+kfv7NmVJB6ySc7+MjgtBa:5A9Rm1K8vg3B68+MjgtBa

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\PGShtx.flv

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	47.36 KB
MD5	203374ffa488f88e86ac73787c396799
SHA1	060cd135cb721db6cc1a1a76b50694d89ea76755
SHA256	d6b83c74926c634fada2050eadf1cbbbdb35c8b83f1d8528004128b318438a00
SSDeep	768:+p6JXx8HKakodbq7K/ZV7HU9CHMBlqzhJnSSuzXyUt6nLmZdLhbmmpyEgl:W6Z6tkuPxVzlWwSVZeSZFXm

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.77 KB
MD5	c3985c0948527c6eaa3c43a8c034a16d
SHA1	9a45145dbdc4145f8b19df21a2d2d0ba98689161
SHA256	44409680d1818c56bd076af5223cbde9587e770228d9763757fbc1781138a170
SSDeep	24:xxchV1e8mWesEuEkvEMI6xr3IOwqwl5W5KE/k:shSXsEu7t4OE5WUAk

C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	246.28 KB
MD5	7880b39e749d1cb7ed1ab93a096f8657
SHA1	9062935ad92abe63a1e5b07867285be37c770a02
SHA256	fc21803858556c1ab7a4397ffee49fb7319b10b86e1f982c5517a19b9a6e918e
SSDeep	6144:ArE6IYqNsnyD+I0jJ758UcY3yvG+nZC9jQssrw/6:MEX2nCG57cYCvdZCuH

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\StcAE2tTjZztvsvpV.pps

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	20.77 KB
MD5	19758a78cb887a8c9b64e378431cd6b2
SHA1	aef9c81e1a45ddfa3b4faf7abfdaf3a98406e613
SHA256	e095ab8cc40d7c3de924a05b323f1e3c757668ba8fe22c6baf0be698ab521e51
SSDeep	384:qYJbFDz1LnoPcHvMlRuAU2ErlF5aSDuGYu2GgITn8/mHVi2in:zbJ1LnScH0RFWrlF8CYrII/mHVi2in

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.63 KB
MD5	11db0f316cc378b78c20367d92ce3e2f
SHA1	84b68dc2dedae0ca53a46e95e451c77afd147231
SHA256	2613467d7daf1bcc7dd2c44d56df60dd833e15f2a1d3fb039b786271244c07b3
SSDeep	48:JNECDoYmPM+9qQ7y4lpdcP0WlIdW0NZn+SVyNKKjyGVx:bECEYmk+kmy4hwKdDNMuwKKjyqx

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.sig

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.41 KB
MD5	812de7d736c4e0822e5b1a50e1571ca6
SHA1	77dc5bc7a28a53639200f43b3a86feaca3c9e158
SHA256	30a47e09ff5772936c5c237f929c848fd6e3cfc1548508e83812e0719210100b
SSDeep	12:MxJORJ0vMpCdx1/HX+hHWOu85x6HjVT9GLF5YNuB:MsWvMpw3UEH6LF5Y+

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	c31bf49ba0387d5e489237933ded9d1f
SHA1	73961f38739547b33de71cf965d0a6f43727bcff
SHA256	1768b9778ac80d86e182d24efdb70a93cb91267e1b56ed78f9031f3f43890689
SSDeep	12:cK8o6H+Ro+WruPbOmCdb3w2amSLl/6gAgDUqmrsLOagTTExKyYO6vb6/Rnk0K9xF:7aHlbuPOw2amEN6xgDUZrsLOFfE/5g9P

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\12_All_Video.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.33 KB
MD5	4979666285a4ab5997cf79274d30b3b4
SHA1	31a67a523329334c124ed8cfa71df01498552d99
SHA256	a2ba3a785e4bf010db2ee87d237f82525e8f0edf2bc82e5481619468f9686bf5
SSDeep	24:rzG22KOJOSeg1erdMt3pLAhYHxZWiRQIY50XzJngZozDI4bGaQOE03AycP:rzGnKOBeZpM1ZAhsWiRJE0XFngZozDI3

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.cdf-ms

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.00 KB
MD5	3df1c409522484f0444819cf275f4e1e
SHA1	98397e85da7eeaf11d618e70528a5ad317b82ddd
SHA256	4d5a8ff9dd7eca98cd6e00de226db67676d87be175a07639bea1c3be0284c557
SSDeep	96:Oh35mR+04NSvnAV7tisPR0RtDmwJQ/XRuJn4HpoQyaR8qek:OF50+hSgRiTnJiX0J4Hpo7aCq9

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	37a999167731d3a817cb93e12d554e28
SHA1	320404d58a5c4a3c170e462f1afb190dec6c373a
SHA256	2342761bf31ef58385a5cd33a21dcb3c530215c3d78e5377469ffd299aefb35d
SSDeep	12:H1O6jGJrOZ/Lz/iyrDls3fwObkpmTFLHQPX5eSNuvQdy400MT4S6mBmm8SaT:H19oMaynliP1Qv5J460tT4Cmm6T

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	dce2e3f651fb15b191c46460f116f237
SHA1	038f9c010306591fc7edb232a6996403c462b2cd
SHA256	5d9de2d90a6814aa47b2bb07cef18af5259cb4859ff92abca33e520bcbbab8b4
SSDeep	12:Bw5pNIQ936uzrGWY3cwP0LkG7Iy2tvlaw02ERguJLEgUVIweFpn3xr:B+MuMOwGT2ttaw0zZJLEgTwqp3xr

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\12_All_Video.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.33 KB
MD5	7d554c0f8df2b1c4a743ae243fedf687
SHA1	c5369151d7b12d4781f49c30b80d2c24d1cef88d
SHA256	617bdd6f9464b572db2ae1caf83ab45eafe2669f99e716aec0f16bd84f441b26
SSDeep	24:6JwYrMm2fS3A0e2S8f6dL1mhRicshVAZ+9ieucsoOS9wtsWarWhtI:2Bglq3A0/hf6dL1mXiVVj9ilAw2wI

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	128.28 KB
MD5	fa5cf4755a2eedd3736adee4a05afddb
SHA1	19eeee26ab2f95f2730d052560e381657029cb0f
SHA256	94f05de990b91e9702e57ac9b64f647a815307fd81a9d585ce19fcc4eb63401a
SSDeep	3072:5ZOqVlKDaGFGAvz8Yp6ixNAK1Pzn5cHQGNrnzJl:5ZOkPGFjzvp6iUIwQGFv

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	240.49 KB
MD5	0a3a2956db370003bef1a253b46e560d
SHA1	0e023b9f32a2731277f386d66cf8a3eedf327113
SHA256	1e9205432c385194d89407bd6dbeeeb99e5ac257fd3ca64de4d8408a2919c1a8
SSDeep	6144:8fG254sJLRflHxdH4ottmgUv0cQH51Hm76tg:ghLRflHTlt8aHZdHg

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	34.56 KB
MD5	56f6181c221967e744418a712971c06e
SHA1	102ba6a48cd773a38ef537e02823e1a2cfcc925c
SHA256	1b56a75d6f634bb8916ace5b123511de0d5fdec9c0e94c437158eb8f6289ad51
SSDeep	768:dJABvhzFIdVlOqZ0tqAnkD4kBPIypFsqCri88QJOgOh:7ABJRId71cqAnaxrJX88QJOR

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	81862b536b43988743893c51f3e91e14
SHA1	6fcad16b400b7cce0998fb92cc78cae2392c63f4
SHA256	960e8e18c45467828af837ea10c653aa161652c8b12fdbfd569b994a42fdcad6
SSDeep	12:+AnAWinpH576x+wxkAY+8/mUcgeaEN+eAHbdsm60DSSWhAB6yd8QR5oHXHwNuBp3:/nAHZ76IwxS+8/NE+eSdhLiyd3vo3HIG

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\-Wn- 5eycDY.ppt

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	30.02 KB
MD5	e2b678d72bd1f7032caf4f37fd03b118
SHA1	100801c2648ea80534edbc3a242425ce5f556092
SHA256	6623b7865276ede349a414e32273fccdcebb753025cad7d73d04101a154cb562
SSDeep	768:rytrTcr15dn1wp24gChG+U8sVn8MOizX4ki+9xh4zt+G:ekY2sqn8zizoJ+9x+ztB

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.02 MB
MD5	7a084599dd80da44b93df30d99a4fae4
SHA1	fe6d274822c9cbc77f7bc11a9f1f0d05fb693acf
SHA256	e1f0a1ee0e6c4d617df515f3544b0da25860630d25ee8a0a465fa8ae51adcf4e
SSDeep	24576:y1gRDU7+BlkRsSsD5g7UYMwfC/YnmplCltreVgkLx:y1gRDU6BpnwxdltRi

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	0c4d8e082199f05dae02a0ac67214d5f
SHA1	e84cf84f6459a68a3556645cbc1a9d8395b50906
SHA256	213a065860d48c3a057a2c7cb6303514dd9261939e209830c3be719103a566cb
SSDeep	12:siC58/efQqDrNt8LykJjUOQhxNghiPE24FmBrx7HstoZH9bjxsFQQc:A5pfRDrP83pZGghiP0FmBrZnZHVHR

C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.00 MB
MD5	98471a4cf3e54df2296b2ab951280c22
SHA1	b6fedeb8e76a4231b9cdeceb6efb791cc6e306a7
SHA256	531664317f2f71e7d36aec41b4bcd27665f370aa419daf364896d16369cff6a0
SSDeep	196608:LK+vt6jPAgl8DH2+Qo4iT6YqQitS7+KgxUzGVw9vV+Ud5CP46ZjNK:LcNI6xdBISxUzGVw7+YMggK

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.56 KB
MD5	f80c5ce56558f7ef1667a76fd1614188
SHA1	4fb2cb681f092c358b4fabe02e66a7d8e51617c5
SHA256	3a7361f081fc9cdcb76674839abf92f348b1e1cf6fec8bb0ba6f5ebd23f55e57
SSDeep	12:ScniME+PbZOkcvmpq2LsGn/BU3/uX+ClFQdCvJBbH3v:ScHEU9dq2LsieuZDv

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.00 KB
MD5	7fd64eacb1d71f55d15e455162c4e652
SHA1	a37415c24e106f96b0723f02350c9840ab8e07d4
SHA256	ba49acee7bdb5a38408eb99048ab088c96786be267110cb2c1790247342c55b3
SSDeep	48:L8Z02iyJTkdPN99j7pAaXzHoJ6jK3YsaAXMeZlSRRcMGaQRFRe:wZ02xJQhNHFAa76MAXM4IRRcMG5Te

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	abc42ff6e32d0c7bf6b38a24e14c6033
SHA1	0b8d330e22a749e3fc78041ba4d5f8691908c0e8
SHA256	62bef7aaae85cada3c7c3932238aaf81fa9f0f4f219e9240fd2867d69011ebaa
SSDeep	12:MmLquSkBLQWZD+iudy7AKI9LvCkdTop5rkQ38CiKl0ZTJRA8Ls2KBB6oV9ba3mW3:1qKiWABAAjzNIrkQ38vK+TJCos2KW+NI

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	37.10 KB
MD5	4a3f0ebb029464cc6106df168750300b
SHA1	35cb2afd141c95ec8eaadc3dbb5871924d023967
SHA256	23d8cda0e22a2bdd4e7e402130c151529bee295f640dcb25dff0d314832a7aba
SSDeep	768:4J83jXdmEq+Zf8s8UVaDxOzu5vweAp+ZCFFfx3Rh2lQbdvI0NH+ylTgMEbDo:4J8zXQEqgyUUdOzu58p+yLuQbVCylTdj

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	6f4892fd4203a8c279abdf2327426953
SHA1	a84c0b57a6c5e5a840e245cc10e80949c93dbbc6
SHA256	4ee26f63f5af8e1cbc024270fd499d5067a40b24fb9bc09a4b1b3ea027ee8a95
SSDeep	12:NvOhl4tW4fQb55zeYUdDBpVBodlxXSLKxpbUFdyBYnUPjz5RZwrnEHWtlLrR981:5iaxuzeYEDBhul0LKxpbUFwBNRZwrnE9

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7396C420A8E1BC1DA97F1AF0D10BAD21

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.81 KB
MD5	6ec2e3d20bf1f8eec18175786a74100c
SHA1	a75bc6a99133feda12e8bacc97d5b1dbdfe40152
SHA256	fd6ce1e44f407d5632eedb834cc85f5146715bd2cc91324ebb7bf772a5564767
SSDeep	24:JSBnnpFsWdygJlm03IsYWJ+kmDweSnXBZS4ait:ARI7g+03IsRSwNXzSIt

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	9d430e9d2662d8db987e868021c44970
SHA1	aae6460a1e128087943cecfc1db08808ac5b3ab8
SHA256	e6f8fc570867a9bcdb2044cc1fccaf2cd496024f4860ad81639fb1d2c15ace84
SSDeep	12:cta38/5xGoUJo/ixbj30Axjr9+czLr/mtdJfyWiFKSG1acKhqUb7+PxH4+z:cQCvGW/i1jRJp+S/meFlcKhqUb7+Z4M

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3130B1871A126520A8C47861EFE3ED4D

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.78 KB
MD5	bc38eedbe85206c1e2086df2a739236f
SHA1	e97e9099fa1270aae62f3ff219cbdd412609b90b
SHA256	399c0af97db848a94c1af630e65725fadb7f98b502af3400f304046af1fbdb67
SSDeep	24:jUcwM0ucEzEt292CAWmHoH7IHVYm4C1NUFNEVF6L6q:jUcwM0TQ9TADHobj214mVK

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.78 KB
MD5	9a74bd5a57296a3e70e67f66acadd546
SHA1	020fcaca4a9bf11116e16d641233cf150000b133
SHA256	15cf734ac6a4d5d862b5533d8af62e2f792be4e3d8e9a3f47b888573ce8d4cd4
SSDeep	96:Ti572MyZ0b4OCiV7WSDI7TF4zMyWdwa3TX5GRM6:XM80bNlDIPF4IvH3Ty

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.60 KB
MD5	42ee2ebf73fac57b28faa8f934eaeb64
SHA1	ce11684a79a85c66743180a1b22e58e0b5dafb96
SHA256	09768b3fa78767b0dffe7fdf078b3abf185423c61cb00ab7582c7b3c01bfa6c4
SSDeep	12:cEa3hIWKDJjLIpywE8SvH3FXRA3nYkJSCFbq4c4q2RWgFrxcbWm/oOUgn7Gl:43enIcxpATlbqKqTyTv

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	135.49 KB
MD5	00589b95ce7c6813430c31755105c923
SHA1	517407c2fe6e4e8656aace74573faea54acc0adf
SHA256	1edbcb1135623ca774eef47e03581feef16c2529b0622bd48578b9d5b7de0417
SSDeep	3072:ObIYLcHXqh8y5QZUASjjRqctrO8SykXzvh9ieuqXIBU:ObFcHXV4iFUjR5dobLhfIu

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.69 KB
MD5	4ca06ebb4c4806d0e8b7426845554884
SHA1	16680f60555e56da175701032247bbdf3c737760
SHA256	4f49ff310e5112ef3b0681e6d26aae8b918e358a2d0b12746a9878ca255ff69a
SSDeep	48:sodlinVUN5eW4VusoYmPZnz/G057kBQl63Zb:sovinSr6pAnjG057KQgN

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.69 KB
MD5	62f726654dc966ed03da6c72824c206b
SHA1	5d9d2af62feb7907abad7d2781426b205064c2ad
SHA256	2cdcd962aee2781ebc23f1a976796d384abb9b305bbf9ae779ea7fbf68c5af5c
SSDeep	12:klD5l+i80ucp8ROGQcrw6NVQThOT+CdUKoDr0Q8vRBxIUpIAXBAyo4n:sPGV7R3RQNO7SKoDQNpu4n

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.67 KB
MD5	57dfdf6bc328d8ebd9b6ae921ab22dc4
SHA1	fdbfe75937ee14f4539aa99b7e96ac65a09446ec
SHA256	3fb75395c4b3f4d087bfc6ea506d2266af47aac5c93aa62950dec34836164f0f
SSDeep	24:BWNZpJtShk2j4JVk5ydNG/8PISgAoY7MQG7xe0XM+XpAm3fhN7PGYhO7NsYnlBUr:+1lVGv9+GvXZAmZ8eN+l+r

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	dca5f9e9e5340e2bc0bbda530976d71a
SHA1	48fcb37bc0ad298641bda58fb5498e0353cb1e2f
SHA256	af3ee2418e93b2f5b839e8aa193c1df004d698d59356af524e40703c055a8348
SSDeep	12:ZAQI/7gUCNSPnnYSKOX/aNLp3wCFeB1uNuMrxz9xg2vhYBzmQiP:+QIz6UnY5PX3oBgNVhgiYBzmv

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.75 KB
MD5	aa333346327b9ada58699cf936aaa6b9
SHA1	0605c3956522e8a6e689c5dcc0170e13bc3a3e16
SHA256	ba09a56dca04f4b0c62dcd4795cf827e154816365b715d697841bc3318437d1d
SSDeep	48:GyiJ8G57Vb0wmESg2qLmZSWd0Ia+w7FgkaVukVrN:g8G5t1mESg2qL6S57mdV9pN

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\ACECache11.lst

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.42 KB
MD5	af659794f2a93c4f9508bb1e94a48d67
SHA1	749a94e2829629283582e52658b9aa80ee658ef9
SHA256	16b8a1a4c0c50a360cb4fb3e1bbdc8f2275b678bbd7a1d2f01fe7d1da6569db7
SSDeep	24:BuRuASNYOvoPIqQIiwcsw0pKjHiu/EYBvjNreXceaauLm/ThBIVwA+E:0RAqZIdDsw0wjHiu/vhe+LSTgaAd

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\4g1U.gif

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	73.53 KB
MD5	d8e963074982ad8dcae0714f9565abfb
SHA1	554fbede191db84356b41db3ebb516a6bf50f7c6
SHA256	bb3242a32f96e04c555237ad9a63d1a25c3d2a3693e3577bb3f9b77b81381b64
SSDeep	1536:QyVznW1WhLRJWa2bNuSlZGH2SYsVH+QwvX14jba60Cq43Ji/5yxjaYOl1ooJYk6:QydW1WhL7DZOZjgH+lvQuEqUiwxjm76

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.69 KB
MD5	2db966d5262e4f444d61df7f68c6cecb
SHA1	529fbea6f9976716aea3d33f84a0f44338e22e26
SHA256	278054bbf841fb494492a3b56c4b8d6ab9cde208c6f5ddcb20f7fdcb46899bf7
SSDeep	12:X1pd4OFc6cxqQvWbqEirWsg1DwKfMriWEH8xW5500pCxOK4Qp99CE2fKXJ3QAFzc:XHd4OFc6cxqwWbag19MriXHdXEgQp99U

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Fn18QvLhrLaviua8VE.swf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	97.47 KB
MD5	cf75e660ad1be3a02d3b74657165ff47
SHA1	d406508751be2ed1adb35d89d2b24c8c84eab97c
SHA256	c3ae52a13b476e161e2fd1bc57584e764ab31ec46e8ecc57bfa0fc3d2cba4ec4
SSDeep	1536:R1LpjLXpWdpeaq8RFo1uIRTulOxCRxopW7gejvISGh8H2224ipEYp9AC:zF3Qrhq8RFllO0vH0ejASqseEYh

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	0b0ceeb951f5a6334a05efb0c2fcb11c
SHA1	8a4eef0f0b491ded4a2ffb69eac4d07707fe427e
SHA256	9ab2f7f1fae6fcd99184591e4291585019204d5dbd5b58b3d70e913f33581308
SSDeep	12:H/f2fw7bnvmKevVpMICRyg25OlDQFSu6MOif0iAUaY0ac5ZkGD45BKakR:Hcw7bJevnM5ygdi8ifTA9acK5BKaC

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	28.28 KB
MD5	ffc74800d0fe4fc5ff26018719163093
SHA1	e4f599dcce589d4f771288fd74414d406f464bc5
SHA256	ba5c92040d4a391defe0112899a0b7015dc5a4b5745888bf73114fc3a8e18be9
SSDeep	768:kwqX8QRykCbI30GnuvZ6Q+75vq1GkH4i+VDrlkI5:kwmvRykCR0Qvk41TH4LhrN5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\MS Project\14\1033\Global.MPT

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	381.78 KB
MD5	a12ded158a03289ca9459e10a6d2d003
SHA1	2ae513c0d392a4d9b0291b84270d789427b8359a
SHA256	e43c4f0301e51d88df319cb13f472a56f973a347078f73cd11d3b31e29314428
SSDeep	6144:ris7O4zIXSLtZ9Nbq8cKEDElVHwqYQbOlokp5EePwXUT9rhvM5Ln7Gf3B9aYV7y2:rE4xf9NG8cGEloUtPNhM6pMW7HF

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.66 KB
MD5	e3afc148c69b220d4ffb246126e170d4
SHA1	026d78dee8752d73519b9d7a2db50a7b1976446e
SHA256	f11683de80ead230b6262a5409a06298bd3e44846f6912b0ae83077e32438cc3
SSDeep	24:xWrk72ttjRvhNLC1vw6VcbhaR4m1lgzO5J9HNajfzeQiBCspBSV7uRGRX0Nnxprb:XcDLCoEccmb6b9kjr1spBHZxvCG

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\PNHi.csv

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	46.03 KB
MD5	ffa940a757f6891644fd1c15987e9bd1
SHA1	77609ce419cb7c943ee823c16be12443333f536a
SHA256	305db7944ee02dff7c49d81d637916fa72c34b4c2158b49330bd4e6371f329b8
SSDeep	768:dqnXP5BE61UPpLcPQIhu45T26WkTnksEUwSCSIoYNUFfLWOOrJKdtt7i+XXq9Jak:d25WPpR45W8nksEUTu3KW7JKR7i0uMzY

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\06_Pictures_rated_4_or_5_stars.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.05 KB
MD5	59e32286d6a0c6bbc3904bef2d6c8f93
SHA1	b92b8b952d1d5bb530353c44dd0e2c5236c82791
SHA256	66ce3a08fd7fdfb4f0e911299a144d443e9c0da96aaffe580fb520c70337caf3
SSDeep	24:FqkZSR/2SlSgU/fozGbfCmoeVrixvJLckgg34d4SzP5:FqYKe3gU/QkqoiHLcRgxSL5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.49 KB
MD5	1f1192b968b5cd8158985628cec0243a
SHA1	11812d4d751532de079e4b44bf4fb14928fabbe4
SHA256	60985279e4de4a47eb188bef0348db4739c974e3e2cc862bbfd52f964c491287
SSDeep	12:hB4xYm4mMTVMZsnSo2KI9zIWP0h03mq0YPiIeLabCNkdlbuM:h7e2So2D9zch8gYaIeLe5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\yhE-03.pps

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	25.61 KB
MD5	ec11e3b8053283bc9c280693fa2bd439
SHA1	baf1bc0f751c9ba89cb996c50a17913382ac77bc
SHA256	2c66a19de6dc88d245f6580aad5bc45efa7dc52607bdfa34ba4d1643653f6c75
SSDeep	768:E9EtlvMUcGsXoLznm62b+YACwRLM+kEvYC+:E9nGsXoLzm63YACwRwEg

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.06 KB
MD5	6c7c99a60941b9eaceb6d786d04f7567
SHA1	8bac6f7379b4a7ca8605389f53b65e005cadffdf
SHA256	85850fda282d7b561a81e8fe0c8a7ac5e1c415153293173ef8691d0d8346bc8d
SSDeep	24:hpQ3U+vpuXbYcaea/506kizAAMJAXbpwE/YkiZC8316Y:fB+ikrem5nMAI4lwqYxdh

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.10 KB
MD5	656542ece5f1bc199b06acd04d2a89f1
SHA1	3563f2b364883292917eeca8965ca0d6bd928627
SHA256	cf93c63004db18d47e48762bfde4c0f53f521f44919ad89b960ca5df1e72a65f
SSDeep	24:1optkXrf2EjDpQzCZ1EVz2ywadXJJSnmiOEXCWqf7Vpl:apterf2EjVLZ1EJfSnmi1e7Dl

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.85 KB
MD5	5b33a08150baad51f173a3368a217931
SHA1	c9d3d2157dabb8272a5b2727c785f89d060f2eda
SHA256	15293eac3ab095759bf587c9eef5e593c01c96eb9831235ce82fc8c8cc81efa7
SSDeep	48:OvhtMY1jHn4e5gLqK5iMjA1Ec3tuFPN0sBf3enD7OzkaIB:WtZMfLaft0BeWzkaIB

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\YYEW1wYK6Oxi.odt

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	57.69 KB
MD5	fa89d8996395be9d409bdc577421b41a
SHA1	5e0f7843851bc0f0374f3eafeacbfcce627be4ff
SHA256	404018b34facfbd7cfbfa977e00dde770ff2b1f735b7093bd9f88faac3e4de58
SSDeep	1536:mVlp4VT19Qj1xLG0SJ2ebuapHZyJQ4lrnsSe0DWtTIHw6:UpsU5xKjJ2e6apHmQOsfntT0F

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.52 KB
MD5	08a67321a8782e2b1af75e8dda89dd10
SHA1	435b45ce68eb88624a4d0d566d80cdd958843a3d
SHA256	26c62bf57dfe0fde5f7de92e90755d585ae844424ece49d2b2fd03d1e9d00738
SSDeep	12:m2dPaxNdV94970Wkg62ACPIJ7DglSxur6MOPkvigtEiDB:ddPSNdV98wW/62ApdnPkvLEgB

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\nMUAm.odt

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	47.17 KB
MD5	f0122351a5ba8c72669d48a81c8cb37e
SHA1	235c3a89e66ce3fb565b187d02b67016b6c5a74d
SHA256	b4d6caaa3bff8aec23c9c0a85fbfb8a91dc15e28dad7aa8643adb59921374d7e
SSDeep	768:FOcxVP9F0RbkBK1xcAVn84dRvkx3HJIDTMNyNGAs4kHf2NTrHnQ3IsDBg3kKeYyO:kcT9F0xkKKodo3pdg84kHe1rHKzBgTyO

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.71 KB
MD5	2050444324bacef218c74746808e77b1
SHA1	6edac18241094fd6f466593994467c350c2065a9
SHA256	528f2d0fc28e499d90f2a4f808c8fc07514b7f4edcb7c029a3df6eaa9416ecdd
SSDeep	12:XvSD08eLMdpIQi2St0Vvq3LDYN0mE20/HwqCyOyzVYzdTHC7E+uIZTcJBETG8vNU:XvSdeLuy+SQN080I5y9YJuVcOG/

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.99 KB
MD5	2a84247f70c03422dcdd8b214c133c4a
SHA1	803ca94beee68b2db998f2f4f1d1f998fa038fb8
SHA256	cbb9b16e72c5ab06cc2775f29f30f43e3796342ac5693adfca855c417b9b11b2
SSDeep	24:5Zp/4ZALMxKjCLSprMA2bBoPMsZkADMkNzjDn:5ZR2KWLSprMA2VopkADMyP

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1DAF2884EC4DFA96BA4A58D4DBC9C406

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.05 KB
MD5	8a3261fafa210209615684d06ae0e88c
SHA1	30cfef2cd1cb9402fd7ceb458c24d9e5b4b8deb6
SHA256	0dbdccd251acf246f086744d5e51659811a5f0d1e1ffe52e427bc8850ca2c418
SSDeep	96:zl7SJiTGhFvtj/D1SQS30Z5IUZ7Y2VVXMv12noZV2iKLoSx:Y2Kt8l+xZdqAob2iKbx

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\2be989a0-16a1-424b-9211-51aa3bb43e5d

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	f335f5387594293d98b100c49018fa06
SHA1	51630f24b800ed251e4e77d39269f325d7e7964c
SHA256	84c3c526fe1e96b25602dcae74ffc796537ae9e6aa1a9269787b4d827e21927d
SSDeep	12:WRn54wHwdxjR2SHeo7ftxGFiCaxSA4rwbS8qPGKLH8VFbP5O/faXWZaHAePPnYxP:mQR2c761aysW8LbP5iZaHNPAVjDXJR

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.00 KB
MD5	060fed4263a34c88d88dafe86883d7c8
SHA1	30be1de838b7869496b4765b1a86aa496d811892
SHA256	a31abd59c7f3e8f45de526be4b827b8fbd7f2f099d17254470e88b5a1ccfd11b
SSDeep	48:Dfm38pCFZ3njl9/5pw6RIuC4q0yTitX+S48IEeL4f:jm35F13kFSX7IhLC

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\5YfvWxaryGU.mp3

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	53.86 KB
MD5	b4c2f0c4e70673a64a6728239ed380f7
SHA1	1d989c9aea6febe130db76da13d104811070c5c8
SHA256	4fd1f618ff954b7be1e63767e20fc308eb70b4a0576ede6bdf3f9a637dc9cc87
SSDeep	1536:tgKRmDM4UPCRWEpPpeclv/nM/vpS4EYNVdCYc:tgKrEp8EnMZhEYNVJc

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.44 KB
MD5	fd624955d176390568536b3b7ea46b90
SHA1	6fee48f445a418864dca389f862b13fb4b6d99d6
SHA256	b3ab3dd24f238a487978c88ddfd4c0fb936d7043307947c6fe6d355ad7e3600c
SSDeep	6:sq4+XrdVYrz88vZFtr+u/B7guzEgQvlJGCzm9km3J1VkCTaAJgSAN+6xTFE6uYyz:Z7s0W13JkZrvHGCUp3pBgbIjYyEs

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.88 KB
MD5	2176e990d66bcd5edb8231e59020b4f3
SHA1	c5bd431025ce2f74796c3224e7d57017b8d4299b
SHA256	ae66f70c285586c9bdab91106a93a6be0c91a4b0504a98b5c1318c066721c49d
SSDeep	48:Eo38Ov2MILZM4jJHjaG2TSPUK8eR+4FUuqZ5DylylR41GTpg:P38HtjJDB2TSPU8fFPq7DrDWGTpg

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\jSxMVvO-8dbyb.bmp

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	82.03 KB
MD5	79da33d100cd46cf95272b04c01db3ab
SHA1	21250c43afd04ea0c298eb44ad9f01eb7a6c59f4
SHA256	855996f166d85c55be875a1cf31bebb521b12a0ce2e2b392931e9a18fac8cd22
SSDeep	1536:L1aJ6W/6ivvpGVX32dIKRFNhW+paP9OwP1DMOYq+YPUL6CpBDDrOVjCro2cOKbZF:hK3iivvpWmuKfNQ+paFVP1QO9fP4hhrW

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\st75Up-pL3swxSrsi.jpg

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	24.94 KB
MD5	aa234998a30879a6594bb6b71102279c
SHA1	14004a86d5c7d23fa3dfeacd3e73d68a042e8036
SHA256	dff1da72123b8fc057bdb10b80e84c3fed29b208576e0268829155b9de460dfa
SSDeep	384:Je3eRCRwxCDxlhxCTwsMgBRvVpEvWh1cVMcPxwWikZosPrAdvl7G3z1G:Je3eRCRwxCDx5CThfcvWhquWikIT4z1G

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\06_Pictures_rated_4_or_5_stars.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.05 KB
MD5	a01e514f0b13defc14c0207873fa9b47
SHA1	a9c6ec379300ae20135232afbf2d63db5cd50cdf
SHA256	3d31a0d4e9b4b2a4fb97baf172a5a57ef77e2c644a26787d88716412b0cc1a84
SSDeep	24:stsnnNkHPGOBt65eAO36zEWO0J9KfjZf+I/9TN2gTb5vp8q:s2ndOaP66W0J9KLJVNvFB8q

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.78 KB
MD5	3d5ac8a73bb94e7a83a8c860e04c692f
SHA1	5dc2951efc58c4a96fe991926f7077a388c0dbd9
SHA256	b03df0348f3cfb4c22d14639f522001bfde32b0ad5e7bb732dc2657cb815693f
SSDeep	96:aSJNr1WNt6OAphosPKAc3p49eywOtHiDsFvRp3zraR38ouJQ/loh:ay1WJg5KA+GDwOU49y38XQNoh

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	4b8959fcb833c482e7dfc6e6804b4453
SHA1	9820256f030ddaf100186c499c74294eb03b591b
SHA256	dd4fe1d40bde018d556105931d5a4afbcb1fb4f152ba54dfaf3184b6a695b2f4
SSDeep	12:qM2R2MzFK4OLuunFAgDW9XiGJFR5Z12Q/0QkqsQIAua/9nqqgda8K:Y3A4snGgDW9XiaR12OvkqsQIg9nqHK

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\42d89ab6-6f5e-4463-92e1-18d8b8614c36

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	764270643a9c8f57d83edbf0ec4ee5c2
SHA1	2246db8340d32f589f3b8c6bf2b8b8abb0058fdb
SHA256	423137d841de0b91d25e5a97bd8c44ada4a98cdf0619bdef1dfc5c6ebc83a282
SSDeep	12:b8V1rpzA+0hTNN+BhXm8b564YHoYwx4SzwmeLbMcoE5TmYGHhM1pptP8aQLo:yq+0p+9m8b564YBoe+E5icp98ZLo

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.19 KB
MD5	78fd4f170d02be5bbdd8c10302fa2f2b
SHA1	ecddc21f093b0f73bb0afdc7a398fe2792b05bf4
SHA256	f50ece61ba8263747b2906025fea27e4488cf0a60d632815b048c093ec6868b6
SSDeep	24:YS7leilrR91yMT1jDWordZC4V2TV+fe2kIImSg2qEuYbjDxMRL:YS7IwHgYZDWQ/V2JseeSgzEuOjlMt

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.53 KB
MD5	6ee72b24b99473f0ad36b2160e80edef
SHA1	95089489e20d90401ce8c284b09a902605f409f6
SHA256	47861dd9332d554fbf9512330b2778ee0931154cff3bed64f1e690f8b8a07a0a
SSDeep	12:Wy4D+KSj/POv3ohxQM8y2cA3e3JFQolXDG68AIpD6jtoQ7VeLC3zS4Q3:1iSjnw3ecofV5GrfD6Zo+sizSF3

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	568.38 KB
MD5	7ddd444e2f5a721b711d6c6f22a0ea4e
SHA1	fbe0cdda76e933d1020df92b573703fc47c104cf
SHA256	7ed28a1cf35453f8290ac04b4d61ea050d023119dbf13c6f26389e05dec2f6f1
SSDeep	12288:5/NigZPVyyZdSQHKq+1ycAySCeA8ANbD8cAGxedUtnbzj0hX55:FpPVyyZdlHKq+1yxj7kNv8VQnnIhX55

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\uQ69YqY2.bmp

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	57.42 KB
MD5	37034e038616c9aae1696bea63e85b68
SHA1	06e51946aad80855a14981bed8a91804327da8d1
SHA256	f03eb23cddb06d546f72a45dd7efd00e9b65d160f3c30380b638217ee147befb
SSDeep	1536:rDpB8xsCsjMUvr9qpDl0YqrFdsvz9MLZgTNRvDLRK:vpBCVUvr9OWrFd8uZgTr4

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\Outlook.sharing.xml.obi

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.46 KB
MD5	d0c7b08e350f87eb7224e7869947a5ac
SHA1	9ecc6bc8b26887615c9fac09cb126c938952bf35
SHA256	9b75ceadf4af1d17e2b9c1f09f4275813fc8edf3a4a7f6c2e92cb9c5d13e51f0
SSDeep	12:sCIi8b1VIDkucy6zWI3m3UVuTmHcWBc8q4v94PXou2eebRppZQ0m:sCI5M4u0CAwUVUwcWWZ41UBebRLK7

C:\ProgramData\Microsoft\MF\Active.GRL

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	14.89 KB
MD5	7e52222840b71c6a8892525f525791a3
SHA1	c2086c737b849bf171e3857ac3361ae5291a56e9
SHA256	4fb1f6d9cf9abfe305580289825c850366d0a8bbf9f3cc686615f29b72f565e7
SSDeep	384:vs9Jy/T2PznHM1Wepb1zLeB+nqC3kpgz+tXbo:vwJyT2PznsYe51zdqBW+tXs

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.86 KB
MD5	2ab41bc0bcc92123bc77f9b6dcd32b32
SHA1	7b3fd19c838edd2a1bd1a3e19a2ca6f13b2f6c6b
SHA256	98d0ed8b365fc9b632fbb98d191d04340068c1f4445eda3bf55989e646aa959f
SSDeep	48:ywM6B0acNX5qkulfghEMwI7Y4yKGwaKi5eqc3BXe+/3GLg/:xMiWKDlYGZIM4reA3Ku

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	1ba9c84f6ad560ce46c454572a4cd41c
SHA1	b3f6fd3a999ec8f2fce18acb953e24e61d915dd0
SHA256	9f943a03e251199af5490eb1b15d5d6eb6b9e80cc8832e5285e44a49f1604dfd
SSDeep	12:YVMkmS2ssJsuVX9DaUfc96eik6ffGVxzdwWzYo9ZqypXePJKOoa0:p5SXuVXQIc9ZifQVdz8EZqypAor

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\08_Video_rated_at_4_or_5_stars.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.27 KB
MD5	d1f78fb94f1e5fd7fb632aed1b4e4081
SHA1	d15f7f1380cd1f24c6331c8f3c88b058ec591208
SHA256	8d61ee11bf8a753923bb6d3f2ab8cb24fc2e99139455d9894b07f5a1a87e4501
SSDeep	24:fhVvzj7VLHvucXJXWdHSKZLw6/I09qfaaEfT1i7aZ22o3QEIL7kzT:fhVvP7VL9JX8Xw6wAqEfZi7j23EIWT

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.36 KB
MD5	5ea31c8fc8ce594e9ea47727823bdc5e
SHA1	d41f16fefa23572aac864c2f227375a92ab94fe4
SHA256	a557591387b92b5e8e491b3dce8763fadee39a7ba301d4ab703c02fcffacf502
SSDeep	6:ZSX5Nmp6EHa8R+fQnmmPwX9eeARTKUItbhKhPHsAJl3ncI0CP5eC4Osp/LLEpzcU:A5Nmp6EHV/mmPAAUhczYC4b/LLmN

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	4a59f758ee88a4a3fabb64ed254bf3d1
SHA1	e4e3019f54a989f6087216ff493eafbf74075d12
SHA256	dadcd865091e9f4d61d9e9d9f7105e49de3507a1d98f68afc51c8c9b3422ca26
SSDeep	12:gIZpZ1nsBi4sKjhjQKfUk/djjLomYByTxAl1FNJAEtfYon0iv6g6V6MM1VpxIin:7pZeQtKtnHLomkHvznDvhnMkVpRn

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\07_TV_recorded_in_the_last_week.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.30 KB
MD5	7cf929d856ecbf8d659d9debfd1c137a
SHA1	dbcbe6bcdc8a24d80f1fcbbc3e2ab9b40c183762
SHA256	840c58787f4275fc501235e01b043941c29f193c2ce48a11c4f79c5a8c015ace
SSDeep	24:2+LB/xI+02idSZVqkydnYFco7dJSFnBK+bjSjfEpjmL4dtxF6KOkRPGHKYaI:FIDSvbYKhmFnB1SEpjg4fJjPGHK4

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	c449c9fa47f55f6831b1e874f0f26afe
SHA1	570ee687025b4544b10f14fecc961e22ed979c08
SHA256	a88771a0feff1ca694e66729e5f0e1c0b3a552b223f3745884ccfd38e1d716d0
SSDeep	12:PGabDQMCLTKxWKkgd1lVSh/clA9QSJd42wgsl9gA3FSR9HP+wsHkM8NOvxWh:itTKx2gd7sFdQS42w1/xa+wsIUS

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\11_All_Pictures.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.85 KB
MD5	ed839c97847bf86ef95975df69050195
SHA1	40e2d6c1cd047f84896cdc008e626b68fcedaf9a
SHA256	231da351c92a63816124d720abeec3a133a7caf1f4e04ecd33c6b08ae8f33b6c
SSDeep	24:ZAd8/e5D/JTtQjgxIVgQ7Zn727ZUdV2k/qeqbPo4h:Ij5D/JTtQc+CkZn727OdVGHt

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.86 KB
MD5	14e49d30de111b46d8e69257931a1146
SHA1	1e89f7a743b416a4863847bd3f24f9629218c698
SHA256	c1d50ea938ebf9ab52eca1c1691681f7778a63a3b095db010d62c1457fdb722e
SSDeep	48:3rrnwa31XjimDgVprqlr0GDoNFQiUJ+fe4:brnwa38pQlJIfj

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\xzV1gkMa6a.ppt

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	8.31 KB
MD5	73e0cddd23b9457f91650e8729cf7776
SHA1	ec3d3bfbcf1397940bd7a4dea61b986260d2ca6a
SHA256	754fcbe0a7be9c2dd6eb03c72861a0764def59ca3bb9e844af14a392410e33c5
SSDeep	192:pft+xF7YvSHcpxYi8IANhoArnhyNe3EU7DSmN1ky:psxF7YvNY7xhoVNe0GPNWy

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	5b9cbccda1564c413bfd4458f961d465
SHA1	df1de871d8237a3dc1529dd45abfe667ad71010a
SHA256	b294fec0a97222d5b9b52a8a00e8df67e5ee99af5619644dee7fe738815c5118
SSDeep	12:CUwCSMBKSJQr+DsYPQxVH5+q0TTllRKxSiSlEwpzNRyBOMmizZlxCG+sRHx5l:qCJM+QaDs+Yo7TThKHSlxhRyB3xZrCo9

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.61 KB
MD5	dde74472ab6e3a5a1a2767682951f21a
SHA1	226a7d5acfb8c39513b70443d95679e177b0a65c
SHA256	75576f06e4bf9cd5dea4cf80190edfbf00f5a2eefe7c0b8f3e6208c6892b8042
SSDeep	12:3+CfgrRpv1HfCnWiyDiaOY3/CGPsQtxjmsYStabhYTm/RVS:OWgdzfCW5DzCO3jgXWTmJVS

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\29373454-3c13-4a27-aa0c-16fc0ac18343

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	8dca5f73ed0a2ae0e2ee5a58e4438429
SHA1	2744acff8887d7e417460b20e64e08623f9be93e
SHA256	ef882908c4ee6cabdfa98f802ea5a5f7255635e11717d720ca2902878d1f7099
SSDeep	12:DsqHr/++tXgPLYjSzQKZQDv/SyDBKWA8UFsJoYZSRFUX4qSreBxzJau38rPaGrSJ:Na+BgzY7/ehOJHCGx8rCGrS/BWE

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\08e575673cce10c72090304839888e02_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.33 KB
MD5	8bf794b7460c17e493e80cb6fbabcff9
SHA1	0f91c64eb443f440f3cdee0b7fb3dbd45c33866c
SHA256	b58534e40e580b8c8fee0d54447931e31dbfd651f342f04a223d10e313964216
SSDeep	6:9LWEtB95Kfv4udvNclVR1G3eECNkDkSJsmMwZgB9y3sM+xxUp47aHtkn:P95ivLs9GuysmMwZeOsMA1YSn

C:\ProgramData\RyukReadMe.txt

Created File

Text

Not Queried

»

Also Known As	C:\ProgramData\Adobe\RyukReadMe.txt (Created File) C:\ProgramData\Adobe\Acrobat\RyukReadMe.txt (Created File) C:\ProgramData\Adobe\Acrobat\10.0\RyukReadMe.txt (Created File) C:\ProgramData\Adobe\Acrobat\10.0\Replicate\RyukReadMe.txt (Created File) C:\ProgramData\Adobe\Acrobat\10.0\Replicate\Security\RyukReadMe.txt (Created File) C:\ProgramData\Adobe\ARM\RyukReadMe.txt (Created File) C:\ProgramData\Adobe\ARM\Reader_10.0.0\RyukReadMe.txt (Created File) C:\Users\Public\Documents\RyukReadMe.txt (Created File) C:\Users\Public\Favorites\RyukReadMe.txt (Created File) C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\RyukReadMe.txt (Created File) C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\RyukReadMe.txt (Created File) C:\ProgramData\Microsoft\DeviceSync\RyukReadMe.txt (Created File) C:\ProgramData\Microsoft\eHome\RyukReadMe.txt (Created File) C:\ProgramData\Microsoft\eHome\logs\RyukReadMe.txt (Created File) C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\RyukReadMe.txt (Created File) C:\ProgramData\Microsoft\RAC\PublishedData\RyukReadMe.txt (Created File) C:\ProgramData\Microsoft\RAC\Temp\RyukReadMe.txt (Created File) C:\ProgramData\Microsoft\User Account Pictures\RyukReadMe.txt (Created File) C:\ProgramData\Oracle\RyukReadMe.txt (Created File) C:\ProgramData\Sun\RyukReadMe.txt (Created File) C:\ProgramData\Sun\Java\RyukReadMe.txt (Created File) C:\ProgramData\Sun\Java\Java Update\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\Data\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\Data\CJW3O3KP.BX7\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\Data\CJW3O3KP.BX7\6NG60CXZ.9GJ\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\Data\CJW3O3KP.BX7\6NG60CXZ.9GJ\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\Data\CJW3O3KP.BX7\6NG60CXZ.9GJ\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\Data\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Deployment\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\CrashReports\RyukReadMe.txt (Created File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\ryukreadme.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Credentials\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Event Viewer\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\1NBUR4HR\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\6ASVN7J7\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\D68G7BIJ\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\FORMS\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\IME12\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\IMJP12\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\IMJP8_1\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\IMJP9_0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\DOMStore\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\DOMStore\3LKBQZJ3\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\DOMStore\8NES5H33\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\DOMStore\FKLUIDU0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\DOMStore\OWLVMZRC\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\Recovery\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Transcoded Files Cache\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\Groove\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\Groove\System\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\Groove\User\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\ONetConfig\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\RoamCache\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Publisher\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\TaskSchedulerConfig\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Visio\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft Help\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Cookies\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\History\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\History\History.IE5\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\03J4UQW0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\KETAJP6D\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\VB18B0KB\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\XT1RPYG9\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\WPDNSE\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\~nsu.tmp\RyukReadMe.txt (Created File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\ryukreadme.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\VirtualStore\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\Search\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brz\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\dan\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\dut\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\frn\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\grm\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\itl\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\nrw\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\prt\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\spn\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\swd\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\IME12\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\IMJP12\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\IMJP8_1\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\IMJP9_0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\UV0DUWVB\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\Services\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\security\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\tmp\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\tmp\si\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Collab\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Forms\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\JavaScripts\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Security\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Security\CRLCache\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Flash Player\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Flash Player\AssetCache\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Flash Player\AssetCache\D5NTRC6R\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Headlights\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Linguistics\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Linguistics\Dictionaries\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\LogTransport2\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Identities\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Identities\{31810C36-5D23-4CCE-A3B4-316DED195C38}\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\P7Y3F7QB\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\macromedia.com\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\AddIns\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Credentials\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Document Building Blocks\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Document Building Blocks\1033\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Excel\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Excel\XLSTART\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\IME12\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\IMJP12\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\IMJP8_1\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\IMJP9_0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\65UX3YG0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\AY721QDR\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\DZBKZBIC\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\VRLZOZ0E\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\MMC\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\MS Project\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\MS Project\14\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\MS Project\14\1033\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Network\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Network\Connections\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Network\Connections\Pbk\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Office\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Office\Recent\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Outlook\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\PowerPoint\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Proof\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Publisher\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Publisher Building Blocks\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Speech\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\SystemCertificates\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\SystemCertificates\My\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Templates\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\UProof\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Word\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Word\STARTUP\RyukReadMe.txt (Created File)
Mime Type	text/plain
File Size	0.78 KB
MD5	cf525d95dcf6b4a874727fd34f62c7ec
SHA1	cbb47b81c1fad34bcd3604dc978f137006d33440
SHA256	0b07aceb0d18cd1edf368fc9c60d19b00b2c4d5a077a412cabbad9172f2f64f3
SSDeep	24:iVezHysv9F2Ob/87gPsoU3gMqvKHHLb1+y3RhXY2bfbX9n:xzSsv9FjxFiH0iDbfbX9

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.33 KB
MD5	fc5d5238675198673fdbeff0f6190ed8
SHA1	4fca0f45bca53d4940fc61886bc99f795850e3f4
SHA256	db25c8c7b752f07d09f86cf4c0407714c4c84c024ab948f46914206f82b96d88
SSDeep	6:7iVRFFT6QeWMEEXD4D4gW1M72LV1KVp+Yg0kU1gWsMStJ3eFi76:GPFFT9FEz4D5yLiVDPkU1gWsMSzM

Notifications (2/3)

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After