a5590a98...6130

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gfvrib.exe

Sample File

Binary

Blacklisted

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	246.00 KB
MD5	0f3deda483df5e5f8043ea20297d243b
SHA1	70dac7f3934659e583f962e7c5bff51a4b97dd11
SHA256	a5590a987d125a8ca6629e33e3ff1f3eb7d5f41f62133025d3476e1a6e4c6130
SSDeep	3072:CEBqvIftQC2mCBBGVPZRgUluWH+0XmJazMgXjJOBN4Fl4NgIE4cQd2/RfDnropYB:FOKPVIWH+0XRgGl8acpjgQ2UV5e
ImpHash	296368c880fbf799c243544727d93dc8
Parser Error Remark	Static engine was unable to completely parse the analyzed file

File Reputation Information

»

Severity	Blacklisted
First Seen	2019-08-31 18:16 (UTC+2)
Last Seen	2019-09-02 22:08 (UTC+2)
Names	Win32.Trojan.Zenpak
Families	Zenpak
Classification	Trojan

PE Information

»

Image Base	0x400000
Entry Point	0x401bc6
Size Of Code	0x19a00
Size Of Initialized Data	0x2ec9400
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2018-12-04 11:00:39+00:00

Version Information (4)

»

FileVersionStart	1.0.5.4
InternalName	fiubsiyfv.isi
LegalCopyright	Copyright (C) 2019, fdgudfgv
ProductVersion	1.9.1

Sections (6)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x19957	0x19a00	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.72
.rdata	0x41b000	0x1d5ae	0x1d600	0x19e00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	6.54
.data	0x439000	0x2ea64b0	0xc00	0x37400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	2.32
.gfids	0x32e0000	0x111c	0x400	0x38000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	1.19
.rsrc	0x32e2000	0x3fb8	0x4000	0x38400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	6.16
.reloc	0x32e6000	0x13e0	0x1400	0x3c400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.56

Imports (2)

»

KERNEL32.dll (80)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
lstrlenA	0x0	0x41b010	0x37e60	0x36c60	0x54d
DuplicateHandle	0x0	0x41b014	0x37e64	0x36c64	0xe8
lstrcatA	0x0	0x41b018	0x37e68	0x36c68	0x53e
GetModuleHandleA	0x0	0x41b01c	0x37e6c	0x36c6c	0x215
ProcessIdToSessionId	0x0	0x41b020	0x37e70	0x36c70	0x399
GetLastError	0x0	0x41b024	0x37e74	0x36c74	0x202
CreateMutexW	0x0	0x41b028	0x37e78	0x36c78	0x9e
CloseHandle	0x0	0x41b02c	0x37e7c	0x36c7c	0x52
GetProcAddress	0x0	0x41b030	0x37e80	0x36c80	0x245
lstrcpyW	0x0	0x41b034	0x37e84	0x36c84	0x548
FormatMessageA	0x0	0x41b038	0x37e88	0x36c88	0x15d
GetTickCount	0x0	0x41b03c	0x37e8c	0x36c8c	0x293
GetCurrencyFormatA	0x0	0x41b040	0x37e90	0x36c90	0x1b8
FlushFileBuffers	0x0	0x41b044	0x37e94	0x36c94	0x157
PeekConsoleInputA	0x0	0x41b048	0x37e98	0x36c98	0x38b
GetSystemTimes	0x0	0x41b04c	0x37e9c	0x36c9c	0x27a
GlobalAlloc	0x0	0x41b050	0x37ea0	0x36ca0	0x2b3
GetHandleInformation	0x0	0x41b054	0x37ea4	0x36ca4	0x1ff
UnhandledExceptionFilter	0x0	0x41b058	0x37ea8	0x36ca8	0x4d3
SetUnhandledExceptionFilter	0x0	0x41b05c	0x37eac	0x36cac	0x4a5
GetCurrentProcess	0x0	0x41b060	0x37eb0	0x36cb0	0x1c0
TerminateProcess	0x0	0x41b064	0x37eb4	0x36cb4	0x4c0
IsProcessorFeaturePresent	0x0	0x41b068	0x37eb8	0x36cb8	0x304
QueryPerformanceCounter	0x0	0x41b06c	0x37ebc	0x36cbc	0x3a7
GetCurrentProcessId	0x0	0x41b070	0x37ec0	0x36cc0	0x1c1
GetCurrentThreadId	0x0	0x41b074	0x37ec4	0x36cc4	0x1c5
GetSystemTimeAsFileTime	0x0	0x41b078	0x37ec8	0x36cc8	0x279
InitializeSListHead	0x0	0x41b07c	0x37ecc	0x36ccc	0x2e7
IsDebuggerPresent	0x0	0x41b080	0x37ed0	0x36cd0	0x300
GetStartupInfoW	0x0	0x41b084	0x37ed4	0x36cd4	0x263
GetModuleHandleW	0x0	0x41b088	0x37ed8	0x36cd8	0x218
EncodePointer	0x0	0x41b08c	0x37edc	0x36cdc	0xea
RaiseException	0x0	0x41b090	0x37ee0	0x36ce0	0x3b1
SetLastError	0x0	0x41b094	0x37ee4	0x36ce4	0x473
RtlUnwind	0x0	0x41b098	0x37ee8	0x36ce8	0x418
EnterCriticalSection	0x0	0x41b09c	0x37eec	0x36cec	0xee
LeaveCriticalSection	0x0	0x41b0a0	0x37ef0	0x36cf0	0x339
DeleteCriticalSection	0x0	0x41b0a4	0x37ef4	0x36cf4	0xd1
InitializeCriticalSectionAndSpinCount	0x0	0x41b0a8	0x37ef8	0x36cf8	0x2e3
TlsAlloc	0x0	0x41b0ac	0x37efc	0x36cfc	0x4c5
TlsGetValue	0x0	0x41b0b0	0x37f00	0x36d00	0x4c7
TlsSetValue	0x0	0x41b0b4	0x37f04	0x36d04	0x4c8
TlsFree	0x0	0x41b0b8	0x37f08	0x36d08	0x4c6
FreeLibrary	0x0	0x41b0bc	0x37f0c	0x36d0c	0x162
LoadLibraryExW	0x0	0x41b0c0	0x37f10	0x36d10	0x33e
GetStdHandle	0x0	0x41b0c4	0x37f14	0x36d14	0x264
WriteFile	0x0	0x41b0c8	0x37f18	0x36d18	0x525
GetModuleFileNameW	0x0	0x41b0cc	0x37f1c	0x36d1c	0x214
MultiByteToWideChar	0x0	0x41b0d0	0x37f20	0x36d20	0x367
WideCharToMultiByte	0x0	0x41b0d4	0x37f24	0x36d24	0x511
ExitProcess	0x0	0x41b0d8	0x37f28	0x36d28	0x119
GetModuleHandleExW	0x0	0x41b0dc	0x37f2c	0x36d2c	0x217
GetACP	0x0	0x41b0e0	0x37f30	0x36d30	0x168
HeapFree	0x0	0x41b0e4	0x37f34	0x36d34	0x2cf
HeapAlloc	0x0	0x41b0e8	0x37f38	0x36d38	0x2cb
LCMapStringW	0x0	0x41b0ec	0x37f3c	0x36d3c	0x32d
GetFileType	0x0	0x41b0f0	0x37f40	0x36d40	0x1f3
GetConsoleCP	0x0	0x41b0f4	0x37f44	0x36d44	0x19a
GetConsoleMode	0x0	0x41b0f8	0x37f48	0x36d48	0x1ac
ReadFile	0x0	0x41b0fc	0x37f4c	0x36d4c	0x3c0
SetFilePointerEx	0x0	0x41b100	0x37f50	0x36d50	0x467
GetStringTypeW	0x0	0x41b104	0x37f54	0x36d54	0x269
ReadConsoleW	0x0	0x41b108	0x37f58	0x36d58	0x3be
FindClose	0x0	0x41b10c	0x37f5c	0x36d5c	0x12e
FindFirstFileExW	0x0	0x41b110	0x37f60	0x36d60	0x134
FindNextFileW	0x0	0x41b114	0x37f64	0x36d64	0x145
IsValidCodePage	0x0	0x41b118	0x37f68	0x36d68	0x30a
GetOEMCP	0x0	0x41b11c	0x37f6c	0x36d6c	0x237
GetCPInfo	0x0	0x41b120	0x37f70	0x36d70	0x172
GetCommandLineA	0x0	0x41b124	0x37f74	0x36d74	0x186
GetCommandLineW	0x0	0x41b128	0x37f78	0x36d78	0x187
GetEnvironmentStringsW	0x0	0x41b12c	0x37f7c	0x36d7c	0x1da
FreeEnvironmentStringsW	0x0	0x41b130	0x37f80	0x36d80	0x161
SetStdHandle	0x0	0x41b134	0x37f84	0x36d84	0x487
GetProcessHeap	0x0	0x41b138	0x37f88	0x36d88	0x24a
DecodePointer	0x0	0x41b13c	0x37f8c	0x36d8c	0xca
WriteConsoleW	0x0	0x41b140	0x37f90	0x36d90	0x524
HeapSize	0x0	0x41b144	0x37f94	0x36d94	0x2d4
HeapReAlloc	0x0	0x41b148	0x37f98	0x36d98	0x2d2
CreateFileW	0x0	0x41b14c	0x37f9c	0x36d9c	0x8f

ADVAPI32.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
DeleteService	0x0	0x41b000	0x37e50	0x36c50	0xda
StartServiceCtrlDispatcherW	0x0	0x41b004	0x37e54	0x36c54	0x2c8
SetTokenInformation	0x0	0x41b008	0x37e58	0x36c58	0x2c2

Icons (1)

»

Memory Dumps (3)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Points	Actions
buffer	1	0x033E7578	0x033FA857	Marked Executable	-	32-bit	0x033E7CBF	... Memory Dump Actions Download Dump Go to process
buffer	1	0x00020000	0x00036FFF	First Execution	-	32-bit	0x00020000	... Memory Dump Actions Download Dump Go to process
buffer	1	0x00020000	0x00036FFF	Content Changed	-	32-bit	0x000204F6	... Memory Dump Actions Download Dump Go to process

c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-3388679973-3930757225-3770151564-1000\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.15 KB
MD5	de55a8ff6bf32cc63a1669e9400291e3
SHA1	6e46cd0bdc8dfec33d8b606a4e99ace60b5bba83
SHA256	67206e12a8c7999042f7962b387e8e209e05bb20632b5d320127ace776a752b0
SSDeep	48:6WvsGFmZUbdhpzXWzBy552+81XBz4II6lcbd+pL:6WvsGy+gzByDe1x8MwApL

C:\Boot\BCD.LOG1

Modified File

Text

Unknown

»

Also Known As	C:\Boot\BCD.LOG1._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	text/plain
File Size	359 bytes
MD5	3d7a48eab7cbbcf50e5211aa289a2f99
SHA1	16d99e12435fd1b3a2cd0513f57029856512e75e
SHA256	df901acc8dfaf169c5a24bce34e7dddc879305013c8b507c54daae8d3fa6bb40
SSDeep	6:Y80I3L1xQ2BNwUAx21PHRgUBWOKrTYiI3psVGhG2vT4MRy4s:3xQuNwZxaPaUoOKrrwps0c2FRy4s

C:\Boot\BCD.LOG2

Modified File

Text

Unknown

»

Also Known As	C:\Boot\BCD.LOG2._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	text/plain
File Size	359 bytes
MD5	b1d5178c3d98ea84bd1837efa712d96d
SHA1	0203f2f7da8649feff39f8fcdd4ac8201af121ee
SHA256	df0b4887f5b98b1ceff86c4ade5e58eb3e484f1ac993eb875ea8e719e9417598
SSDeep	6:3WRay1os5jhQaWA34wcidjDzTrHbz5/uxMJgd2UhmOUjYz4KMULis:IayGs5jK+TcUjTzbzNI/xhFDz4Kws

C:\Boot\BOOTSTAT.DAT

Modified File

Stream

Unknown

»

Also Known As	C:\Boot\BOOTSTAT.DAT._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	64.35 KB
MD5	b2ee19c87614452f5558f5905f6a96a1
SHA1	465e3b5e6dca33fc766d0d6748f333dcacebb1b2
SHA256	6da92560b643be62d5f1e97d3e80069077affc1a51b7acf251569849c01c4306
SSDeep	12:oLzIheLMD61paWzzujbgPxzPl2nQaN1jyL/0dBn6is:izIqNfaW/GEPZlW7jyLcdcis

C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi (Modified File)
Mime Type	application/octet-stream
File Size	2.39 MB
MD5	23f209ab94abe0c86a4b6fb54c476534
SHA1	db8a2736cb21777d4f4666408f79ae1b9b0ec860
SHA256	60f78bd8c3c86927e5636d776be5c1110ac885b2243093a2732cfb8055094d97
SSDeep	49152:T8nDxL8QBoI9eljidTex4S120ytJyham6Co64:T8nR89EQ1oT

C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	1.88 KB
MD5	b78e3952d922b97c1f075baa855ae1d1
SHA1	d6fd099c3d0d43bef20e5de21d7e10451dcfb747
SHA256	15230a5e0b1d890da0a7cf31ad424edfde63972a72946fd5a4d7e806f37749fb
SSDeep	48:urBBh5FGVtWS6d1+Ihen6ZFWyKID0FillgWgKjw:url5kzyen6nWyvllgWgUw

C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
Mime Type	application/octet-stream
File Size	2.59 KB
MD5	f30274c48e5a19e50fe4f7ff0f9f0d48
SHA1	95b00374a119ad1804ea43fa7fcf6cd27ed9a274
SHA256	1f515c349465af690a9124cfdf15bf97693223bc9c551db12b4f1559318d552f
SSDeep	48:ct7IC7vWJSdCEtv9/xtsM/CJ2Gi6hDCix5St7W0K+kNs7DW5qKFkURdorM:cdhCIvtsMIAA5St7WL+CsDW4KborM

C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	2.39 MB
MD5	a8e18152c34767acbad6f6c3494ad936
SHA1	700dd1c1acc93b5e0a0abce7df76dae923209331
SHA256	0b36caa14c31ae9179e329fa0b52953d42d25db514b277b343d6c282eed44efb
SSDeep	49152:28IDxL8QBoI9eljidTex4S120ytJyha16CZtZ:28IR89EQ1oP

C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	1.77 KB
MD5	e4ca0890d740c27ee69ee43575d180ef
SHA1	11a68b6c0d13502117240738787b6a3e3a7e7164
SHA256	f2dedddaba1675641f7fc7cb041d4d1b8f150c8b0fae9d3fac0147058a737f4a
SSDeep	48:Lltj/pK0Cm8U/0ip9vYUTSC0nDeqHUPrIhQ8r/jrNO4uH:Lltj/pRH/0aWnalPrQQgkfH

C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
Mime Type	application/octet-stream
File Size	2.19 KB
MD5	40962c18fba4a71d53915aece33a36a8
SHA1	6b222735d80fa8a6dc68d3e470ea77358e77cf47
SHA256	d1d57bd806d2b52826d91db09a58e28350470cbae38bd69c4de951ff62027b46
SSDeep	48:T3P44TiT3ZzlaPiAqP+mx0lNUq4Ak7bfzJ1Brl3TlyR5hhIIoVPSqK/fVdMLXf:T3nTi7JEPiqKq4lffzb3TcyTzYmLv

C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	2.40 MB
MD5	7b143101ef379517e4e78371a09f22af
SHA1	2cce3f72b472e7aa6ff3f906979d0d12a89eee20
SHA256	fd43713722f723d53ae2613530624704e9015fe5373cc5362b8effacf37871c7
SSDeep	49152:bnDxL8QBoI9eljidTex4S120ytJyhaLz6CCHm7:bnR89EQ1oLz

C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml (Modified File)
Mime Type	application/octet-stream
File Size	1.77 KB
MD5	f37037b329ac5c159af7d7cf57e338d1
SHA1	f11b3167f23a16755317604fab3e793c3c317179
SHA256	dd543afff59f4283ea2a993c2b493f05b96475780b6669164ba90a06e771fc6c
SSDeep	48:mkYTwaWBw5SRuuVIAPdZI94mRyHjZaaWCHT93:mix8SHIAlZIVRWjdWgR

C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	1.92 KB
MD5	b911c40f19ca73e33c8b79490e2683ab
SHA1	bea5d2b1df2f0ac993ebd18ea92257d605aeded1
SHA256	b8e0c6fed37c176cfb51705c36bdc661c6045f61c7e2add46ca5dd750711403e
SSDeep	48:Ph0XhnZS+PLxU8SKBgiOd+7kyEpQGkHrdeRk:OnZNPFU2Od+hEpQZHrde+

C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi (Modified File)
Mime Type	application/octet-stream
File Size	2.73 MB
MD5	01850546da579e2d2fd85523cff9dd16
SHA1	d64a1c0544315ed285cf9872630cbff330671a5f
SHA256	5d5e04853f902cb4fa2ff8e5bd9269a9a8d1e7daa0bd7108c8c7489e0060eb6f
SSDeep	49152:emHYLL/Wo9kLljb1R6rOSN20yRJ63PooFMP+l:TqLVe6vjr

C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml (Modified File)
Mime Type	application/octet-stream
File Size	3.46 KB
MD5	0a33646112a0d2d7cf531014b28a1676
SHA1	5bc62475db40b36f016f4e1237f89bc97c09ea2a
SHA256	f78c82b8045b33990bec5824c44a7bb9d8d104667e1d8e414f8c725d42a85271
SSDeep	96:wNtFK0qcCLb404VMbqlBFzWku7q5RECkHW8yxm:wmcCjdapWH7YiCkHW8yA

C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	4.46 KB
MD5	1cf347cf9e409c3247d2499dd7ee5ee6
SHA1	f39ce4f76f9c7c84ebdbeb1e4e133fbc36935f57
SHA256	5618ba9e5d01f01102d58f65462d2b6afe45d28e80f79c64bee3547cfa34cd9e
SSDeep	96:c4sN4iyb11Al27MRcBtJzKDJ94JePrz+63qhyWf262+pu3H:c4s6bQo7MSKdKJejzh6yWfX1pu3

C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	2.72 KB
MD5	aebac675f16564c0b507c8d9225a7602
SHA1	bdabfcd12d174e500d5035a6afcf879291f72892
SHA256	ffa4f598b1129c2fa2a29354ab75529153c74195179a060ab8ce860173f83599
SSDeep	48:FBiOL9nRgV2gAgy3lBS9+IWdh/Pw+MWxYk9ywKsMjTPjjnbOBnG7bagEvZWKhY:FBi2nqDNGS9+/XemKsmTLjnbOBnzRY

C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	2.41 MB
MD5	8dc94e4140fed41e1895325367673913
SHA1	485fe3af8c531aadf258b778be92f703357c6c49
SHA256	ab7d033882e2858f15d288412faa970974946fff288348df7867b6a00312bef0
SSDeep	49152:xd73DxL8QBoI9eljidTex4S120ytJyhaM6CLCA:TDR89EQ1oy

C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml (Modified File)
Mime Type	application/octet-stream
File Size	2.11 KB
MD5	78cd542f0ebe80e8b926ea7119afd97a
SHA1	1e9a53e9291788a16d7cd5a3e520cb0ac0c42a39
SHA256	669f4d1bc61172a4401933260680ed5a261f694a4a9fe67addd35e7c082a25e0
SSDeep	48:bNTVYa5/MdlVhxmUXQAPuyTtJZYyPlhlxG9HQdirRWa4Sb:b556hTHDZYyXPwHQCRWC

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	855.35 KB
MD5	c238e06eff33d7faf9b8aecae698b363
SHA1	b5f7eb5dcb4f795cc051be5f1f8acaa0d55d456c
SHA256	a8a99300b0ccbfc37d69222473015110e8e7e7f394999be5ed7d26e986ad61f7
SSDeep	24576:kZn1ACG7fJQPi4x3P6WBWkmf3egDqo8o9370Pv6YwO:kXACjzgLf7qo6Pv6YB

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml (Modified File)
Mime Type	application/octet-stream
File Size	1.67 KB
MD5	d4e4bf8f3104330cbeff5498e7f9035b
SHA1	5451b24e46771cbf14c59d86e3f1c7b1386a857b
SHA256	cfc67421179fc0f56fa2898420acc552ec2bb602720ddb2680b6be281dae2f74
SSDeep	48:gPkYkYSCkw3ZARDObKqAw+GiKALd5Lz7lksBT:KkYiRDq/+GJApV9ksF

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	860.85 KB
MD5	de1942f62af8fe8282b2e07d191215fb
SHA1	c24c98e927d5b1748556e522f08acf0e2e6e5891
SHA256	60e5b023eba7735e51a591b80716447ce907f485c8674da112f57e84071fc238
SSDeep	24576:yLl+67flQPmbxnP6WBzkm83xgDBo8o93OOr8Bkyi:yLQUDxL8QBohr8Bkz

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml (Modified File)
Mime Type	application/octet-stream
File Size	1.77 KB
MD5	2f8c44e6152125aa43c55ab8aa5556f9
SHA1	67eab9fda4a6864f5f7fcc8f8a17d1ce7009ccbe
SHA256	18b1e7db3ee4084ccba38ab1b75ba8e3499376b45aaa6f250c831f8747095124
SSDeep	48:427CkMPQuF4m0gRNaBWV5dz2ZRkrMrKlTEV+QM8/2qH5:4aC7bb0gRoWLoZyMGmVNM8/3H5

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi (Modified File)
Mime Type	application/octet-stream
File Size	865.35 KB
MD5	80776e9f01407f284f403ac9e20697eb
SHA1	4d44773e71b8492e86ef0b52645aaeff7bde6f14
SHA256	a01aae9300af8509fbf79be1b808a98b77456bcdc7ff129897436fc8adf022db
SSDeep	24576:M70PFv+7flQPmzxnP6WBzkm83xgDBo8o93m9XLH5XM:M70tgDxL8QBo6XLH58

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml (Modified File)
Mime Type	application/octet-stream
File Size	1.77 KB
MD5	f8e89043b3b57b197ed15937fb58b8ef
SHA1	ea90fed89bd363c5149a9bc3c7d4b0fbc394a5b0
SHA256	66a9bcf77c8d221d2a0f4fec9d3b105cdb2d2ac02105770fa3935e9c4397b226
SSDeep	48:10NuOSxsVAEomaDhKkE8IjMw5hnykuLZG236IpGdQQ:WNXSHXHDhKRbBykgGiQZ

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi (Modified File)
Mime Type	application/octet-stream
File Size	848.85 KB
MD5	78f35daa181e7d25f0ebd8abf007f10d
SHA1	2c5ec7c8168786ddaf7d9bf262d06346ab261ee9
SHA256	d0a485e086cab52757ea6972cee27c2f51f16ef04c83044be474cf19017dad08
SSDeep	24576:rqhiv4gElx3P6WBWkmf3egDqo8o93lo6pjEkg:yi6zgLf7qo46pjED

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	1.14 KB
MD5	0e901b2419b836538b7bbdf69da5d0ff
SHA1	f6c41fc0426d732e5c9a1b8867ddd6632442fd80
SHA256	f61afa7677c24ae9c7d58ed0ae822073ade5f459a6c12393ccbc8f042ddef4c4
SSDeep	24:pA4OxzlKk/F275d3oQ4uRrQcjtVGqyNEgHYUH7EufVgPunqLB4oOBOs:64Y/qD1RrQ0HFgHRHAc/fBV

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
Mime Type	application/octet-stream
File Size	6.10 KB
MD5	e1a2560c5093c2effe857101d3e248a3
SHA1	adc7653678af716e060464d2580787ae7e0943d5
SHA256	13eb60eea027748ed3760892fe17a51faad2fd29c6ec0bd173f259c3556024fe
SSDeep	192:XZBzDtBYllEZb6ZXsoDoO5iz0x7T3jm4ZvE76t5:Xf2pXwz0FjdvY6X

C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	853.85 KB
MD5	38a8a61775137eb204f7535b807e2789
SHA1	7d4e936fd33573af1ccbc3b9f0af7f29a115e53a
SHA256	6759e887026cba57d0b279c8fa5c839941ca699633188fcd4eb7f139ef4ebcdc
SSDeep	24576:5C54gEgx3P6WBWkmf3egDqo8o93PU6py1p8:kZzgLf7qo26py1G

C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	1.70 KB
MD5	18e1cb12b546dff7512585933ca9ab53
SHA1	add27df513da822dc6d866cc08541bb4120c4455
SHA256	0e2658c7d9e12ea8314f323e51b8b85a41203215de63b090153027391d180851
SSDeep	24:YYWzTRsjgrO4Yv7F4XaPJkY1aECD3Wegru82N6BivGq9qqABZRBDkCBmDAVwj03s:dWzTNrO4A7UaP+uaAUrtAD/BmDAVc

C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
Mime Type	application/octet-stream
File Size	2.66 KB
MD5	ead016522af79279f8910ef013cf7559
SHA1	0ac86aa40bce3bef8b111752b558b0d1bc50b824
SHA256	37eeaf46c822a4b00c5c6bf865e1883f0a95c38a860b0306f1a10235d5c9a446
SSDeep	48:KZH9XdRx2IMTumx230wplK7TtcdBaVc/MShEiZ0hJzO/HEtg5LpcyvvG:KvXdRxKTX2s8BeAjqJzztMpcYe

C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	2.98 MB
MD5	7be253a791310da1bc46dca0950d4286
SHA1	5da354653d42710a0ef93b6c5140f7be7df2ed39
SHA256	e632996b96b22ce800056fd1a052456039bada786e2b4f4dea59381e9d38a872
SSDeep	49152:w5SevlLsUloDoISMljcqmcLaSt20yrujThvLf2Ad1:G1xslDo30DVl

C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	1.55 KB
MD5	0a7005b34c1003b4d1ad7abb39f6418d
SHA1	5ffc90153d1003c7696a910d4d2fd2aabd71d921
SHA256	ff3ce6d5d125c45a91eb1f916814a56ebc2df5c98f20a82a785a2c0953b9e694
SSDeep	48:TfYYabe41QJn4nwTzqHvPsdjANzvZRv5dzRMmbMSM:TfCFsnw3AAN7P5bLM9

C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	2.16 KB
MD5	a86b3f0e78fce87a4f7a35562416349b
SHA1	e929f5650ff3d77c3a8c61d6298f7bca3455d14b
SHA256	12eaf981308e0f00b0dac1552f7f08cbc18af4abfc92cbe3c0aa21194031dd25
SSDeep	48:LiXjOrXtLeEAr2ORiiyoPe3VQdjQX4kEfSQSIFB461Jiaq0FiT:kjOrX9eaAixot84DbB46P/V6

C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	6.45 KB
MD5	ec7f13bceaa58575fa1dac06b24c440d
SHA1	a165b9a89206de45c2807c75bcf4ea244f0aa1dc
SHA256	0c418ecb6bbe2e32582f7cc0a5f213eeec3fe1c6ece60ef335863af4a186e74b
SSDeep	192:p4A+sCp/J+qzzrnM+8/rcptSE4xZISDn4Kic9hRvq:pl+sCp/J+qzz0/4sZIEn4Kpvq

C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	2.67 MB
MD5	d5b1325d78ef76f509f006ec94b6f46a
SHA1	3344a524f450fe9d3166f33fa4b11f316c768b1d
SHA256	67e40581d25896714cfbfd48e0e434bf4ace85840b9bb1c16dad223894591b25
SSDeep	49152:tSwaYDxL8QBoaneCjSTJKpwmR20yNJqbnaEicmfcE:tSJYR89srJzdE

C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml (Modified File)
Mime Type	application/octet-stream
File Size	9.63 KB
MD5	142e457f02842c36d976ae2cdad08ea1
SHA1	c601222419795f1f3f4683cb5728ea6aa3e20fc4
SHA256	7485aad4bfbb651569b524512ef04e62f5c8a3d6e55790a6e6482643f5bb207d
SSDeep	192:mjMd69sQvmfwZTQaxVcCrT0O05MyCHUj7OCeq1E3UIIgmjCMG/7ynj:mjMd4vgad05DbOCelkhgO0mnj

C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	2.39 MB
MD5	adbede177524f63223540779c42d3180
SHA1	ea870267c7d441b49fa1ed23075a062f80355ef0
SHA256	c94494fe119bd98537b1b27d8bb6365cdcfd09e1657ab15a31629d730aa37551
SSDeep	49152:+ADxL8QBoI9eljidTex4S120ytJyhaK6C3oY:+AR89EQ1oA

C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	1.92 KB
MD5	a69cee6fbfe1af973511952fc6ff7b06
SHA1	d81b81e3952769633622f75242214bec5be5f243
SHA256	e2bb904d03683d00fbcf98ef35ac8c53787c8c1d98f13febc758c06306d6b786
SSDeep	48:NaWl4oEs3U9tKA7DUm7NYZ8RYn7eMGO1aLk0:ll06U7vp76n7eBOID

C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	2.29 KB
MD5	88da64924b2f8407635aef2e7490a0ac
SHA1	e1509d708ccbf1c8eff1e414be9174d72a2f8e47
SHA256	f91ec4a79c095be81ce5241ba869e9ab30b20bb8a31ea4d8a60d9360903d67a0
SSDeep	48:ppwu47ATxF8wpZsfkLUehiU2gBqPQuvRl4aa4bqKfV3XY:34iRuW5oBEoV4a9bqw4

C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi (Modified File)
Mime Type	application/octet-stream
File Size	2.40 MB
MD5	74e568d50aa342591b8a02a6006e74c4
SHA1	bf4987f14d5716f8d5451e5216eddb0b4a3584f9
SHA256	769f4f9c77d77e428e1eaf205bbc689b75b46f2d9d30934f53b8c14769563868
SSDeep	49152:ijsHYLL/WoGWeLjN5HRYnSt20yeJji34mElfaA:ysqLVVHqA4b

C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	1.77 KB
MD5	51f950cc347470ed17ba848902b6a77a
SHA1	2e36be3d1a561f1479e2b17d78e3f525f96c8901
SHA256	5902e6494f1152e9d19d0f559ff0f7bb8537faec37251c59c4cec0711f828ee3
SSDeep	48:y+Mdz0cTDbXQ6fXSGaLSftjb7yctigCb0N:ybw2jfXSOyGiRb0N

C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	2.18 KB
MD5	9c7031b9877a17ee153b7499a27bd643
SHA1	3283ca954b3aeee595b11763fb2806c99c856c49
SHA256	95626dc2a65ac6c103dfc08b07b2bf4a2d0d948cfc2b8a0286ac02615995a02a
SSDeep	48:gv8Nh562f8WqoEhWINJQbDu4mZm/cW/bq5UIE820E6Tg0:LR8WqPhWIX+qpmEW/b9I00E6V

C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi (Modified File)
Mime Type	application/octet-stream
File Size	2.39 MB
MD5	4baa58c89f5e1a6f867525c723aec4f7
SHA1	b91fdda34d12cfd4b9daf6b711d67f053c8da169
SHA256	a5e08de6cd2fd6f4bbd38fa61bca80232a975db12fdab45c4050f96401c944d8
SSDeep	49152:GuDxL8QBoI9eljidTex4S120ytJyhaD6CmEb:PR89EQ1oV

C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml (Modified File)
Mime Type	application/octet-stream
File Size	1.24 KB
MD5	fbaa62da46a6d3bd02b15090ca491549
SHA1	7bdf69c5cc4956dfe60607c25be2d1720d8e4aab
SHA256	2151912f2767d9acf53c0d559ff9694035f5f148d002d5a4e155b06b5a7c87cf
SSDeep	24:NrGv/PKOMXV63INcyvfaZYJzX3wHstEVtHj4JQq/pI15H2UJuzXsJo5JWZAs:OPvu63I/vx5MSdfKuz4oaT

C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	1.77 KB
MD5	079f7436cabe7db18f51fef32eb0e93c
SHA1	c9fb7b06dcc31639399a06a02fb5fa9f9dbf356e
SHA256	f7cc70ecc7e85ec66292ba972406407938255afe01bfee3623beb85718f41fe8
SSDeep	48:f4uAOc+68qYDQDHDse40XiD+fz5pf2rWGg27M7xm4frM6w:4chqUNe408OPfq7g27MVmWw

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml (Modified File)
Mime Type	application/octet-stream
File Size	582.71 KB
MD5	7e6c63da5b1cb9532538d02ac960ec3f
SHA1	3d69ca48e83f71619ecb7c454266c331a389c54b
SHA256	c48c8e141360add9ac0efaa94735660828261c9b92a3ca8a30d99814cb32f62f
SSDeep	12288:2Muz03L5/Rjl80vLMHu14nFpjKW4MgJZZ/CAi02uCAi0IoiyEfCAijFvYFpjKW4+:2Muz03L55W

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi (Modified File)
Mime Type	application/octet-stream
File Size	3.53 MB
MD5	e66c9ce95026a743bac32456b0104af0
SHA1	7934218f40171eb04868b98aeb1bef9d70d58980
SHA256	cba42ec76a8a120d5b76ced54bffa3fbfe496fd1d1c32e3c6a0b067b07b64473
SSDeep	49152:QvlLsUloOZlxyt+BDljNNHk3qS920yrJoDNpqTIIIIIdhh5Ax8yZ:QxsluyAwDhpqTIIIIIds

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	5.78 KB
MD5	a292c948a8ce4cd6a990de858330219a
SHA1	4b065fef750f7a203fd80c55b4d7219563241d4d
SHA256	97f39d3b3b744ca5575eba08b65e623851ef11ca7d95fd6a89c4ad33ce4c153b
SSDeep	96:9A8dkhPCSUgzeHxfAzzw2z5ZtDEImkYtMzr2hyPvFtgTQg/FeM/qdi4BfgMkZCZM:W8dIwKzk2z5ZREZE32qdtgTJFGdpgsu

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi (Modified File)
Mime Type	application/octet-stream
File Size	848.85 KB
MD5	9560ce03318acb5530d19c6ca01028b2
SHA1	e82ad1200c3f204e112853bd9279fab724498ca0
SHA256	aa5b46bdf366b9b3f946042553b5db98f66aa79e0eac455aa3848036c9332ea8
SSDeep	24576:ia4gEux3P6WBWkmf3egDqo8o93lA6p7wbd:iyzgLf7qoQ6p7w5

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	1.15 KB
MD5	9e6f5915df84a72e719ad788f74d871d
SHA1	b14b675f1cdc30717b2820c3c8d328ca3d0e41ef
SHA256	3d0e173ff14d85209d2c545720d619db8ffe7c1a546b3e344bc16b68c6d1fc7e
SSDeep	24:uqT8sUexqR3VfY9+36nNaMrm7pmTVfMBhV0SWW4R6s:utexOw+qXyyZMSSh4X

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm (Modified File)
Mime Type	application/octet-stream
File Size	26.91 KB
MD5	d0d51bbc6a401d01ef759ca9bf7f5410
SHA1	6c09fbe705a65d75bc118c0021eb1bd11493d6c5
SHA256	a2a6e8704eb4b404b60684b67218f7b8490e131aed91bdc2ecf83a06cf0fe79f
SSDeep	384:GRLLdNE8q8+6+sAKirqbpp/tTxqpK4f0KUlUcna/SduT6PEI9PRHvEe89:c3o8btngflU1qT6PEsPl89

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm (Modified File)
Mime Type	application/octet-stream
File Size	65.97 KB
MD5	3b4898614527d9675ecd840946320a4a
SHA1	35b3bfe1c5c91dc762122c032cc08b6459a044ef
SHA256	dac08a619f13a5475d9ab1114ce74e3cff62d5d81fbb07a3c03e6d338d57ec61
SSDeep	768:ttnx5uzSrQx5uzSSd3Z0XV9uUf30J3S7rZTmiKhDG+hdkDg7Ka/k4fJ5tVSsr/b:PgwYgV2lsA3Y3S7cpJxdGYLk4LtV9Tb

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
Mime Type	application/octet-stream
File Size	9.48 KB
MD5	c7353d650cba386c49d9f047adf7cb4c
SHA1	8b1c1d3b945d088aa3d9406c02986d39618a9b7e
SHA256	cf6c05a12e64faca32b9f6adeeaed503e50cc0b95843e2001529fd05453ac256
SSDeep	192:nWUIH+v4+NGnbmXOkklLKwpxfhm2L7+FwfVS:Wxev4+AniXOVlLKcffJfVS

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST (Modified File)
Mime Type	application/octet-stream
File Size	3.85 KB
MD5	e97b6587eb550a54a560ce54ec9c3e13
SHA1	e076654c4b4ced4e96beb42493133a0ffe59e30e
SHA256	7b39f00e2b42d963c4a05b64b0f670b45d89897dd0198b70dce30e68ac4813af
SSDeep	24:ugpFbKR5gkEWMBBujDk45/CxvvZ8ASdqzx8ooyneeO30HfJqFhUOnZXr9CGglt7T:uaBL4MBI//5/+B4qzxZVfJshzx9CrvT

C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi (Modified File)
Mime Type	application/octet-stream
File Size	2.40 MB
MD5	d12791d38bb09f0daec6f7b4f96be7f9
SHA1	b255fac538f31a9752abc440e558621aa3cf9e2f
SHA256	456daeeb9990fa83d7e56ec455504573a571b0c1fc77590d6edc56b568bff97a
SSDeep	49152:Z0jDxL8QBoI9eljidTex4S120ytJyhamLCj7v:iR89EQ1o3

C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	1.67 KB
MD5	12578f10041186f6568eced29707a76b
SHA1	2db8e9732d25d13433c2d8e9f5cfdc29ec9deeb5
SHA256	9dc5d5d43ab867b4fd264255ffca95c18749d771810ba4ab531b4bd41099a025
SSDeep	48:yxRK9pH9ekXySKAtDENs0XGvQ1RqO5V/kdn1:ck/H9Zu8EX/1wO5VK1

C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	582.71 KB
MD5	1dd39de46b009c0d5a941b0610870c0e
SHA1	bde3e3f143c9fb70379158f0a4f4dd2f2afa81f7
SHA256	eb87555a5d5778e619418cb4d9844a12abe322c5c7c7803594bda546e44e4ae3
SSDeep	12288:qfsKmHVxch9FpjKW4MgJZZ/CAi02uCAi0IoiyEfCAijFvYFpjKW4MgJJ:LQi

C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi (Modified File)
Mime Type	application/octet-stream
File Size	848.85 KB
MD5	22b893b342765a603f5af29721411f65
SHA1	5e6ff0f1de1607683a68e526ca125349931162e7
SHA256	927ec7e76687796e48a6902813b3dbf455408b67efd7d17f4d7fd023be06720f
SSDeep	24576:cVy4gEux3P6WBWkmf3egDqo8o93lA6pMoKz:cV6zgLf7qoQ6pMou

C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml (Modified File)
Mime Type	application/octet-stream
File Size	1.15 KB
MD5	ea4e04fb158bdd169997eda471475e24
SHA1	bcf8cf4242253a9b2fcd984405f410dac9a2849c
SHA256	90522cf77d16aa6709e05fdfbaaacf09d4a387b643f90932f7ad98de212d7dee
SSDeep	24:xwlb2o20cXkbSQOo1HALSGv5IyRHdUZ3tEqwrLv9SbtkO8fWJAr73s:qp1bS9o1HISGvayRHiZ3tENSbI37c

C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
Mime Type	application/octet-stream
File Size	2.91 KB
MD5	a6d60ed379d6095d57eada5bd795e6ff
SHA1	1811ed95b776c6d2701a4c9e158c5ca2adc7c205
SHA256	acbcb0437254496ba66c288acbad8fd1db597da7392bb31a71576a6fd68cbb15
SSDeep	48:2gLL6PgMN6sM5ZAWMw7ST8Bm2NXLwWstv2EQNHkKyRKP6N4p5f1n5SVu+Le5f4S7:3n6PgMsswO4pNXGvpRs6N4p515bcYgS7

C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi (Modified File)
Mime Type	application/octet-stream
File Size	1.90 MB
MD5	9c20eb8fefc48f0f3f288fbaef5af6ed
SHA1	0087f149dbaa3d03ffe48b26164e3c4b46e30cc1
SHA256	b6f0fbb4a968b47ff93176b943ee2a50ed8648f33f83989ce528cc241c03ce05
SSDeep	24576:TCAiPJGZTxhF6WBckmh7EgVEG8o93s0ZWdrU+MAR+acIty0BqEI2S+o0k4Xqb9O:TCfPqHWLhHEGr0BqEI2SU

C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml (Modified File)
Mime Type	application/octet-stream
File Size	4.52 KB
MD5	c0fe8d98b0a8f5a4e32737818aa5b257
SHA1	63bef2c9db232d36039b64d927178f895d613569
SHA256	81aeec4128a27776655b603de901d7dad2bc053b500ca0b84c0a28529acc4c9e
SSDeep	96:Js9aZqDtOlpt7TjIA44LZLo0g7C4+2dPtBNHfxzf0uwOcWOM:JuSqJGI0tDwCYPtBN/xzwOcxM

C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	699.41 KB
MD5	b9d4748bfa46f72506d7ea62a03087b5
SHA1	0664bb5b14e1fed45b05682bce4ca3cef1322677
SHA256	65c06848663b40037a3ee2c06c10ed7925b67c1966c424951b0767d896be6afc
SSDeep	6144:wVSH8xPG1BYWrsFbwdzdhAvfWQK+DU/Sx:caSx

C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	26.26 MB
MD5	11b377fc89f3f59e991bbde31e52217d
SHA1	b766c32ce296e98af9a335aee626db50f0810991
SHA256	ede88d466932e5f18e18fbf8fdc3bec5dda28777bb49b7baeb5ae11b659075e4
SSDeep	98304:RhZcchjWpuXDTvqK+nCPg+stUoNJHHeG1+bktEnr+jtNqYrL5UEHzYh5AZ+M0Jbq:RhychlTvq/rJH+4+kttXTYh5i+MaW/

C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml (Modified File)
Mime Type	application/octet-stream
File Size	16.81 KB
MD5	748c977c6a08ec386ad2259ef7ae2f3e
SHA1	68cf04b22e8196c68f4fe2a228ae72bc7fa2e947
SHA256	e9b98acd876628ebdc294162eee5bc8bc9944e62b21a6c137c9ed23631526475
SSDeep	384:j82y1GHHMwrtlMlFbyoDofrrRMpwAuoi2LGkomR9R5O5Z2oZLnIwLxOb2N1EQptT:ry1GnMwZliFbyoDoDrRMpw/oi2LGkBRE

C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml (Modified File)
Mime Type	application/octet-stream
File Size	30.72 KB
MD5	80c6ec5992c8a0850095dff00771e7a5
SHA1	8686b3f1313dffb095a4cd0ae440fc95a9d7c8b3
SHA256	2c79fd45ecb8293ff52ffee54ced6a1f3c562a8625925fc2cb4c961213d9cc23
SSDeep	768:zOw9wSwSRmw6wRw6wDYXt8ohwWNQwUweXwEwSxagnzvpuqaqU8udhHvMpd5:yScYXt8HxZnzvavo

C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi (Modified File)
Mime Type	application/octet-stream
File Size	1.90 MB
MD5	4053861c2f99090295a6db5c1beab8fb
SHA1	2ef51952b8b40b5734b74436194a3d548b25a537
SHA256	18994961a275c725ac623a58ef3510f6c0632c6b5df653fcc82102e1ef3222e8
SSDeep	24576:MmiiuZTxhF6WBckmh7EgVEG8o93s0ZWdrU+MAR+acIty0BqEI2S+o0k4Xqb94:MRrHWLhHEGr0BqEI2S6

C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	4.52 KB
MD5	9c9aa8c2a00c224b3a76f64bc9ef302f
SHA1	7cda26d86822b3c493188ba40ecbdbd31d618d91
SHA256	493cfed6ecc1f648da4c7e7c2f58fad5d2244e769cda506913320946a6f15e0e
SSDeep	96:uLKOW89CuU/2t82FuR5SB/gcmFVEMv886XRXPUGnJ1DnF:uLKDwCuU+vFppghEMv+XRXPUITF

C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	699.41 KB
MD5	a74cbd84c04c58f58bbe16ac7f22dbb6
SHA1	79463be475fd4e7e198820f7cf2b46e899004ff9
SHA256	ca7bd8023c4f745952d75a02139bbe1dc8a292cd6551e0148a568090462b7546
SSDeep	3072:CUs3vCR70dFb2uGEkrsg0+eixuEJYN4sxNV0IAKQajxM/SVjOQ4ernuFp+m4RzAN:j2vG1VEkrsSe90myKBjtAvfWQK+DU/SD

C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	10.30 MB
MD5	29c303413ab091e4be23ad09c125e569
SHA1	2c43d87d8887a1312737a0fa483094b594872050
SHA256	efc210c0020d7276aa1064de724361e3a3fc1f1ab3b963586ccaab25a39fcbb4
SSDeep	98304:2chN5EhrQQWeESh6BsaB/yJsOaAoqF9I9NaX6qTIIIIIol:Dh3EhHZhhsCaGTIIIIIol

C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml (Modified File)
Mime Type	application/octet-stream
File Size	6.62 KB
MD5	bb4553e0a8f3a218dff8cb33f9fe46d3
SHA1	686c5a8d2865a59f9977fb044970b106b8907bb5
SHA256	b6106e26bfea6fe6c74d9cc846b1b750ed35f4befe9263af1be717fc39be6180
SSDeep	192:0oayA4Qe/bZ7k+QrkHhKS/8FTkXwzW/D3tTMWLb6hPkGj:0obvxk+ak4SMkqWZIWn6h8Gj

C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	16.64 KB
MD5	475ac0d55a04b4446653187bb2b3490c
SHA1	b094bc9077dd9ea32fbcc7a3074748a728779ab2
SHA256	6cc0b9bd30b4a0db3583d0590e379b76982f95c17396d83454aa6c156575f430
SSDeep	384:DA6xrT9XOibw4yJpJYvGNN6S0+6CWseC3YHdMuVqsq:vx/bw4yJ8vGH6S0+zbYHdMyqsq

C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi (Modified File)
Mime Type	application/octet-stream
File Size	1.90 MB
MD5	0b785b0df1d7733de778ef68e9a82e0a
SHA1	c746ad6291e0e96bd87cf8a5f8fe30b9a276a22d
SHA256	6aa75a9fad643c9266c39ce9e343159bc2e3f09e7a3b3d49dbd226a3031a83a7
SSDeep	24576:stwZTxhF6WBckmh7EgVEG8o93s0ZWdrU+MAR+acIty0BqEI2S+o0k4Xqb9u:xHWLhHEGr0BqEI2Ss

C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	4.52 KB
MD5	df5ce1276dc54aecc82a4a3e5dfe5929
SHA1	d3d38ed1511388058b35580434dcb25525db8cb1
SHA256	4fb580393d93e397454cd8b18194be064b8effbdb0ff52880e5d56b03cadf451
SSDeep	96:fdFHDuvkq2XaO58Mx1WGGPFDqsNX9xEsVjx/EGG:fs0f873FDqsN8sVNC

C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms (Modified File)
Mime Type	application/octet-stream
File Size	699.41 KB
MD5	ec87c40276a0a25514a5a988a39c0f6a
SHA1	0b1f8dd6759dffb5c8c666289061e9cdbce77125
SHA256	b9a129f66c161a75c8d1ca592a47ea45ee8812e0492bb7824bb05628f177cda0
SSDeep	12288:cDemWs59ArkrnsVhfaiN3OqULMEUQGw/GC8aSt:cDemWs59ArkrnsVhfaiN3OqWMEUQGweH

C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml (Modified File)
Mime Type	application/octet-stream
File Size	20.45 KB
MD5	188f3706728989398abc8f840c58154c
SHA1	6a14638014c37b9d0e1a190f3dc7664344c76147
SHA256	0cf71bbc915b71acaac36aa5f424c0b79cc50b8955bf80fe85f67b055c827cb4
SSDeep	384:S6P0+Yg117gKUU92i/di4qM+Ogs0O4fguDlJNePR2UXAX:SA5lPiMisU5JNEO

C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi (Modified File)
Mime Type	application/octet-stream
File Size	11.50 MB
MD5	a78d69ba58a8e0a324489a05262b2552
SHA1	b0a764cce20b419aff2742bbb62989f74a382d6c
SHA256	1098d28a336fb17d1ded29a30de7cf349bd47eb853ab8f2be4a73ffd4aaed084
SSDeep	196608:5NhvchvTvf/kSi1VbridMRFLbYTIIIIIy:5LATvf/Fi1VbridMR5s

C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml

Modified File

Stream

Unknown

»

Also Known As	C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	8.87 KB
MD5	99b37360c97ea72f0015e277cac66b86
SHA1	9378e930844adc1f5d5abe234bb33c871b054879
SHA256	cac7f42f628e224d6cc20bb1797e680b3375df1156ec32b48de31566c51b2dd5
SSDeep	192:QqI/IgihefbZhgZkFaXXvjtDs8uiNU0YhDJOgK4OiRtRULG0gol/xliYVPgGUsMI:Qwt0hakU54wYNAEgLRFi6WI

C:\Program Files\Internet Explorer\SIGNUP\install.ins

Modified File

Stream

Unknown

»

Also Known As	C:\Program Files\Internet Explorer\SIGNUP\install.ins._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	application/octet-stream
File Size	819 bytes
MD5	8da616afc9d8d753fed252419814e619
SHA1	ad06ef1cb8e4515c1fa808388a6d647b16dd3410
SHA256	0bc496d10d133aee1dfe4d6cae28c45010a6565663d72b72b5063c91d59122e5
SSDeep	12:BKoshTkV3y8oix1YMIZlCDULpCo/vmg7Kap/pu/o6KDC2L7TOJz9TltNrtvSUsC6:B/VCBix1YHlCDbK+g7xQX2O93N5vf+0s

C:\Program Files (x86)\Adobe\Reader 10.0\Benioku.htm

Modified File

Text

Unknown

»

Also Known As	C:\Program Files (x86)\Adobe\Reader 10.0\Benioku.htm._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	text/html
File Size	16.95 KB
MD5	832eb62eec6e28cf9b3e9a834c3b7865
SHA1	26b5dd340b483c581db0edb57d78637c9d997240
SHA256	d2eadf253aeec7fe248834221d322bd775b1b0ed4d5871d44211cad15af8910e
SSDeep	384:yizWkycXuz2B+zGPihqAqRM3bVsf+5vFAFmg7aRLPOC/0ofhTqjK23U:ycW/MAzGBRMCm7aTeFPOCcofhUKKU
Parser Error Remark	Static engine was unable to completely parse the analyzed file

C:\Program Files (x86)\Adobe\Reader 10.0\Berime.htm._NEMTY_kGOBjgD_

Dropped File

Text

Unknown

»

Also Known As	C:\Program Files (x86)\Adobe\Reader 10.0\Berime.htm (Modified File)
Mime Type	text/html
File Size	17.03 KB
MD5	a5b2d39fecb809444d10aa8fad51240c
SHA1	63cbce95eafe8cb17ed316810f8d7425e16416e0
SHA256	01de41cadc6e27488a91e9012089fa1004ada9a2e5ebd577aead36c53e3e3425
SSDeep	384:B1vwGmWtSfNX175E/jN86+Wf8/c18UACDH3MKO8PRHVqZnFFAYRB:B1vw4eH75gjecz8LCT3/tV2FFAYr
Parser Error Remark	Static engine was unable to completely parse the analyzed file

C:\Program Files (x86)\Adobe\Reader 10.0\IrakHau.htm._NEMTY_kGOBjgD_

Dropped File

Text

Unknown

»

Also Known As	C:\Program Files (x86)\Adobe\Reader 10.0\IrakHau.htm (Modified File)
Mime Type	text/html
File Size	16.98 KB
MD5	7497765a849d983596bc994e541f10c2
SHA1	40324c58a0ff9054fbde05680128aa587dcde3bc
SHA256	c8ad210ce828dbf3e17e31a24a64310ce0e43bf7c9a1047eef58a2a20a8a6213
SSDeep	192:QuCTZ4T50XhLy9pbrNkmHl/lPPHkMAbt0OLdN9Fr4rUuvKEnOSm6p1nRQ9D7HtVr:QTFLqvOSl/lTAtfVHt/TWavSWwo3LxL
Parser Error Remark	Static engine was unable to completely parse the analyzed file

C:\Program Files (x86)\Adobe\Reader 10.0\Leame.htm._NEMTY_kGOBjgD_

Dropped File

Text

Unknown

»

Also Known As	C:\Program Files (x86)\Adobe\Reader 10.0\Leame.htm (Modified File)
Mime Type	text/html
File Size	16.91 KB
MD5	ed7d1e60543ade45983e811e90303a48
SHA1	3791621a7659680655729c40f7c2f60ffa3382c3
SHA256	d9931a81fcc19c4079e9f0f6bd1acb8d2c61e1398986fe95a7c3b9a2942537d8
SSDeep	384:x6dRV7QtJfGnKj2S1GvF1XWyM22I7FJCaorpuHF9:xCRVYt/XO1mN2zCaod29
Parser Error Remark	Static engine was unable to completely parse the analyzed file

C:\Program Files (x86)\Adobe\Reader 10.0\LeesMij.htm

Modified File

Text

Unknown

»

Also Known As	C:\Program Files (x86)\Adobe\Reader 10.0\LeesMij.htm._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	text/html
File Size	16.82 KB
MD5	35015ad341a36737ed2f78fe678c0414
SHA1	19ba35cf7b24f58145cf5c38fd7ebfe2d7f35719
SHA256	059dff9fc67932dad33067246b0f843c939df51d6f1b5671eb56706ec21db933
SSDeep	384:S9ymlbA6oNHB8Lr6dszlFKueVY2fzIFh7xlo6wV:Sbb2361z+uInMHtC6wV
Parser Error Remark	Static engine was unable to completely parse the analyzed file

C:\Program Files (x86)\Adobe\Reader 10.0\Leggimi.htm._NEMTY_kGOBjgD_

Dropped File

Text

Unknown

»

Also Known As	C:\Program Files (x86)\Adobe\Reader 10.0\Leggimi.htm (Modified File)
Mime Type	text/html
File Size	16.98 KB
MD5	f99ab6e2158f8c003a7619c232eb34bb
SHA1	4df817e8faa62c1acbd453dfc184dfe1e876092b
SHA256	1b7128b55ffdbead7d1740335e4f194535a45cd5168d8a230deace7983fa7c2a
SSDeep	384:LMu9QfwP92G4h/KT9bUkigT38DlYOXFXwtBhTqMZp+Yp2Uax5GaoU:LMbwV2GOEUrw6npwLhFbp2B5DoU
Parser Error Remark	Static engine was unable to completely parse the analyzed file

C:\Program Files (x86)\Adobe\Reader 10.0\LeiaMe.htm

Modified File

Text

Unknown

»

Also Known As	C:\Program Files (x86)\Adobe\Reader 10.0\LeiaMe.htm._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	text/html
File Size	16.96 KB
MD5	d50e2639ea46865416c7d24cb57f5dc1
SHA1	7428f4704088c7b6e5f48e59a4ab7a4ab42af5a4
SHA256	de9639a5e336f8bc68b1ead290d235bcc7040a1d9c50ed16a5928876f6154fb5
SSDeep	384:w8PK0YH7TP34PjSfuC06Ty3Dkdsj4ZXzqkk:wt0YnvW2mCrkDkdZ5zJk
Parser Error Remark	Static engine was unable to completely parse the analyzed file

C:\Program Files (x86)\Adobe\Reader 10.0\Liesmich.htm

Modified File

Text

Unknown

»

Also Known As	C:\Program Files (x86)\Adobe\Reader 10.0\Liesmich.htm._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	text/html
File Size	17.03 KB
MD5	2e0d716a9c7e67a8a49500f67e4e6792
SHA1	454b81a85ab2e68401e746c2878dcf508fd2a493
SHA256	628d550aa31b6bea83a68b6d10daf8af8c9d224e8e0f8747de48655f7e3a4aa0
SSDeep	384:vEnfmy1V4xnWrEPUFkuPDVGQuip9g/VfYl8+lMQhc9PE:v6O64+fkypzgZSK9c
Parser Error Remark	Static engine was unable to completely parse the analyzed file

C:\Program Files (x86)\Adobe\Reader 10.0\Lisezmoi.htm

Modified File

Text

Unknown

»

Also Known As	C:\Program Files (x86)\Adobe\Reader 10.0\Lisezmoi.htm._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	text/html
File Size	17.29 KB
MD5	d864a1dd1917634617307858d8873212
SHA1	69caf17c862dcfa1007415afd6a11888eebb6389
SHA256	3cccbc25cf4fa7654af0ed6aa513fbb75bbf4fa7426c903b0cc5025a9fac15a8
SSDeep	384:/5dcNQ1dElp/LD1mML+UAKCH23cRnnCXQb+/ROa1BKWfE7oPixc:/5dS8+p/P15LYK8l+pxAugRc
Parser Error Remark	Static engine was unable to completely parse the analyzed file

C:\Program Files (x86)\Adobe\Reader 10.0\Llegiu-me.htm._NEMTY_kGOBjgD_

Dropped File

Text

Unknown

»

Also Known As	C:\Program Files (x86)\Adobe\Reader 10.0\Llegiu-me.htm (Modified File)
Mime Type	text/html
File Size	16.85 KB
MD5	a53b98531e7bedf516c1ab9bdd852ed7
SHA1	917b3b1c39d30efd8cf4c52dbd4418dfe5fc8e8e
SHA256	d3f439694801c3a7891065f0e89b626a0a7e860f512fd14d5f341804f0dcf557
SSDeep	384:D61W02iV78aWVtFsBlhi3huk6FRUyxlbRjzHwb2CnEZeqYtYxlXn4sNK1:0W0rh8JV0c3EFqu5Rjzwb2CEexQX4sG
Parser Error Remark	Static engine was unable to completely parse the analyzed file

C:\Program Files (x86)\Adobe\Reader 10.0\LueMinut.htm

Modified File

Text

Unknown

»

Also Known As	C:\Program Files (x86)\Adobe\Reader 10.0\LueMinut.htm._NEMTY_kGOBjgD_ (Dropped File)
Mime Type	text/html
File Size	17.18 KB
MD5	9ffe91eb6b268714f8d952f1d48003e9
SHA1	d118f2a4a4b6ecf932ba96243d108bc68a631b42
SHA256	26f3bc6289e0421919993821eb8e3a4059dfc7bb0014b44512e6a885233ce206
SSDeep	384:4qM+tV43+Rhl0mi0fjbUSI1dxV0gMi+nJh9RJw7zKJVN3:4it23+N0EoSSbagB+nXO7zuVt
Parser Error Remark	Static engine was unable to completely parse the analyzed file

C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Adobe.Reader.Dependencies.manifest._NEMTY_kGOBjgD_

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Adobe.Reader.Dependencies.manifest (Modified File)
Mime Type	application/octet-stream
File Size	1.79 KB
MD5	3cd97bbd29e07a9e666e825b3b487014
SHA1	480d2cf0584687379852cb33912cb01a2d986990
SHA256	8eaa53a9772abb9ebc43d132cd83d6241fda8651a4969b578e1ba257ef0c79e3
SSDeep	24:pRQoaFtzUXVFI+2whCI4K5oToCd/6k17W4hCZtZ8mlZSJSBdYs/Xu7A+aCb9Brxb:d6YOAUpA6Tt7DUv4s7Q9Br7tlLvXFT

c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\cookies\5p5nrgjn0js_halpmcxz@db-ip[1].txt

Dropped File

Text

Unknown

»

Mime Type	text/plain
File Size	111 bytes
MD5	9945bd263c27c1c1d61e6bf18b3f1b2f
SHA1	e98f386ef7d1e8ce778565a224a39e041195814f
SHA256	946224d1c6aa3a0d09bc965e5f0316425ab705048630e6ea037358043570c5b3
SSDeep	3:GmM/fHJ1EWXAHTfD3DEWUyHmTlSNXR7/SdZuvNI0vX:XM//TgfDzEOHqlUhuh0vX

C:\MSOCache\All Users\_NEMTY_kGOBjgD_-DECRYPT.txt

Dropped File

Text

Unknown

»

Also Known As	C:\Program Files\Internet Explorer\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\pl-PL\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Media Player\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Media Player\Skins\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\MSBuild\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\PerfLogs\Admin\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) c:\users\_nemty_kgobjgd_-decrypt.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files (x86)\Adobe\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Push\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Photo Viewer\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\ru-RU\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Media Player\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows NT\Accessories\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Media Player\Visualizations\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Full\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows NT\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Portable Devices\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\pt-BR\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Esl\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Journal\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\de-DE\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\tr-TR\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\ja-JP\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Defender\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Config.Msi\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Internet Explorer\SIGNUP\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Journal\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\zh-HK\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\Fonts\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\es-ES\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\hu-HU\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Mail\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\cs-CZ\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files (x86)\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\pt-PT\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\nl-NL\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows NT\TableTextService\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Media Player\Network Sharing\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows NT\TableTextService\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\zh-CN\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\fr-FR\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Internet Explorer\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Mail\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\zh-TW\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Shared Gadgets\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Reference Assemblies\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Defender\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Uninstall Information\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows NT\Accessories\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\it-IT\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\PerfLogs\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Media Player\Media Renderer\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\sv-SE\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\el-GR\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\ko-KR\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\da-DK\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Photo Viewer\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Journal\Templates\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\fi-FI\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Boot\nb-NO\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File) C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\_NEMTY_kGOBjgD_-DECRYPT.txt (Dropped File)
Mime Type	text/plain
File Size	3.74 KB
MD5	2f3f5c41ec5e79b06d75d610d9007417
SHA1	a1c3d04425c958700134f8f1be5e15975fdff142
SHA256	fd317778b1a579d425776051fa878ca930b6a313a37f822ceb8d69705edae9d2
SSDeep	96:rBkSab5A9cFzNMtzKelqP6f4dHkDTe4wGjjxll1:t7abO9cbMzKl6fuY1nxlf

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After