a598284a...b47e

C:\Users\FD1HVy\Desktop\hwyfzd.exe

Sample File

Binary

Malicious

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	306.00 KB
MD5	f1ef7657a4d7df5ba1042a90e5f64486
SHA1	cc74694481c7a94248ceb8ab8e52f2e5996bec8c
SHA256	a598284a823f757e3ceb8c5d11cfd87a9c4ddfb54d5937c2334e60035e36b47e
SSDeep	6144:Gv1iKzq0QXdK0NbeHl8mIYIlU/uuPWjFw1:GvfzqvNK0NbeUzW/PQF
ImpHash	14dfc9ba067c3bb30cb3ec825f0bafe6
Parser Error Remark	Static engine was unable to completely parse the analyzed file

File Reputation Information

»

Severity	Blacklisted
First Seen	2019-12-29 07:48 (UTC+1)
Last Seen	2019-12-29 15:20 (UTC+1)
Names	Win32.Trojan.Wacatac
Families	Wacatac
Classification	Trojan

PE Information

»

Image Base	0x400000
Entry Point	0x4240d0
Size Of Code	0x2bc00
Size Of Initialized Data	0x32cb400
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2019-01-01 23:52:17+00:00

Sections (4)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x2ba8b	0x2bc00	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.34
.data	0x42d000	0x32b2b04	0x7200	0x2c000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	5.65
.rsrc	0x36e0000	0x3b58	0x3c00	0x33200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.03
.reloc	0x36e4000	0x15900	0x15a00	0x36e00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	0.9

Imports (3)

»

KERNEL32.dll (86)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCurrentThread	0x0	0x401018	0x2c1ec	0x2b5ec	0x1ac
ReadConsoleW	0x0	0x40101c	0x2c1f0	0x2b5f0	0x366
InitializeCriticalSection	0x0	0x401020	0x2c1f4	0x2b5f4	0x2b4
ActivateActCtx	0x0	0x401024	0x2c1f8	0x2b5f8	0x2
CreateEventA	0x0	0x401028	0x2c1fc	0x2b5fc	0x72
GetSystemWindowsDirectoryA	0x0	0x40102c	0x2c200	0x2b600	0x251
CreateActCtxA	0x0	0x401030	0x2c204	0x2b604	0x67
lstrcatA	0x0	0x401034	0x2c208	0x2b608	0x4a6
lstrlenW	0x0	0x401038	0x2c20c	0x2b60c	0x4b6
GetStringTypeExA	0x0	0x40103c	0x2c210	0x2b610	0x23e
GetProcAddress	0x0	0x401040	0x2c214	0x2b614	0x220
GetTickCount	0x0	0x401044	0x2c218	0x2b618	0x266
LoadLibraryA	0x0	0x401048	0x2c21c	0x2b61c	0x2f1
WriteConsoleA	0x0	0x40104c	0x2c220	0x2b620	0x482
LocalAlloc	0x0	0x401050	0x2c224	0x2b624	0x2f9
QueryDosDeviceW	0x0	0x401054	0x2c228	0x2b628	0x34e
FindFirstChangeNotificationA	0x0	0x401058	0x2c22c	0x2b62c	0x11b
DebugBreakProcess	0x0	0x40105c	0x2c230	0x2b630	0xb5
PurgeComm	0x0	0x401060	0x2c234	0x2b634	0x349
GetConsoleProcessList	0x0	0x401064	0x2c238	0x2b638	0x19a
EnumCalendarInfoExA	0x0	0x401068	0x2c23c	0x2b63c	0xdb
SetEvent	0x0	0x40106c	0x2c240	0x2b640	0x3d3
InterlockedCompareExchange	0x0	0x401070	0x2c244	0x2b644	0x2ba
GetNumberOfConsoleMouseButtons	0x0	0x401074	0x2c248	0x2b648	0x212
EndUpdateResourceW	0x0	0x401078	0x2c24c	0x2b64c	0xd8
UpdateResourceA	0x0	0x40107c	0x2c250	0x2b650	0x449
EnumDateFormatsExA	0x0	0x401080	0x2c254	0x2b654	0xe0
GetCPInfo	0x0	0x401084	0x2c258	0x2b658	0x15b
InterlockedIncrement	0x0	0x401088	0x2c25c	0x2b65c	0x2c0
InterlockedDecrement	0x0	0x40108c	0x2c260	0x2b660	0x2bc
Sleep	0x0	0x401090	0x2c264	0x2b664	0x421
DeleteCriticalSection	0x0	0x401094	0x2c268	0x2b668	0xbe
EnterCriticalSection	0x0	0x401098	0x2c26c	0x2b66c	0xd9
LeaveCriticalSection	0x0	0x40109c	0x2c270	0x2b670	0x2ef
UnhandledExceptionFilter	0x0	0x4010a0	0x2c274	0x2b674	0x43e
SetUnhandledExceptionFilter	0x0	0x4010a4	0x2c278	0x2b678	0x415
GetModuleFileNameW	0x0	0x4010a8	0x2c27c	0x2b67c	0x1f5
HeapValidate	0x0	0x4010ac	0x2c280	0x2b680	0x2a9
IsBadReadPtr	0x0	0x4010b0	0x2c284	0x2b684	0x2c8
RaiseException	0x0	0x4010b4	0x2c288	0x2b688	0x35a
RtlUnwind	0x0	0x4010b8	0x2c28c	0x2b68c	0x392
TerminateProcess	0x0	0x4010bc	0x2c290	0x2b690	0x42d
GetCurrentProcess	0x0	0x4010c0	0x2c294	0x2b694	0x1a9
IsDebuggerPresent	0x0	0x4010c4	0x2c298	0x2b698	0x2d1
GetLastError	0x0	0x4010c8	0x2c29c	0x2b69c	0x1e6
CloseHandle	0x0	0x4010cc	0x2c2a0	0x2b6a0	0x43
GetModuleHandleW	0x0	0x4010d0	0x2c2a4	0x2b6a4	0x1f9
ExitProcess	0x0	0x4010d4	0x2c2a8	0x2b6a8	0x104
GetModuleFileNameA	0x0	0x4010d8	0x2c2ac	0x2b6ac	0x1f4
WriteFile	0x0	0x4010dc	0x2c2b0	0x2b6b0	0x48d
GetStdHandle	0x0	0x4010e0	0x2c2b4	0x2b6b4	0x23b
GetFileType	0x0	0x4010e4	0x2c2b8	0x2b6b8	0x1d7
FlushFileBuffers	0x0	0x4010e8	0x2c2bc	0x2b6bc	0x141
WideCharToMultiByte	0x0	0x4010ec	0x2c2c0	0x2b6c0	0x47a
GetConsoleCP	0x0	0x4010f0	0x2c2c4	0x2b6c4	0x183
GetConsoleMode	0x0	0x4010f4	0x2c2c8	0x2b6c8	0x195
DebugBreak	0x0	0x4010f8	0x2c2cc	0x2b6cc	0xb4
OutputDebugStringA	0x0	0x4010fc	0x2c2d0	0x2b6d0	0x33a
WriteConsoleW	0x0	0x401100	0x2c2d4	0x2b6d4	0x48c
OutputDebugStringW	0x0	0x401104	0x2c2d8	0x2b6d8	0x33b
LoadLibraryW	0x0	0x401108	0x2c2dc	0x2b6dc	0x2f4
TlsGetValue	0x0	0x40110c	0x2c2e0	0x2b6e0	0x434
TlsSetValue	0x0	0x401110	0x2c2e4	0x2b6e4	0x435
GetCurrentThreadId	0x0	0x401114	0x2c2e8	0x2b6e8	0x1ad
SetLastError	0x0	0x401118	0x2c2ec	0x2b6ec	0x3ec
HeapAlloc	0x0	0x40111c	0x2c2f0	0x2b6f0	0x29d
HeapSize	0x0	0x401120	0x2c2f4	0x2b6f4	0x2a6
HeapReAlloc	0x0	0x401124	0x2c2f8	0x2b6f8	0x2a4
HeapFree	0x0	0x401128	0x2c2fc	0x2b6fc	0x2a1
VirtualFree	0x0	0x40112c	0x2c300	0x2b700	0x457
VirtualAlloc	0x0	0x401130	0x2c304	0x2b704	0x454
GetACP	0x0	0x401134	0x2c308	0x2b708	0x152
GetOEMCP	0x0	0x401138	0x2c30c	0x2b70c	0x213
IsValidCodePage	0x0	0x40113c	0x2c310	0x2b710	0x2db
InitializeCriticalSectionAndSpinCount	0x0	0x401140	0x2c314	0x2b714	0x2b5
SetStdHandle	0x0	0x401144	0x2c318	0x2b718	0x3fc
GetConsoleOutputCP	0x0	0x401148	0x2c31c	0x2b71c	0x199
MultiByteToWideChar	0x0	0x40114c	0x2c320	0x2b720	0x31a
SetFilePointer	0x0	0x401150	0x2c324	0x2b724	0x3df
LCMapStringA	0x0	0x401154	0x2c328	0x2b728	0x2e1
LCMapStringW	0x0	0x401158	0x2c32c	0x2b72c	0x2e3
GetStringTypeA	0x0	0x40115c	0x2c330	0x2b730	0x23d
GetStringTypeW	0x0	0x401160	0x2c334	0x2b734	0x240
GetLocaleInfoA	0x0	0x401164	0x2c338	0x2b738	0x1e8
CreateFileA	0x0	0x401168	0x2c33c	0x2b73c	0x78
GetModuleHandleA	0x0	0x40116c	0x2c340	0x2b740	0x1f6

USER32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCursor	0x0	0x401174	0x2c348	0x2b748	0x116

ADVAPI32.dll (5)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RegFlushKey	0x0	0x401000	0x2c1d4	0x2b5d4	0x24d
RegSaveKeyA	0x0	0x401004	0x2c1d8	0x2b5d8	0x26f
SetSecurityDescriptorDacl	0x0	0x401008	0x2c1dc	0x2b5dc	0x2b0
OpenProcessToken	0x0	0x40100c	0x2c1e0	0x2b5e0	0x1f1
SetPrivateObjectSecurity	0x0	0x401010	0x2c1e4	0x2b5e4	0x2ac

Exports (2)

»

Api name	EAT Address	Ordinal
@dfyldfg@0	0x23da0	0x1
@fhdjdfj@4	0x23d90	0x2

Icons (1)

»

Memory Dumps (2)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Points	AV	YARA	Actions
buffer	1	0x03A18748	0x03A1C29D	Marked Executable	-	32-bit	0x03A18748			... Memory Dump Actions Download Dump Go to process
buffer	1	0x037E0000	0x037E6FFF	First Execution	-	32-bit	0x037E0000			... Memory Dump Actions Download Dump Go to process

Local AV Matches (1)

»

Threat Name	Severity
Trojan.GenericKD.32887457	Malicious

\\?\C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log (Modified File)
Mime Type	application/octet-stream
File Size	940 bytes
MD5	9a0f37c5a30945e1fb1ea4a9e1eb5a3b
SHA1	12b453efa5095dac85fcdadf64b62dbf42a3e51a
SHA256	c2bf3a5e817cfb50f3e69ff489e90641610dfaf4f9c947d90afc1ad37cd69ced
SSDeep	24:dOT3ULBoWU9yuD2YLNigLMS3uEDja1nNwH0v3wKx:dk3ULw9yuD2CNXLMSeEDu1nSHSwm

\\?\C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll (Modified File)
Mime Type	application/octet-stream
File Size	141.57 KB
MD5	f0b5eccd6abfedf0b3874867bd93d252
SHA1	5ea2fc5e3b3d08d451d68b564748fffe5af68137
SHA256	c33fa85784796f95f71f12f46d81529c96267975762dd2d7707a4c7389457d04
SSDeep	3072:LxqygjpPR52dCJOnMjilG61JjqnsdvY6NKe2v:LcygSEj4jqnGY02v

\\?\C:\$GetCurrent\SafeOS\GetCurrentRollback.ini_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\$GetCurrent\SafeOS\GetCurrentRollback.ini (Modified File)
Mime Type	application/octet-stream
File Size	1.03 KB
MD5	b998818228e0290c340a4208524bdd43
SHA1	56d37ec22a2c52b7940754f12f6c8a170ea41afc
SHA256	d8a806b5937db5a500eef9ddf65de1aa923d7c6445434992c4e98626dae39e99
SSDeep	24:cYk5bMbT3ULBoWU9yuD2YLNigLMS3uEDja1nNwkQJWy5c:cYk5bM3ULw9yuD2CNXLMSeEDu1nSkQ3c

\\?\C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd

Modified File

Batch

Unknown

»

Also Known As	\\?\C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/x-bat
File Size	1.44 KB
MD5	23b650ea2c355f0b30af0fbdb92274dc
SHA1	e234bf12e358eee1663ecdc1032de2275cd240fa
SHA256	0224712f8c4b10598fdc45955cf56bac6b3d5a8d4d0c117e83048b8c0ea8dd7e
SSDeep	24:Pq/5MObwCuFosPQ42BUdPLT3ULBoWU9yuD2YLNigLMS3uEDja1nNwyI:459bFuFjY4/H3ULw9yuD2CNXLMSeEDuG

\\?\C:\$GetCurrent\SafeOS\SetupComplete.cmd

Modified File

Batch

Unknown

»

Also Known As	\\?\C:\$GetCurrent\SafeOS\SetupComplete.cmd_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/x-bat
File Size	1.18 KB
MD5	193d74f034fb6c7c88bc537e99347c57
SHA1	e5e23738f14b285651ee0fde633f89c3174f922b
SHA256	82b026f8cbef9c458c261910a38d03de7b134bf867c3eb414cce9632c6fbe0bf
SSDeep	24:upfT5UGIxD6sT3ULBoWU9yuD2YLNigLMS3uEDja1nNwvFvkd:upVUGel3ULw9yuD2CNXLMSeEDu1nSvmd

\\?\C:\$WINRE_BACKUP_PARTITION.MARKER

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\$WINRE_BACKUP_PARTITION.MARKER_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	900 bytes
MD5	0bf3fc5300797c460e3f3926a0ffa6a6
SHA1	bc50179234add490da7a9915b9cf8c459cd02bd7
SHA256	446567a0228c721601e33956ca2f17fb6d903d2495f5be5c7056cc828bf02149
SSDeep	24:sT3ULBoWU9yuD2YLNigLMS3uEDja1nNw3/U3uN:q3ULw9yuD2CNXLMSeEDu1nS3/UK

\\?\C:\588bce7c90097ed212\1025\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1025\eula.rtf_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	8.27 KB
MD5	7d98ced89240541e1bab7f8cd96d668d
SHA1	7e2b54029aba1f3af128e10fc5fe7a6a66014dfd
SHA256	6892e65909ac88c891372dcff2c2969f6135ac321161f0576940d6b1f14068a3
SSDeep	192:IBkYjM1JJLeyxVl8R9ljXpKg7Rzl5LMra/2+MVauAo:JYjMx7xO80oa++MVV

\\?\C:\588bce7c90097ed212\1025\LocalizedData.xml_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1025\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	73.35 KB
MD5	250ecfbf198e1d1555601b7ad58f04d6
SHA1	329af47288adc147c1a8baf35130f0149594bdd1
SHA256	a1cb1c7386d441d16880f771acf8d5d7e5f7c71da9f57da237dc6897f86c31a9
SSDeep	384:/JlC8Xcx25aedBvBeebq/K8eDb4QxGMZzhKtQOsitz0SBijTJ3ejrwddf+MV27:Bocc8595HyKnbLxGMdAVBijTJ3eHC+x

\\?\C:\588bce7c90097ed212\1028\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1028\eula.rtf_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	7.04 KB
MD5	93ab549e9b00521ae0f0464fdc541059
SHA1	229b7a713a1c98ad275616ff8f09015ba68d5fc5
SHA256	289fe6caa2a23b4c98226bb6c3df4bd5647576220b1304b4964f2083531b3f63
SSDeep	192:JWXjvUGbTqrJ0eH4YDJ9pFV2sQ5pml9g12+MVauAL:cXjvUCIyeX9pFAsQbmn+MVq

\\?\C:\588bce7c90097ed212\1029\SetupResources.dll_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1029\SetupResources.dll (Modified File)
Mime Type	application/octet-stream
File Size	18.71 KB
MD5	83f04fca078972feba962f7e6c1049c0
SHA1	6dd3e30d366a02a917b2a73544e848cbb58d2bf8
SHA256	eb54884778c244b2d9baa0466ee0770a834583fec10bd2ed9ce6f8bf14c4b0aa
SSDeep	384:EGiQ40RDbdV54y473WiO4JgKWYnGq8o6Ih1KuMWp1eWCLXci2jpvs3+MVB:EGi50BbdV5f47dbV8o6MCMi2jpvs3+s

\\?\C:\588bce7c90097ed212\1030\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1030\eula.rtf_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	4.12 KB
MD5	15f1c1b35d7acf9327f1db36234dca28
SHA1	a1ca1042efe07071b116c07544c1c3eab3ae1e8d
SHA256	10499185c28126fdbe880ffe1f60761d29dcbfcd49f9e1347eb07c3ee385429e
SSDeep	96:NW9aJZSPAmSUhY3yeI9k6qaYf1ok5RUWw9lD2c7MVau1SC9:NWSwPAm5kqAaYfGk5Rw2+MVauAk

\\?\C:\588bce7c90097ed212\1030\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1030\LocalizedData.xml_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	76.80 KB
MD5	a234ab56c5a68ace3c982f095f49ec1d
SHA1	7cb73e4ceebbcee9b296bec06070996e75226633
SHA256	1efae8ab7150c2e76696f59a42e93fea831e9ce02fd8d901dfc1c0acbaced2bf
SSDeep	384:wvLLQtuTyy+BdThJGN7nXRnLJCggWuUyl+JMcf/zmSmRLAgRQJmS+e/JAu1O2Xx5:wZTv+FJOnhL4ggWuUMe+e/JQ+b

\\?\C:\588bce7c90097ed212\1031\eula.rtf_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1031\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	4.22 KB
MD5	d159e7a40f3599d2865270f482915186
SHA1	acd41aba8d0e0214e60271bb116566752d1a98d1
SHA256	8c7cac862bfce2b352dad96c175fb33f9df7fe10b5472b377f2dba1f8b68d8a9
SSDeep	96:u5KIfIIBxRb9FrgVER1r6oM1QcTKzwWw9lD2c7MVau1SI:nIf7Lb9FR1rM1Qg2+MVauAI

\\?\C:\588bce7c90097ed212\1031\SetupResources.dll_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1031\SetupResources.dll (Modified File)
Mime Type	application/octet-stream
File Size	19.21 KB
MD5	c9383daf5ebac61bd6c91be7a6d8193a
SHA1	3546278fa631bbd49d3b0db1cd464420b7c17ed6
SHA256	699482f1a65bf6eba0f7cd30c904c63548ccad082e3b5fa0c0e0db5ad221cfea
SSDeep	384:M4MjPLdV0cTy5o8EpvWn3nSYvYVA9WKieW8bLXci2jXHU2Z6+MV5:M4MX0cTABEpOCYvYVAA+Mi2jXHU28+Y

\\?\C:\588bce7c90097ed212\1032\eula.rtf_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1032\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	9.55 KB
MD5	5635b4b3326c79eb44de823e1852e6e4
SHA1	df66086859f30bfd7b393c0e95117f387ad4ecaf
SHA256	71b319656392e99b7d97a9e60b246ac274abc0e2bda465da3b19da7266bc9cd7
SSDeep	192:81/yNlFszGYj+f8oLz9zpG4mcOagpIRNIW1K6i9/fh9wBsvoZPH2+MVauAnGMSl:K/ydmb+UIBzA41Tk3h9wGv0W+MVxl

\\?\C:\588bce7c90097ed212\1032\LocalizedData.xml_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1032\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	85.14 KB
MD5	a601ed5566c23bf5168eb67e94fffec5
SHA1	25273398a0af335c3e8f33e7fd577c9b66c32bf9
SHA256	5202e445f752ede56429cddcb2952ab63b808fd44b97f9aa5fd11b5f8f035609
SSDeep	384:aKtXvCaXZ59RX520UURmWduKha3N++sTGoheXrW4MgcyvF773/xSFVQbleaS8tOB:amp7V25UYcBA3zl5PunjiJj+z

\\?\C:\588bce7c90097ed212\1032\SetupResources.dll_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1032\SetupResources.dll (Modified File)
Mime Type	application/octet-stream
File Size	19.71 KB
MD5	fd5c37a45281cf626fb4cf2cef764de4
SHA1	dd10e9edf499986bba7b74a2726f83d99a118b7c
SHA256	6db19d17b23f37586a62a28f3dc2bd9ee7ef9ffd169be541b66fc5d38abbb4f3
SSDeep	384:q9Ca8+q9emqannXPZc4U4ivQJ6hqKU7O2RPWTBZWwLXci2jXHUs+MV3A:q8a8+FannS4UTQ6bU7hSLMi2jXHUs+R

\\?\C:\588bce7c90097ed212\1033\eula.rtf_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1033\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	3.99 KB
MD5	29c3ba463636d6367b2ca041f1be9329
SHA1	1234860fc00b43b2ecb0176448f8577d13406a7c
SHA256	60beb4f96d340ef0bb16ee3d6d8a36c4a6fa28a9fa833033c2508076872fac13
SSDeep	96:5RZUqSPeVm/tpknx2mV5k+eFUZnaBWw9lD2c7MVau1S7:5xVm/tpkngIk+e2hA2+MVauA7

\\?\C:\588bce7c90097ed212\1033\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1033\LocalizedData.xml_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	76.30 KB
MD5	719c48e283dc026c4cdc4f21c1acadcd
SHA1	3f81123cc72f336ca57c811768ca7c1110fd027f
SHA256	e5c52b45b24274ad5ac17dc266bd4a533738d4f3e1730df78de92d8f3646b8dc
SSDeep	768:0uM8Pz9R/jHdJ6ff/WKKIrDPT7lSJYk+q:0G/9cfmKKPJf

\\?\C:\588bce7c90097ed212\1033\SetupResources.dll_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1033\SetupResources.dll (Modified File)
Mime Type	application/octet-stream
File Size	17.71 KB
MD5	7c4acae5f971abfcd75fba0f19da5328
SHA1	e5a90f17202abf632ecd3009224128d1a572acfe
SHA256	2c9b83646445661743d3970be1bcd3802ba31d75c741dd9ae2908e4ddc4489f9
SSDeep	384:QMKMX5OPA5hCKMTJjsSb6otpD9kzLXci2jpvQ+MVt:QH545hUTW6wMi2jpvQ+I

\\?\C:\588bce7c90097ed212\1035\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1035\LocalizedData.xml_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	76.10 KB
MD5	b2bca786facf46a161a022866829a99e
SHA1	4f364c1ae803b5faa79f32a63ce52a18e9460670
SHA256	ec4d69539f91f0120cac3e3c87db5f2ebd118f68f4c4d016dfb984977a2979d0
SSDeep	1536:dYV0nvPBX8ugmmuM92kEMeeGOCOUJPePJiWGICG+JNa:S4JX8ugmmuM92kEMeeGOCOUJPePJiWGu

\\?\C:\588bce7c90097ed212\1035\SetupResources.dll_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1035\SetupResources.dll (Modified File)
Mime Type	application/octet-stream
File Size	18.71 KB
MD5	e7175e67d144930e0f31c46355e8c80b
SHA1	d3b500fa63773407d1ed4de1539e60ab6515aba5
SHA256	15966f8b31d5184d8d4b7986dade0ca0c7b1ac82d496fc00f35ee3865973c427
SSDeep	384:CLs5TqobYJ1Pvi8mo+Oe2GbwyJXe2hy8pUOsWMkeWELXci2jpvW+MVc:TtHbESI/jIDJXbE8KO/cMi2jpvW+Z

\\?\C:\588bce7c90097ed212\1036\eula.rtf_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1036\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	4.32 KB
MD5	6681f422efba7456bb9d115bea82330c
SHA1	182e46451a154e846b78df44e2838eae7bfec2bd
SHA256	103a6fa12b74e78f67ae4d5e5109ff67de204a3f5a2d292815612df41220de20
SSDeep	96:trH+5SVebQV/Sig8QARe9UhpVBgOEJewtIFuyAeWw9lD2c7MVau1Sqo:tj7WKL13WUhpVBgbASIF0q2+MVauAqo

\\?\C:\588bce7c90097ed212\1036\LocalizedData.xml_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1036\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	81.90 KB
MD5	788d894306aa6b018f9db0b61a77c3cc
SHA1	3d243ec5150aa443bac6e7cd582d98ecd051dfb5
SHA256	624001fd314093bba4825c527cb1cd36196f8a3f94c3cd760c63abb6e746db50
SSDeep	384:AOT/D+QSZJHdzNjagJVzRzchryjiTIJz0kbG52bxVf+MVD:AE/HSZZdzxaluaIJzaIf+y

\\?\C:\588bce7c90097ed212\1036\SetupResources.dll_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1036\SetupResources.dll (Modified File)
Mime Type	application/octet-stream
File Size	19.21 KB
MD5	e34438bf6a575fb437e9ecafdea02c66
SHA1	20d847fb1991aa8a1bbc030c8c05f608e9546cd6
SHA256	af5e982ce00796b5992b39bd8f6d7db14eed638681ed5f0ac13246a076e49833
SSDeep	384:rso/Fpy3cDTmw5ORMds+JBz4iYkbiWpQeWELXci2jpvQ+MVQ:rso/q2aGXs+Jt9DycMi2jpvQ+p

\\?\C:\588bce7c90097ed212\1037\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1037\eula.rtf_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	7.57 KB
MD5	652c9922cddc35d6655c54c8726dccb0
SHA1	a86adf327f5ae1e396f9fb7f75299f392202164b
SHA256	157696c5a27bcfa3b1bd1a5b0dad315ab0b963536a8d2a9a744bcf98265a2084
SSDeep	192:l8kX77ev8sIqi/ovQGWLwFV3u/Vi4zNk8mlttroUL2+MVauA9:lHnevsqUovQLmwXKbroX+MVQ

\\?\C:\588bce7c90097ed212\1037\LocalizedData.xml_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1037\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	71.27 KB
MD5	bd30dfb9371703a36b9ad2a32475445f
SHA1	adcaca36a947c528f4ff876fc10122bd0fb757c9
SHA256	ee5dda97de9a92aa3002bc1b78cd0075672ec5161f8e56b3eca5b9a11f41195d
SSDeep	384:SNu2BeA0TgyGGeDXfXCMIlMHM5szaay27xaAzdNhXdQGKbvvGu1kZJNvSX33qLfB:S81GJDPXzIQMqT7xaeJN7r+C

\\?\C:\588bce7c90097ed212\1038\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1038\eula.rtf_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	5.03 KB
MD5	48c13eaf01eab36735e5136df5d8cd1f
SHA1	4532111154c2cdb22530cdb9b91ecb852b1185cf
SHA256	50e59315f7d0d65402471284c7027b080f49ee9200482fd8aae2cd5b8a73d0e0
SSDeep	96:XAyeORa/s9/VtqmbsLaOGiumq2ai+CCvqduQazM0rCwL0XgJHWw9lD2c7MVau1S4:XUOCc8aiuv4duQaRrCJm2+MVauAcZ

\\?\C:\588bce7c90097ed212\1040\LocalizedData.xml_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1040\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	79.06 KB
MD5	cf97c0016a69fa8e3b2e2692446e9bc3
SHA1	1da4c3a74347819e2e9e91f32c7885d3584a80bf
SHA256	d20ccb4302cc655719974357aec504019a849330eaf9d2b11d10dc41ffa46b3d
SSDeep	384:1W6KOsXFQt4QnO8RCuaO9nJKT0fW3uG1fPK/YBZ3tMa9eIzNZNs4fzWmJVo5HnsX:1NzcFQB9BfWtNKjaVLJiy+0

\\?\C:\588bce7c90097ed212\1040\SetupResources.dll_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1040\SetupResources.dll (Modified File)
Mime Type	application/octet-stream
File Size	18.71 KB
MD5	1cd01ed9c3c1854e3cbfd43a508437d6
SHA1	9a5c79332d2c92029d7c7f596e32cbebe3f77e9d
SHA256	fc3c50b0f5d1d8bae7a0ecbeef73625c2a9e89fee5c1b7a38ccf3487a2523038
SSDeep	384:rThCibyPUA1GpV4MWeIII/OvJhNcs1o5hWXeWFLXci2jpvzy+MVY:XFbFA1NIxJftC+ZMi2jpvzy+B

\\?\C:\588bce7c90097ed212\1041\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1041\eula.rtf_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	10.77 KB
MD5	7565cde2c9731e83f338277b22034ba7
SHA1	57837b55d9f6708ecb4935a3b8bee33c402dd30c
SHA256	cde740f707f788cbc57d8dfd036e4ff7fca3fc94fd8c1b5b3d9773fdd3bb1464
SSDeep	192:aaLM5VqQo6pw+Zj8WFNLGFsbPdsY6xTxKGDIl5lDSSQu6eKnRjFUt2+MVauAJ:aaIrSWZjpNyspsREGKlDYPU4+MVc

\\?\C:\588bce7c90097ed212\1042\eula.rtf_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1042\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	13.27 KB
MD5	04026af3bca50ede830287fddb00d38f
SHA1	009a5c0172f301effe351d616ad98159376e145f
SHA256	7a244b53f682db1c5c0eeb19a0f76110d885bcd79bd90ff0b448bede16ae91eb
SSDeep	384:8AJTVx5UimELsoxZi1Jb9ChErWdUN/rey+MVG:8SX5rllx4kEksZ+L

\\?\C:\588bce7c90097ed212\1042\LocalizedData.xml_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1042\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	64.59 KB
MD5	cd606a82deb99a55d807801aa961d09c
SHA1	e59190afc5b3b6e0e46aae6eb64ac43b8717011f
SHA256	75f0446875ff5f9488f3185df419f0ae0b9ffc53117d2bb23b7f225e5b5cb25e
SSDeep	384:rxC847opxMQIk/rn8KwCXlKDPtcad+zYucGy6vItbM+ZuaHQzSzXLGKgooDQA0pw:tu7oppIk/337AZG7QuaAtqpb5yw5Jc+8

\\?\C:\588bce7c90097ed212\1042\SetupResources.dll

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1042\SetupResources.dll_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	15.71 KB
MD5	7dd0b53ca6b6d10595b39c981fc4d7d6
SHA1	971613037b7cb6c61327d7cc3910d521a1ee07fb
SHA256	568709b6edf5dc636104a18ec0055b23bb20f227eb3b97c211478c12c0c8c346
SSDeep	384:bmPT4CipIJaBmmQLBfhtsx3wY9rsvdyX5ci2jpv8oa+MV+N:b24ppXBmmQLZzkgxi2jpva+tN

\\?\C:\588bce7c90097ed212\1043\eula.rtf_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1043\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	4.34 KB
MD5	d3e8c486f1333a593892007cfbdd97e6
SHA1	08e641bedb17789545f62e53c8fdd52aa2d978b1
SHA256	b14ccf6437588104bd37358b5a3d4621f01dade5e2db87321efebfa2dd892c35
SSDeep	96:048KXDmB5FaD9jiGyp8vPdX8aOlATLjy9A/wNF3DbIzgWw9lD2c7MVau1SNy:ZxDmB5FGdsUkKVoNVJ2+MVauANy

\\?\C:\588bce7c90097ed212\1043\SetupResources.dll_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1043\SetupResources.dll (Modified File)
Mime Type	application/octet-stream
File Size	19.71 KB
MD5	61612e92d658982e042ee0fa097cfe7d
SHA1	95176c8a76e7d096958fbace7d22753a95ff4f93
SHA256	f711517c0edceaaf8aa13df9b135c7b987860efa61fd0cea92ffc76b5c4edce9
SSDeep	384:dZmr/OyTTnfdoAunyTFGBMqWk00VLCexvCcOZjv1t2WlLeWvLXci2jpvw+MV01:dZmr/Oyvf5cyuMqU0Ve9zMi2jpvw+d1

\\?\C:\588bce7c90097ed212\1044\eula.rtf_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1044\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	3.85 KB
MD5	a0a1fd1249c80f0dd55e95f7476a1ccb
SHA1	0fbf8d51b83d0e52cd97ec7f88e6909f24c48d90
SHA256	c266a5ef7f4e6020657912986a6fb94c85b98b6b33d46be4def144b737434ad6
SSDeep	96:GkL0jtJaGp32degBaiBuvwqxqaAGNWtfsQbkysWw9lD2c7MVau1S9t/:6tJx+iicvwtsOsgS2+MVauAz/

\\?\C:\588bce7c90097ed212\1045\eula.rtf_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1045\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	4.82 KB
MD5	f2d324d05300f140d890b45e9405fa3e
SHA1	b8bda9226bcee74b6f90ade5cd0521f8c3d7be2d
SHA256	c79f559d571d4b83ffca10e306dc180ce41eaae5b652657c35c1bdbb91294ce9
SSDeep	96:wSrOcMPqy3AkRVKpRrexaDXdDg7ovFGYM4emaDuOPC4opnYWw9lD2c7MVau1SP:wSKcZXkREpRr42Xxg7YemUBoxc2+MVaz

\\?\C:\588bce7c90097ed212\1045\SetupResources.dll_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1045\SetupResources.dll (Modified File)
Mime Type	application/octet-stream
File Size	18.71 KB
MD5	480b22b70d6d4ab0afc7fe16f4d526fc
SHA1	245623893d599f2ad468b22f6fc6c8e294e56e8a
SHA256	f42674996e4ad0ec1aec019ea52cbc1c55faeefff9ef769f4903bfa4e582324f
SSDeep	384:ylH+dCmikjNb7oJSuduhgLC3q7bDiFmV26WneWALXci2jpvs+MVz:ylM1EAg6SCIoDYMi2jpvs+q

\\?\C:\588bce7c90097ed212\1046\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1046\eula.rtf_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	4.48 KB
MD5	2587a5944c49ceebfacb73b7d5a701c9
SHA1	04a8bbe84356ce0fed0720321a1ddbb38850f1b4
SHA256	18181bac9ba5a40023d341cb17bd14bb498028bd4d2c8b34cc0afcba52d46fda
SSDeep	96:LvJ6ss0rCrCLls4eFIw+G25JPSuv/QoWw9lD2c7MVau1SKwr:LvJ6/qjy4rGKwuXh2+MVauA/

\\?\C:\588bce7c90097ed212\1046\LocalizedData.xml_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1046\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	79.72 KB
MD5	731a2f2dca62ac3d8fe5686570e5a010
SHA1	0e1f15057d8c244996f2879146b7e964d1d90507
SHA256	89cf11e90f243a963c9cb009be0ba121462115e43c46076acd7ab05e87d6d411
SSDeep	384:SIBSwmlbR/l+B4NQnvKodM6wL1HFKi9cvMOem6QemIAY/YEQTeQoqk7EHd9nKxXq:CtmeOnva6q1H4eCe1CkyJtG07c+p

\\?\C:\588bce7c90097ed212\1046\SetupResources.dll_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1046\SetupResources.dll (Modified File)
Mime Type	application/octet-stream
File Size	18.71 KB
MD5	cf4dcf19c7758ba4c3a9bdf0a24fe8e1
SHA1	539a610770fe9bcda5354a7dc508c16c1cb47c34
SHA256	98051dd616731ec68245e4f15b431933edbaaa2d28a78b6af42c5984f773054f
SSDeep	384:zr8CWxLNxqWWECvMewtnX7bWQOmWNeWSLXci2jpv3b+MVqr:zILJxqWVCE5La7yMi2jpvr+j

\\?\C:\588bce7c90097ed212\1049\eula.rtf_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1049\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	54.06 KB
MD5	9d72af3fb43bfbe3575e41b4b7a8a5d4
SHA1	9f9ea75521471f603e7e01f72fbf81551d5e4146
SHA256	7f68139d370efef782c48d71c36661ac1fd92b3407a80ef581f8186b3d393856
SSDeep	768:T1lTkEBP/JfMFJv3zGz9tWQ2ni8UNo/8PZrS14B+R0:RxBJfmeDX

\\?\C:\588bce7c90097ed212\1049\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1049\LocalizedData.xml_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	80.45 KB
MD5	501dfda9dfd498501e8d10ebb069af17
SHA1	bb1bb7c8d750e76146c009763fb3b2a8cfde01d2
SHA256	81eca75b0a5c0737ffb5566786d4a9b15b7bf6a8b052deff77bb1d96a25cfd2f
SSDeep	384:xdZZV/zJHCTLhFA9fFDDQoEOXsPXBUhOLGvVVA5/Fpn9zJop9TE+zkX6JS/5cGhp:xvZV/zJiUNHQo2XyZVrJV+Is

\\?\C:\588bce7c90097ed212\1049\SetupResources.dll

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1049\SetupResources.dll_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	18.71 KB
MD5	518aa21074bfab510680f7215d6988f3
SHA1	6c8e90e57b11f522bbb45963cb6d38692136c57f
SHA256	dfaca41898ef00aa6a708f510aada891c298264fd6117241161572cb904da70d
SSDeep	384:K+CJj9KmgpkBLXrnYRe7hO9/kmIoPeW1LXci2jpvaFHA+MVZ:KLJj9XMk579EqgpMi2jpvYHA+o

\\?\C:\588bce7c90097ed212\1053\eula.rtf_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1053\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	4.65 KB
MD5	738a22fd1f139ebaac2c1962c16bb72d
SHA1	477cc90d95b3a8883a1b23859e1696b191ff4bcb
SHA256	9ebfa7425182e5f64f3d8087ba6cfde2fc35f74a8c1484e0a640c0f2964088dc
SSDeep	96:HE6nz+h5kWJ8CfD3XGWRpyVdI4Ems9B61tbzBWw9lD2c7MVau1S38Xeal:HEIa7k2TfDGWRpyVdI4EB9B6Tf2+MVaO

\\?\C:\588bce7c90097ed212\1053\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1053\LocalizedData.xml_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	76.74 KB
MD5	9a7391af5768ba32d1bd36938e7a7bea
SHA1	0132eda98c0ab2750db6e4b3c9a5caa5ac8b2377
SHA256	e0a39223920de26bc86162a850e8485b615b5421455f39fb5fe889e09a7066be
SSDeep	768:f9/8Wz2+vcbsyNASsuD7jwDkqmGeJsoO9+7:N8Wz20cbRASsuD7jwDkqmGeJsoOC

\\?\C:\588bce7c90097ed212\1053\SetupResources.dll

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1053\SetupResources.dll_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	18.21 KB
MD5	b7d57a5d43a9414601b853fcf0970aae
SHA1	f87821de50929ee2b1e53a36ba55f9655d8f05ec
SHA256	08a6aee2c173b6b2da3bdc945792d8a63768f4c8c151dcb753bdada0350febfd
SSDeep	384:EXlnV8ULby+TRHzKUCQYwY3sDa3U1D7hVgAbqx/oZVQVWpyeWRLXci2jpv4+MVxi:E5VLPzTlzK/DwrsU1hVgWVWVMi2jpv4W

\\?\C:\588bce7c90097ed212\1055\eula.rtf_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1055\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	4.65 KB
MD5	e65d5ff1f8d04be840719090913e94e8
SHA1	8381ad5c759454bda7b8264a735cff7aebe13718
SHA256	d435580557e2c849b1f0fd7ff9a90bdab5a8cea6023a0d4d67edda3d5ac5413c
SSDeep	96:L4M/lOWeZ7/tGzw3tUvlrg/huSpsS3wnXBfAldWw9lD2c7MVau1S5sv:LblyZTtGzctUvlrg53SSgnXBfS72+MVt

\\?\C:\588bce7c90097ed212\1055\LocalizedData.xml_r00t_{8ew5f6}.ebal

Dropped File

Binary

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\1055\LocalizedData.xml (Modified File)
Mime Type	application/x-dosexec
File Size	75.90 KB
MD5	b327b5c0d7b0cd762aed7ebbab4b019f
SHA1	9f91e006adecc2210b7d359ec26b18be5639d3d9
SHA256	6daf2f3c84d1a1db634e008220edc6e305079a87231714ea697aa39494380467
SSDeep	1536:ZrELDeGQRL87mlQg5IgrbGZzwOS8Frc+iI0jJNJ7rtRpUu:ODxQRL87mlQg5IgrbGZzwOS8Frc+iI0t

\\?\C:\588bce7c90097ed212\2052\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\2052\eula.rtf_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	6.57 KB
MD5	248e25fd7e83046fa13aea65f71e74ab
SHA1	f064ad1906caa62085cd05e9a6eb1a768eba0365
SHA256	b1bf04cdf98f53d63d1cb62dc8e2e325e672b3fe850c498c35111a045db017df
SSDeep	192:m/TRn/4fu9DZ0Px8h20xN6FtAK6XAf1sxUIorZ2+MVauAkP:+x/uu9DOZ80tAXXNx7oA+MVZ

\\?\C:\588bce7c90097ed212\2070\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\2070\eula.rtf_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	4.80 KB
MD5	31f5d13a7fa20ba8d81201c7c6124ce1
SHA1	aead65ed8c6d014acaa1f9ab8d0bd9bb18a1cec3
SHA256	38be382047ad64cf6520c077d3ec11089d04a355ffb84fa521d3270e78089fa4
SSDeep	96:LZ2/pLmvuFanDp2t+ZdarmkmlV2yDzrhHYypfikv6Ww9lD2c7MVau1St:t2hkU80t+6rmkmlVpzrC6/v+2+MVauAt

\\?\C:\588bce7c90097ed212\2070\LocalizedData.xml_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\2070\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	79.25 KB
MD5	fc223652fd64e3a3b800bc76fd068959
SHA1	4654de4832afadf8593d9e50d71132a9b58d1bfd
SHA256	d6bddbd727d0dd997a1038ae4d1320ce4bcec4cb92c6373697fe05c1833c3f1c
SSDeep	768:8TZNM/r/YrTNwbeCeRuXWpFxgJMh230JMaWg+w:8Tk/bmybL4uXWpFxgJMh+0JMTg

\\?\C:\588bce7c90097ed212\2070\SetupResources.dll

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\2070\SetupResources.dll_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	19.21 KB
MD5	e78f9924c661dc19a3e6396f5bb4e910
SHA1	c3e07d4c6329ddf89ab3cb6579e39ca03da890f3
SHA256	cdf24e40ad83c81dac3d4f6e097e5ee8b949bf73589d1c3e8ad673e31b95de7b
SSDeep	384:zSirsT9A5kgjb//zCp6cUXH/VEL2iV8qUvWp7eWYLXci2jpvag+MVt:zPi9GkIj/zCyXHwxwMi2jpvX+8

\\?\C:\588bce7c90097ed212\3076\eula.rtf_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\3076\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	7.04 KB
MD5	1ef490ed4c76b2b49f33fefc75c574a7
SHA1	d32c1b9455ef3e7ece198ac4708474b56b6cf383
SHA256	d897ddf1754ac6076282edc5d7c467f89ac69edcea92f913be5e8608235505f6
SSDeep	192:he8Wndh2qIKXl4q40rTszx7BBf8h+H4ijSca28Z872+MVauArI:hezh2qV4qzTSBBfo+H4ijSjbF+MVkI

\\?\C:\588bce7c90097ed212\3076\SetupResources.dll_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\3076\SetupResources.dll (Modified File)
Mime Type	application/octet-stream
File Size	14.71 KB
MD5	b9ec20431932c7a14b95992b82f573ba
SHA1	0ec3350ac776cc0415ad561137cd64db752b7104
SHA256	0379ea6f026ab390a00b28e39adfb2d37baf87fdbf74b3b5e7d1a3351fb31f65
SSDeep	384:4kl4Khq6J9NdIGpffjpZqSVzO3j2jpv36+MV3:4k7hX9NyGZjvLVsj2jpv36++

\\?\C:\588bce7c90097ed212\3082\eula.rtf_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\3082\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	3.88 KB
MD5	3f29b220f93d932439e941ce54a951de
SHA1	5fef46f88fb12e767569f3abcd850998e8b7bce6
SHA256	3bfb4119cb0315b820d193a9c24ec5c58b2b33fa8e443951a17e02f44750e9d8
SSDeep	96:r2V6p2vcYu9QOyzyIX9xASdTc4l2E3Ww9lD2c7MVau1S7Ic:SVpcYO1yztxXTc4d12+MVauA7Ic

\\?\C:\588bce7c90097ed212\3082\LocalizedData.xml_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\3082\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	79.00 KB
MD5	1f737f0d47f7f99153d55e33ae97e193
SHA1	44434db9d0499f65bb7526f08064fd20f4693495
SHA256	8ddd3a64b7af70b22b4cf302df3c9b4a24f362fd2e67e142bfd5961599ec01e3
SSDeep	768:LQh6GjNfnyH0VMf+Gmf+S94oU+7j2JoiZe+I:Mh6qBe0VMf/mfL94T+7j2JoiZ6

\\?\C:\588bce7c90097ed212\3082\SetupResources.dll

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\3082\SetupResources.dll_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	19.21 KB
MD5	1b757b44e4d66b28bb4e4c4f8facedca
SHA1	9794ac139460cf5285e8758d01d652f8fe499aaa
SHA256	72314ccfeda0279d9f48ea24c5ab63874c0b92d2068148aea55a347fd8f3f079
SSDeep	384:TqVFIpUm/kkT0oIusUQrQM69XlmW+eWaLXci2jXHUxQ+MVt:T2WpUmjTh5gQhC6Mi2jXHU6+w

\\?\C:\588bce7c90097ed212\Client\Parameterinfo.xml

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\Client\Parameterinfo.xml_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	197.95 KB
MD5	387e164a9ec294653e48756cf53ed739
SHA1	e4ae30103f2f25870cd10648ae771fa359040915
SHA256	3234a3abe3fca1f341deb8f6ae2595e0d0b605333f832a258f0eabee0f76e410
SSDeep	768:QgOC76gZC+FVrCZRbYoVQTLTQTDFdPknZ13GpPcbrI1+G:jOC76qC8VGZR0oDdPMIr

\\?\C:\588bce7c90097ed212\Client\UiInfo.xml_r00t_{8ew5f6}.ebal

Dropped File

Binary

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\Client\UiInfo.xml (Modified File)
Mime Type	application/x-dosexec
File Size	39.01 KB
MD5	62063d7f6f9589895df6de486606a91f
SHA1	0f3dadd8e50ef9a6654c94d097a4c14e863f661c
SHA256	24ad40b7e4be6cd2e0f1c6dbe2ab317ae774fb420b92fa55edafdefad14332cc
SSDeep	768:BDlWVTl8QvamtW67TJh6F8hZkV1GO0N0phUl9eu+dODOOODOtT/vefkfuz+Y:sl8QvfcKT/6F8hZkV1GO0N0phUl9eu+P

\\?\C:\588bce7c90097ed212\DHtmlHeader.html

Modified File

Text

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\DHtmlHeader.html_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	text/html
File Size	16.62 KB
MD5	98dd2ceab164a1d1a2500b41393cacd1
SHA1	dec9edadde70548734ef44732e87698100a78c1f
SHA256	84f1f65c92c88d68986bf2dd180cc5edd7904d51e50f54d23423964f0d084ece
SSDeep	384:gqFssFLuyQ/Y2wIIBSpRKSmnpB0vH3+MVg:guHLu6nNBiIp6vX+h
Parser Error Remark	Static engine was unable to completely parse the analyzed file

\\?\C:\588bce7c90097ed212\Extended\Parameterinfo.xml

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\Extended\Parameterinfo.xml_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	92.01 KB
MD5	c789c19cf73045c7e694ccefc3596694
SHA1	27a1c50c00c807e8436bacd056459f36d9c6d81c
SHA256	bf2b7d05057095c4eac4c53ea260ae400b4873b3de23a19e1614e788aca3395f
SSDeep	384:5cRLaPVFSw3AsE+CWxmqzP4JUaGMLiqedW0XeeUnG3GPcbrKF1+MVf:e54vI+CWDTaBG2PcbrI1+K

\\?\C:\588bce7c90097ed212\Graphics\Print.ico

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\Graphics\Print.ico_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	2.00 KB
MD5	6f6bac2d8d2ba4b05fc1c77211aa83b5
SHA1	be9c377ff91f45b94ac5a4fb9d8ae070f1a27478
SHA256	c71488c660561630a00062f1cebaa0821a1e67899974c7a50dab717efe0bda21
SSDeep	48:J+FhOX8sM15UBCumOVMSsx99+T3ULw9yuD2CNXLMSeEDu1nShnh2QCT:J+HOm16aaWoWw9lD2c7MVau1SCQq

\\?\C:\588bce7c90097ed212\Graphics\Rotate1.ico_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\Graphics\Rotate1.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.75 KB
MD5	b07a90834d14d32dc4af93321d3048f2
SHA1	1344fb57e0ad30b38e61e6fb2ce6c0c97102db1e
SHA256	7003e87aa8d98fb07bcc500a8fcaf703099f4047a49acc20c3c5b4a7ad9f4cdc
SSDeep	48:YjsTp8xjkXvIGxY3ULw9yuD2CNXLMSeEDu1nSiG6R:YjsTmxjkXvIaYWw9lD2c7MVau1SifR

\\?\C:\588bce7c90097ed212\Graphics\Rotate3.ico_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\Graphics\Rotate3.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.75 KB
MD5	2e07c797e3f42028ca8646ef78e4c590
SHA1	e95c3cdc59cf9b0c9c98774021179d02f4a8b343
SHA256	90a2390030005643ef1494381296043342272cecca545aea7170c8b67609bc31
SSDeep	48:2EgO4LydugPLiSc0Ibgk3ULw9yuD2CNXLMSeEDu1nSc2D1G:DJPD5phkWw9lD2c7MVau1S5D1G

\\?\C:\588bce7c90097ed212\Graphics\Rotate4.ico_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\Graphics\Rotate4.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.75 KB
MD5	c9d55a34957b7cd9e329a77892cdc285
SHA1	26327457611099b25dd24c19ae6a872651ed4673
SHA256	976db0848d4db2f281cb9954600f63c1b2431a7e3e48415663fb56551f18d2d2
SSDeep	48:tgCAozIEnBGUmsCvzm1n6FLsrM4rv83ULw9yuD2CNXLMSeEDu1nSxKFCw2:Ooz0UmVzw4cMo0Ww9lD2c7MVau1Sxt

\\?\C:\588bce7c90097ed212\Graphics\Rotate5.ico

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\Graphics\Rotate5.ico_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	1.75 KB
MD5	ee2ab416a8d5dcc745de0cae9f3921e7
SHA1	53fbe7079a4cd9dd97b16fec403b5d4606fa7afe
SHA256	a538a9c082212aa6d0610a3a5a71097c0e8c08d3dff9c8ce399bd71e2dc8324b
SSDeep	48:EGqq0ZWQzpTIkOYpIr3ULw9yuD2CNXLMSeEDu1nSjfj:EHqypTIkdIrWw9lD2c7MVau1Szj

\\?\C:\588bce7c90097ed212\Graphics\Rotate6.ico

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\Graphics\Rotate6.ico_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	1.75 KB
MD5	b3518f217ea595999574a5ee96da5248
SHA1	591c2ed75dc679c8ef4a4f168ef3e5b609f1f266
SHA256	16ccc9c8191a39e5999e8a4b0a0a037ff11f259c318b4222c8f068679a39aca6
SSDeep	48:B52zMwMdGvvWimJ/Q3ULw9yuD2CNXLMSeEDu1nSpelwzK/:iowRvWh/QWw9lD2c7MVau1SAlwe

\\?\C:\588bce7c90097ed212\Graphics\Setup.ico

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\Graphics\Setup.ico_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	36.73 KB
MD5	b0fb914bc3bc7c7238ae07499d2ade03
SHA1	03bc8a79674843b5beaf69e7206b02fdddbf14d8
SHA256	69d1bc18e4d453aeb5c1b15522300dcfdf91c2c7b8273caf4b7c6499d91eee35
SSDeep	384:vL26973nOr8fSEoCzoPki3/Kcqxkk63gBh6wSphnBcI/ObMFp2rOebgcjTQchE+N:vLfLFfLopt9qxMQP8pc4XessTJE+N

\\?\C:\588bce7c90097ed212\Graphics\stop.ico

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\Graphics\stop.ico_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	10.78 KB
MD5	de1358e007a2d4c630b58d32343b3822
SHA1	8faf6a23367e84ff14bdd558824d58aa56f0c235
SHA256	60fe2b9f76a0098ed2f11d9f6a4736fb8d3e91ec87c8c7022f925f0a5abdf8c3
SSDeep	192:1dXRN2Rqvw17cNg8CRzHx008yAJ+bInOe3ZpNsoIk4ILicNtQsiN9Fbk9Rz2+MV3:6GhNgtRHx3/YOEZpNZILIRNYFbkna+Mt

\\?\C:\588bce7c90097ed212\Graphics\SysReqMet.ico_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\Graphics\SysReqMet.ico (Modified File)
Mime Type	application/octet-stream
File Size	2.00 KB
MD5	573687aa18f1e10114c4857758d66b05
SHA1	4891a96de055e58830604619b9b73423663b08a7
SHA256	dcce53c02a51c7eba806a907eaf06bb264d8d20e7724dfb078585b658fa3350b
SSDeep	48:OSpX2JRmZyBPH6Zz5Lq6w3ULw9yuD2CNXLMSeEDu1nSt3B:lpXkuSyXTwWw9lD2c7MVau1St3B

\\?\C:\588bce7c90097ed212\Graphics\warn.ico

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\Graphics\warn.ico_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	10.78 KB
MD5	3e57ec5d48ca6646e39e81ef2e8263e4
SHA1	618e19ce10417725755149c28bc9eb4e5ed66033
SHA256	87c37964116f420c2185067cd950f7805d4b1e564acbc035f70b04f47e5e49ea
SSDeep	192:5FNw5kBVRZnQBWPqxFeNoHShitFr8btiNfx9Vk13Qr8ZavfU1Yi3A/14oU7CKvvV:XNwCFZQBWaeNoN+bgfDi3Qr8ZUfU1kuX

\\?\C:\588bce7c90097ed212\netfx_Core.mzz_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\netfx_Core.mzz (Modified File)
Mime Type	application/octet-stream
File Size	173.08 MB
MD5	ecaec62662216976d0b04ff30f3e5a63
SHA1	c63004365942e9d2487344f08fefbface3a8e7d3
SHA256	9371f33738e7e5f6e2436c94c07357c5cf5e7fa35acc27809023637eba553d24
SSDeep	196608:RV04YyKSBXZ35w+KBK2KJKDcloT46ooP8ZNoz+hK12RP1O7lT:g4Y7qZ3CwFISoT46ooP8Zyz+hm6Mp

\\?\C:\588bce7c90097ed212\netfx_Core_x64.msi_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\netfx_Core_x64.msi (Modified File)
Mime Type	application/octet-stream
File Size	1.81 MB
MD5	7695f3db6a85838ffc935b5cbcd11534
SHA1	5102c622489a8194cbdc751951655aff7b27675e
SHA256	d7ecad968d03ad6bf7964f64e58e22198358b82043ca01f34a1b861c3c7a7465
SSDeep	24576:2/zZ6tsNrQpc+BQbPyxbs4rONSnfiPBC6xahsovoMfjhOGxZWxw02:+6tuQpcxisfQf2M6FGoMLt

\\?\C:\588bce7c90097ed212\netfx_Core_x86.msi

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\netfx_Core_x86.msi_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	1.11 MB
MD5	a75c3a55f81f45177d34aecfb7938617
SHA1	3f66c2553a2961b2c02fcdb93e5c847dadffdea2
SHA256	5284bc1910e515d63fab3206ff407be72ae618090b3034495437e893cac703f4
SSDeep	24576:Df6szx1u6dsNbQXcUwabPx9bswH/fd6pxra:DfhzxI6d+QXcWDsK11

\\?\C:\588bce7c90097ed212\netfx_Extended.mzz

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\netfx_Extended.mzz_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	41.13 MB
MD5	e3bfc0fa1c6f6e0fbb9d8e16b8a09b00
SHA1	3999ab384d21fe68ac53e6a2ca662d698297ad7c
SHA256	999354eb5e2047d588f0c56035396bfe7ad815e0169210a95e037f04172ad06d
SSDeep	49152:qpqkOFSX7xpSdqU6tLnvVqSK5G22mDgBOOmeGGiU9Erqkbnt7QTr5+Oc2EI+8ddx:utZKH2mALErq2nt7rvfI+vZpfQ

\\?\C:\588bce7c90097ed212\netfx_Extended_x64.msi_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\netfx_Extended_x64.msi (Modified File)
Mime Type	application/octet-stream
File Size	852.88 KB
MD5	f7b77186e95406006bb3d3595cbae073
SHA1	89203470292216848ee41b30ebfb64f7696b223e
SHA256	32144dc4e7b908da8e036a07bb7539b016d6ca3052328299c14d591b89724679
SSDeep	24576:5u/J96doNrQlcqGRpOQSpKiPBD6txBkkkkk5SVZ:5w6dKQlc4Fc216XmST

\\?\C:\588bce7c90097ed212\netfx_Extended_x86.msi_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\netfx_Extended_x86.msi (Modified File)
Mime Type	application/octet-stream
File Size	484.88 KB
MD5	46dd4b603f04c3496f7cb6079b64f909
SHA1	9f194f08d363afa714f2c1eac8f5cc987593d87b
SHA256	0c40158ee84160a1ff51f42fb6e45e739bba6d9807f0c5299904195940363ffb
SSDeep	6144:FRHfepsrxRrGh/JD6sAOiOk05c+Q+OjUIsLQUIcFxZSBVv+lYjsm6FBQ0ssT5Hn:HHfepsrx1GX6sEsNz7QXcFxZ+VhjErH

\\?\C:\588bce7c90097ed212\ParameterInfo.xml

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\ParameterInfo.xml_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	266.55 KB
MD5	8a4d0dd786b15e5bcedc011f65e8b7d8
SHA1	686b328425038265234e9232be2e3f558f308b11
SHA256	65ab6e6270130c906598f54796343a3a765603771f82fe552498d73f1ebddab5
SSDeep	768:iAFxiuICKxROYoVQTLTQTDFdhaaot6PcbrI1+3:iEjcRJoDdhaZIm

\\?\C:\588bce7c90097ed212\RGB9RAST_x64.msi

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\RGB9RAST_x64.msi_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	181.38 KB
MD5	07a0541e19d43e3c85bdb0cba9437be4
SHA1	a425c2bae61ffabf45d872765736303ddf1d8a7e
SHA256	f5d273a136305473e4dcba4e49791ff962c01ed563dfcbc75863fd12eeb9773f
SSDeep	3072:9GjZbdgC73Q5H0Un0li+G9A7Kve3Hg5BszizUVQzB7m09g47aEqPNWZKq5uXp0f:Mjddgq38l1A7Km3Hg5CzizuE99gVEqi7

\\?\C:\588bce7c90097ed212\RGB9Rast_x86.msi

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\RGB9Rast_x86.msi_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	93.38 KB
MD5	aa0b75d6dcbb41c79a0fc124ec18e593
SHA1	baa87f0bbb01f51ea596bbdd564a117cf227fe2b
SHA256	0f61169c19c22ff29398efd3b9023b2f6cc9e3132d1aa374da03e0bdeea0cf17
SSDeep	1536:low98KZdWM41picgCjX3QAoHwDHL0fWi0lrmsIjyG9heHApNR3YHaeAHaeee3:aQIZbdgC73Q5H0Un0li+G9AsxqQ3

\\?\C:\588bce7c90097ed212\Setup.exe_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\Setup.exe (Modified File)
Mime Type	application/octet-stream
File Size	77.20 KB
MD5	3ee3a802a7cac9e07de22c95cc82ce23
SHA1	4a6b9d528b2b764b458f93b6953384968981d03c
SHA256	6c650c9d07528b726992227228f6b90c96c1a36ed7baf8bc21041cbcad3b234d
SSDeep	1536:jyYZcEBL5NWiiESc0exWZnqxMQP8ZOs0JD9rHUs:jEEB9NWTZctc/gBJ9os

\\?\C:\588bce7c90097ed212\SetupEngine.dll_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\SetupEngine.dll (Modified File)
Mime Type	application/octet-stream
File Size	789.21 KB
MD5	4e3290178aa0b6af5e224c759317ddbe
SHA1	7c09692f16d9012418b8270e853cfadbb2788fe6
SHA256	9c0d770605d0b5d36552ac26ef478068732847fda566a476642e3c8761d9fd26
SSDeep	24576:q4S62nlYAqK/AitUgiuVQk/oifPNJIkjbSTzR8NmsBJjL:nS62nlYAltBjPNJIkHST18QsBJn

\\?\C:\588bce7c90097ed212\SetupUi.dll

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\SetupUi.dll_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	289.21 KB
MD5	cda10d8f100344e29e81daed24877a55
SHA1	6c46687dc19860362a66a5e13202d4d0306abed6
SHA256	42ba157a1fc0bc84fcfd5fde9b1dabd2358a46c7a6cae299a95338426a182952
SSDeep	3072:9duVm3TVUK59JN+C0iy4Ww8oBcPFIOrvHvr8QDZHAAKWiIHT6llN1QkvQZaiionK:9kATOoMFrz8ygAKWiiIyKf73wy

\\?\C:\588bce7c90097ed212\SetupUi.xsd

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\SetupUi.xsd_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	30.29 KB
MD5	41209fa477236e65b68e1ed23c88da53
SHA1	4809fcb33886b89e51dc95893d759985db77c7d1
SHA256	fbc4ba28584dfb22bbcc9e50b4b28cdfbaf7a562073a01bcbf35d04a107978cd
SSDeep	768:L+gLcxeH205ZCET/chT+cxcW8G2P4oeTM2+kr:Lye0wchT+cxcDG

\\?\C:\588bce7c90097ed212\SetupUtility.exe

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\SetupUtility.exe_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	94.71 KB
MD5	2ef7e2fdfe62d77d11f39c66632fff18
SHA1	aabf1722fd79540f0ec480d5cb13de0864dabb24
SHA256	a6d4137823732f55044e05e44d309549d27c57dc0021588e9bd742eae05aa8a3
SSDeep	1536:pS+v1d/z59IKI1N74oszIepIJqwlAno0dwRXPuY6zcVcE7OgkT9vs6M4raUZrH93:pX/z59hI1NktIemJllRXGYRKEaVM4rao

\\?\C:\588bce7c90097ed212\SplashScreen.bmp_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\SplashScreen.bmp (Modified File)
Mime Type	application/octet-stream
File Size	41.00 KB
MD5	3770eeff816a30490d5703b471e0932a
SHA1	92f93d8c0706c6e9bf9fd3cfb2d782a6419dddab
SHA256	9547654c1b844bd4bcb4de4bd5acc4d6c8ca5b036fdefcca5bf7f277fa8f2218
SSDeep	384:otCjdWBE5wYHleWh/QESPLHNq1XjM4eRC3pP28+Qq1ms68/tUqHUlHGwM7bwv3E6:1jdWO5wYHllh/pXjbQ+pTbimsqHGk+u

\\?\C:\588bce7c90097ed212\sqmapi.dll

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\sqmapi.dll_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	141.91 KB
MD5	b9f9526eac9f8206b2f0515ca77bcbd1
SHA1	9a04194e122144946ad45af40f2bed324a089666
SHA256	5f2e454cd999f0b677b1c5422fd47ff217f7d6864eadc85c24c797e5009f44c3
SSDeep	3072:ddCMFWrJjKOMxRSepuBaqn/NlnBh2Lx0JVzx1wWobn1ek8F7HncO5hK9YSHlUApi:ddCDFB47UhXBh2yJ5HcOSSSHZqd

\\?\C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	4.96 MB
MD5	8a7b97a0f0f678c00ac5e8ef46cda69d
SHA1	af39c9885173e306646001578a9abc3c05885248
SHA256	c304c919a269d6b8021ea92d0e4db653942a00673ed76dd291e77e076b729af4
SSDeep	98304:9uEAUjX57BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKJhlE:h3ZBkOK2Knq45mY4H5OMKkKzlE

\\?\C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	4.86 MB
MD5	29db5eaf08a3c157643f94e23693c639
SHA1	70ee0f10ce0af5373330004fb1ac75fe593c1f46
SHA256	f1e4fe6b731a26b0bff38da61e19678d911b1aa4d1ff7612b7ab107d600d2094
SSDeep	98304:RQf0pKy/aBHTKYzKXH54UuFe1kBpHua/KUKcs3DKVDK6rCW:A7BBHTK8KXZ4UuY1kB1iKFKmp

\\?\C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu (Modified File)
Mime Type	application/octet-stream
File Size	2.04 MB
MD5	d2d96c4f42b4610e103957548006b7e5
SHA1	838949434c5109a5b9f03f45e11481a4908cdd15
SHA256	36c598ac21d71c793531e1e8c7bffe0831282c48dafbbcf8d7b6f0a880cfd39e
SSDeep	49152:O7uUU7N37NM7u6/7uUj7uU6cP4UJ6EeaDuv7GuMRau8yuXQFKUYcs3HVKf3rhKz4:qP4UJneDGnRau84KUYcs31KfFKzdN0

\\?\C:\Boot\BCD.LOG2_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Boot\BCD.LOG2 (Modified File)
Mime Type	application/octet-stream
File Size	900 bytes
MD5	0a988ae0b203630e254376395005a3e8
SHA1	2a53e78e37a2d057a1aedd9c04647941fc343599
SHA256	4e4ee27ca7debdad80967e9168a2ca66bac23daff75ccdbe89b906f7bcb9c3d1
SSDeep	24:sT3ULBoWU9yuD2YLNigLMS3uEDja1nNwKvFr4:q3ULw9yuD2CNXLMSeEDu1nSKv+

\\?\C:\Boot\BOOTSTAT.DAT

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Boot\BOOTSTAT.DAT_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	64.88 KB
MD5	a137170a53e279561149f53700b61ba9
SHA1	315180bde99b4cf0a03f4a2b31a9a207fd2ceff0
SHA256	730203b52dbe44c2243e4d0991c3ea1e31b39f569b7a3b10c88cf00e824f2eb6
SSDeep	384:22LNC4whDWijhSWsfQgM/XhVjC5MTxu+MVa:22LNC4wh6idSdfQzVeMxu+/

\\?\C:\BOOTNXT_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\BOOTNXT (Modified File)
Mime Type	application/octet-stream
File Size	901 bytes
MD5	c13f79be9c96889cbb0ef3f4e6584efe
SHA1	7a85d1da5798db67dffd70ca2aeb7898bbdc483f
SHA256	f07e3dd81d3e519450df50a847ea7273bde0216fc813d042072cf568b8d345c3
SSDeep	24:TT3ULBoWU9yuD2YLNigLMS3uEDja1nNwQ4NQ:/3ULw9yuD2CNXLMSeEDu1nSQ4y

\\?\C:\Logs\Application.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Application.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	f4692e9e09dcfa6c9bb4d51a47e31cb6
SHA1	488b7e48d2f963c0f223dd00df37a709bfc28fd4
SHA256	91bcb9c0c4fda6dc68d5a8010e8792a3830f425a24957079454e0fb3eb5b29e3
SSDeep	768:XG2yFnYcqJqAczhqbIkq6cqiqdqCIXIuqCLIHNI3Re+Q:XlbJcWcouRO

\\?\C:\Logs\HardwareEvents.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\HardwareEvents.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	8f251674be5b02dc15ed966767320fc7
SHA1	e9f12c011f501c2dbcdafbc191fc6088cad73343
SHA256	271a7e310cb6e70797ca2d42f3651881e9421b50ca0ed5b73571a7203c714c98
SSDeep	192:wYDOdWODKBXcjRiF7J+7UkCpS9/U8AEr0fwn4eZudOo/Z7s/Ez/7THDp2+MVauAW:wpWe2AiSBCkJQfoHZxO79T7I+MV7/

\\?\C:\Logs\Internet Explorer.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Internet Explorer.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	471e67ada95cf63932a693b18aed3b90
SHA1	e48556bcb3c07fc5a6e6a71e2e918425f48f04bc
SHA256	6e4f32659177dcd8c015e192db0c2b6cfc3adb787bdbf52a7b0e1ba1c53c72f2
SSDeep	192:TpBAAdTlytlwNDRQHWwTiZD3FIe/7EC97ZdUd2YFGFBvrN2cBG2+MVauATX:LAAdZLMg3qWBr6oF5r/+MVMX

\\?\C:\Logs\Key Management Service.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Key Management Service.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	788054b3572765d1289b5e6e059eca9a
SHA1	ee860b9511b39463b86568cd3a28c644cb4e643e
SHA256	ea99ddb3e60734f39245ccf16f25fdcaea25be0dafd21abcd126c6f2a0877252
SSDeep	192:8bvsw9TihIAalR/IwnZxX768vOa3nWbjFKQLLp1JejZwNXGu2+MVauAx+:ssaYIA2tZxXe8vOa3nWNKQRb6GI+MVg+

\\?\C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	24b9da1906d080328dcd5a448c6e7662
SHA1	b5cdf7b0886240dd04f56ed9444cb3f534844e49
SHA256	72864f666b8b15814d35850e78b9cd807c22ceea132b95f94d139b6675fd328d
SSDeep	384:nhnzxqLgm7Pji02DOo+HUvS14mqdXptKHICbHtULkATKyKg9W+MVA:nhzxHZytHUY4tdXptgHt8kATKyKN+l

\\?\C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	871b5ac09c2dd7ff76a0f8b12266d282
SHA1	ea91a628d101dfee586db62cfae5c899ec38e28f
SHA256	4d066f3a2f786a737082ccf983e6a8c780aa7a32c6b765843d5a951afbff0ec9
SSDeep	192:GfVJ8UZFYRGJa/Lj3T/fM2xozQsS1MD8YcCZtdw/2JbrPSekT6db7kYXAu2+MVaH:2b8wFOvMmBYcmBTT0YX8+MV+Z

\\?\C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	835769204ae08441d1db91effd9db62a
SHA1	f5d79497192cda51d4cfab083c531af21a8d809f
SHA256	b7bbb800598b024ec8ff53bb237260e817d0bac2b1b019695ad8a08141a94b62
SSDeep	3072:MZ4zWZTZKPJ5r+5CJn/X3dlvwrTzt5AXqtclb7vF1rum/lZmJauFMbTZ08bD1p5w:24iV5G4

\\?\C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	b7dd8723c6b1f2f98344e7afd6253233
SHA1	1de669a92f861544c66e55827aa7cc5dcbc0da72
SHA256	f4eb6e17f5f6aa74bdcc0f8960543b1e77d7b4696c56a53e7d767f66b60f1836
SSDeep	384:EDjL34nRe/xLkBkAagVNapdbphlhOKqcR+MVlr:uT4nRgxLAa5dbpuE+ir

\\?\C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	9faea4adf618f70fc9a237d86ceb5495
SHA1	fc5c6449083680088d9ae155cc91a4c41002f2da
SHA256	ad623e55afb06006d43377357ee82ca81669045615d8cb23ed5ae4058920919e
SSDeep	384:z/QTkpwRTfzxFsyKIbKaQagNrNcN1Ne/NMcN9NBpKNtNmNzNsNINcRNj2NUN/NoH:zLOHxFsju+MbUXCn5z+5

\\?\C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	0cb7a72129e92a01b91c486b537701da
SHA1	23438d96cfc95dcd1da6456d6b7141cfbffcb8c6
SHA256	a326523e02513e9408345c75be772e507426491b2b7b719bde79e5ae4b795b80
SSDeep	384:Z9cJX5I4b4TtyZABefsayAvE2yKIcIwIsI0ICI8IDIKIQzLI7InIGIrI5IUI/IRn:ZGJI4ETtyZbbEmFjZ+f

\\?\C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	2.07 MB
MD5	166b6bd28681ed8fffcf7db3d598d5e1
SHA1	b863f3fbc523dca90c7a316b8ffc2acf9e2b669d
SHA256	2385b408992df65aeb5a743bae37488c8454631e1fcaf5c83b102a2ace5b3cf9
SSDeep	3072:ozu4T8ZfIXU4bgUzJCANS7ebOKXQbwkqBYxbJ1OAzLU5vQ4LkTK2JNiHim5WN/jY:ozuC7cPT6

\\?\C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	7af538a4d440a6832f850acaca810196
SHA1	88566033d0d21c3ea2378ec566b3b580dd0254f9
SHA256	1c838c6220643431eba2ec2cf6ce14bc293a88e34e424ddc8bc0e179cdf4242b
SSDeep	384:xqkpd/3VSHv1lARYVgIBHoxn/OuR/h+MVz:cSdcHv1lAegEoxN+i

\\?\C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	018041e146747380f7f6b30dda199951
SHA1	6e352b8f1c46d10a0db919c2ec061490f727db02
SHA256	f8d541ae96be3688b9a9c17cec8ea0013822f22ef5d9a11fb24f1771127051d4
SSDeep	192:CPM/whLiKUeY04hiT8cM64NuOa/FX37sGblhWN9FBySR92+MVauAT:OhLLVd4hiaAD13dlhUBfRI+MVC

\\?\C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	03b1b36dbc07a268eb2d667265c4aa09
SHA1	9f8d6cfc72790b14018b4772ad7098f1a0758ce0
SHA256	9bab475e43a0f7e1a14dd2a268a9060667896866cebda4b10f8540154d9604fd
SSDeep	192:0domDrb+vv9lGbUkWMHsSXmfkCZUjalDis1229wjw2XXvtKVrYq4RYj82+MVauAR:BmDrYv9l2FMSWcChDajwO/tcowR+MVfY

\\?\C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	8f1b08c0b0c5fd0e51d07b52c25f80c0
SHA1	f800867d9a3e2fd0b7b561dd575302384e68dc26
SHA256	c6c8243a3f0924b32d84ac5f7b04b215f6424f052f2df8a048bf7f509e9e268d
SSDeep	384:KjR+4UvHx0jl8fH4Ec0xjROl+36W2kZohyG+MVn:uRkvHOifH4EjxN2+l2k+hL+G

\\?\C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	e269b70ba0a8a7c0dc1fcb82f4fbc2f7
SHA1	87057cde5bb2a7e873a1618ee37d27de07239d10
SHA256	c00e4b996176a6207eaff29f7b090bbfc76dcefc4deb77075bd3e7152679b496
SSDeep	384:kJHnfKqg6Oqz8BZusGyAL+iDUDK41fEkDXHD+MV7:kJHfKLqwBNGLlDUDD1MkDXHD+C

\\?\C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	0155ec438eb07dbe12d21545de8ea5a5
SHA1	848d41534fdfda9c86c62bcc3ef8449f4401989b
SHA256	e1432a4253488fc0655cf18ec3b88eecae61a45a42e699f3d9fb93d09bce7d25
SSDeep	384:xn725wtCDYDFiiAUO8FnAq/ZvCPSCLfC8tCY0C/ECkLCzBCf2C4aC8rCL9C3UCQ0:x72ACD0RAifm5sH1IehGLxLivVn+t2

\\?\C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	a865d2858f2edb927a2f82cad1fc5a78
SHA1	8401599a3903d4e1304c4a14c0eb7832a777053e
SHA256	e68005380d8a00396156bdb1d5ed8b9afb988e71c5e3501ce0860bb2020e1919
SSDeep	384:P4yS77QfREeWcB5wHQL80GGPMPCOOLYyLrL1LDLLLNLyLgLnLWL8LvLVLYLGLoLi:4nPeJB5M0tMPCm7QBom6e+8

\\?\C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	dd04b7d89bb21dc125af689713abe821
SHA1	789a15ff4755b29230f08f7e3f52cb025dc5464a
SHA256	076b067443443ba1708d71b0317a1d40988208cc9a33a6f11a35869274cdca54
SSDeep	192:HynTLAu2MxXRjGt1gcR2I2lRZ1H1Gn0u16r0ZMp39mc3WQ2+MVauAwl:2AuBOO/Ipn0us4m3Vmt+MVd

\\?\C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	e24e30d989e4e2b188210e3016fb80b7
SHA1	b518409b5d73299e54d41d25efb7aef98eeb91ff
SHA256	2de59b857cb2380c35d8db940a35fd1526872a8b31c8c9bf49f49e2680168672
SSDeep	384:ie6A2hKANNyxEBzqg1p8ZLaZ2wcnu+MVTY:H6LhzNNCEtq3wcu+N

\\?\C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	a9c15d2c74676e17e30c52da44751403
SHA1	bff4e4a07550a816f95fad12a51004b1cd44fcc6
SHA256	c5d533490e42e99ee712a8752afd413395a0f1dd504ab79b63929e49232686d6
SSDeep	384:hRALAhnTqDhEy2W62bY+Ea4ZQJSEhEvxHENEEE7YaERnEDEwREeZEkcEVEpKEGEU:hFqDh8Cbf6YdDjLsA4MVi+a

\\?\C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	a8b723bfa45c3f5e6f8eb69d556100f7
SHA1	033161acc896ff42a5984d36ddbf9a79d3a00252
SHA256	82513b1e48fb3f672a562bd076f30bcabe05c93f06911cf648596c3847f368a3
SSDeep	384:1nrR6VtzCtfJPgg2seT8Phh8UEVZyqQ+MVs:9N0CtfaRseanyyqQ+1

\\?\C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	3ff33d220799ff574fe61d8fb3bd11e3
SHA1	c434319fd79aff60cccaf7ac5d2e2901a78fdd54
SHA256	777cfafd915fc8d6ed5ac68bd7769e8a0fc3684681ae80a381b3eca7d973a36e
SSDeep	384:ROjHskpwRffpVIUHkb5auWWxC1A53+MVq:ROKBfObkCxC1e3+/

\\?\C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	a58b00a1f32587d7335954e637020f5f
SHA1	60590096a051e2ca2bc203fbc9f8790c88e4ca91
SHA256	f764052c5a51196d2509d3b27eca0da6190f22342b6233844736e03b570a70b6
SSDeep	192:zrmyz8q9zJTItMyOzPKimBxzqip60/WXBWFSZl2yv1bVYrp7oqxQ2+MVauAU:z7fxJ0CoimBxzZg0QZZEyv1Jk9H+MVp

\\?\C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	c6c35c6586cd3cdc207e63201759210f
SHA1	61154b5f491169b158acbb8be458d2dc63946ede
SHA256	eac535a8ccdd6cf661945ae15dd74aa07acbfc953a67eb917cca0f83eb86b999
SSDeep	384:UM02hSZNCfEsSWqhLVAb/XRJIClr+MViI:flSZPhx4RJTr+c

\\?\C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	4ea9667f00849d26c6dd40c25bd48726
SHA1	caa35402c077e8d321c2b3546f1df155863df722
SHA256	0849a05358175798edba462524dc4dd9ab3e4f2d70eeff96c9abdc759ae30508
SSDeep	192:PRK4T566FvcxYdVTLDLiKPy9qSFIrUe7jz5lGx6Q0mY7d2sotzTgxaykj2+MVauL:5NBDLfrSKAe7jz5lT17dogx2K+MVz

\\?\C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	9c9f976ae6761bc1ecf1ec029d67415f
SHA1	e33f359f0578a61b0f9f762854e9333a7f8934ab
SHA256	ebaba842405d66c2487dc70b7b0672d4fc01576f026be3967513ac40e8e10b41
SSDeep	192:u5U7M2mPPon+alLYHk/oe5uH34SGWtQNyBLSoHO/96UFk9NB2+MVauAG:TQ2meZlkWoLvGW8sLhHOF6U0Nk+MVr

\\?\C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx

Modified File

Binary

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/x-dosexec
File Size	68.88 KB
MD5	7d94e5d2ab039c7e4ff91ae72bdc7a60
SHA1	24dc8742e9873ceb5fe4e605e8299edf96eaf13f
SHA256	ce11f01cb7265115f248394865d57f425bff0e1d3d2b8871e7cee75705a1e753
SSDeep	384:5J6LYdtBKrPKf5kkyyfEvF/zj+02CV+MVQ:5JMYDv5kkyyfEhq0Z+l

\\?\C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	c49ddf072d4fd354b7cca8e3f378da43
SHA1	c18b5aef824da186c4a8b3ae04f37b66e737d0f9
SHA256	4d4707555f330bbeca9970ffc1ba8617e8a812d1b1c4335ca01106f8e42da244
SSDeep	384:c9cVgci0aA1yXR/CWf42wNVOM2I4Ih+MVQ:pP1CR5wN0Mj+9

\\?\C:\Logs\Microsoft-Windows-MUI%4Admin.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-MUI%4Admin.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	c823194d6354183e77c1b0b2cce79bb5
SHA1	d3cbb33b05091c178b632d838d17174b3aa3df15
SHA256	33035c10a24c684048914782346093326d7a0cc3e3f8c5bd3d4b5437ed7ca4b8
SSDeep	192:kgZvXM1Szz5bfPxuyKjgSXGbSQPo1/A+NhLAWRuT7U82+MVauAa+:LX2O9mjjXGXPji5AWpR+MV3+

\\?\C:\Logs\Microsoft-Windows-MUI%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-MUI%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	185ea621691a65d95cf92fcb18ccd573
SHA1	687e0937cd74b2316290e94c7ff5a374aa181eda
SHA256	84caab5b97b9c1d016b23ebc2a85b487dadbc2f15abd91da376d4fadd5dd0399
SSDeep	384:OnZxTzMfrtkQvc67jH3I15ZpTKVMivEndcXXXvoXSXvX1AIXsPSXACXhXXXBXXXS:OnnHMfril67c15jKV8nzqY+U

\\?\C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	64d4410f7b1ca532f188bf42bcc6ada9
SHA1	e4aafcd5585a0ec93c4fc81435bc1f19561f1966
SHA256	181123865b6d7105dd22ab0760cc9ca7bad45fd021eeeef83959f50007c2cc14
SSDeep	384:WTO56zgKvfittU+7N4Jvy00anmBP0+MVx:WTsEgLCdl12c+Q

\\?\C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	14c0715774626a991f20219daeb1dc02
SHA1	54ae1c3330048a43123fe29e04e72a14b4f47783
SHA256	8df9ca8a724b3efee430c251a2577d2a7ae13e877e594e5f7c6649c56fe343b1
SSDeep	192:m5t7I+r05CkFOUs1wwdQAujVnqMWUVe+qVbCpxRAhOqkNYYbcUrx2+MVauAj:EdHDmXJ1Lj5iUVibiRA4qlYbk+MVC

\\?\C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	f25d40d7734c6a0b8b6dab1108f355fc
SHA1	8f8b10d4d3d395951c74e2e8eaf150b1dafe8f20
SHA256	57cc5d36588c3a4acba79401a51d037dab7f54840a04407a37bfe110f3ee74e4
SSDeep	384:Tn8rXGycXgdBxbga3C7UCYxBZs2X/++MV7:TyRRdbV3ukvB2+G

\\?\C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	ae38dbf46d2d467168739289be378918
SHA1	9e042cbb5371d12adf3f9469ef8d23483072dd62
SHA256	c1bf644cb74644d33a2842ba493d8729ed02e134682f1e57ced3387f90ca2b73
SSDeep	384:d2W77H8UPI4VkmbPJucbuxDtlCcYkPPY+MVU:dDfHRw4amNuc6BtjYePY+J

\\?\C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	e64a065f7b8cb65eb20a20ed9537d370
SHA1	63168698dcd5b4b5b39bff7e9b3c904c60987fec
SHA256	086982f167010dd55de73ec118050afe7dd6e649c4df579800e2a0effc248d33
SSDeep	192:wTllYp95buaoGIKTjLV+BjUHTBhNXH99R5/TWkGyLfpy+mg/FDvqk2+MVauAz:MDYGaot1KHTBnXHz/TdddT++MVq

\\?\C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	caf73be75eb140bcd9cfc24df7931d38
SHA1	c9367cd7ea00f31612a0c142efb0388d90acedb2
SHA256	203462b73b06bb55f8e1b4b090b0b568aea6f865aec5f26716f5fb3340e104bb
SSDeep	384:UDqfOqI99dXyKMGouzgV8wVti4udZPjX+MVi:UAORf19MGa8w3zELX+r

\\?\C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	0035f0897036451a801c90909bb4413e
SHA1	c0339098c75ef7d1563154ae14cf2a7b36adeee0
SHA256	bb8a678c7faf0f53e1bb690f0f48b2dc7e954bbc8d3c7c3625d1382b8b4b815e
SSDeep	384:FYqcmX5Ibu7t2TWccEj56tzG3tbae+MVd:FddX5IS7t2WrEo0we+M

\\?\C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	f4b921b36c2bcf2958c605db5ceeb429
SHA1	864d991965cf89572552fcdb64fa0c50eded7867
SHA256	cf01f51ec4961d55f81e5491f912f954943b6cd9159b3902865c3a5da8ee649e
SSDeep	384:qNaw9X0XnPdaMDyH5+IVuvRMzZUHprNP+MVh:qNGnPdRDyrUvCzuv+4

\\?\C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	ac36ad1830cad6cee4cc9dad0d20e2e2
SHA1	bca93d888f9a55ee06249738b041fe29b1618f28
SHA256	cb2f67f68b5f446125e77de7aefa8fda6ac180254f6ae428a17db0c0f461a6e9
SSDeep	384:Ov0o5ROU184bzifaBCuPBhLD75tk0Ka+MVuK:OoU184ngaBCuPBbjl+4

\\?\C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	b12d82f6c0403b2c330d1673bcc679cc
SHA1	54622732334192ca59ac6511d496d50da7142e36
SHA256	02b7779906f13cffc266f7ee306cdf397bcc08871b35fbf4adc73919cf194e17
SSDeep	192:4Sr9sLzGkvvWh4IjON9tK6whEopz3erzG9Z7nAbmH5zl22+MVauAc:4Sr9KN9MlxOrzeH5h+MVV

\\?\C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	7e96390292a0d030a2b81a96478b8104
SHA1	65d189517ca35f0610199bed7c374e5b5f6ad3a6
SHA256	9d34f0b956b647ba870603a843f17de9b27a305d8bf83a515c3e7ac5458c58fd
SSDeep	384:L70O+EYe5Dv36fIOssReDRzbdYBzHHdj71iTi/iXiDimiiiOiliCQiFyiNijiTiq:LoO+xQ6wOssqSnxSnu17qGQjEy+q

\\?\C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	3a2dbea24f1a694efc8a75c5eb642b39
SHA1	472dbd5453897d4ae476c6f2b1f94eca45574c75
SHA256	1d89a8eeff1363cdfbe052cd9b4216cde30c222ced1826be756e5a4b097ccea3
SSDeep	384:v8E271SLq1mEJLnC2JrREYVQ5BMxY3gvm+MVHn:v8EUZ1tJzC2rTVmOw3+en

\\?\C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	7ee0734054feaf8b5cfa3d9087a8bc5e
SHA1	b07dea7c52d226d7cc132bac877e7e417e71c965
SHA256	4d2142ab02acb0f7cff268dc5ebd48931a67fd4b164067fd41579d6c331bb199
SSDeep	192:7dGpS00fQL0HY8XJEosXt1n2G3sDMaAQ2aP451HBu3H15TpztMQO0Vm2+MVauAFl:8j0Z5Of2Bz2aw5pB8X9iQn9+MV+l

\\?\C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	07d1a62b5e634ca300a7271877e63b2f
SHA1	ec3539310c2e70f8b3984b21fa5e1f3a2424235e
SHA256	903dbfcc3bdec4a36f0a6717a12e550b87e1e55de6c66100a8936469fe392bd3
SSDeep	192:74j/ttAVGKMu++1EfAtWeb3LfkCNoaLIfcm4SqwcxQNcE2+MVauAH:UKimW2MCmeIfcwQxQN4+MVm

\\?\C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	99386e5c059fce56fffc4b72da129f53
SHA1	505770182cf44e71cc4d234da75275bbdcd4261f
SHA256	71b65af7315b1ebe55c89615dd288c56bff192436c98b014cd057de980dd189a
SSDeep	192:2F0fatpfKCN2IPFcH5o7Qee4/iGVDClv1hfIK9Ko0ei/PH26AU2ocIe2+MVauAI:S0mZcIPFcZo7Qe9iVt39T+ntmIH+MVt

\\?\C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	16e055fcf046f3f847ddf2c0e60b2ff7
SHA1	47dc892aae57e1045e83354fe2ce58bf26e0c5a3
SHA256	a3dbe2cd569c3ffecfafad3d645cd30ad81692175ecd449131554b8fd263bb56
SSDeep	192:l/hNEBNy8NDGpvHw7TD8HwX9QVq0tG0KiURBMV8jjeULXYNY73V32+MVauAV2:l/hNETvVMwrhSnk0tGc8jjeULooG+MVR

\\?\C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	68484f2cb4f6557f608aa6712cb454f5
SHA1	e54e12c1d35435891e1d675a4bf434d20e2f3712
SHA256	a0db086973d05034c3143ee64a5fb20121f3e4bd251c1e53da5586552f9fc477
SSDeep	384:7p8AD0uHQoWyBXlnlp3zuOy6Yi0gWF2XcjM6Pgh8hthHhohDhxhshRh/hNhthQh9:CavayTnTVKgWFM96PV+MK

\\?\C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	a7de8a7ee7ede608530f3de87b9df7d9
SHA1	967f9ca14a30900d475cee086989b5f2e7a71b45
SHA256	5d598b250934f257442ae7482a6f68ddc3a657cc32d4ab863d415c428eb2f8a4
SSDeep	384:+pb+6OjCGkuxf9zcSKJrao8l8Fpsf8HfuznfZWfO+MVV:+pb+T9zh4Alkp8X+U

\\?\C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	27910e436e6b85d10e2feb0b1d753c9d
SHA1	ac431851d552c95461251954974df64ddadcf784
SHA256	f5a591d3a65e9602f9f4cb731d3678b690af02ca1ff06fb95c97abc64c3fee43
SSDeep	192:EcbqB/7AIrKQiizjwB7G6/uMIUEvrMS+fvFvjdBNot0aoGJTIx2+MVauAj:EcGrrKQi2jg7l0UwoS4972hd+MVG

\\?\C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	8c012e4bf7d4687d57237be6eb268f44
SHA1	ef661a3dab9337bc5e85f6836db8a3f1463f245a
SHA256	6e013da214e458ec29d0a380d9f70173ff56fe284708c65bc8727c580945be3b
SSDeep	384:ZeVIec78mJdQ6AcebaZLV5SiFjSFE38il+MVj:Z6XcBM6AcebaZLnSiFjZl+S

\\?\C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	9c081c08209c4f02d15e1e72f9a85c1a
SHA1	7e9a23646dd0f0ceb766227473f8b165d7736839
SHA256	dbbe6fa23bf256fff9dd1469276b1f1d52a4346b243586651393696ab88959a2
SSDeep	384:py4zVlpfH/IguvsNow9DLaDTykklFJqs+MVI:BHpHikNouA8lFV+x

\\?\C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	ef34dd43e23bad606e4180ca2c98a36b
SHA1	8dbdac1f27e5a1c1772afcdb5566d73aa52597ce
SHA256	d7a990c518931149e3b4f57bee3c2c0008dc85cb8fd040abef2d07e3879d2d03
SSDeep	384:N5epqN1pe+ZxrEuBO4BImi68H5n9HR3RdRfR3RzReR7RaRSRrRnRDRgR7RDhRSRA:Xeks8xhOWImiZZvGOr+uk2kMcscvKz+G

C:\Users\FD1HVy\AppData\Roaming\taridd

Dropped File

Text

Unknown

»

Mime Type	text/plain
File Size	6 bytes
MD5	7492811d7da271c99ecdba47922acbdb
SHA1	7105809ce4d7bcf0bb7682ebd3c2acafc4418699
SHA256	489537e959120dc05b26e3ebb1dd82f4101e593715cbceceac91728ed298a546
SSDeep	3:a:a

\\?\C:\588bce7c90097ed212\Extended\---==%$$$OPEN_ME_UP$$$==---.txt

Dropped File

Text

Unknown

»

Also Known As	\\?\C:\Boot\pt-PT\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1035\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\zh-CN\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\da-DK\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\tr-TR\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\de-DE\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\el-GR\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\2052\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\sl-SI\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1031\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\ro-RO\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\nl-NL\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1029\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\qps-ploc\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\sr-Latn-RS\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\cs-CZ\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1032\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1036\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\lt-LT\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1040\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\es-ES\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\uk-UA\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\hr-HR\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\zh-TW\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\$GetCurrent\Logs\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\nb-NO\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1041\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\bg-BG\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\en-GB\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\Fonts\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\zh-HK\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\pt-BR\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\fi-FI\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\$GetCurrent\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\fr-CA\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\lv-LV\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\ru-RU\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\Resources\en-US\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\Resources\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\pl-PL\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1042\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\sv-SE\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1030\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\sk-SK\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1033\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1055\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\Client\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\ko-KR\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1044\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\ESD\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\3082\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\3076\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1046\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\sr-Latn-CS\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\en-US\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1043\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\$GetCurrent\SafeOS\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1038\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1049\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\2070\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\et-EE\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\Graphics\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1028\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\es-MX\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1025\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\fr-FR\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\hu-HU\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\it-IT\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\Boot\ja-JP\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1045\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1053\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File) \\?\C:\588bce7c90097ed212\1037\---==%$$$OPEN_ME_UP$$$==---.txt (Dropped File)
Mime Type	text/plain
File Size	934 bytes
MD5	545b0e26e2f6493eaf676d564f995d80
SHA1	1e1f22992135a3dcbbc2c91bf090583380230f17
SHA256	e21b324aa6a10edf36ccbebf63030f048ae6f02ebae0673ceec2124e55a63bb6
SSDeep	12:psFXqItnjchj774WkcL85NGldXzAYsFpG6pdCyiz41LYVMge1SpNq7qRIzffEK:CYIhBW987maFmpoBWU/ffEK

\\?\C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log (Modified File)
Mime Type	application/octet-stream
File Size	42.55 KB
MD5	c3f0fe4cee7924a7181aacfcd23d19ba
SHA1	7800f4292de2b5916ef6752f1bf73e8606401e70
SHA256	eb47e9f63a6675edac3afc1dacd2227720afc8271b8665de375bafe62520eb8a
SSDeep	384:DHvbrwpm9GptvAteiXAWzsK147IpUSpKhRdprlF+BxHcP8YaUavWKDXv8veSR2Fe:8m8pNPizskIwKhRb7ODfy0FaB+I

\\?\C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	6.74 KB
MD5	2128cd4ebecfafdd61fe136b99118f04
SHA1	2dfae8ed89d5877aeed6b1e67d3144ad43c5373a
SHA256	a6a8290cd87b7248c6e7d50153d3d481a86e97e9a7e3bff99174ab036dfd3425
SSDeep	192:AfOy733f3F5OU3DvQnvU66mP3g2o/JfNjEXLRBBiaY2+MVauAY:+73fN3TQnvFFkBVjEX9vF+MVh

\\?\C:\$GetCurrent\SafeOS\preoobe.cmd

Modified File

Batch

Not Queried

»

Also Known As	\\?\C:\$GetCurrent\SafeOS\preoobe.cmd_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/x-bat
File Size	974 bytes
MD5	faa384142ad1c23bd391dd6617b6fe35
SHA1	759e528ccde908b8a5a0b5cfc0f80aa6c56b66eb
SHA256	cab2962ef60d8ce12a3e557aee3c68ece30c07eb7bbb957644d28ea85232e897
SSDeep	24:rxITH8nUEsT3ULBoWU9yuD2YLNigLMS3uEDja1nNwIU08Q/AP:IH9/3ULw9yuD2CNXLMSeEDu1nSIUioP

\\?\C:\588bce7c90097ed212\1025\SetupResources.dll_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1025\SetupResources.dll (Modified File)
Mime Type	application/octet-stream
File Size	17.71 KB
MD5	40aeb12e3391e073df44c1f4f6b20b1f
SHA1	9deda838a7ff7f5bf55911468346aa1c44cde4f5
SHA256	ec69cce8ce1d1f589dce95884326a18424e1051f65e982d9d9c304dbb7c1ea47
SSDeep	384:rNqmwqBfZOOEqyaR633OvFF2G+YupPReWkLXci2jXHU46is+MVL:rsmwGfMObya43O/SYw8Mi2jXHU46z+a

\\?\C:\588bce7c90097ed212\1028\LocalizedData.xml_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1028\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	60.27 KB
MD5	d6d933a4c102a8db7aa06c547ec34fc7
SHA1	09b44463f5d3112b05eb64f2e25b5eca8de087d6
SHA256	43345e72944296c8a20428ebd6cd97e27c6f72928470262dab3f20a2cd677b91
SSDeep	384:hcRtWHSmdOmy9yGIY3P+szaf2+2jP8lxtrzh1hsPN7ODPnPgQy50sJCXnofDPifq:hcnWymQStUUewYTJCv+Lh

\\?\C:\588bce7c90097ed212\1028\SetupResources.dll_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1028\SetupResources.dll (Modified File)
Mime Type	application/octet-stream
File Size	14.71 KB
MD5	dabdbc925d0a914fff781d241fa5439b
SHA1	744ce30823ca94146c51e5de341bfeaf0b3055b1
SHA256	039645d6415384de50c88ff261460f7e07da158e1a63136c9a6a2d34b1328249
SSDeep	384:88PbY60pwmE8r2o4WOmUKh2jpv36+MVbnY:88PNErr2/jmN2jpv36+QY

\\?\C:\588bce7c90097ed212\1029\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1029\eula.rtf_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	4.52 KB
MD5	b3f4ce3421833f6190177af6d4ae1bdc
SHA1	54f468d3127eaf07403c4b175212c79256d35684
SHA256	057504c376a231b0a48de960fead4fef5a0493ef9a7e90411085146f306a7a07
SSDeep	96:08XUuf7CLrCjyXOoY+5MlOA/xeEPVX/YIG9DpLE+QHNx+Ww9lD2c7MVau1S6SEn:08XU56V+mlTeERHGpFIS2+MVauAVE

\\?\C:\588bce7c90097ed212\1029\LocalizedData.xml_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1029\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	79.95 KB
MD5	309ddd06b2a53ef857d77196a3d3a9bd
SHA1	dab77e7a84888a288785088966c53ff4ec621d20
SHA256	7368e4d7c2cd909501e26526288db318171bb86514fc9130c4a62f033a4dbca2
SSDeep	384:R8/SXKwQb+ViKP6miH2jLa7ll9mT1B7eyNdT9eTiyn15byYOMbqav8qAMrZEXw/p:egKwq+fmj9EdvoZJZ0L+d

\\?\C:\588bce7c90097ed212\1030\SetupResources.dll

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1030\SetupResources.dll_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	18.71 KB
MD5	2c73e51089fd558905c133521bdfea3f
SHA1	0f151363958d086fb2a6a46d3fe7e8541c3ca41a
SHA256	c990199bc1c4ff1c28d3c74904ce9ebcfc35fb0d062d41f6b92cfc2492450cf3
SSDeep	384:DEnwotSkRzrBdgnqW98tAWWptfeWuLXci2jXHUgyh1R+MVS:KzwkpdWPCaeMi2jXHUgU1R+T

\\?\C:\588bce7c90097ed212\1031\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1031\LocalizedData.xml_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	81.29 KB
MD5	d62d3a02be9d428a3a5a99227cb885fe
SHA1	249b5f2ec9258bfedbc88801829f1452b1853445
SHA256	474ac5b957e88122a034ca96709df271a666eb917e291bb308a9dac53bf0815e
SSDeep	1536:4MGbdUbZwf+2CzQHsjz1VbxzPGnz6solo8xKc6JT/1SI:4RbdUtwf+2CzQHshPGnz6solo8xKc6J7

\\?\C:\588bce7c90097ed212\1035\eula.rtf_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1035\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	4.49 KB
MD5	e0aaff45751b4cf8227e1022e9cdaec7
SHA1	4c87db77c5f614385276d535e8875f4a69561f28
SHA256	33a797dba9461838661ba20c8df9e6eeca30330701199fd2796d36c7b38af628
SSDeep	96:F+uCVtlvzB/4QGo6vcq82oLSZrPmmC4cWzcSbdmWw9lD2c7MVau1SkL:F+Xl7B/CL8HSZrBlcOcSbdC2+MVauAkL

\\?\C:\588bce7c90097ed212\1037\SetupResources.dll_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1037\SetupResources.dll (Modified File)
Mime Type	application/octet-stream
File Size	17.21 KB
MD5	90a828bb73bdf0d11a16388a7fbbae0e
SHA1	a1c92a9349273367f6f50a3254bf8c75243a0957
SHA256	c4d8bb3db5b250a9eca2414820deb93ca998b0174980445a4ce6f4fbeff78efd
SSDeep	384:tT5HF11Mf4eXa8E+4JH9E6QbzcFdYa7c+wQLXci2jpvfM+MVSi:3H31+4eA+4JdXMzcsicLIMi2jpvfM+C

\\?\C:\588bce7c90097ed212\1038\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1038\LocalizedData.xml_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	85.29 KB
MD5	5672a455dc3a2e38c850ff65133658c4
SHA1	eec4b39202281db90fefff8ffa39b93b94e820f9
SHA256	ade8c20b82b9d5411312c79dff1ecbaecb2062f4f37fd05833b19fdabdf235cb
SSDeep	1536:nfbbCjNJLuNF70SNjPBzuXrXdJHbdi3kC4kLi:nfbaJLyF70SNjPBzuXrXdJHbdi3kCZO

\\?\C:\588bce7c90097ed212\1038\SetupResources.dll

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1038\SetupResources.dll_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	19.21 KB
MD5	6884f81c4c295e873e3c58d862f8726a
SHA1	ca5ce46e54f4acae25f8374437b40761753d2356
SHA256	42846471fa31c1d776874e720485f11af426d82145325462b84132b50cf8216d
SSDeep	384:X8ZQRldok+ZcnxIg8J4oWY1L/3i0MC4wWqyWpLXci2jpv5nNU+MVl9:XCMXokpxu1L/3i0MC44pMi2jpv5nG++

\\?\C:\588bce7c90097ed212\1040\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1040\eula.rtf_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	4.44 KB
MD5	b2e05b08ec44990065e81a7c8a7c6ad0
SHA1	bbd1930a53b9e7b0fbf7ef3731f9452c7510a474
SHA256	cec353118fa952745db003bc939821af730190a92f7246ccf338d5383ee9b2b1
SSDeep	96:q8Z8Oks6EXSCdA910Abf7KcI9TvxamwVoVtroWw9lD2c7MVau1S0:mnsfAwA3KNxLHto2+MVauA0

\\?\C:\588bce7c90097ed212\1041\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1041\LocalizedData.xml_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	67.51 KB
MD5	2721c5258d018306d45727df50ea1771
SHA1	fd4540c07db5c668914e81d3014988aa87ad14c5
SHA256	f4bfee620f4657adcf48d5022433cc3de1e4b429f69e5686a49d385fd529f077
SSDeep	768:gdKmfPAJyQOu7GlCnkJMlvWy0aO8rRnfJh+O:glQYQOu7GlCkJMlvWy0aO8rRfJX

\\?\C:\588bce7c90097ed212\1041\SetupResources.dll

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1041\SetupResources.dll_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	16.21 KB
MD5	1fe6f0b17fa202981465c1836dc55e63
SHA1	7d1074658fd60284097ac20531723f8d27ff5391
SHA256	2b52ee7e8f4be643f7b65028257e20e661b8a168805d1a0aaf4dd118ee42e5e1
SSDeep	384:+E2Ae0v5YHmLRlu86AXIW8xl/2y+Xci2jpvR+MVu:B2L45ymLvu8PaeMi2jpvR+T

\\?\C:\588bce7c90097ed212\1043\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1043\LocalizedData.xml_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	78.65 KB
MD5	124df59bc05b8a3be80dad8c278e31ab
SHA1	46ab8620be23bef573481e9695560b1a475a11f4
SHA256	e44ba3110e8b1e07b927b31e7502bea0d56b9f8006c2988f0e4f17c3a4701f24
SSDeep	768:1HkVnV3wwx2Pb82IB+GlQ5gwJBzauJzk8+b:xYBw+Ob82IB+GlQ5gwJBzauJzkP

\\?\C:\588bce7c90097ed212\1044\LocalizedData.xml_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1044\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	78.32 KB
MD5	54e6f2207d7c9c36611fe09a7b6129dc
SHA1	7b21f9ef5708c9ba6fb440dc14b342e87f5779a1
SHA256	2c55eecbeca61de1595d53c8cf902f7f05c595ae8f377888c8b6cfda088a3f1d
SSDeep	768:wHkHawZq4TGqeHveRhAo9CM6b2NJBuO7+y:Q/8ByqePeRhAo9CM6b2NJBuOh

\\?\C:\588bce7c90097ed212\1044\SetupResources.dll

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1044\SetupResources.dll_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	18.21 KB
MD5	1bdb0f9ed2fcda6af904db1b3f1b750d
SHA1	13f202fc6a9a4757350d893d80c06df1e91db4b2
SHA256	88650c66c9247d9d6c7c82d73e957102743dad4084d6a3eb0ab6b2366231b7fd
SSDeep	384:tssoBoexVbYcl9Vxp//rW9eWoLXci2jpv7y+MVw:gDTYoVr/WgMi2jpv7y+Z

\\?\C:\588bce7c90097ed212\1045\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1045\LocalizedData.xml_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	81.32 KB
MD5	058cf0377bd9b6fb1ab3064ed77f2ee7
SHA1	022e931e7134ae7b9ab72009ac3591d4675a37a4
SHA256	57f30c98d878ac4ca97565883e52aa4da389467a15d4fc1ca92185bcb917d7ec
SSDeep	768:Ssl4/7DarD382CQKvvUOfUs6LArUpFymrqQtr8BAyfO4RkSzXunasvJH2TF0wpYm:S44/HaEXvvUOfUs6LqTavdJkUQ

\\?\C:\588bce7c90097ed212\1055\SetupResources.dll_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\1055\SetupResources.dll (Modified File)
Mime Type	application/octet-stream
File Size	18.21 KB
MD5	88fcfc22a2970c83461e961836175c0c
SHA1	9359599027f5d4d863679c3ad8a008d1f8fdb90e
SHA256	065f6a548bfb5da304c058fcb9026f067300b90ad27518000659e2ee3f042b54
SSDeep	384:ZJI5xXdX3zJAGUoseKVHgbFCmKSgPMjN5CijRtRS0W0eW0LXci2jpvhP9+MVy:ZMzJpzsvVHghLKLMjtRtRVsMi2jpvh1k

\\?\C:\588bce7c90097ed212\2052\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\2052\LocalizedData.xml_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	60.14 KB
MD5	b6e38ef81423dafa46d3e4a68453f359
SHA1	24a4b9a75956912e8b7553ac78f49df68c83b758
SHA256	f4a55c4164c8b1ef2faf356ce4b5c62327400c2995ee1955209384a439a59d3d
SSDeep	768:HxekkPFhLHNo+jz2bXXwoZukC7FQKAuXRgcJv+P:HxekkzLS+3JU

\\?\C:\588bce7c90097ed212\2052\SetupResources.dll

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\2052\SetupResources.dll_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	14.71 KB
MD5	d45739587a6d8be9a99486e7f2ae9bcf
SHA1	3c6c564f334722013125c767b6d238957245542e
SHA256	8d80f3c115529e7d45072035f5f7c2bf895cfb638d90b4eeb5204eb63797b491
SSDeep	384:BAIYzcYLPoj8WHjG/IQjAqwwBvac2jpv/+MVb:S1zrPEjGNd/2jpv/+u

\\?\C:\588bce7c90097ed212\3076\LocalizedData.xml_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\3076\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	60.27 KB
MD5	d6bdb4979858f8dc5c1aea43ae491dc1
SHA1	09a9f20d5f3910708f1bf894906a5a457e047c40
SHA256	4ac13cabdaf4bf63d407720d198ede0c7145dc3f4e07498f139f6ea7644f8e8f
SSDeep	384:lHyzgUWSJaT6cdHqH2xe7oG3r0CJtu5C7A+2jP8lxtrzh1hsPN7ODPnPgQy50sJ4:sg3t6EH1klR7XewYTJCv+c

\\?\C:\588bce7c90097ed212\DisplayIcon.ico_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\DisplayIcon.ico (Modified File)
Mime Type	application/octet-stream
File Size	87.34 KB
MD5	d4945ab0738d459b45d6e8590c8cdc2e
SHA1	125919029f91651d460647605629289ab1fc9ca4
SHA256	f2e97faa414f6b9fc37ad59b49aef03b9e24ea90dc5e70aa5971e710153fe30a
SSDeep	1536:gzDyLhGzsoSqxMQP8ZOs0JOG58d8vo2zYOvvHAj/4/aXj/Nhhg73BVp5vEdd:gzDwozsd/gB4H8vo2no0/aX7C7DcH

\\?\C:\588bce7c90097ed212\Extended\UiInfo.xml

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\Extended\UiInfo.xml_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	39.01 KB
MD5	3c2568c6cd3356759bf4f3b8e0373622
SHA1	70da88e0302da9b1a8e1c0ca95fbf004c5c3e069
SHA256	95293cdadb53594f54e1c7be099ca8fe517e53bd71bf8f9b390a5c26078240d4
SSDeep	768:DERLaCXIzzlyAZQh7Jh6Fuh3kr1UO0NWpPUb9cu+dOtOcOdOjTRvefkfuz+qL:DesRE7/6Fuh3kr1UO0NWpPUb9cu+dOtc

\\?\C:\588bce7c90097ed212\Graphics\Rotate2.ico_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\Graphics\Rotate2.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.75 KB
MD5	1d9c1cbbe6950a990ba15b24e04fa275
SHA1	4a27a31bd7b916b784bda72749d6540b5e86502a
SHA256	7946b9d17f4f74a662c0b3f744bfac7eafcd406402d15966218fad17a66d0cb7
SSDeep	48:t8fiuNn5FiTxuRYGP3ULw9yuD2CNXLMSeEDu1nSanx:UM6Ww9lD2c7MVau1Sanx

\\?\C:\588bce7c90097ed212\Graphics\Rotate7.ico

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\Graphics\Rotate7.ico_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	1.75 KB
MD5	0333d6a04eaf59ba7ef78ce9ae718a73
SHA1	225e33043789490f69341cbe1b103008ae09e8db
SHA256	35b503a7f2d0d9133f524349732bea1e8833faf418ddd3f6aae6139dbcb71a98
SSDeep	48:BEDMhL6uJZ4D3pjYVl3ULw9yuD2CNXLMSeEDu1nSM4C:SDMhOuJeD3pClWw9lD2c7MVau1SM4C

\\?\C:\588bce7c90097ed212\Graphics\Rotate8.ico

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\Graphics\Rotate8.ico_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	1.75 KB
MD5	1fd0adf3f42eb15ab1dbdf670798bb2c
SHA1	54650d3626f26ff38ed1ab815664d60cda9a4471
SHA256	9fb99cb349776e092f970df23d54965f9d43390f51faca56e105fe3a977ea45a
SSDeep	48:ghsRduf48BslIQT5EmYXI3ULw9yuD2CNXLMSeEDu1nSrAXc:HRdu9TQtEmyIWw9lD2c7MVau1SX

\\?\C:\588bce7c90097ed212\Graphics\Save.ico

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\Graphics\Save.ico_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	2.00 KB
MD5	a1552ed31c6f93e6f43d68adccaed8dc
SHA1	98d56af2b2e275605d16baa06252b1a9c2a112e0
SHA256	0dacdb6003ff890cd84fe1e118a3d7cd65ed4905dceaebb7f08b2ea8f28765d6
SSDeep	48:sf5W4V+4N7p0JmsXy/3ULw9yuD2CNXLMSeEDu1nS0o/wA34p:IfDphGy/Ww9lD2c7MVau1S0tAop

\\?\C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	2.00 KB
MD5	a38d6f37768260cf94ac34d6865a6818
SHA1	1e21c3a461c3d7bb06dc2048bd8705497dbb1056
SHA256	5c4a1ac4f6b9459277aaa47d0b79ce3df7bb145636fba84b917527372f10b726
SSDeep	48:+H7Xw7Ge2xeKUIez/gVnQc+j95ZDq3A5z3ULw9yuD2CNXLMSeEDu1nSJF4qz5Qf:+M7BixjHyTD8mzWw9lD2c7MVau1SUc5s

\\?\C:\588bce7c90097ed212\header.bmp_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\header.bmp (Modified File)
Mime Type	application/octet-stream
File Size	4.42 KB
MD5	270161d6ebad95c02a57ac088ff31c91
SHA1	de13296beff1c281fb83e2383a3040a25d0646bc
SHA256	a33ffea5802f94b1b5442108ce85b4297267130f39abfe35b92b13b9f3aeabf9
SSDeep	96:vN7ksBMaOeWuINLURhfEUO0ynsLpeAYM5Ac0I8FknWw9lD2c7MVau1S9:vN79+aOeWHof9NCjM52kl2+MVauA9

\\?\C:\588bce7c90097ed212\Strings.xml

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\Strings.xml_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	14.63 KB
MD5	7b390277ccaef92aa4a4dcee1a13b957
SHA1	f917a39187a1421d9f1b79288ae7fea6331fd2b2
SHA256	39076d6f6a9b01f024c1a96faa5cae6793c43e13262c111bb5ce1fac38eb094f
SSDeep	384:vkeAbhOL3ddd/UcNbBenuHlLrKsWUPO+V+MV7:vyEjdDc8IuHBryUPl+q

\\?\C:\588bce7c90097ed212\UiInfo.xml

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\UiInfo.xml_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	38.87 KB
MD5	565674b4e746c8c897553e2c14b7d7bb
SHA1	b7b2aecf84548cf21f54a8f0b56f48e8eb6672a5
SHA256	01c98baf3ba193911206baee34a829aa96c2d5f26693657c86606828a258a4f4
SSDeep	768:tmxqN/NGS3IUfPv1Jh6Fmhvk71sO0Nep3UL9Eu+dOtOcOdOjTZfuPcfuz+d:SqN/NGSx1/6Fmhvk71sO0Nep3UL9Eu+g

\\?\C:\588bce7c90097ed212\watermark.bmp_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\watermark.bmp (Modified File)
Mime Type	application/octet-stream
File Size	102.51 KB
MD5	0dae82fefd3eda2423cbe341ec47d173
SHA1	88992816925753b9dca35e63dbc8a4356c19a0a1
SHA256	9c60fb279ece926a2ef631650b7c5d3b16e36bea52c63176ad5d646a5363cc0c
SSDeep	768:5GbTMhVyeI3aF93CWeBmAj72KbvEvffvCv7cTIMUHuRzHA8X9H51T9ho4xw7CgBi:54+Mk3cmAfbvEv47cIHzE9vo4SuUi

\\?\C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	2.09 MB
MD5	351a13d9dc16fe950ec5cefcee3eb8b6
SHA1	86cb894164202d4481e70963282db62a1dc54e7d
SHA256	edeae10297abd25fb04097ff0f8fe207ca4c7d6363c3bce66eb03fc35cdf3aba
SSDeep	49152:k7Ti7TD7TH784x7Tb7T6YV4YaG7T2DumT1r7AdXZy9KU2KUYxs35DKZ3OIKxWh0Z:/V4YakTo1PAdXZzKUYxs3pKZnKxfeK

\\?\C:\Boot\BCD.LOG1

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Boot\BCD.LOG1_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	900 bytes
MD5	38f73b73a90ec68ac16630e3c0fcc319
SHA1	2bf82fa973bbc40b6238a8809587c1fa5b2d1077
SHA256	ffad7b837b971a48382e584f5d1f01b7d1d6537ad7666da5193416a7b84cd447
SSDeep	24:sT3ULBoWU9yuD2YLNigLMS3uEDja1nNwztw:q3ULw9yuD2CNXLMSeEDu1nSzm

\\?\C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	f1c1a0f7668a2da9b9161327b4223773
SHA1	210f8be7088ad0a4ad75cd34b6e211b97c3105a2
SHA256	961f8eaa1af7c6eb4f96a6430cbbe2cd6d24ee5e9102059cba22dce54625516a
SSDeep	192:xSEcvdtPSVqz+JkRGv6JJ4U9OEynPMetF61VjD9g0EEHyi1zSG2+MVauAL:8rpz+JkGCL4QeK1Vlg0Ai18+MVm

\\?\C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	50d2d5e19f14d2116be503fa9dbdfa58
SHA1	23e0ed947f96f255ce7e17422a5bf3ba82c52ea5
SHA256	6e801938c2cb6b9e1beaf67caa8541d55b3cd5bc8ce25a97f7c46e319898a70d
SSDeep	384:Zs2CwQFXhJZ4i3hv8rEHkHFq/Ql9AY/ulYaY9UYCYOYGRYXYCYsYJxYDYD+MV7:ULdZx0rEHwq/QD7uiQ1+K

\\?\C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	813d2230df0951bb3fd993a83880cad7
SHA1	c061ee374869f62e0876bdc49c5100255e65ca26
SHA256	e966d04a3997a1434be75ac606af26d6298cca323bd548211be77f676ab68dda
SSDeep	384:HZ6SpFzMh7tsj06QUU4ros4lG+DYmYW+MVPaF:5ppihGtU4r4p8mYW+d

\\?\C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	1.07 MB
MD5	91dc3c2d032cccaa07698873a253de00
SHA1	b755e14b8dd32c811c3cd406f09b496409773910
SHA256	daec2b96200f2b76fa10ce8ecce2da93d393ddf167dc218d8fa4de452e910979
SSDeep	1536:xyq5QhzUIaaJgdT07GivBDSyHjA/zx1mZ:xyq5MaaJgp0yivBDSf/zHmZ

\\?\C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	bad89a035bd3aed48f23cd4ec59a39b0
SHA1	f284f64207923e622d9af2b5360b26f74a6af88f
SHA256	dfeeb7117627afb7ef971817534ef5454aa4f84575ba1908a39cf8d74f275d02
SSDeep	384:m3YlSeijBxU+9IJy4ZvGprxGnsDKTVvzV3V6CVHVbVLVaVnVlViVaVq+MVl:m3YlSeidu7LZucOS+Q

\\?\C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	615b40e6d5d6385bcb8826ae059736c1
SHA1	a3399652ea7be0fd96d8bedacc2c3e40dbef91db
SHA256	885ce5a939bf85d8374139f43277ede1f9820e45bbb0eb03d8ffb8eb9f99f104
SSDeep	1536:4+knGWF8eN1Mv6iXnPvrnP/DTjf/f7rXbb/b1:AJFj1e6snPvrnP/DTjf/f7rXbb/b1

\\?\C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	99c8e0bb35bc98efdf4e5f10bcdffd14
SHA1	eb4f937dca4b621d08bce866ae09eeda04166e30
SHA256	463124f423fc326c8313481e88766ee8665ff851129e0e6f9646d678bdb2198a
SSDeep	384:ZAtl2q3Wt5B0yEHMEZdm+e1dhcc37WLBnVA87+MVQ:ZAtv85GvBdmJdjWtnVA87+B

\\?\C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	b98449c092ed0882e2145cacf10b33e8
SHA1	43204a4b7d38fb5c6fc56a9adb3faef9585a2ba6
SHA256	5b39947c7f2e9be1fcd85dfbe9f22c107d0a416abcd700caed817ae633525046
SSDeep	384:3l3gs2b2Q1QqkZQpHbAEI6sy4oZVUzywunngpZ+MV4:VQDbh7fpHb5I6syhVwunng7+V

\\?\C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	1c44625cb6c4bb2b27b0b1d560276b1f
SHA1	4ac58d75c95703ba9e1ad4106a8b99ebe39df774
SHA256	9b2c162d2ebb05e03a33c79b2d1bf6aa532eac652ba9df21cc1b16f4368c785c
SSDeep	192:c6swVo/DN6zs7Vu9cp4IKxsHOz1L1a2JCmDCr6uHnMA39A2+MVauA31:cAVW1Vu9cVwsAnsmDc6uHVNd+MVk1

\\?\C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	a3a6bd9d672d5a86e5296c09f3933234
SHA1	96974d455525aff4f3806dc423399e0d3d881080
SHA256	519f08960be199f9442dced08591c8d5c60ffc95a7b305e7205f27a562add000
SSDeep	384:v7jTsPJveZmcCdoKwmF2NBIXvJxE2xys8V+MVN:vAPZYfQoh6JrmV+c

\\?\C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	a3a8e7408729fe7fe94888ec48fe04df
SHA1	1a87326fab47a280737e866799760ae2730d244c
SHA256	0a7d47a944b03a6400cbfd7522b9c6e7e020dae38869fe24ebc073cc6dbd1526
SSDeep	192:EXt4ZRf2q+miZyFjWEnuvGC8wMEkfjT0dazid8ivCOT2HvnvPJvXj2+MVauAlh:EXiMmiZyFaAI6xx7Idazid8JvnU+MVYh

\\?\C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	781cb8cbd38d720c81a0af8f1e0d3f97
SHA1	f89974d46e749a6fa22263f665dc4757b2219f5f
SHA256	2db25cf8cc775804e38ac64f375c5c51419188dc0fcaa67f2f392d1f8e83e884
SSDeep	384:I/xgVTsXzjXtEEaYDkhJ6dFc81Uq19rceyNnMYsf+MVB:I/x7x3zDkhJ6d91j1qbNCf+k

\\?\C:\Logs\Microsoft-Windows-International%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-International%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	80be0f928d9158c9863f6bbfa9802867
SHA1	e50db2dff57251e52278f97720d4a8d821cb1b1e
SHA256	983e0a5b55f47d8c7c6cf230b382c3a87ec34588c1ba923e08bb4937ea12655c
SSDeep	192:VhmPVvPRGEgV/VXjIrEg4pU7mbXvrK3tbzUnE1qFLuoKOSFHf52+MVauAOf:KPtPI90r/2/rK3tbzGE0LUlVM+MVL

\\?\C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	53399551438fdc6cb21c58ca9ae43ad6
SHA1	810afd6a3e68e9d6d200977b33b9b8fd4b797509
SHA256	b13a26b2ab599ef2c0e4d886c5d851906b96116be8177bd1c96dd1bc2182ea7b
SSDeep	768:HtM42MRXTztXtqyeNhkNGJ5owk7qkkYyQIN13ALyYYz2ZcC+hKSDAdpQ+9:Hhr7eNhkNGJ5owk7/hINMRpd

\\?\C:\Logs\Microsoft-Windows-Known Folders API Service.evtx

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Known Folders API Service.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	88dd3429ae8729f813d528a6db776237
SHA1	c981c01ecc00d68a1a83bc6bd1fba5cf4e0f5ece
SHA256	f0dc69714c5cd32bb99c5620cb204a956d6d89007596d3590286adfe270a737d
SSDeep	192:Z+bm2pWTwQoybgcUgf+8nEV0ZpdwK/txChztIwBA/NNbgxm+bVtFcOP12+MVauAX:Z+3owybUgPEKZjZwqtOPX+OPQ+MVi

\\?\C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	c141d7046632a2f76204fe1a6d4518d7
SHA1	9e88b24c441666ebb82a8aae472edd4164e4fa24
SHA256	d45cc5d817afcb14c3cfb8ae30ee6efb987ec910cb77e70f835eb65691d419f7
SSDeep	384:dx7cDuHR7khhkS8eWj8qVasur+52a5cea5ia5ua5xa5Da51a5gza5aa5Ka5ba5Dj:d3FkhCp/jQsqr+6

\\?\C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	60ea3a786405f1354b9e2f9b7849a334
SHA1	eb2804f2e7c93b73b755b38837e5d3bdc6a6beac
SHA256	bd895fb92a210b42443a715ad50b22a1c06bf5700092e1b19037feedb224e9cd
SSDeep	384:Vm4SFBJiguUQM6i63B/tvAt9KbFWKpke+MVm:Vm4SF3i663BdAtkbFDn+n

\\?\C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	16760e32bc13353484ac59e8ee674e0e
SHA1	3eb54857dddf9242f2fa5af9451dab3f5ecc8049
SHA256	8170ccbbe6c9e243445fadcbea59e47942504bd89ee1d5110bd3ce920c7a56df
SSDeep	384:ZtoARk8x9fp/O8lV8sxwHOM91rPygR+MV4q:roIk89xBpxwlagR+k

\\?\C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	3666ecd9b87a22c0cc9c87164cd11845
SHA1	69f7080ed9cd1bfee3f3e764a04f0c52482f9b69
SHA256	59f2f2d334c1cac8dc4118ed4c9d5a96ed550ec31d5ace5f3cd60fc3161901ac
SSDeep	384:smVctXeNRRj/iNGgN6EAefbq6b6Mnmo6+MVI9:sGctOh/eJpe6b9mo6+T9

\\?\C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	ced33980aaa4a441fde40e3ac0b0e5c9
SHA1	ed091036a5a3a12f60e56443de9c31af3e7335b2
SHA256	dde916285aab91fea628f28c5aab1a63018719dfd006315eb71d7615cb2d2b5f
SSDeep	768:I/mH2s370AhFK6mgWD8bJMJFIlLNv4uzo11gqd+5:IOWs3gOHtWD8bJMJsQa

\\?\C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	4d5855a45ff860907aeab6c5390dc10f
SHA1	efa2e079c67dc5197267ceba530d7642032a704f
SHA256	d9f3e5cdc4c8e9b96cfb97470e53d8467364d0a2b075dcc48dc10fd3ea3918fc
SSDeep	384:7/udl3copLzpDz+93r0nbwnwiE5KfM+MVH:TsMopLzV+hKbyEH+K

\\?\C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	5c38f0f9cce7a4aaa82520a9923f51ff
SHA1	f9bcee6201890829f93a2c8c89e8e4b32ba367df
SHA256	7624ce0308f3e4cd55645329bc6a159330a67ffaa2009ea67240fa36e58ade25
SSDeep	1536:3nLfldVyT0pHh9ZCLpv3fjcpdcxX0Jh/ieZ6yRoebhNkEA96xo41XWUd3195F7b4:X5dVyT0pHh9ZCLpv3fjcpdcN0Jh/ieZ+

\\?\C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	b17ed9a8779039a29953fe4540e78ba8
SHA1	1408c6b8380c386daccd08f54856039ebb98419f
SHA256	c5793e2d7f9318e540e44199533414695bde39e74a3c90c6b7f4ccde4e690bd4
SSDeep	384:da35HvEgnw+J34JPWi5yauNeLtXuhOM+MVE:da37wbkiEbNeJXy+5

\\?\C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	9eeeb7f24fabf8f23a50baa92b980d20
SHA1	3b75943624c15d067082339d3e82eff4c6d3a78a
SHA256	e9754dc0b094bf6ee3b19155f42b5596471823e688fc53f5bd1c91778b4f1214
SSDeep	192:F5MrYc/wmUykiibYkxouNHM+Q05ya2c0BcoTs2Jcv456mN2+MVauAjD:7Mkc/wmGYkxouNHr5y7LBJjJ+45E+MVK

\\?\C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	b2580fee286b194cc5218fc20cbf5002
SHA1	f52e11e386c7db3f553f3c154e7208f8217d26a9
SHA256	19f396fbebcae43911c315042cd3c90809e79306a39f1f8ba233bd4c95fa8eeb
SSDeep	192:u8R+6gxOgbpB5uBcU/8uknrOUfi7WtNoq7a9SEWGZMSsfZXYya2+MVauA4/:vUGP/8ukiUsWsag2RfZIyL+MVt

\\?\C:\Logs\Microsoft-Windows-Store%4Operational.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Store%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	4d99eaa619c3c878da865f9ca475baf7
SHA1	084e3a7bbd83150cb961cc4c539b925853941d9d
SHA256	7bf2c945dcbbb726d51fd03b1e141214805cbd0ca0df8bc41f7318350f6069ce
SSDeep	384:nQ6Hw0tk3VxM6KFZSrVVMa059YPQ+MViol:5LklxM6KMl05mQ+jG

\\?\C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	ef25735677d937de604f5ce230b4e7d2
SHA1	8c5f26845e979bea8432666d605742b4ac1b38d8
SHA256	dcab6f01d7b58fbee0f124b23e2483884c3757a3cb156b4c62fbc1ab7a70651a
SSDeep	192:5DydabXbP2/5m2XiM2UK5n+FvFW6MdVMQfImhlyykQiJ9vpifo02+MVauAN:5udaXP2xtXiXnsIJTlsZ/pUo5+MVo

\\?\C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx_r00t_{8ew5f6}.ebal

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	ced5fdfd13688e61c2627dbe1b223480
SHA1	b706aee1467bea0d855b63ce882d8c39d634ce52
SHA256	a4987d71059f09abf8830f5f33bc27aaf045f8ea5d3c74c0236f1627030df0af
SSDeep	192:40WL+kAie2WRd8ikC4ubSQPS3y/tN348K2jdnbY/iWE3F2+MVauA+:4NL+gU/ySR63yFN3BbjBYqWUg+MVX

\\?\C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	ce5d1386f765a274bfb00ca9b7a7f00c
SHA1	c6a1497e7b4b775015fcf3b283c4099c95726b6b
SHA256	a41d169b8803d740a67721328dd28341ad399c323a2ee2110dbb78e515bd1b49
SSDeep	384:7pLOnEVRLwymGRbuX+cI8wU0P5/8n+8m3m1mbmemZmq+MV76:74nIRLwymcXHpA+n

\\?\C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	68.88 KB
MD5	4b7bebbdc46f8368928542a17108d418
SHA1	844dd67e6b6002a7eb95e17be0581efb312fbcc9
SHA256	f3777be37c60ff3895a1c6cd01fccde2b9dc6939d25732323bac2dc845b53510
SSDeep	384:ewEaXDQkR+AVFKLGZjCwxUvj6+an1+MVP:GSDQkJjFtqj6+k+a

\\?\C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx_r00t_{8ew5f6}.ebal (Dropped File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	f1b4289a9da216fd75f03c4d089ade54
SHA1	46eb3edb8abf11900ec8a03abd4db013c83b9eb5
SHA256	9e92e844d7ca08e3b2ea67deb55d59a6662aef770deb91e01a95656ac0b7d039
SSDeep	768:wYmdgSBXj3KM0IKub/Witryk+NN4ONE1Oaba8ysSlSpQ3uLaBzEBi2qV9l1abT+w:wFdgSsRwWsSlSpQ3uLaBGfqM

Remarks (1/1)

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After