c65df5ec...b1f0

Master Boot Record Changes

»

Sector Number	Sector Size	Actions
2063	512 bytes	... Actions Show Code Modification

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersGrujaAppDataRoaming6Xx3WI1ICfwJbN6F1OD~1.EXE

Sample File

Binary

Blacklisted

»

Also Known As	C:\Users\5P5NRG~1\AppData\Roaming\MOV7TW~1:bin (Created File) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Modified File) C:\Users\5P5NRG~1\AppData\Roaming\\8DAT2H~1:bin (Created File)
Mime Type	application/x-dosexec
File Size	128.50 KB
MD5	5e4d33770945fab4c48bedf329c7ce5c
SHA1	54a6e4d0ca09af93a96eb3ee22085759da63902b
SHA256	c65df5ec5152af018ff362039351255ba7b59ea844639619f73d96ea135ab1f0
SSDeep	3072:drpyXTfAqsqJ6FHoZfsMoQQNglC1Omz8spl+9dVKj+4:Zpy4OBVQGCMmzRpIVKj+
ImpHash	8446b3d161d5b2a53c721bbab8017430

File Reputation Information

»

Severity	Blacklisted
First Seen	2018-06-01 14:58 (UTC+2)
Last Seen	2018-09-01 05:48 (UTC+2)
Names	Win32.Trojan.Streamer
Families	Streamer
Classification	Trojan

PE Information

»

Image Base	0x400000
Entry Point	0x402313
Size Of Code	0x18800
Size Of Initialized Data	0x6e00
File Type	executable
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2018-05-31 19:06:07+00:00

Sections (3)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x187a4	0x18800	0x400	cnt_code, mem_execute, mem_read	6.43
.data	0x41a000	0x1368	0x1400	0x18c00	cnt_initialized_data, mem_read, mem_write	4.48
.rsrc	0x41c000	0x6150	0x6200	0x1a000	cnt_initialized_data, mem_read, mem_write	7.58

Imports (12)

»

kernel32.dll (13)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
LoadLibraryA	0x0	0x41a48c	0x1a7a0	0x193a0	0x0
VirtualAlloc	0x0	0x41a490	0x1a7a4	0x193a4	0x0
VirtualProtect	0x0	0x41a494	0x1a7a8	0x193a8	0x0
GetProcAddress	0x0	0x41a498	0x1a7ac	0x193ac	0x0
GetCurrentThreadId	0x0	0x41a49c	0x1a7b0	0x193b0	0x0
GetTickCount	0x0	0x41a4a0	0x1a7b4	0x193b4	0x0
GetVersion	0x0	0x41a4a4	0x1a7b8	0x193b8	0x0
GetCurrentProcess	0x0	0x41a4a8	0x1a7bc	0x193bc	0x0
SetLastError	0x0	0x41a4ac	0x1a7c0	0x193c0	0x0
FormatMessageW	0x0	0x41a4b0	0x1a7c4	0x193c4	0x0
SetFileApisToOEM	0x0	0x41a4b4	0x1a7c8	0x193c8	0x0
SwitchToThread	0x0	0x41a4b8	0x1a7cc	0x193cc	0x0
LocalCompact	0x0	0x41a4bc	0x1a7d0	0x193d0	0x0

gdi32.dll (10)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
DdEntry4	0x0	0x41a460	0x1a774	0x19374	0x0
FONTOBJ_vGetInfo	0x0	0x41a464	0x1a778	0x19378	0x0
CreateFontIndirectW	0x0	0x41a468	0x1a77c	0x1937c	0x0
DdEntry2	0x0	0x41a46c	0x1a780	0x19380	0x0
DdEntry38	0x0	0x41a470	0x1a784	0x19384	0x0
GetLogColorSpaceA	0x0	0x41a474	0x1a788	0x19388	0x0
CreateMetaFileA	0x0	0x41a478	0x1a78c	0x1938c	0x0
ExtCreatePen	0x0	0x41a47c	0x1a790	0x19390	0x0
GdiPlayJournal	0x0	0x41a480	0x1a794	0x19394	0x0
DdEntry54	0x0	0x41a484	0x1a798	0x19398	0x0

shlwapi.dll (16)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
PathGetCharTypeW	0x0	0x41a554	0x1a868	0x19468	0x0
GetMenuPosFromID	0x0	0x41a558	0x1a86c	0x1946c	0x0
PathRelativePathToA	0x0	0x41a55c	0x1a870	0x19470	0x0
PathFindNextComponentA	0x0	0x41a560	0x1a874	0x19474	0x0
StrCatBuffW	0x0	0x41a564	0x1a878	0x19478	0x0
ColorHLSToRGB	0x0	0x41a568	0x1a87c	0x1947c	0x0
PathFindFileNameW	0x0	0x41a56c	0x1a880	0x19480	0x0
SHRegCreateUSKeyA	0x0	0x41a570	0x1a884	0x19484	0x0
PathIsRelativeW	0x0	0x41a574	0x1a888	0x19488	0x0
wnsprintfW	0x0	0x41a578	0x1a88c	0x1948c	0x0
SHRegQueryInfoUSKeyW	0x0	0x41a57c	0x1a890	0x19490	0x0
PathMakeSystemFolderW	0x0	0x41a580	0x1a894	0x19494	0x0
AssocCreate	0x0	0x41a584	0x1a898	0x19498	0x0
SHRegDeleteUSValueA	0x0	0x41a588	0x1a89c	0x1949c	0x0
UrlApplySchemeW	0x0	0x41a58c	0x1a8a0	0x194a0	0x0
PathRemoveBlanksW	0x0	0x41a590	0x1a8a4	0x194a4	0x0

winspool.drv (8)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SetPrinterW	0x0	0x41a600	0x1a914	0x19514	0x0
AddPrintProcessorA	0x0	0x41a604	0x1a918	0x19518	0x0
SetPrinterDataA	0x0	0x41a608	0x1a91c	0x1951c	0x0
AbortPrinter	0x0	0x41a60c	0x1a920	0x19520	0x0
EnumJobsA	0x0	0x41a610	0x1a924	0x19524	0x0
AddPortExW	0x0	0x41a614	0x1a928	0x19528	0x0
AddPrintProvidorA	0x0	0x41a618	0x1a92c	0x1952c	0x0
EnumFormsW	0x0	0x41a61c	0x1a930	0x19530	0x0

oledlg.dll (6)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
OleUIChangeSourceA	0x0	0x41a504	0x1a818	0x19418	0x0
OleUIConvertW	0x0	0x41a508	0x1a81c	0x1941c	0x0
OleUIInsertObjectW	0x0	0x41a50c	0x1a820	0x19420	0x0
OleUIPromptUserA	0x0	0x41a510	0x1a824	0x19424	0x0
OleUIAddVerbMenuW	0x0	0x41a514	0x1a828	0x19428	0x0
OleUIPasteSpecialA	0x0	0x41a518	0x1a82c	0x1942c	0x0

shell32.dll (12)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
OpenAs_RunDLLA	0x0	0x41a520	0x1a834	0x19434	0x0
SHCreatePropSheetExtArray	0x0	0x41a524	0x1a838	0x19438	0x0
SheSetCurDrive	0x0	0x41a528	0x1a83c	0x1943c	0x0
SHQueryRecycleBinA	0x0	0x41a52c	0x1a840	0x19440	0x0
Win32DeleteFile	0x0	0x41a530	0x1a844	0x19444	0x0
SHCLSIDFromString	0x0	0x41a534	0x1a848	0x19448	0x0
SHGetSpecialFolderPathA	0x0	0x41a538	0x1a84c	0x1944c	0x0
StrStrIA	0x0	0x41a53c	0x1a850	0x19450	0x0
ShellExecuteA	0x0	0x41a540	0x1a854	0x19454	0x0
Shell_GetImageLists	0x0	0x41a544	0x1a858	0x19458	0x0
StrStrW	0x0	0x41a548	0x1a85c	0x1945c	0x0
Options_RunDLLW	0x0	0x41a54c	0x1a860	0x19460	0x0

winmm.dll (12)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
mixerOpen	0x0	0x41a5cc	0x1a8e0	0x194e0	0x0
PlaySoundW	0x0	0x41a5d0	0x1a8e4	0x194e4	0x0
SendDriverMessage	0x0	0x41a5d4	0x1a8e8	0x194e8	0x0
midiInPrepareHeader	0x0	0x41a5d8	0x1a8ec	0x194ec	0x0
midiInStop	0x0	0x41a5dc	0x1a8f0	0x194f0	0x0
mixerGetID	0x0	0x41a5e0	0x1a8f4	0x194f4	0x0
midiInMessage	0x0	0x41a5e4	0x1a8f8	0x194f8	0x0
mciGetDeviceIDW	0x0	0x41a5e8	0x1a8fc	0x194fc	0x0
midiOutClose	0x0	0x41a5ec	0x1a900	0x19500	0x0
waveInGetErrorTextW	0x0	0x41a5f0	0x1a904	0x19504	0x0
mixerMessage	0x0	0x41a5f4	0x1a908	0x19508	0x0
waveOutGetDevCapsW	0x0	0x41a5f8	0x1a90c	0x1950c	0x0

ole32.dll (15)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CreateObjrefMoniker	0x0	0x41a4c4	0x1a7d8	0x193d8	0x0
CoSwitchCallContext	0x0	0x41a4c8	0x1a7dc	0x193dc	0x0
HICON_UserSize	0x0	0x41a4cc	0x1a7e0	0x193e0	0x0
HGLOBAL_UserFree	0x0	0x41a4d0	0x1a7e4	0x193e4	0x0
DllGetClassObject	0x0	0x41a4d4	0x1a7e8	0x193e8	0x0
CoResumeClassObjects	0x0	0x41a4d8	0x1a7ec	0x193ec	0x0
CoEnableCallCancellation	0x0	0x41a4dc	0x1a7f0	0x193f0	0x0
HMETAFILE_UserMarshal	0x0	0x41a4e0	0x1a7f4	0x193f4	0x0
OleMetafilePictFromIconAndLabel	0x0	0x41a4e4	0x1a7f8	0x193f8	0x0
HACCEL_UserUnmarshal	0x0	0x41a4e8	0x1a7fc	0x193fc	0x0
CLSIDFromString	0x0	0x41a4ec	0x1a800	0x19400	0x0
OleInitializeWOW	0x0	0x41a4f0	0x1a804	0x19404	0x0
GetHGlobalFromStream	0x0	0x41a4f4	0x1a808	0x19408	0x0
ComPs_NdrDllRegisterProxy	0x0	0x41a4f8	0x1a80c	0x1940c	0x0
HPALETTE_UserMarshal	0x0	0x41a4fc	0x1a810	0x19410	0x0

comctl32.dll (11)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
Str_SetPtrW	0x0	0x41a430	0x1a744	0x19344	0x0
ImageList_Merge	0x0	0x41a434	0x1a748	0x19348	0x0
DefSubclassProc	0x0	0x41a438	0x1a74c	0x1934c	0x0
ImageList_LoadImageW	0x0	0x41a43c	0x1a750	0x19350	0x0
PropertySheetA	0x0	0x41a440	0x1a754	0x19354	0x0
CreateMappedBitmap	0x0	0x41a444	0x1a758	0x19358	0x0
FlatSB_ShowScrollBar	0x0	0x41a448	0x1a75c	0x1935c	0x0
InitializeFlatSB	0x0	0x41a44c	0x1a760	0x19360	0x0
ImageList_Add	0x0	0x41a450	0x1a764	0x19364	0x0
DrawStatusTextA	0x0	0x41a454	0x1a768	0x19368	0x0
CreatePropertySheetPageA	0x0	0x41a458	0x1a76c	0x1936c	0x0

advapi32.dll (11)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SystemFunction005	0x0	0x41a400	0x1a714	0x19314	0x0
SaferSetLevelInformation	0x0	0x41a404	0x1a718	0x19318	0x0
ConvertStringSidToSidW	0x0	0x41a408	0x1a71c	0x1931c	0x0
SetSecurityInfoExW	0x0	0x41a40c	0x1a720	0x19320	0x0
RegisterEventSourceA	0x0	0x41a410	0x1a724	0x19324	0x0
WmiFreeBuffer	0x0	0x41a414	0x1a728	0x19328	0x0
GetCurrentHwProfileA	0x0	0x41a418	0x1a72c	0x1932c	0x0
CreatePrivateObjectSecurityWithMultipleInheritance	0x0	0x41a41c	0x1a730	0x19330	0x0
LsaLookupNames2	0x0	0x41a420	0x1a734	0x19334	0x0
RegisterTraceGuidsA	0x0	0x41a424	0x1a738	0x19338	0x0
RegRestoreKeyA	0x0	0x41a428	0x1a73c	0x1933c	0x0

user32.dll (12)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
DrawTextExA	0x0	0x41a598	0x1a8ac	0x194ac	0x0
MapVirtualKeyExW	0x0	0x41a59c	0x1a8b0	0x194b0	0x0
EnumDesktopWindows	0x0	0x41a5a0	0x1a8b4	0x194b4	0x0
InvalidateRect	0x0	0x41a5a4	0x1a8b8	0x194b8	0x0
GetClassNameA	0x0	0x41a5a8	0x1a8bc	0x194bc	0x0
GetDlgCtrlID	0x0	0x41a5ac	0x1a8c0	0x194c0	0x0
BeginDeferWindowPos	0x0	0x41a5b0	0x1a8c4	0x194c4	0x0
WINNLSEnableIME	0x0	0x41a5b4	0x1a8c8	0x194c8	0x0
DialogBoxIndirectParamW	0x0	0x41a5b8	0x1a8cc	0x194cc	0x0
GetWindowContextHelpId	0x0	0x41a5bc	0x1a8d0	0x194d0	0x0
LoadLocalFonts	0x0	0x41a5c0	0x1a8d4	0x194d4	0x0
MsgWaitForMultipleObjects	0x0	0x41a5c4	0x1a8d8	0x194d8	0x0

GdiPlus.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GdipAddPathLine2	0x0	0x422138	0x22144	0x20144	0x0
GdipAddPathBeziers	0x0	0x42213c	0x22148	0x20148	0x0

C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.locked

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	10.00 MB
MD5	2aa4a1f277596686a24f98e5ec92f2fc
SHA1	eabbcba0dee9cf276f02a69cc7414487a6f208eb
SHA256	ba36805b970001a77a39c9dfc9fdb2875bca375ceaf3c9c62fab242adc8bace5
SSDeep	196608:N5gcmQRCW+SlDIlTytuej7VuwyigvWEc/yI41nHQRLK41cO0dJI:x5ROIIl+tuo7tyxWEcO1wRLKUcO0dJI

C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.readme_txt

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	1.11 KB
MD5	cd44a3076aaf434b39dac285d9b936cf
SHA1	028e70a863473ad6035997ba00135fe7f822f1c5
SHA256	42c035c5935686d45b73a73bb4970e3c5ef69f621f2dacd478df999a855cc073
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHW53NSKHfcVv:xzSsf9FjfiHZW5irkhtWfHWRNSFv

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.readme_txt

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	1.11 KB
MD5	c3b1b3835ce6ee34009ed4a7b4ca664a
SHA1	55eb8529dbcced58bda46b7f70f2c1363fa3429d
SHA256	42c539c31162e3ba3554250783af600b8e74a1b01f7d41f31c06614ddc60c5a9
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWPcw0OR8NS:xzSsf9FjfiHZW5irkhtWfHWPcB3Y

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.readme_txt

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	1.11 KB
MD5	19d91ec337598d55422ecf3be992198a
SHA1	404e73efc090de595632b569d99096465402c2a5
SHA256	e1511243875380e7a2154c2e31a3a2a5d6410d8c9a3e782ec5bbdc52cf2abd18
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWLnDHDf/SN:xzSsf9FjfiHZW5irkhtWfHWLnDHbSN

C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.readme_txt

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	1.11 KB
MD5	fde07352a0bb361ade69ad2303df5d0f
SHA1	3e504e0bb0cd3de8e3ba3af05898a28c2d6c4acc
SHA256	6fab4316fa40b855071dbe4430eac8430c6709bf3a1bd5ca32ac809475e80341
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWNyIdIXE:xzSsf9FjfiHZW5irkhtWfHWNya

C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi.readme_txt

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	1.11 KB
MD5	599996a6790253fc18534b7378a36db5
SHA1	4bae69d9103f055749d626cab8d9503b238c6fda
SHA256	3ea0f2c01f2d4408cb66feaaf4ab11788a04c7cd7176b7baeb44dfbcd6cb8619
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWqA8StGirv:xzSsf9FjfiHZW5irkhtWfHWqArGi7

C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi.readme_txt

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	1.11 KB
MD5	61ae554772d5626cf3ef8d9d2a89cfe2
SHA1	b6f870f5b8a7956c450d4b2465e9723935b936b9
SHA256	f5e579866eac20e62ff6db88457e42e816bacb9c67d52d198e3770fd380f0a66
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWMLhAv63s4n:xzSsf9FjfiHZW5irkhtWfHW9v6P

C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.readme_txt

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	1.11 KB
MD5	d67173176bf7725b268dead8e7f4572d
SHA1	d6a45c7aaf277bf52dba3535a34b628cf7908994
SHA256	174a70ba1296d52fe0ca3f63041f96dd8f12f29970ac761905c5006fbf8bcd51
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWY1QD2jEPu:xzSsf9FjfiHZW5irkhtWfHWY1QM

C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.readme_txt

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	1.11 KB
MD5	3ab1599d6184a3868d6a5f8f16439db6
SHA1	81fc90cedd5db619d647b418009720a034def17c
SHA256	01a891f443bb7d0a802fe19fa188c06421279802cad76de448f12ebd557df1aa
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWaNjrBYgyYUD:xzSsf9FjfiHZW5irkhtWfHWa99YgyYk

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.readme_txt

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	1.11 KB
MD5	b4930bcf1b19a88533b6ff0e99283aed
SHA1	74d5bcb1767b44fd406567c28b7583a6558e048f
SHA256	07c15ae197aec1ca0e6908d5b0ec76669b6e98c8ff8c5917c8cf75bc12df70fa
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWkMfGRPtY:xzSsf9FjfiHZW5irkhtWfHWkMfYS

C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.readme_txt

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	1.11 KB
MD5	a274b72aa37c6b8e748f64a520dd8a73
SHA1	cec705e99072d5755ccffc2bb39a701c563cd074
SHA256	83672a2a5a03f525da8ec885fa71f2ef94e54348e734d1b52d4e9b9a79061fca
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWr8WdM3:xzSsf9FjfiHZW5irkhtWfHWoWdM

C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.readme_txt

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	1.11 KB
MD5	6b2129c7a24c288fbc58d0778961b4d5
SHA1	865999f515538fe901e3af1bba15bcc5b744f5c7
SHA256	a696b340804bc4167e574bacc8e7843f2b6db79248e81f4f4611b222608ac088
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWNU8qo5Wtc0rrV:xzSsf9FjfiHZW5irkhtWfHWNU8zItc09

C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi.readme_txt

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	1.11 KB
MD5	9a68ae0ae29ba78e5f6369b17ca6bc59
SHA1	90246a1cc1527c9d54b64016add364cc5e6c3c1e
SHA256	de326b0b0485b64499e2bf1ad3e473eff2cf327ba1f04bfd13cd7be0cf011f66
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWgwMB:xzSsf9FjfiHZW5irkhtWfHWY

C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab.readme_txt

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	1.11 KB
MD5	7993b67eeace980a55d2f8b45552ad81
SHA1	7d99e1fb750720c56c37ec5a5f8fe6faa1f12b65
SHA256	27680e13f4ce28771d0fd8f96bf622e822061ffed79ec6565bab55f82a329561
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWn9IQxcp:xzSsf9FjfiHZW5irkhtWfHWn9IQK

C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.readme_txt

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	1.11 KB
MD5	b3640bf7056174f0af3780e1456b56e5
SHA1	252b22afeae5b70cea957269139be159b26d54ce
SHA256	e5b55862397d8ecee6e94d6c5de8d328a1cf408878feb32d3f6ea89c4cbbd1ad
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHW9tdd5ZFg1:xzSsf9FjfiHZW5irkhtWfHW9tdLU1

C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.readme_txt

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	1.11 KB
MD5	01f6624341f02b302d3278e35205fe8c
SHA1	2ea46afe7ea052e28ba33253795eaa7d87a4a3d9
SHA256	5c7a8feacee7b15009663f12de485956a511f7df4ade92fc26cbab909d334cae
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWsdPx2yN:xzSsf9FjfiHZW5irkhtWfHWAx2yN

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.readme_txt

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	1.11 KB
MD5	8478e1d20014f4054ac1e50d593199a0
SHA1	a97ac40ff3aebdaf6bc7e5f1cadbb242a844bb53
SHA256	c47d0b6078985922acc1f7bbdbae94e22238b7d084e41666f196ae5f71f579e0
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHW2QCfzvxfLE:xzSsf9FjfiHZW5irkhtWfHW2QCvxfo

C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.readme_txt

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	1.11 KB
MD5	77f31a805fc18474f3549553e4bd1966
SHA1	fb9325a2c1037d5c2e557990ca2a27056b70e84c
SHA256	2f614e63da9ed3ef146195602477df40e51af5b0a3c6117393ce5eb217b2b956
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWeTVX/n:xzSsf9FjfiHZW5irkhtWfHWeN/n

C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.locked

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.41 MB
MD5	d7831a28eb789c80f4a3e1d56f39639d
SHA1	cf6670cc589c3aeeeb9e03f4560460c3168886cb
SHA256	ef513ca4bcf9fa9ef59d2e66f1a6d78883c4b3a2585ef34df275bb37401c1647
SSDeep	49152:0FThnX5pPpx+ZiS0I6DXdnrDot39dcgnQz9TwtbdqQEMZNTYmvxqN4Rwzjxre:0FThnJ7xDSm6bnnQzqJdqCZH8N4mJe

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	769d8730f9a8d09855d002b2617c8e1a
SHA1	b1b20cc22af9c09fe6b6e7a34f8265b3d5ed568f
SHA256	b0039f2121978ea3cc1e706aeffd615362a17be86793eb45677643999f5f9092
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHW9dUW2Nxw:xzSsf9FjfiHZW5irkhtWfHWkW2vw

C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	8173c40101e9709f2b49f071e7bfa743
SHA1	ea9ff67baa75261ee92b66d6a72059da7da8c931
SHA256	e0954de4bdd0bf5471160444e621b0d6111fb910035e0e60163de9336a6cedf7
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWxmPBIoqek:xzSsf9FjfiHZW5irkhtWfHWQ5Iuk

C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE:0

Created File

Binary

Not Queried

»

Mime Type	application/x-dosexec
File Size	170.35 KB
MD5	4965b005492cba7719e82b71e3245495
SHA1	441b048b302f14b6266707de938841a6c27504b5
SHA256	52ad72c05facc1e0e416a1fa25f34fdd3cb274fab973beaae911a2faca42b650
SSDeep	3072:wacEHTAkXbVjAaX/0EVNt4xXqutFdNciAqnYCDb5+aVjMvhNOSH2S9oe:0EHskXbVjF/ZNGtFdNdFnTDYZNjPB
ImpHash	8e598b492338e61885e9e3de1b4d3573

PE Information

»

Image Base	0x140000000
Entry Point	0x140014368
Size Of Code	0x1ec00
Size Of Initialized Data	0xc600
File Type	executable
Subsystem	windows_gui
Machine Type	amd64
Compile Timestamp	2010-01-10 04:19:27+00:00

Version Information (10)

»

LegalCopyright	© 2010 Microsoft Corporation. All rights reserved.
InternalName	ose
FileVersion	14.0.4730.1010
CompanyName	Microsoft Corporation
LegalTrademarks1	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2	Windows® is a registered trademark of Microsoft Corporation.
ProductName	Office Source Engine
ProductVersion	14.0.4730.1010
FileDescription	Office Source Engine
OriginalFilename	ose.exe

Sections (6)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x140001000	0x1eaf8	0x1ec00	0x400	cnt_code, mem_execute, mem_read	6.3
.rdata	0x140020000	0x65a8	0x6600	0x1f000	cnt_initialized_data, mem_read	4.99
.data	0x140027000	0x3900	0x1600	0x25600	cnt_initialized_data, mem_read, mem_write	2.04
.pdata	0x14002b000	0x1698	0x1800	0x26c00	cnt_initialized_data, mem_read	4.99
.rsrc	0x14002d000	0x730	0x800	0x28400	cnt_initialized_data, mem_read	3.92
.reloc	0x14002e000	0x480	0x600	0x28c00	cnt_initialized_data, mem_discardable, mem_read	4.69

Imports (7)

»

ADVAPI32.dll (29)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RegCloseKey	0x0	0x140020000	0x23e18	0x22e18	0x22a
RegEnumKeyExW	0x0	0x140020008	0x23e20	0x22e20	0x249
RegCreateKeyExW	0x0	0x140020010	0x23e28	0x22e28	0x233
RegOpenKeyExW	0x0	0x140020018	0x23e30	0x22e30	0x25b
SetThreadToken	0x0	0x140020020	0x23e38	0x22e38	0x2bb
RegSetValueExW	0x0	0x140020028	0x23e40	0x22e40	0x278
RegEnumValueW	0x0	0x140020030	0x23e48	0x22e48	0x24c
RegQueryValueExW	0x0	0x140020038	0x23e50	0x22e50	0x268
RegNotifyChangeKeyValue	0x0	0x140020040	0x23e58	0x22e58	0x257
SetServiceStatus	0x0	0x140020048	0x23e60	0x22e60	0x2ba
StartServiceCtrlDispatcherW	0x0	0x140020050	0x23e68	0x22e68	0x2c2
DuplicateToken	0x0	0x140020058	0x23e70	0x22e70	0xda
GetUserNameA	0x0	0x140020060	0x23e78	0x22e78	0x15e
RegDeleteValueW	0x0	0x140020068	0x23e80	0x22e80	0x242
RegisterServiceCtrlHandlerW	0x0	0x140020070	0x23e88	0x22e88	0x282
CryptGetHashParam	0x0	0x140020078	0x23e90	0x22e90	0xc0
CryptDestroyHash	0x0	0x140020080	0x23e98	0x22e98	0xb2
CryptCreateHash	0x0	0x140020088	0x23ea0	0x22ea0	0xaf
CryptHashData	0x0	0x140020090	0x23ea8	0x22ea8	0xc4
ConvertStringSecurityDescriptorToSecurityDescriptorW	0x0	0x140020098	0x23eb0	0x22eb0	0x6e
LookupAccountNameW	0x0	0x1400200a0	0x23eb8	0x22eb8	0x189
FreeSid	0x0	0x1400200a8	0x23ec0	0x22ec0	0x11a
AllocateAndInitializeSid	0x0	0x1400200b0	0x23ec8	0x22ec8	0x1f
CheckTokenMembership	0x0	0x1400200b8	0x23ed0	0x22ed0	0x4d
OpenThreadToken	0x0	0x1400200c0	0x23ed8	0x22ed8	0x1f6
RegDeleteKeyW	0x0	0x1400200c8	0x23ee0	0x22ee0	0x23e
SetFileSecurityW	0x0	0x1400200d0	0x23ee8	0x22ee8	0x2a4
CryptAcquireContextW	0x0	0x1400200d8	0x23ef0	0x22ef0	0xad
CryptReleaseContext	0x0	0x1400200e0	0x23ef8	0x22ef8	0xc7

KERNEL32.dll (132)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CloseHandle	0x0	0x1400200f0	0x23f08	0x22f08	0x43
SetEvent	0x0	0x1400200f8	0x23f10	0x22f10	0x3d8
GetLastError	0x0	0x140020100	0x23f18	0x22f18	0x1e6
GetModuleFileNameW	0x0	0x140020108	0x23f20	0x22f20	0x1f5
lstrlenW	0x0	0x140020110	0x23f28	0x22f28	0x4be
GetDriveTypeW	0x0	0x140020118	0x23f30	0x22f30	0x1bc
GetLogicalDrives	0x0	0x140020120	0x23f38	0x22f38	0x1ed
lstrcmpW	0x0	0x140020128	0x23f40	0x22f40	0x4b2
DeleteCriticalSection	0x0	0x140020130	0x23f48	0x22f48	0xbf
LeaveCriticalSection	0x0	0x140020138	0x23f50	0x22f50	0x2e9
EnterCriticalSection	0x0	0x140020140	0x23f58	0x22f58	0xda
ExitProcess	0x0	0x140020148	0x23f60	0x22f60	0x105
Sleep	0x0	0x140020150	0x23f68	0x22f68	0x425
InitializeCriticalSection	0x0	0x140020158	0x23f70	0x22f70	0x2b4
GetCommandLineW	0x0	0x140020160	0x23f78	0x22f78	0x171
GetTickCount	0x0	0x140020168	0x23f80	0x22f80	0x266
ReleaseMutex	0x0	0x140020170	0x23f88	0x22f88	0x371
ResetEvent	0x0	0x140020178	0x23f90	0x22f90	0x384
WaitForMultipleObjectsEx	0x0	0x140020180	0x23f98	0x22f98	0x467
SetErrorMode	0x0	0x140020188	0x23fa0	0x22fa0	0x3d7
CreateEventW	0x0	0x140020190	0x23fa8	0x22fa8	0x76
CreateMutexW	0x0	0x140020198	0x23fb0	0x22fb0	0x8f
CreateProcessW	0x0	0x1400201a0	0x23fb8	0x22fb8	0x98
MoveFileExW	0x0	0x1400201a8	0x23fc0	0x22fc0	0x30d
GetSystemInfo	0x0	0x1400201b0	0x23fc8	0x22fc8	0x249
CreateFileA	0x0	0x1400201b8	0x23fd0	0x22fd0	0x79
ReadFile	0x0	0x1400201c0	0x23fd8	0x22fd8	0x362
SetFilePointer	0x0	0x1400201c8	0x23fe0	0x22fe0	0x3e4
DosDateTimeToFileTime	0x0	0x1400201d0	0x23fe8	0x22fe8	0xd1
MultiByteToWideChar	0x0	0x1400201d8	0x23ff0	0x22ff0	0x314
FreeLibrary	0x0	0x1400201e0	0x23ff8	0x22ff8	0x14d
GetProcAddress	0x0	0x1400201e8	0x24000	0x23000	0x220
LoadLibraryW	0x0	0x1400201f0	0x24008	0x23008	0x2ee
RaiseException	0x0	0x1400201f8	0x24010	0x23010	0x354
WideCharToMultiByte	0x0	0x140020200	0x24018	0x23018	0x47e
CreateFileW	0x0	0x140020208	0x24020	0x23020	0x80
WaitForSingleObject	0x0	0x140020210	0x24028	0x23028	0x468
CreateSemaphoreW	0x0	0x140020218	0x24030	0x23030	0x9d
ReleaseSemaphore	0x0	0x140020220	0x24038	0x23038	0x375
WaitForMultipleObjects	0x0	0x140020228	0x24040	0x23040	0x466
CreateThread	0x0	0x140020230	0x24048	0x23048	0xa3
VirtualAlloc	0x0	0x140020238	0x24050	0x23050	0x458
SetFilePointerEx	0x0	0x140020240	0x24058	0x23058	0x3e5
VirtualFree	0x0	0x140020248	0x24060	0x23060	0x45b
GlobalFree	0x0	0x140020250	0x24068	0x23068	0x28c
GlobalAlloc	0x0	0x140020258	0x24070	0x23070	0x285
GetSystemTimeAsFileTime	0x0	0x140020260	0x24078	0x23078	0x24f
ExpandEnvironmentStringsW	0x0	0x140020268	0x24080	0x23080	0x109
CompareStringW	0x0	0x140020270	0x24088	0x23088	0x55
SystemTimeToFileTime	0x0	0x140020278	0x24090	0x23090	0x42e
GetSystemTime	0x0	0x140020280	0x24098	0x23098	0x24d
SetFileTime	0x0	0x140020288	0x240a0	0x230a0	0x3e8
SetEndOfFile	0x0	0x140020290	0x240a8	0x230a8	0x3d2
WriteFile	0x0	0x140020298	0x240b0	0x230b0	0x491
LocalFree	0x0	0x1400202a0	0x240b8	0x230b8	0x2f7
SystemTimeToTzSpecificLocalTime	0x0	0x1400202a8	0x240c0	0x230c0	0x42f
GetTimeZoneInformation	0x0	0x1400202b0	0x240c8	0x230c8	0x26b
FindClose	0x0	0x1400202b8	0x240d0	0x230d0	0x11a
FindFirstFileW	0x0	0x1400202c0	0x240d8	0x230d8	0x125
GetFileSizeEx	0x0	0x1400202c8	0x240e0	0x230e0	0x1d6
GetFileAttributesW	0x0	0x1400202d0	0x240e8	0x230e8	0x1cf
GetTempPathW	0x0	0x1400202d8	0x240f0	0x230f0	0x25b
CreateDirectoryW	0x0	0x1400202e0	0x240f8	0x230f8	0x72
GetCurrentThread	0x0	0x1400202e8	0x24100	0x23100	0x1ad
GetFileTime	0x0	0x1400202f0	0x24108	0x23108	0x1d7
FindNextFileW	0x0	0x1400202f8	0x24110	0x23110	0x131
GetStdHandle	0x0	0x140020300	0x24118	0x23118	0x23b
GetFileAttributesExW	0x0	0x140020308	0x24120	0x23120	0x1cc
CopyFileW	0x0	0x140020310	0x24128	0x23128	0x66
CreateHardLinkW	0x0	0x140020318	0x24130	0x23130	0x84
SetFileAttributesW	0x0	0x140020320	0x24138	0x23138	0x3df
DeleteFileW	0x0	0x140020328	0x24140	0x23140	0xc4
GetTempPathA	0x0	0x140020330	0x24148	0x23148	0x25a
RemoveDirectoryW	0x0	0x140020338	0x24150	0x23150	0x37a
FormatMessageA	0x0	0x140020340	0x24158	0x23158	0x148
lstrlenA	0x0	0x140020348	0x24160	0x23160	0x4bd
GetComputerNameW	0x0	0x140020350	0x24168	0x23168	0x179
GetCommandLineA	0x0	0x140020358	0x24170	0x23170	0x170
GetStartupInfoA	0x0	0x140020360	0x24178	0x23178	0x239
SetUnhandledExceptionFilter	0x0	0x140020368	0x24180	0x23180	0x419
GetModuleHandleW	0x0	0x140020370	0x24188	0x23188	0x1f9
GetModuleFileNameA	0x0	0x140020378	0x24190	0x23190	0x1f4
RtlUnwindEx	0x0	0x140020380	0x24198	0x23198	0x396
FreeEnvironmentStringsA	0x0	0x140020388	0x241a0	0x231a0	0x14b
GetEnvironmentStrings	0x0	0x140020390	0x241a8	0x231a8	0x1c0
FreeEnvironmentStringsW	0x0	0x140020398	0x241b0	0x231b0	0x14c
GetEnvironmentStringsW	0x0	0x1400203a0	0x241b8	0x231b8	0x1c2
SetHandleCount	0x0	0x1400203a8	0x241c0	0x231c0	0x3ec
GetFileType	0x0	0x1400203b0	0x241c8	0x231c8	0x1d8
EncodePointer	0x0	0x1400203b8	0x241d0	0x231d0	0xd6
DecodePointer	0x0	0x1400203c0	0x241d8	0x231d8	0xb8
FlsGetValue	0x0	0x1400203c8	0x241e0	0x231e0	0x13f
FlsSetValue	0x0	0x1400203d0	0x241e8	0x231e8	0x140
FlsFree	0x0	0x1400203d8	0x241f0	0x231f0	0x13e
SetLastError	0x0	0x1400203e0	0x241f8	0x231f8	0x3f0
GetCurrentThreadId	0x0	0x1400203e8	0x24200	0x23200	0x1ae
FlsAlloc	0x0	0x1400203f0	0x24208	0x23208	0x13d
HeapSetInformation	0x0	0x1400203f8	0x24210	0x23210	0x2a5
HeapCreate	0x0	0x140020400	0x24218	0x23218	0x29f
QueryPerformanceCounter	0x0	0x140020408	0x24220	0x23220	0x34e
GetCurrentProcessId	0x0	0x140020410	0x24228	0x23228	0x1ab
TerminateProcess	0x0	0x140020418	0x24230	0x23230	0x431
GetCurrentProcess	0x0	0x140020420	0x24238	0x23238	0x1aa
UnhandledExceptionFilter	0x0	0x140020428	0x24240	0x23240	0x442
IsDebuggerPresent	0x0	0x140020430	0x24248	0x23248	0x2cb
RtlVirtualUnwind	0x0	0x140020438	0x24250	0x23250	0x397
RtlLookupFunctionEntry	0x0	0x140020440	0x24258	0x23258	0x390
RtlCaptureContext	0x0	0x140020448	0x24260	0x23260	0x389
HeapFree	0x0	0x140020450	0x24268	0x23268	0x2a1
HeapAlloc	0x0	0x140020458	0x24270	0x23270	0x29d
RtlPcToFileHeader	0x0	0x140020460	0x24278	0x23278	0x392
GetCPInfo	0x0	0x140020468	0x24280	0x23280	0x15c
GetACP	0x0	0x140020470	0x24288	0x23288	0x153
GetOEMCP	0x0	0x140020478	0x24290	0x23290	0x213
IsValidCodePage	0x0	0x140020480	0x24298	0x23298	0x2d5
LCMapStringW	0x0	0x140020488	0x242a0	0x232a0	0x2dd
LoadLibraryA	0x0	0x140020490	0x242a8	0x232a8	0x2eb
InitializeCriticalSectionAndSpinCount	0x0	0x140020498	0x242b0	0x232b0	0x2b5
GetLocaleInfoA	0x0	0x1400204a0	0x242b8	0x232b8	0x1e8
HeapSize	0x0	0x1400204a8	0x242c0	0x232c0	0x2a6
LCMapStringA	0x0	0x1400204b0	0x242c8	0x232c8	0x2db
GetStringTypeA	0x0	0x1400204b8	0x242d0	0x232d0	0x23d
GetStringTypeW	0x0	0x1400204c0	0x242d8	0x232d8	0x240
GetConsoleCP	0x0	0x1400204c8	0x242e0	0x232e0	0x184
GetConsoleMode	0x0	0x1400204d0	0x242e8	0x232e8	0x196
HeapReAlloc	0x0	0x1400204d8	0x242f0	0x232f0	0x2a4
SetStdHandle	0x0	0x1400204e0	0x242f8	0x232f8	0x400
WriteConsoleA	0x0	0x1400204e8	0x24300	0x23300	0x486
GetConsoleOutputCP	0x0	0x1400204f0	0x24308	0x23308	0x19a
WriteConsoleW	0x0	0x1400204f8	0x24310	0x23310	0x490
FlushFileBuffers	0x0	0x140020500	0x24318	0x23318	0x142
GetProcessHeap	0x0	0x140020508	0x24320	0x23320	0x223

RPCRT4.dll (6)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RpcServerRegisterIfEx	0x0	0x140020518	0x24330	0x23330	0x1bf
RpcServerUseProtseqEpW	0x0	0x140020520	0x24338	0x23338	0x1cd
RpcServerUnregisterIf	0x0	0x140020528	0x24340	0x23340	0x1c2
RpcRevertToSelf	0x0	0x140020530	0x24348	0x23348	0x1b0
RpcImpersonateClient	0x0	0x140020538	0x24350	0x23350	0x18f
NdrServerCall2	0x0	0x140020540	0x24358	0x23358	0x11b

VERSION.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetFileVersionInfoSizeW	0x0	0x140020550	0x24368	0x23368	0x4
GetFileVersionInfoW	0x0	0x140020558	0x24370	0x23370	0x5
VerQueryValueW	0x0	0x140020560	0x24378	0x23378	0xd

WINHTTP.dll (13)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WinHttpSetOption	0x0	0x140020570	0x24388	0x23388	0x1b
WinHttpGetProxyForUrl	0x0	0x140020578	0x24390	0x23390	0xf
WinHttpGetIEProxyConfigForCurrentUser	0x0	0x140020580	0x24398	0x23398	0xe
WinHttpReceiveResponse	0x0	0x140020588	0x243a0	0x233a0	0x17
WinHttpConnect	0x0	0x140020590	0x243a8	0x233a8	0x9
WinHttpCloseHandle	0x0	0x140020598	0x243b0	0x233b0	0x8
WinHttpOpen	0x0	0x1400205a0	0x243b8	0x233b8	0x10
WinHttpCreateUrl	0x0	0x1400205a8	0x243c0	0x233c0	0xb
WinHttpCrackUrl	0x0	0x1400205b0	0x243c8	0x233c8	0xa
WinHttpQueryHeaders	0x0	0x1400205b8	0x243d0	0x233d0	0x14
WinHttpReadData	0x0	0x1400205c0	0x243d8	0x233d8	0x16
WinHttpOpenRequest	0x0	0x1400205c8	0x243e0	0x233e0	0x11
WinHttpSendRequest	0x0	0x1400205d0	0x243e8	0x233e8	0x18

WINTRUST.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WinVerifyTrust	0x0	0x1400205e0	0x243f8	0x233f8	0x73

USERENV.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
LoadUserProfileA	0x0	0x1400205f0	0x24408	0x23408	0x1f
UnloadUserProfile	0x0	0x1400205f8	0x24410	0x23410	0x2b

Digital Signatures (2)

»

Certificate: Microsoft Corporation

»

Issued by	Microsoft Corporation
Parent Certificate	Microsoft Code Signing PCA
Country Name	US
Valid From	2009-12-07 22:40:29+00:00
Valid Until	2011-03-07 22:40:29+00:00
Algorithm	sha1_rsa
Serial Number	61 01 CF 3E 00 00 00 00 00 0F
Thumbprint	96 17 09 4A 1C FB 59 AE 7C 1F 7D FD B6 73 9E 4E 7C 40 50 8F

Certificate: Microsoft Code Signing PCA

»

Issued by	Microsoft Code Signing PCA
Country Name	US
Valid From	2007-08-22 22:31:02+00:00
Valid Until	2012-08-25 07:00:00+00:00
Algorithm	sha1_rsa
Serial Number	2E AB 11 DC 50 FF 5C 9D CB C0
Thumbprint	30 36 E3 B2 5B 88 A5 5B 86 FC 90 E6 E9 EA AD 50 81 44 51 66

C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	472eb39fa2a9d0d2cbd5115904e98595
SHA1	ecb6e81ec01ffa88566bfd2f62ce0246f9540a3d
SHA256	37cb71d5ce5be30e1fb829faa05cada91305558910880ee14f2b96b05731ab3c
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWBJqONK2:xzSsf9FjfiHZW5irkhtWfHWBJ1t

C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	4580b7ab1fb50f77078b84a9d41b8b48
SHA1	7bc479e073de3c3ada2d5c450d994e278d155717
SHA256	f1e19ba76677d45f102e44f637a30b9f6f7d1bbe81568a71b1e8a3a0cbb78d02
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWrkW7hqTokdk:xzSsf9FjfiHZW5irkhtWfHWrd7qk

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	f1102b7ca8fedfdfe08292613785de9b
SHA1	22d6a74ff013f6a5f7e6574f4b0460e6e6263d55
SHA256	805dd2405be593f131cbe163edf264ba77431d6018e8be52f3e3a3d640f9737c
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHW882:xzSsf9FjfiHZW5irkhtWfHWd2

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.42 KB
MD5	c2b8597cad9fe3a755fc78debe277222
SHA1	e0f4a1e09b7d7a9d911eb319889e80aa12a0241e
SHA256	795576d002cb4f83059ad748128398a331fc5bf6cc7680b4bd17c2fd1dc0fb20
SSDeep	24:Wrg3/t8vOgTxGp8X5SdCMYS/tsaevPemO5hB4ymHVbM3Rsihdorw4ERefmvOKyAZ:WraR/8pICDS/tpouhB4ymHVb6Kihd+NS

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	c801775ffe418f142a00aa57c44aa439
SHA1	38a46f7e47137eb83977a04360abb20633c08331
SHA256	9b2d6461af0b288fa6da4afdb222a6b28274d8a7f26e9951d1b006893032c6ee
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWt6KZDfK:xzSsf9FjfiHZW5irkhtWfHWtz4

C:\Windows\TEMP\EtcB3F9.tmp

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	0.09 KB
MD5	a6ba8e0370f83b101efaead1ffe56ba3
SHA1	52aa83c47c570d7df33575bfc06a161dd91cbb73
SHA256	b28fa7dfe5b277f9056c095bf93d5545b1c29c3766189fbce791520244f2e62e
SSDeep	3:cPGKhARtucmJhpozzlLq3QRtt7hX4an:oGKWbTwhp4oAbt6a

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	2d84d0849743927ade605ee99e0d25d5
SHA1	6d0613b84e87ff649902faf7346d1855ec84b9b7
SHA256	21fcefa16cf5b4dce9875cfe8b86fd01f1ab3f7b63b5a43f04f2540c1269516e
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWbYck3CXOX/u01:xzSsf9FjfiHZW5irkhtWfHWkyePH1

C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.57 KB
MD5	19da4f6711394d7a31e7523e285dae3d
SHA1	528540d264c61f044f00bcd4938c4aedca62882d
SHA256	dd930e15e8664189129ca9e0e1f068f90f42bfe525b89f2e9e6a6c1baf641852
SSDeep	24:pgI/enomofeU8CRwVWu1/lp/tnaaC1i2j+Ec/bATjmkgEVyhsdUClDA:pvEofeYRwH1aaCo2j+lufysUCBA

C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.11 KB
MD5	6a54d261943b87ad6835ae1e1f739531
SHA1	d6bf1b609959f45c3be33298f1b7e7b9e3a37872
SHA256	a9439ffcebed0056599662e22a8658379851cfd359039b2b5ff0f4b8c18a9013
SSDeep	48:JlLw7pE15AsR2JghphSdriqY8G7kNYm7sDRmzWUimHJUFcv+a+cNgr169QRA98Zi:fDwVgv8u98//AeWhmHJ2W/QAaX93Ax/

C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	091e307764f607d68a5a2085145ed507
SHA1	17e6515cfd9cc33d884a250a1a6a0597fa5f1885
SHA256	9337731be8d843a9670573ab2c807bcf7cc3efc6f16b1689f981244a38701e5d
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWcZgxoWxfBan:xzSsf9FjfiHZW5irkhtWfHWmgxoQIn

C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	51c72deccd8b09e4f35b9744ee6a29e7
SHA1	125a29c1167ca72f539be565bf60bce349f23cbf
SHA256	5d3300971fa2b80f8914c87b52940ae7c5e344865774ec75e5c04738ddb05666
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHW/gFa9MlI5zi5cR:xzSsf9FjfiHZW5irkhtWfHWV9Jzi5cJf

C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	b89daecf8dca8ed4c42d8391e49e1bda
SHA1	1a5feb934e644633552f78a3e723a0f228686bb2
SHA256	5be30e897367a39a32a61c0180f462ba77d0c1754aee5a7986c805daf752541b
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWQRaE0Siugb:xzSsf9FjfiHZW5irkhtWfHWYfixb

C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	92156c88bcae03d8c34c394fdccb33cf
SHA1	db0343b017729c6446bd823e9223aad0c7d903d1
SHA256	7abda68bd6e051bba82494e740993ed31d950351906066ddc9c86e68e006283a
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHW1EYPjV:xzSsf9FjfiHZW5irkhtWfHWmg

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	c3cc5c0e3374d1ef30d9c4bda19fecbb
SHA1	92831573138ad5f98317819183ff9f8972fdec15
SHA256	73155367ff4731783fd82c8f5b38847dc7a371880ad8c8f3afad175d4c31bb39
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWFedJOgPlIsCC:xzSsf9FjfiHZW5irkhtWfHWFYJOct

C:\Users\5P5NRG~1\AppData\Roaming\mov7tWJUGg

Created File

Unknown

Not Queried

»

Also Known As	C:\Users\5P5NRG~1\AppData\Local\Temp\y7148.tmp (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\\8DaT2hw8LGIxi (Created File) C:\Windows\TEMP\qFA91A.tmp (Created File) C:\Windows\TEMP\4A91B.tmp (Created File) C:\Windows\TEMP\jPEAEC7.tmp (Created File) C:\Windows\TEMP\XA9AED7.tmp (Created File) C:\Windows\TEMP\OolB290.tmp (Created File) C:\Windows\TEMP\wLaB291.tmp (Created File) C:\Windows\TEMP\EtcB3F9.tmp (Created File) C:\Windows\TEMP\cDB3FA.tmp (Created File) C:\Windows\TEMP\UAfB81F.tmp (Created File) C:\Windows\TEMP\vB820.tmp (Created File) C:\Windows\TEMP\zBA72.tmp (Created File) C:\Windows\TEMP\MPBA73.tmp (Created File) C:\Windows\TEMP\3cBD61.tmp (Created File) C:\Windows\TEMP\2RzBD72.tmp (Created File)
Mime Type	application/x-empty
File Size	0.00 KB
MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep	3::

C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	950b7762fa0d3d878e9a750eeeb17e24
SHA1	ce5a1c9fd8583133d5d71941be54868a2f7421dc
SHA256	81739bd734f526bc5525f985c5f097efea3ca283f9740a078339c7bd88c5fa6a
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWre6yTnCEDG2m:xzSsf9FjfiHZW5irkhtWfHWRyTzDG2m

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	860.50 KB
MD5	3ec5890d3db23be5d9c8069b2955d764
SHA1	1308663fd6098f569f9a8e5d63018d3243014d9c
SHA256	715ac256ba30b11d3912b12a0d50ae95536754937e794e35cc579b9b261fdbcb
SSDeep	12288:dpMI8NkETdOk/ua5iAA+Siqb+PNFTUa1SZ+qXmE3efSDjFlSra3E9p6wBry5dr06:d+I8dOk/ap+BPnoaMsqWyeGSKSJ5u

C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	912a95a29c7d550a70eaaaa5bf43a791
SHA1	2ae6093181f2e8062b7d614f8366ad9ff684a342
SHA256	77c5c5a09b622e9943ed804277f5eb295e348a7fedb4a06c42a8fbe915124397
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWHiKwGc:xzSsf9FjfiHZW5irkhtWfHWHpwGc

C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	d376dda45f3a898382a2b8342a9c267d
SHA1	3e18fe2f372dda36cc8761080e59657e1f69134d
SHA256	f08b1e1db708b976ff7bc5dd03d45ca35645644f97eb58500d55edd97e7f0d54
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWuleGc2Jq9H:xzSsf9FjfiHZW5irkhtWfHWrwm

C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	55476d53b32c3f7f8a35821993b5023c
SHA1	c5edd710068e8898f999d787f4940e3ce6fd0f0f
SHA256	e692a2436e16e1d2aca5e62a10c330ecd3495d09748913d32c5cc7f81a697226
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWfWU:xzSsf9FjfiHZW5irkhtWfHWuU

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	865.00 KB
MD5	52e00456bcc8dc9176ac1914fb5a3352
SHA1	f596e52c397a69251e78d8b81e3f1dea097f0c86
SHA256	d4db5022fc4ec15dac22f4ea6b2c1cd61e3abbf0fb2f7417fd49a7201a38e7e8
SSDeep	24576:/G40L0gYHI73f7o+l3lfIVEEIdyY3v796HFRwtdJs2Kq1:oLsI7PV/IVJY/h6GAM

C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	2dcb55d9893d71db4e9efb5baede4708
SHA1	aff9b3a7186184e7a44af524446c6d3695be54a6
SHA256	81076a9f5554fd91353aadcf3b1f22abc85eef3a6faba11a9ceda95e8a0e632b
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWipKXK:xzSsf9FjfiHZW5irkhtWfHWipz

C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	4898d711922ae960b3f8c96afae90372
SHA1	6f2584d4dff29b6b74fb4d8859a7c5bb4c8401b7
SHA256	b03ee945152d52e7f9e9fdad9f2c600bada2dbebdc9e99d19d1845a909a36860
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWTXXNtIF53y:xzSsf9FjfiHZW5irkhtWfHWTnNaq

C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.84 KB
MD5	05759498d75c6d07f255936315bb152f
SHA1	4d232c50d14335a8383568121bf34fb881dc545d
SHA256	839e2b6b6f39a0a46475fa64da194ccef5528d6ce6f2d448b1711bda6d4701b5
SSDeep	48:1YWvc5w6K7x7zxSTGYhFvk8+jO4HWN/gyOCbbTCQMMoylf0:S0Yy7xzdYhFfUfH2/gy9bbJ5M

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	78b03277f7ad304a877e9557be32410a
SHA1	c3405db741439ede4fd9a6625edb66c67046a294
SHA256	16b0a5183fbb6ccbc0650d137a1ca3f2df5cc472a35f8054c0f555c452754e4e
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWXtLCcV:xzSsf9FjfiHZW5irkhtWfHWXt1

C:\Windows\TEMP\zBA72.tmp

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	0.27 KB
MD5	48dc487b4efeae7397cf3de8ad52b857
SHA1	c02eaa43c144a37abc36f11bde2400c80ad26bb0
SHA256	5d12da043c8ef4de78510423075ad0f5761bdcb474a3acef5db643f1246616a4
SSDeep	6:oGKWbTwhpdBMW+hFa5urYs0D5FFW3vyQuvskEcNIov:oWfw7d5Pu0vD5FFW3vyQu0kdIy

C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	cf9d67009e57fb2f2626bfde003c2eba
SHA1	ec938bd835a5c20f81c33192ff5dae41738a911a
SHA256	a3e5584079eedca344767b8fcc22d5caca0d5695512ca3fe1911e8bcf84c1edc
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHW6qFuZPz6L:xzSsf9FjfiHZW5irkhtWfHWnQ+

C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	85c1a114f051bc18a0cb1a52eded3ab2
SHA1	29b86bc0d045c81d7382f0abb9a48012d8e48b6e
SHA256	8e36218dfece9204e8f5dde00cf2a43ca0d52a6fd06af6e2c80b6392d25ff7dc
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWt50kNHPf:xzSsf9FjfiHZW5irkhtWfHWtim3

C:\Windows\TEMP\wLaB291.tmp

Created File

Text

Not Queried

»

Mime Type	text/x-diff
File Size	0.06 KB
MD5	58f0b5925675e4be77420b9d29c24c04
SHA1	e728cd694a3fee1e04e0124e86da05d7db5c1c54
SHA256	1e81e0f55d5da3c062050676bb452f68b5c4cc944fddedebad1bfdb180e483b5
SSDeep	3:qiTmJh1k5RAkSZv:7wh+5mfR

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	855.00 KB
MD5	0d17a0b14e7b00a5a8d276be3b7dcf74
SHA1	d8b8dd9513f69c2f763c4f5d7b9541b24efc04e3
SHA256	88175d09b6bea7aad312f9771f61dfe3a39a2703f51c93a35f1ecb18745657d5
SSDeep	24576:2ZrQqLzLA+ZdFqZ6Tr46+iFxEH9wliBf8lm+Cj:YLzXFNTrmi8H9wRm+e

C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.76 KB
MD5	c546671f153d0dfd3ce460ea8b764bc3
SHA1	b025ed21e7c3ebca450d8a0aab5d96c4ce816c58
SHA256	739966c69c4537187c6497cb76c8fd66533592cac7fdf871ea356afc5201fafb
SSDeep	48:Uqmhfs4H6/pk4P9nhBpC2wkie6v2krjAAc/9uQAG:UVf16/pk69hRzAMPAG

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	c7340d1507912fbe38a571467b930ae1
SHA1	6c25775a2f77a1d327e04a6bf4f642529ebb52d3
SHA256	6a3e44a847a9a4b6e4de8b516d7855c55e304abf51c2f7c92a885503687521ff
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWIt6yDsGAIw:xzSsf9FjfiHZW5irkhtWfHWItRjAIw

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	5.75 KB
MD5	c4922dd79983f6d387599e50bd2ebb43
SHA1	1f6031fd2b5bd206d6209096606d688027bb7923
SHA256	5f241e51cf8c57532cf9574fccab987e26be9ca3428f6770be1eadb5c4038e2a
SSDeep	96:NXtr7PQ4u/DTvgDX0tNDHbUF3qptnWfdIkcouXLGx7RvkfqHvmRB4Z0Srcx6Uaas:7cXgwDDHwF7VDcS7SfqODLMcx7e

C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	7326b60c55da0f2a468771f116140de1
SHA1	2dff3d6d96035cfb1d639844bef17eac4bcf0f81
SHA256	6ac7a777659a3d45d6b367d361278552b1c9590476a98214db3ec2c2b7f024b2
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWOSCSk+Il3U:xzSsf9FjfiHZW5irkhtWfHWOyDIZU

C:\Windows\TEMP\MPBA73.tmp

Created File

Text

Not Queried

»

Mime Type	text/x-diff
File Size	0.10 KB
MD5	9a042997fea2f144df904de527694e58
SHA1	bebffe9adc332738333887230f1eec81ce8742ab
SHA256	f95584715df74f908b483323d278e9573e5b75adf0dd5d848859e849ebcdbcf7
SSDeep	3:cMLH6+W4RKGzUTTFk3QWWALV2RHIZJVFBX/:cMj6b4RvzI9WHLoRo3VFBX/

C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	948b26063d76225549503f5289f44df3
SHA1	df59bb7fe058d4970469ac4690b8b5b22c78e572
SHA256	8c765807b75196696d645ddc44b1ae7c229524b3b0a585179e730b8f6457fcfd
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWfp31v90U:xzSsf9FjfiHZW5irkhtWfHWBlvd

C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	87678435dab5385c6a51b222e119ed78
SHA1	4aea284d906afdc7ce8fe439836ab3f52410c570
SHA256	c84c0e7f44a46216d3be3b1c97607615b8a88334405b2c6ba46d799c91f91f6b
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWKjl7hmc2Qah:xzSsf9FjfiHZW5irkhtWfHW6lmc25

C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.79 MB
MD5	10e7d49c587ee5cdf369f1770309745d
SHA1	8a901b640b2fef2a31c2141a44faef600458d019
SHA256	a109d217115f875b072de2b00b2424e9cae56e2a64207a255259be2850a87035
SSDeep	49152:omoGF1t5TZQvafHnMC/EXjuxo8VruQn7h3OVce9OuOHgE9UnVuc:b9LZQifHG0v17WceDOApVB

C:\Users\5P5NRG~1\AppData\Roaming\\8DAT2H~1

Created File

Binary

Not Queried

»

Mime Type	application/x-dosexec
File Size	36.00 KB
MD5	55e37ceadd68e3acc571269af0f89be8
SHA1	549be64325b2609e67307de82ba6e74f455e95e9
SHA256	9375d56bdc5f2cadf3d047c0ebdc231d60a6a78db2ab4b11251b56b34f659b15
SSDeep	768:psz1SuCiLS3+hBTILkNuOh4UU1JJqT7/pXk:uSuhZOkNu8e1e
ImpHash	9d3c05ceed45ea893adcac15aeef45f7

PE Information

»

Image Base	0x100000000
Entry Point	0x100003edc
Size Of Code	0x4000
Size Of Initialized Data	0x5200
File Type	executable
Subsystem	windows_cui
Machine Type	amd64
Compile Timestamp	2009-07-13 23:49:38+00:00

Version Information (8)

»

LegalCopyright	© Microsoft Corporation. All rights reserved.
InternalName	SeCEdit
FileVersion	6.1.7600.16385 (win7_rtm.090713-1255)
CompanyName	Microsoft Corporation
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.7600.16385
FileDescription	Windows Security Configuration Editor Command Tool
OriginalFilename	SeCEdit

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x100001000	0x3fb6	0x4000	0x400	cnt_code, mem_execute, mem_read	6.0
.data	0x100005000	0x720	0x200	0x4400	cnt_initialized_data, mem_read, mem_write	0.5
.pdata	0x100006000	0x150	0x200	0x4600	cnt_initialized_data, mem_read	2.78
.rsrc	0x100007000	0x4448	0x4600	0x4800	cnt_initialized_data, mem_read	5.29
.reloc	0x10000c000	0x84	0x200	0x8e00	cnt_initialized_data, mem_discardable, mem_read	0.23

Imports (7)

»

ADVAPI32.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
FreeSid	0x0	0x100001000	0x4738	0x3b38	0x120
CheckTokenMembership	0x0	0x100001008	0x4740	0x3b40	0x51
AllocateAndInitializeSid	0x0	0x100001010	0x4748	0x3b48	0x20

KERNEL32.dll (29)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SetFilePointer	0x0	0x100001020	0x4758	0x3b58	0x474
FreeLibrary	0x0	0x100001028	0x4760	0x3b60	0x168
GetModuleHandleW	0x0	0x100001030	0x4768	0x3b68	0x21e
SetThreadUILanguage	0x0	0x100001038	0x4770	0x3b70	0x4aa
WriteFile	0x0	0x100001040	0x4778	0x3b78	0x534
FormatMessageW	0x0	0x100001048	0x4780	0x3b80	0x164
GetFileAttributesW	0x0	0x100001050	0x4788	0x3b88	0x1f1
WriteConsoleW	0x0	0x100001058	0x4790	0x3b90	0x533
CreateFileW	0x0	0x100001060	0x4798	0x3b98	0x8f
GetConsoleOutputCP	0x0	0x100001068	0x47a0	0x3ba0	0x1b6
GetStdHandle	0x0	0x100001070	0x47a8	0x3ba8	0x26b
GetLastError	0x0	0x100001078	0x47b0	0x3bb0	0x208
GetCurrentDirectoryW	0x0	0x100001080	0x47b8	0x3bb8	0x1c5
LocalAlloc	0x0	0x100001088	0x47c0	0x3bc0	0x346
GetFileType	0x0	0x100001090	0x47c8	0x3bc8	0x1fa
SetConsoleCtrlHandler	0x0	0x100001098	0x47d0	0x3bd0	0x43b
HeapSetInformation	0x0	0x1000010a0	0x47d8	0x3bd8	0x2db
CloseHandle	0x0	0x1000010a8	0x47e0	0x3be0	0x52
LocalFree	0x0	0x1000010b0	0x47e8	0x3be8	0x34a
GetCurrentProcess	0x0	0x1000010b8	0x47f0	0x3bf0	0x1c5
TerminateProcess	0x0	0x1000010c0	0x47f8	0x3bf8	0x4ca
GetSystemTimeAsFileTime	0x0	0x1000010c8	0x4800	0x3c00	0x27f
GetCurrentProcessId	0x0	0x1000010d0	0x4808	0x3c08	0x1c6
GetCurrentThreadId	0x0	0x1000010d8	0x4810	0x3c10	0x1ca
GetTickCount	0x0	0x1000010e0	0x4818	0x3c18	0x299
QueryPerformanceCounter	0x0	0x1000010e8	0x4820	0x3c20	0x3a6
SetUnhandledExceptionFilter	0x0	0x1000010f0	0x4828	0x3c28	0x4af
Sleep	0x0	0x1000010f8	0x4830	0x3c30	0x4bc
UnhandledExceptionFilter	0x0	0x100001100	0x4838	0x3c38	0x4de

msvcrt.dll (27)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
_commode	0x0	0x1000011b0	0x48e8	0x3ce8	0xc4
__setusermatherr	0x0	0x1000011b8	0x48f0	0x3cf0	0x82
iswctype	0x0	0x1000011c0	0x48f8	0x3cf8	0x460
_initterm	0x0	0x1000011c8	0x4900	0x3d00	0x16c
exit	0x0	0x1000011d0	0x4908	0x3d08	0x420
_cexit	0x0	0x1000011d8	0x4910	0x3d10	0xb3
fgetwc	0x0	0x1000011e0	0x4918	0x3d18	0x42b
_XcptFilter	0x0	0x1000011e8	0x4920	0x3d20	0x52
__C_specific_handler	0x0	0x1000011f0	0x4928	0x3d28	0x53
__wgetmainargs	0x0	0x1000011f8	0x4930	0x3d30	0x8f
wcscpy_s	0x0	0x100001200	0x4938	0x3d38	0x4f3
setlocale	0x0	0x100001208	0x4940	0x3d40	0x49f
wcscat_s	0x0	0x100001210	0x4948	0x3d48	0x4ee
_wcsicmp	0x0	0x100001218	0x4950	0x3d50	0x379
vfwprintf	0x0	0x100001220	0x4958	0x3d58	0x4e0
towlower	0x0	0x100001228	0x4960	0x3d60	0x4d9
vprintf	0x0	0x100001230	0x4968	0x3d68	0x4e2
?terminate@@YAXXZ	0x0	0x100001238	0x4970	0x3d70	0x30
__set_app_type	0x0	0x100001240	0x4978	0x3d78	0x80
_exit	0x0	0x100001248	0x4980	0x3d80	0xff
_fmode	0x0	0x100001250	0x4988	0x3d88	0x118
wcsrchr	0x0	0x100001258	0x4990	0x3d90	0x4fe
vswprintf_s	0x0	0x100001260	0x4998	0x3d98	0x4e8
__iob_func	0x0	0x100001268	0x49a0	0x3da0	0x73
sprintf_s	0x0	0x100001270	0x49a8	0x3da8	0x4a7
wcsncpy_s	0x0	0x100001278	0x49b0	0x3db0	0x4fb
_amsg_exit	0x0	0x100001280	0x49b8	0x3db8	0xa0

SCECLI.dll (13)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SceCloseProfile	0x0	0x100001110	0x4848	0x3c48	0xa
SceRegisterRegValues	0x0	0x100001118	0x4850	0x3c50	0x2d
SceAnalyzeSystem	0x0	0x100001120	0x4858	0x3c58	0x7
SceSetupGenerateTemplate	0x0	0x100001128	0x4860	0x3c60	0x32
SceWriteSecurityProfileInfo	0x0	0x100001130	0x4868	0x3c68	0x46
SceIsSystemDatabase	0x0	0x100001138	0x4870	0x3c70	0x26
SceGenerateRollback	0x0	0x100001140	0x4878	0x3c78	0x1b
SceFreeProfileMemory	0x0	0x100001148	0x4880	0x3c80	0x19
SceBrowseDatabaseTable	0x0	0x100001150	0x4888	0x3c88	0x9
SceFreeMemory	0x0	0x100001158	0x4890	0x3c90	0x18
SceGetSecurityProfileInfo	0x0	0x100001160	0x4898	0x3c98	0x23
SceOpenProfile	0x0	0x100001168	0x48a0	0x3ca0	0x2a
SceConfigureSystem	0x0	0x100001170	0x48a8	0x3ca8	0xf

ntdll.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RtlLookupFunctionEntry	0x0	0x100001290	0x49c8	0x3dc8	0x401
RtlVirtualUnwind	0x0	0x100001298	0x49d0	0x3dd0	0x4f0
RtlCaptureContext	0x0	0x1000012a0	0x49d8	0x3dd8	0x27b

USER32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
LoadStringW	0x0	0x1000011a0	0x48d8	0x3cd8	0x1fe

SHLWAPI.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
PathCanonicalizeW	0x0	0x100001180	0x48b8	0x3cb8	0x38
PathIsDirectoryW	0x0	0x100001188	0x48c0	0x3cc0	0x5b
PathIsRootW	0x0	0x100001190	0x48c8	0x3cc8	0x67

Icons (1)

»

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	848.50 KB
MD5	07f6669544e9a8fe3378774fc520fe36
SHA1	130d950a5bbf13c361a8211b7bb9c53750ab5703
SHA256	a626967b7bdaf5ee116cfcc3543eb39d5eb095522148494c65479f61afc98094
SSDeep	12288:vtYfKo9E2hRhPvqANrxU0QdLj0Vj+rP2K5Yg1oayv+OkAER9nuv1tW:kXE4VvqAxC0GLj2+rP2KPg+OjSnoW

C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	11155e8ebd22398a43f5b078354542d7
SHA1	8d5af28b186300216f2451521fcdf85d1d5c545b
SHA256	933c41d4e15dc4433eb21229ad6e7730a5ab7d1ef57a3bd2f201a72e34259d6e
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWjKsXyaujR:xzSsf9FjfiHZW5irkhtWfHWjPCj

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	db76dc77fec364f0118270b3c96b2f4e
SHA1	84faa3c7e669ded839cfe1d66cae83e2fdd08d7a
SHA256	ff59437c4ed48c82031e5e4dafafc8c3077581e6417b92ea2db43184b559e21b
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHW8CrYRfO:xzSsf9FjfiHZW5irkhtWfHWJUxO

C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	39bffc4243d1053dda98b61cbf073d3f
SHA1	791c1a4b87f27838b096733d331632e52095198d
SHA256	1cb0e4230c889c7fe2c5e18033505b463514dcd43547fbbec9ae9fa532a63fbe
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHW4BFKz:xzSsf9FjfiHZW5irkhtWfHWmF0

C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	b2d8828ed4c27d2fe991f46778f18ed2
SHA1	e67aa3bf9b4a4b062b8ca7598b222952a580dd43
SHA256	be766412e3220cb7a2c991e98eea5b709f97d6835441b7fcccbe355763683fe5
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWD4GGRnf:xzSsf9FjfiHZW5irkhtWfHWpGRf

C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	593032acf5ba961f63485005f0c896a5
SHA1	6a5e08b4839af010bd4dd1ddb9ecfa6e9d2f193a
SHA256	05dab9e57416f7c7219c9f385f17bc7646d53647e05ba1f1bf0f5b490a039758
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWTFuU4Q82V:xzSsf9FjfiHZW5irkhtWfHWZRsq

C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.73 MB
MD5	7cef9fad4d423d9b8beb3133aa6a850a
SHA1	1e60c3952865e6476e66a89f26b97bd8e565d9dd
SHA256	d2125c14bc4f11e78b3b4d69117da28e2b268f5335a441b0a85105648111424a
SSDeep	49152:CbcQNbSQoHH7SuIoJ9rdPvd5WzPWHnHf561QG8MLA4CjvoM:SPSQsbZJB9duWnf561Q7UejQM

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	6d4090c298e4db69c26b76e77a1544ff
SHA1	fb7813b0fe6a3ccfdc6690d03900d9aefd4831a1
SHA256	c53f387148e530ecfc0292f3b00069e7b1dd814facee81963220fbace3ea1950
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWFwKNQ0yry:xzSsf9FjfiHZW5irkhtWfHWFm06y

C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	3fef04f533d05b5179df5357ad340d10
SHA1	f17bdc2695ae92339fad4dc9dc8820d2bf25589a
SHA256	88f26732172f91918a0c9182c88fd3b905881b4e78f2ec147767f2cec1e61798
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWBb:xzSsf9FjfiHZW5irkhtWfHWBb

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.locked

Created File

Compressed

Not Queried

»

Mime Type	application/zlib
File Size	1.42 KB
MD5	46c15313918f49889a31734844cf3c2a
SHA1	b2db3910116c5d4528cd805c8cc9c2ffc3034771
SHA256	3cef9a483847345f849fa64d10793207717aaeffd71727df2efdb52a4aa3c8f8
SSDeep	24:0DHW3aCccmI+aBNO+3LVTWg9/HlJRX3hYtGKhDsXOlK7BRi/BczU/CqmaM:r3Gcmza3LV6g9/3rYtzgmEBs/B9CZ/

C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	e0771ba934f23ccd8dac721d1df5d388
SHA1	80ababa6ea87c00c8ea51ebcd36c14e7a686183c
SHA256	2ff4a59b3f796c42754f54ce47e79b4ddffb765f45b0d824124d457bf0d8af06
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWXpReqn4:xzSsf9FjfiHZW5irkhtWfHWO

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	daf253f3aa3345b11fd7d518302161b9
SHA1	bd8cd22d19780c5bbc2a025ce511607cd05964e1
SHA256	a4ab6be3e5e72e2a1bb1cba0efb78ea76660b783146cbfc3bca8f5d9e85a616b
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWdU2/:xzSsf9FjfiHZW5irkhtWfHWdUW

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	f4252225596b11d48c5f4b380fa7d6f6
SHA1	03e4ed6f888b8798a712e26c9d35bd3901bd8135
SHA256	840ced25d99b1ed7ead1a04917198db60e6527eb72bd67a1499f0d9d395c3a72
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWbQJTv1XnMOb:xzSsf9FjfiHZW5irkhtWfHWbQb7b

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.32 KB
MD5	fedf49ac8c97bf0315c47d687da04d61
SHA1	ff05a4315039def8a22781e75c40b8f39449a0b3
SHA256	06999c34022794beaa79cf5f4d139a4c2212ae0ce130c7e2d2ecd8faa6c08681
SSDeep	24:7BJA583D8nZITZV6xp8WzDW+Gnfo5iiivsDOO044drY/UkMAgeAXjkcOX:7rA2z8aTr4pdzi+J5igDmNlNJXofX

C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.39 MB
MD5	6cdcdc9ce14079c4dc6d86eb6ce721ae
SHA1	f86e1933e4d6a7b1a7defd710ee94ce237e23c19
SHA256	01a1e5193246dcfad5e70afa792e2bb04950d21ad2ec65446a9d0228ce5e5a40
SSDeep	49152:WMjkGbgwOFFEoq9361fOVQnd0Dtukoqj2KA65ViE2DAa35IX0AMKKfsNT:VjkGkFEoqJ6lOKndqs5K7H2DikA5

C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.35 KB
MD5	f95055a8a463eca57d7d35171e25693b
SHA1	0cdf35e3a2f7955033520b164e58223d61f3db4d
SHA256	88078d0aad8a521122dbd9d07154e0cfa87c7dbc566275175e4e21838704817c
SSDeep	24:8mOBs0qyzE7oGJ8RRDgZPRgJqyONbJrmMhHJXilcc7hc4I3sa0rYZ4gK:8fBKMauDgZP7yCVrJ5Rnc1c+aS+a

C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	8c7f87d00a9c54fe8c84ea19d0243d3b
SHA1	174858cfd7ef728557bbfbc6b93218ad5f43e92d
SHA256	b7f11f38a93d26c2d23bc5f417cf1825296b3068a92a97b10037026591e1f4be
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWcq/aMRvo:xzSsf9FjfiHZW5irkhtWfHW3aovo

C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.53 KB
MD5	bec808415f3c92ecf13d2cff39b5da8c
SHA1	e399d9a0d61ed5e7a6f9ff073a1b27d6ac288767
SHA256	07821a3b587c125dc107bacaddac3a4f8ec5ac21e786109efafcb49467316ef4
SSDeep	24:+1UJVLeIiRqt1eoGUqGbPJPLQlrpTm5xzx4UbYgyxaurBDeVCl3GXJCb:+1UHLeIiADGGRPCgdTkggl3rb

C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	ca1c48ede2fd890b1aaac1f5c66dd0ca
SHA1	1974d9771ee88e2b2f46e915cedfe457a22aee91
SHA256	8750563eaf1cfd73b33b51b1a74bb3346615c58d2461b8eb0b3ed8e79a98ea6e
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWbMA7NSR7w:xzSsf9FjfiHZW5irkhtWfHWbM6w0

C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.42 KB
MD5	666c2437dc1070458d4d674aac98cf36
SHA1	2c0c05211be9ce747e0e4ec51e6c429ebdc1ed4c
SHA256	7e88900118a510222e8955aa8eeb90afa27201b6661eb1f857a757c8bdeb7253
SSDeep	24:L1WDmt4K74+GoprFgFoM9RzaDg4WVNg6bG9Dsd3Z8z+iJeRY98T8DFWvmVuPG:xWDmrsoprFgF79ULWDZmOpm5cW68skmG

C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.42 KB
MD5	0432274d7d98e9f27e09f493b6140d8a
SHA1	3ac96d7c29ea7ae8275548b51bd804e03bef5418
SHA256	998c73ec1168d6d3e205c865340b3b4516e8a6d836f2ed0cf8e011365f8188b3
SSDeep	24:ApD1nKbWY8u19GkNYXGORPDIaMUM8WRTmNWzU03/jfYS0kc1HDcp/Le09D/rtEKC:IDBKiu3GkNgGMPwUhWRlzU03/jYSmdDj

C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	e388ead1fec35d0648e6ea6ef7900782
SHA1	f45195c775ca744fcf93cadb7be8a71f9d5059d7
SHA256	045cb93903d79e9a80a6d90efa1bc874a63aee9f8c7dbf4a7a00bfdddca8b637
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWBjMR6jeAfJi:xzSsf9FjfiHZW5irkhtWfHWBjMzAf0

C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	08cfc5ff9bb699ed829055f4f2008e20
SHA1	42b69f060f2b1672bfc17f55d7785c3fa63e9272
SHA256	5785008d7eb8938a09edcc0590d229fb6f6e3bb830b10d0817014f383f7d3517
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHW578Clx+UOA5Mh:xzSsf9FjfiHZW5irkhtWfHW57Vlt7yh

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	7593abf3496eb32b7a08dd8cd5f130fb
SHA1	2c7e40c3dff65656dd4698bed50590f857b048ac
SHA256	0b2455cdf43b84296f5789fc2fb21bd03bdde6a27c221e0447a84051c8747d43
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWU1tnS6:xzSsf9FjfiHZW5irkhtWfHWanR

C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	853.50 KB
MD5	01150f3c465486f6671846c803ba7039
SHA1	711afbcb77b1ce1820a8abe6634ebd4c129e4c25
SHA256	a94783c7da754bedb582187bd65d095e5349f76ea73641aa588f410536389bd4
SSDeep	24576:TMV0fMRnomzaFaEJckGWxMdS3MrCnRB96cwO/R:AVJnZzJm+vdIQCRXwO/R

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	c4f74befc41ba06740ace2c8a651053d
SHA1	605eae12b47d98c238ed47369ee820a634e8357e
SHA256	4e4a760fd7c457d3b92c680b9754c2fe22dd12195a90f7db1666ff8633f14171
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWzzbRyfXtLEs:xzSsf9FjfiHZW5irkhtWfHWffs

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	ab079fc59c2eca46c2b480c14ddf4168
SHA1	8aa2808a07a3bf06043fd23c9d76ebeaf5fae1e6
SHA256	a8db530c7c1cb404a53942d2b2ed5060fa31787bc66d82d96448e69a7495a09b
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHW1PJ1:xzSsf9FjfiHZW5irkhtWfHW1PJ1

C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	60facc227378e0aad97f435fb105a5e9
SHA1	ca06d518667e87b9b7aedff049215552bf49f891
SHA256	24538e5bdb4ccd9651e6f659feedc07833195b5de20af869ec18e77c845708d1
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWjKmDNVq2J:xzSsf9FjfiHZW5irkhtWfHWjpD+2J

C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.37 KB
MD5	a89d1360be99eb508f8ecbb0a3d4c880
SHA1	df285d42b3fba8a5f8f13b48eaef0e63323c1a45
SHA256	6545f4cc59de84f284f6f7a30045fe9c3fe32639ddb3220817ea8512f417fced
SSDeep	48:h9jbXG0XhO26HZ1lwNGv83F2DPlZy/q/PTk1:vHlR9GaFkP6Uw

C:\Windows\TEMP\XA9AED7.tmp

Created File

Text

Not Queried

»

Mime Type	text/x-diff
File Size	0.06 KB
MD5	44ab1155051f70b414b12b027f92fce8
SHA1	83cf1732eb1c826953880ef2f800409b00f20818
SHA256	ba00146ddfc63902906c6fe74901c94ae285a832ac095aeaa07857dedda55ea4
SSDeep	3:qiTmJhGqIA5RAkSZv:7whGzA5mfR

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	f6e5f39526c4661a5b7d1149d053c24b
SHA1	c24c189adea44222834476a605cf3dab59708623
SHA256	45dff93014f573f0921dcfe367a2150be2c1bf7b8877dc82c3d0407598ed87f6
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWivXFfFhcLyzn:xzSsf9FjfiHZW5irkhtWfHWiPfuG

C:\Users\5P5NRG~1\AppData\Roaming\MOV7TW~1

Created File

Binary

Not Queried

»

Mime Type	application/x-dosexec
File Size	96.00 KB
MD5	51e22f2a41fe8def3e54a509493c38cc
SHA1	47b2ddd61e5f403b5e3716c3b4dec0b0bca4d554
SHA256	c5cea8f1d4edefab1cea7486890586ce845dcfda81d1bbb2ad7f8b30e65fd710
SSDeep	1536:TwL8tBYwdJNhsaxn0jDJ7n0yRuMxadZFAntGCO6PxmBtn5IHehMw4hGw6G5FyC8Q:TwwtewnVS570M9kdatGCO+xmBc+hMPhs
ImpHash	fbc054a5b8ee8c449880bdf33f6f529d

PE Information

»

Image Base	0x100000000
Entry Point	0x100001658
Size Of Code	0x1200
Size Of Initialized Data	0x17000
File Type	executable
Subsystem	windows_gui
Machine Type	amd64
Compile Timestamp	2009-07-13 23:22:12+00:00

Version Information (8)

»

LegalCopyright	© Microsoft Corporation. All rights reserved.
InternalName	BdeRecoverWizard.exe
FileVersion	6.1.7600.16385 (win7_rtm.090713-1255)
CompanyName	Microsoft Corporation
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.7600.16385
FileDescription	BitLocker Unlock Wizard
OriginalFilename	BdeRecoverWizard.exe

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x100001000	0x1058	0x1200	0x400	cnt_code, mem_execute, mem_read	5.58
.data	0x100003000	0x6f8	0x200	0x1600	cnt_initialized_data, mem_read, mem_write	0.42
.pdata	0x100004000	0xa8	0x200	0x1800	cnt_initialized_data, mem_read	1.43
.rsrc	0x100005000	0x162f0	0x16400	0x1a00	cnt_initialized_data, mem_read	7.12
.reloc	0x10001c000	0x60	0x200	0x17e00	cnt_initialized_data, mem_discardable, mem_read	0.22

Imports (5)

»

KERNEL32.dll (16)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetLastError	0x0	0x100001010	0x1c58	0x1058	0x208
HeapSetInformation	0x0	0x100001018	0x1c60	0x1060	0x2db
GetCurrentProcess	0x0	0x100001020	0x1c68	0x1068	0x1c6
TerminateProcess	0x0	0x100001028	0x1c70	0x1070	0x4ce
GetSystemTimeAsFileTime	0x0	0x100001030	0x1c78	0x1078	0x280
GetProcessHeap	0x0	0x100001038	0x1c80	0x1080	0x251
GetCurrentThreadId	0x0	0x100001040	0x1c88	0x1088	0x1cb
GetTickCount	0x0	0x100001048	0x1c90	0x1090	0x29a
QueryPerformanceCounter	0x0	0x100001050	0x1c98	0x1098	0x3a9
GetModuleHandleW	0x0	0x100001058	0x1ca0	0x10a0	0x21e
SetUnhandledExceptionFilter	0x0	0x100001060	0x1ca8	0x10a8	0x4b3
GetStartupInfoW	0x0	0x100001068	0x1cb0	0x10b0	0x26a
Sleep	0x0	0x100001070	0x1cb8	0x10b8	0x4c0
GetCurrentProcessId	0x0	0x100001078	0x1cc0	0x10c0	0x1c7
GetCommandLineW	0x0	0x100001080	0x1cc8	0x10c8	0x18d
UnhandledExceptionFilter	0x0	0x100001088	0x1cd0	0x10d0	0x4e2

msvcrt.dll (15)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
__set_app_type	0x0	0x1000010a8	0x1cf0	0x10f0	0x80
__getmainargs	0x0	0x1000010b0	0x1cf8	0x10f8	0x71
__C_specific_handler	0x0	0x1000010b8	0x1d00	0x1100	0x53
_XcptFilter	0x0	0x1000010c0	0x1d08	0x1108	0x52
_exit	0x0	0x1000010c8	0x1d10	0x1110	0xff
?terminate@@YAXXZ	0x0	0x1000010d0	0x1d18	0x1118	0x30
_fmode	0x0	0x1000010d8	0x1d20	0x1120	0x118
_commode	0x0	0x1000010e0	0x1d28	0x1128	0xc4
__setusermatherr	0x0	0x1000010e8	0x1d30	0x1130	0x82
_amsg_exit	0x0	0x1000010f0	0x1d38	0x1138	0xa0
_initterm	0x0	0x1000010f8	0x1d40	0x1140	0x16c
_acmdln	0x0	0x100001100	0x1d48	0x1148	0x94
exit	0x0	0x100001108	0x1d50	0x1150	0x420
_cexit	0x0	0x100001110	0x1d58	0x1158	0xb3
_ismbblead	0x0	0x100001118	0x1d60	0x1160	0x188

ntdll.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RtlLookupFunctionEntry	0x0	0x100001128	0x1d70	0x1170	0x401
RtlVirtualUnwind	0x0	0x100001130	0x1d78	0x1178	0x4f0
RtlCaptureContext	0x0	0x100001138	0x1d80	0x1180	0x27b

SHELL32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CommandLineToArgvW	0x0	0x100001098	0x1ce0	0x10e0	0x6

FVERECOVER.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
FveRecoverWizard	0x0	0x100001000	0x1c48	0x1048	0x1f

Icons (1)

»

C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.40 MB
MD5	f392e3fb79467facb1b557467f47dbb1
SHA1	1a7df1eadb221a478b69352c4880b64598dbae4c
SHA256	53ac4f22344b4dc44e91f1c49a579d5334c3a93407a21fc3f6e62c36a7c4a30e
SSDeep	49152:V4b9l7I8XNBlc7PT43ggr5NobEV2b4mv7pLXPk3BWMCNFRmU8:V4bHkkNBlEk3gg1NobEEcubekPBs

C:\Windows\TEMP\jPEAEC7.tmp

Created File

Text

Not Queried

»

Also Known As	C:\Windows\TEMP\OolB290.tmp (Created File) C:\Windows\TEMP\UAfB81F.tmp (Created File)
Mime Type	text/plain
File Size	0.04 KB
MD5	605866a66fd890d4efa389a56fb183a4
SHA1	a367e27150a9a1902d7bbd65e63f683fe45f8f61
SHA256	96dfbfffa039f5f9bce909a750cc90d5b1d1b4ccc4a515b2687a10c89f234047
SSDeep	3:cPGKhARtucmJhpov:oGKWbTwhpy

C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	a0ae07f723082a9069bc7690ea9fe53d
SHA1	31b5a5013e8ff302bd03ab1f934a683fe8f38da4
SHA256	e69dffd33245e095b9080da48a057e2f7bef464d728138b75abdc636dc32a766
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWNnDt5GCU:xzSsf9FjfiHZW5irkhtWfHWBDnlU

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.79 KB
MD5	749598b8b517c455397a8cb1261a1b8b
SHA1	67f3592614d89c24b6762dd0b23b7f315a76bc5c
SHA256	a24a1fbfd040e69505b0beae148ebaf05857c71e7d495c12c5bfa8d54ac51ed8
SSDeep	24:sahh4gfqf+XSDLsyu6FRYPrbX7u0hhqd5X3ujf/Oj3:s4hsMSMyu6Afzhhqd5X+jf/Oj3

C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	b2292dee4e86e5ab76ced66c797ab966
SHA1	843ff08cc71f18817f101589e5cd22e11786ed53
SHA256	d1219226d5c3fafbcd0ddb2abe5b5da8b1e754a36fa725e93570df240224b9f0
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWSTe0XJd7OrECjF:xzSsf9FjfiHZW5irkhtWfHWZ0jO/jF

C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	429.84 KB
MD5	e88b2ac70c39f7310a51eda64c3b7717
SHA1	fd20382a9ccba60f7703683c808622f97c0ade35
SHA256	bf920cff198d175ee05a2325bd6f928d1ac1378f9522cc092308fecb2c6f9f90
SSDeep	12288:xhOFWdMQjpcf0mLbWFyhroTunDyGwJcn+CFidO2Z:x0WdMAS0MWFy1ykLw+nZidO2Z

C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	d66164da0d07c476446901db80419868
SHA1	161797d8b41e6467052d3a2a8665d7362039733b
SHA256	883757aa79b263566c4c812a7bd3052d404013c089e5c624bd9333fe607a3d33
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHW4N8O:xzSsf9FjfiHZW5irkhtWfHW4Nt

C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.24 KB
MD5	05f4b8dee712bcb57d4c131fe4c792ec
SHA1	78a4e8dcf5e4d9e5dfbb4b83755317ab2da7610c
SHA256	443ecdc5e39a31d14d29937bb1b1ead99ce1786664fb4260b56ef17d8dc4d4e9
SSDeep	48:F+n7ABxmV+gScLLJuYLI9fGmFYps1EdgaazHZelBjS4Y04NWNmt:FQ7OmV+gS0Ju+I9uKYhdXazklB24Z4NP

C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	9114ef408e4cf76c572c2cc6cdfff819
SHA1	9adc0c9705a4ba7f16abca57507d21106ded67db
SHA256	837a1ac12fe49899e1f4903200619acb067389701407b64921652fa62784778a
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWtLtpA:xzSsf9FjfiHZW5irkhtWfHWtLtq

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	db92369748ca16f02a446fbf5a84e583
SHA1	9a2a6e7eff854763097871f85fea96e9f2627a2a
SHA256	6bf7e2d0f41108d10da1ba992e923591e1d23ae303e3fc225c734c74349e0894
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWXePioWxY9d:xzSsf9FjfiHZW5irkhtWfHWXxxY9d

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.00 MB
MD5	fea1c770b86198154f5efb7a2c267880
SHA1	75b607d122a07a46f272b21b6f7dba3476e19212
SHA256	610c070fd50965f395e3d18d72b6286364222fb0ebca09b1cdc95b91722e7355
SSDeep	196608:+jqOJh4z/CyaHYj5Ilr2j8T+aqpkvjoNB3IHS5xKp6UerqRPQVd:+jqOMz/Cujf4jmw76haPQVd

C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	cae69c980810d6e0e426bce3e314528c
SHA1	520dea866d6b6890335befa388693c3d38da476b
SHA256	476a19f18dfbd995ec9cbfa1303f38a5b2b4f09316f08c4d021cc9a4b7551e5b
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWdh72R:xzSsf9FjfiHZW5irkhtWfHWn7y

C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	d58808e6f32bedeaf2c27a687179cfa7
SHA1	f4c047f976c646f8417e8df37183dbb142a20b87
SHA256	d4e3a6dc637a9bb2028a73772ff12f550fd6817f07a7649e69ac92f19a57fddb
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWahjB82O:xzSsf9FjfiHZW5irkhtWfHWaRB82O

C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.31 KB
MD5	d514a199b82200fd3d745c6630204ab4
SHA1	8edaa5c91d7ada9f16978c5b404df3197b10c965
SHA256	a63eb7a7fa15a50ee1431f22be91f2cdedff3bd0a2f03bbbee6cd8cf4647246a
SSDeep	48:8hC3gPDG7z4KNxLNDasEjy+OB6JnjobdaACLk:8w3gPE4KqX1oRaA0k

C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	2dc66cdb1ebfbb4a5456148dc9e9378d
SHA1	ba1838ac07324137f839682a852edfc33c3c70aa
SHA256	0c6e7badc73445ae9c95ee7b9d4a293de6d8e3f2298b4c4083d87e808c3d7e93
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWzGhDRbNUPOy:xzSsf9FjfiHZW5irkhtWfHWzYeH

C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	cd2e88c5ce99b1f8727fc29dcaae97c9
SHA1	45f12d57d8bfac71d14d40205ef923232f00552e
SHA256	ff6a2841f9146c6ac78bdcec4cce3b03bedc3f81a1c2c1b4b10acbe56026086b
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWxx:xzSsf9FjfiHZW5irkhtWfHW7

C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	83ab0cffc31cef147cd60ca4bee812af
SHA1	a6f9be6b03521053b23ad7ca63f00fef2ddc7616
SHA256	087a980c5aa21f31b2ca9182460e788e349b236eee09567091d5ccb0b26868ae
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWflJr:xzSsf9FjfiHZW5irkhtWfHWdJr

C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	b02503eadc368f7f64cf45785ddac56a
SHA1	b7b0993c43b489f1f75060f7594aca1488dc4f97
SHA256	005648fb6a6f8bfdf99377ce892594a55166c06e5c88d42b5f72027fac41a20a
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWITgrS2WwX90lws:xzSsf9FjfiHZW5irkhtWfHWIMS2WwXkZ

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	4eeb4cb8d5ec4fdda7cfb5eee6599f11
SHA1	02dc0d96e13f4909d0b9e33f8dd5324a4fa84605
SHA256	60c2ef1d9b25cd0ef82df9b95f0e1ff36775ef0585ba30f22f7a1712cb45ace1
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWQ0mQG8+t15V:xzSsf9FjfiHZW5irkhtWfHWQtQxK

C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.39 MB
MD5	1ec7810fb0cc64a7f64a611badeb21b8
SHA1	a369b105b67f541961f07618327070e0c24ccbd3
SHA256	5e4aa92b67c4bfbd907d67e0e6f25711446d7d61970da726ced948efb530061f
SSDeep	49152:5QisaWBM6+5q6W7oO3x4JM8uAXsyLO2aE5n6FFNlTBBHmzj:mBM6+5pWN3x426jLO2aC6F7lfHm3

C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.00 MB
MD5	ecec573f8c35bb2713241707dd07fd3e
SHA1	d16ae4f07eeb23a1ff29865f15389f3b7ee9c69e
SHA256	926d27d16cb11cc47270786b4287d098b2a9ff1a2357aa9f3900c9c7198e1108
SSDeep	196608:LztpxzBBNo0iVCosqe78OT5GPmHe0qK7YLVTQ2eqvGhiKoUeQcmYdYbGvA1r:LhRrDPdVamHbqkYZTxeOGSUeQcmYdYbB

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.00 MB
MD5	d4f3ba9417919b86c0987233dde813ce
SHA1	989d71581b51b443d4ab30197e18ace8a8e3eda1
SHA256	35d74bd6f52ebf57a2eb04bf9c219d911548502c627069f3a45684460dabdb70
SSDeep	196608:x3o+K/59mNYZWWWXk/yE1DKbKer3aCwEjFGAoDk9S5uic6H2W8WDXth1+EHocqk:Vs59mgKDj8wDQ5zc6HRtbV

C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	62c54e2788c878f8b94cfabae9ec9622
SHA1	cfb9cd55c09e05f27af5b1f6d14ca98a4746b727
SHA256	9c7405ed6025e312a3ef5e997293fe463d51ef3a154a2ab7e8960c62de3c0c49
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHW2NmedoCXc/L:xzSsf9FjfiHZW5irkhtWfHW2/tXC

C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.00 MB
MD5	a00f3364501c0a977805824aea78110e
SHA1	c29bb23797352da766c378bd86def3e6d9be7472
SHA256	a667d44f8fb05bf2b93f98aeaa760a47b92471a5cba36f2104c126660361ecec
SSDeep	196608:w7/PoQlzZIk5Z+As4C19LsxkFJayyCAFb1YeS9uI11wCHlM:MoQxZIkD5C9LqAJaXdFB5CL1wCHa

C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	d3b3d412539641bcd38e755ab5aad114
SHA1	3a8ca4573a0c8d4f83e56e79d8587cfd2af7f75e
SHA256	76201f74460b83b5d90d1d16a981600649515985be57bc55607d4f82cbe2cc84
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWwhKFEIn:xzSsf9FjfiHZW5irkhtWfHW0Kpn

C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	ca77a58004e901989d4e1444a2954836
SHA1	0221ec87934bea45914e42b5b14e4676fddaacab
SHA256	127f0fbac92ea917e06d5a68f3840ef376548d2330862eee70f5a2fa716ded16
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHW0XPQ9E:xzSsf9FjfiHZW5irkhtWfHW0/Qu

C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	9.50 MB
MD5	3eb0d85bb6a8a786c982ae08a27de804
SHA1	91a2a1c010a21c34acc0fc3286280b76444a1580
SHA256	36f0e17fd5bbd868206ecfe494f6998e23c03a3e50fe79a43f4e2de1f426bf85
SSDeep	196608:gSv2/ELkYQ7TTMCBu/oRJHD6aVJ/kz+NN3AOmMYKJZqQ62iAgAOOX9DFAohmD:gBHYQ7TYCwcJGikrIqi5j9D7hmD

C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	a8d5cdbb0752888a8ab416051fbc4cc9
SHA1	db08c89ae60d5f6ed661a0b6d1bba47f4b2d9c24
SHA256	6886b3ff264c24f47ee5a63adafeca3038ee7fa8a01d7b39826426d3d1e7afeb
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWzJMMtfh9:xzSsf9FjfiHZW5irkhtWfHWzLfh9

C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	b98aa5e6f8c08da23e983db8502448c5
SHA1	33b80d3395e5b5de687d05c8e926b17336445260
SHA256	42e46b72383870aa63220a73dbd83ffac25d07ad4ada45a07e98d2af11cf4224
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWt7qi0GVYoWG+6V:xzSsf9FjfiHZW5irkhtWfHWt7Ov6V

C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.11 KB
MD5	b04427ad20d14f8c82954501f185eedb
SHA1	7e01c1573375c4783ba5be7dbcc3556da365091b
SHA256	97db188cbae642df6219be6a1dec602a85244f17fcb58056d1e75001a997a930
SSDeep	96:0X3d6TqI2pNaUgUcskEBqP/uAvqFC4++Ah:8t6Tq+XNEBGPbn

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	5aa7173661a2320842f5d203313c562f
SHA1	a9faa003c6b2e4cb0fff823c971a764a74c18353
SHA256	0d23a7d673385b217e9c6f58c4d338ec48e7d79c57571c1736b0371bdc3b4636
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWkpDC:xzSsf9FjfiHZW5irkhtWfHWkBC

C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.00 MB
MD5	cd295b175a439bf08233d75f5d57a46d
SHA1	26289535c6ec2f31524f7dea92bf3cfd043ad84d
SHA256	6b89247e97c0e4a837af073f157263914bc8cfcd144139a4d2286f9659f27d00
SSDeep	196608:MvC9UQQctcGU2Fe72/FgltiTZcLoyv9uMnFfkpvMYKH5NOkW:MvkUOtw2sltiTkJv9uMFfkpv28

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.locked

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.00 MB
MD5	7b8c00c932c5e0ec3b79af04e73b175f
SHA1	e719c5422da9ffc1efae345127d2f488cfaca87d
SHA256	61a2e50acda32ff3e8cbf44663b3f268d33aa25ded6ac17718196a13b4d41320
SSDeep	196608:Dt1eYop4m7hxo2tYcO/b5KmxuocWvMVj/VNXB85cQVMSvlWQXi:5TeKiYDb5KrocWvMVRgXOfQXi

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest.readme_txt

Created File

Text

Not Queried

»

Mime Type	text/plain
File Size	1.11 KB
MD5	323f87120be74449432c5917b01241b7
SHA1	b288bcfe99ef6384a394063bfec742d60ebb2d08
SHA256	6ebf9496d521af481498b495986d4e7bd19e9b760ddfdc403829aeb634620174
SSDeep	24:iVezHysf9F2Ob/8pqvKHHBA1+y39FXIvjBJk1YspzLiQtC7fHWpmz3nOC:xzSsf9FjfiHZW5irkhtWfHW03OC

Notifications (2/2)

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After