e66e7468...9b5b

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pnogzd.exe

Sample File

Binary

Malicious

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pnogzd.exe (Dropped File) C:\Windows\System32\pnogzd.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\pnogzd.exe (Dropped File) C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\pnogzd.exe (Dropped File)
Mime Type	application/vnd.microsoft.portable-executable
File Size	237.00 KB
MD5	39c8a6a3351915b5bcc8c4ca67783bf1
SHA1	f7c89abe31acf0acdf107657486c9b297461637a
SHA256	e66e7468f8206abe35e6be8b046f687c101e08fc93c51383ff075a46c4eb9b5b
SSDeep	3072:Qyue49e9V7LuDHUOuduU4p46Lsr5ZUSUoxC1viZZLw5fta6a5KcU9KBjJf:Qyz4ojLuD0O9U4p4r3UZok2LoxQ
ImpHash	b17ef80b0b00fc2be36f751b59c8b8d4
Parser Error Remark	Static analyzer was unable to completely parse the analyzed file

File Reputation Information

»

Severity	Suspicious
First Seen	2019-05-15 11:17 (UTC+2)
Last Seen	2019-05-15 11:28 (UTC+2)
Names	Win32.Trojan.Kryptik
Families	Kryptik
Classification	Trojan

PE Information

»

Image Base	0x400000
Entry Point	0x404d5d
Size Of Code	0x29800
Size Of Initialized Data	0xa2000
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2018-11-14 18:00:53+00:00

Version Information (4)

»

FileVersion	1.0.0.11
InternalName	pyutoi6u.uxe
LegalCopyright	Copyright (C) 2019, rfgdgf
ProductVersion	1.0.0.13

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x29775	0x29800	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.93
.rdata	0x42b000	0x45f8	0x4600	0x29c00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.19
.data	0x430000	0x94a60	0x3600	0x2e200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	1.42
.rsrc	0x4c5000	0x7750	0x7800	0x31800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.15
.reloc	0x4cd000	0x2252	0x2400	0x39000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	4.14

Imports (2)

»

KERNEL32.dll (81)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCPInfo	0x0	0x42b000	0x2ee64	0x2da64	0x15b
WriteConsoleOutputW	0x0	0x42b004	0x2ee68	0x2da68	0x48b
GetModuleHandleW	0x0	0x42b008	0x2ee6c	0x2da6c	0x1f9
GetPrivateProfileStringW	0x0	0x42b00c	0x2ee70	0x2da70	0x21d
GlobalAlloc	0x0	0x42b010	0x2ee74	0x2da74	0x285
GetStringTypeExW	0x0	0x42b014	0x2ee78	0x2da78	0x23f
GetComputerNameExA	0x0	0x42b018	0x2ee7c	0x2da7c	0x176
GetProcAddress	0x0	0x42b01c	0x2ee80	0x2da80	0x220
RemoveDirectoryA	0x0	0x42b020	0x2ee84	0x2da84	0x37d
GetModuleHandleA	0x0	0x42b024	0x2ee88	0x2da88	0x1f6
CreateThread	0x0	0x42b028	0x2ee8c	0x2da8c	0xa3
CreateFileA	0x0	0x42b02c	0x2ee90	0x2da90	0x78
SetFilePointer	0x0	0x42b030	0x2ee94	0x2da94	0x3df
WriteConsoleW	0x0	0x42b034	0x2ee98	0x2da98	0x48c
InterlockedIncrement	0x0	0x42b038	0x2ee9c	0x2da9c	0x2c0
InterlockedDecrement	0x0	0x42b03c	0x2eea0	0x2daa0	0x2bc
Sleep	0x0	0x42b040	0x2eea4	0x2daa4	0x421
InitializeCriticalSection	0x0	0x42b044	0x2eea8	0x2daa8	0x2b4
DeleteCriticalSection	0x0	0x42b048	0x2eeac	0x2daac	0xbe
EnterCriticalSection	0x0	0x42b04c	0x2eeb0	0x2dab0	0xd9
LeaveCriticalSection	0x0	0x42b050	0x2eeb4	0x2dab4	0x2ef
GetLastError	0x0	0x42b054	0x2eeb8	0x2dab8	0x1e6
HeapFree	0x0	0x42b058	0x2eebc	0x2dabc	0x2a1
TerminateProcess	0x0	0x42b05c	0x2eec0	0x2dac0	0x42d
GetCurrentProcess	0x0	0x42b060	0x2eec4	0x2dac4	0x1a9
UnhandledExceptionFilter	0x0	0x42b064	0x2eec8	0x2dac8	0x43e
SetUnhandledExceptionFilter	0x0	0x42b068	0x2eecc	0x2dacc	0x415
IsDebuggerPresent	0x0	0x42b06c	0x2eed0	0x2dad0	0x2d1
HeapReAlloc	0x0	0x42b070	0x2eed4	0x2dad4	0x2a4
HeapAlloc	0x0	0x42b074	0x2eed8	0x2dad8	0x29d
GetStartupInfoW	0x0	0x42b078	0x2eedc	0x2dadc	0x23a
RtlUnwind	0x0	0x42b07c	0x2eee0	0x2dae0	0x392
RaiseException	0x0	0x42b080	0x2eee4	0x2dae4	0x35a
LCMapStringA	0x0	0x42b084	0x2eee8	0x2dae8	0x2e1
WideCharToMultiByte	0x0	0x42b088	0x2eeec	0x2daec	0x47a
MultiByteToWideChar	0x0	0x42b08c	0x2eef0	0x2daf0	0x31a
LCMapStringW	0x0	0x42b090	0x2eef4	0x2daf4	0x2e3
HeapCreate	0x0	0x42b094	0x2eef8	0x2daf8	0x29f
VirtualFree	0x0	0x42b098	0x2eefc	0x2dafc	0x457
VirtualAlloc	0x0	0x42b09c	0x2ef00	0x2db00	0x454
TlsGetValue	0x0	0x42b0a0	0x2ef04	0x2db04	0x434
TlsAlloc	0x0	0x42b0a4	0x2ef08	0x2db08	0x432
TlsSetValue	0x0	0x42b0a8	0x2ef0c	0x2db0c	0x435
TlsFree	0x0	0x42b0ac	0x2ef10	0x2db10	0x433
SetLastError	0x0	0x42b0b0	0x2ef14	0x2db14	0x3ec
GetCurrentThreadId	0x0	0x42b0b4	0x2ef18	0x2db18	0x1ad
HeapSize	0x0	0x42b0b8	0x2ef1c	0x2db1c	0x2a6
ExitProcess	0x0	0x42b0bc	0x2ef20	0x2db20	0x104
CloseHandle	0x0	0x42b0c0	0x2ef24	0x2db24	0x43
WriteFile	0x0	0x42b0c4	0x2ef28	0x2db28	0x48d
GetStdHandle	0x0	0x42b0c8	0x2ef2c	0x2db2c	0x23b
GetModuleFileNameA	0x0	0x42b0cc	0x2ef30	0x2db30	0x1f4
GetModuleFileNameW	0x0	0x42b0d0	0x2ef34	0x2db34	0x1f5
FreeEnvironmentStringsW	0x0	0x42b0d4	0x2ef38	0x2db38	0x14b
GetEnvironmentStringsW	0x0	0x42b0d8	0x2ef3c	0x2db3c	0x1c1
GetCommandLineW	0x0	0x42b0dc	0x2ef40	0x2db40	0x170
SetHandleCount	0x0	0x42b0e0	0x2ef44	0x2db44	0x3e8
GetFileType	0x0	0x42b0e4	0x2ef48	0x2db48	0x1d7
GetStartupInfoA	0x0	0x42b0e8	0x2ef4c	0x2db4c	0x239
QueryPerformanceCounter	0x0	0x42b0ec	0x2ef50	0x2db50	0x354
GetTickCount	0x0	0x42b0f0	0x2ef54	0x2db54	0x266
GetCurrentProcessId	0x0	0x42b0f4	0x2ef58	0x2db58	0x1aa
GetSystemTimeAsFileTime	0x0	0x42b0f8	0x2ef5c	0x2db5c	0x24f
GetACP	0x0	0x42b0fc	0x2ef60	0x2db60	0x152
GetOEMCP	0x0	0x42b100	0x2ef64	0x2db64	0x213
IsValidCodePage	0x0	0x42b104	0x2ef68	0x2db68	0x2db
GetUserDefaultLCID	0x0	0x42b108	0x2ef6c	0x2db6c	0x26d
GetLocaleInfoA	0x0	0x42b10c	0x2ef70	0x2db70	0x1e8
EnumSystemLocalesA	0x0	0x42b110	0x2ef74	0x2db74	0xf8
IsValidLocale	0x0	0x42b114	0x2ef78	0x2db78	0x2dd
GetStringTypeA	0x0	0x42b118	0x2ef7c	0x2db7c	0x23d
GetStringTypeW	0x0	0x42b11c	0x2ef80	0x2db80	0x240
InitializeCriticalSectionAndSpinCount	0x0	0x42b120	0x2ef84	0x2db84	0x2b5
LoadLibraryA	0x0	0x42b124	0x2ef88	0x2db88	0x2f1
SetStdHandle	0x0	0x42b128	0x2ef8c	0x2db8c	0x3fc
GetConsoleCP	0x0	0x42b12c	0x2ef90	0x2db90	0x183
GetConsoleMode	0x0	0x42b130	0x2ef94	0x2db94	0x195
FlushFileBuffers	0x0	0x42b134	0x2ef98	0x2db98	0x141
GetLocaleInfoW	0x0	0x42b138	0x2ef9c	0x2db9c	0x1ea
WriteConsoleA	0x0	0x42b13c	0x2efa0	0x2dba0	0x482
GetConsoleOutputCP	0x0	0x42b140	0x2efa4	0x2dba4	0x199

USER32.dll (4)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ScrollWindow	0x0	0x42b148	0x2efac	0x2dbac	0x257
GetMenuInfo	0x0	0x42b14c	0x2efb0	0x2dbb0	0x141
LoadImageA	0x0	0x42b150	0x2efb4	0x2dbb4	0x1d8
UnregisterClassA	0x0	0x42b154	0x2efb8	0x2dbb8	0x2de

Memory Dumps (3)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	Actions
pnogzd.exe	1	0x00400000	0x004CFFFF	Relevant Image	-	32-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x006B9DC8	0x006D1AA3	Marked Executable	-	32-bit	-	... Memory Dump Actions Download Dump Go to process
buffer	1	0x006B9DC8	0x006D1AA3	Content Changed	-	32-bit	0x006BA6F3, 0x006B9DC8	... Memory Dump Actions Download Dump Go to process

Local AV Matches (1)

»

Threat Name	Severity
Gen:Heur.Titirez.1.F	Malicious

C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.66 KB
MD5	2e23ac8554587071fff55be8d630ad8e
SHA1	4be3f2a43801d906a7a03448d262d1b6c94cd64c
SHA256	2175e52892bdf0088051fd18a7744a7e2c7683f5bf6ad001a5cb807b19916615
SSDeep	48:Eqi8lWbUofLiz8VYxg25CUyX9OgY8G/Pu4EXLIte0ds1Q:Eqi4WDf+gV2l5CUytO580kXLkSQ

C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	4.33 KB
MD5	aa3bf139a0987b444810e8163d995f86
SHA1	e56733849579db7495cc6e8b1bed766300023ca1
SHA256	3f0b6088a629cf97c69c6f45a358046fdad00ea7ff7d78a53879ae11ab3a035e
SSDeep	96:4BERM103E0whyjariQkZoxuAQ2g6VGElB5F39f1BhOfSA:4BZ4E0yyjwvTzQZ6nR17Oft

C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.66 KB
MD5	d19f2553f536e85a8d57da40a2a30404
SHA1	3772c647b554d31250b41adbc9077f3b02446dea
SHA256	8293820757194303f915dc42af110f9915e5a575be95d355aafabadfe5551f59
SSDeep	48:CY6DZeX3+DBBzKPjd1/GjEMngOPR7PhewSds1S:CY6p9Bz6/9OZ7QSS

C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.54 KB
MD5	9eefaf945e4a8ecfc6ebf09f1c463e6a
SHA1	609293034c920a51d15b01f3dbf46239415cbfd3
SHA256	60598b0b5ad05dbc0d839825571fabfb18bd98130ae8d06da03c43b25486fa45
SSDeep	48:3+F10vNhFkLZHxxo+2Etk/Sl9RMHvhWQI+19cT08ztewu4f1aE0UQ2ds1A:3+n0IZH3o9PSRMHpWyW08U+wEnQQSA

C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Binary

Unknown

»

Mime Type	application/x-dosexec
File Size	1.44 KB
MD5	44cb823de810b9672be75b92a6c07ed0
SHA1	96a0a3f8d2ab26bfbb8f2fb8df5c6dbdba200612
SHA256	beb9d0e9014726d37f0e1d9c0f51dc202732bb0b40d97e8d5255082d127bbfdf
SSDeep	24:i3SOWbBOON7ZZzb9T63RmfRxVTy422HzotXkY/aP78+anmxkdSCHbw8UYehNRdsa:oS5kW/zbE34fPc2HctXZ+wx7w8UYe9dR

C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.81 KB
MD5	b6023e3f3ce1de678cc6d69420650947
SHA1	88b6e78f486974e7c0b25142a072638e3988b488
SHA256	e47fbb240054be5bc4523117755d3945ae7ae6352ddf41cbed626848b37f243a
SSDeep	48:2j/ZsoiX4+pNoXELgsv9SmF5MdL7RxZxoe5Pds1u:2VsXIWaELgsVPWR7ZSu

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	5.67 KB
MD5	f7d367ede5b0bb1e195a17497ea08613
SHA1	03827267c038347cfcfccd0b0e719a5cab5fcde7
SHA256	5c5a2e431590ebddaddd3f9588c20901de2e13304f4c2f8eddd54f75e9ed5e09
SSDeep	96:aCPQ/QrhOqO+bC4U/hGAEO9SQNpXapaCjvuUz0fR4uqYWm6R3LkOjBN0Vs/rr9Ue:fGPX+bC4U/hYQ3XapXj7wZ4VYPMbkk+a

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.05 KB
MD5	fc5f30fd7bebe92b64922ca9e9e53496
SHA1	a251e76cef73c580ea795668203a522b2ea87da4
SHA256	db796f79a9f5e40820350d5f67d1c8eb64c7997e8aa51f18614892da1bb225a3
SSDeep	24:rmryiNDbBbiY2KVqnbCMtEfIh0b3/Uk6pjbPL/s8S2DFds1wue:rmryA/ViYt6LtEAh0b8Z97Ls8S25ds1S

C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	3.14 MB
MD5	78e6cb6f0c5244ced7353b2c65fc26cc
SHA1	a4075757e58290fb67dfd2999dfb1e7e6b1d27e5
SHA256	48b0b6e6e9fca95f69e04c41db902b7d4c656ab9b3af22a11dac0864e14a1c3f
SSDeep	24576:zxnP6WBzkm83xgDBo8o93HmJP9VB5bxQrzVDFJdjHs5wuofLfdky20ytJytLmcfP:zDxL8QBo6Tex4S120ytJyFU1kl2I4z8

C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Binary

Unknown

»

Mime Type	application/x-dosexec
File Size	6.51 KB
MD5	c2e1b6d31d0a49a168a36bfd02b375f6
SHA1	d4e934091708ff9646702a6afeb006779ca4f13e
SHA256	2e7140c04b550e00f1e14afc9d0d8414b3dbbf5fe502056b7eae011b70650bee
SSDeep	192:CM4JVaqpdoOXIFP6RG9PFL7z/AkEenJTfU16bVbKzNBrqmF:t4n/CSk9PR7z/pEeJfU8bV+zjn

C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	4.42 KB
MD5	4880ab0022bf885cda0ff5fe0ae2afaa
SHA1	aa3b0879cfb0ea8a9ae51f1e7e3b1840cddf8a6f
SHA256	3e9d4fbadd61012b40fc430a9001938318a7515a659252b4b96b9467172f2a5e
SSDeep	96:AlgjGMN6BJTHNGsqNZcBQusXvpO0qrD/oK4MBPJSSu:GgjGM8JbwjPVvpO02bqMBxSv

C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	4.42 KB
MD5	3a798ce45181d2d5e19e44cf93ad21f4
SHA1	4137b0466773866321ddb6b4a492185858ee3f4c
SHA256	6cea8fbc6e880f994f78a0f70cf729aadfde039827d789df2730a129211710da
SSDeep	96:2T/fAEWPSzsMJNc3FeQjIilukWodXY5WyOJDSVn/z2RlCn6IvieV794CQVzSu:CQmdPc3hIilGT5WyaSxCRlCZvieVGCQF

C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Binary

Unknown

»

Mime Type	application/x-dosexec
File Size	14.94 KB
MD5	2b061ae4033c657dfc8c1c97cba863db
SHA1	66b0beb0ff19e723fcef7091043c0cb315a67c1e
SHA256	31ad0d70e8a0e356fcc86bf2d75ad525058226b405a5fab432f5dc9faeb41007
SSDeep	384:8TziA/izLzBi5Bp5i5e+oCz7imd0YKfb8cX0QSP:8TziA/EUBpI5/z7imdqY1P

C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	8.76 KB
MD5	1e011e475bff7eb988e557e89dea391f
SHA1	b614af0cd878e01312fd9fcc13fab73b3ff75036
SHA256	df0f1ac00770ac41326e0444f5cd39eaf7f877bf90f4bd7fdababaf0ce93b61d
SSDeep	192:Kc4xUXqdQ+uBxf0kmpKGT5DkhLZuMYBDgX02VsQJwaGEsr+cD:/5XOvyfFkKGNoPXnmIw/r+k

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\msjet.xsl.id-9c354b42.[decripted@cock.li].ddos

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	28.52 KB
MD5	32b7e5dde7459d93ba73ac20f175d7f9
SHA1	75a66037c134880e1ea94a44bcde5fa096f42c9e
SHA256	0bd54d96da8748bf0c598c7099a3eb49d1d560bc337194e921c0b3c0849ca6ce
SSDeep	768:aVEhs9+GC/6b+bLy4bhW8o9bC2WQNmdaUWAtNcRobNSyOUa:8b+bLy4bg39O2WQNmpWArSobwy/a

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\informix.xsl.id-9c354b42.[decripted@cock.li].ddos

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	30.46 KB
MD5	e2b822e3d8d12f905708ea6fb0d7ca42
SHA1	627deb104e7c5f2c8cc497ca8accc7ccdb731378
SHA256	3102d4377608121b14a283213f5f1d0d76bb826d0b7c0f4efd623ba85a8f2576
SSDeep	768:pItUZIIZia6Kyh39QuI4OKabbWLWARrpNxMXbs2sUNyg9+APAeD:MEsrMkabbWnrTxMXbsGQgQAPAeD

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.05 KB
MD5	5bc7c36574b4d7be280b3bff463edf2d
SHA1	6a26b24225bd1f4eaf342b6b3e635adc15733452
SHA256	e9bb5cbfe2bc5483bd59993385fa0c7c3dae48ea2895506cfb3c07440d74224c
SSDeep	24:kCURkNWEuTtwAXxh2p4EvtPvWXqxE+CR6S2jA1nd:XvOP2rPvBuR6S2Gd

C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	49.22 MB
MD5	4a43e9de5e87d9f114e74efed9286ef5
SHA1	517e619c1314d530e9007b2d8f2f2c1d3e1e7b7a
SHA256	2e90708be25ef9fcbbfb93c5485235ed6943c25228ac36da6430eacac636f8b2
SSDeep	98304:GC0AjI6iJlhxqzKqf4/KCShxR/DzLXSaQ6GDWX4ku0PgDj/5Ioc24i8qZAs42iUI:GC0AM59i4hS7Zj1WNf2KvALmtl9ibbbL

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	16.52 KB
MD5	30ecd2e81bd74ccf1c098f091b19e99f
SHA1	1eb769f3d8c8e0c3cbd9c32eb87802d452e7a64b
SHA256	fa7da0841dcf4233595507e85ead830828643462f47657dd87afd7438d4526d3
SSDeep	384:Gqe2G+5/efgCacAPVVUATAJrgRTQzNK5MEnQtLZJD0i8qJGHFK5:G/+NHC6VuA5RkpGnQNzwjw5

C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	378 bytes
MD5	ca9870a47c79f3555fb46adf1264746a
SHA1	fa2d275b4e9932e2c929bd1788b635eb52bee0c6
SHA256	dd4e11c7d5ee08d307b94471d242dce94021dd7424535e031a592e7974e44b9c
SSDeep	6:n4M1d8LhEVEddJZFs9JuYPGNmliPsB6WCUwVCKAglb2Zs0WNfJ/Ps152juHrNsl/:n4jGV6ZFiJuYPGNSiU4igC6dNx/Ps1oz

C:\Boot\BOOTSTAT.DAT.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	64.25 KB
MD5	84ce2558838e6dcbaa55064d8f2f678a
SHA1	3495b6da501f0b94e0db2921001187c492a7ec15
SHA256	175e00b0976495977216825db734581a0eae926232ef44b9dd5b3c158bdf27c4
SSDeep	1536:PVe9F4Dcyqo7IFvyS2z4uPoTjZh7yWmlw6KJegQmwL8:2acyPIhD28uAXbynOegh

C:\BOOTSECT.BAK.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	8.25 KB
MD5	fc45fe70d6aaec79437868e5716b9fe5
SHA1	5d7ab995a958cbca0fbce9e1f87e85bd0fbf100f
SHA256	0d50969e49f5683bb645d5fbed3990d0f4f0462445ab35d3c2bc675b85f42513
SSDeep	192:5bGi+DhsNIVo4Hn/egGWV6A9QI0gWAOM28S4ELr5+1a7loF+D:5+dnWGAA+IDVxS44I2log

C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.76 KB
MD5	8aab39626602b34ef7ebc313f107b268
SHA1	6587ef9e6f122caf6ef28ccfd2f4cc316abd6072
SHA256	fbecf6ff9d7a50b5d54994c9a27255f4f12c11046e84f601d97f53f3cf25c7c9
SSDeep	48:EORD8JLDuvWaP/dHYdr9v4HeTHUY2xnNS5BkNcra6JeQds1a:9RD4LDqzA9DHXYNSsNc7Sa

C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.47 KB
MD5	289bd93172d13c3f4edfe1aa1a663518
SHA1	de721bed5e0999e0293b6d129984bb0a08d62e7c
SHA256	9083afdccd2d81ea84d7eb4b8ec52702fb9021df216989d12da158c4a9381447
SSDeep	48:muAwX9fo71MmuK5I0C3LIXhx51H82zODe1ER6TiuAokD5tHJMqwXswtSFds1A:fkdm0Cc51H9DKRaRGXHwXfSbSA

C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.07 KB
MD5	ceae05a665713e37b0dc496d942da410
SHA1	d06ff22a818bcfe6cbec393efb527ca76acf940c
SHA256	38139a6a49d49b642406e12cb72ced92277daaaedba7b5b01ce15add4452ddfd
SSDeep	48:Hh13dX3Odfcah7j62iw1OcRauNclmm/nL1k+XyK27m1hsds1A:B13dXe31B3euqmanLHXyKThmSA

C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.36 KB
MD5	9f5246ebff29b542f2490669f5054c0f
SHA1	0680bb50d38e662f0ff76771994bdcc546bd025e
SHA256	4c97c85a3719aa7c5483c0f2800be2685b5e0611fd8587951f6bd86b151080fe
SSDeep	96:6Gq6HhyBKI2E5CljBcJW8hoJF6Fy1fxZvUwG7D1/t0sZSu:6OhqnUjBcJW8hoJYEtx6wU1/Giv

C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.80 KB
MD5	5db61b57c9fdb8048a4430ab007a0043
SHA1	6739927b3b30c9e507bd378800a32ca16e03d705
SHA256	80b28aa923eb63a4a9752aab3808f6f336a8005a9fdc34deb5aafa1076ea6d35
SSDeep	48:bb6nNv4ogmM/cgScKhqjOsSPtFMNn+qzgQds1A:bb6JmXS7qjoPtF8nLzgKSA

C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.99 KB
MD5	a48b88ba44af1d232db11da5179d6e09
SHA1	1b9e3c97b63cb81ca6721fb71aed4885a0b7483c
SHA256	47490ead5480fcb8fdeaac1f23c8b3a3102af5e13675d937c2c53abb2917e58c
SSDeep	48:qtIF/07swwYDNdLYZzUb8JfPwp4xCrgS4Y7e0ds1E:3JbYDNpb8JfwKCr4+SE

C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.60 KB
MD5	b2596527e4b2c551342408698c1434a4
SHA1	4c6281d772c205beeb89d787d2fd313c0cdf9237
SHA256	8efbcede5328c6ce029592f658b11198f1151baa51bbae7f59d3ca23af7f16cf
SSDeep	48:85Z4AzdbqmAZq83gIty8ND8XBDgCOUQkTkkjj39ZgPMOkds1A:8DTdbqmAZqag+yQD8XpgCq8jj39OEOet

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.66 KB
MD5	e5c799a20fd9d7b85013768353f9cabe
SHA1	752b5a35af08b169ddfc74b0175a4b408e16d136
SHA256	04cfd4ffc549960df2645e2083ed7ae23aa6c003faad5c486620cfbcfe4af068
SSDeep	24:Ov5jdbcuO7QhEHqZBlb+NSxMm80/1Fat1uynexRkKHnTgUn0Cgpmil9rds1wuk:Ov5jdbSYb+YxMP2FIDernTgI1Gpds1A

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.55 KB
MD5	eeb95fb9214319eaf7b39d5417f1b41d
SHA1	35ca1d58b2813c490a2a67fe604175d096104d93
SHA256	32c10de624789ea2680de2bb5605a8b55257f13a771afb811fc90a1f33802c1b
SSDeep	24:QtDZTS5UzceQLUehXEU+kGeGXOEfYt0tHatVGeyAK+/j8pOAl0N4exFTN8Yds1w7:M1m5xeAUeZrEX96a3qIMAONVFtds1A

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.03 KB
MD5	ab2d3302376549fdab92b6d5dc7b6121
SHA1	be8b985dcd4e048d76c2372fd6f0d17c4d154bb2
SHA256	39ad6aed39c8cfb60616c538070a040f82c29605bbc218151e425f6333764786
SSDeep	24:zH7j3qToBlU/DH5YK+HLySY8iqw8R1Nj8Ysds1wu2:D3VBe/DZYKMn9915/sds1a

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.66 KB
MD5	45b77b6c9aa4b2a7e9965620b15f0d06
SHA1	0d75955096f53a956cbfa9845d3727bd053bd6f6
SHA256	fb8362c4b07148b5bb4d2d6be7d6062d600a2db0303677bd5506c56c0f9350ad
SSDeep	48:Tnyjbd7cxWVjp6EUAoLP3Bt8Eieewds1A:TnyhNp1UvwEiFqSA

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	5.97 KB
MD5	91f8f29dd9e25ffe05062d2e3b44c526
SHA1	b2d07dbb0fbf495ccc067338cb88194e5fb16dad
SHA256	31ee66dd8e3482f15aaac57b0bce09732ec0cfdb748fbfad807808cc1e9cd38a
SSDeep	96:MxMy7uXMwldMBcoSYqNZB8nTcI8J//37ep6f1Q4dxiCVd8BX8t0Oss2TbdL6/UGC:6MMcMw0WsnTcxJ3y+i4dxi4d8BX8t4si

C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.60 KB
MD5	5952af900437969a4a7620eeeb6cff64
SHA1	eaee292b1a9349d9912d459fae077a5c4b8b9108
SHA256	87d5f2aa924c9974307a4be0dba78e80999be8d1159e7ec20f1da4dcb763fd84
SSDeep	48:/ZilOTjfDyDOlGal941qPLRmrh/tgnnpOjmZ1efds18:y4fGDg9EqTUVspS/S8

C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.04 KB
MD5	d0a88b1ab27103598928d4599c779774
SHA1	eb7ee8bd3f22551bd2fe1437a0f2de24fb68a411
SHA256	b61251d809b561463b87bc16b751ba76f213a35cf5c0e03a7eb2797c17573f69
SSDeep	48:V6b5SIENxjMVEr3T5a+Si0MnE3AVv/BITXds1A:2SIKjk83T5a7JIE3iSRSA

C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	6.33 KB
MD5	c45b928126515a0041d4352899260dea
SHA1	d524ea9f27f6bd3891642c21065ebca8b9990f91
SHA256	9d720693be4ea773466834d2048c1ace18ed0063188255815b05429e2eb4916c
SSDeep	192:ySbp+CNijgwkvuOJnAK/+aAPwstdLWXLAWJCFGGWrc6FOGt:yStCjgvuenAK8osbL78B8g

C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	9.51 KB
MD5	c1ba28a920751bc65d9be409dcc380a1
SHA1	b59275dc289daeb534384a79a2a79659c8b395a0
SHA256	f67b079fa88c661e34c84e36a8e370aeb6ad81b308b7a362ae77434464393b0e
SSDeep	192:KXAl3XhHSlmdeD28QRd2OyzhLfSwlHcabXdoIQih3XHP4J167ZD:yAbXeuR+zhbQilXPS16V

C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.07 KB
MD5	f63b7610fd7ef3b6f638135a7345aff2
SHA1	44f6a54ad05539b88dd7c72ff2a25a21db7cb035
SHA256	3686a9295ee4ad1cdb73c7ed978a73a75a6c03bb83013ca478d76651dd81df0e
SSDeep	48:fN89/N8DbjfthixYo6rovA1dN23wKGurP/vyH24bds1A:fNkNcFhiCovoCVGUHyW6SA

C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.14 KB
MD5	1fa04d4964d2819dc67feee82b7e0e4c
SHA1	14e226836f5f0f43af9e96733f330099873c5455
SHA256	62bf88f62d970ba3eb2d32a3c7ac360af780e2de893939aaf233ea99bc4689ea
SSDeep	24:RmpmOMnY4fEACLsD5PT3OCTn24U6wUS0vyormix2sFq0UaXehTJRds1wuM:jOMncAC+RN64XHTrR7exDds1Y

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	582.61 KB
MD5	92c0a739178a3e88988fef5ee535970a
SHA1	9d4766171bbee057df12050fe19369091567112e
SHA256	1c76be48362f8eea482736e70783a07b55080a3377e7bed179beb2bc52392da3
SSDeep	12288:xwLcyrr8kRU19Gywb9V2Ho53ZXiyhMB2MTXfy4d8bRi5:exrr8uU3BkC6lhjjoV

C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.65 KB
MD5	15ee48b4e34370781ddc8c7b11f6e6ea
SHA1	d3dabca4554696557c1e173f2987f6f88d77e5fe
SHA256	1c6c5775258b08abd781c479bc2299f72965aa86e3635d94f903d486cf993ede
SSDeep	48:IjU7RszkIDO28cjuKpbgeQ3Lya02OWig3iDqdnfUwdC2xmds1A:IjU7ckcZjlVg/v02OWR3isncwdnxgSA

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	26.79 KB
MD5	4e271136c42a97096ce7a10754cea800
SHA1	c95dd4b0de5f9b099be84fb966ae73004f070b30
SHA256	7cb513117dd8a90a31a935ebba7aa8e20066657741f3385c80039ff02e81a944
SSDeep	384:gjFVQrjUBUo213wOh00qwh1bm9ZTeAhfycb5Y+6AlIOs6dxYIRZzj+0irid:kMRAO1/h98RE+6MIX6deURKXid

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	65.85 KB
MD5	ddb0f92eb3a5e56456d0d9a2ad885b3e
SHA1	ca124b29278ae6a0d2ce409f0e8787bd2e8ea0d2
SHA256	9b0d68f395cadbd9e0d26986aa27ed38eef53553930e82ad263fdee2d2dc4640
SSDeep	1536:cjJCOUdFS1p6JBn1xzRfGIazUuaxEIRgrbnDDiUfMdiAiXk40EDiwJN0/Ck8Et:cjJCOUe1szgIo6v+r7h0dSXku50/Ck8c

C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.14 MB
MD5	7385f6f61940ec543a8439d6c8b1ee66
SHA1	49f5897618c0512bbb25d794de52adb9cf166e5a
SHA256	7b1ec65b654390545f630e157d5471f2830a26280dd5914aa1c35ea38071e277
SSDeep	49152:zDxL8QBo0Tex4S120ytJyYPkWsYGfrYcn+NJ00eS8VgJ/:zR89t1wPkWsYGfMc+NH8C9

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	9.37 KB
MD5	d0009afdab2099319ab6cc3087f3792c
SHA1	9231cf91688143cdcb96eca7c0d91d58d46712a9
SHA256	aeef648237a848aa4d9e9fa426afe8470426b5f636ba74664193daafc1ad2c4f
SSDeep	192:2yg9g2H+Y2ynj+AYyCZLjPMiBdqQNTTbNOgNTK4Krd1zA7dVtBt:2yi+IzwLjPMsEGTBO4wrXqt3

C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	67.85 MB
MD5	6b078cbccbab0d5edeaa1d85f11ba58a
SHA1	66820f091ea72f244d2d2019748cbda0b7b9702d
SHA256	7597007b7fd82fa6fc079ad255cc80561c20be4bc515df7968b4b0e377292774
SSDeep	196608:H4KKCX5FvaeoDcBdxmOJR7nxOKOmE7dzaNQwr:H4KKCX5FvaVczxmUJnYSE7dzAT

C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.56 KB
MD5	aa39a22cbcdcaeb111f306abc70af254
SHA1	1727da7170de8b9f383b56cc7723245daf26bf1f
SHA256	130b1b6e2c63af1c76c322a4afa81715466980e7636372fe378ccf984284562a
SSDeep	48:t1Pt0rPN8rkB8ltQOLSEySZ2cEeC7ectds1Y:t1iWkYYEyEEe6SY

C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.66 KB
MD5	cb437d16a7ed633e224964eb8aecea75
SHA1	10d76280a3bfba267e11813a2aa1eab61561a7e7
SHA256	852c063aba7249650dda54d689c390dd4db7208acbaf1cc35d53472eef1bc038
SSDeep	48:ZAaiJqwL1P+WjkU0UKhDkbf2A1UGq7/TGjm1ePds1u:WaiR1xkUxKE2nF7NMSu

C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.18 KB
MD5	2e94b8fa641b72cf91419858c728aba0
SHA1	6895b6f615d9df957e01b60fb3e58316b0402787
SHA256	bb60986e73f1ef237d6d78cd7ba869471ad14cf764d7c7a62cdc6504f8d6435f
SSDeep	48:ISZGuLU5OkPiyTgF0/NmAYpTjtfOSQYn5lJ3g4Wnds1A:pcuLU5EyO0QdVOSQaJbUSA

C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	16.94 MB
MD5	2fb10a322517f7cbfb3a6cfe3f7ec571
SHA1	f50dbea0bf05e4a4f73abb265fef52fa43db4e07
SHA256	5ef870f132dab830dd5380a5f66f2db9ead790ee6610fc191c638c2aecd616a4
SSDeep	196608:6a8A7fKP0ReD0wXKLUEfRrDXP2ifogB2jHcSBLWiyvyWJRMLhdPWfi:6aRDKP0q0wM9JrL2ifJcjhW/6vL3Ai

C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.05 KB
MD5	b43a1d402f937120da07a0263ba3149c
SHA1	99dcec4b97a3afe5aeae3de73cc32a361483863c
SHA256	6aef37b94f04d0ac2a817990aea3f7741ac0bd3376d5f59d61983c3425452321
SSDeep	24:qYmwBAM8zFsH5eSzOk2ReKe0hAjCvrjnsXsXcWS2DcIds1wue:qY+L5ieZA+ns8XS2IIds1S

C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.15 MB
MD5	aa62adb30d7eda78298faf85a97cc6a1
SHA1	14aaeefcc66d94fae156dc3494eef7f1407f6b05
SHA256	477b8e7934e484cc5299596293123743a6caf43d91563fe12415f1caf7cb0ad7
SSDeep	49152:zDxL8QBonTex4S120ytJyk3JXrTcMa63QcDAkcdeqWh:zR89K1GfnDARdeqK

C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	582.61 KB
MD5	84dae187788ec2bab91f9c9e8fdeb947
SHA1	80a59fbd6b6061e8033651bbc21a51ce09325b9e
SHA256	772514120f04e00e14aab66ff6aec143128c4ea442599539a6805667e69d6ec6
SSDeep	12288:iuets/5KatrXiibl7aRskko1bQ4wexsix6sm6jQU:iuemIatjVbl7aqkkodwBix/m+J

C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.80 KB
MD5	84ca3f3b76533a183cf1a8b31c65a1e2
SHA1	da295398e1eb3b88bd1151631fdbeb6d0138a228
SHA256	ccd0ae2e5570bba9bbc040b2f19c45c7427b5b91243f92999db8c8edfcbe7235
SSDeep	48:2eVswrtxe0BKjQxfpfjyTqMLSTiVQVUPNk7yf4kXKWNq1WH2w9UrJG0WNXWwLtcv:XswrzBXfdyTPmTWWTyf+W1ir4FNXJ43t

C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	16.70 KB
MD5	3a4478799bb26eef074ab6e9f61f3157
SHA1	5ab8cc9c3d4eebafbf259f2a89a43eb5637c64ac
SHA256	c606184137cc187c4aeee89b4736fda4d5c4bc116652a6221fafb30f685e490b
SSDeep	384:IgPt42QhjkUkslmdVD49pOJGfnqmsiOa8LFYl7+ry9cT84vc:IgPvCkUkslmdVIbn2iOa+E7+G2Tpvc

C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	30.60 KB
MD5	6455f9128b6c239827a80e6fd0b97bfb
SHA1	df5e82126fda4741ae37675b9a475f91788d7254
SHA256	a136a5f471e80f466df9951887ac63dc6b41f23b3e2e65c3662ef2010406f7e9
SSDeep	768:oR0X8y1oM68vBAOQij8PPS+xDH6j++6A1CNbZeYGFx11v/9+fXF:nX7J6yBAFiIPSoDH6KG1CHl0x1B/kf1

C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.42 KB
MD5	5d8832d318b0c884922b7bdaed42e0c8
SHA1	1de498a71341e8446b0b4e19eca0a28e6be65115
SHA256	e7101c3514748a463f5eaf6d57fc0929dc7dd5ada925f593a49dd2be5672a14f
SSDeep	96:y6tzJ7skm7mm8yrOCpREHpKHrq6WzCx65IxHJ4HNJIDvGDISu:TPskm7mbyr1RapYqJzl5IxHOtJ/Iv

C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	16.52 KB
MD5	07f183e8d2a9ed676be039a51c7bc060
SHA1	e6ff12bc673fbbb441de7fb2be6deda2db26424e
SHA256	e9bac96957386df0d9f4bd1178fe98cef4842cdd4e53bb512b8e4bf73ee1776b
SSDeep	384:DTcZb0LJOHJdmib87/Ys2cMjl7lekhuheyowtd7:cSV71ajGdOGJ

C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.27 KB
MD5	d0254162e477b36412b324639ce55841
SHA1	5ac6685566caa501b45336f0007647f33fe67759
SHA256	a7b56693064da26f52710924fd0a0c198577f2b5cf630b920546970f934de840
SSDeep	24:kXtDYXVOz4M0gvYY5rdZMLm2d/LBwuxB+rt4HDzquMB+lCyds1wuS:khwOz45dSxupuuD64jzJMBjyds1e

C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.27 KB
MD5	f6da9f3a12fb5ed861794c70d4eea554
SHA1	7c0243e80712a7e9407699725ef7da7448671647
SHA256	3bdc0730e41ae6dd35bf6d0bfc187a425b6b1c5084e8b447023d641e929fe62b
SSDeep	24:q49znJ6sm2oPx8c05Lvgo3YDptEKG+dxpcR17mF8sHQRds1wuS:q4O550pz/+dxk7mFJQRds1e

C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	20.33 KB
MD5	9d70c09ee8c4bfc7e565057535d30459
SHA1	1fcf6a2e3ba9dbc1e9c912d5a13c4dd1cb5f4734
SHA256	c79d5e9de69794159411fcc0ac9da6c6b805d5dc95bd02409e381a63e0bd2f1f
SSDeep	384:69H8QMgsiU/aptBm04gttTl5+0+Ok1QqLtGlhnj6WrAs3eUkxmxV:kV9sH/aptk04cTl5N/lh2WrAsAc3

C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	14.88 MB
MD5	0132354deb06c352353675fce278a129
SHA1	82f447263c0d4d83d398af15034413083edcbc35
SHA256	8e5451128ff68d309300dd54c2a3bb83f196e6fefb39f1e8d6b7c24b8a6f7307
SSDeep	196608:TIwm3nNVAl+ig71eZ8FclBElWHEbyLbyo9crpLlR8ioLO0ZF9CrpbQ:OL71eiFge/GHyo2rpLkcoCrpbQ

C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.88 KB
MD5	45fab4d6863cae0d2f859b182b0ac39e
SHA1	60eb86077e86ae8f0b3d1681fdcc20280b62303d
SHA256	d44f9cd0c4b064945bbe23579f6d3761568090b9ffbea1ebcc4a71948bf55af1
SSDeep	48:ElrZU+bdbvc8QMC44dnJb2u6C/XtyWkQFcvEtC/kMFds1e:w++ZbQMKJb2PibcssSe

C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.25 MB
MD5	b0f6f96b5d9073511d436da300b9b722
SHA1	40a3ac3b2ea547f850fe7d123027a18f15a05c05
SHA256	83555fcd1b8e6aed9a3e361b76b2fd10ddd6f3fb852a0d1ab8fe2947e7bde3fd
SSDeep	196608:aPUvTYpH9RBl/tus7o4L7tZiTnp/jE4U/bxlLRx+S7U:MUvTiNhU4L7tZiTnprP0txRs9

C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.48 MB
MD5	7e0075b3ec2f0f60a5c2c3ef5dca48c0
SHA1	6f188e792a80351e0ca2adb6b2961c57341f60ab
SHA256	bc08f2b014db30239989aec7ae16d4fae9c56686ca32e75356627aa46d31329a
SSDeep	49152:fHYLL/WoWLljb1R6rOSN20yRJ60l4cum/J6:fqLVW6vIl4cum/J6

C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	42.53 MB
MD5	4fb6c079967f604d4b8cdf477caf6de0
SHA1	a8777ca0e49e5d98d01a6b007c7b62b5dffb5b63
SHA256	9fac05c1ffc4b8060b0a5b942d35cc90c0bff012af1a00a6712c6d03018b083f
SSDeep	196608:MaurJM4k8IMj3kMxfGbWaxJMKMA4JxuiNQG3A2r7rfiSFhysD8uxDxKj:EOn8IQkM2BFEx96G3AUf7FnzKj

C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.16 MB
MD5	7f68ee5e62e00f3bebead0da36f8119e
SHA1	c491c7e971a9e49f1dadfb11621b3ec4eda0f3ea
SHA256	63b287bba11ed86df3b82f9dbc2b6e0ad896f43a1701ad4da4e18fe6bfe22ce1
SSDeep	49152:zDxL8QBoSTex4S120ytJyOZZ6szF71jU4:zR89r12NlU4

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	855.24 KB
MD5	fd36e7bf1d96ca04da58775d803b7f37
SHA1	ad7fe1e1b75bfe4bda74c035041fb5cd9fcd8c1b
SHA256	1a9e9d0c188c5237659565d4bed577e448f45b408dd64e840798334d08e17673
SSDeep	12288:P9w3FR45fEXZU1n4LDOxfE8TzVUsT1CTN3bnCTKoCJXc3cm44AvrSyd3vbchyL:V44fKZCnyDKc8UsJ2jaJOycj4sd/Ys

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	860.74 KB
MD5	4bd5db5c568a17a9127a26b596307cee
SHA1	3fedc96348b012468f0fb35b8746017e9cbc655d
SHA256	cc186b3327186c81206266a2826f8cb7a409dc6150445aaed60898f8b153f293
SSDeep	24576:N6OE3AoTSeuWza2wpgGby1BB6B7djcHTL7q:HE1uC+dVO1BBY7Ncz3q

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\desktop.ini.id-9c354b42.[decripted@cock.li].ddos

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	410 bytes
MD5	9e338439f364bee95a0a010767de85ea
SHA1	793712b11f7fdcae0bf9e4a40d1c83145b752f41
SHA256	b6416e201e3cf0e8476278757ac336d7b271c9b65f8e507e50b8d9277e132b2a
SSDeep	12:QbHNzpVeu6qpxpU1mvigChrwCUwBnYomV/l:2pgl0xpsm6zrB5g/l

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\as90.xsl.id-9c354b42.[decripted@cock.li].ddos

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	18.54 KB
MD5	92d88d7188e1188d31600d668fe3971c
SHA1	2b7b1d413cbb84de942b3b0749b2bb0687d24313
SHA256	606131d5b8a073a66520cbdbbfb69065652c1cfefaf61ecea641d046eaf71472
SSDeep	384:NIwYs4236AbI3+jAt/vIIpxXCp42GRkK7NlCr3UN5qZtojK3fDsqNS:ewYM6+2/gmxr3lCrk6YsfI0S

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\resources\1033\msolui100.rll.id-9c354b42.[decripted@cock.li].ddos

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	14.76 KB
MD5	a01c1476c03314fd58efa244b42cdfec
SHA1	dd8ff2d73906562117fb7a5526a018c9039b354d
SHA256	a633665bb39184006ddc10783990feb1ccdf287c48983319cdd6c40d7705d612
SSDeep	384:J1ANdQqCpRKeNctK8D8CrrcXenbFquxbJT6e9:J1ANd9eRKBAU5cObFque8

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\sql2000.xsl.id-9c354b42.[decripted@cock.li].ddos

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	33.51 KB
MD5	64d1975110d483016a56899c865e0220
SHA1	81b57cc71a205cb862c9965799ac6e56d674a987
SHA256	713de0389da4f84466c7d698b3d2a423768d64c1c6939380d2dc8758584a3482
SSDeep	768:STRNIiJ6oJnpRXMf78DD/YALR779yUitMpnBz:IReiJ6SnP8D8X/YAJ7MzM9Bz

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\as80.xsl.id-9c354b42.[decripted@cock.li].ddos

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	17.08 KB
MD5	ebafc045ee780e809d10635e234e17de
SHA1	2e1948f457caab526841cce389e37256b483f7eb
SHA256	256bd521c5aacec41d3cd5868e4133381e80ac4751653d802d5d062685495690
SSDeep	384:og2p9SxCYaLVhJF2HSHtTQkXw8pzlhBYbNGiKtUU7IxJik7fey17QY:ogG9lYiXJF22TnXw8phhBYbAitU7KJ5v

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll.id-9c354b42.[decripted@cock.li].ddos

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	651.07 KB
MD5	958adb489010ffcb0b784fe6e81f82f3
SHA1	e1fafb4dffadbf554a74de356efa5259bc562bb9
SHA256	1e7e74818acdbfad2b0cf977184d986c33d96979c17841dd31fd1b456d65180f
SSDeep	12288:Jgvvg/k4RAbuoh1Z6YugJejJMm6qNl/yxOB2o19CPq5cdsanptZZ:KvvSCbuiJ8762IYBBfCy5ce2B

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\sql70.xsl.id-9c354b42.[decripted@cock.li].ddos

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	31.63 KB
MD5	e14066c8d105c20ce292bc9221d638b8
SHA1	47edb07df989c2f5ec498451456ac24511c51fed
SHA256	0c5912a868dae10c4fe6c3b371c066e0b2f4c52430317f254db94856ce151609
SSDeep	768:x+WKAQywR/X+Snsw3Bpk32oRVmQxWTI1PbUN7:x+WKAv6uSnsw3BKRVx2I1i

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\sql90.xsl.id-9c354b42.[decripted@cock.li].ddos

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	38.82 KB
MD5	e7fcded6938aa70de012190ece90d6d9
SHA1	a7371db576d929bca40d62206762884920741e30
SHA256	0f9793e0c7a91d199f031efe24d4191df85b62113f4b160cc013228b5f8397a6
SSDeep	768:vH6XkL59Acd3w9rGDpq/8mNCEOLcQq3lTXlLvO1df3z6ZjjVBeL7k55bCxbK72:vH6q59Fdg9wq/7hKqlxG1Rj6ZS0Cxbm2

c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\sybase.xsl.id-9c354b42.[decripted@cock.li].ddos

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	29.32 KB
MD5	794c08a8059eb8550cafb07055254209
SHA1	953514f4591d514b24ec18e7734c4b4727595ef2
SHA256	27403da51aae536a78c70fc621bf7005a3560f6be12c5df82ef8b9d807ffac3e
SSDeep	768:vlleoLdcD7yUgWv8CHmOHvbNQfvmAHph+:tleP7gomOPhQfvJHpE

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.13 KB
MD5	b062e7cf13c9261fb948741823c03f73
SHA1	592b598cf7a98596efd6e278c1a142d30cc6ec62
SHA256	c2bd7ae852e6392f9a0e1697e77bc3428aa9b3fbc14bbc5a9349c0403b175065
SSDeep	48:jw0iWZVHzLXN5bo1WESwRpjnzPFkEOQfUCEuZKcByRrnTnCqpweXh:jwBWzN5s1W8PjzPFCQMCvZXByrCQwC

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.56 KB
MD5	4a49153f282cabea7829e8858e1b246a
SHA1	8356e659cd88aa01d54f92d394eac46659d36634
SHA256	41bc5ba0035acefab7053c5c644b573ffa1aef4111d60b754bd04b49bcc3a71e
SSDeep	24:OZqeXmEPrYDeB7wX0MFuG7UM971IrLQZ1/dAOQO7QNx9IlWSusnjn:kqe2EPr/B7tPG779RyLQZ1/mOfb3jn

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.76 KB
MD5	0d7d929d1c7d53245ac85cfb3d2f787d
SHA1	c2afe4292e6f052b804844b115dcc664e386768d
SHA256	799064baaa263e1e4ac8fab8a587f5fc8ef248d5f3e72a7a67667849ad0e285a
SSDeep	24:nThdpyyFtfwE7jje6fZnf0ngSRn0I7DIg5/m2gCLrtyFus4+nc3PgDxASCLXuOhD:Th/yyFthj/R0gSJ5vvrI4+siKX1hNl

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.05 KB
MD5	71323d56ab974531841ee82cb517d3f1
SHA1	65039d77adbf68340d6250e2bf0d0ecb2ae89440
SHA256	a6db60125428fa5bd3bbe1ef907e8e3b49d1f463598598e57f9ff60c29d6fb18
SSDeep	24:EWlgedL0BXgRhwGtdRMtndm1w8XDWS2jPnd:EWzLQgR2GnRMtdm1J2jd

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.80 KB
MD5	cb6afeddbd8307f094a216cd6798e272
SHA1	e55d8d0a9e3d672915e152c1e98f700467c7a77e
SHA256	47988f50c458b95b71e78766b4a770217ce4cc81f05c8060ed82bc49dddb0585
SSDeep	48:FxsviR/zqceNUZ+Fwn83FndJ0nnPyGLPy/BmpwByg4ZwPQFIX+9vDRNaL:cqNzOw+qn4FdJSnaWYvYg4ZwPQFbDRi

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.14 KB
MD5	0f690ed883c397eed25b0f70e4fe28c5
SHA1	ed81feca6baa7bec1bab296f9bef10934d218c5a
SHA256	581e551e69b96c993714bcf8367367028bf5679bf56d43ea06f74df77ba5b7a9
SSDeep	24:CMc6ritwQL214tgFsX26oU7WtkhsNUsj1zkHGZku6iNnjn:Nc6ritwQLh26Z6tostAdbcjn

C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	848.75 KB
MD5	09b0b3020aecff9d466dd121e9046cd8
SHA1	5ba15defc0d448da38eb4d835772e8d3714e25ab
SHA256	f2a08c7ddade1730dd3a5e476df65e0b967320274d7396b13ebcc703adbd3865
SSDeep	24576:LOOqUcaXPL9mQUGVrKu4O2TAdLrrMBFKXGNhB0:LlrcafL9c+rKu4BAdoBo2Nw

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.65 KB
MD5	d7c13c17d3baa7040e26526e49e11158
SHA1	5fe01f9359295b700660c181279f1e72e8606671
SHA256	d58a419cfc1a674e50bc3e073ac4c7eaed4f2d719604780db3ecd49b3fc275b9
SSDeep	24:MpGT1krujZTc/sDI7T6GXOto+SXo7kn/nf7jRTynh6QloN1waMIa602uhDDeSLBL:vkraIHeicq/ZehXocaM+uhDCStL

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.04 KB
MD5	becf82dcf134e08d5a61cf1959f70299
SHA1	a6cb87570a9acf601cb1624ba58680d192527ed4
SHA256	93e5aa3edee0e89c584b43e8358563ba8bdc10ea74108eac9d5c735e26fa58fb
SSDeep	48:b/1JU260zwdvi4SDQ/uYoQTHK72gclEhIdoaTRuL:HJzwdvgDourkHKizOhM78

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.44 KB
MD5	588299e5100c709dbe2acb170b250255
SHA1	5eba7dc5de3605479fbaf64e020d0ad23f5a0ec4
SHA256	96a8cbb5c96ad3ec9db4bddbed5cec88d720faab25a01b989737a14c6a073005
SSDeep	24:P7ZoJvDxuv3rr1Q2Ycqxm+maWgYqBWQbpPTOYAmxwqgTGJzuQnH:FoJvtH2Yfxm+87sRp7OYAqgyJz3H

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	582.61 KB
MD5	d2a74edec6c2368f870c216577f48bea
SHA1	293cd2db3aa61aa14337b71b2af6a253f602ad33
SHA256	09085b9ed50f06e7f37472e4f33e1a118a411abaf91ae53b8665a35aebf7fb59
SSDeep	12288:G/x+JEJIN8uTrN4FmYfSeBuCpi/osUylyCtPkd7dMnN8vW9x9JGJ:G/xoEJINKVSOKkyECtS7dXAJ2

C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	853.75 KB
MD5	67bf5379894d07fb0ab1fedc2ab6a627
SHA1	23c89f2cc45de3bcfadde5fc7a2992aba0ed40f6
SHA256	c44ae7f15a53d59bbe64faae94f6e0addc20dd920247d70c9f9eb468c6db90db
SSDeep	24576:wE37ezCMZ06g+XPWK3zrlTPXsEoDjmllL+ZeJC7:1LezrLfxDrlTvf6OFJC7

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.47 KB
MD5	cf24128141bb9f9f717a912b9583f24c
SHA1	7e03338620ae32255d6d63e25a134438e45c37af
SHA256	12b8715f80b39e632e54d13877372c438058831b4604d9a07ec225f3dccaf394
SSDeep	48:7R32KNpBEdnISrgy6FbLprK14NVT5bgZv5Ks5+jkLXa9vE6sDhYVCkEL:7txjBEdnjg3btruKGv5P+jGq9vE6sDhz

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	69.80 KB
MD5	7760196545d787727e22d2e19898c467
SHA1	3300e5405e5ee491106411c3258514db03dd5332
SHA256	0ac0c842d5b7c218120d7055f3d9450846ce772c0b19ff15aeb28ed4b4f0ad6a
SSDeep	1536:WiL5od7AK32mAexHTcqAln0lLq2y1BCbLttQTIn+BeVGlHl3rjQ:WiydrGPsoqAND20BCvQTu+0U99rjQ

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	37.04 KB
MD5	d677c5f0e34b03bd6bfc1c95f4cc69c8
SHA1	0c150685a3750eefea32e82e47444cecce96ff4a
SHA256	43c594c5eee0773351e49e6c03f4e1836a6d6132386b711e87901a7948442db1
SSDeep	768:pXhysqOqIkKqRhjcClsOcoijs/zVy75+FPdZxPwANT472WNruAvAe:zyZzKqRhjpRTQV+FV5+2sH

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	5.67 KB
MD5	d31cd14b640aa60464c786405a7b0252
SHA1	eb2de4be01bdcffe58ae5f183e3e1a1bf7b6f178
SHA256	0c4388e9ed05866c671a6974a86778fb8163b56b1d5edc079216ab7a4996ce08
SSDeep	96:Y2gZZ6UJBWMGuV8g6vp9kNanjrjGE35jxc7eAEbnNuxcRta5lGusgAZdM3/KbfJ0:VW6UFGk8rhpTGU5jueAEThzalVj3ClXk

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	65.85 KB
MD5	80f3d1ac700d4bf3258908e753fe5e39
SHA1	b6e8fbdde242df9385fa82408ba5d7e61341df61
SHA256	6fe5c011a7b9fcd16dfd897407c67e7e1fd8f0156093639780f3e53d050b6c57
SSDeep	1536:ADD6PQdJml67e8tmARKFNAK0+wC5mz6O22QpRb4C2quoBPEx:Af6PkJS6C8tmAkm0mzh2Db4CbI

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	9.37 KB
MD5	edab44458eabce5ac9b7dc853350953a
SHA1	f5e74cb8ff0d24255c3e2b136042a4a73ccff69b
SHA256	6bceebb13e721892258915000e6f1086902be580faaa12bac8a08be9c916afaf
SSDeep	192:y/SmKN77R5RSFlkcA1SOsZ+w2yFJLK0LiXwLcMXU3RD5G:sQz5AaPwREgLlXU3l5G

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.60 KB
MD5	d8fd379c971cafd4612139352f5156a2
SHA1	528a25a54f836e8349a0ea2729869513bb6c7ce6
SHA256	1787b3a3399e86036c53befe6a82dbc6f46d3c19d4467e1e51c999202f4c02c6
SSDeep	24:9BatlxOXIgyZiul2lRGCgoxmK6eCHhc+zdsJ6/vVxKslqtXvl7Gk2lulnH:9M8Jg2lg9oxVCH/zdJCsYpvJG1uH

C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.54 MB
MD5	8f0d8c8b58310dff69008b2a2da4047f
SHA1	847ad8551dab06250d8e4c34cf30cc635cac88f9
SHA256	3823ab90b5ffd9d6596901e8538d75290ae426ab82c7f12131998a5159653c55
SSDeep	98304:zDMUwxyODPFhbY12HLodiF4+5rimsiUGwotfRIP:z4UwVthio4Li1dtW

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.54 KB
MD5	ab406987a4b2a3ca1c42685edd7f5aca
SHA1	d0dd1696473fd885d5522f00090287a557cdfc85
SHA256	01a43704906d2c3182aec4beb6349d18fce072707b7439fff9ea3fe1ca646d5d
SSDeep	48:sDY3N7yP704C8HB2B7tiiiJIr6Tngo3vn8/PR17Tgf9sVXUL:ss97yPQ4C8HB2BNiJiofn8jTUsVXW

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	26.54 KB
MD5	28983e4645cb274d80b42f8d0c2e4caf
SHA1	5b6a3ee420080165213b6f117baa148c6e5e9fa6
SHA256	4f42f991ff93f2f2c2792e66e11b6160b2b13851b3ea8c99c3e9a0290f4bda4a
SSDeep	768:8fOJLhNg+urvHPxrMOU0rruFrXYMai9JFXZhl7:UOJNGtvxJUsr8oi9bX57

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	26.79 KB
MD5	e9551814ec372b8724cfd4c64a03f6dc
SHA1	f1d58daef19755495336a4c19599776ef4af7db9
SHA256	29cecaaee6a98150481c826a887f9f9d507e6948a905b228fefbee102cbf238b
SSDeep	768:SH47c6QN6nPzm8fvyZXEylGSWTELDZjCWypM2yqG2:RznyRXDYTqfqG2

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.42 KB
MD5	1837bf6886d2618fc1fa9a152e075cb3
SHA1	dab9a5912de973e33a09bc99b5ce107f64701650
SHA256	66a0cf5da4cc1384b436bd395935ee9a27dfa5933905ed5aea8a464c27c0eb52
SSDeep	96:bLs6gFIU1ryhXyc2sgCh9wdCPfphR6Ph64LAqbL:bLs15yhXyXPC0CnR2QEL

C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	18.75 MB
MD5	06e69471c0bb81eb102e539f0a04490d
SHA1	e0e8dbed58bcba38c03ab546d7753d1f973df44f
SHA256	b53484f0eccebe76bbdf0262097d8f747d5a05d0e569a544452eb328aada91bc
SSDeep	196608:iaDH9F7/iHXDI2CPKBUq6qMuGm9vqExoi93nnedBwzSlmKwDhANZbPhn:DDdFDX2J5uuGyCfi9uIQmlANRh

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.35 MB
MD5	bcb6ee9bd542b24271bbe17bf7100ac8
SHA1	09f67899de3c130471ce24e7d53806bd2003276a
SHA256	c708a3309eebe4572f4e1bd65bdc6c2759df57c73539d4890cf9ea715db230a6
SSDeep	49152:R0opH/cgHa3HRxz+4gU69JN7iNZ/NWY/l:R0op1Har+N9JtfIl

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.36 KB
MD5	5698c53e02ce6d033eb5d60d23be8012
SHA1	1ab74fc9b811a5fecd3e599cb89cdba28787c06a
SHA256	8b44759372d7e45bb953b3942f6e33eb2a3e142708f7934ac05680bd7ffcf49e
SSDeep	96:Lzy6Zp+ZaP6JZp3hNhxrYqe8dc2AUNLd81BV:vjpofJZpFx0dqJk

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.81 KB
MD5	334a5de8ff0682fee16b78259ff4ec8e
SHA1	95a4e2c0a4c45ca6102ab2422197e0efcacf759a
SHA256	d28590ab1a4ff94bc6bd6626b3812b2630d29085c13e96d41573275b160ac798
SSDeep	48:9bO0U8tuh/UxCDH7rbvRKKb8VydGaqlS5:9bO//LrdDUeG+

C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.73 MB
MD5	852323c1187eeaf381d3af1b8c4012c5
SHA1	eb27710ac023ae2b81c03ef93a26dfb29b57526b
SHA256	24f627ad3a3143f3f565c9dda8c86770042f3d7ca1470647503314f9e0f8a908
SSDeep	49152:5vlLsUloDoZmcLaSt20yrujThvLf2AdMKRGJS+JMitM6eeb:5xslDoHDVjRGdJMiy7eb

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.33 KB
MD5	f9e6a2931f11930ca89b58132b7ea8d7
SHA1	5cfaf885dfe6a8cd02118a938a49980c09eb49df
SHA256	cd75dd939dd40b7acb4d6640b5942f0d85eb0cde8769e0f45e74dc5845298538
SSDeep	96:BEO8tScUP03+ZRVGrsLqncCSF2NqGipWeK4ami:BEwcUPTZRrLKcCe0OK4ah

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.18 KB
MD5	b339d97c46f696e85b7d4ef704a54c50
SHA1	c7040c45b713cc865f5741ed36b57dfddb7a1541
SHA256	74e8bafc76d75d2b44b8bf2856fd29afecb0923e4344f1b1a6a23297927a3727
SSDeep	48:XPmxxLixmqXDylmgHwjMcjcH48HaJGHZ3pHhrD73L:eqmqzylmgHkcHaQ5/rD7b

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.07 KB
MD5	60738de16e765a4052eabdd30ac1697a
SHA1	99edcc9ece4b9e7c856bc91fa7aff19e8b9496ef
SHA256	92a763bc85e835abe8bad475de11e4908b67cf55755cbf807a048609732d4e86
SSDeep	48:HC3rHT+z/qEBRGfb10nXeLbzZAynv4JQI+qpXQmA9UINPvHVCIkL:HC7T+r3RkXzZFnyv+qx1I1dCIm

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	6.51 KB
MD5	53819a3d53a2e8f8d666974b44b0c7f7
SHA1	bf548ca883246c0a0ced7312198557b618c700bd
SHA256	35c6d60d32caee200ac9040577ebf185ea74dfb4b4680760f637e394c4fe889e
SSDeep	192:EhJnsgPw9KElP1WE24EQzOkn/4d4vwh5gwg3now9:cndCK7E24HyknXvwbgV

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[decripted@cock.li].DDOS

Dropped File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.66 KB
MD5	5c89e7e86019e686382efd5158d916b5
SHA1	a12f4e7251b9627adda88df764828d6744243272
SHA256	c2431acc51f0dcac261b75cf70b6c430b7499024fd95c3e9f16515ed5047bf31
SSDeep	48:/2lxM5BNneaqukuOqttFdHRJgsWhuCGqctcPb:/sKeaqu4+tFCsWYu1j

Remarks (1/1)

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After