270e465c...483f | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification:
Ransomware
Threat Names:
Dharma
Trojan.Ransom.Crysis.E

1svhostru.exe

Windows Exe (x86-32)

Created at 2020-02-15T18:44:00

...

Remarks (1/1)

(0x02000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Indicators

File (4081)
»
Filename Hash Operations Category Severity
C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll.id-B4197730.[black@gytmail.com].self MD5: 6e9d313fba14946ed0428254cfbc6072
SHA1: 418d675673423339a672433373d1dbd71ee54c3e
SHA256: 910908b56c0325e05f967885dfbb348af158dec751abdb0834cb7d48c559dd51
SSDeep: 3072:+35ofQVB7rynb27ScoJ/wKUEs5c6ZkWOXLsoTLhky9Wlk55H:+35ofQVZBSdwDX5c66RhkSuk55H
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\$GetCurrent\SafeOS\SetupComplete.cmd.id-B4197730.[black@gytmail.com].self MD5: 8778bd641cbb01a3a689e9c3b0f51a79
SHA1: 9123d84eb771fadede98f44573727acc621f8f3a
SHA256: 7b8d8784b3cfe38adcd5b09edd6d1398ae78414e2511a3d7ef33ae14e8072aea
SSDeep: 12:ZNJgFZQDOESq6dPnBh4k7v87SUwi+ExFFH8l5pW8+IQilOfnlwvfiz:ryv4Ov8+/sFFH8l5pWRILlulwHg
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1025\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 56f561bc463110ac85e5b756cf06f696
SHA1: 1e05142484b8d94933b5d17f9867bd34a7862652
SHA256: 953c28c5a5ee7343a1116c6385c666536038493eb3da9487e8d586dd9f57548c
SSDeep: 1536:czXHyjcI1NssMKhuDXY1tsLa6Z6UhOalzNBuWdkznirRFtOKUEfb6:cTy4ojMKhuDXY1tDgBhdiitOAj6
ImpHash: - 		Access, Create Dropped File
Malicious
C:\588bce7c90097ed212\1025\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: 85100fa6081d46cf7011eeba7b523b75
SHA1: 6d133925eabf21f5efc96d81b6651f001855d9f8
SHA256: e1e1f29b7d9dbe7e05d6be31f023128f2d2218b536d77706688d1305524fac5f
SSDeep: 384:Y5s49o2Z324NaAVeEfKciuOxZqUfT4sIm+hIsrQFE9r9/fsN/1:Y5r9T1CEfKcz8spe7S9r9/fsNN
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1025\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: e50a36d80fba24fa60489188cb58b8ef
SHA1: f921d3b4fa461fbbfe65025d174dc59aa5908738
SHA256: 1a06800bf8b75833d8a79d84285fa14ce06278282e353a510f831c7d9e44cc1f
SSDeep: 192:6BwH/geUjXs5RrU753nSIaNlJczOQYq5YGpKlt:6BwH/gtjX0RrUUIaxczOQf0t
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1028\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: b092db20b1a198b2e7b06fbd0d89e16b
SHA1: b41f6492d9558981242bda3ef17bb539ef95fa26
SHA256: 5f6e96f359fb41c823988651663919a2f39f1142f6b299bb32ad486033aa3932
SSDeep: 1536:QAcYk/rx1nrbx6ZReRddkJkNCIDT/wFhr93itn8XB:QAcYk/rf2eRdeJkNCm/Wr93iaB
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1028\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: 8ee3096b3955c806ab15c633ee5d9d91
SHA1: 8df00b471f34cb3b3a050bfc25be4f922e22dfd8
SHA256: e3ac86f70af3069fa1bae20865c0eb3e7503d7a4684b7205977223498f364e24
SSDeep: 384:KhElmne8FUGBOf6DgA+Pf7G2TdlG3XQht:/lk/OGwWg7PfK6d+An
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1028\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: 34fc20e3fb1c25d04d63889cc01aa02f
SHA1: da5a6b3a42cd20bc1fe4a7b79cd8908cf6fbc693
SHA256: 240522fe7f037c639f6ea7f4b8257ea4f48caf35a8ab674090df971b8c626b2a
SSDeep: 96:8MJD5lYDrEiYlpIcGfok4T6seczdKBAJOk4Z+IMP1tqkEbOE63rg5X8ZMEc7Tgz8:8MJD5KDA3IAT6sIMOkg+ztqkk8L+TzYy
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1029\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 9a5cb900cb9462cdc3272c4a50cfb5df
SHA1: 0aae71cc79f0c735604c3503f35308fe20d76031
SHA256: c1049d7991d5f143fa48c2f92198e84160815f3b7038d4ea286c4c1b5c5682af
SSDeep: 1536:C7oq2TAL6CYXI3EHwOSzVX7rJZSqfsvMgPMqC:moqoI0IUHFsVrOdv7Mr
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1029\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: 54c035ce8d830c7a16079dfc43710c1b
SHA1: e01c7f24e4031cbee35f92ec090261407cc97c91
SHA256: 06093c765b1fd850e95808e12c23865a3f084e0395bef09669ddbf829986fd99
SSDeep: 384:9lrpcWjFxrlePcuAtKOoTDsWlHV3tJVTMUt3XrBTt7d5Wr:9Vp5xrUP7AwxHhhb6UtLBH8r
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1029\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: ee3cf0f25cc5e11874fc6345e02d6983
SHA1: ef47cb715d01ca799f4094b9e11cdf0ecd9beef5
SHA256: e978b6ce8355077cdd2970736d754d447bfa4894428b375a30a0728599a62547
SSDeep: 96:fTFCDT/d8i7kp/UHJc3Vq4MIz+mhZ51S6+d0SO7:rADT/d8JpcC3U+z+O59k0x
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1030\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 2e8a19b9e7cffbf3f3a01e3f38f1d8ff
SHA1: fba35cb6719459617dfc87ac8db02437e879c18c
SHA256: 41dc40afd18500e830e0d60aa5321ca6a6f06c6d16591f65be9627fa55da2546
SSDeep: 1536:kR/NuJfs6fMhuJpmc13jMt6QX09JYcVB/YY0WelWZM4ve144PnzvcMB1F2HkR56:kRQfyhGpr126rAa/YNR2c144zBW
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1030\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: c55aba0c53cd635d89ff3d860afbbcbe
SHA1: 3a2776a1fcc5fc9ae8e2bbe4233ef686466be995
SHA256: ec766f0062e0d8650d5e443493bda5d0c599ee81fbeac07166d1bfb5d55f8441
SSDeep: 384:jRkvdCHpWYIQ/ZUhOVJ/58vbyIcb2VgUNXhXb5h/TFcE:jRjJWO3JSbyJMXF7/TFV
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1030\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: bd095506f73e1acae132937f6e1431a1
SHA1: 96fc0957ee73b7840b9a8eca3410cff665407517
SHA256: f6cf35feb4d6f0eb642c4df77a30a1daa97732c59ca93d706ca55fbc2694b57a
SSDeep: 96:78cPQY1/C4A7QjSH/XL2u2OrfmRQ3HZh2a0r7:ohY5jiQjSfH8ROh2L
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1031\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 1391d77da5876aeb551be1a2b5cc7af2
SHA1: 969789f8a2730227c27dd75a4555351db787ee23
SHA256: 00a83188d4d6d0cb6a414e1a6eafab7af026867e2af8df16df9ee2dcd5964be0
SSDeep: 1536:B8u15xxUwkj8hNY8K7D2I2r8gAR+HDbJcWWAywxrPxO5TK63hg5tG:B8O5bGj8jY8K7CIEPJeCrPA5e+g5M
ImpHash: - 		Access, Create Dropped File
Malicious
C:\588bce7c90097ed212\1031\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: 28fe93b489beb6b238c5ee3fdfbdcc62
SHA1: abef89f21b5d278bcff2e004ca9faf1ccb3765f7
SHA256: 28257d55b7cf8b250d7d13b92fa559f228ec17eaf6114ca5b1066e61baea3dc1
SSDeep: 384:ZyxljuTkxU2tG+6Kxuv8mlwo3S2oLcrM1EpgSoTV2HETw:ZyxFuTkxniKMxwo96Z1EZj
ImpHash: - 		Access, Create Dropped File
Malicious
C:\588bce7c90097ed212\1031\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: 9f8a547a124953a742222db6f3f9c6c1
SHA1: 18ad24f3d63098e7edb91e12ca2843cba63c2bc8
SHA256: 4b9a93c3922c2bc1a64668637ec43be03a5d5f0a44adad202ec2b13e1d01bc17
SSDeep: 96:hif80y7KCpgkkLbaRHVL1F07FbC9vfLt8ngVh7:hif80yPpoQVL1y7Fm5T6Kx
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1032\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 1292bc406068461dd5745f894caa8648
SHA1: d53bc6758555f935c2912fd50c811ebc9b592ab7
SHA256: 262aefad8a3fb3070574a6b83348d701d518f4017d8f05c060647e1bc26576ea
SSDeep: 1536:+l80pM/VGLKX+AnbSUzcxx0t0LiidH+fIw6/3JK1u0Ghc7+cCNpKI267sn0mReoX:H0+YKpb9cf02zdH+fIm1ujhW+cCNpLsF
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1032\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: d16263d62684f284df46b6add58d83d7
SHA1: 9a3db30f0dd3ff96bb8d269d8713bd056b9ac7e9
SHA256: 4f70ca7b44954a4f3d63d3151e2bd7b07c83983c89ba86cb7e02333ba77b11c1
SSDeep: 384:ZtiDgeLLaGXIZlVp5iSa2YLNAiAkx0y3CrPKgiKdso39OCZOz1yptotcsAWdh62T:jGLLaZLiSa2YLNUKOKdqx39OYK1yzdAb
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1032\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: adb19f5ee7c0f16540081b029bbc059b
SHA1: 873405a182d4f68ab248c3f6c9e49e1fc30359db
SHA256: 560480b7e6f95f4bc94f0a78b848a68a708fb4bdda54597e0d184d6cee0307c3
SSDeep: 192:IonV+7ipWB3AAB5+GmI+8J/4Rhimy2QLYu:uepUnbJmI74kp2QLh
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1033\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: fcd3a33396328ec8cf98655053fee6c6
SHA1: f9e9fad538fa20e889934e1bb6b2e090cd65e3c2
SHA256: a2ba818134a02f4c2c5655f0f11555a7242ad2556156344f27a617152e357ae3
SSDeep: 1536:f7dqI8tDhPn86aMOo7jmVem4WSOZ1MZK9oLfiz/jf2Pa//IftZdngMjb62aA0:fgI2P862Cyem5SW3Mu/T2y//s1T2/9
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1033\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: 0e018b4543aca507998694b731794fdc
SHA1: b5bb2fff8cae6bd36c54d325100ffc3a20389e3c
SHA256: 5f1a651504b2b06ad7be19d62db7dd9f252fecb98707f24afd2c96b4d744d1a7
SSDeep: 384:Dhp4khNkGbfAsX+uQjSYTArmuFFQAKDGdbHbUjA:7LNkQfkuQjSDrmuFFQkbHbUM
ImpHash: - 		Access, Create Dropped File
Malicious
C:\588bce7c90097ed212\1033\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: 4cd43e156106666187cb3dd1e25dc42a
SHA1: d2263bbbb5f94820af809ab3047a800d627f0000
SHA256: 211848f0a8b6f513f1b06314f223688be2bc4f55fdff21774005b7389eabb7f7
SSDeep: 96:ThqGDZYUL5kHDlSZsafsvmKgmhSgquQPp5mWHlQkr0ui9N1ik7:ThXDZYUcJagP2JP7DFTipiu
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1035\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 4d68be0c807fe4b84cfa6f011302faf5
SHA1: 91651a7e8c997b1d31638402c2e2bd5304b17b39
SHA256: 5ab9847fe76fba0251f4d27d38503fd6fb7b2da1b0633c2f4b4c4c983bf6eef2
SSDeep: 1536:JVjWn10+ED9i14sxK9OPpaGZukm6QoBQb77fTXS9li6uHcYjU/YwrD:JNW10pEYmEuSgBY7jTXQoHgTD
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1035\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: e0845f5568f37c0bc19d7a2b914c0697
SHA1: 57c7f987fce1e7943b5bae5a365d1b8edb656c5d
SHA256: 51bc96235a46f5ffeb389a77d209d49bd90968cef2b460d99635917d425d50e0
SSDeep: 384:avFcdaY66bYt1X3LkB1csOI6mgLmXJ2TsM1zyRQ4aLHfhFYJO5:aCdaYRbYgB1csv6t6XJ2TsM1zyRQ4mfx
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1035\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: ccabc6e676d5fa02cc8f368df9e33131
SHA1: 3bee5cf77bf8df3c17a45ee3e2da2ecb6210dd0d
SHA256: e0f9de55ad4aabf7cd03c1d58e037a19716729fa6def1ce75539423e5ff321be
SSDeep: 96:lIv1rj9lxss7NvbPUHMSY7WWkV+1KXAaZGP8G6xfm9rg7:lIt/Ws7N/MgBv8Rxfm8
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1036\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 42cae94adbd7e8590da4adbe689c2776
SHA1: 44f03a6eab38c7e5a2deb9df7fbfcc3bdbc7b8e3
SHA256: 660005151bd417f8725328b9992b23035f8ff7da0c05c61508dff147e98a7350
SSDeep: 1536:t8j28ucX0IRsv2xcvZFaX03CzLutAumhl6TatjqtTOPYL1PH9:t8jJp9xchFA03CzLtn62CaPYLf
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1036\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: 171b2a6137c0b0a4e19d5078b1aca804
SHA1: 4ab4c0c145c34ba81f35c76692db5aa1d489e614
SHA256: 2f1a526c433e316c63e50e9479ed18e26eceadfdd3a67bdd2aed0f0cd626a252
SSDeep: 384:FZO6XmMXdYpkOWO9b71+Jmltlz9PlhvZ3BvQBwFW39Qqpa/:yGLXdYpeO9bYstlz9Pvr46qq
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1036\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: 74c9c52bb29d5ce166d8c6cd9bdcd0b2
SHA1: 7935d00a0a027736b96641505aaed63c2089439d
SHA256: 0e735d503862610530b6d251703eddc6dbe18af5165badcfae6fd3e501f84a31
SSDeep: 96:gZYWZsoZD02wySgafdzlpVv9d6BYIZG8uRyKGriS0qY+h7:gZYsl03yyBrFd6B7ZpuR4ZxYA
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1037\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 5dbd14d3d9386923d14f587822e7c5c1
SHA1: 252c4e4a979cdc252e7abda7eb2c814094fe56df
SHA256: 8cfbfde382006ca906636b4dd0741ad50bf97aa012663dc1943254e1b26f55b2
SSDeep: 1536:6LK56a8WvyWVCINv8HpgKzgWCpis2hYat//HjeG8PNiuXfGPZdKuZEusCfRLl8bc:B56azF3yZCpis2iat//6G0FXq/KuZEcx
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1037\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: 15e89cc28b1fe83d307be0202b3dec9d
SHA1: a875927c326d34cb2cfeda41fdf900793fd7b150
SHA256: 4c22351b6777a00332326b8d23e79c131cbe7ef79570c8ca005b00a3c6ec48ee
SSDeep: 384:4wm0fQxTTC/pc9jO8Eask9p7qgRPW6rgJ5I3vdtxAgtE3m:fMxTTSkANep7qIPW6EJG7xxOW
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1037\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: 708dd06554a5a0b0c0d424d7f429cd6d
SHA1: 269628d37b6caf14d2be5f80560bcff688d24cc1
SHA256: bd11f62c1dea3e0b69743dafbbbf13c4fd907b2c0fe491ae0ef68c481d03fce3
SSDeep: 192:4l8f6s9r0xxK+CPsGZ/3cyff3D8pL+mLU/kwNTrhwN:f7sWlM8fTIL+mLU/uN
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1038\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 06b8b1b3d53062b2bd7b86535ec5241d
SHA1: 41626541ca7b037ad28c9021f7ae38c8a21629bf
SHA256: 33566151aba03a13b2f6e09193b91f0772e147965720b9c2b7b7a423b7e99372
SSDeep: 1536:+/w/mDAJiOVwoznm4hF3YeDjB6iRSjSzWR7kfADvY/eiW4gJFEexdm/Uw7m3:+/w/ircwoznm4hFIshqIU7k8vSoDEezJ
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1038\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: c14e19bf0bea9f0386bca88908deb967
SHA1: f5a081892c4e156e48b51024279ccfcb9c00aa3c
SHA256: 49b280d7d08597aecb23dd3f12ef56b9e118a407c40e100ec8260fa2b78ed066
SSDeep: 384:rxFPdnNcLVuImQYZhh/jgjjbO+4hiv5FxgTbko6tFsoyWcsVe+pC:rxifmQajgPi+iGFxgToo6tFxyWa
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1038\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: 2aea894ea56ab5bf26ef4465f04b2c0e
SHA1: 5e001d69eb9c3f2f13667fdf8852fc8d32e32d04
SHA256: bc355c1a0414d9265e9b927d033ca614751e69f064bce99549278fabc6209be7
SSDeep: 96:dGQ3xGu6AWE0oRJ9f1I5d+IQOJuL9Rl8UWL2T6J7:HH7I5d+i8+NL2Te
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1040\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 119fb1100fa64ba34d7c9efbac8cd302
SHA1: 5ffd0bc7b2350c2191f72edf7019f1f38524e5bf
SHA256: 5790414b9193c2bb6b76fc59294bd51aafbeddfae03722808151f8af0b57f8bf
SSDeep: 1536:Gr4tw53AqbG0koKSLtdtRXjNlk5Tvl4qOtL8GYsO1D2JL5sAiYgff:G0t6A+G05KSLtdvjzkxtVOPjO0J9sBY2
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1040\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: e06e65460bfef576aec926d538b176bb
SHA1: edf985730aa910b525df681d38aaffe12aadbe90
SHA256: e5658326d58371a167cc7bd009ababdb6dea1139919c2234849611f076be439f
SSDeep: 384:jO5N3pw06OrI69B68/W4dwRSG/WChTwc7eOji4dUy5U9ADhOsQD:GNR6Oz9o8/7+EGTwc7ekt0D
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1040\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: 75f4e738abca0e22480ca8c6339e33c9
SHA1: 9912475f2cf385161b43de783f4e5aaeb495c5dc
SHA256: 37ecef55dfda977a429883e6cabd0194b68fa0e84b777a1b5730c0bf64f9879f
SSDeep: 96:oRyfWuaNc78MfpOJOEubja6dRuYorMWc/nkn0LawG7:oRyfdic78UOJTu3a6aY+Mbn4dT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1041\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: de9e5e9175f12234546f31e3d3a3adb2
SHA1: 27ed68b6dc0d48978c417b5c0094f504473ae15d
SHA256: d2f49701fb4c86693bf1ddec4d306601305c480025a773029c2190bd975ffbfc
SSDeep: 1536:F84Woh04kzIgHgjbrtbyHcvb+zrql608XwdRxZTwIUVG2x4:S4W6kzIgHgTtJvb+aY00wdRbTwIUm
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1041\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: d5d708204793039492dd3982e8960c3b
SHA1: 31d68376ee3bba6cc984df6d3bee65e4163aca9d
SHA256: 5551e2bdbf145c1edf9871ca6616bfe3394aab515c50d58613777a3b800f2a5a
SSDeep: 384:DJ9VUnm3nPreRNQAOWoXTJyO0Lgg6TPiGy3RxDt:l9VXfreRNQAFoXTJyO08guPiGMD
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1041\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: 5c43adfc9f4ed341882cafa35a2b2adc
SHA1: dde27816560578cdcde03e941b3213267e989687
SHA256: 61224e499a77dde3c149edd66d9b8aee6e7d7881cb128802d08f19bb40f27a79
SSDeep: 192:QuZp4OZ+XLVGwVtKLXGBccPEF8asCWfcdTD8lB3wPZ3TPVx+tq23MW2Uk:Qu3qcoKSBRPEWZPcd383qRx8tETz
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1042\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 1e1d7873d4e7072c797d40c0c9213436
SHA1: 0423b0569d19d5ed7d16ec523ab024f943f2140a
SHA256: 4eb21fffb69af435f1359a208523e4c4c2b0780e19bd1df5a9cf948e8f67912b
SSDeep: 1536:pLxg2uNKHDvWpWWwJe11RlKWNInS8K64IzSDNHSg7CevxlEF:pzlDvWpWWwJI1RlDmn+xYSQguevxlc
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1042\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: db766d0227f7996a1e3628de005bfbf4
SHA1: 03e07e7fbfcf3afdd7cb9298fac3b7359312affe
SHA256: 5c0f7adc2f9f8d767613548a0e202f8c5e82104d1a921253fb18652f6bbe531c
SSDeep: 384:/vge7s1r9GCw/Rf4tPpJndDQ2EAuHidPAYXMsMvrZAS/Q6w:/7Yr9GCw/RAtHdqi3fMvrZBo/
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1042\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: c5eb84a457b16405ebdc8b4ef3ec73c9
SHA1: cdb06add86800a9cde6f90b68b2cd342806380ba
SHA256: 0e904417e7d238bda3eea82e40025a3d2bfe362a6e19d7610f995a08b63235ae
SSDeep: 192:ay+JG2j2Dd7DdV4xO5tGagSOrw2dzabaWKkFYoFzE6WLJExEnm03dIPpZovmrHgt:aym7iDd7DKjS0yqixAAv8ftLReUDb
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1043\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 0f9fdf5d50c003f3b9674c48c254b076
SHA1: 6ae3a5d4bb44004f8cfe55667b98a75646783b6a
SHA256: 5fbfd0e82bcf33ae51e54a3315f3dce27c5c9f4899537313e60c1f7e3141404d
SSDeep: 1536:jNf8kWQY21kI2JJ1LB5smL1zllbk1cSU8zqkHi3QJ5XrLhYumMzVm5Br9sGApZrN:jOQxnevN5rDbk1cHULuQjPbwApZbZv
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1043\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: cce2b1f590e52f2d8c902ef5de3dd65e
SHA1: ffec6e0827b8d8bf58eb50b09a0a7b1e65a2326d
SHA256: 536f9941d43252c6b6c9a639a928ab71da93637fdbad7f454d017f43ab014a34
SSDeep: 384:3P1fh/RlSuTtPxjVL9KzUNhuHlFjBOB3PBE39oVYPrdwtRcJuDPfkSY1:3PZAuSzUNhuHlXn9kYPrdwtCJuK
ImpHash: - 		Access, Create Dropped File
Malicious
C:\588bce7c90097ed212\1043\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: 9a6acf8174599f8ef563151160c13568
SHA1: 1c9ca5488f352c6b8bec7a4b99b7f2671272a547
SHA256: 65761ccc79ff006163047ea428ef8cd54d04ed3e6c7c3576c0c47c5640f12dc0
SSDeep: 96:juPu5VBLIh5jiaD1CidIQMQMbA+CSVTI7:jRLyxCidIQMfm
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1044\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 18ac816cda32def2d7b3109307b5ccaf
SHA1: 164b838f4985c705f070945c15e9b826d4dccc20
SHA256: 7d65de098b62afdd14514a91e4d409dfeea9dd9736453abf38aeda14229a4a54
SSDeep: 1536:Xjbzsps9LLtCXUKpz+I9qEOdceHVul/Ork/XvcxLOTxlJteOjEr4I:XjvyJ9qX1Hrk3AOTxlJtPErv
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1044\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: b5163fd44fe2a44eb61e50a77056fa8e
SHA1: 7fa2788402980eff11a9e44102c65cdbc6609c32
SHA256: 4ac4535ea6725f51689665d6eabb13b9caba5447e1e69722140a1f71a677d465
SSDeep: 384:i4UTuT/chTd+buzyuQbDH9oyjBl3hl+KPqptCtfzvCK0w/vX:i3mKCDdoel3KKYMCe
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1044\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: f91ad9c4edee8e2821f69bd0f1ae6dc5
SHA1: a6f24d4aed58bfa37b22de341c16b7cca9f2b1e3
SHA256: 021bd5cd9f45126fbb6bad77d5236c992c75ebc2055369e9312c0f32ea071495
SSDeep: 96:KPhh7Au7eGMP9FX4HO95rlRNKYWIZbxFOhUyx7:KPhlACeGMPfXx2zIZ9FkFB
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1045\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 18e1170ccae96168afa7a6a5e1d912c7
SHA1: ddbf6da9108efac092cc3e14edb3a5a5c2e1f84a
SHA256: 8acfbb9530f9f5a8694ac8b377660726471201330a729fb40f77271c6f8d678a
SSDeep: 1536:XdfHZJt1HnbwaRvpgALabBL58a8N8XUJHfva+A5vfVW/2kFD+NR9pK83n:NnfkafsB9Q8XUJHfy+mfDMyNRnK83n
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1045\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: 37e6e376066813029952ecbb14feee4f
SHA1: e61f625045f49894732b87e0e22e8e1aca709a88
SHA256: 473f7e2d6a319422e60e8d475df112fc032fc0d47be469ec656bf3843ab48901
SSDeep: 384:LfrsxvKU4xhQQlvjoDtqIAo6De/0nVTUXV/evprHAciDlxJ7VIjGnD/NnvE:LjsKUuhllkRqrDUNhcyNVYv
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1045\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: 5302d570b6688decb2a50c6492b074a9
SHA1: dbb12dd02e2d04accfb7aa44d960f83c033ea169
SHA256: b572a33e4334ea8555c639e11645e8789c32000f12fc626182face8716a45f49
SSDeep: 96:pyfwtC5rkn9aZsJA7J5NEuHgqW1BhKn+qeSNr57:wfwAUQ7J8lh5Pg
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1046\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 0ef5fd770d6bcdb76a0c3c70f11eccf4
SHA1: 39f0ab5107545c4168051f27f402fbfa6209926a
SHA256: 01e33d495a687fe0a4af9860b81d9af1ef2973d13f09bf75e6f731fdef4db2a4
SSDeep: 1536:o3/lMDn4ZWo6QcjBWi8D1tIVS3ywJE3y9B+6qXZYGYM5Um6SPSsnH5YPwnS+ei:o3/lMndoRclCDvZT+6qJYLZSHaPwS+ei
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1046\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: 9bf74f59e7539c2a20b81476310c863d
SHA1: 02a30f40cbd99d66d4c7bb0f10aa18694c47bf97
SHA256: 6a446737694b76cc6950eff12975654fd326b5066e0502b1bdd690e38c5c714c
SSDeep: 384:YSQjy77xNgr9pflP2UqjqqiVLn5wgAHzBj2n24WdcpibCxM:YSZ3xEl+UKqqs5OLJkJG
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1046\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: 21ec3845255b8f0c76a2dd68480cb56a
SHA1: 7b7d1eb1c87a1526cbe183dd556d45186d68c563
SHA256: acebcaff5c32a0f556d39166e18c01eec7898bceb1aaef7d88acf841b4beb078
SSDeep: 48:grhEHL//DTNeGdefY86NOBENh9oIc/v9HbIkPz0jmHP5+tCN6qBWQZtlpcg3XuQP:2qLnNBew8IyNHbyjmHBAcTyieKvwW7
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1049\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: ddc3f25fc2136ba3aea97b0d77cff226
SHA1: e9b0b2960e141b378ebc58c5a9a5e32b08de711c
SHA256: ace1b11294b17e710b395f32c5f95725d91680239c1381c217e9f0d9c3457457
SSDeep: 1536:Znlgi02Ct1C3CL7oQnOg9asMOY5f4a1gfTCAMh+4Hvw:Zmi02CfiCXoQntEfOorgrpMh+AY
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1049\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: f9065d8fb444e835823d009e97f78458
SHA1: 6423887cb640be9c724dbaca7ff46ad52ae98a4b
SHA256: 710ae6d24996fbae14d2f879e2a7d9dae347c7ce751cb9c2f7319940089ce998
SSDeep: 384:O4Nti1NzPA8g0E4hnCD88ZNy5HB9NhKHo2DZKvpEVXrnadHN:THiv48FhMJTYBDhKIBvpIjOt
ImpHash: - 		Access, Create Dropped File
Malicious
C:\588bce7c90097ed212\1049\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: 198889b258446ddb2218c408bf8a05c9
SHA1: 5e5006d58c4829b84197b36aa3bc201541f5aeb6
SHA256: cbe608e7abb9d22d414a563c28c1f8f3411561852732907ca5a369eea200a2c7
SSDeep: 1536:sqOAFyUmNxd34yz14994ct0QNsipLffmZFcWU0M:haHd34i89LKQmi1WM10M
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1053\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 9655fbf4433da2ce3a7d032576499354
SHA1: faeb410b817e9a915a9ac4f439f98baf41efe162
SHA256: 44da6ef0647977378a573c74e2d8d8bdff7e87ab6af89921e7d59908cf7753d1
SSDeep: 1536:FYihajiZ8rrkKwZ2lw8Hmk9YwR2GprAs0eWUe2mSQxLPizO:a1iZyr4Z7M9YYj/0DUe2mSmoO
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1053\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: 98d8535e71e2e71f3f5e1b86f1677844
SHA1: be9ae1dc74a6c42991a73c21a98ad306d24a65ba
SHA256: bdf8c0c3fe0fb8f73d412da94372a5ecda6a54c028d28ef604b00c7e6c9f974e
SSDeep: 384:nqtVNdQ8pQDSxJZ6B1B6bYU8NGWpM2Ps14R0zI0W0BO:nYVNoeiv6yAWS+sgN
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1053\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: dccbab10061afb9c329536971dd31aba
SHA1: 5ce8f457f3a87ad4317dc295c1167a98e37ca8c1
SHA256: 72378dfd0849ca75b68a6800c15593fe8e71d72362256b67e3f1d18ba77c83c4
SSDeep: 96:7tIZFX/sNu6Iz2TU+6JkZoa+OGK/P1/N8Fxso1MFSCJjSe1O7:OLk3Iz24K+fKkEgSSpe2
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1055\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 4d95a03a5a57a14226a5d80f19e05a13
SHA1: 8b30009368402d5099750cfd23877ef6f2fc3426
SHA256: d294c53564a71d9b8dadc2fed8ca92b03ada7448b6495471e02523b75f8429b4
SSDeep: 1536:hScKBstI+L9rueWzTV/1dwDzY6xyE11+HZ7AIjOkqco1aQ1IiQW8jfRKa7X:ha6JKBzTVtaD/4E11+HZ7AIFLPNiofRp
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1055\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: 882aeb62204e0490cea122a39659860b
SHA1: d3b5a04a7aa1faed56e4a339b8016e5bf3d7d2f6
SHA256: 0349d7388590503c6276093febfa96fc7dfa9b4c49c422a6bfbfea3b5f1f0914
SSDeep: 384:gnTlE2LKfdozB46uiV44Na3kn/H27zFmn7iyKENpnv:cE2JzBDuINa3kn/H27zU7iav
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\1055\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: 9dd53ad6838123d2ee699daa3a4f905b
SHA1: 7841fe3402676f702cf94e25887a569ce6867f1c
SHA256: 5810b4a1f8e0c1718c8a28b9ec6b665f56c4219accebffe7776ad08b60232511
SSDeep: 96:o+D2htQYtA8LmkPHdm8fHDnAi7Wxk6uZxMauf7:oe2LQYtdSkP91HDnvqxk5Eae
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\2052\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 837f653b7ab0cc459925bea17beabeb8
SHA1: 7532358614681f314a3cc8d573dd991abf2fd5ab
SHA256: 9ce92931de2b135ca6887f14c0afebe387626aecd41e2e1d79dbb631a3d2a6a5
SSDeep: 1536:mnpEJn2AfDcjwfmd6cyEhlEHKjIFWrDiQcEyAcsmJHsIH:mnpoDlf2FyglEII6DSEyd3J
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\2052\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: 6a454bc7225103579d512c5440e687a3
SHA1: c55e5d89e968ba8c402e4e5befeb2b89107a61af
SHA256: 1bfcfc68e40461baccd25c39026f630f2f4eff0d250ee4c1033449f4efb07a84
SSDeep: 384:VgJoMwSUIhhWLVxXIhU19uw90ceuPZr7eeqxVMxEIL:koMwS32VxXIG19uwmlu17dcy
ImpHash: - 		Access, Create Dropped File
Malicious
C:\588bce7c90097ed212\2052\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: 4c6109aebcfa3ed9f19c3e7a780add57
SHA1: 0474d7f2fe9922612e4c1e2752c3cc70e178ce25
SHA256: fda33aa3644a81e4fff253cbe25f909f02fbb908a6110d0540c0e122589a264b
SSDeep: 96:sYsqyCHXLJ4rvqL9irIRQf73agjPzo6+D/T+Z74OehgzJQA0e5dmPn2yvbc/z4o9:j3b79ijugjPzuPq5zJQFu0Pn2Mbc/bsA
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\2070\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 596e4a661c3a3aca8d9f5d81e6d59c95
SHA1: b3b3e351d92ff3cc52ede718f9f3b6b456eb4e0a
SHA256: ff041c66f238dd9ab5883eb26c4412fdfe6a37c286645c2d0f53bfc1dac35c81
SSDeep: 1536:rCefoZ0cTwQiIKkn63fAdZ3obn5OTX8UsB3zcA7rB:r1fMwUFnddZ3or0TX8Uk3QA7l
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\2070\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: 8f6bf55e45eeecd81f4b07064569851d
SHA1: 33af0713b91bb43e58f7dafd926ad3b11d27d9d2
SHA256: c432c41e41813527a95f9c15f8e2b3debbb918842b02953ebe64b6bd73a43095
SSDeep: 384:wbW/6GCE6Lql/v5ftL47i04CJC/9yOgS3NpSTTG:l/5Be7ilMCn3Tga
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\2070\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: afc49b78548367b96fff08fb481273b7
SHA1: 347ed71b03ec55407325900229d8d67553318949
SHA256: e5fb8f69d531389f4a6ea3ba3c30b9b910b521780d9bda54909800c5a125b209
SSDeep: 48:kjkpv/MRbHyR3E7sl900rsBx/xYYlCQe0i77MIFROMR/DObItQs+Aqut9ozEPGGm:kjkMHyR3ZvNo7YA5ti77tfD5zasi7
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\3076\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: ed768c488fb4f34b5ff961d887679535
SHA1: b72b31166500d72e09f4cdb43b85fe308e1e90e1
SHA256: a202d431f7e4352656b0930e2a2b3c741d028df5a1ba71ea520edd8d3c29dd32
SSDeep: 1536:W1nONotGMeyexXxNLqaY1/nH365dI8q3gSSig0ntQRz:lo4Z33dIdsV0n6z
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\3076\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: a45daa82cb60ead5b9098495c8b603a4
SHA1: 5b996df547c3ea6821d6cdb0bfbaf5c83daaf9b7
SHA256: 0e67387605cc9ca95cec32d1bf921c3090b15e6cebea27e3ef0c8142d4612823
SSDeep: 192:v5arcg7PbDbr7KM2srgeK1Go1BebKAo3k4XcEk7Y3KVioGqyBcnCgt+gp6i5JY+e:3SiigJ1HhAak4Xfk74CN1zpRW+qr5
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\3076\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: ae769e8fb2c2864611346d1ffed77d89
SHA1: 1db01c6090ada14bab39199700078e754250e0e0
SHA256: 1277873ecf8c4cd52246d4076b272073663982731df3e50af0dcea76cdd9962e
SSDeep: 96:IfkWLHrueLBEIKRiCZFgbbkKWa97iIg+oQE0tgVClZySkDXvD/yfvfF+rPYWP7:8FL7L3FCZyt77iIg+vzg4lZyi+rAWj
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\3082\LocalizedData.xml.id-B4197730.[black@gytmail.com].self MD5: 11ba3936a4da9ccde4581997ac7ba661
SHA1: 12d9bf9334691203193746a8dab0cf3eb8cda187
SHA256: ceefd8eaa00105676d456fe4047399c10dc535d425a61bac6bc5aa15de48b213
SSDeep: 1536:wEAeYEABixAjDRrQLNymqxBTDtSIyrJcLGkJhCK5kLb8iuFs6mUdouk54ilQs:wFkhxAfRiPU9GktUbwpm354+Qs
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\3082\SetupResources.dll.id-B4197730.[black@gytmail.com].self MD5: b679276da28b454b0884781b768d42e3
SHA1: 5878564e6cef17ee39bcaa829abb452fffad9881
SHA256: 0a26c48c131b8746289d247aac0ebd332c37a46ed26aea14090c2e156e796315
SSDeep: 384:fYvI0fPa0zJJ8QrfPdVbTjE5GDbDA3tXukcgp5rrtyO8JPPLLZAORad3iSPldk1e:wgAPZJ80fPdVbE5GrelDcaAO8Jh0d3lf
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\3082\eula.rtf.id-B4197730.[black@gytmail.com].self MD5: 49e3e79188e4f06d5c23c8b734e6da32
SHA1: fa8b9a68765d482cfe2e329957f642bacdbf77a6
SHA256: 6e046ceee9a9d609768814d61cb54adcbcd602998dd53d8702e003b814ea06ed
SSDeep: 96:Xr0NeWKYQTus2co2HSxSMDKIT4xpOCaNw7:7EefYXfRmStDmxp0N6
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Client\Parameterinfo.xml.id-B4197730.[black@gytmail.com].self MD5: 0faaec009340391b6fc61dd023e7eb30
SHA1: 13c1ccf92512e3b7b104005fdbb34297ef544b39
SHA256: 4d4f51b1c613ea34d10758a03fff3b6625ae19bf709c0615650bceb944aaeac5
SSDeep: 3072:9oOFDhoUsMC9KpWu8uVBo4ETUkSsCYGqfhmlSQnXpwri76UrEWXrlcj2EWeQaNuZ:99DSM+5LiYnsjXpwrCrE0uj9WeQtZ
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Client\UiInfo.xml.id-B4197730.[black@gytmail.com].self MD5: 4b8e885266a01114048a30489e4278af
SHA1: ea81c55780bcb75073a9ba8414483250689ad048
SHA256: 018c8ce75170518d6c0c632f2bc1396862752604714f160aa109f90ab7f54130
SSDeep: 768:BO2u4IZ/BkDD6K20+YLoVgxLCROhXjqvvUaLBqkuyA14tqIvJGozn:E2vIZ/Bkb2HYLtyOFjqvvUaLkPyA1+Gc
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\DHtmlHeader.html.id-B4197730.[black@gytmail.com].self MD5: 545dd451312e35e27341efdbaf7fa465
SHA1: 9e780c2ddf5edca889f8896ed4ba3e33cebb5bbe
SHA256: 197963ad2d3bd9884f56adf9d52deaebca8a062923417a2cb0df90a6816da199
SSDeep: 384:AjblS8UJSDHPCdoAs+NhRKG+E5E9jeHGqwymIrOpm7pj6WUZj/AG:ybk8IoMNLs9jeH2PmlcAG
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\DisplayIcon.ico.id-B4197730.[black@gytmail.com].self MD5: 194aca0fd841d030d660bd0d1cda1c3f
SHA1: 2d26e642c4ab9b899c9f58d9ece94c58615a671d
SHA256: a796230fbb2dc70d21712a0ce1c722cb0c400702a7adfe64dba0a8416c9fc24a
SSDeep: 1536:BJ9bDma9Q/4z28rHltYMbLE+2Vqg1GozbLLIbCV+WIJQJ7rh+FDEB:BTmaAqZHbLEsgPbLHIJQHB
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Extended\Parameterinfo.xml.id-B4197730.[black@gytmail.com].self MD5: 6d63cdfafeb4b7e45268afaec0b0da82
SHA1: ebd729bee53f3cb7a3b9ce180c094dff30370fa5
SHA256: e9b449d16f85e536a619aadafd4479d1f1d039a9f6344a623f50987e74a5f87a
SSDeep: 1536:XBucP48dbIq7JJMr+3maTYbLW4hhHCe+e2mAqYCVfVjbSBj3z22RA6oDvJIMtD9/:x8mfMr+2qWHHymAqzFVXS5jY6ojJt19/
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Extended\UiInfo.xml.id-B4197730.[black@gytmail.com].self MD5: 14819862ca113e4fee7abb5d72cd7e97
SHA1: b16a6d929ccf22eebe646d12308bf4b91e7ec550
SHA256: 2702006227bcf9ba09f7aaab84505e88261a0cfdb21b7c78bea80e7549bb060d
SSDeep: 768:aWjn2B4l18b8JIiye2zEy8F5cVAMY3qTMO+cgd4A/+NpQtQWTh4KECE0mSe:aWj2B58nye4EJ6tDT8b4E+rNI/y/
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Graphics\Print.ico.id-B4197730.[black@gytmail.com].self MD5: 3b77f91685b9abdf4bb6214b4ec836ff
SHA1: f61cd6cf61a9af91b9668200664ef630e513d4a7
SHA256: 6e3ab2ae8744d5035f8c375de1c4149b80ba521673c04c372fe351fc1be853b6
SSDeep: 24:TB3kFzwEsbjxajw6TYCVIyPoToSykN3DTQjU+LrJ8uzQCIygbXT0WCdtnWzHILlW:F3k2Esbj8jwdsCToSykdDTZ0rnFgbXTB
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Graphics\Rotate1.ico.id-B4197730.[black@gytmail.com].self MD5: 8a1448b977528b857d543068c5b617ab
SHA1: 59976a11e3dfdef7ebcc1c26fb468a51d3c53132
SHA256: 78194c2c04cc80ca713634e76392f3822a7c329e39e7a35b371b119ebf7997a9
SSDeep: 24:YduRjF31arx5fkwqb5Cp4TUn4L1vftl7N+XWZRkILlulwH0:Y4Rp31ix5fkwUWn4L1bN+GZRz0
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Graphics\Rotate2.ico.id-B4197730.[black@gytmail.com].self MD5: f403ff7a587c32e3745313b5340c6268
SHA1: ba5393e641526749656d598ac6c65cd115286e85
SHA256: 6ee54d775d7ec9f6ccb23e3a69737b6c6039101709747f7f0af7ab9e4f8e17c9
SSDeep: 24:oOU8znLExv7q8WjDwEa+CV5IioPK53HDXcB9ILlulwH0:oOUGEx+8SwE7Vi4K5XDXcBU0
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Graphics\Rotate3.ico.id-B4197730.[black@gytmail.com].self MD5: d22cfbfd6dc4ef4382f33ed55c731cdb
SHA1: d3be364ec4813fa2f1fe39545cfc30612cdb4863
SHA256: 32f82022bca9d57cde78d61fc0e40175844433e3e1c1db3256a12992fd2bb194
SSDeep: 24:H8sIqfRomcUC+Gt8xZJpJyZWTX7Llcr8SYDQCU+ILlulwH0:Z/fRgUC+HZz0ZCFcr83Mn50
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Graphics\Rotate4.ico.id-B4197730.[black@gytmail.com].self MD5: 3298f2dccf2364b2eca5056c7b98aa53
SHA1: dc7608e328ac5ba23c1c772b37a24cfeae705dc9
SHA256: a6d0deac74bf59ff29c4847615a813295ab15541a1194c271577af7460c67571
SSDeep: 24:IGcgbXLKUf6jUDpQFdphIgJgaGAoharRpiuyJ+ILlulwH0:IGcqLK/+WpuMgaGAoharRpiuyL0
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Graphics\Rotate5.ico.id-B4197730.[black@gytmail.com].self MD5: 2d1c37e6b7b69abdc61359d9fbd1b79a
SHA1: 56326428faa4e61fcfc9aeffa933b5fdefdf3975
SHA256: c9e79048c1b70a82e4033107170c7f7e96b3d338194c7a047a6051bf910af878
SSDeep: 24:5VnU+fvgf8eP3IZ3YQo9oGhHnooT2Rt7dj4X6K5SwmTzILlulwH0:5hU+BUROGHnv2z5jnK5mTG0
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Graphics\Rotate6.ico.id-B4197730.[black@gytmail.com].self MD5: 446233d9f05564a8cf009293c0fefe9e
SHA1: 57df0713d774dc5065351703d85dbed34f3c868d
SHA256: 0a9bf944f12a1db559dbd601b30b41b423e8e8804732aeceef5c762ab0e750b7
SSDeep: 24:G9yw77Dghe8Xm1BxhcRQtVAXT64EODtDnGJSLwHILlulwH0:GIw77DghePTrc6bQT64EODJn2SLwq0
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Graphics\Rotate7.ico.id-B4197730.[black@gytmail.com].self MD5: eec8b052c6591fc830017fbb1dd1db53
SHA1: e925abcafd450a5106f21cb0e9c03c2eec9231b1
SHA256: 187c3e380a3e7aa294e1faa5cd6ad03b1634b2789e2fe51683ef098d33fbf997
SSDeep: 24:USEKCET4M7izL4ZeEd+9Ydn6g9TOi6YUjSt/cILlulwH0:U7GiX0QGd6gOPzjSF70
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Graphics\Rotate8.ico.id-B4197730.[black@gytmail.com].self MD5: de3d1ae12a70af82e075aea61a0198b9
SHA1: ceebb05f85fb644f44a19f1652862ea076e34c70
SHA256: a3968406237d99376c4f1306de43992cbeb90323cf4565bd91c9856ea1c74a9a
SSDeep: 24:CUoEmX5suC9qEirRm/Y06YdMmaTifY0jw7TctBXX810rsYILlulwH0:CUfIQ9qEJ/ZTLjjw8t1q0
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Graphics\Save.ico.id-B4197730.[black@gytmail.com].self MD5: 725726b233de3ec904f849afe30604be
SHA1: a13dab17436f5b141a7ad08eeeec0d12100db1e2
SHA256: c8c84964571d1e7894bd33f6a3cd6c1488ad0acbeb7ee7295608b7c872903198
SSDeep: 24:0ylROOPsWZbtUG8qZWSYGhe8+mo64t5wkSDZGnILlulwHy:0yROPW5UGlZWSphe8ZZGKy
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Graphics\Setup.ico.id-B4197730.[black@gytmail.com].self MD5: 635d89f78404ffa911b569fdc7814ff7
SHA1: 6d8f5a55fd3e5730eb9673f4f38d9a64af49f77d
SHA256: e95b322bf4de8bbb419b0ebe68ad8434c070edca5afa9cafd62099fd4a3d7028
SSDeep: 768:84r3BcNfTkiQdMEOSE3bcxXYMFTBQgJ+ahEB1zIdW:XTBcNfTDQdMSX7BgTd
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Graphics\SysReqMet.ico.id-B4197730.[black@gytmail.com].self MD5: d6f516e79268a321e386fc35f8fb4350
SHA1: db89a2ed9883f836f3fb26e84d3da793286177ff
SHA256: 79c20f6c817763f0d94c21d0121e03be14b84de616d52b4e33fbda682758f19e
SSDeep: 24:f4JW97AlOLSjrFAuH+HjTTMM3WsKF2VIV8J0abh1xR+EYbT6iYTKYbiILlulwHI:wJf8YFZ6DMM3WsKXa91zXYHlYTVbtI
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.id-B4197730.[black@gytmail.com].self MD5: e75bb72a87e20075e87f564efbdae734
SHA1: 70c810f8749683c8bd2d5ca58f9c25d528732c11
SHA256: 7db1a0d973c0b9437e72c56bb7c2e05f03ef8734183735dad03d4f305402e142
SSDeep: 24:lL99Cgp3J77ESwWHNTiZ/KnzrUcjnXtqT6MG/x0tAaUgsQx71dsHILlulwHi:lLmsFnzHNTiZ/UHVjnXtiGqtsHy7Zi
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Graphics\stop.ico.id-B4197730.[black@gytmail.com].self MD5: 9b1657adc776c1e58f9fee8569f0fb07
SHA1: b2cebf237098fa203381354a7c8385e9bbbf4b2d
SHA256: 432dcef6063abc569a1d988670f1afcd67e632609d172e4b8da093eaab309c27
SSDeep: 192:CYtdOSyrE6Vhfl+Qn1XAkHpXYMM6BBTM1BpMURAPP/BUzC6mW848kAyB:Pkrr9VhflH1XxpXYuBBY6RJUW+8KAyB
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Graphics\warn.ico.id-B4197730.[black@gytmail.com].self MD5: f20cee7ce97871f595ff5a5b8301d999
SHA1: 81f6696255d64d4cd7a9551ddba0a7c32c12720b
SHA256: e79c7c98970e8028143eb5804f0f1cd5a9fce62687fb822188ddec807fa2193c
SSDeep: 192:enJBQw/TYMxfN0g9A6apBtEqjoPYMZ+ra2rCYEahM76yrR9:2BQwbpVNE6apAqmYMa+/l76yrf
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\ParameterInfo.xml.id-B4197730.[black@gytmail.com].self MD5: 69ff7057f0a9af73382466654f8b5039
SHA1: 02aec91e800bbe9032517e28910b2c1a442185a4
SHA256: e51fb30e0d9192f6976d530f7f3bb7f00599927e28fe5c6eb48a1e224a427753
SSDeep: 6144:Zk9bI/Da7EH+DydRA/7CQOXS6ptMnuhAur6P6kkd38W3y2RjNihV:gcB+2Q+PS92m6bdMW3yRz
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\RGB9RAST_x64.msi.id-B4197730.[black@gytmail.com].self MD5: 43f95c5b1926489c65e6fb60d9111779
SHA1: 54eb51411eee30046605751762c35618b9af851e
SHA256: 0206668466ab16860c2ddde34ca7ea4d308e2755ae0e5cb79426fcf3f7580b03
SSDeep: 3072:v0/W66Js6agCIqnhIK6qHBBXGBG//AeVjm8UV0sG+HRwEW4TF2o0oaCSS7tLj:iWa6agCI+PlXGo//e8hMRSIF2fdXWLj
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\RGB9Rast_x86.msi.id-B4197730.[black@gytmail.com].self MD5: 335de90200201aacf7db4776e44ea4d1
SHA1: 85439361c2b8b66dd6d5ca19b20e1e8323732f78
SHA256: 1d37990dabcd4c73a5083d3dee7693ebeb287de0f992aad243d8c567fae150ce
SSDeep: 1536:DepOazitO/Fd3aWBA+1R0DODUzI1yFXm7UHUSls05kiPjtEQawb:CFqoFd3NBASyCDryFWU7smbtFb
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Setup.exe.id-B4197730.[black@gytmail.com].self MD5: 938b4341349c19430da8b3c4a8c7f298
SHA1: fea3684095db1f20814c9e135dc62f3159ead9e0
SHA256: 3b492d98b47b9e3c11507cef416bfefd9bee2743b8982e614a3be38dc2feb3c7
SSDeep: 1536:kQnuHNMY6nG7IDQHXjcjb5mJmX35jyn8TU0Ul4Y/YGUNP:StIG7IMHXjabs63MnSUXYR
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\SetupEngine.dll.id-B4197730.[black@gytmail.com].self MD5: 16643315ba94f743a1e93690fcbdf3d9
SHA1: 08cc190ad8538858787f0f8fe4efacc29d827430
SHA256: 1962331c472e4082711d9a2facbc8aca15495d440362956342a9b7ece5f4826d
SSDeep: 24576:+JS/Ux3Iyn437r50ndOT7D4DU9nnfG2vqxoY:wS/U1m7runET79nf3vOoY
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\SetupUi.dll.id-B4197730.[black@gytmail.com].self MD5: 48760b613442e6a64c5a5a41678db2a1
SHA1: 4a73cc75f898b805790460bd2979846e6a591555
SHA256: 9f93c794a0509ac0ea322fdb7ab1be6e6b69e98937f7e48554f6edbbc7d9c3ee
SSDeep: 6144:Gc8HJQqyfh86ywqKGCQ5cacypvR3KYP5a8/zGqvWL:Gc8H+dm6oKfQCOT3K58jOL
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\SetupUi.xsd.id-B4197730.[black@gytmail.com].self MD5: 7214f16b00fff2b10caf3f278b1a8410
SHA1: 9d483fd25f40bc8bf8f83c3f1c17b1311031d992
SHA256: 707887e1186505ef3e11f64472371e3d475dbb8b2cdbaa64a885f2a27d9edaa8
SSDeep: 768:rM+LfnP/zzT4F0Be8VULtfCYwRhH7fqs0Lmq:F3/zXxI8wtfpyh7tRq
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\SetupUtility.exe.id-B4197730.[black@gytmail.com].self MD5: d14a8f6e7645c8ff783aeaffd7b3a7e9
SHA1: 6ca7877481c0434ec55861a68d11388fdd3ce324
SHA256: 95822b353e66ce71eef736dace3ceff65fb865ff905af3871c20b2edc5944f25
SSDeep: 1536:gsZ6UBTJ9nDaXDO8MX6SjQa1tgItspi29gZEdHJV1DkJW0J4SN3RAjG3RjYAPD:guJ9aTMqS0xpUZEdpVUWgX3mtAL
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\SplashScreen.bmp.id-B4197730.[black@gytmail.com].self MD5: c1d54c4e3ca95cbadf1f31715e395fda
SHA1: c002e37250be97cd0f7b51ca4b8768ecda443706
SHA256: 13f4d8f705d5ae51f5a2198dc6583404048dcd387235d0a683ffcaae3773be41
SSDeep: 768:EomzOs+ZbRJcmHOD18GyR7EldkMq8b+Xqce0FjVAvYLNS+coiv7nxnFmmf:EJzONdcm95R7XMq8bzYMuI+1iTnxkmf
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\Strings.xml.id-B4197730.[black@gytmail.com].self MD5: 0628ebc9dd2d39421160ec050b1f668c
SHA1: 16f0d29a1fa2fc969f948ce99c9e0faf499c3b72
SHA256: 93173efea7df43f5f968122ae9e5e3efef1b9c965513a4cc7c528d4a38642326
SSDeep: 384:rBEqz+1kaXO2SMLg7LtWmO8Vx/lMi+IdpA5qjr:rBvikaXOEInJlMmpNr
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\UiInfo.xml.id-B4197730.[black@gytmail.com].self MD5: 044d803091499120d979c59375350935
SHA1: 112200f261a69d908a65f9c512f199bb179653c7
SHA256: 1a12c5342d342273cf4145ce9c89eb0c81a63f67df9888214b191c9302faae58
SSDeep: 768:kAslaBiKH24vNVLgIjoaCERbUVp09uiekCjNcsB7ih+PSd:HslawULv/LX9UhkCjmlh+s
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\header.bmp.id-B4197730.[black@gytmail.com].self MD5: 686a29da34b213b6641bd66bba982bc4
SHA1: ee7e46612d7a1d7164709d2001abf3ffa0a490bf
SHA256: 93f63c554c92c15d5a2a898affff319022536b89896848aa2c084ce405c37e9a
SSDeep: 96:sfMLHyvf4DMDOMipogl03xsnEFG0YaqUO9o02DeFcki3w3n:/LHyn4DMDVipIR0faq391FcjC
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\netfx_Core_x86.msi.id-B4197730.[black@gytmail.com].self MD5: bed09b6d38dee8e58927ae1850ec34b7
SHA1: 63a3fdf297f8707ed6f203ad12c63a17e02f2fa8
SHA256: 0c7ca9e3735b81d8345a26e1f31d6e0c512ecad6f682a9fb4ab217e090b6362e
SSDeep: 24576:V4yayOrVmHfPg80eUN7p8xhnoABXM9q3DXmZ3dgiJ:V4yayFIkT7nBXhe3l
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\sqmapi.dll.id-B4197730.[black@gytmail.com].self MD5: 34be38838512d8e47529b41e3d5892ac
SHA1: 432d6a797ce0549163f63d657f594cab81aad8ec
SHA256: ce8869ac50450aab16878bdba8fb61e6da7aa19e5165f679a15719cea14b4b6e
SSDeep: 3072:BzGN7Uaxe425OimmH9iqakfKA+hSh7paWSZGZQVYhBU+tx:BixobD9itkfftRvWVEU4x
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\588bce7c90097ed212\watermark.bmp.id-B4197730.[black@gytmail.com].self MD5: 76e24da1429a02d0920c8cee1d6223ec
SHA1: 16cedb6a7dd9253227a9f8c7093de6ebe2c8a8a0
SHA256: 126d980d7c7252684faca05ba503e9b51f1d3070075c0e053adb5c3e4ab82ac2
SSDeep: 3072:wzphKFK5QqNjW8q4rYFxNTmqFdRXEXHZJt5a:EoDqNa1RYgdRXEXHZJtA
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\BOOTSECT.BAK.id-B4197730.[black@gytmail.com].self MD5: cd98bca9735b205210667a4708cea5e6
SHA1: 68eb7c0075c873fc9599b40f9c37b7aa64c6d1d0
SHA256: fcc2f8ed84fd9a715f9bab2e9fa3e2c7fad43e2657115e970d918c55fada52b4
SSDeep: 192:2TlsYhwxUo4ubjNUvbBoWyhx/IrrZuiGfQXJ4qIH8:2TlUSo4u/NE+WyhxgvZuiuQZ4qIc
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Boot\BOOTSTAT.DAT.id-B4197730.[black@gytmail.com].self MD5: c18ab719a1ead13ce5040e598b4b0802
SHA1: f718de585179336b4908e143ff16d632d4cad2a3
SHA256: dfd1d3c4db23cd8a20f6cbab3deb3f8122192343d5fff6384fd961f972b153e7
SSDeep: 1536:G22z7E3md32La4uA70HWoVdt9FaX/yvOp6uWTfoK7LIumZAIM:uchx4F9sXavOEuWTt69M
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Logs\Application.evtx.id-B4197730.[black@gytmail.com].self MD5: ac2d13d6f4232acf8a5787500f0092fa
SHA1: 0839a05e857037572dab67360a5333e72d3d0199
SHA256: 49cefd16de7e7e9dd0699d7807b2452b4b143a12016c2db81c321eee716eebb4
SSDeep: 1536:Sf01ej86TuRxBMYlQZyJ+/VDRfVrlBcUEg0XPvchOHUtnH:Elj86TSKYcyg7tbcn/vcMHG
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Logs\HardwareEvents.evtx.id-B4197730.[black@gytmail.com].self MD5: 3e6e3daccc69f3888c9625a4d3a4896f
SHA1: b1530cb4b42ad16c80cee215446e6ff13df5c0b7
SHA256: d8cc8c80c876b9ae60fc05f81082448594ccdb29554501ae82f2fbd8760545e5
SSDeep: 1536:kZjcv4MFJtWPiez886WXDzFbqdkl6WNpcWLiytcaEO5wh:2S4MMiewfWXDzFbqdvWNpcRoEO5i
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Logs\Security.evtx.id-B4197730.[black@gytmail.com].self MD5: 3506d2983dae86ea2e534d5e08ecaea4
SHA1: 0403ec641ccb1bef2e6117a78185badb8ce0fb93
SHA256: 69d1e5b28e0b4a820567151d8a271113e0e206d339906d9a1bafe4907d58b6d6
SSDeep: 24576:FPk5jRQeo2TTfSO2iEAchnC2jV7N4U6CH3cX8PInMpX:F6OsTDSCchCk7G6H3cXvnq
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Logs\Setup.evtx.id-B4197730.[black@gytmail.com].self MD5: 0fbd21cf7e63f9a5d1e825b65a014883
SHA1: d300a7f297ae21689cd07ab6d7a8344c2737f038
SHA256: d8c6d56005835c698a3dba05829e5940b203e2ed4338ac1170e7299ba8cd81b5
SSDeep: 1536:o2tYrkG20OAv42wrrse/8Fpmf1BhKZsDBcyHQFmvoEZOm/:4HZv42WrEmf1BhZ3WCaK
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Logs\System.evtx.id-B4197730.[black@gytmail.com].self MD5: 5effcfc488c641ba39e9c01bc1245ee5
SHA1: 41effe3b34feff380fa7e1eece2c718b1c051a92
SHA256: 5d0a7ab76e0081380baa438176a22063928e7b6c8e4db3e751717b89154ce25d
SSDeep: 24576:BmsGf4y2561d+DhiFyuDvh1FlrhNE7JR0lTffzP:BBrDFkh1Fz6Uf7
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[black@gytmail.com].self MD5: 909a47cf387bac01ad90f12524cb9beb
SHA1: 2cc48ed5d18f7aad5bfce09d308b3d5c3c1f9917
SHA256: d815a6bb847dcdae169555e62c82f485cb0eadc7e0d96a184e51e809a9e10262
SSDeep: 384:ZhT9w/mCghv9bPLrL0q71/3W5PGf3qGYoO6tqvI:ZhTcghvJLrI8J4P6aSUA
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id-B4197730.[black@gytmail.com].self MD5: e98d941153fc5618be178bc8680f16b8
SHA1: 89a761924df92ff7786ac6baaeeb9fcbf9726fe8
SHA256: 2640a9e206dfc2076ca6390b4f88ae823aa401ab8bec0aac8b1001445bbe95a3
SSDeep: 12:KU2Os48pFSHGDAWb+CWUI0srHB7Gz1ugMkkOq4VnXps/5KW43d394GG:sOyPSmAC+VUArJmBqWZsx9CdRG
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Java\jre1.8.0_144\Welcome.html.id-B4197730.[black@gytmail.com].self MD5: f83f1e3ec5470ecbcaac112d4443e191
SHA1: b47d4ca228a1358d6c54ce13052f2610e5d5efb4
SHA256: 18cc73296bb7ed36f0fe6c61be4a94ec5f30933f4881ffcde2557d679aec6a2f
SSDeep: 24:bSJMIeQkCtZVQk9Uoz5EeOrROZjm/IB7OeHoF6vnY8KV9CdRw:p+VQAU+5EeyctuIB7OE1A8KVKRw
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[black@gytmail.com].self MD5: 8922b36306b7892d9dccc955bc075bb0
SHA1: fcf4d867cf8da7b1e862931328697f9cd2a8bf1d
SHA256: 71803e14ab8f5bdd862714947ca8d9a934eaf3f0135d3ad92aa16c59e11c8e95
SSDeep: 48:poYlOhKDPtUhLLTgLHHEtWlbUWVz7vRKR0:poWztwLT4H/lbUGvRn
ImpHash: - 		Access, Create Dropped File
Malicious
C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id-B4197730.[black@gytmail.com].self MD5: ecd3c5f0f24857e9e824f8efcedcbdac
SHA1: bdb75086780e46ed322f5a70a7ccf7122b42c3ba
SHA256: a393a46887400eab3898f90eb992a01c52129437a16d5b09962a1c024a33a292
SSDeep: 192:xOeewxp+pilEjcnJbo3B0A3jVheLWQiwsEGEergDFXFWpXM6lnplYYbuU73v95g6:xVLJyBLjCGEerg5XFUNhbYctv9S0+2
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[black@gytmail.com].self MD5: 8f49ca7dd8da4730f116c59ce24565d8
SHA1: 23f76f65a30fc7b36b850638013026d0a571a8e6
SHA256: fc6c34b49e609f9c81e06706bac5d8dd5e4e18062a9c2e15280e1a0fea9f9001
SSDeep: 192:5NjxYxoVNxoW7kWRlFBtsi5VrF05RYUyMMTRUdMaM:vixoaW7lRlhssmRbGRUdMaM
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[black@gytmail.com].self MD5: eac3073913ee4a8fbf422dbb5ea7313c
SHA1: 948122afff1e78e842796f3ede2be50f6b7ad9be
SHA256: 99e64c1419e1a6bc5ed5e8d4f7634c016a03f21d013311599a2e91bd7c4e619b
SSDeep: 384:wzhZdfQF2ZZqfL8ZfvTLvGKkvcfrItpLzvKgD5y214uZdJr+:6dm2ZoaDLvGmf2pagvvZdJr+
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[black@gytmail.com].self MD5: e78f877f3cce9dcd1d8256ebc6612783
SHA1: 18a98d2e175d6fff90bca32b130a9b7bb95078e9
SHA256: 815cf3255c69e444691dd1bd294fd4bece5fa408d18d16a52cdff96249a59979
SSDeep: 192:vvZEsNJFZwedITA1w7KhMW6njXNNuKMPX:vvZFZw3EfWj9NRE
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[black@gytmail.com].self MD5: bcf60e3e04985f2f462e9ae833a685c5
SHA1: 81a48954a6cba0500f29cce963f1180ad019506e
SHA256: b960c18b588ef39f0c4b84191dcd6f937a220066a061ddea47890f493fff0b5d
SSDeep: 384:RLSh1M9ZyJSWGV3d2i+M/jXNJWisgBcNhpkbm2ej:R+eQJSpV3bjXuscjpcnej
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[black@gytmail.com].self MD5: 8ec1575b89081ae41bf9ae3ac2dad606
SHA1: 71914d43222c73cc3e66e333c2c69b42d540c660
SHA256: fd810b6828f743a9261898c46013c6ad6ea2dc9626c08810cf16baf821a68bfa
SSDeep: 96:fdujtS1k8v1zqyppyrK8MLq1xgIapmsJsdrz2qKLoTl5T0orPvgwfMgX6xA5V:fdxeYrppF5pmsCdrRKcTl5Tb70bA
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[black@gytmail.com].self MD5: 2422db19ee18342c8d3312e46dbd1997
SHA1: 280bf0b5e799391a229d36fe6d0f56fe9fcde4f5
SHA256: 0cf4ec3d08177301cb9403f5ecedc2816723e6856f7caa7874fb5c7fa211ffdf
SSDeep: 1536:hNJ9TBErrwDWAVJ1JVuc78ZDol/o98M3+Q0/2wc0d/K0+g/fkhnoTCdcb9uSrk:hzErriVXucgZDwdV20dx+g/lCd0ESA
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[black@gytmail.com].self MD5: 56dd32e6bd16d0506d753921003ea8aa
SHA1: 9e3a73a65def37098584a5a87908c5a74d824885
SHA256: 10b2b9578db839558d7b3d03d7afda046baed5849e6ad91bbee269fd640bfcb1
SSDeep: 3072:o0Vs7RySziCBGJsd/oswG+f0Bjbrx2HytatMcXlwMJwjQ1iot4vktvjb7n:Js7SNqCPB09Oy8t5KMOot4vub7n
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[black@gytmail.com].self MD5: 2a9636084c5997cad3bdf19d4959e918
SHA1: 810c5d9837c9a18cecab1fe4efb399007d5240e9
SHA256: 5ed86d3dc36e9198331b24f9379c60fa5fc83063c414d503ac484df9a946f8ff
SSDeep: 1536:ckxecxn9jRqljMYBcAjExXD72u2WBr+GcWOyJZSye4nKr2EE72f7nDiaE5uNHoJ:fxnxnnLAoVX2s+GV/Sy9KHe2f7XESHoJ
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[black@gytmail.com].self MD5: 61358fa3ca534be197dc68a0986df983
SHA1: d0c80a061495f9ea22bdb32c9fabaaf4f045672f
SHA256: 365aabacfb8a13bbd5ed11496b3cf0f1d7e76074f28a757a93f9d39f269f782f
SSDeep: 768:BhLqWJzda9PFNQcTm8RaYHd7YqZNhOMMtWuKYthYoxtE:BBq8dINQcTm8RaYq0yMeWHYfPQ
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[black@gytmail.com].self MD5: bd19d7b2a2b5a7b81b83d61131535b48
SHA1: 710f659c75f2dd940fcbe1d3e08bfa51c445350f
SHA256: 51fc411c0a468aafdafde6fcbc270ca1910dc7edbfe9cd47fb884025914b0c05
SSDeep: 192:nesQj+niA+H+WR6P5ZzDG27PhMqVu/8DDEYVSrd38/MRYX/T1UZWDY:JW+nSQTPhMd/in2uKY71UIDY
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[black@gytmail.com].self MD5: ff1ad8582e926bb5bcc23e95882b0e84
SHA1: 374b2ad45b2d2f7daab7ea7d7d07aae38669c9ad
SHA256: 8d45539778e8065e5e1662d51a5114052b50281dcc760ce238693c34822f3124
SSDeep: 192:BK4d1Ey7UeN2JxKrwHyhz/+YA2A9Nzfl+chJcTx/PO0Nw:BK4dqy7rN2qrAyZWY9A9NZ+ckx/POuw
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[black@gytmail.com].self MD5: e2a0fa2b3bb25aedfb6585e2f89cfb1c
SHA1: c78ba6903d126c427cc40af237a25a9d7cba1c73
SHA256: 30948cfd45b06817366641c9a189629e7fe2e4dd7dba76d0e8a9cc2d72876ac2
SSDeep: 384:nQqwIiRc+efz1GvVtJAdxjvnqHOh14fSyCfyWh2PmrKd:Q/cf5Ut6XnN14f4yWimrKd
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[black@gytmail.com].self MD5: 7f93035b1b2662c62fe0caed7fcc77f7
SHA1: b08bff522944bcbd223989f50092729ba7f15b53
SHA256: 9d230981ab335160b5d8d07cb8ec4c07a51c4203b1d61c1effd9125fa13220ae
SSDeep: 96:5bzlWGHWDm1vwpm4L6H2imlYgN7QZb56pn1sM0rq/hmwumrvgXugoOVkmmCr1+wi:5/HMMvWfL6ql1k56117sq/77vg+y6AE
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[black@gytmail.com].self MD5: 1841484291c1a27f9a697c8ead672542
SHA1: 1d3e882455e27266a433367f84637829fd959eaf
SHA256: 68db6418e9dd5b0fa75e581e987d260b2bb2b9284895f9177c30e334f4f707e1
SSDeep: 48:wYhDz7rh0caZALOxYq9C61SCDtfxtV8weuZ53oJ6rAKMrnWR/oZXzc5M88lkUxfr:wyycSWcVECDNxMuZ53oJ0QaGiM8cSCT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[black@gytmail.com].self MD5: e4589032b8ab67fd1b5ba1d82d324359
SHA1: cb059a98a90067708eee2f185761f6012c31e6a3
SHA256: 9d05b993a940d73f1834a3987b2dcd1f95dea42c9cc0fea07a1c3be3ef6cd4f7
SSDeep: 192:V9rpXZMdcX/hh2kz9JJDc5BkbpDPacLsVUZsgDe5TYdjhhoG4jwGrD5Ktgh:V9ZZMeXphRzxc5BkFDPaksVUXoTYdTor
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[black@gytmail.com].self MD5: d651c2cf13c8d36fdd6dabe1ead3b61f
SHA1: ab74da13f4e4fb9894b255b427a230d580e8077c
SHA256: f948b97e1ddcffbc965934ce97fc29dcd6c42129e84f418da913b8e7fe332818
SSDeep: 192:igjQ4uOGHAoFdIHQ98cWmDBypwHjxJRvTLx:2dOn+d2syc/rLx
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[black@gytmail.com].self MD5: 15a091528f2f0efc531678f97743879a
SHA1: 52c22690a1362956bef19e8aeb755fa097482dec
SHA256: a6f2b5d6bfd9046b74f0059f6ec7127d2d3c4c412a20aa552ccc9cec4eda2e56
SSDeep: 192:RMTMKG49CmVOYKfvHW2JfTFITsjsYIckfKvvPSt2H6LVSUiZ4GwmvufO1W/MGi2:RMH+sOZ5JXQfKvvPy2aLVavSO0/M12
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[black@gytmail.com].self MD5: 986cfc3128eb36efae319114edc78b36
SHA1: 2e02f1664d422a9e280b322da4034321aa34f451
SHA256: 22376884113a95e4d4836342e4d57afccf0b1ce12257222bc86d37827e692491
SSDeep: 12:KU1HiSrpfEl72u3VZ3mW/X/w13Np/iGifzEWsr4C4V7GgKW43d394Gw:rn1P/iOaG2zblC4VKg9CdRw
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[black@gytmail.com].self MD5: e1f09c5046add9d182e8a0a13b0be32a
SHA1: 03a143c438f9364b51e3e4bc10a68f0c74829a52
SHA256: 68d88a9b5ac4d8194a18bef90f2ab2abef46993a58dbfb3b1c614f5fd88c1739
SSDeep: 12:5RrogWLH8++A+KWjIVEU26lInwq7PIqW079jVdAgRRGNn+6hKW43d394Gw:5JoYh8CUDEPIejXVyX9CdRw
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[black@gytmail.com].self MD5: 0a1a71a9af737f6a5a0fc6070f02f55f
SHA1: 18baf0dd0dd364c5fcd49ee467457631041f4f8d
SHA256: b919db8b513be3f8bebdb24cb3be8d2f4b0315ba6c566b9838c45a5365bf12e3
SSDeep: 192:lHqf5iZqorjUXOTX2aOH63W+fW8XaosafX4LZg/KRj4Vt/bsQOkudvtv6mDyI:65iZqsjYIdm+fW8XaYIFgiRj4Vtbw7+I
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[black@gytmail.com].self MD5: 46812da25e5a13621144626772bde245
SHA1: 07ebe9a5aa6f6183b070ff8c0927e347588d749f
SHA256: bd88bd5370604838cd7f2c4b5393a0faa7adb57ca435c42b4bf311591a17433a
SSDeep: 48:bcJ71qxeJJdvs65FQJTdfKP4f8/Ldz3K9dkYrVtpx65ZE6BgjNyF/6sh5usu9BWi:USgdvs65FQ3wKoQj65ZXWjs/1ab+ijT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[black@gytmail.com].self MD5: f407fc594b7ad56d13a2c14c9326327b
SHA1: 9a07428d437299981f342a911c4639c2fc694add
SHA256: 41cb5d4e19ac524893d45b3a503e6721d8e9a9eebbd04ddf989616de00b57161
SSDeep: 48:z4WwsNIwVwdgDScPf1CTEihbtsnayjmNxjbVzunKTDansmz5A6FC0QbvvymydKRw:1bRUNc4TFb/yo9bVqnKTLmzWL7vvyPdT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[black@gytmail.com].self MD5: 99f4b5c2c131ee7e993ddf8a7891f152
SHA1: b818cd2cb1844c55e0ef6dab60801bdef9a8c1cf
SHA256: 6da76b222c8de9a3a408932364edddd6e8175b1ec5e1294f022dbc3612dc4230
SSDeep: 192:WutTVsRe0gMNjdLgQlUTtYIJCFS35bwpWNypjtjXBwt5lE8DZW:WutpXnMRdcdTCte5bw5LwtrEWW
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[black@gytmail.com].self MD5: 1d79efd3525166c1facae3e92729847b
SHA1: fe3569ded560bfaabfe954e57ef0dd87c3abaa43
SHA256: 8a5e1f891bfd9f702b6b109715427104ce62ce92d6a598569ea72cc7d27fd74b
SSDeep: 96:AAX1TpAMBx7c6WWetCzIJv2MkkMEbWxnipYIrjmWgmARnLqCTg+T:AAFXHY6jetC8YMkkMEbqcmWTgL/TgE
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[black@gytmail.com].self MD5: 67022608a4058a26c5525e87cf63b528
SHA1: a6fdc5fcb25af69c779179d8dd5e094a400d9a0f
SHA256: aea2d94b03d0389db7c61178429ffa7b892b65780f670bf50deade94dafab9ff
SSDeep: 48:WalnTUxxxAyKmK/fc87YR7A6m3oZ+NMv1iHs6/GX0LRZk3W580QzEMaYnKRw:WoTUxxxmc8YYYZ+86/5Z/G0QQMaYnT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[black@gytmail.com].self MD5: 67087654006dc15d0c32fa822e6c41c7
SHA1: cb0920d241edfeff47ae1ae2b9bed345b96fe376
SHA256: 6a82b4f2986d5bb5c970a759ba0b1f3e12b8eebec85d19835998ed315f0b54a4
SSDeep: 192:EPaXkQyz76SeK0Oe4kHLrsPCr/xE/4wzqdXt5eB8YfPz6q0Rz833JJyV2gWJGpJ:EGkQy65xrrsPCd24wmTeVmqam3JJ5JE
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[black@gytmail.com].self MD5: c712f7dc8ede677b1ece0c42d4c411df
SHA1: 1ab7f9abea350d237d5d2ba3ecff7be1c167c3b6
SHA256: 1ebb7e59c9e4f0bff292e7ef41a0c99b7e4a6bd509cb166f8c1a23eabe7daa1e
SSDeep: 384:Rhsb6GeNBoUJ8aIHHW78mPjCCeAq5hhuuou3mGLhd2y26tB3:fs/A6UOaInc8mjCCeAq5hguo7GLGe3
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[black@gytmail.com].self MD5: 5daef47afa2fda7c2d6ed9657a903daf
SHA1: cd1c960f32d57020198f7990db171a93fea7d0fc
SHA256: 91c8fe01ff04ddb0bb25730e51b71e0150194fc662e4eec2bc944b361539074e
SSDeep: 96:CUdw+HNHc9hlPQ2zRwup0uinxCtJdVVx34+UAxConMOiHH99bfgWxIYnDhA5gqtT:CUy+HOBzRwK0ui4jdK3AxCoMRH99b4J5
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[black@gytmail.com].self MD5: 171e23497123eb9c108701cc9539e36b
SHA1: 365e231a11c06333abec94af006c2d04504c4884
SHA256: 8286e5c21e0d48cc599c961b51ed4717576af4950bde155b6d6c378ddf4aba78
SSDeep: 96:VM+QTvZtajN8OQbL8KHeml4zyRqjh2Q6l5WeaYPy1sA1mlT3T:dQ7KJ0cKxl4znt2fl53nHA1an
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[black@gytmail.com].self MD5: 22f8144f345b3e473a72f7a0e7e0a6f7
SHA1: 34e19def2b99f52f70e344ced6f23d604ef08bea
SHA256: f610f94ccd51bf33ad2f6957ae6594a640437ff53ade47e76bd349702895b6b5
SSDeep: 96:fieIwAUmwHGSmQkcNm+89NNOyead6hji2FeyDpQlAhuWkli3ip/7T:fiBSHGSmDcNm+89NEf46BFeyDSlRWB+v
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[black@gytmail.com].self MD5: 7fd4c4183ef829d987cf4ba9a11f8c22
SHA1: 11c5a586860ffa76ef005cef44ebe31ed7bb5e6f
SHA256: 30f7c411b6c669ff1c19bfb04f9dc9b73940cf799d6043c81aa377be431f7030
SSDeep: 24:a0q4i713p0LM989NTsUUBmmIqjKjLYQhAfVdsQysPKpz7M9CdRw:tqR50LLUBJCvY1fvhxSpz7MKRw
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[black@gytmail.com].self MD5: daa9ec3bd590143312740f3ac404d5a6
SHA1: 330fa7d24055f9aad44367d5a291b546f9d16361
SHA256: 10aa1a7bf7cc3665196962402c5687feb5e6bb8d26f402643e62c09376b6164b
SSDeep: 96:5QjQNkDtB3xi9WW2uk7sEkC9q7XcoTMCL8xWbYPRhYST6eWvDoL8jvsgQ/CiKaz9:LStu8szX9VwcbqRhSe0oL8ZlafdZh
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[black@gytmail.com].self MD5: 1cc6f39af9837c0232fc2054f86fd101
SHA1: dc81737f5e666136b55cc48a393e328040334aac
SHA256: d6a658dc53cc857084d1b9d00f3b7b64b05f54507cff64267f367082a81f9b23
SSDeep: 192:zoj8u8ykB1TjtO2lFgKCNScEOjgRWPb5lPGa:z5ujGPtOMC8cEOURWjLua
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id-B4197730.[black@gytmail.com].self MD5: 1447479357d131404668ba72e1559857
SHA1: 765fe73e0f31a22650e3d692f8fc64504c9d1864
SHA256: c1ed03df57056663edcb9a393cbacade38698c1af3244936e439c1ec09e9e43c
SSDeep: 384:ph4nu/sD6bHI2uarPhBBOFEbEB0r9jtKaT:phvE+bHPhhB86bEB0JBKaT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[black@gytmail.com].self MD5: 7b76cbe6685c53246849e0c8425ce82c
SHA1: 8ea13ea10c87d3e20cdded44f64612f68afbd2af
SHA256: 5c1d30e3681c71e2054bd89c8e13c28c71bbd74aeee4f3bcf3a4a5d642cd97c6
SSDeep: 192:fcAR5vquo9dCXt2BwhBi2gkEhZYu6UxjmEjl6M/OZzltPMKtNm1W5Q+f63xzPi7r:Usqz9MXQuPi27AZYCxmE4M/IzlBMENmU
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[black@gytmail.com].self MD5: 38a5f8343789e7ce0196b6c9c65edd80
SHA1: 260f1c66ac0470452fdf35eb61ae5573f7f297df
SHA256: 5d4e7334a1961f4c9a22916bbbc913d3606e393b17feca0bfdde0fe76e020bbf
SSDeep: 96:SLyM9bw3XBP8k/db92GSuiISiTr7vby8FI04cFE/9gZion5n83YmdPkprJGT:YySOT/db97iIFnbhS6FQ9gZzn58PkVJ8
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[black@gytmail.com].self MD5: 18f77b900526560a077116a3f49afb15
SHA1: 2478a86895f568f717de79d48d4ac6723235d356
SHA256: 55734dd8b24f5abec5ff0e70f055974e08d722425ed0db4379d28cb6ff86d830
SSDeep: 96:T22tUqEz4VUfIM9wtjSFAyb9MNYxgrQc78ntpt9ijR1XmdXsU+BD5ocgaT:WB4nSwtj2kwjUPmdXsU+Birw
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id-B4197730.[black@gytmail.com].self MD5: bf51c57837d9708d0bc2b6273e39a164
SHA1: 0e89909b0d8b6e60b399a1f0d1d3e9f2224e0d1c
SHA256: 5ae84fd248183a080e2d694cb9431d6642594cdeea28328a24bd773954053adc
SSDeep: 192:4BJ6tOKvRrwOh1UC177jeARR7os9TAdjr2ysQP+Dx4ZQvYPCd1dnNO:IeO6rJ0CxKoVqXRsvDx4ZQyCLfO
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[black@gytmail.com].self MD5: 370b229793d5c282ac397f9ad4483d7a
SHA1: 0f82b6e0aa4a59534f4bd6a0cca48abfba068613
SHA256: f6b0e4190650c523e7357ffe42461def6cd0437ba720625d7a8fc956a4caa5fd
SSDeep: 96:5CWjbTuoSoJSecVyz/4ZhaE3GLfCYB32oLrkeu7PhbDmKU7Hai1745T:5CiuU2Vyz/CatKvo3tu75bDm3Wia
ImpHash: - 		Access, Create Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[black@gytmail.com].self MD5: 140665dc5c6917f88adba8b5bc7265e0
SHA1: 59c60976538e7271e8ac976b3fc2cbac8bb26c30
SHA256: 07b7e8f33e8465fcb86aa6fc5bf741e0be776311eb0fc611a750630414bf447b
SSDeep: 96:QAlPfraxTIdP4zZvYfQNqQfNYa+ir2zRTZ52qqrFHoy4qqpjWWqS8TcMYT:NhzOIV4VNpfNL2zB72XrFHN4qcjW/Swm
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[black@gytmail.com].self MD5: 0470ab9d687015dd793868acfae183e0
SHA1: 5f6e52ec5b119185ea141520a83d378290b5e4f4
SHA256: 91de8179891964a383d2946470dcdefaf34c7fb3aac855a3ecaa51a65562df65
SSDeep: 96:y9QUueW9r88Pn0oxEm/9fkpaooH7CsQFD0M1s6NBSb4ubnNPT:Yuk+FhdPouCsMDv3s4uDNL
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id-B4197730.[black@gytmail.com].self MD5: e470254ea7fc3641f7a5800fca10f5b2
SHA1: ca006a050e15f75625b9fc8c1dc8092bac647c42
SHA256: 63ebe8808d704a2fc55134165d7a7e17b91f24cc98990ec1a064bd4e393c9d0e
SSDeep: 96:+5bq/W4lY+nTpJ9QRyJRBH1RIEj1SiSt0PKuSwPoH2nDc1T:+5ADVJEyVVdtAkAH2I
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[black@gytmail.com].self MD5: 4a92c9ec6eab5a49ed6b211936fd77e2
SHA1: b62477f6f948a8e029e839ba32b86383968806ed
SHA256: 864491dc030f5e9825ead84c51841ea77bf2e925603ba2dfc262410c075ceeec
SSDeep: 96:eg/36lujtklxyaa8Ilos2GlJmivTQ9/TT:f6BDBa8Iz2Vi7G//
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[black@gytmail.com].self MD5: bcbc5b5c908e8b0fc268875df5e8264c
SHA1: efc78d9ccea39e7a51df40b96e53b9e437c50f34
SHA256: f7681d4b10af4b8c4f741459fd45b750d3256bb9110d0031b64ff2c47f289443
SSDeep: 48:yZzQeiGYzOVlkfAuVQWq6rZwZlBmuP1HL8ig81KJJLuqgCE7EJmcBXSwtXrDQnrT:mzG7zqiJSJyZw39w5JLgNWmcB7XArT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[black@gytmail.com].self MD5: 5adb66529eadcdaaa1fcb59cbfa88039
SHA1: 62acf070d4636bb2afe6fac7a5f34037002ae3e3
SHA256: e8321aad5bcfedf1f0c86b9ee7472f980b345bc249f73acb11ac2c5a384482c2
SSDeep: 96:AAoKD78nz6ZRAgop3UlrmaU1QePcGfgDhYTQqmeCFWUdkXtSfqT:AAolnOZR3opklya2Qe0GfgDdqzsISfA
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[black@gytmail.com].self MD5: ebc3396a3eae136d2675355042dbbbc6
SHA1: ae9ff11a7b804746acad61cb73fb5dac97ddae8d
SHA256: 2b5785bb8b4ebcfa02d205675f28a18a623ae13737266f5d179c42640d7db1f8
SSDeep: 96:6F74SWYeXGPllScqEWIw4bHrfwusOZCCBXaoxbvYWJGpVwPzV0WI5k5V44iVT:6FCX+PScNWF4b7wCLXayrYlVoZ44+
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[black@gytmail.com].self MD5: 5ca8151c8bee3460ab3def01e594ebf3
SHA1: 0902ad43fbcbf3eaf5c449591cae6ea30802fb80
SHA256: c35423cae1c15b77e0ea4ff0facddd2244384200fda784b3cd125ad81df3de7d
SSDeep: 384:Xkr6/QG8SPHLYjSpQEtVNYlywJ569IpyisjLvKls/jgxZSAWSDN:XZQcHLYREfNitQuIpeCgxZTx
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id-B4197730.[black@gytmail.com].self MD5: 7e60ba19f97633dfdb919e874fce43d0
SHA1: c289511e57521135f6cb5e25794f7d356d824f37
SHA256: dc3a16662039800a7bd9c1caae2b7b6fe252929052fda655ad23b065104c859f
SSDeep: 192:lojTlW5X9vz1cuQ0Gp/bewYKaacr8tIpEt+dTlZHSVhnZ4mUvKkERiJZINfL:lH5N2uQPjPaacrLpEt+tlZHCUGSINT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[black@gytmail.com].self MD5: 81f7d42411c560667783406a4dd949d8
SHA1: 49e3ae86d18e9ee8f8f1afaef6cda539e52ebf52
SHA256: 5124acfef289d6aa3d7099a448135bba6ba87fbc76c46372f5bdd345facde925
SSDeep: 384:SG8E77kusDIZm8xTdcw0x2Fl2Q7jm0HBk5LLN+4tbbTy:SG77kussZm8xBcw0xml2Q7jm0HBk5Lo
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[black@gytmail.com].self MD5: 6db5e0f8ebfda38dd5f9ae244a407b6a
SHA1: aafddf2e4e721427b112076632048a4e7fa69ca1
SHA256: 92d91b0674e2970ad4aae8769e8bd2818222f3dc5c9032341ff2bb28a10434a8
SSDeep: 192:oWwSrGY7mOxFwpRe5Yv9IX6e7Ieuyeu5dl:oWwSrsOoHeWe7iKl
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[black@gytmail.com].self MD5: 3907509847d0aacb31b54f9299c1fdb6
SHA1: b73c8c58155379068e09a197e244073272b2f483
SHA256: 76a09a933d51712a8cf5fe265a27bd1c25e76daf35f112edaa3e56b739b8192e
SSDeep: 48:KMVtpWKb34C+Rd1REyNkbCWomtO2omCu/Qcn1FrwpOTb42lxcYsJep5UayOCf92p:Z4VkkiX1F8pO3pl9s4UJC2MJT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id-B4197730.[black@gytmail.com].self MD5: bcc86560e1133c8913dc0dadfaeee38c
SHA1: ab28d83cd8762b2fe955251051d950701e779462
SHA256: 83b1f0921e71c63ceec2dc9f70c77c56ba0a49831b02675959e9c145ba2fd66c
SSDeep: 48:3G1tw72Ga445QlidoEkvuy+nLhiDP+EvU1KRw:3ytm2jp5QoeZojJT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[black@gytmail.com].self MD5: 42b5fb227a574968c67111c6bc9489f1
SHA1: 255c39090bc5a2108305d1a7a1d6ad40dcd744fe
SHA256: 6302f5a0128fbcd5cb30fa99e8f95ee0e8eee220c2c5096aa9d78b39c72b4cc4
SSDeep: 192:fLJZD1Uns5SXgiec5o0nPnEdW0Ew1wjXGAxHSHgZvSsLJnn66:TJ1RYgiT5oEfEs0EUwXGaHShInV
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[black@gytmail.com].self MD5: 2b40b76aa9907d117b516d9a739ceafc
SHA1: c021d305e83e1d0625265e74da2c5b9540061095
SHA256: 466de46daf2ebd0cb5e58f605bfe02d4e818020fced0d6a7a45b27c49441120e
SSDeep: 48:JtY3gdyAU0gtq+vG6755oM5Euy+3NP2M9d6WTv9KRw:JarAU0/2WUPFdVT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id-B4197730.[black@gytmail.com].self MD5: 3b893708e27ddf0e50360d7804332fd9
SHA1: a97bb6e09c5de0a46fec09e80be8e004e854a3b2
SHA256: aaf6d94bdafb4a49a02ebc350ec58052b1bc00cb4d30c2886d5581df1a063eac
SSDeep: 384:LDOYNEz59WNbLG739Mibqj0fxdHtY71xBp9kgKFg6sc7lukK52pgV1QDj5dM9W:2Y2laLGN40nHtY71xdeqC8kKQgnuk9W
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id-B4197730.[black@gytmail.com].self MD5: 112b42c1ee5b4324122de4b612890f0e
SHA1: bda28b1934780c9773917fdead75496279c2a27c
SHA256: 51480c42983c0140354070c8414bb5acf1abf51978267eb13bf1cb04c2e7fba4
SSDeep: 768:Bo50hoDGhp5+6c7SYJe5z8JrA38k+1QaKZHaCjWu:B00rpY6c7SYYzS1ZKUW
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id-B4197730.[black@gytmail.com].self MD5: 370685c1a15a56b357441db26f5f6560
SHA1: 06d6c1c06a84fac16cc3bc4a482916d8077b8efa
SHA256: 72cb7206af7688bb30a577e14994ef6843dfc90b9941f112e42f1f787c722f7b
SSDeep: 96:D5KxlU7xxZCO7qK6mp4wATEC0DXJqVgdQjkenqo5IpWZtZKT:DglUlXDHp9M0bJqYWkroe6a
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id-B4197730.[black@gytmail.com].self MD5: 6d5351cb4701b923a49cc8936c220ad5
SHA1: 2ec13bd69e70425a130255cc91dbb002b0951a92
SHA256: e56d32335493285f0cecf176d01eeb72590cd8a13361bec0e881ca7a124890c1
SSDeep: 96:m3n6eSQmVAkO3qWENwoVnBss8cmxFbBsbPcCYh1J9Quig+XL6gzNMhN/YbgOxySl:AnFpmekKqWEN7H8cGFbKbUl9uZgiegZp
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id-B4197730.[black@gytmail.com].self MD5: 3ed1d716b1daf77ce96b4060580f7fa4
SHA1: b1cebc5a4c6da270d09df31e4ea0c74225c86e30
SHA256: 5f7ec69114d4076b699d17ae237ea6206c80de3429968a8d1e251d54aa316a44
SSDeep: 96:zP6I5rVKlORT7ajfqYHkCuqF/xSNQt7ojdGT:zPH5JQjSYOa/0Gt7oh8
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF.id-B4197730.[black@gytmail.com].self MD5: ae72064f47a3eda11dc0340b1b797fa7
SHA1: 8bceedcb399c97ab5c45085381ddbce4409861b9
SHA256: 81f7a813cdbf7f9fe09a96b365444b127c13d3a10dc8576a83ad0f7201f582b0
SSDeep: 48:abvLAK+KwKO5YJmHyE1ui8HODz0ssQsfLZgjiN6xRoJ8AA4s6HNMyFsVGts1adOO:k8TYmHy89D1sBLbN6xELAEtMvVj1ZV7O
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id-B4197730.[black@gytmail.com].self MD5: 339105be91939074bbf6164fca5a70cd
SHA1: 8c74d3b7219699e6fa585430098a645104f06325
SHA256: 74d8d5eeea3ecc61a84cdf41af675478b32f3b32eacf686f0291d91d9899822b
SSDeep: 192:irjnS6b8FvlhhcpT8UEVfHl0v7J9rJc+ed/028GEzN:i3nWh0mfC7JAlW2h0
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id-B4197730.[black@gytmail.com].self MD5: 45b6e6ecc5d3a13208289acb30ff06b7
SHA1: b79cf8158c52262f9412dd4f66751fd5c5ff3275
SHA256: 336d87fe14e14bab2a7063c5b8bc68050ac5b0bb376a34b8875d31ae0b4a4adc
SSDeep: 192:hchdFvigKDqdPQJEAoVInvsiGsNXXzg3a1TN:ahdlFK+dxknkiGSXc+
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id-B4197730.[black@gytmail.com].self MD5: f6e19add9753afd24cfd1e8d78421468
SHA1: 882d629c9a39a4feab9db4be9c3c2b2b28c163df
SHA256: 4656a07ae01f0ec2b3a9c8b733d701b4b3fefa7f3c9388670163df9b62343830
SSDeep: 192:ia3RC70m5Ksi0T2TkV4jHYBqC23b6CUSvyohHLy:iV7hS06TfjAiDhHu
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id-B4197730.[black@gytmail.com].self MD5: bce5f34fa2cd92da8eb03ea014d0cd34
SHA1: 9a049c426b7395750662965b83ccf833d1d8a079
SHA256: 8103f5bdcb3ae7782bdb895842fa1cf03fc9aeb5489a221f03cab8af96a0bb01
SSDeep: 48:x7diMzTlny1t447m70fMJF1afMkXXLq0ksYZ+KRw:h5M9gaf/nLx9T
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id-B4197730.[black@gytmail.com].self MD5: 6bdc1fb8e5b9f029caddb366ba14627c
SHA1: 7a03f8fdd09f96a28fd3c156d454eba904d2d902
SHA256: a0641bf30c949fb28e66f3914253de03467da000455d1ca53ebf67c870974c0c
SSDeep: 192:HR0m75LobX02/6N9IMD7GkhwzW28PsS5S/Hwu2u:HR0MA/6vIMvJwzb8US2Z2u
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id-B4197730.[black@gytmail.com].self MD5: 869895923a7b3e8ec353edb579a429ec
SHA1: ef072f28d02d5ab5eb59cf5a7edbb327f2c21672
SHA256: f1f3900ee74db137766983434a60f91d7167bbe8c93b95b1790cd34108bc9ed2
SSDeep: 48:MyilfgoPB4MgNiyGv1JpjlNgkPxemhxfJ6fcGaCOwq4vaNT32Dp00yKKRw:M5/OhNTyNBdjecGa9ZbNTmV09KT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id-B4197730.[black@gytmail.com].self MD5: 83eeb9780d7dbcd28e3127985e1aac3a
SHA1: 6ca0a5bf7448b94fa436023d833cbd83278e4649
SHA256: 553c7305ac14b393062df27c401961221419e60ea860f0d1d88c62fa798cf9e6
SSDeep: 96:jxuB9eRU+ZjsaiAsO4fStA3sSfsMv0j0J/Uh4Iv94kDpkBcpWSvkykuSezcogAT:AUU+hsVKcvEMv0j0J/Iv99McpF4uk7y
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id-B4197730.[black@gytmail.com].self MD5: b4f1d92b9d685c8bbd10fb3b7c3c51bd
SHA1: 23915ae0a37e1e55461bc71a643be1fa6c5e50f2
SHA256: 791c3b5efd6d12c714d0625ebd46c7755a9a707f9aa5989d3c2932c6b572109f
SSDeep: 96:17Udiczc588avbvEQhWnF12clyWL4+lIioEWWT:+wlaTvR9clyWHiK
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id-B4197730.[black@gytmail.com].self MD5: b98da75fe72ecfabebaec41ae363af2d
SHA1: 33b045788992c8e4863a707db247849eb57e7552
SHA256: 91003215d9073cb495b523b33637a94cd680ead0a51f2dde42ad1f08187cb803
SSDeep: 48:VEfviaTjdd9gVN8llgbsNi0zsN8lGF4Rcj8uAklltcbhBYPmPZ5G7o4Q8RTPik7r:y1j48zi0zsSlC4Rcj8cvtcbh6PsGoP8L
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id-B4197730.[black@gytmail.com].self MD5: 3d10a0c68261fbcab1196188ed81ff41
SHA1: 957d7dcf3403a93ecd887b315eeff54512a8991b
SHA256: 2e61a2c3e1e11cfff5b07d0bcd986f16d61159320ec6128de40f335af56fc6ca
SSDeep: 96:2RixjwTUnf8PR0pWHi1ja3dmeUsbYezgh1Qx+Ps6IB9OcqpA6UdshtG2Ff7GJoAY:2yYCqcsbZ0hi+PV8hGA0tG2EzY
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id-B4197730.[black@gytmail.com].self MD5: 21b59f0c64dcf764d6222fbfeeaed0ba
SHA1: de8bcf2a6943282340b841c64beef510e7d3b089
SHA256: 2470347c87fae5a7c1a669bf14f1dfb8b025f891d94d0097fdbe67ef998f431a
SSDeep: 96:s0fL0475djKtqAYNNx2Wii47kH1C9O2gUtunqZW+7N3RaLoxb2gvj1EVRI2T:3I4D2EAdWii4M1C9OTnGZxRL1wRd
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id-B4197730.[black@gytmail.com].self MD5: d8515aa0e40516d04ed48684605f564e
SHA1: 14295601ee7764f8584cd5d6d90da5a4ce7b483a
SHA256: 25ee6683e4079c3bb30da1e153177b0a0f3951d14a22650bfd4f843b19f95432
SSDeep: 96:nsqD6AL0hY9lnuTjKQD5OS2CCEUt05ifdETOJAG5MLI4/T:sC7Lt9qFcBEq05sUOJAG5G7
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id-B4197730.[black@gytmail.com].self MD5: 80f9d7a4f7c8aa3a8d3890b9de241468
SHA1: 2a7af28a4ce6cf54dbb3d56be7021a5dcebd7c45
SHA256: fce9b11b9a225774a18073758b3c60fe64b3137020d78b3fb4f8542e52ba0703
SSDeep: 192:jMTqyMhg5Rz8kY0j7jDkUPVEhVUfxDOkO/v0FuGaxVpi4DgK/666:w1MhczYckZV2Op/vtGal7/6x
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id-B4197730.[black@gytmail.com].self MD5: 9c47fd49f33e4c658844ecc355d18965
SHA1: 895660f98a12d639c77770c55d2648940aa31ed7
SHA256: 085fb08b332c0b354c0e36600011a07c4821104dd313f16d5ea222ec0d70d9de
SSDeep: 192:MmJibVOCaZe33aLz59N9S/dxF0oj4FUdq7NqxUNNWf7oah06Jrh7Dk:dkRxaZewz5D90dxsGeGUXWfVhZrg
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id-B4197730.[black@gytmail.com].self MD5: c04e3a3370b88422035c44845b77a4fc
SHA1: 7d06dbcb3013735ab24965034a3f6abaa4a5e14f
SHA256: dbb05dfc0eeeb89be16d2be02c8610ace9df9ea863f204b103571d5e95229292
SSDeep: 96:TN7UhnIZ7OBjDtZfcUCJP3dwIcU4R+6sZD+c8m/WCJt3gh6H5Ab9VUCiQ4FxK7zT:iyOLZ0USGtU4gqmpJt3gh6ubT6FSzMFS
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id-B4197730.[black@gytmail.com].self MD5: 0ee34102bd38c9b64983554e178fde0f
SHA1: a96aa6d12cd469812cdf9c4f61fdea879b779890
SHA256: 0722915673a21c594a412bba749b8c77dca327a497fbff3f7d043f3e3c7d8fdd
SSDeep: 192:gM2dhYeE4sN2nN2eskfjNbMm23IIH4SDD73EsGC4/MRXNK:gMWYeQN49sk5U3IIX/EzCcMNK
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id-B4197730.[black@gytmail.com].self MD5: 43408696799a3933224ccc4bfdf569c5
SHA1: 93488a158a27e26a75c6b46defacb4b9f5e92600
SHA256: d92c7aa325a7b60cf199627b3750453fa62b60503017f5762173443b18c4ef45
SSDeep: 48:07NpXXh9gR4khmzThXqrwNvMTZ3487rEAHtGxh/dEljxm+4iMKRw:0R1bggQ9Zo87r9HwhwMT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id-B4197730.[black@gytmail.com].self MD5: 99caec3a337444bb7cc1cc69d037fb10
SHA1: 912013c9ef620edf64deff166a55c632d6a24e89
SHA256: 1ee51a4a2d92b52126c2124ce6d768baf8de112cac3709baf59d30df196c19f7
SSDeep: 48:hBodMSDlE+yfYKFU5FU3hxlr8Mw8cXqCJh9PgM72+KK+zoH55jDVoKRw:ToTgfYlor7hzuIA2+KK9neT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id-B4197730.[black@gytmail.com].self MD5: f3f762d50412992093eca23b56ac14cd
SHA1: 829d85a0e7a70dc0e035e752f6cd653c64b06cc1
SHA256: ae3d0a81398bdfacc91d934b39689632623cdbfc853a7fc41510db77b80d7707
SSDeep: 96:kmQSRKA/8mJOuDgXcfTfIGirLLZWGc0FlJLFnkzxH1T:kmQuKAkNuDsULbA0Wj32xH9
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id-B4197730.[black@gytmail.com].self MD5: 2e880e72fd03f630a76e4f5579c966ec
SHA1: 191261e542c1633f852732bcf482dfb5dc00b6a6
SHA256: 8100ef3dcc8be856a6edf9bc34c113597566af1c8abfee4737113a4b248fd99c
SSDeep: 96:g5wgw/q77zqLvD6t763UV+3IF3WLDgzXZGcMb5qlT:g5wgeq77zqD6tGM+4FGWXZGc7t
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id-B4197730.[black@gytmail.com].self MD5: 11a0dd1ac1d145d3e67545bead70eb21
SHA1: b6c4bf5aaa3acee6db803e5b36739cd95a67f7b4
SHA256: 605fdcbfad0f30be6d973e9a945243d851b0bb196ce9f0b7f155e7a4e842ec6e
SSDeep: 96:1VMbDyhabFGK8ne6PgY5dl+O8mtzEbP+0dx3T:PM3TbFq2Y5d0OvEbWMj
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id-B4197730.[black@gytmail.com].self MD5: 5a39ac8962d2efd4beedc4ba48d22308
SHA1: aaa4b8943931902e650452844240b8b15c2bfbed
SHA256: 45eb93548439b9b906a22724d0067382bee681bc2e2a5be9c77cfe08995eee2f
SSDeep: 96:eGGIAq/gIeK3Cv9+7sbbloErJnK/gtU8bFgp7i0PP3LQkYT:eGVAq3VVEglGFgp7RP3LQp
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id-B4197730.[black@gytmail.com].self MD5: 5bb400e0924f1c69635e3ed52ee3a015
SHA1: 55f3a3a4ef25d8a94001f1fd22cf1f218c4edbe1
SHA256: 55052d6650abb7475ad3907be08eb4eddf969d0f73c40b8342af2b47d14e3ab7
SSDeep: 96:RpT1VVCQ8L+2bQkml8XSAXVhzzAzBC3uzSPdZ+ULSmHjONFtiY5T:RpvAQs8kmOCAXVZsSPi3OiFtim
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id-B4197730.[black@gytmail.com].self MD5: 1ae04f17331df92e77f68668041697c2
SHA1: ebdac6600810b838143678f5a99fb896c53aba83
SHA256: 76290672e27f3fcc93088855519773ff556151eeee01956a2030a88434d61e49
SSDeep: 96:GyOGeN8zil5D9pWpLGVpR2JPTWOzw9+zp9h9Yh9PqewCxMA3pTIoyywB3VzCT:GDGeOeuLGVH2NTWAwIzpPcPqPCxMgOoD
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id-B4197730.[black@gytmail.com].self MD5: 5cef31dcd0c15cfca0168347ef0761ba
SHA1: 3f2ecdb7fe05a71ab6518a12f9c302c7e609ce91
SHA256: 0466515e25f5eab337bd9d430e2554394baeaa5822f51c677f642c300e49a8cf
SSDeep: 96:/oSVtrwo3Ay8RW31nCJJ2KsSkOTnjTDBxd2KCM6Obsu8J/Z5MGFUxT:teAFbMJJ2AnjTPwFOwh/MGuZ
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id-B4197730.[black@gytmail.com].self MD5: 6cc87e14c80174023b27c8bf892fcf16
SHA1: 6a090491c6df3982e03c51ad87f672408b894967
SHA256: a26beedf23ef7811716f83dc60b4395ffc9fe17618b0ce7e2bdf808f06ed244e
SSDeep: 768:l7UlRaCEou4e1ng74ummoddoUtPUND10lLxEuY5/a:2aCzuU4gY9PUNSLxEuY5/a
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id-B4197730.[black@gytmail.com].self MD5: 7ee56f02107821e95c03188a93d80c13
SHA1: a949ccc443a3fb99e7fcdec6e055218b51447e63
SHA256: c9dacedb283e5537c032e628f937656e3b04ceeff5f3b90c79301c0062ea509b
SSDeep: 768:tdJ4OjcZtP64SIYpAT+AWdekeA4nnvn2PVqD36AInMbsb2:tz4OKU8kcnfKVqj6CT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id-B4197730.[black@gytmail.com].self MD5: fc06d708555cc6233763c91c353ac281
SHA1: 3e6bfd8b6361c68a724b3aa8406d243855dae47d
SHA256: c91fefd60f55ebac0c1cad460920b2faafb67ec43fa4f7069e4d32c59372db32
SSDeep: 192:3Ypb4XMb21Cv1ipqN2Z3fNwflujsr76svSMhiwPyWZbOk+QTSNiWOHmxuRUTfk7L:s8XMwMkkCsh6s1y8b2QTSXeUSUTfw
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id-B4197730.[black@gytmail.com].self MD5: 07fa8df1461601cdb55447923f51a005
SHA1: 10903c5437294c3d50de78c49743859947f4254b
SHA256: 5294a14b27e9e65e8ccfb66a9f5c19727ea8b060ded4eb91177b825a8345eb71
SSDeep: 384:T7m5anK3a6Tpo7umF8I69lpkJzX3bqW+R1bWCSM0WQWYej+kuIXYGevP:HmknQaqo7j8I69AJHq1aCu52tuIXY7vP
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF.id-B4197730.[black@gytmail.com].self MD5: 4789374cf803373e725c4df2d4fc524c
SHA1: fb05d726f09b059bd001c0621751c7cd59273744
SHA256: 990d78423a42dde4078a5e5e115c844129892dd4863254b70fbdf2b65fec979a
SSDeep: 384:Tzx7azfg+Foxdm5QISJl9SU45edsOSdFkDvJSAZSQvv:laLSxdmC9JbcxOr7JS78
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id-B4197730.[black@gytmail.com].self MD5: 7a5715397e08e24ec9777f3d9c12f6a3
SHA1: 1da26e6b50ae85121e85d0548db0cf3a2c7c584d
SHA256: b2720b4e6b649b8e02e6f0135de165dd09019f08cc9f70cd82a3c459806b107e
SSDeep: 384:o/zQIUlyZoPuBmU22kbtxhH1KqGdJJaYZ26/hqJhHauv7GCkU:oErrD2otDHUqUAYZ26/hq2y7GCz
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id-B4197730.[black@gytmail.com].self MD5: 36503a08a41744c29ee3f6bed2994a75
SHA1: 58b4041433ec85fd2ef281044c3c657cb711cb01
SHA256: 20ffb9b1ad5ffd8a48a10b8b1a00a4a7f5de2946dad4b8f32ff5e2e0df6d7c67
SSDeep: 384:i40rZrnUvJT84O5tl2bYh+0SGlGzjXNSnidbhCD:f09n6N+2P00XQniJ0D
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF.id-B4197730.[black@gytmail.com].self MD5: 7f1b2cc544b7b5788800d0ead7958b44
SHA1: ca29686a8cf8b83f4ff2eee13decc3db77612908
SHA256: c3b6e5c85ca65ea0ff38399a37bf5b998b0157e96c8ea86ead1d543620d12a2d
SSDeep: 384:E5N0/iCvunvIQSzO23Gz9tbTpBzMTTMD0vwVHkLPcG2:E5NgJuvxdfnpZSMowVER2
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id-B4197730.[black@gytmail.com].self MD5: 6cfed08979c38d4951910506eabb698b
SHA1: d25dd97d50e18f763038f732e19c0ed47b44ab41
SHA256: d5e76d373b1fb3c7c2408a6f06a67a6b59da2e288a69433931746dd1508a255b
SSDeep: 768:vwS856IcGGMcqIVxH/XGSm9tza0r94btkXP8F1xymTPNpkL:vwt56pdMcPxedHr9UtkXixymcL
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id-B4197730.[black@gytmail.com].self MD5: de9376147a5a297a7f5879fbd9bcfd4e
SHA1: e2e4784c982dc7e5390a1bc804fce95414417855
SHA256: 3bcfeb1b2eb3e79f87396416565721aa99e80f43c09a67f3353bd037f20a5dd1
SSDeep: 96:Y6lHDd6o/OdXroyThuKnBBH/bRyGEu6HZT+yflkMi0FTaXzjN5p1LkcIT:Y65h6ZxoSuK7/bMy6HOMNT2fNz1Lkcq
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id-B4197730.[black@gytmail.com].self MD5: 109f8858e590fdada9364bfe1d18d277
SHA1: 5cb79eda41412a5e9f2f8d05b762c79b0c4da694
SHA256: eee1979b24c9997efeeeecee8b2649cb305df40bb3bdc7b62b3dbdfa53276798
SSDeep: 96:3iV4foeNblJ9S2k1pLqQqMmhSFsdvqukv8/PRy+T:3e4ffNRJ9S2apLqR3qukveRyE
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id-B4197730.[black@gytmail.com].self MD5: 3bd091cd19931730effa1926258e93fe
SHA1: 2c63a2324dd2ddf62234fb8802048ad1bc08c33c
SHA256: acbd2f474c880bce6edcba1a1a03f00ccf866e720d01eb5049531fb199815dbb
SSDeep: 384:FidC2P8hxDcXvKpqv7J7IHdgN+u4+JTXgefs+nIWO+CLiZo03mVEK5IxT1BzRXel:FF2kRsveHyBT9fcriZbmVx+ble0Vx5E
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id-B4197730.[black@gytmail.com].self MD5: 8e6e7983aec7046e8decb040f5eb9760
SHA1: a255a6320093896eae96e22ac4e8c376e6eac88e
SHA256: 1bfb9e4096ed07d94f320acc065da8caf12b9aefe9b3369f2761f09ea7d18ccb
SSDeep: 768:dY2NqdjEEOfPtVOQoKE4thRQviOhnlOHmLJD:dDWjqyQ84tYaOJQHgJD
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id-B4197730.[black@gytmail.com].self MD5: ec5ffdfb65362a67cabdc8a4e8edd1e7
SHA1: 40518aac5b1f7055a64d10b913c883c950eb4a09
SHA256: bbee8a3756e0d7fac7e3736861cec2c5a12842d44777351e0e2952924a3dbeea
SSDeep: 768:2//6mEKXNIvRTYVQSL1SN8QZPaoFxeRm6LPdCWjJkA8pzzAituCrL56sTSPRD4n5:2X6gX0RTYV/L1ktcvlCWjJkA85esTSJs
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF.id-B4197730.[black@gytmail.com].self MD5: fbfb24d54c5dff3a7bd2db7cd8a21c8b
SHA1: f8b3997ddd8043ed417a2430f1e08fce978d7d83
SHA256: 8e2497e6c525abb312a1d68248b6cdfbf651393ccc2ddee39dcb735e99db23aa
SSDeep: 768:gvqogCVdGMyfsvvPCIHwgUclfQHyHxG9/lAM9DByvgJ6ZSjc:idmgCIQQlYHtlv9DhAZS4
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF.id-B4197730.[black@gytmail.com].self MD5: e6cd0044282107c3cec53e3789ee7b47
SHA1: dd45296955d16972b35a96fd4b9f37462c9677cc
SHA256: 41e45bead9c7b5805f24c2208d581bbc7fb7f6e14fa44210d1f1202720206636
SSDeep: 768:yQEKrhihvKB0ZAaenCa4IHfvvbkaXCU3GbShn0vcYE6Q0XTJMe7g/xTSeCzramTr:IvKB0Za4IHXv4QCU3CIn0vJEx0Ox21zJ
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id-B4197730.[black@gytmail.com].self MD5: 84818135e4cca332a93207c0387c8a5e
SHA1: 991c7ea5625b4e40b783aa3a310d4b54d5b0415c
SHA256: 1244d823f77df1d52a7ad871bab0d34ae93e900c303ce2d06e8e421a59ac3d06
SSDeep: 384:H93H2aRLg/NKT/WU4TtDx6FWMsxcdXdRTDayPhMww:d3H2aJwKT/WU4TBsAch1pe
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF.id-B4197730.[black@gytmail.com].self MD5: eaee8ab8ecf8b74675e7ac1bf6108619
SHA1: 81584c8ef18e50b1b935c20121bc4aa20d8a4e78
SHA256: f295fd4a3f5b783a8fc6cb95f22c7c0b09502857839e503452cac044181a3113
SSDeep: 384:ONSc799mEgSKazEkvnml0Pb3VFpP9KeoXpGCzy/E6sU74H4JZ2WfHffNQS4:GScB9mEKaAkvmlezd9KeokC2/L74H4JO
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[black@gytmail.com].self MD5: cd8c705cbb185e94b81c68b20d402ac6
SHA1: 54754c3f422b4dfc77d8a2c3b58dd66cacbaa4f4
SHA256: c6411b3c16d943651fe71f27e1d24fbdbe122d6e32d164354db3c245a3ac9211
SSDeep: 192:nIRdUFBa4x81+/08RGN9rZLaN+jkdebYPap+EH5lSi:IdMQxM0uN8MPsqi
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[black@gytmail.com].self MD5: 8b8f388e39f8ef1d1f21c7c8cb737ac0
SHA1: 0063d7fbb554b55c7057b4ba606d83850c26f0df
SHA256: 2e1d7b97af0e8b76e93d45f7d00bed6ea1a5761ae8483f785a42e29c7d93eb71
SSDeep: 384:xy6k5SQ4DLMtexC3paf3gzHMyHg5DNEA2E:xy6+4kt0C5kQzHMyAZ5
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF.id-B4197730.[black@gytmail.com].self MD5: c9b34871e956d58475d6b5a07d8fa896
SHA1: 55c297cd6e65fb638fb3eb0098d226f357bacc56
SHA256: dacf5fa877998c76a74e29e7b243fcb14d9f490f9888dd13065b49de4dca5a13
SSDeep: 384:V1C5P10/ofE1f8tF4onNbMF2sW0xZPBC3v+oneP/ArinTb7x6RX93rvWRyqMAnCC:Vyd0/iEGF4oNY210nJCNneKinn7xcX9i
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[black@gytmail.com].self MD5: 33c56f26516176304fa14b3fa050671c
SHA1: d01ff7f53827b69b79278e3bf69c685de6367bab
SHA256: 48ca792f56ae938014e572ec8b7ce6991f579643ab1bf3e09cecadedb58895d9
SSDeep: 384:17XhzXYd9zN34Xl7teSwKU9w39xDsa8kHSzvt2E+zBHDzt0g+1O6FTwd3s:Vehc7if9o9xO7QDvlwMs
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id-B4197730.[black@gytmail.com].self MD5: 259eb1515d00d69c648f46a7a2a36132
SHA1: 3343683d6ada5674c139b608957b18e5ded9497b
SHA256: 26dde7bb32f0f44bd38572817fd1501a47d2f322afd46b99bbfc4de179e69ea1
SSDeep: 384:UKe/XNH8FfEHkqF2zSqPWG1ZNq7FBROII37lOIWcKQ:fe/XNHuEHkqoB5zq7FBwIIAIWcB
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id-B4197730.[black@gytmail.com].self MD5: 71c4913846301f12710e2a029e4170b5
SHA1: 3f3fead5b269de1d4e280d9a8ac49bac774ff809
SHA256: c53c51e8086c7433b4fc26eddde717ef6a0c203f44945c2dc929fd3c394817c8
SSDeep: 192:4qEzk8VYh19ABoyjkX5TFaolTKfifzPUWFUNHXfnPQ6FONniKx6jy0UZGuspDVzY:BLXhYBRjkJTdDrCnP7KiK50UZGuspNgd
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id-B4197730.[black@gytmail.com].self MD5: f0eec6d507adcaf6b38374f94173ac9e
SHA1: 1476d5bdf48cf6e954ab945f14459375a7ffbee3
SHA256: 2ab8ef6599b57af3c5e6d60face32102f973baaade54c60d013c05622a0ac9d9
SSDeep: 192:TlRw9k7e2nLMFcg3BKRnZeiGEd5r7MxUPmOGXIHr89l9t4Yy82dXSDao:Tla2e2n4xxKRZeZEdigmbIInfBy82din
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF.id-B4197730.[black@gytmail.com].self MD5: 03d088bb20f970545c77ef69eb37183b
SHA1: 35eb5908cf9ffcc2aebb14f696c311dc6a8df841
SHA256: 81626306add68790dce006b6b351fe8ba4ad180fb7bc6063b35fef0528ccc8c6
SSDeep: 192:F7tUKvDfiuDDGVm3V4nWfcMH1MCHdGmWxerY/dV3:H7jDDGVohfvHq1xerS33
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id-B4197730.[black@gytmail.com].self MD5: 912d33502b19796f96430262cc5dec28
SHA1: 0475999e36d4eea8551812f27bdb51edfa335124
SHA256: a2fc19b076c98ef627144008c3a9ea2806d8d70cfd45228a0f4a9963ede087b4
SSDeep: 384:nHtMFYrA7gy8zSXzdGUiPNxg2fKVqEd+caApv/f8C:nNgWADOSXzd4lu2fKVq9caqXfN
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF.id-B4197730.[black@gytmail.com].self MD5: 3b84162f237be8b563a34d4106999558
SHA1: 35ba79bec878297bf66faa8f22b617db5d716812
SHA256: 01d7c8d4117947fd20a3b5ec244cdda254bc98a072ec46bb153d069b3cfd29e0
SSDeep: 384:N1Vf4oihv96EVrcwVvXywQMCWSIBt/zP0guDVsL+LKEPbDUDTSY:D1vyHVfYMCK70PXLKEPbDs
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF.id-B4197730.[black@gytmail.com].self MD5: 59ede569ee218351d3158192b05090cc
SHA1: 1c4ca8f53a167876944380663cc124181fa16f07
SHA256: 006d3ce30dba1de87c42819cb894c8eefd87a542b18dba7b6c9fd561b9d3d33d
SSDeep: 192:RG88wp6AAoc7uqFBxqHIVxYl+yNAcenf1nQDRGWrHZ06xKKlSkvtKqK7Ox+G1:RewXcFxTt4pef1nQDkWr5mKntKqK7o+o
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF.id-B4197730.[black@gytmail.com].self MD5: 2e66380bf2560fd6fd0cd7e6023bca28
SHA1: 6a1e67c5d0a5624bd8205caf7999d8e0fe683c3f
SHA256: f4cbbd0bc923d7eada7ce5643348912441885c2a1253e03936dade883143f57c
SSDeep: 384:3cWyTjPMForSvDSZCr2oE+9oGYB66eCUvFf/:3iHkKrkDa+cB66eTvFf/
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF.id-B4197730.[black@gytmail.com].self MD5: 82f30e899c1afe26b4935eb6e1cf402c
SHA1: d2c1f149e8adac5c49a747d0791bdc33e35f00de
SHA256: de418b8f982a460aa3de62ac9c0264017cf033e1cd2ab09d704fc60ce3f04e40
SSDeep: 192:H+iU//dMxl+kAfcrXJOOYbc9F5oCw8+v6n/j8wpK5yhFYryffMY:HDU/fRkkIn5oCF+ojJK5yhFY0MY
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[black@gytmail.com].self MD5: df5d8c9f703b0e49144f34ed54627f70
SHA1: 3c2d3714d8df1e81fc0c8cdc7e146bec92b97586
SHA256: e1ce010de395761127ae311bb43909d48eaa927743a529d6d3f063ccb66e5d40
SSDeep: 192:2w72Wdq7hh1IN98vJ8fXMGhJaMOEBs7rlhmVIlxrVMwb5247n40Lj:OWdMhPIN98sLJaTr7CVkrnjL
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF.id-B4197730.[black@gytmail.com].self MD5: 3237146fdff036e0bb9c695112a4ca20
SHA1: ec607ff72817ffd81348f7454a32b6b1733b571e
SHA256: e3868a219a67f4eb54d2414eaac818aeeee2968d8bb9b658d5d84b75365d1ca4
SSDeep: 24:e2Eb90e+ibin0KUAYnHOpHsYxU5UQtm/Uia9CdRw:xEC8i0KSxT5UQtmsiaKRw
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF.id-B4197730.[black@gytmail.com].self MD5: 100ff1e4fbbf7b064ad1e621ff48e6fa
SHA1: e79547ac073fbd6014014f051e6f838cb9feb101
SHA256: c91175e0f66e400fb9a38b0cde093c56566c0c1bb925d9d66e0eeec19da29794
SSDeep: 24:T1DlgRt0EibPrCyTUH/RP1bk8A3ddbT8s/ykl0jv9CdRw:T1DSR2EICyTUH5P1zAtdX89kujvKRw
ImpHash: - 		Access, Create Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF.id-B4197730.[black@gytmail.com].self MD5: b5b96248d7f5cd3903dc9035fb2aa7c2
SHA1: 644ad0349815d4075dd0f4d7b93f8ed5ceb29c23
SHA256: b0f16cf527b9929647d657a660be60303a3898d1657f833ae0ba2e480dd802ca
SSDeep: 192:l4zQJESYnMFUAx5PusGEKtJxoNH3EhczY/hSwks+rByOKj/K/B72vT3czSgHb30:OQJTOcPusLc3oNHsoY0BfrByOv/mTzgw
ImpHash: - 		Access, Create Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF.id-B4197730.[black@gytmail.com].self MD5: ab0f8a4c096bc487ccd61615a38f2a17
SHA1: efde67191bced31d5749ec9508a789a08a6cf6c9
SHA256: ba90e40fccc2d2fcffb8f4c51443e821eef687b5b4c0bb0e73c2e5f05855dace
SSDeep: 48:gUhaEUWDnFG7nbPweqA1JbDQgYLk5ZKRw:xUWDFO0svD8LwZT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id-B4197730.[black@gytmail.com].self MD5: b87eb0974585dd165d5157e4a9efa474
SHA1: 7015a4653187e35c7f7826e8148bb92a088d3ae3
SHA256: 6869b40c03f5089cad93f84431609366913dd8001d983bd38486f1af14d57e6d
SSDeep: 48:r+NsHTVF6iv4LUIdV8yC4S8EOBpYGGKRw:r+MVIpYa5SalGT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF.id-B4197730.[black@gytmail.com].self MD5: d142373d0443239369caad6ff888febc
SHA1: 85bd37671f844f63e2441f302c084fd11c0d352e
SHA256: 39d5cc1b1ce37c81506f830d41fe255401872cae1f9482717bbefd1788eb99a8
SSDeep: 48:Zp0ROFwgo1iO5Fp7zLxn4Co5L1tsPxP1bQ9KRw:ZaS2pFtLF4xHIP1bmT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF.id-B4197730.[black@gytmail.com].self MD5: f70b3a9b610b3f9772fdc2d302578059
SHA1: e8179fa41a146084af36b4a1b3fcda265e79f850
SHA256: 6870dbd7bf9d672117b68a1c7badf959421a6faf20465793df17bb29a3b4979b
SSDeep: 96:yzy8IYk++OQ0iBiI0QsEwYFujYe1xMYCZi2mMfN4HmhTovJXZDEECfPpT:p8IYp+OWiI7wBL1xMYsmU4GhiXZDE55
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF.id-B4197730.[black@gytmail.com].self MD5: 2118d0bb031fc8ad3e7e3aa7ca1e762c
SHA1: 223bf8696fdbe3765b52e0767c1a0219c445f083
SHA256: 0db033f9e91af7a879cd71d71cba32d1edfab1797dc87570bd89df2d1fe8a475
SSDeep: 192:j2A1IXOF94suKaUAJwuoIcttDeB/qezwuG7+xU1:qNRs0UAJAIy6B/qyPa+xU1
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id-B4197730.[black@gytmail.com].self MD5: efb104cfa2fcefeb3a6cdd88526c38e7
SHA1: 7cd9fb2e1691ba082705818b04d3ec03afaf233a
SHA256: 36f7b107e6add0268c8a83337b3f22a1d9afaa18e52d6f72e53dda802d3aff2e
SSDeep: 192:GNg66zpGK8RKHp2WfcHOCafsHNHakzrZcE9q7h5QVc+xuJqon:M+sZKHp2W0mE0MVfq95QVzuYon
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF.id-B4197730.[black@gytmail.com].self MD5: aa0e14ca096f9a245fac3a51289f7d00
SHA1: ae42745e01db21cb47eafe8c0fa96882e3359322
SHA256: fcc013aca0a25630eb763bf5923b1e3c2821aa7ecd9f17557b22c906d2cd5001
SSDeep: 96:kzeVZJdA7w8znyygkhdOa4n/qf56HuCABKuVtT:Gy67wSyyD3O5n/A5MFOKuVF
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF.id-B4197730.[black@gytmail.com].self MD5: 7cacd31fdebd6bd6dbdb27836622d12d
SHA1: b11e8084f73ec88a5866486de115f8b342828799
SHA256: 64ba64dce21aebfc3c53cb544e26a197c7597d2004e308bdf985a2345d10a9da
SSDeep: 192:zyi8n0efmrQowDyPbwJFvEPDpyTOX0zG+qXWZUMdNi9G9GahgTfiRW10RH9cHYC6:D6EBf+1OXOG+WWzi9cMKMKV9cHYjfDh
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[black@gytmail.com].self MD5: bef13ae0c241f45e19ecd147025fc601
SHA1: 99cf4ff397bc3ca8a0f95ca2bfe6974f4b1534bd
SHA256: b795e3582730eba64a64817fd07c344a6e3e7f5d524f43e71b29c96288d3ffeb
SSDeep: 48:Iq0a+A5nHOkA+y0fLSQVIia16ZTVzdcVV1VgboKRw:TnnukV1HOiawZT9GVV1VgUT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF.id-B4197730.[black@gytmail.com].self MD5: 974c5b7b49191df2cccb127ad5367c70
SHA1: d1b6e4a7a870b5a8930db86e182827ffb8cc58c5
SHA256: c81c8b8314c0a5cc82d7a9139363024121369ccfed96277af2c52a353ca1445a
SSDeep: 96:uRlsGrmTz7WIFBk+4TYes1XcluU8sNS0aYB/W5YwqNdLQyEnsJ/E9zdDT:uRlpmT+W6VkesyluTOs5ZugpJN
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF.id-B4197730.[black@gytmail.com].self MD5: c8e216dea64c035fbada03ab218c18e6
SHA1: 4b769f4340b08a17c613fe01898c29af15fe033d
SHA256: 59e8a5e94b0fc3d3c164fd0b5fe9e1f7064875072ae35661ab7e3775d94962ff
SSDeep: 48:IJUf4ffDGwq+dPQ23esxpTpwnC37y363g1e8nGKRw:HQffz5PnugTpwU3g17GT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF.id-B4197730.[black@gytmail.com].self MD5: 5d61e4b8a8336dac0c9af5a82e09d02e
SHA1: dc0f5f7b94ee039c02dfef3e598e438f992b686c
SHA256: b9ee91c5afb9599cd82e0fef98f6b0f0f49bc2139c4daf095120565ba25e5f74
SSDeep: 384:Qet59Km8Pi8VR8xfuqOBvBc9cQK+VekWSqOk/:bt59F8RVQOBe9cweDF/
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id-B4197730.[black@gytmail.com].self MD5: 93e0c720496996259277516256259cb0
SHA1: b7b8068ac6bb3a309ecd5042b58a8637e0053b87
SHA256: 6d64eb9840a63553aff3c6a3e4806fdec56fb695dda05b4c2be739c0dc6a0d8f
SSDeep: 48:88CkDgl8XD6Sdps+fuyJ5w4srnLQKLOMNxHvT17q2OR9tKRw:88CkDglsDpPWO6rnLzRqjR9tT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF.id-B4197730.[black@gytmail.com].self MD5: 20fe48be28a7f47366047c576b1bb7d7
SHA1: 2b11902bb6c8434cacd8c2d072bf5a0b536a813f
SHA256: 4eaedf332c96d319ffde6dc05927d1d5a126d544be85ae7bea7b4d1206836e2f
SSDeep: 96:Qk6fZCvjdvmI6vmrx5gEp3nu4wQ4lA5vko8DAy47akH9pNoST:Q5fGdufvW2U3nu4Z4lA585Ay4Fd7
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF.id-B4197730.[black@gytmail.com].self MD5: 7cd88777f3cbc01b29ea0cda2609e1bd
SHA1: 59ec5ab019e17978e29b3d90348ebd0ec452808e
SHA256: 2f2359f90081b78cd50084123ad53f030ca0d24d233ebc276f38ef545a3926f8
SSDeep: 48:PZ1aHZruPgCnE5cpLEQsyNGZ9dbySUqoSasmyLVyaTMoesfa+8MSacEKO8tCKRw:PiHZrwPngQLEQiGSxnFLj2L+j+nO8cT
ImpHash: - 		Access, Create, Read, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id-B4197730.[black@gytmail.com].self MD5: e92d2699d7ac56bc5141fb4b570b5eed
SHA1: d3a495cac4b84d5085e2f336c74c29cb7d17950d
SHA256: 1c1b1d911219aeb45331b8bf86c2cc38a6d8809374de2a021f9d6c2cd64ff1d0
SSDeep: 96:61stipvgfFwgpPa8nvCGMpbdnP4MGrrHPxIZrJjvtDFju6p05qZyvPKT:61stip4N5nMFdnQMGPSZrJDhdu6e0ZQg
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF.id-B4197730.[black@gytmail.com].self MD5: 9f8ccf09b2ce31bb858011576eae33ef
SHA1: b437df4e05997bb13c16d87b20db4e6f68dac7f9
SHA256: 45f214055e21425ee2cf4fa29d012379837d4c86c0bc4ecdf53ad245f2dc102e
SSDeep: 96:xpIwuxV1S1m2R4Odyxp5IyLpbRbotX0gzzztsNSnYT:xyPtnOdyxDVbop0gzqSn6
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF.id-B4197730.[black@gytmail.com].self MD5: 2eea33febe257311b2b75563c57e3151
SHA1: 84141abab6d43e50b5077533bec75b82765c0881
SHA256: 42a3e837f9c2798d60c05a8730066194764745b1446fea59c524d0f894cd4c9e
SSDeep: 96:r5Orvkl+e4agI1tDgFGrt3KncCEmUT3Vh5KtnaT:ricl+t3IfDgFGrtuciUT3Vh5Ktnw
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id-B4197730.[black@gytmail.com].self MD5: bfb9b90f5dbcc29910036964eec22b07
SHA1: 51a992fb78bae8153f4c2cb2c8f8b5a8a3a1e93a
SHA256: a2b6778e2f073a7bfe0769c9d1af6b49dc038cc420a33082ddbfc989a6f00733
SSDeep: 96:bciCMnBAXQTdZo166OtCwgDEZ6spTMy7OT:bhCMBAgTdZm66OtyU6sVv7U
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF.id-B4197730.[black@gytmail.com].self MD5: 1c6fd973b50cdf8dc378fce4433b0faa
SHA1: 1d9cc1065fd7e422c0b1f252824f80ccf7c6fdd9
SHA256: 453979878477780e0d0996e55277f13afb642473a5a6b8596e3bb951fa2c9f3c
SSDeep: 24:MGqNY0k1go8Rf8z4jkWFKNAHj0lkhNlYBv629CdRw:Xq+dgUz4jkWQNAHwlWAk2KRw
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF.id-B4197730.[black@gytmail.com].self MD5: a1c15a03c65d98ec61c89cf8fb5dc63d
SHA1: 879714d969364bd3247a821c3cefc37f3ab85176
SHA256: 04fcdbcf756cbac2856bebb0223ed4e4cc3ccc67690e32a925867819f12abe4a
SSDeep: 192:H9dx/1LeOlqXTMhBRlfx1OXR6HPK6T/u2q3JQfGRuKVBJq5AK6WA5mJDQc8JwXk:ddDLeRDMzRROXOPN8CfCBGYsDP8GXk
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id-B4197730.[black@gytmail.com].self MD5: f90bfa865d286f30f09fb4ee9b10486a
SHA1: 49794f7502dc7e023d0bcc0be4a0515dc1decf31
SHA256: 14d556269da0d828a61fc9816c4a6d0ce7b61316ee191ed65c01c32d50f8c2b7
SSDeep: 384:YYFhCtDR6A/6XweErTFTIK9ceRBCJwZeYnmfcsPK7zpWkzuk+zR3k:YGhCFWMrFr3RBCeeYnmfcj/uk+F3k
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id-B4197730.[black@gytmail.com].self MD5: 9a0f612f1cfc5fa1ee35b716e3d850dc
SHA1: 021e62002d25806111ddb22c0dd19e72c8ab4324
SHA256: 7579a12a5aac0176717a2a2364fdf590c0f40e5168a88788bd67c784c2accc16
SSDeep: 192:/qrEfu7onPQZht9aoepuoSCJlZAO/rHIpbzWtZinlmOY2:/qknP8tzoh2GrHIFytZilDf
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id-B4197730.[black@gytmail.com].self MD5: c05d5055358c41e37be3b6ec8ede0b7a
SHA1: 9b8416a068c0938d05d7f17ee660e3d543906a86
SHA256: a8216f58d8e18c9db38da228e11af43e2878f69c2f746223c07f55004e81b508
SSDeep: 192:I0k/6biOGCv3qQDTNM6jz64zGkhdd2JSLh9hFp4A1n:3kSGOnqQVHjzGkbXnLV1n
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id-B4197730.[black@gytmail.com].self MD5: 50cba9d40008d5ae26215730117e5cc2
SHA1: f52c95b77ea20aa219fb1989a20696e1785109f8
SHA256: 721053d1fc2c7640ff89b24b858c68d577eaca8e1a4b455f3b3262a044644440
SSDeep: 768:/IVcCDidpCu64yo9vbeUc/u0yoePnzk45o:yid8u6RolKgloePzvo
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id-B4197730.[black@gytmail.com].self MD5: a9090c9fb1f660307ed582728bc3ea15
SHA1: 8e30400866666abbaf690a5c344df39187cd24b6
SHA256: 7834579d519eb743e3c75d7c2d9cfbf8333aedeb18cd578072a2133a00a6e758
SSDeep: 192:N5fnwPghs02sVFe+UpSKDqhKtse4lvNSd7J6G5OjkovU0cniY41m5PGtJ6qk1tbr:N5fwohs0de+SSKuhKtse4JUAG8j9Bcnv
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id-B4197730.[black@gytmail.com].self MD5: 9cd224462570c3ded138338f192a41ab
SHA1: a4f2ecb01c2a2acb77b332ec4e82300c1db8bdb6
SHA256: 36293a7a69a33a7a7e469d35a89d2a5ab86574ff375b40a469588d7d14e6c4df
SSDeep: 96:WKJn2Pj20UTuUoUal61AO7Cl4iXF6CdD3gV4MpjIZH+01bVJDYoAT:zJ2Pi7O6rUXZx3Ap8p++VFYoy
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id-B4197730.[black@gytmail.com].self MD5: e8e5d84d2d5a1d12dc64d02f285a932d
SHA1: 97e1e4d7d7bc1b3038ddf6c09f2e3a965b548420
SHA256: e62e5daebef5de34c8bb1e0feabc2d82539041d0efdbf9974f741b5454be2d8d
SSDeep: 96:ZBLvuEcYq3N0ugPne3KyL/pDTQVurLZuhIFuo5lFjt4AAZUBiIT:7mEC3N/gPeLR/Lm8n5PjKAAZUZ
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id-B4197730.[black@gytmail.com].self MD5: 63733ee38e104817241a454c4c30bdf8
SHA1: 1b5fa84b076a315203e12f3815af5a1032dba33d
SHA256: 08d1b4ae184b73411c17b1af78c21c6bd4c6f7f4b687e66e5c5854f30373d77e
SSDeep: 384:pi4bwUNeFZsuRxCSzNjuYOQMfPOoRous0SdoNQi/:pKUs+3Spjx2PNRSPi/
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id-B4197730.[black@gytmail.com].self MD5: 4b77d19e1923a1f44295047de9a471e0
SHA1: 6de66f8d4b7a1422b1a3d4e142fe96043c4d65fd
SHA256: 17f9ec183d59648d223652fbe742e46817a277881bbc9ea5cc632ae40f66390c
SSDeep: 96:RHGmeXPqmf/dNulpDIKusoUssjGZX9TLAA2v1hjUbyIVNqT:4bFNNuDI7oeX1AA29hjU9V2
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id-B4197730.[black@gytmail.com].self MD5: f3d32f8b27c7e8b8093a47d36a3ea3f9
SHA1: 130b7f8500222190316399d4f294b7d77269cd5a
SHA256: c7ded602f0d8fc8e21237f97cd911b6eec20788ea333a1a9d86d3f7ff53be3d0
SSDeep: 96:lFuqfXfKbTCTzXZMQAamxXknbWKzukxKF7:lrfSb+MPHxXWbH9Kl
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id-B4197730.[black@gytmail.com].self MD5: 9e008251763415e2c1eb871f2b63de6a
SHA1: cff7116d82f937ae4e7f7f41ee5337ddd343f22b
SHA256: b88ac89adea3006281e46d00a01bf9415e59340687a1b7ba4374b98aa3889138
SSDeep: 768:JTJ6c0JnGc5hDT+MoOJSvMrDrdRq7SR9To/2:5JIYc5hI0dsuTo/2
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id-B4197730.[black@gytmail.com].self MD5: 2db17624ff26ec8ae34caa9995489fd8
SHA1: d51f659d8aacfd607b4db1085c2b3a3400564b5f
SHA256: 2dcab5a4c6b57df0a887bd63fe5117d8ecc9d5e1bd93788e5cfb4134b0bb7f50
SSDeep: 48:f8pYnxUYuKT5139brAifmVm7CkewW1duYqXL/h9KRw:06xzv13trTmVmezg/h9T
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id-B4197730.[black@gytmail.com].self MD5: 2f876eefb6c8b827dea10be6012bddfc
SHA1: f4a72002bbbe7331270bdc290c277181b01d36c7
SHA256: 71a0385cca67541263ac70bbeb3c8e802aada6439f577c2616202e2a44d8faa9
SSDeep: 48:xXvpswVSkSB585aQl41NOT/X+RHSRAxNmn3Q0Zj5KRw:xfpsMLSg5Vl41NO7OtO3fT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id-B4197730.[black@gytmail.com].self MD5: 7a587ca08898dbe83ef69a27c59924c0
SHA1: 9ef96ab3d8a7001563b65094e897dd676f6f6520
SHA256: 26acf9fc44189627c5bf53c40fba7164e9faf77ab1390cd8d95119c6f350600d
SSDeep: 96:YJEAZShzLU6SajlDjoG3O3fTAKJ+5cqE29to/IX7uUU06idXlDVUu1EHHf9HUTcu:qPw3U3a9dsUKJ+53ljo+xYuWuktg+J4
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id-B4197730.[black@gytmail.com].self MD5: 7102bd33682011ae416def36cffa40f4
SHA1: 67a910711d928939c550fe5415c40c1fa67b6a0f
SHA256: 78a0db34653d101fbe483cfe3ea8a70b2226efe7a52e6faa12105a9c5b52f741
SSDeep: 48:Aq0l7+499ghUnsqe0GdUTmX1KVBnJBS99lXoWccADczcIEMq65yCtSAx+mGSKKRw:lrUsqh3Y+RJGXoB3sc/1UyySAx+mRKT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id-B4197730.[black@gytmail.com].self MD5: f688866163903d13ce61bd6bdf10b87c
SHA1: 2d8f7f6959a2da419eb2bf497c2a34f0d5e0f173
SHA256: 1416a53f0228806569e4f6ade0aaf566e991c9dccc8341e8c461bff4706c2dc2
SSDeep: 24:IJBxa1wIBXjaahWy50LS4GHqdHJAaBB75bsi/HMUX+I8mXt4K4RmkLu9CdRw:IJ3IhaeWuFnK0aflhfMV9mXSK4Rt6KRw
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id-B4197730.[black@gytmail.com].self MD5: 2e121388b9c100abf7e8dae37b66550b
SHA1: 4e0cceceb1c0d20e299787d42c25e651b258e865
SHA256: 028197bc1184f3becebf745ba4b8ba78591399280b0cad05fed51d22032a4ff2
SSDeep: 48:rs6UCug5suTK5O0dztLDjMjzwriHYJkCziKFZ5AQc9EKRw:46FuosyKpwzwrpa25fOET
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id-B4197730.[black@gytmail.com].self MD5: 54cd456fb585c901bf5e07a28a791681
SHA1: c49a10d87ffd97d97e9470d674b62bfc7cf6cd0d
SHA256: e0c65d6a74b6a68eb6ba134269434f6c92f5d287414a75aeaf2c31fde3435e6e
SSDeep: 48:9V23piF+Jl7Cu40Z5FSs0cT2HyZiWHbJJNgKRw:9I3piF+3Cu3R0NkJNgT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id-B4197730.[black@gytmail.com].self MD5: 8168fdddb136e9fed8e12bb0ddc8d88a
SHA1: 1e80a8f9d32886a7a300bdee892905640f3119b0
SHA256: a97d4e48758cef940f5d43933b7190ea767a22308d593db4c481323e19bfefe8
SSDeep: 192:JJDRA+2UBAgWWKYayMf4jO1Lx0XhD2IPNkw8VSmw:XDlB5WD2MwjO1Lx0Xh6aNkw8q
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id-B4197730.[black@gytmail.com].self MD5: 83a3daab4747baa29a1e3d2344381fb0
SHA1: 5e8b7bc5891edfbdd909bf5434f44b01a01c8420
SHA256: b14c2f18d162eb45d70c1923b8c44ba7126614a982248f7f8e639596b84ec0b5
SSDeep: 96:/MpLoTPiQGiyNJGidAkK2RFOki7iIzaboU0V4+CBgRATT:/MpUTPiQfyNXdAL2RkkiZzf7JCyQ
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id-B4197730.[black@gytmail.com].self MD5: d26b96436779dfb4c4b10e80e99ee7f9
SHA1: 9fe57e4a1b39eee5b38f68f4fe4c45fb84fe0276
SHA256: 9709e13528191e2a0eb6ed91453a3f648c527833dc1f495bf2a01669126dd469
SSDeep: 384:D6iZHWmMCOdhtR9g9s9Dz/UNhEYAtTvGuhGW01:VHWmOh29stesuuhrS
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id-B4197730.[black@gytmail.com].self MD5: 743ad1c624d1729142b9735d3d84ecbc
SHA1: bd05f7a68ca19acaeef70ed526455eae61dd673e
SHA256: db9ab3cb66b845197262560c973f42be47aab7451b0b78387bc75af37084db33
SSDeep: 48:/vfAYref7oo+fmYDPIF2Ct4oiCqGyRaeoMWUIneGz6bVManUnAgK8JHxnKRw:/vuf7oBmwQskWCWR/tcejuwwtHnT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[black@gytmail.com].self MD5: c51bf621209e3cd5c40abf002d09f20c
SHA1: d94e49de7642dbd79d236653d6f19500b0e9d583
SHA256: 6129a8d5ac169c5f075f8adde2bd211f3263f09e86034da1ab6d55c749043879
SSDeep: 48:ONkJu/Uxj1r4gDw6Jl0wNLNZMeAkhbMgIYvEzOKRw:qCu8xj1r4Kw6Jl0wNxZpfMgICxT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[black@gytmail.com].self MD5: d9426e905e2f635ec64652023a28961e
SHA1: da80a4da092f5269d2a4bbb766e2dddaaba792b7
SHA256: 0020f69e4c59da35655b4897fe7ee5f68ab4212e4faae1cc0969b2fa50496c0e
SSDeep: 24:QKaWii5dSx6gzrr9b5/0mdYH/jEvSn9qf60BWrVa+u/sjCyT0W38H7sn/y9CdRw:nxjSx6gPr9bVddYfjVP0Bu0V0Go0WsHH
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF.id-B4197730.[black@gytmail.com].self MD5: d496102186b9018a537b25f3a83b14b9
SHA1: bb284f9dd1c621491808fe12bc9f8179bc2d0b90
SHA256: c7a60f929ff92d3bbe57debbb714d220bf56336da3ed619425f799775103074b
SSDeep: 48:AFsi59cuu6dFt8nc1ehQoUyQYgjrkuwoYv6E770fOKRw:AuzItScczUpYgjuCXGT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id-B4197730.[black@gytmail.com].self MD5: 2884a63471e36fd918c911496b3e9781
SHA1: 6cdb84a0c7d785c8c3ae8f8f61b881f5a41f33f5
SHA256: 6fa78f74350fe1287cc5e4bc7b9eebbcb9116019acf75dbda8e65ebb3b6f0279
SSDeep: 96:h5C2Bgs+/cQnd/nj4vLlmGJHzhufyelGUegerwkUk6cfN1l4ekLvfye6x24TIDv/:q2B5AlnjALZPQyelWgerwkkqblyGe6Q9
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id-B4197730.[black@gytmail.com].self MD5: 16f4ed4a0139c612d98f471464bf6197
SHA1: a06ea31076eac97103eca0829781ddbf74d1d5b7
SHA256: b41d2957f98482f8f6b7626856e35a033ac604f1dd5b46409298b98a425b60ad
SSDeep: 96:XtI1h7TGEci9EYeyNK9Tss9ZXNYV/qbeRBEX/T:kh/GZkM9Q+XqVk7
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id-B4197730.[black@gytmail.com].self MD5: 13b5ec87ee3cb04040b6bdef5cf72c4b
SHA1: 87767d583f3e08a6a22194eb195d35a4bc66dcad
SHA256: b5c96749b829e197cf2f3207d975898b4de12678a586de3de6cb37673eae2452
SSDeep: 48:1JTr6S+KDSxS153BJjacNw9pqrqnpun0au59dAOVRXrYd0WS6cospQtKRw:1JTrF1DUS1jW9f8utA69/e7tT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF.id-B4197730.[black@gytmail.com].self MD5: bd18682518950ca874406ce61dfd3aa9
SHA1: 8fe2eed28f57ef1b76e612b5d7aeeedc9ef8e88c
SHA256: 8cab1c91905bcca6b81f9eab40bcb07b786c24fb684b4ddb3db45b4a6e59c723
SSDeep: 48:AGxKcIAlhcS4gnpINQP+N9H11bSamxyAsXkeZirQHKRw:AMrlqSFnj27/bkSkewrGT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id-B4197730.[black@gytmail.com].self MD5: a92cc89f6b6c550011f1dacd715e15fe
SHA1: 14248ea118514337e8177fbd4b19b202734bdb98
SHA256: a6dac7f3b5fae8699c20d580256f27baa86c3e14a718e5d539ad244883bf49ae
SSDeep: 96:nStMwAAwO/thf5fpMCIjZeWGwghHE5P+gKTEr7VT:nStq4thxfpZIo0+s9
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id-B4197730.[black@gytmail.com].self MD5: 6c8d5267cff26166e9213a27723b29f4
SHA1: 973cc5724466b773386f51a02547381a548f1eb8
SHA256: a6e1aa766617757746fd37833ec4a39e2904c95559eb42252a5e80abae79acd0
SSDeep: 96:QylJRo3g889KAlqJte878PmpMTP5Rp3VGY+tUiyqhuqfH14FIBT:RGg88snJtX6NPJcDUiyqkcRp
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id-B4197730.[black@gytmail.com].self MD5: b81234ac1104059373ad36c3053d1397
SHA1: 4baa2cf8a1a84b7e167601e182fc108f890fde0a
SHA256: f47bc6426f162992335f84b6c541c3e208bb54d05e4ca6a9809608a2adcf9a03
SSDeep: 48:94LvMAZA48RqZdB+WKBSLckqFDoyVSsCLteITy/YkdVPzrTt+hKRw:+3KaZ+WmvFDoyVSs0+PzrTt+hT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id-B4197730.[black@gytmail.com].self MD5: deb3f1be39c989231b4feb150c2f6533
SHA1: d23b7cffbc1e579757c3081e5f65d8be06e049bc
SHA256: 18c3b1fb603be37997d6eb07ca3b077b6ac215b3cc6df7b4a7b431d38f5f5e5f
SSDeep: 48:xnwEPlPh499225NvKGuMh8ULQorqGB83WPMtf+KN6yVjzF/zW2Dha2cP8OM1YIBL:FPlpb25YKSULQqqGBreVN6yZpfa2vju8
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id-B4197730.[black@gytmail.com].self MD5: 8f80af2d0de6a572125e3495de93a031
SHA1: b2daa48f87150bc35f28d9aace9f0b34dae03d13
SHA256: 14304ca83753d27476855dab7a05a7e58b82407b8f28d2162be0526aabbdbc27
SSDeep: 96:IokhawlTi/V5Oj9w7k790yX/LZMY0sbIL8ntJhZpp5bC3hkb1TuR8QT:ockidoj9w7k7xeY0sbI8zC3ib1TuR8C
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF.id-B4197730.[black@gytmail.com].self MD5: d59716afd2d4a90d4a6d9b5a77642faa
SHA1: 6bdc2a4214f480d27c889f2bdb67c79c1a4ac9cb
SHA256: 271ea9de59580520996ba7e7865f9856eb762a7ba3c60a54a8858a2cdd965dca
SSDeep: 96:E188vnmTNLKL48O9eWkBlf+kVmOy+JiQMT:E1dvgKL4f9Ji28XbJiQu
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF.id-B4197730.[black@gytmail.com].self MD5: 8b27afa0f32bfb827b6951531b5af169
SHA1: 6ca980db132d57ef1485fd1b74b829384f9c013b
SHA256: 699bf2edb0af56a26c0441e1249497cd8fd1e7c0bc6ad44d657167277e012b16
SSDeep: 384:TO+pB1UO6HdxG8+W96MsTnK7DsC34D8qNU4B/Aa7i/C:XB1UR908+0EbC3I3UO/f
ImpHash: - 		Access, Create Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id-B4197730.[black@gytmail.com].self MD5: 67910f4856409b5e9e73af5deffa3c40
SHA1: 796f0022052c339184fc4793fcfef1c0075746e4
SHA256: bc8288fb8946a3fe03209ab2553ad69ac61f4c5cde8cc79692d19b648121ca94
SSDeep: 48:o2PvBBD5tCnBHdcWKkqR9rsLiqWNj0r8v30J+VSt0KRw:nvnD5tCJ6Umsr8v0cQt0T
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF.id-B4197730.[black@gytmail.com].self MD5: 9437894ed6d28ea521f151ed4992caf9
SHA1: cf15c5e28d95e40cbc08b0beae1ccc00c4759b1b
SHA256: 5c041aa4383fbd514bc4cdcef62de84e54189a4c57ed07ddd4c5415dbfb39cb0
SSDeep: 96:7HYssNyEPGV4HHn66C4ZPrKBu7LEG2vWW2dS+NTInxL2lT:QyEOV4HDCKTKBu0vWW2Y+NcnQt
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF.id-B4197730.[black@gytmail.com].self MD5: 7b6a152c23eaceb47fb18877c31e27d8
SHA1: aecbd2d8588a3cdddc2462d99b6e5d2759914325
SHA256: dd53d9ac53b21fa3bb48e8dd3c49486dd92f33b44b5cf737980384bc852f250f
SSDeep: 192:lDdW0RanjHEP0VhlBrEcbAXazIDA49/6iTqRS9QP0jyhVN82Gt4Gcu9Jh:ZU9njHEP0rrEqzkRxqw9QMUb/Grc4h
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id-B4197730.[black@gytmail.com].self MD5: eb24f61dfc64ebbb74095c17f6aefd57
SHA1: da25b65f632a189a9d26b2f64b6ccdf491225497
SHA256: 4133d5a4f1d4cfcea4d5819bc285d3f6df7c9b4a2292da17903a255ce2751679
SSDeep: 96:hpdTjmvXTJ9+BE87i24B6/g40thKlJkZZT:BcTJA7I6R0tMJkZx
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF.id-B4197730.[black@gytmail.com].self MD5: 951cfdfd5cc76ebc1757083e4554e214
SHA1: 0ce9a65a8ed4cff0e132dfdbc0adc9c5c78659cb
SHA256: 22dc4f0f9ea47a8a53722526ee0011802dfee5e50dece9be0f5c4cfd9845b3c4
SSDeep: 96:TL5k4yr8znw2ogM3B9JmyhOEQMs712tTQlw+Q5+8n:hKIwxztmuOEM71WTQlw+Q5+y
ImpHash: - 		Access, Create Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF.id-B4197730.[black@gytmail.com].self MD5: eb479ea4b4986a4a0d342980ad9cfd13
SHA1: a9ba60b1306e26bd2d9b768fde6d9b87e736a2a3
SHA256: ef1da95fe749c0733989e559406fae69a14aa0a9ce46edb1d294ab30006882ac
SSDeep: 48:0xXKCJ1soJrTguZko5ywSufjlQRLyOK3jOOa3FHf9XQRnN3a9LajHZiq25fX3KRw:GX1EoeuX5yIQhyOK3jk3FHf9gRN3aNas
ImpHash: - 		Access, Create Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF.id-B4197730.[black@gytmail.com].self MD5: 135323904de5afd169fe67f151b018e4
SHA1: 05719aab7df7d215b83ff00c818214c3d172ad28
SHA256: 7749cf1fb6810c413bcd7d6e37e11c75cc1aca4b8b719f906a03c1d463b5e4db
SSDeep: 48:3r1/PSPEWakvantkF841H2Fat3utPkd+e6dh1CD9bYSd3IWWWPwKRw:btPEY+F841HfetW6dOD9djwT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF.id-B4197730.[black@gytmail.com].self MD5: fd44a21ad4162255ead4c4de4f92e84f
SHA1: 6e186faa5639d91e169e8a6e1963686dd7b075e3
SHA256: cf6af3a2daf62178a858e32532a6ce1a569a9a3fc5d6447ab5f470f1951f9268
SSDeep: 48:qZiSqDPy0p0J/GxKcEGv+cr9VtSGzoNjD0n7KrtfPT68uNz+nk5KRI:q/4qWPxN+c4Gzi02RXLe4k57
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id-B4197730.[black@gytmail.com].self MD5: 183211528cc2d19103f647b39c64ba80
SHA1: 0d08e4ded0f2b22193e851a65f284bde58bf6a29
SHA256: 6bd213fc85b90154010784cc8e81612110d986bbc60e6e0541d578dde91c13f2
SSDeep: 96:Q4JHgwpfA8Y1khZOvwqzvyCudTsAxVB3fGouHNJfHeEdO6ijQBzSRX9ZwubJ5ezs:Q4BfA80khZKwqzgTsAHuHNIZ6i8BWRXr
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF.id-B4197730.[black@gytmail.com].self MD5: 823176c33977d910407c731da8b08e40
SHA1: a6d358e13f9d2686521e3e27afe7a52d78b00c22
SHA256: 9705eff0447bad2d01b3e9fc967f4abf6463da3edd2a991b39d131f254b75ae5
SSDeep: 1536:iG3uQYqxHln0PxguL3bP7ypHqHRcWe/4x/EN4:glqHl05P3ypHqHRlBEe
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF.id-B4197730.[black@gytmail.com].self MD5: 51afd4de8f3a23173eb941551cc89ee7
SHA1: d0d702ee6581bdfba2f5e7ec0e56723f34270d17
SHA256: 90871345d4c6c3c3bd5030b80214ef7a85001b435e40bd2333b3f0a94daf3c05
SSDeep: 96:qyTz5Qsug4eWimCjJY5At6Eqoe4rAx6o2R:qSQI4JimCFi665oe4kva
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF.id-B4197730.[black@gytmail.com].self MD5: d8276fcab2dcc1baae79e1cd511b8cd8
SHA1: 4e5bd04f73f3ab1db497c9cb27715b754e94e822
SHA256: ece5438188c113093262aa046627a6ee092414bb4bf8d76d023802d108f0cff1
SSDeep: 192:HdvU9V2sjIoxI/MiG799nKYL5rwjB41q/dB5L4Tr59QqlAsCZCwg:HdMQ0Iobi69nKYL5rByB5UH5eqldT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF.id-B4197730.[black@gytmail.com].self MD5: f71c8bc2ba94dfa6d1c4fb61a9b13644
SHA1: 8741f83f65e5eac3b295b2c08237a58619973b10
SHA256: ada6f19b74b70514072cb17c81b39a4d74a8bd04b875e880ee5548fa770726a5
SSDeep: 768:/FSj2i02hDjs7qCSuRlBLURXnI3MwV8aRoMum1LzGx9/t2yZvzms1LD9M1UN1:ViPNUS6LUR4XVPR1um1Lg9/sormsn3L
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00121_.WMF.id-B4197730.[black@gytmail.com].self MD5: 5a9dc557c868854580f75ab70bf23d03
SHA1: 7a6e071dd3fe37169f25df0ba77f7c809468fe90
SHA256: 26594db6afb101b2906d49f6c7bfc14ab031fee3b29e505186c16924b7ebba9c
SSDeep: 192:RVbyU+culZHzR+BGGXOf/oyO0E7AY9tIQfU5xLq:RFyUEzR+X+f/oy675Sk
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF.id-B4197730.[black@gytmail.com].self MD5: 00d04e60de1864f86568920e521a0ad5
SHA1: 463dc5ebdd655b77bd3129f0f3d6701405817ff2
SHA256: 01b1f5a096dff2732e4f5bfdc396f3c45eeca0dac5262676b3b22988f19c913f
SSDeep: 768:9cv18FvaGihSvMe17lYYIXJjAYTJUTMkOtodatV:gmaGZvM8+YwE0IMkOtoG
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00255_.WMF.id-B4197730.[black@gytmail.com].self MD5: 49affed4fc15fe8db4139c889d540459
SHA1: 2dd6157be2edfa637911ff95587e7c779632ca42
SHA256: 4bd24a8c53b874c6a19563cb99d2418b4aa8163ad21b958f77a070907432cc58
SSDeep: 48:0fOrUqS4IV+wOisksCq1WoQ+hn3XoSvk0Cig0ipnPqgYO+7F/KRw:0fUUZ44+Nqq1WoQOIBKg0cPrYOST
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00256_.WMF.id-B4197730.[black@gytmail.com].self MD5: 668f359f60b8a1e857ce1ab4e8b337c5
SHA1: 4749eb6acfbdfb64f7636b11272e9ef9f4c3df68
SHA256: a698dead4c71fb00c1984e5b08e89ca967e2f1232fb98ebf839a2eb71d4a5c20
SSDeep: 48:E5U/xCIRwb0tsGL4x+8R57xXEjtlStRd+8r6xTkaLWGsH0S7AAfQmFKRw:Em/xDw+8ijj68gIS7ADmFT
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[black@gytmail.com].self MD5: 19705dc269168671fefc7fe252b7c1f5
SHA1: 775b106ba27bc8e351d0ff8e76e9616ff7b17df9
SHA256: 11daa7bb3fb8d6dec1997dc65b5fe247d9992702173c0c8d6ba0d79e4cedec6e
SSDeep: 768:TnGpszOT4KrJEjQTtpmX9PVYuRcEsznKzWn1Q3GL/ZhkmTeZK7ICtxO9fUcTSs/h:zY40JEjQEKEcEQKzWn1Q3GD7vTeZgxza
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00297_.WMF.id-B4197730.[black@gytmail.com].self MD5: 965b04e44e6b08ec50f6aa479a445c13
SHA1: aa2b11cfd6d37374a2b2e5e9e971ec7a8065e5d1
SHA256: a7fa99e39b2e2dd2fbd926912ccaa6318ec9c22a246c90e67118b1e243168b64
SSDeep: 768:2bmGhJ8cRF4Q0WTKWHaNtB+NrbZVKpjmqiJY9ux6Qg/UFTYhDdM2BvCShpTyy:bGhJ2nWTKBkbV+m9dhVQDdplhpTh
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF.id-B4197730.[black@gytmail.com].self MD5: ecf50ddf0e62fe5602c7d81f773eb550
SHA1: 324006816d4c365d140a99524d30bac563c0460a
SHA256: 01cdba28a43371736a139e503ded3262e4d3610c0b9ba33da151479040e4e2f5
SSDeep: 24:l8oKtx9FzrBuhct9WXTKzIK4YtVeC99YE2VgojJuX59CdRw:l8jtxzrohyWOzv4Y3x9KE2V9jJGKRw
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00405_.WMF.id-B4197730.[black@gytmail.com].self MD5: 0e91c92c02608517cb356a14ce599066
SHA1: 8aa9a2c087c8aecd2fe2921b5f750cb575215dcf
SHA256: a043ba3102c0095b3e48584e2db209925ad8c73cac83cdd8f14f1b446bed730e
SSDeep: 384:hQYzV1UVaG37qAK9LlNtIQRl8uGTH9m+c+FksReyEAMEwUPD:mWjOf7qAK9tjcCswyEtErD
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00407_.WMF.id-B4197730.[black@gytmail.com].self MD5: c3c6fd2c94bdc49393a158b8fbd65aeb
SHA1: 032310b332211bfda8389b9a43db1f6169f4de85
SHA256: 865eacf1444a959194231c9d2b6a7970d19456e8e4bc9ab597976b1c44e162c8
SSDeep: 192:Ga96o/iNUF+Z4N99/Vr6dqEV6tvHqu7ZmkDlGUnsMh/0R3qzKyEP:pi+2o9b+cEVivX7NJGKPqR3S6
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00413_.WMF.id-B4197730.[black@gytmail.com].self MD5: c8e49b64d2ee1639f44be7d8546e7e01
SHA1: 0341639fa55a675daa47982a2ab9a8be63755bf6
SHA256: a337ea6402971da6c6ea85af21bebdb55d04eba516cd1181889b38db8247f323
SSDeep: 768:5FlDb5vsdmdR3aQkCoyoDVM62VDaWA8HrwFomhK6Jv8jBa0TlO9kjq82hEbKNHpY:ZbZqmdRoyoG62LFmV98jQdWp0j6
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00414_.WMF.id-B4197730.[black@gytmail.com].self MD5: 0248b7ebfeb398dc6249e9073632b50e
SHA1: d94f2ae5157a898d17eb1a0a275431caa45aa0b1
SHA256: b80a6964ba0d1f4d188ceb76d1fec63536519458e32600c180f11ccf9ce275fd
SSDeep: 768:hq7cG3HjtZ1Dee+spnc0SqPuRBLajYqsmmeJxyCs8wmcmU5aVLa7bZCCU:hq4wJ+spncm6LCv5TfzsbnZCCU
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF.id-B4197730.[black@gytmail.com].self MD5: 00e71fba36c16b5e0261faa9bdd33d7a
SHA1: 83ac7056829cb384eb48a196e9f14886c7377fb7
SHA256: 4e9acd4df593ca77136c87f2280440b5dffd04d8911daf5a555be9f0e535aca9
SSDeep: 24:vqShlohiyIs0CL1G7bFAJD1CJk0aPRWlR59CdRw:vl+jJOBAJMCRcTKRw
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[black@gytmail.com].self MD5: 08c4ed7249a45ce93fb6d51a2b550c34
SHA1: 669558000edf869cdfeed89f0d9d87e74ca18d08
SHA256: 83f159f49b5e3d257f82662c432fc30779d12e503716f0ecd1f5644bfd614ead
SSDeep: 48:POqfkJFxG6JQyTFps8vC9XjLrA5qEKrKVYSi/KRw:18JXRQyTv8XABVLi/T
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF.id-B4197730.[black@gytmail.com].self MD5: de55dd6ebd0460c032c979349be912ad
SHA1: fe01b9780532b59ec6f3d2173de76bc75a27f042
SHA256: def9059a32324254050043808a67bcc0ff4ac1d0b561930159b88ab152d1f35e
SSDeep: 192:5H1em17zehdFrR+TNvc7xtDmHpUXv8aOFxzMZKXDmLLvCapbNe4Xt:hkAyFr0QxtDmHpUXvtO78KAO4bNeK
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF.id-B4197730.[black@gytmail.com].self MD5: 2747ebca740ee139dc308a133235fb8c
SHA1: 0b02423d285199bdc7e8f8847f6105b8b0d45617
SHA256: e94915da4285c030e02156c5670a792bc191e5704c3eca56bdc4bba72f258f41
SSDeep: 384:zXhRLlvoMNEp+Wjy60eeYSZPo2VJEAOyCoiTDoxgYi+XbAa6q28pKNdPwjn:zvlwMNG2geYOPo2VrCTAeYiwbPppgd4D
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF.id-B4197730.[black@gytmail.com].self MD5: eb37f4eae2183bde8f61ed89f95de0a6
SHA1: 59f521d6b37423f1f307c4f827a08f3936320c65
SHA256: 6d442d44cdcbb189e0bd863ed3342172a8f66da6c2fe4d8a754ae41d011a01a0
SSDeep: 384:pWSI/2JO0iAE9e1kBrTsBCHpekO35QBmBsB3fzyfC3ZDBg0TIW1aSPkshpn6GJ0f:pE/AE41goyTSPBsBPz8CXjPtksLnCiNK
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Program Files\desktop.ini.id-B4197730.[black@gytmail.com].self MD5: b334ee0a943e9386de9b5f02980bac57
SHA1: 74dba5422a866fa7055c58bb5eeea3c452bb8d64
SHA256: d1be2470db8aa316875ab0efe61b9a6ac9c9e091da30a9e8a7d35333c4667b9f
SSDeep: 6:16tTqNvM4FlITT7mBNVGHRuGfgJ6WCh0emok2F1KWzn83drb94pliG:ktOJMmlIPwExtX9k23KW43d394GG
ImpHash: - 		Access, Create, Write Dropped File
Malicious
C:\Users\FD1HVy\Desktop\1svhostru.exe MD5: 474c8910a8137e44e13856ae17545ffa
SHA1: e558798510a3311ae74d17f6a2dcefa2c6dc82d8
SHA256: 270e465ca40ea4c7d3e561861eea25e6b552a309f7318dbad11004c8dfdd483f
SSDeep: 1536:mBwl+KXpsqN5vlwWYyhY9S4A0jsJMhjIykURWxPIlF:Qw+asqN5aW/hLKjAyIyk8WlI
ImpHash: f86dec4a80961955a89e7ed62046cc0e 		Access, Create, Read, Write Sample File
Malicious
C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.id-B4197730.[black@gytmail.com].self MD5: a2a6e58163b276fd65933b3eea7505d9
SHA1: 3937c80cc1ed20eed29d5604c9774a168e010afd
SHA256: 980e0d6aa3934d46ede7b0ff7d79243cf85fcf404b92512f8e3dbf7761d36571
SSDeep: 6:/OjcFZ3Uel1DmRH8lD7gfv0e72oet71KWzn83drb94pli8:/Icz1UH8lIPypKW43d394G8
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.id-B4197730.[black@gytmail.com].self MD5: 296b67a6eabe5840f6500297b1225c10
SHA1: 0006b1331612b82e5c8a61c50e0380d6c7a03f6e
SHA256: f2f8dcac4cf294b671428b16a9a627436955d5a86c2b525131348583c94bdc4d
SSDeep: 24:wdpFLiJV6745ogez2DjbOYov31f/eH8l57JILlulwHS:wdzWJV3/SY+328lmS
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\588bce7c90097ed212\netfx_Extended_x64.msi.id-B4197730.[black@gytmail.com].self MD5: 20414baab95b2430c08a7197a8c2d495
SHA1: d9d5e397dd37959057f4400249a02c6a6eb92ecc
SHA256: 4a7d014d516929a5abcfd7d101de7bf719e7ed440d3d335b07ff80a0af0f6fea
SSDeep: 24576:4gaC1ny1kI4pYadJwKIo8ieyFo95Jbp3hvkfs87c:5aMnykFpYadJwuey05JF3FkE8Q
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\BOOTNXT.id-B4197730.[black@gytmail.com].self MD5: 2b7ec57ce6873feb9b8bb9dc5ad5f850
SHA1: 7be35dbd4f58d6de29e5ce2d33a3ad6c3fba3ce6
SHA256: 75ae505605b392563237cb205fc099c58740bc24fdb11131d6864c1b82a0d959
SSDeep: 6:Nh25slU0eZf7iYfIQMHlanfnbZovLyYiozGVl:3K3fIQilOfnlwvfiP
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Internet Explorer.evtx.id-B4197730.[black@gytmail.com].self MD5: 5eb0b3795f5cc22e7945e1bd88537f42
SHA1: 572c80502eeb80a2353238cd1a3b3ad40fe9e1b6
SHA256: 30dc7703844decb020327f09cfdf5cb29155f539bd194fc3783b62aa414075eb
SSDeep: 1536:26yzQ5kKZRD8geTSmBTq8V13FWm4dn8bBe3gUYfFPktGOt:26ycVZODIibBWkFPkYw
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[black@gytmail.com].self MD5: 3efaf23bf5e18062c96d07eee3388651
SHA1: 14bb3aa7f03d709ca3bc22d9bd5b2933cb3b6421
SHA256: cd2bcc633cc60f8ee51519e925fa0a4d8a07397b755bf43b400300ef58809d86
SSDeep: 1536:2IY1GJxV+lCVPjYR3/ucUmoJxELeRpv6yFd404:/Y8oQPUR3VXmxELenh4X
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[black@gytmail.com].self MD5: c0590329d73b8ee9d99f1e725d96d8e7
SHA1: e3df40252d17741b17bfc264a04112e21fd9becd
SHA256: 6a19bf38e022fd143977cdc4f95e23ef5a3bac2bac256540d5c7260244c2a5a4
SSDeep: 1536:s+egWJjhcufGel5QUFvDbJXIW1FSx5YTYJLYP9DUnwFMCuHRP6OaC:s+YhTueMY3JXIuSxQYJ8YwCCuHRP
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 8cc78ca829525de481d82d9546ba561f
SHA1: 6ecdf213055765b1504df64e24b61fddeb23487d
SHA256: 716f21828eeca919505d982d53606c01bf9e15a7b3eca8cb9674ef2808270c07
SSDeep: 24576:zxNBmLQ+2BcJv+BhzOfgJKXPHH2/hiCQEYzA7I7ZzTgttFjphnII0zMsSOMkv5Zx:tek+2Bq+DOoJKXPHH2/PJI7ZzcttFjpI
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 34668780ed12eb2b3508d265cc7bd75a
SHA1: 53e160d1793121533abf7d4a6b3d9e2a9d3382a1
SHA256: 19595fbada40a4cf4be62a39b8fbd2696a0ddd575c660546679307c808d74e56
SSDeep: 24576:ZiPcoGVwu3RBpRDpj4z5PbDFvIHDK0QV+Xs:kBwfp9V41PPFvIjK5
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[black@gytmail.com].self MD5: bb78a7e670d3d3abac03526c7d743ad5
SHA1: 58478e86bda56b5f00036e607395c730e4bce44b
SHA256: 5b29d253e990ffb51083de820d93cbcc02bf1c7280d847a82ceb0258387095cb
SSDeep: 1536:pFP5mNA9GYp22jR7NltpCOoZqxiXf2AQCeS/TxOuY:rBmNA992oR7zt/QPh9TI/
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: b887fb18792f06095d75c276f7f8cb16
SHA1: b8c1d1c12df4d7ccb8430988d11abe08c8bec7c1
SHA256: a0b5f729dc2ab059a19f720f534c08f5d840382d41b285962316c5b66d03934e
SSDeep: 24576:Hfa5mOJ+Pb8O4ZEbqytfcyF81AfpPIZTWqz:/omOJVO4ZEbqyNcpjT
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 39acd37457f1e611f5174afe1bffd51c
SHA1: 2dc60fba5d199e94bdffcdc35abc7b926aa23fc1
SHA256: b27cfe531baa47a6b66c446b0e3a4d4bcae15afff70f18d3c8baab02612793d3
SSDeep: 1536:1CdVi4mE6PnA8lBQ9z0NmKCg0PEkQn8RD3KU1SCDAizegNGIl:sdVi4V6PA8w9z8CtsX8JLlhSIl
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 5ebd482a4206901f05665bba63344760
SHA1: 084e93f238e7c6de41f95e07f8afabd45dd531fd
SHA256: 721a57e945044e7d9a757146007e3a108d07c1c6fed7b3c1729e707b1780db95
SSDeep: 1536:AxYuYth191V6nrmo7e89/TPDp+NGwVKHZPhChPGohGjHa/uxcIa9:yYtX91VGnH7PDcNGDPM9xGjH+79
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: c441ebfaa37e2b26c8a791fbdf3a24e8
SHA1: 5e4d9737300268d0cbfeb4a820439bd1aeb1f2af
SHA256: 5a2beb16cef144fc7a4ac2def3ebebdbe210aa305ee4e401c87ca8062b7bba59
SSDeep: 1536:k4pYeYlC8QpcCW8IqyrXGD5nAVJXpMXRE7Rmd8lsWBpaNdhAcI7:k4eeeTQpcH8ewneXpMBjuE1I7
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[black@gytmail.com].self MD5: 5570f694f36a6021379d3bde123e9a53
SHA1: 056807a0f06aae036704f09af7396e8bcd688f29
SHA256: 62e6fc3a1e246f6fc7c0d09310faea63cdcdf15b3e39695f8817bb270b5a51e4
SSDeep: 1536:33XHpfiB4PWQq4MbXTjHNZ9h+Utr2x3y4trtYLJKzxeMk:n5zPW/4MbX3jq8rN4trtjQMk
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[black@gytmail.com].self MD5: 9359465377422eae01e3ccdb2ffea825
SHA1: f741b49cd91d84070085c5afe4496005cc2c928e
SHA256: cca49207187b29323afc50f3b1159b4e64d79a4565f78007bcb9b07249e9be1e
SSDeep: 1536:OKw1wsLqTNzkRPQ/OkIGqmAYyYdylHVE2lZVpUCje:OLAoRPwJIiARYdqS2jVpUCje
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: b6913d69749b5e10c742ef342c93ac50
SHA1: d01bfcae20865f391d8f2643305a662f97fbd1eb
SHA256: 2af83c708717c0fe4fab4fe80433267bfdfec178b30337eb495d4325e08dbff7
SSDeep: 1536:YdhzYZVpZvMPn/9tlWMjj6t6epE/HQdmGFmDCUviDYvAvKrI2t2Eb:YdhYZVpmPn/9P9j/4EfQ44UvoYvAvR2z
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: d743fd8c8dd071a1dfb77607b3bfbf2f
SHA1: d8d9d9eeaab1d978fd3960607971547e72a2cefe
SHA256: ddd76674ccb259efbfdc64128d54d9721ffd31bc9ce62322b786e443101b2ddb
SSDeep: 1536:XPxAC/P8tjjD2OJhayNWgl800/GbwN6u3nUb0siXKZKQ4D5:XPFPEjaWhBGNOb1xb0siXKZKjD5
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 0ebb941eae30bb1c85f67ba04fd82069
SHA1: 23fb49fb8260fbffeca07f0c415e173096203975
SHA256: 1f9fa4efd888d452ac873a10e34f3aa8426dcf27b79c0ad835ddb79a74e32842
SSDeep: 1536:wrPhgWN1mq3VAaSNgHT7oR0bXJAFuObbcdtCHyEP5Ajkl:C2WXmq36KHTbXxObIdarakl
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 158dcfad5c491c0d7ec6802bafccb028
SHA1: 4441bd89bdd5917b575d0d998a8a72eed0fa2aa7
SHA256: 3f7ea59baa942f60f1f36b067ac6171322b5efe9cc860229af311bcc8e2777fc
SSDeep: 1536:Ho9j6D4pyLJM4Inkh9rxOr0dUxesE1+kjoRONRsOQYouFdAgXKNwOy7:IMD4pyLJM4phAEsu8RARsOxouFddXKGL
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[black@gytmail.com].self MD5: 84dd8bcfbe29db88e992fa85775f0475
SHA1: 8d5f2b09371b36f19a97795f1e8275cf611f8673
SHA256: ea28b7b6e4b723ceadd2268cac55a452483c7f7cbeb2f6433e8e985c50d543d0
SSDeep: 1536:OVisZ058dNkYPsEWqm6qDjasAYWJCQ38J6oF3xD9Ln3:vsZqNOXm6UubJCQINBRLn3
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 21db7e36db7f45e7058154b7df7313df
SHA1: 90a9e4441f1343c78b24c76cf65321d4935610e4
SHA256: 9d94c0b6a55e668eea419e2c941a6be3c230f5a06d03bd1bde10b862f707299d
SSDeep: 1536:FTCi4UbrtVV7KOMrQRt0EZqLYjWbN+80DZ27nSL63:VC23hWZFHOZ2DSL2
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[black@gytmail.com].self MD5: bd1966a2c4f9d362f10f9b077402ab80
SHA1: ce025833d6768f9bba40333b7c63f5c86c7e8181
SHA256: 2b1f0bee631954521397f6ef023cfabf1ee18ea63ab93605aaa2237c64b5b130
SSDeep: 1536:8G24HyGlbaoKMJIWF0iBVKo1fDRV9fTptR8NBU9Nq+t:8ayGNamJ0iBrfD39dtSk9Nq+t
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[black@gytmail.com].self MD5: ae96a42bea888d0d5f663110117f7a92
SHA1: cb58d18214912d45c13ee2ddae24adf2198dada6
SHA256: df29235f8f534f89131d0872ed7f27f6f844ae91e229ca6ff2ba45c7a103e5e5
SSDeep: 1536:J/DAD2ue3fatq23iozEIX0E9Y+1MwQMI8T1JCxvstyrV4Fp0:JDAChatqaD/EO9c8i4FK
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[black@gytmail.com].self MD5: 4876bbebe004dce91e4479ce3d8c3c42
SHA1: 556327e12e3a31aa1c27edebcdf69f3517b176bb
SHA256: 758b24115377bef288005e023855b04df8f3e7bea906bd306418252b8aa81509
SSDeep: 1536:Hqwe5E7n28lvhedmAOH55zqRQOUMtL1AIGZZaGh+rGJR:HqzE1lha5OZx6BZyZZaG+8R
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[black@gytmail.com].self MD5: 6e52d8ed85fd49aa1ee9d6f855e32950
SHA1: 74061dc426463a4e481e3d499b771496bba03a99
SHA256: bdc60323625637c2235dc5171147c3c7e8d1ce131419bd5570dfcac46447477f
SSDeep: 1536:cIcXBC34dSt0EIzOVpqoQFs7FRFUCvqavtAsa/dTokXuG:cRrEIzOPHQa7LFUCTudToNG
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: da6a09ee676574274627925157841c5d
SHA1: 1b1a3a51c47e5eddcd0fb649c7d48aa110b6b35c
SHA256: 8db2ea759b6d7deef3bdbb5a9cc4056364aab5973b8b0063068b1bef944023b4
SSDeep: 24576:iigQuduAV2lVgUhKAGRZKek6gN5Ro6UdwG/KNtI:dPAV2uzMN6gN5RaOG/
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[black@gytmail.com].self MD5: 7d6cae0e0f683d2a2037f4b275fdec56
SHA1: 5c4eb6fd891bdb48e62f2b46011ad2ea4a4f3618
SHA256: a9e7adb9a4db4521284d47d0e05d1f64f3d1dc26f06b2042da789a140d3d15ba
SSDeep: 1536:5LDIGon5Jhh+5ygenZsYSF49bfQoeWOR2K:pDIp5Doyg8ZsoQolON
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Logs\Windows PowerShell.evtx.id-B4197730.[black@gytmail.com].self MD5: 7ce41e7c5f58e889c69cc480da0afd27
SHA1: c8bc725efa2b1410f239bd1f4c463e3149f66c5a
SHA256: 86c592bb4718672fe9a373aef507a15f557cbf051a5cf60874b3be2437df94ea
SSDeep: 1536:FrY3Z2v5iuyfSUvzsRQHsrv6bxkQVjF0IFpj5jG2jMxp7Y/:UY0nSUvzwQHC6bxBEIMLY/
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id-B4197730.[black@gytmail.com].self MD5: 0fe198f8db45b67f98d00e8bace9c351
SHA1: 1c7ed72cbd09939f089388d647fe7ea53b34651f
SHA256: 642090a0c22f35f14179d174be953e19bf9dc140f5bb466c4a4b3d29382572dd
SSDeep: 96:iITNfmXIjre5e1/lf3d6ad30Zx2dHTo+qX/BmzhmbznTub:hpfGIjplV6wG+T/qPUzhmnnT8
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id-B4197730.[black@gytmail.com].self MD5: 3baa4d8557c11654d47c953cb1c63785
SHA1: 1af4febcfb2aa550fc470af9d6c5120d25baff8b
SHA256: 617ab1ccfa7d6dec82cee6e5fcf8b80b28822a660c6e8434392832ad99146299
SSDeep: 96:XHlBqGvNNS4393KQOllGX+oi6cEAQtalw1jdH:XHyGvd35KQOCur6zVal2jR
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[black@gytmail.com].self MD5: bc5049c39c0c51e46c513359a36938b2
SHA1: c55785b68e0a864703bc5dda5854f5e0aaa3fa62
SHA256: ff2328598c606b0b1e01e774c7d3de97190ac7d3f547e45e88130f8b4bbcca55
SSDeep: 384:mgyup98B+ntvUJ26JaDRYwfTeTqBoku/spL2r0ZCXkH/h3lTTeQ5g:mjS6JRJORXfCMSL0fXSF
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[black@gytmail.com].self MD5: 9da4e378b5543dcbd9fa81596f12ef51
SHA1: eccc9cad0da1fd991bf96afbab3fc3a081a6200f
SHA256: 61c8df742a59e7c11621bedace518c10c29f7bf3f5976dce467191f12d41962a
SSDeep: 384:fvCa62jEWvarjIve2XhOrU4XTyZT4qWX94YwTRjxciPp5YBOpmr+XV:fNDwsjh74XmxgXWYwbYBOkU
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[black@gytmail.com].self MD5: bfdb0c9baedf07ec30e9004b90243efd
SHA1: a8720bdcfa6686555bc945ea76fc8f387adb2910
SHA256: 9893495d8fd8af44c46a7e5a4bf8e5f810eed2d6a26ed14b5a7c6b4dafcd8917
SSDeep: 384:M/0IGr411f5sMWBXseFwwxU9a5MW+K8R8b8unb9WXPV6FmNq5/Xwl5p+oLK1nQy0:M/0IJHTEX7K4UGMW+KM8jh2N60NO0p+u
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[black@gytmail.com].self MD5: fd7a86dd48ba527469947f819b5cc7cf
SHA1: 695a01e5f5d4c6dfd0e78063227369c26d48d07c
SHA256: c3cdfa256a5c1c6940c158e1c38dc76cc74ceb2a3260c138503ede36e6992b0b
SSDeep: 384:cmqWWJj+OEOUrSShyccgXOE/D5TVpLxNJkFsQ9LBDlJnu7whBVwddF8I9FsL1z:TWZKWMOENPOuQ9LplFd7wddFDFsJz
ImpHash: - 		Access, Create Dropped File
Unknown
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[black@gytmail.com].self MD5: 1107f4c19689c76443eed6ce839c27b2
SHA1: 45045a8e68fe43b245785139a6a596dd8220ec9c
SHA256: f938e58bfbbbd219edb969f49551236996cf7841f02b6faa65496d29c4c7c189
SSDeep: 384:1x+MFO2zuIpWe7Cg2AoHLyxJVmHxCeaPtS7dDkuLlIX0:6/u37Cg2AGLgmRUPIkumk
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[black@gytmail.com].self MD5: 44e82ec58c7de49516ee7e3de049fba6
SHA1: dd68af4e9c54fe1072f7c7e8a3aab2afd1a47aa4
SHA256: 251357501c721157d58a0d582cf1a110cc74f22aa7f44e245e788ed2abd4c8a5
SSDeep: 6:SxOhJXocpraD0erHVaF1KWzn83drb94pli8l:3RoY3KW43d394G0
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 941477d41ed2bda1862227ea3b26ad95
SHA1: 6bbc197a04fd2bb17cd1677469369bb559cafd05
SHA256: 1e19f0d479845cb024ddd4c420a2f84eb1aa2d4e72f38933fb497d2003373a8f
SSDeep: 48:RBschbj4p4B6qdUL+RLwwCx/fLc50WKRi:schK4B6KEVfQnF
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 978a4619db2e89c345a440168a3709f5
SHA1: 3a264c446cbd2605a364a18addd8fac1e662b1af
SHA256: 85ab39faae9bf29da1c9432be2e6a05c4b036b090c3f4ba66b1bb419f00c5a00
SSDeep: 24576:8auUM1oj/aJWStmDFScSPV97JKUzueDPfecyJHyoKskc:tLM1ozakSIDdaVFJTfiooKsP
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 6b2ad617469d6fc2ef8a54a079bb04a1
SHA1: c9ca426c11af27911fd2db201918a41149229eb8
SHA256: 03cbabaefec2fbfc4df576ae11ab6514975c656b4037983ff9bd9b6e4107611c
SSDeep: 6144:bLtVqCnlmfQpBojatWPgS/XcJ1YbMiO3eN7o27cb3DY:bL7qs+Qpmd/g1PiO3UoRLU
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 0a91540f00e60d1cdb677c70a235ce09
SHA1: 8b1f6ec5aa84ee766ea6aa3a0cba33f5ef5caca7
SHA256: 3f55aa52fe8011ea2a6d85ab4eb8abca5d5b50e39fedcb9100f05195ea0c7dee
SSDeep: 48:01siZYNzS8ToenFam8Ra6N23B4HmWITKRi:0CiZsS8Txek6NqY/kF
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 565c91653310b233d297334d9d7e4737
SHA1: 06be14be0a725cb4f80b7cf0e4f89accab2c6f03
SHA256: 5a63eb9d12e112d9a258f14a74f5d3e6d08eed331ae987a2b93b52ebc64f5723
SSDeep: 48:Xwm3O85OTCvNrmReMX5GTVwqB1xmSvXdNCKRi:XwAOyO+FjMX5GBw4bmSvqF
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 76d6ed67aa52462a3573d70afd96d354
SHA1: a8515de0ed3a3d0b6a65464cac5ea71a2d5adab1
SHA256: b97f5fa94fa6fce04256babc90e52288faf02553958c1a109fbf845e082593e9
SSDeep: 192:eh3NnI1gLnklwVO0CxdpKlobosbpKuUV0MpNCihTYSGDRNN27qR4LDWWhhDtVR1O:83NDkmEDzKl8RMVSP7mqlWhbzAL
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 6f1bd7f585dc0989d53ad489728cd771
SHA1: e713fa99f484a1984168396755e40d645e5e2711
SHA256: d07f3ffb2ef198af9d0b0af3c807aa3e9e3657e9aa00a7408ae9beb7193fe00b
SSDeep: 6144:2LL+ik9ueqs3Gx/4ZrjgK5sJIIHVHarxAJyuVSDZQ7i30Odfr6NVGayf:8Kikx/PRMxVHar60ZQ7Q0qfEGayf
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 8aa0c25afb5aad7d890a3ca3578bf394
SHA1: 2a9e6eeb61732641433a5084a129825577397613
SHA256: 8f2a847cc54fa9109fd84638ea56618be8a9a8ee0b3c7f1f827b795347b7a135
SSDeep: 48:O8utfNlE4v/oeWKyd8gDelQSX7/84IgW/KRi:O8uWKKdyQytIgW/F
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: c90e3b8cc7630a2add24e2acf7a293a7
SHA1: dc750f350bd05cbcece42e01dd465a81df87c6f9
SHA256: c40ce480e994fe93cc81dabcb6e26c0bb3c1c1be22d5489756763efb14eee29f
SSDeep: 1536:g5IR+qL6DbGdnJTJR2qE5XGMV5B7FqA2OW3JF:gKRcb0JT6qEZD/BM3D
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: ffd9c43cb9b655c2e63d2790751e077b
SHA1: 37d0443001124846de4035baac1db324922c35c2
SHA256: 733e7dcb83d971273eb813dbfed5cb4dd4f031f7b3b250ed533836771536de1b
SSDeep: 192:mjLUX2T8ZVAcX40JLt+865PQ0qbWLwQrS/OpUbj3oj:H2TsoY0TPQdWLiNbsj
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 85ce67a9a452c90412dd91184e229f29
SHA1: ea59e7e5f346a6e1eb63cb7a082fe05e1fce642b
SHA256: b17dab1a4f725551cf2ca30c055e10bb5618288cf3f5c3f0b2527cf66f315904
SSDeep: 48:UQfTC5teftLIuRsqwbtnZWC8DWvHq87SKRi:TTdNTwbtZWCcWvn+F
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 562d2626dfba4d375cf92717c4017d5b
SHA1: be34259597262c782e6b215ba65ceace9c1e6b61
SHA256: 397eee15f554c0eb639da34a5eb1ec9ba55264dabed290f7cfe8525aa94cc51a
SSDeep: 96:9iCjKbkc4hvb50sChFhY5Coh/fBk+vbcgTF:9RK1Svb50xhrY4ohXB/Z
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 8a48625e550ca20a4bb659d2293dc750
SHA1: 1d7e2944e577bd407990d9b14e9296aa386d07a9
SHA256: c9b163035aef50fed39a4dcbf48a9a89578b48a2e6299677ce42cf0b9383a4c9
SSDeep: 24:Bos2sMRQW+n/yDUqXAFPuntQZybDyggoDmb5MHYIEXkKpmaaXeshWe2gtamO9CdM:9BxyDUqXAFPItIy3dDh4lJYXe/XKRi
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: b3a572ffc9af034ab7cc26763410c59d
SHA1: 72ea0014c365b7e5283f3bfefb0c94a69856bb04
SHA256: 374fb125cc3889638dcb3e1b4d36a3b839d71127cf3c180bb86e1b9d929cee93
SSDeep: 96:eR7FYJe5bYC6MBpEhoVoz+/+2UqBg3jXis0F:eRJYJe5bvs2VN/gzXiss
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[black@gytmail.com].self MD5: 8bc6beab59f62e6646863e76fb510bf9
SHA1: f66bac1605261ce5cf1f81bf7335863e5424c2a1
SHA256: 242cdaff4791ceb7eca7ab70ce826c46ac04af8bfb7e6fe0044a10022d9d2485
SSDeep: 12288:zwlcYQuoeRDF+3/8Kh+4hnkZYjQ5sUBlI6KeIPgTs7ukCZcklFylLNVDM1aKFj/c:uckth7KhrhnDusUseqEbkAlAti/c
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF.id-B4197730.[black@gytmail.com].self MD5: 30e5a5d53cb464a69a3acd41a65967ba
SHA1: de5a324a0dfb754fe33fd8352b5f17b6d3dcaca3
SHA256: 82451901956e1e430b2c2c610c6b3099e1959eabfcd5924e99df7eb8c0a90290
SSDeep: 96:S1U3ZthQZ+dKw9AaOQAE+HvpIKq62lujeQzxMpegKu9I/eBlH2T:GtZcKw9AaR+HvpIKqflRQzxMUjSIr
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF.id-B4197730.[black@gytmail.com].self MD5: 63d8759fc8d4af57b4dec090115e434a
SHA1: 920990595612c840706746e77e23d62872eb857b
SHA256: e828527b20da9697240c4409aaa8eb0029e3bd01879319f38d992e75d8307bfe
SSDeep: 96:pGvY35dCzkbOrr6qLhfw+whwYVDTMVzzCjqBCrmSanHT:8vYJukbOpa+wheJzkqMez
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[black@gytmail.com].self MD5: c49cd38aa640edce80e42d5047dd9388
SHA1: 9eee5fc6111fb93d30cf7301951fbfeed0d57181
SHA256: 0d07776b292b0587ab8386dfb3c0ff791bcb1a0569ee6419af7fb26c871fcfd9
SSDeep: 768:GnXzKxt7sUUp0ILZzWerWL1KfX0lVcxKvj20YsPcUEfLgGbRJeIydMW+niRAin:GncmprWLc+VOP0lPcUCLv+Iy/9Gin
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[black@gytmail.com].self MD5: dcaa03864da1f50494bbbe57d3806570
SHA1: c9cbed39cd117aad1aca1d0d6d7fa867b1679be9
SHA256: 94ea94ec202141b86be33dbb2d41c11654e86aeb7740b080ae8a5471933b261f
SSDeep: 96:SgVPPGlF5c77/6vEIEM9omzOZ1NteetSkcDR0s0ote3IyxdUhwNs30lFUpR49ue+:SgsF5+CvERaSl7t/80s0WwIyD/1Fuekb
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.id-B4197730.[black@gytmail.com].self MD5: 617b840c7b5d9747af868b940067e98c
SHA1: 42deb824c3aeac525d4f1e419b83fbbf34f339ce
SHA256: 9ba844691327d6d1e8d2a53a8a3005138ebc9a753e8d09bb838a5fe425d34cea
SSDeep: 12:AepehVf7yl4Gh8DfjDM/laqlHKW43d394GM:np0oCDLDM/laqlH9CdRM
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\$GetCurrent\SafeOS\preoobe.cmd.id-B4197730.[black@gytmail.com].self MD5: 6152aa07c086bcf27f0e9a552b1f84c4
SHA1: 656816d22f4640b31d5bcb337a924908174c8505
SHA256: 052026b27341c3315c11e83609aba54f2f7ae17980a43703c7ce726da4d8603e
SSDeep: 6:nQGXfLA7r3rhsQlSarv0ebxtxRIQMHlanfnbZovLyYiozG3:nQGXWXearHbHIQilOfnlwvfi3
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\$Recycle.Bin\S-1-5-18\desktop.ini.id-B4197730.[black@gytmail.com].self MD5: d64f25c77abb798a37a84285212d6c58
SHA1: 6e9e8009c072ffa8680111338acac8a6c5cd24c1
SHA256: 568d956cfc54a2f58dcc13b145285dd19a993456a419d76c86390d62bd4dac3b
SSDeep: 6:KJr5iNwsoyL/LoI1WmAv4V6wRq/i6WCh0etbPdUdWzL1KWzn83drb94pliG:KJFuwdwzWrZmqxtbPdE05KW43d394GG
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[black@gytmail.com].self MD5: 5da58aa858974fa5166ead0aff8db4f7
SHA1: 62777d54971ed7abb57822136584cf1aa28aa07f
SHA256: 1e0c890600b59258636df82ac538aebbbba5f80e639695f9be8c8e4e584419a2
SSDeep: 6:mSGXRgyImOpVBmgpdahrnjRms+3cM46c6WCh0e9hfNTF1KWzn83drb94pliG:mwBpdahf6sU9L3KW43d394GG
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[black@gytmail.com].self MD5: 86fbe2695e10d49f9a50be0b884aff3c
SHA1: ddd4a142e04e0d0b088a3caf68df36ae557d88e5
SHA256: e642524853f0aa9ce033de1fd6313d991843cbf5d692426eaf6ececa4699f658
SSDeep: 98304:uuEAUjb7BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKbyXHWTq/CSOFyq:e3PBkOK2Knq45mY4H5OMKkKbP+6Rx
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Not Queried
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[black@gytmail.com].self MD5: c5dc88eaa91061845a19b9056cbed2c7
SHA1: 3443fce0e5d72c6e7559b59e57628fb2824efc27
SHA256: 906631b6b61372b7911be9a7cfc37b6cd33229ac35072fc3a2b491767ad24454
SSDeep: 49152:WV4YaGoDumT1r7AdXZy9KU2KUYxs35DKZ3OIKf+x9axyUZj44XHv4:WV4Yab1PAdXZzKUYxs3pKZnK4A4WHQ
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Not Queried
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[black@gytmail.com].self MD5: 5e0ba5fde5c250d1b01e21e488827f4e
SHA1: 3529335552c3dfa56f8104c8cfcbc13663daf47c
SHA256: e5e79d23b4b443617e543e29f4b15a6ee3188d2e31409a9eb8fd1eae812246b1
SSDeep: 98304:Ef0pKGBHTKYzKXH54UuFe1kBpHua/KUKcs3DKVDKvw6uAmNPYEWg3:27GBHTK8KXZ4UuY1kB1iKFKvw60Su
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Not Queried
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[black@gytmail.com].self MD5: 0f35f74a6c5189c38d3fe53a3a8f8259
SHA1: 16f0c9fae12e163b70a8afe4ff726625a8d424a7
SHA256: 144bd20ffc3dbd930cb9d6c8ef60c1438f9b1b04c424c4a5e2bf42ad510d474f
SSDeep: 49152:oJ6tDuv7GuMRau8yuXQFKUYcs3HVKf3rhKYkL2quSAl3f:oJbGnRau84KUYcs31KfFKPMT
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Not Queried
C:\588bce7c90097ed212\netfx_Core.mzz.id-B4197730.[black@gytmail.com].self MD5: cc75e7bda8993fedfe1a6badcf08dce7
SHA1: 9f7920f930c3874402c2d3c14535e2bdd1fe4eed
SHA256: e104262286e666244be9b1244b073d074f316420ff783d93d664a93ea8c7c99c
SSDeep: 196608:GV04YyKSBXZ35w+KBK2KJKDcloT46ooP8ZNoz+hK12RP1O7lT:z4Y7qZ3CwFISoT46ooP8Zyz+hm6Mp
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Not Queried
C:\588bce7c90097ed212\netfx_Core_x64.msi.id-B4197730.[black@gytmail.com].self MD5: 36923dcc25dc61e027e274ab0df0e435
SHA1: 53763bf08c5f811e8790663b7dc4dfce7f177539
SHA256: e35e490e374f6b06efe32c328eb5d2bf10456b66a56db80d842bfe924d25ecb5
SSDeep: 24576:nc+BQbPyxbs4rONS5voMfjhOGx9uunFyBz7gV8T0b1GFU62d3h+3e4jn:ncxisfQxoMLwaFYzH0QU603t4jn
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Not Queried
C:\588bce7c90097ed212\netfx_Extended.mzz.id-B4197730.[black@gytmail.com].self MD5: b790da90d0c6c3db2d470430d72b0adf
SHA1: ba28aaf3de47f780fd99f939c6190d4a029b4166
SHA256: 9079e442aee573d221fa746a405405a2553f60de994e7db863d6eb28640df578
SSDeep: 49152:cpSdqU6tLnvVqSK5G22mDgBOOmeGGiU9Erqkbnt7QTr5+Oc2EI+8dd0ZwTse9QOH:CtZKH2mALErq2nt7rvfI+vZpfQ
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Not Queried
C:\588bce7c90097ed212\netfx_Extended_x86.msi.id-B4197730.[black@gytmail.com].self MD5: 4ab8af130b43d5a367b57597059f1125
SHA1: 77b4aab0ab93aa8f15b175756e32eb5ed5b0934b
SHA256: b46a17867ca9b6b8f961b1204e1324df89a113f574097ec47e39642ff8c51dac
SSDeep: 12288:VOjhW4DRgsrKiMX/BDYzUcijH0HBCFbFdtib3jFXH9zbozgpvacz5r:VOtWYKiMJDi+0HBKLkpXdvUgpX5r
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Key Management Service.evtx.id-B4197730.[black@gytmail.com].self MD5: e7f48fa60335b8447ae6bf7bc13b6e56
SHA1: 065672e664e4e13389a2a3779175d6ebdc212086
SHA256: f00ed3e44ca86d47b4761d52aa3f8f25bd5e72521fd93c8f2439d12051d37061
SSDeep: 1536:tqlAi98w6Z3HgDpLENKvXWthcuEYW5IS4ZWJa2MnuwImECIN:3iwVHgCNKvXWtmG/iwNECa
ImpHash: - 		Access, Create Dropped File
Not Queried
C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[black@gytmail.com].self MD5: 5b674d441b5dfda01b4a9a85ee12010b
SHA1: 52c3741092c27af9beed9d7f2a7efeb96b776563
SHA256: be05858c107127d8538c3df33373ac778fb1c5f9c9696cd004a19737feefd681
SSDeep: 1536:edJdDm47PdZ4LzWUMWrzBX86tTFond0G2NwWu+YxKGRlRcS0ne2D:cdB/UvrNMe80G2N9GO7neQ
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[black@gytmail.com].self MD5: c3c7d56c589067df3110db8d468c2cb6
SHA1: 61a6740703bc721c24a70c10e9cc2bbba58181ce
SHA256: 37914ac171c09a2bc3d268346d2637d80e3496d45b0ca19e2040f396f8fc1131
SSDeep: 1536:abNmvsaozdR28FYCq03zrcYeOEG6pwsf9WM6gMUMV:ajzdR2EjdvcYDEG6VUVgS
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[black@gytmail.com].self MD5: 0f8a42ef1b59e35ea5a42806b29f0698
SHA1: b8dabec0f006628a461ae456c98220d501b0b63c
SHA256: f66d4b5bc455aab70bd21072f1b28d138923a83142f12b83c7a97a88af5e9b6e
SSDeep: 768:nP5G6zozvzDzNPARyf7sdGeOZdOortgm4c11SEtE4FMA/0H1V05s73L+fcXsg32T:nPs2ozzbskJO4t15q1kwE8tyiwEbW5Ms
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[black@gytmail.com].self MD5: d64a2569691dffe18664165480659ab5
SHA1: d0cb4ffcca424f0a21b7b284647838959093d65a
SHA256: 6185adbded6fa1ddbe478c1dd6ddb15914d05b2b2258f6cd91150fae17af6f19
SSDeep: 1536:Y1wZlQV4ED04mpdBrlogQdu4z4vlBiKTR7l/g27PGSbCPxF25rE:bhJ4mpdlBQduisB5tltGGCPxWE
ImpHash: - 		Access, Create, Read Dropped File
Not Queried
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[black@gytmail.com].self MD5: 22739cff4ece8f5868e6c54dc1ccef34
SHA1: ac9b6f6b114277ab99e6ac6fea34509782e177d9
SHA256: 05a255ca5000e64edf4ba5dbffb626d5570c08e3d795fa3202930011f2bc1ac3
SSDeep: 1536:tyJ7AY2tohaQOK2yN86eH2/JFbmskI+06wNd6ulYZcJO+H2B:tg7AxOHOqvQ2/SskI+062jlYZqo
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 3199625b745c01b18e8598dd4539d319
SHA1: 895a86d8c066faab88421befb87a197c5d453dae
SHA256: 6b6465cfa9bcb8af29a4362bf78aaaf286c9570a3095a23ef936ce307d148fd8
SSDeep: 1536:kEE7lwHT3DO8hkhzzEGlMZgKT0zPtrH9If:l3DFSh0GlMay4trdIf
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[black@gytmail.com].self MD5: ab0533b59f6792b0ae526fd2c9afa195
SHA1: 61cd9d0674947010908e215ec059dbcfe487fe9c
SHA256: 6c9f5fe38ed4398e10bb0c2a08ef0b1a85ff4a9514c8ef2998affc17c8036240
SSDeep: 1536:UxABIJKOZCh2wQk5v2Nl2njb4d34FfSH1hVtubAy8syCfVY:U1JjZCc7kF2N6jsd3aK1hS3+
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: e96efdc76014cd5c026bb804877240fe
SHA1: 138b955ec1f00e3f08f411ae410cfcc844a7f93f
SHA256: 7e644cd908a0cb46274ca30f3b4511cbbf1913a297e7963ee4b9fdf96f1177eb
SSDeep: 1536:9gaTpvxJ69GtClBoTtptf2nvCNivIdzHby9juhcixSUaCxE7a4xs4TR:Ga9vj8M1feCUYH5msaVVTR
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 83af5e5fdc19974a729712be7f3ca419
SHA1: 3000d4e024545a22620f2d45f3395ffff64363bc
SHA256: 9bb3f8acea27c3c2fcfd70bbae2dc0fab2bda6064088486622cf4e87274f9baa
SSDeep: 1536:SomUr13rB94oT57Gr4Z2EQInWuFvfllrzwkj1C+1rx8DmcyfboRY/:SovJrQoZA021ItvtBfRC+EmckboS
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[black@gytmail.com].self MD5: a41721dfb7f67b6b83dc64a7e8d57f46
SHA1: 3efdef7f80ed4053efb30eb667308724bb0cd819
SHA256: 3299c850e240aabab91a47d05446876367a4e7c994d5514020817a8c5fede254
SSDeep: 1536:mC5hreDQxxRZ8TaTrb+wpUhnIlYfJx9QAGN/bok/C182KeCFIS4pwWdNWcRU/j:XBeUxxRZ82TXtuhIOfenlbokq182KjP3
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 47e784bb7c070da81a4a5a5163b02f9d
SHA1: 1015ae4c53201b3294057026285ce6021ccbb720
SHA256: 324849f7b297ede707577e862a86d69070c11da42a63ca64a794b65c3290f489
SSDeep: 1536:G2PVwNOy9q31bo9N2fucWwWILGLvPvvxoxCXt4icOPFyqC7nDaASGLTr:G2g9q31bCNFcWwWIYnvJtXt4iQvpS8Tr
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[black@gytmail.com].self MD5: 9f0d06c10232bf7d9082ae58db350871
SHA1: b74a3e21d9c59e1cfbc49ad35445dd1b407a5afc
SHA256: b592c8a1861155069654169781d7e899c6c37c0eea81d818304f81ed5886b4a6
SSDeep: 24576:w70EW5zrKX9GJ163Qly8ZbiQ/52aAaRXtlTZ5Xnq0U:SsZ+X9GJ1bEobiQzbtlrXq9
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[black@gytmail.com].self MD5: 3e9243db3d6acf2460945e2d50e022b6
SHA1: c02649e3e8384b561e77abcff2e8f9fee7003813
SHA256: 80c4c7c3b96f65e699254e0e6a4c259515e0d8f1269fdc0a1b8df878d59db1ee
SSDeep: 768:U3XtQU93p0mmikRq+vjiE3YytM09KpLq9Wx/xXMfLN0Cf5j/KYXm1UsdSQuY4UkJ:E3p05iE3YmM09Kxfp8T++gSQuYCVr
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: fb7df02d35437caa963f49bdc47775ed
SHA1: 33a21ef0cb5e41cd7afb2c8972c5adaec98e2196
SHA256: c6612b85da2612aaf518f2cce7e797404af74d0d684af7e9af6e23fd01b101b3
SSDeep: 1536:JdN2u2L4xntSj6TDl8noyn7i8VgU2Y4jVBHOWVI8:rI4xtSwSLl6U+BHbVI8
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 73d2cadeecca3c0b1e53518d9cadb092
SHA1: 9da2a403be1c8b78c0fdb9d18e61dce5774c532f
SHA256: c693a28bd1f612fe38b6a773bb8d271253b4204c369e53115871705db1eacc0e
SSDeep: 1536:CTtC+fzsUPtQZWIcyntYYSaiXPV2UACH88CH79UNLK8TB:CTtC+1aWXVacPVxA488UaLzF
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 1d15d7c9d80c7ef81c297db33ef7cc5e
SHA1: d2ca8393dc2e853001fe3db73ebd1cc6063adce6
SHA256: 1b899c7b525c02e81a2d7697a9d6e00d07cb2b41163550988782f46d2b7335fe
SSDeep: 1536:8bEX5irXQJ34+bvbEdOwTsGJWIcQ6QgJ4c0y8wMGnVcPp1ptH8:8bfUI+8dsgWIcA2NxnVcvzc
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: f1045387aaae0ff0a4970801b49e546e
SHA1: 17c631bf4627b525d9e405207d2fd6657d50f0ec
SHA256: 5361676698f1957857811f6756015b9b92f398ede813e2b0857fcac037274bd2
SSDeep: 1536:Qn8AIE9flDU0I8YHmoLeueFqaIGX+YD6GMJYCVte6QsIHrC:aIEllD9PYfzeFq2X63xm6LeC
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[black@gytmail.com].self MD5: c593f7ab3a7029cfbabf6e0a61048f52
SHA1: b866386d160498d82013dfa71720ce61cbad7071
SHA256: 105bb37009457ed29cf335d8b8799d5fbae19a7003731f6f02fe8763683c8b44
SSDeep: 1536:S8OKbAQUn4SgCuif3lCwGQoy3bmohI8zcDyTH9cRtmZ:NOKbAQU4Pna3xoYSAzqyj9cRtmZ
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: ca10a78a2474c226f8a989932cb57f0e
SHA1: 0c909ee5391d5e588848b1ad5338201651170b9f
SHA256: a017951e430193e8ee16cb67e7e042e0528fb109838bf7f3a3f6d1cb55dc6e3d
SSDeep: 768:kONmR9PLj94r+k13pIO7ctYAKYBy5InMHrcBivy7UoZCluCJYLUqOVqFySk7wMok:kCe9Le9ujKSMH11vkEVqF9Moqckz87M/
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 4b570f0c98b311758f179f80a04a59e7
SHA1: cf01800a6f0538d87c0fcfd1b934265f5ea378c6
SHA256: 30f77690239cecbaa51846369ed863c75f022acb65a4aa079d036050237accf9
SSDeep: 1536:tPgDrSFZs4s4aDbmWkdSTFjYB9n8+RCt3Z1XdtFHMQhEY:crSFZK4aDSWEH8+RS3LX5XEY
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[black@gytmail.com].self MD5: f81bd377b8eda83ab89d51ae768f38cc
SHA1: 13b260b3ea77ef4d1578d38f502ad9fdfaae10b6
SHA256: 05f045893e533c9d3db3a98d4e83e35af2894903f2c3ea2277d84e2dfdead982
SSDeep: 1536:peQE+0gAFXfOKflY7ziYj9/MwNySa1+n5q+iESnc8WPT8He50:peQE+rMtlY/d9F/w+iE/8+50
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[black@gytmail.com].self MD5: 4af01c8f6084aa4ba5aec59c5f47939e
SHA1: f5d617eb1d0a270f2617f6fbcafdcc81ee6e93c7
SHA256: b010ade7b7523a8061cdd9c0c8d97d8c364365d99d4dc65ecfa02e68c1d55ce1
SSDeep: 24576:WLLO8wDFZqFlf4PwMX8a50ia5h8BaB7/AHku:WLK80FZE5eXx5HazfNvu
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: d2c0902f0e353a50ca2efa0db000ee8b
SHA1: 102f4764cb5b69e06e29528e62aa79f803fc5cb4
SHA256: f2596ab40f32e5a87252de2fb91b35031bbb3c7e3fffaaf08309f9ad36e613c8
SSDeep: 1536:Vzo1RPg9PoJMv93U4w3XvPPdCBRUa7eum9u/I6lqQCV9SP:VzGRPVMhU4w3/dC4aium9cbqQCV9g
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[black@gytmail.com].self MD5: c26561112f01560f24cefacb4c661923
SHA1: b34751714f58d8c69a11156af3be93c1b0f68502
SHA256: 3501580ee3ff594963e082bbe25547195fa389fd059d8a4f38f4c092fdd684f8
SSDeep: 1536:/FBS/p2BxHMmSJYxvwdG+3xU8yzmT1s1ttzy6sGBZ:/bMaH9SJgvwGxzyT+Xo9sZ
ImpHash: - 		Access, Create Dropped File
Not Queried
C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[black@gytmail.com].self MD5: f8f9fa9bca40a5d0773c644e13e36b5e
SHA1: 07336d820bfab56ead3930ff0a37b23ef539b01f
SHA256: 6ff479d9c07eb25a3bd5a3e7e2169b1bdababe006848c730394d1e167c80eb62
SSDeep: 1536:vRfVGvCf09wmBnYGTRWwUOagNBBchYxSRYLs/wU0WlH:ZfVGwmB7TRpUOagmh7v0aH
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 6e0bc8e6dadcd6c3ac0b0dd095cbe3e7
SHA1: c4ae152055eba89253c64323e919c477dc1d2ad9
SHA256: c1cae0ed5e6827a5ba188fdc9776652ecadf9d559383e78735ee32c81f1823cc
SSDeep: 1536:spx12Vq8ht6uXwx9X7nneTUkFcFPbfj+9g8R:sF23AuXwxV7n8UMcFPTCN
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 4a2b9d68541a1fb8d217dba42f6bfd29
SHA1: 85858e536a9979a6203d980891c7b68e831c1e40
SHA256: f6b209e02d0a03961ec09ada6d08b9eeff096835b92d6bfaef54f33feca4eaad
SSDeep: 1536:4RrMwYfvuyQwCyEvPwKevkrGOxvp/1/5YxyIv6YcoGw:4hMwYOyMvPwKd8yIr
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: fc7cf8c8fa88ffe25780db914f9a11f8
SHA1: a541b9726380ddcdd542f6a181d3b8b14d99b720
SHA256: 67d5c8c47bb47e917b691160212232799c524f73bcb04ddcf022e0d7ba257cc4
SSDeep: 1536:1/nxAVcc205DjTVfZc35R8+d3aLExTscd4yHBFnz:C120pVZc373agxYcyMpz
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 1f5733ce1e20026f2e998768b8119e83
SHA1: 78a3af4fbc9729ddaa64339b652915cb4d51ff1b
SHA256: d5c018a801167b5e6710ae4f3ccda06fbd6f291b8a7b6cbda836ad0d78a83ac4
SSDeep: 1536:G/OZrSGzuGardINHZq/JOHv4KNJK7OuSWRhtIAqkfvXoWJ:GWZrSGzuGaruNssHv4Ki6uSUVqSvXJ
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[black@gytmail.com].self MD5: 50f0dc7cdea83dbae2037f3ab341fbbb
SHA1: cf3896cb5c930773e149833afa3187a22d7b9477
SHA256: 61a45cea97322229ab511240ae34e067ab3b5d10c26dcd7571953b93b90eb1f2
SSDeep: 1536:PGSMPtanSIUSc321BuB6iRh+3nmunMrXbq99aILfKo:eLanBU8GB6G+3JnMrLq9NKo
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[black@gytmail.com].self MD5: 21ebfd0361d09bd338515d28c0541331
SHA1: 9ebd29539f9bce5a9bfc977bac8b4d97f90e87e7
SHA256: 53372a0f63e64d5b2990d4f28f75cd5c040e099a2e67a63afda58db3a7a4eaf7
SSDeep: 1536:yNJ9eQcWmYTvI6EoKk3xrTA/uP4x1XPiIV0UM8xnwwKXcmpGBxnrG:qfYWeXoKExrWrLDVPnw+yGHnrG
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 23ab9da34114fee7dfbc69588f6297f4
SHA1: 320852db086c0f35c04fe2971c8d5b0e6b9d9e15
SHA256: a91396e549bd73bb66e479c6a427447ac3ba20226264e6f2da80a2dc0cbb9366
SSDeep: 1536:/9RhgebcGd9uYqBv1pYHEYjtR9PdP8ti87RhdU7Rz3:uGq11pWEYjtvJ8tljdwV
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: cb35e9c74d3e255475e35e06a3033c63
SHA1: 320e131756c164569e96c52ea612d286b80c86a7
SHA256: 1d1b46ff4dee1cda4944a6ba5fe65594be7ad945a78da8a299331f95c3f26851
SSDeep: 768:vYImDgy3my3pWX62Q2OiXHDWo2dUf0nyrMiFTO9hze0BfP4IRpwMb8oT9p3RSvSh:vY9pdXyXjCnIpIhaqIzBE2vHi5Z
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: d1a3400969e8f32e5d47e1b389e472dc
SHA1: 65128e437f16416fba3c4b7abea9558f73985cd0
SHA256: 49b41bc1cad270beea75c56857c557798ac570ada390e4c302b964ef7bd59372
SSDeep: 1536:/fWdNPHdlfVBkuM+W/cWI+RxgDWERZ+4Yqw9n0te0dHNzrzbDtD:/+PvPGtUPDW+Z+tILzntD
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[black@gytmail.com].self MD5: 9905c7156aaffa6f32d4b0f50bd32432
SHA1: fadba2eef7ab774120ace94b09be96ef7bb93110
SHA256: 03f7235bf1bd0fc12be573625db7a1a9de04bf8300cff17c15cd02322449eec7
SSDeep: 1536:xjWt/iXeoTNocW41LYoVbNG0XdvsbQCU1OI:xjm/iXR7oo1EV6
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[black@gytmail.com].self MD5: d0cbc981613ee8cb72df99994e55bb29
SHA1: 6c93ca1261d32d82802121f66ee5d2fdfa963c4e
SHA256: 36289428ef9a54f965f88944e55df011934a99d7ac29277e7b32fd94fe835021
SSDeep: 1536:o5MNsEaxNUHS+Bq5KvRd7CJbX0CpuINdxA9knZkdg:J3dHS+BxwbXnkIDxAywg
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 7e0ee0ed3519dbbc94bb1cacc80ed58e
SHA1: 99e968605e55b2364af3d92f9a25634170cd3d6c
SHA256: 41317cb9f413895ee90c5a8e50ce94a95696e9f4e12c9a4b2fa34039f7bbcb83
SSDeep: 1536:7cMFQG9olf1Dr+9+eno1K//mbguR21Cflt76D1DseNw:/FqlNXeno6+bd24z+D1DseNw
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[black@gytmail.com].self MD5: d5f036e070ca2ece6ae58104b38795b4
SHA1: b42cb7641e6f3b319ad239c1769ab536362f8175
SHA256: a33c163b4b3f40a13fa53527f776e97eefc9bfbc7cf87a4328aaf32f2bbbfa59
SSDeep: 24576:yqTW5TnSKv0ELi4RkpZLI9AX8t0V8MVyfuVCZXqL1zce:tCQ40EGZLAG1yfuVEice
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: df142a22b99a9474a4822a1681241dd2
SHA1: 5d49ba2192203ad3014f40fd50e3ccb678c5ffc7
SHA256: 7342a11539f18003a45bf0add22dae623b28239f54c695c7a214278e69485391
SSDeep: 1536:3Es9tgsuJ0XKtOx+oO6a/Yfc0POvfFKKnD+PdnS1viaBdM:3EsXgZmqnXYfpPSsyDCUDi
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[black@gytmail.com].self MD5: 9868cac5761079c3f4e002873dcd1f49
SHA1: ba3efad9ba9a192a5e172a7e94749c24ff410290
SHA256: d84de16ef1b5bf68e5b97c0f629ff4c9cd56f872c1319dc6b36d5e07baabd289
SSDeep: 1536:DdPqSnHrqaV0r+ISoXeCbN8WCK5+qtRfigu4g/kYPYWgD:hPqSHWaqr+DCh8WP5zEwgMYPY1D
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: f4227f04e0561bef1b044c1dddb597c7
SHA1: 0d24f6f1219c4e88104c4bd0e2a3e2f3e75d1258
SHA256: e1b12b6d25c9b73f116ebe39f87e8f42cb0980e580fc1e8d0df60e1fa829a423
SSDeep: 1536:mFq4bVPdGPMdJsnsjSGJ10qX+9Okz4Cs6BvIgMl:Qx4PMHKn610xOC/BAV
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[black@gytmail.com].self MD5: cc445d24dca3a2c475f30d0e975f0393
SHA1: 5f598286c5d2bb24293288752d06d0b23ffed6a6
SHA256: f0815ca21346ee2d6474b33c4e8ba57e9685254c125112fa2623f0dbd3e90def
SSDeep: 1536:FULXFdQvsY9xJk7hvqBKt17spO/ff/1v61o9noa:FoXFd0sssFqBKzj/HZToa
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 1aa79f758a61e4040ddd028df5915558
SHA1: 64f3c6a44224faa8cb70e007e41490c30a135a9b
SHA256: da53fe3f4af0b3665db596643fe11cf2bdab7793effbf2ebd6358f53b8c7a137
SSDeep: 1536:KV2paeICIWivzE744ob0ym20LIU2bcN6lX2h1k2DwsGXjWdq9Qzpwwlszo:KV2p2bWX448LWgQN6lX1JBCc9xo
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 5198f6142b2a71da09f2cd4dd454db18
SHA1: eddbe8b5d156f95af4061e6194c92aa596fb62cc
SHA256: 5b518436f23c0cf06311f011b6688606f580721520cad3b3856bf32940e09eb2
SSDeep: 1536:PR30Mf2sQR5idf/F3HuKNsP4YCoFwsiB9mTfw8NTkaT/:TfQR5idHF+KN+4kwsiB978NgaT/
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 2de6cf15dbc1bb74121527c6183b08d8
SHA1: 0ff1995dde6c2700697f2f747f3c2749875c37c1
SHA256: bd3f242cd1221eaef1a94828464e4d9fe9abf10ae24a15f89649da088b4cbc80
SSDeep: 1536:22z+iq8tYX3+VNV/bD/xXx+GAw9KGqhc5/5tCK83fYH7jdH0gtHQ:2eFq3+7V/bzls+1OKKYndH0gtw
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[black@gytmail.com].self MD5: 375cecd115bdd49ef9241b43c7425478
SHA1: 9bc233a501e0f7db9f19d3ddc95763fb5b95e79b
SHA256: 8b73d0bcd9f5e0f2d1ad8cd5106b4979f5030299e1aa87f41652971ac5108f84
SSDeep: 1536:BOK0Adn0DF2iwF/u56HP+aSkiE4boyRNY46mJh7/kjd:wKjdn0piGkGAiEpB4dh7/kR
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 096304da315fa2e1d5774a438f2cac00
SHA1: 5a42984c1e2c6bca756b40318ee1b2981d607673
SHA256: e01bf2d9a44d423564b1022c69e08b37a94f5f703f1fb4001a317d7496f06cb2
SSDeep: 1536:u+O6V5Mwul1au0tR/mphJeFsd9Zfxzv4UZkCt3JHK:u+O6VSzau0ophwFsvpxT4gkmdK
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: e0991aa1f799b311059a438061dbc0cf
SHA1: e8f370dc72b915b0152b6637602abbee72450751
SHA256: 8b08a861ec4e882dc5d3446b17897d5e3b4b7f4e9f7bfcb900937198b78b0ac1
SSDeep: 1536:LPWy7QTYmyWZN77mCjQCRKuYc48CpDG8OmpiLzUClPaeIJS9v65fO:LPHs04N3mCjLRVYc48Cp68OmpiLzUQam
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[black@gytmail.com].self MD5: 4c8ce3075f50e69a634130e5cf78307a
SHA1: 9357a7922e4864076ebd0d6a121a3dea56d29c31
SHA256: ed847312e510ad9a3f5e07e0d5ddd7778a7c79fcd06b8bad5ddb62687c8d17c8
SSDeep: 1536:Ru1DqIPTlspyHvyOcjl9cWQPkB/aeE6HLD9L4ykhdIpt14X9ee:UPPTlspyHovQ8r96Qpte9ee
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[black@gytmail.com].self MD5: 5f9924828099c1add39dd946975117b4
SHA1: 30847a94f902e0843b1027821bb8ff3c899b0b8c
SHA256: 2e2828794f7439b47388ce87598594f94f9d1eb66cc6b83a22dd97eef987bdec
SSDeep: 1536:w5esWKJMae+j7V15zhju6DH0/jVYTicze4nEddCMBram4hVfl6O:wDWSMaH7V15hK6DH2jVyi8fnEdIMkm4f
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: feb54711583d582f6f26f9ae51a59439
SHA1: f1d74915f3e5d49721fccd0e55d8c4bc8c683baf
SHA256: add6696c385601c03eb94d9e5ee3d75c15315ebc5e10e4c8b6e4b4f0fa8673c2
SSDeep: 1536:bhZDWr5rPQBKjraO2DwTu04OrhWmROMtCt6CmrLsx3+Cg1:bDWNrPQC+GhrhsRt65rYxQ
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: ace2dbdcf3a1722738824c85841b76ae
SHA1: fd4fc15c30bd680a3b60ed367362b1bc40c7260e
SHA256: 787c048781a997c6eb8928aacbb1667e39ca7929b56bfd0aa6434b9b18e381d2
SSDeep: 1536:or8CgQYp600zDYuM6qrntVwuAxhsZiye/gJC6cKb:orI600z+dztSuyhs3JC6n
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[black@gytmail.com].self MD5: 229b7f579c1e37eb14d7572577e82836
SHA1: 605790fbdefc2b630eb0a33b8224d1f83fd9c835
SHA256: d0ac85235e6406deebbd232ee9145bb45a04f0c88d6535c4530a939a89cabb05
SSDeep: 1536:2puW1gs1qD/J+JDeC5Vbdtwn8TGUcNufuAWUWKL:U1ED/JkXdenxNufuJfk
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 9f7e6557da11cafcc471340fb374de86
SHA1: 80645f9ca0ee47eeefd97bcc35bd30847383fb09
SHA256: 81b451a145260388d2d432d472ce373a42c552b96829a596583847baf44ac34a
SSDeep: 1536:PzYB/WJrfvs6zG0HtyRqZEwnhzuMz0RYjsF/:cx2fvs6zDyqZEWi0qFF
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[black@gytmail.com].self MD5: 042d47c2ddd37a4c71ecf7fd20967f03
SHA1: df54c80536a75291f8266076302434426ede8130
SHA256: 1e945de8661543d976fd1b0ec33e355e89dbc754a2190c829cd0489bb67c7768
SSDeep: 1536:YJJBNL/TPXMy05sWkt7qNobDA0Tqr4SLvdgyUBveXLs1:YRNfXMy06WSrbZA4Wdg9JeXO
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[black@gytmail.com].self MD5: ae01e33571ca0333ed0c53e86a19a130
SHA1: c1388f2763cf0be3df2b7376ca925e84879b7eb2
SHA256: ec45db9048eac2c459f9c802862840351b07e649654c83591b34c2c33fb2db12
SSDeep: 24576:R4CTFts1TIRLm/gO1g+IVs2ug0OuR/WYciDW4YxtG6:RD6ix/VDVVukYcix6
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[black@gytmail.com].self MD5: 01e698bc0e4d799256f49c0c2f2a7417
SHA1: b5b2e5ebe9f9f64f981838685c642e79459810fe
SHA256: 3e0c86404f4a7a6f5104fa4492d31dda01c357e45e96d8b8eb90d657df6846f3
SSDeep: 1536:B0WXdHNPiZ2WAzn10ym4UM40kfGE5b+J+xiqAT5Y88H:BpNt6ZCL1Ez5rjG58H
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[black@gytmail.com].self MD5: e0023c4f85b3ae825a1e03fda75cbeb1
SHA1: e8c235583ab27c48152168665befd5b3cafb13b8
SHA256: b4fc7ea5282e97e0a478782c24c057161af384fe3cb6715f5ff8eb6362085ee0
SSDeep: 96:AvqNe5NzUfj+t4poJm0VmC7PXgJNlZiqdd88fv:AXzEj+CWdfbgJNlsqj
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[black@gytmail.com].self MD5: 8608d081a3c169481f7df3124c1fb8e5
SHA1: dce9451d54587d441eca2587982988813ba4a07e
SHA256: d2d497bd706fd29826255efcbecb6c1339e3d3f609f34df4e5bd36cce3ce4d99
SSDeep: 384:OwekR69X80rUnFXfMDfBH6BRXTpvG+lqQOMHi7quyDUHb63gJndnVIi:OZ/Ktu5HCtG+lqQOePQW3gdIi
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[black@gytmail.com].self MD5: 26719c48cf829dac7ce8405156b6e444
SHA1: 3fcd11b2a5379e7d24e15f555bf9decf603fe6d0
SHA256: 8c8ad687679b71a8b0fb171413720c617c6351548330f332c8ac063e13c84e09
SSDeep: 384:FqlfxtV7A0AnZtAfxni0hN44AncjQ5rr4Gbh5YLEokcZICKeHiikYCkPxqFFjspc:8ft5szmxi0hm4+BrcGbXokcqElPxh4C4
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[black@gytmail.com].self MD5: 44c51ddee7277c8973fd76ad4436e62c
SHA1: a6c632c3111ce221c7fbdb45a597c2a45437243b
SHA256: 43f626f974637ee76d35d3228008e3eb3bd50666ec00c280c5b2c1125472fe6a
SSDeep: 384:wJHu/r+2tbsQiQKmoVHKzAU301oPhZx7mGn9Lz+wIbZmDYAHW:whu/im5Km/oy57h9Lz+QDYv
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[black@gytmail.com].self MD5: 243fbd3ab796369aa5e016ee6d05a2cf
SHA1: 653ad97c21a85c907c5a14c9342b2043f5fe1a5f
SHA256: 23bc787405121633bbd90dbafa4099ed5c6532b16d3d50fdefe8a1ffd51eef4d
SSDeep: 384:s+BQ+lyMAS88/5PcJ1hmyQLapQkGEwn7FU4ef+4gIEOdTjWBVgFKQ:s4yMAt8/Ym3eij/B5eqYaKt
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[black@gytmail.com].self MD5: 65ac05f3bd5faeafb66d625cc8a8529a
SHA1: 35dd12a5729faebb12b30694fb411bf23edcdb01
SHA256: 9945c3423efd1f672c1d8cce259c4a4ab82a47152338ed85498d1d059ba67fea
SSDeep: 192:JdakjDqqV0BbkWTw8/CzOKwZT90xxwbWiuQnumkozGllF0LkuA6ap7BZ:f7jaBbkWTw8DKwZxINXXG+liLPAr7BZ
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[black@gytmail.com].self MD5: b5e4af973efdb0aacb566ffad6b207fd
SHA1: e73c23f8c38927a0e2e664022f03ba4c41956635
SHA256: 33751ab3f492379cce643e54cf3ffa555a59abe990dca18287445a33b49d9ab5
SSDeep: 384:YmcoOKE80KeXbH88Nd+8VpKjC0scKsSBy5izoYSOEqPvVdas5C1Wm:YmJlEkqbTKjCWjYy5jZOLPqN
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[black@gytmail.com].self MD5: 88797c775faf19a99f375f5bcf3f2d69
SHA1: 7f5f7a8f5f13315fca3c162d9a99928a78aef631
SHA256: 65212eb7ed56fc7f91004db152d3bbb584383209cc6342be081d53aebee2ef55
SSDeep: 384:aqReME244yrZV8ZfZ5Cc6VZZ1zEUXdHjUwj5HPhO1NpnpAWrx1ElsGrXdsfXjd:cMB44kQDb6VZ1UwjphqrAiGXds/jd
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[black@gytmail.com].self MD5: 569c9d6d84ea4b4a9f930526f8a58cef
SHA1: f7d709e172e576bdc6ae54321800a2174da24947
SHA256: 3cb7444eb8f45c368405535ab5820c70caf3a998d6831629e384bb66bb0bbc67
SSDeep: 768:Oij9SnVBSz4vZpm+JDGFKBW/4Qvw6m+/HhL4:Oij9i3xG0BAYjoHhM
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[black@gytmail.com].self MD5: 84eb749cf822fbda23d6159e46728b80
SHA1: b039e63f651c4fd62a5e735a6785b37bc8348112
SHA256: cc7f27f22317c1cfc68909f0c9d9ced6eb18be44132b8b214f486209bf7e8bd4
SSDeep: 384:YF42kKd6r2qIBU87K0ee+ESGtV1tZ7XPwilQ0rvAffE+ZF0zY8gO82Pfk4DQg7KM:YFNkpSjU0t+EjHZbfuE3182PfDKOW8T
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[black@gytmail.com].self MD5: 91e29ea0b4f1d9e8496b0f25ce963588
SHA1: e1ae930d3063db84c54be6d35433f58fd7c72523
SHA256: c54e3b0c221cd501cddbc78f5b8ed35026b77e08b511659be159bc90b758f0c4
SSDeep: 1536:zE0eg3aqR36I3v9CmlA3XmwxWfoRjGGGvPzYwcR+otLQI7CHJLk:deoJR363mwwcjpGU+oNAJLk
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[black@gytmail.com].self MD5: 0b2f720e46fdbb89ad11ed6a55781e0c
SHA1: 34c9a32f6732bb8781967a5ff221c7592fd0aaf9
SHA256: 99e8131302db23fed15fa22b77b8a4908425fc6d9306360f9e799dc0212aa0a7
SSDeep: 1536:Vh4/kx0AJxiNVrAvoe1hihUVn41kfZJVEC5o++H/BupcCHMJ:V2W06xiN+epkfZXECG+UGNHMJ
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id-B4197730.[black@gytmail.com].self MD5: 3ca457f160b888bc141e6dc515880569
SHA1: a46b5d056c496f2c999d3721cc240f53f744bfb4
SHA256: dd67ebe60e6f3498b9b46934c0ec2153d1b7ed12e3594a04a8b99bd76cdddd7f
SSDeep: 3072:rfQ1R5EBBKwF0h70YX4s3oWDoE3WFV5vAT1nB3uUqz:ro14K82hOWDoBAuPz
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id-B4197730.[black@gytmail.com].self MD5: d32dbd88b1b389b1c1fbc9ce2152ff71
SHA1: b73bda612c3eb547c44b25b01a4be15088a1359e
SHA256: ee1e61b141d42dcf74cebf1817a61d92426f7b8d1c57fd594d20a7a07b423701
SSDeep: 12:lFoh1ivl0FnvmdVnMf3MrFvKW43d394G4:lFoh6l0FvmdGkZv9CdR4
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[black@gytmail.com].self MD5: 7add6dd420cea07f1fb360c734412fd9
SHA1: dcf5c57445da27824e09235dfa310e1984fb6eaa
SHA256: dc6be2d53431b03789555b1af6e68ee76dab29b9fb6c5debdd736fb0ef7bbe9d
SSDeep: 12:GhFqljpt5/6HnOcM5q6q3O3+LKW43d394G+:/lJwOcGq6O9CdR+
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[black@gytmail.com].self MD5: 3842e8b01aa796212a4c94437b22d016
SHA1: d003971bf94b3841b65c01d8fb36623a3307a6bc
SHA256: f3af0a413090a8915eeeffa600a8cea3459ba94b16d639266ddbbbee3a9ada0d
SSDeep: 6:1YVvMLwY+jQTF/irl+a7GKZOwIcp3zlp5nOClHv0eJj/tRh31KWzn83drb94pliq:eELTTkAauwIq3H53Nj/jnKW43d394Gq
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[black@gytmail.com].self MD5: bab270468cab9a7fc210ed3020a65695
SHA1: c7ac14993cfc1e47eaac1c9a0633ab62d0ceebac
SHA256: 91259d65cb495dba04b163b583b4c62af748b330286a18daca5ac612485cd2a3
SSDeep: 12:x5YQMoXZHhSLehpTmjv30a3elUpKW43d394G+:x57MAZB+iZmjols9CdR+
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-B4197730.[black@gytmail.com].self MD5: ae059080100e67548655834e1c9f57bc
SHA1: c444e484d30863b73b35305f8398e2b543857288
SHA256: 87c5bdad41e793f2b2369cfb4167fe30975519356d3bacb9142990da400bf966
SSDeep: 6:Tk7z3HKtj8mqx/WehxmN+gcwxjDqip3CDb5nOClHv0ejnfbVD131KWzn83drb94p:Tk7z3tJgNh30b53nfbrFKW43d394Gq
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[black@gytmail.com].self MD5: 2b2501e2e14d0901c7fbf54d2bb0aae2
SHA1: 8d113a0ffac2aa9335553c6d68bb50124820b830
SHA256: 2d02f9b49226956030d6f25025b43cf9b5d8dfd011a034fc65341ac85cad68ec
SSDeep: 12:eoLEhbIdvbq4Hf2nM3q35ijvKW43d394G+:eWnlz/Zz9CdR+
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[black@gytmail.com].self MD5: ed6970a489dfbf48351c839f2bf28101
SHA1: 993a2c90e740244af5e88a96d19f704ded546d0c
SHA256: 09e3a3bafe8ccab6ed7523bb3ea1fe6e6548e22fb5c5ed356922e3fd87b8e596
SSDeep: 12:UjggJobvxNDYmxUq3vT53uUbKW43d394Gq:6g/dUMoq9CdRq
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[black@gytmail.com].self MD5: b024844b05755f4fdea5e4209034960f
SHA1: fb1c1f1f7272d9bff54df3c457c78901456be075
SHA256: e2e0b766ca01255b28c8e2608b56b887c475ff2d23c51d075f94eb1eb9740dec
SSDeep: 24576:54vzz1Y5Zj9Y6AOwaWVNWWHHzRu1k/L9chbUF/Tx7mWqn3gVtiBwGFwRusBwlNS9:5qk3NIX3NIIaX6wZbSxjlgsnxpQcV
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[black@gytmail.com].self MD5: 76403071ee72a40242fdf13705d8f5ff
SHA1: d6643e49f07cb6db831fe7087bedfc06e8716eea
SHA256: 8547dd0d252a60b45ba4b32fa29cc0ee2982308cb6afda0e2631a02ac11e39bb
SSDeep: 12:sZ6FNCzyLH1tQHwCd99RXiERC3Mcn/Vjc1jIRtaKW43d394GM:s6N1CwC/9RXigvkfa9CdRM
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 94004dd208dca6343e3b50864fc9c769
SHA1: b0bcb95fe3d50fc812c10ce6641796c030cc5786
SHA256: 375ef40622545ce2791698274ec8a17af270040a71ea54d85c8614a0639341b4
SSDeep: 6144:LPANzZnjnsFrOKN0vwKe5UMreYrfsCR1r+2gcDaZi2y8Y/Q7OUxOG+dbDyh4nCEV:LPANzhj6N0vwKoUMrFzPNJ2dnDIGIbDF
ImpHash: - 		Access, Create Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: ab71c8f4a66e405ad480fa29f05b2698
SHA1: 9fb2206896d33a125ac4f310c2b10c83bc55c619
SHA256: b9b8870267afd3b37892bf29797fe79dc7189e97e67cf91cd153148137dbd976
SSDeep: 48:Nok/Wf6EvlQqT191rQcUgXlZqXacdKdXLXLipKRi:NJq6Ev11UBEZ+acMdXLXLipF
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: b6b1f0f545f87a76c5c4b18c068207e6
SHA1: 06e734146dbd3a502147e76211408b5d1bf11544
SHA256: c913e04d45335754999ea93a37c0bb66f786b9d7f927863990d54436df0c415e
SSDeep: 12288:/DzvnB2sTVbVX9mM4bjsplkJmetKhuj3zoxPXqW+V8yYNH1rKLTT:HB2QVbVtmMoQ+Q4DUF6AfNRwTT
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 3a22a7c58e5b7471b1306d6ec8c3d5eb
SHA1: c549c825f2246fd8f32e9717031c89149ac2fb7f
SHA256: 967f490f4992b54960c206616e78681c74f676d2fd7a0087da9f3a866c8333c6
SSDeep: 24:FW2ZxN/O+6nM093h1j69fzIBOmKwgnWvSzMiPH5mkikN7Tfm9HCgJ8g9CdRi:FW2Z7D0zYfMCwFhiRrdhTfm91GgKRi
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: a0d9646894b7696868baacc6a5812348
SHA1: c690d5c2ca5335a779c95f537a7df559f5ad704c
SHA256: 42e3355e21f1ae7eb6861b6fb8ce20504f62b2aa9550e84504dd84c0dbf027c5
SSDeep: 12288:DefX4/8Ey15QdG7hDv9vPGeyxCkzM2Ifcmzp9aharOnsp:DkX8sbQd0vvP2xCH2EcmrahE
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: e2d93369b09e0db74aadd2374b4234e7
SHA1: ec7a22fd831cabbce6bffe9e688cd2976de9f77d
SHA256: 7851600b2659e8a3e74a43d8ee3185cd87daafc72b75555d77f11ba835cead89
SSDeep: 24:jt5igNboNQ8Q6hZ5hCMmB0LUus7UiiIQ9+5pjalW79UekwDT7AlUC9CdRi:jtHeI6NhNBUus7U8Q9+vR79hkwiKRi
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: b005290c2f292b138cfb9ffc1cc67aa3
SHA1: 9df7ab5a8b28484af134c31b771a46ca1a7d5d19
SHA256: c0936a36351385adc44c0016d81c36577a333647da3d1e53bd3c33a2f94418ae
SSDeep: 6144:fmlKOGkXYL4PssagxcJj5rrO6/UQQlFhYy7mjFzdexY:+dGkIstagxcBd6At8oyQR
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 01759515d21ab0b58e9614fd512927c1
SHA1: c4ec10b87a735e450f2e38c6eda54cf2fbcd1b02
SHA256: c9d645f719f4d041b838aca26c92d91466b7d796f44fe16037dfee3b2a1b58ea
SSDeep: 384:7fsp98zdFbGhJDBhfwJgx85dB+XF2uXfnmHX4az+w18ie9K1h3nViulL:EWzkoJgx8wXpfor6w18ie9KrB
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 7b8847bbe51942f3416b4cf93233dc7e
SHA1: e16590647e251a1b6d6c5da5e8664c2c71e8003c
SHA256: f49d47498b38fcda210940d691a6fcafad0e79442b8ae0f88023433c3ed0678b
SSDeep: 12288:K0P5n9+62yetqZwtT2Q/fB+kH7a7rPnDCBCF/ZdQtG216HZv6tsi47JCSJyrfjTb:d86/etqZwlnEy7IzDDF/ZdQtbtwhyzK8
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 69deddc71d8c5470339a767fb3e29466
SHA1: c812c50c2ec2b39bf48855c8c7aabc4892abda51
SHA256: 7fab9448f28153fd29b9300e513db1aecfc975c09406d378c6acccee99908ab0
SSDeep: 24:KtjsF29zNestimo4QQQvHXo/l+31UuR9omZwlv0n48AU60ZvUtjUbjqJfGchy59T:ORhQvalM1UG9oliAr0ZvU8jqIcheKRi
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 306b342352f622899ec0e525b9e83b20
SHA1: 276bdd88dad0f2b240cfc048465affab5531ccf9
SHA256: a5818def8b19135d68823612e94a62e455c12e86199a4724421449e6c5d0e672
SSDeep: 48:gFzxM5z3hgGRBbqh40qGqNdBjSBc3kZu9GbdKRi:gK5zK+BbqqBCKcDxF
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: c6f1228164347ba3c82e68a5e2bbb6cf
SHA1: 610feb90a2f6ed7fb81adcfa0c51f40e03409385
SHA256: 54a5e0f8a5fc04a55a67db7ca42284de5b27012a01547bb6ea537f1a7e4c4e2a
SSDeep: 48:PenqKJQ4cOkllDecTtYtlHXvyfQRTP1txtwCF+uNKsqAjhbFQAKRi:s/Q4cOklBeGINXvy49ttxtxFyuhbFLF
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: d1d240ef377a6bc926b523365776e413
SHA1: 8c897516dc5d11fe979618ed8e4254fbf150f0a1
SHA256: d614ba45b2abadd23c9487fc6f27f06bb6f9c72eadf9174ad4ef454f92b3da55
SSDeep: 48:jE0bp7qQ1rWXE9skifw4eqUDYOHudj2fWS9+7moL1FLEKRi:j3pt1rEE9srIjqMYOE6uS9+7moLUF
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: e1d4e8726d6d72f54d34d67d0b48dd3b
SHA1: ed83b0eb8320ee60c9296517d0a7cebaec362fd7
SHA256: 66c5a689b81b5f90bc60493898188bb18bcd24773fb7c3ffe41d8d3489b51a21
SSDeep: 6144:SySWjmVX79UVvDwkYWn4bvgQ4QFlbidDKU/GhawU:hIF79UCkYWnqftFEd2U+PU
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: d6f0fb563214a4d69c8781f8d8fa1dbd
SHA1: b9381008f21e291dcf5b3f471e0ff9ef04cabd34
SHA256: 35565741758ddbdd049d733965d8211947a7e46d3a70d89615fd23b9ede27105
SSDeep: 48:ES2uw1Pwh9qXKAdcWs1iO4SirKHMTDXSvKRi:E6wdwhwKAGNwOtM/SvF
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: ab75d4609f9bf6ae90479b1ef3cb39b7
SHA1: ede1d310d0958337e33befa3e896956b14d8e168
SHA256: 345a6e0e03e8f6efc11bea56b7647488be26563e6036a764fdb3cc7cb0ffef2a
SSDeep: 48:2tuUi71B/Gpqv0XN160WL8+8nV8+LYBEsiFiKRi:2di71wwvmqXJ8u+sGsOiF
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: f0068428a6e572dc6e512d2e739cd2da
SHA1: b17436659094ac01ad2841941e303953e05745ed
SHA256: 2ba7289a15d425720f4f0c6d13785c7dfe481da81d7b214f50fa93af165e6c00
SSDeep: 24:sMiCsMHhf/qNYROuh0nZxqLIQUTfryiE0iKWmiASm8vmY1/MEbsN9CdRi:sOskXqNYRk/ekfryiE0+tvBrAKRi
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: 138cebfb4e0aea3badb772993b36df2d
SHA1: 75af9b93491ee172bcb3f10472b337ad91709388
SHA256: 49b4ddcc51b261b0fc0f9499d121fd98cbeefb202f3e369c0722c517e5a12d3b
SSDeep: 12288:5/zLMNG9tbdxPLVwKrJY8EqZ90n5ZsrVmum/OfbmLTp:pzsG9tRxPLVwK1YhhZsX8Oyfp
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[black@gytmail.com].self MD5: ba65073bd8efb5817846df4d184f2e72
SHA1: 04a3563706972ba92b18f750a38ba1dfc502ff04
SHA256: 41cd3ee00fd5098f30926459337b84a246bbe9f906351758a6a5e1bc084762d1
SSDeep: 24:YQ0n+gpWTt6MaE1tQAMjyKM8bM2XWvcEFCPy2H9UgvwmH3RVRf8u21Q9CdRi:Y9+gG6MqjyYAEH/vvXRVybQKRi
ImpHash: - 		Access, Create, Write Dropped File
Not Queried
For performance reasons, the remaining 3581 entries are omitted.
The remaining entries can be found in ioc_export.txt or ioc_export.json .
Registry (26)
»
Registry Key Name Operations
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\1svhostru.exe Access, Write
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Startup Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\1svhostru.exe Access, Write
Mutex (2)
»
Mutex Name Operations
Global\syncronize_ZKFKZFA Access
Global\syncronize_ZKFKZFU Access
Export to TXT Export to JSON
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image