274011aaa97f

C:\Users\kEecfMwgj\Desktop\274011aaa97fd19ad6d993a5555c9306090da6a9b16c991739033ebb7673a244.exe

Sample File

Binary

»

MIME Type	application/vnd.microsoft.portable-executable
File Size	36.00 KB
MD5	52e47deed3440de981bf84e22c6da710
SHA1	e11a43a223b2558d99452b2efd4e6a289855b2b8
SHA256	274011aaa97fd19ad6d993a5555c9306090da6a9b16c991739033ebb7673a244
SSDeep	768:VlUgrN0sWl7V8H+xolL18mDIOfd6YgDb431QMX0nl:zPWlx8PLZfVgDb4Wl
ImpHash	f34d5f2d4577ed6d9ceec516c1f5a744

File Reputation Information

»

Verdict	malicious

PE Information

»

Image Base	0x400000
Entry Point	0x40a41a
Size Of Code	0x8600
Size Of Initialized Data	0x800
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2019-12-28 13:13:43+00:00

Version Information (11)

»

Comments	-
CompanyName	-
FileDescription	Program
FileVersion	1.0
InternalName	Program.exe
LegalCopyright	Copyright © 2020
LegalTrademarks	-
OriginalFilename	Program.exe
ProductName	Program
ProductVersion	1.0
Assembly Version	1.0.0.0

Sections (3)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x402000	0x8420	0x8600	0x200	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.25
.rsrc	0x40c000	0x57e	0x600	0x8800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.02
.reloc	0x40e000	0xc	0x200	0x8e00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	0.08

Imports (1)

»

mscoree.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
_CorExeMain	-	0x402000	0xa3f8	0x85f8	0x0

Memory Dumps (1)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Point	YARA	Actions
274011aaa97fd19ad6d993a5555c9306090da6a9b16c991739033ebb7673a244.exe	1	0x00240000	0x0024FFFF	Relevant Image		32-bit	-		... Memory Dump Actions Go to Process Download Dump

C:\Boot\# HELP_TO_DECRYPT_YOUR_FILES #.html

Dropped File

HTML

»

Also Known As	C:\Boot\cs-CZ\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\da-DK\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\de-DE\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\el-GR\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\en-US\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\es-ES\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\fi-FI\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\Fonts\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\fr-FR\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\hu-HU\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\it-IT\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\ja-JP\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\ko-KR\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\nb-NO\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\nl-NL\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\pl-PL\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\pt-BR\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\pt-PT\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\ru-RU\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\sv-SE\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\tr-TR\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\zh-CN\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\zh-HK\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Boot\zh-TW\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\PerfLogs\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\PerfLogs\Admin\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Assistance\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Assistance\Client\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Assistance\Client\1.0\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\ClickToRun\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\ClickToRun\E728F99D-05D1-4020-9ECE-6DE2EC414166\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\ClickToRun\E728F99D-05D1-4020-9ECE-6DE2EC414166\en-us.16\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\ClickToRun\E728F99D-05D1-4020-9ECE-6DE2EC414166\x-none.16\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\ClickToRun\MachineData\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\ClickToRun\UserData\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Crypto\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Crypto\DSS\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Crypto\Keys\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Crypto\RSA\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Device Stage\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Device Stage\Device\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\DeviceSync\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\DRM\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\DRM\Server\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\eHome\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\eHome\logs\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\IdentityCRL\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Media Player\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\MF\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\NetFramework\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Network\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Network\Connections\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Network\Downloader\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\RAC\PublishedData\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Vault\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\WwanSvc\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\packages\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\packages\vcRuntimeAdditional_x86\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\packages\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\packages\vcRuntimeMinimum_x86\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{65e650ff-30be-469d-b63a-418d71ea1765}\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\packages\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\packages\vcRuntimeAdditional_amd64\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) c:\programdata\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\# help_to_decrypt_your_files #.html (Dropped File) C:\ProgramData\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) c:\programdata\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\# help_to_decrypt_your_files #.html (Dropped File) C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) c:\programdata\microsoft\windows\templates\# help_to_decrypt_your_files #.html (Dropped File) C:\Recovery\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Recovery\d327d5c2-7147-11eb-9862-d731c5aaa7a9\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) c:\users\default\appdata\local\microsoft\windows\history\# help_to_decrypt_your_files #.html (Dropped File) C:\Users\Default\AppData\Local\Microsoft\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Credentials\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\1NBUR4HR\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\6ASVN7J7\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\D68G7BIJ\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Internet Explorer\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Media Player\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Local\Temp\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) c:\users\default\appdata\local\microsoft\windows\temporary internet files\# help_to_decrypt_your_files #.html (Dropped File) C:\Users\Default\AppData\LocalLow\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\LocalLow\Microsoft\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Identities\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Identities\{31810C36-5D23-4CCE-A3B4-316DED195C38}\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Credentials\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Crypto\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Crypto\RSA\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Protect\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\My\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\Contacts\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\cookies\# help_to_decrypt_your_files #.html (Dropped File) C:\Users\Default\Desktop\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\Documents\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\Downloads\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\Favorites\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\Favorites\Links\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\Favorites\Microsoft Websites\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\Favorites\MSN Websites\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\Links\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\network shortcuts\# help_to_decrypt_your_files #.html (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\printer shortcuts\# help_to_decrypt_your_files #.html (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\recent\# help_to_decrypt_your_files #.html (Dropped File) C:\Users\Default\Saved Games\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\Searches\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\sendto\# help_to_decrypt_your_files #.html (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\start menu\# help_to_decrypt_your_files #.html (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\templates\# help_to_decrypt_your_files #.html (Dropped File) C:\Users\kEecfMwgj\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) c:\users\keecfmwgj\appdata\local\microsoft\windows\history\# help_to_decrypt_your_files #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Credentials\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Feeds\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Feeds Cache\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Feeds Cache\1NBUR4HR\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Feeds Cache\6ASVN7J7\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Feeds Cache\D68G7BIJ\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\FORMS\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Internet Explorer\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Internet Explorer\Recovery\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Media Player\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Media Player\Sync Playlists\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00008B4D\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Media Player\Transcoded Files Cache\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Office\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Office\16.0\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Office\16.0\WebServiceCache\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Office\OTele\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\af\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\am-et\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ar\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\as-in\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\az-latn-az\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\be\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\bg\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\bn-bd\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\bn-in\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\bs-latn-ba\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ca\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ca-es-valencia\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\cs\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\cy-gb\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\da\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\de\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\el\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\en\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\en-gb\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\es\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\et\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\eu\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\fa\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\fi\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\fil-ph\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\fr\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ga-ie\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\gd\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\gd-latn\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\gl\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\gu\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ha-latn-ng\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\he\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\hi\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\hr\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\hu\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\hy\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\id\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ig-ng\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\is\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\it\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\iu-latn-ca\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ja\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ka\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\kk\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\km-kh\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\kn\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ko\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\kok\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ku-arab\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ky\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\lb-lu\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\lt\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\lv\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\mi-nz\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\mk\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ml-in\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\mn\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\mr\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ms\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\mt-mt\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\nb-no\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ne-np\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\nl\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\nn-no\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\nso-za\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\or-in\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\pa\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\pa-arab\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\pa-arab-pk\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\pl\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\prs-af\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\pt-br\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\pt-pt\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\qut-latn\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\quz-pe\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ro\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ru\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\rw\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\sd-arab\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\sd-arab-pk\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\si-lk\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\sk\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\sl\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\sq\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\sr-cyrl-ba\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\sr-cyrl-rs\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\sr-latn-rs\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\sv\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\sw\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ta\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\te\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\tg\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\tg-cyrl\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\th\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ti\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\tk-tm\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\tn-za\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\tr\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\tt\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ug\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ug-arab\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\uk\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ur\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\uz-latn-uz\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\vi\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Outlook\gliding\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Microsoft\Outlook\RoamCache\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Temp\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Temp\gen_py\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\Temp\gen_py\3.8\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Local\VirtualStore\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\LocalLow\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\LocalLow\Microsoft\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\LocalLow\Microsoft\CryptnetUrlCache\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\LocalLow\Microsoft\Internet Explorer\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\LocalLow\Microsoft\Internet Explorer\Services\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Identities\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Identities\{31810C36-5D23-4CCE-A3B4-316DED195C38}\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\AddIns\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Credentials\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Crypto\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Crypto\RSA\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4219442223-4223814209-3835049652-1000\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Document Building Blocks\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Excel\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Excel\XLSTART\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Internet Explorer\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Network\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Network\Connections\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Network\Connections\Pbk\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Office\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Office\Recent\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\Contacts\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) c:\users\keecfmwgj\appdata\roaming\microsoft\windows\cookies\# help_to_decrypt_your_files #.html (Dropped File) C:\Users\kEecfMwgj\Desktop\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\Documents\Outlook Files\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\Documents\o_o-1F3TH1sB884\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\Documents\yLKsNetY\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) c:\users\keecfmwgj\appdata\roaming\microsoft\windows\network shortcuts\# help_to_decrypt_your_files #.html (Dropped File) C:\Users\kEecfMwgj\OneDrive\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) c:\users\keecfmwgj\appdata\roaming\microsoft\windows\recent\# help_to_decrypt_your_files #.html (Dropped File) C:\Users\kEecfMwgj\Saved Games\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\Searches\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) c:\users\keecfmwgj\appdata\roaming\microsoft\windows\sendto\# help_to_decrypt_your_files #.html (Dropped File) c:\users\keecfmwgj\appdata\roaming\microsoft\windows\start menu\# help_to_decrypt_your_files #.html (Dropped File) c:\users\keecfmwgj\appdata\roaming\microsoft\windows\templates\# help_to_decrypt_your_files #.html (Dropped File) C:\Users\Public\Music\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) c:\users\public\videos\# help_to_decrypt_your_files #.html (Dropped File) C:\Users\Public\Downloads\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Public\Libraries\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Public\Music\Sample Music\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Public\Pictures\Sample Pictures\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Public\Desktop\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Public\Documents\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Device Stage\Task\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Office\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\RAC\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\RAC\Outbound\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\RAC\StateData\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\RAC\Temp\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Search\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Search\Data\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Search\Data\Applications\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\Search\Data\Temp\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft\User Account Pictures\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft OneDrive\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Microsoft OneDrive\setup\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\ProgramData\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\AppData\Local\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\Music\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\Pictures\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\Videos\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Default\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\Music\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\Pictures\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\kEecfMwgj\Videos\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Public\Favorites\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File) C:\Users\Public\Pictures\# HELP_TO_DECRYPT_YOUR_FILES #.html (Dropped File)
MIME Type	text/html
File Size	3.47 KB
MD5	275cf0b3ea374e44f46efc30aa876e4b
SHA1	eb2db340418bc7abf0146253a6fe252fff7e3c85
SHA256	528bcbff16bd0df4ecfe74142d9547e4c81ec08132421f2b883ac553a45071df
SSDeep	48:dSlyJflI7/oGASKZ15n7CfMHkKiA+uefqbs3Wlmx2QmV60DiAXlRN/l+kw:1JflI7/oHZ15VJcuER3Bx25xiylYkw
ImpHash	-

Extracted URLs (3)

»

URL	WHOIS Data	Reputation Status	Recursively Submitted	Actions
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css	Show WHOIS	N/A	-	... Actions Show URL Submit URL
https://blockchain.com	Show WHOIS	N/A	-	... Actions Show URL Submit URL
https://localbitcoins.com	Show WHOIS	N/A	-	... Actions Show URL Submit URL

C:\temp0.bin

Dropped File

Unknown

»

MIME Type	-
File Size	-
MD5	-
SHA1	-
SHA256	-
SSDeep	-
ImpHash	-

C:\ProgramData\Microsoft\ClickToRun\E728F99D-05D1-4020-9ECE-6DE2EC414166\en-us.16\stream.x86.en-us.man.dat.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	864.48 KB
MD5	bb2d29c5bfc8d9e76ea46dff962abbba
SHA1	449c66b6011b2f6f12ae5243679e9cda5e16091e
SHA256	848175bb55e3190e493d0947458ae2088b5b2d76ee4c51a8ce2365c6a34f5d53
SSDeep	24576:aYHcL7BIU/59Lnq3Pjk0LEpO7KJP54YJO+iuuZqOfz4QWn9OE:aYHcL13LnNeyeOLOuuQuzjWAE
ImpHash	-

C:\ProgramData\Microsoft\ClickToRun\E728F99D-05D1-4020-9ECE-6DE2EC414166\x-none.16\stream.x86.x-none.man.dat.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	3.54 MB
MD5	d26c6276709e2b343039c360d281745c
SHA1	219667fd64bf00d5de2702c82e6a668372e7acc3
SHA256	4d2df5bf825faaffd7c8df5d7b9e63c46cb23cb04ebf08812521467cdd5d5dff
SSDeep	98304:92DPZRHksURuYdIur6o384IEfQZaBYKuQk2ot3Df26QisaeERG+PhV:ADPe1T/13xk2oNwqVNV
ImpHash	-

C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	126.73 KB
MD5	777ee5f707aed3f2d02b1326e3773e1f
SHA1	37657c7b841b8fd27374ff63d2a9e73b98d40acb
SHA256	ea66f669d62cb4cd1a7e591ae377743af0d120796b92b48d23ec0369b2ec6bab
SSDeep	3072:Y5yr+AUYzhpE9inCxFJ9rZeVso/WXBrixS6vC6FmNt4Xn:xr+AU9i8JmXWBGf66FaMn
ImpHash	-

C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	43.47 KB
MD5	5b34a1b993617598e89874bd9142c46e
SHA1	cc0e9f5b3c9e1c48b12000e8e515f8eee7ac77d9
SHA256	2f8b4f916a5eb3f3967552170c03ef51526c77ba1b6b6160b8af8278fe960f09
SSDeep	768:9TmFZKo9MN4tz0nD9+/vxZjD3+QvRPdM+QHYe6bezl3suuLay52Txd:5I8TN4tz0D9+nv3bY+7ep39caTf
ImpHash	-

C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	28.22 KB
MD5	23b87990075e49def135dfc97ec84309
SHA1	80ab3ac5f12a268c3dea62350f373cee47b88977
SHA256	2cec702b344d2f9b9c277cbfdf9bd33328e3eb2ce2397c3aaefd279b4fc4cd6d
SSDeep	768:p/Iu+sFVdw2w1V3231eSaObV1TWTcKCNdhuhgodcB3QV9F0l5UQo:yuNFVu2w1Vm3IYfTpKCNdhuhjcBASo
ImpHash	-

C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	38.48 KB
MD5	92ac5945e838eba2eb50c0dd6299d5d8
SHA1	5c8de0df687a186c2907586a35881ff275f44357
SHA256	58f2109cd46d0d4e2520d370f8d33535a65f1cfae8902f32c71fbbfa258e02a4
SSDeep	768:QN/WmP0vLSPjOq3Lan2GBSV5BG1GbxB89VpwmBAndJpE19E2kS/Y77a5rKUg0z:QFPyGun2ASVm1Gr89oNneFYfaQUlz
ImpHash	-

C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	126.73 KB
MD5	ee2eb85a98a19e5aa2bc39799391d998
SHA1	afebb31c79c642729033b68f005219d00bf26372
SHA256	98eda0963ad94c2fc948dc3fa620640ef080f9b8a04824e11f949604cc751809
SSDeep	3072:LdPrjJRJSOOdC7Iaf8AzFlYgBG2Z/RPqqh2mYI:L1jJRlp7Io3FmgV/QqhJYI
ImpHash	-

C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	28.22 KB
MD5	1b6ffa96225729bb5e294fc7986f07b9
SHA1	e8e64942dd73bc560ae5382450eb167c74faf3e0
SHA256	a619462132c230bceb5046e5411072ef9c97378f0855627d573d6abe2bd924ca
SSDeep	768:LWctyZUlqq4tQaV3ERcD/GEl20BNJ9AawmpeuYBHG:LwZUwDV3ZD/GyPjw5mpezHG
ImpHash	-

C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	2.68 MB
MD5	ad684a462eb9cc112db27df67e42f351
SHA1	aca28c1414aefe8f014ecfc2dff96c89d919bc22
SHA256	ad02551d3d8f5bed393566a2e07e983f721991c158251ca442645c3403b5ee90
SSDeep	49152:INqdBFYMfjfluMlOnlIFSI+nJ6nASmvXwl2hPUlyVK7RU1l/SYVdqY0e0ZeO:OqdXBfjPlMlI4DJ6nASg4sPIsdXxdvpY
ImpHash	-

C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	89.38 KB
MD5	e28cfa19f60553152f274e4cc110e870
SHA1	36a2db38286c517bf2183f93e0d3a101a06e8feb
SHA256	8bc9b0d65d7d8ca3cba4ce27102daa37d217baffb504881bad131d242aeeeeb1
SSDeep	1536:hz83Jr2XK/vtRPya22GMaHBJlYNOMuGxYrP4Ak5mOR3m3UIKOOsEfTA9+/dPx4l/:t8Zr2XOvt5aDHy2qYjkQOtm3UIFOLfMV
ImpHash	-

C:\ProgramData\Microsoft\User Account Pictures\kEecfMwgj.dat.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	32 Bytes
MD5	b8b6218205084b674817eb0547f8ee6c
SHA1	527b6774496175cbacfaf546ae3fdc4554f1cf48
SHA256	ef863ae46e51e974fcac10bcfb814a4877f4665cd197c9ba33aa9dbb805d213e
SSDeep	3:e7hvlcnRFMutgrm34:khvlcRFMZmI
ImpHash	-

C:\ProgramData\Package Cache\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\packages\vcRuntimeAdditional_x86\cab1.cab.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	4.97 MB
MD5	4d84f098e144ac9a6a2c6ed0210f6ba9
SHA1	674c682615c5545a295faa7663d2ce869683844f
SHA256	87e7a4fc6943a60cfae00adbfc9082c52c4afe9e830823189910109d756b0d91
SSDeep	98304:mKRS+/Hs8l2yig1uByMdlDMzLaSTzM71Va5tvdpf:JRrHLl2yd8oMnMzLaSTz41iv3f
ImpHash	-

C:\ProgramData\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\cab1.cab.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	973.70 KB
MD5	c3ebea687726d243a8e55f4d0b6f07d6
SHA1	800f5253a21cd67690a2a6b30198ba2972468c3a
SHA256	f60bcad669a4220fea221a51950b2303e2df0e7ee6499689dddf45a9833a8c7a
SSDeep	24576:p/VOHihauAGiX4ohlHWzz//q/fziMCwF6q5kq1V2Wfg8DcMEq:pYHisuAGiez/8fuMaElfgMP
ImpHash	-

C:\ProgramData\Package Cache\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\packages\vcRuntimeMinimum_x86\cab1.cab.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	1.30 MB
MD5	5c9de5b115fda09148090d98bfd953c8
SHA1	20d20a1e3035d9d6bbf2412849c44b536d7240d7
SHA256	6324312b83049948b1dc02e2c5a3eff1150341b4ae3cb67e4debb64618d30525
SSDeep	24576:KkvWArHHXuRCr1IINfzult32eU+irtYgf+D+ZPUst3+gLMpggWv45mS:6oHHv1IIVa39U+ihsD+Zsst3+gYqgWaV
ImpHash	-

C:\ProgramData\Package Cache\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\packages\vcRuntimeAdditional_amd64\cab1.cab.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	5.37 MB
MD5	bf99273a84d6044f74b5f66da173167b
SHA1	07751c0e0bd4e857cd6f4e73897d8f6c2fbfab11
SHA256	ef5ecab261f50785e8f1a3ab5cc1d76fdee7f914f19a5e68bf327c36ad2ef3d7
SSDeep	98304:HEPNzv4SzAUFlJ1TZ7tSM9whl9MMAoVXd+Clo4O09HVocEvu1hNq1hXh8IuScBeZ:HaNzv4ql7p0l9RVXICloYoFvkNyNdL9T
ImpHash	-

C:\ProgramData\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\cab1.cab.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	5.33 MB
MD5	9548d23b58f571e9e58090666997a5fe
SHA1	56d49951f61a9d8cbc1f422c220878bf57dde264
SHA256	e22f81f8ecc8ff1939cc54ab66481c0913c650dee268f862fff307ac9f8e695f
SSDeep	98304:gK4notyMZRzO3YF5fHS7VJP1e3OBdsmfXwlmX5FAeVQb8IWCS2PZOgqdYss/Is3S:z4notRz7fS7Tte3I2EwzZ9NTZOgTS
ImpHash	-

C:\ProgramData\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\cab1.cab.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	0.99 MB
MD5	ffcc0f87063b08f8f11a238c65195826
SHA1	41b13291cfa4dcfb1df9d964bc798ad355e47115
SHA256	80dea819fa7bf85eff20fc694ddea79041b14420f9c458387c89ccb5963fcf1e
SSDeep	24576:qIr/QXoNhQivmlXz3QW8nx+M1f6ot6zXR/22osdqPyVTna95jBG:droXoNOivC4/N6zXgTsmxQ
ImpHash	-

C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	4.92 MB
MD5	a5f51c60a1a03ab815ad35fbbfe29abb
SHA1	9cb72b68fbd65de58ea3ac0363cc2faed007257f
SHA256	ef65e2a5eb725bfae97044b60de7709f31b8f53f3e92d540d0fb106e00741e21
SSDeep	98304:kztGwFQoQJ8tg47FUGqatdM6W4JvlrHkQm/IbHYe8lkq5UkxxmKtbYVtRBRk/Zzu:QGUQoiEgOFpqatS6XNrHkQjbq5UC3bIh
ImpHash	-

C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	802.45 KB
MD5	fde4d999cf3b80bcc0282e69bf6f9a79
SHA1	98c133034f0b195e3971a6cc46d5ffb04837ecde
SHA256	e2e8f1db49faef21519a9682a47adb7c057b29c1292901874b59f1248770ca15
SSDeep	24576:b5MkRexHhkzQpZSTyIz41N9V0cplU9kEWH:aCzyZSjjOakN
ImpHash	-

C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	790.81 KB
MD5	41c843d93c326c8ac5a6368fb206c912
SHA1	374a950f17f9b0695ea25044d7df9aa622b90fdd
SHA256	f4ea2757fdd7b6df2e8476d8f0279f011a9d856f90f0707f86ddfbae853dce3c
SSDeep	12288:2T2XdWantLMgEJi3Hgnh1v58xApJ+qgQ5I2hrZrTXB1mU+ZLrqpiyx+Ua0VTNgSs:2yXsSwdhkxANfhZTXBaqpipVeuxdH
ImpHash	-

C:\ProgramData\Package Cache\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\packages\vcRuntimeMinimum_amd64\cab1.cab.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	1.44 MB
MD5	714d5b137a1561f61d586ede0dd9917c
SHA1	ed2b6d08931660bb9096affcfbd5082774539c70
SHA256	7ce6e73ca75c5673edf3b9a641cd9f2e21d44c74c341ec6221ceafa4f2f36305
SSDeep	24576:omO8OS1KtLCP56dtqjl9LaxqafI5qeABiWE1TraCli3RO1C+Kbro8J5C:omBaCHh9OxqafFBiW+rasek1jIrB5C
ImpHash	-

C:\ProgramData\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\cab1.cab.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	4.70 MB
MD5	dc43965a236b7c2bbac052595e2b31bb
SHA1	406e69cd09475068881cc1ba18d2d649246fd22b
SHA256	7c155fd201c29df0c7944647fb8cd64d223f025738c3a4c077c886f959c6cde1
SSDeep	98304:tpthcSgwjP0x2waumo5taAO6yHhlD9TgQ8bmAhSsYlvQMY9xO9sVUhx2:DtzgbxVcv6yNMRD85dexOm+M
ImpHash	-

C:\Users\Default\NTUSER.DAT.LOG.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	1.03 KB
MD5	fd8bf9adcb14f9745871460a9c140e91
SHA1	f5a86a90db09ef821a9fc2b9bac07e33bc6d0068
SHA256	3734707a4e478c6bb8e47e81b31008a047de51f567633dcc657459c6cf8725cb
SSDeep	24:bqf7+Hvk+Izm9UUAqLqntTsSUA8SUOSE67cOUskDo:emUDUPLqtTsSUEFQ2Do
ImpHash	-

C:\Users\Default\AppData\Local\IconCache.db.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	758.02 KB
MD5	7b8db0cda8b21ef22afff4fc9e605531
SHA1	b4274b9d7bc5c0681113335df580a6442ab47f9c
SHA256	e2413ccd3ea112070652a35597f97292fd1e1e61831b745cff41526be4e971f1
SSDeep	12288:lliGzJwILzpzQgKunwdFKgvxRevCzTCkwVRI6Z6ZXjMRlzJ5q/PLY6oqf:l513JzQgA/bXeaztwgoCE3yPs6oY
ImpHash	-

C:\Users\Default\AppData\Local\Microsoft\Internet Explorer\brndlog.bak.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	11.94 KB
MD5	fca7c068c8757f83fc47469fbc85e429
SHA1	1d4254d080bad6a3d73d264ad9ec94ac84cca65e
SHA256	892f061e59d65c4f480c83dccd186004a72215a99a1a54059fb515678800ff72
SSDeep	192:m9cyaX/rvyzMtFwqZvmUdS/oXL3q11wGvWw6P5nTi9p3UyIz1Axx+Cxm:TyUrvdtRHSp1wSWw6P5nTiFMAxx+Cxm
ImpHash	-

C:\Users\Default\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	11.94 KB
MD5	807fa048edbfc2023a8eab2378b79689
SHA1	0d171d8602ea5c725d322600f51d337b6ae14982
SHA256	be6c4e521e7cc3931376eaa5b3085509d571f172f6aa63274a5924c704a374dd
SSDeep	192:fQnLgbEcn42aHXkh+rngq0N7SrLU5vt6s57VMlMPTaoa/WR6OKTbsx/Iv/xH6TlM:fOLIn42aH0h+zznUPfSMPKSJKTbkJteJ
ImpHash	-

C:\Users\Default\AppData\Local\Temp\FXSAPIDebugLogFile.txt.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	32 Bytes
MD5	ff7bf27022fa33d894bd143323e4b92a
SHA1	92c1f489d413c8ce287ec6e1f1d820326de87604
SHA256	72fd103ba09f2dbcf7a98e3deaed8603b4485d3a56b3e7031f852e80bf6c93c0
SSDeep	3:GqyFLZ87:GqyFLZ87
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\IconCache.db.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	1.12 MB
MD5	8f6793a68ee9238a67ad28753d8e56ee
SHA1	a62a423e38034da97b9a57cff43e41b4162651f9
SHA256	3dfc9b69fc48482295633c5adab6a28f1fa3f311af9406113989c7ab506afa45
SSDeep	24576:vXXX7X4ypphjFdfnWUjDc+iBdQfHo9bcmIqHoku1aTgcLzNfhsk:Pn5pfpdxQ+iBWHwrNIr1vEzN5t
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	240.23 KB
MD5	74a2f10d523c163ca00e074a5a71c103
SHA1	af879c43bab9d4b9292b8b8bfdbf461bc4a77313
SHA256	337a683bf87e7f7a464e1d1eaff0ecc96ef47e1c3edcf41eab31c1fb576e251d
SSDeep	6144:xm0eIgZSIT0SiRujSuEmtK6aiIjyfTv4/45e7xoZ:xmGgZdTBrjSuENPefTwA5e7S
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\Internet Explorer\brndlog.bak.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	11.94 KB
MD5	a788905326d27dd17a3d1dab442bae8a
SHA1	aae4f979c6744eb720c749fbdcae1b27f030fa1b
SHA256	4d8001a3d22057b6ce1bcbab42e6690cd9850f1845960e3b823ac1fa16becbaf
SSDeep	192:xl/ND+HdK2gHWucccK3c7ijm4Wz7SEWKihGQyS0inTv+ysIvk6+EoaIEPwXkZC63:ZD+5gHWlhEqiS4Wz7SEWKcG3S0inT27i
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	11.94 KB
MD5	a6b49176814be04069f2e1f7e7e99cc0
SHA1	e187623cf4dde6da85c81bf03af3228665b30d27
SHA256	4f97ec8924b09ebf03d178eacc182b89855dad95d77922f048085ddc4c125c36
SSDeep	192:FDBXKSZjw8ZC1uftey4nJpniqV8MvS9YVQRS19ZaZPXGhSij2esOuvXU6iynGaVb:ri8ZSufteyYJxiNMvSWd19ZaZPUx3S82
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\Internet Explorer\frameiconcache.dat.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	9.12 KB
MD5	9a48bd77ae8cbb51484f7a3ef09bed8e
SHA1	dc7a1db1674c6b11b467089ef0614efa2013baca
SHA256	ba12908f69892fa377104858fb1c6f4f41346c4adb3180a392ef304a14380f4b
SSDeep	192:IiwPn4GtdqngJgcFnV+wN+LwKhDd72VHFKiAk3nTxG0+KP:2POhc1V+wXOyVlDA0TsI
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	16.03 KB
MD5	162d91138fa255ea5d9de6ede008d44e
SHA1	ca218d19d614e862023e4d455883040567ce79a1
SHA256	e866f97af740f814246ee4e62bf2ade8d1eb44c3f03dbcc717df4dd294963d90
SSDeep	384:7K5hH4OD/8IYRBEsQO1ki2RovvnNSPNwjRObl3ic+CwR4UPFF9hax4+3:m5hH4CbWExg2avF0WMUcVwZFF94
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{8AB24C65-1C57-11EC-B986-C89F1DB658E4}.dat.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	3.53 KB
MD5	f08ab7641f0ccf4b95ce9f7d3ccaafcc
SHA1	ad2250bfcb4ef9cc1a2374f70cb7a1ee71105511
SHA256	ef41ad2f51b137d1d6527d0537f62c8dfcaa9cb7b33a98bc56daf71932e534a9
SSDeep	48:FI0wc4Tk7ii2ApNMnG8ayQQg6ec/Z4H7d78WimPJ+Glby8UqmF5pOpfo83SqjMlS:JwRaiiDSn/aIgqMlHbPJXlMqmF6GGKLG
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{CBE13020-1C57-11EC-B986-C89F1DB658E4}.dat.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	19.03 KB
MD5	b0eb392f7592265e2bd686455f44f7b8
SHA1	8e53e49cf54552a7e5c5c0f7571fea9ac2834548
SHA256	94791e57f87655f683a903aa92dee256ab32b07910a552cbca2eb3841d824fa5
SSDeep	384:chxlDmm5Hnis269tizG4EOzpKcSTMpzDReh2PlEEVhlFvDq:Gm+n26KXzwcSgRSelDvu
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\Office\OTele\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTele.dat.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	304 Bytes
MD5	00b79979ef9d6e47bc77f2c1b5213daf
SHA1	80356937952f41451b90048c50faead8460d931a
SHA256	f16dff27919d56b34b0b24e677f02bc9c5d23416a993f5a188eded4d9d8bab80
SSDeep	6:zXWK8e4B54RLDyQJ9GemGIYXToa7ALTVZpUrLmmlNck:zmK8QVeQJ9pbTj0VZpU3VR
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\Office\OTele\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTeleMediumCost.dat.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	864 Bytes
MD5	2852085bb1ef5c22f58351c1ec2f80ca
SHA1	93e10014f67363be162c9a32a035c8a787446b77
SHA256	3ab23f6703bbfc98680eae8475fc64198dc4fa97f932dc68db19326f79995609
SSDeep	24:1vvMp993RNlNmLwqRMbe1q+/nLq0P06Dd:1vejVNmlRMb5anvbDd
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\Office\OTele\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTele.dat.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	320 Bytes
MD5	664fe2259d3697453fdd6c8606a1e550
SHA1	b8aea7c8535edd54b6016ff054061e8aebbca674
SHA256	81cc75633dcb407474f251f765766c70b5552ac567c74217d85ef9263843ba14
SSDeep	6:MncprKu+p9lT72W9KnseLhbWA8z3Z+vjNRCJYt4P4QNd9Yr+RE8kK:MOrKbXT72x9bqsUI4P4QNd9Y0E1K
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\Office\OTele\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTeleMediumCost.dat.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	544 Bytes
MD5	26f99f234ea37c45f3b180b27dcfa43c
SHA1	4c07de34a14a1a760f93f6fb139c85695f8d2231
SHA256	69e7db20c0e1ceb61f774d4710a54b5afc360f8a2457baf13804edda38a35cc9
SSDeep	12:ZPL8V64x6pDCdwgWYS6RrgjbI4wkY5T5y/Iln:ZPL8V6tDCdXR2bz2t
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\Office\OTele\{A7D1044D-57E2-45B6-8A93-CD389A77D3AC} (0) - 2256 - winword.exe - OTele.dat.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	208 Bytes
MD5	3e0f57063f1857dc3639b206c06094e1
SHA1	4b6e8d71418e2a24eaeadf3f77e0120efd35a364
SHA256	38e034bd1e41dbde2893d8bd7731dcdf8252eb07e60802e67795b073e69e8378
SSDeep	3:Fm1eMUsRAqP2/KD7A8EcjCeY4secADxOF8INFvTRMczdanoGe+oCDQKLfJI:FmxUOne/YlEMCeYkLDxGVTGCPsMK6
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\AutoPlayLogo.png.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	4.58 KB
MD5	b483e7c174a3c0ebcde76894a225b701
SHA1	4aa7fc19cd763986f39c279d315bcf1f9329fa67
SHA256	9aebea41c5688eac19d9f886645e01d451475c2c5b0c719b479fbd9256837680
SSDeep	96:B27+L9AkKs4TNeW9Uc3OrXLl+gBCpa3VJAAEh086efNx3gzzi4:BxLakKOc6YgIpcVJA6oxQ3R
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\AutoPlayOptIn.gif.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	374.27 KB
MD5	5ea884ba3dc7f2c04bd50aa409d0d50e
SHA1	a906a3f828ffd5c2ceeda075190fbe75db4c5a81
SHA256	cec5ff383bf80823536aa589663f73a8f6b5f9d062e079d8fb49d805e5b447d6
SSDeep	6144:UWbwo1ytcr+BYIQdwcWBaCPTIlL2QwEZp6UcrXpK6h8T2zVMZkFa7o:Ll7r+mvdw9Mn9p98P8hkCo
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\AutoPlayOptIn.png.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	10.02 KB
MD5	eb2fad3b65f2110484f04affe7afa8f3
SHA1	6efd21101f390696618256006edabbbab2186a99
SHA256	c3dbd31ecde4e5c06ad8cf395480c119fad57804b7e2be71c162649f4c0c0730
SSDeep	192:Z9Rk19Sh8k4N8gzRcsjoMgacVDWXKlaYE9lvz2QxYWQv4D3fPz26YnRy:Fkc8ZN8MP4a2De9tPz2+YWP7fPS6YnU
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ScreenshotLogo.png.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	4.59 KB
MD5	3f726d1eabf43f330a51f0a59ae962c2
SHA1	1873dce15641c3ef1c040e4a682140ac71c9ea4f
SHA256	9cfd412f92049ca8365a8ca087c9696f4692094139e80c8b3c9a8072a2b2cecf
SSDeep	96:axBuO/iQrH6MxKwlyHFEgtIW7g15zUMTPeZXbaYhXgLTqWGEp:axBuO/iIaawH6gmWc/zdPepuYhXg3qHa
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\ScreenshotOptIn.png.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	432.03 KB
MD5	d9b24ccb19653894df48f3879cf71a71
SHA1	b0a69ff94e251a7c74486ae83418509103bb11ca
SHA256	bb0e74b204aac65e3a8e93b7ec0b8b2df1803991747024e23d89a8376b5bd434
SSDeep	12288:2WWyeRgf31dQiXWqQgxBCH/8+DWIP4kAIK:Cg/1dQimq3eE+DZPev
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_CB55C2C1F45FED459E403036C0F2F1E7.dat.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	608 Bytes
MD5	86ac34571063a1a94ac4d02d99447815
SHA1	ba0f4c3765a777ff3dfb22d83338a760d858e7d3
SHA256	45d6f81e3d01279dd9734b608e52e55b46f0d914f1ae3ea3ca3cb030dec6154b
SSDeep	12:Lva2AByeBtQ8PQQgi17nFBqyAEmqw9K/odohTZB1ev5:zAtBtQOBb17LFmN9KnZOv5
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\Outlook\RoamCache\Stream_TableViewPreviewPrefs_2_7E96CFF05AA1AB4F91E2DCF307336A81.dat.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	304 Bytes
MD5	7f27820de7bda4ab8d9938c433989b0a
SHA1	b8bc31a5868a1c2230826714a7f417407c62c68b
SHA256	587453be783d791e7a91c479b86d0f6f40c70c939308815c3f5e763718e1ed95
SSDeep	6:h4bH9sayB73MkjSuhxKVzYLBk9nqDu/DPiJiw137kFTdF:uo73ii4MeVq6bP7s7K7
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Microsoft\Outlook\RoamCache\Stream_WorkHours_1_0B01BFE21DA49B4A926A43DB70EDB003.dat.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	656 Bytes
MD5	45a60ec911c0f984ae03eee934cc7775
SHA1	6a5af784eff01dea578b15ccbe11ace359a0535b
SHA256	404f7516e8cb54a92088c58de2e39a2b489ea0fe6c74feb123588be91d2f336b
SSDeep	12:55fAnW+d8IFxiyvJhmaR6z1P4vMWJHocOYypyZ1d+G/sc6FkYSccVoFGpEd25:UWCvDv6z1PQ+7Lpi1d2kYTc2i
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Temp\Iv92.xlsx.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	10.56 KB
MD5	18292ec254eb78c66da60c89b1ac52ba
SHA1	1192cc8643c0a11cae1a4f2afe463d0ef0d8efe4
SHA256	af2b19ee72eb21a60a978372ed2d4c6dc6d915b0bdc1e10c5296ab52b4183396
SSDeep	192:b5z7/7lhf95bGNnrLPEr8fC0TyvMcWJ2LwYBRB/jJk7Ym20GF2Lrhu7mI1tmWwQc:lz7/X+vEr8K7Tb8qP7ugds2bc
ImpHash	-

C:\Users\kEecfMwgj\AppData\Roaming\1bVoxTN-Vw.pptx.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	54.36 KB
MD5	defd8a6c774edad156bd1f677bacd956
SHA1	ccf38149c4f784824e70906e882575fea5359ac0
SHA256	51db55b8a0dd6df1cfee3ba4869b8304ce957eefb54cbe09d8873df4b9236392
SSDeep	768:RR1gpTtTqe/DYnD8NDok/FqRKXHujBbFS8FaxgqVFZ58m/6CGHrMulG0IbIkbHLN:LstTqe/cnwhok1OjBbo5gQFwnCGoP8+
ImpHash	-

C:\Users\kEecfMwgj\AppData\Roaming\TbdxF.png.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	1.22 KB
MD5	a73ea68cef2b7af08b256459a54fec13
SHA1	3964f9db2751f6e95e478ae50ce7906562e89b34
SHA256	605e877c29439e5546c8cd7987a6385fd8dc87652d87234e3e795cd4f3c16668
SSDeep	24:3iBPvIorxr4Qp8aL27UVtTZByDG64z8LzWpV0vVJ1/0g0p8loKglVK:SBPvIsJvK7UnGDv4z8LCGJ1/0g0p8SFI
ImpHash	-

C:\Users\kEecfMwgj\AppData\Roaming\vQlz Kgl0PXWpBvEU8.mp3.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	63.47 KB
MD5	1824624786ac82065ee49fab9d8403c8
SHA1	fea6af299d106ff0f5448132e05022c8611baf0a
SHA256	e81bacae1a9ca5dd35fcb5d091b891401eaa96d622bac460a6dd88a62c4b424d
SSDeep	1536:1l6cFZ12S0+vXeVolAPmDqWUJjw63S8KGzIIF2XI4OfDrlv:1l6cFXrh/eZPmDq3z3S1GMuh1
ImpHash	-

C:\Users\kEecfMwgj\Desktop\JWm7JQqlgRl.mp3.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	93.56 KB
MD5	f1ca5c975c52df161818944484d562c0
SHA1	8bc5b9181974bc3d183586b26e48bef502a2b223
SHA256	7b279d261470353cc1058494518a6b522710dee77dd1fa21a2526d951c76c190
SSDeep	1536:CZdl7+tmEuc39yYUiY/YRtJNqJt64xj942hq7VsX/eAtpVQ2qt/8YnRUXKLxhye6:KdlEmE73QDA5qfjpqC9tpHqt/LU6FhP6
ImpHash	-

C:\Users\kEecfMwgj\Documents\In7fV.pptx.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	44.17 KB
MD5	a44cd573ed9fa24c313832a7b94a3238
SHA1	40a63b4f56c64990cc537c19882b81eea41aff4d
SHA256	440b86785d7f9b052be96984950e0550bf68bd2a6786848edb98c9dc9c471ef0
SSDeep	768:TbtF0H/Hrny03YXYiv3i2YH6V6yrqtMMNweqFVfxaYz095J8XZcc:Tbw/LiY07YaV6yrqia4N8YAZAZF
ImpHash	-

C:\Users\kEecfMwgj\Documents\R8OEYg58.docx.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	76.14 KB
MD5	3e07daa36785a5c666f448bc7ba604ee
SHA1	2a2e2a66c84a5280eec83808c71d502cb0bca41a
SHA256	aed40c025b1295d6d2189f09fc27a2281daa6d033968ebed83539a599b61c7b8
SSDeep	1536:gizfgHoolbB5r/o2RHXiFn+Q8qmYxQcyI5bmdQFJZL3QA:dzfIo8N9hSFn+Q80xby+bmdQF3r
ImpHash	-

C:\Users\kEecfMwgj\Documents\ufvNF4jQ-pQP.doc.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	54.02 KB
MD5	b9dc237a1c6613213ed9123dd61d7b46
SHA1	581000ba8d4ae8e6b6a026ca698f5f58b6f10ff4
SHA256	41a396d85ec8e47489e88a60ad2f64835702b42e24e11afba491989c910713c3
SSDeep	1536:TgywU9NVe42juDDIJSXD/9KY+XIisG7f0xE:dwUzY4FDDlX79K7XIyLUE
ImpHash	-

C:\Users\kEecfMwgj\Documents\Outlook Files\franc@gdllo.de.pst.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	265.03 KB
MD5	1f68cc282519a27ab45f2b076ef57d10
SHA1	19039eb4ee22e7c0b0b15eb0938b915d34adee7d
SHA256	bcf3d5896ad91b340df4cf9c081ef2bcf64aa59297c9bffd1af2c4e29e2a76b7
SSDeep	6144:z3kAyL9/48aqDmYZOaKN6vgH+OXstvZWT6LfsVvuofF8FbwkI9:zUAyp/48MUE6vgH+OXcxWWfevuHbwkW
ImpHash	-

C:\Users\kEecfMwgj\Documents\o_o-1F3TH1sB884\0pjpvs64FNx.docx.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	99.11 KB
MD5	bfa4c1cac33d66aaa9e444137e588836
SHA1	ec4492a0bcb3971e26d4fc22e2f7d119a930127c
SHA256	cb50f4436f8077c09b57d5d2a03b0a456d7c136fe93c343a61ebc6ecd9cdeb5c
SSDeep	3072:hqVuiK/wgjsaWzTlvTuFPV/nhffyc2AgqMp7Hg:CuikUT85ffycTgu
ImpHash	-

C:\Users\kEecfMwgj\Documents\yLKsNetY\MN5H2GzzCWr7.pdf.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	86.09 KB
MD5	277a7e40ab85d53ebdc6054c64d28e78
SHA1	1923ec7bc34d9beb4ce887b110c92602057a558f
SHA256	a5e9bbb108d218552b2ac1278bf1f9669b1ae7171f93b054894be69983df91bd
SSDeep	1536:o12qpOEgGEV6cTj21XbzoVVd69mlIcIKwBOxToLPWIK5Y4QO/goW1CV:o1OEgGEwcHUGNIKwBOxcLuc4d/twe
ImpHash	-

C:\Users\kEecfMwgj\Pictures\1cWy43U6UB1yaWgds5.jpg.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	95.62 KB
MD5	f7d337d9994bcf57ef7f64d5d7022e11
SHA1	4e22b1f28c55700ae7a878c5f8dcffd6554f68f8
SHA256	ebbca5fece58115c34a4f14b3b43f9e297a207d2542612b598aaaf7a62105f1e
SSDeep	1536:sNIlEx4QGL6PKEqvCmEoJXTdnBtAd0eeqVNeKCXeSOfZwwZEm8BgGzUpxSbbhS4I:sNIEcL6P/qvCmESj7tAgqqKMYwK/GzG9
ImpHash	-

C:\Users\kEecfMwgj\Pictures\9NV7HJvRw0QQr0hIwhy.png.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	8.34 KB
MD5	4dfc675a1d897cd180c6c83cebda762b
SHA1	62420ea70fe2fa725ac9ce9cc2df2490d9869c71
SHA256	a007ccfae160b697caee93429c79db44da20d011f6a1df922425c7274d26b405
SSDeep	192:oQRTfc2Bq2MM1pr7Yjml2kZB/sP0RenT+fvQuaW+tGR67:oQRznhpr7Yqk04nTCqt3
ImpHash	-

C:\Users\kEecfMwgj\Pictures\c9kvkj2NGeB.png.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	59.73 KB
MD5	b417c18ee3dc44a054c81268ffab22d5
SHA1	23e3ad12bca9463f49e03264219259cef4bc9052
SHA256	30896086a672404c57d20a6b82dfc9cc9f804908790690904456eb80dfeed94e
SSDeep	1536:Od5GKmTJABy2e0Ei+E2v3uLbCoeo2z2uhNe2pmHhnBa:guTUy2pEi+E8eL2oR2zfhZUHfa
ImpHash	-

C:\Users\kEecfMwgj\Pictures\HKNKtQ.jpg.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	60.02 KB
MD5	104cde10d2623690be9cf21571a786e7
SHA1	000927ae2bc4b7c15a1ba0211c37e03bb374c352
SHA256	1009a69076c6b4727254afd09f74559528a3e19790e34afe4f1277405885e9f4
SSDeep	1536:cWbtCfcsWkDQGz0lzRu2QJFx1Uvq9IvpmqN:cWbILWLa0lzEJ/uSiIqN
ImpHash	-

C:\Users\kEecfMwgj\Pictures\kITMELnl0grVCrYTU.jpg.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	92.70 KB
MD5	65897634b33f8b80bdefd734194cfb57
SHA1	1f38c310089033abaf44155f6989b64ee9b8882a
SHA256	b053593b01e1f0d23853efef78d45378e1d0a63d053ed668620295723b45ab66
SSDeep	1536:yYKDAjMh5v/ayDdciP06fTui1rwXwgu0Ry9Je1sFeQDFU6bFzsTNlA5tbcvHmWnK:yYMh5X/dcwvyksXwgxRyW1bQh5bF4T7U
ImpHash	-

C:\Users\kEecfMwgj\Pictures\rImHN1xh0sKY5.gif.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	61.09 KB
MD5	f0eca4bd865db21374d42c6df6b8e792
SHA1	d7f21993abf3575a41680e8d18621c8719276126
SHA256	0d46bfd231094488a9a291b153a49f58edabd7735a0b9a4a3dc52ca603753724
SSDeep	1536:hguO4+7u188GpRrGZYPsiqcvoFngAyKcaMZhsuz:hgalaxaYXvoFgAynBFz
ImpHash	-

C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	858.81 KB
MD5	715a6e8ad34fc915d8f1f403a39ed0f2
SHA1	1b8d768c86c0ad808881ded28f973666ed7bfd38
SHA256	a9113df7cffcc66fdf4fe55c371ade92b33d027e5998282a07b5d292877aa265
SSDeep	24576:aZZBANE0NNSEnmcvIYMTJgeePOJGeVDKXM:aZZBAfXS0RNMTGtWJGeVDX
ImpHash	-

C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.bitpy

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	826.14 KB
MD5	ea925dce217fdac10f5ae236f4490075
SHA1	fe7ff39f3f454456bea05ec73a19ee1b1e09adac
SHA256	57be857093a09f50754e8a34947641f07693c7d9310358e057a09bcfc7f74972
SSDeep	24576:t/MPvDUc3eVS7LPXJB383R4mtJrdx3piLNA6QRSWD+C:CDF3eVGrD3+RJtzaJA/D+C
ImpHash	-

There are no files for this filter

There are no files in this analysis

Classifications

Threat Names

WHOIS Domain Information

Before

After