28f7aeea...a310

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aoldtz.exe

Sample File

Binary

Malicious

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	299.00 KB
MD5	a6b283c7162458bb736cdb434c7c4eb1
SHA1	f77a01ccc2c6bbe8d73c36cd2dcbd2c2ee84f6e6
SHA256	28f7aeea9a0a1f79f792213f44475e9d5d9304cd0e61e3ecb2b9d38e0271a310
SSDeep	6144:tg0IIc1DvO2y9vbWUs0pujfIVclD1m5IckjTYnQ3Tf0fMeZ:tg0IIcob9uUOlDn/3wf
ImpHash	d5a92fbca027709e52070682f5e9b6f8

File Reputation Information

»

Severity	Blacklisted
First Seen	2019-09-09 16:55 (UTC+2)
Last Seen	2019-09-13 15:19 (UTC+2)
Names	Win32.Trojan.Filecoder
Families	Filecoder
Classification	Trojan

PE Information

»

Image Base	0x400000
Entry Point	0x4110a3
Size Of Code	0x21400
Size Of Initialized Data	0x3f400
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2019-08-30 09:41:10+00:00

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x21374	0x21400	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.67
.rdata	0x423000	0x2561c	0x25800	0x21800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	6.63
.data	0x449000	0x17e20	0x2000	0x47000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	4.01
.rsrc	0x461000	0x1e0	0x200	0x49000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.72
.reloc	0x462000	0x192c	0x1a00	0x49200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.55

Imports (5)

»

KERNEL32.dll (112)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
InitializeSListHead	0x0	0x423040	0x47a44	0x46244	0x2e7
InterlockedPopEntrySList	0x0	0x423044	0x47a48	0x46248	0x2f0
LocalFree	0x0	0x423048	0x47a4c	0x4624c	0x348
GetFileSizeEx	0x0	0x42304c	0x47a50	0x46250	0x1f1
SetEndOfFile	0x0	0x423050	0x47a54	0x46254	0x453
GetLastError	0x0	0x423054	0x47a58	0x46258	0x202
SetFilePointerEx	0x0	0x423058	0x47a5c	0x4625c	0x467
MoveFileExW	0x0	0x42305c	0x47a60	0x46260	0x360
GlobalAlloc	0x0	0x423060	0x47a64	0x46264	0x2b3
GlobalFree	0x0	0x423064	0x47a68	0x46268	0x2ba
FindFirstFileW	0x0	0x423068	0x47a6c	0x4626c	0x139
FindFirstVolumeW	0x0	0x42306c	0x47a70	0x46270	0x13f
GetCommandLineW	0x0	0x423070	0x47a74	0x46274	0x187
FindNextFileW	0x0	0x423074	0x47a78	0x46278	0x145
GetCurrentProcess	0x0	0x423078	0x47a7c	0x4627c	0x1c0
WaitForMultipleObjects	0x0	0x42307c	0x47a80	0x46280	0x4f7
GetEnvironmentVariableW	0x0	0x423080	0x47a84	0x46284	0x1dc
FindClose	0x0	0x423084	0x47a88	0x46288	0x12e
WaitForSingleObject	0x0	0x423088	0x47a8c	0x4628c	0x4f9
GetFileAttributesW	0x0	0x42308c	0x47a90	0x46290	0x1ea
SetFileAttributesW	0x0	0x423090	0x47a94	0x46294	0x461
GetLogicalDriveStringsW	0x0	0x423094	0x47a98	0x46298	0x208
lstrcatW	0x0	0x423098	0x47a9c	0x4629c	0x53f
GetSystemInfo	0x0	0x42309c	0x47aa0	0x462a0	0x273
MapViewOfFile	0x0	0x4230a0	0x47aa4	0x462a4	0x357
SetVolumeMountPointW	0x0	0x4230a4	0x47aa8	0x462a8	0x4ab
FindVolumeClose	0x0	0x4230a8	0x47aac	0x462ac	0x150
CreateProcessW	0x0	0x4230ac	0x47ab0	0x462b0	0xa8
CopyFileW	0x0	0x4230b0	0x47ab4	0x462b4	0x75
GetVolumePathNamesForVolumeNameW	0x0	0x4230b4	0x47ab8	0x462b8	0x2ad
lstrcpyW	0x0	0x4230b8	0x47abc	0x462bc	0x548
FindNextVolumeW	0x0	0x4230bc	0x47ac0	0x462c0	0x14a
lstrcmpiW	0x0	0x4230c0	0x47ac4	0x462c4	0x545
GetDriveTypeW	0x0	0x4230c4	0x47ac8	0x462c8	0x1d3
GetExitCodeProcess	0x0	0x4230c8	0x47acc	0x462cc	0x1df
EnterCriticalSection	0x0	0x4230cc	0x47ad0	0x462d0	0xee
WriteFile	0x0	0x4230d0	0x47ad4	0x462d4	0x525
InitializeCriticalSectionAndSpinCount	0x0	0x4230d4	0x47ad8	0x462d8	0x2e3
LeaveCriticalSection	0x0	0x4230d8	0x47adc	0x462dc	0x339
SetFilePointer	0x0	0x4230dc	0x47ae0	0x462e0	0x466
lstrcatA	0x0	0x4230e0	0x47ae4	0x462e4	0x53e
DeleteCriticalSection	0x0	0x4230e4	0x47ae8	0x462e8	0xd1
lstrcpynA	0x0	0x4230e8	0x47aec	0x462ec	0x54a
GetComputerNameW	0x0	0x4230ec	0x47af0	0x462f0	0x18f
GetSystemTime	0x0	0x4230f0	0x47af4	0x462f4	0x277
WriteConsoleW	0x0	0x4230f4	0x47af8	0x462f8	0x524
DecodePointer	0x0	0x4230f8	0x47afc	0x462fc	0xca
FlushFileBuffers	0x0	0x4230fc	0x47b00	0x46300	0x157
InterlockedPushEntrySList	0x0	0x423100	0x47b04	0x46304	0x2f1
CreateFileMappingW	0x0	0x423104	0x47b08	0x46308	0x8c
CloseHandle	0x0	0x423108	0x47b0c	0x4630c	0x52
InterlockedFlushSList	0x0	0x42310c	0x47b10	0x46310	0x2ee
UnmapViewOfFile	0x0	0x423110	0x47b14	0x46314	0x4d6
CreateFileW	0x0	0x423114	0x47b18	0x46318	0x8f
lstrlenA	0x0	0x423118	0x47b1c	0x4631c	0x54d
lstrcpynW	0x0	0x42311c	0x47b20	0x46320	0x54b
lstrlenW	0x0	0x423120	0x47b24	0x46324	0x54e
ReadFile	0x0	0x423124	0x47b28	0x46328	0x3c0
QueryPerformanceCounter	0x0	0x423128	0x47b2c	0x4632c	0x3a7
CreateThread	0x0	0x42312c	0x47b30	0x46330	0xb5
Sleep	0x0	0x423130	0x47b34	0x46334	0x4b2
VirtualQuery	0x0	0x423134	0x47b38	0x46338	0x4f1
GetConsoleMode	0x0	0x423138	0x47b3c	0x4633c	0x1ac
GetConsoleCP	0x0	0x42313c	0x47b40	0x46340	0x19a
GetProcessHeap	0x0	0x423140	0x47b44	0x46344	0x24a
SetStdHandle	0x0	0x423144	0x47b48	0x46348	0x487
SetEnvironmentVariableA	0x0	0x423148	0x47b4c	0x4634c	0x456
GetCurrentProcessId	0x0	0x42314c	0x47b50	0x46350	0x1c1
GetCurrentThreadId	0x0	0x423150	0x47b54	0x46354	0x1c5
GetSystemTimeAsFileTime	0x0	0x423154	0x47b58	0x46358	0x279
IsDebuggerPresent	0x0	0x423158	0x47b5c	0x4635c	0x300
UnhandledExceptionFilter	0x0	0x42315c	0x47b60	0x46360	0x4d3
SetUnhandledExceptionFilter	0x0	0x423160	0x47b64	0x46364	0x4a5
GetStartupInfoW	0x0	0x423164	0x47b68	0x46368	0x263
IsProcessorFeaturePresent	0x0	0x423168	0x47b6c	0x4636c	0x304
GetModuleHandleW	0x0	0x42316c	0x47b70	0x46370	0x218
TerminateProcess	0x0	0x423170	0x47b74	0x46374	0x4c0
RtlUnwind	0x0	0x423174	0x47b78	0x46378	0x418
SetLastError	0x0	0x423178	0x47b7c	0x4637c	0x473
TlsAlloc	0x0	0x42317c	0x47b80	0x46380	0x4c5
TlsGetValue	0x0	0x423180	0x47b84	0x46384	0x4c7
TlsSetValue	0x0	0x423184	0x47b88	0x46388	0x4c8
TlsFree	0x0	0x423188	0x47b8c	0x4638c	0x4c6
FreeLibrary	0x0	0x42318c	0x47b90	0x46390	0x162
GetProcAddress	0x0	0x423190	0x47b94	0x46394	0x245
LoadLibraryExW	0x0	0x423194	0x47b98	0x46398	0x33e
RaiseException	0x0	0x423198	0x47b9c	0x4639c	0x3b1
GetModuleHandleExW	0x0	0x42319c	0x47ba0	0x463a0	0x217
GetStdHandle	0x0	0x4231a0	0x47ba4	0x463a4	0x264
GetModuleFileNameA	0x0	0x4231a4	0x47ba8	0x463a8	0x213
MultiByteToWideChar	0x0	0x4231a8	0x47bac	0x463ac	0x367
WideCharToMultiByte	0x0	0x4231ac	0x47bb0	0x463b0	0x511
ExitProcess	0x0	0x4231b0	0x47bb4	0x463b4	0x119
GetACP	0x0	0x4231b4	0x47bb8	0x463b8	0x168
HeapAlloc	0x0	0x4231b8	0x47bbc	0x463bc	0x2cb
HeapFree	0x0	0x4231bc	0x47bc0	0x463c0	0x2cf
GetFileType	0x0	0x4231c0	0x47bc4	0x463c4	0x1f3
CompareStringW	0x0	0x4231c4	0x47bc8	0x463c8	0x64
LCMapStringW	0x0	0x4231c8	0x47bcc	0x463cc	0x32d
HeapReAlloc	0x0	0x4231cc	0x47bd0	0x463d0	0x2d2
HeapSize	0x0	0x4231d0	0x47bd4	0x463d4	0x2d4
GetStringTypeW	0x0	0x4231d4	0x47bd8	0x463d8	0x269
CreateProcessA	0x0	0x4231d8	0x47bdc	0x463dc	0xa4
GetFileAttributesExW	0x0	0x4231dc	0x47be0	0x463e0	0x1e7
FindFirstFileExA	0x0	0x4231e0	0x47be4	0x463e4	0x133
FindNextFileA	0x0	0x4231e4	0x47be8	0x463e8	0x143
IsValidCodePage	0x0	0x4231e8	0x47bec	0x463ec	0x30a
GetOEMCP	0x0	0x4231ec	0x47bf0	0x463f0	0x237
GetCPInfo	0x0	0x4231f0	0x47bf4	0x463f4	0x172
GetCommandLineA	0x0	0x4231f4	0x47bf8	0x463f8	0x186
GetEnvironmentStringsW	0x0	0x4231f8	0x47bfc	0x463fc	0x1da
FreeEnvironmentStringsW	0x0	0x4231fc	0x47c00	0x46400	0x161

USER32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
wsprintfW	0x0	0x423224	0x47c28	0x46428	0x333
wsprintfA	0x0	0x423228	0x47c2c	0x4642c	0x332

ADVAPI32.dll (15)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RegCloseKey	0x0	0x423000	0x47a04	0x46204	0x230
RegSetValueExW	0x0	0x423004	0x47a08	0x46208	0x27e
RegCreateKeyW	0x0	0x423008	0x47a0c	0x4620c	0x23c
RegDeleteValueW	0x0	0x42300c	0x47a10	0x46210	0x248
RegOpenKeyW	0x0	0x423010	0x47a14	0x46214	0x264
LookupPrivilegeValueW	0x0	0x423014	0x47a18	0x46218	0x197
AdjustTokenPrivileges	0x0	0x423018	0x47a1c	0x4621c	0x1f
OpenProcessToken	0x0	0x42301c	0x47a20	0x46220	0x1f7
AllocateAndInitializeSid	0x0	0x423020	0x47a24	0x46224	0x20
SetEntriesInAclW	0x0	0x423024	0x47a28	0x46228	0x2a6
SetNamedSecurityInfoW	0x0	0x423028	0x47a2c	0x4622c	0x2b1
FreeSid	0x0	0x42302c	0x47a30	0x46230	0x120
CryptAcquireContextW	0x0	0x423030	0x47a34	0x46234	0xb1
CryptGenRandom	0x0	0x423034	0x47a38	0x46238	0xc1
CryptReleaseContext	0x0	0x423038	0x47a3c	0x4623c	0xcb

SHELL32.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ShellExecuteExW	0x0	0x423214	0x47c18	0x46418	0x121
CommandLineToArgvW	0x0	0x423218	0x47c1c	0x4641c	0x6
SHChangeNotify	0x0	0x42321c	0x47c20	0x46420	0x7f

MPR.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WNetEnumResourceW	0x0	0x423204	0x47c08	0x46408	0x1c
WNetCloseEnum	0x0	0x423208	0x47c0c	0x4640c	0x10
WNetOpenEnumW	0x0	0x42320c	0x47c10	0x46410	0x3d

Memory Dumps (2)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Points	AV	YARA	Actions
aoldtz.exe	1	0x01260000	0x012C3FFF	Relevant Image	-	32-bit	-			... Memory Dump Actions Download Dump Go to process
aoldtz.exe	1	0x01260000	0x012C3FFF	Final Dump	-	32-bit	-			... Memory Dump Actions Download Dump Go to process

Local AV Matches (1)

»

Threat Name	Severity
DeepScan:Generic.Ransom.GlobeImposter.C7080421	Malicious

C:\Users\Default User\Local Settings\IconCache.db.Ares865

Dropped File

Stream

Unknown

»

Also Known As	c:\users\default\appdata\local\iconcache.db.ares865 (Modified File)
Mime Type	application/octet-stream
File Size	758.73 KB
MD5	64aed118775574e67ddb7b78af8668f9
SHA1	22b1d9c6fb9a2ccca11cc4fd9e917c9159dfe634
SHA256	bad033c9c645ca0c7703a4fb149c8bf3d1065e9dd03d22826c719cc245d14268
SSDeep	12288:vwaM0p17AFsRqmAi1JpgpnspVpM+Qoy5CdBrad225vdvYoQ+fQoDcVuTv:AW17Imp1J2peNrad225vFYPuQCNTv

c:\users\default\appdata\local\microsoft\windows media\12.0\wmsdkns.xml.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	10.70 KB
MD5	2be5137a72f4bd862e55d58f13d2c729
SHA1	09f42a516279116741726db61ad19f95930932b8
SHA256	2f7eb7a6332a77757a4d15b7892345e4f89dc1969faccc1540591569195fd38e
SSDeep	192:wiltwrib+DUcKTX13RuKgbKIrRBEWrItfGg18DhsXdMQ1f9zHlMSZ5xa84UF1N5:wq2KZ909KIDEWrIkwosXFfYSZ5B4UD

c:\users\default\appdata\local\microsoft\windows mail\oeold.xml.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.02 KB
MD5	47f8c43a5c4d71846da53e7bf397e68d
SHA1	3dc67886587ce38424f1c2750621e24abc5f0a83
SHA256	be4da77497f5527b02b4dd5aa77913f2b9eee5a1ab937b074d573ad4e2311db1
SSDeep	24:ddQbjh3qk1ifvIEjOeiWKYTx9ohK7GFxXEC6uP4oRkK:dejdFA3IgOeRK494K6FxXN65kd

c:\users\default\appdata\local\microsoft\media player\currentdatabase_372.wmdb.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.02 MB
MD5	92e2f8f36d73f5ea8a7f1a9b1aee0f63
SHA1	c8562437751d5b9ec1ab0dbf6dd9449778f8fd40
SHA256	22f2ffc7081d942cdc2e20bc64c58db028dcbb4cca5a1e1603b0d4d9ab5ecb96
SSDeep	24576:bIIsqXrTWbdX9wt5GLF8k2kOYdZd4n6hWpKCINXCARmdWEgAl0:r41YG6HkO2RhGAH6W40

c:\users\default\appdata\local\microsoft\media player\localmls_3.wmdb.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	68.86 KB
MD5	78108eb9020082632ec7cff3df9719db
SHA1	9552a8903e89185ac668205d9e263583b9ae4782
SHA256	5d805e5e1c40ca6b8da96aecbe92c239d233113221a53bcced6b9c3f2e5a267e
SSDeep	1536:bAVv5adsu83fkN0D0l3f9vu/FT4WjbrsGY+/AZDNEZyE58Wlf2Xq:cXu8vZD0BU/F0SNY+jZyk8WFcq

c:\users\default\appdata\local\microsoft\internet explorer\brndlog.bak.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	12.67 KB
MD5	4c394efef874fa9706f0148b2c0b19f0
SHA1	93db7505b187e09cc7d80275720bb09d3ae94b26
SHA256	407e9a22260b10d944be96477c722c7998f8ddb1c77dd775924700407970094b
SSDeep	384:dATAu7JB7xRvIwX+vHLUjuLG0BpH2R+gllstpnHj8ue4UD:dATxNRvNX6LUNQpHelWNDqf

c:\users\default\ntuser.dat.log.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.75 KB
MD5	a48727f5e3ec1b48b46907996045b742
SHA1	600480a2cd5a7b7b959c03d9351cdcaad93824fb
SHA256	b20907a7d29f627d2e38fe7423b4dc09d7838c34ae6fb86bf812aee9b5aa9854
SSDeep	24:cPL0j5m7tdBBMFqQ5OggSE7e5aJVPtQUpF7WKYTx9ohK7GFxXEC6uP4oRkK:cPoerBBM8Qxg17cA5cK494K6FxXN65kd

c:\users\default\ntuser.dat.log1.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	185.75 KB
MD5	6d1dd64b8bf94c592dc3b7088d6ebb35
SHA1	4288189685cabfb02fdadca4156f4f2bcfd73c82
SHA256	ff5e9f821964d7e4f95524ebf05039b99f1f8f9bc1a50b66371ea226ddb027cc
SSDeep	3072:9hC3Haj4lnGq3365Uwtxn0TxtJ/sUTosXxXbUvNpclERjAE2zZTECGAM:66jGnjK5kf/3T3LoyyRsTZYCGn

c:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	64.75 KB
MD5	0b69cffbd2c37e57a9e0d4034c232227
SHA1	550bc209e5342049bf94bed465f3f2ed774d7c06
SHA256	035925450d1b3c834ef006e48fdc5c97f820f6e26dfa5485338e927f349571f4
SSDeep	1536:rDrXCeEicUMm5HeJPYttimSITicdhJaCryg:rDD7KjLkmIWihgEP

c:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	512.75 KB
MD5	eed0808801f2c5d8fda03e9c4374e728
SHA1	c1ff816ea7e465b155790cebe888f2896b55bdc9
SHA256	6a73e052ecca6c2c134d6c359b352710aa38cd6faab5fde1ad3c67a94c1745ef
SSDeep	12288:Txq9RvCbGnoTEtoAG/T8Okmgc0b5uonP7iWGGKc5aJb5NbdV:tq9Rv2GnyAO8OkFDooPjGGK1b3bdV

c:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	512.75 KB
MD5	adcff09574ca911f3cdbbf4ee54e5806
SHA1	fc5fa8673dce623ac04b593bbd0c87ad0089325f
SHA256	b47bf5c4d8c3532d10cd4a0bf6dfa33075e14efcfe6fba3b37c67e14a4b74df1
SSDeep	12288:ffg7BfJHFtUhuF2uA8f5HJzmsyrOQLFlP:OQ47A8BHJzmLqQfP

c:\users\default\ntuser.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	800 bytes
MD5	c31c7f1198618b66ba1ad0e860c73ab0
SHA1	6cc45c533b23e970ad3896860827a3e529206da7
SHA256	b284a8f40ff4dd7b6b524b74ef6895c56882d6a464d0d949c37a112bb116170e
SSDeep	24:2i3wgxG/y1Jt878WKYTx9ohK7GFxXEC6uP4oRkK:2jg8/8t87vK494K6FxXN65kd

c:\users\default\videos\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.25 KB
MD5	cfae9336bfd4440ba374649e8d034d7e
SHA1	62cc5f8f7bafc7f1d3cc550527c345922043f254
SHA256	3b7ba58ff81768f78710fa2ce626f8ba001585f0116f2587d8d64debfcd10d8b
SSDeep	24:Vx67WaZS3SFWpqWo8w505PoWKVZKMPXZWKYTx9ohK7GFxXEC6uP4oRkK:j67nZS3AQwVoM/EK494K6FxXN65kd

c:\users\default\appdata\roaming\microsoft\windows\start menu\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	944 bytes
MD5	5ab95316c1c9f9c36b41c051cd098c99
SHA1	1ac6a1e24d4cca61541147b7e5d3dc9728931665
SHA256	2f520f0e829b4551b13080b8b3973d8779f7ad550d83c96251f88ed6725cd8c8
SSDeep	24:Ml62GcOIFJvgxjm1s8kHjatWKYTx9ohK7GFxXEC6uP4oRkK:MBP4j2W+QK494K6FxXN65kd

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.22 KB
MD5	b7e2c352f986aeb178ffdcd847bfd0c3
SHA1	aef681b4aaedc9c77ad5c3e60e42237bacbca1ec
SHA256	8a351d21e7e2f3ed57309044c4eff5aa5834207c87b7fb3ccb9bb7f9a38a3fee
SSDeep	24:AKAXFvIIb6NRK4cKstr5QN/6ruUWKYTx9ohK7GFxXEC6uP4oRkK:wdL+zFcKM42CK494K6FxXN65kd

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.14 KB
MD5	68e41a86d371504d5128d69e89dfea7f
SHA1	d1526bc7c517127e60f5d126616654269801bd9a
SHA256	b3675a9b92bf498fb1a031fa01294bc73baddbd3af3f5f15d4109665dd5cdf29
SSDeep	48:+C1sBpi0ELhTLlB/Tznol0BcJK/lCuGK494K6FxXN65kd:d1sBpi0ELd3/TLoDg/ga4WK6F1N8u

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\internet explorer.lnk.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.17 KB
MD5	cb7b4bb8e11fbe35145201916968606d
SHA1	bab6885e404487a0c322fc6e5b6c8d8be897b469
SHA256	4421e4c53f6cf0c047789b394cadca081eb8ddf6a519f651b4d37e1d580b7801
SSDeep	48:KYjKyEkSd463HbXKYTJwLKPrGJkO/qcLKLPKEK494K6FxXN65kd:KfLki3HUKKkFgJ4WK6F1N8u

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	944 bytes
MD5	c3dac03f14b7703285a11f3fbda6da4a
SHA1	a2453da5ad8cafd0f354c011c6df05b861ae3649
SHA256	21019feab6fe49e11e0bb09fc111846fc136efe6508f2671e2c97580add0c618
SSDeep	24:8j0u5wFdnMZ3SCNbd8WKYTx9ohK7GFxXEC6uP4oRkK:tBFhMZSC3vK494K6FxXN65kd

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.06 KB
MD5	97830e50409774f91bf027e175bbdc1c
SHA1	0bf9a6edc4f2b026efb75028c772970ce7e2030e
SHA256	b1b048a58027c985f677ff262f0584b8510af557f4bdd3099da49e84e9cbb09b
SSDeep	24:GnwT+BV6NcE4VjccG3d4ZWKYTx9ohK7GFxXEC6uP4oRkK:ywTIYN8iqEK494K6FxXN65kd

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\help.lnk.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.02 KB
MD5	1cc793d767f117c4134fc1f9d24c38ca
SHA1	f82ed9072e42325c811788043bd6d358e4caff9c
SHA256	2419927da45d97a4288c43da02afa30b0d63f5518bce7660bbf26af7e898e651
SSDeep	24:jWELKUakb4vV087WKYTx9ohK7GFxXEC6uP4oRkK:4dk+iLK494K6FxXN65kd

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\administrative tools\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	944 bytes
MD5	aa9838be84702f49b43aa27ef8aeeaf6
SHA1	7f3ba4bb607c788eeecedca98277c0e0ec8c7725
SHA256	b3c045cd7f888450ad7d00d8e3c1a8f91f4b381da85e8f20448d77b5daebf613
SSDeep	24:hRebNaiWXpCut/7oP6ZWKYTx9ohK7GFxXEC6uP4oRkK:zY8zXJ46EK494K6FxXN65kd

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\command prompt.lnk.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.00 KB
MD5	787bee70ff9a56d58694f65c61744207
SHA1	adb75b7d9ac77d3ed47ad36813e476c800cdf96b
SHA256	0bacd120f107356d49c9c99860f5f371b21af148d935add53dc69898dd6d4309
SSDeep	48:LnJjoRC93dtNtYIe4W++sdVBMK494K6FxXN65kd:LNoAX/JeJ+Vv54WK6F1N8u

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.42 KB
MD5	0fa5b870eb2e22483387be3d58a22d16
SHA1	27efa562d5737baf9e5263fee188155baf789d0d
SHA256	449f5bee564f2399318dec09cf3fdd6bc7601f8a3e237d4d512decb550a02786
SSDeep	24:PbByc1tDxwt34fvJw4DbB1PVfcUE8ogy1Lvj9W/P/FWKYTx9ohK7GFxXEC6uP4oP:Np41kRDbrNfcUEwytvj9OIK494K6FxXH

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\notepad.lnk.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.03 KB
MD5	c2b36bf8ec831a1dec53c0292aa014ba
SHA1	0623a1063843c14b36d5d741bee6298d38342527
SHA256	3c35e6b571e16310a873516e96b92fe4282174693784d9e3eced609b0eb3a21e
SSDeep	48:kunle1zyRyY1sPE7ffY/lmLeACm5RsnxoQyU7nK494K6FxXN65kd:feFIyYiPIY/lmLHL1Qyj4WK6F1N8u

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\run.lnk.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.02 KB
MD5	9a1d58f598ca19498fd5712b956e1714
SHA1	54a5fc85699961598f21188837e572151c86f338
SHA256	3340282c158c902e55d0b031bc996457c1a7150acf6858919246f4e4929556e6
SSDeep	24:/vD5JJAcJVOC2L94wAOHyLpWKYTx9ohK7GFxXEC6uP4oRkK:/LFAmVt2p4qDK494K6FxXN65kd

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\windows explorer.lnk.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.95 KB
MD5	84f98a6734e1c05368fa04862cd24f51
SHA1	57413dbdecd362341ffebdcb09a470442d1010d7
SHA256	786a019e48c99d1a109b9d1165b53c58bc5fda4ef4f40dc47451b5493f9af830
SSDeep	48:kziioy+GI5Z2+9te+TWztETac146K494K6FxXN65kd:8o5Z/7KxKab4WK6F1N8u

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.02 KB
MD5	fc756b54f888bd10e9e0eb6f8e825756
SHA1	a84d650336cfd2695669c867a0202b81cb80a1b3
SHA256	931e0acc474d2abd3f235bc63ef3a20e467fe221fc66bc0946b92d5b0bfa3c7c
SSDeep	24:MEA12ju0vWkMc4TYsElAUoNXU88WKYTx9ohK7GFxXEC6uP4oRkK:i0jFvWkMc49E6XUWK494K6FxXN65kd

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.02 KB
MD5	1ac9d49ce61ec0cdf92d6310708d729f
SHA1	49ab3c87528be09fa01f27a42d03192fe2d81e01
SHA256	52c4f0b979ddb66c5f4b587d2af18c14457d8dfd92d656849463a5ccb57ec17c
SSDeep	24:TPO/gcJJqY4hrRIEpZFtyC0zWKYTx9ohK7GFxXEC6uP4oRkK:DO/sYstRkKK494K6FxXN65kd

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.48 KB
MD5	7466666ddc1f708804c46e970acf7954
SHA1	964a254509ed7683892dd621389e49796fd7812e
SHA256	a48079c6c41f765adfb369605a07f3770386f2dc63a49585728b714afe40db21
SSDeep	24:eXOzwtGM1+TY2+Xq4gSSUMHEEKl8KwJmXMLjeO8Gtvhgq91ODPWKYTx9ohK7GFxX:q2w00+TYU3UMkEKlPwJxLjv/tvuq9183

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.22 KB
MD5	38ce487d9895e72c7bc92d3c77fc3a02
SHA1	a2acc2899e79feaf9a04e3d5619645e75fac94ac
SHA256	d24cdab775fbf429bb1a1ef82a80e759da0020afe52714f360d29194a6eb8f00
SSDeep	48:40iQCCLRnEq9MivcoVpJTMLNEKWg2HjKK494K6FxXN65kd:sRC9n/MiEoVpJgsHn4WK6F1N8u

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.03 KB
MD5	b5da81537345396cd90633c2184e12c2
SHA1	d656df7a396298dd2dc25aa7ace725210e458835
SHA256	a1256188061afe1eb7839e0841fd706c59a090434ea7f65bd8eeb1328b6e9a71
SSDeep	48:O7zDs6mtQejC6RQhFo0xBKHI+n698b42f6TDzfK494K6FxXN65kd:O7zFmTjC6WQ0xUHR6TD24WK6F1N8u

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.44 KB
MD5	35d1b12d75fc79a97f6005c060169e64
SHA1	9e7346f6dd5142ba171bb8227753ec21ec93a4be
SHA256	9ec248bb9c637bad3cbeadd0b2bddc0cbfae168e886d371cfa10ad478b11e00d
SSDeep	24:9BkMrukluFi95U5FXP3P/OjDronGjTx5AhzM3eCWKYTx9ohK7GFxXEC6uP4oRkK:9tiklDU5pP3P/OnrongrAhzM3exK494v

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.08 KB
MD5	7c196994b86f4576d04c08ee717e612f
SHA1	a18be29ecd471b6f6580f3b9dc6a963bdb351721
SHA256	cb406f106e2a627954ba3e0895218f4f1972e20fe98a94a887ad922e8524e44a
SSDeep	48:CizfqMLz1F1k8nIRIDL7EYsAWJbVUALK494K6FxXN65kd:CiTqMv1nk4j7hSjUAe4WK6F1N8u

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.98 KB
MD5	01add5bdb040fca4ef774f9912e3158b
SHA1	a945c1834ab477aead202d9f2f9bf34968894f88
SHA256	d05e432d3ada0ba58f37d3c120ef706bc0935b45f2acf6e7f8517989c0023777
SSDeep	48:M7Gu6MckbC/1vDC2MSqxthX+OYYdGREOs9qK494K6FxXN65kd:MiuPcgC/9DCXx3JYAGuOC4WK6F1N8u

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.98 KB
MD5	70feaf3fb8bfd7f1725c30158ab0dd9e
SHA1	6fe2c0dced1b0e3ed871dfc4b4b06f39abfe29f4
SHA256	99efad92ee1cbdedf134958148110a252c7630c1edb7d41f8e12c23813290923
SSDeep	48:jwwT7Os0YO0f1782mLSpu/3vaczULB/5dfVK494K6FxXN65kd:kcb0Yx1782mLSpuf0Nk4WK6F1N8u

c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.98 KB
MD5	3993402c880932b64e891fdc98fb0f02
SHA1	e47f87b535360fce88cb156823b85f7c1f4570ec
SHA256	b650c958a977be876376989daab0a8803713c9d5c87244970b30f82046f7f19f
SSDeep	48:n2tK980MpHe/RXPCIygK+Rr9vFSWrBxKQI+YK494K6FxXN65kd:sK98PN6RXPSCrjtBsQV4WK6F1N8u

c:\users\default\appdata\roaming\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	784 bytes
MD5	3b4818c5507492460474f181779bc583
SHA1	7a7ae2bdc32176eb5fa2627b4258206009729967
SHA256	b0747303e374a49427fe7122d32e04501ce880c67987873fccfe19b521f43c32
SSDeep	12:YrjSHrJIefzlLTmQA3Il8eVYTx9luQiKVOh2XC4FpJdqAx2DdFxXZKC6dVWP4ocu:YktzoQA4WKYTx9ohK7GFxXEC6uP4oRkK

c:\users\default\appdata\roaming\microsoft\windows\sendto\desktop (create shortcut).desklink.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	784 bytes
MD5	c6ae263731d324e61d97889d58c99394
SHA1	ade447e5b2c2fff71ad6d52c8e2d89947940b7b8
SHA256	cb2f187ddab6d105d7125f49ba132001834448261effa121548d3556b2444882
SSDeep	24:QZojZUUrbpuXpps15ozWKYTx9ohK7GFxXEC6uP4oRkK:QcZUUHAXp65oKK494K6FxXN65kd

c:\users\default\appdata\roaming\microsoft\windows\sendto\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.30 KB
MD5	60df58b6280814c0d4c8069ee91b8e59
SHA1	386d50e608a1e382f2aa02f8b22c16a20836742d
SHA256	862f4d296f57b0a0a0e553fce46b7e2e19732ed8fc433abc69de310508b0bde5
SSDeep	24:fJAa26KV8/qKHPRzsgZREFLgCn3iOuyWKYTx9ohK7GFxXEC6uP4oRkK:fJAmKmqCPREFLHCBK494K6FxXN65kd

c:\users\default\appdata\roaming\microsoft\windows\sendto\fax recipient.lnk.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.97 KB
MD5	9c89ff503f54b1a27c796d0db3ffdd58
SHA1	7e548ff1117366bd81839cea195c8f8830aa219c
SHA256	daa84a580f578aa61ff925900686fc8361ed4e0882aff5a48ff61fba3a5b024a
SSDeep	48:V+ul50+3dzstGCYvFUAvFzK494K6FxXN65kd:V+s0+3EYiA44WK6F1N8u

c:\users\default\appdata\roaming\microsoft\windows\sendto\mail recipient.mapimail.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	784 bytes
MD5	8fa9f01c8afc208f139fe52bdd7d725e
SHA1	03e5d182852ba80f2f2eba74daf7f871c56408b7
SHA256	1618e1e8d02096403d4387b89a02c0102d774ef2507bdc890507623002a8a5ba
SSDeep	24:pGr8pccdzWKYTx9ohK7GFxXEC6uP4oRkK:pGKcc0K494K6FxXN65kd

c:\users\default\searches\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.27 KB
MD5	4583bc1c3d0ce350d8e39ab0a90f7d0c
SHA1	7df24d40667397f4da16981cdf4490daabf9fcc5
SHA256	d9639758c590aca8138b52b3eded0da83abf610f4f950d4edd9605627963dbc0
SSDeep	24:xMfkd4uRSM3KOoLjPepnHUpvd8KiXI67aYWKYTx9ohK7GFxXEC6uP4oRkK:6Mdjz3KOoLzedKdY46GDK494K6FxXN68

c:\users\default\searches\everywhere.search-ms.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.00 KB
MD5	9b51d231357b6707308f6f16ff1db006
SHA1	8cf5004cdf0f0f4ba51cdaca97574a20b6d9ff09
SHA256	58ad0086f2da8ffe851d8e81a37df5709e9bd50e95a21b87e8815a683d819113
SSDeep	24:gAwkuF9m/r9j+jSURzpi4XYCWKYTx9ohK7GFxXEC6uP4oRkK:gA3uApj8RzpiaYxK494K6FxXN65kd

c:\users\default\searches\indexed locations.search-ms.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.00 KB
MD5	6d2c0f587a6d5216150e8abf539b9b29
SHA1	1171ed551ed7d80a8d63e6885fa5e7183c6cdf5d
SHA256	b8f91f55fc7245b34feabf8bebdb40d2b06d7a1c00dcc8da2d7cce396f24932a
SSDeep	24:ebF+HRr+jW713EPjdepR0JD/YdIEpk8WKYTx9ohK7GFxXEC6uP4oRkK:e5S8G3EPjARMD8lOK494K6FxXN65kd

c:\users\default\saved games\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.03 KB
MD5	f9325a9438dd867a66407d008ee5a5c7
SHA1	621c566ec5239e322e95062b365f93ab16187552
SHA256	e9c1634b8bc82d291fe5e723d7aba16d74483a1325344bcabcc5dae38552ca8b
SSDeep	24:6Ni3kTS13b64079WSBwY7EGMUZ8WKYTx9ohK7GFxXEC6uP4oRkK:7kTYr0LfEyK494K6FxXN65kd

c:\users\default\appdata\roaming\microsoft\windows\recent\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.17 KB
MD5	6b43bb032a4cdcb7a569960f532f6646
SHA1	e52fe57027fe72c9fc5f7cad4a64c199dd5471d4
SHA256	4b0bfda936a829dc3ebfdf6c1f2a54443bad1ead2909f291817f826dcf6470c5
SSDeep	24:TRf6pHe0ZANdIx4Ci3FVFn25WKYTx9ohK7GFxXEC6uP4oRkK:Qp7IdrFK494K6FxXN65kd

c:\users\default\appdata\roaming\microsoft\windows\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	800 bytes
MD5	fff6c73044bfd1967273d2a58f39a0bd
SHA1	994048a4cd36230e6c0f3a33d4f4f063dc2f169d
SHA256	f1d359a547f4d7160c5050a42104aacaceb61a95ae40167a56736c0d9f95070e
SSDeep	24:r841UYJuC44t4WKYTx9ohK7GFxXEC6uP4oRkK:r8RYMCD1K494K6FxXN65kd

c:\users\default\appdata\roaming\microsoft\windows\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	15.78 KB
MD5	a1c272a5fb399ccefa311f07f095184a
SHA1	178ddedf82fcf8d63049dce14ae2210cb2af2892
SHA256	c1f835b6f0f5b91ffd23bd4233e77220b19e77b44b2858737cffc75943d90c25
SSDeep	192:0R2oxYwvxKWQGhcMbsAMsvspI+iObUEM0ZgnpylsFRedkt6oZSgBmYTTEGoTri0R:0rYiR/vJGI2Wp64PNENTr9KVUU2l4UD

c:\users\default\appdata\roaming\microsoft\windows\recent\customdestinations\7e4dca80246863e3.customdestinations-ms.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	800 bytes
MD5	db21ba3025d42adc7045145589a9a072
SHA1	5ed1955e846293663076f3d95264f9b6070a51ca
SHA256	c093288d0ae63046e888b88d3a8bc07289640e570ccd172b3edf08ef79ec8946
SSDeep	24:gwfLeMEE1JUN0WKYTx9ohK7GFxXEC6uP4oRkK:VfyMx7UNnK494K6FxXN65kd

c:\users\default\appdata\roaming\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	6.25 KB
MD5	a898eb4c19bae51e0955206d94b146e1
SHA1	e2c5212a991ac5957bd56192a13c04d6e3713838
SHA256	b9ccd0c57616e91aa4b3c4591ceab5d752fc487826f2ccf33d5c19038222a91b
SSDeep	192:XH0HN89aDJCBkIlirnnnjgxbqOJC8pMuoyJBXSYy4UF1N5:XHraDQwjKqv6M4ZSj4UD

c:\users\default\pictures\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.25 KB
MD5	6904b985ababab93e44d1f3dbef40c5d
SHA1	3b1e83b0cae2b49540ff5d5c2b575679df5e64e8
SHA256	32c3bf535831500115288b4a31edfc7221b38344c35ca68085e47285d438c822
SSDeep	24:+4rmMaxn4k2QqEQMFrjGmYjXP9+tsjtRaJZWKYTx9ohK7GFxXEC6uP4oRkK:tdax0QqJ8jwL9+maJEK494K6FxXN65kd

c:\users\default\documents\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.16 KB
MD5	696d020fac6cfc6c270d6811f42c0729
SHA1	8510ca30b8252c0fba335d5c87d1f3b9062db6a1
SHA256	20cfa7ac2f4e3d4c913338fa65d580212c03d6fccc6108a9d7e3ff60f5f85139
SSDeep	24:mxlQShETR6CtxngBTEFs8lR4Hd24WKYTx9ohK7GFxXEC6uP4oRkK:mIxt9gBTEWiI2jK494K6FxXN65kd

c:\users\default\music\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.25 KB
MD5	294a325a929621ea1cd47cad1280acc5
SHA1	9011fa9eba02fbbb489eff19d32fee017286d964
SHA256	f754f0a16f38e83fac5cf6c0f14da0a8c3ad844667506ea9ee445166619fb38d
SSDeep	24:JSnY/oB9nnYxqVD9p/W1+Y5KxWNUxzHAqhdqbWKYTx9ohK7GFxXEC6uP4oRkK:3ofnnY8sKxWNUxzHtqSK494K6FxXN65u

c:\users\default\appdata\local\microsoft\windows\temporary internet files\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	848 bytes
MD5	b4404d4c1897d3e14c7823da8c4d18ac
SHA1	cbbea2c0cb1659695327fe699f3e2aa143a2ba17
SHA256	80c0c08f50b0a9cfc026cc7a570cf308a577b7f65036541fe5ab9bef45170ae7
SSDeep	24:uLB1duk83rLAEWKYTx9ohK7GFxXEC6uP4oRkK:uUPrLAXK494K6FxXN65kd

c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	848 bytes
MD5	9d712801260e9694679bfc911e4488fa
SHA1	7a6e707d9f68224f04fc11c15634b55ae3b689a5
SHA256	436c63e37823c97e12b578781ad3c23def9697c1e6022952cff57572e5d46b10
SSDeep	24:WK6sGyhmqs5wFC3JWKYTx9ohK7GFxXEC6uP4oRkK:/6Whmv8C3UK494K6FxXN65kd

c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	32.75 KB
MD5	6e76a695efeac757bcd6d972d3acb517
SHA1	1e31a128273ee336f019d2c24d1da986f1d76010
SHA256	edca68306f5d8bf1b5fdfc3e1e23f191d743995bd7294bedf0af1a043e4d6899
SSDeep	768:qPWNK+cJzkJ3xIpnlbvoUVp3qUadM/I/hMDsBsZJ7cf:qPWN5cmJBentvoA9qEs6DsqZtk

c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\desktop.ini.ares865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	848 bytes
MD5	d5879eca24ff5f44ccff1a6636e2d436
SHA1	0fc032bb85d8e70bf21d00c9551fe7e100a4ba5c
SHA256	0a12fe5495315b0a02464a69ec5e1d2f6d3995b411c0499d59a9f345f8b7a971
SSDeep	24:b2aUFh70aLQnev4uWCNWKYTx9ohK7GFxXEC6uP4oRkK:bZ4PKu4unwK494K6FxXN65kd

C:\BOOTSECT.BAK.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	8.75 KB
MD5	e34187f96b5d4f65b0c5f589fca4f02d
SHA1	c4472ac50b977d60fb3c7e8834c2a50cc4a29169
SHA256	260b5792855f4da4246b72b61002329e5154623583326a2a838d970678642d1c
SSDeep	192:Za85b4/ZuksPXz7ImjBl7kbFhUPW3zwYoDdv+4UF1N5:Zx5iZrMXvImH7kbEQTMG4UD

C:\Users\desktop.ini.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	944 bytes
MD5	fddd462cef750819e559a51e2fe3fbfe
SHA1	f510feafe346eb3c4920478a77aafd1fb8f1e830
SHA256	f5415814194d5598832220ec1b8653bac26e4e3d6aaa57d24ac9d6dea678387d
SSDeep	24:CQsCevBqsCw1Of13gEzPYyWKYTx9ohK7GFxXEC6uP4oRkK:7sddM3JzABK494K6FxXN65kd

C:\Users\Public\desktop.ini.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	944 bytes
MD5	4c00c512498e6f7a6580e3059a11b0cb
SHA1	754fe6e63a9ccfadf03710e4ff366774305331b6
SHA256	6355ff93b88ec5a12c7e1642b5b84a6ab2dc9b0a9f985b25109886b875252207
SSDeep	24:qrzfe0Me8rwyZ7ca/GND5MuKsZWKYTx9ohK7GFxXEC6uP4oRkK:OEeuwsHa5EK494K6FxXN65kd

C:\Users\Public\Videos\desktop.ini.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.12 KB
MD5	2f85248f2e7e3353e513bc3455f4f717
SHA1	1bf96d2ee4b5519b3237b6935ed1b4575087cd58
SHA256	a8f2b5c680f607ab80725399906379e10a091ed5413805c004e7bbfa757cc05a
SSDeep	24:nkoiZlnBeFbk68cJqR98WKYTx9ohK7GFxXEC6uP4oRkK:k7/BShJqPvK494K6FxXN65kd

C:\Users\Public\Videos\Sample Videos\desktop.ini.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.08 KB
MD5	0c802880634e195c13b6208673ac40cc
SHA1	8c9c03c2c6e8e82cabe78b1b44259eb53c672105
SHA256	3b9316fae2acbd724c221ec708a7920a6e9dd04541eeb121a3c60bfc76f05b16
SSDeep	24:8VJT4daZeOmR+MttNphyQXTXe5r4WKYTx9ohK7GFxXEC6uP4oRkK:E4dcegyNOQjXU3K494K6FxXN65kd

C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	25.03 MB
MD5	4aa27946d526dd948294e602df30bfa0
SHA1	d341afc7fa6af61620739041c6d1ca59edb55f13
SHA256	385b37f5eceb5aced79de2c09bfb5f24302e13521e2668b9667cdcf95bc6ed79
SSDeep	196608:UlElEKi0w+IBD3kjtHXo+5/9xM+Z2i0SOIeFlfZ8lPQGvwGj5Yza:OElET0w+ywjf/zMw0SZeFZwPQGj

C:\Users\Public\Recorded TV\desktop.ini.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	848 bytes
MD5	a60398004ccaf091078f2af734e2d9f9
SHA1	4d4b1fbf292856b2f0f4a0c9a0ebe98ec67322be
SHA256	70a5f34708e0990732359d0b38c3a4be4ef004daa91317a145895e7d2b568dcd
SSDeep	24:/bwlEvvC57amOC/WKYTx9ohK7GFxXEC6uP4oRkK:WAC0tCOK494K6FxXN65kd

C:\Users\Public\Recorded TV\Sample Media\desktop.ini.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	944 bytes
MD5	8cb12b4d796997c5293e5fa58545cc4d
SHA1	0854195e9b830e5e6200a6c1f6d7614fb53a4bab
SHA256	92ed8f671f78116452943392ea83bb4906ad6ca2b788fc982485b9e2982f0dee
SSDeep	24:hlo8xuz0zr/f+OSTa0WKYTx9ohK7GFxXEC6uP4oRkK:DoCHf+OSunK494K6FxXN65kd

C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	9.25 MB
MD5	e582c19b2a6013197edbf46cbe595d77
SHA1	3e6211e978f3c06ecbc0108ef9c630f3a274b0ef
SHA256	e2c1559ee816be66f54daeac9f340d9934f070cd1f29c239e970511471952a29
SSDeep	196608:EIWzwrkIeQ3qzsmmQ7tbq6jZCzZTlkcEEnluDbBHsz8LDa6HojGEo2ijSsp8gNr:EIWzAWiqZmQ7djSgIluug/a3uS6

C:\Users\Public\Pictures\desktop.ini.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.12 KB
MD5	59ff39eb40e472bab23d5a4b7abfb5da
SHA1	98af7dc2040ced3d6400dcc61c40b88ab5e01ba7
SHA256	50d76ac5894211cbd1159b7055f0d06912c5472c67b096b4dc1175981aea8daa
SSDeep	24:C3xUz3owbhfRyYReypdgRWKYTx9ohK7GFxXEC6uP4oRkK:C3Q4wblRypqK494K6FxXN65kd

C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	859.55 KB
MD5	4012245000d28b28f6862b8b187684d2
SHA1	2053ad3d98d490ce7d694395eb68e55e3a1c012a
SHA256	11589e15a7f7d43e1406046cd1f515eed6aa54cebfc99524786dd17b187142fe
SSDeep	24576:9g4TYaT70thzyfIqKUznM5Ngxs8QKFeM0E2F:9/U00thGgqxznMY6Xg90Z

C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	826.88 KB
MD5	997638082132333e33995b3003d0a921
SHA1	5eabe63c1e9ad41495f164cd10f994dabc7d5c6d
SHA256	e75498393e7e97c3783eeef7b1943670c01a98252e7233363756e9eb1a08c808
SSDeep	24576:iL9rwOOI3j7WgZd/BvMOawnfC4YU5zSnE:SdwOB3j7W6ZownK4YUZD

C:\Users\Public\Pictures\Sample Pictures\desktop.ini.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.84 KB
MD5	9dc09583eca0cc82e5f389784bc8bc2a
SHA1	e652c141de6f5a9e6024a0c0b7e06c95ad6ba66b
SHA256	fc581a5578f6754bdc5f23df08d7007f540e18045cfe304b492999688de20cd2
SSDeep	48:R+Q7l2OmLdKz88DwQzERdOq3K5bIwEQo1lK494K6FxXN65kd:R5lNVzoQzEjOGYtKU4WK6F1N8u

C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	582.09 KB
MD5	42688cc3cee0611368701af133102f96
SHA1	61c21caba219fef147f8463bbb45e3bb4a2444b4
SHA256	b40279e49e46fdf2986c6a9039cb3f40e086608e3ed20d2bdbdda8d4b4e566bd
SSDeep	12288:KADMhXYRWzDnhSopNHXYCfPSQryQVC8xpeYWgeG7orV/qkkB:nDOXDzP731y3QVC8xpeYWjG7+//u

C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	758.28 KB
MD5	4ce5e96c6125ca2f8da531c1540371a1
SHA1	bf6341e0835527f1c7eb3bd92a71e94d57d82051
SHA256	09972ea1619bba2e5ed66937ead4448d98c07f047e25a3f10860e4e798e2a978
SSDeep	12288:LJjBrCkXaIesfO9mneiUHAi4hWguROOZ7D02A/fNwG21VwPonXSeWhhTy+3D:NBGkXaIxkmnrniNOOZ7DRA/VgbwP+Wf9

C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	763.28 KB
MD5	ac87b409742f9df3686288a5646071e0
SHA1	ea8926795abe568af96bc41c5656b2e37bc11c7f
SHA256	0d1a528f927cb875bc6e2ee1759a2694ef2d0976b1ded43f3b59f45766af6d4f
SSDeep	12288:aHgENLK8+fMOmrG5nenSfd5cCtoPMLhkMuRk/VYgb7Q11hbqHxGlVibiiKEUO7:aHgEJK86R3XcCtoPM1kkNLQ1DmRGlgbx

C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	548.88 KB
MD5	3b8dbfa3565c6c352826fce1453f2e89
SHA1	4232e699fd738037f772028235baa70231b8dcec
SHA256	bc564de38cab54bb0e8d8d416fa3386e5f46cac8963d976b2c356e75773e1380
SSDeep	12288:RrYzP2MUaYWW8o3X6PmIhcYZ3hZLouqIWEypW+WWjNlf3hyk8BJ7:YlWw+I6YN/o3IWE7+WSf3hyPh

C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	760.36 KB
MD5	7f4c16508ff5bd0f513658bc16bb3fb5
SHA1	3afd33ce4979b4bc8751a51bbd5bac15f44aae1b
SHA256	82979783380767c0dca9caf166af104655cd03ffc6b49323dd1e8d05d2eb058b
SSDeep	12288:RMNyMQKH2H4GLphgCy+z4oiylRQkpFR2tvLq42SbtIwg/ZFLZsw5qAI0M8qb+dbP:RwyM1H2H4Ophgx+zL9z2zbtg/PLN5FIk

C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	607.09 KB
MD5	c537731da3a27f765d6dedd6bf6cb977
SHA1	f754f81f013182d54b5182983326b4d58d960a65
SHA256	74a1ce03eb7e3931c9d2354542f79d121bf136c38d3dfee9ce94ae7df8da2678
SSDeep	12288:bp1P5XQHchRVhzT6/9RcnN2LoEpevtAM59oKTFR7DsVldtLgYpxL0:bz99x6/DcN2LovrboKTjsVloAe

C:\Users\Public\Music\desktop.ini.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.12 KB
MD5	28b513305c58a85fd836cfbeb8a807f9
SHA1	9ec4e2c1a2fcf424aec1b822c1fc674c2697dcc4
SHA256	1066d1135b123fdc4ee3b76b6aa4bce38a32e83ce94df3bcf630b7f83850f4ba
SSDeep	24:5YJQGAtJ3fcS6ae9Y+e8sZWKYTx9ohK7GFxXEC6uP4oRkK:5OQGlSTIDe8sEK494K6FxXN65kd

C:\Users\Public\Music\Sample Music\desktop.ini.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.33 KB
MD5	86cc7e68a7fdd1c3b273e9f506be99c6
SHA1	2c3f1a0db4d3a5f4acdcedd1f2155ef49239fb79
SHA256	c642e8400251fe1b8af3f2ec595ef262cdb9d6cace69f7c57ce27d90d8d24078
SSDeep	24:HFaEhDo+J2Cg+Pmo1Go65uAuO3Z1PWKYTx9ohK7GFxXEC6uP4oRkK:EEU+cCgLoMoQuO6K494K6FxXN65kd

C:\Users\Public\Music\Sample Music\Kalimba.mp3.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	8.03 MB
MD5	df136c2b50d8026a90117def67cae96a
SHA1	b91d59c96a95ccd8e018784cc1d4be2927f9347b
SHA256	e2fec1e81f35b592ddf8dc57db9adda77d42a67a1a20d517e2c85315dd32fc4b
SSDeep	196608:8uLtoMZQMhI5/6ue4Y24qE46IV2qpOosFHGqzcakaYBR6H:1ovDNY2HE302qpOHGq4hpRk

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ids.txt

Dropped File

Text

Unknown

»

Mime Type	text/plain
File Size	11.93 KB
MD5	0564e0bcd47d6dc2c2ba1ae9fabae07c
SHA1	642542a82eabeca880c6b9bef6a70746d8c26c15
SHA256	421bbc1c237bb3408596843be41910988788459cc8d97bab6dfda9827613654f
SSDeep	96:MNzPKXpYXS2Q5qzq59qz9q599qz99q5999qz999q59999qz9999q599999qz9990:mLKO4jNr

C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	3.92 MB
MD5	208bd127c8b3ae4f2dd6f5747fd5a7d7
SHA1	f1e895662152d76fe8d5d98a3270134dcc1931b4
SHA256	3605fbf6fece6f53f1519a6f61d433b8342750a0b3aea38030e6cb4a21164348
SSDeep	98304:ZolxC/b7ReFajGH7sQWqmxTadMKBrDKIlnmD:ZolxE3SajGH70rxgruxD

C:\Program Files (x86)\Java\jre7\lib\zi\America\St_Thomas.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	848 bytes
MD5	daf9fd387b98fd809464d57e69fbce9b
SHA1	85ae9c6ecbb5da41ca8455fd642c7d299c1a7123
SHA256	030457338854042c301cc29dce8575d2d350d517a24724fd31da1f1bf007c64a
SSDeep	24:MmboI7+c0MkJA+PVdWKYTx9ohK7GFxXEC6uP4oRkK:Ec0lJA+PCK494K6FxXN65kd

C:\Users\Public\Libraries\desktop.ini.Ares865

Dropped File

Unknown

»

Mime Type	application/gzip
File Size	864 bytes
MD5	1991d3a6a61ca797481810e5cdf2e3a9
SHA1	8a091ee41852a14bda774ddd81a4ab0f4031b060
SHA256	db3c9d1719469a3dca5ddcb94f7ccfdb2f557927a1a580f18da2e900b37157fa
SSDeep	24:5U/dykLGaSBqDMEWKYTx9ohK7GFxXEC6uP4oRkK:KvLGaMK494K6FxXN65kd

C:\Users\Public\Libraries\RecordedTV.library-ms.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.61 KB
MD5	f84c90f8fd90e6a825ef01302379defd
SHA1	5b68e3310c762af75404b900d9e5be796f290e68
SHA256	51a73e82a1b5c01cbda5babdc62fc1997b9e8c886d033c19a7a9e52bdf4ee617
SSDeep	48:Xb5lhaDVtg5whHNS4Mj0TiWK494K6FxXN65kd:dgjJxMjX4WK6F1N8u

C:\Program Files (x86)\Java\jre7\lib\management\jmxremote.password.template.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	3.55 KB
MD5	34cb59ff083a7a34fd426b16bf0bac38
SHA1	1b10ae54ef8a6f2c00a6f0e02d9075199b02343d
SHA256	fcc355424277a9f23dc5e61aad51ab80393c14da319870005c643e5f74fdcae2
SSDeep	96:+Sax1jtaMjDqQKL+OuClOKSWC4WK6F1N8u:DtQDXQOr4UF1N5

C:\Program Files (x86)\Java\jre7\lib\management\snmp.acl.template.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	4.05 KB
MD5	3c7085bdb254bd441bc0a6f516c2acb3
SHA1	f70f8705368af4a343749829cb647850277371de
SHA256	08ca4ada6d621d6f12f93d35c0d80cff9ac6746f961f5a83364e8b35ec1c18d5
SSDeep	96:atgA7gNyu8e97cyjyQR60cVxruzEsmOhpG4WK6F1N8u:abUh8TyjLExiE+hpG4UF1N5

C:\Program Files (x86)\Java\jre7\lib\deploy\ffjcext.zip.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	18.95 KB
MD5	2672ba37bfcec4dbd5f6b5b93ad53e8e
SHA1	b1518c9ada1f669dbdb66910a8403de2b6fc2e34
SHA256	47e1f66f0a79298dbe9662ac377fa6b6fce613a226576fe33202c74777e50d42
SSDeep	384:13TdyOW4PeMlpQQjTkUxuJT1K2F/M4yAKkwkElX04Mjp1Ev4UD:VTdyh4FlpQ8T7I1xMnhb+wf

C:\Users\Public\Downloads\desktop.ini.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	944 bytes
MD5	5f9b576af5b8721b849d20c0e7bf4d98
SHA1	44043e6c3c1e61926a7fa53943c4d49d42ff8361
SHA256	b0c8cb567d55c7c0c24fd11a066d59e7ee06ba0fa7bcd969881127e025483f8a
SSDeep	24:hAt3lm2z/X1gGEWKYTx9ohK7GFxXEC6uP4oRkK:aRllDlK494K6FxXN65kd

C:\Program Files (x86)\Google\Chrome\Application\chrome.VisualElementsManifest.xml.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.16 KB
MD5	6ff7ef3f25b6096eedacd4bbf7bf0053
SHA1	e57326a08be1db9f4a88fedd7246743349cab8c4
SHA256	954b4a1eea604e7a9953b71fd0d09e00a0360f453100e7de9274f886f4fd76fa
SSDeep	24:D+VteTKG8AxiBJm3DmhUFVhqJGWKYTx9ohK7GFxXEC6uP4oRkK:D+VoTKGPxifmzmhUFOtK494K6FxXN65u

C:\Users\Public\Documents\desktop.ini.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.03 KB
MD5	7d136eea20b8b7895c12adc8b6877150
SHA1	bd9168728965318960c0dc20c084809edad96446
SHA256	fdb1e5748260e2545ee303660612ae477085cfff593f0f4d8297247a4ae23139
SSDeep	24:zG+LNAElIrVG+JGV/9mTTQ4C1cWKYTx9ohK7GFxXEC6uP4oRkK:jRAElIrVvG/9mPQ4gPK494K6FxXN65kd

C:\Program Files (x86)\Common Files\Java\Java Update\task.xml.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.14 KB
MD5	343d9818ebdaf918bb59724c77905a28
SHA1	83436a8a1e9e5c998b3170c41fa69325fa4ae168
SHA256	c7cc5c9236373980cf077b949a65e558b7b5a8822ba61af8fecc386933e366cb
SSDeep	48:SuO/k+h8bpPeR+tQ9JwsTc7SQ1RNveFhm8K494K6FxXN65kd:SGJbpptqw8Gv14WK6F1N8u

C:\Program Files (x86)\Common Files\Java\Java Update\task64.xml.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.14 KB
MD5	a00b8c16d90d96cd7d4dc0d9440d60be
SHA1	f828a959a1debf49a2c9ecaa0e18b5f378122dc7
SHA256	7f824c894608e363360fb352e85af281c471e78253249dd7014b30f8323b2328
SSDeep	48:T8oAWZZ3kM3+sJbKfEEEpGInakFoVGOCdw4Mum03+bK494K6FxXN65kd:Tlzg4+sKDVyagWKdwam03+O4WK6F1N8u

C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.CAT.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	305.75 KB
MD5	7d7338de92b5d6259809a00d0b473aef
SHA1	968b6bb4bd1411eb08ba6c3029f904d85d03c87e
SHA256	f2499d2b46bedcde8feae60a9d54c2019fb14341ffa13260f564c8258effb0c3
SSDeep	6144:jAk/hSfEGXgBZi/RpOeO/yk7bnP+u5kson2tteyySZvwykin+s:jAk/hSfEGQBZi/yeeyk7bnXkso2LeyNd

C:\Users\Public\Desktop\Adobe Reader X.lnk.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.73 KB
MD5	3d83e2d322da1c011e42eb986a843c94
SHA1	ff2d5dec0f421203d3a75e6d1003eb32d806a5c7
SHA256	e356b9a8676a075b83efc4dfa900abddb364c2e264af33dd668b5d20765a8766
SSDeep	48:5ExpB4+DEtV+tW4FlpeuY3jYoPklvmbSg92TdaFSpbiAK494K6FxXN65kd:5GVDEb+tW6lpe93so8l0QcSpbI4WK6FB

C:\Users\Public\Desktop\desktop.ini.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	944 bytes
MD5	b9ac6a265022a81c62977c70e448408f
SHA1	037c2f6a2b6db660807d8fad4971429a8cc7393e
SHA256	7e3f63019d82f5df000e0da8685f1ae9c606d91f70a56209f2592bcbdeb78d1d
SSDeep	24:UPRmezzhVTYTbnoZPWKYTx9ohK7GFxXEC6uP4oRkK:iRPz7YTccK494K6FxXN65kd

C:\Users\Public\Desktop\Google Chrome.lnk.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.97 KB
MD5	8a0ebfb9e7be7b4d119b4f82dfcce4ab
SHA1	43a2594415f101eb3cd3a6d342eb0f8676498043
SHA256	dcbae98e73733503bcef7c5472386731aaf97e08ee7c033815d11a51c7b10644
SSDeep	48:HKyQ5jCI1Z59xvOdTa7cgqm5KzDEWi+9+rSK5aPDeAnq0eh8jsEMfcQhK494K6FB:qjCI1Z5jvqOcgYzDEWwuc6aAGssETz48

C:\Users\Public\Desktop\Mozilla Firefox.lnk.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.89 KB
MD5	65b0d48d1d322206b61c8d0afaa4dbe7
SHA1	da58ff117ec953f740f1fc3e37c271421d3ccc2b
SHA256	9938c70d21bd560985cd9871ddc16d97b75ce65d3ba8d51c65169966b580a8ce
SSDeep	48:lFwapemU2mos5DZlGWO5X8D7uJiiJ1AlgKK494K6FxXN65kd:ledmU2s5tlG+nupJ1wg4WK6F1N8u

C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.CAT.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	294.75 KB
MD5	5c6e0b66b0ce3fd16aeaaddf67b57d50
SHA1	5a0bfa9794d747351aa18c7a6a7fbe292187969d
SHA256	23b3dada76518d3319b28eb576b9754681f1f06a7bfcee37be200deaa639482d
SSDeep	6144:Hc5nm7HgPRK5wDJCXmaQpi9qwYEYCTUKzwcCjwsUoBy5LWMKlR:H37HERK52MN9qwLY+zwmsUoBGLcn

C:\Program Files (x86)\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\ICU\ctl_gb18030.cnv.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	223.81 KB
MD5	7c6a38724250000929dc3b871540d8c3
SHA1	4c9539e239da21ee787a16142edf977c31de7622
SHA256	676b04738fa966f8c343ef778e5320674104536c2afe1f06e7609eb6a9d111de
SSDeep	6144:Fl/3B1ZRYhudXUeAn1Xs2rygyHIAmoTOx/NeGyNcOIC0:Fl/pRYhIzAnxJygyoAn1uVC0

C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\Providers\Proximity\11.00\araphon.env.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	15.98 KB
MD5	787c998b83814dd60c3bb5c0601f956f
SHA1	c1229779f6b4ecf461cea0982227399f80718455
SHA256	1d2d858e83911031980efe24e2a0c2fdf679c591c86537a85e42435c1a2920e2
SSDeep	384:Ropt8oDlgkl60odyKjPk4BiJfecoUR5OPdCMwUFEFEvB4UD:RopjqV0osKj84cwfE5OP1TBf

C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\Providers\Proximity\11.00\bulphon.env.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	5.80 KB
MD5	476f6d9ba5b07e668231b0823233e22f
SHA1	436bded75983416498c6ead088a6165bc366cd30
SHA256	00e51dc390c3dde5cc3c63857cc335659aca50c4f6d2c82270addecb2a4e5d8c
SSDeep	96:Jmua47Qm1aKzowEZQJG4zP4+Ux1lhXT2u+9z8G+DoVsgxiVWC0hzauhh87L4WK6D:Jf3aKE1SxzPolZYz8GDVs4Sn0h2mS4UD

C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\Providers\Proximity\11.00\danphon.env.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	3.50 KB
MD5	aec6672194574fb2b21d52f336c16508
SHA1	fc9fbc1e61fa672a7a7a603bf5a793ae8353efc2
SHA256	19393908842cb548f24ad41050c22afae5e24be89f47a1060ca135a83d36544f
SSDeep	96:SXKN1ZHvB2TEREYOyj9OH/jJ5OI7bBl0glXiqm4WK6F1N8u:VPBZlREYOyjofekbBl0glXxm4UF1N5

C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	3.17 KB
MD5	97351c6d90f372e125be91220b837810
SHA1	f2aa0621d3193022bb31deaed1063dcc5807a3ca
SHA256	23cd1125d4d086b2c2418a6db7014cf994a9b95f3030123be28dd62ea9c24d2c
SSDeep	96:s6aZdBh3cC5WGOsShi7O7QFt/IW4WK6F1N8u:38dBh3cBsSWwQXIW4UF1N5

C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\Providers\Proximity\11.00\estphon.env.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	4.80 KB
MD5	d005d9e9ba7a34bb1c454da55cfb3431
SHA1	12d7dcd7127ecad8bdec6024cb1c8c90b0624f23
SHA256	b02ef7c6c312f05544a22e61b4f152f1eb123dc3747d0e41798453f5680fb9c1
SSDeep	96:TgRVcT/9DJsOV7Um8J/fqmPkD28yUbq6m8JNt1NEfN7vb/IsR4WK6F1N8u:1/rumuHqekD28ymFR12fNX/IO4UF1N5

C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\Providers\Proximity\11.00\finphon.env.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	4.08 KB
MD5	29af280f22658ea653368b0c7baff0fb
SHA1	ba0d613b88003ba15011e8e182d458bf17b6e9ba
SHA256	60cf394d27bcddc23d6e070a33b26e625714338522a41c5a03761f1eb19b47ae
SSDeep	96:6Vs/IsPUZIr5FhuYQWJO8bJA04+kLUA4WK6F1N8u:p/tYO5/EzALSLUA4UF1N5

C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\Providers\Proximity\11.00\hrvphon.env.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	8.55 KB
MD5	81f5f79dd3f7f1d85a69b3d7a3e4738a
SHA1	94106e01d1366465017046c44c86abc1c4e16978
SHA256	80a12ca6362500a8c2ce7d1a4f6a8a3d60a363dfc8cac28781fad344533c97a8
SSDeep	192:RcscnCEa/g/Rxcmn1oSzEwymvpYkxE0SZmnE4RDo4UF1N5:RyOgAUoS5WN7cEso4UD

C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\Providers\Proximity\11.00\lavphon.env.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.73 KB
MD5	c506fad668ec70e98d2d9d09578f1eeb
SHA1	c4a277d983e9b60c5cf32172d86d15a7065d0c2a
SHA256	10a67477f14d70032ed8ae0e02da150149e4885376be37d9508bc472f8ef73c2
SSDeep	48:e9uPnQEpY2J/omtGpuj3rI5IpjuQaKH1cZHTeCon8gmNpK494K6FxXN65kd:CenQEiw7+uTrICQKVcZzeXnvmN44WK6D

C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\Providers\Proximity\11.00\litphon.env.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	3.34 KB
MD5	af83424b1b8b56877d7d135d955c9c63
SHA1	506591de8a8a0f81b5339e88b96c42501d0ffd4e
SHA256	ae352bee1611642359a80a2c45c11e6e27b9aef8d59fc4fdf1030275195423a2
SSDeep	96:wLfSAk6m1kfo7u6QynX6vLdGa4WK6F1N8u:+fjWCfo7udEXSLdz4UF1N5

C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\Providers\Proximity\11.00\rumphon.env.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	9.88 KB
MD5	b407fd6705797c077f9901b0d1c34289
SHA1	3720e641b11a5e9ddb7a6b393b251788b7904f81
SHA256	dc0ee7b44d1ef01f9ac40df4f6f081c84971072804222c467ef66a598e490601
SSDeep	192:xUlmVDiJefwpRGq8uzzmZMdZusFtmim4hqx3Xoh74UF1N5:qlgDiJef2RN801dZFtmim4K3Xo74UD

C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\Providers\Proximity\11.00\slvphon.env.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	4.91 KB
MD5	8b66a46fd9ae0f822731c0aac51cd663
SHA1	4d657d28020603512d3b7b2d66d8c69a3f548416
SHA256	67f746a78b0c73ea53dba56b597ce1697102022c069714523463a13291c4084f
SSDeep	96:w8dxAsmGfpojSga4hyui++cjvJn3PFZOaJk6a0O5c25wA2kXuh4WK6F1N8u:wyxAsTjAyuj+0F/F3i6BOJwAzuh4UF1H

C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP\Flash.CAT.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	3.25 KB
MD5	d156878d6ee8ebaddc37a93afc8ba6aa
SHA1	fef6b56e59b5f2b7a65457557d3cd08a9cbc73b9
SHA256	75c8cf2def71e06ffea518b1fb3986c04f6a0defc08ce5db2904b5ba662404ff
SSDeep	96:aGrYulJsKZlWVhVJeq9qCf/FvMZWN5oE4WK6F1N8u:aGBl6oAhVvl/FvMZWN5/4UF1N5

C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP\Mcimpp.CAT.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	8.75 KB
MD5	b7e9b8ad18cdab641a1a77e293d48f39
SHA1	22de7fedaeb7fc1c6b79c7f244663e5026471a18
SHA256	46fb3a146cc7288858dbfe880f1db51b8b36a7020ab81d35a3ab6ccb006284f9
SSDeep	192:fKdbYsul52t2KAjpVfM8MFwuKM56hJjHirKMXthwR312q5r4UF1N5:fmb0I2KAz9MFh5sjUXthMc6r4UD

C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP\QuickTime.CAT.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	3.25 KB
MD5	d2b9c9ad452de53fb48a24504e1e6c58
SHA1	5cf3c7284309957daaad344a4fd71d2e805412cf
SHA256	97b1868badce728b1274799937ed38a9bd0193a7917f00bab262dd774188c247
SSDeep	48:8VQYieYwhEIR3owpmbgjHp32x0fhKtAW2vI48KZXXoEYWd9fRn6yBieK494K6FxX:17kYwbB5fq6UKZXXjl6sif4WK6F1N8u

C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP\WindowsMedia.CAT.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	3.25 KB
MD5	dd61f2c42b64be06e94e55e64ff8b128
SHA1	e65f07d26b9432345f56ce6a442f2a8a6d829c4e
SHA256	8220651aa3522d14fea0f94657644ca1a2f85ead72927b103968b65086bf1a18
SSDeep	96:MXxpZ2tuFTbAqi8uytQzbG5rfN7DMk+pkfXUbR4WK6F1N8u:s3Af8bQODMk+pkfiR4UF1N5

C:\Users\Public\Music\Sample Music\HOW TO BACK YOUR FILES.exe

Dropped File

Binary

Unknown

»

Also Known As	C:\Users\Public\Music\Sample Music\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\lib\zi\America\North_Dakota\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\hu_HU\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\de_DE\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\videos\how to back your files.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\startup\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Setup Files\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\Mappings\win\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows\history\low\how to back your files.exe (Dropped File) C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\Extensions\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VGX\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\lib\zi\America\Argentina\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\System\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\cs_CZ\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VBA\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Resource\TypeSupport\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\SVE\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\nb_NO\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\fi_FI\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\eu_ES\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\es_ES\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\WidevineCdm\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Font\PFM\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\da_DK\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\hr_HR\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\ITA\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\RUS\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\sv_SE\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\ro_RO\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\nb_NO\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\da_DK\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\System\ado\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\zh_CN\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\bin\plugin2\HOW TO BACK YOUR FILES.exe (Dropped File) C:\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Libraries\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows mail\stationery\how to back your files.exe (Dropped File) c:\users\default\appdata\local\microsoft\feeds\how to back your files.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VSTO\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\how to back your files.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ja_JP\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\de_DE\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\zh_TW\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP_UKR\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\System\msadc\en-US\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows mail\backup\new\how to back your files.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Stationery\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Java\Java Update\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\SPPlugins\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\lib\management\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\rijuql1c\how to back your files.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\AcroForm\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\sv_SE\Services\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows\temporary internet files\virtualized\how to back your files.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows\temporary internet files\low\how to back your files.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\hr_HR\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Resource\SaslPrep\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\sl_SI\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP_POL\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\media player\sync playlists\how to back your files.exe (Dropped File) C:\Users\Public\Recorded TV\Sample Media\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\ENU\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VC\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\JPN\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Downloads\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Triedit\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\CHT\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows\history\how to back your files.exe (Dropped File) C:\Program Files (x86)\Google\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\lib\zi\Africa\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\administrative tools\how to back your files.exe (Dropped File) C:\Users\Public\Documents\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\lib\applet\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\Locales\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\how to back your files.exe (Dropped File) C:\Program Files (x86)\Internet Explorer\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\System\Ole DB\en-US\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\ink\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\da_DK\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\lib\deploy\jqs\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\ro_RO\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\recent\customdestinations\how to back your files.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\TextConv\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\Providers\Proximity\11.00\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\FRA\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins3d\prc\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\pt_BR\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP_TUR\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\searches\how to back your files.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\TUR\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\sl_SI\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\fr_FR\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\bin\dtplugin\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP_SKY\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\media player\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\ko_KR\Services\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\saved games\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\zh_TW\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\mm5o9xqs\how to back your files.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows sidebar\how to back your files.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Videos\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Help\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\uk_UA\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\de_DE\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP_SLV\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\System\ado\en-US\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\Acrobat\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Google\Chrome\Application\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\zh_TW\Services\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\network shortcuts\how to back your files.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\fr_FR\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP_RUM\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\hu_HU\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\eu_ES\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\sendto\how to back your files.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\recent\how to back your files.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\it_IT\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\fi_FI\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\CAT\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\feeds cache\how to back your files.exe (Dropped File) C:\Program Files (x86)\Java\jre7\lib\jfr\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Pictures\Sample Pictures\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\LanguageNames2\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\media player\sync playlists\en-us\00010c6e\how to back your files.exe (Dropped File) C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\WidevineCdm\_platform_specific\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\nb_NO\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\feeds cache\6asvn7j7\how to back your files.exe (Dropped File) C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\Installer\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Favorites\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\System\msadc\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\internet explorer\how to back your files.exe (Dropped File) c:\users\default\appdata\local\microsoft\media player\sync playlists\en-us\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\Mappings\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\HUN\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\RUM\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Resource\CIDFont\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\DAN\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\ESP\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP_RUS\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\recent\automaticdestinations\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\Mappings\Mac\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\how to back your files.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\how to back your files.exe (Dropped File) C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\WidevineCdm\_platform_specific\win_x64\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\HRV\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\System\en-US\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\ja_JP\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Videos\Sample Videos\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\NLD\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\sl_SI\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Videos\desktop.ini.Ares865 (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Recorded TV\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\lib\images\cursors\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\documents\how to back your files.exe (Dropped File) C:\Program Files (x86)\Java\jre7\lib\ext\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\it_IT\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\KOR\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\pmmr5k9k\how to back your files.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\pt_BR\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\nl_NL\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Portal\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Setup Files\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\pictures\how to back your files.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\nl_NL\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\DAO\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Java\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\lib\i386\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\zh_CN\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\es_ES\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\PTB\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\ko_KR\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP_HUN\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows\history\history.ie5\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\sv_SE\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\es_ES\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\tr_TR\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\CZE\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\pl_PL\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\bin\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ro_RO\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Font\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\lib\zi\America\Indiana\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VC\amd64\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\EUQ\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\System\Ole DB\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\sk_SK\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\feeds cache\1nbur4hr\how to back your files.exe (Dropped File) C:\Program Files (x86)\Google\CrashReports\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\ja_JP\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Internet Explorer\en-US\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Resource\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\cs_CZ\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP_HRV\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\credentials\how to back your files.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\start menu\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\zh_CN\Services\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows sidebar\gadgets\how to back your files.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows media\how to back your files.exe (Dropped File) c:\users\default\appdata\local\microsoft\feeds\microsoft feeds~\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\Providers\Proximity\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Tracker\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\SKY\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\Mappings\Adobe\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\hu_HU\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Internet Explorer\SIGNUP\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Music\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\pl_PL\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows mail\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\POL\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\tr_TR\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\nl_NL\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\hr_HR\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\lib\deploy\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows\temporary internet files\how to back your files.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ca_ES\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\default_apps\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\Providers\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\sk_SK\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\uk_UA\Services\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\templates\how to back your files.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VSTA\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\pl_PL\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\CHS\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\uk_UA\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\DEU\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\UKR\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows mail\backup\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\pt_BR\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Google\Chrome\Application\SetupMetrics\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins3d\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\lib\cmm\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\eu_ES\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\cs_CZ\Services\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\music\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\NOR\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\fr_FR\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\feeds cache\kqmhsvkd\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\ru_RU\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\lib\zi\America\Kentucky\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\lib\images\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ru_RU\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP_CZE\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\SLV\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\sk_SK\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\fi_FI\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\printer shortcuts\how to back your files.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\ICU\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Pictures\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\lib\security\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\it_IT\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Google\Chrome\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\ru_RU\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows media\12.0\how to back your files.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\ca_ES\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\SUO\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\lib\fonts\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\how to back your files.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Java\jre7\bin\client\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ko_KR\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\VisualElements\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Desktop\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\Adobe\ARM\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\feeds cache\d68g7bij\how to back your files.exe (Dropped File) C:\Program Files (x86)\Common Files\SpeechEngines\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\tr_TR\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\AcroForm\PMP\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\how to back your files.exe (Dropped File)
Mime Type	application/vnd.microsoft.portable-executable
File Size	119.00 KB
MD5	f5e8d7b5b56f355e592726b817997445
SHA1	ba6bdf142fc01a58fe14d6c276eeeba341bc0871
SHA256	908fd06baaf76bb60f40412a5e3682f068ccecea0af2e090efa381e0a63ba8ed
SSDeep	3072:Kmnc/ksDE9qVm5IcZ6m3zeRGjXC55lQ0YnCRL7L:FclD1m5IckjnYnQ3
ImpHash	567270df66f047a5516f09b57de89287

PE Information

»

Image Base	0x400000
Entry Point	0x401af4
Size Of Code	0xfe00
Size Of Initialized Data	0xe400
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2019-08-27 15:03:08+00:00

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0xfc2b	0xfe00	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.62
.rdata	0x411000	0xbcd2	0xbe00	0x10200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	6.79
.data	0x41d000	0x1290	0xa00	0x1c000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	2.17
.rsrc	0x41f000	0x1e0	0x200	0x1ca00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.71
.reloc	0x420000	0xf94	0x1000	0x1cc00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.45

Imports (4)

»

KERNEL32.dll (67)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
lstrlenW	0x0	0x411000	0x1c540	0x1b740	0x54e
lstrlenA	0x0	0x411004	0x1c544	0x1b744	0x54d
CreateFileW	0x0	0x411008	0x1c548	0x1b748	0x8f
CloseHandle	0x0	0x41100c	0x1c54c	0x1b74c	0x52
InitializeSListHead	0x0	0x411010	0x1c550	0x1b750	0x2e7
GlobalAlloc	0x0	0x411014	0x1c554	0x1b754	0x2b3
GlobalFree	0x0	0x411018	0x1c558	0x1b758	0x2ba
DecodePointer	0x0	0x41101c	0x1c55c	0x1b75c	0xca
FlushFileBuffers	0x0	0x411020	0x1c560	0x1b760	0x157
SetFilePointerEx	0x0	0x411024	0x1c564	0x1b764	0x467
GetConsoleMode	0x0	0x411028	0x1c568	0x1b768	0x1ac
GetConsoleCP	0x0	0x41102c	0x1c56c	0x1b76c	0x19a
GetProcessHeap	0x0	0x411030	0x1c570	0x1b770	0x24a
SetStdHandle	0x0	0x411034	0x1c574	0x1b774	0x487
LCMapStringW	0x0	0x411038	0x1c578	0x1b778	0x32d
FreeEnvironmentStringsW	0x0	0x41103c	0x1c57c	0x1b77c	0x161
GetEnvironmentStringsW	0x0	0x411040	0x1c580	0x1b780	0x1da
GetCommandLineW	0x0	0x411044	0x1c584	0x1b784	0x187
GetCommandLineA	0x0	0x411048	0x1c588	0x1b788	0x186
GetCPInfo	0x0	0x41104c	0x1c58c	0x1b78c	0x172
GetOEMCP	0x0	0x411050	0x1c590	0x1b790	0x237
IsValidCodePage	0x0	0x411054	0x1c594	0x1b794	0x30a
UnhandledExceptionFilter	0x0	0x411058	0x1c598	0x1b798	0x4d3
SetUnhandledExceptionFilter	0x0	0x41105c	0x1c59c	0x1b79c	0x4a5
GetCurrentProcess	0x0	0x411060	0x1c5a0	0x1b7a0	0x1c0
TerminateProcess	0x0	0x411064	0x1c5a4	0x1b7a4	0x4c0
IsProcessorFeaturePresent	0x0	0x411068	0x1c5a8	0x1b7a8	0x304
QueryPerformanceCounter	0x0	0x41106c	0x1c5ac	0x1b7ac	0x3a7
GetCurrentProcessId	0x0	0x411070	0x1c5b0	0x1b7b0	0x1c1
GetCurrentThreadId	0x0	0x411074	0x1c5b4	0x1b7b4	0x1c5
GetSystemTimeAsFileTime	0x0	0x411078	0x1c5b8	0x1b7b8	0x279
IsDebuggerPresent	0x0	0x41107c	0x1c5bc	0x1b7bc	0x300
GetStartupInfoW	0x0	0x411080	0x1c5c0	0x1b7c0	0x263
GetModuleHandleW	0x0	0x411084	0x1c5c4	0x1b7c4	0x218
RtlUnwind	0x0	0x411088	0x1c5c8	0x1b7c8	0x418
GetLastError	0x0	0x41108c	0x1c5cc	0x1b7cc	0x202
SetLastError	0x0	0x411090	0x1c5d0	0x1b7d0	0x473
EnterCriticalSection	0x0	0x411094	0x1c5d4	0x1b7d4	0xee
LeaveCriticalSection	0x0	0x411098	0x1c5d8	0x1b7d8	0x339
DeleteCriticalSection	0x0	0x41109c	0x1c5dc	0x1b7dc	0xd1
InitializeCriticalSectionAndSpinCount	0x0	0x4110a0	0x1c5e0	0x1b7e0	0x2e3
TlsAlloc	0x0	0x4110a4	0x1c5e4	0x1b7e4	0x4c5
TlsGetValue	0x0	0x4110a8	0x1c5e8	0x1b7e8	0x4c7
TlsSetValue	0x0	0x4110ac	0x1c5ec	0x1b7ec	0x4c8
TlsFree	0x0	0x4110b0	0x1c5f0	0x1b7f0	0x4c6
FreeLibrary	0x0	0x4110b4	0x1c5f4	0x1b7f4	0x162
GetProcAddress	0x0	0x4110b8	0x1c5f8	0x1b7f8	0x245
LoadLibraryExW	0x0	0x4110bc	0x1c5fc	0x1b7fc	0x33e
RaiseException	0x0	0x4110c0	0x1c600	0x1b800	0x3b1
GetStdHandle	0x0	0x4110c4	0x1c604	0x1b804	0x264
WriteFile	0x0	0x4110c8	0x1c608	0x1b808	0x525
GetModuleFileNameA	0x0	0x4110cc	0x1c60c	0x1b80c	0x213
MultiByteToWideChar	0x0	0x4110d0	0x1c610	0x1b810	0x367
WideCharToMultiByte	0x0	0x4110d4	0x1c614	0x1b814	0x511
ExitProcess	0x0	0x4110d8	0x1c618	0x1b818	0x119
GetModuleHandleExW	0x0	0x4110dc	0x1c61c	0x1b81c	0x217
GetACP	0x0	0x4110e0	0x1c620	0x1b820	0x168
HeapFree	0x0	0x4110e4	0x1c624	0x1b824	0x2cf
HeapAlloc	0x0	0x4110e8	0x1c628	0x1b828	0x2cb
HeapReAlloc	0x0	0x4110ec	0x1c62c	0x1b82c	0x2d2
HeapSize	0x0	0x4110f0	0x1c630	0x1b830	0x2d4
GetFileType	0x0	0x4110f4	0x1c634	0x1b834	0x1f3
GetStringTypeW	0x0	0x4110f8	0x1c638	0x1b838	0x269
FindClose	0x0	0x4110fc	0x1c63c	0x1b83c	0x12e
FindFirstFileExA	0x0	0x411100	0x1c640	0x1b840	0x133
FindNextFileA	0x0	0x411104	0x1c644	0x1b844	0x143
WriteConsoleW	0x0	0x411108	0x1c648	0x1b848	0x524

USER32.dll (13)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RegisterClassExW	0x0	0x41112c	0x1c66c	0x1b86c	0x24d
UpdateWindow	0x0	0x411130	0x1c670	0x1b870	0x311
PostQuitMessage	0x0	0x411134	0x1c674	0x1b874	0x237
GetClientRect	0x0	0x411138	0x1c678	0x1b878	0x114
GetWindowLongW	0x0	0x41113c	0x1c67c	0x1b87c	0x196
SetWindowLongW	0x0	0x411140	0x1c680	0x1b880	0x2c4
DefWindowProcW	0x0	0x411144	0x1c684	0x1b884	0x9c
CreateWindowExW	0x0	0x411148	0x1c688	0x1b888	0x6e
GetSystemMetrics	0x0	0x41114c	0x1c68c	0x1b88c	0x17e
GetMessageW	0x0	0x411150	0x1c690	0x1b890	0x15d
ShowWindow	0x0	0x411154	0x1c694	0x1b894	0x2df
DispatchMessageW	0x0	0x411158	0x1c698	0x1b898	0xaf
TranslateMessage	0x0	0x41115c	0x1c69c	0x1b89c	0x2fc

ole32.dll (4)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
OleUninitialize	0x0	0x411164	0x1c6a4	0x1b8a4	0x149
OleSetContainedObject	0x0	0x411168	0x1c6a8	0x1b8a8	0x146
OleCreate	0x0	0x41116c	0x1c6ac	0x1b8ac	0x119
OleInitialize	0x0	0x411170	0x1c6b0	0x1b8b0	0x132

OLEAUT32.dll (6)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SysAllocString	0x2	0x411110	0x1c650	0x1b850	-
SafeArrayCreate	0xf	0x411114	0x1c654	0x1b854	-
SafeArrayAccessData	0x17	0x411118	0x1c658	0x1b858	-
VariantClear	0x9	0x41111c	0x1c65c	0x1b85c	-
VariantInit	0x8	0x411120	0x1c660	0x1b860	-
SafeArrayDestroy	0x10	0x411124	0x1c664	0x1b864	-

C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\ca_ES\accessibility.CAT.Ares865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	44.75 KB
MD5	c0c69b91a41cd45934e19caa121777a5
SHA1	b50dc1c83991739b33a0a9ad7ccb23d0e6205683
SHA256	7a84e69b75d4810c478aec3ee4881504624ca5afa486a2c55200d4ec405c7bf1
SSDeep	768:Bq7qLpjoG9i9lLXCaSBUAtLfUM1GqXTMHbhbtEvRgVggS8Efr7IikBUfmC058f:Bq7qLFoR9lLnShbhhXT4dxEvRg+g/KIS

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After