6396ea2e...a9df

C:\Users\FD1HVy\Desktop\CC.exe

Sample File

Binary

Malicious

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	715.84 KB
MD5	00b2679e73e28343fd153df9858bc910
SHA1	f27390cdca4afea0ffeda89f117931858e7f5a7f
SHA256	6396ea2ef48aa3d3a61fb2e1ca50ac3711c376ec2b67dbaf64eeba49f5dfa9df
SSDeep	12288:XvLinIalWM4xgXO04gQMqFSimn7ASylgpOTouNs:DclW1QO0+MqFDQASylgpOrs
ImpHash	80ccc470b5c03f358ac4b90d1cffe605

PE Information

»

Image Base	0x400000
Entry Point	0x4909f0
Size Of Code	0x90600
Size Of Initialized Data	0x21000
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2002-02-07 17:40:55+00:00

Version Information (1)

»

CompanyName

ftware a.s.

Sections (4)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x90510	0x90600	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	7.5
.rdata	0x492000	0x1dd59	0x1de00	0x90a00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	0.01
.data	0x4b0000	0xf2c	0x1000	0xae800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	2.87
.rsrc	0x4b1000	0x2194	0x2200	0xaf800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	1.45

Imports (4)

»

KERNEL32.dll (4)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
VirtualAlloc	0x0	0x4b0d5c	0xb0d1c	0xaf51c	0x454
GetModuleHandleA	0x0	0x4b0d60	0xb0d20	0xaf520	0x1f6
ExitProcess	0x0	0x4b0d64	0xb0d24	0xaf524	0x104
SetErrorMode	0x0	0x4b0d68	0xb0d28	0xaf528	0x3d2

USER32.dll (5)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
LoadCursorFromFileW	0x0	0x4b0d70	0xb0d30	0xaf530	0x1d4
GetCaretBlinkTime	0x0	0x4b0d74	0xb0d34	0xaf534	0x102
GetThreadDesktop	0x0	0x4b0d78	0xb0d38	0xaf538	0x173
IsIconic	0x0	0x4b0d7c	0xb0d3c	0xaf53c	0x1bd
GetCapture	0x0	0x4b0d80	0xb0d40	0xaf540	0x101

GDI32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetLayout	0x0	0x4b0d88	0xb0d48	0xaf548	0x1d4

ADVAPI32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RegOpenKeyExA	0x0	0x4b0d90	0xb0d50	0xaf550	0x25a
RegQueryValueExA	0x0	0x4b0d94	0xb0d54	0xaf554	0x267

Digital Signatures (1)

»

Certificate: WATUMQAQGBVDTECTGC

»

Issued by	WATUMQAQGBVDTECTGC
Country Name	-
Valid From	2020-03-07 07:27:29+00:00
Valid Until	2039-12-31 23:59:59+00:00
Algorithm	sha1_rsa
Serial Number	C8 D2 D5 C9 C0 0B 3E AB 43 94 FE 15 62 22 A4 49
Thumbprint	42 79 3B 1C C7 0B 9A 3A 54 63 47 53 7E 95 B7 FB 4D 5F 1F 6E

Memory Dumps (5)

»

Name	Process ID	Start VA	End VA	Dump Reason	Bitness	Entry Point	Actions
cc.exe	1	0x00400000	0x004B3FFF	Relevant Image	32-bit	0x0048FC40	... Memory Dump Actions Go to Process Go to AV Match Download Dump
buffer	1	0x005D0000	0x00651FFF	First Execution	32-bit	0x00650FC0	... Memory Dump Actions Go to Process Download Dump
cc.exe	1	0x00400000	0x004B3FFF	Content Changed	32-bit	0x00401220	... Memory Dump Actions Go to Process Go to AV Match Download Dump
buffer	1	0x00780000	0x00800FFF	Image In Buffer	32-bit	-	... Memory Dump Actions Go to Process Download Dump
cc.exe	1	0x00400000	0x004B3FFF	Process Termination	32-bit	-	... Memory Dump Actions Go to Process Go to AV Match Download Dump

C:\program files\common files\microsoft shared\ink\es-es\!!FAQ for Decryption!!.txt

Dropped File

Text

Blacklisted

»

Also Known As	C:\program files\common files\microsoft shared\ink\fr-fr\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1046\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\sk-sk\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\system\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\oskclearui\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\java\jre1.8.0_144\bin\server\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1044\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\ko-kr\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\en-gb\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1031\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\2052\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\client\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\graphics\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\system\ole db\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\designer\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\nb-no\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\office16\office setup controller\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1049\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\system\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\internet explorer\images\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1043\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1042\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1040\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\insert\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\ar-sa\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\vsto\10.0\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1033\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1025\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\2070\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\lt-lt\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\es-mx\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\java\jre1.8.0_144\bin\plugin2\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\it-it\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\main\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\zh-tw\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1028\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\hu-hu\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\nl-nl\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\hr-hr\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\system\msadc\!!FAQ for Decryption!!.txt (Dropped File) C:\logs\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\th-th\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\java\jre1.8.0_144\bin\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\system\ole db\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\vsto\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1035\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\3076\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\pt-br\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1038\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\ru-ru\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1030\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\sr-latn-rs\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1036\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\system\msadc\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\sl-si\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\lv-lv\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\stationery\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\vc\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\system\ado\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\msinfo\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1029\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\ja-jp\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\java\jre1.8.0_144\bin\dtplugin\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\system\ado\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\uk-ua\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\ro-ro\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\internet explorer\en-us\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1032\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fi-fi\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\cs-cz\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\et-ee\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\bg-bg\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1037\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\he-il\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\office16\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\clicktorun\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fr-ca\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\msinfo\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1045\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1053\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\3082\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\languagemodel\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\tr-tr\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\services\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\pt-pt\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\el-gr\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\vgx\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\internet explorer\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\da-dk\!!FAQ for Decryption!!.txt (Dropped File) C:\$getcurrent\safeos\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\sv-se\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1041\!!FAQ for Decryption!!.txt (Dropped File) C:\$getcurrent\logs\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\zh-cn\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\1055\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\source engine\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\vsto\10.0\1033\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\de-de\!!FAQ for Decryption!!.txt (Dropped File) C:\588bce7c90097ed212\extended\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\common files\microsoft shared\ink\pl-pl\!!FAQ for Decryption!!.txt (Dropped File) C:\program files\internet explorer\signup\!!FAQ for Decryption!!.txt (Dropped File)
Mime Type	text/plain
File Size	344 Bytes
MD5	37faf663f846ed1b6a05dc55747e3bf1
SHA1	536b13cbd8b87ccb9c6648dbe4699d887bcf869c
SHA256	7eabe203dd78a24c44fbe3ee17d4afd90493e43be68aa3c66495ed9bdf7587b7
SSDeep	6:8q7GxCSfmYXYF3WAFkNX46FilovWVZCFckUCyEB9guLmVMcKHke1HrND4RydpN9:KzeYI4G6FrW66v3VMcze1mipN9
ImpHash	-

File Reputation Information

»

Severity	Blacklisted
Names	Mal/Generic-S

C:\$getcurrent\logs\downlevel_2017_09_07_02_02_39_766.log

Modified File

Unknown

»

Also Known As	C:\$getcurrent\logs\downlevel_2017_09_07_02_02_39_766.log.cuba (Dropped File)
Mime Type	-
File Size	42.67 KB
MD5	d7d8a59b574dd6b19a30b5e34a698a39
SHA1	77feb6c2e88e5705d6a705187b6f29fc9e7bfb9e
SHA256	ffac0dcaa512522fba252609497cd19a00fa7040267552342f784db7f5e97e33
SSDeep	768:KcCOs+dKMikUEVdzs0bkabZ6Tcu4EyLFxneGpE6mkOhCOgTS4T0Tuvy5j5:k+dgrUdFDZ6TL4/rnedPhg+AKh5j5
ImpHash	-

C:\$getcurrent\logs\oobe_2017_09_07_03_08_57_737.log

Modified File

Unknown

»

Also Known As	C:\$getcurrent\logs\oobe_2017_09_07_03_08_57_737.log.cuba (Dropped File)
Mime Type	-
File Size	6.86 KB
MD5	35b95163b2391e75ac31b184ce6bc32b
SHA1	51faf70d1f15aafb221c36e7cc03466dc79ee014
SHA256	e776a56609d28c0de99f78561bbf026aeaaee65315b52bb15802563f26bd3b01
SSDeep	96:7OiQ0gvIBU5xWvjgXe3SLFP42H4jcqxYdb62hvSOTsiCqb/8QXP4BV:tQyBUx4kXkiV4nY46v1iFU+V
ImpHash	-

C:\$getcurrent\logs\partnersetupcompleteresult.log.cuba

Dropped File

Unknown

»

Also Known As	C:\$getcurrent\logs\partnersetupcompleteresult.log (Modified File)
Mime Type	-
File Size	1.04 KB
MD5	b5bcb687e078bd83ef81d72243b2e335
SHA1	81f8cc4b3f3448367498ebdccb50fa1735a7014a
SHA256	25381a5c52466a4d0efb04945d0a7961eec049a6d4725d31c39734dcf7c05c72
SSDeep	12:7lhHj2CVLu5kCw+Xl5qX6VTekDMSc5AzVowXStcK7Tp:7lhHKCVL+kGvqX8CN1AewXSOgN
ImpHash	-

C:\$getcurrent\safeos\getcurrentrollback.ini.cuba

Dropped File

Unknown

»

Also Known As	C:\$getcurrent\safeos\getcurrentrollback.ini (Modified File)
Mime Type	-
File Size	1.15 KB
MD5	3f2c1e98b5e63ae0401a6cd6b57c8942
SHA1	68c86a2a8ee34a5627bfef0e80546db0f8a0394a
SHA256	33a1df6f359db5e42e59b19617a3fb2c8f3ed8b5f0b3d659f847e21189ff0b24
SSDeep	12:7l84dt7L+sQXcFJ88SbpyZQDgW+z9zgUKYR0DaRgWwUMnywu36MlEHYEQ386Afaq:7l8432sZ/6DO95dbiGKyw8iwoj
ImpHash	-

C:\$getcurrent\safeos\setupcomplete.cmd

Modified File

Unknown

»

Also Known As	C:\$getcurrent\safeos\setupcomplete.cmd.cuba (Dropped File)
Mime Type	-
File Size	1.30 KB
MD5	5f859f3d8f667ca3036efe1ebce252e4
SHA1	7751958f006bba3fc7d978ed2ced49bcfa48fd24
SHA256	b1c6103f94841b9ba4ebfd961c8b135ea979e7882569e2ed7a85a43d3bed9c58
SSDeep	24:7ltF1++EX0dhW81tHWmL61yrz/FtzaMlxvU5bTQAq8A+:7lnQMdhWC1WmL4yrxvEbTzv
ImpHash	-

C:\588bce7c90097ed212\1025\eula.rtf

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1025\eula.rtf.cuba (Dropped File)
Mime Type	-
File Size	8.39 KB
MD5	d9a1fbd5b0a1825893e030ce6dd11b8b
SHA1	2d4d25cb16a9077bef6872c0248c9da417f6a2d7
SHA256	30528ba0e74ed0c415db663b9b06ee14cdd0fccc9a070fd6018b6f55daa4d7ca
SSDeep	192:hvCcp47TzwW5579PynwQHOF5cSpiIUFbvQlKA:Npq7TzwA57By3ubfblKA
ImpHash	-

C:\588bce7c90097ed212\1025\localizeddata.xml

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1025\localizeddata.xml.cuba (Dropped File)
Mime Type	-
File Size	73.47 KB
MD5	3b18dcf216582ee5d1a33e7a04eaa950
SHA1	06283fba29da362738ba9bb0a5444aea4e8ca80c
SHA256	9651a28ebfbff7ea765247f32c0db5ffc7bf224819edd87d981b8435234a0244
SSDeep	1536:AirKlHxP3U6zkV7tzSnaY2t6fkxIf394gX7jRAIiYrUpiGvwF:In8+GtykxIfNtrjRpiFa
ImpHash	-

C:\588bce7c90097ed212\1028\eula.rtf.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1028\eula.rtf (Modified File)
Mime Type	-
File Size	7.16 KB
MD5	b8268d8d8093cc87cd92d1156757ed38
SHA1	69742bcf98d63867f5b1f75c40f021c46224d8cd
SHA256	1da789080a50fe9bb9645b8b1c0502a9e726d573be2f21c3e77753dd0e14eb92
SSDeep	192:5BMgjiRqieZhSG9p8PSaytSKmYyMqquhkzs07DuF:5JiRcBqdYyMqJ1jF
ImpHash	-

C:\588bce7c90097ed212\1028\localizeddata.xml.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1028\localizeddata.xml (Modified File)
Mime Type	-
File Size	60.39 KB
MD5	8b550de3e58515f317bb5c2de7d444ed
SHA1	86e5cb1081148af96598def2d16de2b27cc4313a
SHA256	0f65df0d9564ed7aed7af562a03b22faa8ccb44a87609eb7664af14418dc4bbb
SSDeep	1536:cNQ2tnWPnxaEpVqULUX21PUh+0k1urNUEV:cDWPwEoktsrNUi
ImpHash	-

C:\588bce7c90097ed212\1029\eula.rtf

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1029\eula.rtf.cuba (Dropped File)
Mime Type	-
File Size	4.64 KB
MD5	5aabb250acbfc888f06bfba7729e5fb4
SHA1	12ff733d5cd49febfb2be4573337dcc4c1ee0a59
SHA256	3868a8ecf7e2d86a2f167b4a6045d0e8ac142b732cbf380e3aef1c97317a3d5a
SSDeep	96:7eg7XR3RnMA+UcD8L1xTEBgA/UmZR5Q9A6WD0chOg/T72uD6d4CtNYY:ig75cezTEBg8Hn5Q9AXD6g/T7xuttx
ImpHash	-

C:\588bce7c90097ed212\1029\localizeddata.xml.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1029\localizeddata.xml (Modified File)
Mime Type	-
File Size	80.07 KB
MD5	5b07763ebd393df2fb4f799144ab06a2
SHA1	d7454a0e7897369b205dec6e04d3ccf87f6a424f
SHA256	229111e4300b50dcabac501e0377cf29b7553131f7f8a654ab07c6602362abbf
SSDeep	1536:zjKtVHP8ePWIlEOpDdQCmQ+kjHaD/hjerxk1D0kentXxGPhSlTpK4WyfArfiCT:6tVHP88hl9ORkr/aok0XWIlTpgrfi0
ImpHash	-

C:\588bce7c90097ed212\1030\eula.rtf

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1030\eula.rtf.cuba (Dropped File)
Mime Type	-
File Size	4.24 KB
MD5	390b77dc7d14ece5f88d7ad9d07291da
SHA1	c8a46641e1c43a2cc1e0bbe5eefb6fafe10d23b8
SHA256	862b8e2d19fc89082443a362c8788db8b6f8595150fa1fb4fe73a506028f4d68
SSDeep	96:7WNdGlqt1E5WCv6X0ZjqcadVz9tPquTwxsHqvgUBiG7:cdGm1E4EZ+FquTEsHUgdG7
ImpHash	-

C:\588bce7c90097ed212\1031\eula.rtf.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1031\eula.rtf (Modified File)
Mime Type	-
File Size	4.34 KB
MD5	28a8a4da46a63a9145c3a541bc01a42b
SHA1	7ad1663ce6f7c5331d39fb0d6a81b7e9636e86fe
SHA256	8aa5b01a5a3f64584618d596a75442150d1f5a4a37961ef48cc662c2a8afcf77
SSDeep	96:72UOz2C7vn3PRaryXt4trbvroAYDpgWQDskX9HVca6vNd:r94vn3paxtHvl/WQDsgB61d
ImpHash	-

C:\588bce7c90097ed212\1031\localizeddata.xml.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1031\localizeddata.xml (Modified File)
Mime Type	-
File Size	81.42 KB
MD5	c7ddee4a0148459804a785f5343182e0
SHA1	a921c0ea298986d1118e11bfe9e33e64a2c293c5
SHA256	29b63048fb132226b5e4e68b8a379120fc4ec71a436d6cba86a6367ec75c61e5
SSDeep	1536:b3xOlZLc1rb0ZQcA1qbY0hGtIyW2XvBE3lqlI/+bny2KSE2A5C:EZLcB0ZCg8QGtIk5E3lqlY8k28C
ImpHash	-

C:\588bce7c90097ed212\1032\eula.rtf

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1032\eula.rtf.cuba (Dropped File)
Mime Type	-
File Size	9.67 KB
MD5	058982fbba473104e7ab6df01250b976
SHA1	9524fc0815eb47bb95dc9c59c8184890992bdd10
SHA256	58c8190c178ea24c1b4fb179126d68dc924f3d16538a728a07530413c97a5392
SSDeep	192:t+tXFeaSrJ+19mIMLM99VYvQewQ/8h8P1bQRppHgHGkEsZezdw:t+t1xG+3mNLM9rYvQu8hs12MmkEsgzG
ImpHash	-

C:\588bce7c90097ed212\1032\localizeddata.xml

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1032\localizeddata.xml.cuba (Dropped File)
Mime Type	-
File Size	85.26 KB
MD5	fe81a489d515ccdbea76da5922619307
SHA1	5413a356d45e61f5694030d79b341a030f0f8222
SHA256	113c4a2b4638332694f0dbb1369cd2c8eeedc01fb76d297983829522a9187074
SSDeep	1536:7e7PPZpyLp7DDOB/0njr1hZDH9AX+G9u4mG1MtmEXeJBOMTLcgQs26rp5wYjFPd0:i7PP3yLB2u31hJ9AOWu4xEebWh6rTjxW
ImpHash	-

C:\588bce7c90097ed212\1033\eula.rtf

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1033\eula.rtf.cuba (Dropped File)
Mime Type	-
File Size	4.11 KB
MD5	dde8022512b06a64e19d3bbdc1eb4cc7
SHA1	826fe48d9c7b7eb060f20f43d7849c1a3c14fe88
SHA256	afb64118a2076641085564716aca6d7777649804bc7d185bbd13c62716cca545
SSDeep	96:7RJBGDNw0tbUAJbuu1d3BNKKpAW7n1N4oe0VI:HYVUiiy3Nxf71Cr0S
ImpHash	-

C:\588bce7c90097ed212\1033\localizeddata.xml.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1033\localizeddata.xml (Modified File)
Mime Type	-
File Size	76.42 KB
MD5	ca0d9c34add1734ffec672350056ba92
SHA1	81ad3bdb45ad0befe3c43a824284dfd25add6e2b
SHA256	ac4163e5bc79c2da87f0eb4646ec3a83c8a81c74e746b0c438fa2070ee01afb4
SSDeep	1536:BWXehiYuKrYw7PDmDd1ZOPd6OvincUmV6jN9ab0+au26MidF30fih:KeDuISS3in3u2uPh
ImpHash	-

C:\588bce7c90097ed212\1035\eula.rtf

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1035\eula.rtf.cuba (Dropped File)
Mime Type	-
File Size	4.62 KB
MD5	d0b2bd9f1a9724f1bc5bdff9b9868427
SHA1	ab51d7b0c34148838e8f6d3a4767d97ad9f1822c
SHA256	64d3c7bcebf754ad546a4d3d5453182bd3847388bb0161c9964a688ce14d20f9
SSDeep	96:7ZcoJAvda+UWiId6rNo9AG4qVPs9yE5bM6TvpJ+zS9PrOe4A7y:1coJAvdmWi09zk9J5bhTvpUzS9Prx4Uy
ImpHash	-

C:\588bce7c90097ed212\1035\localizeddata.xml

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1035\localizeddata.xml.cuba (Dropped File)
Mime Type	-
File Size	76.22 KB
MD5	24b91ce3b88af6d0896d2c9fc42de4d4
SHA1	71f7d2cde9a91d2a9e601a766fb940b076f233dc
SHA256	408cdcd6646992e19d5fb5e8dfcb91aea13f469c8f820c4123817d7a6bf34cf2
SSDeep	1536:SBF9NrILXzAh55UGCmp1LtQY/4ubrYaYBryXrtdXoakC6OoyTZk8Bpo8uWZI5:Q9NrEz855UJSZbEnyXrvXorWTmCu/
ImpHash	-

C:\588bce7c90097ed212\1036\eula.rtf

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1036\eula.rtf.cuba (Dropped File)
Mime Type	-
File Size	4.44 KB
MD5	8193fd016d92311aea14800db44f6f0c
SHA1	b6721ed7bc9a6f736455310482aa195ca1ee17ee
SHA256	b1c4e7eed1023ec604362f307e3dfc9f3b114b84bc5d4287d9e34a7abe7bffc3
SSDeep	96:7TB9rANlSsL5k0rLObrR4zPNxBfkTgp1hymPb72L6SpK0:TrQSUq0rLObr8NxScYmPbGX
ImpHash	-

C:\588bce7c90097ed212\1037\eula.rtf.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1037\eula.rtf (Modified File)
Mime Type	-
File Size	7.69 KB
MD5	e0a96ddb66e1ef109169b84749c4cd2a
SHA1	ee1ddf5ddb32ce2f8688250a96906bcabc563b72
SHA256	e5d46775e3e1907288fcf4f6704637054299c2496d53e6b3573efbd0765d97c8
SSDeep	192:tZesVfY4i8UPdNFXZ4S+kc5gd6i5vqNqlOPs+Ddfvlm3vMU2Z:tn/6D4jx5e6eYq0PrdHE3vMLZ
ImpHash	-

C:\588bce7c90097ed212\1037\localizeddata.xml

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1037\localizeddata.xml.cuba (Dropped File)
Mime Type	-
File Size	71.39 KB
MD5	9ec8410037f4315e5fee629e8b4fa658
SHA1	d434f07e30a0f861a91694068856cde1c093c673
SHA256	b5446cac9a6555ea743435e1a964efd4846f23108db54ac94b9dc036d8befe86
SSDeep	1536:T2c8lk2l4d7Md6Ua930zmQeVJ3Kl04fJS3h3x8U3ZxUVSY40MTOZ0A:TB8l3lgIcuGqthS3h3aU3zUVHgOZ0A
ImpHash	-

C:\588bce7c90097ed212\1038\eula.rtf.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1038\eula.rtf (Modified File)
Mime Type	-
File Size	5.15 KB
MD5	4fe52cd4fbc1628ab77cfeadaee6847e
SHA1	4701097a6b8d85f2624f32e12975c39256a047ad
SHA256	8cb380f7ae245f40b182012bc12068f2f9cf0e6942148bd6a35ab87c3a0c5315
SSDeep	96:7IoKenp+ZM7EwEA3PGcMqLL4oaPnQj6VdDQT/yq5VPAyA:8jRZGHRuq8okQzDyq5LA
ImpHash	-

C:\588bce7c90097ed212\1038\localizeddata.xml.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1038\localizeddata.xml (Modified File)
Mime Type	-
File Size	85.42 KB
MD5	af87698a182e94e70e4b00e7a7842d75
SHA1	242e3471a066bd1a6c92cfd9056761125502a9fa
SHA256	53ea7823d49d9d310771767bdf9b5c0153c2b8d5f01f90c1c4e9a71651acd1f6
SSDeep	1536:+ZipcTwoCQixLtJQHUtiZhpy7DxE+ELzNKPevGhgT1A6nNh1MOL7N7:OzLcZ60tiZfUiDqe+hl6Nztt7
ImpHash	-

C:\588bce7c90097ed212\1040\eula.rtf.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1040\eula.rtf (Modified File)
Mime Type	-
File Size	4.56 KB
MD5	c4bcbe1b29cba2409858c8f6c9d3e230
SHA1	7c6234a5b63e2f5dea59122caf415bc0321dcf05
SHA256	9f267339409bddbe1985a71948bed4accfbdce600f9ddca64948598473965acb
SSDeep	96:79xcURhyx9DsZLu5tImrnK2yi3yg3uueRd4n+c5YGMKxw3EoEjD:hxNsPDslAkiigeuelc59vxwNmD
ImpHash	-

C:\588bce7c90097ed212\1040\localizeddata.xml

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1040\localizeddata.xml.cuba (Dropped File)
Mime Type	-
File Size	79.18 KB
MD5	fc6cf0f4ce2767deb9e2a433e139e0a7
SHA1	a68ef8e4e79997a58dc29328d9dc1b3472c4de6d
SHA256	855782f495ad3c42c60a2bb19ea8f9f6d24b1b584711533f1d8ddb5b6e1cbcbe
SSDeep	1536:m2LavVy33bPIYaIjqvcFldp8shMtPXAnA0Ssv42yskjj4D7Mpa9GdsVWDgLStWr:JcMAIeS/M56SsFyZjAMYf7StWr
ImpHash	-

C:\588bce7c90097ed212\1041\eula.rtf.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1041\eula.rtf (Modified File)
Mime Type	-
File Size	10.89 KB
MD5	0a323ebab0a0990514718cfaea07af40
SHA1	19d389c77db358a345da4719504852415caee4a1
SHA256	d28d7abf40a61544cafdd90cbfe64518666c9d47ebfe0b2e76037c12780048d0
SSDeep	192:7D4lffNkG8nCd+c4zFPMjaWUkZ3/tac1YnMRzrqFo3ByUQTbHS7d8eBkvJUO:HuffKCN4zFPcaWhZ3/3Ha2By7nHShBkF
ImpHash	-

C:\588bce7c90097ed212\1041\localizeddata.xml.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1041\localizeddata.xml (Modified File)
Mime Type	-
File Size	67.63 KB
MD5	19c635cf59991a400bd4933df053e6a4
SHA1	06cf32ed79c28d7b86ac288967fbf95a4a1367f3
SHA256	e00f4701ab809f297132ce9b436b697ea69ea5aa145ca7d0a2675d3a86978920
SSDeep	1536:xoRxEFJiS7LSaDcCZiZ2UxT3qRTswJaRzAh05J6jc06oSJ:xoRxE97Lx9iZ/NOXaFi7SJ
ImpHash	-

C:\588bce7c90097ed212\1042\eula.rtf.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1042\eula.rtf (Modified File)
Mime Type	-
File Size	13.39 KB
MD5	47399a67b5c7a664276be60f06fecffd
SHA1	569531ed1ac604c50b3d40b7525ff5f418ffc680
SHA256	44cd485b545af86a78ab09ab1d9009bf1b55dafd8d0680ecf84888b7929763b9
SSDeep	384:yW23FJLEAOohxxaGzwKVdXcsAJXWXmyD/SGr0wd8:yW23FtVOovxLVBcCt8
ImpHash	-

C:\588bce7c90097ed212\1042\localizeddata.xml.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1042\localizeddata.xml (Modified File)
Mime Type	-
File Size	64.71 KB
MD5	09da556b0afcc8c3b6cd1ab27409cfea
SHA1	15b6d50d03c01de8d86cf897c4cdef8f105b86e4
SHA256	3d4f37796c3d4f791d498c5ad6cde76b6829a2755700c7abb338cbe51a17abc3
SSDeep	1536:fuUlLrpGkv/zTspGRgYIFLEANM6Bq1FxJ1z:m0Ikv/zIpIqo0wFxT
ImpHash	-

C:\588bce7c90097ed212\1043\localizeddata.xml

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1043\localizeddata.xml.cuba (Dropped File)
Mime Type	-
File Size	78.77 KB
MD5	e23ad71346ee2c8ae3574ace2f486d31
SHA1	215a04a0b4e110edf4f5816d412de1eed3cfb12e
SHA256	76ae1780817b617a6e202403f3e0f2dfe692f03a3ec1a93fe5190ed7b02a75b6
SSDeep	1536:wJUwywaz5xqMyYauuJIkPkpwSHrisR9LJ8+qIEHRv/F9UWN0Xe3c:nSazaNBCHHeCpJ8+Q/vN0Xe3c
ImpHash	-

C:\588bce7c90097ed212\1044\localizeddata.xml

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1044\localizeddata.xml.cuba (Dropped File)
Mime Type	-
File Size	78.44 KB
MD5	c80d90ee92938932fb3ca386a80f235e
SHA1	7807ebfa564a6a9b1e74f7f971e30fa28db40923
SHA256	58aa7a0233915ed3a81b43d5478995a6864a9c9f26770ac2de8098105ba16ba6
SSDeep	1536:hvxjCzCx0BAebJMsRsBQC8DqSJC8ClTeVKn2w1w/RA4YnHEBLY28:Fxj+CuBjbJMsR8QC8DqSJklD2XYnYE28
ImpHash	-

C:\588bce7c90097ed212\1046\eula.rtf.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1046\eula.rtf (Modified File)
Mime Type	-
File Size	4.60 KB
MD5	5925ce62aabc9fc6b93222e539ee4079
SHA1	9a0dbf762a1c1fdaaf3df735f50513dd416193ed
SHA256	0149c5cfde027625282f45d2382f432de273ad9eb578af03a365371abe28d614
SSDeep	96:7Qc6dj6Xl7glRyn3B0Fgqj88EZjFcSV0qJaEvdmnuOWSKFMym1iQiW:0c6djy7+mCw82jFcSyWu3zcMyE5iW
ImpHash	-

C:\588bce7c90097ed212\1046\localizeddata.xml.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1046\localizeddata.xml (Modified File)
Mime Type	-
File Size	79.85 KB
MD5	88ffe456da37b5ac15d7d1db74975ac8
SHA1	bffc6949bbaea8f3d02ca1728519c19791b8a652
SHA256	951a421fd54c0029502a08e6a523958370b8e58879a710e9161c1bc89bdd8a68
SSDeep	1536:xSUZIM/qu1nIJphRhnbhooKxSqJjTJS0zemyI/JRCeKgSF6FOp6T+fUB9ZHkcml:Svu1EpU7AT7mdyPu56UBMX
ImpHash	-

C:\588bce7c90097ed212\1049\localizeddata.xml.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1049\localizeddata.xml (Modified File)
Mime Type	-
File Size	80.57 KB
MD5	9f99afdbdf0da923cb2cb5be4fdc2e12
SHA1	357355f7e0e2462084de4d7d7983af5aaa5d2752
SHA256	c183621769ef0f4cc006de664ef1a7fc0b2fbc41dd36aa41f6a91e4da48f691e
SSDeep	1536:fcMdwI6CyeXlWEHLasYEsm2+nGFijOejTvL3dMNN8Fwzh0SgKeL:fDdwcokLiEs/QG0OEiNeF20SgvL
ImpHash	-

C:\588bce7c90097ed212\1053\localizeddata.xml

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1053\localizeddata.xml.cuba (Dropped File)
Mime Type	-
File Size	76.86 KB
MD5	d09656bcf7a82bc395364eed62f4194e
SHA1	047b66650ef8eb5d1d3f945698d2e8c61dc6d987
SHA256	82afc8aefe6c05632924a422b6504ce39b49c806f3bd10dcb5ccb44be9cdd562
SSDeep	1536:Ar/Se72RJkQHi3DCUolioPbGx9aglQdLjtRCht5xuIiGzlK66:AWJZK4hIrQdn2EIi1
ImpHash	-

C:\588bce7c90097ed212\1055\eula.rtf

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\1055\eula.rtf.cuba (Dropped File)
Mime Type	-
File Size	4.77 KB
MD5	86b99af86a2230a7d1e25d606537f900
SHA1	a2a93f1fe49c18af24ef4381cd3ff1352c93ea8f
SHA256	b0df6519c0c6df06bc640c7f51163771f61d362838a84638b4bef6ff1363cd4d
SSDeep	96:7v9MciLkbEfuOmuD50SX6aY6I7ENX8ClVoxPXcyLVmd+8:r93VO3DfXxY6n8bX5LVe
ImpHash	-

C:\588bce7c90097ed212\2052\eula.rtf.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\2052\eula.rtf (Modified File)
Mime Type	-
File Size	6.69 KB
MD5	5f9f27348fd437edff87aabe99cd0211
SHA1	d61a629a7c8d1a73dc3957c8e17283fffcde7ae2
SHA256	c5ea0e974cb2106a653162dee31112771b2062c53c67bfddd65e11ea3a474697
SSDeep	96:7RUBbaxBt6MgdJMgj4JpcK4Sn2hmOxh6jOT7MBYJa8cVnWea4J:9UJax4XVj4JhhSY4MB1x8vO
ImpHash	-

C:\588bce7c90097ed212\2052\localizeddata.xml.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\2052\localizeddata.xml (Modified File)
Mime Type	-
File Size	60.26 KB
MD5	44002f78b3a9e4c5bba0042d8f5e90dd
SHA1	4e65ba8ea019ebf8ee14c31bb21f55b368d9aefc
SHA256	51fd84484ba28b75247f9bc944068bf6466a4c33b6a2a03848876fde94dc590a
SSDeep	1536:Xh6knIsq2qgzCf8BVHMUmaPd/1fPbqRA7EVchlpJ5BlX:R6kxqajBxMUma1/lP6A7EVcJJ5HX
ImpHash	-

C:\588bce7c90097ed212\2070\localizeddata.xml.cuba

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\2070\localizeddata.xml (Modified File)
Mime Type	-
File Size	79.37 KB
MD5	6175f7ae2aed09cb1a42747738e08e30
SHA1	7197a8d4e339d50eaf02169b8d937b2a75b0b642
SHA256	09aacfd3b7dd9cb78dab2003479119f405811c02d14fa1957caed791d6633c53
SSDeep	1536:NXLupKF2KRBtc/DZbc8bCXDNLC3blhSBELRX9/7IkkCeyim2iKlidApFG7:9L1vBulpCXxC3bmMtFIg/wjnG7
ImpHash	-

C:\588bce7c90097ed212\3076\localizeddata.xml

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\3076\localizeddata.xml.cuba (Dropped File)
Mime Type	-
File Size	60.39 KB
MD5	3bca4586ec0b064aed434a3423ab53b7
SHA1	7e57cde32d10a2c549c218fafba2f0035a2ed608
SHA256	442232bb504ea604f708c8fd97303b41656246ed347937db22e043891e584535
SSDeep	1536:QyKsm4vUSoSw1TB9aY8uTrUjSl1MP3l/3JxCkvGO:v3m4vUSoSw3sY8uoSl1MPl3JvvGO
ImpHash	-

C:\588bce7c90097ed212\3082\eula.rtf

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\3082\eula.rtf.cuba (Dropped File)
Mime Type	-
File Size	4.00 KB
MD5	204183878163dc6e3e44d78d62b117e9
SHA1	03b40f83e54cbc550472ccf88060806903296d4d
SHA256	46d71a19ec5fcb4042a24c0d659dc017d82b7ccaa1a1aaf6132d687b7786741d
SSDeep	96:7gzalUT88gnZqv48ubLizwa/Qfhbit2jWZOS8u8qsBOkxNC:ca39af/QfhbW0jqsBOkxNC
ImpHash	-

C:\588bce7c90097ed212\3082\localizeddata.xml

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\3082\localizeddata.xml.cuba (Dropped File)
Mime Type	-
File Size	79.12 KB
MD5	46d8e0549636ea769c4b4782776e1a83
SHA1	3db6ba62d4ba5cfb96b8b2e7be3d8fc4313b3d0e
SHA256	ae2e0612958f06310ed93b6510d9e3d7fc750c430825c2165e2030c6ac562919
SSDeep	1536:VwEaDgn4dpVdmBJud93FjukQSRpN0blH7Ya7smF42AqQuLJzMEUfnb55I2f:VWDs8pVSu/1ju36olH7Zs+bAq1JpU96c
ImpHash	-

C:\588bce7c90097ed212\client\parameterinfo.xml

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\client\parameterinfo.xml.cuba (Dropped File)
Mime Type	-
File Size	198.07 KB
MD5	5656ac9b1f291ae8becf53e6b3868a6d
SHA1	0577838766b0349f9d3cfdec5136f42f670c7e25
SHA256	546df8d1f5c1d989a2a72af5a7579456acd80ee296c2b298a3b645400131e1df
SSDeep	3072:fXDvvD3gL9Rz82cAAt/bDVW7zPua9nEYLpNSMGkZEMHWDbEc+1hN2HZ9HN:bXI9RnuSSYnEYCkZrabnPrN
ImpHash	-

C:\588bce7c90097ed212\client\uiinfo.xml

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\client\uiinfo.xml.cuba (Dropped File)
Mime Type	-
File Size	39.13 KB
MD5	8da84a8524808bf3b3f82b9a6083376b
SHA1	54f255fad86a6a3095ae982ccec02affd5f7bb9b
SHA256	eaa2ccec240897911e85f8f2c184b4dcfe0542223fb6dbd08f6b8e58400d9ac0
SSDeep	768:ydw+tO3shzjQJvVT2tVnEuhzceggQFSlOksbsjOCX:GtYyzjQvOVnH5cqU3A6U
ImpHash	-

C:\588bce7c90097ed212\dhtmlheader.html.cuba

Dropped File

Text

Unknown

»

Also Known As	C:\588bce7c90097ed212\dhtmlheader.html (Modified File)
Mime Type	text/html
File Size	16.74 KB
MD5	db1b11aee94dd28a371f8474ce3f014c
SHA1	c3aa11581af968aca8d67be95c7ac7a58278632b
SHA256	3f8467216ca45da9774e5f46b98da6f274bac1e38f29c91454f00fb9df830229
SSDeep	384:j+MZ+idmC0HtHKFezVsLpkRbshf3EufVcBAm5JyksFwGczJr:j+M1gC0H4viOh2ASIFwb
ImpHash	-

C:\588bce7c90097ed212\displayicon.ico.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\displayicon.ico (Modified File)
Mime Type	application/octet-stream
File Size	87.46 KB
MD5	47beb574206def45cabf01758be35759
SHA1	d644d2352b878e481dcf102d495d41719523d139
SHA256	639a01e1b15be0bd8142e90cbf4478ff6b451f26b0b0eac1f11ebc1b0318dcc7
SSDeep	1536:PQPgzC6pFkP2gzLGE8h3GX12/KjMERRHa3JQA6/qslfrLBS2pQE3rIdAl:PQI+MWjWE8o8UMUEJQATsBrLKE3rIi
ImpHash	-

C:\588bce7c90097ed212\extended\parameterinfo.xml.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\extended\parameterinfo.xml (Modified File)
Mime Type	application/octet-stream
File Size	92.13 KB
MD5	08cc0224065bc448ce5cc55d04c5df32
SHA1	4da1e74c70983aa209a3e644f96c3e8b9ec23534
SHA256	edfb2c6bf1343ac180df7de613c7555b51fc623930e725a5f9a5430e43e0b7dc
SSDeep	1536:kdloREJjJTPMfNY9+4nJlNCg9DQ4g/MSLulTb5QGArlfCS6FJ+zhhb3rnY:AuREFJGY9+4bNCrl/XLyTb5Q1fCSIyhy
ImpHash	-

C:\588bce7c90097ed212\extended\uiinfo.xml.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\extended\uiinfo.xml (Modified File)
Mime Type	application/octet-stream
File Size	39.13 KB
MD5	126cadf59d90b2dc8b5e4b136f204c41
SHA1	bbc879538a331c37a0c14218d48ae11995dafd4e
SHA256	82241f668875b8585ec53991b3b870b63a158843843de59348bad700108220a6
SSDeep	768:1Z6NDrPhVwRCOIg7eyltK1oxYLMKKubwTagGfJgkUoSYaAV:1ANfzwptK1gKKujJgl6V
ImpHash	-

C:\588bce7c90097ed212\graphics\print.ico

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\graphics\print.ico.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.12 KB
MD5	4ecdac87a6854d62af4f79b33b7b71bc
SHA1	b76513b5e5d2cd4a3e81fbd0f651aa1ae69f5ebf
SHA256	212d7c595fcd6828dad805100cd3ad773c6bd7c9fafb1951cbf2df06aef23ceb
SSDeep	48:7lSBX9w2VBAOmK0Z3e5xPZTA2nie+qndSo6EYfj:7wN7DArZcJJ1+qnW7
ImpHash	-

C:\588bce7c90097ed212\graphics\rotate1.ico

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\graphics\rotate1.ico.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.87 KB
MD5	b6fa10f2df46f89f13ed0c9b138fc771
SHA1	e4513604673b55286f352bf02794a84ac7649301
SHA256	a4fc43f1515e014dd112dc92b8fa673a0a0250ee61a0fd1f3b24c0e976d3b60d
SSDeep	48:7lVTwvsI3ioXgK/hU6K93jYCy74H/Bv8+9h9kmSY:7Twvrioh51FCyC/BvD9zku
ImpHash	-

C:\588bce7c90097ed212\graphics\rotate2.ico.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\graphics\rotate2.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.87 KB
MD5	6d0452967227d19d67018869e9cea6dd
SHA1	db79d10dbb570826f86a11ae2cb31e9d5993f699
SHA256	3773dc090ca4bda1ec5f9659527bc3eacc45f1e225a59cf718756905862e5af2
SSDeep	24:7leMeZmuckwsFHLqtpFW9jGJ/F6fL2JPgxZKmj/PbX4WOM/vpSqGXvFIcg4WgOa:7lenL2iMJ/tEjz4WzvIq6dY4xOa
ImpHash	-

C:\588bce7c90097ed212\graphics\rotate3.ico.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\graphics\rotate3.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.87 KB
MD5	b77eb3814d75e03ad439641ef3420568
SHA1	c16fa761b2fc8438ba5d4789c7155bf3ffa5625d
SHA256	b40568f0ca85fa3e1bc8b2a306003019f44a989f316a13da8c0486c28545211a
SSDeep	24:7le18+Ph+povHxJ4wExQZfP1yxOlGm+hP2VG+Fdf3JbT9cjl9Vx9DdK6UL+:7lenPIpKkcNyE9HFdf3JH9cjl9Vf59x
ImpHash	-

C:\588bce7c90097ed212\graphics\rotate4.ico

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\graphics\rotate4.ico.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.87 KB
MD5	119d36ac23afc0320c2e5e1b3147811a
SHA1	1483e7c1dafbbbd025a267b61c62db4864beff34
SHA256	bbefac18bb976e6b12155a972503b9d89825582d3c2c4e04c5f63e403d3368e2
SSDeep	48:7lOrNXmybfF9Q9946HIeZj0661lOS3mkdZBVodsh:763bm9OeZjq1lZ7dZBydsh
ImpHash	-

C:\588bce7c90097ed212\graphics\rotate5.ico.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\graphics\rotate5.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.87 KB
MD5	1829193a3f575561751321c14f540eeb
SHA1	e050e4d89daf030a241b368ddbefc38a946976f7
SHA256	dd83e985f99b8945b99a41047df78ab189de2cc1264309dd19fba347abcf1bd0
SSDeep	48:7l6dC10OSi/g1fVjMOZAGxUHAoEXJkK15C5v+uUk:78410Ci+O+xHAaY5qvPUk
ImpHash	-

C:\588bce7c90097ed212\graphics\rotate6.ico.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\graphics\rotate6.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.87 KB
MD5	0ddb5ea45bcfed591dd566bf4ef5ea65
SHA1	d7ffaaa30548d84d4b856de36b4ab0b6a5324469
SHA256	a45994f1e443eb3e7008acef411e4b25d76df9950c3c8ee7ce7f02eb79cc2d42
SSDeep	24:7lOyAdbcvmqJ//aX4KSSrkC6KHPJ7os+XDnmh1O/4FoQmtzHbpOwe3feQ:7lO9cl3RKHPJ7imh1O/4FPmtJAfp
ImpHash	-

C:\588bce7c90097ed212\graphics\rotate7.ico.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\graphics\rotate7.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.87 KB
MD5	fd7cd4550bb6c35849159fa550ca1633
SHA1	3e06af367ae12386729501d35a301ccdfa98bc6d
SHA256	e0f4b6f95bf8312eeb715bfa0d87f740aad6be1d29c3443d235920005a2168d0
SSDeep	48:7lUXwIFutnt6lf2yq/vHLs9mpQpSPM0PeGRfKJdppX:755ltfQvAP/eCKdpd
ImpHash	-

C:\588bce7c90097ed212\graphics\save.ico.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\graphics\save.ico (Modified File)
Mime Type	application/octet-stream
File Size	2.12 KB
MD5	cbf8e79fbc807f8a89836271eba53066
SHA1	71b284b8046baf4981b3650b294c1d9720c5fe7a
SHA256	31c6fba98e1b11f8cb9034378736419b316ba28abb1b7db98b8b3f7a8dd4ce6e
SSDeep	48:7lx2gtV1Z3947fhDxneeqRs6tft8WKFlWC3SvH/:7v2ef9m7fNx/cftqFljI/
ImpHash	-

C:\588bce7c90097ed212\graphics\sysreqmet.ico

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\graphics\sysreqmet.ico.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.12 KB
MD5	909c88fc5ede03cc40f15e089cb41e2c
SHA1	21d6b4b6a9bbb61d9a700b9eb750372a62f48a19
SHA256	adc3ae0413bbc0312c117f6748c8fd196d4457096ee40beca1ab669fe81db50d
SSDeep	48:7lVYIpxbAVXZCa2gfKbxbyhcKALocP1+IG:7XXbABEalfKtbkvilBG
ImpHash	-

C:\588bce7c90097ed212\graphics\warn.ico

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\graphics\warn.ico.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	10.90 KB
MD5	35510efbd2bb7ee61235b6c87ab4f965
SHA1	ab08111771dc28db9ff02171e5b2e8f82d519608
SHA256	cd902d8feb110e2e1a5c1651484f84d68375898c16cc0a35959edce165129c86
SSDeep	192:Yukm6Mnul+rb45+RocW5IpCaB5KnqLOFDTH4SmszAi1CB5oaMJmCPCtastLCN:Ylm6sul+s3cW5IpCssnxFDEOki1CkBJT
ImpHash	-

C:\588bce7c90097ed212\header.bmp

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\header.bmp.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	4.54 KB
MD5	72710535f6a232ab2319228814c1dd61
SHA1	01e605c404b1f804b53ee46c0cbfcb2a3adb6ac9
SHA256	689847201b974568c6ed5f4a1f3d5a33b300f1575a09ec495125a182e84642d5
SSDeep	96:7oDHSplITZYubZODPQlp4NyrL3OiUTz0fWrmdR5qGVs:M3VY7DPQlGyX+iUPEP75jVs
ImpHash	-

C:\588bce7c90097ed212\netfx_extended.mzz

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\netfx_extended.mzz.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	41.13 MB
MD5	3791d30b2b32a5ae85bbea92eacaa1c8
SHA1	c6aca78c83f6e884f98e651ed76d8a6756935774
SHA256	ac1b9d76d7139bef8a977a4fa51e25a869595485aed55016f9325ed4dae7626d
SSDeep	196608:wLE+SzDvmw5za2mAL2q6NTwgZlX5AWBfXv:yEFDeozXL2q6NTwgZlXGcH
ImpHash	-

C:\588bce7c90097ed212\netfx_extended_x64.msi.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\netfx_extended_x64.msi (Modified File)
Mime Type	application/octet-stream
File Size	853.00 KB
MD5	49eeba3d4b7315b7e25045f8d00a9d96
SHA1	2d51acc21697215d5a16d2f243b25e189765a1ca
SHA256	fae9c8e774933749912096377260fcaa829d09520dc43a6b5e06917de8e4f069
SSDeep	24576:CAhzvOKh8205H+Lu/xsb8AAmqRFcqF5BpmTd:CcOJRIgsYAzuFcCJmTd
ImpHash	-

C:\588bce7c90097ed212\netfx_extended_x86.msi

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\netfx_extended_x86.msi.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	485.00 KB
MD5	36b4cd9bcc8173b6888d5614336dc192
SHA1	35208700c116e96e39da2f3fc2f9d361d8ee9a31
SHA256	3a6269a3d6f68a71d066b7e4145630c8b4b1366565b00fd82d2abd0cc047dec4
SSDeep	12288:i5FaDCN10mXYBX4VrPzqmKEwLB0M1T+zrAcav0Se+0sRw:kW810rBGrhKEg0MVrx0+0sS
ImpHash	-

C:\588bce7c90097ed212\parameterinfo.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\parameterinfo.xml.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	266.67 KB
MD5	3a198e6ec90a3be9edc51caad3d93e29
SHA1	1adb609096cd2bd1f92cdb765b335d72c20edbbf
SHA256	1d44afda1d2d2d5b44ee59f10f3e677775b55886b4027718c15c8c28f8866cb2
SSDeep	6144:EsOhGpKT+1e4vnGZBTVKQopjrtsgV9BT2VjoEZ/SgG/3q:EsZKi3GjZiBTWb0gd
ImpHash	-

C:\588bce7c90097ed212\rgb9rast_x64.msi.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\rgb9rast_x64.msi (Modified File)
Mime Type	application/octet-stream
File Size	181.50 KB
MD5	a9b85515b32d8b85f5c9c18fffc8e0b3
SHA1	d141dd7db9d63907d414f7dbda0e54df39e8eea8
SHA256	b90ebea940b052c56dd693613c9bae9193b3c73ab455c66d31e09704e0913c51
SSDeep	3072:HVHsie5FxGNOc2dhzUuMLyMK/Y2JopC8YztCD8T068fX2OxNKEg6:UFxuOnAuMLIY2Qb68eOf1l
ImpHash	-

C:\588bce7c90097ed212\rgb9rast_x86.msi.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\rgb9rast_x86.msi (Modified File)
Mime Type	application/octet-stream
File Size	93.50 KB
MD5	aeffcaf39fa1aa6690e1c7f18e9b0349
SHA1	7a1653d35541b7f78f80c133ca470c3977af6c9f
SHA256	fa9aa69e6a8a5556b805d450760621f40cf660e66d2507db0ca4b93d1ad9a33c
SSDeep	1536:N4MB1pidLOjH6f1/vkD6R/mWq1rKun7vAe0hKJIpBLoxO+o1Fz7PVAvLX5JAdLz:Nb7eOj6iym91/nsHhK1OrF1A9oLz
ImpHash	-

C:\588bce7c90097ed212\setupui.xsd

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\setupui.xsd.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	30.41 KB
MD5	1f3cb0a9d71996696ac5a296df7e6f8c
SHA1	4566eed933422f8b49c7876c0423c36eb5b2b899
SHA256	ecd787a985596b6f71cf0dbfe4233ec9a181a2f29c4a6ac60aa5bd2c94fec763
SSDeep	768:qZ7HofdXAoQckEwRZRl27gX2tt3Ju/j+9khq/IxEwf0wux:qZTEdWcS3XXY2+98pxEwcT
ImpHash	-

C:\588bce7c90097ed212\watermark.bmp

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\watermark.bmp.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	102.63 KB
MD5	0d1511bfdbeb508f37fabd5e32db97b2
SHA1	57a20522fc137631aff4903641ebc5489bdb4612
SHA256	1b54575c0cacef5b567a293a20757db673c55f27ebc2bc0f5fdb4a3ac61762bb
SSDeep	1536:8v4O/PNX3Hlo3cN+YlvMlidqzxSzkDTEmg83myF7on0NThxRIGxZ8JL+n:8vBBHSVivMCqVkmtF7o0NbZ84n
ImpHash	-

C:\588bce7c90097ed212\windows6.0-kb956250-v6001-x86.msu

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\windows6.0-kb956250-v6001-x86.msu.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.09 MB
MD5	9628d4808c5076413f86761ebcc73e5f
SHA1	1d9867af2f33fd30c9309a1675b7610c07990aec
SHA256	ab2269d910c3ecb75f102aa1fbda1a55a7af54739dd40f46cbd40bab5e77979a
SSDeep	49152:B2QUzSepZXlRxmX7yzNHWuiDumT1r7AdXZy9KU2KUYxs35DKZ3OIKxWh0e6:ADue/VRx/Eu81PAdXZzKUYxs3pKZnKxh
ImpHash	-

C:\588bce7c90097ed212\windows6.1-kb958488-v6001-x64.msu

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\windows6.1-kb958488-v6001-x64.msu.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	4.86 MB
MD5	504799c4ad586e57b9ec2a2457cea77d
SHA1	7a939a2189b1bd80c901b80f23ba3934b7e5f137
SHA256	b08083dbc07801c7cafda5302afd37e743801f3bde9080f46ce3722239330c3c
SSDeep	98304:1CnsO4W5vK35Ky/aBHTKYzKXH54UuFe1kBpHua/KUKcs3DKVDK6rCo:EnPj5iwBBHTK8KXZ4UuY1kB1iKFKm/
ImpHash	-

C:\588bce7c90097ed212\windows6.1-kb958488-v6001-x86.msu

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\windows6.1-kb958488-v6001-x86.msu.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.04 MB
MD5	a09f6490486fabf6593820df0ac69d44
SHA1	2bf35d95f4030541c5cd7fefa883efbe47ce0615
SHA256	4a4279b2979e9986ff41a2e8323540021938228d192d9804ad32bcc40fd4101f
SSDeep	49152:yVF0HabfACyYcYXpkU/ADuv7GuMRau8yuXQFKUYcs3HVKf3rhKzdN7:8ucfDyYcmKU/NGnRau84KUYcs31KfFK7
ImpHash	-

C:\logs\application.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\application.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	e3091007c4aad72267bb8488ee932cb1
SHA1	574f3b2e5c5a4f25dedbf89d524a7e3537cf3bb0
SHA256	9f3caee4e9963eadd07267bc215e26ea43afbd33176d4f19cad3333de533cda4
SSDeep	1536:6y/aXVg1l7KC1IL8wMY4XnhlPvdb+RBwmW0VYtvrgu0:6yyC/7DIL8wj4XXPvIvwnt8u0
ImpHash	-

C:\logs\internet explorer.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\internet explorer.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	4b327f2d667cb129e0cdfb7bf55b77a2
SHA1	146ce81ac89d8287eeddbf54f2c5fa2b08a370cc
SHA256	82a794b07097351065e1a388565a097ee92d08df59553e37cc51f40dc2cb133a
SSDeep	1536:hX8r8nf+k3y0i7N+JTXyCl+hTKvwv1ALxxB03s6+w8hTmkQPIWM3:qgnf+0y37K2C0TKvwtAPIUYtI
ImpHash	-

C:\logs\microsoft-client-licensing-platform%4admin.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-client-licensing-platform%4admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	58adfea903e23f51188a569c43e30ff8
SHA1	8b0c0d50e4a0d918f745fcd61bee24aca8a5b3f0
SHA256	e7b485bf2a9eeb31593ffbf4b7282f31e62f3e42a39cfc4171356c4b4537ed03
SSDeep	1536:XPKDQrSQInRulAzQMpZwqEXzAdKXpMvWCCezO/tJmC24lCYKD:XPRAReMlZw3EdqpM+4K/tJmCF8
ImpHash	-

C:\logs\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-application-experience%4program-compatibility-assistant.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	c6a2a7d5f8b2b81d971bbc971de3e6e5
SHA1	6b0fd716c408111f2098d9945be79f8e53d821ed
SHA256	95fc1059e53bafd5edcf8243e70f84c2411b8a6c47b7f57b153346bd9ace2158
SSDeep	1536:uN9yQBqFRYJXArxWyqokWdrUQmGYNVrO9DzA2AApoFCxR:uoFRYJXArxZTgVrUhAAiA
ImpHash	-

C:\logs\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	41e5033398b65d4a001fa9c9565b2bc1
SHA1	364a61668ab7d55845d884f83ee7cffb99967b6f
SHA256	a38db643db93e8e694f7edbb1d32a9ddf29a35395bd45d8175b2383318d98d1d
SSDeep	24576:E0YqGXqsgm93X6V95prvF9vTmpmC6syi3k/4e49F0P:CT3ylDTGyww
ImpHash	-

C:\logs\microsoft-windows-applocker%4msi and script.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-applocker%4msi and script.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	3e75dd872c3da0a93f2c1a595df05bd2
SHA1	28a91fe1c6149557e399761669c10663627a6795
SHA256	cc970acf623c319e9d2f61b61081b49352f6ce99e629c806570a69262bf47877
SSDeep	1536:rc3zPSpTR+cr/E55lynVogO25qDWjaONQFosBMOfl20FocRwx:mTSpTR+L55lynS7oaSWsOfl20Fonx
ImpHash	-

C:\logs\microsoft-windows-applocker%4packaged app-execution.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-applocker%4packaged app-execution.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	4902bf2ec8593fd6ab17c075ca545bbb
SHA1	2f561f03d8cdeaf6c9b91badd387fddfec9400e4
SHA256	4add555b63d0b34f92858bb8dafb51a856d492a7a6e07614587b49385431948b
SSDeep	1536:w/RQZp3SbyZnOLRQWVSCtn0PNzkFleaa+PVx:ORQD9qJVSC+NKT5
ImpHash	-

C:\logs\microsoft-windows-appmodel-runtime%4admin.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-appmodel-runtime%4admin.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	cb2109b53d03002d33ec8b49983b1ba4
SHA1	39509f8e2a14ef76ab7a5184a34210ec54764ff3
SHA256	418f0d0424286d1ece46e5f90b6f97e98ee333dd0d4a073d9911f153dac5b40c
SSDeep	1536:Uli7LckR624xPYHe0ycMcWhExryn12vhuJAG7U5146cs:UYckY24hYHryLceuhE7U51j
ImpHash	-

C:\logs\microsoft-windows-appreadiness%4admin.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-appreadiness%4admin.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	7ba06b750adef79d7d40b613b1dcbc74
SHA1	1d4ae026d85f1f8eb2d54f6cc8f7063c3742595d
SHA256	a1fa9c5085093afa2a65e3d00b66de62bc0167723c7e6d260432b39dbdc021e7
SSDeep	1536:iRwfR0A8pWwR0TMmavtTY4jWrumEzyynoMujKd/4gyjuZ:/fR0Y88Mmau4aruXyynMS/4hs
ImpHash	-

C:\logs\microsoft-windows-appreadiness%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-appreadiness%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.07 MB
MD5	28385cf8b54a1345d0a99f8272453cb4
SHA1	ae48f42c9afb0216fac11c611332221c70ff4841
SHA256	35921be7d8129aec154bf33a5477a5a90a6cb2459073735ddbabd038fe8d76de
SSDeep	24576:2TTIMv2U6xEKL0V8CWUNLKbCwgdw4yfxLhTJSa5E0s:v8lKIGhUNLKzwMfb4ws
ImpHash	-

C:\logs\microsoft-windows-appxdeploymentserver%4restricted.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-appxdeploymentserver%4restricted.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	92216b40283fddf9e3c3730339831f6a
SHA1	b6e97077ef71e20eddb4edabd9c3e30db67922ef
SHA256	6858a63e2e4a4630a50a58906db5e3694ddbc06d66d41c608b02be8a91bf0e6a
SSDeep	1536:YlJwIr51329v3rcTArqshjIYfWsga3e68jzpnpPvxfc5:MfNNsbWArq0EYb+Ra
ImpHash	-

C:\logs\microsoft-windows-appxpackaging%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-appxpackaging%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	6fc56729cc35025ab31dd0231de18a17
SHA1	025cbd1b107d462bcf37072661c692cfea427400
SHA256	04a2708cf245346b46cc849d0c68ef46d1aa31d00e653b80620f492b96cf16bb
SSDeep	1536:8mLa6k2FOpRC5L9xorb3suncuRPBH/YiwlMihowXQlj66bTd8:8D+O7C57oNdRJH///Dlj3XO
ImpHash	-

C:\logs\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	e9e3a8cdc2de77f82eaa606bf31e0d0c
SHA1	486513875c4fc90c74c3bb2ef7cc1c1450a7d0cf
SHA256	9151863d93e33311951e5136db243fc81f5f541effbe3829c92dfa829128a292
SSDeep	1536:nA54HOgFnscZ6W+mPAIpUflSuSUjeK/IeLe5PYflilCkWVEo6tdZBLHlJJj:/vldZXAWrQeKAeq5YliZFnZ1HZj
ImpHash	-

C:\logs\microsoft-windows-bits-client%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-bits-client%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	a527a012583106aafb237ab59a42a87d
SHA1	b7bbfacefb8f29003d4b0a1298b0827d0c5ed0e9
SHA256	d44907a34b478bcb3f94c7cb3a97678dd938d4538ad691831bde4ec441bda6c7
SSDeep	1536:acKtbhVfVT5a7dGEsw2yHRvGqZfUVkijHZw0PL7G+iQ:UtbhFPUdGEsw2yxGqVUVXZw0PnNiQ
ImpHash	-

C:\logs\microsoft-windows-codeintegrity%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-codeintegrity%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	c7020f3868c12f5be0fb5412738caefa
SHA1	4078b9eb50438ddf292f131cf2a0a64839c9eac9
SHA256	2d9a16604efb7d16e2f68031a091877fba03b1e6ebd5ed8541b5f045e82e739c
SSDeep	1536:nvda3hSjKrGn89hUk3BAEEPEM100cS/59VcykYq6:nvgRSerzh3BAEEPESfcyk16
ImpHash	-

C:\logs\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-coresystem-smsrouter-events%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	d6630c9f4ea1d8743fbaec1d1227c825
SHA1	33bf450b85f01594d6c1891807ea71e8b6a8607b
SHA256	2cc89e91c6d1fcd0c76d4e9eb89e4c9adebdb233b1a0baf048f30e19e8dbb02d
SSDeep	1536:yWP7/qnaXVR39NrUyWwVRtji3Utvv54tEc1GYaYJPYtDFl+ZeWcp:t7/pVR392yPfNi3AgIOYtDFl8cp
ImpHash	-

C:\logs\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	3c2d99864ccabf8c7e49fa7c4d2c8c3e
SHA1	80a1cda30368dc11b395d53a44b0ba91397fa4c4
SHA256	2b8fcfd9882ab66ce9e17085ed51808ece229126ea9e6d5e008d9a18020b36e0
SSDeep	1536:LEIdoTlksrTJ7Y7BaYwFDYdJggo5Pfuqtqn7lTxrMdW+sl0e7kJ:zo+srOaY1JggkHuqtal6U+sl0GkJ
ImpHash	-

C:\logs\microsoft-windows-crypto-dpapi%4operational.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-crypto-dpapi%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	88dd06a37cd8806fe5f57e3078c1d87a
SHA1	879d4b8e100cce3d491579e08a87f4a50997a13d
SHA256	31b002102ce96bfd2653a8c8efd95cf98e7ab378eb4854909b26fa5e51a5b3b5
SSDeep	1536:M6WWUH3z/Y/X19vXtFdJBEzyX6YMGbSn6BL3XVU2:M5FHUf19vdbEzyX6ybvt3FU2
ImpHash	-

C:\logs\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	418d25d4e5f05b1c4d12647523f97370
SHA1	be52626f8162a9a2150f408c923dddf9ca40bda5
SHA256	44017012bb1521431d00e6830b17b010221b0c7e31ff0ba238ed7bb29a59afc8
SSDeep	24576:fI7oP1HXmwBFrJVJ/UXXa//0qfqr2aG30BAqm/z8:fTx11KXa/8qCru0B9m78
ImpHash	-

C:\logs\microsoft-windows-devicesetupmanager%4admin.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-devicesetupmanager%4admin.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	f231cf9d81c0bf3363d176032dd7215d
SHA1	9fb0ab683ec61af5a5120e432260647ddc2a5a21
SHA256	081c53dd85f95b857367364e8021254ee01739a14eeeed3f0688debcb2ca769e
SSDeep	1536:WL87M7h+gGarFH7SFRLY0ltwVuigfe201D08VfGDF:WL8CsorYFRXg2e20t088J
ImpHash	-

C:\logs\microsoft-windows-devicesetupmanager%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-devicesetupmanager%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	76a5a7962fa6e64845a80a95d7044044
SHA1	6543ef575ca84d551e97401386667d3bfffaee96
SHA256	caafb7de09b7a062f69143e00d72659886d5c5cb5b4463222c3c9ed4973ed998
SSDeep	1536:KWc2NnyvzAeZcYdtJrQ8ID59fFOkXCrEoHZkil4j643OYVktHh:hc2NyPKYdtJFID5lE4oyibURsh
ImpHash	-

C:\logs\microsoft-windows-dhcpv6-client%4admin.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-dhcpv6-client%4admin.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	737108b92213972ebaf59776418cd3c4
SHA1	829651a907932866f1c7d9a80fa2e72dfe6ba0cf
SHA256	dbc7f885e854ab6e205486bab56f603201440b14315f7011b49132394ca773e4
SSDeep	1536:NMjAu/YLBofVU3gxtaJ+PQQcUpP/bFUesbXxRlmfOjlo+K:R1oi3wtNot8Ues1RlwOjlo+K
ImpHash	-

C:\logs\microsoft-windows-diagnosis-dps%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-diagnosis-dps%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	62992f9201eb3fad3e95d9f457e0a361
SHA1	89ce3874e8b4ecec6940dd48f55a2e8d146f443a
SHA256	bba11153fb4b079fb88add7cafab860a7c1cc61be2fc380a24cda4592a4797fa
SSDeep	1536:RGjttfQs2jSFq3NL+x1WtCMdCvyJtJaDNUHu2BDjxIZ0:RGjttfQRjS4N0inEqJtEQjK0
ImpHash	-

C:\logs\microsoft-windows-grouppolicy%4operational.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-grouppolicy%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	4863ab8e4a61f93b11703201d1c6171c
SHA1	ae7c889a611fac973a44708883a73832dbf48417
SHA256	ba0b1c7570ad6f3329c9f06a049e1ebb9697bc0200bf3ffb66bdc395f47375ad
SSDeep	1536:2089f19j5waiwiSPgLuthpL38b3TmGX5EYHIhd6:Wfb5wak+9tMD/5Nov6
ImpHash	-

C:\logs\microsoft-windows-hotspotauth%4operational.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-hotspotauth%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	d47b4445813073fab6086871641d09fa
SHA1	ab75ca18522078d42fed2f8b06dcc152eff6dfed
SHA256	b81806446dc7900a0c00c694545ce94e5484cd99dc7b09d1655c26d56d1526cd
SSDeep	1536:4ECadHPD/D1OsIy4KQ11O1kkmivQBQyNO5em5NtWmZ0KEaZBn+b7Xi3MRWn9WK:QaRL1Os9xY1QeivQfNOk2NMU0KEU+i8g
ImpHash	-

C:\logs\microsoft-windows-international%4operational.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-international%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	1cef59fa69c24d7967deb84cbf77af69
SHA1	c8073a36df5a7aae56a14c058a275d8c7d4aaccc
SHA256	82ff27f07e91f20cab336cfef7cb7dc31df098e65d5dfe71b14792e077d3528d
SSDeep	1536:3en/v7X3o+e9vYhPuth3wMF02p2xTJoCHA6bKfRWBxGDk/wC:3Ebnox9vUPujA002p2xTxA62fR1DAj
ImpHash	-

C:\logs\microsoft-windows-kernel-boot%4operational.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-kernel-boot%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	c98a8f3c84657a1988fa5a46233268c0
SHA1	41b2ce035d0f4385326a2469ae0f8a5f87158402
SHA256	1c0433162ba6efc2029d3d89a14e593a6573c6fcbe65fce21800c8666df20dfb
SSDeep	1536:hIlr86M8s98k4Ka0K4vSp8pLJEq4JDNj6pzzOBEE7AHycPvrsoT/hcZxLDp8vTy:hIF86cVXSOpL3uDApzzOBEEcHHPv4/L7
ImpHash	-

C:\logs\microsoft-windows-kernel-eventtracing%4admin.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-kernel-eventtracing%4admin.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	7d9caf8f5fb732fe601f1de59be30baa
SHA1	e0e2d0376cc3ccdbacfb8dc351da5e45da66b4b8
SHA256	602baf530c14e39ddd9280b155e7b6652fbebb757b4d9b70ec1805349bbe5037
SSDeep	1536:fT6vTRVXHEOMYwy9OaKpBzYbNKE4qBy2isP72JLykxGuiIHv:fTwVXk3Y9GpBWKP1M72JLy/utv
ImpHash	-

C:\logs\microsoft-windows-kernel-shimengine%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-kernel-shimengine%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	c13d0349355209f215915821c73a8ff9
SHA1	3c4321c3a995ffe32affbd94d3943a791e3cfc9d
SHA256	608f09c08015e3810f16de96d52935862f639dc24f737b25cc178e6098398375
SSDeep	1536:Xlxrw64Gymv62AkOlCzO2B1sooQvu4/WgmBBZcqo0QgA:XlxrN4HIOlCzO2nf5mOA/QV
ImpHash	-

C:\logs\microsoft-windows-kernel-storemgr%4operational.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-kernel-storemgr%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	6f45b5a53b0977f5ad6fba0aa4ba69ba
SHA1	ddeefe029f7472fa951cdffefe49af960d30889c
SHA256	749b96782033b098ac61a1fef725aa41d8802326aac13fe865405570c603e1ee
SSDeep	1536:oq3WxnENwRmhyV35xwutrD115JLlSlhuubHP40:HWq+RmhydZB115JxcFjP40
ImpHash	-

C:\logs\microsoft-windows-kernel-whea%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-kernel-whea%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	3f4f25f80e032d1bf573958f28613ad3
SHA1	0304d98b96456bdfb7a145de9784a0c83e7860b7
SHA256	fc025106f9354a95af0da049a07c507b640d2707bf2f6ac5c2de65aa29a3366a
SSDeep	1536:ppL2mBu7pbdozLsJWduvFKzX1l5mV/glgOwF8LbmfIRskvcpZITP:gbqzvdudKr1l5mVIlLG8XskIITP
ImpHash	-

C:\logs\microsoft-windows-known folders api service.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-known folders api service.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	a5c5ab760c444e270db4bebcf1ed5a37
SHA1	3376850d3e6e4736133378978bb8a795fcdf4274
SHA256	9aafe2c3caf05cf191992edc6efe83f1a18e4d80f76e5dbd39958fcad0a1d2cd
SSDeep	768:hW6i8H6vuFgUJqpXnFrIm5JJt2e5CfKVHONPO/n1ATMIcaJSnP7C4pC9Zi3sSHmT:irmFrqdFFIeEfKVHONPOfCJmnjbrsSO
ImpHash	-

C:\logs\microsoft-windows-liveid%4operational.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-liveid%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	63b4edb9cde01d3c90ff5d3484038189
SHA1	cf9931c500e5231a9f31d22800a2cef9d647a559
SHA256	43d963a368bbd3ecf34c03fd20e458acbfb89d983a452932f551c031801ea541
SSDeep	1536:WydHoxoz9cRaRO4vRN7Jws6Pl39GyCjfYNzJeRIYem0oIg:W4IxlQOiWs6Pl3czfCzYIYFIg
ImpHash	-

C:\logs\microsoft-windows-mui%4admin.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-mui%4admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	f1ccec34f671f27124348d9b13d78cec
SHA1	d0f83ea5ad10aa73b37acf9238f1917af86516f0
SHA256	534e99fb5197f7b8db295bd7dd1694322b3badfaf3ea9d0730f784b1ec4ca39a
SSDeep	1536:OEh4n8X/C0Z3KrBj1gB/+WBiw2o0pTEJg0ncyCBIBiODKfw18VaSWr:OcX/CJrV1gB/FiwVgufw1fYSWr
ImpHash	-

C:\logs\microsoft-windows-mui%4operational.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-mui%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	bdab627dcad3020c6f91c94a57c1fb83
SHA1	d49e979bec9b8d601e0bd1c57458484050d96e9a
SHA256	54c297595f9cdccd703eed275027e3d104c4b82f7cec1af04469005d525bf81d
SSDeep	1536:1Hcf23dWR0mj7dghK7DQJnksMu1tTyhDD:Sgg3dAKX0MstTy5D
ImpHash	-

C:\logs\microsoft-windows-ncsi%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-ncsi%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	d0ece1f62a943825935d73aee84c5086
SHA1	28d104b96f39a1aef26129b8ba663bd2c994bfa2
SHA256	69f680b841f9a50b1a14497e6b4d085faff23753753b7554f7815e6d62b82f03
SSDeep	1536:OPgxo75xDna6cDsUWt55iwkg/ORjCvVay98sABAAp:OPVj/UKiwkljjy98Tj
ImpHash	-

C:\logs\microsoft-windows-ntfs%4operational.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-ntfs%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	febf50ab04088d6e9f07365c3e092fe5
SHA1	d083986d9d87b3d7c32ee1a8fec0b3ac171ca7e5
SHA256	1958fbb66fe99dca3ace44077a03d82b06535cb89d3fd87b1e49610034c7be4e
SSDeep	1536:3xMJsfXVGkntyjVhIuMQ26Rcv+Sg3cKQLJCthVd/j5y:wsvZn8jVO4lULJ4hL/ty
ImpHash	-

C:\logs\microsoft-windows-ntfs%4whc.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-ntfs%4whc.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	0e276bcec1e19f34946d3f3b37ee7014
SHA1	c980d220b7e483942fd05e023ffca1381763425c
SHA256	09779c81b40dbbfb2f3a91a54b9f45bf91f19c0d3dedeed79bcd96ad26f0b083
SSDeep	1536:Yex59qHI+R0ohhlGrHcJ0zB9+xSHYKdhQDXZ0H1947:YexqHIEBhc8qzv+xkd6DJaE7
ImpHash	-

C:\logs\microsoft-windows-resource-exhaustion-detector%4operational.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-resource-exhaustion-detector%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	5a94a85f495a3ea4f09b06988d2809b1
SHA1	0bd640e2ad252a3ff4c9fa93debd3726110a0494
SHA256	67a455dd64c1cc4d399ffd21f1d1ff43884daae2c96321aea2b53cbd0c8ada99
SSDeep	1536:fb+V/G+Dsax3CNZtHcCrEWulMMWSIEFDJv0RjGo8DP5AmfhdE1NkMgqxQsVk:zwGSszFgMMfIaST8DqmpuNklqxu
ImpHash	-

C:\logs\microsoft-windows-settingsync%4debug.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-settingsync%4debug.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	08ea701ac4bd9740d81ebf1cbb988d98
SHA1	2c4c8130ace5d5ebe746d6cebf5cb6a0de06af71
SHA256	24f2ab5ab6de869e84acea5da065a99942872872091a75c444c4824902507fc7
SSDeep	24576:bKEg9YpJpdFKSsJbekkBlCkWwcSU7DGv6T2:gGpdvsX3CcSU7Ql
ImpHash	-

C:\logs\microsoft-windows-shell-core%4actioncenter.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-shell-core%4actioncenter.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	e58c8d4bed3794e6262fe39a57ab9773
SHA1	24fd0116f12ebdd5df4b348c6ed07ff6eebb4acc
SHA256	47cc60c377e67cb280648c84e6e3287502ea24a9d6c534eb77cb780ec82dbe88
SSDeep	1536:NQf/ax3IFeDmE2dYA3zjFgbVNpBydbWXOT8SQR58vNA624rX:NQfypJSE2OA3l2VNvycA8SQ8vJD
ImpHash	-

C:\logs\microsoft-windows-shell-core%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-shell-core%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	708d9027962346a093820f01639b00d6
SHA1	d2b4dfdb18b36e1776cbecae786bc16753eed807
SHA256	0aaa395d586a58071ef4debf3957918a215f7fb0b40643599f76aa9f8d14cc04
SSDeep	1536:CdKGKnc6oZ9HSDIA9farO/aWt9bPWfgAxQfDL+LrAMy/TNtXiEnxD1lMTpm:j0ZS0uaIsgzDLgrAxaEnx1CTpm
ImpHash	-

C:\logs\microsoft-windows-smbclient%4connectivity.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-smbclient%4connectivity.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	cd52550d63408d20631113462e54d4ed
SHA1	d35c7f3949e3f1352d14002dd35e00425db0e2e3
SHA256	6f13df12ea20f853f1ef4a2e35178ff9d8f9d3fc6f7e8f3ba1901cb878bc0645
SSDeep	1536:9SPH8GwU7LiurVIVT4if3lA1O6N5jTtzXMVLDfmetPZinf42fjFUYTcs2WGbx6y:9SPc9UdVIZjVz6NdTtzXkPPZinBi3YGF
ImpHash	-

C:\logs\microsoft-windows-smbclient%4operational.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-smbclient%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	78273705768a208e34b0ffd6c141e4d8
SHA1	832ff3bfe1723042957752ce97a9c2dc94c9ea97
SHA256	5dcab062b4e4bfd060d3ef46ff5d827091bcb69e0148a86ce80d2d1cb7a1141a
SSDeep	1536:MDrqkFCrW1gOydJXD6wQHXOBV1f9KOB4zEW6mriIIT78m:eWk5OdVD6wQHX4VDKL6mrhIV
ImpHash	-

C:\logs\microsoft-windows-smbserver%4connectivity.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-smbserver%4connectivity.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	bc89b251f963e5b9f7d28e5c4bbecb0f
SHA1	63bd8f7848037382a05f3e7f62623e9b6981a5ad
SHA256	113978fccb6ff4268fc96b7b1880f20280cd7af1d0438a417d44663abe976870
SSDeep	1536:XEUckR/gfBw1IuBrVKfwU+gbeiUkeRVvSSuU/zQd44Eb:XEUcBQIu9VKfwU+4UkeRASZb
ImpHash	-

C:\logs\microsoft-windows-smbserver%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-smbserver%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	5d50169a8a0a9f1d2be707975f8dcccb
SHA1	91eba7d467876ecc0eea47a897fbc475a2fb38e3
SHA256	22e7e943de2e93c60805a0882318609624b6a7857195ffc141d2dd059a3cc242
SSDeep	1536:Ll5I2zDz41NNNwd9V33ccYSC958vMiAq/es/6/XrVpsh1W:Lluoz41NfwdT3ccWukmeJXkM
ImpHash	-

C:\logs\microsoft-windows-smbserver%4security.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-smbserver%4security.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	0bb5bf28c8c9f9fb343723c0f12ba807
SHA1	269ea5805b94cb45ce83b9bf52b2b42345069c62
SHA256	087d19618df0097c04d43e89aadaea7be932d9c10c1dff406c0993c488c4301b
SSDeep	1536:2uvDG5cMXJrJ51fFz0YlIeedU4OtTJ6ZoDK0eMqVi1xPEk8the7:9bG5cMX5J5Lz0YlUdUmZodL12k0g7
ImpHash	-

C:\logs\microsoft-windows-store%4operational.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-store%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	af889d0a5ad8612dc118c0e42a17a4e6
SHA1	746b88d5a68f53ecf0745532b0828850a6738476
SHA256	877dd1dac83af15886691ac4378bae32181fd15549286091690cbb787ab6d6dd
SSDeep	1536:W/awAm5aa7s4o1kmfxPv37a5PYpcrlM+wRCku4LXDfI18fcA:W/Am5ayhkkmV7a5PYCrlepXDg18fcA
ImpHash	-

C:\logs\microsoft-windows-taskscheduler%4maintenance.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-taskscheduler%4maintenance.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	4b14a4036ce16d55dd6a84299792cd7f
SHA1	918659f2fe41dba52554636875872cbdcf047db9
SHA256	0269457e2203b3d126f47be5403a7dec4f228305b9453f70ba569b974f8f3f99
SSDeep	1536:IbBo8RSCstoQv2X0E1I+LrV0Ulf9of9T+iAhlRJKqwMHc3UAuT/FD:IeHCsto2m0EdHBfA9T9SJXwuv/FD
ImpHash	-

C:\logs\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	6dbbdb4aa93f6bf190c393608ad6655d
SHA1	a434d86e146db51dd7cfa75fd4587fa8921182ce
SHA256	edb8ca96b0035c1052c9f99ddebe93fada9a7600e1f574e6588bf2036fb7b892
SSDeep	1536:FPHx+VL7QoW8oKkLpF9wf+V6sq3uzG6/W/xQYOhDgKoCho7F9txn5:N6HNW86v9wm673uSCW/xRXXLF15
ImpHash	-

C:\logs\microsoft-windows-twinui%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-twinui%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	c378609c8c5c2507d32378dec1bdbed7
SHA1	ac2dd389fa304a77285c6228b29d05f6730b0ae6
SHA256	527035852e3acd0969041a892cc7df84d0fee0206d1905f49e2e54a5488ecd9f
SSDeep	1536:bivQLiiwqD2mXw8apZmOWDob6uIlnPWD/x1y5l0aNd:9VDNXwpZm+6pYx2h
ImpHash	-

C:\logs\microsoft-windows-user profile service%4operational.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-user profile service%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	c2539b9dcdb6dee71445e9caa9993a18
SHA1	7931221266ea89e1c0698fc2d24160966e76f4e6
SHA256	0707a0fd1becaff5f66617bd2493ea578fe0083be1a23d7cd17ff9627507e622
SSDeep	1536:uqT0n78LVdTq8X0NYm1y+1XxO83V1ts0hJ9iqr9hqN2:uqTM78zTq8ENxd96k
ImpHash	-

C:\logs\microsoft-windows-userpnp%4actioncenter.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-userpnp%4actioncenter.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	f115063aa25992cb27c3b2197e0af7e5
SHA1	4d5aff1b51d67f5c6352d4b84f7ab93c24de5a95
SHA256	82012b43940d586e8ac869115e5e7660d812b36a2978d79556e5374a74a1e295
SSDeep	1536:tWvh3SgOoolMMHanOZSMUOyaSd14Xee2pPYugw7ArJ2dxoU+6lOlG0LxicN7TD:tWvUg4d6doXee2V3gwIo8sOFIcN7v
ImpHash	-

C:\logs\microsoft-windows-userpnp%4deviceinstall.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-userpnp%4deviceinstall.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	2a6915da0edb8a2575be4c0867474edd
SHA1	83fd7a3764c4795d0323a23114307dbbcaabd4b1
SHA256	dc4b3ffd2397a883d3b822c89c058e4d1797145a046cd141e14d136bf5e4940c
SSDeep	1536:mnHdZbLnQeRMR8wUE3m+lx3h2TB78ny5qVJbd7zkf2/kOPBodx+CxACJ:mnHdZ/nQS18lKB78nrVNph/kJdx5nJ
ImpHash	-

C:\logs\microsoft-windows-volumesnapshot-driver%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-volumesnapshot-driver%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	16eafde533117e848af79fa21597abae
SHA1	f9851e29dd94dba4a58371cebeed27105c5d5ba7
SHA256	f473f0207f85f457ffba43fd051f628d73faea615358eece7fb1d9702e1111ac
SSDeep	1536:jA7ejhksQ2j98MBZ8aOpqcotzhEoWwHPOThUvo08K5JB9eY4p:pSsp9DB9ShodhEIPOTaD5JDet
ImpHash	-

C:\logs\microsoft-windows-wcmsvc%4operational.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-wcmsvc%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	7f8e225f3de9eb52e15c1d50a66eca4f
SHA1	66acd4184aa856f213cb5e85ff4bc7e5c8fb78a6
SHA256	f798c0d0af6129981e212ad452c5db96a6cbb6e29fc607221e438ee95381e0d7
SSDeep	1536:7KxGyuZqOMNTf2ToSIuIoJ02KnLuQtfeQF+dO/PSKfNA:7uoqOMNmbKLTj+k/aeNA
ImpHash	-

C:\logs\microsoft-windows-windows defender%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-windows defender%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	6812c0089a38df2bfdd1f76203a2618a
SHA1	a16386d6158ad7e7068a1291ef5fc1dac6776b28
SHA256	a1339ca2878067b7849d81ae46c30936b7b679f45f27bfcc255f1bc064615259
SSDeep	1536:rhoD1H9OXp7PzdkJqsyo+Ryf7LoVTXG10VCzTY1i2P16zKW:aVMXfyqy7cVTXhd13cZ
ImpHash	-

C:\logs\microsoft-windows-windows defender%4whc.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-windows defender%4whc.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	5da09f6289548df7eb957b13471ae4d2
SHA1	044fb966bc34e2f71678427d942339c2bc4c0051
SHA256	7c83247674f71836f213c02ef05d72d146a3ed0bfdbc640c34277ac2b682cbce
SSDeep	1536:clYVukJCnPz0IBd5pX+U6n7DL9e4WbDbk4zWbyJ+9gVGRr:pJCZJXf6n7DL9nAg4zWby00Sr
ImpHash	-

C:\logs\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	7465d9623891693707df9fb8129cf185
SHA1	c16681e7683a82006f6c7493aabce499382013f8
SHA256	57bd394568eac247c1335f553ea7f2a0e1d10d9a8f7686cbd7fd50114f1659a1
SSDeep	1536:Z1jDb10dMg/6ON6iLzDI4k5hhQhWVdrNQmy+bMIjjHDCb9dir:bDb10df/60D6dQwVvQViVDDWzir
ImpHash	-

C:\logs\microsoft-windows-windows firewall with advanced security%4firewall.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-windows firewall with advanced security%4firewall.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	f8418ae651e1da2fe285b9e2d124d19c
SHA1	e177279c0c5f41b320eb5f1bf1a18dc7a8e3d5ec
SHA256	9d5dc2ec8c47dd5d8416fb2f1fede50631086e52391315644725b00a40e46069
SSDeep	24576:J2iqtANQv0mltAPl3Z9zfKarT60cgghj+TtxUVh:J2xAS0uAa0cgghoTO
ImpHash	-

C:\logs\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-wininet-config%4proxyconfigchanged.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	9ecb43b1fab588646992aced6b7e2f08
SHA1	3d07529eab65a8dbc2bde9826e8c3339c5a56cae
SHA256	ba633fc40f1089d2399f9946a992acb49a61c388542ba8f43557be99b0fbfb6f
SSDeep	1536:hgJ9eVffbQHqxb2yY9r5eoQUuimjlFnXgHnDgRAtOW5IWZZtZh60:89AzT9Y9r5LQUuimhFXgDgFW5jth60
ImpHash	-

C:\logs\microsoft-windows-wmi-activity%4operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\microsoft-windows-wmi-activity%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	4898fe5ce344676811df9f1eac08cc7c
SHA1	43309a69239bcc1d2e2c489a42951071a6150cfc
SHA256	7a5dd79e57e7b780e07b6a14f535b1dccb4df242929ee877d62e335b8c564c07
SSDeep	24576:jqOs2r4SS0DuQ/xd+AzMOYkfChbHuehLUl8WeYwHZAs3xpP3:jqO94SS0DukNMOYkqtxLGbe3isJ
ImpHash	-

C:\logs\security.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\security.evtx (Modified File)
Mime Type	application/octet-stream
File Size	1.07 MB
MD5	557cd730cd8d3556c91c781b11377324
SHA1	8309be1b4ef37d9611c6bcc60abaa65b805bcdad
SHA256	a3ba05009662aa8f050c79d338fd85df32b5909a420a6441bb6dc211defba8bf
SSDeep	24576:I82QtrNngUDcMA5ghTITLLPKP1BBAoYA8gSc1L15Vcxp:btrNndigGHz2jP8Hc5c
ImpHash	-

C:\logs\system.evtx.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\logs\system.evtx (Modified File)
Mime Type	application/octet-stream
File Size	1.07 MB
MD5	506821a027f29f1d36d5c1f63d6278a4
SHA1	a08b2277a2f8299d38b9ffa37c548c8bfb01c801
SHA256	41a6e044707d16f307b1ad855fd4e0190369639c89ab91c707ba3e4c00a46091
SSDeep	24576:gewjMOuujvzDW0QQS5bRH2UiDd8UusMNAJxwAU:yzW0QQS5lH2UgYsMNEC
ImpHash	-

C:\logs\windows powershell.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\logs\windows powershell.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	dd3c24e2d1595e5873a0eb313c5f5044
SHA1	24871492f9dcee114ec36e79d4efadac52bc2d6d
SHA256	bdfcca0f840f8db4e141e8f9abe588a3ae1ca7f1f1a0c25a31cf383e55a5b293
SSDeep	1536:uKDajkwBMrJrO9setLsMBZyZQbiCi18ubM3iWzUJFsRRo7lvTNl:JujfQrKtts4i4Pz0LNl
ImpHash	-

C:\program files\common files\designer\msaddndr.olb.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\program files\common files\designer\msaddndr.olb (Modified File)
Mime Type	application/octet-stream
File Size	16.61 KB
MD5	114779c6c54c5fc9a5ea54a3f81a1962
SHA1	8d07d4196306909fde7f5ec98f6f10f9a51cc2f1
SHA256	63459e3bcd75153fcfed41fd720ebe045f529bb88d286fa7062cbd76e6a42f9c
SSDeep	384:AlA8oJLGOIWtRoskqXqu4I8fj/F2ctbncA66CF2E/3GMO:AlATJSOIWLos1qu4I8fj/F2ctLY2GGP
ImpHash	-

C:\program files\common files\microsoft shared\clicktorun\c2rheartbeatconfig.xml

Modified File

Stream

Unknown

»

Also Known As	C:\program files\common files\microsoft shared\clicktorun\c2rheartbeatconfig.xml.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	5.04 KB
MD5	4053b009358578715a7fc9ee5a5e2c99
SHA1	37683eb8c8f19920a933ac5b5510ff17ba007667
SHA256	8f0e36b41493c82670adc6781f19a23ed1003eba6192f6d84cb6a960b09413c8
SSDeep	96:7FcaLw+DI+KZsjZs9y88q6SeYs7uaIXmuPZTjq4qw5PZGa+:pw6MZsjet6zYou/2uP84qw5xt+
ImpHash	-

C:\program files\common files\microsoft shared\clicktorun\officeupdateschedule.xml

Modified File

Stream

Unknown

»

Also Known As	C:\program files\common files\microsoft shared\clicktorun\officeupdateschedule.xml.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	5.67 KB
MD5	290a631cdbd67fd588924d4d989ce98c
SHA1	531a5aaa5de9ff6c21b6ae4aeb1d64a200d1cc93
SHA256	8390e800cd34722cc6792c1ad9ded59c3bc5a485b1b9d36560becda233f3da31
SSDeep	96:7b1TINw85gbO3T9M3rpuhOWVtkbCnKmXR5oLFVtLZA/PRBjJf:VTIRvji3nWkeKmXRtPRBd
ImpHash	-

C:\program files\common files\microsoft shared\clicktorun\servicewatcherschedule.xml.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\program files\common files\microsoft shared\clicktorun\servicewatcherschedule.xml (Modified File)
Mime Type	application/octet-stream
File Size	5.35 KB
MD5	f614bc93832c33b235dc6595da190dda
SHA1	7adab0841d3dd3e6233de112895bcbce50b3165a
SHA256	ac74a0023174fd2f4029507d33c6621cf83760c60dbeac9116db7025626221f1
SSDeep	96:7uc0glp3UmK3rrQasHRN+C9qmqyjdHu3gNwESGR7qPUUPLnXr6:XFRf+CMmq0O3IwqBUzXW
ImpHash	-

C:\program files\common files\microsoft shared\office16\office setup controller\pkeyconfig-office.xrm-ms

Modified File

Stream

Unknown

»

Also Known As	C:\program files\common files\microsoft shared\office16\office setup controller\pkeyconfig-office.xrm-ms.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	577.68 KB
MD5	c18543d4a40ed5922da012ec0a21580f
SHA1	207cbe3e201f6cd1923bc068297c55c750a0b576
SHA256	4846a6fe42c9339b8704dd04ca92a73ea22ff77360e93339d6100880057c02d0
SSDeep	12288:/XAd+6ig96yDGxsPqm7AafZ0KnNoHa3DzcWmaiuVBHyFpbVygyNG3qy6J:hg8y66Pqm7A5KnNo63DzVJgzaNI6J
ImpHash	-

C:\program files\common files\microsoft shared\vsto\vstoee100.tlb.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\program files\common files\microsoft shared\vsto\vstoee100.tlb (Modified File)
Mime Type	application/octet-stream
File Size	17.65 KB
MD5	3fab7cc0d125bf23b57b23f22faf313d
SHA1	8a78981c538eb7f47743e2b977db216279980877
SHA256	c269373d46ff3ee4c8883f251f0360dde13d4f97eee4e41f413b0e9aac6ad056
SSDeep	384:WgtKV+lGe7PIt73UFgsLu79ktOIhGG84NdttbX:WMK+lX07b+uZ4Zh1tx
ImpHash	-

C:\program files\common files\microsoft shared\vsto\vstoee90.tlb

Modified File

Stream

Unknown

»

Also Known As	C:\program files\common files\microsoft shared\vsto\vstoee90.tlb.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	23.15 KB
MD5	f20002f7edb703feb013c3779620e069
SHA1	4257304f9bab14069b423d694e1d6ff5119f8f7f
SHA256	5fc424ba6469f3d2f2db1585c6c715649bb647d659479f659bcbfd98a0a8829a
SSDeep	384:/XZjPROOsSwazYHMm5GU+mBnKTrJoXEaRI+IZW1jBypc09djEwfmx6mpHpehvDY:/XZzRMlHcbzaXEaRI7ZotSc09djEMmVx
ImpHash	-

C:\program files\internet explorer\signup\install.ins.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\program files\internet explorer\signup\install.ins (Modified File)
Mime Type	application/octet-stream
File Size	1.44 KB
MD5	05130765fdb1db3b4765ebf62667b061
SHA1	0dff1ecb7ad3a58d1df9275c133238393d324394
SHA256	00d8e47096e450f345852b80fb393acbdabe6f4d569ce7a24afde18a05edcf2a
SSDeep	12:7lw+4RJ+4vsAUZemjfk8brC6+owxQQqLsUmmr+WJlLmcn5iAzTgAF3WjAoHB/8hG:7lN4qJZP7q64sH3JkUZzTsH18yuCf
ImpHash	-

C:\program files\java\jre1.8.0_144\bin\javacpl.cpl

Modified File

Stream

Unknown

»

Also Known As	C:\program files\java\jre1.8.0_144\bin\javacpl.cpl.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	184.00 KB
MD5	19cdbbc255e11da0aca59468666600d8
SHA1	b46c5a6291cbe92c7361d8ae7761c4c7bdd30693
SHA256	5fff51602efd603819a2caf34f2ec37dfa5e750bd2f2362b9f91685019c5f5d5
SSDeep	3072:fY3EXCnogL+Yh1k3VM/VH5xwIZkNGTNgrewgSLg2oBaI0HVY/Khtw:AAgLP23VMtYUkNyu/gpnE5htw
ImpHash	-

C:\program files\java\jre1.8.0_144\bin\server\xusage.txt.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\program files\java\jre1.8.0_144\bin\server\xusage.txt (Modified File)
Mime Type	application/octet-stream
File Size	2.39 KB
MD5	8876155b7d791035d27178f29a5609b9
SHA1	f9d897c1452257a69b724fb2111ac547f07dfef0
SHA256	c2401eaa391c772fd1388d684582e1ff9fd4a3477db89c7199556f313cd95865
SSDeep	48:7loz7xcYiJGl5/8dq94ajiiPfYYJDmzj1IH/2X79HKvH+UrbAlCtDuAShiS:7mGD04WiiYCDmfGHeX79qvrPVtOhiS
ImpHash	-

C:\program files\java\jre1.8.0_144\copyright.cuba

Dropped File

Stream

Unknown

»

Also Known As	C:\program files\java\jre1.8.0_144\copyright (Modified File)
Mime Type	application/octet-stream
File Size	4.17 KB
MD5	d40b055807a87541d05f2995598f69e4
SHA1	e0ede8aa532ceed3bff09e65b60736b63b5a93e8
SHA256	deab0de01a3e6f1288d9051eb109b254074bcb55b0d399b50ab56affdf7c3c1a
SSDeep	96:7AHILTtF57iD/AeEypMG7uc2+mFDK5s1G9mqyNLWyOqnY8ehuQnqvtwPjx:M0zS/cypP2+Z56hNq1qne0FKx
ImpHash	-

C:\program files\java\jre1.8.0_144\lib\accessibility.properties

Modified File

Stream

Unknown

»

Also Known As	C:\program files\java\jre1.8.0_144\lib\accessibility.properties.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.15 KB
MD5	ed40f306cebc39766a04f830cc9256e1
SHA1	b53daa7d9972ca13a78cd62d17dac32d18071ae0
SHA256	f09139da827773dd7d664ebdaf269a2958fbab5f29e4478e45be5c626df79966
SSDeep	12:7lPbgWwe9if8v2Z80CeGXHEB5ktW3fpGohOFKPXvajmWhwx0Lv7tjtmwg89:7lPGmuAzkB5T3vEyaFwx0Lzmd89
ImpHash	-

C:\$getcurrent\safeos\partnersetupcomplete.cmd.cuba

Dropped File

Unknown

Not Queried

»

Also Known As	C:\$getcurrent\safeos\partnersetupcomplete.cmd (Modified File)
Mime Type	-
File Size	1.56 KB
MD5	64d1b07301f2cace6627ad88046d23fc
SHA1	d7af2c7046539ca9f052a61fec406d8568e5c6ec
SHA256	676562da6e925b2c7c2b8aba09a473a693903a9715a2020f295c46d32102436c
SSDeep	48:7lRcxCfNrhMPa20+9c1q/QIeMHVuqAmh8wo:7j6+hMPaBe7kdWo
ImpHash	-

C:\$getcurrent\safeos\preoobe.cmd.cuba

Dropped File

Unknown

Not Queried

»

Also Known As	C:\$getcurrent\safeos\preoobe.cmd (Modified File)
Mime Type	-
File Size	1.07 KB
MD5	331b30516eb14cfa8120e7b449ef07c9
SHA1	0abf6ecc3db52c70d24cf860d8e70e02796c3248
SHA256	434635074960b9bb2220214c56017b2eee9124a293df1c3df4ac6989c26a8ee4
SSDeep	12:7lzsCefoHu6JGJueFoo9ZbtiyKcYOwOG6BIuRPXhSP4yXrdnb:7lzsCDHrJGJYo9ZhidPOa2UAuJnb
ImpHash	-

C:\588bce7c90097ed212\1030\localizeddata.xml

Modified File

Unknown

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1030\localizeddata.xml.cuba (Dropped File)
Mime Type	-
File Size	76.93 KB
MD5	7fa293b176a9419299fb20995a0533b7
SHA1	4b3f4e72c5b3f9df437aec45917c1a6a46f1000a
SHA256	40b7fb4606b8896bcd2f8458609d6a692df72281652be515b7918457dfb46de0
SSDeep	1536:VKcN1xGTTWZ68PbgLKRit9nJFLxl926swmQvpo5GIxrc4+/EIIZHjTXhDoW:VKcjxGutbgLKIt9JFLxC6ZvyUIZ+/ZIp
ImpHash	-

C:\588bce7c90097ed212\1036\localizeddata.xml.cuba

Dropped File

Unknown

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1036\localizeddata.xml (Modified File)
Mime Type	-
File Size	82.02 KB
MD5	965e84d16d6be9583fbe1b96e10113c2
SHA1	e9ac05a48e5cc0529c59061837adfe047d539e94
SHA256	498632fb347cbdf6e79e69caeeefe98204bc9ed98ed0330acfa326649d42045f
SSDeep	1536:0rKNGAE52J4FtXruizmS+ueh/vWK/wwB5MKhoE3aTagCuWtzK0OaaTr5peq0VmPV:0rKNrE063aS+uE/vWK4SzoNGruWt+0dQ
ImpHash	-

C:\588bce7c90097ed212\1043\eula.rtf

Modified File

Unknown

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1043\eula.rtf.cuba (Dropped File)
Mime Type	-
File Size	4.46 KB
MD5	45a735cda8b21a2bf6e852537f39d12b
SHA1	2357c0d7fae7001db24826696afebc77ddc1ddfa
SHA256	a59cf3fc591e663a1d741d596ebe6713ab21097460788cabd2eefb27aa19d027
SSDeep	96:7g2YyAVDxRqJUdLzG7mY3GPiSbNLK+KvczmwozkrXEYO273VBI4:k2YyGRDHPigNLN9nOulh
ImpHash	-

C:\588bce7c90097ed212\1044\eula.rtf

Modified File

Unknown

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1044\eula.rtf.cuba (Dropped File)
Mime Type	-
File Size	3.97 KB
MD5	fc20fdbc0f6fc35afdeb00bbd309f9df
SHA1	c3f1fab90047e0f6c2bb779acad5ea8241c7629b
SHA256	a33c6480cd08f4a93f2790610b883ab2d9562da1a56c25690838c0c36c8d826c
SSDeep	48:7l1XCRArN1VaAtmHQfTNvENqf8AjgV4YOMMa4h0S7RjJseHZi/nyOEVXP9+FPUz:7Xi0fXt0OTNXV7MDS7hJtZ95FA8z
ImpHash	-

C:\588bce7c90097ed212\1045\eula.rtf

Modified File

Unknown

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1045\eula.rtf.cuba (Dropped File)
Mime Type	-
File Size	4.95 KB
MD5	6437251ff1ca2bd43498661b0c881450
SHA1	fbfbc9fc730a6944e9c9185504c284d448b6cd3a
SHA256	d9a34d6c73b18b60d56055a0ff25ac59d5869458082773f297a22e9bfc5c5cc1
SSDeep	96:7ILkbRv5gMj5YF0Zpft2VuiGBDL0OiVjNf1Th1EH0b/pGOi:cLkbV5gwyo/B6R5jpPi
ImpHash	-

C:\588bce7c90097ed212\1045\localizeddata.xml.cuba

Dropped File

Unknown

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1045\localizeddata.xml (Modified File)
Mime Type	-
File Size	81.44 KB
MD5	95df90b2b13229a9f4d574719ce95c0d
SHA1	ab7312269fdc383273c8f00ae784d82f0759317c
SHA256	26a05adfe504601baf7b700b558b818400a08c27a2bf78bc40cc2204a098c3d1
SSDeep	1536:EVGl/ZOTSSuBTp4GMV+TNpFbwuUz2gYdqrZGarCuCpET9ut1puWjD:EVGl/Z9THCEyuUzK6cm1g6utT
ImpHash	-

C:\588bce7c90097ed212\1049\eula.rtf.cuba

Dropped File

Unknown

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1049\eula.rtf (Modified File)
Mime Type	-
File Size	54.18 KB
MD5	d596afc3bf4cb75382767af0a0d3fd50
SHA1	daa93cbe37b710fad9098ad599bf9ca9c1b423b1
SHA256	4262f7d6246f7b8f46e766e90cf566f56982be44c782b8adeb0237cf6eefd4fc
SSDeep	1536:AoFzGNFtS107jfH3An8dJov7GAURK9vBFKKxzW9jO6xzz4IOHgtf:AoxatSq7jfHU8dJoTVoRKlWNHpz4THgZ
ImpHash	-

C:\588bce7c90097ed212\1053\eula.rtf

Modified File

Unknown

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1053\eula.rtf.cuba (Dropped File)
Mime Type	-
File Size	4.77 KB
MD5	529b6f2f28f71c19cf18e11c8bfec31c
SHA1	87bc5f3de2f6613b4cca524076bcbbda1ab629a5
SHA256	9865dbcfc40b81b8503109d0ebf7e392ce7f801155ae562014903e18ec904f02
SSDeep	96:7KixuLRtHDKoXieSCbJ5sNLiMQIaXHUut39C/vDsx7Ec3XE0o:W0uLRtjtH5sNL9nut3E7sx7NXO
ImpHash	-

C:\588bce7c90097ed212\1055\localizeddata.xml

Modified File

Unknown

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1055\localizeddata.xml.cuba (Dropped File)
Mime Type	-
File Size	76.02 KB
MD5	48cf75dfe62db784b7a9d9a5969ee471
SHA1	00dca7bfd6ad1cbd3bdeccae97cdf42154428dab
SHA256	768e66040922d5cbf89127ed68be0c97b2f157dd8fb75f3858afeaeab68219de
SSDeep	1536:cX9Jmrq+pryZSg9nZtMSzf9IV6TImVbQkK8pauR2fzZNnz:ctJmrZNykQnZWyI2Vs539Nz
ImpHash	-

C:\588bce7c90097ed212\2070\eula.rtf

Modified File

Unknown

Not Queried

»

Also Known As	C:\588bce7c90097ed212\2070\eula.rtf.cuba (Dropped File)
Mime Type	-
File Size	4.92 KB
MD5	45c0c730bf316ca75ad056ee9073363c
SHA1	7dc3dfaf34f111d0e94fbbb3e35157edbfa1ac76
SHA256	1ef0581acf13d7bac4dd362dbf87c0e60ffdc9768106b1f0d593acaf6e5c5bc0
SSDeep	96:7I7JAJWbebqWVjAjq718e1tqTh8zAfNfDvIiJAR:8CJWbYqY8jE2VhBNLvIPR
ImpHash	-

C:\588bce7c90097ed212\3076\eula.rtf.cuba

Dropped File

Unknown

Not Queried

»

Also Known As	C:\588bce7c90097ed212\3076\eula.rtf (Modified File)
Mime Type	-
File Size	7.16 KB
MD5	0a4e60dd5cb12e6cf70776602d50bec6
SHA1	d482adfc06dece9069234e073566b5c4ef3591e3
SHA256	2854678ba3137eb91ac147b0765d55231c9b6224671b2bb58603af5523d2e735
SSDeep	192:D2IbADEKWRSNeehc/WY81TJHJuFOQyDQ260YOZ95HCS:D2Ib6WChcuMFoQL07X5Ht
ImpHash	-

C:\588bce7c90097ed212\graphics\rotate8.ico.cuba

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\graphics\rotate8.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.87 KB
MD5	4db7806ed18b250704d1b0da98399af2
SHA1	cc238072f0af56780a3528b535bb0a2037b21930
SHA256	5942f5ddc6bf05c4c0cd15201edba746d3b3917a65491d1917265ff540f60abe
SSDeep	24:7lHxSUyNTwkhlYbVcUet7gu84PPbVQM6dXygAm6FTogvPoYM0YgRrVw5egn:7lHEnNTwwjt7g+bVQLXGJvK0/rqZn
ImpHash	-

C:\588bce7c90097ed212\graphics\setup.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\graphics\setup.ico.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	36.85 KB
MD5	bd3db5af144cd2ae66e317e327041120
SHA1	7ac9b5def444ed6c6660427645dbe11d3338ceea
SHA256	8df4eb382b29761c70da63ac9bd5e429545c82dff3ce6fbdf1b301f709b37d49
SSDeep	768:2xCxV2giFtqtMpdgT56+orokEuNfJdOJuZJp/Jr:fxV2vOIiQPoGRSG5t
ImpHash	-

C:\588bce7c90097ed212\graphics\stop.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\graphics\stop.ico.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	10.90 KB
MD5	d7135b7a14a98371241d7bee46219734
SHA1	581682c3307d75485a12a1dd7a1ff1c60613846b
SHA256	26f56bedd1f741e855d69e1e901f74cd9498e5fd5bcadd6a3dd7a7364aca4de2
SSDeep	192:3nas8NB+awg5UZc59yC8ncgOAdcrkoBJLYZMYseVV+8YeV++ghzKmy/22QG/ZgQM:Ks8rDP5UZcWn7KwspOswVb+LtaHQG/K7
ImpHash	-

C:\588bce7c90097ed212\graphics\sysreqnotmet.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\graphics\sysreqnotmet.ico.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.12 KB
MD5	6c77423aaee1a3b94d1772fc67f408b0
SHA1	1cc91253e958f944ecd75aea3326c8ed5a26e414
SHA256	dbec24818e3ec721dbc9ab16392ed6fbc67d224da075846c7f841404a5798aac
SSDeep	48:7lZgr17rt1m3aTnO7HWcO+Zrg+tlJEnRsSO5DZd+XL6Lvxv:7cnU38naWD+ZrztHE05DZ6K
ImpHash	-

C:\588bce7c90097ed212\netfx_core.mzz.cuba

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\netfx_core.mzz (Modified File)
Mime Type	application/octet-stream
File Size	173.08 MB
MD5	778d8a2bf09e34b07eda914b2d634a8a
SHA1	65c4f0224c8c75bfec229debd9de22e24dda9a31
SHA256	20aac7ca6a6fe2c83bd29dcc4d605af2091bd54721109d9ac659d07116d269ee
SSDeep	196608:3qMJQ3Orv04YyKSBXZ35w+KBK2KJKDcloT46ooP8ZNoz+hK12RP1O7lT:aMJNc4Y7qZ3CwFISoT46ooP8Zyz+hm6a
ImpHash	-

C:\588bce7c90097ed212\netfx_core_x64.msi.cuba

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\netfx_core_x64.msi (Modified File)
Mime Type	application/octet-stream
File Size	1.81 MB
MD5	50e3d21e5b16420f910f60388852e362
SHA1	5929fe7e80246e654bf5e5de43b13be562d1d8ec
SHA256	19099a206f1cd8e8b65daad580d23efe968a85341f102d17e04412de46bc3fc8
SSDeep	49152:uVrBDxQ9yILuPhyXDi0cLPg+L7mYRdCublzf:uzDkD6PIDi0cLPd2c
ImpHash	-

C:\588bce7c90097ed212\netfx_core_x86.msi

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\netfx_core_x86.msi.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.11 MB
MD5	2f0adbe1b04666860258ed641091dc5b
SHA1	9cf259533171bf5207c54285ecc9ad4973bd4d0e
SHA256	e8ccf384e731807fe230999c58f8605c37ea6f13ca4bc5fa111d66d689c0d053
SSDeep	24576:udySfGc0LxGnRE56g2F25MW8aSVaF9BEgQ:ucSacRE5Zh5MW8yFjQ
ImpHash	-

C:\588bce7c90097ed212\splashscreen.bmp.cuba

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\splashscreen.bmp (Modified File)
Mime Type	application/octet-stream
File Size	41.12 KB
MD5	a3ea5532bba3a77a060c065c31e7f264
SHA1	b3d166a039ca5e019a3424061be045ab8117a4d7
SHA256	c8762a1af7112538f43f2480f2e8c034adad51146c49209158b689e41d58a4e7
SSDeep	768:P8MkWKeWP5hGe8oYpdGseyGEKs9tOzEJdcS6XVQB7u5VezJxoH:PDkaWP5z8JIsey5KsPOzEzB7IelKH
ImpHash	-

C:\588bce7c90097ed212\strings.xml.cuba

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\strings.xml (Modified File)
Mime Type	application/octet-stream
File Size	14.75 KB
MD5	80fdb6f4c3e3957a92e07c2ce5cb6680
SHA1	172cceedbd660df6956f35327d2d3c73a4b1adc1
SHA256	23912290b37e96682e1a60510202b7b0df1619242103995638a554f023ff59f5
SSDeep	384:8tF9/DkGWlZGVK0pL0Yx/v2nCnzRmnf4F:e4GAxA0Ev2CzRwfa
ImpHash	-

C:\588bce7c90097ed212\uiinfo.xml.cuba

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\uiinfo.xml (Modified File)
Mime Type	application/octet-stream
File Size	38.99 KB
MD5	1efc9f372844203ef797d14fc254be7b
SHA1	4aabb872963645e15741587ea51f33ec80ea8840
SHA256	a26d4cf59d74a297b6b8ce214c29885dc3ebaff30ce23ae65c16a102e88ad55b
SSDeep	768:aGqMDVYWk9q27IS9VP5UZErGne9UXCFDwrbjKsQ8W7x6rmtDO4h:cMDVYWkw27IS97U0fybKHRK+7
ImpHash	-

C:\588bce7c90097ed212\windows6.0-kb956250-v6001-x64.msu

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\windows6.0-kb956250-v6001-x64.msu.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	4.96 MB
MD5	fe2d2bd923e72f4288cf3c07abedd144
SHA1	de4ebd64b40011e9eee6cc9bba1174d4e1930768
SHA256	88cf605956253b98cf4212db49533c0b517979a1119df43d770f9a63a4ae47c5
SSDeep	98304:4dVxAU0x5AyjUjX57BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKJhl8:4LxAUi5UZBkOK2Knq45mY4H5OMKkKzl8
ImpHash	-

C:\logs\hardwareevents.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\logs\hardwareevents.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	f5088c9723572b7f83942532b0894745
SHA1	98e23c9f90e460f4e94e912348a1080e8f59cb48
SHA256	6b43ba971219868420f5e2fd55d22cf5024d535886c279f2c951979a3eae53c0
SSDeep	1536:d62WvF2CHY5i1gv5zyDKxe8GD3iQdrOIOWsM3NLdui2YJ9g4db:dzWNF45i1i5vx6OylscLuipHB
ImpHash	-

C:\logs\key management service.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\logs\key management service.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	d1959b20f6a8843ff23778b27f124f6d
SHA1	0aeeac77198fd43d534c9542183ea230c47c401d
SHA256	d63509c0c46c7a84afe45e2e30c7d94237e8bfd8d163b8079e83e1dc618cb514
SSDeep	1536:LrgGhnTyzOVHJvvVk8iB4/VsmAxEK5PGp/546dBv3nMOd+jF4TSoPn6qhWqNPGw/:L86TyzOVxvCGV6xEqGjnnnddxnKqMw0c
ImpHash	-

C:\logs\microsoft-windows-applocker%4exe and dll.evtx.cuba

Dropped File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-applocker%4exe and dll.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	af21f92c67cceb841608c6ffd79c5518
SHA1	d3eb34fa1772aebcf356ea864182c31a76565449
SHA256	3e3fecd04869deabaf63a97e7022c4a3b9b9f0205b04b3233e267736afb4990b
SSDeep	1536:aFrLYGJjeHCH80UKHBFSzGkre3zb6FUTgSq/HRTLqrhM9udh52tCucfpXuxiJ2H:oYgei8cB4Fe6FmnqpLUhIgh5icfhuxqm
ImpHash	-

C:\logs\microsoft-windows-applocker%4packaged app-deployment.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-applocker%4packaged app-deployment.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	93df6b71cced6a8b003acdccbd48ea62
SHA1	1c1dfd4e1b16349e6dd8b9abc2c7e86fbc4c0cb2
SHA256	b8ff1df7ef69e9b07382c4103768e723c745a233d77f2906390203d876ff27aa
SSDeep	1536:iFTAF3FZ1uFHlKueNcVnDZuneq2lEg80ywd5K+Q7h/tzgveXZOGl:iy9eH6NiDZ3HEg80dL2h1zgvk7
ImpHash	-

C:\logs\microsoft-windows-appxdeployment%4operational.evtx.cuba

Dropped File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-appxdeployment%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	f91cb5a1fc5c48299f825d39c014d782
SHA1	c9750e24370cf688934634a34500ec3d7a65b836
SHA256	78cb3b6a4ef4914d1122e7c7a0dcf4fac5e91332dd962ee0a5ca3d8243bfbc2c
SSDeep	1536:jyWMfsr7tx24OY5nIvr3GdcHDXtUrz/DHf4U23I:jyxU0xamX2P/7p23I
ImpHash	-

C:\logs\microsoft-windows-appxdeploymentserver%4operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-appxdeploymentserver%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	2.07 MB
MD5	99c583fc77ab33a1f5aa0b529c535be2
SHA1	60938ab93d36fbf37679231aa3ccc59b13c0cf36
SHA256	72ab978676873d0ff881d4f8dd22f475849b5d3ab3b50fbf8a3ba49b55154b60
SSDeep	24576:AvO3p3HWV+ig1npY7d7I+dCESWFFiMkHwMo3i6p5n:A8Hig7M7yUFi9wMyLpt
ImpHash	-

C:\logs\microsoft-windows-dhcp-client%4admin.evtx.cuba

Dropped File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-dhcp-client%4admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	281809b899802ba1f820e082363d0075
SHA1	c9a4580702101688ed9b69b4e0e40bce463b48c6
SHA256	9b163cd25fd36afe98fe7980ded96444cdac271e3956473e1ab7c99185d24b0b
SSDeep	1536:tMdWLSZ+GIbGKqMovrd6l+3jrpif8uckKpeJ5R82jLdfeo:FS0GIbFmR6l+3j1iGXped8+fj
ImpHash	-

C:\logs\microsoft-windows-diagnostics-performance%4operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-diagnostics-performance%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	a39f3f696c3b79d3048bdfd2ef54c89a
SHA1	beb184ae88d11d964e21724e7cf0b96a21e3543c
SHA256	7af92c5d6bb1584fce8ca8da758387ea9b86c03801a05db305552175e1845ced
SSDeep	1536:dg+sLAMOiaaR7fTK8o7ZDb9ZpyEDlSuS5VuEQqhFGN:dglHU/8GDJZpVJlqvGN
ImpHash	-

C:\logs\microsoft-windows-hyper-v-guest-drivers%4admin.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	fedf433628b3ca97446989bd2da615b4
SHA1	ccf927e42881fe48a272ce716839f9d622900cf2
SHA256	c1d8c6711022f60538190c1d928691f773dc808f767affcf201025cc77c22afc
SSDeep	1536:FA+GYS9Afm9h+fcqZ6oF6PmMMx+bNBRK+IWmIxyDxHpxkF:FAj9A+9CcRokPE+hBRKzWOHpWF
ImpHash	-

C:\logs\microsoft-windows-kernel-pnp%4configuration.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-kernel-pnp%4configuration.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	c9a67689e53bf0cbc50cf45d860c8a9f
SHA1	a8f5e8f83a753dd46b3278eeef5ea0e1ba8ac1f7
SHA256	58e8cc9205cdedbe4c42976ef44ec2cc801cadb430614d8883e182549c052e58
SSDeep	24576:L/CeEZpCKY2NLMNsWIxFSZgAO54yj8A3Nt+lsF95:D8qCLjxcy5FYA98895
ImpHash	-

C:\logs\microsoft-windows-kernel-power%4thermal-operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-kernel-power%4thermal-operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	3a2470f089ee1ce55b51f3851a1e388f
SHA1	6878cbe3ae0f34e785fa4aa5adf9ce23249a53e1
SHA256	9c01b0fb6e8ac6268e3b5f17ad02bf0a92b26aa84c01fbaf89678e65cc17e304
SSDeep	1536:maNnJAkdqEF67lmNRx68zo6ZY7H29PfW3ls3j4KCk+TIlyRkxXOLNr:muHHo7lmNv6WY7HofWXfknlsr
ImpHash	-

C:\logs\microsoft-windows-kernel-whea%4errors.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-kernel-whea%4errors.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	981bc3af01b2894c6028cf9a7df09994
SHA1	089211b4357800d136c45598accf1e545e9fcb09
SHA256	14018bc34140e15e7b6dbc5eacb50b20300e8d352b6f74185301dbd26de3023e
SSDeep	1536:IGM3nHq6vNNJgNecB17WdTuu99PEmAxoqQ/bO/hlF5z:IG6H1vNaeqklu2Mm/fGlF5z
ImpHash	-

C:\logs\microsoft-windows-networkprofile%4operational.evtx.cuba

Dropped File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-networkprofile%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	ac667ec968c29dc5f00e8fc87e975052
SHA1	5ceb22d58493accc3313db5284ebf61416c6ac0b
SHA256	572d909de1179d0fc899332eeb3cdddebc99b8563bd9c391ab55cedb09623a5a
SSDeep	1536:KUMkg8O9JdRtzDxZrxwLdfB7tCBFD5aSCrS:RMBJbJxPwLdSqrS
ImpHash	-

C:\logs\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.cuba

Dropped File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	2afd4b716b29d7d17851892ff40c3d18
SHA1	bdfa9d88048e9e8de5b9712f4c0b8af313f65cee
SHA256	d34040350ed4150c9e585a21003fea32ad321f1de1525883a17979463c56f95c
SSDeep	1536:ppCt4KB1EM4yk09S59LKnGzBZv5wjD5XPvV68DtMaGbxmM5JUFcF:fC+yEM4bLOAZKnNV6OMaux15jF
ImpHash	-

C:\logs\microsoft-windows-readyboost%4operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-readyboost%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	127d3295364a8d7b8d02c5fd4d531354
SHA1	fd2b3eff8e16eccf3b5b27666f85e7f7eee46ba5
SHA256	e423e0d39aaf1393c7f71f9da69984b1f3397abd66c74c6e4df71b4b8711a8ce
SSDeep	1536:+3KFc6D63a63WaUMIt+Fqk+7ICS+pMwDCVBfK5gMzuyh0rQMhqYHsF+:WaRXz+Z+7RSODCrvJjh/Hsc
ImpHash	-

C:\logs\microsoft-windows-settingsync%4operational.evtx.cuba

Dropped File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-settingsync%4operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	f9c03482dc6f42ffc1d7f13cf8edf11c
SHA1	1d5a9dbe8eabe7a9f736eedcd2c0d4144be581c2
SHA256	2ed0ad8e004e625ab0aef70f7c5d8a9fae10f2e0f4389e30e7d95be07b554e02
SSDeep	1536:2Aml9hzepSpts/UFYqzQyuP6jeasqfRNrDu6cueSp0:Al/0Spi/UCqzAaBTXeF
ImpHash	-

C:\logs\microsoft-windows-smbclient%4security.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-smbclient%4security.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	9484ed13dba12be261180d2712c405dc
SHA1	a333dca279c3d96ae11c4a5fe484babfb8b447d2
SHA256	c7cb163247296e096059823d46b949ec252e695b81979972b143c2fe431d4029
SSDeep	1536:nANwfIhp/gN6EptVvdOFDl+s+rbg3jvs+N:nAvNCPVdOy3rMb
ImpHash	-

C:\logs\microsoft-windows-smbserver%4audit.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-smbserver%4audit.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	7e62d6e6f14717332d3ec8bbca9085a8
SHA1	a662521f8d2b7042156bc8ce2fe073e015475d75
SHA256	f4060708c23a29bcaec907253b64540aa8d769da2a1beb018b8d21714b55ec94
SSDeep	1536:EyRlqhdzLyrSAqs4phRbpNPQqYq+BASMqONyKqC2ZDM5DZ:E8lM9/hRbpOqh+ezN6ZDMn
ImpHash	-

C:\logs\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	de7995e08e02946c0c839340a1c42d82
SHA1	840e8f1164a4f9881d18d7ccb5e435b54d9a0b05
SHA256	bd30042404705f66b00e2de11909b2554d1a81d1966425169bf54a6678672a41
SSDeep	1536:oaRnVZYBwzXuj9gq03IbJ5leQRUcMlGEUKXCWGoRG5Kw:dZVZbzco3q6KMUKQr/
ImpHash	-

C:\logs\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.cuba

Dropped File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	58ed45a706f41c28afdb5f815fe190a4
SHA1	b711f1af9c88eeca40313b35094d7ef78455a236
SHA256	f5a61f80519e1caa2d5d1da8ae3ca2d4855f3e5a871b68ee5e37c272c62b2ad6
SSDeep	1536:PFToDkPKMR9qhO8f59TwLQdi1luHKZ4877lPt3XPNX9WNWbjBum:docqhD59TwLQYZlPRXPN9cWh7
ImpHash	-

C:\logs\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	24707e12668755306531fd336b052cee
SHA1	3d2b49807c1778aa74aaf14276b0f40c978b2a00
SHA256	5845d6439b624d19a19288b31db5e9c01a1c75f2510916ed88c7dc5a890f5f38
SSDeep	1536:H1BC68C5SHEgs836qCBp3MKiXVwbPdilvPPh664gCHALS:fZ8C5GtB6q1xFw8ijgm
ImpHash	-

C:\logs\microsoft-windows-winlogon%4operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\logs\microsoft-windows-winlogon%4operational.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	f5a710564a2aeff771f9d52b657840e8
SHA1	b16b480c94b3cceb064a7dc957d3b987946ba917
SHA256	d861fd2cbbcc2c95ec76d8a22b2aadb12b531f5cadc4364050630b8e6f7c55b3
SSDeep	1536:qEr1uCJGqf2PqJJtLpWd/wmnVwIhPtcbWQk39ki6zKJy:q0kCUqf2PqJJtLMd/wmnVwIhP0YtB6zZ
ImpHash	-

C:\logs\setup.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\logs\setup.evtx.cuba (Dropped File)
Mime Type	application/octet-stream
File Size	69.00 KB
MD5	5fd54d9376d9a140cc722004f4d70127
SHA1	5d03da190bab91441387471a0262456ae6ff77d7
SHA256	dda5d91cdbe061b00894cbcc54614f0675ab18bc7af12ff98e2a82f9bbc9c27c
SSDeep	1536:vXxCm4/WuLE80xpci18+gYYaMSeccro8k0oeYPTuLagW0w6bzzk7A:vXxDuLE87o8ZZccrH0bu5W0wczk7A
ImpHash	-

C:\program files\common files\microsoft shared\clicktorun\i640.hash.cuba

Dropped File

Stream

Not Queried

»

Also Known As	C:\program files\common files\microsoft shared\clicktorun\i640.hash (Modified File)
Mime Type	application/octet-stream
File Size	1.10 KB
MD5	cbebb6fffa7c7a87a3dfb8dc1693c243
SHA1	37d571244f703e15d7d991775c9f64e5390773eb
SHA256	11c2d56521da8b5b1b99696f7a37ed980da4177ddde1d4030c8089b5f10d63f6
SSDeep	12:7l3ivinwIy90pP4fzKrC9/+yjQZAGcHKONHMYwxBOj/lK6fUgSWHW:7l3UFIn4fPjQZABKKlPUd
ImpHash	-

C:\program files\common files\microsoft shared\clicktorun\i641033.hash.cuba

Dropped File

Stream

Not Queried

»

Also Known As	C:\program files\common files\microsoft shared\clicktorun\i641033.hash (Modified File)
Mime Type	application/octet-stream
File Size	1.10 KB
MD5	c83d472bfbc10c960a8c0742bb37413f
SHA1	8ee021944d19ade398d4b65b22b128f4a4e9d541
SHA256	e4d8b98af896600dd5661a8ecc14a0e71f98cb351797c0a857925a40be1b9301
SSDeep	12:7lQkJxszIpfVNfOFA0l0fuFc/LSgDPlCOw8I1gCzg66317:7lQqFlVdkZ0fv/LSKNFwaCGl7
ImpHash	-

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After