8140004f...9766

Master Boot Record Changes

»

Sector Number	Sector Size	Actions
2063	512 Bytes	... Actions Show Code Modification

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\fbGmyEdwPDf5aXfy.exe

Sample File

Binary

Malicious

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	196.00 KB
MD5	9594d3a407ab03fc40b9539c63907bc2
SHA1	cce903f046fada4ed779539c00976c98ed0b93ee
SHA256	8140004ff3cf4923c928708505754497e48d26d822a95d63bd2ed54e14f19766
SSDeep	3072:giN/FWv+OUtYyMy4YvmMW04Lc8tmz/3EOtWrl:HNWv+Qyb4YvY04/2FArl
ImpHash	7304fc031c729ed62048b4dd8e72efab
Parser Error Remark	Static engine was unable to completely parse the analyzed file

PE Information

»

Image Base	0x400000
Entry Point	0x4d90900
Size Of Code	0x2a000
Size Of Initialized Data	0x7000
Size Of Uninitialized Data	0x4966000
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2019-10-21 18:52:14+00:00

Version Information (4)

»

FileVersions	1.0.5.9
InternalSurname	vebuk.ekc
LegalCo	Copyri (C) 2019, pirmudationca
Prod	1.2.8

Sections (3)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
UPX0	0x401000	0x4966000	0x0	0x400	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
UPX1	0x4d67000	0x2a000	0x29c00	0x400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	7.26
.rsrc	0x4d91000	0x7000	0x7000	0x2a000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	5.85

Imports (4)

»

GDI32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetBkColor	0x0	0x4d97e70	0x4997e70	0x30e70	0x0

KERNEL32.DLL (4)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
LoadLibraryA	0x0	0x4d97e78	0x4997e78	0x30e78	0x0
ExitProcess	0x0	0x4d97e7c	0x4997e7c	0x30e7c	0x0
GetProcAddress	0x0	0x4d97e80	0x4997e80	0x30e80	0x0
VirtualProtect	0x0	0x4d97e84	0x4997e84	0x30e84	0x0

USER32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCursorInfo	0x0	0x4d97e8c	0x4997e8c	0x30e8c	0x0

WINHTTP.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WinHttpCloseHandle	0x0	0x4d97e94	0x4997e94	0x30e94	0x0

Icons (1)

»

Memory Dumps (3)

»

Name	Process ID	Start VA	End VA	Dump Reason	Bitness	Entry Point	Actions
buffer	1	0x04F54778	0x04F59BDA	First Execution	32-bit	0x04F54778	... Memory Dump Actions Go to Process Go to AV Match Download Dump
buffer	1	0x00210000	0x0021AFFF	First Execution	32-bit	0x00210000	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x00210000	0x0021AFFF	Content Changed	32-bit	0x002104F6	... Memory Dump Actions Go to Process Download Dump

Local AV Matches (1)

»

Threat Name	Severity
Trojan.GenericKDZ.72508	Malicious

\\?\C:\Boot\BOOTSTAT.DAT

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Boot\BOOTSTAT.DAT.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	64.03 KB
MD5	059e5efa1829c5f9f767fc1bf88bfd63
SHA1	185bf6b7a57d2ef6e1e1805f6140c863fabaf61e
SHA256	e34b221fbb3a7031b294c0c82eb21d552a22038b5eeebeb705a0931c9088ab84
SSDeep	1536:wB4Uk7vP+mTEGjCeOG1ZTIwDOs81IfayuZThSMgC:I0+mTOvWOsnayuZ17
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	75.69 KB
MD5	0a9feb1c06372015d5e9a1300370ff9e
SHA1	8782c339e4dc1a465facc69b17936dae3843c297
SHA256	bda1a44d5aa56a10c26c7d635e316677655b36a2149f90d8dbdded6a30da4fcd
SSDeep	1536:RGDy5aXEofcPC9fxznh3PtNmwUQamZrZuuJEVYxH0MH+oYtghKDPo39Ek:RkREcWgxd3P5UKouWyxUY+oYtg5
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\SharedDataEvents.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\SharedDataEvents (Modified File)
Mime Type	application/octet-stream
File Size	5.03 KB
MD5	16ecd1b99b9a872710165b9260daf6b5
SHA1	e6cefa41df4c922b0bd3bdd7ac9b6385dbaf6b84
SHA256	f6a7dd18db495fceb1d9510cc7d0627bee21d0cb57c03577c643a5b4a336d39c
SSDeep	96:oyZPoeBPTZ6o2sk/OI3VRHP0hBbWvLRm/iIXprbCxUGQMs7Krr/PKb83sf:bPRLZ6oJ0OI3VRHMhBYlm6WrbMUSooTk
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\ACECache11.lst.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\ACECache11.lst (Modified File)
Mime Type	application/octet-stream
File Size	1.18 KB
MD5	97c876d1f0442841b2198a85d62b715b
SHA1	cb1bf732eb1d4e3618c709f684a75e783e42d24c
SHA256	ea769a14b3d90581c6fbf488d7ef991253a2280bb460b7cd2598bf0317c44fcd
SSDeep	24:+tCG3aKntQ0zu7iWno8GtBK3snEguKtHXI/tKWVEnfEpv:mCG3aM/i7iW6BeIOtKyEnM1
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.icc

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	2.64 KB
MD5	ae66aa22366e09c4cb3d25ca29702988
SHA1	dbe4190a7f6ec8d1224c216bf4227baac32c75d2
SHA256	9a7b9c627000ac49f578adc3251fd8b3d5a14e952b8094b42b04bc222fe5a1a7
SSDeep	48:yf5wHfqbm98gHwHaNLS9Sgyxe47Q5wo4pybrRcd+arHKiEImJTFxbBFqvKcwKUxs:mwHfqbm9F7af4EbudfrHKRIIFNRJZcVb
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	64.69 KB
MD5	0d45ecbd8d90981cf7cc690dd3d51ca9
SHA1	550d265f2ccbb263a090b45cf298c8cb699ca990
SHA256	15d8801a649ee98a2c25713184de0dd3d92040e8d5c8ebdf452f88112f9fba07
SSDeep	1536:mMCV7PM01lPEYodJAXDObbY2moshEmZv3WWn:mHV7k01hEYodtHnmnRV3fn
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst

Modified File

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst.babyk (Dropped File)
Mime Type	application/x-arc
File Size	135.25 KB
MD5	db15aba5cc60ce2d19579e91755e0311
SHA1	6c594c7b3a9a69e73c2157f8d2aee1c77cd5c52c
SHA256	f2e883c5a63bf3b243e72e2cda5befc411112bc567137accba331ae4db2a562a
SSDeep	3072:Qcyq4xP9W8r3T5L/ZOpd5OklWjePMbpCaG3m4BOa1kG+e:E71Ws5UsRekbpCdmmZ
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.cdf-ms.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.cdf-ms (Modified File)
Mime Type	application/octet-stream
File Size	3.75 KB
MD5	711190cc5cf992ea2e4b682b36c0c63b
SHA1	f7893f4abac4b47d05d86703d24bd08e7a7a7632
SHA256	ef99bed68f7fe918863e9e37ef23e8b5dbb637e34b8b6dd7abe30488e2d3a906
SSDeep	96:SccrYpwmVrjQDsbjCEJfnWviH+/3Z4pkXDCq0rBJMg4YN:Sc4YtVrjVbjXfWqH03ZurBJMu
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.manifest

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.manifest.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.38 KB
MD5	e5b313f2a6df369a83376f476ca71b4e
SHA1	667ffb570cdacf4558754489fb325b2f2001cd7c
SHA256	f1de1829bc82b6a78aef631111af21e5727eeb3d631a5bc96372c14590226c29
SSDeep	24:7LkE1O3ekjCm42hAMGg/x0oh7Evep0mh+i8QppSJGPV+MyqbmEKgVmYrwHWaJ40L:74EAFhrpp0aKEhQQp0GHyH0VC2kVyKX
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe (Modified File)
Mime Type	application/octet-stream
File Size	15.11 KB
MD5	cd710fd810236d88f8b1cd40720b7541
SHA1	696dd4695110184622389638ae5d40f641754c74
SHA256	581a355141dc7f85c7fa5307d34de6dec032e83bdb8468d1708010aadb771b78
SSDeep	192:5ueu5hkISmZoZH9KsGIaUziz98a93dd73imBjwioPMByoKjs2QQ+Kkhs9nBrtFW9:5ueuzS1AIVzWrh3i8jgMAs2QQ+KNxWK0
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.manifest

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.manifest.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	13.35 KB
MD5	fa66cf47118088aa18119ca153d0b838
SHA1	55b55d955a27366f989c6c48081b5a10ea1d054a
SHA256	4f396cbeea03ab4d3b17fa54e7463b0aca348f82ebf51e7eece9e74c6c6957fc
SSDeep	192:rEIYF8p6YvlGiyzaqfTAXbw240RFbz06FPYCtV/8fYjXGK6SfRUjP9INIIoqXCqL:rN1MTziHbz06EYj2WRglIqIoqXCprMtx
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms (Modified File)
Mime Type	application/octet-stream
File Size	14.20 KB
MD5	3abc86cd6d089b9b191bb46438560542
SHA1	4075b603d3b29933ca951cd4d1a2ea7305ee725c
SHA256	d8bbece70768c9108883977e0ed574f473ac79f619fa66c97dbe0b3e36a26f95
SSDeep	384:NnKUwQud7uPsSr+hqsYuQoEQjRivhLLNabr9cQpGvgnWX6Y6Cq:NnHwxdxSSIsLUQjRyhdmr9hpYgWc
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT (Modified File)
Mime Type	application/octet-stream
File Size	106.30 KB
MD5	6bff77426c20c96c44fc9bbdc39dce6d
SHA1	ff68194131323223282da745eeecba834af253bd
SHA256	7e20279576009b95c46217202a6be4cecfb0f3332e1d6dd8505099e8df7b5728
SSDeep	3072:bEGOiOXClgVOJ1gUjsiIc97oKfHPgNWxlVV+Dyi8pViQsCOA:/OfXCtJj1fHYkxlVVI8viQsC/
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest (Modified File)
Mime Type	application/octet-stream
File Size	11.58 KB
MD5	5d0422cefef86f1d13f744f403c373ba
SHA1	9e52b9cf8b53e71cd8e30dea2e2409f4cb38ce49
SHA256	6145ffd66880284f97d88b28c92f99546923c257af8e5d0b22b3b6f6675f1a9d
SSDeep	192:0Vtc3aqe6M15M3sKmXXAOesnAmLl9ITglhf0EcWQ/kzSlNsuxwvUU3QXpuouYUtk:0/uaQM1W8Bf/Rc7/4QwvUUkKYkk
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	28.03 KB
MD5	bdcfdeba6577c264ce1c47d33188a159
SHA1	c367efbedab45787c6bb51a48364f84ab979fb01
SHA256	58fef55cc47dd36b41c20a964d06fa681ddef48ebecdb53036b6aa6104b4d4f1
SSDeep	768:/q08M9mGYY9XtzztXepY6fJPa5ns4fRgW4Zt7B3/:/t8ubYYDtXepDBQns45Lk3/
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	32.03 KB
MD5	69685f503a47d1b71429883ee86577e2
SHA1	fb75ca51b11efbd7fc974bedb059ccda0a238356
SHA256	5104500b6fd3c1e1c8497b3e169e8e1a2a22c89aa9176c3bd1559109b0397aa2
SSDeep	768:DwB3bKQnIcXcvslD7o/0nzmZVQeVz0/UrUeFdG5xJTQo9yVCM9F+LT:D0XnXKsNE/06Rp0/qUeeVcoYVCAF+LT
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\1NBUR4HR\fwlink[1].babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\1NBUR4HR\fwlink[1] (Modified File)
Mime Type	application/octet-stream
File Size	32 Bytes
MD5	8689fcaf3ca8d8e66f2e691d6204a98f
SHA1	0e8a9aee0b73de6649e89e4412c2327efdf45659
SHA256	1ca1dad7b1cd1c43caf465d270d47a5cc25f1ee89b0cff7db6758a80a43492f8
SSDeep	3:TgUCtOSpY6:nCY0X
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms (Modified File)
Mime Type	application/octet-stream
File Size	28.03 KB
MD5	737c780d14bc8eead019bdc3484a92fb
SHA1	a389b79c3fa27c419fe79445265ec115e207d106
SHA256	ab477d5ff15fa01429d9da0c314367995cbdaf236dc85f56752c853191984dc3
SSDeep	768:pJy580TRjcH44qdwjk9NXpbv2HIjz+hH85jEFfVBFlH:Lyy0TZ+k3yUKhcOFTDH
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\GoogleUpdateSetup.exe

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\GoogleUpdateSetup.exe.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.08 MB
MD5	e9fa6a02e1c2082673fd77a041b2f501
SHA1	cc26c46822b300a57c661f90e6118ae399cf3b67
SHA256	bec59a69f3ed238616ae8808048b965a56fe90df0265ef60878ee903ce042d6d
SSDeep	24576:iJn+chEvzFL+CMdwuwKVxm78p/cJn9x5uUrv9ddX7sxTI1B497:il+wEvN+Cynm7c6n9vuuvdXAee
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	28.03 KB
MD5	b753381bef56d8062acb0e12c45c9659
SHA1	1c0f8a9801d0145a6941ef9de5c9b876e89d616d
SHA256	93b668f7a7a58ed6762c5e4b7573abbe9f0dbd4614618c638f1e787e257db9f8
SSDeep	768:l9FBZYxyzYnmfbVXGKVYyCGuZ5xu81JtN6QnmG:l9PZY1nKXGKDCG6zb
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\6ASVN7J7\fwlink[1].babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\6ASVN7J7\fwlink[1] (Modified File)
Mime Type	application/octet-stream
File Size	32 Bytes
MD5	b6268550c216ac281ec502c6d054bccf
SHA1	c02ccab81af9dbb8dca434e22f16c99f4aa0fe1f
SHA256	4c5ee03ec8b5fcfae8d6dc1113ed2c8cdec81f0ee2066fd7e00705d8e321ec67
SSDeep	3:hv2Aej0QWgXn:huAejjW4
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\index.dat.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\index.dat (Modified File)
Mime Type	application/octet-stream
File Size	32.03 KB
MD5	d168d1af94dfeae3889698cbf818683e
SHA1	14615d4cb276e23e2acfab1e68c97d2b3632f139
SHA256	42960614bd1233beefbcd6599ee948708400b0b1039352e0fbba2c8bcb5b40a8
SSDeep	768:bidAzznAkJsUwM08dFEjN8Gif4t7kaLM+odRMQdqq0EGus:GdAzmUx08TkKWgLdRx70ERs
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD\fwlink[1].babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD\fwlink[1] (Modified File)
Mime Type	application/octet-stream
File Size	32 Bytes
MD5	c789bae21a09708e008ca4da287054c1
SHA1	5793ee90cd29f55b7b690a3b4de547f491c81edb
SHA256	dcee23ec4a7f068cd773470dec4f3989d76450c44c3842f167b6d6c3e7ab7e0b
SSDeep	3:p/GAZzpbL7T:88FbnT
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD\ieonline.microsoft[1]

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD\ieonline.microsoft[1].babyk (Dropped File)
Mime Type	application/octet-stream
File Size	32 Bytes
MD5	a069c32605033ebed4e6538ea692a485
SHA1	d9cda935beb8d5a4e5666105693f41b1fe4cb843
SHA256	35e5543056ae11d15768ead9688ce7a99f6769aee145b306a306ac91080a670a
SSDeep	3:j79T8:x8
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	240.25 KB
MD5	97914c4ab9e681a0c3df9948a73c39ec
SHA1	2f23798352021d7a568b9fbbd04dbf32b064fd5a
SHA256	62ccc4cebd333c018b9909b787195f5e7cabed7f948a955caa46dfe221dcc396
SSDeep	6144:CwEIalH9+bX9Wpiuh6Oz52b9zYvyFvC+H2tMndjLIXCj:VBWH+XEQDqGsKFvStUsCj
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\D68G7BIJ\fwlink[1]

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\D68G7BIJ\fwlink[1].babyk (Dropped File)
Mime Type	application/octet-stream
File Size	32 Bytes
MD5	432257adaecc1b68b43a81cba7ef6b87
SHA1	4340a9033e8cfb9d0e3db0a433b9b9d275f14850
SHA256	3992964ff3b6f8ece3b833f1566d992cec904356e2609dd061c1d2437e13b8c9
SSDeep	3:c5yYYi0Un:c5yI
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb (Modified File)
Mime Type	application/octet-stream
File Size	68.14 KB
MD5	66cf2d754d77315a00d070d1a2fc700f
SHA1	fbf8e7e66d882053fce0407a9a19421fcec151d8
SHA256	60bae4348b9b683c57312f73acd62e98c67ce3ac8bb32c6da42a7e458e5cc82e
SSDeep	1536:f34L+H7jM5fb1KCerRPlrq/9/jbZOj/6IAkJVsMFy9LEx+ydmIgsO:f34xwCerf+ZbZOGYsMFy9LExHQnn
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\01_Music_auto_rated_at_5_stars.wpl

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\01_Music_auto_rated_at_5_stars.wpl.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.05 KB
MD5	3b769a98a88ccb74a07c20d7e25b6861
SHA1	0785fd4b04d3afd98e0e4be2ebf5a4b73f59405f
SHA256	4164117104b0e16948edcc529b699b2a8c949197aa32c48989bc4ef91f696222
SSDeep	24:63zo8Y79w8euMkH3kEERI0bxqyl8wG2NHb2mEZr60U/0t1oe9fb:6jm79ZeuMkXkEERIUsyvrNHblEZr6pMT
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\07_TV_recorded_in_the_last_week.wpl.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\07_TV_recorded_in_the_last_week.wpl (Modified File)
Mime Type	application/octet-stream
File Size	1.05 KB
MD5	50d34484c8fb30a7d7be642747e1ef14
SHA1	c3309a6f119d5e0325acfa7d64bb984620042809
SHA256	d295c4a9aef4091218e2e6a833361ef4b8270ee7c4e06c12240417c33e41b2f9
SSDeep	12:VQXl1HZJBLxdCZsxBF0vxincbV90ehvNUF1yj6QIjM0kLFyYXAnurKYwx7GBUi8I:0vNzAsxBmZFbwyFdyYXnr9wx7GBU6Em
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\05_Pictures_taken_in_the_last_month.wpl

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\05_Pictures_taken_in_the_last_month.wpl.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	829 Bytes
MD5	0e528fd2dc7798efdb7720e9200728ba
SHA1	73ecfdcc1e465766b943d6b013bb7f7f881ecd17
SHA256	836892165a71ab08fe0f3607a466324ced51847adb7ad34bb750e8e5e071b0c0
SSDeep	24:NrrPG4evqj46eO1qIdua8SE3ivMn3mzpy7Rw4DKGIyC1T0K0i/:J9eDudgl3ik8p+vDT8V3/
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\03_Music_rated_at_4_or_5_stars.wpl

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\03_Music_rated_at_4_or_5_stars.wpl.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.27 KB
MD5	e19d7e52520ae79fecc00d517aeedd34
SHA1	364d0cf584824055ca238f950a887bc03652055e
SHA256	8243ffd2da0d5286e19678816d9235e5cca6ead5c7ab6b6212991c07b1acdd4b
SSDeep	24:rt/kcjiyoD1N3HZofZ/Zp4S1MqxbdcTs8YvteJ2:x/kcROJoh/ZJMLTsvcM
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\04_Music_played_in_the_last_month.wpl

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\04_Music_played_in_the_last_month.wpl.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.29 KB
MD5	991e0050c43aa6cbf64a24131edc9838
SHA1	b0a51e9fa9e59060cea9a755bfc4f59eb1b0336e
SHA256	ae610bf7400cffbbf83328d2830afd3894942057f2eacc34313b31a4fccc8274
SSDeep	24:haBaT+jLsO1tlSPj8ymVLoaS12hV/i4ZnK++Tak7Cl9zEhUT4LYyNDQBy5IWPdLu:haBjX1DSPj8yme1EHK+kak7ClK6T8Dfw
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\12_All_Video.wpl.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\12_All_Video.wpl (Modified File)
Mime Type	application/octet-stream
File Size	1.08 KB
MD5	6e1d5c364ad922c48f6a70dbd37e003f
SHA1	ba75e6c70815f23b3eb77df542613e7e3dd9d3e9
SHA256	18046c88d8c75fa014e62bec5fa872d42420febc38a472335578150527d44127
SSDeep	24:/zNUmQpWL2Oh0ENgPp+W+pyhpdILAPKTvYhYw8SytyT+jiiGOkHKmX:7NZQpWaOfXW1HdILAPKTvYhWEgHenX
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\01_Music_auto_rated_at_5_stars.wpl

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\01_Music_auto_rated_at_5_stars.wpl.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.05 KB
MD5	1746e4c956303d5436c09d433a73f56f
SHA1	069c9aac02e59e836e15014dd6103349df755b59
SHA256	5e7880191c87b4a4fb870eb7ff55d9c914768c091bad5d7875ee81609c3dab35
SSDeep	24:cHb2eOCmJs0gvlni+SlOxh1XJa8iJN/exYTX:48pJs0gdi1lO/a8i//xX
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\03_Music_rated_at_4_or_5_stars.wpl

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\03_Music_rated_at_4_or_5_stars.wpl.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.27 KB
MD5	83b3c429012189ba996eaf61bd53309c
SHA1	294bf26d212ad9387dc89c0abfa08381349b62b9
SHA256	49d752aed37f2cf0e1bacd41d5980b0ed7a19a150ea9a0843c99815bb9f73fc5
SSDeep	24:b8UdM1RcLZeDNM1kJVUtMLa5efb9O68iOslQ2WvsV1TH1btrY:o8OeFUM1EqtMLKM8iDl9Wvq1TVBY
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\04_Music_played_in_the_last_month.wpl.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\04_Music_played_in_the_last_month.wpl (Modified File)
Mime Type	application/octet-stream
File Size	1.29 KB
MD5	cbca9c441ec7b6171964ae399d7fdf50
SHA1	cdd4250af2d55cd78a2f7abe125b74e1efe8678e
SHA256	7021f7b6aa7fc5f4aa75a5c67a71e0f25c05f40c852541cf286d7f5f4f8c42c2
SSDeep	24:u3YIg0nE0p8ztPD0Czrzgnj4AU3ka1u24OjtrRiQsvQ/BUb5/L9mot0WXpvCbV4:u1rkpDjfzgNWkT2rjtt/YQZUbl9motl7
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\11_All_Pictures.wpl

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\11_All_Pictures.wpl.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	617 Bytes
MD5	1c705919e4344963d002605ee74388f2
SHA1	1dc89c7158f4f6fd1844edb49f2a95e62555409d
SHA256	d5f1f3592d309a62266a2edbe741ff9bd7caf4cb260920fe60bafc94b0e9e42b
SSDeep	12:FU1+Z19eU/XQ4sM89I8PTfCR2ue4u4r84LySpunwrjPZWOS8HL74F5/WoGG2n:FiAfeU/L89HTfCNpunyVHHLcFNW7B
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\08_Video_rated_at_4_or_5_stars.wpl.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\02_Music_added_in_the_last_month.wpl.babyk (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\08_Video_rated_at_4_or_5_stars.wpl (Modified File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\02_Music_added_in_the_last_month.wpl (Dropped File)
Mime Type	application/octet-stream
File Size	1.03 KB
MD5	9b06d79292e10a6a0dc447de127ea0cc
SHA1	53f3bfc5d96e518ee341f697f8345beccb6b2c9a
SHA256	13654c353e12734b047b8b479cc16d0d8b2d8a53bfd1c440c15d03a5adf622bf
SSDeep	24:0RQ1mp2VRuGtgyn4ERIpSjF/M1tz+KVq2qn+vUO2YZ20Plf:0mY21tUhSjF/M1BzIv+vUKh5
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\09_Music_played_the_most.wpl.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\09_Music_played_the_most.wpl (Modified File)
Mime Type	application/octet-stream
File Size	1.03 KB
MD5	44008e56ee3af3e119521183628718f3
SHA1	a428ca8cbdaa8dd056cd1e9e58a81976f982c307
SHA256	872ae3ec835bbe2822a6d1ec49e0b6313c9869ccff856b4be756b9e3cbc010b7
SSDeep	24:G/OR3BfJypkvsWDggyfagydWHR/UX3HFun:OOR3BfkpW2fandCCX1un
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\08_Video_rated_at_4_or_5_stars.wpl.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\08_Video_rated_at_4_or_5_stars.wpl (Modified File)
Mime Type	application/octet-stream
File Size	1.03 KB
MD5	afa5d05366abd6dd840385bb24b4b566
SHA1	a1f4b6e200724c5e82170093273263a4f4223ca5
SHA256	66de34ac5a72eed498f529ed5edc32462fef5affae8a5071363214487297b80f
SSDeep	24:SQFfBtrMbkJ23ODBVwp3Y/2v4ZDDIfJ6ynLrn:SYZtrf2mPya2v4ZDDsJdLrn
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\10_All_Music.wpl.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\10_All_Music.wpl (Modified File)
Mime Type	application/octet-stream
File Size	1.07 KB
MD5	73f0019a28ccc3b338192c440b55853a
SHA1	084bf981155b1df9edce84ee573921afb5bbc938
SHA256	f6a625c2f65a848437e3f771f292b05a89f8092f7c9b954756bcf8c56fac672c
SSDeep	24:ez5H4hwhF9W5iAJFAoo+cZjtB0eDM7XvrfHILIoeYDtsaES:etYhwVjjtLDMLvrZQN3
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\10_All_Music.wpl.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\10_All_Music.wpl (Modified File)
Mime Type	application/octet-stream
File Size	1.07 KB
MD5	946846a5652595693f118b4868a6a8c0
SHA1	c150d582800768e3a010aaff20fab3877c8dbc27
SHA256	959651c438d7cb1ef0b86b77ef15c792b456f32d27bd47fa4c5aa46335d24569
SSDeep	24:8jObflNnIV5OF07uhF1PJ3xjvKfJHDXoeGwVRPCpk4:8ixNnIV5+KuzxzOfCDP5
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\11_All_Pictures.wpl

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\11_All_Pictures.wpl.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	617 Bytes
MD5	950a9680a5cdc47e15bfef907a2a6f91
SHA1	d8a6777283b9b73646571fde0abe291ae546a540
SHA256	224795b6b23c240ebaea2533f3603b38cdf3f7dfa24f0226c0429f3b37f7a714
SSDeep	12:Ec8AoE99In6+P5D3BMp1j+ZFIO66GmdpgNNmaz9lk4:Ec8k99ITD3BC1j+0O6Vmdy/z5
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\12_All_Video.wpl

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\12_All_Video.wpl.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.08 KB
MD5	c2839114a7f4000c8e48c3abf4c3f3bf
SHA1	65971df075ef3835aa3e1d94edf150123fb8c3a6
SHA256	d611b5c9499cbafa3b2580e9118de93e0e16229bfb497f93996f42e32376e0e5
SSDeep	24:rqHve0/ScVv74gNPy2Vc32XSVIo3NhZl8rRHP+0+Zir09cJECD8H:UfcgNPy2Vc3L+kNhsRHT+Zir09y7I
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\05_Pictures_taken_in_the_last_month.wpl

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\05_Pictures_taken_in_the_last_month.wpl.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	829 Bytes
MD5	8f45da46e77b824c11f0e276cbbe6632
SHA1	34f885428763b7a84948ad74164307df5338aa72
SHA256	abe90da16e35a2a2d0c13f6592d6d4504076644c8c4683c7ffb10834cccb8dca
SSDeep	24:HVojFwK3kqqIufeJA209EeVj7BZsVS3HJUaUms:HCjyK3RabVJ57BZsc3HadZ
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\09_Music_played_the_most.wpl

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\09_Music_played_the_most.wpl.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.03 KB
MD5	70257f43e67e23d28cc7c6c7a1859f16
SHA1	3f578f64ca020f8c3b9eb230cbfdcefcab33026d
SHA256	b8be275a93c47117c127d378a47fdf363a3de72d7bbfa725d0a58bd5f4793ebf
SSDeep	24:TPgB8FfvUWjx7OW2QMuuWQ4phIKzYKffC0y+BKUR/iX1:TM8pPOW2QhhqcC9+BXRS1
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\07_TV_recorded_in_the_last_week.wpl

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\07_TV_recorded_in_the_last_week.wpl.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.05 KB
MD5	40b03055a1da8f3e79ccfc106160cd0f
SHA1	35c62d679a58902aa5eedebf04f8c8ce15ed7949
SHA256	6a4601f1f40f58b2102867ae843a431a91372ee93531e7b02023ebae33b90bd8
SSDeep	24:QshFeY7i0tmsIJYCVtC/2guk5nWA8bRTkp6KNDRgAL3vLOViINqp:Jz7igIj105WAyY64DRX3vaVNW
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF (Modified File)
Mime Type	application/octet-stream
File Size	146 Bytes
MD5	37400a611686dc0fb7140153b2f240e6
SHA1	290b644bfff589027ca6386dd82d4ff131d8309a
SHA256	f5198b8f5f7d5c0cfb95842a4e3666a70da7208c27fa20814915bb4b3dd9e617
SSDeep	3:/CEBGiSYawqZYzPbXvorlvBC/v4qr8T/rCPBlU2BECacZMRe+W4PqzA/dTn:aoHSNDAzXvShBC8T/WfTBnyRY4PqzA/x
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.xml.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.xml (Modified File)
Mime Type	application/octet-stream
File Size	2.01 KB
MD5	114b26119356d63eeea636c5e004cd5c
SHA1	a37f6c883f3a5adb2725f647aee7a79c40fa1f6a
SHA256	f9a5baac3c299aad7c884e1e4818355f0c2e048e38bdb58d595b6defd13b9554
SSDeep	48:ZD0skEnAzKYHjhTRk7Ji/EmBTEJxmBU43Y9xhuKY:19A/Dhtkli/EmBK5/sKY
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD (Modified File)
Mime Type	application/octet-stream
File Size	128.03 KB
MD5	ac1124cf0acc0a966d0d7286314cf700
SHA1	8be0efe56f3fdfa7a10122c6a3c07ab411d74dd5
SHA256	1f93a587ee4d6e9dbd4601a54f5173f310d8ae99d445453d14125550c4040371
SSDeep	3072:3bcmeN95nfOPGzzHJF/0BFuNJf+p031cGpEqfjH8f79fxmldm0P:QTUUzHJF/0BYNJf+a1czDfdx8PP
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.02 MB
MD5	d4ffda36fe870670abe7d063d1f9cde1
SHA1	9410fb7dd014f659ebdb28afdf7f6d55bc108887
SHA256	1453c46445c9fb653c90b2dc67e9d93dba6d76bbdaf7f3d8b2a88607eff6601f
SSDeep	24576:81ELPf1DIfoaQFAE12CSk8LguR7DtmxvdczNML3LBW:8141DEBGAEjGmxvyNMDtW
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\~last~.sharing.xml.obi

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\~last~.sharing.xml.obi.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	217 Bytes
MD5	e68acb202bb0428a50625807be760b7f
SHA1	892a4bdd967092a818ff84dd71262a087f1bc5df
SHA256	5690e22a4fdab14bca96814aa3cfa1ed5efac4485cdaa756aabccb2de5815b47
SSDeep	3:N4rc2x5nD939XIogUYG1gGEjYcsd8LlP6zqRWXZvesF18W1SG/IlqnnGzzoGZ6Eg:OHx5nZ5WRji856z/z7xAonqzZfG1
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\Outlook.sharing.xml.obi.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\Outlook.sharing.xml.obi (Modified File)
Mime Type	application/octet-stream
File Size	217 Bytes
MD5	9c7f88e0db38a722870d84c77dd4762f
SHA1	578cc7b3e0201f08c98ad261b927a42231d2ed7b
SHA256	80cc7c99ea1fd21bd1774a7ee39f2dd7547f69ada1d4615076af200e1e841ecc
SSDeep	6:vOUkh6mbhFJ7UHEf3f4oPBjcpCrCbkapZgm6:hkYehFJ7UWvlPVcHHnf6
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	704 Bytes
MD5	f76ce4a6227067bac418e55af9082506
SHA1	fa0fbc2f69da901ab00caf60e46953a4afc06cee
SHA256	1543144bd6b6c386f8d4cf9538f0402fe62cb9fd05a327d7bde68dc16065dd79
SSDeep	12:qvcAtei3o/6vljszDbRgaHsQHI7hYr5cYC6okl9YZhzBctCzAt2t3j4mWL:gtei3i6vB4BMLtc5cY/t9YfzBACst2t0
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.73 KB
MD5	5a8bd3ed7944d17b866ff2c70c1be7cf
SHA1	b88bd7b78ce915c2bc1ba88753ed3aecb9a6a47b
SHA256	ce5b6fda793cda799ec237e9f83fe143ed3474dfa07e2e2857ca4314f6bf32de
SSDeep	48:kzbA7YvkcZcEeKWbyJKr4ymEh89m25MsEsn:kzbAYrpfl5m25MA
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\mapisvc.inf

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\mapisvc.inf.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.13 KB
MD5	bd0accefb586cefb2553199a393b5458
SHA1	fe0815881a156d8e226946b550feee021e894df6
SHA256	3cc63924f63350e17833344f3dc0ad61f809dabab337af543678a36e6cc1207e
SSDeep	24:wNbIpI0DaBCaaY4+2677+eF4Fc3GyQTCu81+BpSV18FmM3z3Z/qmK3iPRN/b:4SnKhaJr6PHF+yip8QfSV18Fb3z3ZHIM
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	292 Bytes
MD5	26b1af1d8afd96bf2e3767cfbc438410
SHA1	d10fd5435bed90b4ef30468e639c47d52e7f7e44
SHA256	aca104a60a4e04a8a0bf14cce58ddd61011e6c3c25d689ba0e28e5d35a8fdb53
SSDeep	6:EC1ueWLicSzPxKFMixPCUDGtdd15IGoy+wpbXBOTFw+n:tQGcSLB6PC0GdvIG6wpjBOpj
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\edb.chk.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\edb.chk (Modified File)
Mime Type	application/octet-stream
File Size	8.03 KB
MD5	899c942ad819f9b94aec9319671cb0f0
SHA1	620f6c8530adf06a6297452b2ff80a3d5bf84be3
SHA256	ac01034546a594d3f760406310eaab190342bf07ce7150c7a4bb6ecefd2bf1b5
SSDeep	192:bV/TXferVDqEW4yYf+hSUn15wc9ykhgF7J/7HXlGkl+:bVioAFm4U3wcckhi7J/73l7l+
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Backup\old\WindowsMail.pat

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Backup\old\WindowsMail.pat.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	16.03 KB
MD5	e7bca1757a94c5fa3fd4bc5a7ac4d84f
SHA1	5017b61f93ac95734a6b345cb544f7114298107c
SHA256	141fe36f314982b6dced2333ae99873f07e69eb65192bb0165467e1882e2e2a5
SSDeep	384:3s7Tug0X0ZvZN80EPzutazMw+LrwiGmpu4iQWfSSOZuz30wwRW:3SA+40ttHzRGmpuRUNdVW
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.htm.babyk

Dropped File

Text

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.htm (Modified File)
Mime Type	text/html
File Size	287 Bytes
MD5	19f92a0f9dc84866b7c88103949bbe2b
SHA1	003e3a231cc239af23d7fb1195eb5b5c8d9407aa
SHA256	8f61b7d90d0c15ea1bcdf3d0a3deb67a9fb809735f73309ce805b281f98cd70d
SSDeep	6:SG9nt+ROd1K8uOSSGFglV49zSAmSn14i8xvQNX07Ow0LRNz6F:Sqnt++2vShV3AX14i8xvyX0cRNWF
ImpHash	-
Parser Error Remark	Static engine was unable to completely parse the analyzed file

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.08 KB
MD5	b29e7ba31fa2c6ec66f5f813afe1a98b
SHA1	b3a247306b451b9a9d2717ca967fa01111e3417d
SHA256	56ef230436180fe5a73b13f06a303fa2337d6f4ff22ee62d15178e101445cfa0
SSDeep	24:RF9dix+isFlfns1/qtEdJmBDpi4obSRv8kenY56ax9:/Vts1EDpiDuen3ar
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.htm

Modified File

Text

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.htm.babyk (Dropped File)
Mime Type	text/html
File Size	263 Bytes
MD5	cff42c282676f776f3b3d4f6bc21afae
SHA1	857d319b9583894bd2255994cf5cd496cb3844e9
SHA256	a320a31ba21035932d9b5d51c4c90d3a2af56d945dda9262eccd43a390f28608
SSDeep	3:8yh07ExsiCsud6ujGPvTzsITQqGtD0PeVowmvkUTeW28mojrzbBI+ErqLlGNJ9HP:8/92ujCTII0TNVNmvp3monBas0zHkZ4n
ImpHash	-
Parser Error Remark	Static engine was unable to completely parse the analyzed file

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\edb00001.log.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\edb00001.log (Modified File)
Mime Type	application/octet-stream
File Size	2.00 MB
MD5	9517cf59691408615c15195f540debc0
SHA1	0e1667e7d41b057591c0c7434f919c423d065425
SHA256	b616d897692bf2e8a9f8238349171d3919d3327207ad4a99c380235374f7959e
SSDeep	49152:IcL/YF6AlPVptB2gEZCVU9QGKzpOoqy9bp:r/lAldMgc9TKFO1y9d
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Green Bubbles.htm

Modified File

Text

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Green Bubbles.htm.babyk (Dropped File)
Mime Type	text/html
File Size	269 Bytes
MD5	d86872b9919686c35da2234db70ec497
SHA1	4cfe9795f40cf1378cfcf2ebf7f975a336aeb770
SHA256	f802ad601dcf2ae6bdd674c47c9d934018e83f2644af7126a20f576baeae5e5d
SSDeep	6:d4kfyeR8U8cQJtSymaKdCgWSpXXpp8WYX:azeGUkXTK5DtYX
ImpHash	-
Parser Error Remark	Static engine was unable to completely parse the analyzed file

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg (Modified File)
Mime Type	application/octet-stream
File Size	6.29 KB
MD5	6856dcbd37a56fc9dc479e92cbd86d17
SHA1	a90be5ee58902ec66e723c086382b13fb1401c79
SHA256	4c594df06807bb5cf62935dcd80bf2b2898bc5122e2ac887c34da2694e9dc9fd
SSDeep	192:oPYkXvYF2a/i6v9c4WBxdjFiMAHf2yjupWKq79:ogwmB/L1c4WBxZI5uU/
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Hand Prints.htm

Modified File

Text

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Hand Prints.htm.babyk (Dropped File)
Mime Type	text/html
File Size	267 Bytes
MD5	6500f2c6dae567834825505e0c8e7606
SHA1	3520cf07354d1d70ec0a7f125a4373e249f5618f
SHA256	3a40dbd4f09c6e2da05ba828d697bc18b4cd5538fbc618140ead500f45256b6e
SSDeep	6:tHMQ7ZoFelVXeWHsR3PzfyA9Nd6HBRZ2mfSkLEtB9:xDVoFSoWMFP7yAVsZ2mfSsEtB9
ImpHash	-
Parser Error Remark	Static engine was unable to completely parse the analyzed file

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg (Modified File)
Mime Type	application/octet-stream
File Size	4.15 KB
MD5	755e5310e82d4816e1e7001f30ebc28f
SHA1	9a0a84988786f8de1c9589c6fe07e4a4438a8967
SHA256	f3313eecb6be676994c0e73fa60851cc8ad264aca08c6a2db21a3233968c1f0e
SSDeep	96:J+bI1z5f+7Ol28BaVEz1Tja496hCiRGygqzkeVDMu3av+BZJf:J+bI11sOBBaGzhb4pgqzbtav+BT
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Orange Circles.htm.babyk

Dropped File

Text

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Orange Circles.htm (Modified File)
Mime Type	text/html
File Size	269 Bytes
MD5	0c303cf41317dd420e684cc0690ce8e2
SHA1	24af8590426ea57376e711557ce29100b8dd031c
SHA256	cbde628c3e5f5f15eb006e82716b5aa1ab22b31bb777b43f22973fbcf611674a
SSDeep	6:YeB04skILwCNitYecdmvxbrku6+cuqle198tA/sGEm+:Y+04skILwCN3xdYlrwuqQ191/sf
ImpHash	-
Parser Error Remark	Static engine was unable to completely parse the analyzed file

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg (Modified File)
Mime Type	application/octet-stream
File Size	6.26 KB
MD5	fa5d6cc065b526dc80c28dbe98d20023
SHA1	c4aebf246ed27563642d7a88f20b4cc2a7a6da8b
SHA256	9a5126419ea204b6fcf2614306531b6e84e5ac398bccee87c5ce1db6d527d055
SSDeep	96:tmLrgu4pdUxsGdTdLtUI5zZg9AYbOvaxZ3c9nCC1zM3DFv2fOrxzJ9EMDS+4vHXh:4LEu4nKdTdCIhZg9NOS7gsAuz4HrHXh
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.htm.babyk

Dropped File

Text

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.htm (Modified File)
Mime Type	text/html
File Size	264 Bytes
MD5	ed2eddc6a3af2a065a0d9ab0cf6d0d7d
SHA1	d4a8b44f0c04a2361cde58464ad9f109008866f0
SHA256	7e9d51881ec6b658f4840834a55e6ee8a3335dfbc02e27f86f27954c2280bd16
SSDeep	6:9yHOTyju6fvEYo/sZzRSr4PE3j2JgH2sP+s4eW9ZNNd:4cyFHa/sZzDE6CH2sP+hv73d
ImpHash	-
Parser Error Remark	Static engine was unable to completely parse the analyzed file

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg (Modified File)
Mime Type	application/octet-stream
File Size	5.03 KB
MD5	b596213dba6cac3afb5efd493f06a37d
SHA1	a1c762ae8c4e9376846a947571a5938059087694
SHA256	18f163524d1a36af46f4c3c87876f98ade9c0307ca63acfbd69d63de383eaa4f
SSDeep	96:0Gk+wbhn/nzV7vZhkVqUX0MCsAEpdBsZpGGe5k4XVEm4Qvgm80:0Zn/B7vZhqqUX0A7ApGn5kBmim80
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.htm

Modified File

Text

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.htm.babyk (Dropped File)
Mime Type	text/html
File Size	265 Bytes
MD5	5589e5ea284e6b90d33d09795768524c
SHA1	ef6c1266edf21ee4265e5515f7a43c10306337e1
SHA256	26b2b5e9fe4c77a4980c77b4e97ad35c839d63763fbae1071bfc412fe1fa070a
SSDeep	6:SNGmxFNRePYI11PKUNBh7XMOA3/g4Zsf2bhOO2lljq28zNEr6n:SN8JXrhDiE2wO2jq28zX
ImpHash	-
Parser Error Remark	Static engine was unable to completely parse the analyzed file

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.91 KB
MD5	691d8b41a69c4927c5e28a2ab10fbfd4
SHA1	16f0e28a25d333778a6beac3b3c46effddc385f8
SHA256	48f8dd82850f367d2b1916b403eba9c1b6d20a5b5339222f548b0ea91f1072fe
SSDeep	48:ohV3qi2LgIoLGU2TcffoUKC+FZJNjP0t+v3c2q:oui2LHoL72T0oUYJBq+v3vq
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Shades of Blue.htm

Modified File

Text

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Shades of Blue.htm.babyk (Dropped File)
Mime Type	text/html
File Size	269 Bytes
MD5	8b264de2f28ea1272ece969c9dd11e0c
SHA1	f9e10015dc136bd99b75894a09df6ef2b1890e5a
SHA256	661ef5531ff0f1b7edaca7b1640e5ddba9cd2295e29362c622369d960419980d
SSDeep	6:bbOc9nKYiBvZ70JquAt7FijJ8Ci45KnTtBD494LYpvcZQL8z9x:mcncBaJ7jqI5YYlcZQ4
ImpHash	-
Parser Error Remark	Static engine was unable to completely parse the analyzed file

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg (Modified File)
Mime Type	application/octet-stream
File Size	4.65 KB
MD5	5e8b82297952457bb8c17bc9eca3de23
SHA1	ff4fa294990e407c1b2bcb564e0337e93f8d9645
SHA256	015a7d543d0c31e14e776150829f7d7601d02a3fe8b889fdf3bd9cab3271ba18
SSDeep	96:F46NoxJ+D4S4FPhx0zEWQNLtZ6qWWzb+tHY9Oz/gM6GRIslcj8d9vRm:rG+DmF3WQbAsH+tHY9Oz/7RiQd9vQ
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Backup\old\edb00001.log.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Backup\old\edb00001.log (Modified File)
Mime Type	application/octet-stream
File Size	2.00 MB
MD5	7852e90262f42d365d841a5ccdf17857
SHA1	16abc8dc6dfe1d6210658d84b02045485cc86c01
SHA256	fa9a315a27744e876c2c9b950a0c0430631c2f20988b8905408cbb8c55447c5b
SSDeep	49152:VVb+pKjLBF3EBUBt9AvEcn67+Ok3sgxqoU5nz89pGSa0mYl9J7H/4KrBGb:up6UeBt9AvEIYoU5nt6l9NfDq
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.htm.babyk

Dropped File

Text

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.htm (Modified File)
Mime Type	text/html
File Size	262 Bytes
MD5	5f17c92d4a52bf1c5bc472f6faf9b21b
SHA1	18eddbe36c17eb35dee78f9978f6435721da76c5
SHA256	9ccf14b2f82d7c969a892609191529c54aee3bf91ecb9c9cdad1ad197d8aa474
SSDeep	6:6WFgXpfKXrFex32qOrckJeUNnxM3fW/o3k+75M63Gr682:Jred7kJzpxkgXS1N82
ImpHash	-
Parser Error Remark	Static engine was unable to completely parse the analyzed file

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Soft Blue.htm

Modified File

Text

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Soft Blue.htm.babyk (Dropped File)
Mime Type	text/html
File Size	264 Bytes
MD5	8d996b7688e86f769a0a73d1ec069e02
SHA1	f84e36015f9d36f69b7627b9063f05b712dbee85
SHA256	fbc351acbd91dc724279dc31d43b075048ea7a96cceda5ab3bc57109f5af29e0
SSDeep	6:sDLTqxW4QQXBJnx5n1ZOmiIBzzL+PU18qF:DxW4FXx5nrO21f
ImpHash	-
Parser Error Remark	Static engine was unable to completely parse the analyzed file

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\edb.log

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\edb.log.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	2.00 MB
MD5	8a03cd322ff95fc0c2192d2dc42f68ef
SHA1	62c10ccecf8a3a78ef8863941d86c2cf7843dbaa
SHA256	d7cecbabd19b13153a16d2fef4406c083a70ba10e765ba38a12ade1ff0ffc0a6
SSDeep	49152:pC8QEjMhlg/JP9JnsEE7qCDaDGu7VeEiNDJA0WmfrU6xw:ptvMhlq35sEUqCWDGu7ANSB
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	10.35 KB
MD5	f1529de5f9b3e7605fbd87bb301b272c
SHA1	cb2630737c7260264945a78b331db7dcfdefa5ae
SHA256	0c2e2e8e31ac3b9610523ce560e4eb501b3b88ff2d13a4ecbd1b6f6ad6d826a2
SSDeep	192:6z02Jy6uya2ImEEotbpBBOf1uT9K6mozZhtPqePynVjsaixVmku2bkzCwheRAzHE:b6uWITECbCuT8ozLtPqeA1sGku2wz7hm
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Sidebar\Settings.ini

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Sidebar\Settings.ini.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	116 Bytes
MD5	6e2e9b7cb7aa77611ed558b3e14852c7
SHA1	0d7d5056ca3ff28b8b42615dff6ea5a34e19b156
SHA256	d7c1368adb903c274510b829a69bb3822fed7c4895985744c53a8ca288170c25
SSDeep	3:FZx6Ejhgoz1x90u2o1OOw/2a8z35XDPmtQUXYqpO0Tu5q25Ql:jxF9z170213wuxzprmpYqR72Ol
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\-X4QNMSGSnm.bmp

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\-X4QNMSGSnm.bmp.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	14.84 KB
MD5	18383ab85378afd410efc8a7e9b78b9c
SHA1	4bf4ededddaa5f557492b649a60d61785a2d707f
SHA256	8c784a6ac96eaf6f47707ba95e2ad7670044a197770fad181e5c2e69ea1bce69
SSDeep	384:471kig1+DUDaFNBoMWL/MJMDWOc4nISwI:AgUDh3BonsA19wI
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\0RJUxrh.swf

Modified File

Binary

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\0RJUxrh.swf.babyk (Dropped File)
Mime Type	application/x-dosexec
File Size	25.09 KB
MD5	748795d677a846c722c36b1680c8d0de
SHA1	dad7804f76bcab4e526699919b1a70d250092799
SHA256	0bc7b66fd116fdb35e5cdd2f479bd0038a73a9a1c64caaeaa393c17a47e6556b
SSDeep	768:QE3gEg5aU/Dzy5hsasK/sd2o82vhu3F/dQH+aUQ:QUW5aU/DzZasUUyoM1VQH/UQ
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\3L7NUNwv1iQPihG0Z2x.m4a.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\3L7NUNwv1iQPihG0Z2x.m4a (Modified File)
Mime Type	application/octet-stream
File Size	75.49 KB
MD5	5d756244b88f930029bc8dc2cc0e143a
SHA1	5720fdb7a4f90d32a46a265f5cdde6c22e7db8b8
SHA256	ce7ca35958977797dfbb17eb2d2e85f5863bde73d4281f5600cd185e7071dc55
SSDeep	1536:98Ui3FC3udJTz5UHwWyiP+/CviMGJoh27FLdwIOQTqCj:989FdUQZiP+6KMPKV1OQTdj
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\4r5GUAtULFJGRHlrFDl8.flv.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\4r5GUAtULFJGRHlrFDl8.flv (Modified File)
Mime Type	application/octet-stream
File Size	4.29 KB
MD5	a757de00d3588cd00adebc35ae7e3b93
SHA1	2a2bdb8d61165e35c0226631f46bb2b23b720105
SHA256	00c844d57834b9570dddb0523eebcc137dc32ea7bf396360739eb04b5b82fe0b
SSDeep	96:i8dHNaRLN4y7ifVA5+Ak7uhM4SpfSUk7a7FZhOovpMeFoXs:i8LaH4y7itAfkChM44SUk7ahZhRh7Fl
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\72VpMKQj_0gnr.swf.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\72VpMKQj_0gnr.swf (Modified File)
Mime Type	application/octet-stream
File Size	95.79 KB
MD5	4069cf79dbfd483dfe1a3ad0916466ac
SHA1	f5bff816bb0394a7f91efebb149362d38fbb224e
SHA256	d244dfcf320288c01453e9819abe1d810a5945714d1ecdbf1ac662554e1a6dcb
SSDeep	1536:P2oOYxLU0gPw5NdyW0ZDrKQo8wcpWrSDwHL+DVM5VAruGf8vujBmlb5tVyy:P2oOYPNgWKxU+Dwya5KruGkGFmf7yy
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\85aOiw-GOjE4ad1dS.png

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\85aOiw-GOjE4ad1dS.png.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	24.70 KB
MD5	94cb4c3743fb23100d82c204346bf4be
SHA1	b38f4f1102dc4d7396f4de0c436fed55c490fd56
SHA256	8c78b7241cde6f93718c6f2287b5311e580095820ac36ca9cbd70af397594c64
SSDeep	768:aUlcYLB0aaJ4i92km6EnBqBK64g87wqu51t:bj9rG4i9jmzP64gYq51t
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\AdobeARM.log

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\AdobeARM.log.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.53 KB
MD5	0f12cbd8aca8c7bac9fe8e77bb1de8f3
SHA1	cf2b663ea445071b34254fa720698ae25bd49ccb
SHA256	478c3285591465b509975c0e85051b90c02ac3ddf05dc1a58ff717c94a44f9e4
SSDeep	48:ux5G8QXZPNpq+ICBsyNRGslutj8APKIQ1sPO73MQ5g:w0lNpqHCGwuRK9n8
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\bdT7Yq.swf

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\bdT7Yq.swf.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	54.00 KB
MD5	bf4aa11bbbd7110d9b0ec52b4250a66c
SHA1	de31643ca0f85a820385033e0d06ce9916700a08
SHA256	839e39fb5fbddcd817cec72039e20df50cec753a2b5e421b5fbdba25edad9917
SSDeep	768:iMitSafKCfkb9GryYSjyM9YFDKUT4OLrUdcI6EGWn0TyFffofCMvgNBlEhRFQK9m:lwTKIhmPYZKfiUdaEG0zffoTvvm3X
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\bst449D.tmp

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\bst449D.tmp.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	32 Bytes
MD5	8a8288b2d19bf62dcfac441c13a3d326
SHA1	2247eb6a7e956f1e55d2610611824374cb019421
SHA256	cc65ea90d4b54659d2ad08d6db55e5ffd1547fd3ef0ecd02c81e555fc97cfa69
SSDeep	3:Q47GCn:Qqn
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Cookies\index.dat.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Cookies\index.dat (Modified File)
Mime Type	application/octet-stream
File Size	16.03 KB
MD5	945eea9ee43afa594d06658a1a05d590
SHA1	1106bbad63cde76738cb25c0b14b86febdc44ea4
SHA256	086482e5e8c0de289865b61dad6d1f6969e0836d17df18bfd4a4970aec29ed3d
SSDeep	384:XLBWCHrPrUJOQ0WJuDP2zp3RPsTXiPrJF:bgCLPrUz0Wgb2zpNj
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\erQ6NIvsxPfy.png.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\erQ6NIvsxPfy.png (Modified File)
Mime Type	application/octet-stream
File Size	45.88 KB
MD5	cac62cd9499d99a028ef6cf1e2787423
SHA1	1d5d2281280b5550ea8b3c6d87f82e23d503ca68
SHA256	ec694c833e021cc77a4b03e73be61429a2b7d2dbabd8c564ebc2a885ed474d0b
SSDeep	768:fXFGDvUlaS96yg9f4831vrkfcOTvDqwoDcASv/bQnyi9dG+IEjklABx4Z4ih6T9J:NGrc9Hmf/kpT7qwlTHbg19k+zNc4c6b
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\History\History.IE5\index.dat.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\History\History.IE5\index.dat (Modified File)
Mime Type	application/octet-stream
File Size	16.03 KB
MD5	10e6c7b246853ad937c7914156f60116
SHA1	33557bc1cfeb2a1df5ca65101b432fe3da76631b
SHA256	eb926bb1530fddc98f2f5c8df1cfaee3212c11093d4fae4f26a3be5e7ac89143
SSDeep	384:aNmOFotNCg1/zzDfiY1za6ki7pA4oRqtWMqXoV0phL:a1FoHr9zzDf9fkcfoRqDQQo
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\iWl-0TSQwim p1.mp4

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\iWl-0TSQwim p1.mp4.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	64.29 KB
MD5	5f12e0d34b8e3f8e411f0c45dd444b36
SHA1	e3b84e4ea6f905fe263aa39965bb97f4cb5c3257
SHA256	de5aa5899fffbfdace7602464e3583cf2c2e18ab76b530f60e273dfd708dbf1b
SSDeep	1536:uDNV5TfIgLDwUNbSj/W41GKHmCZJGoPKTkhWWzS5lqVZgODPe9:uDNVR17WjGQ1dhbGqVZJDc
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\MR9CMhlkdKxgWe.mp3.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\MR9CMhlkdKxgWe.mp3 (Modified File)
Mime Type	application/octet-stream
File Size	35.32 KB
MD5	4fe38c46552a32e3f8d27050a8567916
SHA1	5a39752e8c4f1b095851bb92f0be82b5fd5c2f77
SHA256	eb9c44eea60cd963acf92fcfe8529afa4d725ce61845b8222f0e4fdd7ebf8548
SSDeep	768:0dAQr0QWq2mTQk8Re7okI+EhobIyGozHCMLzyDGvpYRnQ0wvVSDMDVdnmNIuzRS:fQr8JmT2Re7lIjhobIYbCMLza48nQ0DG
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\edbres00002.jrs

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\edbres00002.jrs.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	2.00 MB
MD5	9a2445900db27ac3d4974e8b961e552e
SHA1	036fd773c9e6aa78910c3c7e350531e4bd8e65b5
SHA256	74cb1daec3c4564b80442f38e8eecc3058d083cc326f395afbf7cd246849bc17
SSDeep	49152:uWjNMkP+ivyGiMpp9u7Lx67+8UJQvRjyn1T:zikPH9C07+8Ukyx
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\oZu3FqQ.m4a.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\oZu3FqQ.m4a (Modified File)
Mime Type	application/octet-stream
File Size	20.31 KB
MD5	7bf7114204328748e3bce890474a444c
SHA1	228994cdad382d1acd5dafa16e28a840ef9f56ac
SHA256	0583aba53b3716bb199ae16964b4ba55b04f8803a37f6dce6588328021173aa3
SSDeep	384:s5SPhz0dulE5txqe6j38LaPM0CsPGUVq/VDN1LR1UVPp3O9rP3pRb8mXq:s5SPhYdulE5XqJjM8MfUVqtx18PQP5Fu
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\OOnaU.flv.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\OOnaU.flv (Modified File)
Mime Type	application/octet-stream
File Size	48.30 KB
MD5	7a08edafedd2331f2e39d12fe8220907
SHA1	66b92afb6cc0c57ffb37e26fa7efb5f232c9c15a
SHA256	7635dded0c2b1a4a85217430e6d0eefc7b42e08f52a6d0c7c2a2796da55e72c1
SSDeep	768:dHMSXsvwxUfs7+K+m6raF4SYW4QPt2alEWWPAtZvLl2d/DqMCdAxjLpfk:lMssvBfXm7Y0tPEx+1LlA/DqMJJLpM
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\sb9oS67_VhtIvKIaCl.mp3

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\sb9oS67_VhtIvKIaCl.mp3.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	7.09 KB
MD5	d80b583f7de1814e79b9f38c8b172239
SHA1	42428ad678b948a4053ce7c9969608abcde1af84
SHA256	c08e5799b923d1b7750ba11df2c1375f2999cc6578337c43d991c92c20ff89aa
SSDeep	192:AiUNm+pfxmmwYupde8wlHMwmbbh+GOTnvWLHNVs91ng:AiGmyfxqYupdOmvh/Hung
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML (Modified File)
Mime Type	application/octet-stream
File Size	9.98 KB
MD5	8ad4731fdd2083b89a72ba2107e6f140
SHA1	a51b2f2fea75d27f39d7e25d0167c88e6c1644d7
SHA256	5d4a3cb5e4d82646bea690f5e426a3bcc6121e7bdc06f9d05d66fe80224b9deb
SSDeep	192:Vgf3xzNM5JpZPHLN+sQCnAoBSxV8oEF32Ft73TAu/26BYoMYNRXs:SfhNM5jZ8d8TIFd3Tn26BZRXs
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	32.03 KB
MD5	a75c178a1c611b48f7315eec3c0c3762
SHA1	d3f5bac9ee763487b54ab6118e1f3f5209342b0d
SHA256	73ce2473402cf65ac3e2c6d8dfbbdb8c57652ac690d8ef710f16358f92915e0b
SSDeep	768:I1ugiTAuR10RC8QqqSrH/Lc1y8goyR3vibYUaIcCDxYCOadWmd:JZT/L8Qk/L8goyR/ibJaIcfCbWk
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\edbres00001.jrs.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\edbres00001.jrs (Modified File)
Mime Type	application/octet-stream
File Size	2.00 MB
MD5	b66460d9d8721941e7490265b6f86c50
SHA1	49a887f2cd9fd7be4f77e2dc071ff7de5d6c168d
SHA256	3d4d8009350dbac5e692675fe6d9f2d798f7c108693f20c773541e3e9afda67c
SSDeep	49152:9LJbXO18uWX4MQtPjQ5eokuJ43GaocweTFhQH8+lSvSydjwf70ww:9xXH7IMoPs5HkZGOwe5hDKITR
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\UAe_8rmPVC.avi

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	97.49 KB
MD5	6a2aba4d90bff973f22109eebdbfa51a
SHA1	0076b73fbc0cb872827611308d24ce68edcc29aa
SHA256	627bce1bb9897de5b3826018ee6230b8675014ccde02ffdec2a56efe541e0d8f
SSDeep	3072:Ij619GLX+5cJ1a3qHs/WWV/x63DYNbvsVu:2DLX+5c+qMRiYlau
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\QfdyeBcZGQnSk0.gif.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\QfdyeBcZGQnSk0.gif (Modified File)
Mime Type	application/octet-stream
File Size	91.53 KB
MD5	dd420c564efa72d58620bdf835a1c2f5
SHA1	be0fc1e39c4f6fa929cd052bcea218e084b84e06
SHA256	4eee5a4ce3e45999dca0c52f5268f8201119cf9d32cd20a80f21583569d80b4b
SSDeep	1536:cEVoo9EiJFcNqy8YTMW08ryzjQJEyDc4lUaGKbQIVZRi8DWXfV2rVfeXI+oJ5:Bo8JyNqmgr8gQJEyD1+aN3ZRi9ArVf8q
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\wKARjRR4-etec.wav.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\wKARjRR4-etec.wav (Modified File)
Mime Type	application/octet-stream
File Size	54.47 KB
MD5	8ee394bd921092992933ac2f2f9a2ee4
SHA1	bcde5ff0ab1b038b8b5fbc6c12f0fff07fd29c19
SHA256	64fdede465e47c506411702d9d65260a8eb47beca72acbd6f984fe5dcf0e32b4
SSDeep	1536:7aNIpVGbL/F+N+px+V87ufrGyC0et8uKIE8wXF2mPmykPm5s3b+:GKY9TzaUZmuVSEmPDkMsL+
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\SnPo7BYjPrfq_.avi

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\SnPo7BYjPrfq_.avi.babyk (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\SPTdmBPY2.bmp.babyk (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\SPTdmBPY2.bmp (Dropped File)
Mime Type	application/octet-stream
File Size	17.22 KB
MD5	da26922c0bb91d638b5af0bf5497642e
SHA1	ebf7885be6da667e0129bde18abd8e1a2e9aeb22
SHA256	dc7a2d885868c5cb7cc1066ce64fab4ebce4de70add2daed3fe4e87870a93d71
SSDeep	384:iyaWEqdS9fzvObIXYoFrGNvbSgkBqbD2F2fFx2C1cmPVng:WffqbIXRFrGZQ0D2F+FICimPVg
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip (Modified File)
Mime Type	application/octet-stream
File Size	41.53 KB
MD5	c19fd760464ad8785d8cb39a21849d11
SHA1	0b5da71dc173e99f16cebbeab6cde38f37e9acab
SHA256	22a51d4e047dad040654252d7131806961a77f32324b58fd00fd03ee67ff976f
SSDeep	768:sifwzw2vijboT2k95OHHA1gSNdI20YD0KKLaQGHKcmZbmTP4gp9hiSDvkdvC:sp+oSkOHHA1gEW2lDxKebtPZiSjko
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\ReaderMessages

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\ReaderMessages.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	8.03 KB
MD5	028333bd688a4391055e2e5c53e4f631
SHA1	c59d1b400d04f100cdf289702da5a231d1f1d1cb
SHA256	2131f3b7702d53fef6e27543f702a17e237d54b056c6970cbdc6ae411863a09f
SSDeep	192:DqdR3Nb/p+yXBJVx9iCu2JAD3eavFIps/VWtNVLo65W:DqdRdDp+yRJVx8NsAD3eavFgsEXdc
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\zUQ4J.m4a

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\zUQ4J.m4a.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	78.96 KB
MD5	0aa2f3a6c19e5c2b185ae623e739171f
SHA1	23428f5c24f2c0ebb6d732e27a5ea4c6608f2d50
SHA256	5f4db2e2955600e148a78cc1143d5ee62bbd12e4d7e93e377c685bba6e7b2af5
SSDeep	1536:uyTfz+2rhTdwrVRVEg3xe00hlfW1PARd6ontkSTOBWGITlJD2dYZxEYuOYEuva:jTfz+E5IVE2t0XePakSTgtIJ52dYZN3
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\vXfELTinkHhg7Qv-6rt.flv

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\vXfELTinkHhg7Qv-6rt.flv.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	65.82 KB
MD5	3ce179fce12f5c6932a348b92c6dae5e
SHA1	6c0238479f33abf4e7c95d59813c9b41a125d0e2
SHA256	fd54ec3d1c52e7a5eabcab818608fc61c772019b2206b48bcfb8214111a298e9
SSDeep	1536:2xrGW62qqd7Jspbas+sG7pKLKWV4JuY3AA7/CRPcIqABtxmGQC0meit:KrTnXdVspOsJuwV4o67kPcIqEjiPg
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B (Modified File)
Mime Type	application/octet-stream
File Size	503 Bytes
MD5	3f8d7df3f56ff3d625d28a3305f1aa0c
SHA1	6e24a1e34092a06c176bae85ed6132dc90c6d382
SHA256	e24bb1ffe79192d106b38a8cde6d2c16a5e3993c1656e573407bae20f46154d9
SSDeep	12:Xz/CHfkb9pUrKDPvtKymlcJQs6HId8Eungj4:DqfkbLUrgvsl/LO8ESgj4
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875 (Modified File)
Mime Type	application/octet-stream
File Size	1.38 KB
MD5	07222332849a5e0cdda4f3cc427f2611
SHA1	fb0f794ec540b64c4a0e44990df56780fe5a845b
SHA256	0bed24df7af76198e29520be7fedfc6c157adf70e87f770374eb2f7b2b098f9a
SSDeep	24:ANhXuwRN3I67wIcj6KpK3Tnpiacs614GoWYw9pJR08eItT3E/QDnKz8wX:QhXnVjKk3TpiaPw97P53pDKN
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973 (Modified File)
Mime Type	application/octet-stream
File Size	504 Bytes
MD5	995d2bb94a9e6966c07c54b9b43a5bc1
SHA1	b4291112c992771bd98ebad8f6d99c966126d1b3
SHA256	2dde3bc2c01e8fe9b24164026e0915a51ed431a2ca513d6c49fe96cf61079fdf
SSDeep	12:ES7Uak44UtZPLDpo7z8I3wQAneLEdQXbIDG0GtyS7:ES4ak9UjczZ38cG+IDGdp7
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D (Modified File)
Mime Type	application/octet-stream
File Size	1.42 KB
MD5	ec35231a306ba88b7c21342ac1e8fc04
SHA1	ee2558cb1b757baf97f2f6b7d505d01a6ecee72e
SHA256	34525b5f8fa9ee5b8839b71ed07e6afe13fba55dcee04fcd63def99d45abb42d
SSDeep	24:AVmaNx+QSedj0JKqGlHzy0EQ598CRkHhLMr79tR/z0CqLSwpyHlhz8VbDuH:AVmsxcoIJqwvQ5KCyBLMzR/z0FHyHleY
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	759 Bytes
MD5	36478066fe7d3d9cca1fea3a3e3df63b
SHA1	9854b5b926280da1c3f217f0df7e4ffdbc83c85d
SHA256	27fca28113f9ec7906cb888ba534389842c200d8af861bffa3eb205af20289cc
SSDeep	12:/9cfk+/QcTGMEcRGIWmOEg4ty4pNALs7myAo5yehkI56dYWDIq3Y:/945T/RLWmft1pNALkmyA5C56dtDn3Y
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4 (Modified File)
Mime Type	application/octet-stream
File Size	503 Bytes
MD5	ee4b6e6d37b81ce95639cccb8b038b71
SHA1	9d9a24e885c478f88fa647080416b67c39c9c442
SHA256	f8c2bc4d9f003a01562f31b8faabe42e776e4e0f4e19815f93d3156cb0c404a1
SSDeep	12:Tor+egKEkIAyb259wxfSFI4/J8Hyhs+bdJ+a0dQIFnvZL:Q+eZE99zfSIhctbdX0dtxZL
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	503 Bytes
MD5	669d5a2cc8071172ff6580d2dda52050
SHA1	98c1eb99fbeec14b3b44e472e167fcc5ec494a07
SHA256	e7afdad6ca495cbff2c89e75fea39a5b035432aaac9b133cb60fce58ece388dd
SSDeep	12:bJBBJx4tL5mzNbmqCyOBGkVXMYivhIH6MwSDBHJWa9t:b9H43mzxmqpOBtVxiv6H6XSDxt
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D (Modified File)
Mime Type	application/octet-stream
File Size	1.65 KB
MD5	bbe6cc3325018f0da21c478a08ee025f
SHA1	109ab88182de42c57347e9582111daa7e6759205
SHA256	4727709e49483780efdecb4aa3f7e37abc02f28a779dd4f25d51fdff4f84aefa
SSDeep	48:PfBb1xFGpCISzxYSEjKzK5FPJ/cGj/4xD:PfB7AH22PJ/cGcxD
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (Modified File)
Mime Type	application/octet-stream
File Size	1.75 KB
MD5	775fb9eb55321adcbba7b003c0d2b5e0
SHA1	64da04d50ae032e14245935044b06c3b3da76757
SHA256	81f545b06fee31e9a41352a9a0c9da993e1d34f3662747264b9b01409e329c32
SSDeep	24:8W4jp46MVf3TM3aK/J3K4RUQp8HVNsDQQlFc6V7mt8kyB+K/yY8Sx7cY49UE:2pSjM3aK/ZV8HVGJhS8kyCzA7cYiUE
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	495 Bytes
MD5	25214b32bd403982d292746f849c7b22
SHA1	06bda7a3cd08bf2187faa83b01881b3511e5a124
SHA256	f34ead192f56a402398708b20723482dd603ebe185df14b90c0c913291534a54
SSDeep	12:wDRLs0YUm4ge7qRn7UrWtJV7OY196jrwBkubkMPg96:wdLs0Ycge7qJ7+W3FTirwBkubhq6
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E (Modified File)
Mime Type	application/octet-stream
File Size	495 Bytes
MD5	0b60cc251a63a7505b689cef91b37e7a
SHA1	990b3992eb29968aae9612e7025b1e19c87d4413
SHA256	2c1ea6c167560793048934ffc4a6acfb070522ce2bd3bb1d29014776e9235d61
SSDeep	12:1T3vs6oCjFGrDiY/PIWL7rwbp1rb+d5jix:y6xFGr+YIWv6MjE
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1 (Modified File)
Mime Type	application/octet-stream
File Size	495 Bytes
MD5	f345d5b0facefb60eb343f4dfbf8ddce
SHA1	f4ac688e98ef7e94c1a0b7468148835e181241d8
SHA256	7d91e06aaf5a394f70001e10efa0b05096bad5b8c4f0ba550496b4a91293a926
SSDeep	12:IpcNUH5Q4aiYv7h4pzm/ybS0hFoHrPGIhkc9I:IpcaZrXYSz2YHhF8DhkmI
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	495 Bytes
MD5	1e6700017e398236999ddc8e12fefee3
SHA1	dd8d033bba12b339fb2da2eb136291de2a4293f9
SHA256	d88dccaec42f2f49a3a02ade06a2338199d6329571fb9ca34a8aff6b0eff91d9
SSDeep	12:arbC4xkmPQBl7IT/s/vgM30YbAT9n7RlQOUFUZ/:B4mmPKl7Irs/UNQOUFO/
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4 (Modified File)
Mime Type	application/octet-stream
File Size	495 Bytes
MD5	92c26a03028c9ebd74ecfd3c99885c96
SHA1	cf287ac7e1bee577b76790863afdfd1db256d194
SHA256	58c6cf53038a254e6741fdb6788c16815a5cb8395cf9492a2b537cf7a7026581
SSDeep	12:yOLfvfe67D2YRKJmlhoNHlkLLbXcAZDCLyw9O6qkMb8MGIAOCk:ykfvfyYRqmlSlk/zxZDCLo6TR0
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778 (Modified File)
Mime Type	application/octet-stream
File Size	495 Bytes
MD5	5179a499246c84f45a983ec51fddc719
SHA1	23f8955a54a25c5d469cdfe0edcbba22db15eb14
SHA256	2820793fa113f888356b0cd575492eadfa20a6d462abd8b61de4809038769c42
SSDeep	12:rN+RWz8yfyVMy4+jd+pUQwO3iKPE6FKeW4XA:rcC8xLj0UQwOSKnEV
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED (Modified File)
Mime Type	application/octet-stream
File Size	495 Bytes
MD5	4f813fd8f173bcb69b407c6d1a28fa37
SHA1	7f2f8765f80b1dd9cbb5687b39d0743f698c4db2
SHA256	0bbbcf9d233a12ebbc088681cef90e636370a333f1e4e468bee1bd2aa9eae03a
SSDeep	12:7t/L71eLnxGpYYf6kQOAn9P5zzlqt19w02+Tt+nzOWjoLDss4YPIUtTm:7t/YTxGpY+qn95zlq1w0NTtwOHZI9
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E (Modified File)
Mime Type	application/octet-stream
File Size	495 Bytes
MD5	7e7caf668139b60dd48e1f873df2fc34
SHA1	f9f7067250e45ee529792adaf4c7acbc01f275e0
SHA256	476f98cc059eb48b67e044cde1045bfd32d72e88f9f380c924648481087f6ebe
SSDeep	12:jRFoyoiOLFPQwvkPyH/R6BWwH+7HOGBzIXT:Po1F4TPyfR6oyJwz0T
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB (Modified File)
Mime Type	application/octet-stream
File Size	495 Bytes
MD5	4dac89a66126918a46259eda644e8857
SHA1	77151db05316a347361eeb25ca54b3796866c849
SHA256	ef655c6eb87158efc2e37f66600805f15035e2160ac19c73a7b3d7cff8088ee0
SSDeep	12:QOhKKUXIc2VVlotwXuMnXQSufJk9DUxng1roa+WVrAooQ4xUZvqJP:17c2vl8wkf6CxnghHrmEvyP
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD (Modified File)
Mime Type	application/octet-stream
File Size	845 Bytes
MD5	65c55c2df79faab90ba43be97c475417
SHA1	6be41687f7ef93cda5330fe2986919cc5e4f3034
SHA256	b1796e6a63332c0f8994a6a9c9efe782374cc8bced580c82d1539022389f21fb
SSDeep	24:/G1CB6KQ7nuLK13rKUtuu81SFBJjZkIk4gKC5Fn1r:/Z6HDkKtKUuEFBtZlkzKC5F1r
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.75 KB
MD5	7491f9c17d31ed142c41c5cebda75b10
SHA1	2e25a7719ab663dd1866fac5fcbf419d842e18ca
SHA256	640f981fbd81b17aa3834fdf72126042b4f5c3c08757d660bb51c4b3cf0cd028
SSDeep	48:m1NgoMCEJIpJxkv80PCXu4rYF8WE99QLU5jDZZ:WLXkiXcF/EaU5jDT
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.75 KB
MD5	1f4f96aa73eec41512b2316fed70dee4
SHA1	8972032510d7cef51fba8e9e4baca1595acfdc4e
SHA256	d262512095cb05c771907490c46b0da3ff72e9c944afd2d939c4f0f91ca21cf7
SSDeep	48:w9eUwkZBg6o6Lk6CoaOx1RSfOQyfsWBbyE:KwCdo6Co5HSfVVAyE
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.43 KB
MD5	d178a0996767846f40cf1c1fd1e2f994
SHA1	528156b161e21e10a02ddd8cd12dd0bd108a390e
SHA256	7916cacbeca892b8bcc0d0b81ffa4b03bdc9d664db4003610fb401c54e204f59
SSDeep	24:Q0QrudWtQUNT3WWyBWx0Ag4mG5435oUoTCPv464B81Fsqgj4w24quU/l0R:7QZ/5GWyBWxV5E+K4/oY4w24qXN0R
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	52.74 KB
MD5	36e538ad6bd9666b177c65292f6e369a
SHA1	2a1151c5832af62d555701d97c81f264e3b5cf77
SHA256	914514e2e4316b832a5e492094bae42a11c8eb69e6c452b1ffd0c14890002ca8
SSDeep	1536:AHxfEeiZ+LCpMXckO5xIKeefp52K8kh+598GvV:ApiELCpMskOXn2K3M8I
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.45 KB
MD5	0202dd008112c0b21434cf659e5b55db
SHA1	ae899f349bccba1405e64abd480c8ef67b2a92c9
SHA256	abf1e544d324fc83b5df862da12518ba77e688e6673991adbb7e502518f22f4c
SSDeep	24:8EysAVNfw0s291gKXJeXYFNu1wIjB2O6xIj0PLj5tJ3ww5dtd8WTkj0pGCjq/bFP:8EOznlJeIjswoB2bugxfASd8WTSAGCE5
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1DAF2884EC4DFA96BA4A58D4DBC9C406.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1DAF2884EC4DFA96BA4A58D4DBC9C406 (Modified File)
Mime Type	application/octet-stream
File Size	3.81 KB
MD5	31ec53c9ecd6dc389abf21df0fc1ecae
SHA1	79946ddeb862c6a7865763c2aaf5360803335ead
SHA256	bcff8b6ce303c88294ff5bccf7c584f98d22c50ae35a0e10e8aefc49a9ddd8ae
SSDeep	96:g4hyorf9W0XvujYZAHj76G+tVfRqaD2DVprQ3Z/b1F4wyd:g4hHbqUqiGuVPWVp0JF4wO
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.75 KB
MD5	3474a647d9b208f230e29b7d45fd50ee
SHA1	f34d42b3b8cf78979c11270b530a6759b60feac4
SHA256	e98b82866aba1cbb95f9ca26ec745eec8f44eda1486398a7847eb7d2bfe52ee5
SSDeep	24:nWPSYN/BZRf6+8PhR4x+Qs58Mi3nL6xTefuIsa/NW4lE26i4xknlbAe4naThJRUA:WPt/Bfi+8f4ZZ93aT7IsEz/RXRSe
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56 (Modified File)
Mime Type	application/octet-stream
File Size	1.39 KB
MD5	cb6d44fe174da25b95a9913d462c7a3f
SHA1	579d55760875052baee82f856a8599d2ef2e8b1e
SHA256	d754dca45f24719cebd110e93d4bb3c75ebdc0776723787f7ec3e1353c4a99c3
SSDeep	24:gRraxERbT29gOEqBqBDYbhqBkVJRMm7o4eyo4j1PJ2Hlqmgx8yk1ig9A6n:gNa+RumOEqBqBdBORw4x1ITTyoLG6n
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.51 KB
MD5	788a175c0250f881a7467fbddc09737d
SHA1	a8b4b12f91b558e598e19f2290e30488c7a28451
SHA256	6d8b9eb0ca951b0e54c3faf4dfef5439e00648cedee8c15d7e3691e0edd148d2
SSDeep	48:OonrHzfnNROPrrVbjoGUwgP18CgPtCfu1ez+5iKqzL:OonrTvNQVjowC1oYGYv
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852 (Modified File)
Mime Type	application/octet-stream
File Size	1.61 KB
MD5	b151811f333df2a8c31d1c21108b95d8
SHA1	cea4a9ca1394e6a332bef00607cb1dcae69fbe15
SHA256	cb23aedacc286ebe715404db79730b2d4b2fe0a87695d2dcbc5114f783ec838a
SSDeep	24:wUUe9ur75Y8ImGt5sBCcteYTwSZIdoSkuGmJVIo4vhkKKofzL2JBVnQUlR61mm:wUBftyk4eswqPpuSByKri3VnQU/60m
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8 (Modified File)
Mime Type	application/octet-stream
File Size	1.61 KB
MD5	1334ab548c25db7246d8f34255135382
SHA1	f1c3ef6d71bc7b027b9a1fe87c0fef2062c7d9f6
SHA256	e07ce8e086280240b3dd0ba5a4fdd652a103b6a4e8b6afccb967cd9f857e5558
SSDeep	24:FgCnPK8eCb3Ixcl9kGD30UF7vkcdaZ8I0yNZKMyu7ESxcsx/bTpoYlI5GuYTNg8+:FlKP2YG97x73da10t3WxXzhXzNg8ywM
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150 (Modified File)
Mime Type	application/octet-stream
File Size	1.51 KB
MD5	03389c73e28a69574c2015e9b9bfcfc1
SHA1	495ebeab3f2200e9e6bed21dad56238176a87ab1
SHA256	e9c12cb50aa074a81657457fac3e5de8d74650bc1c15e43b0e49ff6b8530fbe9
SSDeep	24:k8WpLHnyLkiOJN9/5v23m5jWLI6ZPiUYbOLDp3l0cVi4TfegbekCo9xzN5abs4bY:k8I7syJX8WZW3RRYbOLDv04i6eRaMs
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	503 Bytes
MD5	aa3f17de43338bd584595045ea18095d
SHA1	86d97412ec93dd91eb6cbe44f4d09c528c34feb7
SHA256	b9a75063c27f4ce63daa9b31b25243f2391422dd494918a351f9450845b23010
SSDeep	12:GCJyLSd2UQggWljVwChR2W64p1Bl8c1Y8dg:LJyLFUV12WVp1j8H
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.66 KB
MD5	91ca9217d9617407dd7c900ad5dace06
SHA1	7a336e5cfde7cfe7279d2e233256ecda91a102b2
SHA256	d8153f0043bd20e8b8ed184fc86832607768df8408ccb84e39200158c5ef425a
SSDeep	48:QlTsBpbpIhYkcGiViIkn35Wfb3MB1bS3/rjqW3oGSMsn:Q9UtIeEsGEDMXy3Mv
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.45 KB
MD5	cb5c9f0f41170ca765270ee968f3fd7c
SHA1	2d1bc545a69caa8a084bbc3ce163c8c39a5ba946
SHA256	82dbba88497ce58b764180ede06d52b2190b876afae1c58b0260e7a8ab4b2522
SSDeep	24:N8xkcNGYpY8YitZYKnOc7mi3ouINHEWX8VgYoTj2Wa17VHgzpq27lU:0kpCY8gK/mxo+0ezg27lU
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.45 KB
MD5	63f8249a739b110e6c7a4c0ab9bb946d
SHA1	8aa0d603503244851a0f094a8bf27be427f5bfbe
SHA256	c6855d481ba5903bc0ce1af96cb1eae7111bbedef009f0be85679a75ac11d450
SSDeep	24:HEv/h9wJRnxP9HYXeeBW4Lq8YBcwnvum3AvSEO9o4Me1lnAmrSIrUiNNis4/SdU/:kn3yRn1AeeBW4Lq9c8uSvAmGILiN
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.63 KB
MD5	27c55ffb74a231771687cfd7c40a403a
SHA1	7fd7546f3d960be6f1cab9282d8ea9a5f74d808f
SHA256	1a6ced041750282e3b91f412405c0b5a83f15aef97f4301eecfd0f982707d8e5
SSDeep	24:TMP/frzyjFOGjnA6e1rZXQyi0gGhHWDE9RR6p/8vvuyWd31njCR/8SAr74Yxak:A33ScaAFXDNWEfS8v2yijCR/DIcYxZ
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9 (Modified File)
Mime Type	application/octet-stream
File Size	1.50 KB
MD5	98a0029ae42287e9b5135d8b47a218f8
SHA1	c9bcf7abb14494906d5866c8df2b38fd7ed19fb5
SHA256	22dac496bf473cd00a59af6a0a0bab3915a365ca780ae807d55fefe704831f3b
SSDeep	24:iDdWDd2i+6pgPzWMd7OnxIE9nEmmSVnlcc7PptKqVHtYeYZFPJFpyB3/a:iDch2i+scdxEpgSVnTdtK6uf+BC
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.61 KB
MD5	870e24c50f38fc5671148bbfc01cc464
SHA1	5edf4a038036f5d57d8db5efd0cd2f61fe94ed98
SHA256	469b51d14c5cd042c6f49e8d0c33599bd2702361f400cf6b29e8e0c0ded4ded1
SSDeep	48:yODxObzZ3N3xFVOahsLLvANiP3X5Jc+BKPd5U:yODxObzZ3N3xFVOEsLrAknBKQ
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061 (Modified File)
Mime Type	application/octet-stream
File Size	1.61 KB
MD5	f3a3d1dd1341c5c62e6b6043c22b1944
SHA1	f0b7efe5252087b9b87a441f920ce75587a45cf1
SHA256	331c136eef335da2968fdfb0d7fe3e12f2a9c63715141714279dabc42e57142d
SSDeep	48:25hW6+LvcjhNsBTi3bFPYghwigFjGRT22y8:8h8LvizQIbFfY0T2E
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE.babyk

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE (Modified File)
Mime Type	application/octet-stream
File Size	1.75 KB
MD5	cc67afb1a17270f48c00f2d7ba6a2c4b
SHA1	84710831d41cbb6c6c7342f8bc681899809b3314
SHA256	0f9fed70dc168aaae4ee08548595cc739517ab24b813da6f978e8d4fdfb9fa0f
SSDeep	48:MlFJviesNzF1VZ3WeDtWL23CFsWI6bfAKFn:MhBMpWSk/FsWI1KF
ImpHash	-

\\?\C:\Boot\BCD.LOG1.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Boot\BCD.LOG1 (Modified File)
Mime Type	application/octet-stream
File Size	32 Bytes
MD5	0d7dd915627dd90d636da090134b0483
SHA1	3997f99721cbc47ec662450e3d62600b665e38bb
SHA256	584ac55a84655eeb7a62ce3989d0e7f7022a2f047ae317829403046814ba2bb5
SSDeep	3:0YAAe6z:fTz
ImpHash	-

\\?\C:\Boot\BCD.LOG2.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Boot\BCD.LOG2 (Modified File)
Mime Type	application/octet-stream
File Size	32 Bytes
MD5	bfd34c06a277598995a100a72d4733e1
SHA1	b07799af27d0f0461a4742d792a996922c676b95
SHA256	6a1f7e7f24f814397c3828293524cf944771667a56cc4884c7aa01c75ccfe7a0
SSDeep	3:L0/uh9W5WV3E3Nt:z0o3o7
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	51.97 KB
MD5	355e90ffc8f641fa38af22f4b89ee86a
SHA1	6168408a1c41caed848e9943d44c44942b1d248f
SHA256	d855ccef9aea8d5558f76037e71c551a5481b22e8d5662d4fa4c90771937320e
SSDeep	1536:VCay5gf316csclNBeI07X0j6BJ53Dl/sMU:VCay5S16c7NBgwjsJj/sz
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst (Modified File)
Mime Type	application/octet-stream
File Size	34.32 KB
MD5	ee02ff0081b47b4c0252bf3ce6117a67
SHA1	14f6624e25783175ae93a4cf57cd73c12388cb46
SHA256	1896ed53ebc1b1ce0950499b80200e37038d09535dc271faa18a1bb1afd0616e
SSDeep	768:YF655pxT1PeZ6pzo8eEeS5VKvcDkj1X356MQavqYFY5fB2:PzX1PekxeQevcmZ2cX
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.cdf-ms

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.cdf-ms.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	16.73 KB
MD5	cb942cf71ecb8e7c34348a74705cffe2
SHA1	f054473ef461691d32ded5df40148deca03f99e1
SHA256	b88d2173d484e93d230162684d65927d9fd2fe5af8928354e7a5a1bc324de991
SSDeep	384:3Kqd0DL7HXKBgsqWxA/3NEMg5I03DPBuS8K4eu5t+hbRM92+M2J:axK2BWEjgxDPMS8KG5t+xOM2J
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	6.53 KB
MD5	0ee0323c3f61000ec0bc49e9a0d94267
SHA1	07897409a097d2aa4000ffd7922b75f9440e7897
SHA256	4ce9ce3a846d8fea250ff63ed47e54cf54b96433c844bdced6cb6724fd057296
SSDeep	96:RWwgJosP2Bq6WLR153jNX5SUoXgENb54Y4o3jXcFSeetamYoYWLPOUrCxEfeeLh3:RRFI6SRW9g6L4o3j+kamYoP6yEUzxiE
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms (Modified File)
Mime Type	application/octet-stream
File Size	28.03 KB
MD5	ae0d6b58c82c19b1f1af2166adcad328
SHA1	64b2c5d08e581284060c5b2b2ff30ebfe6f53714
SHA256	f0520da113d60660f97c8040b108fe3155a64187e4fcd47a725a320b58ab1654
SSDeep	768:7zZGmGyQxcaOOoc1xOEgkiUSL9Sg+6IHLOw5:YmtQx4OoKbjJHLOy
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\06_Pictures_rated_4_or_5_stars.wpl.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\06_Pictures_rated_4_or_5_stars.wpl (Modified File)
Mime Type	application/octet-stream
File Size	817 Bytes
MD5	aa0592a4fb6b77d874d154b4f9c20253
SHA1	64d4de99702c08a00246735fca227df8f4d268a5
SHA256	87f6f39c0396f02243d1408ba0e2f62a2c52cc426f4e12f5e9f15dda1661a33d
SSDeep	12:GGgXXd9rY3tRKVGcX+B3ebFgtfAR3n6CVONy37YL4pYMZAlIKCO4v6oFI6T3g/wf:Uc3DqFX2+FKARKBBlIjv6oFlIwJ9
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\02_Music_added_in_the_last_month.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.28 KB
MD5	89341599ea73317f16527228bb2daba5
SHA1	2b02186709c2afaa4ff235da0e7fc2ae2e96d6b1
SHA256	02d46d10e3040dc522a0365187937baec25fddfefb76875d842d25c70861dcaf
SSDeep	24:+bnxboOumQmutjNL+Ub/YN/d+Qk+jhi8fhkWzuyA4BKzEuQfu65eiRTF7F+xFV9U:WxbckuVNioYNMQk8YykWzuyA8uj6vRTN
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\02_Music_added_in_the_last_month.wpl

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\02_Music_added_in_the_last_month.wpl.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	1.28 KB
MD5	1e7b6f0d3904737f175745c9e00144c7
SHA1	47e2d2a03baba3110a7c84050e76194942145910
SHA256	77a8d2e744810beca84d446be894be3cf51a5b0442139dc54f0367da07a00cd9
SSDeep	24:fvCMfGhFxr6bvR84InjHIIBFNFbfq5+4iXNYYiywYNOLsrkZTFzP7:fa2bvR0pbG+DWYimNO9ZP
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	128.03 KB
MD5	2852ea6b6734afff7e1f2b3892a45189
SHA1	f309f0b618bfda2ef9d0a75b656a1fb485e35710
SHA256	9733a10a6eeebe3f8af73db634bdb47a66f61e116ee55c2a9ffb66f2b13f9aa5
SSDeep	3072:OzU3Qk3A8p+M1lLLa4goQFYZU0PKlnzrP+kHcWcZBKAwUZbqklg:5gilXD3zbPozrP+k8Wc/w6blg
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\06_Pictures_rated_4_or_5_stars.wpl

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\06_Pictures_rated_4_or_5_stars.wpl.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	817 Bytes
MD5	4547e6c3596d7c0090bb190d31df8a9e
SHA1	5ba3e1c0e43ed2a72e91748df30ab6f82788617b
SHA256	3bf75199167bcd9dde5462235a03ffc8b045881e7788e1a4e1ab83a82c092273
SSDeep	12:Ahc2Yh4ACSDeTzcNJX9yxTZC1hnj1jElYMrNYGXRasadJdcZIE6IvD1RbEl:Wc2HieT41k2jkYMrNY4b6CIE6IrLEl
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.sig.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.sig (Modified File)
Mime Type	application/octet-stream
File Size	160 Bytes
MD5	066dd9e4b0911b3bba6e9c157345f645
SHA1	73e84c2967f3496c640c15f40b53e7f73de94881
SHA256	5b3070be93e555f0ab3485b24b5a23158d2ce3f9bba8de3de82345da506ba918
SSDeep	3:i8O3kgAXkgagC4JcFpbMBRqoriszpb9psczpTWEVf0ofiosMgp7:i8ekvkgJcXSRZWstb9DpTD1nTsb
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Visio\content14.dat.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Visio\content14.dat (Modified File)
Mime Type	application/octet-stream
File Size	99.25 KB
MD5	f53165f1f20363095f402b65e2bd41c4
SHA1	7d4da020c1316e19b0e33cc098bac9906c96c871
SHA256	ded59b7b2e21c1baecd411e96a7f4496acebda581e8fdcab89ea49f4ee522c74
SSDeep	1536:s33SThVIfCJ+UwBRUVeKB1BQXnXGcuHkvkFD+vKeNnIgYofdczDMS3:sSTwaJrwBniBMuHlFD+yeNp7VcvH
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Visio\thumbs.dat.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Visio\thumbs.dat (Modified File)
Mime Type	application/octet-stream
File Size	125.03 KB
MD5	8b6e24c0e0aa4b2733bb59f033f89de2
SHA1	d7440d86c5b8b1847e3968a96145bdd8532a9c38
SHA256	e765fab289f591f72ad40dec610820b4ced9af89c82c1df622b05c196ade62d4
SSDeep	3072:Yx/Lnc/KY5BKpStK3AtXd9IgtdmfvrJOvbUPZW6O3/q5gNn9Ut:eyTBhK34fv4O8M6OS5r
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount (Modified File)
Mime Type	application/octet-stream
File Size	1.50 KB
MD5	7a10716f97a2321a72cc0c54e08aa3a6
SHA1	a02cfe0ec10529802fa1bac6bca10d8d88b48d3c
SHA256	c6adce48c8ba7f76c57ca748d98340e3c58cd5425b873738b125b282e79ee0eb
SSDeep	24:93WFIfa9Oy0om8TyowTGy/JnuM2rs78Irv7rLbCOOPoY1urb48EAh1n16z+af3Eu:9Ks78TzE7/xis7Tr3bOPiZDn16Hcu
ImpHash	-

\\?\C:\Recovery\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\boot.sdi

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Recovery\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\boot.sdi.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	3.02 MB
MD5	448378e8e02be51453449bb86e50bccf
SHA1	5344b8afaf341b1f1f93397ddad71958c731747e
SHA256	7b1a78fd0e22c51f8455a6467f9e733a998e28e167af2c92a05e4cb03aa1e798
SSDeep	49152:ggTfG0LDRzEwAKouKQfkLpEim029VxIsL1o01umAZbf2GIYQD/K5YD/HgfHl9n:t66RzEwAKo2omhVKsh11jWbpaDlDgl9n
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\oeold.xml.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\oeold.xml (Modified File)
Mime Type	application/octet-stream
File Size	292 Bytes
MD5	6a3ec0f411c67e4e572f8b4e953bd7ad
SHA1	32965c66a5d0ff5c411f4b2643fb59bce71faa9c
SHA256	4a3d3ee9aee6eebc4a2de9b9fdd3806a1ed631eb33760578414af238ccadbb99
SSDeep	6:JbpiNrw9FLBiOfm9N1y0BIEnOGQFFqT7fRC+1o5nVKxYW1B:JbYNrw9F5mNyOqFTVKe0
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Backup\old\WindowsMail.MSMessageStore.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Backup\old\WindowsMail.MSMessageStore (Modified File)
Mime Type	application/octet-stream
File Size	2.02 MB
MD5	55d39d4f5b1a922ff68df07ed338b795
SHA1	61f38617aaa220d129963127f4325a51fe0a9ff1
SHA256	a782ef891f3d561fb201992529fc35871bc0b5303facc09ef910c12c86f5d862
SSDeep	49152:EylKeP+VXyZz+qw89FSudZhTv5DQ4keO5uQjki:BGCZqB8KudZhdDyeSuaki
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	7.36 KB
MD5	3ac0c6cc8a0657fc1350f706f6e47927
SHA1	25eb6a8483d79338f9cbe9b11f8e7961ffff1004
SHA256	9406d16c25a8bb336ce01f2c0012ef7511e685b17790a807a1147e29f977ac8d
SSDeep	192:yqUVYdKZmwq2gjBVqvLQLad7NUYs/BCpAWJ:BxdKz0BAvL7i/chJ
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg (Modified File)
Mime Type	application/octet-stream
File Size	23.34 KB
MD5	66e72e4772638c882849c79e07728e5c
SHA1	bd1852430bd685dbb5269b1fe34a1f047df387db
SHA256	407f6728ed85a9aa1db82db284d1b0e780b4ca1ef2fa8dc72f467b6fac756884
SSDeep	384:diGfs+7mJW4b1ueMWxuU8o5A6ZN/YW/+O4GMe9gFq2QuvBou+03iVGcWY:NfsXWWQenucq6R/+O9kq2Qul0Vrb
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat (Modified File)
Mime Type	application/octet-stream
File Size	32 Bytes
MD5	8e5dd2ef95652e19c64b1dde0209fac0
SHA1	11aa944e0276a6918735bf8856929f40d7bf8df9
SHA256	f204880a666388f950538049ffc786543a75bfa5494769c2481eb51b825a364e
SSDeep	3:BdM6n/q4I+sDtf:BOuq4Dy
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\DkAOexCpByKujkW9w.xlsx.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\DkAOexCpByKujkW9w.xlsx (Modified File)
Mime Type	application/octet-stream
File Size	82.18 KB
MD5	148d517ca49793c562b2ef8d239f5d21
SHA1	a03616e4ce4d91222cb4455ad067bf427e25d19d
SHA256	1e3c7a5b511a1872304c395d97019369ec4c562a20399eef3c382728e0ca84d9
SSDeep	1536:dH4xK8gnGVClAoL7IFSeMVQaBL0okLp5NlVv7fNtijcfVN2cMs:xD68KZ4QyL0ok15Dtijc2js
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	530 Bytes
MD5	201c447f12c844d74d93ecfaca8f9839
SHA1	f27323e63a4c261128f5f1f976b356e63fd1ec78
SHA256	90d1b0ab473fab15d4e9f97c06588e2a39afbd7c29b0327e718ccc5270897d87
SSDeep	12:kEmJDSUDxoTfOsh182GzXYgJ4gpYDz1PqXc7QCQKQkw8ZBUewxn:kEaKTfV/x84e+sqQaQeZmV
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\SPTdmBPY2.bmp

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	77.59 KB
MD5	1dfb9863e082f99e58a4c3bb39993f29
SHA1	51b771435a8cc0fa1917a0317fe234fc195cc91b
SHA256	1677078d6c1e9a29fcda9184f6a650864b5a2efe9d919ccc59f776290cf053e1
SSDeep	1536:n02nkVeikFTf6ZlY93lvjybanfG+xDPQhmIxGQRApbFj8AmkorW+3to:02nSo6DUlvWe5KGm4bFjBm19o
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\xa3Jq.jpg

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\xa3Jq.jpg.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	6.75 KB
MD5	178cfe1ce2d514f397428256b296c273
SHA1	f0891204a3700a76be86e54aae43b76f73b15495
SHA256	9b605a7284dc5b7e1f883682be5be4c88d7fddeff8982f05aa15e964a2d3da96
SSDeep	192:MigTwEZbm4hSlXWebjjG/2NMYBJct2zNr:MXbm4hSlXWe39Mojr
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\xBOB8Luktfd.avi

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\xBOB8Luktfd.avi.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	88.56 KB
MD5	bf1984d1146601177ec95cedbc469c76
SHA1	8a65a004f6ff7a7ed168ce6bc2be8d3b5ec6cd26
SHA256	b1854f2872e933b2029ba2b9600ca87104199127d4094492053a7103374c2637
SSDeep	1536:8Hj6rPZkJx2nlmibSWrZ4NbfWoI4sC7ida1WYwUzFJMCgwdqhuijxIeQcMXelizM:RbZk2l/tyhOXNgNwenUDNIekuDyqO2z
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Ut1vfF_R5 uXcsKwuT.jpg

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Ut1vfF_R5 uXcsKwuT.jpg.babyk (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\UAe_8rmPVC.avi.babyk (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\UAe_8rmPVC.avi (Dropped File)
Mime Type	application/octet-stream
File Size	29.42 KB
MD5	5fa7dc00df4dedf848c6243475db11bd
SHA1	1c9a6bf1db4668cb9fcb3a4f2ade05a28d6167a6
SHA256	fdd9b19ff91aad9982ef52f28de573a03caa249f28a2c70cb4011afa16806c8f
SSDeep	768:g+AYySLcrH5wMdU5ce/u88ohlTdgKO5cgap51i5mOS:ghigD5wMdU5b/uJohrgKO6ga3U5mOS
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\YG_-W9bSlwDULxvX.mkv

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\YG_-W9bSlwDULxvX.mkv.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	57.95 KB
MD5	8e01ba82687ff66aed0be198a50f451b
SHA1	615ae638c6f146f210b4551949c47f408c8228c1
SHA256	8e016bdc2c5fe11d09dc901bf52a00b3a4d7f4d5fa7d97b2090de648d032b010
SSDeep	1536:1gm4N8bmz54CJ30SXMZSuQe11WcWl9t3NUt2iR9TA:fjCN4CJ30S8Zj111s3gFRi
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (Modified File)
Mime Type	application/octet-stream
File Size	357 Bytes
MD5	f239009c0644c615ec3bf90369343d5b
SHA1	f326a3bd3e7614302b0c3dbc02c6bced5e1980fd
SHA256	9188d9e612aea5f4b3b60924389dcf4b8ecf4dec1358c0ef065ad5eb5b5867bc
SSDeep	6:kVU8Qe8PqLcup+ta+nF20zkJl0sX2/PmE4A/Fl22HZORfZOhVQWDJRLeQW:kVoe6q4A+t3ZzXsXYeE4Au2HG08WDJRY
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3130B1871A126520A8C47861EFE3ED4D.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3130B1871A126520A8C47861EFE3ED4D (Modified File)
Mime Type	application/octet-stream
File Size	553 Bytes
MD5	1c1607678ed0e5efbf578f0314504719
SHA1	8596d0635be47957c0e9c8151db51f8c3665baec
SHA256	d6ec81881aca83971a48d1e2d718003941c32270ec2b0f0accb8635454a64b76
SSDeep	12:TDvgB6l4BzCPoOtzBXq5PFF7MEO6XJ82PPD3:40uBzv+AYEO6XJbPz
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	2.88 KB
MD5	1f894ff283e29b4c107825decb1ee775
SHA1	0070796560c3c3550aad636c05d5845021dd1eb2
SHA256	e5470cd3ccb097f6298cd79d083ee9a0ca6bd2146a20873626f98d31bd3b1590
SSDeep	48:oX/+zEq5+DU1xXpY9DHZSranJ4sykifrlV6SdCIda+xmcA9UQn46S59It2/:C2wq5+4xZ0MrKJJSgSdCIgf9UQn4PjUc
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	503 Bytes
MD5	73035e86b32a04d724a56ae39523df6e
SHA1	286e5df3e6e6e23a4c28c315bb7fd56db37fd99f
SHA256	f5021e6a3d4b0e3b1000fe9aa5b304177c66d079c71e9bc4a965bcfaaa35c1cb
SSDeep	12:WMvRaUEAgkNcwLuA12KdxTWH8014RSMQOadqpWBJWBPe:jZn3LumdTWh4RSjLQqJWBe
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220 (Modified File)
Mime Type	application/octet-stream
File Size	759 Bytes
MD5	3d2d7d106abd7d5020a0ae8e6bdab4f9
SHA1	d56c83b1e863cb407c208f366a2dc3b6ab5a1f74
SHA256	01cab72c18c259597cbba0f79a398a173b6870ab53ab6527e12d6dd5a6988f1f
SSDeep	12:daRLz1/q6sOa300gj2SXyCFNzI5SzAcSVfMTUWT2kufPcHrfpd9K:daBz1/q/OaLqRXyAEMzifMTH2tfEHrhe
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7396C420A8E1BC1DA97F1AF0D10BAD21.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7396C420A8E1BC1DA97F1AF0D10BAD21 (Modified File)
Mime Type	application/octet-stream
File Size	586 Bytes
MD5	41940840d943489a804b8c496322f171
SHA1	d90a1bb2e170753fb4331bea17f71b231484ff4b
SHA256	ee0859605736bccae08e3ea5052dc1e24d8abf0e19d79dd5a71910c659a15f2e
SSDeep	12:AXMbw8JwqbIcrnvJuobbhC3DIsn/8pwSI8nBeE9Pb1Bc30Nw81TK:AXMt5NrnvcUhC3UlJI8noUxBG0Nw81TK
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21 (Modified File)
Mime Type	application/octet-stream
File Size	1.60 KB
MD5	8965656e707c970212c6ad7fda77eaaf
SHA1	1d573d23b8e33b6da334a01e4f95e0476798e2ee
SHA256	0ce2cbfc01ebde8ecf0da241d1afcce8c5d2ff073a494f1e9f297febf5af1334
SSDeep	48:cpnYoHbVqoCfakc8ls6wGlpPv5Vx8CPF3yrSGD2:cRYo7goC3s6ZHPv5/t3yV2
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	538 Bytes
MD5	4dae0cc76f82903667e7e3d7d776fe20
SHA1	af2e05b18f38b1bc259dd6bb33d084068f830fa3
SHA256	8c8913428a2d44d9f73b10acb3ea58098c1a64f8309f305414b117d06d5ba84f
SSDeep	12:T/SarzdXSXizbOPhBfqIOfYIzqyC0hcW9KOlddOQ8z5UDd:Taa5KiYrq5fpztC03OQ8mJ
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	495 Bytes
MD5	508c1e8354fb6e02662b756d3a25a4fb
SHA1	d34170f8b5ed2fb77f00c1d6491d85d54e234d08
SHA256	03344011dc0a29677cf2d8d9649742be0fb2db35cf19c17d6e3310f2336492cd
SSDeep	12:q0paI5GqXanAJcAMetT+MSyyJv2rcJ9IILlTdOxuy3th8Xrm:nYI5PKnAJcAnkuyt2rcJbpdOxJ3T8bm
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC (Modified File)
Mime Type	application/octet-stream
File Size	1.51 KB
MD5	a7279a8646d0a506414ceb2f3225c1d1
SHA1	675b7e60c58e41dbc5e91a2982a53e21ab3ab922
SHA256	f7983128c26fb8f28c4fdc37a6dcd9c25d6733c1e155c44087f76ced34063988
SSDeep	48:VqKbocMStv7orPNdeIrA0fKEdtfCdifPDn:VqIocMYv7or9FfdCdiXDn
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873 (Modified File)
Mime Type	application/octet-stream
File Size	1.75 KB
MD5	dbaa93af4e57b7823b4829cfd32bcda8
SHA1	2c7c95c0774e08e7c62f917b7ba4c6cbea69bbc2
SHA256	1618bdf65215933ff96d115dea11c63cebf596454f3ce8754131c857685fdeea
SSDeep	48:pcXJBhoOkmvI66F/WosFSF2q98oQENxXi5Cf:pc5+mJYTsFSFl98NEN1yCf
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF (Modified File)
Mime Type	application/octet-stream
File Size	1.75 KB
MD5	69bdb56ac549406c82edadca137d7225
SHA1	a4fadbb6c009a93ddbf280c0fb36155bb9f3782b
SHA256	f6f11b1558ceb913c0e63f1fd5a061d1baf452da2f1e5b041e8d42aace079fe5
SSDeep	48:Xhs4Xj6RXTupG+E9qN6OmAuVrQlfZKVDLG:XhqXT8zqqM3AWSfwtG
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B

Modified File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B.babyk (Dropped File)
Mime Type	application/octet-stream
File Size	432 Bytes
MD5	b54e7c1ac4ed5f7c1f0eb2c899f17dd6
SHA1	0674ee7e3960fe4f636a7e1c448429d2cdb18aa6
SHA256	55868cb26a4e659edb0838feef48ad2ead2c7d6ccd2725609f917f1237a7cdff
SSDeep	12:MkN3bMjhTG0Ot7CXwkp1csD3UsSQoLjobj+2YdzMm7C9up:/Rvs3p1LDlSQoLr2YZ7C9up
ImpHash	-

\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875.babyk

Dropped File

Stream

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875 (Modified File)
Mime Type	application/octet-stream
File Size	390 Bytes
MD5	40c742b566582babe2a0dd9beb8f5a69
SHA1	c164101362a04c243811c6504d3b738953ed1991
SHA256	11faa0c94fd2345be5a1a9503bde1643274865782c0ba78a6d2cf8b1e518f815
SSDeep	12:byGQZ+eTi2wpgRoqTzLnxO3bRq9Bp/Q/88:ZQZ+eT9oIzLnxO36Q08
ImpHash	-

\\?\C:\Boot\tr-TR\How To Restore Your Files.txt

Dropped File

Text

Not Queried

»

Also Known As	\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\TaskSchedulerConfig\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\it-IT\How To Restore Your Files.txt (Dropped File) \\?\C:\PerfLogs\Admin\How To Restore Your Files.txt (Dropped File) \\?\C:\Recovery\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\History\History.IE5\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\en-US\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\1NBUR4HR\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\ja-JP\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\ONetConfig\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\ko-KR\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Visio\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\Data\CJW3O3KP.BX7\6NG60CXZ.9GJ\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\nrw\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\fi-FI\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Sidebar\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Event Viewer\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brz\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\03J4UQW0\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\D68G7BIJ\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\Data\CJW3O3KP.BX7\6NG60CXZ.9GJ\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Deployment\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\pt-PT\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\History\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\hu-HU\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\Data\CJW3O3KP.BX7\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\WPDNSE\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Publisher\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\How To Restore Your Files.txt (Dropped File) \\?\C:\Recovery\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Stationery\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\cs-CZ\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\zh-HK\How To Restore Your Files.txt (Dropped File) \\?\C:\Config.Msi\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\Fonts\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\6ASVN7J7\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\zh-TW\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\dut\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\IMJP8_1\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Credentials\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Backup\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\zh-CN\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\sv-SE\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\IMJP9_0\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\VirtualStore\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\RoamCache\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\Search\How To Restore Your Files.txt (Dropped File) \\?\C:\MSOCache\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\Data\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\Groove\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\frn\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\pl-PL\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\KETAJP6D\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\spn\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\FORMS\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft Help\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\Data\CJW3O3KP.BX7\6NG60CXZ.9GJ\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\Data\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\pt-BR\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\da-DK\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\es-ES\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\grm\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\dan\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\IMJP12\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Transcoded Files Cache\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Sidebar\Gadgets\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\Groove\User\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\ru-RU\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\fr-FR\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\itl\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\How To Restore Your Files.txt (Dropped File) \\?\C:\PerfLogs\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Media\12.0\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\XT1RPYG9\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\Groove\System\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\swd\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\nl-NL\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Backup\old\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\VB18B0KB\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Media\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\nb-NO\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\IME12\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\prt\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\el-GR\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Cookies\How To Restore Your Files.txt (Dropped File) \\?\C:\Boot\de-DE\How To Restore Your Files.txt (Dropped File) \\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\How To Restore Your Files.txt (Dropped File)
Mime Type	text/plain
File Size	1.64 KB
MD5	5abdd19cafcd3e72f92826392669abbf
SHA1	4d1b82cb3ea2d38e9a64b9e554ba37076a534836
SHA256	2a4bb91546305a2029efcf3c4bd6977e580d3d9824186cafec66199407f6e507
SSDeep	24:Ld4gVOOBFxHGI5QxNvpTPPYGRjjNnF30EdiR5d157+7Gn1rKF+d339uvGln:LfVOOBFZGKQxxpTzlO/deGnnV3IvGln
ImpHash	-

Remarks (1/1)

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After