8d3f68b1...965b

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\FmoAc.exe

Sample File

Binary

Blacklisted

»

Mime Type	application/x-dosexec
File Size	172.50 KB
MD5	c0202cf6aeab8437c638533d14563d35
SHA1	5767653494d05b3f3f38f1662a63335d09ae6489
SHA256	8d3f68b16f0710f858d8c1d2c699260e6f43161a5510abb0e7ba567bd72c965b
SSDeep	3072:tEyekjv8/eFJ59W2+yV3XgDJ/nptkIV77pJd7RQy+P/:qMo/eF7EDyVgFfn7QyK
ImpHash	3d84250cdbe08a9921b4fb008881914b

File Reputation Information

»

Severity	Blacklisted
First Seen	2018-08-17 19:43 (UTC+2)
Last Seen	2018-09-26 05:30 (UTC+2)
Names	Win64.Trojan.Ryuk
Families	Ryuk
Classification	Trojan

PE Information

»

Image Base	0x140000000
Entry Point	0x140008614
Size Of Code	0x16200
Size Of Initialized Data	0x19e00
File Type	executable
Subsystem	windows_gui
Machine Type	amd64
Compile Timestamp	2018-08-14 11:45:17+00:00

Sections (7)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x140001000	0x161e0	0x16200	0x400	cnt_code, mem_execute, mem_read	6.44
.rdata	0x140018000	0xba80	0xbc00	0x16600	cnt_initialized_data, mem_read	5.44
.data	0x140024000	0xc2f8	0x7200	0x22200	cnt_initialized_data, mem_read, mem_write	4.02
.pdata	0x140031000	0x11f4	0x1200	0x29400	cnt_initialized_data, mem_read	5.18
.gfids	0x140033000	0xa8	0x200	0x2a600	cnt_initialized_data, mem_read	1.42
.rsrc	0x140034000	0x1e0	0x200	0x2a800	cnt_initialized_data, mem_read	4.72
.reloc	0x140035000	0x610	0x800	0x2aa00	cnt_initialized_data, mem_discardable, mem_read	4.75

Imports (3)

»

KERNEL32.dll (84)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
OpenProcess	0x0	0x140018048	0x230a8	0x216a8	0x382
CreateToolhelp32Snapshot	0x0	0x140018050	0x230b0	0x216b0	0xbd
Sleep	0x0	0x140018058	0x230b8	0x216b8	0x4c0
GetLastError	0x0	0x140018060	0x230c0	0x216c0	0x208
Process32NextW	0x0	0x140018068	0x230c8	0x216c8	0x39a
GetCurrentThread	0x0	0x140018070	0x230d0	0x216d0	0x1ca
LoadLibraryA	0x0	0x140018078	0x230d8	0x216d8	0x33e
GlobalAlloc	0x0	0x140018080	0x230e0	0x216e0	0x2bb
DeleteFileW	0x0	0x140018088	0x230e8	0x216e8	0xd7
Process32FirstW	0x0	0x140018090	0x230f0	0x216f0	0x398
GetModuleHandleA	0x0	0x140018098	0x230f8	0x216f8	0x21b
CloseHandle	0x0	0x1400180a0	0x23100	0x21700	0x52
HeapAlloc	0x0	0x1400180a8	0x23108	0x21708	0x2d3
GetWindowsDirectoryW	0x0	0x1400180b0	0x23110	0x21710	0x2b7
GetProcAddress	0x0	0x1400180b8	0x23118	0x21718	0x24c
VirtualAllocEx	0x0	0x1400180c0	0x23120	0x21720	0x4f9
LocalFree	0x0	0x1400180c8	0x23128	0x21728	0x34a
GetProcessHeap	0x0	0x1400180d0	0x23130	0x21730	0x251
FreeLibrary	0x0	0x1400180d8	0x23138	0x21738	0x168
CreateRemoteThread	0x0	0x1400180e0	0x23140	0x21740	0xa9
VirtualFreeEx	0x0	0x1400180e8	0x23148	0x21748	0x4fc
GetVersionExW	0x0	0x1400180f0	0x23150	0x21750	0x2ac
CreateFileW	0x0	0x1400180f8	0x23158	0x21758	0x8f
GetModuleFileNameW	0x0	0x140018100	0x23160	0x21760	0x21a
GetCurrentProcess	0x0	0x140018108	0x23168	0x21768	0x1c6
GetCommandLineW	0x0	0x140018110	0x23170	0x21770	0x18d
SetLastError	0x0	0x140018118	0x23178	0x21778	0x480
HeapFree	0x0	0x140018120	0x23180	0x21780	0x2d7
GlobalFree	0x0	0x140018128	0x23188	0x21788	0x2c2
WriteConsoleW	0x0	0x140018130	0x23190	0x21790	0x533
SetFilePointerEx	0x0	0x140018138	0x23198	0x21798	0x475
HeapReAlloc	0x0	0x140018140	0x231a0	0x217a0	0x2da
HeapSize	0x0	0x140018148	0x231a8	0x217a8	0x2dc
RtlCaptureContext	0x0	0x140018150	0x231b0	0x217b0	0x418
RtlLookupFunctionEntry	0x0	0x140018158	0x231b8	0x217b8	0x41f
RtlVirtualUnwind	0x0	0x140018160	0x231c0	0x217c0	0x426
UnhandledExceptionFilter	0x0	0x140018168	0x231c8	0x217c8	0x4e2
SetUnhandledExceptionFilter	0x0	0x140018170	0x231d0	0x217d0	0x4b3
TerminateProcess	0x0	0x140018178	0x231d8	0x217d8	0x4ce
IsProcessorFeaturePresent	0x0	0x140018180	0x231e0	0x217e0	0x306
QueryPerformanceCounter	0x0	0x140018188	0x231e8	0x217e8	0x3a9
GetCurrentProcessId	0x0	0x140018190	0x231f0	0x217f0	0x1c7
GetCurrentThreadId	0x0	0x140018198	0x231f8	0x217f8	0x1cb
GetSystemTimeAsFileTime	0x0	0x1400181a0	0x23200	0x21800	0x280
InitializeSListHead	0x0	0x1400181a8	0x23208	0x21808	0x2ef
IsDebuggerPresent	0x0	0x1400181b0	0x23210	0x21810	0x302
GetStartupInfoW	0x0	0x1400181b8	0x23218	0x21818	0x26a
GetModuleHandleW	0x0	0x1400181c0	0x23220	0x21820	0x21e
RtlUnwindEx	0x0	0x1400181c8	0x23228	0x21828	0x425
RaiseException	0x0	0x1400181d0	0x23230	0x21830	0x3b4
InitializeCriticalSectionAndSpinCount	0x0	0x1400181d8	0x23238	0x21838	0x2eb
TlsAlloc	0x0	0x1400181e0	0x23240	0x21840	0x4d3
TlsGetValue	0x0	0x1400181e8	0x23248	0x21848	0x4d5
TlsSetValue	0x0	0x1400181f0	0x23250	0x21850	0x4d6
TlsFree	0x0	0x1400181f8	0x23258	0x21858	0x4d4
LoadLibraryExW	0x0	0x140018200	0x23260	0x21860	0x340
EnterCriticalSection	0x0	0x140018208	0x23268	0x21868	0xf2
LeaveCriticalSection	0x0	0x140018210	0x23270	0x21870	0x33b
DeleteCriticalSection	0x0	0x140018218	0x23278	0x21878	0xd2
ExitProcess	0x0	0x140018220	0x23280	0x21880	0x11f
GetModuleHandleExW	0x0	0x140018228	0x23288	0x21888	0x21d
GetStdHandle	0x0	0x140018230	0x23290	0x21890	0x26b
WriteFile	0x0	0x140018238	0x23298	0x21898	0x534
GetModuleFileNameA	0x0	0x140018240	0x232a0	0x218a0	0x219
MultiByteToWideChar	0x0	0x140018248	0x232a8	0x218a8	0x369
WideCharToMultiByte	0x0	0x140018250	0x232b0	0x218b0	0x520
GetACP	0x0	0x140018258	0x232b8	0x218b8	0x16e
LCMapStringW	0x0	0x140018260	0x232c0	0x218c0	0x32f
GetFileType	0x0	0x140018268	0x232c8	0x218c8	0x1fa
FindClose	0x0	0x140018270	0x232d0	0x218d0	0x134
FindFirstFileExA	0x0	0x140018278	0x232d8	0x218d8	0x139
FindNextFileA	0x0	0x140018280	0x232e0	0x218e0	0x149
IsValidCodePage	0x0	0x140018288	0x232e8	0x218e8	0x30c
GetOEMCP	0x0	0x140018290	0x232f0	0x218f0	0x23e
GetCPInfo	0x0	0x140018298	0x232f8	0x218f8	0x178
GetCommandLineA	0x0	0x1400182a0	0x23300	0x21900	0x18c
GetEnvironmentStringsW	0x0	0x1400182a8	0x23308	0x21908	0x1e1
FreeEnvironmentStringsW	0x0	0x1400182b0	0x23310	0x21910	0x167
SetStdHandle	0x0	0x1400182b8	0x23318	0x21918	0x494
GetStringTypeW	0x0	0x1400182c0	0x23320	0x21920	0x270
FlushFileBuffers	0x0	0x1400182c8	0x23328	0x21928	0x15d
GetConsoleCP	0x0	0x1400182d0	0x23330	0x21930	0x1a0
GetConsoleMode	0x0	0x1400182d8	0x23338	0x21938	0x1b2
WriteProcessMemory	0x0	0x1400182e0	0x23340	0x21940	0x53d

ADVAPI32.dll (8)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SystemFunction036	0x0	0x140018000	0x23060	0x21660	0x2f1
LookupPrivilegeValueW	0x0	0x140018008	0x23068	0x21668	0x197
AdjustTokenPrivileges	0x0	0x140018010	0x23070	0x21670	0x1f
ImpersonateSelf	0x0	0x140018018	0x23078	0x21678	0x175
OpenProcessToken	0x0	0x140018020	0x23080	0x21680	0x1f7
OpenThreadToken	0x0	0x140018028	0x23088	0x21688	0x1fc
LookupAccountSidW	0x0	0x140018030	0x23090	0x21690	0x191
GetTokenInformation	0x0	0x140018038	0x23098	0x21698	0x15a

SHELL32.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CommandLineToArgvW	0x0	0x1400182f0	0x23350	0x21950	0x6
ShellExecuteW	0x0	0x1400182f8	0x23358	0x21958	0x122
ShellExecuteA	0x0	0x140018300	0x23360	0x21960	0x11e

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.00 KB
MD5	3d605d0c6cd7a48160150c467aa83dac
SHA1	5a1331867693742c4f25c07b7cada4436e2796d1
SHA256	f684902b051ffb0b7f724ae1ac0ce0a8b07d0278491a59d0869bd009182c6c67
SSDeep	48:j+RRUQOn/T3nQ6d97c4w8qba/OvF77rXQoyB5Xx:jmk/T3nQgvMa2vF/DQvB

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.manifest

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.63 KB
MD5	fa5fb1800a9908bd73270edb68dad948
SHA1	a3639e6477b5abc9b80b3ff68cbdfb4dff1ad2f8
SHA256	fc7aa7840075d192bc3f60dbe2d8d37df2b6ecbca1fba57e0b53a6cc72811c6a
SSDeep	48:HJLiPMEi05JP1vwLhtsUxNmVXPIO/bkWRGkPyVN:p+iYP1vwLzUXgO/DR1PMN

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	3635c246ecec600bf3665864edd896b2
SHA1	5c3e688706fbc585c9cb4a7f837ca2ea05afffe6
SHA256	490c4cd4603f7875062de62fdc271fb54d62aeb49ababd73c0cbd1daae5a0b94
SSDeep	12:ljdTHalC02u9CA9tl64vfEZHZ65BBu0lFAJORAQ/oqeG/DXCcdkBLrZT6c1QQQVN:lh57uPtHv8dZMJsJ2KbGbpyLV6AAmPoL

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	28.28 KB
MD5	491899f95a074ab8c3e34fda0abd348a
SHA1	cf43934331a3a79863a4332ea5f4ec95f1c449df
SHA256	71615f4595365e5353cbab77c3f7d894cd6c96bd23c107698177d7eb16776461
SSDeep	768:rSZmRamfgNgEwQYvtLxeaiEahLJuyHKjfR:r5+NgEqVxjmLJrHg

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	0.81 KB
MD5	3039cf2b8cde958de9e1f4c1f97026da
SHA1	6970a9ba57aae936005b3d912c1d43f412d0ca16
SHA256	f5f9b3f7cd0a111e8159ce8d3179b8b94ae97b6c1e69bcdef8304effd9181c48
SSDeep	24:3/wDAV9GVqj24HnLpBJpgDW4N7gyFCIP2lc:3/mAV983InLTJpgDW4RKlc

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.icc

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.89 KB
MD5	0ccdafd14e8991300bb5a59c6125bb8c
SHA1	329240481c6201b9c527e8544fdd73e34224bdaf
SHA256	03b99e298e48aabcdfa1eae3ca6e6ebdbc7a1d98fc8b1a0661269643935fd191
SSDeep	48:PnyBJ1k7IeG52dqvsoL3g2wp5OCHJMRbhbjRBgkYwWLlwLf3KP7XmxLoWtnf:2Jm7Ir2kEh2K/EjRBELaLf6TUsq

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\05_Pictures_taken_in_the_last_month.wpl

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.05 KB
MD5	794e16ded59752de05feec7d906199ec
SHA1	c127af47c41f90dff72ad01e65f7dcfc49889867
SHA256	cc2b70fdfd6aca275527ec7a450a03c9d9cde749354af486bdd9684d0555f03d
SSDeep	24:cHnzRX2zBji0g+uAe/LMF3oA1fqItsdJpWs1c:cHzAzBjHpe/Le51fqI+Jppc

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	c31cbe703a16d8d23a96fee29fdf02d8
SHA1	8eea9883bd0957ec2035792f5b6e8fc679ae117c
SHA256	65c41594729398866bd9e0dd28c92564f4ece402993713df61cbedcfe92cabf5
SSDeep	12:oUP3s/mgFoWney9lYGHEKw950QtWdMicy/tO1JZdoGJ9SLPTUE4X7YuttxJCBKq0:oUfs/mdWnT9lVHBwMdn7FO45YTptF4h0

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\x7hbSg-AIke.bmp

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	99.66 KB
MD5	27a2ae72399aef777a68ea1633c242fe
SHA1	9e516c30c8e43a4958302d1fe1d21e0204067685
SHA256	aa381eec2b6762c5dc9a595e41e25f4260a34efb4fe6a9afbeab3f22a86b7ec3
SSDeep	3072:sjkY+mKT8M8ol0o/u45+tS6KFuJuftgT8o5wEi3s:/7vuS7ugtgAmic

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	1729d6af8837f7ee92933d1f7bb8943e
SHA1	90d3b919da37258850f64ceb1ff15c1068b96e28
SHA256	aee124201566eeb6cef2ec90dede1900d47da7668f920a734d23a0f38077bb86
SSDeep	12:ekjcY71KQhMoEXw5lLXXHdQaNI1i6xCXyjANpcv3Wh1J578pjMTa1VGTjb5aKuuU:ZAYJCA5lZQaNIpjAW+J5Ix2a1Ixlo

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	548a8a2f03e32327f0951d8e3a03d9e6
SHA1	8e72baac876c9dd3a2e0b8bf3a02ee349ec59bd2
SHA256	ed9a048947905b0757111f771a2215d40ff253cfc41d6144f5575e47355cfdda
SSDeep	12:bwmS7pN3ndjLJR8xkjTWQajHzG6BdoBaWwuWDM8dKGroA6d1ksP2Yp:cNlNXdj4kjTWQozG6LoTwu6/rx6d1ksX

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\03_Music_rated_at_4_or_5_stars.wpl

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.52 KB
MD5	55b6f796c6b1f161b6078432d6c54047
SHA1	c72eb96b8d4e9f10357b3ce4e2bb8fb3c7269942
SHA256	2fce0e21f2c975444dabe25332787d941f9b596e9e6c46c48870f54486b15f22
SSDeep	48:koXzUA5ZbP6yHMPMOvBb0fAPQ3vQf0avclvfiBe+CqGNdS:kcUM760MPdvifSQ3vEUfce+iS

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	0.78 KB
MD5	62618cfe2aab3636d1cbc70342ebbec0
SHA1	f2a6844c7cfdd615bd55778ffb79ad9c2d43f485
SHA256	108a47c21fd98fc3e858d008b2a8cf8004899ce77c1a4b04bc5109d63e18b02e
SSDeep	24:mJxP2JCB9ZkOBD12l3njEkp8/mTTExnUMQ2s:mS+bL2lQkp8/mXYnUMK

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	32.28 KB
MD5	7aa8142e8c29dc10a494408747a66e37
SHA1	8df95cfa1559f535ed489e2733db9f376739486b
SHA256	61af1e57499445072a87a14c935f21f075bd201516762a591f84a2e480b58507
SSDeep	768:YQyAqcyT+cjzkjiKlcK0kNCgWorJCiipVoxlHqhp4JqLFW6E3d:YnRTbzk/c6SosiiklHqhuJb5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	5f0072213d5e1eaa9fc650e3130f03f4
SHA1	beed0caeeb04cc8d915b178dc9ed519bcb219a92
SHA256	34adfce0f84f944b100768878ac64d6eb4e1e8ab3663d41e603b507ef3947aa5
SSDeep	12:8QAQBitmc126ZOKJ19ZlVdMNlGVz//8x4D1mkRnWSs6rss2s7e4ucdYNFqGYDgAJ:PwmVlKJnpdMNKswmAWt6VH7uctg6

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\02_Music_added_in_the_last_month.wpl

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.52 KB
MD5	ab820eddda12276654a5be2eccb4d4e4
SHA1	a8fed6f11b589c3425bcb992528aa56b3a6ad1a6
SHA256	198245fa192dadf46c8f09490b66d5cf12f70ac9c06e0bef5046a323dca80c17
SSDeep	48:hwPgrY6RDHJz/j+EApSsxKuGoLvDOhDAsoi:xlDHJjj+5eutiJAsh

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Vzdyixuson.flv

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	88.41 KB
MD5	8ec0cd56e5c732a3e3f75f4569bb53b9
SHA1	1c5f59223d8dfc57fecb574c76548f75dcbc0d9c
SHA256	b534768c06136b6108a18fe61141f930181f82254a64b5decdbedfc5177d4f8d
SSDeep	1536:5yr6eOxYykMWZZJQixgM0kOX7XWBViKt9I4ed0ocQFAijjk4hkNhPXlbBDbMcyxt:8r5OFbWZnCNCVP+4rocQuisgkNRlb9MF

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\VkZynCnq6y0.png

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	88.00 KB
MD5	b39ac30ce0f6cd9abb43843c3c5df9f5
SHA1	5bde97d00c1db50142beab748075fb50bd46ef1d
SHA256	ff4833e3021c73758bde909dcd221c5441ae5f55e5268f5dcb62e9dd69eac427
SSDeep	1536:3auCCNE/74o1vYizEReqnNoCR1vcsi6ziX4Qc8w8wqsiK7KATJ2gA2x6qcbv:3lCSEMoWReqLRlcsCc316AT8gzrW

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	128.28 KB
MD5	70228201d48d10e64460066b35eef99d
SHA1	0f628e67044b765b8fe1a9c926f8ff5f651907ed
SHA256	e336be27d85b2a64d54bf40df60fd9702412bf8e10bbc92c7b6d1b1dfec8e84f
SSDeep	3072:p5U2ah7acyNZQT2nFcjYcZBvth6K/0KGWz4MyUnJPpupRq7S:nIhecyNs2FAf6KsNWzjycPpupRqW

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.39 KB
MD5	beb5c162657c1ab016833682cb8ab9c9
SHA1	71c40ef4b25bcbd35bdc8a2fe30175a76bf6cd9d
SHA256	52a0eb85ad4d78570e1581ebe966c75c2e03fca3f255ed8380f19dda7e266ba3
SSDeep	12:EAxiyAZ8Ze2Fp8HI2CKAlKY0KvXfY+beaWIQSvQ:EUiT2ejo2ElKSP/4I3vQ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\AP56ujxo.gif

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	89.33 KB
MD5	9a7e3e3e53c7cc79995126128308ccc8
SHA1	a66e67cff23bbe3cc0371519377f940110ca5f0b
SHA256	8d1fd2055f884095ff0566e1fbce3ee366d9f4796bd7dbbd7a83d0474390860d
SSDeep	1536:TbNXtJAFSHYybnfF7fnn2A7U5fIvzM+ndhahYxj0ISy7G7y1Rq/eh82MOrVsEu6e:PNXtJAE4yjxn2AkCMQLaYxxG7y1R5hZm

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1DAF2884EC4DFA96BA4A58D4DBC9C406

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.53 KB
MD5	202ff0dba0fd5e411c497878f4c95f82
SHA1	f5e979d2b09f8f129c609bb04f55618ec609031c
SHA256	0338bece4d12c30d29ccb020f5e025f667e6bc3b34615dca23156699b90638fe
SSDeep	12:RE+N+efm2161tBa5HWSPVtKoDvD/3VvSz9os42TJhAZXu:K/efmq5HWSPHDvD/3VNs42HIu

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Xvfh8g056KKpbsL.odp

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	76.46 KB
MD5	7f7b3ee94140d15180babf890421ef7f
SHA1	070ed386e379b0d62db535a4839990dbe365c2de
SHA256	ba222e7f5626fec8e2d4e43696e7ce366ac4236750063636b07705a9b84e761f
SSDeep	1536:RbYkKOF2OkW8KgJJP1L2LdpnYuwzKeyaUz0+0f:REOUVZKRZxmzgdz0Rf

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\index.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	32.28 KB
MD5	76935818493bfa6688ce0fc0d9bde8ba
SHA1	e3b3e96c33748efc710ea25d678446a00d82bdef
SHA256	856f64a613127957b9818aaea6e3975dca683a9c4f8fbc6802f53f8af7c8393a
SSDeep	768:8BzPqEwwaU4mYhIYMMHTg/jt2w/gwx1A53B8tFK7CaoRmdc/GcJ:85yBweCig/lxm53qHKeaozJJ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.52 KB
MD5	0d00f7ad865bafa10be3102082e0c609
SHA1	dcebddb844e1afc6ca9ba1491059351794a3de0e
SHA256	f50924501a313ea4b9943f918debe2a06a594c8c63d75b2e70c2920204a760ca
SSDeep	12:oqEfjxKUhkip1a0FR1YE0rTjg1bpNrv9bAeBEs:oljaiCU1YEsYRBbAds

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\04_Music_played_in_the_last_month.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.53 KB
MD5	2431da335864a207e5a2382d273abb67
SHA1	df9e92351a56959e64bf5bfb5913a8ca7bc7f4ac
SHA256	53790ac20fd5e216ed20d70a55f7e9e87ffdd56be11c8cea1caa8eeb64c0f0ba
SSDeep	48:+UdKCpCCuBg3V/Ob5LaOiSBdOnXfmwZC+sPD:+48aVU1aOlAX+wZC+sPD

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	f2139b2028e9bc1219243f8fd1b0bb17
SHA1	33462e009c3908891539e70c21f935b0e9b20a87
SHA256	aaa78f206ab62a8a0c5485734c0f41ad314cf45e37aace4afb5aca804c0bf88c
SSDeep	12:cZVjBVaXMv3b4Pbxwde/ENqdNwymfNvC5y1smf0EiwwwbSgIocQ:yVjBA23+bmde/ok/4gmf0zvg

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Visio\content14.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	99.50 KB
MD5	93287e33530167186a421f9e05ac4530
SHA1	276d5c22035786f47c9ff767cf480f4e049a6c43
SHA256	5d835e0c78073045ae1409ae34608626c6f2891f721f72a75cd1a3b78a7c0b80
SSDeep	1536:m6h1A39wTP9V6riuACnAUrXw/bjyIXBhVTqPa/I/P8a5fZY2h9FJVyNkol7oFD+L:JIOT1JdCl4jxhua/i8y9vVyNkouBXSbV

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\ACECache11.lst

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.42 KB
MD5	694964e4a7e26777dcf067f5d60125e3
SHA1	41c2a60183d3a8a16b0edbcb033257b6928d4038
SHA256	f1fc92f0d66a12dd0cbf37a994f4b3dee837865bdca05b1d1a4b9961f52d6ea4
SSDeep	24:NpmJoRordGYYJIjDhb5xW5T0eIF/fi6Re5pQMouCOE+GuL5wYei406CW/5nQ9mgn:NpmJoRorsYYup54V0eIF3Z85CMNEV4br

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	e3c9974ffdde8ae9741439ee0992b184
SHA1	188184f1efb9272cefacfcf179bd3297b091153e
SHA256	9fd496c868beb14acf74939a5b2f33a57bef024da3147080c6cd8bcb8c6e976d
SSDeep	12:NpEuMBHmmLy65OpenUqRCwTH85ssQm9oFY8zqMyof6s2OE:NYBHhLrOMnVfH85Qm9olGIv2OE

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\QFHy94MFeo.swf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	61.67 KB
MD5	54583375e97b279a010d1baf8ad2f03f
SHA1	93e6eb1a5f5f634527e4217718c36bbc6896ce80
SHA256	69e2de020d309926c05cfc78a4c903c0013b7b8be0d607e199608d1835ef1eef
SSDeep	1536:a5zxb6DEowgFpt3jrfXQlhIvsRLvWNTfbpctOgj:a51m/wgFpt3PYfIE9eN/pctOgj

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	a2dcbe0c2273ee43fd17b3665dbf7581
SHA1	5adca1cddfe59f3231fa2d4c153c741dd02820ba
SHA256	f6bc109502ae3ef35e8105ff128a558c199eacdc9d8db341dc0a5d5203e95285
SSDeep	12:Ytw7iucP362MGpTEsoQn5h9gdyzp9QKekkgSReCTYeQmQBNe3i+JW+i1uoNOHd9:Uw7iTPK2HT9n5hCgijTYjBwi3d13IT

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\u M6M_AAd-mFBjkWfPBA.mp4

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	29.38 KB
MD5	6e4b05f063302388cf80ed71f0e88828
SHA1	8cd44332fc3b216ca914f589a267da11e8a0005c
SHA256	68cd2909c6b849eebb79319f3decb368b463d5cebc113e7f239420c4fa2fe14b
SSDeep	768:irilUZWMvTgJRxHOjdr7AglRf8GFKv+RQLI1phO33QtLoQj:6YU5Ty8r1C+RFwneci

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.61 KB
MD5	075e23b4a99fe4c4b0a63cb619cc3cb5
SHA1	a9efce9d23fce8af706221ab94a7c6068444ef55
SHA256	3e8f12d69b1a47351d0877199334ee5357723a10b8a15d500b2fca64fbfac9b2
SSDeep	12:a1+NsIfLBhJCGfnKMphoiGSwr1cNtdkQhwpJz9BD639Wea72YAX2sD:wIPJFCMphgSwFJRp6NIpAX2sD

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\treA-1QWjT.avi

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	69.27 KB
MD5	acaa55a50d3d984c161f3378521389b5
SHA1	195b9cea76e695201ee006f528673aed4069067e
SHA256	bc995048d251143a02f234850f3ed464bda09095eacfbe4c545017127c6dd126
SSDeep	1536:mrOd1B8StyxuAQTMrZQwjP2NPe1LovZiP6lbYosRN2e4AYB57r/wdNCf:mrSv8StwueSESepovoPebYhvk4Q

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	128.28 KB
MD5	b620f8a824c45a3b97b06a6ae508e7b7
SHA1	5def0351c48981c06ceb7674676576f2929460b3
SHA256	7e5e6d6f8c12a764121999d5175c2e284ef3b1a7b193adf0dbb3f9663a485706
SSDeep	3072:Vnh48+Xili1XEK8v3koj+y5qIyju3CsY7lC5:9+Xio1l8v3VyjRL7s5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	32.28 KB
MD5	9cacc7e6f577d84a5889e5a3b5761201
SHA1	ff380f2b45b1c16375ae891a13d27a0ee65951ee
SHA256	784000e4c517639d84f2b9d8962ae3020f475325b1d3de24d93139d4e3f9de4e
SSDeep	768:TztVWm20fIZjWNiVVRghZ4Lx6gATRSa0XX2tO:33xi3RkZOxJATb01

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.31 KB
MD5	0e6a336580cefeb1bb90403797a52203
SHA1	ef11c57cf57fbaff8cd0e8fc340f2c5b364f0316
SHA256	521990b3e383d0cf6620ed335be39de31d7ad5010c0db323f57ba04c256a390a
SSDeep	6:J8kb6LS7Qw+zYp1LDhyBwVhJ45aNEmsCR38a0jqWGiQp7TNyjtn:Ji6Qw+zYp1L9yqhJN+Ll+vYjtn

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	21be652990f3b5a8c33b09e8caa8c1f0
SHA1	d0cd505de75ddac974d9ae274d2a56f1cb22b2ed
SHA256	d20ade01a59eb5ef18ce5ec293a6ad5857c6b126f8aa81d33005acd3124de97f
SSDeep	12:LbiDjofMiPTyTO6QuFu7smwoTHHp+qfFPX4DlZCeMNNFGH1srPceM89sLH5+rb:/iDjc4QuFwsmwmHXolr6NS1sweJ9sYf

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	240.49 KB
MD5	630669e4207cfdfd9e28f19323fd9543
SHA1	dacbe5ba924acb6baea14622b66c334b60e4f807
SHA256	39018ba3f7c77d5f91b43610cd9007c8dbbf63817d73c97b298d1e1695c595b8
SSDeep	6144:KIMkY0gUHMUBhmx+f5+jKiBqm6ndEuYr1CMpDLQMk/E58:KIMZVoBhEK5+H6dEuk33QMksy

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\08_Video_rated_at_4_or_5_stars.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.27 KB
MD5	9b254fc7422f54ec07b04f63fb4cf579
SHA1	f829b71711d80f673cccea439bf50f2236ec9d97
SHA256	4cdc29c02663acdcfc3aa3d657eeb6e36d4da5e4f01bbcfa2f8bae7f366b3afa
SSDeep	24:T5xzKJmN1/U6V1HnbSazIbqqTX6OU3oCrY/Gph8ceMeeT+xcRgQWfxqr/:T5xcoVPGazDqmZ3oiS08ceMeeqiW/fxS

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Visio\thumbs.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	125.28 KB
MD5	3edf9f3162343dbbf35650c741523711
SHA1	8b22d92a7a712eaf315ede1b8d4a58c8b9106154
SHA256	9699243fc57c139d76660feb11df5f170c7629a1681fe23ccac3568c0c29d173
SSDeep	3072:PUkWFZqag6SE0GGcDxAVaoKk+u9CHKYG+Q:PUkqZLg6WWfo5+usdTQ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	11.83 KB
MD5	bf20430bc9f07d76fa1394a3225cdbf8
SHA1	0e842c9a8b230e5d448177cf54c34f31ce9519d3
SHA256	a8579244aa31e48c571c09f7d416d7753a3d7e3181883612da6ab7e7c4faa727
SSDeep	192:7pWfyIzI9i4TZmUH4CE1wq1B2drk32di7onWMThX4g1U2IBt3Lpj:7ppIf4NmUH4C1+Cs2E6nXn1U9bpj

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	e8a3735e5af9c22ea26e30f0c1c4ada0
SHA1	c88327b46fae24904690f9b24f08f23ff5a48796
SHA256	bed3e8e387c57ac6b42a02613a159be2a9ab3edd732f784e6bdd06b49f4def83
SSDeep	12:09rkqARlgf0RTLaNPBhGZrswC10ZMvx3UlAy949kTqFTATPCWZ0ZAc8RgrSp:2QzgMyZQZrsdoM58qFT09ZSArRUSp

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\07_TV_recorded_in_the_last_week.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.30 KB
MD5	a2862f8caf13b962a6904495511c4579
SHA1	af0af98d341344fb4656aa9b5ce4483b329d9a11
SHA256	e6f7e8dc17613639f3e60e43764b6b1bcdae9c9e65dffbc0a7cfddfc8a6184e0
SSDeep	24:TKgYycYDbntYu/WnX4SZ2NrB4YHkZ4kEm+I/gFRTMFWrpfn7TDYDrVKdF1O1:uWtZiX4SZmSbZ4vhIoFRWWrl7TDYDrVH

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\zfKXNkr7GrGlHIsM.xls

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	27.83 KB
MD5	14aab4a39a991fbbfff8d624f16d63e7
SHA1	85737a5994cc5a212b535eeb3df44ede262c5106
SHA256	a22108cf9ecbd43c9a6491ea020392df6726d365b8cfeb3c96fd0ab420981838
SSDeep	384:Mar+x+/zzH9/6+0nkj9UgFi9eOWwfjYQBpYHXdjV7tExoKMAgwoRy1j2I3eXLPfz:Mal/z8+0kj7jtwf8QXYJrvKMtN+Sx5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.86 KB
MD5	a330bd5efc2cd21e4fd38e1bb16f12c5
SHA1	f5530f661985424c607a28a053e2b0254a3a88e0
SHA256	f4088350e981d411887f691d67da12f1a4d8283f3db9f2478d8657abf9fa6e43
SSDeep	48:VRAJOSBEDx9hLULEVG1aYMuOM7UgbmTSoSD2/xQ:VuJurLUgV0aYMuOMggbqQ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.88 KB
MD5	a15302bc3772a800a122f6466dce9ec7
SHA1	60081a613219c969a6740357f121a908e2b8b550
SHA256	c178aff84cbd5cb7a3094315c2b744961259394294699c7262ef28625447366d
SSDeep	48:dVMU2ksv67mKLfqoNqcxcapkjIlX5DyVNlutOWg1Qxh8X:dyU29Cm6fNUI92iJDKF1Qxh8X

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\mapisvc.inf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.38 KB
MD5	983319f3ffb491ba7422106a1f8638cd
SHA1	01b7c133ef26222b05df55f09fc78f387008080f
SHA256	d1dc2b368dc469915d5ab7f2b1dce2cf1086b2bba3fabfa2714036cbb11f13f1
SSDeep	24:R72VuX5VclOl/W8SgC247iGsVVYdWm0tkxTYmigcOBufj/7AQvYOz/VsGgfz8Y:RJX5RFCmGsbvklY7g7eMQvYOjVezb

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\frameiconcache.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	9.27 KB
MD5	a5941d63171e013d4ee87d7d6c0090ce
SHA1	e3aa236e2d0ef6f41d72f6404b24baa9c451f425
SHA256	9805e4c79606d83fdc0a4b6b5f1a3fe92411f4971a02fb7e7e09fb7c003715f8
SSDeep	192:a0hedGOIO5TMK6qsJqXoeK7Y/41KFnHzj3mklvaSu5WivG3U:a0YdGO35TMK/gSoeK7C40zjxuvvGk

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.69 KB
MD5	807250b74260207d47d4277748000a34
SHA1	8e2f3ea8814ef8a9e7329b652fdbf73fb3812c7f
SHA256	f66e74175fbf188ceb4eed01a6397a92cacd77c6dd136335deaddf29ef46f265
SSDeep	48:zHggZsOF3ssHrBaQ9JljD3lAaGZGmuDk/zbJ4KIG8qABRtlTp:zAaHF7s6JB3lfpg/3J4NZR7p

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.86 KB
MD5	695d09d8260c2efc40a3f62153e79c80
SHA1	430be81e3de3379232350bcb7fb911615557412e
SHA256	a07e5b7e4564219164a42fef0a325339f3f091473a2f88bff2ba55fb84f7d497
SSDeep	48:ROoeFFDP+XdQZgXaa5mC5Fm0IdQQtW5v3sIN1dUncgaw+586:e0dUwaa8oFOy5UIXdUcga9i6

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\History\History.IE5\index.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	16.28 KB
MD5	a8357c9d4ac7d18763aa6b00ab4f0b81
SHA1	1113bd7c6b6f53574040015c0a188a93e2d53517
SHA256	567c2f73a65e46a8b15e5c69cddbd75baea86c1ad37ea99f7da1d4e9dd8a1309
SSDeep	384:TPY559DNudI/lzwNH4o/Xtm4q6V9frP1huXbj3ezUxuEe5y:rYpDQiNENYGXPlV9fDuXbTeIpD

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\2be989a0-16a1-424b-9211-51aa3bb43e5d

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	54b3ba6fc6fa30b7e241a701221fc441
SHA1	7a63788b39726d110482d89e27d1d95b35cfc100
SHA256	a085059202912d11a9b1793e490451771aae6a6a95cd6020cf6dc327fbcaaa5f
SSDeep	12:EcNqEBKHiq7cwGjHhjNXAVVxpDNFt0kz9U1WwidZekqbO83WQglx9CZi8D:AEPq78rh5wrxpLU1geknRnTWi8D

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	5922ba9b9541438e8b0cea095f2c08bd
SHA1	120e357fdb07c80297715d695c95521b8460952f
SHA256	3ee3ec99f9735e8351aa6c29dbb4c66134480ce9e974a7b32fd7c63be03cbb53
SSDeep	12:11j5Ig5+ZqxeeGWOkdL0M7mlJG7VUp7mIRXpK4cE3SBuULOyGexQ4VP0sSTgy5cL:/j53nxAM2YhUbR5K4cASLrJxQY09PWC4

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.00 MB
MD5	14fd55cb025b2f499462ca69a74b99a0
SHA1	c64b116cc135244974206656ca02b7a0065e0ca9
SHA256	a39246ef977d474c74bdd10cfe96d329bd07439e7aff4ef6bca639a66317b3e1
SSDeep	196608:MhUHA1kPt1pYF8R6Qsrdq7zEqaZswqLhQTcvlj9/z2H7DLKH8:cUgsDYFxmEqaeqc3/iH3mH8

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	d337df6395a47ac813beea7a70590f65
SHA1	0fb9c1409ac2b866a6d53324a4b19cd0acf5fe45
SHA256	2e2a2598cbba7c3333b0feceb1e5e08e654c712d351c161c2f83e3f4337929ad
SSDeep	12:b0esfW3rXCDXmjLWhrwTpQDX5Leht0O0Ala9Ok0q9Og2d4d6MxnqYx:b0eBrXCyArw1wKhtGAAQzq9n2axnlx

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Z4601M9xHFmAKHF8pH.wav

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	57.13 KB
MD5	9ac4c4b786508db140081f2dd41c0a0c
SHA1	39bc1d0a8895b31eedf59916bb5eb0582acdc610
SHA256	b28fb3e528b9498fcf112f90f477435007a2a676ac0ff0c343c417e77eedda25
SSDeep	1536:ZHJO54LszjeeuhtMd0sWNqtvLS2Z3QFnCTSkLlW09bGD:ZY55zje9gV1enAlW09A

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.00 KB
MD5	838da678a64bac80cd9d23ed7fbd5d86
SHA1	a592718c927b4592d4fca13e4031428523a64755
SHA256	c7d53d85d76fbebd23d9b3feb583f098572c484f050d1c3fe9e184d99831101d
SSDeep	48:YluaSQXOwkh1W9Umjb3SZkYfF3mdJ0+YxDnhmEuahMgGWg:Yv41CUmjDSZlVoiTm6WJn

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	f08f5ccb6985162ed5832b91306c62ee
SHA1	0e1ed08e1ef0f07511db7929e85e765ff2fa541d
SHA256	971e52308abab3d1f814c0dbf373e36c26d91d3e137ea0ff43170ca604ab5796
SSDeep	12:Y3IT33CQAWoGzVvF6kgLj4JVzK9CN+oIpe0/NFNdYYdxT33fBF/mn:Ym3CQAtGVvF+j4/10lFNWYdp2

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\CZaqSsZZKSl-6c1peT.ots

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	27.92 KB
MD5	f2d6fe4c1cd1550a3e3a5acb66a60e33
SHA1	92b6a4b84747903ffbd3753de4a5137409d9c982
SHA256	3b07a37709d43b364980b9174d7401f65c4e69b61c0456db179cafe7194d44fc
SSDeep	768:BZOOIcYp1qk7GiLXlwZDD6aWulT5c5yN6TsMKB/jM:bOPcviLqZRzDiKBrM

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\OuRTQD1FZ.mp3

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	17.64 KB
MD5	1710377ac2ed7a6f5724f9442901361b
SHA1	02abb366014ee74a96b48c254f3c0fda40bb30eb
SHA256	0e8829c98bdd7dc822f04e7ec74b97ac24a20f2e0da33d8950ef9ec858e92656
SSDeep	384:ORCfJyCWW/9SjA+h3gMR21aS/2sw1XKjY0RQcx:Oof4W/9SjA++MRJS+XKk0RQ+

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	d96d516e45797903c5db6eae7a2bf523
SHA1	babcad4e19bab4bf3b2b7369f4a9c98329492fe4
SHA256	fa22d52146492ab84bef1d6c61e83060b91f651bed247b87f4546d62f7300590
SSDeep	12:gfx51kHoTNfxawu4EbRTkdKbwzsw74fFhDodEtqxguELup9j4Q/imY8bgT8sb:gp54wXwZaKbC74dxft4guELup14RmCPb

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\CDYXS_6alg16o.bmp

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	19.25 KB
MD5	1b8cba6b1905a987b7046d50de0399a0
SHA1	3df60ff5334e50cf0cd83fa0a7bfefcb0c4c523c
SHA256	aa96359a0b78782c4d21085e8c399aa26bf9281f38744d25088a4a2b0ff0aeaa
SSDeep	384:m+tL0cZADz0vRy/T1QHqyu/rJs8Fy5D50QkR2l/zL/JSxSn1WQF4pTe7bAqL4s:Z06ArGHqfls8Fy5d2czVR5/78Fs

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	75.94 KB
MD5	3b6ab050303665d3d080507fe05a1eb7
SHA1	ebf4f158952d9b0974ba95c7a92db35651e9d895
SHA256	91a440feb72045a9859e138c0a6197bd74c8e658f63675a757ce70a43822ece8
SSDeep	1536:v3bHEuuhd4X4fc/cO8LwyKeltiW+Q9qo3XgB/X/bSIo75dXxlqEs:v3bHEdn4X4fvj8WrwQdn4f/bSVqEs

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Cookies\index.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	16.28 KB
MD5	b4fd81bca40783a9a7bebba4fcf20761
SHA1	0fc7fbf4b94d40b4b8ede4cc8b77ef11459485ec
SHA256	363c7ba638af7779b23d96dfa7692a3568f706993af03d9129a6671fac361c79
SSDeep	384:P8R6wb3D3n9GhPMlz2CYskgSY5pUbXz+awfiv2BGK5xep/dH4:PXw7DXcilzjYsjSY5pUbXz+awK/p/t4

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.69 KB
MD5	c34393b6b8ea2fc7d2db5dc7622ec359
SHA1	4b1b4b8111c0cea28be8ed5678b8cd78384194c8
SHA256	08061e00b577250123a5f1dcf9a78c95e0c30ce7352cbbb6ba01b75f5421db9f
SSDeep	12:CWQxQHnMdSFCXTXnObB5oZAkh8xCaP/CTL+hSvRk3BP01/uXJUNz5wEpxBLK8km2:eNdtjObgZAkhgC0m+MvR01JUNzCe/Ln+

C:\ProgramData\Microsoft\MF\Pending.GRL

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	14.89 KB
MD5	2605810f1abd06551cb15524b83b9d2e
SHA1	35295d027e210509a39fd7cbec2499f6654b52be
SHA256	00efaed11170e21ca1070da7b1e7bf2619e9256aaf9d1848aae5d0fbeed9f368
SSDeep	384:43vnWtL6N/nSvxoFUHSDKSWCycTp1m2cUxf3l:FtLS/nyx+UytWv2csl

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3130B1871A126520A8C47861EFE3ED4D

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.78 KB
MD5	b4c3cb50890677b3fa4795103ea39f1d
SHA1	5368093ac15b2b233eeb1972e8f050a4f18e33bd
SHA256	22be91e5fa79ef890f9ea8cac949c2f56c098cb1c3e51f786f0cdfca5a1b7132
SSDeep	24:T5ALw1E/Fq1L/hKQg4nJIUds7usGrCMwDz:ycmQZ/4Q5hs7ICMq

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	12116c247347bf1f145dd77646f4105b
SHA1	a4164919c68241c5c840ca8e1d4a98677b2b1953
SHA256	b0bd0e87eff4ff292bffd2a063745a3edb0463549d13599bed1a5aeafd4fa8c1
SSDeep	12:iVeJWzNDoiDuBBfFHKXVwEMVuZEOXrFVKiQk80JkrVzijdnuZ817mR2id:WesND7SLxdu9FVKc8KfpvVm/

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.13 KB
MD5	a333d332c29440679b5ba36bff3969c3
SHA1	0268a095f251ae876a95b4232846a1895c41cea6
SHA256	a22c30f714dc3871f476a07b706b992be2f8e37d07967d11bf2329c7224a9c77
SSDeep	48:UaomM8tA7z9pGzBVDHrsQ6P+y/c6XJn3rVUstg4x9I+eF1hFjoQhRbI5qL1c:UwSA5y/cyJ3rysthaf1AQhsqJc

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\Built-In Building Blocks.dotx

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.99 MB
MD5	19d3201468f1ccb275e874ce20d3f2a0
SHA1	a73de4d20157a466c15398f47e020c65f2ecd1ee
SHA256	244a7ff1084d12c7c7a5dc3c27cc050beb98acc1371d3304c34769cb93cfbcf9
SSDeep	98304:HXEPhTZuYHIICfEEYsrwZZSch9/EFogsNkRwO+Aco:HXuY4zuGZkcX/yozk5dco

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.85 KB
MD5	808ee7e7189820195fd14e3b1e2a8577
SHA1	0d21b2ba6639c0d563be2aa76a0c958317a7e27a
SHA256	0c69b41eef8a52e72b4dd8411a23f21e849448a94879ecb8356631dc60cecfa7
SSDeep	48:R4h6pY2hI1cw1Kfzn2LBaIDajSKxrFcMBHQkY8Gt/1ZPXN:YsYrCw1K72LBa4aDxrvBHQkY84P9

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	402e0d031a8bb2573839f93ce44a3193
SHA1	fa441f14099dbd3c0c336109b64aaa9a6dbcbcfb
SHA256	112eca9da543fe06de07e4af6c03fa947fdbc5baf6704bee04fcfe311541ad24
SSDeep	12:Vdz+RlOCLS+bq36MC02uQ0EWQOkln1Phn8VXqyuPxKEirwat4BqYS0CXS:VdqRlOB+bqO02R0EX7b5OX6pKEhtS0Ci

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\MVNll77OeccQ3jz2D7.m4a

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	53.36 KB
MD5	260c5c06a385a0a32aaab4dfbf719b94
SHA1	a9b1999feb1cca5f1e52cb685fed317fbe3133d4
SHA256	a002ee32642bad2cd05f818e79254bc18f4b4c70ade52f57cf0b3eec1ec2c273
SSDeep	1536:u55HiOKY18yOJtlV7/8Pst5iaWGOjojevz09:Y5HiOKy8hloW5dW/jsmY9

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\18DOQd.m4a

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	60.97 KB
MD5	aa42d34497252e0faa4dcb688d66353d
SHA1	0fe0a8e406317bdae5a6663293a28eaac18ebd50
SHA256	1b720629b05b8212039c806bf612af1b341f2109950ecdc6880cb21508a03495
SSDeep	1536:MsADjlCd5tMzVR8IOoS7MIbWPacy7r6N/XnYtq3fGFAwMcHLbM:AXUtMjlIYOr6N/XOqAVMc8

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.99 KB
MD5	c2b391a7f9291a6e9772d5ed5b25ddd7
SHA1	90b8f7a84e5b1fe8cc0214a242e0da5863e37964
SHA256	8b813e1ddaba71634036dd473c60e3b2e101fd8630cec4d00e168af10afa9214
SSDeep	24:/W6WqwAd6AftO+fscNkwDML3bAzz+LEzGd81A:e6wA6AFfPXo7bAYi1A

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\06_Pictures_rated_4_or_5_stars.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.05 KB
MD5	7089a60629b56a378a525b4e61eb270f
SHA1	530bb9964d02e68e7d63177aeaf344fd75782789
SHA256	79846876945adfb9712f8ee4c2665e76b37a43058af88c0257e17a7ff7ba2ad4
SSDeep	24:GRvis7t08pGdbPuNKH6TJ8BM4dVeWMTYH+JMxggIjtX2kkBfIwr42:GjjpEPeKH6TJoRH+JMqheBfFr42

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\gqDMJSuso0fyIVJ6j0.doc

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	99.56 KB
MD5	89fff6df16f085739c92c075a456a527
SHA1	4cdd0e92fb0fbafb624a55a012f9bdd01fd519fa
SHA256	9d12b3e9ed7e0805081d554dc89206c1ffbf8dc0a3410464f245efdd18148131
SSDeep	3072:2IgyvJ8x0UVyyuuXRLkaBRYfJ4JYEBH3V8wCyOoq:bs0SaERjhJYkXGryC

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\WzF9a1WRQ7ycW55H.swf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	38.21 KB
MD5	216e51e9b27fcbe609b82cabb0b57b38
SHA1	78ab796fd64b6d8fa9f21cd32b39627b40ddf489
SHA256	79131824d02c2d05005c190239d4b0cb4d15e8f67c3090a6f2523f52a3eec708
SSDeep	768:qSxCOmn0vxNI8cHVW35w3p2ASKTY1DU2L8a0sRMhCr4QtgYivE8db9nl311lDPAH:Bo0r04p5ASKE+08avMu4sgRvt9NdC

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.75 KB
MD5	5a97500e54d4f3ca25655e1f6cdb678d
SHA1	6c2371a052408d3d7d85d7223cfe3b384f1436d4
SHA256	a1119a90892f1e2d728352fe5636bffa042e47f3b2c56c3018b76aa08665571c
SSDeep	48:SxKLLlmJT+ErahHtZqeUE+W34rA/lJEUtPSy:uKLZmJTxe9t1mA/JPZ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Security\addressbook.acrodata

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	5.55 KB
MD5	afdb0e3a6c8247c6a0410c7815954d64
SHA1	66b527c1424ae38c2ffda01d140565d7b2157710
SHA256	8c2b03f86ded59c0201df6fbaa07543f835ba8f1572a80b211f507e74aeed64f
SSDeep	96:bLIHnQL3D5rxEv/jTpP9c45M3W7M6ZBlQ/WUNoLqBbICaLZtvz6yHaTkWMNcQQhT:4HQ/4njTplD4W7jwNomJa7KTf0cxQM

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	b31f7064132a6ffeb86514d56bc5090f
SHA1	d59741dfb276077dd44643cbbb19dc68dc8f59b7
SHA256	f0c29ef2a571b4c5d7f0a96de82418352ec19c4692e6f942e8282a573f97498f
SSDeep	12:HIjTiiMepgHei2iwc0tQqofEfdalsx1pSxtPvGUwEowfj8YDoQl8g/P+lrj8nsOR:HQoepgHX8t0ETxqDNwDwfhRl3P+xYuQ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\U8X94Jcx67O3KtoRhc.flv

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	35.17 KB
MD5	5612d97686b2fec509c2d750f999689a
SHA1	f8f8971e866c1c10c55c61136dda592a0db4383b
SHA256	9b2423cfde2d4faa6acdadc1c9e76a65ac7f99322b2f735178a2f7b21275a998
SSDeep	768:Vs0bXmPaMe4ULADr8fi81Wq5ZdOqOS8hO6h+lBDESqrjM3H:5TVEDrhih7cqOL+DESrH

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.86 KB
MD5	ff9309093fe25bbc150877232760930a
SHA1	8d9f908806cff5999a8349e2eb6cc7996f674c8b
SHA256	3e8ba963d879f00b4e928a3c01b75b5f010c76da227d24e50a538d1cdc9a6956
SSDeep	48:kTiUnhkZCQP7AWU5irXMZJL0ruJJsC1npts8i8fyydEH:n7ZCaH0KXMPPOC9c8ipydO

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.cdf-ms

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.00 KB
MD5	4119c29dab45645e299b9820fb58757b
SHA1	9499f69065d7b7e728388afaa4975f10879dfa67
SHA256	ba5560c1234efacb732542d5562e0ecd138f50057c3d767dc5a41ff6d18732ce
SSDeep	96:8v4P3+TUU3csfO6RyxDVwwrzLKjlINkGR7V6OCaZ9a:5PuTPHRyxDGjyNnX1tM

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.19 KB
MD5	4093c34a694da453bf9930148d6ee5b9
SHA1	79555a5d2e667b41babc02dfca45b57fa6b85467
SHA256	3607e11f2af65e67b686b8aacff710eeda137d3206ca9adb6c5380513d369222
SSDeep	24:ZItqqJsDrU62E4eIW8+MVCbIgeGOBNRBz9R4ybnq4XE71DqDZoBSNwmQ9b5GJMiR:m0qanUE4e1N99OBNRBf4AtElKKSNo9bO

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.78 KB
MD5	9112ec8f726783ab7efeb789e7b73860
SHA1	b2ec4b56c51c5a1c09242eb58c628aceaddcf08a
SHA256	9b22c79c02b464f5429d7090496581afe978ca2bb4bcb1ae50676a1b61188a85
SSDeep	96:LVwoYjBZkHeYbtdxwLdJbtBx6FztZDAukeQixzCFkVwNn7nsNPWQXDxN3:LVwPZMeY3UJbt2Kb/Wu1rQWA3

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	5bc6ea7f26da613bd58008a44005db57
SHA1	c6dc623f5599ec52845e051118c683d15a832a2e
SHA256	b212886d08bf2f52c0c6b1eda93bbebc8ed2fd52ee3a14ab8616d8dca7cc3c00
SSDeep	12:0vJfhDC+CrNjT3U4M9hBNH5yrN7aJJ3qk1Gxe0wMzads6jd0JobtHX9qStI:GR01N33CDBVgZ7aJJ6k1dfMsrjd+orqT

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\bYftUo.avi

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	17.77 KB
MD5	b2bf260a80a372a2cfedcb96f9dcc851
SHA1	9890ef44fcff20b1e87772bb94b7157326c7643e
SHA256	f97989eca1a0038c8f680859f4eedf6d5b5ea7be7c49e370ceb0337e5cae2dd0
SSDeep	384:/0sBJxPSUJwuS/w4JwdH8282U77Dx9ivFx4ZcUfhwpm+rWY9iGkP2:/0sLxPSHo4JwdH8282U7fmjGjF6WY9

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\ReaderMessages

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	8.28 KB
MD5	f644f2e6870bf8ad2607827a18585f0c
SHA1	9a524423f94691e6f0c58bbeffa5ee1cb5f711dd
SHA256	e96be4f0de6b3e9aaca7d69675f4f612354705e52b77b6795302adb5ac68f585
SSDeep	192:sDMucrXyy2DMLVmXcdniypz02tnewp5SR5I45RQgRedc1udqWbo072YZ:sVi8MLTdniWzXtnARCiR/H4o07JZ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	a096cd271e9fe0ac3bd7f78ce5f629f8
SHA1	78db561106a5e27daf275d224f4e9efebda28d38
SHA256	0264083f39f843e27801d97ad58934ed18fd681e59005201cf233f35792bc41e
SSDeep	12:jzbwOCNkZY0e2GPnvmFySQjEVsYnJMoggzI7NkP7GiCE/VrN:PbDCmY0u+v2EyY+j45N

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.85 KB
MD5	9313fa1950514e9f3e87b0b2d981dccd
SHA1	8924b3a2299552d90aa8d1b21922455d352de857
SHA256	1646abb76dc46c6606474cf8d7ed43d44182567d85c4b268f57782d15a70ada1
SSDeep	48:eBQWM0nHWk+Oj2xKGQojyHE7hJymNzkY+Qc0rCf3jK:eBQWMM5NWKGQojZlRoYjc0rcK

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\aVt2QKK.m4a

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	7.97 KB
MD5	b431975bb4ab4ca6492753c3f1763bb5
SHA1	ebef7e99a6f8541a50bc684165b2cc8bdb07ece7
SHA256	503dbb2ba95bd8484b67d7568acdf5b7f0d0492f4e553a3e50b9a5371af2f5a2
SSDeep	192:Vv3pAuwcsarHTt0lR1iRiAHaPx0zGz1DxkWKRc2O:VpAuwc09iYAHaPSzGZDxkWKA

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	445ac558779294de09fbb846a8286365
SHA1	dab95f0da65be2b48c3fe90fbf9c8ea697d308ed
SHA256	189ae9a7e8edff7db68ac4c44d66a22ad7c3e2a3601679b9ce15c92442f9c552
SSDeep	12:63pqHrX0XsJoT0ZvyCDQQ4wKH7r8EjJd9OLzCffrBop0p6jBU4ZlL:Epqj6sVr6H3bZ2I1m0Yi4v

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.89 KB
MD5	9dcf657b1eaa1064316930ac2eb72146
SHA1	a628d828e390cfa173e6ee6a1b324a8e49e6cf54
SHA256	a8289f20c015ad9a6733a94b2928ef1d3187f3bbcd9eb9d25869f0ce5a537002
SSDeep	24:EDbmZE3NnpLMrpudsqhi/V5DorF7edtV3g8XiEzwt7G9MqvRNyjg63D8WWY62t4S:EDyZeVSpuYIVH8XkobST8WhaYeRDzu

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	568.38 KB
MD5	4a6a61c4956e6004009b352213c995c9
SHA1	8ac8889e9de6cf25638d955eea13f9b5f75b81de
SHA256	8f12536cb2e64eb8ea9b99135bdf287a9fdaa7a408c4fdd1286b4e212081ce16
SSDeep	12288:EueZAzHpC2KeaXm0K4KlFmR0pj+e/jZXy9sq8lsNkV+B2mSfQ:Eue+zpLKecK5LmOpjF/9iWK0TfQ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\CkBB8.pdf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.66 KB
MD5	064802d5d6b2099a1552f2567145d390
SHA1	2c89bb24a7b648bba33f7fde07f21524dde73a99
SHA256	111dbb1c4ee54cef310a79a5eca254ee0cd366a4b7c8a570b8607dcb22d32ff1
SSDeep	1536:hJvOY1D3NCEkfKSO/dtdWAl55UU5Zh4A/dTjs0G3/Ll81iTUAglRYFfEWhn:hJvOY/VkSSO/dtdWA/v34A1TjY3TlK12

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\SWD_mb4GOmI0MBilDv.mp3

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	48.58 KB
MD5	da40925564c2906b347aadc3a7adf3f5
SHA1	605991151709520e173a6817475bb144b07f9f8c
SHA256	1a0a6960ae5eddb665fd85293795eef0a8a61b601f1bd285d7235b2f29aa8811
SSDeep	1536:kakIadeSlT7cr7WPX+BtyMGbwzr9gkY4t5oFBp+5/zO24BJR:k7pesoWv+vzxzTY4LoFBpY/MBJR

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\SharedDataEvents

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	5.28 KB
MD5	0c005e81bfb98df094e7147086d30e1b
SHA1	4a12c0adf185b96d31719490b57032567449b5bf
SHA256	98a265562b6741687ab0260e946add9b23667a452ba01f31dcd0296ae1366371
SSDeep	96:tTx3DsIEqU9nlqf0/u5ZExFIKXb7bAzEmxVtv1lVNQmXBPw/20+F5vZLLhwXtQFe:jsCalqk+ZDabn6ptzXiOhFr+9QHoD

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	6.78 KB
MD5	a238148dabef19cd3e60da40eb03c5fc
SHA1	e5ce4ba4228fefdb9a45e5fa27bf00dbf0ca0c3b
SHA256	61488e2e64c25c06c5014860648e2097a0b02c951a9319e9cf3b4a53c0ae0133
SSDeep	192:m0DDWEwDAs44Ekv2ayNvml+mcigcQp9jzwlQE:JCvcs4Z9jvm+BNjSl

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\ax clB78Xbyk.jpg

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	14.94 KB
MD5	74283866b3f481095b0f913669ebf8af
SHA1	4020b48958b55f4673ec84ecb9354414c945c506
SHA256	ad5e80b69a96f67c99527b2e2257e1a27f6966ca46d7d26f89d86c48a51dfb05
SSDeep	384:WOcRsR7CkITNw8RiOcebxF1eDKUDYqR1eCrh1S9:W1yR7CTNwy91F1chXUCV1S9

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	fe6efcf318a0924f09d5b645c92d1b17
SHA1	f048768c351f90782062ae6218f952cdc7168408
SHA256	3c884400959621f0b932613acc80dea698816d7acb8be0aadfc9d76edcdbbe00
SSDeep	12:jDKtjVTIkVZRPrnbi8oESnubvcTaA/rc1lS9VVjERgugBKraF5zmKxXwIVmEpv7L:jDMjOGW9NTaA41IRgg3GarzmKxXwIpf

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\yTYdL-hI.mp3

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	92.89 KB
MD5	5b169a4509b0e63553dc82e9b2c86052
SHA1	8fc0dfb0d1049f307ac848aeecee3d03cac07212
SHA256	610187681dd11ff552b9b07db42c9eb13832b6c4d1bff6cf564d81ab7c1c7af6
SSDeep	1536:kbJn0bPt7uNHsHnLu6yYwVlkxYDx3xMFgastwFp1v3Gfk67VBNPhcEpyz1K0NJr9:kln0p72sHnLVaYxQx3xOW+l3GvBxoI+v

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	c80c26057a989a24d9349cf7c5ecde63
SHA1	a9978ae5602b3a8f3707800eca0659236ff94e81
SHA256	723fdc2d20e3feeec704f8b3b0533ce164d21bb9e931104a80dbd3b51d853756
SSDeep	12:bDjE5HM+IMUaI/aNvX5Y7o41U0PtlSRmdqbXkydq+SDe4uJmJucvryYLgy:olfvOokDNdeETDtxzR

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	41.77 KB
MD5	5ef59cb9264572db1dc6edcfd2637f91
SHA1	d267f040a61d2b4f86f84e3545a66ce9b3a04c11
SHA256	898ae1480bec097be292dea4d2b66ce49f2e39cb47f5b845016472362c765ae9
SSDeep	768:EsWJpf2wbP2EIjGoXeiYM2nh5ZuiotCjySIYaMgPEM3T13CATSEjMP5aVe2DNkv7:Ep4wbP2qoXIM2nh5nCKySIygrtTSDgsZ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	106.55 KB
MD5	e5a25eed4ba2895899447b5b7c9858da
SHA1	c67146d26b5410f8439e39d3c41c1172b8f7aca1
SHA256	37707051483c1c3b8510dfd543c7fbd9b53fe97327b2830e323a0c5873eb6809
SSDeep	3072:OabSKebsEA+4YDidHFJyP+4+S4uQzEB+3Z9muRq:FrXpYedHFEZM9t9muo

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.56 KB
MD5	58f9c37bb4ddf8b508df77c131f0a38e
SHA1	86df8be741a52b6986e09579aeab7eb78fa090fb
SHA256	5f8ee6ff87d849bba9ef10f23c8223e7a93669f6dd55cb113548cfc96aff1f83
SSDeep	12:MV7UY7qRN1Vml0gige/c+Is8eavdvPXLW1Zhij6CDt9ZY:M1UwqRrMmTJgvPXLW1uGwt0

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\rV1JKxq4yqd23vT2.flv

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	33.56 KB
MD5	68de06509ad20de893db4033fa3c9575
SHA1	e38d45bbb754b42d50996802ff29e0b1a4d7ecbd
SHA256	4b0227bf306dfea613af5400a3aaf67430661bcb0c324c494184917eb17e686f
SSDeep	768:imW/csB9babn2FqDcPrxAJ2TOiVE1z6Yphne5j:VqrB9encxC2RVgzrf2j

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	5d228cf84ee617d925d2fab530f7c53b
SHA1	c2470fffc3c3059a1638cee6c9374d0852ac78ae
SHA256	b27d9f231ff07faf6eeab28fcd1954629f908ddc97d86f724cfeb9a4a6e6ac41
SSDeep	12:aX2F3RTt8XrgafqVqimEXUHJrhGGZGuIUqEcZU4y2qvkKcmYIp5TprOkxHzVwgAE:akhTiXs2Iqm4cIGuI/pqvkKcHIxY6zqY

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3130B1871A126520A8C47861EFE3ED4D

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.49 KB
MD5	e4f09a5430b3731bc0ff7241a8af78e1
SHA1	d94aac7f9a4cbff6504436632d9cde45f06214d3
SHA256	4908198a3d107ee37956401ed7ee96947b8c52bc93998d512dad08ec29f9f924
SSDeep	12:ERI+7R/BBP98HIMo4tdbdFiVU+Bpo982j5WXAJ:oI+7R/BBAIn4HbY9po98mWAJ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.00 KB
MD5	85eb8550d16c0129e19e5832f40db505
SHA1	c01177d48fcab61d5c03c17a6cfdbcce713474b1
SHA256	5d89eaa45cfc18cf33fc090b4f3b4b8b3ce8dfb59b57d5f9affb296947476985
SSDeep	48:7HB1knERh0yqqzXZtDYtRDTV454XIBlpin:7H3Se6qzXZtKRqEI5in

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\SSiM.doc

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	72.41 KB
MD5	326d468a63e524af2bf42c8a3fba648d
SHA1	741b687ddd5bd3f4c63811c3cae3f3f8fffed253
SHA256	e2f53560856d925df1ccf9b28ec0be8833e6ec2999a336def8439aae6a42516a
SSDeep	1536:jewiJekEtXf8wrNP/Zz8Jo0WI0Al02EC6abaGB8ugE5iUFPLezklw:jewiJJEVhXZzR5Im2EPXG9iePLezsw

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.49 KB
MD5	2f2dc4ca5130f448cb163676fda549d2
SHA1	7202d58cb6b2307f50ae0ec95d20b3efd66a75ca
SHA256	d576d023550594e5ffa4b51466a8e08c60a3e1cbcc65875bcc1ade6af3b47d5a
SSDeep	12:Yi03EMjfvhII9h8o8TEcjYhLksH3XgEU3gkwdq:ZwZ37v9ksH3wEU3g/dq

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	181.28 KB
MD5	4665a8b1a93e5555006ca136cc137fba
SHA1	6b143f3c4e11408513c41ca082b1d8b60f797323
SHA256	bd57ae7b4374df9875e96169617750003b129339a18a0fad4e41b2da337d4d60
SSDeep	3072:tE9G7fxKs3686Sor7CMhJROe9KTXB3gITXXED8XIIZkyQQ4tbf3G9MWC:trIs36IoKM5ETX9X0AYVQGbf3O8

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.69 KB
MD5	bedb5e5e22f6e69254f6a99bfdb8363a
SHA1	7e024c90841960fdd0d437fd9719e97fdcdedcf7
SHA256	37da54f6ab0008c799056ae28ed4db03007f3f11929bc8fcc16566c8af2b3dcf
SSDeep	12:qZ6BXrPPRPe2RC9e+LkHKf7MdEkszwx037t/41+ax+l8To9GbVuiw:cOXrhPek8+Kf7MdE/ziMZ/4jHVuiw

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	9a4eb0ab46debba505e51dcc8be3fe47
SHA1	a9201ded5aed8076bc5bb2ec9ed475f5afe7a960
SHA256	b2cdb4aca7b884d2997486bcd76da79217562de1e261f4deb2270702d770a62f
SSDeep	12:DrKkscFAdu7Jg3DysPx3KiNaqnn7hRHly1vqDS69aY2Weu2W7Rx0u8AR9FekkbiZ:DpjFAduW3DvVKdqn7hRFy1vqmb/qGAR3

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\10_All_Music.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.31 KB
MD5	d3cf5f2ad3db74be5c49f0b6892480e5
SHA1	a746ee657c58e84feaa8271e8399c4a7012f373f
SHA256	9c11ef5f511eb4efece3bfe76510a9ba65773b496b50934a819b322c7e9eafd1
SSDeep	24:sOOFBJJ0afTWxJoqTR4cmXD6OHHK3DXkB2LU8P50BE0dXHd9QYTcpd8U8:4B0afTiUuDK2LH0Bldq6cT98

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Outlook\Outlook.xml

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.69 KB
MD5	03a02430d5854b27abf8063976a2b1f7
SHA1	48cb04037bcbd491aedd5c3cf22b83f85d995084
SHA256	0e7d0b83f51f29cba4fde7d557e05f8278a034475f12d0f19c4430f519c6639d
SSDeep	48:isg8LKIVtXKeHAIDJ9nDIvUXjWtY/gY8YBB+M6E8x3iWdG6EvCIQ7eHpybio3+3:RlKCXLAuzDBytYTv+8PT9qp7gybi4m

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\YK6LXiAwXNgyBQ.jpg

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	77.53 KB
MD5	7241d262b39f3b6626fb3804693b6575
SHA1	00bde31ce46b3dfc83e73bbc33a181df3b428d76
SHA256	be5480d845ca1457dec7c9b65566bb202e6648f42df59d721c9e7642aa1b00fb
SSDeep	1536:izh6Y27MA7Yv5uG9dwSYiNDtHESdfSdIhyff3zVrZpbSJQ5uvFsbu9:Kz2RYxJAfi1hEiyxrDSMuvFt9

C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp

Modified File

Compressed

Not Queried

»

Mime Type	application/zlib
File Size	10.00 MB
MD5	51be009b838fb714992b6f1c6b2f6fd1
SHA1	3d46fe4c1ac03bfc83eb47439b9a77f1dd54d7d2
SHA256	aa0e24411d6138ba4b5b5cd4008fd97a8250e7b225dab3e0597c47aea0df6971
SSDeep	196608:BHPUrtLxYWBgvDXadSLsS8nQsiAESOsYnwZrja9segf:dGtL24gvsItAqpnevIu

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	64.94 KB
MD5	8b1827401fd90445eaecc86101ee9373
SHA1	bfb772a5f5d759f110d33f7f5bbab4785da95469
SHA256	a76660eee052d9bc6c549077ceb4ae9859c9fff8a7b2051ff487122ca3670d1c
SSDeep	1536:Nl3WWh3d4Zce8dmB/jz5JvvEPX3qg+C76Y8mNxtc7lAlTc3BAd:/3WWh3Be8d4/jzHwqEBRxa7lAlTD

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\MS Project\14\1033\Global.MPT

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	381.78 KB
MD5	ae28e0cecbcb861092513607e8fc37cf
SHA1	4e1e0278a1631e95a63011ff0ca2fc98476c24b6
SHA256	00f109a010bf5ad7569e3d0af40d8c29acf45716ada2ff7486d2fc51ea19e9e8
SSDeep	6144:hNDrpakuJ7wFvjtqqYb9zz0B5oM61U8oFIzDwrErPe07N+y6Nu9fCAf847emtgjT:hhlakuJ7hqK0BPrrFIzD6EjrNz4u9fCj

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Templates\Normal.dotm

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	20.42 KB
MD5	0e6ba76829ff6c878ee45f2f588d07ed
SHA1	044b970b68f892243cfb9d3fc97bc02239ba6e57
SHA256	03dbee13c58c8bb316bb33e88614ba7ac898d130b3f982f587ab05587aee3f53
SSDeep	384:TgS9EAfxJFLg3tzuE+FVW8j8wSJqUqRSZwhdONJUqYdMPXKb1GtsWHqC2EcBFfNN:TdfC9u5FVW8j8wUxWIaqXKb1GfHqC2Eu

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\brndlog.bak

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	12.19 KB
MD5	b4f474cecedb7e633022cdbecf85d502
SHA1	6b0d9a99a8b10b2bf71694d8171d0bf822f5f423
SHA256	bb8ab798a780b1dac7ab0ff297dd194f7a5079dca17a503dfdab560730fd0d11
SSDeep	384:I1uhpLiMrSZD3zm3EsMpH/TyLW7ctVcrOgm:teMrS1jCEBpHLye0Ee

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Li4nwNY52.swf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	66.91 KB
MD5	c6a9bdaf4b921260b94e801a94f5ad07
SHA1	94bf3f831ea5e12dca053f00374355b067f75999
SHA256	ed1a024ff17adeb660b31615e3def256c9289f601dbd8445e0fa0b12fe5cc668
SSDeep	1536:5z/KpGG193n2YvwaabonNQ2ezwqwIl+H4czt:kR1932KwiNacqZl+jt

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	95d8f1b34f283094d3b8ddca5454b5bf
SHA1	2c9dab02c3239155b89c9122f8e847e3550d8d6d
SHA256	2a3003a757d1917cce858154602fcb103628b01b47aab01ca308b0aa37c84d20
SSDeep	12:6TicJXb2+bi+71CKx1dGZIypcryo9ubAVWOUBCKCkzRAxueHSoivwJvMgIHkcsrw:0++7/x1dNypc+o0O0tzou6iO16sJQ0y3

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\03_Music_rated_at_4_or_5_stars.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.52 KB
MD5	b7e17f5fe6ba062e9d6fb24126ffce96
SHA1	11f91f8b743889610a013fa4899b674f258ce7b0
SHA256	1b5dab9ce60d6c29fce80214026675f42ba19ed842929298d63f67cea874726a
SSDeep	48:/aPKZgO9GFwq/z8Bh/OTRTOLBG/aooTX8F8jjY2B8V+:fgSbaTRraoog6XO+

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\CREDHIST

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.44 KB
MD5	a849fd8d261388d4898c9c757469c94e
SHA1	75bd70811a274d7100ab8e2b780cca2b4aec303d
SHA256	f9b2321ee47f265babdd7f7027cd2accef0993221ebe997e5fc13a9ce995735b
SSDeep	12:iVvoUr6vKw/Ix3wUlm9YNogrTTlySjFp/9xsVjqSfiS:io/gANS5rESRpPsD3

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.85 KB
MD5	cddfb094ab668d59c57afafab854b00d
SHA1	733cb5276c1c677416e464dd83dd3d4d4434e428
SHA256	86e9e2b8059a049a7afd1bbaf9b6e05d88ad028432d2fb29b1a8908e2b5576b7
SSDeep	48:XSRH1LOpUfMcNWf3fppVBTE8umEatQ0/TFAPfXhc:21aUMcuhn1E8uXbSBavhc

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	397feebd9c957afcb4d35a4ec843c141
SHA1	9531b21ee22a4755769afdadbb57d22725689efd
SHA256	a2e8eeab37902019e74722c8932dbde1b5f3d36bea492b9723bc6673bdd8cf8b
SSDeep	12:9GryL6HM76EhzPLNdJLXm08Mn7ouItTpu+Q9f+dJ5l5XwPTNu0lwlHMzPT0Ei:9GryL6HSl5HXmenZ9U3vXwPxuGaMv1i

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.sig

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.41 KB
MD5	cfc3a9a4189b7e6d26397913de83e1d0
SHA1	ae149a343969829a02200c96323f59fdfac833ba
SHA256	1c86608c248de2367ca34bb755888260296ce8772f3f50b2d858c7db91facdbf
SSDeep	6:OFRc+X8u1T2KZvdIN6C1UX7uaJ64+83K1xUMLeMIutYGV75r1a9c8/Lk/UM+mU1h:OFq+su02qiSaJ6S3K4YeMIiYq1adVxJ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Office\MSO1033.acl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	37.16 KB
MD5	98db7e15484e1bf98ad826a2a71d0020
SHA1	a361222c36fbddad0b0af50e14136e58e64d102e
SHA256	1bfe5ef4917a0eb44e0e0c6cb5944af33873a1eaf87a082d0d487ae3360a5b13
SSDeep	768:FHvP97QqB/Pd+dF2zRqfoDT1Q/19lEBgCxQ00FBIT2BU:FXpQ6yF2zUXNHCxXqvK

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\1H9BMgq2T-FhDKMZ.bmp

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	67.63 KB
MD5	e4af0aae33ad68222cfa8cd07a263d71
SHA1	716a30e37ed64e6512f52e271fd34a5c88500cb5
SHA256	39f821cde6f295eb1bb438e8efea0017227605f87af0588508c5d0ccba373b83
SSDeep	1536:qGXOIjyoHZwTR4lCa6e6gE8dGfrTzRkG1w48O:t+yyaZ2m4b8dGfnzCG1/P

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\qsVWzMjLHCh.mp4

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	36.38 KB
MD5	4cc294635281c6f2370f59949e935b7d
SHA1	727c93f23002d55d3ae342c2bfc090a06d050d9d
SHA256	ae812d48ecbd00b3830fcff7df5397f76f40e6d7964479b54ba9cd98de1c2b7a
SSDeep	768:YcthOcLpfVOHJKs21hiPZatHAeU2FBhDKSv3eapJgb:rIcLZVOHJKTbiPMHRdToS7q

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.69 KB
MD5	1d9717337f21790f7e0ed72e500f212c
SHA1	e355df92d05b0c99eac7c1f96a6e95aaf26b0dba
SHA256	80e7607ca0a1773601df8b8da6ee75972b6a54bd239965a05d2a67c0621c305d
SSDeep	48:n/cxDQAZsLpJgOj48TRvcJCDcq/BI+oB6d:sDypJgm4xJAL/BkB6d

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\AdobeARM.log

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.97 KB
MD5	f9d5bfa9a75a7803cbd4ab6a3400114d
SHA1	cd6027fa491fc29390e67bd91e1e019f98a3fb19
SHA256	d51f33348c9a2350f3c6bc8615d0e52fd31a5943cad99fa0be1a87ed341d3811
SSDeep	24:+madetJVz++2fK7RjJC0t97I2BdY5VbuEeIUatXRNzmKue:+BdcJM+2fmRFCI902BWnbKIxRcXe

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\06_Pictures_rated_4_or_5_stars.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.05 KB
MD5	d5b279fdc1bea964842771ff5d734d94
SHA1	25eb5d6a5ed75e7698219252cc78d3f3b9f53f81
SHA256	c882936ac5e32fb6822926b9a4568b7d8dcb6874adeff60e6f25cfac33266b10
SSDeep	24:sGMxVKO1G2QZgw/6CQt3FcZqjfwBgt+ty8cvfdrF:sGM/Hs/6VFFcZqcE+tDcvJF

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.99 KB
MD5	6eb4a18d0fd9d4b16684e9c1a1f5d80d
SHA1	8a10a1c74f4ac81bef46501cdd6abb631d0faa11
SHA256	e2224569d085d4ebdf14b1d9015c6740fe9a073dfce9a8981862503f200c09d2
SSDeep	24:yhadK90Wc9F4loCGi7K/xsM5eOJtNA55K+HT2T1M4:+Hc9uafZ5e00M+HiB5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	5f44c1cdcb8b2e4108ce1f9a34676a7a
SHA1	1775c2355270eea746facc453668e4d8b1e9a53f
SHA256	84d803600c20282e09cbc4484a3e24e9149e26dbab5d54b242af64f0176d98d3
SSDeep	12:6tMeM+DTDSHwv2Q0kz1w2via0rCvA1DCpqAI4j11CsFXpvC:6tMeMzHk2bk+2vinrgA1rAZRdXtC

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.75 KB
MD5	774a7de5b45fc90a1db9eea99fffb2b6
SHA1	68a12594458f5ccec33bedfbe3843ce50a43546b
SHA256	94a7f3ddbc1f99d753e72e1972cadc6b4ce0d8c32f65367a7d02a563b046eb2c
SSDeep	24:02PPoYyoFIGLi/FaZQzW/cXQvKqDsaZR6:02PPoZWQ5QvKqD1O

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	28.28 KB
MD5	d9d9be9dfdaa8c4c0e52c3ae70272aa4
SHA1	c626e606c5c389f556856804aee85f4d2bb3119b
SHA256	5a00b47875c99ada5762f1ff3161ea24700f87a4cbb9466071d1194d3190bd24
SSDeep	768:fPqQc8tnVX8v/VW5MBZgYFzk1KDxEDUATegOKECD9ifSl9kPt2pIzI+V:w0VMv/VW5MBZJu6xaUATbEiX92

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\index.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	32.28 KB
MD5	b9691efee852f5ba5650e6c8a702c801
SHA1	a01278d387a620c1a46fc3ff54da3e455fb1a17c
SHA256	86452b5ff80377e1a1962adbdae9d05b49af4f53129afe2ad31f384cb2a7fa32
SSDeep	768:Xl5uv8XNCTYDlNTwdIA9dOcSPE7MbQV2CPb7h0WXTXZcaaqYa:X3u0X+YDXwdP47E7Mbuz7Hr2ajYa

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.38 KB
MD5	1acba2ed17a6cfc2fe964ce550b2f7c6
SHA1	acab500f29d012d902ef46769dcaf2ecb5ba1aea
SHA256	c887b69f29765aeecc00a798bf1e583241b606963912864895d8d28a69e4f434
SSDeep	1536:pR6L92zvy9J7Gwqy5bVmKtWUgGwwv/xW+mE6f+Tg1uc:KBIOxCVKwUfwKZW+mE4uc

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	746dbe6683b8dd7849b2f56cf272e521
SHA1	997df104716a3a5a0a8b2367a5afe907afef4d26
SHA256	91dc684435469f95f0a24e134fe002187fd0c49f002bea8d57cd601e9cf4d2e9
SSDeep	12:G41Ub55e+bJKl4EU4fGtiaVf8LK2cKAlPjgZ42IDaccK//7UIJm4Y6vwrrPxMHz9:G4qb55euJbJPI+tNgZ42gFcmYIJm4Ysr

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	52.99 KB
MD5	d99e6e9a3aab0b7f3616a2d5dceae0d7
SHA1	47a355186cebaca0a63e2dfb38992ae41013196f
SHA256	b2c7f6a75cbe1f95a3d39298e74c91d9ce74c3c955540a91bc3b8d1eaf1d24c7
SSDeep	1536:fhJm/et8pqVlsH/MlVJFyMIOdJIP0G1Qe:fhKetRV2klDIQJyOe

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.10 KB
MD5	e30f6cfe8f16863ebc4b5ab789af70fa
SHA1	32938225d9301978b789547bab28f2ea5363d321
SHA256	914c311a79f9c0fbfad0cae9fb6231d48918450036f92161fd7866ec0d22f826
SSDeep	24:jBYfTjKIPwoQQkvcvmPP2dIw1H+NrUDQZvied8dkS1bhPuj+:yT+8wXQkv6sc/1eY2vitGS19Pc+

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.60 KB
MD5	3284ce9f41a415e274d1b951391c757a
SHA1	a698d53008b020704efc46ea729761c07a5581e4
SHA256	1132cd4f74f6c0815a48eb7d609f15380a88a37a0d177337ef71d854080bf691
SSDeep	12:DQvtwWwDKfwVig3xwDOGPxvkkBWiyN7lxRUPn71yx9xy+d:svuWwDK4waGPciKG5uo6

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Ll3fHZPw.flv

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	22.11 KB
MD5	33ceb7e2df8e1f04a519a5fde8b2bcfa
SHA1	8d877968918657ebf4364dc0044fab693c982e78
SHA256	069b6716336f7d755ba0a2f1385dfb42f4bd68e68d96ecf35231fb28c97d1cd9
SSDeep	384:i69k8lVY4eERtwGbXcmfHBC0RiqnlBjPCtzDAfVCGb6tIT2N0l/uPXlNPLpy:Djx79HvXPCDAfVbMXltI

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\04_Music_played_in_the_last_month.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.53 KB
MD5	0b761f0533437e12c8acc3f594d51847
SHA1	daaabd293a224c799b8e99ae41670d38c81905eb
SHA256	41f21af31718e563fd0142f0b554d9049c3790475a15129d1e644540c14e9bf0
SSDeep	24:5keMXXckK+Faat8n4ZCGQQEI1FCmzVebqYjZynIIbo0FpXA9phbJInfe:aHckKoW4ZUQ5JebzkbAZ+e

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	52d622767c8bbc2a0ef7f7b137c979c9
SHA1	33be4a240d7df103ee2dbad9324d819b2c8f7469
SHA256	bd65b8ec7bba8c65bebc649c440811ca6ffd858878b7ae83cdb212df5a472a48
SSDeep	12:9OoLc5jXCL52YBJsYkmIv5WAhyRvdMw1aSEYUOjTQw1mONNs581eUcHZG2mnVsd:Av5rCL5FBJXkmeo5dMw4SEYUjcS55UcB

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\gtjOTF7.mp3

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	34.72 KB
MD5	9a37967e6ff0595c10c38fc5f602ede8
SHA1	2bf78a9fadef2ce44bebf6eca1148fef103c6411
SHA256	dc690832f58d2eed7702ae9f375025b4ed375bef147f6dbca46991db3279d524
SSDeep	768:Qxy9V9eStVc81B+XS1Sur/yvAzoJWmQJFMz1VUPn2A5kCtZsG:QIeAVcE8i1S6ZmwFMzDARm0sG

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	5526c307274fa351d3c36bf910ec3b9d
SHA1	c9f22b8cb5945fa6a47ba38d62248da33f725504
SHA256	9f3549125adbec28cae17b2bc29ed8b2457fd5bc8b5defde7887546085fe488f
SSDeep	12:hZgM0bWIdanpTinBO+VrUvX4vL/3Hj5lrj70HFDUrDIyVQ67BOJprQ9BL7/7+8Ux:hOM0KSQinM+VQAvLLfolwQyC67n7LcEW

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\-33_sohOSKdSItpB.wav

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	25.56 KB
MD5	f5cbaeb2bb04e0bb5dcecadbd64b991b
SHA1	61294f15ed6c320681f206698cf7e1f98e94e543
SHA256	a68839cda6f691b0c7d3f3b5f1677f8c0450ad06e4b9ce36bdb28519aad86970
SSDeep	384:+dTVEle1EedDbUMnJ7+REVJfEUbDSj1k7vD7ru/VrVb52c9x7HA2Uuy8Qy:eTyJQZnJ7+qlSZk7vLu/hVbV7gcr

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.75 KB
MD5	3da042a3ce10c4e53850874b2b04c658
SHA1	fca2fc638a16147e6cd28cd5eb9c9b8f794be14c
SHA256	a181d740d9e61bc87e3029ff3dd9a24760bdfecb6a0f5d1f5bfbe89ce6fa0e3d
SSDeep	48:hi8zzvos6UKADNTx7iqqII5arCNPikEIDXCwBzCM:htj2AxFtq35ae1ik7XJCM

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.33 KB
MD5	2b683a258605fe137c5575ab1b12caa1
SHA1	08dd9a944d046c8534266c1717ca44bad50ea5ad
SHA256	dc9fd0aaed3be71e5fd187de711f31c42f7c207da930c8e5ec0e71b157c049b1
SSDeep	6:J/RDoognoSgeQmtC/fWMNmL9MjQwx58dSCymv/WqEm2l3IG8CsRK:xRDe7CDmL9kT5wh5KBz

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\nH-My1UdhBR2sa7.jpg

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.61 KB
MD5	0181d3f53036e7f77e048f3b3b8634c6
SHA1	06c8cbf76bc1bc47ccdce39f71785bcbacd6ca4b
SHA256	d162e7605f7104130b0fafcd533552a1c8f473f92add9685fc08f0dd218d86e2
SSDeep	48:v19/nMybYHMQOBeyzLNOrUisWcUeTUgGsOL/x3gEjzc6Lxf4fFeeNERnF4hu0k:t9veMagqsvTcsOLhDE6o5ynFf

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\ANdFG5xeFt.m4a

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	75.31 KB
MD5	98cf26a1ac2d3944b8acf3d276622939
SHA1	4346008d687ab42766342969342aa7c17e027d37
SHA256	471897ce7042ed9e43a27af9cef1408e19ac04aff4305903aeea9952cbb2cc21
SSDeep	1536:bkPniR5b48sKzQdDoe+xLvLaPIwgfhPmoulYnCIPQCWLT+6tcSjar:ZR5bhace+xLjaPIw+H+jI

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\12_All_Video.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.33 KB
MD5	e1fcd30d864df876399cda3fe8970231
SHA1	b93c9551cd2c6cf3c2967817f617fe45204b2b16
SHA256	444ca3ee864fdd2fdbc11713059d3199b10e93a841d829e2aa08ce2d3a77d891
SSDeep	24:YQzdSFwfHtdM4rS20Cz/mzFXiFDGBLrnMwATUA587bu8v:YQzQFw77t03XSDGNrnM5TPynu8v

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\LuCgxYJnKOKRXF1ApvsC.pdf

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	97.25 KB
MD5	70b6e0686b0bd93500a20dd841be0cb3
SHA1	cd4cab157c9666e81b7c598b8b88374c5fc75f08
SHA256	9412f622c158191a0e456e7508fffd560dbb8a26047a49a1544e1759130f6753
SSDeep	1536:9lAYFjEnTX+c9XKR/HIwmjbK16joLyionyuxw4hBoQzgvK1jfV/2LQzxAnE:1O7XKRibKgMGrnyXdKttOkAE

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\zJDtMsVUIYHc_Fl.mp4

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	32.08 KB
MD5	1ee25fba5452a14a545105cf4fa5579e
SHA1	f31b96319131a91683d8c029cf209343abe53701
SHA256	5fbfbfe8e2a5766589077474faf1636f6b813ee8b05840c64149745c4f14b2ed
SSDeep	768:QIfsf+B0rU8EtYgHjSK6b8NTBtBaAnPlKl:i+x83gDSK6baBDaAnPY

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	35f05772dfca342c050a78ce434f36ea
SHA1	d05170baab4e5d608615ebed5f51a55ea9637ab5
SHA256	222071ab10ef06b5ef3451e44cb1d128933ac935bf9ff27b2fe71c3d3ba17f5b
SSDeep	12:8fJuefaWMtm31IbqcsmLMUgnCTCLWPq9xkv0IfU/LobbceDzyPOfmdU//vvGk:8xh3yqrmLMo6WPIxkv0I8LoseDzyHk/1

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\p18Nw6XNaucgdkQ.flv

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	92.63 KB
MD5	547bd75bfc2532575cad5e2c5e14b7d3
SHA1	824fa5c3dc5a0d56c06c74e01b48fd0e91473331
SHA256	37b15bfc0e244ec6769b60ab71f27d7d9c744cdad31cd964b9d343cd961e4801
SSDeep	1536:3pObRb5lWj6JD1/2T1m/StRuR5QfG0Mwjvq+r319WgqpOFcXKbeJ3i:Zmdla6JDew/StcR+Tjvp3iZEexi

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\fJ2brPA.pps

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	98.81 KB
MD5	05e579fcd001e528a6dca1eef3bc6002
SHA1	a8103038773c5781a6fafe5a62783253c35edda2
SHA256	7b640c333381941cef5d37a031d68600e8efb56c293add6350dde6e3890d8e81
SSDeep	1536:rrm+jDTOf3CgAIrhsDY5DNOSekItS1Hl8CDr7ff7hD/tCuURBtg8NYcWig:rzjDzgTb5WkD1HjLf7hDFCuBu/g

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	f8f23bbb9db0d78a25a4f83470b0234c
SHA1	437e8c2c9106b3927c84db2a815cfc9ba316641e
SHA256	523aab955d99322f232141b3c48adec28516f128fbd35cd17fec9e45d67e131b
SSDeep	12:mzKzsQE22ROg20rx3xWXcmyTqiAhpA68s7I8SQzKJdc5vR9D6Vp9Dp6sqPwSOwT:mzzQC/RE7NjzA6aOvnmRp6sqPdOwT

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.69 KB
MD5	d1c784638e9364d844cd5be7301b6a38
SHA1	a2fd5f4fdb5f69c4c8d3bf7776ed316bfca36236
SHA256	31bbcda77727af607b925ca5110c51d702b1f5153a3ff2b790a147ed543b965d
SSDeep	48:QxS7zSxTw7dhH5dDQ1ZOvlXnmekAWm0Yb:YS7zSxTw7rH5Zz9X7WpYb

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	f6c7c5a928dfa2567ca01a52b005236b
SHA1	c2825876687833483ee4c10058ae5e3c009a4c7e
SHA256	1816ee47d7892b64821e1f632e208c1b416d419f7e32362cfc7cf68964313009
SSDeep	12:MkkHBDggLeiN9lulZUnnhWz5cnjqPbh4f4DUc/Zx4kgimvkpsf:WzN9IKnhWz5c4bQc/PVFo

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.44 KB
MD5	ca01907526b2ff3dfc95d327e3e51e18
SHA1	7ff67c4dd0702a5fb891e5ed5d15bdc8471c20d2
SHA256	7fe283a2689a08d49ca24504ab16743829cec3f0b31340de39dc155f4502e9cd
SSDeep	12:fdMGGh5DyF70+VWAClNFsxDcQ2p+4eHhE:f/kFyu+4ASFsxDcZ4RhE

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	135.49 KB
MD5	30c6a09a873c7715f248563f2114488f
SHA1	fbc7b497bc83a11eac85ef2309bab4f41ef44259
SHA256	a875a75e29ec48acf52aac11fe8d566f383c08b2b38a955c83221d6349a08b63
SSDeep	3072:OVVBYVPa8W58M3nKR1lOoGtCqpQBfbloOQLp6Gs8ZNRA+QFLJP068JE9OJ:UbWHW5J6R1lOoGtQbqOQLp6GsG5QtuNV

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	db7f6f2f37370beb7c3093fe346dbfe8
SHA1	03a30eb04bce9cab529d61bc5c1d368e2383a976
SHA256	9ccd424eb13192488de135a243f90a6478f2dfd64d0a32fafd6a50ea0a9451ba
SSDeep	12:PjoJ5MBCQ9myjez5h9wrTsS2SdpGuauY4OlgJpa19nRS4kCYX4t3mBTTrbQLOC:Pjovutar9wxpGDuYeJE9fY4tmTjQLOC

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1DAF2884EC4DFA96BA4A58D4DBC9C406

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.05 KB
MD5	9609393481b7748dbd077f6d40b97c33
SHA1	d6c4a6729e50def4ea77124f2c66282403165aa2
SHA256	b6cb7ffcbffec8db1fc3738e93919131d649c6e821de4f9065edc61ee0b7a422
SSDeep	96:7JPD3jSq7v+K8+BCtO1Q27gp1tTc5+A1Bwd7uM4teSs4Nn5k:7J3Sz4BCtO1FgrtOK7/aI

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.36 KB
MD5	6c3403fa0751a1e56af7b806ebca38cb
SHA1	afc946a1c8807ed4371a2264a4f4aaee2a8c737b
SHA256	b7ba1addec14da5957bd60eb4f6c55635440d6d8f9d4f4e4ded302c0106aa910
SSDeep	6:M+jCmxe298TVvUjlvJs3UFSiCThLRAxn4xSktT/bFkkXd7pgjrIVigY4W/IMyxH:MNmws5Js3UFSiqLRqn6S0qkJpg3IVigv

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\08_Video_rated_at_4_or_5_stars.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.27 KB
MD5	38ce2f7cc69212d4c7f23bed69bb55c2
SHA1	e3e59d7ceded906e2ea3fe3bfca399f9bfd06aaa
SHA256	ff39d9114145c66ce821b79d937005a575267df5db3b5ba004d507a45179ab25
SSDeep	24:swAlJZlEDyIzSH1lyTihDQJu+eSmIfa2JWB8rWkzlkTw:swAvsWxxKfa2RyQkTw

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	32.28 KB
MD5	b61dba6729b0917d9705d9076c54adb7
SHA1	732f3fa927abbb260fa229a3754c40cb5fcf5d1d
SHA256	2bdf69a01dc1c9ae7c72c3a525d4ff318ae12595e631f8bbbb72d3091437581e
SSDeep	768:r0q/Fdn2EwZY9aFUZPtmqfZamB14mUmAlTigMd0:r0CLw+9aWccZamBuHmkTigMS

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\01_Music_auto_rated_at_5_stars.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.30 KB
MD5	4a331d7cf152b4e846b70d869a7cf9ec
SHA1	2d7fd027b0d3b872c97fc5dd3fcc677e170d0a1f
SHA256	098ead5be206b7eb4339a927b6b568138d420b2826037569fad89951cb2b30a7
SSDeep	24:ZQIfhX/EN6ykpjE4DFU0Y/PJOjA1YYi6/624NChA63eJV6qSVgeaq6:Z3fhnPyAtYPe0YY/aOy6qKaq6

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\11_All_Pictures.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.85 KB
MD5	302cad45ed6bbe3832e976c04c84f904
SHA1	6cf2ab4c7b22a737d46420b8f52f4cd0b1118474
SHA256	82f625c1f1fc8c177639ceb8bbbe53efb506aae833963d546d39940ef5d71088
SSDeep	24:jUMOnqOmx56WQUFiDwT+XbwKAcfmWPfo8WG+rr:jCqHADwubwKAceWYD5rr

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	52.22 KB
MD5	8f11f9760c6c068e77189f83cd41613e
SHA1	cd4ff31676608ff0a61d756aa99f27ea01ff649f
SHA256	b61d5cf48f7d9188d23a767b3ed9c04974d24d19e46790cdac703bb36e10cdd7
SSDeep	1536:225G8l0c+/xz6/c3BjeNnU8UM2dWo13zgPrzd:fGy0cq6sEnZUvWodzo

C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.00 MB
MD5	9cf6b3ef4676c75efedfc6029af027dc
SHA1	316eb087e211e86aa4ccd32004c42ff4fbe93411
SHA256	0d361ba62fa66e7358bc9d0d198539b11354b9e4182f6a330005cffa54f3708f
SSDeep	196608:3Bs6jwlxQvRo7ulQwf+Qo4iT6YqQitS7+KgxUzGVw9vV+Ud5CP46ZjNK:3C6jwmo7u+w/xdBISxUzGVw7+YMggK

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\RV q366ndMhU 0.jpg

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	9.41 KB
MD5	247a9ddb95c059187d6059c48472fa5d
SHA1	bb9b7cf218b9ecb273baf6c0e1ebf879672a1a4f
SHA256	8b0bd2d2aae15f4a6512c797091172326a0626003dfd21fe063344d0e195833b
SSDeep	192:QwvAGUhGaT97WEdA6z2VR2j81n3cJd9H87T8pR/V2/0fS9/X:QOAGUJDdAk2XyI6H87+R/LS9/

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\12_All_Video.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.33 KB
MD5	8f3bcb35e32e9b282857dab5c27c2402
SHA1	a34c9429827d46f87d8b166d0c69e047db8a5dae
SHA256	e95b8e3d02b69a0484f5c053f2318e328c05887b511af8b0d0cd19deb182fca6
SSDeep	24:mx8fRwJ0iik6034ZInNuCXo5NdY//SNub65Pz1LmIgVerrcYF:mx2E0BkJoSDo5NCXSMkBLgcn

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.75 KB
MD5	518f19847abfe44d9197c0bf8735620a
SHA1	677d4034a3301f3f4edaab2fcdbcb62b37810257
SHA256	276990ea9c56ff06600995f9f9f8695be9665080d88e3deae7081436d609442b
SSDeep	48:+Yb+r7+miWDFSL8A75G8iYaWhs2f6JBY63Cbs8Ag:Zo7+mi9ziYaWu467Y6T8Ag

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	3d2c4b8311f420036b583fe333374a74
SHA1	40ca737c62395a6065f0ba3780a1499934c4cac3
SHA256	1f8e469a3542a4903216dab1e2210e3a51f68524bd1605a7725443ed7942f89e
SSDeep	12:ZjzJdw/ytg2tajDF7RK4yRWqbF6P5hEoS1HPri8ALMa9HAK9AFaYMjdDmzgQ:dzJNtanFt7ybsPPEoShPr7ALMaZAHFae

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.78 KB
MD5	c4a972b8c00dac76264bba59eef54221
SHA1	3548bfa7ab713afeac238098c7ee3da216c24a8f
SHA256	efe780f7ffdba71b14be93326cff4e6102c1d0531abba1cc04a4c91348a7eb1f
SSDeep	96:GcJpKl0HO/tw2gkLFTkcDapeU3I2xkjmFIa6DdKd5B1QskqUwy:3OS2PBocDapeUY0BPDtnUwy

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Office\Recent\index.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.33 KB
MD5	f4922719c374a453ed7c98cbe4210322
SHA1	f534095b2e246984032d8d3710765ab9d877d8f6
SHA256	e034581f2c040d9219c9a8813678d7ef3d34ba69885a1ba2734601dbfa8b441a
SSDeep	6:AMydPNotxh4ZAxNb9acylLH4MtmhMSXU6zcE40WIPUx4J0V+L4Tw6sZLp7YZECxI:Aa6+xk6smLXU6zrKIcx4JQ84TeLpIrho

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	a815378d9c5eceac0e7923fb85250a02
SHA1	f0b0a8218a7d7588f67b5603cbbd56d9a26f1f2e
SHA256	f4b8999c2a3b29319e6624facebaf42d8563f90aecb0ee831f07042c4f607167
SSDeep	12:nRzqf8wafgEUlGYqZgFCvkX65XDNOip0BRS3+XhAomiO0iNflQNwks57DpKC3h1B:RzqUwKU4vbROi8k3+XysdsNQNDgDpKwB

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.77 KB
MD5	5175470cfdd58709930eb90cd1ebcfba
SHA1	7ec41adf5469d46adb4909ba22b51bff9119ef07
SHA256	955feed9c0f1a2a51df2545ea43aaa3ce0c1ee2800dc2c2551f7ea4d1790b094
SSDeep	12:z89tSsgl+QTh66WG1K7Zt2gQ7Q3BT1PH3XjjrRQalL4KdzS1g+FlhacwgABK4Dxz:z87SsglQpUKdOgTtHHj/RNpxdzSLcVDL

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.xml

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.25 KB
MD5	010bb418e23baddf0ceb0a4afec8e8bf
SHA1	f95a03a68bc58bc53e7e0fbf9165a6958e830060
SHA256	a65922097bc04144f53858d196dee58378a23fd778e537547f27fde7efca96a3
SSDeep	48:vn+3J2Nvel5H1noIn+V3zJhIpyBPNW4IkA90XHPKG2PZaRJRg+1E:eJ2Je/x6JhEyBPEvx0CpYk

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.86 KB
MD5	6582783d7d6fcb731ab374d6ab0ec087
SHA1	b1ff794f9f3f5248f4a90d5f5b6bc5a010677801
SHA256	d1ce3fe7f2f7f0f5ab57cf4d33cf7ea0bd395cdb51aadb35aa7232ddeedeb91b
SSDeep	48:OveNMCp2SkgMomt2k95WJX7yr8UT+rWoeIOdSE1Dn60:OcMCYTZKXS8UT+rII1Ec0

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	f0bcac3a4cc2645d9943086f16becc9a
SHA1	9a4dde5fd5caf1262afe3c6e33749912919978cf
SHA256	87204c58beb629ba47cefe225868b6005a34973b54f388c29a30ce1d1dff88cc
SSDeep	12:b+vGUb5WcQSmvh5D8gRBd4r1n1Xrzrsm6NfF5o/OD32gGxl1ZLAkbl:b+OA5dY5D8ev4r1N6N7wONsH6Q

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\10_All_Music.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.31 KB
MD5	56384e7a7058a06ac9e79cc5e8efdb1f
SHA1	0414baa4e73729437611e56a0a51e3c121fb0623
SHA256	4283e6b0c3bb1c3ed3f8b65c19a9ba36a6ef6b23877f4d48672f88b5a3d0251e
SSDeep	24:iRIIMXfxBTzcSl+/gexQPW1bQZiKHWzJUjxKL/SFYaEQFPX5nrGB0FFIzjy8VIy4:0pMXnCRQu1hKH6J/L/SFYaEWX5aB03wQ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	1acf61416d9006a2276957cb68985d48
SHA1	ff01464e4933c7bbb92b5edcab2a24ceeb0b493d
SHA256	f238c7b647c6dac366ed2d873f2ccf36f7e67325bd4e9105193b357bed822d4a
SSDeep	12:NYo8J1B/MWgH8RVZgNYo+WS+cISU2MeDAsVQyeUu62n4OE5LUQmd:Nz8/B/MNwV2CF+cT7h00Qy1gnA5qd

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\09_Music_played_the_most.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.28 KB
MD5	01526e43887c187ba64b45e072b4fb94
SHA1	b6e7f878f31e969fb625a67196b30a5d560ec77c
SHA256	80b2f504846792e0b0da7d50e2b0e8ca602d7e5b92e1e8edac53e5ab3ccd11df
SSDeep	24:nEM/Qazq9zmKFmNS/aN7CyG9oByX7fLD1Xor87z1IU4p15YWdeE75XKrzDwdY:Vzo7mNGaBCd9oBWH+izYpMMeE7545

C:\ProgramData\Microsoft\MF\Active.GRL

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	14.89 KB
MD5	4043575d268fb0c2267524e972009c69
SHA1	9212ac49746bccd9e005d6fc683275b849dd5a74
SHA256	7341dcb8a241e8e683ca7045dd1e7aebda074397382307786d882df75b88e102
SSDeep	384:0zPw/JoYIOqxfDvcf1RbHflzC1OgZf5zH3yX3IlLEq66k:0z4JhqfYNRBoOgpNHZ+LX

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	0f303e75427334c4535b195df2de6161
SHA1	c2a48d6de2f949ea2c8b716dd6cd210aadfd3d26
SHA256	9b4dfaee0f3647dc44ea1db35ed99734a7b37b8252f1cb44643c01837b097ed4
SSDeep	12:+gAIk2qU6XW2A5hRb9ocrcEzEz+7ZOKA8eb2Nppqc03Dn8:pAIk2eWhRbNXwGuVube3D8

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\07_TV_recorded_in_the_last_week.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.30 KB
MD5	f6c19b88764d6f2bd719f0d55f49c13a
SHA1	e6f428b154435eb534ddb29885d343cc3dcfd742
SHA256	63a2c2a2f05c4dd3e4e1d1724f46ed4fc6af3bc883dcce607bde45f063349574
SSDeep	24:N5sBe3whZGHyBrRrfOBFGNKZP5efYdax7L64THIdr0NiKSxFra8Kw/FFJS1ZzAYm:N5sB/GHyBrcFGEPvO7L64TomNhWV//h/

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\7j36yIw_9ZvavwaDmh.jpg

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	86.52 KB
MD5	b1e157a450e653ef4cf6d026750dbf4e
SHA1	86213d16eaab09e75ab9f44f282d281f3f6e4287
SHA256	900115b6be4cb1dfb663ed15bd281f46e426a69cd3ac2119dde33819bb7f4f58
SSDeep	1536:NzqpGDCGxCgTckwnHVWKLBFOnT7ymNUnhA7hmFqHwLxgURLhRYZ:FqpGDLuVWWB++mKhAFkQwLKU5hRK

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.52 KB
MD5	9e94be159359d675c0cc7cc5818f3660
SHA1	aeea5db4aa04e6f8dd271d16dc5cc2e3035352cd
SHA256	f89e780881493d52872d77e165d390b2d087de06a11934a29c4cbd1e50646d10
SSDeep	12:YLv+56H8K4aZsWd3fgLnjG9HsEFKXTrsbuveM:Yiocx8fgT4hFKTeM

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	32.28 KB
MD5	7bac74d6b41c028edbf315c7c4ecae67
SHA1	7ae039fc2c07fa64b8240665335f8c94d45f6ad6
SHA256	4e17934d77b2a014b71583428216cee6f7cb62af84f9524bf67e8a8607ccdab1
SSDeep	768:G0D56/Z2KIph4SlOLCWHdVB/wYGxoNdLcps5xeBZ6GT:Y/Z2NhfuZiYBPcpsre7VT

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	885.78 KB
MD5	67eddd2e751a669388d37d75ec024557
SHA1	e60930df726c0e295b511c7c7d44cbda14b0f209
SHA256	0f11167d21845371c6bcd1d7a1314b371fff34c4c259d9e8f5b06615d249e42e
SSDeep	24576:Jx9T5z7Ly6eujVLOn/BBqoFTSTajyrJcn9ES:XhY6zQpB1WqKJA9ES

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\GV-wRmRhU.wav

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	75.53 KB
MD5	d47c221ff8f52d5336f65dcfb0f322c6
SHA1	3f3cc5851b99a65ba9c56cf66c39f3b86b9fd0cf
SHA256	27feb38dc798dcb966ba5b47bff670eb9131b68038895a1fae02ae8ba3ff41b7
SSDeep	1536:FqE1Ac+Ed7+l1/QbCSwG/1KAWrgZXCYkckWRknm8DMo3/Dxg:wEB+3l1/fo2EXCYcWRkn/5/O

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.66 KB
MD5	7186b859ec8c88be57474b066a33776c
SHA1	0d6cff317c38ef75821e0e750d5cdaf4034e4cdc
SHA256	3537d8c08f0e6e7b8ebb27b5a45d223f20607b77e1e70ff5e77f307a9fa08ec8
SSDeep	24:mgZ0+csBkZTk/t3v2zXEsUVqazYnT9yqH7yVVc7PMl/V7sZT/QKs5YFCkYFDVkn1:Y+TBkqV3v3DV7Enyc7UBuNs5uCv16

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	7858221559bbd52cae39b5fb06c252a5
SHA1	607ac4fef862cb0c0e62ab1c8b45c4fe4529e38e
SHA256	720c1c6085b08e7c508dd82cccaacbe2b2d0c1355e2375ecbbac94cbdf7b4977
SSDeep	12:f6e1zZWOfB9En7Ce9cZQw1KwZXNRw7yzLATNcUnbvy2wSna9Y5cmQ:fdOOZ0znw17ZXk7Tnbvy3ccmQ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.00 KB
MD5	cdd47b622426cc259c3c68ce7a227616
SHA1	69a09ee3efd5b418cd66aadb2b62dc8a742a7614
SHA256	458c3fce4a1d63266af73c9fb15ba2a3c46d98ce08fa715e11d7657c7ec0208f
SSDeep	48:kp/60BO6z7aWE4h/gmJfCwbH3YbnhUJc8WF+9aFyrefrWessY51jJp0MdD70re:uOC7aSh/XVCeHGN8I+gF+e6essY51jJn

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	34.56 KB
MD5	0f0c9cb4c20c0e544be56e5d313c6d30
SHA1	add9d77911468248b876161e972665e2434edbce
SHA256	624bddb0449f93cc26c232a51e2840a81918269ca9614eb0518c5e9629780460
SSDeep	768:06BVIKN/dYvEmBT8UPqQSCenrd7GyLjiOykBs7XiEuB/:0cVIKN/PmBIUPwVGyLIXWB/

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.71 KB
MD5	b990d95c86a784961e0055d81421953d
SHA1	8d10d2699bcfb7a5324e858a201f71564a8a89cd
SHA256	49b89369448fbc5aa64861930be124300aad86417faa1eb1863c59282490f0a0
SSDeep	12:k86fbWEablyG/xGCkxgcKolqc97zmAM1ehhZxRaZj4Ney/pp9Qo9qssuxFb1:mbWPblVozxlKo0c1CHU/xRaZj4NemZ9b

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\z6aeKDo.avi

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	25.27 KB
MD5	4490faa8681360109bf2d4ef85b06362
SHA1	8d415c6e343b2165a8d4fe8a657ff449b970df84
SHA256	2f3674ef811e369dd7d3d2bbeb218f0ff2f2a43094e236faec41768a625a412b
SSDeep	768:Abl8xEHWJMIWpZtMAizE0VzyedkDII9f8mR6:AbGGsMIWX+AifVztdkDlEmR6

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.78 KB
MD5	50448466a646b8f1188fcc00ffe7f231
SHA1	77f862e16c0c6c36a877f5e0e5186225ab540cb0
SHA256	8889adaf16a3a79ee4ce4b9552c605daad5ad98b1dfc7529ac8df415a5b7daae
SSDeep	96:QbWIaQntNE86yxxgl04NnE7aAL5NTVS4Y9HhoV5bmNZt7E:QdaQblxglRnEPLSduVStQ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\19Kgww8LCX.gif

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	19.11 KB
MD5	3f630ac97137ef68b2122d4b09f72c59
SHA1	b5ca3135f1049878775e4471e672b9244293d9d6
SHA256	ee94e9a444dbe7f6cd24f5cfd8b1693a4cf7e57355f8249685b0de656353a621
SSDeep	384:Ujzek+oQUGLyaHo9rtv3KpawlpCFdJX4gHmBv3G7GyJICf:UjunyGoNtv3gaw7CJX4TAvf

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	16.28 KB
MD5	5385699341f7a67605a2136edbb0e6c8
SHA1	32bd2ceface436fd07de7d23bfc4ffcdbfa8498c
SHA256	9bc2a0545b9fe6969c506e50374bf84550a1047d811247e34ec272a404aba7eb
SSDeep	384:qFkjmkBAUHLZCZHokjRqYsmMe3QoxzaKnjpLWM+dpb6lAU7oRV:qF0hnH1C1lq/mMeJzaKnjE/dp2l6RV

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.06 KB
MD5	69c2af937d69b17b8d5183b285a0296f
SHA1	f7a1cb4e52a00b3aed48face07c62025dbace457
SHA256	4d348cd13b5da32d1345ca80ff5efa4ea4213b2f2aa39f84e51f2988f92cd1b3
SSDeep	24:Pt22b80tdm9qft4HNHCAEkgJvllCsDUYtxDq7/qU2e6icptYDk2XsLtEFB:17rZft4ABfRXOJ2GcnYDk2XMk

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\wPLG.wav

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	43.72 KB
MD5	b73f510541b6009956ddd412831dc1b7
SHA1	6a232d39361dad55e0c4613f670db608cafca3ba
SHA256	4ecfdcfddd8789111cf309f3d82f568d6fae300da319e7986d85c45573d48a91
SSDeep	768:YKFyzTb4J2mQefGV7kuNVrp7ekopC0s5/DvdniNXfi3dMRi7OVG4u5sE3iUjbS3P:XJ2gfGpkMVd7eDC0s5LdiN0ywNsEa1Zz

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\0e15476d-d8fe-46ca-8099-ebdcf80f637c

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	00b75bcd06b99064becb3d1d8960fefc
SHA1	1cf7b5b317d10509018d9b2a22f7331d02e6fd5d
SHA256	16b6e2b4f06da989111f5d987272536e55c9a6c8885671ce6bf0b0c266e45e06
SSDeep	12:Zw3b1DwyrfjIOztlHrbIeLhIM0IvAGoIE7w12uQ31WSH4Fan4zP14lGI8I2bs9Wv:Z2i4f9ztlHrsaIM0IIjIE7w12uCWt4l+

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	9419217dd03634cf1c13c74a5a728853
SHA1	e288f22b33f67dc937fa2806d7a08dd4d0a296dc
SHA256	7ef9e6e3546b0f75ecdc2287e399202d46c0da26fa6a2f0ccd5fbf33ce8b27fc
SSDeep	12:v4unviQdJw5ugZpeBdsnlxCqS8c6YVzMEJfL6ugbqHS63AVB3B6:v4b5cBd4fHSSYVzMRNbqy63AvB6

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.69 KB
MD5	5ad88be81d52f195f4fb5cf04538b12a
SHA1	72c918bdbbe580460d97ac4501936974792f7c40
SHA256	30a9b6efcf5440ddfd66c5e46c895e55e26db3bf267e01f85a08ceb9815859ed
SSDeep	12:5tA5948bPTDxQr0waL3rvzNW8zjmp8h+kih9m7LLGWrZRJnzF6TPUIyT/:Hl4PGsXmp8YHX+tETPUI+/

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	28.28 KB
MD5	f9bf6e66b15519a335a9806e96046a4c
SHA1	e55a2ced632f1468feed1e331da325c13bdc712f
SHA256	3f49904b25d92ddf3f35b04d8f4e181ed157ee5b36356497c7d9658109772efb
SSDeep	768:V9HsK2m0kP6OZHnEpLqDJpiSKktcwWL+TWCOXna:3HsKn4O5aWDSktc5hCJ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.72 KB
MD5	5f3be718e8c95b5ea0a47a8e22a308c6
SHA1	a8d6febf7560e3f4efc236e07af5fc1b02e399c1
SHA256	1f4c0127999b9f74d66017ecdb1ed80207d5a55017045cfa66bab1751f760ec0
SSDeep	12:wAWMsHGVCvgRSJjYuz5IfsDICAosLlngIR8ZKMhLO6S9PvKqV66IETlJ9:fTsHBjZzQwICAoWgKMhLJS5vfBIo9

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.63 KB
MD5	0722b0d8202fa321e6f011ef232df70e
SHA1	44246f67b50c8f35bdc468fa7bd7cd768c022c16
SHA256	1eff8102b3b1fa1149daf45dac32ba2bc6a20af80b8a4a951c51bc140b50c7d2
SSDeep	48:ue8eGFxBVNC5/1wSCi1v/7ULBu0zz0BwB:uxZFxZMNwzisBu0H0BwB

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Outlook\Outlook.srs

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.78 KB
MD5	84fdda528e7616f5c281cb617c743c2c
SHA1	c6e0acd0863bfd9e34f55f5df6d8cf81c5b51d28
SHA256	87a0687f31dee8f6470af052b2073d4018cf3a8d6a8d619125fbe6e4015c73a2
SSDeep	48:2h7WzThTX1or6BfoihPnWh9jXPYBVOwuZvKvJz0WuRxartFLnMMTK+0W8CAYhyUc:2hyx7Sryf5WrPYXOwuyNur2txxT6WlA5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.67 KB
MD5	95fd63636b9fa63819e0966d77b8e06f
SHA1	96a16b10aa1fb742becd1e9dd63cf339fd2a08c0
SHA256	943dcfbbce934fe240394d1dfbce6d567cad5d120f7ce6acfc8138e6cbc3c2ca
SSDeep	12:C7FAHsfH3Tk8AJwRGf9wdHkWOTsPpxZcDKv/Wh2H5j7x5H4nP:iAgH3TkgGf6HkkXZcsA2dn4P

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.78 KB
MD5	341fdc91ab8f1da78d14db32c5f34bbe
SHA1	546caa8dab40cf8dbe9753f3fa0deee793e94fd3
SHA256	60f564f4e955f3abf52858aa49a6a32d6d55aec8e507e8953e620d00262c39cf
SSDeep	12:t4O3B+pi97mRIVv1Eby42fgrjULDQm4X8zLRwP3Z4NjbMwb1qJmfMDSf1shyT5u+:DIK7dM2fFAmapPp4NjQJmfrAyT4fzp8

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	1a5ff10f97b099f9c0b1ca83a63a13bc
SHA1	ae52d88b2265db4ffc1e9fdd60facdf068c643be
SHA256	8f49d1102854390d8a8eca6a9ef7249d475ccf636b891e78ca62423c8834d267
SSDeep	12:dOrVX3/QwnkzW+ZHrXVE4DNgBNiFzsCKGjJR1SINfhq3q0UZzkMCp3t:dOrVnkWQXZWGdsCt151oq0AzhCp3t

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	834d854f1dbd6449d0ee2ef5073bdcec
SHA1	d26fcc7b34eafad37a9e8a2d484a89deaac87319
SHA256	bf0ca6a3ea5382ee2a6f72421cf6d92e1aa5bb1394330c4046e395b808e436e9
SSDeep	12:c+fARdZaz6IiB+7DphHW4bkUTAID8mIQfMJYdLCq94IkCH7Ap3DBR5S893U2+88o:c+fAszbic7DphH/kKAIg9cMwLB4Ho+D7

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.63 KB
MD5	d4146a7a9d6efd4ae1d1aa4b154c89b4
SHA1	423ac314130cd1a97bd0534e52dad70e2ddeb4fa
SHA256	bdc4bc69ad153ec7252c8a1e9b61e2f125f60be4804ee81f584b8fba6d9b6b44
SSDeep	24:slt3pZBc5cI0qe5WKpGDuh6+0/BgY1W8v543gM8uA6MfbLkeIhOfBcwyh9eianWO:slt545Iqe4s+OYcM4Qlr6+lt4i1

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	14.46 KB
MD5	602a458bfa3b3053c6764092e33dac9e
SHA1	4d6c2e2f4795a19750657b69ca68909bb8f36966
SHA256	cb290a4a8f24c7901456054c86de5402aa9cc46b72dafec7f4fe8750d745e21a
SSDeep	384:dHCivtrqpQsr4SC7/QzjG6x4vtJRmhO8DdeiamZ7GSalmq94yMF49F9c04k:BBtrqJ4J/Qm6x4vtJUhO8ZVZSByy0SF1

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\11_All_Pictures.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.85 KB
MD5	d2244d47db2d2ae0452af0b2feeb2597
SHA1	99a0b1624df126c0452bdddb76257f390af81091
SHA256	62bed9df11f679ffbb6d9c2a21fcd50282c91a6d3fe8a3b5c9e97b1eecbd9822
SSDeep	24:juT6zwElPbJY0KiKPhEckXtdEhm2iUKwyLQZjQ+TLt:KT6zXljJY2mhEzdIzQQpFt

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\0511c6e3-7aa0-430c-ba92-892236e955e5

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	e1c3b6b9f98c89814e3f5326ee5eadbb
SHA1	f5a3aefe45dab2e5dd01374032a4f86b078e8ebe
SHA256	c46be18bb0c09be789f195a75127525a2b893527567c0ac99886586b87a91f6c
SSDeep	12:tSHRKkzIQIOQImxOfcjlwXfaDo3fC+b9D3rhVgESWA+G1acWrHjF7tcYDcIk3yo7:tyxkQIOdbQMBCIbhVGMWaTHjF7tVDcI+

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.00 KB
MD5	b9f19dbd990e73e6183b71979c798bb2
SHA1	d7a32e1dd4e9de01eec2fe7624311ec590779a4d
SHA256	db848c5762a4d9d844518baa810b3bb21818e0f90c7b47b8352d458cec169de5
SSDeep	48:GHcopR1uI3wFlvoGzS0K9occUBZZAH7qcSPgHiik/nG1gx+aR2eu:GzFmFlNzT+occ8bAH7dS8+CgR2eu

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\02540a10-7eb7-4b20-a8c7-470f8986389c

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	4498fb3d315a19d01800972a3c8e62c3
SHA1	92cdbe902316fd1c4f9588fa2fd3fbdac1dd8cc5
SHA256	a133ef79b4bdad86511ad72546b235b433533a5ca50d32bf002fadd2e755df9c
SSDeep	12:QdLw0SU9huqLQJznzsuIPt0asexgvL5WzReEnFGh7xpgBunPSItp7JcvWAwzjCVc:CE0SUJLAAuIaavX7e+NQIvDwXC2n

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\ehP-Bfiv5vGeOQfFEnG4.mp4

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	81.02 KB
MD5	168524825777085ae317c2c1443619d3
SHA1	8acb8678e97a631d205538b75c2195a71aa1467c
SHA256	ffe5b884f24a8ac0901c9e86ff1108613215c6bdd3c94e97e29c0e797289be4c
SSDeep	1536:23pGqv6IwIOfu+BiRnQkOEA1yjFMVgMoPoAFRRM6B86xKfFZa:2pv6IwIQmAEeCFABoPHFI6B86x7

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\05_Pictures_taken_in_the_last_month.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.05 KB
MD5	1f271e42ec78d5316e5899d5114ac8fb
SHA1	0ffd2c24b2f0bfcd0879bd10b11f26ec891d0bc4
SHA256	37e978c61e7be3e37186a7b9d234623201e8df0850eb63df43b61904433459a1
SSDeep	24:aVxrzbR4LYneg5Dw7VZY/FLohQYWFFi2U+JqP7xr:aVneODR/+l2M2Q71

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\01_Music_auto_rated_at_5_stars.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.30 KB
MD5	453edbf6ab418f11315d726171252ba9
SHA1	45727709f0b9fd248d2d5e16ac3a44c472d35b31
SHA256	42179cdcc6efe3ba0d289a12ce64e8e0b9cd0e3728c2c77947118ddaad2bdbef
SSDeep	24:MtY0hfMTq2DMnnK/jSn/0d5u3xYEDEP5KmvWm/NCi0XHe2S:zT+2DqnMujYGEP5KmvhlCdet

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	37.10 KB
MD5	faa5d4ebde33948cb17681e9a1828c68
SHA1	0e4ffefdbbc7cad9edfb4c3abfec3d6635de9465
SHA256	81da3a3d5aedc8e4c1c036627da5380ff574aaf193d252474f5d40cf267d134d
SSDeep	768:oz+hmbtV09HWrtaxfzJqXUV9J1MoSEfIK0YLtgd8AZM:MUmb3nrGAEHLMFEghYLtOM

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Q3klePDr_a7JNGL.gif

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	32.36 KB
MD5	6650a1e395985b08bf152e7cf8a5e02c
SHA1	858186ccdd9241783bdff03195d3293c971a6cd7
SHA256	88781bfbecb0deaa6a7e37138e85cfe810f3de3507d94e9fbeed77c585f9f88d
SSDeep	768:M8xIC3Rw9UMt9vaaaouxsaOs9zo5RPNh0PbEGJPRhhIMZTfxa0dG8rdc:Mf9UMt9CguxZ59zeRPr0jrPRhhIMFfxA

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	3.78 KB
MD5	dee5eb8006b5a59447d404395649c64d
SHA1	2523218e430fd2ee2b24c7008e392dcd056fdcc2
SHA256	41c2ccf5ca2a67c861ffb34df8f7bb8fc9a9cff56b5452af7c09ba073da73b9e
SSDeep	96:qAQHTjCkjj2vU+2Or2EeHuGepLYt7VIeDop:qnfjwUMyEeHSUt7a2op

C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	246.28 KB
MD5	345e038bc0eee53e4febf0669a86379b
SHA1	42b737f468294817a475193a0a942820d8a7f8b0
SHA256	8a1340d217982befb842812427d8d51b7dcc12c8597f00c29f3ba158ed98c654
SSDeep	6144:OAnmY+J1dJ1LmBbKJUCRHjRfpM296Ee87dcoqpdW9Fo6mot:4vNLKqUCRHjBiLEe0qjYFo6mc

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	5c7839d99b774d4814ea567bc8095290
SHA1	80cd6283d5f1869b50d14ab1d35b1f436b8c9a28
SHA256	96dccb4d745b5aad3028a4a6767ea527e04d1e89257e75cef1bec3201d8828ee
SSDeep	12:EKYKb+LN/cG6lETiWE6R5WldFllfqhjl8OQWU3uu0Llx49nq0KW/Sn:EKYt+G6lM/1cN3CluWUh0Llx4tan

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\IconCache.db

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.15 MB
MD5	ec9376c5cb8ca63f49da8a88212a9d41
SHA1	c65a83908761831f4588f7c7b2dd719d13801871
SHA256	8b6652eaba778a0115f7a129a12fa5bb0290f40900431296c01a694455f3babf
SSDeep	24576:b+V7xfY3UKEnrIyFfEwDhQi3qr9tkOzTneu35wSmtgb+ZeYREE:Sc38rzFflNQLr9txHZefabUEE

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\SYNCHIST

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.35 KB
MD5	4b88b5a7971a658b936cbddf20040687
SHA1	47617df95c0cdac9ae84df00792dd691831b4b63
SHA256	e547500c5036ea4acef717eeed09b9b11404e629f2b8aaa3964559f52fc6295d
SSDeep	6:aXDPrPZBe7a7gC70MYD5wiqKUBVsiGv7Cdwkf2rkXt1Su4r4pqqN63OGJl:i3u7Ux0IiijsH2OW4eWV+63OGj

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7396C420A8E1BC1DA97F1AF0D10BAD21

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.81 KB
MD5	ce1fd9a1b4f8ad5be90d1f3762cce7d0
SHA1	2d370471b9841681fc7f130f6220cb5448c1b192
SHA256	04e2873d5139e4a6eb453417253ab8c432cb2c6c1f0fe6e212d534b4fe940ece
SSDeep	24:+xiQAtAZliuPcF2lPZhTZPBTs+xen+7tGvA:+0PuZIv0PZFZPBRb7td

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	ba41c09f3fa3a90e7d83b35d1365980b
SHA1	f71e700f57cf05fd856fb8f71af1624ed68e6ab0
SHA256	8390fed575e406999687d89f89bde9775523a739289835b1d9715a7ad70b0464
SSDeep	12:A+4w/JitWOMjmw0sxRHEaykCGZU5eZ+ekMr1gvA+aUtC9n:X4w/Ji13yi3n8UEZRkMobC9

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.97 KB
MD5	2a7ba5eec7fc309780d9ef0b88afe77f
SHA1	0ac199acf82f97b89bab50d2d41ae1166ae04840
SHA256	a20b5de5fd360d032897ca2cfdc766a9c6e5df0f7965a1e4876ef1242b60839c
SSDeep	24:DhAK5RaGD9fNplloHfU6PECMxrTJl8nn81/mZ:DhAK5XB4U6DMlqnnEmZ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\ubb LqXLATFa.gif

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	40.47 KB
MD5	4b4b25152164a33796841f5322cd5bba
SHA1	05d66763e4cb4f1fa8e832700d10f7585d9e987a
SHA256	ab81bf1c98f8eb5bf8532916c60db53d35aab29cdbe463bfcf9b0365cad93800
SSDeep	768:S0GUqTmdsz8cnZc4vTHaHwgEwWDZ/z52dWP9Wlx/Xitv/UwtUM0bfFe86SAVD5UI:7GCd6PHaQgEpZ5iWP9WltXgvM7M0bfsN

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	28.28 KB
MD5	5feca77b21c9b9bb823d69a2b6ecd235
SHA1	03750576dc4eec7b7243c58901e71f6ae174630e
SHA256	bd10f902867d24171e940b152330ba3e25fe72d6ed7f4f9272c6c2a3b5c24e20
SSDeep	768:kwsb7LCHJJkAeC7HcqefTdf6QDKTsXV/AYQO:kwOOpJkkefRfLu4XlAYQO

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\JakbC0D35mXemqu.odp

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	21.08 KB
MD5	5d24b6719cfad5e9c00f0f3aa8a0c638
SHA1	646745456f4d98f94bf84a1f0b8eb418ceea2779
SHA256	f4f78b523920c1e45f42adc18cdfb7a1025964e1c6c7ca243ceb20e4e14899b6
SSDeep	384:D1Up3+nB4Mze28822zRSJ319caoX+C2YtVKIB453k12Sl:DMunhe2x2VHcaoXv2IVnB4pu

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.69 KB
MD5	bf5dbcd3e8597ec72a7f6c2d1fb55372
SHA1	57815e2cf9871b18fc180cfa0b9b9285b20b8b5d
SHA256	6abe5e1ae4d46156a20dc439bdd6c80b539975886b208c4d4832fddb81d0eb1a
SSDeep	12:j2/qqvGo7Fu+jPATWSkS365nzmzBnIK4hLJV8TUeDrDnB5J489hWl5eeJf/+guhD:gPF5FY3QzmzSjhFSTUunB5JhLWDXuhqa

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\nZS Qg-Nz.csv

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	54.42 KB
MD5	f04508c7fb0e26b9cf784a46dac3b9c1
SHA1	519178a32d246d052b08110b0d528d658858db0c
SHA256	6526838da47f00733a777a3ce32d3a5f76025d743fa4823d3350127330050c6c
SSDeep	1536:uSuoSdPGUzvwzCR4KkusGHYqt2VWzTyQe7cI:QFVodOswYsJTyQe1

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\ciqVdTiucu.xls

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	50.64 KB
MD5	5f0a3c1274d4b79ec8ca2b5cdfec6463
SHA1	4f7499b3b9f563305d007535249a3c83b829a828
SHA256	2d7ad0373e50985b8c2d51b37f01b23607e629ddd4c820b8b577aa82e98863b0
SSDeep	1536:GpG9yFYhqvvtRsqYhLnaoPACRQ86dOG7prj7wEZ:G4cWGtZYNFPAqQ86OGP7/Z

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.02 MB
MD5	e795de80362c2e9cd8c921d1cc82ce43
SHA1	d62d0ddcf4e40a59fc64bff7f7924df1ff95c921
SHA256	f40556f3253c9cf84a687a3a5b956998d87fd226b03580503f60503c51e08dd0
SSDeep	24576:RQUAc46qMNoIEo65Ks30zVRyHDclTA6w6b6jlMH9j1dHa:RQr6vNcqaAVcHSTZtb6xMRdHa

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\lrvSnpo0bTofGgXiVtm.m4a

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	16.41 KB
MD5	287375b917daf327aeca9eaa0e286f99
SHA1	7f18dc724e9820d045d7925154f13ebfa6b70591
SHA256	6830286a18ed303fe3cb56347c38384e3c3f68ad3a403d0b4c3a0ec8c5643913
SSDeep	384:AmUfA/yAP1QqjRfZNzP8AubttzSJOtUq7hEVY:jUfyyAP91zP8Bbt5muUQsY

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Cth-M8.mp3

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	19.88 KB
MD5	cc54a6d4170bb01e6bac5587a1d32924
SHA1	552ee64a8f4b81fbeff241ee40453c1a45386e1c
SHA256	0eefe608297ab4fae37187ede0e6d0ae75bf6f57e7f44c291dabafd43aa2470e
SSDeep	384:bTsE/dqWL/1zzw5ptlkFheGdjU9q4aLTrdbcIxiMLN6sDlwfAgPs:Hs+LtzwDtlkb5uq4CtrxBxFMAgPs

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	7304aeb6409394830b7c7613a6881929
SHA1	66bd667987e668c23934464ece8c8c8b2a32302b
SHA256	d0f537c2aef8a641768e57aff2abc7279a9e06f349fe2c47e088f251675d0130
SSDeep	12:MN/K/odEnqlEeL/quhktbMiw3ZnvIvN2LiGMaSQIoVLXkFw4qGPENnVm5Tlhdf4L:MC/sEnqlEeLipwZSN2+GDFVjkhP6U5xW

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.69 KB
MD5	a52fd238fb02c3a99db9808f9c828234
SHA1	cb688627ef639a9e83a3872b9ba65b7d459f4383
SHA256	0461ada691bb3e0ccc85d95349e824b7dc4f91640b858f63fa4851cc17c5eb37
SSDeep	12:Q2CVHtiMCxVz4cAyeazx3CH46jOOGb3a4fNkVsR4SxdvTtNX5iMujjvYHdHHdn:EHRi+cxeazx3CY9K4f3TtSZYR9n

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	d6ce4c8d22ff03539244c442a25d621f
SHA1	80add62b6508fc556677c1bd3295b65117313bb7
SHA256	cc134ea0b9d83e72c336ae437f9487bc9cd884cb2e235e897a42a6689b2386bf
SSDeep	12:7J27OygUfshunxBFKiwMaBJd9KLNAGu3L+fxjlsoniiSbxM3ML/iQakxxK:MOUj4JCSUxioiiS1gML/iTky

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.00 KB
MD5	fe9549cadd1fea73a67f430194f8a869
SHA1	35e208ef0bd40506580101f258d31650e76fdc90
SHA256	d315b04ca4ccbe413e3a511d53aa6b7896d0f55b2a9df09e6102aec02db4ac2c
SSDeep	48:niu47IAHTFr/Co8ov0BbKoLZv/FTOs9VtECvRG:niu4kiTFrqo8fhXV/FT99gCvRG

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	db4ddc660b92fb578e549fa45371c2ef
SHA1	5b7485f4254b719b03600073f64393b9d065b73d
SHA256	cd42941e5bc63f72ece8d6135e9dc9c7e7079f8b86335b5c6a1124cb4572d5b2
SSDeep	12:NZL+F5Vqr3UjP72L9cpgS/0ShdoB5jfrJFFgMnMY+v6+Y+thgc:NlO5I4zU9206qlfrTCMndQqc

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	7e746e3dc36a97c0099d9c2e712052df
SHA1	1127ef86ac6a47176a12dbbf458f5d057a6c4891
SHA256	6b31e71d5a003eaf75f8cb6a18c17e8a615386fcc157d424442927e59c86a0c5
SSDeep	12:4+bgJqrkWK5VTfUElBRRApNUNtU2EG9Fh3PCom2KkrB9iETjzX3HENTxRtLSGE:w8kL1lqIe2BFhdjSETjzHENta7

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\brndlog.txt

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	12.21 KB
MD5	36c8e97d8d1a5cccedcf9cebc340b97b
SHA1	d928809f5ff2c04949e0f494a5f51d529e2ea5a6
SHA256	96cf21f8b8b4b3e7852f0805d307c417f7dbffcc6081baa6f7c558c2e14c5867
SSDeep	192:DMMP1cB/xzKSzmE0XnZWeT3gxh4qlrJ7AawS7nXALvvZyD8LmCZ:DbP+9xugv0sfzLwuXcvriCZ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	028ffb49f045f8ee2aa1b6901eb81c1c
SHA1	2b2335c2ab37d1c646a2cc74f208c9bb0ce5bdcc
SHA256	a21b24975bf736430c16343a8d31e7f772244c88fd5d9a38e65693cdf75d4eb1
SSDeep	12:Inu6DSckC5FyUO0JkzUK6G36UMHMHIbO6pjtlCKQAlBIrmPg19vHVkjRiVhmK:IxDSckC5FtDOUK6s/MHfy6XlCYB5akAj

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.53 KB
MD5	0bcc5afb08465b12d84d2d7d43187baf
SHA1	2319105edd7e4068882aa4689d4e80af24cb67e6
SHA256	ccddd2d463f3e1b31ff6c82321ee99f99ea3c23122c5a2a546a1b95acb8f7a27
SSDeep	12:zuiUXUXBB3Y18G2B+VSTJUjEpa1J8lSsnL6QylcttWl1/WM6U0zV45gRd:zv1BBoGG2BTJUj0aLUNWz+M65L

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\09_Music_played_the_most.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.28 KB
MD5	2593fcabe091f88ef5fbee7a2fed329d
SHA1	ac655f9cb75412d0dcc80a9bab0741fdd0fa4e24
SHA256	3df861a0abf6d637edaa704301679d6679e7205d42c9782c3fc8df8a715c17b7
SSDeep	24:12sGbh/KUZ70JgHVu49GCRkgPMb1TVydD5KfGBLXs4SCepwbS/G4P+4wOV4lmRu:Y/hip+AtgIwl5KebxiwevNgsu

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	75412a04728b8de7928ecdaf15896235
SHA1	af0488cc31137bbc15af628621d98935d3959cf6
SHA256	267688dd2c896d6c3ca2eda6a3c7e1b6d181d50a1debd33ec16ce3bba3e8f716
SSDeep	12:hsOf1A4Msgm+3R0rB+Cv5eklcLufrWDomLPgJi4T6FDOfIsd3hGNBe:eOf1A4Mk8R0F+ChCLuiDomsZpfIsEBe

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7396C420A8E1BC1DA97F1AF0D10BAD21

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.53 KB
MD5	da1917e598ab20a15433b3ea95fda4e5
SHA1	6479aedec59bc0854bd37a509074f2764d092b4a
SHA256	dab5109c2471eaa79a58d35559beb78232de24b611ffe8448d72a8c863e6e3d3
SSDeep	12:s9DZPzB9wnW/3OdA610T2X1XUbhEewPf7lUZ/7:s95XaW/QjlXgqDl+D

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.66 KB
MD5	89350ce4d3d3b0c87a9827ad412611da
SHA1	8d38607faaab5877f757c5dfd0e49dd47b361237
SHA256	cefdf646c23379e099fc79d8257d8e6c09e47d546c0f7f9d54f4ff2d93b9baf0
SSDeep	12:Fu1s1JZTJUUlo0JVdzUE6mRnmjDv9E/aR0gDKosiOZZmo8Ez18o6ao:Fu1SJNJ9o0J8E6mRnmV5DBrORo

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\Outlook.sharing.xml.obi

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.46 KB
MD5	87aa0a493b2f9de33af008c9b232d1ef
SHA1	e5f32bb2395f81812e048c7c3b1a4dd3a42b5cb4
SHA256	5671d75ba98b35598c80ed8426c3e078f091f7bb20a4c554838ab51e82e4dc08
SSDeep	12:lvLJETwRveB1ixfZI0zxX705a5f9WS2E9j+/8EBtnQn:hMwRv3TxXea5FEIjwnQn

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.91 KB
MD5	391ea80b535175555be393554b2f20e8
SHA1	caef734e92b300d21723e815cfa6e1a5629e180f
SHA256	bd1bffe328b8a03af4e26b2f30e68cae6835d9940450319c3330c4ca4ae732f9
SSDeep	24:UYlSw2EUbL6wxgpqsdhyVzEY6aBCYTMZzxhjIBBd64N6PejvUcikMxGYcWlzh1bt:BlS371MNuF8ZKvQmjZig3WjYBHwV5

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.69 KB
MD5	10ba22517689f55477df8f8be44d57af
SHA1	6b6ad6025df943ec646a9eeabd6048a5d7a1714f
SHA256	9a3f335283acf285b0202f102d96720f4c841e283626c9f598349ad8486d2204
SSDeep	12:7QXfMeRHzhJIKY+d3bgeyQxsHwlAoLA/5fAGF82Fkq2q+McOD3oAbJ8hmUcNVnlK:7YMeRHPCrnRfZe2GlWTj8cUcNVn7w

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\_Ov1226 P.gif

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	19.03 KB
MD5	d149a9acdbd18a857d6052083522d299
SHA1	09b9c8c708f24cfa33ac82f4003e319099a79067
SHA256	bf1df3d4ee73562f6fc723df3c8018e082dcdfe0cacb35a920be5a4fe848e637
SSDeep	384:aEyRRSKOF+y8wzPZzigi7M4rfzvDOXZ7DwoWJTtMA4i3gqPjVxJVyo9lxx:rRiy8wzxuZHD0Z7DZWNtMA40gEVYWx

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\oarSaFPIX.m4a

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	91.17 KB
MD5	29488b08f3781b74960ef182914f4df3
SHA1	2273b0eea1bf16ec8f075e0754717a99a846ecfd
SHA256	e912aa40bbb7910c4ca4e1d68a31ee9a43c7e4fad1a942a33d8ab2fea15dc89b
SSDeep	1536:DRgxUOT5kDTQwvrMW+bsdvATUU8ydjEr3pepYmt3ecCjWT7Y35fALy9supP9rkph:DRgxT9gQQ+b2AgU8yi3IpY43bc5LWU9+

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\fbbe72db-afd8-443b-88dd-64b20388700d

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.74 KB
MD5	c140f6fd1eea45971bda6618f8ff4f53
SHA1	383a32378eadef176e7a07c0c22458cbaf58f940
SHA256	6107554a4bd1b0e309a4a55a94896bcccfa040d75b431cbd743e233b1f7894df
SSDeep	12:srJJZnJiefgnVYsTKNNvEakuE4D/QQoZtWy5hD2sTqUWBFMe492S9wD2EzQKJUX6:kXJJgVY0CkLUUttgsOUOMV9dvPr6C9E

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.63 KB
MD5	e1dc0ff9d946a8874432ba29c0799c78
SHA1	5941da5cb0ab68ef720dd775e3ab162f939e0fbc
SHA256	7c2acc197c49d686797ff0e436b6955188f1e5c269adb23d5a3d1c19ba251a36
SSDeep	12:jQmJivMTTU/aE8a6jxMj4OxjE8tfABow8iZIHNPwyGe9CjT5X98fwx:sOPqn8ah069toBow8i2BhGeMHj8fwx

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.75 KB
MD5	6f4d2792f70ebbff8caae56f6f2b3f75
SHA1	f83e17f5caf5614018ad8bcc0001d8489ece5bb4
SHA256	0389e5e9ce563e0f885b5047c39a0724d25f0788828907b27e692a06fe923bdf
SSDeep	24:YBsPCUG/LRK/Z00CITVqsWoSQtgWg1pAt98AZlzR13CeaF1Pko5i6Y8SpyGetdGS:/PiBXiWoKWm4egX3aMo5+tewAOyGA

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.67 KB
MD5	d6d84db8e04a778831522666833b50f2
SHA1	71b7f8fd8c282ba1aeb738ece91eb9bd5145285e
SHA256	3995fcd3aa6f1291c85bccc6d459913fc8d9b4257d0efb7422ade08cd4f4021b
SSDeep	48:VTqO/YHKykperTERw+LOmV2U6WukbSSporDb8z:ViHKyFToOmV6WPYK

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Kmz-qcWsXscs.wav

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	17.38 KB
MD5	75e9912211c85620626794dd3bd3125f
SHA1	927c5d7792a2eb6a9a8cf28546f3c59d05147d83
SHA256	5786dfe5daa2ef2728382f5a34366431be39a3e01a2575634f566a10d29c276f
SSDeep	384:O8H1SdQmh4yIoVl++2EmHZyQL7p9pZ/kXDemnQMq1G4j:xHdmWT+2EmNL7p9pZ/aC1GQ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\bSR6WIzKyY.gif

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	43.56 KB
MD5	e7b2588cb6670fd7575f09d2adfc8c43
SHA1	d91610f415d5b65ab2cc49f499443967883296f7
SHA256	5c75177581d40baaef394b66daa83e26b6ceb0c96dbe388f2a9c99f310bcf584
SSDeep	768:o1PQKzHIOlcOlP3eFGmzjlD0Vlvt11oBTOSzUiXB9USNXk14M8g02p8yMQGokMu3:mzHIOlcO8ljtQSacU4zUQ0143V2pPMxJ

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.00 KB
MD5	0d6d5543bc43f4da378cc144f6f41383
SHA1	97950ce6460e10ed031f2a49f3d5f5a5c8526d2a
SHA256	3d31e22299026c1afd32eab3253af4aa0c4d7370f08eecf899e0e170fa1ff604
SSDeep	48:Q63JdjpyfpuPJn/dnMZVqJQTc7a0UfLJziO/fMKTsFX6QGE:Q65djplxwseTb3fNzx/fM1FXfGE

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\02_Music_added_in_the_last_month.wpl

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.52 KB
MD5	17c1467cc3ae3ef64337e63a07b0dcbd
SHA1	023638137772d0da99d591bdd59de59a9b7ff7e7
SHA256	12ed6e87ad4ef9edff28e9c4823b32fbe51c0ff2c701b1ea554fe033feb719f7
SSDeep	24:sh1eNB1C/w3SpVQlCTYoVodRulx16bPTf4Iz1WBtC1EUdQle+Uanx23vmpHWirk:sCf1C/w31dwertz1WvuEuqx23dig

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\sHIudeg.avi

Modified File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	89.02 KB
MD5	f30dc5a332c7512fc78457d556825388
SHA1	7e5e9f08589b054cae4d357faefdfa685d131f03
SHA256	9507c0ba6f52bf26dcdbd963209704df38da53365ca3beafa66a6d8f42217d49
SSDeep	1536:KBMXslasq+wn/gQ73diZqFwJm5d1BxJxHvRg8L/nfLaULLkwTv88xxlNxCJaw4la:K+8lasqBr39wW1BxJxHv3L/nfLaUMKUv

C:\ProgramData\RyukReadMe.txt

Created File

Text

Not Queried

»

Also Known As	C:\ProgramData\Adobe\RyukReadMe.txt (Created File) C:\ProgramData\Adobe\Acrobat\RyukReadMe.txt (Created File) C:\ProgramData\Adobe\Acrobat\10.0\RyukReadMe.txt (Created File) C:\ProgramData\Adobe\Acrobat\10.0\Replicate\RyukReadMe.txt (Created File) C:\ProgramData\Adobe\Acrobat\10.0\Replicate\Security\RyukReadMe.txt (Created File) C:\ProgramData\Adobe\ARM\RyukReadMe.txt (Created File) C:\ProgramData\Adobe\ARM\Reader_10.0.0\RyukReadMe.txt (Created File) c:\users\public\documents\ryukreadme.txt (Created File) c:\users\public\favorites\ryukreadme.txt (Created File) C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\RyukReadMe.txt (Created File) C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\RyukReadMe.txt (Created File) C:\ProgramData\Microsoft\DeviceSync\RyukReadMe.txt (Created File) C:\ProgramData\Microsoft\eHome\RyukReadMe.txt (Created File) C:\ProgramData\Microsoft\eHome\logs\RyukReadMe.txt (Created File) C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\RyukReadMe.txt (Created File) C:\ProgramData\Microsoft\RAC\PublishedData\RyukReadMe.txt (Created File) C:\ProgramData\Microsoft\RAC\Temp\RyukReadMe.txt (Created File) C:\ProgramData\Microsoft\User Account Pictures\RyukReadMe.txt (Created File) C:\ProgramData\Oracle\RyukReadMe.txt (Created File) C:\ProgramData\Sun\RyukReadMe.txt (Created File) C:\ProgramData\Sun\Java\RyukReadMe.txt (Created File) C:\ProgramData\Sun\Java\Java Update\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\Data\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\Data\CJW3O3KP.BX7\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\Data\CJW3O3KP.BX7\6NG60CXZ.9GJ\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\Data\CJW3O3KP.BX7\6NG60CXZ.9GJ\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\Data\CJW3O3KP.BX7\6NG60CXZ.9GJ\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\Data\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Deployment\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\CrashReports\RyukReadMe.txt (Created File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\ryukreadme.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Credentials\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Event Viewer\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\1NBUR4HR\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\6ASVN7J7\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\D68G7BIJ\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\FORMS\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\IME12\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\IMJP12\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\IMJP8_1\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\IMJP9_0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\DOMStore\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\DOMStore\3LKBQZJ3\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\DOMStore\8NES5H33\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\DOMStore\FKLUIDU0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\DOMStore\OWLVMZRC\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\Recovery\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Transcoded Files Cache\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\Groove\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\Groove\System\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\Groove\User\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\ONetConfig\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\RoamCache\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Publisher\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\TaskSchedulerConfig\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Visio\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft Help\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Cookies\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\History\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\History\History.IE5\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\03J4UQW0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\KETAJP6D\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\VB18B0KB\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\XT1RPYG9\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\WPDNSE\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\~nsu.tmp\RyukReadMe.txt (Created File) c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\ryukreadme.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\VirtualStore\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\Search\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brz\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\dan\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\dut\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\frn\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\grm\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\itl\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\nrw\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\prt\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\spn\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\swd\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\IME12\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\IMJP12\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\IMJP8_1\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\IMJP9_0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\UV0DUWVB\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\Services\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\security\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\tmp\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\tmp\si\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Collab\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Forms\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\JavaScripts\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Security\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Security\CRLCache\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Flash Player\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Flash Player\AssetCache\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Flash Player\AssetCache\D5NTRC6R\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Headlights\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Linguistics\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Linguistics\Dictionaries\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\LogTransport2\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Identities\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Identities\{31810C36-5D23-4CCE-A3B4-316DED195C38}\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\P7Y3F7QB\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\macromedia.com\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\AddIns\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Credentials\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Document Building Blocks\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Document Building Blocks\1033\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Excel\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Excel\XLSTART\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\IME12\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\IMJP12\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\IMJP8_1\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\IMJP9_0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\65UX3YG0\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\AY721QDR\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\DZBKZBIC\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\VRLZOZ0E\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\MMC\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\MS Project\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\MS Project\14\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\MS Project\14\1033\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Network\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Network\Connections\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Network\Connections\Pbk\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Office\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Office\Recent\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Outlook\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\PowerPoint\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Proof\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Publisher\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Publisher Building Blocks\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Speech\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\SystemCertificates\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\SystemCertificates\My\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Templates\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\UProof\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Word\RyukReadMe.txt (Created File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Word\STARTUP\RyukReadMe.txt (Created File)
Mime Type	text/plain
File Size	2.00 KB
MD5	1e5d393290c87f1ccc62a1d3f89caf47
SHA1	87e6f98deeca6ed2ff27e7bfe8dd306b09bab088
SHA256	5971bf3131a292583967ee2ff687e7bf135930fe2bf5df76c6058852abdb7ace
SSDeep	48:ZpUoHkwB1kkerTWOU+pbwsl4id2niFclWgqnddhLDAb3SvZl:Z6ckRM+Jtron6cAgqndL3AsZl

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.05 KB
MD5	93a5aadeec082ffc1bca5aa27af70f52
SHA1	47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256	a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SSDeep	3:/lE7L6N:+L6N

C:\users\Public\UNIQUE_ID_DO_NOT_REMOVE

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.41 KB
MD5	f22186973841401a70277250dbeef346
SHA1	34cca504a460a77da3b937c85f6dd8ea64e4dea1
SHA256	1de15421cf2aecb17166b630867ba5a9718e3825e0b29847244c24e124de961d
SSDeep	24:a2BL4t+DFLC6FxrrHwImjRzykdOTTKmpLBsEG8sr0z/9N38V9sC6ksy:acLxC6vrrHyYMyKmpLBsEG8RH388uf

C:\users\Public\PUBLIC

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.27 KB
MD5	c60821cc4336f6453f9dc5453d8f0b7d
SHA1	09719d9251a7ec8f4c809f4c4377ae48a1629d3a
SHA256	df506e1f6cba7dbcad75cebde8340000b3181409fa672f971825c2c06ec764a1
SSDeep	6:mtNSbTDfsAH1p8r5iyN7Y+BogRdulAjrsNM5rJMb5R9jiyKn:YiTrXHP8r8jNKdu3M65vjRK

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.33 KB
MD5	a41dd4ceb540dbe31d9e0f6f26d42b04
SHA1	68279efe1f6e510f771554ec601079649ed70c98
SHA256	02aa3186c5b694ecc62f8bca5363d8983400ac4f9312510dee94f61577924781
SSDeep	6:C2M0wkbSUxRZnxk92jUWSX25PxXkxz8rLDeXuy4Qwl5TgZcwJnWAJn:pO4SaZxhVsSPxUyPDe+dQwluhn

Notifications (2/3)

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After