d31742a3...fee2

Master Boot Record Changes

»

Sector Number	Sector Size	Actions
2063	512 Bytes	... Actions Show Code Modification

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ssvchost.exe

Sample File

Binary

Malicious

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	18.50 KB
MD5	b550e47de0ed9a121a560c7bb24b67db
SHA1	4050544de3d7d6666a6aa1b868f81b143be85ef9
SHA256	d31742a33f52f5d3326a828f73c666d605c07b2070f5a863fce7d97a4b1cfee2
SSDeep	384:XR+3M7ekPu4ysjQJK8qbqtLnWpOR8gkfFFW8:XY87R7ys0JKrbhm8gkfFl
ImpHash	f34d5f2d4577ed6d9ceec516c1f5a744

File Reputation Information

»

Severity	Blacklisted
Names	Mal/Generic-S

PE Information

»

Image Base	0x400000
Entry Point	0x405f1a
Size Of Code	0x4000
Size Of Initialized Data	0x800
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2020-02-17 01:14:02+00:00

Version Information (11)

»

Assembly Version	1.0.0.0
Comments	-
CompanyName	Microsoft
FileDescription	SSvchost
FileVersion	1.0.0.0
InternalName	ssvchost.exe
LegalCopyright	Copyright © Microsoft 2018
LegalTrademarks	-
OriginalFilename	ssvchost.exe
ProductName	SSvchost
ProductVersion	1.0.0.0

Sections (3)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x402000	0x3f28	0x4000	0x200	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	5.36
.rsrc	0x406000	0x5d0	0x600	0x4200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.12
.reloc	0x408000	0xc	0x200	0x4800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	0.08

Imports (1)

»

mscoree.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
_CorExeMain	0x0	0x402000	0x5ef0	0x40f0	0x0

Memory Dumps (37)

»

Name	Process ID	Start VA	End VA	Dump Reason	Bitness	Entry Point	Actions
ssvchost.exe	1	0x00AE0000	0x00AE9FFF	Relevant Image	64-bit	-	... Memory Dump Actions Go to Process Go to YARA Matches Download Dump
buffer	1	0x7FF000FB000	0x7FF000FBFFF	First Execution	64-bit	0x7FF000FB000	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF001C2000	0x7FF001C2FFF	First Execution	64-bit	0x7FF001C2000	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x009A6000	0x009B2FFF	First Execution	64-bit	0x009B138C	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF001C9000	0x7FF001C9FFF	First Execution	64-bit	0x7FF001C9000	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF001C9000	0x7FF001C9FFF	Content Changed	64-bit	0x7FF001C9460	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF001C2000	0x7FF001C2FFF	Content Changed	64-bit	0x7FF001C2000	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF000FC000	0x7FF000FCFFF	First Execution	64-bit	0x7FF000FC020	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF001CA000	0x7FF001CAFFF	First Execution	64-bit	0x7FF001CA012	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x009A6000	0x009B2FFF	Content Changed	64-bit	0x009B202C	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF001CB000	0x7FF001CBFFF	First Execution	64-bit	0x7FF001CB060	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF001CC000	0x7FF001CCFFF	First Execution	64-bit	0x7FF001CC020	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x009A6000	0x009B2FFF	Content Changed	64-bit	0x009B20CC	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF000FB000	0x7FF000FBFFF	Content Changed	64-bit	0x7FF000FBBB0	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF001D0000	0x7FF001DFFFF	First Execution	64-bit	0x7FF001D0080	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF00095000	0x7FF00095FFF	First Execution	64-bit	0x7FF000953FD	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF001CD000	0x7FF001CDFFF	First Execution	64-bit	0x7FF001CD032	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF001CE000	0x7FF001CEFFF	First Execution	64-bit	0x7FF001CE000	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF001D0000	0x7FF001DFFFF	Content Changed	64-bit	0x7FF001D1000	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF001CF000	0x7FF001CFFFF	First Execution	64-bit	0x7FF001CF040	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF001E0000	0x7FF001EFFFF	First Execution	64-bit	0x7FF001E0080	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF001E0000	0x7FF001EFFFF	Content Changed	64-bit	0x7FF001E1040	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF001CE000	0x7FF001CEFFF	Content Changed	64-bit	0x7FF001CEE80	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF001CF000	0x7FF001CFFFF	Content Changed	64-bit	0x7FF001CFC80	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF00181000	0x7FF00181FFF	First Execution	64-bit	0x7FF00181040	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF00181000	0x7FF00181FFF	Content Changed	64-bit	0x7FF001812C4	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF00182000	0x7FF00182FFF	First Execution	64-bit	0x7FF00182000	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF000FC000	0x7FF000FCFFF	Content Changed	64-bit	0x7FF000FC6A8	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x009A6000	0x009B2FFF	Content Changed	64-bit	0x009B22A4	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF00183000	0x7FF00183FFF	First Execution	64-bit	0x7FF00183000	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF00034000	0x7FF00034FFF	First Execution	64-bit	0x7FF000349F8	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF001CC000	0x7FF001CCFFF	Content Changed	64-bit	0x7FF001CCAA0	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF00183000	0x7FF00183FFF	Content Changed	64-bit	0x7FF001832DC	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF00182000	0x7FF00182FFF	Content Changed	64-bit	0x7FF00182CC6	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF000FC000	0x7FF000FCFFF	Content Changed	64-bit	0x7FF000FC6A8	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x7FF00181000	0x7FF00181FFF	Content Changed	64-bit	0x7FF00181314	... Memory Dump Actions Go to Process Download Dump
ssvchost.exe	1	0x00AE0000	0x00AE9FFF	Final Dump	64-bit	-	... Memory Dump Actions Go to Process Go to YARA Matches Download Dump

Local AV Matches (1)

»

Threat Name	Severity
Generic.Ransom.Small.A8C082EF	Malicious

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
OlympicDestroyer_Gen1	Olympic Destroyer destructive malware	Worm	5/5	... YARA Actions Show Ruleset Show Match

c:\users\5p5nrgjn0js halpmcxz\appdata\local\gdipfontcachev1.dat

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	106.27 KB
MD5	92e128dcb152d05f07faf5da64bd1c91
SHA1	2174814ca563fc2b9679fffbf1b40bdf3ac9abec
SHA256	11437a99f5f9c0a6df09c64abc8828ad3ecd8cf4fa601340ded86b8945edff43
SSDeep	768:i8HrbdvVyZHgTl7ho5sZWN/Ys9byFRQ+AwqGuGyZoVyOF7rrlqTIyMnm:/pVyZHgTl7h6tKR7AwqlGyZQVO1Mnm
ImpHash	-

c:\windows\bootstat.dat

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	66.00 KB
MD5	b0bcc5f4688916ae8c962d203e407cbd
SHA1	b3282b38bdf04ac3e0fb4d1effc27efbe644cb08
SHA256	d5e5620b36cbb1329c0aeeb931210ebc9c8a9c1a6475baf9913e61653317992e
SSDeep	3:NlE/7k+lHlFlkflLtdsK8Uha6aulIiolxGsnlllllDsK8UhaCtkUlcl:iPWNtNXauKPvN9ny
ImpHash	-

c:\windows\setupact.log

Modified File

Text

Unknown

»

Mime Type	text/plain
File Size	258 Bytes
MD5	666731e0c025572e77af3e585fc2fa2a
SHA1	4d087e4247d7e800c3870fbf1501b3366ae1bce7
SHA256	2ed51c535fc5ce855ad04a7474903aef96730f56bf521d73b1aff1d77f1a2e09
SSDeep	6:/WNVf1gKfTOJ1F34vkxDNVf1gKfTOJ1F34vkxDNVf1gKfTOJ1F34vsjAIGF2TWNx:eVgK6JPo8xDVgK6JPo8xDVgK6JPo0qFr
ImpHash	-

c:\windows\system32\winevt\logs\system.evtx

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.07 MB
MD5	d938d1f49522f06ca5efb1413eb4da17
SHA1	e7b6f0178c2f061055bb211d8c08620d45a1f0a4
SHA256	e71c6457d0c1001f1d92c3d555bfa110e252470d05ab55df861640e1ba0a04b4
SSDeep	3072:JoTv/6mL9hPV6qtyN1md1uk0aBKUPRXeEFEvP0+qylefLd9TyTLzG/EW9QebZOnP:eg1wz0VgGjS
ImpHash	-

c:\windows\system32\winevt\logs\application.evtx

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.07 MB
MD5	6155dc819e8bd94bf64c262cf5714a3a
SHA1	aee2e9be3c1cd25005539055b10bb0fe651232ee
SHA256	a8d9968d5deaf87fee31daa31958d9ac113ee9c1c47d126b92f1119585531afa
SSDeep	12288:i1sheRoQ/hqSl1LDsM4kLF37C0r5E8XK1yXeITNhz1bazP1:
ImpHash	-

c:\windows\system32\winevt\logs\security.evtx

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.07 MB
MD5	ff455bb985f632f8f3a15436f5335dd0
SHA1	81ad33dccb732102b98e407fd787201e9a824e8e
SHA256	ef0d14530db38970d80daea0f7f15d709f4a2b623d3ed52fcb8909dee4680e0e
SSDeep	3072:cLO7IqpT9tOervMEDrPJVtHJLv3BaHDUg:VGervMEpVtHJL/
ImpHash	-

c:\windows\system32\winevt\logs\microsoft-windows-kernel-whea%4operational.evtx

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.00 MB
MD5	ab431123d1b26d772f038d970f389cb1
SHA1	3bc2c9044326bdee05bb7fcb23d908f36b59acb7
SHA256	25a7976121b6a907a38eb6bbb00263ad69a6b745cef03b9e6e3bb598fe7cee57
SSDeep	384:l7hkICqQ0RDIx9IyIQIhInI/JIHIAEIGYIOI7IeIvghVI/iY8CIXIi0IXIhCIHk4:l7RxTOLgPz+RBg03KvUT
ImpHash	-

c:\windows\system32\winevt\logs\microsoft-windows-grouppolicy%4operational.evtx

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.07 MB
MD5	9e26cc8ee1c6b9961020d719a436d58a
SHA1	5dc22c5c443acea37d79fd3aea6d672b7f32349e
SHA256	f780ff763b0534ae65ff69f3ce094bfea93392439a6146cc794e5dc2253b85fb
SSDeep	1536:3NewLRnRlR/Er4HJXLozJOE3kCXIdVWqlgcg+wtmizpZBfLYgH/7ub2dlOwHN6bJ:3P3qQ2kiBNqmW+n0
ImpHash	-

c:\windows\system32\winevt\logs\microsoft-windows-user profile service%4operational.evtx

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.07 MB
MD5	a5a1cbb15698112b8efe7949d609455b
SHA1	e1395b33ce0d36e8e3b3e7cf770c693aa3b6584c
SHA256	00ed4a1596c2558e9c704ead2e61f759917527505a82ffae8a82235fcaf4aa0c
SSDeep	1536:tHdoIScVo73eJwSQpdBCA07aVN6er+FU2PflW7fRBoeRdVTnVzpbRgL8gnRb7WPc:mp
ImpHash	-

c:\windows\system32\winevt\logs\microsoft-windows-offlinefiles%4operational.evtx

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	68.00 KB
MD5	c56ca4d381e6000ccc16bc06329d8960
SHA1	fb96eba7983b569abd02d2f5070e060e1d63c26b
SHA256	139be140890a1ee8957749b398452e9bb2841dc6db5ba0413642db5ed83d3113
SSDeep	1536:5wpSJQxh9R8WJQl58ipWYIWphdBdurh+sJZlpJt7iRf9JiSqhNvtAqhs9+8zhSWA:
ImpHash	-

c:\windows\system32\winevt\logs\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	68.00 KB
MD5	d6086bf36e07c1625c78341dd29b59d8
SHA1	f169e11a3c8a71175e35c8fcf4a9b569df789c54
SHA256	f5c77b417ee61cf81410d187d5c58a6603f355b3efa9048b149720ca5cd5eba5
SSDeep	1536:62sCaBtBbLghOy01lNHsco0kwE2YY21lRw4DWQbrsNKQQsLbNxrVkIdsA0CcxwQO:
ImpHash	-

c:\windows\system32\winevt\logs\microsoft-windows-branchcachesmb%4operational.evtx

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	68.00 KB
MD5	16d173046849154ad74e36d92ed466c2
SHA1	dff6497e1f83eeec91e0cc3ea325a3598a6d347c
SHA256	e583a8306363f4418c9e07a08e732581fdd18040f81e64dd7083f8e2bc4e1f6c
SSDeep	384:1huhDhQ2QPhDY6hDamhDDhD8hDhhD/hDOhD1hD4hDshDchDihDohDLzhD4hDWhDl:1YrQeDQP6e
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS (Dropped File)
Mime Type	application/octet-stream
File Size	14.72 KB
MD5	2a8b92ea0333f6d5e79f76600a8dfd28
SHA1	dde1f467b14b6977be904febe188af31ec38cdac
SHA256	99de360f86671c86d489d93bfad3ac970ecc8f3c640bcaf841c5344957f9838e
SSDeep	384:9Xe72r8zNrPpT9esbDojTEXBVRszakLG3YxT8JCt:9s66NHepTEXCzfL9t
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG (Dropped File)
Mime Type	application/octet-stream
File Size	1.05 KB
MD5	da7007c660915ae9d708cf51360a0795
SHA1	e08c1a4845a8cfebd149f68e68e6b6d8626e655f
SHA256	27ffd1b3a1607e24cc1588270c1845d0483fcd6c817fb77ad10ceb44871d846f
SSDeep	24:J1DZPGyppkwhKGTX32fP8gGW94xWY8bGxcDR:JVZP5pC8TX32f3JgOvR
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	1.66 KB
MD5	20f63e5436bdf5172803d92084787ea2
SHA1	d6afa68b2a0bb28572c06cb3601db262c46775c3
SHA256	f08fbab4e25251479aa2b821c3981047128e35865f76ef29ddae807706e09704
SSDeep	48:2DwidCuSd//0GC1vPngULUOPL+P6AMExTez:Kkd/ePnlTjVAti
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	34.11 KB
MD5	5f85164481ec37f6a072e646790f267b
SHA1	c59bd77517b481dcff59dd15de6624291345ecaf
SHA256	b8276b4e3d40d4556b96f0a3dbeb0ca511796a5dfefe18edd39e7e6797f8c1fd
SSDeep	768:1jQIceGpOahjI+4h6+mGe3HUHQX5VYxkLvwC+kYJeNkaHG9tabT1A:FQIvUsPE+mVXsQV5LvHrYJeNk+G9YbZA
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	19.91 KB
MD5	f079bf6af3bc03d40b07d3cfcc885d7a
SHA1	582478f4e205d28d567de12f5646c7f0118633cd
SHA256	76638e343ecd0e7cc1e6632a4d90dccb6f3fed130414a5594053078b4ac4b23e
SSDeep	384:ayj5by5jD1ixMg90/uRU/QdohSUcxN14npVLn81cnAHYZkmg6MjuQRK9wBBbsLmo:ayo5jDQxMgW2aWUcf12pRZkmg5jbwCDI
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	27.94 KB
MD5	367b5e1a2ae539ec2a0d71e35c302a69
SHA1	edd21606527bbab66fadc901e416820e5dd382b0
SHA256	c77b066c7229147d5f165735c237e4a1caf315dd0683e07398aece160dde8aa5
SSDeep	384:+e5PR+BgljdOwIjHfItem+5N7PMWZQWdbRR8WZ53ab2zYZL9xwfWILBkYX5oZ:NRZljUw6flm+5NDMWiEvzYZfwfZLBkAO
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	31.69 KB
MD5	b230566096ea68283024b6aa02dd6e99
SHA1	905799bc9798ac16be9c6666976a70647743e8b4
SHA256	53368bd4299d4a3dbe6c2e76b1699240f9a3d2400cd5210ee83fe9a73e3c7e7c
SSDeep	768:p2PI8EAw/vzGnB+92CB6t/gIBW7LbrabciIX/VgUNFNaitq:pH7m+95B0o6ybrMJUDNal
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	32.78 KB
MD5	225d227404b0f4f7cabcd099f84f2752
SHA1	7f3d8e15547bec0e46a63bc6a227651791230e04
SHA256	b25a58dd8a414bdcfbfb5881d8ebf68f5b05c27f8784c90d3e506cd22067ee53
SSDeep	768:zC2z22PbDmDCEKoA74XiJTr+D5n04eE/pd2GSOqhpdn:+2z22nmDCEm7bTrW04eE/vqjn
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	17.98 KB
MD5	f17ccbf3b570cb66d760d3fef45cf6bd
SHA1	91347e77d6621965286468d9359456064326d8c4
SHA256	03264f703218aac7ce3879adc77cf3e7ceb7fe0e94a16e1e0228d7415f5c578b
SSDeep	384:3uBBx77CmFOrd2Un5lyo+7wnfTOOFmmrW4vwFS3m1oHITDgO:eTAYO5sFMfyWp8S3m1oHoDz
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	11.31 KB
MD5	d1ae2eb50032d0da827c0cd0da1d602a
SHA1	160134dbba53250b5dd5601b1565155b631e2d04
SHA256	71aee56fc66f0345f57bcc32de4ffc89eb601b30f644942cee2238e9288ae0d6
SSDeep	192:ZBeNXW05KS7s2qWGY6JM196swNF3csAZKWkGZpgjCNg1uU:Z4KSAXLOnrsAZKFGIjCQ
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	15.38 KB
MD5	4980f8619dcc18c41f8f6b3b733f9c7f
SHA1	5565c0b39ae868a0e0d608036345427870ee0049
SHA256	d37904592e7e8571cfe9f4efab464fca8291eb4462c18f5308ef86b9a18381e8
SSDeep	384:NNoatMyMtxTcziYUlCJUN1P1qDbB58y8b1j9nuuqGcM:NNpjWcVJSPFxb1j9uuqm
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	51.88 KB
MD5	bb41f1cd1ff363270c81d23aeff6ae6c
SHA1	d19ed44e5cf88d67037deb4db691743dd7e028bb
SHA256	0a66c7d61c63505932ab68c23f4f161c0a85da98c848ad240dbbcb668ff1fc7c
SSDeep	768:BscqWZXkP2YXjWLtz3wfoDJYGS0eHjgPUpinXcLvptb5E4U2TfCsXbQLFE6ZopIb:BsKBtUwDd+75L35Ez22IKmFPMZ
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	26.55 KB
MD5	dfb594f4131dea4c469577f9dc78047b
SHA1	f3ae1a15aa050e007f15bde6855705d4d8bc397d
SHA256	dd2b2c30aa265e280c6657c906630ebbcc0d51477089b965f99e84546c62f32d
SSDeep	768:sp0JFawIOtxU9WaSc6K9CtHG+b3X/0Whnb8plJSa:sp0+SvU94DKsthnbmlwa
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	21.31 KB
MD5	f7d9016dd2e69f0d996e4d9e064576ce
SHA1	894afebd39d1b3c460ab067ef49d4f45f64d6dd9
SHA256	527345565aeda191fd4f4f8070e0d3976543560a2781c9bdfa0510bf32446916
SSDeep	384:WAhjMUMdX9NSu0qExsSS8Tbi7E6INDfHsPNu8CWNqcY0EWfBi9KCNODb/eA:WAxXMdNN90NT+7EXNDPkNxCWkMhpBCoz
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	32.70 KB
MD5	f422dbb05138cd2c869bd8970f4c5c39
SHA1	2772173f12ead5d804c7963eaaf29514531929a4
SHA256	c4b74ba841dfdf286fa119d043fd4c2ccfabca7cf60d9d50ddf565ecc12e5eb0
SSDeep	768:E0ZqbY2jx8M9oM7Xacwe4SSYvu70KBcUB4MwJpU9v0Om+YnXlLhS72kYhAYeZ:E0yYMnrweHSku70KOC95mvVL472kgA/Z
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\Help\Decrypt Instructions.txt

Dropped File

Text

Unknown

»

Also Known As	C:\Boot\ja-JP\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Services\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\EQUATION\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\System\en-US\Decrypt Instructions.txt (Dropped File) C:\Boot\nl-NL\Decrypt Instructions.txt (Dropped File) C:\Boot\fi-FI\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\Decrypt Instructions.txt (Dropped File) c:\program files\dvd maker\shared\dvdstyles\babyboy\decrypt instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\System\msadc\Decrypt Instructions.txt (Dropped File) C:\Boot\da-DK\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\Decrypt Instructions.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\System\ado\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\Decrypt Instructions.txt (Dropped File) c:\program files\dvd maker\shared\dvdstyles\full\decrypt instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\TextConv\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\Decrypt Instructions.txt (Dropped File) C:\Boot\ko-KR\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\Decrypt Instructions.txt (Dropped File) c:\program files\dvd maker\shared\dvdstyles\huecycle\decrypt instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\Decrypt Instructions.txt (Dropped File) C:\Boot\Fonts\Decrypt Instructions.txt (Dropped File) C:\Boot\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\Decrypt Instructions.txt (Dropped File) C:\Boot\es-ES\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\MSInfo\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Source Engine\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\Decrypt Instructions.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Push\Decrypt Instructions.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Decrypt Instructions.txt (Dropped File) C:\Boot\ru-RU\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\System\Decrypt Instructions.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\VC\Decrypt Instructions.txt (Dropped File) c:\program files\dvd maker\en-us\decrypt instructions.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Decrypt Instructions.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\Decrypt Instructions.txt (Dropped File) C:\Boot\it-IT\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\Decrypt Instructions.txt (Dropped File) C:\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\Decrypt Instructions.txt (Dropped File) C:\Boot\pl-PL\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\VBA\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\System\msadc\en-US\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\Decrypt Instructions.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\Decrypt Instructions.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\Decrypt Instructions.txt (Dropped File) C:\Boot\zh-HK\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Smart Tag\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Stationery\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\Decrypt Instructions.txt (Dropped File) c:\program files\common files\system\ole db\decrypt instructions.txt (Dropped File) c:\program files\dvd maker\decrypt instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\Decrypt Instructions.txt (Dropped File) c:\program files\dvd maker\shared\decrypt instructions.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\Decrypt Instructions.txt (Dropped File) C:\Boot\de-DE\Decrypt Instructions.txt (Dropped File) C:\MSOCache\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Decrypt Instructions.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\Decrypt Instructions.txt (Dropped File) C:\$Recycle.Bin\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Web Folders\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\VSTO\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\Decrypt Instructions.txt (Dropped File) C:\Boot\nb-NO\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\Decrypt Instructions.txt (Dropped File) c:\program files\common files\system\msmapi\1033\decrypt instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\DESIGNER\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\Decrypt Instructions.txt (Dropped File) C:\Boot\hu-HU\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\EURO\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Decrypt Instructions.txt (Dropped File) C:\Boot\sv-SE\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\Decrypt Instructions.txt (Dropped File) C:\PerfLogs\Decrypt Instructions.txt (Dropped File) c:\program files\common files\system\ole db\en-us\decrypt instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Decrypt Instructions.txt (Dropped File) C:\PerfLogs\Admin\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\Decrypt Instructions.txt (Dropped File) C:\Boot\cs-CZ\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\Decrypt Instructions.txt (Dropped File) C:\Boot\fr-FR\Decrypt Instructions.txt (Dropped File) C:\Boot\zh-CN\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FRAR\Decrypt Instructions.txt (Dropped File) C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Decrypt Instructions.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\SpeechEngines\Microsoft\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENFR\Decrypt Instructions.txt (Dropped File) C:\Boot\zh-TW\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\Decrypt Instructions.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ARFR\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\VGX\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\System\MSMAPI\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Filters\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\System\ado\en-US\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENES\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\PROOF\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\Decrypt Instructions.txt (Dropped File) C:\Config.Msi\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Decrypt Instructions.txt (Dropped File) C:\Program Files\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\Decrypt Instructions.txt (Dropped File) C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\Decrypt Instructions.txt (Dropped File) C:\Boot\en-US\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\Decrypt Instructions.txt (Dropped File) c:\program files\dvd maker\shared\dvdstyles\decrypt instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\Decrypt Instructions.txt (Dropped File) C:\Boot\pt-BR\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\DW\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\SpeechEngines\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\Decrypt Instructions.txt (Dropped File) c:\program files\dvd maker\shared\dvdstyles\layeredtitles\decrypt instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\Decrypt Instructions.txt (Dropped File) c:\program files\dvd maker\shared\dvdstyles\babygirl\decrypt instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\en-US\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\Decrypt Instructions.txt (Dropped File) C:\Boot\el-GR\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\Decrypt Instructions.txt (Dropped File) C:\Boot\tr-TR\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\Decrypt Instructions.txt (Dropped File) C:\Program Files\Common Files\Microsoft Shared\Triedit\Decrypt Instructions.txt (Dropped File) C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Decrypt Instructions.txt (Dropped File) C:\Boot\pt-PT\Decrypt Instructions.txt (Dropped File) c:\program files\dvd maker\shared\dvdstyles\flippage\decrypt instructions.txt (Dropped File)
Mime Type	text/plain
File Size	1.86 KB
MD5	51a2014b04424032f1a8de3c3fad2964
SHA1	ca141c9d59f29608f93cf1d98e43c7a80109be75
SHA256	2a026f6d3aeb559616483632e8d80eb97c311c8449239ba508ae4451571b269c
SSDeep	48:DibNVexPVzZ7aLtzZYCNB9r+f17TDzWN/TZA+8s87/A:+sxPVzZMX/qf1fD61ls3A
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG (Dropped File)
Mime Type	application/octet-stream
File Size	6.66 KB
MD5	c849ce993196acc07614646d8261b7f2
SHA1	b3a17fb9245be40632932f2892c1ab2c98085f89
SHA256	23cdb5cc3f0f12d4ec05b198180ca12465a972b6764c50aa58e496e26ba1685e
SSDeep	96:9RuVKavn+svDUOUZsHbQQ7c03PnmcjyDIcb89bRItb+IWhOKU/u3SBuZhei:94VdvnfvDUOtcknTuJ81Rib+IWHs4/
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT (Dropped File)
Mime Type	application/octet-stream
File Size	1.13 MB
MD5	8a91708c6b41c63b7dff5b2d7e37fcf9
SHA1	1519e534a0b439cf103f4597591b2cb86b690165
SHA256	66a3b940a1905c0c2ffbbe3aa4249c5e8051adf93e7e3da0ff489df504f5aece
SSDeep	24576:I2ANbTc58jdNTTgfrTqhQTecQl2muXNmcBpvm7FZ0:NANXcAPS+hQQl2DDviZ0
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	24.66 KB
MD5	5702156f292c7dbd9f8e30e59b462263
SHA1	d134af2e65ac5e467e17d335195b49f3ce55f4fe
SHA256	fa3d8ad02a87a451f7c1fef7c4edeb25dcf0071174911effb85cc4b12980a14c
SSDeep	768:nbpcUluvx1RCySzve77+bfgfeF0D8QhkD22GDuclc6:nbpL1ySRbG40Xh82RRc6
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	19.33 KB
MD5	af7a904d18eec4fc7e26a00e3422e9cf
SHA1	a2e5a3538d380d75df2d0214e2f7d8b436bff25d
SHA256	61d4bec647019805def051d1eae6eda68423c4e32d76d773be204c5f417a5a31
SSDeep	384:GcPtUS+ZlrJY4n0+LNdVokz1xvRc7Y0X+nxQeFYmA9YkDv4cywycvQQC9OlKxajY:zPtULZFPntLNL3z1hz0Onxf3YN3yfa5i
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	20.16 KB
MD5	6d48992281dbfd8503d7cd436a8e1697
SHA1	49f6c5335085e7152fa4254998ee050bdc041b99
SHA256	4a27a2916b72c36eee0299adc15f76aca90d6fa9b600a9b8c046cdcd2c39f215
SSDeep	384:QfTjDCTakCGrVAKsJPRv6nJvSk/DW5TqqvjAfe2uNSPSOEY02OWcCwI8:QfTjemkCIuJpveSk/Kt7LAm2LPhLECwH
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	32.25 KB
MD5	7770da76ea897bcd741bfcfd08cf59b0
SHA1	f8386d497a2a4b5a6b292ef2cc3cc51e459f8959
SHA256	28a6b1b17aac6808be48643c1671179e8834e08d28c74d0a30a759745fe4f539
SSDeep	768:MkAcDPl44wS57yXM707CQZWdtkt0eqlBNdZHz3/H3+1BqrV4wmu:FR44wS57yXS0WIU2qbH9zvOurKwj
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	26.77 KB
MD5	110d7035890a814c8c1759f51520cc47
SHA1	10724882e16bb8922013d9f55cb58594f0bd3b31
SHA256	938dbc4ba3b3be7fe1d640a830d48fcdb8324e96c08fd04ea06e6be000534f79
SSDeep	384:yMBiifK4yfYXdr88/IUSWEsyFS/54R/3EjMcafaJbc5FfaBLSU/T+5+mVZ5v4VNO:yF4EYqfeGdStaiJbyG+0+Hj5WRy
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	31.09 KB
MD5	bac7db32aabe1727355e79c9f8a5be6e
SHA1	6958c5802a045a209e3d02b00c27c2b3d6dca1d9
SHA256	09062b9325a24fb9a5d7a15a80d6785f155732676448af2a89ac44576f31f69a
SSDeep	768:FX1mFmK2tbyDC5r8Syg7bHHxmk1ewSYuYob0+zLZv:FXUmK2RfV8cbHkuSYuVZv
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	42.27 KB
MD5	99de3aecf5aa1c83fd69be42c4a3539b
SHA1	744232c5aeb33ce1859eac65c05f422a1130a24a
SHA256	86e035e824c2a521dd7be05d9c823b5bdc6bec545e8482e3ca02ced4bdc6ab33
SSDeep	768:SFGd+g0JI3rgpbraGd9uIZi7EPZLSHF75U0Xt6Wo4nhmyPsD/W9PG:OeaL9uVaZLSlNkWo4hTPI/KG
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	31.84 KB
MD5	d44b99fc67b70425a8afdc1df8846ec0
SHA1	71322adccf635232e473a6d7fe96f04096be14ea
SHA256	8d1df2909af842768493cd2261e61252c23f4827ce75c10bcd5839c84268eb2b
SSDeep	768:HZQNIlRcKxSFLDq/RO82wYrWHLyWJ3zLS9e:HWOXr0bQYrnKq9e
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	29.23 KB
MD5	8a76a845d7e5364663540b2da5cb638a
SHA1	a4dad27ea631cbab99a2fb5983d309f644d3b502
SHA256	401dac54f6f5bd8360f3540b928a60eb0a89965165f7f5192ad94246b7f6eaa1
SSDeep	768:gv6DN8fGg1o5Cglj7LKoO5PT4H5uE7vuvXL9B4ds8:giDEP1SCgt7lOFsJWUdV
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	20.09 KB
MD5	1ee99e011ee4df451e8d2f8e8a73d59a
SHA1	abefbda5917bf29390bf15ba6895ef879ed29464
SHA256	c388e51b3262b6d111727ced1446f1dcda2a21c4c723385954eafb97b0ca3770
SSDeep	384:uemIL84XNaP6+o+DKt7kH2amBfUVATx1TkaNGjorjverdrdYyzwzxpYkhIjy:JL84XgS+B2lkH2amVUVATxtkaNGj2G1G
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	32.50 KB
MD5	a18ce15122894d18fb733ebd69e10582
SHA1	22d8feaf7758ceee5fa7d36d1454cc9f5864c3c0
SHA256	e1503cd7c5579eb27f6ba5ef6b3ef3da00ab246d9d49c93c63c1c26423e03be4
SSDeep	768:Xj3RfM7QPAt76Nt8pWztXw1QBsTv+M8iVapOjQhDoWxDo41:zhJAtONqetXw1asTv+UValU8U41
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	24.53 KB
MD5	27c75bd6db6108251c5cdd083e9a6b7c
SHA1	ee0bffcc96dfd259da998515ea5ba53102d8999b
SHA256	c5c6e3351a4cbf9273acf5b475956b573de412776bb65624a50b302985a802d9
SSDeep	768:7VxO8SyI7Xc01xG0PpYl8NApqYAcFmg76lH8:pf2mAWUxcFmq6u
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	31.66 KB
MD5	870c42d696cbd1fe6d48d694792cea76
SHA1	c36fffb894bb10823e3ee0b479635a630dfdcd17
SHA256	b003be562e24b6971240428964eae549b31f38fbf3eb6c5344572ccf8a6307ee
SSDeep	768:NGFNPeBBtAz6xI2pHulchU6/EU5xTREVsZiyPzcK8:NGFsDa2x/276R5xTREVs4ybt8
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	25.80 KB
MD5	3dcf6d1a1c4c908eea6bf94d74131d6e
SHA1	a390e12df5e9ecc96c3893fc06df92a7cd4e38f5
SHA256	12a5694d9feab3b3e20771d9afcc6973c35fdfbb24e6329463aa866f87966661
SSDeep	768:xkKBkFTzm+pLoiwxcgTM/l/mMDEXNgODgT6VW:xk3N5dE7TadEXNVkT6VW
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	59.31 KB
MD5	33db95079f205092a54561c29d580b43
SHA1	a414f0bea3546040e501f566f6aada7febcbcae2
SHA256	0f83ace1cce2c3fb61a9537cead872a84b9abf6ec7b76c0970ed1c1e345a0247
SSDeep	1536:JPezfVHVRHhy+Y+gKt+1PJ55XJCXj9wC52UJF3Cev67mUm6:Fe5Hlyp+7t+tv5XQXtBF3yHz
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	18.39 KB
MD5	933611a10680bbd099d6f5c2257af086
SHA1	50e90670a66f9da4dc3aac6cee4b0d67b970033a
SHA256	7425f46e269deb1bde0717441c2f4ee4a1a0b7567b375efa8d2581f374a18fd9
SSDeep	384:/eDFhPy0Jym/DcfW7ZiKx81zhrVBF4eK5x+uR9+URuKS8DU0D9CwxOgcgSu:WDe0N/DcfgZKr6eW5R9RRurOU0DbxggL
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	19.03 KB
MD5	de7d266ea6b15da721436c9766b5f468
SHA1	c3fea002c6cff87feac091cc9f8c9be54080cbc7
SHA256	bd96753eb9a6df74e6dc99df983184cdbdc67b731e1c37f1b84175afe437ff2a
SSDeep	384:OtyAOZB7qpaiKeB1pF7UcMPvcv3iUnxuOd1rZMUEwIagV:OXGRqpaiKe7ziUv3iixuOd1rZMyI5V
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	43.81 KB
MD5	3cdbdc5ddb5c5e3d2b359b612522376e
SHA1	8a7bd9f5661b64184e460c49d26192652b49746e
SHA256	bba50566fac32bb86db0bae23eeb20ed7e0fa375854485168429b707db903c06
SSDeep	768:Ntndbh0MCDtBOBbxTH6eU9AxU2Hyy6XGOxv4M5wqq3t4sWlhDOq0:nndbh0MCoxL6eaUSJGOxgFqwt4HOq0
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	47.00 KB
MD5	bee59e7248e318103c2024901d336d2d
SHA1	956e02cde86662c2bdc21c1680a055acf9c5936f
SHA256	44c4b469e6a417b13ffa4a45915984db962a8f51eaf388a0a00822d5ebfa3ef2
SSDeep	768:WgQTR273A9jsbKlfk6i23OTUt9GXo9WWhwEdabchHvgUcvlNR04SfIBC60rPA88l:Qk7Q9obK1iZgtIuWS3Fv9ke4S1HDA8I
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	36.58 KB
MD5	4f9b7c07cbb15330903cf629a8e2a17b
SHA1	6d275c6c022e0a0193664571321fcd4461711901
SHA256	8f29bc1b472560356032f4f2c29a25e542ec7b23f7a8ee20dc492af2a0bf1884
SSDeep	768:Ji1k6HjZScQP8Mzspn6amU7yHYbCkhZCXyMQNWkNhpeU5M2FyuUz:kE8iL5U7yH83KXdAWkNyZMTUz
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	21.25 KB
MD5	ec9e90a208025e290bd9f8b2f270abe7
SHA1	df59f730e904366f13d9e566d5e249bae241a7e3
SHA256	4b171272a70fcc139cbde2fb73b1e25eef8283b3bc57683ab7975e2ae58419cd
SSDeep	384:QFiHYgOkgspf2lXIrMwfeD01fqkrHRdXwovSczZtAq3zKOukCmMj1ppLzbrVd4p3:AiHYgOkgsl44rykfpHRdX1TZ1DCjBLzo
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	16.36 KB
MD5	4d1a1a15303d488f5a276b005a86f947
SHA1	a587fca80488ac8a3bc42e2876bc08e489496ac2
SHA256	7a682cade6c75c0f04f1d3403d71b9b9ad191a3979137563b4f5a74763622b2a
SSDeep	384:SaFvhPC1oIxbFafSEQA3+lKyxboyzQ450xkXyLGdso:zFvhPC1JWQS+g+X0Rqy1o
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	36.25 KB
MD5	f76b6824ae7daca8328d49fe7d238556
SHA1	66e278e2ca38c98cc0416d825741839ef14778ea
SHA256	66d9c16fdd778d6b4a1415faff87730ebd3be5ca2e76c9fca3bc045e53caf442
SSDeep	768:PPN/Rx2gSDdKejg8VkJ4FED5GfLPVA/ZgnnC/CkjebiZzs6SJQG:PdT2JDsj82J4FNbC/anbbiZzOf
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	19.11 KB
MD5	96ab5e919ea56f0dce677f32306a042e
SHA1	8f00e504e3e6d8bcc1b73fdba6a5f347f032fcd0
SHA256	f3be01ca2e2dc2b5350bd1c486328d6ce68dd3967d31bb57699a85617ec4525b
SSDeep	384:KX1C9FgYwGYRqAoKnebscEoy5ig50Qa8l6YesC77fnRp3B+bBmWq1zLbVefiLjbv:oMSt1qATeg7o2izt8Y+C7jnRJ8bBm/19
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	31.23 KB
MD5	146b7a7a79a56219990201269aadc31a
SHA1	7ad08f4fbc09ace9c74c8e4dda23b66d3cf02e91
SHA256	bd6a1a8edf27ef5a6ab46fefaf0446d01419f7323926f56fbb5a7726736a1258
SSDeep	768:mCs6tgKr1IDoy+C0UmiP0T0AgAcuy2qiyibLDPvofTdTw:mH6tgKrCkdPie03AdyxwbLDI6
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	46.84 KB
MD5	ed73d11fb269a9411f59da34db25dfd5
SHA1	4d7b97ab6480d8f582baf6e53d4b9f94d8e6fd88
SHA256	391d1b38f84699388bfd3eb0985f07c6c47c66445ce2c54c58e7ae9a35792995
SSDeep	768:MmVYdYBbYxr/fEK6Sr2V2Z0mkKwumgTYn+NT8pNCbmXfUA3j1nl8qGQhxNw:dHwHV12k0mkKQgTo+R8pYbmPUA3hLxu
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	33.38 KB
MD5	7756bc97b2535495e12a63ef2100a198
SHA1	63349636f81c5dd7d67fec512a4a90351d88a922
SHA256	513d5c058c70931fc52c135fa513271c074206ae054384457f126b6a1b7ec675
SSDeep	768:jdAr2mUESeZYo+qox6xN2BOfWc546WkiBLINlEbBjxf12hL+/S:jdeJSo+ZExN2AfWiWkALKlEl5kR+6
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	28.62 KB
MD5	62defdc23ab871b14833470977fe66f7
SHA1	9cf682afdc95446008b25e06cac0109fd166b243
SHA256	8c165f55daf9aacbb08a3714abefd9148e1f5d4fd8ffc4bbc9ad299c03293216
SSDeep	768:XLCdEn18/Ya+qjbCrorEmq4zdgniwAC3aAlnjuIv8pmE0xA8WoOkqeZ:7km18/ZjbCMrEz4zuiwAeaUni88pD0em
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	19.08 KB
MD5	550cc5d080eaa3f94fbc49ed8c04d3c1
SHA1	b76295035e01b2c2fe73a0598ef7c2102b43048c
SHA256	21bc946521e05423e49c50c1b98bd02fbeb8f0f63e8729fa3935902284e81a59
SSDeep	384:c5g24A1DCVNki2kLWzaF6Et4QEYd/z4lsHy9As6dnAw9g0iF:cPzuYB7z8/4Q1d/zuCWh4A102
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	17.95 KB
MD5	f757707af3cc87df43175084f52d82ab
SHA1	33046d1da279ad3af9e0c74657f04a6717fd2d68
SHA256	2726e5b74c72401cc73c03435a8c6589b55542dc3ddc27f018e9203e8889477c
SSDeep	384:WpzUoT3lIZ6J4Qh6JCi4Dk/K8KHUJTmj2hA2B6GOqc8B5zm:mUoTz9h8CI1pJTmH5NS5zm
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	43.27 KB
MD5	37c4432b7199a50c804d77a30e5e8912
SHA1	07a348c6311378e03f1537c219ac56ec9f6d9752
SHA256	bf80c6c8cb739b049a586c44eb61070b348738a1161dcbfd2d3adb20778c84d8
SSDeep	768:P1ml+fK9/Elem1ZwZ53fTA7AqyC2bk+7h42f3WI5kHYGNwxVq2jsyJT56AqDYAxO:s4KxEleUZwP3fTCI3I+7h42fNSHRmxAY
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATER\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	41.47 KB
MD5	034acdfb8b8d00335447adcc31466f91
SHA1	907a7dd8d46bf51096b51a91e0af22b3c94ea043
SHA256	39df0a4d740d8d29804d5b1943946219a53c8562eeb140a66aebed623af3273b
SSDeep	768:pbo26dBCjV/q4RPto6A+2n61KTYaAOvTvuMsYchEKAVM71c5V0HJbzL71CruUgJ:puUxQ+2nKODTvB1aEKHc5VgzLZCajJ
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG (Dropped File)
Mime Type	application/octet-stream
File Size	29.47 KB
MD5	8dc499e496e61b9e93055c65e259af64
SHA1	260bd554d1e9b6cf530502533fd345836c654f25
SHA256	151536b392e3441f4ddb75e386cdb64bdd60e0d1c9e8b8aeab45162b50fcb747
SSDeep	768:GufOZ8GXHg9TRmU09DCbgcdh8i+Uw3O32v:GuGZ8cHg1R94rcn8i5wYe
ImpHash	-

C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG.encryptedS

Dropped File

Stream

Unknown

»

Also Known As	C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG (Dropped File)
Mime Type	application/octet-stream
File Size	165.67 KB
MD5	9f61fb2d5a59f71a4da4fbe7cd437a55
SHA1	b82873dc823af52d410f1b1eac90c7f3d0b65846
SHA256	9e6441aaef0ac19b5c2886e910c3db93688d315c4d30d93b2522744c2e5336f7
SSDeep	3072:x8wJ4zzyP420DDFpDN3moNyTlbOZ2ndmbHUqnrQuvSsTPnVQ5Q/W9TCLs5/KjBiq:xZ+urMFpJ3JNEbOsdmbHUwCuQ5QI2Lsw
ImpHash	-

c:\windows\serviceprofiles\localservice\appdata\local\lastalive0.dat

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.00 KB
MD5	bad3f96e131b5f154e446779676f4ec1
SHA1	98cbeeb0ca5b291cd07296372bb266ae9a640fe4
SHA256	3ea91ba2c1c994db2392c75160535b467c43f92e8fd21f3ff658f764749d0003
SSDeep	3:m/t4C28/:m19/
ImpHash	-

c:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	2.00 KB
MD5	093e30bae290e7853c1fd5e127c56840
SHA1	5367ac00b673bebefa131673545c7b6923765538
SHA256	6db05c0658aaa19361778695d828492af5676b9b5111c66e785ddaee228560f2
SSDeep	3:3lw/l/gCv/:VG
ImpHash	-

Remarks (1/1)

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After