d6855d90...dbb1

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\oiikyy.exe

Sample File

Binary

Malicious

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	381.00 KB
MD5	51a708b2501b044f72a7fb9157da72e3
SHA1	c737bb567384dcf90cae0cf9cd83c51882fb4dac
SHA256	d6855d908f9dcecbe08363b07a4ed28efa7efd54d227f8191a46aa6166bedbb1
SSDeep	6144:tS8o3ldjb8W71S/GB3c84MLXujGgRvoCqBUsz52XsCwkMM1etEvlEetCuIaCk:mldjAX/K3c84ZRvoCqast2XFMTEvlEh
ImpHash	4608cae0c35f0f61788d7d39d4be7220

PE Information

»

Image Base	0x400000
Entry Point	0x402604
Size Of Code	0x49400
Size Of Initialized Data	0xc3e00
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2019-05-14 16:12:31+00:00

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x49358	0x49400	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	7.96
.rdata	0x44b000	0x2800	0x2800	0x49800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.04
.data	0x44e000	0xad82c	0x1000	0x4c000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	2.24
.tls	0x4fc000	0x9	0x200	0x4d000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.02
.rsrc	0x4fd000	0x12050	0x12200	0x4d200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	6.09

Imports (3)

»

KERNEL32.dll (102)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
_llseek	0x0	0x44b010	0x4cdfc	0x4b5fc	0x539
GetDefaultCommConfigW	0x0	0x44b014	0x4ce00	0x4b600	0x1ca
BuildCommDCBAndTimeoutsA	0x0	0x44b018	0x4ce04	0x4b604	0x3b
HeapAlloc	0x0	0x44b01c	0x4ce08	0x4b608	0x2cb
SetConsoleTextAttribute	0x0	0x44b020	0x4ce0c	0x4b60c	0x446
SetConsoleScreenBufferSize	0x0	0x44b024	0x4ce10	0x4b610	0x445
SetCommBreak	0x0	0x44b028	0x4ce14	0x4b614	0x422
GetModuleHandleW	0x0	0x44b02c	0x4ce18	0x4b618	0x218
GetTickCount	0x0	0x44b030	0x4ce1c	0x4b61c	0x293
GetWindowsDirectoryA	0x0	0x44b034	0x4ce20	0x4b620	0x2ae
OpenProcess	0x0	0x44b038	0x4ce24	0x4b624	0x380
WideCharToMultiByte	0x0	0x44b03c	0x4ce28	0x4b628	0x511
Sleep	0x0	0x44b040	0x4ce2c	0x4b62c	0x4b2
SetSystemPowerState	0x0	0x44b044	0x4ce30	0x4b630	0x48a
GetAtomNameW	0x0	0x44b048	0x4ce34	0x4b634	0x16e
GetModuleFileNameW	0x0	0x44b04c	0x4ce38	0x4b638	0x214
GetVolumePathNameA	0x0	0x44b050	0x4ce3c	0x4b63c	0x2aa
DisconnectNamedPipe	0x0	0x44b054	0x4ce40	0x4b640	0xe1
EnumSystemLocalesA	0x0	0x44b058	0x4ce44	0x4b644	0x10d
FindFirstFileExA	0x0	0x44b05c	0x4ce48	0x4b648	0x133
GetConsoleAliasesLengthW	0x0	0x44b060	0x4ce4c	0x4b64c	0x198
GetLongPathNameW	0x0	0x44b064	0x4ce50	0x4b650	0x20f
GetProcAddress	0x0	0x44b068	0x4ce54	0x4b654	0x245
EnumDateFormatsExA	0x0	0x44b06c	0x4ce58	0x4b658	0xf5
EnumSystemCodePagesW	0x0	0x44b070	0x4ce5c	0x4b65c	0x108
SetFileApisToOEM	0x0	0x44b074	0x4ce60	0x4b660	0x45d
ProcessIdToSessionId	0x0	0x44b078	0x4ce64	0x4b664	0x399
GetProcessWorkingSetSize	0x0	0x44b07c	0x4ce68	0x4b668	0x254
LocalAlloc	0x0	0x44b080	0x4ce6c	0x4b66c	0x344
IsSystemResumeAutomatic	0x0	0x44b084	0x4ce70	0x4b670	0x305
SetConsoleOutputCP	0x0	0x44b088	0x4ce74	0x4b674	0x442
GetCommMask	0x0	0x44b08c	0x4ce78	0x4b678	0x181
FindAtomA	0x0	0x44b090	0x4ce7c	0x4b67c	0x12c
FatalAppExitA	0x0	0x44b094	0x4ce80	0x4b680	0x120
PeekConsoleInputA	0x0	0x44b098	0x4ce84	0x4b684	0x38b
SetCalendarInfoA	0x0	0x44b09c	0x4ce88	0x4b688	0x41e
EnumResourceLanguagesW	0x0	0x44b0a0	0x4ce8c	0x4b68c	0xfe
lstrcpyW	0x0	0x44b0a4	0x4ce90	0x4b690	0x548
lstrcpyA	0x0	0x44b0a8	0x4ce94	0x4b694	0x547
lstrlenA	0x0	0x44b0ac	0x4ce98	0x4b698	0x54d
SetVolumeLabelA	0x0	0x44b0b0	0x4ce9c	0x4b69c	0x4a8
GetLastError	0x0	0x44b0b4	0x4cea0	0x4b6a0	0x202
GetVolumeNameForVolumeMountPointA	0x0	0x44b0b8	0x4cea4	0x4b6a4	0x2a8
GetCommandLineA	0x0	0x44b0bc	0x4cea8	0x4b6a8	0x186
HeapSetInformation	0x0	0x44b0c0	0x4ceac	0x4b6ac	0x2d3
GetStartupInfoW	0x0	0x44b0c4	0x4ceb0	0x4b6b0	0x263
TerminateProcess	0x0	0x44b0c8	0x4ceb4	0x4b6b4	0x4c0
GetCurrentProcess	0x0	0x44b0cc	0x4ceb8	0x4b6b8	0x1c0
UnhandledExceptionFilter	0x0	0x44b0d0	0x4cebc	0x4b6bc	0x4d3
SetUnhandledExceptionFilter	0x0	0x44b0d4	0x4cec0	0x4b6c0	0x4a5
IsDebuggerPresent	0x0	0x44b0d8	0x4cec4	0x4b6c4	0x300
EnterCriticalSection	0x0	0x44b0dc	0x4cec8	0x4b6c8	0xee
LeaveCriticalSection	0x0	0x44b0e0	0x4cecc	0x4b6cc	0x339
InitializeCriticalSectionAndSpinCount	0x0	0x44b0e4	0x4ced0	0x4b6d0	0x2e3
EncodePointer	0x0	0x44b0e8	0x4ced4	0x4b6d4	0xea
DecodePointer	0x0	0x44b0ec	0x4ced8	0x4b6d8	0xca
RtlUnwind	0x0	0x44b0f0	0x4cedc	0x4b6dc	0x418
SetHandleCount	0x0	0x44b0f4	0x4cee0	0x4b6e0	0x46f
GetStdHandle	0x0	0x44b0f8	0x4cee4	0x4b6e4	0x264
GetFileType	0x0	0x44b0fc	0x4cee8	0x4b6e8	0x1f3
DeleteCriticalSection	0x0	0x44b100	0x4ceec	0x4b6ec	0xd1
SetFilePointer	0x0	0x44b104	0x4cef0	0x4b6f0	0x466
HeapFree	0x0	0x44b108	0x4cef4	0x4b6f4	0x2cf
CloseHandle	0x0	0x44b10c	0x4cef8	0x4b6f8	0x52
ExitProcess	0x0	0x44b110	0x4cefc	0x4b6fc	0x119
WriteFile	0x0	0x44b114	0x4cf00	0x4b700	0x525
GetModuleFileNameA	0x0	0x44b118	0x4cf04	0x4b704	0x213
FreeEnvironmentStringsW	0x0	0x44b11c	0x4cf08	0x4b708	0x161
GetEnvironmentStringsW	0x0	0x44b120	0x4cf0c	0x4b70c	0x1da
TlsAlloc	0x0	0x44b124	0x4cf10	0x4b710	0x4c5
TlsGetValue	0x0	0x44b128	0x4cf14	0x4b714	0x4c7
TlsSetValue	0x0	0x44b12c	0x4cf18	0x4b718	0x4c8
TlsFree	0x0	0x44b130	0x4cf1c	0x4b71c	0x4c6
InterlockedIncrement	0x0	0x44b134	0x4cf20	0x4b720	0x2ef
SetLastError	0x0	0x44b138	0x4cf24	0x4b724	0x473
GetCurrentThreadId	0x0	0x44b13c	0x4cf28	0x4b728	0x1c5
InterlockedDecrement	0x0	0x44b140	0x4cf2c	0x4b72c	0x2eb
HeapCreate	0x0	0x44b144	0x4cf30	0x4b730	0x2cd
QueryPerformanceCounter	0x0	0x44b148	0x4cf34	0x4b734	0x3a7
GetCurrentProcessId	0x0	0x44b14c	0x4cf38	0x4b738	0x1c1
GetSystemTimeAsFileTime	0x0	0x44b150	0x4cf3c	0x4b73c	0x279
CreateFileA	0x0	0x44b154	0x4cf40	0x4b740	0x88
SetStdHandle	0x0	0x44b158	0x4cf44	0x4b744	0x487
GetConsoleCP	0x0	0x44b15c	0x4cf48	0x4b748	0x19a
GetConsoleMode	0x0	0x44b160	0x4cf4c	0x4b74c	0x1ac
FlushFileBuffers	0x0	0x44b164	0x4cf50	0x4b750	0x157
LoadLibraryW	0x0	0x44b168	0x4cf54	0x4b754	0x33f
GetCPInfo	0x0	0x44b16c	0x4cf58	0x4b758	0x172
GetACP	0x0	0x44b170	0x4cf5c	0x4b75c	0x168
GetOEMCP	0x0	0x44b174	0x4cf60	0x4b760	0x237
IsValidCodePage	0x0	0x44b178	0x4cf64	0x4b764	0x30a
HeapReAlloc	0x0	0x44b17c	0x4cf68	0x4b768	0x2d2
SetEndOfFile	0x0	0x44b180	0x4cf6c	0x4b76c	0x453
GetProcessHeap	0x0	0x44b184	0x4cf70	0x4b770	0x24a
MultiByteToWideChar	0x0	0x44b188	0x4cf74	0x4b774	0x367
ReadFile	0x0	0x44b18c	0x4cf78	0x4b778	0x3c0
IsProcessorFeaturePresent	0x0	0x44b190	0x4cf7c	0x4b77c	0x304
WriteConsoleW	0x0	0x44b194	0x4cf80	0x4b780	0x524
HeapSize	0x0	0x44b198	0x4cf84	0x4b784	0x2d4
LCMapStringW	0x0	0x44b19c	0x4cf88	0x4b788	0x32d
GetStringTypeW	0x0	0x44b1a0	0x4cf8c	0x4b78c	0x269
CreateFileW	0x0	0x44b1a4	0x4cf90	0x4b790	0x8f

USER32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCaretPos	0x0	0x44b1ac	0x4cf98	0x4b798	0x10a

ADVAPI32.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
DeregisterEventSource	0x0	0x44b000	0x4cdec	0x4b5ec	0xdb
EnumServicesStatusA	0x0	0x44b004	0x4cdf0	0x4b5f0	0xff
CloseEventLog	0x0	0x44b008	0x4cdf4	0x4b5f4	0x56

Exports (1)

»

Api name	EAT Address	Ordinal
@calcPrecision@4	0x1000	0x1

Icons (3)

»

Memory Dumps (38)

»

Name	Process ID	Start VA	End VA	Dump Reason	Bitness	Entry Point	Actions
oiikyy.exe	1	0x00400000	0x0050FFFF	Relevant Image	32-bit	0x004039B9	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x00312118	0x0035287F	First Execution	32-bit	0x00312118	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x01CA0000	0x01D1FFFF	First Execution	32-bit	0x01CA0000	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x01CA0000	0x01D1FFFF	Content Changed	32-bit	0x01CA04F6	... Memory Dump Actions Go to Process Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x00406C0D	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x00452F08	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x00434FD9	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x0043A636	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x0043F47A	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x00405407	... Memory Dump Actions Go to Process Go to AV Match Download Dump
buffer	1	0x00290000	0x00290FFF	First Execution	32-bit	0x00290000	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x002D0000	0x002D0FFF	First Execution	32-bit	0x002D0000	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x002D0000	0x002D0FFF	First Execution	32-bit	0x002D0000	... Memory Dump Actions Go to Process Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x004211C0	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x0041EFF0	... Memory Dump Actions Go to Process Go to AV Match Download Dump
buffer	1	0x00290000	0x00290FFF	First Execution	32-bit	0x00290000	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x00290000	0x00290FFF	First Execution	32-bit	0x00290000	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x002D0000	0x002D0FFF	First Execution	32-bit	0x002D0000	... Memory Dump Actions Go to Process Download Dump
buffer	1	0x002D0000	0x002D0FFF	First Execution	32-bit	0x002D0000	... Memory Dump Actions Go to Process Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x0042697D	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x0040D82F	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x0040D000	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x00426103	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x00453040	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x00409006	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x0040345A	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x0041D0D0	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x004231C0	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x0040D000	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x00426103	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x0042F96D	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x004033E7	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x0042EEFE	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x0041D0D0	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x00408FB0	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x0040C000	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Content Changed	32-bit	0x0042C214	... Memory Dump Actions Go to Process Go to AV Match Download Dump
oiikyy.exe	1	0x00400000	0x0050FFFF	Final Dump	32-bit	-	... Memory Dump Actions Go to Process Go to AV Match Download Dump

\\?\C:\Boot\BCD.LOG1.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\Boot\BCD.LOG1 (Modified File)
Mime Type	application/octet-stream
File Size	520 Bytes
MD5	fbbee98c63d0a303dfe1dcde35eb73b1
SHA1	28ee76f5250b4c9f8597a78deda5a8dd35d1fca9
SHA256	2231b51ef253a123c729ef6cdceadcf24abf16eae5e405bfbe8cd9849ba640e3
SSDeep	12:Ug4BX3uYXcMFmWj1XqCaU712w39Xiq33zhOBTeKrp055JnNi8PZWE:aBX3u3MLQCv7r3B/nVOBrp0Z48PZD
ImpHash	-

\\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini (Modified File)
Mime Type	application/octet-stream
File Size	649 Bytes
MD5	0e9e813ba8c53f679cdfe678fc397fd7
SHA1	0777689d5f21aeb0b3a8293bd8d7a28250dc309b
SHA256	89430d6082e7d6128af956f00a7fabebffa713cd87756d768dd2ddc1437c3b97
SSDeep	12:zsCfuN+q9vIywBX3uYXcMFmWj1XqCaU712w39Xiq33zhOBTeKrp055JnNi8PZWE:zC+qzwBX3u3MLQCv7r3B/nVOBrp0Z48t
ImpHash	-

\\?\C:\Boot\BCD.LOG2

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Boot\BCD.LOG2.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	520 Bytes
MD5	017ef9936d8918cc96e550a1b5f4e8b7
SHA1	0e959a0164e18005dc17f936d77f1c5826356be5
SHA256	b04685ef3c0d87284cc1cfe77a0f79c2478af52e0ded2e207510015fd626641d
SSDeep	12:5BX3uYXcMFmWj1XqCaU712w39Xiq33zhOBTeKrp055JnNi8PZWE:5BX3u3MLQCv7r3B/nVOBrp0Z48PZD
ImpHash	-

\\?\C:\Boot\BOOTSTAT.DAT

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\Boot\BOOTSTAT.DAT.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	64.51 KB
MD5	5f86476880a423be1ba96d1285965840
SHA1	fd39f5f85be74981a96b348a48fb58eee1765052
SHA256	6e6b02462f255b57f0ad6aa0217dd91c66932bc9e7cfb88594bd52d1a1476c29
SSDeep	1536:O0PL/QrENtAV5xY5J1lDc4NhVRMLUHb0YjnSJuymNO+qwA7kzCp:BPTQyt6xY5F1TRMLobdj5owgD
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml (Modified File)
Mime Type	application/octet-stream
File Size	2.04 KB
MD5	a0af27a6e8c4ab94f5e1caadcb11d6a6
SHA1	b8a6ef606247ac42ebdb62c207fdf8c49d52bd19
SHA256	7b44bc98a7e02324130017aa6f4281ca7c3da97cbb6c368bc0696efc2e75e01d
SSDeep	48:eMKpJ86/xPaEJ277nTRJoOaZgZfit1RRROPod/bjBn+3MjP3B/VOoqAZD:eMih27nRJjaZg2zrMAbjB+3+BsPAZD
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
Mime Type	application/octet-stream
File Size	2.75 KB
MD5	4a157353a75cacd5bacde65caf204db3
SHA1	f94adeeac9fe370038317e3afab4948b8fea6458
SHA256	3a91b25572a7f65deef915a83cefed0c538d3c26a4ffb800400c8c56cfb7b6e9
SSDeep	48:VYtuDCV8jWX1ck0sL/h/04jGbiHWW0WmTJq1X2Wo28aivDUDdPq+3MjP3B/VOoqm:V4qCWUck55/04jtdmTJqgWrgs3+BsPAF
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	2.39 MB
MD5	e2648b4a2b09ae16ac49d5949f791ccf
SHA1	34e24a5bd6b957522c40bcf090f015a481240c70
SHA256	f7f87feb1470a3df53ef7e9d4d17c12cf8d4b1a00ef550e55620ed421b667600
SSDeep	49152:vxsDxL8QBoI9eljidTex4S120ytJyham6Co6X:vxsR89EQ1oe
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	2.39 MB
MD5	b938b1a1d5c702e45d5c7b23ebd86b71
SHA1	a09b5e2cdb794cbb521bb1f9c0db68f9e79b021b
SHA256	cf9f8d3689b69b48477aca3f14863a7a2163e1bfb105cf72f522eb8041df5d86
SSDeep	49152:30MDxL8QBoI9eljidTex4S120ytJyha16CZtQ:30MR89EQ1ou
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
Mime Type	application/octet-stream
File Size	2.35 KB
MD5	0ccc99a53aa18d883adab25c50618bac
SHA1	f5bfa3ddb0c4adeeda1f96fe4aad120842213e3f
SHA256	593fb1d7736d78994f754eb7d94e16bfc85bc9ac98dc86ee6297164d70c3d6bb
SSDeep	48:gEk1GUY6Lqn/WomoHVacZ9nAhA/uHdglC7BfdkQ29WrmyQ+3MjP3B/VOoqAZD:gEk0UZLmmetUA/uH2C7Be0yyF3+BsPAF
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	1.92 KB
MD5	8a204e7ff79f755e5bae7c1e1eb9e2c3
SHA1	1ac6672d1782af501ef96ce81f80b57f2fffa0e5
SHA256	1e80476d8464fe92dc1a051c6b4fd6bed07312cd8935ec5fc83fafa88aab13f8
SSDeep	48:VnonC0CiiweTtx8DRcdYyPyTLZT+3MjP3B/VOoqAZD:2nJ6eDRcLPyTFy3+BsPAZD
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi (Modified File)
Mime Type	application/octet-stream
File Size	2.40 MB
MD5	116d7fa3a8ce31b0a98ee78ac42d6082
SHA1	815864b79f0c05ebdf91485dbbe44503824bfd53
SHA256	75766753b7779098360ce1985a5f1ff0aefcc13d11bd5e9f4ea372b155ffc083
SSDeep	49152:VnDxL8QBoI9eljidTex4S120ytJyhaLz6CCHm0:VnR89EQ1oL8
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	1.92 KB
MD5	cd416034f9bc065d9fa1c2222e389607
SHA1	6a8c21a2586a778232ba29446a69dcab33e2619d
SHA256	c4a5d305ec6381037a272454e0d1d3180ce473cf344a7a87d7f70532b71940ac
SSDeep	48:zrhaLjjvNMRAU1R5aJ/N4MQPEGQh04c+3MjP3B/VOoqAZD:z1AjzNMRAkaF+MnFL3+BsPAZD
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
Mime Type	application/octet-stream
File Size	2.08 KB
MD5	25ae43baa7f702cab602d9138f85c32f
SHA1	055149371aba8cad2562f57844e8d853df53ad28
SHA256	4c9de6740ab093aac4540f84c04e01f0d4483e4e4f8469693af8b6ed629c86c0
SSDeep	48:PxIUM/WMQpoVimjvU85lIKktyzbyvnJ1XUjnWOfwm+3MjP3B/VOoqAZD:PeUkJQpoVjvUmlIKfnoE/g3+BsPAZD
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab (Modified File)
Mime Type	application/octet-stream
File Size	16.19 MB
MD5	927ef94697654e286d0762314f2a2f9b
SHA1	cee5c7f45cc343cc4c7ae57c9d74776a48c3578c
SHA256	d4e10438594aed0aceb51b749e39076ee585d65618f90d8503a7e46306c219d6
SSDeep	196608:71mba8A7fKP0ReD0wXKLUEfRrDXP2ifogB+jHcSBLWiyvyWJRMLhdPWfi:71UaRDKP0q0wM9JrL2ifJEjhW/6vL3Ai
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	2.73 MB
MD5	c94febd1c745eb0a0a249531cadc8554
SHA1	5913562bbe3fd2c07bb0467a7cce2c084d4feb45
SHA256	2e1e3d8f8696745c6d3141fb148d30c467347d1e0353e869d51536e75e980150
SSDeep	49152:AFSUHYLL/Wo9kLljb1R6rOSN20yRJ63PooFMP+P:AZqLVe6vjl
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab (Modified File)
Mime Type	application/octet-stream
File Size	67.10 MB
MD5	1f4a6a05b1fc918c5ec7879e4f02a4f6
SHA1	b8c8a48616507fb1891f64c315de823cf5354719
SHA256	f1adc86ad4f3a528da2e96c41465401cd6c588f00b9dbc1e699e74cc75701dde
SSDeep	196608:6u4KKCX5FvaeoDcBdxmOJR7nxOKOmE7dzaNQwr:f4KKCX5FvaVczxmUJnYSE7dzAT
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
Mime Type	application/octet-stream
File Size	4.62 KB
MD5	9eba242ce952d62d7d88316c767b00dd
SHA1	d102af8474e9d7f5769552f28ab6dccfcd2e7645
SHA256	b3f2992f5e8348eaed1a8bab5d82ec81630338ab14db4bca3833f4c41dd09325
SSDeep	96:8CTjjylU4zhisjoMOoekWPRCa/kYgwEWmGoEoIZ+QaU3+BsPAZD:8C3jMU4zAQEojWPRwYus+KYD
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab (Modified File)
Mime Type	application/octet-stream
File Size	9.50 MB
MD5	626d17bde92e64027ac3f35c7a77a077
SHA1	e614755123d41de2a448ba5780bccf02da5a93a8
SHA256	2c0c7691325f56134293ea54ea0f8326d128bceca05c57b034ed7422574f6ac4
SSDeep	196608:NhPUvTYpH9lBl/tus7o4L7tZiTnp/jE4U/bxlLRx+/:PUvTiJhU4L7tZiTnprP0txRs/
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml (Modified File)
Mime Type	application/octet-stream
File Size	3.62 KB
MD5	6cd467d8577283c0a4a5e45b72115ccf
SHA1	073380d8fad05a2a51dda1eb020ed77e3823d617
SHA256	01c2c2100903047eeb134a0d99e5bc4eaec8df9fa3fe8fd83d8253af89ab832a
SSDeep	96:F9tF/9s+jLAFfIRVpK4FQeAy/StD7AVvq3+BsPAZD:F9tF/9s+jq2pLFQBy6tnAVgYD
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
Mime Type	application/octet-stream
File Size	2.88 KB
MD5	a2e1a90dec664bdf297a7a9702dbb9ef
SHA1	c3e59c917ada3ad58ef97494415380d4efa1e8ff
SHA256	48de630eb52e9e3e43d90843b41110e4deb13fbbef657ac77f8545deb79b092c
SSDeep	48:OP0RbQEewWqaic/2RY2Ue8eL/EEt1ZcUQRMcl830+Y+3MjP3B/VOoqAZD:OsRMLwWqXFJUe80t1FQew23+BsPAZD
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	2.27 KB
MD5	d4dc4e0ce7692278cbe179aa3d94e52e
SHA1	99e9208110c858b4f5cb510055e8fa884889ccbd
SHA256	82f7480d0fee27668fd2195394aa1dbfdf13942c29c03f3b7671428ba85a01b4
SSDeep	48:ouP6hxC4JCVciCM+1pVCqmO2C5+3MjP3B/VOoqAZD:5PcC4oCM+1zjmO743+BsPAZD
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	2.41 MB
MD5	c61f1f68068e4f64f03698845ebf10b3
SHA1	f4e642918bb7bfe60f64bb32e28faaf021e5774d
SHA256	d6b8c532703fa820820556023beee567917e937876109bacb02d09ce5b6b4369
SSDeep	49152:G5mdDxL8QBoI9eljidTex4S120ytJyhaM6CLC3:XdR89EQ1op
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	14.13 MB
MD5	ff3e7d0aed1f17ae290790d487b048fe
SHA1	be04a8c7b99e0fe95ba6b2aa28047a23fa36069b
SHA256	96ad8e3180badc8767b91e3e6549bb3c0d66eb38ff63578d8d1ba46c0326f2de
SSDeep	196608:pCIwm3nNVAl+ig71eZ8FclBElWHp8byLbyo9crpLlR8ioLO0ZF9CrpbQ:pnL71eiFgepGHyo2rpLkcoCrpbQ
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	855.51 KB
MD5	67389dc9abc2bdaa2e916111c935b2ba
SHA1	af07c33fc7eac21d9028e674a791541191f5a568
SHA256	832e4c909473e38150e71a1a6e69a145435739bd10e32c09e971c52858431a99
SSDeep	24576:TH7fJQPi4x3P6WBWkmf3egDqo8o9370Pv6YwG:ozgLf7qo6Pv6Yj
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	1.82 KB
MD5	ef35e30de763d100ae5acdf764ed7529
SHA1	540e7f9dc167b832bd2a10b28234a12c4abdd2f1
SHA256	f108e524da42f47b5633ad5905d8eca6b4676c3faa989213ef02f3f2d68a0cdf
SSDeep	48:OgN+067zEVCeBi2Nl+5QnZZxhIcCvuH2+3MjP3B/VOoqAZD:Xj6XKCeU8M54EA3+BsPAZD
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi (Modified File)
Mime Type	application/octet-stream
File Size	861.01 KB
MD5	d31349a7cf9520ee9419debb4f41dda6
SHA1	bc85345ebbefabc9ec2a736f2f590b23ee7c6ffa
SHA256	d73c510d7ed75bf8315c8d91b1fd6ef2d0175653324e12dcb6fe3f133ee4c20e
SSDeep	24576:0WSsu7flQPmbxnP6WBzkm83xgDBo8o93OOr8BkyL:jSs4DxL8QBohr8Bko
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	1.93 KB
MD5	3a9dbb241ed3f55530e108492ec3f352
SHA1	9036aadfa8b5c1ce78e5c40aab49c263b788e421
SHA256	06304033827e35f80b27a388f4990d70232a3776cd2614d0357d0f5e4aef6c88
SSDeep	48:STIw7y8moyxTtPK28y5jFHg3kR9+3MjP3B/VOoqAZD:6N7MTKy5tg0S3+BsPAZD
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab (Modified File)
Mime Type	application/octet-stream
File Size	41.78 MB
MD5	370f866b05e189d728350e17674fb693
SHA1	a32a62e12829e1deb5428cfe46e36859106dd287
SHA256	735db1d8191109794f2e87c339002683fec2017e789f98f73d40c7ac64f30c38
SSDeep	196608:h77aurJM4k8IMj3kMxfGbWaxJMKMA4JxuiNQG3A2r7rfiSFhysD8uxDxKj:hJOn8IQkM2BFEx96G3AUf7FnzKj
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	865.51 KB
MD5	921b3193ad46bc145e240ac1f37b304a
SHA1	9a8afb2c87b20cd9d191882b7a25f836c2d34be2
SHA256	d26f96a10540099db5be59d39bc33e73d538662731f88c4bb229068365148ae4
SSDeep	24576:HOuVve7flQPmzxnP6WBzkm83xgDBo8o93m9XLH5XH:HOuVgDxL8QBo6XLH5X
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml (Modified File)
Mime Type	application/octet-stream
File Size	1.93 KB
MD5	95bcac46d90cb9aed4f8cb24bcd594cf
SHA1	10c3d976f4176fa053749019036c98b3af7baf2a
SHA256	f1bb8d17305a0ff1acfeb12097828025148af595950086a795b23f4ef1612ce7
SSDeep	48:3o/BgdLZGslaR24qMG2YEytJXi7kzCKGSy+3MjP3B/VOoqAZD:4/BgpIsla2M6E7knGSv3+BsPAZD
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi (Modified File)
Mime Type	application/octet-stream
File Size	849.01 KB
MD5	c16ab558280e7d343ac8dffdcca25943
SHA1	7b19de0acebfd22eae9f7fcc713c36ce757b0b09
SHA256	bf19533632b59b11f49e2ad69e3e5429d92d523c60bdb620789703e382c44426
SSDeep	24576:ikFw0X94gElx3P6WBWkmf3egDqo8o93lo6pjEk2:ikEzgLf7qo46pjEn
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml (Modified File)
Mime Type	application/octet-stream
File Size	1.30 KB
MD5	2ea5f85fd5f29bdeaa2910fad4cc38e5
SHA1	eb199e396b2fa61f802be80789f90180ffa168a1
SHA256	27260111a92e8fb3a750e00b93568c11cf5662b79271cc820c6d2377aeb46a1c
SSDeep	24:dRrs5zmgCyhE2M7RNqjVzwBX3u3MLQCv7r3B/nVOBrp0Z48PZD:nrsknniq+3MjP3B/VOoqAZD
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab (Modified File)
Mime Type	application/octet-stream
File Size	10.95 MB
MD5	fb12b2fffaf377b47da0d5530e877b17
SHA1	5cbfc24f949e5e38ba2b016c099f563ec0e0f76b
SHA256	671f56dd784f652023dc00227c993e95317f8f0ae412c9ed3706cf359e1c96da
SSDeep	196608:Rxkf1gRyjQR9g8YYIcjfX+vntQdQGzFZaGkGdN7p06H1JX/WanfW/OIV0h:RxU1WbR9YY5mvJGBZWGRz1kaza0h
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi (Modified File)
Mime Type	application/octet-stream
File Size	854.01 KB
MD5	9998a34520aa245245a117e6dd5e7ccf
SHA1	0a69325d0cfe4812a0c892c2f96258b716d01718
SHA256	bbdffd46d5403f3d8172e3eb76605282d2e4d5f2c59c13e2ea84bf53fb4c8f7a
SSDeep	24576:rK4gEgx3P6WBWkmf3egDqo8o93PU6py1pN:IzgLf7qo26py1r
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
Mime Type	application/octet-stream
File Size	6.25 KB
MD5	e29b24e32e6ec416808a477009d0b456
SHA1	231bc93a2e47508a0363d370a28cadf3fd448721
SHA256	62f69e567a670f27f45dfcf833103a97887e7db461485d581f347bc40980a2b1
SSDeep	192:Qf7wESwLrRvsF2cY8Tvco2zalIGQ4lOBFZ+YD:jEaY8TUBjG9ApjD
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml (Modified File)
Mime Type	application/octet-stream
File Size	1.86 KB
MD5	84069f64dffcb03886862071cab1d4cc
SHA1	9471f13fdb84434baa2772f9b749f478345a37e8
SHA256	a65705c0025359805fbd1390a4922801c2cee97764b0affc35af20797af8a5ac
SSDeep	48:eL0fLiFO/tvr2kDvw+zr15Wpp+3MjP3B/VOoqAZD:eFs1D1bzrzWpI3+BsPAZD
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	2.81 KB
MD5	db835c7479e413d7526c16777355ec80
SHA1	61fc06042f1aedde0cc091e3f7876bd3fce4b607
SHA256	f4cb49625b900e127d2fe763d19b18e6ac7e6948519533210378fcf833ce7af2
SSDeep	48:9whzn6jt1q9JR3e2WilVB1loQiW/ZCJyi0kGEdJUg3ACaOSSg+3MjP3B/VOoqAZD:9whzAq9He2WilVBToQPEJyn5gNX13+B9
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	13.01 MB
MD5	6463bcb9396a30108f16cdcab4969b55
SHA1	1a18211a13689b8bfdaa38f132a67ae10e3765ec
SHA256	9504695863d5c4a8aa5785debb0ff53eeefe40cefab9b56a701953121fdd7287
SSDeep	196608:0Qu6eDsIwHBL4B9lCzT2bOgBoDuihGYrLpVUBJ/7HAFGtNy6aMhnRTU+:0+qsIwHNB26gfE7e/7JNMM5RTU+
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	2.79 MB
MD5	1c4a42e980777af4fbfbc31e1143510f
SHA1	da7c8591c8af45ddf9e5cae35781e9c021f13cb0
SHA256	b0009ef3a997cadc08e9900b4fcc49184fa43c02fd2836eab7091097492ea8a3
SSDeep	49152:hVRveFNMMFrwnbddIOxT+YoC59POSOwPFhbYRjfIDPHLoBTv5oJBB47q5FqciWDY:4DMUwxyOCC5VPFhbY12HLodiF4+5riWs
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml (Modified File)
Mime Type	application/octet-stream
File Size	1.71 KB
MD5	33762990ba62149f11c32aec39e13841
SHA1	a93ced300a0795ba8b9b02753f2bb4500a95e579
SHA256	925f3e8ea308ae61b87dd726f6cb40c61d91b4967492793abfa1874114d649ea
SSDeep	48:aeXkiCKkeH0qe9Akto+1OAQR2+3MjP3B/VOoqAZD:D0iCreUqe9AkW+19y3+BsPAZD
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	2.32 KB
MD5	15df89502b6da3ab971c9499e708a5dd
SHA1	8e1f95b725d5351656c42f6eb9028a1f0e8f8abe
SHA256	d186ec71146bb53d6996af677f92ef78139f2c9f325c6ba8a3232af8241de8eb
SSDeep	48:ooWSFB6xj+8x1gCEbWaVylAdZDDFr9tX0kjhLBE8JSBrYoMdAwp6t+3MjP3B/VO+:oxSX6BxeD7Vc2BFrbDllE8IBridbp6E4
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	20.09 MB
MD5	df224a8d6c4cd8974fda534c3ff9e35b
SHA1	1ad6120a975667ee7901d81dac804980dae00cc6
SHA256	3682dd9cf9b2ffec1833e37b7ce6d7902dad61a6a1e0e6cddb9319cb6c2fd204
SSDeep	196608:3cFNUxdiOm1j3/abCsYwFOSQo2eWDOQs4hW6s63HS:LPmN3/abtYIQo2OQ93RS
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	2.98 MB
MD5	3cc9e9d5851be2eac0464ec81e378e54
SHA1	7a7bb8096f86183e0296d7c1c4d0049797be338d
SHA256	e8f2d7d1bcd897b3643547d299fd9e5de2f21f4e60465fd3af8010a3c9979470
SSDeep	24576:YAZugwyxjP6Wu6kms39gDlo8o93v22oT4t/+:YANvlLsUloDoIG
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab

Modified File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab.~~~~ (Dropped File)
Mime Type	application/octet-stream
File Size	48.47 MB
MD5	44d32ad2e0eed7a00d6b76dd046efeca
SHA1	338f76df4ce7aa0684729b850fea1ff8efea51fa
SHA256	3ac98ed2d208005196d8f6fe91bc084089bd85fb328786b7c410b38a096ddd41
SSDeep	24576:De+53PNZR8mShCajt/LmTLvSiDrKXZ7hn6kN6ElpL:H3PNZR8mShC0xi30n6U6ElB
ImpHash	-

\\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.~~~~

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab (Modified File)
Mime Type	application/octet-stream
File Size	18.00 MB
MD5	5c65160bcaacd5a36182034962421cd8
SHA1	2142e07e5b9db3917f11419224aef29141c2090a
SHA256	3ae60f3527d3824b231e7d59f5e34c01920b2ec9f3e2e59c1ffc4645f2534128
SSDeep	196608:2aDH9F7/iHXDI2CPKBUq6qMuGm9vqrRxoi93nnedBwzSlmKwDhANZbPhn:PDdFDX2J5uuGyCEi9uIQmlANRh
ImpHash	-

\\?\C:\Config.Msi\Read~ME.txt

Dropped File

Stream

Unknown

»

Also Known As	\\?\C:\$Recycle.Bin\Read~ME.txt (Dropped File) \\?\C:\Boot\fi-FI\Read~ME.txt (Dropped File) \\?\C:\Boot\pt-BR\Read~ME.txt (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Read~ME.txt (Dropped File) \\?\C:\Boot\ko-KR\Read~ME.txt (Dropped File) \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Read~ME.txt (Dropped File) \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Read~ME.txt (Dropped File) \\?\C:\Boot\zh-CN\Read~ME.txt (Dropped File) \\?\C:\Boot\Read~ME.txt (Dropped File) \\?\C:\Boot\sv-SE\Read~ME.txt (Dropped File) \\?\C:\Boot\nb-NO\Read~ME.txt (Dropped File) \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Read~ME.txt (Dropped File) \\?\C:\Boot\es-ES\Read~ME.txt (Dropped File) \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Read~ME.txt (Dropped File) \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Read~ME.txt (Dropped File) \\?\C:\Boot\de-DE\Read~ME.txt (Dropped File) \\?\C:\Boot\ru-RU\Read~ME.txt (Dropped File) \\?\C:\Boot\el-GR\Read~ME.txt (Dropped File) \\?\C:\Boot\en-US\Read~ME.txt (Dropped File) \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Read~ME.txt (Dropped File) \\?\C:\Boot\Fonts\Read~ME.txt (Dropped File) \\?\C:\Boot\pl-PL\Read~ME.txt (Dropped File) \\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\Read~ME.txt (Dropped File) \\?\C:\Boot\hu-HU\Read~ME.txt (Dropped File) \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Read~ME.txt (Dropped File) \\?\C:\Boot\zh-HK\Read~ME.txt (Dropped File) \\?\C:\Boot\tr-TR\Read~ME.txt (Dropped File) \\?\C:\Boot\nl-NL\Read~ME.txt (Dropped File) \\?\C:\Boot\pt-PT\Read~ME.txt (Dropped File) \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Read~ME.txt (Dropped File) \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Read~ME.txt (Dropped File) \\?\C:\Boot\da-DK\Read~ME.txt (Dropped File) \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Read~ME.txt (Dropped File) \\?\C:\Boot\fr-FR\Read~ME.txt (Dropped File) \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Read~ME.txt (Dropped File) \\?\C:\Boot\ja-JP\Read~ME.txt (Dropped File) \\?\C:\Boot\cs-CZ\Read~ME.txt (Dropped File) \\?\C:\Boot\it-IT\Read~ME.txt (Dropped File) \\?\C:\Boot\zh-TW\Read~ME.txt (Dropped File)
Mime Type	application/octet-stream
File Size	860 Bytes
MD5	9d25b03d72a0eb2cb7ebcf7f009d70e5
SHA1	de3a255d9b6666e45b991489668ee2ddbb368ebe
SHA256	96d53bdf1d2ba8fb5aedfca35a9adcda12e5a4297243612bc3bf6663cda1cea8
SSDeep	12:EjJ/gvBxnldtGrlM4sNYqNG5XTPg8GZlJ+lGLjORbh8IJ0KJcUGxjqAe6n:EjIT+rW4s3TBJaZRbh0KJcRxe7w
ImpHash	-

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After