e39bcc5d...11c1 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification:
Ransomware
Spyware
Threat Names:
Gen:Variant.Ransom.Snatch.1

safe.exe

Windows Exe (x86-64)

Created 5 years ago

...

Remarks (1/1)

(0x02000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Indicators

File (22043)
»
Filename Hash Operations Category Severity
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\safe.exe MD5: 78d803867ec6f0044bd3328c7e312ac2
SHA1: 069a1933a7841cc481dc9d994c1abd9e249b57fe
SHA256: e39bcc5d4a1d2dc89078e10c4da2a650ba1ef0f5e6222cbc23ab98bcbdcb11c1
SSDeep: 49152:fgyr4lS8hHvv4l1oeMz+dfHUtofhV3dzB9MtwTRQ4kDuZOgDJVA:eQoP2oec+dfHUtofndF9gwTRQjuzD
ImpHash: 6ed4f5f04d62b18d96b26d6db7c18840 		Access, Create, Read, Write Sample File
Malicious
C:\BOOTSECT.BAK.gaqtfpr MD5: 6bcdb61f49f3937cd073d365f0e8839b
SHA1: cce2575ba2750f78891a3ba09371f581cdc2461c
SHA256: d080244212cd411e1982ce6699a8f4cdec5b3dc950f6455777407573b5000a6a
SSDeep: 192:bIFc8BqEE5hsFKYJ295Ys0UIL9MjJAYE+4lZpW/tpp+u4rATUA4hG9:bIFdMc00YU9Me58/t/+drWeo9
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\Boot\BOOTSTAT.DAT.gaqtfpr MD5: 043fa326700f403d84b3b80c89b8a3e2
SHA1: 9a3813bdbd0e08e442ae5a3c997ace788fcdf867
SHA256: 426ee791a323b8ee8236bd2c881138696a7709d34f7d473a57c95dd9e0f0e92d
SSDeep: 768:X0hMyhgqW3uH6cc2ANeQfzmhN76isRnZarP9:wMH8HncbNe7N7bshZarP9
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\Boot\Fonts\HOW TO RESTORE YOUR FILES.TXT MD5: 0a317f5c42b136648343bfa33bb36faa
SHA1: d192310865f9351044af7d648015c02739eea3ab
SHA256: e185369d0b47304775475d62d72ddb879965365b0a86eeffb839745711bd9b49
SSDeep: 12:acm5zeGLZA5vDvcv2mOWM8SGEXDjZFtuaVMSCjYTiMCQ8w4Do72MfYOfEVY9ING5:ac2NZA1cvb68IKuCMTiMpmDo7D3FwGBL
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.gaqtfpr MD5: 4bc7c7ce42d65a058e308960e7509a75
SHA1: 6904648844f341e2fe84d04c05b088ef6c220aa8
SHA256: 7e78094fef82c5019f88c5cfdb8e9f722b114da9cd4c95adf6c63b363c531d4a
SSDeep: 196608:dhTvA7fKP0ReD0wXKLUEfRrDXP2ifogB+jHcSBLWiyvyWJRMLhdPWfi:dpYDKP0q0wM9JrL2ifJEjhW/6vL3Ai
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.gaqtfpr MD5: 28ec8182ae95d40da4da1805389a866c
SHA1: 7f6535532e9993f98c202dfa7b64dd861f3c4fbc
SHA256: 7e0976a6b1f70a43691e64809d8afb68339e83354aa562fbd5186aca3b93b857
SSDeep: 49152:w0S9DxL8QBoI9eljidTex4S120ytJyham6Co6b:wH9R89EQ1og
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.gaqtfpr MD5: 5bc13cef4f217c847ac9f657fa2fd683
SHA1: 3f2eb89093292a6ef662a653a0170ea3f26fa413
SHA256: b289451e9d1be9a57e455af31395611a6bb98af85557763dedea39e6953dae99
SSDeep: 48:ONAaUIPHTCMlqY+XBDWX9BmndPids8UfocaiPpEvJYfFjaVrBCmx+HrcfkAisnn9:APHhj+RDWX9Bz/UfiiyIXfH3An9
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.gaqtfpr MD5: e1a0bfd6d0c5e7cb6292b641bbfceb61
SHA1: 26668f697557dcb1d7f0592508b2b186258ffd42
SHA256: 825c21e920495748de7171d2f11e0a80a7dcf03e1774cfe1e8a74a229669bd7c
SSDeep: 48:NZOG0BpzjBNf/OXvzoiffdjg3glQvghM3Z+Zv2kSOMb7ocXYf2aRCnq6/cmuF1WL:vOG0BN9VKvhfdjgNhYZ2d7TI+MCnfZPL
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.gaqtfpr MD5: 8f8cdfdf358968bee123e3cd89234b4a
SHA1: 6825125a02200de34996ea4cf6f4e1469b94d448
SHA256: 6276e3ec77a91292867127d86b76dd6270a9eeb69c1bdc08b8ed7c278bb9386e
SSDeep: 49152:/l8xnyDxL8QBoI9eljidTex4S120ytJyha16CZtm:t8VyR89EQ1oc
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.gaqtfpr MD5: 4ab9b43f5515eb79f952231131a036cf
SHA1: 814b967b916c719cc973743b24ffa580b3457786
SHA256: 34fb1b17778de57275d8581d48647e0c993cc959deaba07f818f84d6e43f9a20
SSDeep: 48:4O5jqNvvjh4s2vo/q4UL4uJF+ghtDLQVa6iqnn9:4Fxyfw/qT4ReDLqa6R9
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.gaqtfpr MD5: 604e178da6d00da87f862760c819d70b
SHA1: 29f2448866a574f5e94fed2ee43dbd8c5cff242f
SHA256: 9077489d1972b91c2d90173eee66128fc6c8b9d326c1e32cc990c58838f54427
SSDeep: 196608:vsji5hDfJXIjfUOAvaeoDcBdxmOJR7nxOKOmE7dzaNQwr:kjafJEUpvaVczxmUJnYSE7dzAT
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.gaqtfpr MD5: 595ec5dc3c6975215d208af54af33b39
SHA1: 337818832608e255e36ec24c9f573ded86e18412
SHA256: d8ba0adec1a5c16b01903202ec7c8537c1cd6a77786c92f361561cd5b04bdb55
SSDeep: 48:4Ix9uppFXlX54kVWiFATgyCBSSmpAixR9N8iD50TOAZhF/U6/3I5mGiMtnn9:F9uprXlX54kwiWcyCwv3JnkU439GBp9
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.gaqtfpr MD5: 9fed726e24f51539d714b07191a2cba1
SHA1: 8bd387778765203bf59d2faf6943cc175cea187c
SHA256: 5546cfcab5a3c0e354f10d6512eb6ad3575af03e4819c079850b26b86a80c012
SSDeep: 196608:vedOPUvTYpH9lBl/tus7o4L7tZiTnp/jE4U/bxlLRx+/:8IUvTiJhU4L7tZiTnprP0txRs/
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.gaqtfpr MD5: 8dd9afbd4ccd055f04ce630ceada0c50
SHA1: 43bb7a89783b81ecea1e1da241f5a503b67e3265
SHA256: 4d283039c87e9ecbf3c462cd41cd0d1967ce657a5762aebb503af7833713090d
SSDeep: 49152:4TnMGDxL8QBoI9eljidTex4S120ytJyhaLz6CCHmw:4TnMGR89EQ1oLo
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.gaqtfpr MD5: 7825962743aa2f5dfd4c375cb35411f5
SHA1: 63c80b4df8829c2082ffc62a8f86f0697b469c04
SHA256: 0e11542dc50bf83129f037f98987b4c1e224d2a320a3b91c5d2732fca449c6de
SSDeep: 48:K6PuNKzdMCvqngsA8gVv1YS1tsblo15Ztth6QqbdEFKuTUZ7CkV2/riqnn9:K6MKSCfgg91YSuo1jtvVqbd7uTU7grR9
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.gaqtfpr MD5: 8b0fbed1fb98f66b08d9a1c015ea88fd
SHA1: 770a273b4cf7987d8c26ccacea7140ce145cc3cb
SHA256: 5532e2cde503a448bb6801fd1a4d81c7475a83447dc9d8d53a66d63e7d1d8cec
SSDeep: 48:v1eCi/98U1vp5n6O8YDsPYU4R3PFFkB0W3Xsb4ii/nn9:ICi/ign6OtDs/4R3QB0W3m4ii9
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.gaqtfpr MD5: 1a577fea5a7e737308a313f73f770009
SHA1: 11f064a8edb32d898aee286fd0830ae08d050395
SHA256: 36c476c5601297cb8186e641a2be58e08fe04f3f72ac555ec9e3e9bd1784932b
SSDeep: 196608:jyEjhl7wm3nNVAl+ig71eZ8FclBElWHp8byLbyo9crpLlR8ioLO0ZF9CrpbQ:jyE1L71eiFgepGHyo2rpLkcoCrpbQ
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.gaqtfpr MD5: 5532e4c0a99a4a97684751969ead692b
SHA1: 92e37a5d0432b4510c61a15ca93489aba810fc8e
SHA256: 0226dd52919203d261fc6e69dde60c94ff0b27339ba435da68ff1687080f570e
SSDeep: 49152:cxVfHYLL/Wo9kLljb1R6rOSN20yRJ63PooFMP+Z:sfqLVe6vj7
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.gaqtfpr MD5: 2f38f03ada416b56a4acb25535ab0cf6
SHA1: b128dd0401903b85f6e824271baa3c95adb5e486
SHA256: 6e3ae904eb37683623d83d9521eabc136f3517e1ce4727e832fe9ca3177439e7
SSDeep: 96:FhSKBEG3SkeMIdY9Vs++2iQCNDAjgpUsK9:FhSKaJoVk2iTCsuv9
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.gaqtfpr MD5: 925fe0e961a491468f090ad376f64969
SHA1: efbe6a7efd8269000c7156068963d9356d70d684
SHA256: 766cab852eb5fd2f31260228cdb993aeaee8a9e3a73b8373354f4ce4fb440e86
SSDeep: 96:F8noup71Y8SFQIh+j2zPh5vIA90mqF9XZvCRAhhqMpWCj9slSzH9:Koup71Y8S6A+KzvIA9TqFvaRAhhqMJxH
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.gaqtfpr MD5: 3a0bbabf980f33bf0b0fe881f6e2b0b5
SHA1: 98bfcdc5d756d6558ea4308c1a1934396bf3536f
SHA256: 3082ef224dec21e221d413aab07ab87bff4142210700ae7af8eaae2960454451
SSDeep: 48:r/ggSEDdWJQUOV627cwszoqVsOKpcdzcDF4W1Hr5AoIivYnn9:TDSdJYQnoq2Kdzu11ADD9
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.gaqtfpr MD5: bde7a340213c42a9579104fab7da10ee
SHA1: 8a58e0e1d221cfbdc9c1f0afa2196eb6ab222a7e
SHA256: 2a938aa9319c2836fba08d31429089088d920a618ebd96578293189b2228e850
SSDeep: 196608:FaBjF4B5/rMj3kMxfGbWaxJMKMA4JxuiNQG3A2r7rfiSFhysD8uxDxKj:FaBhUlQkM2BFEx96G3AUf7FnzKj
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.gaqtfpr MD5: bb004cb859582f692ab204eeb016fe64
SHA1: f9aa30dfe77640009b53a887fca3875ebd63f21e
SHA256: 6193ace35ca8e04820434fcb5ce0d1e7d3d483d84c01b7448051c7fbfd84b552
SSDeep: 48:fe7vMvekrH6QvACxNFKCkq6Xwb76NkFB8sFwaMaXsyIiLann9:femrHJxABX+LGaMEs/59
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.gaqtfpr MD5: 3ce4398fca66369e7bd2b58d05a42b11
SHA1: 37b1103c2b3a327f08fc544a6442f7dc82f9c830
SHA256: 4433c899cb3dd6a1899ceeb15cab68261fe3a88cff102081a55addf93a3e05ff
SSDeep: 196608:6jyf1gRyjQR9g8YYIcjfX+vntQdQGzFZaGkGdN7p06H1JX/WanfW/OIV0h:6O1WbR9YY5mvJGBZWGRz1kaza0h
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.gaqtfpr MD5: 1202e3b766c151a04ebe2960fb9be8a8
SHA1: a1545f32cea1fd2bd99930fa1010e534215dd3d7
SHA256: 46c94c84782ee062d3e77a027dc8535691c43f3081face96731941c630c98fdb
SSDeep: 24576:KcRMg9I7fJQPi4x3P6WBWkmf3egDqo8o9370Pv6Ywq:KcRMKzgLf7qo6Pv6Yj
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.gaqtfpr MD5: cf9e2145f0f4aeac77c353a058b321cf
SHA1: 38d88706c27c914468a38c99da3a2d160b7f1f3c
SHA256: eabf12c462106452483deda8e21824bdd119b66b9c26fd612689d74828ddee6d
SSDeep: 48:gKbGtW4/+hh/vxOdIlOF0OmNDFc4RGoAwIiJnn9:5b2j+3/vwIcW84RZnIw9
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.gaqtfpr MD5: 8fb8e3fc3313d776b23dd5ec6b69bb71
SHA1: ca5e01b3c15e60cff059ca092942cd901c2571f3
SHA256: 905f8534111044c187c31669fb0dc79cac148fdaef64ac71e6efe45781b5d092
SSDeep: 196608:N2A3Eu6eDsIwHBL4B9lCzT2bOgBoDuihGYrLpVUBJ/7HAFGtNy6aMhnRTU+:NViqsIwHNB26gfE7e/7JNMM5RTU+
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.gaqtfpr MD5: 648fe13519f8e77bafa85f13d118a0f7
SHA1: 6b93aad03c9897ce0e0f0c18c7cfceefc15673e7
SHA256: 7404cd234adfb86f588c42ff9717e5cdb9420b137142dc8aee72210fe6c44e80
SSDeep: 24576:G0TgI7flQPmbxnP6WBzkm83xgDBo8o93OOr8Bkyt:G0/DxL8QBohr8BkI
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.gaqtfpr MD5: 668f783ce5d4039862a2d3efc52da827
SHA1: c1d02f5d64901d1c26521054816d8d60197cd86f
SHA256: 664138203a10c4384cd1c26d9c089b0d8b6398e7515adb5686c43f003fb081dc
SSDeep: 24576:b8arI7flQPmzxnP6WBzkm83xgDBo8o93m9XLH5XU:52DxL8QBo6XLH5E
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.gaqtfpr MD5: 625ead2051fc2d4bad3efeaa8c1c7ed2
SHA1: 9438fbdb325c3430faf1fd564cb900cbb0b68584
SHA256: 19b9d48469b4f1dd72c61a2316db06727259f6c91dc163696d47f21124c5a64d
SSDeep: 48:1QsSSZ+EWIyWL1ANy1d5H4QIy11nuopuRFl342JiiSnn9:1Q8WaLyE5HZv3ut34eiZ9
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.gaqtfpr MD5: b6432e08d67417287bfa9baa62ee5a37
SHA1: 95c965db1efbbcc6090b9c43c2e578127a839d29
SHA256: 68a0027ee769f73a4d743765e748cec576c2f3e481c2300161af3ffcf1bd3cc6
SSDeep: 24576:qWeV4gElx3P6WBWkmf3egDqo8o93lo6pjEk5:hzgLf7qo46pjEc
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.gaqtfpr MD5: 39ede80bf000fd5da26f33d762f70985
SHA1: 505dc31468db0b0ea82ef3e2294051f49c9f2c5e
SHA256: 35f6961b2769d919c387b8b7eb6a40f7f3e99c19c5875173b3e460eeae6f356d
SSDeep: 24:3KoG6NWNbebp27JBGI9qEdM5wV/KOhty4tF1Skk9QS8kpI098NiPbEKnn9:6fNbeNqtrdM5IyOh/F1Rk9QS8kSNioK9
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.gaqtfpr MD5: beba5642143ec0214adbf98dc18120b8
SHA1: 14eb2dce988e251265c18e0068d2f5225bfc82ff
SHA256: 0f308d2ce93d3d781a9fbecdc1f7be4d818ba004d532b2bb5d46a940ba23b7f1
SSDeep: 192:QXgx5LOvB3CZb5IRKt6Lh1Gmmz6jQ4pK1bAszdWumy9:mmOviIRKIFMjz6zWAAM69
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.gaqtfpr MD5: 169c934cb9b8b14f8b01b053f6f7b336
SHA1: b1b875f3949a90f67e5b1aad76483a71b0c84bdf
SHA256: eb4c73f20dfe2fd015c6c50e1c5a472d818335b0f792586a86b2258ac301da05
SSDeep: 49152:MkQv2veFNMMFrwnbddIOxT+YoC59POSOwPFhbYRjfIDPHLoBTv5oJBB47q5FqciP:MlDMUwxyOCC5VPFhbY12HLodiF4+5riP
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.gaqtfpr MD5: de1f04989e49dbd7a252905e407af9a1
SHA1: 3dbfe5fabef6452354d75e07f59c13b959b0eb4f
SHA256: 48e1c154ba33fda8f509d54dbf541943df8fbd8033a5c0c8a339d2633ba67a25
SSDeep: 24576:eDPt/V4gEgx3P6WBWkmf3egDqo8o93PU6py1pd:+tVzgLf7qo26py1j
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.gaqtfpr MD5: d4148253ebc44fe6684c5f8a609a573d
SHA1: 516093d18bdb605a897c78b1863ee4159bc89a87
SHA256: 306fd2d22a4ac4f658ceba59a78060abc6ab70ff1b14ef62bd897dc33beb881e
SSDeep: 48:y5cKasIq+4GcFLrPV7wwpPn7vBWu8Fskqflykk//LsVilnn9:y56/xQ3bP1W0k+k7sVs9
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.gaqtfpr MD5: f9726c3977c9f8f389eee2ff485b2a4d
SHA1: 918b24c5ab579976a7fd38441a591bfaa113f269
SHA256: 46fd987d62150000b95ae1bf80f2df0381158fe481bb2254b0de31bd66bccc7b
SSDeep: 48:VtLZOt2xctpP1lUrAv/k1nBfaN2IYa0wphko1W2vAkFyqFT0PdKGwgOF1GiT+o9b:9OtXvP1vk1nFaN2I9LRW2VouTY4GwVX9
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.gaqtfpr MD5: fdc239fb3365f5376aac71e4b238805c
SHA1: 2882dc59cb4d69b19e33dd6e2c1f1b31b3ce0d4b
SHA256: a36dc19b5278841f142931dbe26de85bcc302614afcec660fb607c4a1232324b
SSDeep: 196608:SaDH9F7/iHXDI2CPKBUq6qMuGm9vqrRxoi93nnedBwzSlmKwDhANZbPhn:zDdFDX2J5uuGyCEi9uIQmlANRh
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi.gaqtfpr MD5: a38f80e2e58e6f5406a6717e6454ecf5
SHA1: 830c686465cb51a00ee42d1f38b96983538728c5
SHA256: 66827c24a1a39cfa9dc4a069f91fcdf648545404e29c69efb025b232df6ce203
SSDeep: 49152:2bpvlLsUloDoISMljcqmcLaSt20yrujThvLf2AdZ:QpxslDo30DVJ
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.gaqtfpr MD5: 66353cc8dbb9281465633a2850fa5537
SHA1: 3fded14d003d4f9ddfe874800238af89505eaca2
SHA256: c7b9ab4d027e05e4e92c90c1ea2c06825d53531c223f54817f78239bd7b1e1dd
SSDeep: 48:tYUDs5EE6mQWuK4wCQDH30ZNscWT2qf0zrVHqJFxGpZIM+iqnn9:mUDsgmSgXsW5M/VH3ZD+l9
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.gaqtfpr MD5: d61f107b17e19e9b65023d3adf0d6bbd
SHA1: 4425607eb64b7b916be94d0dfa49bf5bcd40be3c
SHA256: db05ad54d37f39c4fd24134b285770e1492cbf5f12281550a47f5fad09b0b0d0
SSDeep: 96:41ldCRrG67bN1+GtxXjj7huXqX6agKEhraKdvKRLIYvWBb3Jsm9CqJ9:2m66vN1+ixXjjVuaKTKMrnyojC3q9
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi.gaqtfpr MD5: 993e7ab0014818f9b64a0fcba2086a8f
SHA1: 6af8061c16a6ead9cb0c413d94bb9dde6093dca5
SHA256: 241fd3e1b00258f4862575ebfab9d255a14cf086f26cd93dc4cea6bab7ba27db
SSDeep: 49152:N/DxL8QBoaneCjSTJKpwmR20yNJqbnaEicmfcM:FR89srJzdM
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.gaqtfpr MD5: 6f1fbd8bc4be2c66e5391826f1bf8e3e
SHA1: 5b8ae7bfb1aa283c6ca10c2aa01fc622647796b5
SHA256: abffaf2fd04d69d7d29b26693dc16eb98b6d5620d31e25b9dde89b031621cb4b
SSDeep: 192:gBxI9VZ2cW0yHxgK4GmYjZ1aiGiPeUNEV1o27QLb2mSAfs/DRY96drc9:2xa2VfHhmOZ1ai/WUuE2ELH5fs/D2QFg
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.gaqtfpr MD5: b272688c04bb98b7c6296e1969a72dda
SHA1: 5ba1f42db93b2f547b8767cc71bfdab0a01d2f6b
SHA256: 97ac04f3b16f8befe33648c8d659c72e5fb5e9ce54d7ffae79458effa1fad7d6
SSDeep: 48:JQ3nN8981xODwkUVNev/wtRU9wcTATNtPWaZeYh1f16IZQFFoLoQZJ3x8aiSnn9:JQ3c81xqpgKxec8UaUsZwcoAx8aN9
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\btwcugod.bat MD5: 5f6745ba3ad40a34244d8c435dd74d16
SHA1: b111f76109c7fd47092fdfcb513245e5d5ce6fd5
SHA256: c0feda402c11199d2aa11f9171cb1fa19d28b859ca5ab032685685043b60cde5
SSDeep: 12:j5/rJsxIuDqj5/rJgUpxIuD25jNjLqlGh:1MUi5jNjLq8h
ImpHash: - 		Access, Create, Delete, Write Dropped File
Unknown
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ddexrxfyhfpkvwmew.bat MD5: 3d33a19bb489dd5857b515882b43de12
SHA1: 0882f2e72f1ca4410fe8ae0fa1138800c3d1561d
SHA256: 3295f5029f9c9549a584fa13bc6c25520b4ff9a4b2feb1d9e935cc9e4e0f0924
SSDeep: 3:mKDDV1A2eoVhn:hNewh
ImpHash: - 		Access, Create, Delete, Write Dropped File
Unknown
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dwwkqdfrvvipabmpmny.bat MD5: 54fe4d49d7b4471104c897f187e07f91
SHA1: 18f963dbee830e64828991d26a06d058326c1ddb
SHA256: 6c9d8c577dddf9cc480f330617e263a6ee4461651b4dec1f7215bda77df911e7
SSDeep: 3:mKDDV1A2wdB6hn:hNuAh
ImpHash: - 		Access, Create, Delete, Write Dropped File
Unknown
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dyhigmtaxhu.bat MD5: 3e36d3dc132e3a076539acc9fcd5535c
SHA1: 89be35c19a65b9e6f7a277e1a9f66ab76d024378
SHA256: 251427c578eaa814f07037fbe6e388b3bc86ed3800d7887c9d24e7b94176e30d
SSDeep: 3:mKDDV1A26n6hn:hN26h
ImpHash: - 		Access, Create, Delete, Write Dropped File
Unknown
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hflnllb.bat MD5: b2ba5b005be5f273f7c6d0b3afadc61c
SHA1: b0f8da1a9c0560714d4cd0b68de4008761081613
SHA256: 53e8ec6d31acfcbc9566e22ee25b14c61e82ce30c2f8a43addfb1c374350b49c
SSDeep: 3:mKDDFGFOTj5ZMCNLfpAdiFhMW4crWadA/EmCQ+t4KCFWcoGFMLVOBFdoKLAEFkDi:hgFOTjLMCNLqioWRCZ/ETT4KCFW+2LVU
ImpHash: - 		Access, Create, Delete, Write Dropped File
Unknown
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pmppvvuvnvmmjoinxxm.bat MD5: 891708936393b69c212b97604a982fed
SHA1: 5b86cf095fe515b590d18b2e976d9e544c43f6ca
SHA256: a80c7fe1f88cf24ad4c55910a9f2189f1eedad25d7d0fd53dbfe6bdd68912a84
SSDeep: 3:mKDDknnFHtu582k/KRx8VJBuqQWvn:hwFHc5k/Kn8JuG
ImpHash: - 		Access, Create, Delete, Write Dropped File
Unknown
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ubrkvefvtjvehnyfc.bat MD5: 6d9d31414ee2c175255b092440377a88
SHA1: c24aee8fa0a81a82fe73bf60e0282b1038d6ea80
SHA256: 2155a029a024a2ffa4eff9108ac15c7db527ca1c8f89ccfd94cc3a70b77cfc57
SSDeep: 3:mKDDFNoF9YojMA26bK40dlojMA2elK40dlojMA2wdwoK40dlvn:h4YPtkYeQtkYuwXt1n
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\Windows\mryacantvdm.bat MD5: 2202e846ba05d7f0bb20adbc5249c359
SHA1: 4115d2d15614503456aea14db61d71a756cc7b8c
SHA256: 0965cb8ee38adedd9ba06bdad9220a35890c2df0e4c78d0559cd6da653bf740f
SSDeep: 3:mKDDAREBIfOmdCflKCW:hUiFmctRW
ImpHash: - 		Access, Create, Delete, Write Dropped File
Unknown
"C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\btwcugod.bat" - Access
Not Available
"C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ddexrxfyhfpkvwmew.bat" - Access
Not Available
"C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dwwkqdfrvvipabmpmny.bat" - Access
Not Available
"C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dyhigmtaxhu.bat" - Access
Not Available
"C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hflnllb.bat" - Access
Not Available
"C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pmppvvuvnvmmjoinxxm.bat" - Access
Not Available
"C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ubrkvefvtjvehnyfc.bat" - Access
Not Available
A:\ - Access
Not Available
B:\ - Access
Not Available
C:\ - Access
Not Available
C:\BOOTSECT.BAK - Access
Not Available
C:\Boot\ - Access
Not Available
C:\Boot\BCD - Access, Delete
Not Available
C:\Boot\BCD.LOG - Access, Delete
Not Available
C:\Boot\BCD.LOG.gaqtfpr - Access, Create
Not Available
C:\Boot\BCD.LOG1 - Access
Not Available
C:\Boot\BCD.LOG2 - Access
Not Available
C:\Boot\BCD.gaqtfpr - Access, Create
Not Available
C:\Boot\BOOTSTAT.DAT - Access
Not Available
C:\Boot\Fonts\ - Access
Not Available
C:\Boot\Fonts\chs_boot.ttf - Access, Delete
Not Available
C:\Boot\Fonts\chs_boot.ttf.gaqtfpr - Access, Create
Not Available
C:\Boot\Fonts\cht_boot.ttf - Access, Delete
Not Available
C:\Boot\Fonts\cht_boot.ttf.gaqtfpr - Access, Create
Not Available
C:\Boot\Fonts\jpn_boot.ttf - Access, Delete
Not Available
C:\Boot\Fonts\jpn_boot.ttf.gaqtfpr - Access, Create
Not Available
C:\Boot\Fonts\kor_boot.ttf - Access, Delete
Not Available
C:\Boot\Fonts\kor_boot.ttf.gaqtfpr - Access, Create
Not Available
C:\Boot\Fonts\wgl4_boot.ttf - Access, Delete
Not Available
C:\Boot\Fonts\wgl4_boot.ttf.gaqtfpr - Access, Create
Not Available
C:\Boot\cs-CZ\ - Access
Not Available
C:\Boot\cs-CZ\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\cs-CZ\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\da-DK\ - Access
Not Available
C:\Boot\da-DK\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\da-DK\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\de-DE\ - Access
Not Available
C:\Boot\de-DE\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\de-DE\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\el-GR\ - Access
Not Available
C:\Boot\el-GR\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\el-GR\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\en-US\ - Access
Not Available
C:\Boot\en-US\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\en-US\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\en-US\memtest.exe.mui - Access, Delete
Not Available
C:\Boot\en-US\memtest.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\es-ES\ - Access
Not Available
C:\Boot\es-ES\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\es-ES\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\fi-FI\ - Access
Not Available
C:\Boot\fi-FI\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\fi-FI\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\fr-FR\ - Access
Not Available
C:\Boot\fr-FR\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\fr-FR\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\hu-HU\ - Access
Not Available
C:\Boot\hu-HU\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\hu-HU\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\it-IT\ - Access
Not Available
C:\Boot\it-IT\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\it-IT\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\ja-JP\ - Access
Not Available
C:\Boot\ja-JP\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\ja-JP\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\ko-KR\ - Access
Not Available
C:\Boot\ko-KR\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\ko-KR\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\memtest.exe - Access
Not Available
C:\Boot\nb-NO\ - Access
Not Available
C:\Boot\nb-NO\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\nb-NO\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\nl-NL\ - Access
Not Available
C:\Boot\nl-NL\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\nl-NL\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\pl-PL\ - Access
Not Available
C:\Boot\pl-PL\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\pl-PL\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\pt-BR\ - Access
Not Available
C:\Boot\pt-BR\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\pt-BR\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\pt-PT\ - Access
Not Available
C:\Boot\pt-PT\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\pt-PT\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\ru-RU\ - Access
Not Available
C:\Boot\ru-RU\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\ru-RU\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\sv-SE\ - Access
Not Available
C:\Boot\sv-SE\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\sv-SE\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\tr-TR\ - Access
Not Available
C:\Boot\tr-TR\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\tr-TR\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\zh-CN\ - Access
Not Available
C:\Boot\zh-CN\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\zh-CN\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\zh-HK\ - Access
Not Available
C:\Boot\zh-HK\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\zh-HK\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Boot\zh-TW\ - Access
Not Available
C:\Boot\zh-TW\bootmgr.exe.mui - Access, Delete
Not Available
C:\Boot\zh-TW\bootmgr.exe.mui.gaqtfpr - Access, Create
Not Available
C:\Config.Msi\ - Access
Not Available
C:\Documents and Settings - Access
Not Available
C:\HOW TO RESTORE YOUR FILES.TXT - Access, Create, Read, Write
Not Available
C:\MSOCache\ - Access
Not Available
C:\MSOCache\All Users\ - Access
Not Available
C:\MSOCache\All Users\HOW TO RESTORE YOUR FILES.TXT - Access, Create, Write
Not Available
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ - Access
Not Available
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab - Access
Not Available
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi - Access
Not Available
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\ - Access
Not Available
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi - Access
Not Available
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab - Access
Not Available
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\ - Access
Not Available
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab - Access
Not Available
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi - Access
Not Available
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\ - Access
Not Available
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab - Access
Not Available
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi - Access
Not Available
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\ - Access
Not Available
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab - Access
Not Available
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\ - Access
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\ - Access
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab - Access
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi - Access
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\ - Access
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab - Access
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi - Access
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\ - Access
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi - Access
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi - Access
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\ - Access
Not Available
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab - Access
Not Available
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi - Access
Not Available
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\ - Access
Not Available
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab - Access
Not Available
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi - Access
Not Available
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\ - Access
Not Available
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi - Access
Not Available
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\ - Access
Not Available
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml - Access
Not Available
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ - Access
Not Available
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\HOW TO RESTORE YOUR FILES.TXT - Access, Create, Write
Not Available
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\ - Access
Not Available
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\HOW TO RESTORE YOUR FILES.TXT - Access, Create, Write
Not Available
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ - Access
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\ - Access
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\HOW TO RESTORE YOUR FILES.TXT - Access, Create, Write
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll - Access
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE - Access
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\HOW TO RESTORE YOUR FILES.TXT - Access, Create, Write
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab.gaqtfpr - Access, Create, Read
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll - Access
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe - Access
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll - Access
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll - Access
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\ - Access
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\ - Access
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\HOW TO RESTORE YOUR FILES.TXT - Access, Create, Write
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\HOW TO RESTORE YOUR FILES.TXT - Access, Create, Write
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ - Access
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\HOW TO RESTORE YOUR FILES.TXT - Access, Create, Write
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll - Access
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe - Access
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll - Access
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe - Access
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ - Access
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\HOW TO RESTORE YOUR FILES.TXT - Access, Create, Write
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll - Access
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe - Access
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll - Access
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe - Access
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ - Access
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\HOW TO RESTORE YOUR FILES.TXT - Access, Create, Write
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll - Access
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe - Access
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll - Access
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms - Access, Delete
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.gaqtfpr - Access, Create, Read, Write
Not Available
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe - Access
Not Available
C:\MSOCache\HOW TO RESTORE YOUR FILES.TXT - Access, Create, Write
Not Available
C:\Program Files (x86)\ - Access
Not Available
C:\Program Files (x86)\Adobe\ - Access
Not Available
C:\Program Files (x86)\Adobe\HOW TO RESTORE YOUR FILES.TXT - Access, Create, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Benioku.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Benioku.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Berime.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Berime.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Esl\ - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Esl\AiodLite.dll - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Esl\HOW TO RESTORE YOUR FILES.TXT - Access, Create, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\HOW TO RESTORE YOUR FILES.TXT - Access, Create, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\IrakHau.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\IrakHau.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Leame.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Leame.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\LeesMij.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\LeesMij.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Leggimi.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Leggimi.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\LeiaMe.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\LeiaMe.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Liesmich.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Liesmich.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Lisezmoi.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Lisezmoi.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Llegiu-me.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Llegiu-me.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\LueMinut.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\LueMinut.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMe.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMe.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeCS.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeCS.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeCT.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeCT.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeCZE.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeCZE.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeHRV.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeHRV.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeHUN.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeHUN.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeJ.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeJ.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeK.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeK.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMePOL.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMePOL.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeRUM.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeRUM.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeRUS.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeRUS.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeSKY.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeSKY.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeUKR.htm - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeUKR.htm.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\ - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\A3DUtils.dll - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\ACE.dll - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AGM.dll - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AGMGPUOptIn.ini - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\ - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\HOW TO RESTORE YOUR FILES.TXT - Access, Create, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.CAT - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.CAT.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.CHS - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.CHS.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.CHT - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.CHT.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.CZE - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.CZE.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.DAN - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.DAN.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.DEU - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.DEU.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.ESP - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.ESP.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.EUQ - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.EUQ.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.FRA - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.FRA.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.HRV - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.HRV.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.HUN - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.HUN.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.ITA - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.ITA.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.JPN - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.JPN.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.KOR - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.KOR.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.NLD - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.NLD.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.NOR - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.NOR.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.POL - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.POL.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.PTB - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.PTB.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.RUM - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.RUM.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.RUS - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.RUS.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.SKY - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.SKY.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.SLV - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.SLV.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.SUO - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.SUO.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.SVE - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.SVE.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.TUR - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.TUR.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.UKR - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.UKR.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AXE8SharedExpat.dll - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AXSLE.dll - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroBroker.exe - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.dll - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32Info.exe - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroTextExtractor.exe - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Acrofx32.dll - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Adobe.Reader.Dependencies.manifest - Access, Delete
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Adobe.Reader.Dependencies.manifest.gaqtfpr - Access, Create, Read, Write
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AdobeLinguistic.dll - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AdobeXMP.dll - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\BIB.dll - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\BIBUtils.dll - Access
Not Available
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\ - Access
Not Available
For performance reasons, the remaining 21543 entries are omitted.
The remaining entries can be found in ioc_export.txt or ioc_export.json .
Registry (22)
»
Registry Key Name Operations
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Access
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FuvWUAUServZ Access, Create, Read, Write
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VSS Access, Create, Read, Write
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemStartOptions Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
Export to TXT Export to JSON
VMRay - Analyzer - www.vmray.com
Legal Note - Privacy Policy
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image