e3dfc048...f1af

C:\Users\FD1HVy\Desktop\look (uploaded by Matt Browning (via weblink) Sep 22 2020 11-03-47 UTC).exe

Sample File

Binary

Malicious

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	2.56 MB
MD5	c53b127e1ba5abcad87628af9f11f22a
SHA1	21e4fdb6935038bd0d4ef0294568a011c2276905
SHA256	e3dfc0485c5ecbeeb9a71473a25a6a8cdf616b7f05d66788ed6e6ade76aaf1af
SSDeep	49152:8t3srpomXBAL3b5b9bWwsoVQoQrAwPOhs1t02UlmkgjYnHQ05:81sBxRjYnN
ImpHash	96c44fa1eee2c4e9b9e77d7bf42d59e6

PE Information

»

Image Base	0x400000
Entry Point	0x448f70
Size Of Code	0x181c00
Size Of Initialized Data	0x14600
File Type	FileType.executable
Subsystem	Subsystem.windows_cui
Machine Type	MachineType.i386
Compile Timestamp	1970-01-01 00:00:00+00:00

Sections (12)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x181a56	0x181c00	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.2
.data	0x583000	0x28728	0x14600	0x182000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	5.68
/4	0x5ac000	0x1b5	0x200	0x196600	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	4.24
/18	0x5ad000	0x19848	0x19a00	0x196800	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.6
/30	0x5c7000	0x143c0	0x14400	0x1b0200	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	4.35
/43	0x5dc000	0xcc40	0xce00	0x1c4600	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	5.41
/59	0x5e9000	0xd247	0xd400	0x1d1400	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	5.41
/75	0x5f7000	0x22	0x200	0x1de800	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	0.62
/94	0x5f8000	0x7bcc1	0x7be00	0x1dea00	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	5.95
/106	0x674000	0x5710	0x5800	0x25a800	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	3.79
.idata	0x67a000	0x372	0x400	0x260000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	4.31
.symtab	0x67b000	0x2e304	0x2e400	0x260400	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	5.25

Imports (3)

»

winmm.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
timeEndPeriod	0x0	0x583000	0x27a2e6	0x2602e6	0x0
timeBeginPeriod	0x0	0x583004	0x27a2ea	0x2602ea	0x0

ws2_32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WSAGetOverlappedResult	0x0	0x58300c	0x27a2f2	0x2602f2	0x0

kernel32.dll (29)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WriteFile	0x0	0x583014	0x27a2fa	0x2602fa	0x0
WriteConsoleW	0x0	0x583018	0x27a2fe	0x2602fe	0x0
WaitForSingleObject	0x0	0x58301c	0x27a302	0x260302	0x0
VirtualFree	0x0	0x583020	0x27a306	0x260306	0x0
VirtualAlloc	0x0	0x583024	0x27a30a	0x26030a	0x0
SwitchToThread	0x0	0x583028	0x27a30e	0x26030e	0x0
SetWaitableTimer	0x0	0x58302c	0x27a312	0x260312	0x0
SetUnhandledExceptionFilter	0x0	0x583030	0x27a316	0x260316	0x0
SetProcessPriorityBoost	0x0	0x583034	0x27a31a	0x26031a	0x0
SetEvent	0x0	0x583038	0x27a31e	0x26031e	0x0
SetErrorMode	0x0	0x58303c	0x27a322	0x260322	0x0
SetConsoleCtrlHandler	0x0	0x583040	0x27a326	0x260326	0x0
LoadLibraryA	0x0	0x583044	0x27a32a	0x26032a	0x0
LoadLibraryW	0x0	0x583048	0x27a32e	0x26032e	0x0
GetSystemInfo	0x0	0x58304c	0x27a332	0x260332	0x0
GetStdHandle	0x0	0x583050	0x27a336	0x260336	0x0
GetQueuedCompletionStatus	0x0	0x583054	0x27a33a	0x26033a	0x0
GetProcessAffinityMask	0x0	0x583058	0x27a33e	0x26033e	0x0
GetProcAddress	0x0	0x58305c	0x27a342	0x260342	0x0
GetEnvironmentStringsW	0x0	0x583060	0x27a346	0x260346	0x0
GetConsoleMode	0x0	0x583064	0x27a34a	0x26034a	0x0
FreeEnvironmentStringsW	0x0	0x583068	0x27a34e	0x26034e	0x0
ExitProcess	0x0	0x58306c	0x27a352	0x260352	0x0
DuplicateHandle	0x0	0x583070	0x27a356	0x260356	0x0
CreateThread	0x0	0x583074	0x27a35a	0x26035a	0x0
CreateIoCompletionPort	0x0	0x583078	0x27a35e	0x26035e	0x0
CreateEventA	0x0	0x58307c	0x27a362	0x260362	0x0
CloseHandle	0x0	0x583080	0x27a366	0x260366	0x0
AddVectoredExceptionHandler	0x0	0x583084	0x27a36a	0x26036a	0x0

Digital Signatures (2)

»

Certificate: qvarn pty ltd

»

Issued by	qvarn pty ltd
Parent Certificate	Sectigo RSA Code Signing CA
Country Name	AU
Valid From	2020-08-25 00:00:00+00:00
Valid Until	2021-08-25 23:59:59+00:00
Algorithm	sha256_rsa
Serial Number	4D 26 BA B8 9F CF 7F F9 FA 4D C4 84 7E 56 35 63
Thumbprint	2B E3 4A 7A 39 DF 38 F6 6D 55 50 DC FA 01 85 0C 8F 16 5C 81

Certificate: Sectigo RSA Code Signing CA

»

Issued by	Sectigo RSA Code Signing CA
Country Name	GB
Valid From	2018-11-02 00:00:00+00:00
Valid Until	2030-12-31 23:59:59+00:00
Algorithm	sha384_rsa
Serial Number	1D A2 48 30 6F 9B 26 18 D0 82 E0 96 7D 33 D3 6A
Thumbprint	94 C9 5D A1 E8 50 BD 85 20 9A 4A 2A F3 E1 FB 16 04 F9 BB 66

Memory Dumps (2)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Point	AV	YARA	Actions
look (uploaded by matt browning (via weblink) sep 22 2020 11-03-47 utc).exe	1	0x00400000	0x006A9FFF	Relevant Image		32-bit	0x00424000			... Memory Dump Actions Go to Process Download Dump
look (uploaded by matt browning (via weblink) sep 22 2020 11-03-47 utc).exe	1	0x00400000	0x006A9FFF	Process Termination		32-bit	-			... Memory Dump Actions Go to Process Download Dump

C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\$GetCurrent\SafeOS\GetCurrentRollback.ini (Modified File)
Mime Type	application/octet-stream
File Size	675 Bytes
MD5	41ed2ddd62199d8802df712673191ec9
SHA1	a64b8b0507d96505f0fdf1f2bf81c43aaffc670c
SHA256	6a60fee86029208d4d11c7532164ffec176581b0040ad6aba18f8b9ac94044d7
SSDeep	12:LPRxbtGe2LvMA/TU+QTU06KME0Sq4Y1WeiIztnQk6ZdQgp4VOw:thtGxvovQBE0SqJxiA6ZFOOw
ImpHash	-

C:\$GetCurrent\SafeOS\SetupComplete.cmd.TRAPGET

Dropped File

Batch

Unknown

»

Also Known As	C:\$GetCurrent\SafeOS\SetupComplete.cmd (Modified File)
Mime Type	application/x-bat
File Size	826 Bytes
MD5	c77249bbd0ec8df19569808d1108d198
SHA1	81019e2bd55919dd90972ff77a55bc34ba81b3dc
SHA256	0e0bcdf9c1de564297975c79b52a2b0634ec378c488229f95818ac4e016c8e42
SSDeep	24:fZAlgAsqLCFldEytzeM6TWWENlZNu2Wr4PiYn0:femdEytzcwDZCrkiYn0
ImpHash	-

C:\$GetCurrent\SafeOS\preoobe.cmd.TRAPGET

Dropped File

Batch

Unknown

»

Also Known As	C:\$GetCurrent\SafeOS\preoobe.cmd (Modified File)
Mime Type	application/x-bat
File Size	593 Bytes
MD5	01040385ec009f8361086b13a9d6bfc9
SHA1	ae2ffe1ea75c42be2da7ef693451c5de6882adef
SHA256	06711e2242861cb634e68e99cfb3af39dcac8d4a08edabde9c37d7f26fa3d673
SSDeep	12:9+XR6eX3n142Qm/vNSnlYIuY6MVueucvKfUZ23KWBPDlBxDgx:ox+1wYlYbhMVuh1fUQ6Wbjgx
ImpHash	-

C:\588bce7c90097ed212\1025\LocalizedData.xml.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1025\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	72.98 KB
MD5	7083051ac0752bf6cf548e8157efdbc0
SHA1	715fcb336e34d2ce0f89689fc715db5422a2a6c1
SHA256	073dec60fde73d7cb7ac94188cc6e981426cd0435b59953f2eb711524cebb720
SSDeep	1536:oRo/NbGG8v3es4huDCewwH03xq0SHyJ48JZ+wzIwb9b8xGx4MHtHYtb:oW/Nyv3esOwiYYLa4IwJb8xWe
ImpHash	-

C:\588bce7c90097ed212\1028\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1028\LocalizedData.xml.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	59.90 KB
MD5	ec55524a4c4a6102a479342a4b52c4b9
SHA1	9c3717e632e7b2c2a0885d09315ded1c3d7a1362
SHA256	46dcd557ec03a0cb6da12f70cef1258077c71f0a322e082cd35a2186ac8cbdee
SSDeep	1536:zJLg9KSRH8Fwl6diMdRAPn19aJIqHpHOiWW:zFgw6H8Wwd7d8n1LqHFODW
ImpHash	-

C:\588bce7c90097ed212\1028\eula.rtf.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1028\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	6.67 KB
MD5	754268094dd628e61593b8c3a81e2d5c
SHA1	22074033e373a09cb5aabb3c376baf154c2dd9b6
SHA256	bb88279f7df6edc9f72c0df08876b5a6dc179c28732c68579fe2c4754b99ece4
SSDeep	96:FCUuLh3s2eBlp4TOR0kJOs8BsDl/XTjSA8LFEP7eT8zPp8MMbsrGlmV8j4LmPNN+:FCUuLhLioJqP6HLFEzeQd8Dsq8cFNyV
ImpHash	-

C:\588bce7c90097ed212\1029\LocalizedData.xml.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1029\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	79.58 KB
MD5	9bdaeb8fc32b897e413ca141a8b4766e
SHA1	12cbfd41221a7f0bab4215b7b9195b9862f3b119
SHA256	0549d382b1af843982e83ac68d99728a097a4d499029b95206d6aa9fe4506c8e
SSDeep	1536:kIuJ9yqv08YeT6YrAB1OTO1iYmOdcx1gXshGfQSi9O6qa5qW1jS5M:ruZvPPY1OTboxXbfbiV02jSG
ImpHash	-

C:\588bce7c90097ed212\1029\eula.rtf.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1029\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	4.15 KB
MD5	5ec75e77f5b8d9824c79047bf8309a1b
SHA1	a324d75586393b42dc674f583b30cf52e57f3dbd
SHA256	7ffbf87bca93cc719edb49d06c39a9a3a967c9eb66870e0795a465713236953f
SSDeep	96:duf4rP8t/5yFQl7vm3I8QYHs/pgJkzozQCfYzetGXYu:d64rPm/dl7O3I8QM+JzolfYzO9u
ImpHash	-

C:\588bce7c90097ed212\1030\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1030\LocalizedData.xml.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	76.43 KB
MD5	56e6a3673afa356f35a1f22984b3666d
SHA1	b4542545acb0d4db98fc7c2c95c38890d0501fac
SHA256	6068cc784f82dbc30675973cd763537a4836eb05b86ed08149a0a64118d34120
SSDeep	1536:1Ln7uqF3dpmkVa2GgUm2Q1/Wy5Pwgdpr/hAbxk0DwAxx:97jTppa2Em2QwSjdprWwAxx
ImpHash	-

C:\588bce7c90097ed212\1031\LocalizedData.xml.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1031\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	80.92 KB
MD5	8d477003f067feeb5e22d09ac018a63e
SHA1	bf221853a5a2806e5e4101e04b4c294d1f0a0349
SHA256	459157b69fc98633c59df82e818af34d912207ef534a69bee58177accf857564
SSDeep	1536:SFzcmSgX9SPrJ+4CokFXK/eddi/8iYpGbMY9v5QI5xnf1NGkgHB1D8T1gNtQBOUJ:SFlS7DlqM8VGb1l1N/gh1jNqOPcUiIE
ImpHash	-

C:\588bce7c90097ed212\1032\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1032\LocalizedData.xml.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	84.77 KB
MD5	3d5f9378d8a101aab1cfc35922f08312
SHA1	b444a0224e675936df4f683e56597ea9d4e242e0
SHA256	35f2807c092dd0672506cfd9979bfea1ec22e8a01e58952568aeb23d8cd21cc1
SSDeep	1536:4OnD8ob2Cha7a+fQSHSnwUzzmgKD9GtysqiE79tlQmeaqZgF55XQNJE1:4OnD3fa7RQTnmgiayL7Feafz5X8JY
ImpHash	-

C:\588bce7c90097ed212\1032\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1032\eula.rtf.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	9.17 KB
MD5	01cde98d9fb7aaa073c480f6ed692068
SHA1	5547d88aed59e2ad92322ee9af59532c62341998
SHA256	092817e463afe75b93cb0547c766f4901df47fc6f7fa59adb8c3502288619f5b
SSDeep	192:RtSYZmlVdggCvNgf38RIbJsvHv/TAEXf91bhPTCLtE9f2YlOPyB:RtsVdgpCfr9wAEvELtEPI6
ImpHash	-

C:\588bce7c90097ed212\1033\LocalizedData.xml.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1033\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	75.93 KB
MD5	e0eabd0807f6586884143a4fcc5d24c9
SHA1	292a10681890a95541ca6ca5bf59c63184fd3f6c
SHA256	0010a4ab823d0a83a0bfc91e65533179c53482cc4503dd58c814273f352e68a7
SSDeep	1536:7dQFfiVembLDgDr5AWwHIoxOpyQX5Gs5O2dBhqvFVSGrPZiZlvBQ:JQFaVemb/ozwHtOYAGst7WF86iZlvS
ImpHash	-

C:\588bce7c90097ed212\1033\eula.rtf.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1033\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	3.62 KB
MD5	1ccb68cf418576aa2fa867cfa9263752
SHA1	316441f8746445b5c5870bd04bfa88ac1154dad7
SHA256	cb363de8ea49ef8645c6eaacbd08b36f556ea0cc86e85f92d23ffe3610fc7d78
SSDeep	96:texa2SN3QkOj/Gq4xrN6Ro0uIFRo1jH3yd+16RV:2cN3FaOq4+uZ1jHai6RV
ImpHash	-

C:\588bce7c90097ed212\1035\eula.rtf.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1035\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	4.12 KB
MD5	459458615c800293386dc7a1737309ae
SHA1	7e9f62d973253e2b9a643735ef26b6e3b49d7ee2
SHA256	0527dada05115de6bfc964b930e6d4b1cef870d0c5e806612611ca5f0c04c73b
SSDeep	96:lfJXrnIAvYXvQDXj1Ak3palBv31elxijMcaHjJ:PBvYfWRAypiv3uxyS
ImpHash	-

C:\588bce7c90097ed212\1036\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1036\eula.rtf.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	3.95 KB
MD5	63c8f300b7f5090cd33a16c2579dbbb9
SHA1	25d4e10934c9794aab3ec005948f44f83b11fb0e
SHA256	923d0c503a65e279eddd27f362af7d454b4aa431de5db5484d37cda6c1bca3f9
SSDeep	96:UTtV368GpAwQXZKxNTlqVnP7l2M12hsbfmC4Hpw1HOMO8hjP:UTtVp7ZKYpJ2zYmvHpXM1b
ImpHash	-

C:\588bce7c90097ed212\1037\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1037\LocalizedData.xml.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	70.89 KB
MD5	09479e3e175ab8d7d243e1ca2d06d78c
SHA1	bef7e8b8302dbeb279863dfba2f0eca4a85d4772
SHA256	d2a78d49b3f942108e3b34a636faa18b9311f11bbc60970b4790d0f7ea872c34
SSDeep	1536:y1OOJuRgujTIJ1xP8PGnjpkQu00qrPVVYmyjkf1/mELC3R84KN1n:y1QgCiL8PG9i0rDgm4kf1/tL8KTn
ImpHash	-

C:\588bce7c90097ed212\1037\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1037\eula.rtf.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	7.20 KB
MD5	7b0f31670acb755f42e070ec09e61e47
SHA1	cc63e2831e495a75e6a8c9a58cbc1dbfac03ab7d
SHA256	0398d5f430e79349cf9f9c1cd58df5d2f57b60676046a1772a2cb4cccac70039
SSDeep	192:6Gun0QmaUEmTPvTlVNM2jqDCEpo+Fntce84OinT6zqoczDDQ:6RpyTK4qDCEowvOinT6+TzDk
ImpHash	-

C:\588bce7c90097ed212\1038\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1038\LocalizedData.xml.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	84.92 KB
MD5	a388be4721b698e61221e28505e98783
SHA1	65b488d7cee7504200a02c4a078a7bd7a75f8732
SHA256	8b825cc836bf33d6a875bae0a203e005617a0d7f3e5aca11131db843dd3f0405
SSDeep	1536:KxTNXB7gmCaS5CWk9tIQxqDvXtCBWwk7XRVeC1q9WoEk+/t4j5RWM+9U1X0Fsxj5:4HsBaddIQgvdxb09WoED4jIQ+s95
ImpHash	-

C:\588bce7c90097ed212\1038\eula.rtf.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1038\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	4.66 KB
MD5	6042859168daada6df073c10ea03b0f1
SHA1	f08b453fa1699b49c8fa809c9d0c2d6b595ced3d
SHA256	ce19606d6e6e93c74868602b2dc452a22dd60a239e448e24511ec68cc5dd0df2
SSDeep	96:dbMz6OfLo919IAtX3I20tRS5Wq99JjnBtJ8PQOS12:dKfcnNX4x/S5Wq9fMQOt
ImpHash	-

C:\588bce7c90097ed212\1040\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1040\LocalizedData.xml.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	78.69 KB
MD5	104c2db205e88ec9ef11b57711af52f0
SHA1	0943a68942f6d3b42e6e369cd903e9b3f76394c3
SHA256	c27680c631f5db982f2947100bc17037fea7bd0f934eabb00ff4b9c6ab2f7442
SSDeep	1536:wibips/XvwqbLVMxT6cpXhHKgVOG8DiO2kz7Cv0mZzE997M9yIWNP:zbN/XP6/RFqnz+do90NWNP
ImpHash	-

C:\588bce7c90097ed212\1040\eula.rtf.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1040\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	4.06 KB
MD5	69cd23fd0bce542548db993af37a05e6
SHA1	3dfd4c4c3170687befd4c4b4e44775d773637aff
SHA256	e6eec0b4a85b800ed20fb7a1961ac76f088a46034845e918f0d8deafcd9e24b1
SSDeep	96:jAfcs79NtYNJGqUpwx2FHp+MRAUH4MvKWpzA:UfZZN22mwp+MRAK4MCms
ImpHash	-

C:\588bce7c90097ed212\1041\LocalizedData.xml.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1041\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	67.13 KB
MD5	948319f5da45b52c3f368998affc9529
SHA1	f15d997a9172f8af4ea77c206724d3e8ea130b68
SHA256	26da006b05290c57df77fcb887759a8699d56998d00fa1ff117ca15223cda8b5
SSDeep	1536:1qTtqV5BdutgwksNezBI2+sdywLAfdGBrW3EdYXvZlVWxe:1qTOBA+wXNUBIGYRFGBrWUdYfhn
ImpHash	-

C:\588bce7c90097ed212\1041\eula.rtf.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1041\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	10.39 KB
MD5	eebd60f98aa405ca3d0f21322a2fe6ed
SHA1	e2fa97801b53ef08f1989184c331f614ca85607c
SHA256	bdb28840e7bc5db79bfda7266c1f820143301835b33912e184e17537de3a846e
SSDeep	192:4tNAWCqzhhTfVwrPWWlobwcklLyraCUQ2ojE0l41W6iMnEDnNg:4tShqzhhTVA+WllByWCUrsE021tNEDm
ImpHash	-

C:\588bce7c90097ed212\1042\LocalizedData.xml.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1042\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	64.22 KB
MD5	008b81883a3806e2e7ee6aa2397b21ce
SHA1	3a568ffe8eae79bc1a7ddbcb8b0d9efa4e66f99e
SHA256	bda95803644c0d5ad5ac19e134731342634d8d9b2a727be94831e18198a8d9a7
SSDeep	1536:RJW/wMK/b5mafQp2+XnXzMrs2j+e4buG/wOPd5e:RJiDSb5mah+XXKsg4buBz
ImpHash	-

C:\588bce7c90097ed212\1043\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1043\LocalizedData.xml.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	78.27 KB
MD5	33063c3d05a99a2ef881c9770c103056
SHA1	17b2a618ee2553907ea297a424438e0635fcb734
SHA256	b04040d255e2e7e89b1fd2e59137b8fa45dae6d0aeebe60bb9dec39a0a12e097
SSDeep	1536:x4rcre8fApC2TY5xqBX/8K74qvBYr4HgWhpLhusbKGnWDAq9qsFWJQH9z/9d42v:/fOCqWqB0K7LvKr4AQuugsUqsFWA9rRv
ImpHash	-

C:\588bce7c90097ed212\1043\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1043\eula.rtf.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	3.97 KB
MD5	8ce51d403df7a04d9f0cd928780e5885
SHA1	f27ed3f781ba3241e8c8e68ee56ba0170d7a3000
SHA256	302c1820c10618915ecc20bc1414412a89ec889a5048cfd1a9cc8320b74aab74
SSDeep	96:f9EZuP2t19UAy8BuOyWBddViV/K6Wp/8I7hAdwnxPZY:fOA2tUAdzyWWChAd++
ImpHash	-

C:\588bce7c90097ed212\1044\LocalizedData.xml.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1044\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	77.94 KB
MD5	0565190319a6a15cfd4b75444d5848fa
SHA1	a405007f783212998591ba2b08f86bebd55e8c88
SHA256	60b0982a5c2ca43ceae77d244ca0cc7f79120d84c29910362a4b4f5afe7b145b
SSDeep	1536:cmdExAVv8E6Uu8q3pK0AKD5rrZU9822I/e/wtRL1sk32jrOY07BzxP5CcB:cby8LvfPtT2jH32uYU
ImpHash	-

C:\588bce7c90097ed212\1044\eula.rtf.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1044\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	3.48 KB
MD5	9aae1e22e2b10d4ad9d339806d0e076d
SHA1	62a3bce9f8e40b54972856a94ae3dd31605bbff1
SHA256	5995c7ee665b193de73de06fdedd7ccde52666737972280e6f77d9fa0530da64
SSDeep	96:UdIfb3IbHaak+VTWutgri6wAQBzwfe6JzT9S/iCtWV:LMHa7+BWGgW6wHzyJE/pcV
ImpHash	-

C:\588bce7c90097ed212\1045\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1045\eula.rtf.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	4.45 KB
MD5	ef74813c9384b23e08bf5356fecb69e4
SHA1	7250a2d3825d09487e3bed6af2c54597ffe8b94c
SHA256	f516b69a00c6f0d84a537c7d53d97de869d0f4f0f9db42e6271e15b4e8cc74a5
SSDeep	96:Z27hIxH0WZMmOPf1lQUl2EGzBHpT9R8u1hGZuHkR6H:wCxH0WZbWQXPJZR8u1hku7H
ImpHash	-

C:\588bce7c90097ed212\1049\LocalizedData.xml.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1049\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	80.08 KB
MD5	f160b0bd455c6fd1c47e8b783961dd94
SHA1	5b48e419ebbbffe042bc6049904dc1fd113b3eed
SHA256	1f21b5961ad50590d046332ab66bb50ddf1938b5fe1294c846b7dca25a070b96
SSDeep	1536:EKKAom7aQsV2U5huP37LNhNemU7iv9l4Zj6jBqDkhYYEZ:MAoV52U5hA3xemoq4ROY7
ImpHash	-

C:\588bce7c90097ed212\1049\eula.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1049\eula.rtf.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	53.69 KB
MD5	a1278b8024feb4a8df1555e246a836b8
SHA1	5c9fd893eba88603cc588c4cb7a94b02f5dc09a0
SHA256	014949d6bf29f61a7c02fbd1af869e2e9f5af441132099ceee8e3154c6bddad8
SSDeep	768:fo6sXoK9Dh3FQ27Iit5lZILKJhykT9qnlDLTz7nGI4fElUkajjbAi14NaNH7XJop:QfoK9Dh1lrdNelD/Uatmx1ZNH7J4
ImpHash	-

C:\588bce7c90097ed212\1053\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1053\LocalizedData.xml.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	76.37 KB
MD5	830995aa39dcbafd0cb65dbb1ca2ab23
SHA1	ed5456acc77446886c099493c137173436d2f46a
SHA256	fb9a606db3307892492e1e1287ebd5afa38da182b83bc920a96131c215d8a18f
SSDeep	1536:ZvBmLRv0V1XwPrftMR6VouMx3XfqVxGUQCfL7VzttqvjeLX6:MROubRou2nfu8Bq/PtqvjeLq
ImpHash	-

C:\588bce7c90097ed212\1053\eula.rtf.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1053\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	4.28 KB
MD5	a771a5c2088793ca9135a779acd34dac
SHA1	e8cfaf22ef969345b94e1dad67b59b8e44e5bae7
SHA256	ca9374bfccf1273499ed9d89c9417fdf11ad3ec69a12af581a16a5c193bfce7c
SSDeep	96:iRtQgysFWKS1zo37XG/OIdMusVusn+AiXc7xkyA:AXyskdq37sOIdQksn+2dkT
ImpHash	-

C:\588bce7c90097ed212\1055\LocalizedData.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\1055\LocalizedData.xml.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	75.52 KB
MD5	747dae573b3a8990ab3ea38a7acaa0e7
SHA1	54bfca5042164d491eb1fcc8330b14adbc70371c
SHA256	15cc611132735f73bea47eb3ee62fef020431995511b0b9c214181e61e905758
SSDeep	1536:U1inc51EW5cwQn7pcDt4LU7RRB64awuKTyJ/vFVhU+kFEO1rsiF:4inc1EW5FQ7poaobB646KGRFchFJ1DF
ImpHash	-

C:\588bce7c90097ed212\2052\eula.rtf.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\2052\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	6.20 KB
MD5	4cc64c3ba3d8a17235cf23808e8c8bd3
SHA1	3270d4902a457f194045fb15b1c9365197e8dae9
SHA256	428da0c2506d144e8205e9214fcd23365aa7f85cc39739e9b2ec0a239c511b6b
SSDeep	96:ujDVkcKxFvTaLuPsCeFGb57fsgdfFt8xPoTxLnDN+Tfxros9CYMJw8DxatIPy:uXVkbFLSukHNgdbV7DNafx50VCkPy
ImpHash	-

C:\588bce7c90097ed212\3076\LocalizedData.xml.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\3076\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	59.90 KB
MD5	256db38cfe95e7f3284ad4128f9c376d
SHA1	31a340222782409e6729d423639f05f3e2f51606
SHA256	2c3b6ed1c1c3dbabde30d82680ac9d3b634d60c1897f02b11a419133bb3f5f09
SSDeep	1536:DGIHqbMrlieglnK9L856GKi0pksNQ90zRW/Ja9iNwBfIc2QhG:DGYt010QvKiIJNQ9kOYfIcVM
ImpHash	-

C:\588bce7c90097ed212\3082\LocalizedData.xml.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\3082\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	78.63 KB
MD5	ef605791a2b047b1821ac32927b60255
SHA1	f08141c23e5e8cdfb519be9ecb9f1024a1c40f5d
SHA256	c233dfe74417aebf8e07e8e210e4a576aa94b1d0fc59ebedb603a2f9e28704ba
SSDeep	1536:fq9SqfDiwFAcWI4RO/sMVwLdQ1/lo2R02fVJnmaOc24qb68EALMeVpaKC/R:foS61WE/sMixQ1/9wc2t5Ejqm/R
ImpHash	-

C:\588bce7c90097ed212\Client\Parameterinfo.xml.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Client\Parameterinfo.xml (Modified File)
Mime Type	application/octet-stream
File Size	197.57 KB
MD5	d2de51339cf690adc36300e74437b889
SHA1	8f9ff341dc34916c529924dff366ebd007949d17
SHA256	f867608b97262c4f01efec210b97e11f81956289afaf32d5a961f15f9e7dc434
SSDeep	6144:VqoMZIbN4StO4BgOTd8fzbyR+1wM1kbgqZsPozfFpwozU7:VwWbVO4BgOTuf+Yigqegzgd7
ImpHash	-

C:\588bce7c90097ed212\Client\UiInfo.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Client\UiInfo.xml.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	38.63 KB
MD5	b70252f5ed0d90f8d6574d2219068371
SHA1	1e05015b3af4a406cf337be9a0d55d2d209a864e
SHA256	b3f8e94578271fcfbee6e20b1af924a83ca48975c8da5ab5d0f0ac7cb741a2f1
SSDeep	768:kpCzmoiY5qz93Tc7afkQFdTxqBKp140jL8YwQuERVyu6eC/:kQzNiwqz93IaFxq+4mLyoEZ/
ImpHash	-

C:\588bce7c90097ed212\DHtmlHeader.html.TRAPGET

Dropped File

Text

Unknown

»

Also Known As	C:\588bce7c90097ed212\DHtmlHeader.html (Modified File)
Mime Type	text/html
File Size	16.25 KB
MD5	be7ac35596cb7aad120516b0e2d06578
SHA1	327879dd6b730b2153c669966a5c54f846ad0d88
SHA256	73f9308b99629b66c4ff196f86c5b04d9942e0a4f9f29d23631158c7b74c3f46
SSDeep	384:8ItQDpHnf0DwyMULq3CCRDSQpV2Nhm7djJYp8RVXTO4EVUBx/3:GdnfUwYL0CwvjJHDjBEwf
ImpHash	-
Parser Error Remark	Static engine was unable to completely parse the analyzed file

C:\588bce7c90097ed212\Extended\Parameterinfo.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Extended\Parameterinfo.xml.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	91.63 KB
MD5	e4922447fc6124ab4da159d6c0e933b9
SHA1	84b20a1b831ef20d1e501660dbfbf1352991d2ab
SHA256	9445d7233a8d7971592c20b0d139e4f3b4b0de40afe66729748817828ff61168
SSDeep	1536:nlapX6sf5LmSDyHDWpgBPU+IAdJfiaSndUFX4XjXgr15bSGw5IhmSfy66usv+:EF6AmSCAuUaPFXk2vbS4rfy66us2
ImpHash	-

C:\588bce7c90097ed212\Extended\UiInfo.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Extended\UiInfo.xml.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	38.64 KB
MD5	49fc7db0750c81812cf18e664aaa3ad6
SHA1	896b022e4320ffee0b354b0d6dc30560f53b15e7
SHA256	8996135e7544492875c65a8079ee580267b2f2871b20d8761fffa16c62b4ad1e
SSDeep	768:k3yizAvMzTdaKboeURvlWMJzzwkVVMfF57z0fV1AgapucV+xPrRuKoobo:mA0ddYlfjMfFBzCV1AgapucV+xboH
ImpHash	-

C:\588bce7c90097ed212\Graphics\Print.ico.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\Print.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.63 KB
MD5	f38e87f692b3d50b208b112de13caf9d
SHA1	1a12b8be066942926d3a12c168b2eeabf38cb80f
SHA256	2011e42c94d074d73ec976769ac7def7c59da0826999dafd2524c40047aa989a
SSDeep	24:Wr96I5sYdjfF79T/Q3JsqL9fh9TCMWpM6xYZvoRs6kvbLUL0U1vKgZ0VtHrW3v0:wt5ssPT/QbZhZgE6kvfUL08iG0VN7
ImpHash	-

C:\588bce7c90097ed212\Graphics\Rotate1.ico.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate1.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.38 KB
MD5	16f58da8d4d470777e3ef056f3caceca
SHA1	35646b2029c5fbe91e03afa426e8b68a8cbe5dc6
SHA256	7234df019d26b7df5e89cf61289a63d729eb28eabe54c4a1baadf692ccaf9d78
SSDeep	24:4wMyNiSxLyeesdybq/6NtEmIMYFY2ewstQkrbDjA1hI+fNF0Ws1UNBwBRRzsaNY7:qjS3VcbqGLIxFTVstQkvfMhtNF0tGK34
ImpHash	-

C:\588bce7c90097ed212\Graphics\Rotate5.ico

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate5.ico.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	1.38 KB
MD5	6cb055c2dc85aac188cce715a9a383a5
SHA1	010381ddb701ba551f02f7aad93614bc2c8d229b
SHA256	18dd464c5287c85edc724196f20c8187976b9c2fb92c97845f1d735c4907a707
SSDeep	24:SPLvumULDi0BN++yJXU4iazEjyss+SbuqoQCVUnaDLQWU1pqEMw2UxF:STv2LDHDAJFNQ2qAuqoQCVpQWSUw2uF
ImpHash	-

C:\588bce7c90097ed212\Graphics\Rotate6.ico

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate6.ico.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	1.38 KB
MD5	3dbe7f37ac4412b30573cac2d00d7c02
SHA1	5126aa4e58a6f0cfe6b22cedc2f9a2766efc295e
SHA256	a88f0f5f211cde1af28315c20f3877722a29aed11a6cb0cbea9f1bcae35b6667
SSDeep	24:VWQCsmJUa0byaxklUtPtWiBZMK5HWzhFLCFQt5bigjyaXUzPzENeTViWzU/cg+Jp:VesmJUNOaxkuPtWiBCK5HWlFLq05bigy
ImpHash	-

C:\588bce7c90097ed212\Graphics\Rotate7.ico.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate7.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.38 KB
MD5	3c761808f9de2447d4e7076a24dda521
SHA1	02bc7b0a3e55db48da9338a878fc40efb7f9b310
SHA256	c40183bce58fe586e764b347d698631f9c5315f7a93e2551e49de6f87cfc9247
SSDeep	24:TKGpxbenLnzmnnSl7aEsQeX4CUk9xZOaqijBXgW5uYd+G8F6Ea9Dw9LOgLT3WVKK:T3fMoi7SbxUkQaqijqWxt8obi9LxTmVL
ImpHash	-

C:\588bce7c90097ed212\Graphics\Rotate8.ico.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate8.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.38 KB
MD5	67d2244e20262d9d5ba4946022062691
SHA1	67cb17930328a4eb92e60b7ab99102729392ab24
SHA256	200d9aacf534bda228df5a6508c8d407ccd69adf702431381489726827c627e6
SSDeep	24:vsmnnRHJLDbE2yiwAyc5BiovP3MQQWv7Aw8mKpZNFk:k+LDbMVoBlX3687AwWHNFk
ImpHash	-

C:\588bce7c90097ed212\Graphics\Save.ico.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\Save.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.63 KB
MD5	e0e71b955e82be43e58919ba475e9de4
SHA1	ba9fb2d39e10d5d49fbf9e9532e42a958cf95747
SHA256	be76493934172d890655129b6ce1f27fd2b3cf384eba471137675450c58729d7
SSDeep	48:PtWRJ3xuh++tY1yKP5VV13vQAYwH35LZxJVLvrWZk:1WR2JYnYAYwX5jJVLyZk
ImpHash	-

C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.63 KB
MD5	9301980cd853b3d23ef12cae8302b723
SHA1	21de24203e2ada797f4332af5c6500d96ceb4bb1
SHA256	a035e51b69a9e3a6ed7abe51a16572064ca79e9a233c95df7a0179912e28ea9d
SSDeep	24:wF63lXYbHeyBUvh4LNVkOIyjWY3zwRgcr7S7unAurKHZdQ933vM7/YhtYQnxZ:FYbxU5CVkOIsJ3zwBS8WK5v4e9f
ImpHash	-

C:\588bce7c90097ed212\Graphics\stop.ico.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\stop.ico (Modified File)
Mime Type	application/octet-stream
File Size	10.40 KB
MD5	e88f46e8e75a2fe3213bd5cbbc86072c
SHA1	305e94b0420f075e7b464d0089181eb26fe1679c
SHA256	a21f237a80800bb4b364f3fa66898d8f1f3c31ce5d4a6f89c61e2f4b74be5c41
SSDeep	192:Rx0i1OQjPpcRkEJkdhquJZcFZFFSwfXrY55p674QV2/Lr9I3QGL0Sg:jb1FuuEqdhlq3FSarYTM7c9ITLM
ImpHash	-

C:\588bce7c90097ed212\Graphics\warn.ico

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Graphics\warn.ico.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	10.40 KB
MD5	cc79cce6f55cbb3a0e48df755a4f3eee
SHA1	85c71b4737a467551508ffb9cf8811702b784fb3
SHA256	0ec327ec02f9a7aee4efae217660259de873aee857790661f1ed2ba39ee0fc18
SSDeep	192:zmH788NlWqCU0QNUDUYFCxNL7DDzlOENSGEM/0d+dqUKAu:zk8NqrzSUXL7JOEQM/0qu
ImpHash	-

C:\588bce7c90097ed212\ParameterInfo.xml.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\ParameterInfo.xml (Modified File)
Mime Type	application/octet-stream
File Size	266.18 KB
MD5	84e573844c07aa0245d07bd82da99567
SHA1	680df62e365e820bc87057e005e00453ee492106
SHA256	9ec19ebf3669cc3873341ae569545b78198aa47db3bb24511d6558de97b984e9
SSDeep	6144:We0C/CXh1RRBiD4dcSugb+5hZK3iWP+QzQY:f0C/kh1LBiD4uY+E3iWPpzn
ImpHash	-

C:\588bce7c90097ed212\RGB9RAST_x64.msi.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\RGB9RAST_x64.msi (Modified File)
Mime Type	application/octet-stream
File Size	181.01 KB
MD5	eddf2b2ca9fe7342697133d05eb955ea
SHA1	b5ebcb48e078fb626c8adb564febedfad6830cbe
SHA256	fa1fc110edcd1b9276a827f5ccd24cd71dda9dd6a2670c0cd4147dd53c961f3e
SSDeep	3072:RqvBY42xIgEgesWJt1B00J14x9SBgiwO6JekAJV1s66Px5vAI1cOZmhsgZl/BH7u:RqvBY4vxs2+g1aABgnOkOV1eXvHipH7u
ImpHash	-

C:\588bce7c90097ed212\RGB9Rast_x86.msi

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\RGB9Rast_x86.msi.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	93.01 KB
MD5	a837299a353492a6c2cc0e29f76f9c99
SHA1	7ac673e50de9bbde6729920ad9ad4b15750b16b1
SHA256	d29c3660565274e4ace90e2393c7bc94cf37dac5e728a33f5bed70436702fa18
SSDeep	1536:DVwQAkRVxSqjukVBOUKviDPR/RXDtHn7kHK7YelnqvIpmZ3W94rzH++HVAC/icq:uQAcNukYviDPR/RzZn7kq77lnZoQePHe
ImpHash	-

C:\588bce7c90097ed212\SetupUi.xsd.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\SetupUi.xsd (Modified File)
Mime Type	application/octet-stream
File Size	29.92 KB
MD5	5392e9ca1e2ea2b70b9dafd3ada6534e
SHA1	f6674d5fd6a8b229522146ca57a6a44de563986b
SHA256	f303f421d9de4387b6749fea7c0acf71ddaf3b48df3559c496871cef607b9d08
SSDeep	768:x6G6WDf8bWOvoY3LL4x1LGiMfdbC4g+zmtOgWqX17aQ46:xEWUW8oY3/S5Gfcd+zCOg77F9
ImpHash	-

C:\588bce7c90097ed212\SplashScreen.bmp

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\SplashScreen.bmp.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	40.62 KB
MD5	6a3c6cad88f3f8032afd4ea2cedccdcb
SHA1	1e70165cb710e4f1fac8d95df6d2f8451a2ff074
SHA256	de2727fab93e0478cb6f2245eaddba81eb9a3bf63e52cc1965ec84456cf905fe
SSDeep	768:R8Ks2nIEfr7xv4fIXkdwhl/X/zSWw99KwMXE9/b4ImDCIpOVj6i0cwDX9k2ZLFU6:qz2nNdb0dwL/X/qsxXEboD3pOVnRwDm2
ImpHash	-

C:\588bce7c90097ed212\Strings.xml

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Strings.xml.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	14.26 KB
MD5	eb0b1f556d3a1ef618627d115d57d27a
SHA1	78c9ad0f2fcbbe28119426026440fd1c457e5e1f
SHA256	b4e7c9bb7de20df9e0eea41830d1ce64c221e6c802a88b0a29b2addc5276c296
SSDeep	384:Wd/8WrJ3t8jlJn+y5E2+xSEHYyQRuEPiT7LZB6PAucXqhonLqR:W8IJSAdLcG7VcAdX3w
ImpHash	-

C:\588bce7c90097ed212\UiInfo.xml.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\UiInfo.xml (Modified File)
Mime Type	application/octet-stream
File Size	38.49 KB
MD5	be60f7edaa218e932de42e894c160087
SHA1	61c43b8ef8ac9e0e6ebd8f8fb0c77ddb9b2cbf23
SHA256	c2c30cb2c568d69e1dea9ab6cdd60bf568b8a37ed47b735067ed0e0aa77362a0
SSDeep	768:YK3f9pr5ZRMleI0Kue2SiREXxiivjejGIdIzNnK6XIRGcWKW:Zv/fR2eI/6SjiivPUIzhK6XeDWKW
ImpHash	-

C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	2.09 MB
MD5	29366a7c6a4b722bbb20466e8e5ccecc
SHA1	4b2bd2eeab261179a8b9f584a4812b62ba4222e3
SHA256	b89e6b3b66a7ac9a6360b409b12a61ed4487422ab8f86a40222d34a9f31caaae
SSDeep	49152:09LyAkvaBZC9bF5exBT2Du+aaiYNqx8y9KU2KUYxs35DKZ3OIKxWh0eH:kLUaB89FuT7aiEc8zKUYxs3pKZnKxfeH
ImpHash	-

C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu (Modified File)
Mime Type	application/octet-stream
File Size	2.04 MB
MD5	fdc583d0076d7762796528e5141f6c66
SHA1	aed3e59048ddb50f2a208911e56406979297d487
SHA256	244b07a674628dda41e1c8bf39c9d4233b489d8705065ac0f41779d324176614
SSDeep	49152:jP01A0duLZDuvKk8FKUYcs3HVKf3rhKzdNN:jP0mmufxKUYcs31KfFKzdNN
ImpHash	-

C:\588bce7c90097ed212\netfx_Core_x64.msi.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\netfx_Core_x64.msi (Modified File)
Mime Type	application/octet-stream
File Size	1.81 MB
MD5	ba9868af590372cc0cd85d74c4080ab3
SHA1	722e5618938e4113837a7d1a84caf8d32872d40a
SHA256	131022359554b4f61c13d003ab1db233004d7ac209107fac32493bfc18ea0c31
SSDeep	24576:9xBDlqvBQbPyxbs4rONSjrWeuNKlwZXWfjhOGxZWxw0Z:ZnisfQvLuQamLw
ImpHash	-

C:\588bce7c90097ed212\netfx_Core_x86.msi

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\netfx_Core_x86.msi.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	1.11 MB
MD5	4fb0b5fb0316cab2a2244956c3a91ab3
SHA1	eefd30191d0bfda240c5e7836ea5cf2bc72ea5cc
SHA256	d189d44b4dc0ff7210659aac7b2ecdf86ad5751dd906d8717e493c8821a2ac66
SSDeep	24576:1jOzk8Yc2qTvAvbcgxvo6JUoL+XzgOEB4Nwd38wJ1lrOxg:Vf42qTSbcC/UzDgNBQ837+g
ImpHash	-

C:\588bce7c90097ed212\netfx_Extended.mzz

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\netfx_Extended.mzz.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	41.13 MB
MD5	ed2885933355d5560e241a4b607fdc28
SHA1	aaae59e83f4dd152d935a5b574a6d1e9db61f3b2
SHA256	3333d6163a3f3b38f022b44737b0b2b0d6de17232bb49d238217f02e17662064
SSDeep	196608:+oXqEnMigq8WFf2Ez3QIcN/eHIhZ/OkajxS:NaVMFuEjQxNrZ/zAU
ImpHash	-

C:\588bce7c90097ed212\netfx_Extended_x64.msi.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\netfx_Extended_x64.msi (Modified File)
Mime Type	application/octet-stream
File Size	852.51 KB
MD5	76fc26648add38a965738b9b99c77fd3
SHA1	1df2e1f25fba8d81abd35a8aac0f0c586f637abc
SHA256	edb16a7402635dc700ccae84efcdaa9eb3cd222d8513a5d8f906a43e9d384d47
SSDeep	12288:Ln+lOx8gY3hxbs9UJoPk28oKe8GKRjRUunKcoSwXcCCvbrlSX4VPKqwsNpGxQ2tQ:LnUKaR6vk2qFGeNUQvoP6Q0rsB/YdGmT
ImpHash	-

C:\588bce7c90097ed212\watermark.bmp.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\watermark.bmp (Modified File)
Mime Type	application/octet-stream
File Size	102.14 KB
MD5	1f0fe4acf5900b215c95dbcb445bc640
SHA1	b91b0e2bd21d9536316841a3026ded702e9e672c
SHA256	789947c761ba176f4084bc8eb053ae02bcd74db8f9106c3a95ccb83b9dae924b
SSDeep	3072:Oc/EGGE5XnFuG7sVo2T6RZwuTGqiYDCrYxaB8yi:R/5GE518aq8FTL1ceP
ImpHash	-

C:\BOOTNXT

Modified File

Stream

Unknown

»

Also Known As	C:\BOOTNXT.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	520 Bytes
MD5	da79fe2e45ca3a7c02c20b949fb25b3e
SHA1	b2012e49caa5d868b6807c348b642cb9e11949af
SHA256	7a3f5e1273057aaa403f3a9623f8a3df40258e10c375409753c1d25cdcc90943
SSDeep	12:vkbGuH6SwvakhpR3vxz++gR9oVtqp+lzsBKTvHYbZNUsvXnujtjuq:66pR8PyVtqp+KBKTvcNUsvXuxjD
ImpHash	-

C:\Logs\HardwareEvents.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\HardwareEvents.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	f2a975786f9c53bcbcd4c7aa4db2b846
SHA1	5b224cd2618760db4e8240c8291fbf322227f6bc
SHA256	8a032fa87468eadb9f6a6162ce6d38067efad97d8be335f92808583b5bb125ac
SSDeep	1536:bzL8DPSFfB94Llhm/zcOTHmHCAjrV6QWKy+3f8wT/aweMdSNeZ2:vTFkvm/zLL8C2O+3f1APZ
ImpHash	-

C:\Logs\Key Management Service.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Key Management Service.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	a7c8af972e55d439ce917d502255dc97
SHA1	6475dc538063c95c4949285a4cfb010fb56756ff
SHA256	354096f714d414a639358bfa0d9ce7bb8b69f3e732cc0aa26a1e2f1a31ab43a2
SSDeep	1536:UZtdLFst0/waqGBLWTGRiSFDfdspB+sE8t/R7ft:UfdLFstYwluLW+FxspBm8Nxl
ImpHash	-

C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	e990041896516f220a089074713eaeb9
SHA1	08eedbf01ed1fbfea23fabaf4373357ee3da96c1
SHA256	82a26602480d8605d23e9ca9889ad2aa82626d78d0be2899487ee26cc9ee531e
SSDeep	1536:CKce1HLwLKcIJG85+dRfZEmxixxgyMlbvi0F4BnIo:jcetLw2cIcdRxYEbj4BIo
ImpHash	-

C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	f2624365dce315dd5bd044489c39113e
SHA1	44b793f8320f0a334f91380d78886bd116a8308c
SHA256	8a309841c6a9e7ac7052dd7d63a5f950b307ce88f3ae30bac1ba9e89c6acc1d7
SSDeep	1536:9qjki4BegSp0d4KlwAymSCSsAcR1co5P1mdfwEBjdCeRM2ie0:9iki4BegA029s3Rmi1mhBxbRq
ImpHash	-

C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	b6113fbb3d1aa8f296a66f4e91b152b2
SHA1	42d384a58e895d19e2e4d85d8ebae98ad34df3d5
SHA256	37b9fe910800d6559bfa53f50ddd3a0186225e3606402cd5ac845430bb9e3c4f
SSDeep	1536:pEgHj/MDe1l3DjtABVKuMdL+O6tnfdKu8QNim0DW77JBjVcNo:pEIj/MDa6BudLnCnfdBvimF79BjVcNo
ImpHash	-

C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	ae20474510f215f6ea9e7e6b8e9a4dba
SHA1	e13cbc50f16041986bface35446eb27cd976fdfe
SHA256	f15f6ea08f237d6293e5bd06a24fcc4c9ced8db3ff8a88b98e43f4c196e8194a
SSDeep	1536:o05w6jFEVlpdSDTxoyZpZ3GU6itOf16wEKGjJKvno15Z2C7L8fYKc:ji6j+lITxoedxCwwER1L2Csm
ImpHash	-

C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	9ecb0a0034c5f886970cc505f9e3cf4d
SHA1	80b409feb4cd9edc23c72d28204b999f6f8ed65c
SHA256	dfcd3f0de4f67028cc06d0146166bd07ad7a6514a5f26a2df3fd471fbc2ad172
SSDeep	1536:TnjwQeYDWHEZwa7S+du0IR3DxycqnwlfWsPJHjfM0y1D:TjHeYDWHGOaujGaJDsd
ImpHash	-

C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	1.07 MB
MD5	56ddac3458e71f9d9b1549a3fd18af5c
SHA1	e37525181509ed5cc58c706576f5adfbdd4d2a5e
SHA256	c5409ffd7bee723e4fcc4eecf76e5cf329f51c2e4792b1c50d1dcf7059d075d4
SSDeep	24576:DdGwAP3/e+0WTiUMiVo9WQNKkGQl+P5SHrtxxm8cs5XhUNLOxD2PBWiqtsLsXQGF:8pPPelWTiv7Mal+SLh5SLOB21JsXQG
ImpHash	-

C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	2.07 MB
MD5	c7bb0ce16b613e553d715578d16ef4cd
SHA1	1dbf70bb4accc5b3ad2ce88215df5c8768c4f750
SHA256	274f6c84a175d0986c58efbba8c23ed496beaf13e5dacd349820fd55bfff5cea
SSDeep	12288:/k9ZlwfjyaN1+CGuMcgAnRIjEvpsCeKCsmItfoVIQwsC5Eba75xu28y66s4ha7:UZlwfGaTMuqjPCeahiFeE27Lu21hq
ImpHash	-

C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	f9eb53dbda746c755c88a78ee59cec6f
SHA1	eb8c00e2b50654d9ce4094147e85eb8b5a14ff0d
SHA256	f4bf038aaac5a91bd11ff007015794ce7a15cae5fef91e90bda3c269ee32fdfc
SSDeep	1536:WVIY1M5mKKzEFYFYPZ9ohKuu+NyOwZ44oZ9LquqfGz7Rx:BY1uIzEFVY0YZjz9L1x
ImpHash	-

C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	4a6d7a872858770f18c6a957829ff2f8
SHA1	fab4097b8c1fcd080d0986e983dfdc7e9cd17114
SHA256	8806cbdc6569e4476186cb59b14842851ba8b4c1bbc403cbdf365851ae43dc20
SSDeep	1536:+1TK8Y+D3eQX8tO5CosWB4nbgGU85uRW99cU6R:+1d9D3eQXZ5CoxqnX52W9QR
ImpHash	-

C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	5029b3ea60b3abd7ec329d260dc4f1eb
SHA1	628e4494a1e2bfe03435e29994d96d0102c0d9ce
SHA256	5142d0457a73f31d11d609a6ceac58b2e62b18b319e1016c73461297f85e21f8
SSDeep	1536:XtxR++6eDt3kETYmJ33pGsVVMYPy7H8Y4+Iuv/9XC:bRDfDhNp3ssDMYPy7H8Yx4
ImpHash	-

C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	eb3db83b973211a01d90a92782acce00
SHA1	4b34af8f93b92c583721f9d05099330ac406ba5d
SHA256	d99aba1607af64500c66611b6cb9110bde88d4d65e723d921de1f8eae4059ec8
SSDeep	1536:vwL+phsE+Gk871/fSUiJd8K2j9ts5PMynihOtrX71dpcsupWL:vHHkM68KwsRMyCOtrJd/upWL
ImpHash	-

C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	d924f6c077211e549731442e7037e522
SHA1	a0c2bcedc20fb702d97abfd2b00d8dbc3f69bd39
SHA256	d279c33bfb79100fd99d5933d1690bd478bb910f9a9daf5d0b41f8f673f4007f
SSDeep	1536:3UnekuHv1uY/fl8swOPw53R5LqxC/1a1tNdh1ISZn:iaD/msPPw53Rl8CQ1tN6Sd
ImpHash	-

C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	f9fa497fd01e6b2c19da0738065ce4f0
SHA1	67dc63676d802fb51a4ef777ed5b6345c3f3c5a9
SHA256	ce297ea891dd76bfe8db142110ed6059ff70ca9bef67e4b8fa5cbd2fb855ff25
SSDeep	1536:8Vf1mhKSvRWUj2C66g4CBaENJhpkpl82vVhsYNff61vvuG8:+mhKoMUj235gEJpkz8qVhdff61uG8
ImpHash	-

C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	b8da6f7dfaf70d882e19b091d5d63bfa
SHA1	48b0aab5461d3258fca8f3981d5f84c13baad825
SHA256	b3dc5c8e96b9ab142b842164c28a8d385384b4f45a41e7d52f2f97b6640952c8
SSDeep	1536:JpDTIax2rryUjxaM9ayds9htJIH/MW5qpahYCpOyTTM:JpDpIr2U1xpqbIkW0pZ+q
ImpHash	-

C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	6fb90b45f99b3d8024535ee3d2b1dc67
SHA1	c92897c0cfae6327f694b210774f2b9cf66d76c2
SHA256	fa3435b73734b5cbcae138115a27cceffa5ae623d35ec23faf10df7ce0b7b578
SSDeep	1536:SBTB9q0IN58Ua6APbJLZIhrxxvvVFMUfPqVzqeF17JnVw:SBTBM58Ua6ADJd8xFFMUfPi+K1Nn2
ImpHash	-

C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	5d528ddbb27ab4950f38df8ef2100643
SHA1	0ed250cdcf10946c373c46f53831db369c4a3c44
SHA256	12ff5815bef8da1609f2088738273dbb4872b1f6e1545378e77069c871419475
SSDeep	24576:V+OLJcvGDfH02OGIZiTdZ/dtjG5fLLBTwVdGsG08//D:EOdDDfH0tGIZiTdZVtizJu3GZ
ImpHash	-

C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	5269cfcee731377c6731dfd6dc296864
SHA1	984f07e0dd5952001460e6ba6094079d37a9f398
SHA256	e99ad83fc9ac166b2c8ecb3f4d59f4cd6a027bf35940e12ce33bea610d33b3ff
SSDeep	1536:unA9WGMODEQpgxeEfvphg3yrRcRgPAK2DqDXUP+sNm1kfm1u9e5s:un8+KvjEfRgicRgoK28EP+sNmyeA6s
ImpHash	-

C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	b2e37add116459478be0f2d19141314c
SHA1	ac2c02bdf989f61eb591b53e658f6f9eee8ffcd1
SHA256	8c53b8b4a6d358b9c84095c2922a8f01d42cde1a8b04d0244af1b4a6c68470a1
SSDeep	1536:XYYghsjRDUQxy3daUSbI2KVdD4n8ltQBcel:XYYghsNDjxyI7gg8E1l
ImpHash	-

C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	4e7bbfe7f5721887e2ae3302ecc46dde
SHA1	66ca2bd85842566f69db588c7e97317226875c9b
SHA256	c1eef130cab85655d4f946b34b49b901f30266e82fab6d8d45a0bb593c2cf103
SSDeep	1536:EAw9FxlmNhMP8nuBVh2fJ6ew4vAc5ZSV3hD:EAw99mLMP8uBPG44v7gLD
ImpHash	-

C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	437f44f853949f8bd99d5ca209ea5c2e
SHA1	eabbdf7e1e0d252363603fc51df571fa5e2c09c0
SHA256	9674bf70afe1c69bcd51b11f5ad2e3156f3db536914bd12771c26a5898991b75
SSDeep	1536:e39GcW3T72f8WRlDJyGXOK/dul0XoxbjnD9/d:xhT7wRjyGmWX8jnDD
ImpHash	-

C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	c1265cfbfaa20ea842a4d3c78634d3a8
SHA1	29cd656083c9398a4a23d2c3cb578c500120b2a4
SHA256	991aa776d6cb08cfe144ad965be02395fce274116e9d99d91990f0988aa9f770
SSDeep	1536:MWObHOTlPplKY9fPhI+x7AGA7yQvwRDWkS+azjFahTBZ64Qv5ytCujKXRHC2usww:M5OT9KGfPyPGoYDWkSFzshTm1vIt7iFN
ImpHash	-

C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	813d3cd8d838cd28a8b53504b021adb0
SHA1	e2cbf7cbf1ea99156615c1e59950f2de120f38f5
SHA256	c392116a354934e6bb29c0468b47dbbd9c168f0b8a3d2edfd1f4693d9584b076
SSDeep	1536:OH9FD0BAfl/Cp01EivOGtH9eJp2/CKur9m:0ldNa01b223uk
ImpHash	-

C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	e73e7b40068858e00178b3d6bec797c4
SHA1	5bd51278c7cc9a4a84dffecdf86f32044b8993fb
SHA256	d4630e13b6d23d4d5f812228ff6f43e49bf551a350d4e8e5e5b5edcab023a2cf
SSDeep	1536:mZJup2a6WzhEjUQTL0GnS558XDo4IiE5INKip9BTZysg9Le2p0s0o:mZO3zKZne5k87D5IIjsgRe2p0sx
ImpHash	-

C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	a2a267b72e8b3545d0da7082da5d2e13
SHA1	f1a4f014aa18b74d175e3d0f47b6d414fe01a81c
SHA256	ddf99ae11dc50e97eb2b7de41c8d126a2f5a523b7c5f7d7b44b80131a0e6bacc
SSDeep	1536:afusxg/beEzGQsMj31NjCq98LBM+Qsp7FdRR8O5aPrajHIKG8GnJ:aq/SEd31VChdQ4uO5tjId
ImpHash	-

C:\Logs\Microsoft-Windows-International%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-International%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	4eeccae5d8be574e15491baa279a5c3c
SHA1	188661258f4c53dd6ae7a6b89db891c3a2995e7f
SHA256	7e1f53575d9aef991d7655d48fb1dc93dacfd3a6bce38d13fe6311cd94997388
SSDeep	1536:pxGOOKSWTeiRac9TWb18sZLofUT8HwfF9bkrgESDZPF18Ie3+iFwe:p1OKg49TWbBZLoLCrYFSloxwe
ImpHash	-

C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	a95dba20f3597364c7388110b8fa50c0
SHA1	0053224d0fc2c8f76f2b8ffc87313728c9644670
SHA256	41ce9a0e39568e9825d5462568c95ec7df5cf740be1c75d323bec2b93c4d7300
SSDeep	1536:ZvspenERba3eq6YlgTLx9ge1d2yiqpq04F1hjv/GDLbXU:Z0pW4aujYO5bLRiqorj2D3XU
ImpHash	-

C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	66475ee0c1ff756f24f46e0bc9ea4852
SHA1	c08e01e82c2263b66513c742ac718dc389223ebd
SHA256	413d2ab490e145ea55edbf123ba2eced9507cfa018f4942e457004037fd74e6b
SSDeep	1536:0nm+gup8GAPPRcTfpMHiWNmh8Nm6q3gs4WS20Dj:Cm7upE272HJciNbqXhc
ImpHash	-

C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	454e409576a85fa9ce4aa1d63c9a06e5
SHA1	3dfdb21a6db173bb742b8f37bf789527aee1f093
SHA256	64c37ee38640201ad450f0d8d3f0903b93c3c755780047b80958adde7e694466
SSDeep	1536:XMH2YBCvNW1m7zENPyNNhjZ+u5CaJpN2lVpA1w84FsntLO6ZAWk:XMH2YBUTgNPyNRjrpiqw8OsVOD3
ImpHash	-

C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	068cad1390e73d11e86651f5a8a4243a
SHA1	6e54683bca83692b127059bc06cdf2746745aaab
SHA256	bc1211a27339d09aa911f3a751da79142bf3baddf479e3ef7379feb3d0fd352a
SSDeep	1536:Mo9XrIPPMaqkrxFqglEf8kTX3Ukyt16mhvzanpQlkAchgJSt4C4o:5cPPzJ1cYVY3HnWrg134o
ImpHash	-

C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	dca5c952b8e83112816f1025d6c3eae5
SHA1	5fdded23888741b6d12b9f962c025255e8454428
SHA256	aeffb3e73bf1587b2c59564d5a369e0417879ff2f1ec73c6d0cba802fd430ebf
SSDeep	1536:IvP2mbfxr+jE4SREGiiNZab7B0HVAVZlK5/+2I4TxoKagqV1v5D8SQ:Iv+Upr+RWhi4ZyFVPI5GbMoIyWSQ
ImpHash	-

C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Known Folders API Service.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	83d700bbc5386d69ef430a4409fddf18
SHA1	b078100d953de1bc893b2dba4fe6fd6ef87df8c6
SHA256	b4a1c45dcc721ec72e321baa8e07b3128351fb96bfcd57f2bd4a815ccb5d9a1a
SSDeep	1536:L7GHr+Dc90WUgiX2Qh4ViBvSDOfONFx+Wdd0aA+:LyHr+m0WjZQsgaDOWNFJcQ
ImpHash	-

C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	b7a86b436d67a12e057e43126d15a109
SHA1	b8605cf544948bb267e1241d8974517fffe367fc
SHA256	414f792f7f7bfe0fdc3556141df17912dc22daf0389b10bdabfa68a59791b952
SSDeep	1536:li2/0WCewaFhDS1fKfO1DxnBUL6IHif3RhSxT5gJGniDYepMQi:lXVRFhDCisFaex6gJ7Yepi
ImpHash	-

C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-MUI%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	a9fdbbce729888c5affb116ee04fecff
SHA1	6994a36cffa2e305a049990332e11a13c795b5c8
SHA256	8ae48758b0de72cf648a04157f97b8ac0b307293d95d092ac17fb4b0f0d760c6
SSDeep	1536:SWgHju1OpgD3VRSJ0jpMlll2RT4C5P440vV0t/cNANUJTqbNGmv1:SWgHjgL/SJekgd4IPOvAcNNTgNGmN
ImpHash	-

C:\Logs\Microsoft-Windows-MUI%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	a0a5b35dc50b552d1d73655ec5a5cb57
SHA1	7964626a17f5cd9eda00fe81071d64cce24792af
SHA256	cfe1d716d580d988a4522ecc75392e42c90b2b928f6be9d5e0d7ae1b224eb8fa
SSDeep	1536:2NGXfd3S5QfD/bsGsV8ypp32l7IBy3ebYLLeLn8Jjo5:2YPBfEG/yp4VIQ3ebYLL7Jjo5
ImpHash	-

C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	77f0b0af77dc91840d78a6f2c669b7d2
SHA1	3c3c87acb1aeb46737d61a9d2b4aca4bc1898c83
SHA256	462e809660998000ab02e6a5f73554b7ed91b012156e813bd1799a71fc792cf1
SSDeep	1536:GltzpmTN/o+JASO2iG8SmC3KBkBszk2hn3BMBzTZ1xxp5Hj4w6AmWWq:ql8/oKA7JC3FszkmyB3V+sWq
ImpHash	-

C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	495e077e09f47ce5fa90baa0e262c3c0
SHA1	24920acc3783f21ed432818d228c74e34e1a1cf7
SHA256	5f2024333bbfbfa5544a24376595865168baef510c6ed7ba80944183761c8c12
SSDeep	1536:rueidX79k4Uj0cj/ccv76etS77jclp+3I/g0flopFx3:rsR+j/c4GL7clp+3IRGB3
ImpHash	-

C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	c70023135a2fbbc37c9958381ebbb501
SHA1	02be867b3125901aa60d8ce496bb6c6ad20d7297
SHA256	04fb51d8f5edb90d3263bdde5593fec20a318b3c762c3e9f725b70b7ffaaa614
SSDeep	1536:AJI5P0eZsv5uZ6NDqOvT46bGX4NBFot+5kZ47lV7Bs09:AK5P0eZsv5ugh064e3E+O47lFu4
ImpHash	-

C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	96a2f8ccfe253ad47b69fc9586337c68
SHA1	38d2518614b6cb7ddff094717803f81b3cda692c
SHA256	a16a8dcec3097225abb8511ab17247f865337f06e1a22971aab3c071198c5bb9
SSDeep	1536:WPWUCmolWX1Vt+sp9lpzI+L92JBDe5yrQki1TvhOus5burEBI4io6y:wWPmYQ5HlpztLQJBa5ohi9hOooWFoT
ImpHash	-

C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	25a95d30842b382b7dafe5b828ee5d42
SHA1	e8c0b9cb4fd8ab1d3b239e158fd15dda83c0677c
SHA256	49b0827d0c0ff599b386235b6ae0506764d2fe73390498f5af90a571ea7aa2a6
SSDeep	1536:5Q0W42LRxUe65wapxUL49rqPhdqfJMLFt:u1LERmCxaEe5MiLFt
ImpHash	-

C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	e7af2a69dea6c97b179183c75a617a8c
SHA1	983e390341a60920da2ba5c780ecd5dadeb85781
SHA256	85b7a4e4fb172e720bbb4df70c9b97fdaf2eddaf828a583d01997cef4b502d78
SSDeep	1536:4P8vTftOcZM+Vi97akCeVcHDpJTYLsuygRNG:GsBOeVi97RNgkLsoNG
ImpHash	-

C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	559b3b44e019620bda18d0b6a0bc740e
SHA1	53fa883d7950d33f0dcb04e88d1e4113944bd8af
SHA256	a1690d433dd68a5e1887e6673ea5a227069f60e15a41ec553d42896525174567
SSDeep	1536:QrSDKvQ4Znay+0Pq46ex2HLkvENt2f+tV3NTE7vOjkKb:PO7nQ036ex2HLkQm+tpN1gKb
ImpHash	-

C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	a9ffc8925a8b1835005dcd497fc4e6d1
SHA1	efc077525c7763fceae5f4526fdbb785954d60d0
SHA256	659e84da3db0048cc3ce5f23f85dc8fbfce5ce0d18f4bc2fcee761f69a6f6f3e
SSDeep	1536:OSYvYesK02HW69nn5XxTlq+CfnwGlXCosRiakios/5bedD596M:/sSK52Gthl7CvllXCoLgok1iyM
ImpHash	-

C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	35695e7d7f5eeecf541d937ab63c8eda
SHA1	dc32d77b53bab3b2fcc9299c9e4ab680e8975b09
SHA256	37592b6ffd8e2aa1706b663b115a5958ecef2ad4458db3756cb0b732ebc789ee
SSDeep	1536:v7wrqQIHb1dQkV6FQUUwm/Of0Sn1zz+RdJJg9hS6FP0R+fE2E:sOlHQw6a7GMK8RdJJWE6F/M2E
ImpHash	-

C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	366a6d960395eea4c7063fef0449b17a
SHA1	eb0bbd6986a6fe08b91e49896246f0732dead14f
SHA256	6f1c881037954fe4c6366dc1794053a55787e122311bbc1088057b39dfe547db
SSDeep	1536:4vPMcEEQn2tATSfpUkieNxhknTY9LGeqdiqcdD7uXfLlgPZg1:qPLXQnLSfge2YdG3dvxXfJ1
ImpHash	-

C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	502fb60eb274ebd4b31fe5e924d1e616
SHA1	fe1119fd61965d4edadfe10af25de52cb088b84e
SHA256	ac0dda7aeb91267f705c7080a87be5fe920135677d8b39b88da0568a0db173a0
SSDeep	1536:9VAA1TomlUi+2QWza5w7+5tYlNkd8uCxpLHCHunR/vrejZOCUA5luRKU:96A1T75vzaShNl3pLiHS5IRhcIU
ImpHash	-

C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	791d01947f92c9559f780722d49ed171
SHA1	e6f9ce5a0b0ba3538ec6e7b6088b8f6be4c02a8f
SHA256	5721e7dd7f90eecd5f6e8c699920dc3c063be850cf8d25441d47ae05570fd47d
SSDeep	1536:1Tx0W+jHS321BEJMu7DFF6Law/HgsDFILTh3UxB+hHU1yROTYL6d5b:1T+BHSGrE3DWLaw/JDQh3k+PRx6d9
ImpHash	-

C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	6c22a232257510be8b46559f3a92dffb
SHA1	afb76afc2bf573f694716e658925a21259b794b0
SHA256	adc07620326f121e312c62044018bce660cb9504a16a5abb924de01380ec37bc
SSDeep	1536:1/v5zAsLogmax2NfamauuDVrySWOflaYCStYcyzEwFeoQ5/QV:1/vhAsIHNQYUFCAYcxwHQ5s
ImpHash	-

C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	2de20b099ad45bb5e39dbdbaa39af10b
SHA1	63cb076dc567ecdc6ddd055397db8154ba9863ea
SHA256	7b17fbc10e2660f6f58cf2377faedb7329097812334849696d9015567d4d2976
SSDeep	1536:tWAFVMD3Xjt0G4vG5WqAvgT/5qGt0jls24zp2tfYMAyI8YNX3:pV0p0lxidSjlczUpYC8X3
ImpHash	-

C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	efdc9f20595386b74d951d1c82e9442e
SHA1	678e4a53cbd7e74c778f5647a70d60d9b2f0e7dd
SHA256	65b3dc47d00af86b74f67c526bf05c164dbc86c4d3a28c0652a2d35bf64f7cc1
SSDeep	1536:7qmP8oz9W1xa/zyyaHArWwZLIQmbPJqB+ZEU/1FZ28mBcPraF6:Comc/WZArWEIQmbP2+ZE6FZjDrac
ImpHash	-

C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	3bd6def1c5ebbeb3a980287dfa2feb6e
SHA1	82e87f86012fdc4dd2db6dda973c49c424caba09
SHA256	1d1cfea0f809d1b002d498ff28664b566c71b80d5a792980d8ed7480d0550372
SSDeep	1536:iTr6QrA06I74fHgSd3QiCVm4S6OFbvOrfUe:iTr6QrT6IUf7xQlmPhFKX
ImpHash	-

C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	80fe9a271de1261094e0e2b76db15311
SHA1	a26a643e9134a4c615b38c2246ce19a7a43e250f
SHA256	da3c39648d6b99477efa2945d57528cd78f54a2909efe1f785aaa650a17ace91
SSDeep	1536:mDpdlJm55XE/Kh6dqOIciCOp+kgYjTskebrEP6D59XEXTuXbOGYe:mVd3m5t16dqOvOpnjwkSrqECqXbYe
ImpHash	-

C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	6b5a54f6ad9b0192b691265d61a0ae15
SHA1	8ae768b6a641d9d104b7a65bd53b91c47110306c
SHA256	92cc8a394ac7e268e58f65264d5b2db16b30a11fff259a902d15f3c270b5c176
SSDeep	1536:czTC+9PKCPinDZ2aDxwSsi8iShxDJxDMPVLmX:yC+ZLPi12msGwBZX
ImpHash	-

C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	392d9e51388d15fe16ac5a360e1b44c1
SHA1	040b7f36942f6af769c3c66cc9609fefd1cd13e5
SHA256	00dbb0118fb5777352040c4a1cbc4d64e92058453f6b71e428a2c251a6a52e0c
SSDeep	1536:frythWyHqXNZMwOvrvMLTUELhMPahrrkSTm6yh/6I1QYeW4dXpnlTf:fIhWyHBTv8IELGPWf66yh/rQAgnlTf
ImpHash	-

C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	ad909e4ec8b8f5faee6840daf3f32dfd
SHA1	ef6dbe4cab216156458d17468fab8ce5feb45d4b
SHA256	851f594b3a62e0c2e8a23513714778080545b910418885f518fda7dcf5801bbc
SSDeep	1536:jV73xWWYcly8gPQzWCX5pecXjnWOObSNa6YUuRNHXB4Lc:j1BWRclyTo/GcbbnOHXSLc
ImpHash	-

C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	a2014bde82e066d525b26409bcfe5ce5
SHA1	5d1b4c083e08b05159331a8f3bd289267aa03e8c
SHA256	592509bd8790a7ee50aafd47b01f8ab0475d52d53c1851f77a4c950783a9239b
SSDeep	1536:pl862y4YBVpXizSiiFeH/j5wYx4jyciMXbmXOurpGLwt2mp2w1nZCwu2TaXiXFNL:f8/y97gNvxIAMrOoY2PEnZCeTI6NN1
ImpHash	-

C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	30d0e0b705945b7f84ea182f462c4f79
SHA1	48d45fe135410e91bd19f1f289f34823d0b79644
SHA256	f929f2dd01cb652a32839e1c82ce635d675653a1c6eacd325a765b98607221c5
SSDeep	1536:9eUr7iN2Ys2nAY8f19oVguV4fnOx+D5iSZDZSZz+ZLji+YipKahK/vMbT:kU/Im27O19o/VE9iqDwpIjiepKa4Ev
ImpHash	-

C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	1feac0ccd6283e0048899ac6879b556f
SHA1	c053bd2c6ba9fe2087966a51a24c8e4e186533a7
SHA256	c8b4d2fd51bde430c9621229a3d0f8a27a4a70e17520cd4bd50df014a1c9fc9e
SSDeep	1536:mgQYvHHexvgVuZNKjzNVH9Z+sY9TS2UpF1/18+:P/+xvgeAdVH7UTPUpFPt
ImpHash	-

C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	a62c2f30f05b90afa848a54ca9c9a59b
SHA1	1e132799edc186ef17c0680f28b1ee84d7cb9825
SHA256	25ee933cb617574204355d29a6d3a8e391bbc95aa176cbb71cd75d90e4954fe4
SSDeep	24576:6IAIaKLSJ8Hsu6luXy7RIRUXuDJpH0Qf8bQAnWfe1WAkbtgJd+7:ObKec6l3lIRUXuDJn8UCWfe6b2JI7
ImpHash	-

C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	20fbfabf6bc40f0e44d864c8e2bc753c
SHA1	fb6d32c2ab0ef98434ac11955ed655b2b1d0bdfa
SHA256	252b35faaf5a301f4cd1df4e8d94361cb492234be5933fd0ce39f1c5160a0413
SSDeep	1536:rZhFP0yqKbxUtbpbH1M0DlEL7SmCYlda1luJtLo2:thFsKbepbVM0ZELGmRHJl
ImpHash	-

C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	9991a033d14132e8fc278f13d5a7e2fc
SHA1	5c2700c7e590cf1cfbdb29d2a978ab8c53c25434
SHA256	39c870acaa9d2a46814f8d064c24b217ac20400568f11c66822aaf5e871aa7f6
SSDeep	1536:mJKDHGSDp94xC+ShDKHRdoM/YGwyEzugaHF0qdab8czDZSkUX+:mcDHGSF94xqhDmRdVpBfgaHFCb8czP4+
ImpHash	-

C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	ce1f5c6c3bb9398a998f99ae27b518c7
SHA1	690abd7ed7941c17228ca066711bd15b7bdaeebb
SHA256	3c3acd87edeecd427d9c6293fd80e200f9730744960a2d4cb1f486b4a2f73760
SSDeep	1536:3ufxk/ZZ4uRQ1uKC9I9U1sNo9mBaqXat+uzOXnym0HoDVGfm:epk/ZZ4u55I9U1sNoYaGaIXYcom
ImpHash	-

C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx (Modified File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	e8917d0e90c2890043283a19f152cbb9
SHA1	92d4127fcf710523866528086dc97a1634bb21c7
SHA256	ddbc44c9856153382d17ae98506b9151565493d0fb6dcc243ac8e02497527f44
SSDeep	24576:vgW5nHCQYHiCIFfMulT5njSL9MIdss+ieOM7R9H:JRCQYfAfM6Fjyp+imH
ImpHash	-

C:\Logs\Security.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Security.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	1.07 MB
MD5	5c35acdd238ff8f88482757bd22e1a44
SHA1	4706844ed30150844f80620d4b266561561f6037
SHA256	5f661eb528865524423beff0c91b1ed8491d72a292adb060449ff8fa56c93662
SSDeep	24576:uLjSNLpB9TCYTVGHAW0cX97jR7TKalD1tethQkNBDDQlgmxyFOY:u/qZRJuBtrlZtethRj4gmjY
ImpHash	-

C:\Logs\Setup.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Setup.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	3043bc41a6a72f195917e92723e70da5
SHA1	cee1554baa6fea147b3b166bae548683ca77eb55
SHA256	ea8bc43508031f417b46a6365a1d92e40370f53b3bc81ebd90d1e28acc2626a6
SSDeep	1536:2QPzEmuJzUJ4C+yviE0vvn6+GZHFkPxaB1masJD2CPyLatAfSJ36qou4d+5ZIyl:26IZCf6E0v/0kPkB1lCPyWWKJ940/1
ImpHash	-

C:\Logs\Windows PowerShell.evtx.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Windows PowerShell.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	a63948bde6a64dff4b5b01c33e4fb210
SHA1	23503ee09b597bf0a5e1a5ff71d0c50b4af56e70
SHA256	6713817e0c876882d051f4e7a226f67dbc1faad5d5d0ad531a16d0b3d5824230
SSDeep	1536:fg2sl5dMIqG4sdrOkYU3uN1X5LXxBcSN/hI2:fMl0G/dON6uz5LXbZI2
ImpHash	-

C:\Users\Default\NTUSER.DAT.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\Default\NTUSER.DAT (Modified File)
Mime Type	application/octet-stream
File Size	256.51 KB
MD5	f96fc1456665613f554c717946cbf31c
SHA1	4f8b1d92221acfa56cdfc9f5e36471fd37963882
SHA256	fb1a0433bbe14cbf483fa1da2568c7996a3515c1b736594b2af28aaddb309946
SSDeep	6144:x53TUa4XVqFX+MgdGR35t0LCWUzDUjeeAsROEKNNtNr:xb4XV2X+Fdit0WWOQjeeAXE8fNr
ImpHash	-

C:\Users\Default\NTUSER.DAT.LOG1.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\Default\NTUSER.DAT.LOG1 (Modified File)
Mime Type	application/octet-stream
File Size	24.51 KB
MD5	2d4ae81d7ea3da3d1af0a2025d8d0cfd
SHA1	5766b346dad0a74e88fad45dbc13e7a3bfc9a389
SHA256	ba7557c78f3e56d32abfb267dd704a7288230378a5fd25a1c1fd460e869aa7f6
SSDeep	768:9BYBYQvhZfymJIykkhs4JnyKMnlvRvk1/k:9CHvhZHCXkhsWnyHRVb
ImpHash	-

C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms

Modified File

Stream

Unknown

»

Also Known As	C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	512.51 KB
MD5	cf6ced664937b154fb06f1e700da8d30
SHA1	e3575ced8ef6a3d2e5cba1e865227697c36ddd53
SHA256	3f5efa10bfcf7a47f3c6c930dd2774a48f85d349bb06b3f7dac67a6fc93db9d0
SSDeep	12288:k7xdTOkMUTPOhd27DQZqOfZAMeJRdfWqipKmbMl9FRhxL:kHlMUE00qORrePdfWqrmCzRhxL
ImpHash	-

C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf (Modified File)
Mime Type	application/octet-stream
File Size	64.51 KB
MD5	30464964322f7efee2721482137e5a48
SHA1	813515a71db79e3a81f2ba0386e802d456f81f59
SHA256	826c110420d42885463c04c59423098c26965223554d0ae67bf743351d34d4b2
SSDeep	1536:TOXOBDcqYEw2J9UG0R5BIcRP1YoJKPPj+kdahB3srDeUQu5MQQHP:TOXOaqYEzSjRP1YoJWj+kYYOuaP
ImpHash	-

C:\Users\FD1HVy\Contacts\desktop.ini

Modified File

Stream

Unknown

»

Also Known As	C:\Users\FD1HVy\Contacts\desktop.ini.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	931 Bytes
MD5	f082f8e30d4bb117a7554ef8640c6647
SHA1	dfa565318b0a2bc11447c61ebacb1b187431e37e
SHA256	6c758c1436434bdef6173948930e3057731457cbd35557aa54edde938da813e5
SSDeep	24:Uc7PIFOmXPi9Mp6hilZIrRNEaKqirwsnKNdbr37:UcMoSaMpGiAhuws8X7
ImpHash	-

C:\Users\FD1HVy\Desktop\-57wLZ.rtf

Modified File

Stream

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\-57wLZ.rtf.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	71.12 KB
MD5	0d2f0a0ef929dc1328daa603beb0dcd0
SHA1	dda0111116b63f68ce5517f16f22cc43ff19e805
SHA256	7d2b7a0ea3e6b1d8c5a759721fed683e3b6ac05a080c74fe514ab64638085f26
SSDeep	1536:pAVKevpp/8ZxEPu0S0vO3+lCUOjh/yeatwyYrp9E5PwLW:sKevppEZxEPbvQAA/Otpy2B
ImpHash	-

C:\Users\FD1HVy\Desktop\03a8XaH-poJg.jpg

Modified File

Stream

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\03a8XaH-poJg.jpg.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	70.06 KB
MD5	9f71be1553227a89c86191027c87d0f2
SHA1	e351415c94cd5114a332fe77e9218c9ef0d57c7d
SHA256	3271110f6436c6326337c367bfcd7cb8a69b8ad2d6b020b2fe882385576ba30b
SSDeep	1536:f7SPJdVTNL23ZXXXJxwBSJwGFnrYk0jOd7fGxyXx0SefhPD:f7stTZcZSmnUmrGxyaVD
ImpHash	-

C:\Users\FD1HVy\Desktop\0Rq8AH.wav.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\0Rq8AH.wav (Modified File)
Mime Type	application/octet-stream
File Size	3.90 KB
MD5	b9eedce5ceffa6fa030edca68785222d
SHA1	fee65f716cd78859939d1bb619f36b1784754a8e
SHA256	a461bdf6ef7f4f8776fb95bb70c9a86611ac1cd2b03d015f89b4488fd38649dc
SSDeep	96:r0KJ3WKy1SuJurEqxiLv+s+nrfE8eDLvPxZ4j0NkGY:r0QGKy1SGTqx8+r0PxZc/
ImpHash	-

C:\Users\FD1HVy\Desktop\5C4shagLlRI5BsyQO7.avi.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\5C4shagLlRI5BsyQO7.avi (Modified File)
Mime Type	application/octet-stream
File Size	38.39 KB
MD5	c4d0ab7b8474c55f50ddededbcd157a6
SHA1	279c3b87b8dd07d50a5b176836b9499ea20df796
SHA256	65f629aa8b28eedb0f9197d84123ce794637e6e6dadc40a1ef92b6374846771c
SSDeep	768:nKMan/Awu8qFC30pF93iQnD3EpBtGLVy9ExgKl7mcz7:xa4uqFC3hO+fYnggBn
ImpHash	-

C:\Users\FD1HVy\Desktop\6CQ9noyTH3z3H5.flv.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\6CQ9noyTH3z3H5.flv (Modified File)
Mime Type	application/octet-stream
File Size	59.41 KB
MD5	a312b1c02bce0fc734ff93945f3c7ad9
SHA1	ad90c3197639e2ffffe91b0f137eeacd20044705
SHA256	c42e332ac33aedaea46716bf8174d6316f78fea109137ea4e6a16ca40b242862
SSDeep	1536:w8wPyxU1awEtNZTTK5HaW3BZZuIKd5oux:mFawEtDqASZIZoux
ImpHash	-

C:\Users\FD1HVy\Desktop\A3735y2rPZ.m4a

Modified File

Stream

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\A3735y2rPZ.m4a.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	52.77 KB
MD5	ecb0ac55b63d584c38455f561de8b615
SHA1	f1d696719c0e7c6d23fc61357b4ca0340899a2aa
SHA256	75ea18d5df9a31c5eb13734d4e1c480771fe376f33886beb9b3ba615195d5f6e
SSDeep	1536:XZh5/LUzPFHe+gRASO0G13MWKGhgs2yRgTkv9E:XD5/LUjF++gRAkG2WY6RgTki
ImpHash	-

C:\Users\FD1HVy\Desktop\EhMSntHa4AWWw_SjCQ.wav.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\EhMSntHa4AWWw_SjCQ.wav (Modified File)
Mime Type	application/octet-stream
File Size	78.49 KB
MD5	f2aa8fefda8e2515db7a0513cc2d9fb7
SHA1	b8a48b7affd648716eabd1b4c6ad2d97fc87db80
SHA256	26c5bab9f16dd89a089252c555a563ee9b2c06d7b5cd758f3ae5e241d27ff4b4
SSDeep	1536:2qr2QHNnCbOwvgj2D+nAqrhDHq4RHRG+Hy0GHaWOMwryNUCB:2nQtcOMD+A6pxHDWOMiyd
ImpHash	-

C:\Users\FD1HVy\Desktop\IO3lSyfQHV.docx

Modified File

Stream

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\IO3lSyfQHV.docx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	97.54 KB
MD5	ca7c545263fad6d42dd5137a1099d3b0
SHA1	1499c82ce87df8d4921e73537a9ab0b9c7e3a701
SHA256	18360839c9604228546f4951cdd211878a9340a910e36fb6834825a0faf75325
SSDeep	1536:bf9KQ+KnXrExD0MdlmQDqBqOiVEVOMjuw/kLdRUDbTcyY2UDXgruZ+CwaIKx:xIWFoMQmQORuw2dR2TcyY2UMr2+C9tx
ImpHash	-

C:\Users\FD1HVy\Desktop\MuoZgG.bmp.TRAPGET

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\MuoZgG.bmp (Modified File)
Mime Type	application/octet-stream
File Size	31.05 KB
MD5	82b6047609f54dee4144f4a2ca0efe56
SHA1	b441a358bff2eccb05874dcc70af86e2d1e6934f
SHA256	4769a5a7e53b201c46d02afaa5185136e25631e5d32521c84b9f23e0b2f86751
SSDeep	768:92mWDhDoTkzsCTiQLbUzkkdo42YAOAfcsoRoWQopTzuOyd9+:92mWD9oTkzsCGQLQ4klFA/kxIw
ImpHash	-

C:\Boot\it-IT\TRAPGET-INSTRUCTION.txt

Dropped File

Text

Unknown

»

Also Known As	C:\588bce7c90097ed212\1044\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Users\FD1HVy\Contacts\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1049\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\sk-SK\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Recovery\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Users\Default\Saved Games\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1031\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\3082\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1037\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\Client\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\nb-NO\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\pt-BR\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\tr-TR\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\Graphics\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Users\Default\Documents\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1042\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\pt-PT\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\en-GB\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1053\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Users\Default\Videos\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\en-US\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\sl-SI\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1032\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Users\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Users\Default\Downloads\TRAPGET-INSTRUCTION.txt (Dropped File) C:\PerfLogs\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\zh-TW\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\bg-BG\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Users\Default\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1055\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Users\Default.migrated\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\et-EE\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Users\Default.migrated\Documents\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\sv-SE\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Users\Default\Music\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\da-DK\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\zh-HK\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1035\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\2070\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Recovery\Logs\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\Resources\en-US\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\ru-RU\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\ja-JP\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\nl-NL\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\es-ES\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\lv-LV\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\Resources\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1028\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\ko-KR\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\lt-LT\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\qps-ploc\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\hr-HR\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\es-MX\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1041\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1040\TRAPGET-INSTRUCTION.txt (Dropped File) C:\$GetCurrent\Logs\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\fr-FR\TRAPGET-INSTRUCTION.txt (Dropped File) C:\$GetCurrent\SafeOS\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1046\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\Fonts\TRAPGET-INSTRUCTION.txt (Dropped File) C:\ESD\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\ro-RO\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\3076\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Users\Default\Desktop\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Users\Default\Pictures\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Users\Default\Links\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1043\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\cs-CZ\TRAPGET-INSTRUCTION.txt (Dropped File) C:\$GetCurrent\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\el-GR\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\hu-HU\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\sr-Latn-RS\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\2052\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\fr-CA\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\pl-PL\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Users\FD1HVy\Desktop\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\de-DE\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1038\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1033\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1036\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1029\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1045\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Users\Default\Favorites\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Users\FD1HVy\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1030\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Logs\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\1025\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\fi-FI\TRAPGET-INSTRUCTION.txt (Dropped File) C:\588bce7c90097ed212\Extended\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\uk-UA\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\sr-Latn-CS\TRAPGET-INSTRUCTION.txt (Dropped File) C:\Boot\zh-CN\TRAPGET-INSTRUCTION.txt (Dropped File)
Mime Type	text/plain
File Size	1.10 KB
MD5	1bb14cbec1de0baf6ea64324fb5db1fa
SHA1	fc8910312e51887890669e5d63c20f916b51e908
SHA256	270290884343cfc330501a84b81c9af60d25334195232b4de103a52c4f517ac9
SSDeep	24:lAR4BxRtFaoVwFEd1AdL9OWNSGAYWlYmT:Sq95RWN1AYWlYmT
ImpHash	-

C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log (Modified File)
Mime Type	application/octet-stream
File Size	559 Bytes
MD5	6561e4f0eaaf7b4f3aeb5aaf4281f1bb
SHA1	4857a385c2dc9a313c1476e1665b6302c8cd222b
SHA256	d095c925e383b7920e569d166884eb8181ffd72ed03596a0560c2f6db7237dec
SSDeep	12:ys4PaLX/Vssgk+vmZ7tfViZRlhiR8CxEY6ynnz6JV07L7bTt:CaLds3mZ7tfVi9q3xl6ynuJV07L7l
ImpHash	-

C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log (Modified File)
Mime Type	application/octet-stream
File Size	42.18 KB
MD5	d697c807a403380946358d74ef607642
SHA1	a7e86e2e88ca616f93028970572bd29473613ff9
SHA256	0e9c4c549fcb1f4262fcdf8051bb1b5762b61930be4785747534556da9c1d153
SSDeep	768:FOB3Pku2h+MaQw0qA/5FT99M/N5ua5OHGKQIllCeQvrT:gB3PkxaQHqeh99MLFilQI3irT
ImpHash	-

C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log (Modified File)
Mime Type	application/octet-stream
File Size	6.37 KB
MD5	684d0347d4a0b25e039793f1dc6433d7
SHA1	7504fb4d6af3034755d3ef145c4192ca1c6a3bb5
SHA256	98d0973223ad6105424f52fe3511ffde9e024ad023640c2564b0b601cb8b3774
SSDeep	192:tWvhdfgAzy2AtFnA++5mYTvg/i7EwybmWQ9yukf0:tWJdU2At5A++xmi7EhyWPc
ImpHash	-

C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.TRAPGET

Dropped File

Batch

Not Queried

»

Also Known As	C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd (Modified File)
Mime Type	application/x-bat
File Size	1.07 KB
MD5	01389bcade6b3ed1f9f941445ca2d2a9
SHA1	01139ec084c07c48c40fb9ce8d9222de25350b8c
SHA256	806dffd90e60ec9da0a71f80a10fec0bf02d51e46d0235db1ab41edbf94491f7
SSDeep	24:cRf81M66MlXs2u+AyNHuw9/J4DhfS1WYNQsjKF9A62QQu6k1CEpz:PuMlXs87j9OD5YYF9T2QQLEpz
ImpHash	-

C:\588bce7c90097ed212\1025\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1025\eula.rtf.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	7.90 KB
MD5	f82af1e65d6199af2d4b169589a3ca97
SHA1	d83c893ad39074b5cda19bbb5a4ac99cf0590f9d
SHA256	7618654be31b9f09a3a514d8f79a55f06bfbde60516726f0f91f1dab601d673b
SSDeep	192:XbCLd9XuEmZLxbqTQQgWqwcqq30b2jYf5uIJRGw9zcA6WdC4d:Lc9+dZLxbIXfqwcqDao5J9zRd3d
ImpHash	-

C:\588bce7c90097ed212\1030\eula.rtf.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1030\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	3.74 KB
MD5	52ecde8cd069f3541f9f50db229cefc3
SHA1	522802d6cab3432d93b7717a55c99df3588842b0
SHA256	4c0191cf56b94b7598343a63947b2b6cf188eacf422288483a9ebd066e746aca
SSDeep	96:9gmLWZUYkNRidkkrwmXMAnphEsQL+MLps8P3s:GmLlMfjXv7EsxU3s
ImpHash	-

C:\588bce7c90097ed212\1031\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1031\eula.rtf.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	3.85 KB
MD5	0d0c89a8e860eb640f6bd68e8aa848d7
SHA1	c5813098a90e53ebe90eb668fe8a0416aff57d3b
SHA256	f1f4106b72fe1a3b94028a66a2a6c207a5d629dbd1d75bfc87c01f06f8e7a21a
SSDeep	96:JyXTr6rGZXs8P3rB850yLtrIeObP+Kfl0Qb+TjD0zi:JofDZc8d853LKeomKd0QSTjDV
ImpHash	-

C:\588bce7c90097ed212\1035\LocalizedData.xml.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1035\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	75.72 KB
MD5	1bb22b6e57e6952170e57ac62c515547
SHA1	25f0817c0badb4b52002eaaf4b694bbe06a968ea
SHA256	5ed115af5b7b6980b7c034eed3806ebc3433812ab0ba4904511cdf4b827b81db
SSDeep	1536:w9CU/C4t+Y/1B5P93GeycPLr4RQQUQLjZmmBnDMOxkHBvNfvvvBDg:w9CUKgtL5tG7cPL0RlUQLtmeD3kHzXvK
ImpHash	-

C:\588bce7c90097ed212\1036\LocalizedData.xml.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1036\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	81.52 KB
MD5	41d0b3c0110d0b4b33e83ae09ef37346
SHA1	abc5f639ca62a9a21eb0b64e3e926f3f759063b9
SHA256	5d852dba9b763ddd152f99b72b1815a8bfcf47635ba151473799ff50ce710128
SSDeep	1536:OZbSbJ0S+dEd7jRhXwyy1JxK/AFGTeBeV0KuRQeyik:OZbSb3+dEdxhAX1JxK/AOekaKuR/yik
ImpHash	-

C:\588bce7c90097ed212\1042\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1042\eula.rtf.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	12.90 KB
MD5	468cac94fa9f83dec9e081a570416cc7
SHA1	9e532d4be48ecd820c180bd8af57977a6e563631
SHA256	a388781d4cbeda1d960a0a71e26047daf1a371aa2b776ecd66dade26b512ba32
SSDeep	384:ic8Mxt71OugJOvR7+aZ/HYET2P8UzqXLD:iBQP+aR4ET2PDqXP
ImpHash	-

C:\588bce7c90097ed212\1045\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1045\LocalizedData.xml.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	80.95 KB
MD5	02498b08b91102e40bf054a570210f53
SHA1	7e7b22ca3527b3e972064fb2f7f07c9e6e4e6eed
SHA256	c70faf4c7d783ab8414873225711eca0cf6068394fedb4047a7aa9d0b2431a55
SSDeep	1536:n1wAW1F1K+Je/Rs5l06W45w0V25TYsDFS6ezya4P7CgSdtvZvmr4Udk:1wZ1z5lxQwCHFZuyDP78v9ck
ImpHash	-

C:\588bce7c90097ed212\1046\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1046\LocalizedData.xml.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	79.35 KB
MD5	b1fa40bd3b5d2b5a2c9e17628dd89d39
SHA1	bb3a6e75b70c526a42973a2058aaaf91ce0cdd01
SHA256	90cb0e9dc1f729a2f87795fc1de036b282cc87c1f19beb00b6450b08b89f40aa
SSDeep	1536:iiE6xvRqZpEwIvFK4HRT5uaIshcrZtrUwmi5Lr86Sa95b0naBhq6Z/ihJmo4rAEx:VdRqZ2JoERT5uaJh4trUw7l86n0qhVZ3
ImpHash	-

C:\588bce7c90097ed212\1046\eula.rtf.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1046\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	4.10 KB
MD5	a74ba0f20a88c2d944ac64d88a440007
SHA1	92f513ad361d0cc04934b98cf624bb3871f3fb20
SHA256	193681950edecc7f8b5803eec252cb5352c1883c4e0578daac61a92c6fab9f20
SSDeep	96:mP54Dp68WOLD6IB5xNxQS4WETcjtiGud+KlhXEg:mx4DpEYB5NxQikcur
ImpHash	-

C:\588bce7c90097ed212\1055\eula.rtf.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\1055\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	4.28 KB
MD5	a5f7e63425172ab60933af47aaa6aa2c
SHA1	70aa186c31c24d8352b6cb2fa66e1d8dde1bb4b2
SHA256	2dbeddfce5fee05c88d771154c0c71cabd963771f2ac73f7cea4ca592219d383
SSDeep	96:N3f0qX3kznIktaZJXur5ylrVzhgYk8Tcm6B25Cw4Gv5:Nh3qnDSJA5YrVzuYk2cjBdw4GR
ImpHash	-

C:\588bce7c90097ed212\2052\LocalizedData.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\2052\LocalizedData.xml.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	59.77 KB
MD5	002297f6a290bfea878283c0c107a9f6
SHA1	f74146e5df8c7a01c76432c0cd4ac3ee602b8b10
SHA256	19302b846730afc7258d2700b28c890277ff6f9e07748f70f29043dcd1069b08
SSDeep	1536:D4Nm/yg7B642shpNA+m9HBKOll2IDnYBEWo5Etf+8vKVbGyVXbGA:D4NWy+2shgT9bBaol7bGuT
ImpHash	-

C:\588bce7c90097ed212\2070\LocalizedData.xml.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\2070\LocalizedData.xml (Modified File)
Mime Type	application/octet-stream
File Size	78.88 KB
MD5	6283b1911bcb50022864133bc53bfdde
SHA1	94040eff58985f00f7f86c7cc32cd03650e5c651
SHA256	bfd1e047cc868aabed3a6e00f4bd422f35cec78018d9ef65f5671d8e2465d6bb
SSDeep	1536:uDV81hZVMkbqtdxFXZx0t8WJh1P3OLDN97F+VrvHuF53G3nU2Fjpw8idQ2:g81h/MkbqjEtphp+LZf+VrWL3CrFFw8o
ImpHash	-

C:\588bce7c90097ed212\2070\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\2070\eula.rtf.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	4.43 KB
MD5	04b32d314d7964036e7c32d727980e5d
SHA1	361890af7c7814915d1f4b41d8b318b82b4e59db
SHA256	a77b0104c903b77ae0c8fccddab687fc5bea531d56f2a4bafe7ba4ce868c0280
SSDeep	96:BNdvuvfjFDXAsgbVzQPnABC5MJ5qaFVOmEgVdB8Pu/Lhcodw:1WnjFDXAsrYbJkazODgVdMujhcoW
ImpHash	-

C:\588bce7c90097ed212\3076\eula.rtf.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\3076\eula.rtf (Modified File)
Mime Type	application/octet-stream
File Size	6.67 KB
MD5	acfcf0259a33d187ab4bb947d8788d0d
SHA1	566baf563427e5d59e51076db6e2801e2ad67c64
SHA256	d87a0a33835a2285fdedc58324b288db55cf78400e46f592caf6e2e2c3dd5c2c
SSDeep	96:Bvv0h8Zd0CXiL57WLZ3R/OpNJx0OthgJwxMGVslT61mbgfUi65uhzuB2wXFtfd1M:lMh8j0CC5itR/GqkMNB6wbBi0F9A96Ej
ImpHash	-

C:\588bce7c90097ed212\3082\eula.rtf

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\3082\eula.rtf.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	3.50 KB
MD5	4769e4cdd628c1850f993b9d4197e085
SHA1	ba14ec8b18d3e3db378218310c632446cba8ba81
SHA256	15473ef7b61374f253f7751a9e5cda9ca12cebf163fd37d3e49fe2dac793a529
SSDeep	48:VHqKGn/bMvF9c0P8/xhRlgSpz6TvJ1/ytV/XOLEKfSUlVSnG/xZxfna0SeKjfZm8:VKdMET3JpWT/sMLEKKygCZxfaVd1Z
ImpHash	-

C:\588bce7c90097ed212\DisplayIcon.ico.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\DisplayIcon.ico (Modified File)
Mime Type	application/octet-stream
File Size	86.96 KB
MD5	5a817308a043e1a59aacfa68e98a7cf7
SHA1	166776bab794311090daee098f1ae3487326ae20
SHA256	871a64ad9779e7ea242e664e7498d39eaeacbdaac3e168631d988713fa3c2b29
SSDeep	1536:De6gqXaM9bJ5nfBAZshd6fu2BDyR9bVRWQ+C1VPhICE0KRFpmTCGTiDUE7KS:DjXaMtxBAOqu2BWR9SQ+CPSSK9PGTioG
ImpHash	-

C:\588bce7c90097ed212\Graphics\Rotate2.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate2.ico.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	1.38 KB
MD5	96501b6a4bb521563226d949816cb4d5
SHA1	a330037a8d30b0b7673275021e805194642a11a6
SHA256	852b0d0d31616741944f77588742525df8942c6b2352b9bf0bad2388e0f56de5
SSDeep	24:Q70MlBZ9bFLEg5AEHn3M5Cvh1pkDIewXty+VA7CSgNK7FlNpTfMGyxWSHuV:20WBZ9bFJXHHvhtnXE7SK7HTf8xWSHg
ImpHash	-

C:\588bce7c90097ed212\Graphics\Rotate3.ico.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate3.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.38 KB
MD5	ffda9297ecefe20e315a7cf7e53c95c3
SHA1	54f0f408eb567372c7386f5fb5863bf8aac72535
SHA256	b84c23857b6e899a49ed8bf0dd50e6b3d7c31f89fad66a11de655bdaa665e790
SSDeep	24:enoQo0Y/Q46ys9pUl1HEO8M0C1TK24w0NynJVbCP4X74NPEIwaPiubVn9chIF7Qo:enoQowymkHEfC1TO/ONX7eNwaPiubwSv
ImpHash	-

C:\588bce7c90097ed212\Graphics\Rotate4.ico.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Rotate4.ico (Modified File)
Mime Type	application/octet-stream
File Size	1.38 KB
MD5	c8c8257f39bc3685b64532bccf6a91a1
SHA1	ba82a0fa079baff8995d901606616d6e9189f750
SHA256	82847b73436529ae8620f95e3d30a06970d1d6eb8cb4e9af1a957c9707bdc1f5
SSDeep	24:nR4VoQGPLZUlMWx+OV2ZbZOlOsAAhHk+IpdiugaevpNM5O4F:NQGTZIM2+sAUOsAApk+Ipd57DZF
ImpHash	-

C:\588bce7c90097ed212\Graphics\Setup.ico.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\Setup.ico (Modified File)
Mime Type	application/octet-stream
File Size	36.36 KB
MD5	c6d7394bbb29a4c9b5774c83061e9fba
SHA1	3c4006ac3898fcf772777078dd70660df7b28f28
SHA256	15d405257385fc988be7db24d94d91760b158bd262c7d795442b3f005ff5c91b
SSDeep	768:UHIP+5VgRp5Xtg0J/0EiYWo7/OqzGPqMBkcN765yhwZ0+6:8T5VgRXR0nYLOqFszpwyhweJ
ImpHash	-

C:\588bce7c90097ed212\Graphics\SysReqMet.ico

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Graphics\SysReqMet.ico.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	1.63 KB
MD5	ebede31b5765d1225fb0519738f99109
SHA1	786c5a00fc0ae6dbb593a1cdf2338a7640bf5ed0
SHA256	b4973457363a4fd10e7c4327b5882901efa77d59a194fef6f050e2029374293a
SSDeep	48:10/VteDn92aUiHWqlzWdYlKM/77NfXjNJw3AlR4H:u/VtgNWqdWKKM/HNfXj7w3As
ImpHash	-

C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu (Modified File)
Mime Type	application/octet-stream
File Size	4.96 MB
MD5	21f315b3cf4b03306ffcfad37120cda3
SHA1	cdb58e8a40173966264f93cf0d7b78526729f392
SHA256	e86d897b4ee18e4f860caecf1d369f6b68ae9a3896b817540d7cba6a76ff86b0
SSDeep	98304:iouUD9sjLvhRv+BkNSZxUKn+L8EVJHi6k7QHzOKJhla:v36LH+BkNI2Kn+L8yJHi6kvKzla
ImpHash	-

C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu

Modified File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	4.86 MB
MD5	09d438dd2db3d4ed0bc297389fb83822
SHA1	b2d30da6cfc3aef1eb1ef5c249e9bedc764a7c2c
SHA256	66b5af9ea8ccf422db17671cf836cfdd6e0124ad63cbde5220f61f80d02bc742
SSDeep	98304:pe4N5UdE06gj/BNUBH+fHCdlFqqCKUVkBpHua/KUKcs3DKVDK6rCD:Q4L5gKBHGidl32VkB1iKFKm2
ImpHash	-

C:\588bce7c90097ed212\header.bmp.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\header.bmp (Modified File)
Mime Type	application/octet-stream
File Size	4.05 KB
MD5	ea3814ef6fd55fb22925c1e49fce5211
SHA1	b8021588a5f0c96538f7d6398c196f0c6f9b0e16
SHA256	9c51fb17779e4bdf43dc9bfff2b3276c822b90ef0a098903c5cd0f7523539bac
SSDeep	96:dJVeyjkVYueV8tpn3JbMi4HLyW9y+A9xVMcW+9tYgg2vILP7gHMKe:xeYV8/ZMi8Lyv9xVNWyYgg2wuA
ImpHash	-

C:\588bce7c90097ed212\netfx_Core.mzz.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\netfx_Core.mzz (Modified File)
Mime Type	application/octet-stream
File Size	173.08 MB
MD5	f0bf6cea576d5e41417a6462b3490a97
SHA1	7420fb3461b5b1d3be1eff4df75df39fbdd7ae0b
SHA256	57d4c823e0391dcc7d9d3576a93171a1f2297da259ec3e0f28081774852cda9a
SSDeep	196608:j54XWSuJ3HdtGTh35wiKJKoglTr53F8FpePoz+zGsgRgivqAwy59fl6:jpSqHIh36IoaTr5V8Bz+qRZ6
ImpHash	-

C:\588bce7c90097ed212\netfx_Extended_x86.msi.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\588bce7c90097ed212\netfx_Extended_x86.msi (Modified File)
Mime Type	application/octet-stream
File Size	484.51 KB
MD5	d130493f415dfaa1e1b9753de0e72dc5
SHA1	68fe6f85c91670b36197c0a44fabc61ddb6948d4
SHA256	2626f59a774e1557ee457375f7a2ec5a7802a57184d18a538aa13336aeac475e
SSDeep	12288:3IWq2TilUWig8bSW4tB9lofwyJnkRNf4gWToIaZUeFepOQl:SzlRig8bH4tB9UwynOggYVaZvLQl
ImpHash	-

C:\Boot\BOOTSTAT.DAT.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\Boot\BOOTSTAT.DAT (Modified File)
Mime Type	application/octet-stream
File Size	64.51 KB
MD5	d854aedc25e68bb31a73cc807ed50817
SHA1	40925325b83fddaf7dc572d75e23acec775e9fec
SHA256	3d00579cb9e66b3944112a22c68bdc4150e73b6755c47bdfd8980cbd7d3205b8
SSDeep	1536:zI+bXa8tQZaIhkScogH2t0z+ti2Y7GXtT47pXhZyYgOe:zDXHWjcLyHYaXt07t7Lhe
ImpHash	-

C:\Logs\Application.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Application.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	217584522d0a2f1a75a4198585865357
SHA1	aad7de7829b3026cdff60d2c398a2fbf7624f0ac
SHA256	c8cb745d18f9c6d19bfdc4275630e6d38e6cc125df07ae942a4126d1d0d37a80
SSDeep	1536:rBTR4i5bx3nOVGZxWekS4mFr6jyA3zw+G9Bl+b2zBBvFqH:9TRFWqVkTDjyADw97XzztA
ImpHash	-

C:\Logs\Internet Explorer.evtx.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Internet Explorer.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	713ac874f041435a24e36371d1e316fe
SHA1	eab10d9df833d47d96459f048b9f20adcaf1dd9e
SHA256	9a3fc409e2b889c5ddba79d0a17383dcfd054f05621acc3cbb2718e0e593d680
SSDeep	1536:uf0c1+I+SgEvzl6EyYgMExCEKghr/ugPc81H:ufb+I+7EvZ6EElRhrvU81H
ImpHash	-

C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	91339c7f909d3ab2fbfb42c8d87dc232
SHA1	e39df3dc5303656788cf86758a95b50bd7fc43c9
SHA256	e84901a0bbc3baf811a085b685127ea5113088fefbffc64cefcb839c620ec45b
SSDeep	1536:iJ5EHUyFShTf4Pq2QcrR+F7vnFEuj5RwnDgfPk0b+Ga+ck:iJ5E0yFscy2HK7vFZjKAaGYk
ImpHash	-

C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	3348a34218dfaa4b1284e850bd853135
SHA1	8f7b6c8feac072cdc40793c2a8aeae65d0f8c8fc
SHA256	87dc9b65f8c5448a6959511140095986da4d759f329646da8344a1a2381b3507
SSDeep	1536:s9jP8wSCvhczBQ2Yq7DjrLXflQmuz1lndOctLY3CuR3zTmcAyVrKEHf3WVQz/CBF:sxPYK2zBbfLXfSmqPztLYrXmReR3WAKz
ImpHash	-

C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	4582c43b680719701b720741d55c001f
SHA1	665cafc0bd366b8e4b2e9effdae2775e9d9f6a1b
SHA256	894199a4dea3163faf806f91a477cd706d20c6ab686bf179775fcfbb72ce1c20
SSDeep	1536:0xLY+M73j3B9YVpwCA6+zK4yRajmSpKM3wekLBN:cM7T3yfLWK4TmS4mpk3
ImpHash	-

C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	e2ca9203189c10db7551556b0920bdc8
SHA1	8bbd1f6c10078f63b14401413b9badfe50edaa5d
SHA256	dab461e3bc68d617f3557bcc57e61d516218df72f6aaffe7be7d4f00193dbd86
SSDeep	24576:qHFzoi3W0cEtqF7mYdxceNb7Y3M5XS+1z3oOeXoP:Qzo8dEFXdfb7cqCY3neYP
ImpHash	-

C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	60b9c4086f4499eb6e22fabaab45344e
SHA1	a159efe79eb17e4e091d0f0e17a24d8e7aa40951
SHA256	97037d5f371157f01308725a246fe94c2f00bfc872ce765131edcbb4d49a53c2
SSDeep	1536:JqdzmMY9NuEO61/6ENEqr+M3IO+y6gl1iFi0pvRe9yE76VS9Cb5jxUx:cmFz63qr+BO+yxeFn89YTPI
ImpHash	-

C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	fba164993f6d826d4896d6a3ab2fb5c9
SHA1	d6b741ca21155af56bbcf4cf9020a3c69d52d3ac
SHA256	7cb058673a56d462f61be5675a0d55b123828a0bafaac4b9266ed135aaeb2b91
SSDeep	1536:daNSxNINtYnZmS5hmuqJWZLJbbp53YM85st879sKf+j8uH+ihZ/T7tCK:d2EIN+UhWZ13psOHXD3/PtCK
ImpHash	-

C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	b4050ad51897b9875cc989942d431a85
SHA1	7e852f97c91b288087ac9e1d5c6f58fce491aef7
SHA256	3b1b0bebc3af512c78cfd976ad17454b57eab59ac7c5f67da15d508ed5f7f633
SSDeep	1536:0MAWtMYWDMR1vapFDsnssRNF2dw3FiZdJ2uY9iyTXm5R85B4Y5id+2Uz8VnQcR:ZAAefDsJuw30DMuyT2yWYnJYVnpR
ImpHash	-

C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	9258e830cb25e2d71bd70c624889bc6e
SHA1	361010b0399fa93cb5d28076a5a2f762a442b1ee
SHA256	6e60a422a1e41bba8b9c752ef83faba80b0e46b0d01a87aae1f877d573a56205
SSDeep	24576:Znf0SZtSirkt3HfjePhET7BgmZnARinwBOrboP10IJ:Zn8SPGtTARinwBpvJ
ImpHash	-

C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	1283d25e2a375b8998f5c7cfe224ea93
SHA1	e79f3c6b237f3f01e7124ecf4b46fe956cbeaf6c
SHA256	f72dcb2725185c12e6749702a46f80ab90c1d900ec1ea326527ce019a05a864a
SSDeep	1536:A9HVUZQPBJoWxDsX/lOitScwLbzYKRBKMEOiQwMrVjrnFJvy:AhVcQkCsPlOitvwLbzY+4fOiqJ7zvy
ImpHash	-

C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	2cabe359c2d3a0827415db929ee544e6
SHA1	dfa1506cba0ecab18db5b6bcb33adf4e7a420799
SHA256	af76ad701047a093ce914e20019a735ac03f33d07134b9071163816816169806
SSDeep	1536:nI04RT/B1eURgG/qVnqNDaPyr1L+DKegFfZaoghY:nI0w5yVqNThfZwC
ImpHash	-

C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	20c809d0d8650e2fd1157ef60784e866
SHA1	6ae6c473705b9dde4028135a184542beb6f2b451
SHA256	9ac14cb5e9bb01111084c5cd36abcbf8a3777d4fdcf404298b03aa8980f23104
SSDeep	1536:/bCkwmkOLD4OJVSQ1z69FPgZB1qpRgEe1euNkR3FlPCx95qS7Gm:jCkwUJVSQJEFeBIpRie2E2KS7L
ImpHash	-

C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx (Modified File)
Mime Type	application/octet-stream
File Size	1.00 MB
MD5	1de97c0b52616fbd4fa056968b28eccc
SHA1	cd5e156e9618b1149bfd49b6c54514b207e780ba
SHA256	8e1a64b8a2b06b70f709b4b5ec4f0e1d6a7f30b0a8320b57388ebc87703b404e
SSDeep	24576:OuqkIDWROvE19d2SYO+bahTcZ89p4wnN+BbkTAuZfWjv+1XC:vqkIDaOvin29fbaSZPPbkTErKC
ImpHash	-

C:\Logs\Microsoft-Windows-Store%4Operational.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-Store%4Operational.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	a458d3e892075d2646b0d3a019d110bb
SHA1	9cd435112337080a0b07185d4a0c48b412912c48
SHA256	09568eb144128f54e5d3711dc6fbad55d193c5ddd938ff5cca684b9567459cbd
SSDeep	1536:wdNv01IBkj9pRxSSp+w2/3DxBb3e4VdQO7uCAQvtwmHTkjzpV5Hu:wXv0npRnpq9Bze+uMwmHTIpVxu
ImpHash	-

C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	8f676a76236f36ce6d0ca2b22ff5ab37
SHA1	e010f2193e468d31ae9df4325c0815afcadd507e
SHA256	c3d02b2ea00d9593133c54df373bd136bf8424e32ec1e2ce227bb98b77a7c30c
SSDeep	1536:/d1SSMOdd7RUtDUm1Eh3Xl3rsFjW1xh21xHB0hUFTr93Qj2qBF/d:CSMOC9U+EXbsFixh21tBOU79yl
ImpHash	-

C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	52a6b5e3feb573bdc7a39e17e91d5a60
SHA1	9be53136836e3e935dcf900e0fdf17906bda4f49
SHA256	a617c6bd56869497acd45254ff2c028ea255dd3fe644aaa27fe5b9198d014478
SSDeep	1536:ey0T7FN8NGX7B5MVwPZMEinPqBcZ9D/3pA4eoRaPzEb:10T7QNGX7B12yGZF/5lNaPzw
ImpHash	-

C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	f702670613e755782d30fd617a831943
SHA1	bfcc68fe1a6fcb9f39a8f47290435781578400f5
SHA256	924bf806027f3a09253e8441d89500b4ebf55c8a74600c0390470d5eb0e5372a
SSDeep	1536:u1udBKdPmHxZyKBQhsmlr5IJW/kl7KCUlkMRmJqR004orIhFSBAlGbqu1u3XyzL:u17sOKBQdlr6JW/kuJR6qRtKrlcY3Xy/
ImpHash	-

C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx

Modified File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	fd1826cdc067d977afb6aaed93c48463
SHA1	30ced2c8a693c496352d1b41190e24f47f82abdb
SHA256	8ef46d257ecde1d95412fecd07b3790e8b55b80dd1f2633e790aa0ad0eb15abd
SSDeep	1536:7HgMeFup+9cO9t3DxYFTpBZTtg9vZHyAn6Rfug:b49BFEpBZaV8S0ug
ImpHash	-

C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx (Modified File)
Mime Type	application/octet-stream
File Size	68.51 KB
MD5	84df97f6ea74b085f31dfe9cca53330a
SHA1	28b7daf7d97844b8270a04e34dec0a4d293b9c2b
SHA256	870bef921f2230c9ecf78db274c03d83451aff1f2573e40a4eee695aafc6be28
SSDeep	1536:638mHuXM0TvqQKdlWLnxQWpxDzh9Q7+p4PB:+0HF2kTrvhW7+w
ImpHash	-

C:\Logs\System.evtx.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\Logs\System.evtx (Modified File)
Mime Type	application/octet-stream
File Size	1.07 MB
MD5	b3b5c46d460c35dc6912cba8d729b29f
SHA1	fa4964ad86d0fab5ade88ea2649b59bdf957dc54
SHA256	fa4cb0a4a4c079e99670cd83495a8c66fbf81b6d5dc67ef0c331c902a46ce2b6
SSDeep	24576:GOgjC3qEXlEzGQXsOT/dR+uR4vdO5t9ves:PgKCddXRh5Lr
ImpHash	-

C:\Recovery\ReAgentOld.xml.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\Recovery\ReAgentOld.xml (Modified File)
Mime Type	application/octet-stream
File Size	1.49 KB
MD5	c39ec52aa7a62cbb31a8e6b062195b26
SHA1	f8559fdcbdab8f15d4cbac3a42ead5699ab1e008
SHA256	3e4d4c36b72f1f6ae6c5bf0916baa0a45150a1e432220e71da98c6e14377bada
SSDeep	24:xD/Gh7dKdEXuSil9iA0eWCoFs95zwQ1JPaMCTcvkgAgv6W2r98YYJtV7f+q5fea:xD/GhOE+1u30o2twQ1JPapcvkg9yYttl
ImpHash	-

C:\Users\Default\NTUSER.DAT.LOG2.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\Default\NTUSER.DAT.LOG2 (Modified File)
Mime Type	application/octet-stream
File Size	20.51 KB
MD5	eadaa35c0b5bc49b7d6eafc6eea1fdfb
SHA1	50fba323a27967310b98163ffe6a31332e24dcda
SHA256	1dc870e0108b63556d1fc925a65735db602ec653b18d3a09de0fa3c7c532d3b1
SSDeep	384:gLsQNcxq7e4T1hUlUdBA98duULyw3MW3eo9g6FAEgrAEVkor+OYJjfwI:4sQu4lhU2BAtQMRovFYcE+
ImpHash	-

C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf (Modified File)
Mime Type	application/octet-stream
File Size	64.51 KB
MD5	1320dbf7a9b269789b7b3dab1a5ea53f
SHA1	f3791561efced1e8a688cdfcc3b8ff0e318bde23
SHA256	3fd9fad9b33232a02ca7b15767549bfaee5c9e2f0c1aa81ffe5ccdea00be88ae
SSDeep	1536:eHmWcwExOJGPGz7cTXrY05UXeUbMOjrtyaTrR8FOvk/QgiY:ewOvU7rTUuUfNTmViY
ImpHash	-

C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	512.51 KB
MD5	9278b97e186b9ac7f8018e1a4326ecde
SHA1	1d1c1357b730d8f17177969132e2695187fa22c9
SHA256	3a76e0435b395fdb6fb37185f2d6638762b70dc94336f833d4f00369176b2123
SSDeep	12288:9/IbD4tKMupeV8Gfo9eknUPyBxR4NSWtwfurUW:g48ZeV8ONkUy143UW
ImpHash	-

C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	512.51 KB
MD5	b322990833c3142019dd7887fe103a58
SHA1	475922205117f478caf275dd0bf8318b4e508c07
SHA256	4086d0e9c16d5dc09b01133353f7ec2332e0a5a0aebacf80d44efb712e8d65a6
SSDeep	12288:hUP+rj0F/i1al+PgbgBgZc9qOJ47RaYHRP1ooqOF:hUPe0Fq1xqgCcgOC7RFRUC
ImpHash	-

C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	512.51 KB
MD5	600bb26fab38331dae142a16e4370706
SHA1	d6f5f491f1f86a5a5bb6cb0652e96d13f00b3a49
SHA256	2b68f904a92ecc0ab6298127aa27b909051b9001db13df7148644927b669ba74
SSDeep	12288:40mhBV3LF+M4reD/EDZqcmlMofX62gP5apMp:hGBxFireDsyMotehp
ImpHash	-

C:\Users\FD1HVy\Desktop\-PlQwM2uVxE9sfoqk6h3.jpg.TRAPGET

Dropped File

Stream

Not Queried

»

Also Known As	C:\Users\FD1HVy\Desktop\-PlQwM2uVxE9sfoqk6h3.jpg (Modified File)
Mime Type	application/octet-stream
File Size	5.71 KB
MD5	f65464a7135e29423467224ae815a15f
SHA1	c185e1054a156a7d68369aa69970c26b81e73e45
SHA256	cfed000bf7732f9994fbd07267b08aa3aa8482c30958beddc0ab4f4ffaa26d28
SSDeep	96:dUmiqLz+mdhfOMitQBuW4zRiP3kpTLRud7BF/MXTxr7uiHUo4Co1d9VTC9lGT:Wmji6Oftm4ViP05Rud9F/ITxpUo49G9A
ImpHash	-

C:\Users\FD1HVy\Desktop\1HazNLYr657481KVf_zV.mp3

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\FD1HVy\Desktop\1HazNLYr657481KVf_zV.mp3.TRAPGET (Dropped File)
Mime Type	application/octet-stream
File Size	45.73 KB
MD5	df7f50da7d4f264d75fca88492459d94
SHA1	732109d7f48028b41b7f785ad7b59ab4bfa56796
SHA256	93c998f34845dde77ed4998a76af86ede48726c21061e16b4cb92f1ca1a8ad3a
SSDeep	768:XWEmDM9Egc6pAPEsPRMqvr+XOb0avTWo+TqL6XhOCIlddWhcZTkD2cODE3VCu:BmDM9Nc6pzsPRMir++4do+T2UmpcOg3L
ImpHash	-

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After