1e0db9aa...5b94

C:\Users\CIiHmnxMn6Ps\Desktop\Desktop Ransomware.exe

Sample File

Binary

Blacklisted

»

Mime Type	application/x-dosexec
File Size	808.00 KB
MD5	c013c2911340d6d29325254cf72d4e42
SHA1	cc3e91352814e1d2bfedea08dd0f85d2fe6e2385
SHA256	1e0db9aae4b512fed223e566d6a7baf6c149e252d276f30037a990fb7c325b94
SSDeep	24576:IRgIUCjBq+W+PYIs35VFUY4HZ8H6oD7QGV:Yq0G+9s35VFC4cG
ImpHash	f34d5f2d4577ed6d9ceec516c1f5a744
Parser Error Remark	Static analyzer was unable to completely parse the analyzed file

File Reputation Information

»

Severity	Blacklisted
First Seen	2018-10-23 11:07 (UTC+2)
Last Seen	2018-10-30 18:15 (UTC+1)
Names	Win32.Trojan.Kryptik
Families	Kryptik
Classification	Trojan

PE Information

»

Image Base	0x400000
Entry Point	0x4bf9fe
Size Of Code	0xbdc00
Size Of Initialized Data	0xc000
File Type	executable
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2018-10-22 18:30:07+00:00

Version Information (8)

»

Assembly Version	1.0.0.0
LegalCopyright	Copyright © 2018
InternalName	Desktop Ransomware.exe
FileVersion	1.0.0.0
ProductName	Desktop Ransomware
ProductVersion	1.0.0.0
FileDescription	Desktop Ransomware
OriginalFilename	Desktop Ransomware.exe

Sections (4)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x402000	0xbda04	0xbdc00	0x400	cnt_code, mem_execute, mem_read	7.74
.rsrc	0x4c0000	0x600	0x600	0xbe000	cnt_initialized_data, mem_read	4.03
.reloc	0x4c2000	0xc	0x200	0xbe600	cnt_initialized_data, mem_discardable, mem_read	0.08
Ms0c5FQi	0x4c4000	0xb728	0xb800	0xbe800	cnt_initialized_data, mem_read	7.54

Imports (1)

»

mscoree.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
_CorExeMain	0x0	0x402000	0xbf9cc	0xbddcc	0x0

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.DlhsKoDumMDb.bmp

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	89.91 KB
MD5	b3877521b2befaaeed42eafee857507c
SHA1	def6b44422630d725d4b32cbf27ea239ffab07d9
SHA256	863254cbe699888687ab1d02385a0c3c7bcdff2ad31fb6b46dccecb1ad459760
SSDeep	1536:/ZkIuCsG9PGzUpYvTSCnmJQILhobvqdRATRlB1ZAxnYUsb8:RkIuaKt2MEQIN9gFr1Sxiw

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.uQdlphYG1dbqk1.jpg

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	70.86 KB
MD5	2ae565171a26dea1b3590e053ed467cf
SHA1	2d90e577661599ac505f4be0c904e1bad0d0aed4
SHA256	6532c6dfbdb8f38893ba38f5de0e6a28e086e4994be1444b3aab7614c192636f
SSDeep	1536:O6F3mB02b80vLZFTnTVn12GykYEsGcHW78d9dYHsOMH5UQmj:rFN2HvzTTVnWEspy+w

C:\Users\CIIHMN~1\AppData\Local\Temp\ueiephm

Created File

Text

Unknown

»

Mime Type	text/plain
File Size	7.35 KB
MD5	4d201336419143ade64b63767eaad1be
SHA1	a960a2e56476d2a4ef744b88167bf1b6a2e976b2
SHA256	62e59456694f3fbe2f83735d73b7cd7d90c4ad33716cbf6dd526c424dd230c58
SSDeep	192:nv1fbgy1j/FhwI8yFk/DL0N0x1LGrGXmLr+rK/:tjgyV/1

C:\Users\CIiHmnxMn6Ps\Documents/Lock.e4YsgwXPFnJ1eF_aq_.rtf

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	90.59 KB
MD5	a29d2f6abd67fcf5718c20ac802ee632
SHA1	b99bd40169965b53e5f72b2214c95ff8dcc928a1
SHA256	5ebfb5eb72b078fb2e8f487ae28633a607c87f8e53a03f497273f617e31c18b7
SSDeep	1536:fnAssYjtciNZax9rkgP5MrBHVMPXZsCzJFrBUL2JQrxYuED6DMSUJCh2trg3ihh/:fAtYai/Y97mpG7VFr7J2KD6BwCgt0C/

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.dCV6-VAR1Amz0.mp4

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.80 KB
MD5	e65cfd7126b21bb9e4ed6fd52f8218f7
SHA1	56d12eed50b8b65a626d88786b25c3a6aac0e6b6
SHA256	e998fa5da054b0cb81eab345c6207e7767d2dfaf8a2ccba1776d9ada0763f4c1
SSDeep	24:LbxMhMTHMd0egMQQk2eiE2leb2qpkOJ+pSTkgxSLcH4um26WHarD1SOUfZ7LYuv6:LCmQQiEUeb2okOJESQfgHo26Sn7Hs

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.R0bpFAwwI.xls

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	40.78 KB
MD5	a873837e1cc6e76da3d7a7854c850412
SHA1	137fc0608a076e7e0cc0e0169e82e12d1fec755c
SHA256	fb7aed3b69233974bf3cdd03384bda4637a9206ab0baca7d2b2ff17a6b2af397
SSDeep	768:xpCfw/DPAztt9UdFlLReu8gLmIUghFW+TXwv9qeBbTg8IVvVKw5CqW:xkI7s/CFl1eu80mIANAubTv09bCqW

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.SeOV2qpgcHWHh_nbqI.mp3

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	40.55 KB
MD5	3ea69d26347f04f5a8a43b1ff0327e6e
SHA1	2835c1292874855921e30a48bc1c14421771a260
SHA256	414838c1b266b82b315d4df6a6fba1b80b5bcaa09f6599ea2065e7c9b8bb16d4
SSDeep	768:Oj0ezuUZ3k9odRxegntsMjxa2fd5SZWos/iU4stl1tNwQXSlsub:YX70HgtVlNF5SwoqiU4st//XmN

C:\Users\CIiHmnxMn6Ps\Documents/Lock.VgQS p2zoBtKpHSKB.docx

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	49.02 KB
MD5	9481f05d394807fcc22313d3538306f1
SHA1	ece8f2fde6578039905083976a8d52a3502a9f05
SHA256	ab5407f68e3fca5f6ebece0c3fa68f1d35ad6a17c20beda426849afb3dd00d4c
SSDeep	1536:Vl3hufmBfmE8by1apOm5zpQEW38On2O5D:0fm5f8QP8On2CD

C:\Users\CIiHmnxMn6Ps\Pictures/Lock.pCRiuz4PFsi5.png

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	82.95 KB
MD5	418fc4eab222f7c2f4dac612f8e5b71e
SHA1	5736b261a903881f4a594c6f0ea1fadb508b11b2
SHA256	7ecca217e64de0e3406533670776cf0ced6c89f04f2fe89297438ba17ecdd686
SSDeep	1536:JBfsuqxwZlCDjPXEjF8CxadNNemTT6LLtjsse166VLbTYEzaJVps:PfsuXCDjP0jFx4jxSLLtj+66VjYEz2ps

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.z0fFK_swV0a.wav

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	68.63 KB
MD5	32ea28c325fb074e4ddd62026cda89a4
SHA1	79d6867695bfd5808191a2d57d807eef38991714
SHA256	99e315b85a002e05286540168ca3cd9761cf5bd022166c37cdfcdffd229f3692
SSDeep	1536:vQyYbnIOG0vwyrhxrTKEiB8xxelbh0bvALrFGQMolJUnhYR5ThHM:dYPG0vfVxrTwAelOboLoRKJUnh6ts

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.SBImy.wav

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	97.45 KB
MD5	effd4e5092c6923b3cd1beaca11bca9d
SHA1	d90d0afadc73c7d8e7aab13c98437ade17b09b5c
SHA256	0fcf5cb0b99eaaef1bf0cfa7d56050d89961071f000cc29634c8303b39210480
SSDeep	3072:xaXjVYXCy7tGl612bwgPPNfa4JSk/SF56:uj6bg2edfa8O56

C:\Users\CIiHmnxMn6Ps\Videos/Lock.5VHrP.avi

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	36.27 KB
MD5	8a6b721beb27f97c5d4e8fa5a45284c5
SHA1	fd9966b0c2717ed649b23c7252644006f88fcef5
SHA256	ac3f2fb9f4d0804f5702f032f020650f4ca24c9118882728572d583c883c93e6
SSDeep	768:kvaRVO5vmZ75PEwOiXgF4Dnoy+uVJVXYLjFOPTwyO8Z:ZXO5u55zOwgF4DsuVXcFOPMyO8Z

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.e5GfWHYXYvLZf4xlvH.odt

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	52.27 KB
MD5	e2b407dd9b604da7b714ee0f340c290d
SHA1	a98ee6e07c89d0e18f06d12cb2205877d325ff81
SHA256	f1a51379fe0486e3795cf60e3e6f9e47b4f55c06ef4e6abf0dd8eb93a2b0273d
SSDeep	768:Q61j39wQPsz42jdeFO6bFm8MlPGcuSgMFweTPyFVu2SlKqcldEa8Ml7CdjK:Q6xtTs8yGZSgMFwYKzKMqZaVlWZK

C:\Users\Public\Videos/Lock.desktop.ini

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	0.38 KB
MD5	1266a4ab23e5f2bb48db47c0ad3a391c
SHA1	8a3c979136b0432c9291d5dbe25cf5a9c1bc043b
SHA256	7ff02fe5fdd24624fb413f493ecb593606663dac00382a7a0e12303bd45a7ae9
SSDeep	6:x/unJ6ZESn4iPU+HID8/KOv9CwdRgZ/6xDhyPlrt45UxnDmOY+FfzFqrQxhNeEof:x/YcZ74iPoQKG9CwdRgZ/qDhyAaiCzFs

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.7NLT7b7.bmp

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	62.46 KB
MD5	b8c7d59fe8061970cc7ef7d8abbd5fef
SHA1	ed44909867439fb2af5fd7db54838060bfa9b46e
SHA256	9c4d7387ef0d78ebcd4466e1630390a00c4e3a88e0956aabdf6eace549e99fd6
SSDeep	1536:Naownp1orPCUDMD2kRsXVvYeQiBCTmay7Cd3YdFOv5v:Na3p1or6wkRsXVavTmT630ON

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.gj X79Jxk-e2.mp3

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	28.48 KB
MD5	be835ec41d43d19eb2c9f32a821ba034
SHA1	dc1b764e29c9956ff9425aac5e70cde00e109ece
SHA256	6bf34f8dd4a568f7e93c23ba9f13336df22be7fc393ca5115bc0b1a30a4167d7
SSDeep	768:+Qsm1eH4kmgVtw47jCNqAOLXGhsr1FbyrcwhwL:ym1e/JgOOqA0GqXbIcwCL

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.VowNGbAt2Uc.flv

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	95.70 KB
MD5	5ee5cee50e329af145873879da55f924
SHA1	9cf5db98608102b4e8f684bc252c786e103eecf7
SHA256	04ac837fd5907dd6b0629ab327eee4e4f46103cbf7d4b7c9ed21f620a2245cb1
SSDeep	1536:4cA6phMOObbxiAAdxJZc3fSl9hfdImgN2oCOCRgDcsv1tzemdAu0f0/wK90CauOG:4cAGwiACxJHpfqmu2nOC6L9lepPfpgAG

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.v_rOYmuVae.mkv

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	4.84 KB
MD5	23a84c8d571f5089240ee3512c01539b
SHA1	b23517c88c13fe7f613a6f19ebff63f8f27c5bbf
SHA256	6197b2612dccb1856f87380be328f3b948f4de38b6d7ac87a279eed2d254d303
SSDeep	96:ltfVKAXn7QkczSRDv1do78+trf76U5650VCfdiRq:dKqcSDv1uw+AU5650VCfr

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.miHZX-Mq6_uJj5Jr.bmp

Created File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	31.97 KB
MD5	7062d17dc0879a2a853b89e89e5b8fad
SHA1	721241c7217fb2847393d4d64ed1b1f78c33ddbb
SHA256	d8913d545eab40184174323798f68d86e2c674e3a7a974e20da15f302ba65b97
SSDeep	768:MP07wNIsdU4/me/hsI0y8s70d2l9iTJeLK9G6ppHM9:F7wNIqUqmPs7I2l9u1M9

C:\Users\CIiHmnxMn6Ps\Pictures/Lock.SHgyDm0.gif

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	72.32 KB
MD5	3234964574b362cb813d85a181ab819f
SHA1	921e4ff33ca26ce2f47d186a67fb7e293028055b
SHA256	4b1296ca5738dd03a0a47298530c10e794514d17389dd70895a9e61c8844173d
SSDeep	1536:fECS4NQWCa75J5TJzYyRsDH+x+nsHnpDiwbnu0iYfs0IL1iXbe:fq4Nz9J5FTck+sHpOwbliYfkgy

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.md9DYhuwlzuJ4s.bmp

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	93.30 KB
MD5	39236a6ad3667c29f35307866ff9352b
SHA1	50ee2ed74d4d1b6ed6421f83f0f4e65023c0a3e6
SHA256	8185ac71fa8d90589947457ddaa1c1f7644602f07f92eb3db19187db3aa27354
SSDeep	1536:cjkgWwRpz3tPisNx+Qah9+SYDKEVhfTIe6Esh4oywHPgCTLkNCf9GWMr9gB1:ukJwDz3tbNx+fh9+S+5IefsDpTI0GWEC

C:\Users\CIiHmnxMn6Ps\Videos/Lock.desktop.ini

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.50 KB
MD5	ba8e16029d84e8959d9562cb2032d9bf
SHA1	b2953e85caaeca1257522b2efcbec4c0937b20da
SHA256	e78630bba56447930624526c839eeb26fa8192df0f97ddd5115fbf630dc2eeb0
SSDeep	12:x/YcZ74iPoQKG9ChqkxEWGx/rb0l4iLNnO91lo:xwA71FCAdf5rM/

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.J_D_Smy7X3HCRMT CH6x.mkv

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	4.23 KB
MD5	b40694223fac355c1d8f1c404079e419
SHA1	621f3b455148de7784cca4d731b31723272e778d
SHA256	003164581aec1e44f746cc8d82f72e15e603963d2dec6fc11abe2db274311d39
SSDeep	96:lMLpQR3bpVt/D4EMFyvkS2GCBG3QKrB7qDFRpGbZS/fwLC:0QVbpVx0nmlrBkPgc/n

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.LvpXw5odR.mkv

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	75.86 KB
MD5	a3e4bb0e803e6a38999c2e6f6e4a9dc2
SHA1	cec31e7efd8d805b17c7fbed8080b91e40bfe796
SHA256	d5a275c4fc3757baf0fa8a1ff4be85dc1e72f34c369f168d6af65eba3fa395f8
SSDeep	1536:kpYxxVXvjHj3SmDxYOEQH9laghUX21w3m8AUfioUkAvqSe7eioMYT+4OHQIoD:dvvX3SAx33H9IGUXx3mvUqoUVJKPoMYX

C:\Users\CIiHmnxMn6Ps\Pictures/Lock.WNoBJk6u3i.bmp

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	76.58 KB
MD5	2cde6e29404fbea9516274f0f7ce63c8
SHA1	52f883a8550cab7398c7fa9eadb0130d73581085
SHA256	c8b896abaa3750f56853536e0cb61c745186cdb75bf433f41066c86acaf7dfd1
SSDeep	1536:OWRsij42hdp9CQQHmqo+vxiO29s27FxHcHWK/x9NPdrWHbReORVLLmxMZ1B:Fr5hd76Gq7iO+sUSWK/HrGeORlL8gB

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.8irUlxoryz9NBEdK.gif

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	83.17 KB
MD5	94557a6fe456d6c47237d125faaf725a
SHA1	c3443cbe4aa1515ed762ea5a9405e0050de96d02
SHA256	d6296b97bac62984b610aae09db79e2e8ddeff5ddc637ec110364250011371e8
SSDeep	1536:dLn0upjDhl+xaY2D6nCAZKv/ENLKg/xhDMalhCQ8555mwSSVTOqUW9strgA5UAM1:dLnTDeiDgA/Iv/xhDvlhCQM5ARw9stl0

C:\Users\CIiHmnxMn6Ps\Videos/Lock.ctEdCOQfNgS.avi

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	13.52 KB
MD5	fccc8ec9522a7ffa8e46dd2e2d487610
SHA1	d1c57da0e7fe612c1c2cc447ec2748f7c85665a3
SHA256	cac6d28f769aac00e5b1f2e243abe7205cebbc4ac01371b91018b7e30f867d97
SSDeep	384:Zbr6kj7b31eWtz4BzCVjggCaz954quVV3xxb:ZbGiNtz4B+tf95ENb

C:\Users\CIiHmnxMn6Ps\Pictures/Lock.desktop.ini

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.50 KB
MD5	82d46e91be16a17eb99f24cac1768f01
SHA1	d1cd482829c5e89d764a36af5db3b23535b0d8f0
SHA256	cb4e93277081095bdbd95f8bd745a80700689bc25483259ae9d970a2c72f076e
SSDeep	12:x/YcZ74iPoQKG9CuF/+Pih/a63DCoDSr3xGFUZ4ppWpo4:xwA71FCi4iVn32oDskFUZQpW64

C:\Users\CIiHmnxMn6Ps\AppData\Local\TempCHHKSM.exe

Created File

Binary

Not Queried

»

Mime Type	application/x-dosexec
File Size	826.10 KB
MD5	3c7218b6316b04c210ae1487433585b0
SHA1	da0dcfe4d9cd2887d99b93cff3adbbefb8540ec7
SHA256	9ebcc96babc5f7bd5873181e84a7de7fef57d2554ebaf286307b78ec8d99deed
SSDeep	12288:ghkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a73oPzJe0/t1k5iEBta:oRmJkcoQricOIQxiZY1iaDobdt1STo
ImpHash	d3bf8a7746a8d1ee8f6e5960c3f69378

PE Information

»

Image Base	0x400000
Entry Point	0x4165c1
Size Of Code	0x80800
Size Of Initialized Data	0x1dc00
File Type	executable
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2012-01-29 21:32:28+00:00

Version Information (3)

»

CompiledScript	AutoIt v3 Script: 3, 3, 8, 1
FileVersion	3, 3, 8, 1
FileDescription	-

Sections (4)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x8061c	0x80800	0x400	cnt_code, mem_execute, mem_read	6.68
.rdata	0x482000	0xdfc0	0xe000	0x80c00	cnt_initialized_data, mem_read	4.8
.data	0x490000	0x1a758	0x6800	0x8ec00	cnt_initialized_data, mem_read, mem_write	2.15
.rsrc	0x4ab000	0xd0c8	0xd200	0x95400	cnt_initialized_data, mem_read	6.31

Imports (16)

»

WSOCK32.dll (22)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
__WSAFDIsSet	0x97	0x482794	0x8dd04	0x8c904	-
setsockopt	0x15	0x482798	0x8dd08	0x8c908	-
ntohs	0xf	0x48279c	0x8dd0c	0x8c90c	-
recvfrom	0x11	0x4827a0	0x8dd10	0x8c910	-
sendto	0x14	0x4827a4	0x8dd14	0x8c914	-
htons	0x9	0x4827a8	0x8dd18	0x8c918	-
select	0x12	0x4827ac	0x8dd1c	0x8c91c	-
listen	0xd	0x4827b0	0x8dd20	0x8c920	-
WSAStartup	0x73	0x4827b4	0x8dd24	0x8c924	-
bind	0x2	0x4827b8	0x8dd28	0x8c928	-
closesocket	0x3	0x4827bc	0x8dd2c	0x8c92c	-
connect	0x4	0x4827c0	0x8dd30	0x8c930	-
socket	0x17	0x4827c4	0x8dd34	0x8c934	-
send	0x13	0x4827c8	0x8dd38	0x8c938	-
WSACleanup	0x74	0x4827cc	0x8dd3c	0x8c93c	-
ioctlsocket	0xa	0x4827d0	0x8dd40	0x8c940	-
accept	0x1	0x4827d4	0x8dd44	0x8c944	-
WSAGetLastError	0x6f	0x4827d8	0x8dd48	0x8c948	-
inet_addr	0xb	0x4827dc	0x8dd4c	0x8c94c	-
gethostbyname	0x34	0x4827e0	0x8dd50	0x8c950	-
gethostname	0x39	0x4827e4	0x8dd54	0x8c954	-
recv	0x10	0x4827e8	0x8dd58	0x8c958	-

VERSION.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
VerQueryValueW	0x0	0x482738	0x8dca8	0x8c8a8	0xe
GetFileVersionInfoW	0x0	0x48273c	0x8dcac	0x8c8ac	0x6
GetFileVersionInfoSizeW	0x0	0x482740	0x8dcb0	0x8c8b0	0x5

WINMM.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
timeGetTime	0x0	0x482784	0x8dcf4	0x8c8f4	0x94
waveOutSetVolume	0x0	0x482788	0x8dcf8	0x8c8f8	0xbb
mciSendStringW	0x0	0x48278c	0x8dcfc	0x8c8fc	0x32

COMCTL32.dll (11)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ImageList_Remove	0x0	0x48208c	0x8d5fc	0x8c1fc	0x6d
ImageList_SetDragCursorImage	0x0	0x482090	0x8d600	0x8c200	0x72
ImageList_BeginDrag	0x0	0x482094	0x8d604	0x8c204	0x50
ImageList_DragEnter	0x0	0x482098	0x8d608	0x8c208	0x56
ImageList_DragLeave	0x0	0x48209c	0x8d60c	0x8c20c	0x57
ImageList_EndDrag	0x0	0x4820a0	0x8d610	0x8c210	0x5e
ImageList_DragMove	0x0	0x4820a4	0x8d614	0x8c214	0x58
ImageList_ReplaceIcon	0x0	0x4820a8	0x8d618	0x8c218	0x6f
ImageList_Create	0x0	0x4820ac	0x8d61c	0x8c21c	0x53
InitCommonControlsEx	0x0	0x4820b0	0x8d620	0x8c220	0x7b
ImageList_Destroy	0x0	0x4820b4	0x8d624	0x8c224	0x54

MPR.dll (4)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WNetCancelConnection2W	0x0	0x4823d8	0x8d948	0x8c548	0xc
WNetGetConnectionW	0x0	0x4823dc	0x8d94c	0x8c54c	0x24
WNetAddConnection2W	0x0	0x4823e0	0x8d950	0x8c550	0x6
WNetUseConnectionW	0x0	0x4823e4	0x8d954	0x8c554	0x49

WININET.dll (14)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
InternetReadFile	0x0	0x482748	0x8dcb8	0x8c8b8	0x9f
InternetCloseHandle	0x0	0x48274c	0x8dcbc	0x8c8bc	0x6b
InternetOpenW	0x0	0x482750	0x8dcc0	0x8c8c0	0x9a
InternetSetOptionW	0x0	0x482754	0x8dcc4	0x8c8c4	0xaf
InternetCrackUrlW	0x0	0x482758	0x8dcc8	0x8c8c8	0x74
HttpQueryInfoW	0x0	0x48275c	0x8dccc	0x8c8cc	0x5a
InternetConnectW	0x0	0x482760	0x8dcd0	0x8c8d0	0x72
HttpOpenRequestW	0x0	0x482764	0x8dcd4	0x8c8d4	0x58
HttpSendRequestW	0x0	0x482768	0x8dcd8	0x8c8d8	0x5e
FtpOpenFileW	0x0	0x48276c	0x8dcdc	0x8c8dc	0x35
FtpGetFileSize	0x0	0x482770	0x8dce0	0x8c8e0	0x32
InternetOpenUrlW	0x0	0x482774	0x8dce4	0x8c8e4	0x99
InternetQueryOptionW	0x0	0x482778	0x8dce8	0x8c8e8	0x9e
InternetQueryDataAvailable	0x0	0x48277c	0x8dcec	0x8c8ec	0x9b

PSAPI.DLL (4)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
EnumProcesses	0x0	0x482450	0x8d9c0	0x8c5c0	0x6
GetModuleBaseNameW	0x0	0x482454	0x8d9c4	0x8c5c4	0xe
GetProcessMemoryInfo	0x0	0x482458	0x8d9c8	0x8c5c8	0x15
EnumProcessModules	0x0	0x48245c	0x8d9cc	0x8c5cc	0x4

USERENV.dll (4)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CreateEnvironmentBlock	0x0	0x482724	0x8dc94	0x8c894	0x0
DestroyEnvironmentBlock	0x0	0x482728	0x8dc98	0x8c898	0x4
UnloadUserProfile	0x0	0x48272c	0x8dc9c	0x8c89c	0x2c
LoadUserProfileW	0x0	0x482730	0x8dca0	0x8c8a0	0x21

KERNEL32.dll (159)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
HeapAlloc	0x0	0x482158	0x8d6c8	0x8c2c8	0x2cb
Sleep	0x0	0x48215c	0x8d6cc	0x8c2cc	0x4b2
GetCurrentThreadId	0x0	0x482160	0x8d6d0	0x8c2d0	0x1c5
RaiseException	0x0	0x482164	0x8d6d4	0x8c2d4	0x3b1
MulDiv	0x0	0x482168	0x8d6d8	0x8c2d8	0x366
GetVersionExW	0x0	0x48216c	0x8d6dc	0x8c2dc	0x2a4
GetSystemInfo	0x0	0x482170	0x8d6e0	0x8c2e0	0x273
InterlockedIncrement	0x0	0x482174	0x8d6e4	0x8c2e4	0x2ef
InterlockedDecrement	0x0	0x482178	0x8d6e8	0x8c2e8	0x2eb
WideCharToMultiByte	0x0	0x48217c	0x8d6ec	0x8c2ec	0x511
lstrcpyW	0x0	0x482180	0x8d6f0	0x8c2f0	0x548
MultiByteToWideChar	0x0	0x482184	0x8d6f4	0x8c2f4	0x367
lstrlenW	0x0	0x482188	0x8d6f8	0x8c2f8	0x54e
lstrcmpiW	0x0	0x48218c	0x8d6fc	0x8c2fc	0x545
GetModuleHandleW	0x0	0x482190	0x8d700	0x8c300	0x218
QueryPerformanceCounter	0x0	0x482194	0x8d704	0x8c304	0x3a7
VirtualFreeEx	0x0	0x482198	0x8d708	0x8c308	0x4ed
OpenProcess	0x0	0x48219c	0x8d70c	0x8c30c	0x380
VirtualAllocEx	0x0	0x4821a0	0x8d710	0x8c310	0x4ea
WriteProcessMemory	0x0	0x4821a4	0x8d714	0x8c314	0x52e
ReadProcessMemory	0x0	0x4821a8	0x8d718	0x8c318	0x3c3
CreateFileW	0x0	0x4821ac	0x8d71c	0x8c31c	0x8f
SetFilePointerEx	0x0	0x4821b0	0x8d720	0x8c320	0x467
ReadFile	0x0	0x4821b4	0x8d724	0x8c324	0x3c0
WriteFile	0x0	0x4821b8	0x8d728	0x8c328	0x525
FlushFileBuffers	0x0	0x4821bc	0x8d72c	0x8c32c	0x157
TerminateProcess	0x0	0x4821c0	0x8d730	0x8c330	0x4c0
CreateToolhelp32Snapshot	0x0	0x4821c4	0x8d734	0x8c334	0xbe
Process32FirstW	0x0	0x4821c8	0x8d738	0x8c338	0x396
Process32NextW	0x0	0x4821cc	0x8d73c	0x8c33c	0x398
SetFileTime	0x0	0x4821d0	0x8d740	0x8c340	0x46a
GetFileAttributesW	0x0	0x4821d4	0x8d744	0x8c344	0x1ea
FindFirstFileW	0x0	0x4821d8	0x8d748	0x8c348	0x139
FindClose	0x0	0x4821dc	0x8d74c	0x8c34c	0x12e
DeleteFileW	0x0	0x4821e0	0x8d750	0x8c350	0xd6
FindNextFileW	0x0	0x4821e4	0x8d754	0x8c354	0x145
MoveFileW	0x0	0x4821e8	0x8d758	0x8c358	0x363
CopyFileW	0x0	0x4821ec	0x8d75c	0x8c35c	0x75
CreateDirectoryW	0x0	0x4821f0	0x8d760	0x8c360	0x81
RemoveDirectoryW	0x0	0x4821f4	0x8d764	0x8c364	0x403
GetProcessHeap	0x0	0x4821f8	0x8d768	0x8c368	0x24a
QueryPerformanceFrequency	0x0	0x4821fc	0x8d76c	0x8c36c	0x3a8
FindResourceW	0x0	0x482200	0x8d770	0x8c370	0x14e
LoadResource	0x0	0x482204	0x8d774	0x8c374	0x341
LockResource	0x0	0x482208	0x8d778	0x8c378	0x354
SizeofResource	0x0	0x48220c	0x8d77c	0x8c37c	0x4b1
EnumResourceNamesW	0x0	0x482210	0x8d780	0x8c380	0x102
OutputDebugStringW	0x0	0x482214	0x8d784	0x8c384	0x38a
GetLocalTime	0x0	0x482218	0x8d788	0x8c388	0x203
CompareStringW	0x0	0x48221c	0x8d78c	0x8c38c	0x64
DeleteCriticalSection	0x0	0x482220	0x8d790	0x8c390	0xd1
EnterCriticalSection	0x0	0x482224	0x8d794	0x8c394	0xee
LeaveCriticalSection	0x0	0x482228	0x8d798	0x8c398	0x339
InitializeCriticalSectionAndSpinCount	0x0	0x48222c	0x8d79c	0x8c39c	0x2e3
GetStdHandle	0x0	0x482230	0x8d7a0	0x8c3a0	0x264
CreatePipe	0x0	0x482234	0x8d7a4	0x8c3a4	0xa1
InterlockedExchange	0x0	0x482238	0x8d7a8	0x8c3a8	0x2ec
TerminateThread	0x0	0x48223c	0x8d7ac	0x8c3ac	0x4c1
GetTempPathW	0x0	0x482240	0x8d7b0	0x8c3b0	0x285
GetTempFileNameW	0x0	0x482244	0x8d7b4	0x8c3b4	0x283
VirtualFree	0x0	0x482248	0x8d7b8	0x8c3b8	0x4ec
FormatMessageW	0x0	0x48224c	0x8d7bc	0x8c3bc	0x15e
GetExitCodeProcess	0x0	0x482250	0x8d7c0	0x8c3c0	0x1df
SetErrorMode	0x0	0x482254	0x8d7c4	0x8c3c4	0x458
GetPrivateProfileStringW	0x0	0x482258	0x8d7c8	0x8c3c8	0x242
WritePrivateProfileStringW	0x0	0x48225c	0x8d7cc	0x8c3cc	0x52b
GetPrivateProfileSectionW	0x0	0x482260	0x8d7d0	0x8c3d0	0x240
WritePrivateProfileSectionW	0x0	0x482264	0x8d7d4	0x8c3d4	0x529
GetPrivateProfileSectionNamesW	0x0	0x482268	0x8d7d8	0x8c3d8	0x23f
FileTimeToLocalFileTime	0x0	0x48226c	0x8d7dc	0x8c3dc	0x124
FileTimeToSystemTime	0x0	0x482270	0x8d7e0	0x8c3e0	0x125
SystemTimeToFileTime	0x0	0x482274	0x8d7e4	0x8c3e4	0x4bd
LocalFileTimeToFileTime	0x0	0x482278	0x8d7e8	0x8c3e8	0x346
GetDriveTypeW	0x0	0x48227c	0x8d7ec	0x8c3ec	0x1d3
GetDiskFreeSpaceExW	0x0	0x482280	0x8d7f0	0x8c3f0	0x1ce
GetDiskFreeSpaceW	0x0	0x482284	0x8d7f4	0x8c3f4	0x1cf
GetVolumeInformationW	0x0	0x482288	0x8d7f8	0x8c3f8	0x2a7
SetVolumeLabelW	0x0	0x48228c	0x8d7fc	0x8c3fc	0x4a9
CreateHardLinkW	0x0	0x482290	0x8d800	0x8c400	0x93
DeviceIoControl	0x0	0x482294	0x8d804	0x8c404	0xdd
SetFileAttributesW	0x0	0x482298	0x8d808	0x8c408	0x461
GetShortPathNameW	0x0	0x48229c	0x8d80c	0x8c40c	0x261
CreateEventW	0x0	0x4822a0	0x8d810	0x8c410	0x85
SetEvent	0x0	0x4822a4	0x8d814	0x8c414	0x459
GetEnvironmentVariableW	0x0	0x4822a8	0x8d818	0x8c418	0x1dc
SetEnvironmentVariableW	0x0	0x4822ac	0x8d81c	0x8c41c	0x457
GlobalLock	0x0	0x4822b0	0x8d820	0x8c420	0x2be
GlobalUnlock	0x0	0x4822b4	0x8d824	0x8c424	0x2c5
GlobalAlloc	0x0	0x4822b8	0x8d828	0x8c428	0x2b3
GetFileSize	0x0	0x4822bc	0x8d82c	0x8c42c	0x1f0
GlobalFree	0x0	0x4822c0	0x8d830	0x8c430	0x2ba
GlobalMemoryStatusEx	0x0	0x4822c4	0x8d834	0x8c434	0x2c0
Beep	0x0	0x4822c8	0x8d838	0x8c438	0x36
GetSystemDirectoryW	0x0	0x4822cc	0x8d83c	0x8c43c	0x270
GetComputerNameW	0x0	0x4822d0	0x8d840	0x8c440	0x18f
GetWindowsDirectoryW	0x0	0x4822d4	0x8d844	0x8c444	0x2af
GetCurrentProcessId	0x0	0x4822d8	0x8d848	0x8c448	0x1c1
GetCurrentThread	0x0	0x4822dc	0x8d84c	0x8c44c	0x1c4
GetProcessIoCounters	0x0	0x4822e0	0x8d850	0x8c450	0x24e
CreateProcessW	0x0	0x4822e4	0x8d854	0x8c454	0xa8
SetPriorityClass	0x0	0x4822e8	0x8d858	0x8c458	0x47d
LoadLibraryW	0x0	0x4822ec	0x8d85c	0x8c45c	0x33f
VirtualAlloc	0x0	0x4822f0	0x8d860	0x8c460	0x4e9
LoadLibraryExW	0x0	0x4822f4	0x8d864	0x8c464	0x33e
HeapFree	0x0	0x4822f8	0x8d868	0x8c468	0x2cf
WaitForSingleObject	0x0	0x4822fc	0x8d86c	0x8c46c	0x4f9
CreateThread	0x0	0x482300	0x8d870	0x8c470	0xb5
DuplicateHandle	0x0	0x482304	0x8d874	0x8c474	0xe8
GetLastError	0x0	0x482308	0x8d878	0x8c478	0x202
CloseHandle	0x0	0x48230c	0x8d87c	0x8c47c	0x52
GetCurrentProcess	0x0	0x482310	0x8d880	0x8c480	0x1c0
GetProcAddress	0x0	0x482314	0x8d884	0x8c484	0x245
LoadLibraryA	0x0	0x482318	0x8d888	0x8c488	0x33c
FreeLibrary	0x0	0x48231c	0x8d88c	0x8c48c	0x162
GetModuleFileNameW	0x0	0x482320	0x8d890	0x8c490	0x214
GetFullPathNameW	0x0	0x482324	0x8d894	0x8c494	0x1fb
SetCurrentDirectoryW	0x0	0x482328	0x8d898	0x8c498	0x44d
IsDebuggerPresent	0x0	0x48232c	0x8d89c	0x8c49c	0x300
GetCurrentDirectoryW	0x0	0x482330	0x8d8a0	0x8c4a0	0x1bf
ExitProcess	0x0	0x482334	0x8d8a4	0x8c4a4	0x119
ExitThread	0x0	0x482338	0x8d8a8	0x8c4a8	0x11a
GetSystemTimeAsFileTime	0x0	0x48233c	0x8d8ac	0x8c4ac	0x279
ResumeThread	0x0	0x482340	0x8d8b0	0x8c4b0	0x413
GetTimeFormatW	0x0	0x482344	0x8d8b4	0x8c4b4	0x297
GetDateFormatW	0x0	0x482348	0x8d8b8	0x8c4b8	0x1c8
GetCommandLineW	0x0	0x48234c	0x8d8bc	0x8c4bc	0x187
GetStartupInfoW	0x0	0x482350	0x8d8c0	0x8c4c0	0x263
IsProcessorFeaturePresent	0x0	0x482354	0x8d8c4	0x8c4c4	0x304
HeapSize	0x0	0x482358	0x8d8c8	0x8c4c8	0x2d4
GetCPInfo	0x0	0x48235c	0x8d8cc	0x8c4cc	0x172
GetACP	0x0	0x482360	0x8d8d0	0x8c4d0	0x168
GetOEMCP	0x0	0x482364	0x8d8d4	0x8c4d4	0x237
IsValidCodePage	0x0	0x482368	0x8d8d8	0x8c4d8	0x30a
TlsAlloc	0x0	0x48236c	0x8d8dc	0x8c4dc	0x4c5
TlsGetValue	0x0	0x482370	0x8d8e0	0x8c4e0	0x4c7
TlsSetValue	0x0	0x482374	0x8d8e4	0x8c4e4	0x4c8
TlsFree	0x0	0x482378	0x8d8e8	0x8c4e8	0x4c6
SetLastError	0x0	0x48237c	0x8d8ec	0x8c4ec	0x473
UnhandledExceptionFilter	0x0	0x482380	0x8d8f0	0x8c4f0	0x4d3
SetUnhandledExceptionFilter	0x0	0x482384	0x8d8f4	0x8c4f4	0x4a5
GetStringTypeW	0x0	0x482388	0x8d8f8	0x8c4f8	0x269
HeapCreate	0x0	0x48238c	0x8d8fc	0x8c4fc	0x2cd
SetHandleCount	0x0	0x482390	0x8d900	0x8c500	0x46f
GetFileType	0x0	0x482394	0x8d904	0x8c504	0x1f3
SetStdHandle	0x0	0x482398	0x8d908	0x8c508	0x487
GetConsoleCP	0x0	0x48239c	0x8d90c	0x8c50c	0x19a
GetConsoleMode	0x0	0x4823a0	0x8d910	0x8c510	0x1ac
LCMapStringW	0x0	0x4823a4	0x8d914	0x8c514	0x32d
RtlUnwind	0x0	0x4823a8	0x8d918	0x8c518	0x418
SetFilePointer	0x0	0x4823ac	0x8d91c	0x8c51c	0x466
GetTimeZoneInformation	0x0	0x4823b0	0x8d920	0x8c520	0x298
FreeEnvironmentStringsW	0x0	0x4823b4	0x8d924	0x8c524	0x161
GetEnvironmentStringsW	0x0	0x4823b8	0x8d928	0x8c528	0x1da
GetTickCount	0x0	0x4823bc	0x8d92c	0x8c52c	0x293
HeapReAlloc	0x0	0x4823c0	0x8d930	0x8c530	0x2d2
WriteConsoleW	0x0	0x4823c4	0x8d934	0x8c534	0x524
SetEndOfFile	0x0	0x4823c8	0x8d938	0x8c538	0x453
SetSystemPowerState	0x0	0x4823cc	0x8d93c	0x8c53c	0x48a
SetEnvironmentVariableA	0x0	0x4823d0	0x8d940	0x8c540	0x456

USER32.dll (160)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetCursorInfo	0x0	0x4824a0	0x8da10	0x8c610	0x11f
RegisterHotKey	0x0	0x4824a4	0x8da14	0x8c614	0x256
ClientToScreen	0x0	0x4824a8	0x8da18	0x8c618	0x47
GetKeyboardLayoutNameW	0x0	0x4824ac	0x8da1c	0x8c61c	0x141
IsCharAlphaW	0x0	0x4824b0	0x8da20	0x8c620	0x1c4
IsCharAlphaNumericW	0x0	0x4824b4	0x8da24	0x8c624	0x1c3
IsCharLowerW	0x0	0x4824b8	0x8da28	0x8c628	0x1c6
IsCharUpperW	0x0	0x4824bc	0x8da2c	0x8c62c	0x1c8
GetMenuStringW	0x0	0x4824c0	0x8da30	0x8c630	0x158
GetSubMenu	0x0	0x4824c4	0x8da34	0x8c634	0x17a
GetCaretPos	0x0	0x4824c8	0x8da38	0x8c638	0x10a
IsZoomed	0x0	0x4824cc	0x8da3c	0x8c63c	0x1e2
MonitorFromPoint	0x0	0x4824d0	0x8da40	0x8c640	0x218
GetMonitorInfoW	0x0	0x4824d4	0x8da44	0x8c644	0x15f
SetWindowLongW	0x0	0x4824d8	0x8da48	0x8c648	0x2c4
SetLayeredWindowAttributes	0x0	0x4824dc	0x8da4c	0x8c64c	0x298
FlashWindow	0x0	0x4824e0	0x8da50	0x8c650	0xfb
GetClassLongW	0x0	0x4824e4	0x8da54	0x8c654	0x110
TranslateAcceleratorW	0x0	0x4824e8	0x8da58	0x8c658	0x2fa
IsDialogMessageW	0x0	0x4824ec	0x8da5c	0x8c65c	0x1cd
GetSysColor	0x0	0x4824f0	0x8da60	0x8c660	0x17b
InflateRect	0x0	0x4824f4	0x8da64	0x8c664	0x1b5
DrawFocusRect	0x0	0x4824f8	0x8da68	0x8c668	0xc4
DrawTextW	0x0	0x4824fc	0x8da6c	0x8c66c	0xd0
FrameRect	0x0	0x482500	0x8da70	0x8c670	0xfd
DrawFrameControl	0x0	0x482504	0x8da74	0x8c674	0xc6
FillRect	0x0	0x482508	0x8da78	0x8c678	0xf6
PtInRect	0x0	0x48250c	0x8da7c	0x8c67c	0x240
DestroyAcceleratorTable	0x0	0x482510	0x8da80	0x8c680	0xa0
CreateAcceleratorTableW	0x0	0x482514	0x8da84	0x8c684	0x58
SetCursor	0x0	0x482518	0x8da88	0x8c688	0x288
GetWindowDC	0x0	0x48251c	0x8da8c	0x8c68c	0x192
GetSystemMetrics	0x0	0x482520	0x8da90	0x8c690	0x17e
GetActiveWindow	0x0	0x482524	0x8da94	0x8c694	0x100
CharNextW	0x0	0x482528	0x8da98	0x8c698	0x31
wsprintfW	0x0	0x48252c	0x8da9c	0x8c69c	0x333
RedrawWindow	0x0	0x482530	0x8daa0	0x8c6a0	0x24a
DrawMenuBar	0x0	0x482534	0x8daa4	0x8c6a4	0xc9
DestroyMenu	0x0	0x482538	0x8daa8	0x8c6a8	0xa4
SetMenu	0x0	0x48253c	0x8daac	0x8c6ac	0x29c
GetWindowTextLengthW	0x0	0x482540	0x8dab0	0x8c6b0	0x1a2
CreateMenu	0x0	0x482544	0x8dab4	0x8c6b4	0x6a
IsDlgButtonChecked	0x0	0x482548	0x8dab8	0x8c6b8	0x1ce
DefDlgProcW	0x0	0x48254c	0x8dabc	0x8c6bc	0x95
ReleaseCapture	0x0	0x482550	0x8dac0	0x8c6c0	0x264
SetCapture	0x0	0x482554	0x8dac4	0x8c6c4	0x280
WindowFromPoint	0x0	0x482558	0x8dac8	0x8c6c8	0x32c
LoadImageW	0x0	0x48255c	0x8dacc	0x8c6cc	0x1ef
CreateIconFromResourceEx	0x0	0x482560	0x8dad0	0x8c6d0	0x66
mouse_event	0x0	0x482564	0x8dad4	0x8c6d4	0x331
ExitWindowsEx	0x0	0x482568	0x8dad8	0x8c6d8	0xf5
SetActiveWindow	0x0	0x48256c	0x8dadc	0x8c6dc	0x27f
FindWindowExW	0x0	0x482570	0x8dae0	0x8c6e0	0xf9
EnumThreadWindows	0x0	0x482574	0x8dae4	0x8c6e4	0xef
SetMenuDefaultItem	0x0	0x482578	0x8dae8	0x8c6e8	0x29e
InsertMenuItemW	0x0	0x48257c	0x8daec	0x8c6ec	0x1b9
IsMenu	0x0	0x482580	0x8daf0	0x8c6f0	0x1d2
TrackPopupMenuEx	0x0	0x482584	0x8daf4	0x8c6f4	0x2f7
GetCursorPos	0x0	0x482588	0x8daf8	0x8c6f8	0x120
DeleteMenu	0x0	0x48258c	0x8dafc	0x8c6fc	0x9e
CheckMenuRadioItem	0x0	0x482590	0x8db00	0x8c700	0x40
SetWindowPos	0x0	0x482594	0x8db04	0x8c704	0x2c6
GetMenuItemCount	0x0	0x482598	0x8db08	0x8c708	0x151
SetMenuItemInfoW	0x0	0x48259c	0x8db0c	0x8c70c	0x2a2
GetMenuItemInfoW	0x0	0x4825a0	0x8db10	0x8c710	0x154
SetForegroundWindow	0x0	0x4825a4	0x8db14	0x8c714	0x293
IsIconic	0x0	0x4825a8	0x8db18	0x8c718	0x1d1
FindWindowW	0x0	0x4825ac	0x8db1c	0x8c71c	0xfa
SystemParametersInfoW	0x0	0x4825b0	0x8db20	0x8c720	0x2ec
TranslateMessage	0x0	0x4825b4	0x8db24	0x8c724	0x2fc
SendInput	0x0	0x4825b8	0x8db28	0x8c728	0x276
GetAsyncKeyState	0x0	0x4825bc	0x8db2c	0x8c72c	0x107
SetKeyboardState	0x0	0x4825c0	0x8db30	0x8c730	0x296
GetKeyboardState	0x0	0x4825c4	0x8db34	0x8c734	0x142
GetKeyState	0x0	0x4825c8	0x8db38	0x8c738	0x13d
VkKeyScanW	0x0	0x4825cc	0x8db3c	0x8c73c	0x321
LoadStringW	0x0	0x4825d0	0x8db40	0x8c740	0x1fa
DialogBoxParamW	0x0	0x4825d4	0x8db44	0x8c744	0xac
MessageBeep	0x0	0x4825d8	0x8db48	0x8c748	0x20d
EndDialog	0x0	0x4825dc	0x8db4c	0x8c74c	0xda
SendDlgItemMessageW	0x0	0x4825e0	0x8db50	0x8c750	0x273
GetDlgItem	0x0	0x4825e4	0x8db54	0x8c754	0x127
SetWindowTextW	0x0	0x4825e8	0x8db58	0x8c758	0x2cb
CopyRect	0x0	0x4825ec	0x8db5c	0x8c75c	0x55
ReleaseDC	0x0	0x4825f0	0x8db60	0x8c760	0x265
GetDC	0x0	0x4825f4	0x8db64	0x8c764	0x121
EndPaint	0x0	0x4825f8	0x8db68	0x8c768	0xdc
BeginPaint	0x0	0x4825fc	0x8db6c	0x8c76c	0xe
GetClientRect	0x0	0x482600	0x8db70	0x8c770	0x114
GetMenu	0x0	0x482604	0x8db74	0x8c774	0x14b
DestroyWindow	0x0	0x482608	0x8db78	0x8c778	0xa6
EnumWindows	0x0	0x48260c	0x8db7c	0x8c77c	0xf2
GetDesktopWindow	0x0	0x482610	0x8db80	0x8c780	0x123
IsWindow	0x0	0x482614	0x8db84	0x8c784	0x1db
IsWindowEnabled	0x0	0x482618	0x8db88	0x8c788	0x1dc
IsWindowVisible	0x0	0x48261c	0x8db8c	0x8c78c	0x1e0
EnableWindow	0x0	0x482620	0x8db90	0x8c790	0xd8
InvalidateRect	0x0	0x482624	0x8db94	0x8c794	0x1be
GetWindowLongW	0x0	0x482628	0x8db98	0x8c798	0x196
AttachThreadInput	0x0	0x48262c	0x8db9c	0x8c79c	0xc
GetFocus	0x0	0x482630	0x8dba0	0x8c7a0	0x12c
GetWindowTextW	0x0	0x482634	0x8dba4	0x8c7a4	0x1a3
ScreenToClient	0x0	0x482638	0x8dba8	0x8c7a8	0x26d
SendMessageTimeoutW	0x0	0x48263c	0x8dbac	0x8c7ac	0x27b
EnumChildWindows	0x0	0x482640	0x8dbb0	0x8c7b0	0xdf
CharUpperBuffW	0x0	0x482644	0x8dbb4	0x8c7b4	0x3b
GetClassNameW	0x0	0x482648	0x8dbb8	0x8c7b8	0x112
GetParent	0x0	0x48264c	0x8dbbc	0x8c7bc	0x164
GetDlgCtrlID	0x0	0x482650	0x8dbc0	0x8c7c0	0x126
SendMessageW	0x0	0x482654	0x8dbc4	0x8c7c4	0x27c
MapVirtualKeyW	0x0	0x482658	0x8dbc8	0x8c7c8	0x208
PostMessageW	0x0	0x48265c	0x8dbcc	0x8c7cc	0x236
GetWindowRect	0x0	0x482660	0x8dbd0	0x8c7d0	0x19c
SetUserObjectSecurity	0x0	0x482664	0x8dbd4	0x8c7d4	0x2be
GetUserObjectSecurity	0x0	0x482668	0x8dbd8	0x8c7d8	0x18c
CloseDesktop	0x0	0x48266c	0x8dbdc	0x8c7dc	0x4a
CloseWindowStation	0x0	0x482670	0x8dbe0	0x8c7e0	0x4e
OpenDesktopW	0x0	0x482674	0x8dbe4	0x8c7e4	0x228
SetProcessWindowStation	0x0	0x482678	0x8dbe8	0x8c7e8	0x2aa
GetProcessWindowStation	0x0	0x48267c	0x8dbec	0x8c7ec	0x168
OpenWindowStationW	0x0	0x482680	0x8dbf0	0x8c7f0	0x22d
MessageBoxW	0x0	0x482684	0x8dbf4	0x8c7f4	0x215
DefWindowProcW	0x0	0x482688	0x8dbf8	0x8c7f8	0x9c
CopyImage	0x0	0x48268c	0x8dbfc	0x8c7fc	0x54
AdjustWindowRectEx	0x0	0x482690	0x8dc00	0x8c800	0x3
SetRect	0x0	0x482694	0x8dc04	0x8c804	0x2ae
SetClipboardData	0x0	0x482698	0x8dc08	0x8c808	0x286
EmptyClipboard	0x0	0x48269c	0x8dc0c	0x8c80c	0xd5
CountClipboardFormats	0x0	0x4826a0	0x8dc10	0x8c810	0x56
CloseClipboard	0x0	0x4826a4	0x8dc14	0x8c814	0x49
GetClipboardData	0x0	0x4826a8	0x8dc18	0x8c818	0x116
IsClipboardFormatAvailable	0x0	0x4826ac	0x8dc1c	0x8c81c	0x1ca
OpenClipboard	0x0	0x4826b0	0x8dc20	0x8c820	0x226
BlockInput	0x0	0x4826b4	0x8dc24	0x8c824	0xf
GetMessageW	0x0	0x4826b8	0x8dc28	0x8c828	0x15d
LockWindowUpdate	0x0	0x4826bc	0x8dc2c	0x8c82c	0x1fd
GetMenuItemID	0x0	0x4826c0	0x8dc30	0x8c830	0x152
DispatchMessageW	0x0	0x4826c4	0x8dc34	0x8c834	0xaf
MoveWindow	0x0	0x4826c8	0x8dc38	0x8c838	0x21b
SetFocus	0x0	0x4826cc	0x8dc3c	0x8c83c	0x292
PostQuitMessage	0x0	0x4826d0	0x8dc40	0x8c840	0x237
KillTimer	0x0	0x4826d4	0x8dc44	0x8c844	0x1e3
CreatePopupMenu	0x0	0x4826d8	0x8dc48	0x8c848	0x6b
RegisterWindowMessageW	0x0	0x4826dc	0x8dc4c	0x8c84c	0x263
SetTimer	0x0	0x4826e0	0x8dc50	0x8c850	0x2bb
ShowWindow	0x0	0x4826e4	0x8dc54	0x8c854	0x2df
CreateWindowExW	0x0	0x4826e8	0x8dc58	0x8c858	0x6e
RegisterClassExW	0x0	0x4826ec	0x8dc5c	0x8c85c	0x24d
LoadIconW	0x0	0x4826f0	0x8dc60	0x8c860	0x1ed
LoadCursorW	0x0	0x4826f4	0x8dc64	0x8c864	0x1eb
GetSysColorBrush	0x0	0x4826f8	0x8dc68	0x8c868	0x17c
GetForegroundWindow	0x0	0x4826fc	0x8dc6c	0x8c86c	0x12d
MessageBoxA	0x0	0x482700	0x8dc70	0x8c870	0x20e
DestroyIcon	0x0	0x482704	0x8dc74	0x8c874	0xa3
PeekMessageW	0x0	0x482708	0x8dc78	0x8c878	0x233
UnregisterHotKey	0x0	0x48270c	0x8dc7c	0x8c87c	0x308
CharLowerBuffW	0x0	0x482710	0x8dc80	0x8c880	0x2d
keybd_event	0x0	0x482714	0x8dc84	0x8c884	0x330
MonitorFromRect	0x0	0x482718	0x8dc88	0x8c888	0x219
GetWindowThreadProcessId	0x0	0x48271c	0x8dc8c	0x8c88c	0x1a4

GDI32.dll (35)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
DeleteObject	0x0	0x4820c8	0x8d638	0x8c238	0xe6
AngleArc	0x0	0x4820cc	0x8d63c	0x8c23c	0x8
GetTextExtentPoint32W	0x0	0x4820d0	0x8d640	0x8c240	0x21e
ExtCreatePen	0x0	0x4820d4	0x8d644	0x8c244	0x132
StrokeAndFillPath	0x0	0x4820d8	0x8d648	0x8c248	0x2b5
StrokePath	0x0	0x4820dc	0x8d64c	0x8c24c	0x2b6
EndPath	0x0	0x4820e0	0x8d650	0x8c250	0xf3
SetPixel	0x0	0x4820e4	0x8d654	0x8c254	0x29b
CloseFigure	0x0	0x4820e8	0x8d658	0x8c258	0x1e
CreateCompatibleBitmap	0x0	0x4820ec	0x8d65c	0x8c25c	0x2f
CreateCompatibleDC	0x0	0x4820f0	0x8d660	0x8c260	0x30
SelectObject	0x0	0x4820f4	0x8d664	0x8c264	0x277
StretchBlt	0x0	0x4820f8	0x8d668	0x8c268	0x2b3
GetDIBits	0x0	0x4820fc	0x8d66c	0x8c26c	0x1ca
GetDeviceCaps	0x0	0x482100	0x8d670	0x8c270	0x1cb
MoveToEx	0x0	0x482104	0x8d674	0x8c274	0x23a
DeleteDC	0x0	0x482108	0x8d678	0x8c278	0xe3
GetPixel	0x0	0x48210c	0x8d67c	0x8c27c	0x204
CreateDCW	0x0	0x482110	0x8d680	0x8c280	0x32
Ellipse	0x0	0x482114	0x8d684	0x8c284	0xed
PolyDraw	0x0	0x482118	0x8d688	0x8c288	0x250
BeginPath	0x0	0x48211c	0x8d68c	0x8c28c	0x12
Rectangle	0x0	0x482120	0x8d690	0x8c290	0x25f
SetViewportOrgEx	0x0	0x482124	0x8d694	0x8c294	0x2a9
GetObjectW	0x0	0x482128	0x8d698	0x8c298	0x1fd
SetBkMode	0x0	0x48212c	0x8d69c	0x8c29c	0x27f
RoundRect	0x0	0x482130	0x8d6a0	0x8c2a0	0x26a
SetBkColor	0x0	0x482134	0x8d6a4	0x8c2a4	0x27e
CreatePen	0x0	0x482138	0x8d6a8	0x8c2a8	0x4b
CreateSolidBrush	0x0	0x48213c	0x8d6ac	0x8c2ac	0x54
SetTextColor	0x0	0x482140	0x8d6b0	0x8c2b0	0x2a6
CreateFontW	0x0	0x482144	0x8d6b4	0x8c2b4	0x41
GetTextFaceW	0x0	0x482148	0x8d6b8	0x8c2b8	0x224
GetStockObject	0x0	0x48214c	0x8d6bc	0x8c2bc	0x20d
LineTo	0x0	0x482150	0x8d6c0	0x8c2c0	0x236

COMDLG32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetSaveFileNameW	0x0	0x4820bc	0x8d62c	0x8c22c	0xe
GetOpenFileNameW	0x0	0x4820c0	0x8d630	0x8c230	0xc

ADVAPI32.dll (34)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RegEnumValueW	0x0	0x482000	0x8d570	0x8c170	0x252
RegDeleteValueW	0x0	0x482004	0x8d574	0x8c174	0x248
RegDeleteKeyW	0x0	0x482008	0x8d578	0x8c178	0x244
RegEnumKeyExW	0x0	0x48200c	0x8d57c	0x8c17c	0x24f
RegSetValueExW	0x0	0x482010	0x8d580	0x8c180	0x27e
RegCreateKeyExW	0x0	0x482014	0x8d584	0x8c184	0x239
GetUserNameW	0x0	0x482018	0x8d588	0x8c188	0x165
RegConnectRegistryW	0x0	0x48201c	0x8d58c	0x8c18c	0x234
CloseServiceHandle	0x0	0x482020	0x8d590	0x8c190	0x57
UnlockServiceDatabase	0x0	0x482024	0x8d594	0x8c194	0x300
OpenThreadToken	0x0	0x482028	0x8d598	0x8c198	0x1fc
OpenProcessToken	0x0	0x48202c	0x8d59c	0x8c19c	0x1f7
LookupPrivilegeValueW	0x0	0x482030	0x8d5a0	0x8c1a0	0x197
DuplicateTokenEx	0x0	0x482034	0x8d5a4	0x8c1a4	0xdf
CreateProcessAsUserW	0x0	0x482038	0x8d5a8	0x8c1a8	0x7c
CreateProcessWithLogonW	0x0	0x48203c	0x8d5ac	0x8c1ac	0x7d
InitializeSecurityDescriptor	0x0	0x482040	0x8d5b0	0x8c1b0	0x177
InitializeAcl	0x0	0x482044	0x8d5b4	0x8c1b4	0x176
GetLengthSid	0x0	0x482048	0x8d5b8	0x8c1b8	0x136
CopySid	0x0	0x48204c	0x8d5bc	0x8c1bc	0x76
LogonUserW	0x0	0x482050	0x8d5c0	0x8c1c0	0x18d
LockServiceDatabase	0x0	0x482054	0x8d5c4	0x8c1c4	0x188
GetTokenInformation	0x0	0x482058	0x8d5c8	0x8c1c8	0x15a
GetSecurityDescriptorDacl	0x0	0x48205c	0x8d5cc	0x8c1cc	0x148
GetAclInformation	0x0	0x482060	0x8d5d0	0x8c1d0	0x124
GetAce	0x0	0x482064	0x8d5d4	0x8c1d4	0x123
AddAce	0x0	0x482068	0x8d5d8	0x8c1d8	0x16
SetSecurityDescriptorDacl	0x0	0x48206c	0x8d5dc	0x8c1dc	0x2b6
RegOpenKeyExW	0x0	0x482070	0x8d5e0	0x8c1e0	0x261
RegQueryValueExW	0x0	0x482074	0x8d5e4	0x8c1e4	0x26e
AdjustTokenPrivileges	0x0	0x482078	0x8d5e8	0x8c1e8	0x1f
InitiateSystemShutdownExW	0x0	0x48207c	0x8d5ec	0x8c1ec	0x17d
OpenSCManagerW	0x0	0x482080	0x8d5f0	0x8c1f0	0x1f9
RegCloseKey	0x0	0x482084	0x8d5f4	0x8c1f4	0x230

SHELL32.dll (14)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
DragQueryPoint	0x0	0x482464	0x8d9d4	0x8c5d4	0x20
ShellExecuteExW	0x0	0x482468	0x8d9d8	0x8c5d8	0x121
SHGetFolderPathW	0x0	0x48246c	0x8d9dc	0x8c5dc	0xc3
DragQueryFileW	0x0	0x482470	0x8d9e0	0x8c5e0	0x1f
SHEmptyRecycleBinW	0x0	0x482474	0x8d9e4	0x8c5e4	0xa5
SHBrowseForFolderW	0x0	0x482478	0x8d9e8	0x8c5e8	0x7b
SHFileOperationW	0x0	0x48247c	0x8d9ec	0x8c5ec	0xac
SHGetPathFromIDListW	0x0	0x482480	0x8d9f0	0x8c5f0	0xd7
SHGetDesktopFolder	0x0	0x482484	0x8d9f4	0x8c5f4	0xb6
SHGetMalloc	0x0	0x482488	0x8d9f8	0x8c5f8	0xcf
ExtractIconExW	0x0	0x48248c	0x8d9fc	0x8c5fc	0x2a
Shell_NotifyIconW	0x0	0x482490	0x8da00	0x8c600	0x12e
ShellExecuteW	0x0	0x482494	0x8da04	0x8c604	0x122
DragFinish	0x0	0x482498	0x8da08	0x8c608	0x1b

ole32.dll (20)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
OleSetMenuDescriptor	0x0	0x4827f0	0x8dd60	0x8c960	0x147
MkParseDisplayName	0x0	0x4827f4	0x8dd64	0x8c964	0xd4
OleSetContainedObject	0x0	0x4827f8	0x8dd68	0x8c968	0x146
CLSIDFromString	0x0	0x4827fc	0x8dd6c	0x8c96c	0x8
StringFromGUID2	0x0	0x482800	0x8dd70	0x8c970	0x179
CoInitialize	0x0	0x482804	0x8dd74	0x8c974	0x3e
CoUninitialize	0x0	0x482808	0x8dd78	0x8c978	0x6c
CoCreateInstance	0x0	0x48280c	0x8dd7c	0x8c97c	0x10
CreateStreamOnHGlobal	0x0	0x482810	0x8dd80	0x8c980	0x86
CoTaskMemAlloc	0x0	0x482814	0x8dd84	0x8c984	0x67
CoTaskMemFree	0x0	0x482818	0x8dd88	0x8c988	0x68
ProgIDFromCLSID	0x0	0x48281c	0x8dd8c	0x8c98c	0x14b
OleInitialize	0x0	0x482820	0x8dd90	0x8c990	0x132
CreateBindCtx	0x0	0x482824	0x8dd94	0x8c994	0x79
CLSIDFromProgID	0x0	0x482828	0x8dd98	0x8c998	0x6
CoInitializeSecurity	0x0	0x48282c	0x8dd9c	0x8c99c	0x40
CoCreateInstanceEx	0x0	0x482830	0x8dda0	0x8c9a0	0x11
CoSetProxyBlanket	0x0	0x482834	0x8dda4	0x8c9a4	0x63
OleUninitialize	0x0	0x482838	0x8dda8	0x8c9a8	0x149
IIDFromString	0x0	0x48283c	0x8ddac	0x8c9ac	0xcd

OLEAUT32.dll (24)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
VariantChangeType	0xc	0x4823ec	0x8d95c	0x8c55c	-
VariantCopyInd	0xb	0x4823f0	0x8d960	0x8c560	-
DispCallFunc	0x92	0x4823f4	0x8d964	0x8c564	-
CreateStdDispatch	0x20	0x4823f8	0x8d968	0x8c568	-
CreateDispTypeInfo	0x1f	0x4823fc	0x8d96c	0x8c56c	-
SysFreeString	0x6	0x482400	0x8d970	0x8c570	-
SafeArrayDestroyDescriptor	0x26	0x482404	0x8d974	0x8c574	-
SafeArrayDestroyData	0x27	0x482408	0x8d978	0x8c578	-
SafeArrayUnaccessData	0x18	0x48240c	0x8d97c	0x8c57c	-
SysStringLen	0x7	0x482410	0x8d980	0x8c580	-
SafeArrayAllocData	0x25	0x482414	0x8d984	0x8c584	-
GetActiveObject	0x23	0x482418	0x8d988	0x8c588	-
QueryPathOfRegTypeLib	0xa4	0x48241c	0x8d98c	0x8c58c	-
SafeArrayAllocDescriptorEx	0x29	0x482420	0x8d990	0x8c590	-
SafeArrayCreateVector	0x19b	0x482424	0x8d994	0x8c594	-
SysAllocString	0x2	0x482428	0x8d998	0x8c598	-
VariantCopy	0xa	0x48242c	0x8d99c	0x8c59c	-
VariantClear	0x9	0x482430	0x8d9a0	0x8c5a0	-
VariantTimeToSystemTime	0xb9	0x482434	0x8d9a4	0x8c5a4	-
VarR8FromDec	0xdc	0x482438	0x8d9a8	0x8c5a8	-
SafeArrayGetVartype	0x4d	0x48243c	0x8d9ac	0x8c5ac	-
OleLoadPicture	0x1a2	0x482440	0x8d9b0	0x8c5b0	-
SafeArrayAccessData	0x17	0x482444	0x8d9b4	0x8c5b4	-
VariantInit	0x8	0x482448	0x8d9b8	0x8c5b8	-

Icons (4)

»

C:\Users\CIIHMN~1\AppData\Local\Temp\aut475F.tmp

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.40 KB
MD5	ed1e7bd7f6df91f75c9176d651cb5b51
SHA1	45a64f005af4925d0c8b075bfd93bfd95eac9d72
SHA256	17480789de1b9fe4d6c38a1ad136594d893d00d8c051a3818f693d52faa89a1a
SSDeep	24:nCGD023AQdkS4FeaTTUzP+31lSUxBKDDIry415a2nsuCmtcmv0dtIxYcGpz0cU:CftUUeiwP27SUPK3IW6PCmtDWtIxtGpg

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.xJQWy0H5XjB.bmp

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	63.84 KB
MD5	636c0f05f62f7ec3cfede99884bfbecd
SHA1	2bf86d214a03565e711073dab21e7328e4a59d42
SHA256	793b51a3b908d7ccfc9562fd0cf80e1d7b2ed39e396d2fdd5fa7a1af0daad009
SSDeep	1536:9pTw2YVs3m/Bfs1ZVrGXltKkdk6qpTi9vHoInn:/Lm/Bk1ZYXOk63Zi9vIInn

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.6x1noCxpBp1mmFoeCN6T.png

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	23.09 KB
MD5	665abeb0ebb28d77df2bf19bf674eb20
SHA1	4c4b46e2ca8de598957be63d85f43a07a923ee37
SHA256	99f2c4d13185d26dd982dcfbb5201761eebca966e289bbc13b8e3763c5f2e1ab
SSDeep	384:WB4mKDPEM+36+FjJOuTdHKQf99RVXzgJ9csPDDZSWtgFEdX/+EJVaM:3mcngB3KQfXRNgJ9cSpSVFEJ7JVD

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.SN-7hPJVIjPbeSt.mp3

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	43.81 KB
MD5	45a708009dca525ef1a1d63ffc4478ad
SHA1	0620737cb43811263a53b4219cea4516be38da3a
SHA256	df6862e2a4fbee4522e9fb4707ffa3db28052d94c260c6aaf30e21cf9d8285fa
SSDeep	768:4nmZZgtTuxx5TRQqJN47JxUm9E+05HVnJ3eEyTb4Ja/WYbeWWEeULL+P:4nmzgUR9JN47/xa+5EKb4JmbeEJi

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.4hX BzG8K.gif

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	64.96 KB
MD5	4219cb8fed5ea91e42a5ca86f3966b18
SHA1	4976fcb15e8f512664825fcbe831f3523d949fe7
SHA256	9c0c3a0eb7a5fe96eb24150d025fcfba22ffe943a552695e388b106b73c8a25c
SSDeep	1536:Fgolcye2DZRaNNZKuD/xTshAF2swaQp1e:S2c+DaNxD+Y2Njp1e

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.5h pi4P G_.ods

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	93.29 KB
MD5	37e0b45f1840e223e40e0d79364b8967
SHA1	afeb0afa4f1cfef269f5c621a345615f250b0cad
SHA256	8905204abc7d1c02d34ce67d6ce78b9d2b75990bb5630c883758f00d19d57835
SSDeep	1536:f7bTRS4Fgfajc2NnlI7BEfswfGOLCbrFq9m+yGKoC0aE0piNSSaf5q5lWUh99F5d:z3RSRfWxzI7SUwfGOwFqo+yGTHaE0otH

C:\Users\Public\Documents/Lock.desktop.ini

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.27 KB
MD5	ed32321288e596a743e12080885bd804
SHA1	bb98925e7c07132b23bb32b11978b6bda0b11bf5
SHA256	b5a21156abd7ed5f0c2b1a0a4ac458ca832e401707ed97361967d46e240045bc
SSDeep	6:x/unJ6ZESn4iPU+HID8/KOv9Cwd2oqbAeifTeWBUhUxcx:x/YcZ74iPoQKG9CwdS+eWehuA

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.6Ihl59F1EW3Dmio30.mp3

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	21.62 KB
MD5	581c885caa4055e871eff58f7cc881d3
SHA1	10e2bfd49c8c5d8c5adccf6d331a81c2f452e88a
SHA256	e7f02b5c7b98f7ba4dcc0d492c2da0be70c8dbebe46fc33be0dad885d83d1ea4
SSDeep	384:W6cIKXm9lSLmPjgbeCI5nIawYZR/tIqH5nzH2yqK8YxBxqSpd:R629lSLasbeCAIawYZRVFF2nKbBxqo

C:\Users\CIiHmnxMn6Ps\Pictures/Lock.di ot4o1qyFI.jpg

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	68.92 KB
MD5	b646962d696dd1b8985f0b97572c41b4
SHA1	d51cf5be61aada6d7942ee8264eeca4e22dd0fcd
SHA256	81c2aadefe4ebb3587a418a7ebb938781ad74ec3e2ee354ccde575bf93f04818
SSDeep	1536:DjaltVT+w8fLvkcGklXqdocq4aWiYUKt13Zx8IaXvM3IJ5p3:UJQzvkcGkV4aWiYj8IaXvqa5p3

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.j3xOnM3C5H UUFiE2.pps

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	17.12 KB
MD5	eb710645b3c13bb03b2980826f88f843
SHA1	bec46c32e19f9af4d7a225fa6baad2ae78caff65
SHA256	66aff372fa71b61160213f9a387053c87e2a59e00bc23489ca1508fa98053650
SSDeep	384:NLnb1VnG//mtoSCNqRykbOegvNmvQJckG7PJnefQp/Do85ZOGFIL9:5G/KoSCMAoOvNmAZUDZo8W6IL9

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.e47Ptw.gif

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.63 KB
MD5	00b06f2b2541986c5cc2edcaea14ab05
SHA1	5cdb230887206da519003aa5c16d8ae678af4196
SHA256	b444f406e29a011fb7bdc6501f4028630ec8e868bfa7ee6f145c38dc74728b1a
SSDeep	192:dEaQL8fuXlhKfTAUNUbz+iIA5rAxTlng3bqkLG/3xXQ:yaQL8f+hKLvniqThypLIFQ

C:\Users\CIiHmnxMn6Ps\Documents/Lock.WUpSn9HARv5eBhQKKyI.docx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	29.97 KB
MD5	225f71f7f2f62bd3520a33c5b616632f
SHA1	dc9eafb157d0b1f568ee4ee06229d9f353c49ad8
SHA256	4085a864fa8ad73ddb308538fd73cc971364e537bcc96bdcb8b0e6d8e4391b99
SSDeep	768:HULsgyyweRPqTsQ8J0guAnbEL156hKn9XQCniaG:iyLx82gu2byqs9Xjiz

C:\Users\CIIHMN~1\AppData\Local\Temp\aut475F.tmp

Created File

Unknown

Not Queried

»

Also Known As	C:\Users\CIIHMN~1\AppData\Local\Temp/8x8x8 (Created File) C:\Users\CIIHMN~1\AppData\Local\Temp\aut9F83.tmp (Created File)
Mime Type	application/x-empty
File Size	0.00 KB
MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep	3::

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.wxFZJI-.mkv

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	17.95 KB
MD5	c91ff64379b701caa83cd7cb1a286196
SHA1	7524286659cdaade288502dbb208c2ddfdbffb4f
SHA256	588faf500a0987a2fc88cd59c42404411978e5ca8bb0d103dc629e5be4a2091b
SSDeep	384:fyJWkZi7/+ryi1RxJkPQIFYS47+p9BfcCf72jJcbRolTDSPF6phuQ:3kA7/e11Jkb4ihBf7mgRoZpv

C:\Users\CIiHmnxMn6Ps/AppData/Local/Lock.IconCache.db

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	118.56 KB
MD5	faba91a40ed3b94a39580b21f20b1e4b
SHA1	43420288c935a413f4b61fdb3bad1d09c351db5b
SHA256	1866c5011ba4d228d4b788e5c87cd4e306e861af17cfb21ce3fbcbce0df6d2ce
SSDeep	3072:1SfxKyFkc5CRoJj7nFWzXDMepKbyssUpV2efrGtRw1wjxCb/MtcJjYfB:1S5KkdIAj7FiDx6V/3frG/wCW6cJjaB

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.a59dR.mp3

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	33.36 KB
MD5	bebdddb9649c4d9bdf98243920be5e68
SHA1	4ac77c476bf477eb60f157837ada07fb24818497
SHA256	5cedf20e288c92d567ecbcac331b4e3b2a7d7219b06b5a390989337334b8dec2
SSDeep	768:+mm3DqSz8oqk03VABHpR79DcwbktQ7vE1gGYRbhjs46EZF0d0hZIn:zs8oqJ3aRmwbktQ7c1WJhj+EZF0mhZu

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.YeqB3B7c2.odt

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	19.63 KB
MD5	6dcd0a6993f2a00251e0bdc490c901bb
SHA1	1b2ea0406c9be3d6df68655f8139a69a7f0c1d88
SHA256	dd11ac2b2f21043156311b4187164a6f83b7c1836a54604be65468cca1cc0638
SSDeep	384:f0iDuRAwpqB3D/+S3qfLoq/2cUNra4Ak74dey1Njazrrn2:D3bqS3WpYra4B70lazry

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.HPiFfUsmobc0kOQ6Rzg.flv

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	50.17 KB
MD5	ba6353b541b9f183db98c8542f9f4781
SHA1	dfa7301335d2d0a0d799e7b917274e1bb7c46323
SHA256	3e3c96b2a1e176bfd0ce9f2d5a7059d566f176ae2c8ce6fcedcacf08c7b10bc8
SSDeep	768:keJEihJHQ82X+ChIV5/EpE+VhrxypsaX1LsvvrCM6OvghZy4mglLi3UsRqu7SHTN:jOinH4X+ChPjXty9X1LIeM6u+flo1miG

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.CHfvN1bcW R8s7_bOrn.xls

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	29.17 KB
MD5	44199d2521e05bd861c20ded363a40a9
SHA1	492dbb8b3fcd9faee0a95b862fbd9ef0dfcbaf0c
SHA256	4ccd78fca236873eb1d9d764d416881ba15ec3ff0fac40a042ca891815eecbf6
SSDeep	768:YaI22+N4oEQWPmwSHj6cVwZfyc7SG1gmfWaC36NnVjq:YblS5LpucVwZTD1gmfdC3mQ

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.T2Cxs_YQD7nPt.bmp

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	38.41 KB
MD5	35e406c59bdc0756018e9b5ee8c3d2d0
SHA1	94de06879a41d7dd27df89358ecd7b67b3c8dd97
SHA256	aa4a11ecaf1744a555878ddab94e75830ecfd9d5e89c1dfad2b34a6984e11f89
SSDeep	768:n3c2zeBy+hrqsdf1WmlAsBvdLrRce2hwUMpj92bmcQ/ybXsglgwvgb1sfE6q:Mvnrjdf5ASvcerUbfgqXpgZIEN

C:\Users\CIiHmnxMn6Ps\Documents/Lock.XYua.pptx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	69.51 KB
MD5	ccfb728780f1fe38f47a0f8c22e2fdd0
SHA1	41db4559f85b1686c6b05e91127860b047d0363a
SHA256	6ee84c39cb8fb33f89257de6d9b024c48c587c963857f8315c7ee495c6ad8fb2
SSDeep	1536:zK/TS4arIevBSgm6HAEASabKp3vlOOVVZi1WYARobMTUKYs:O+4Tz4KelOizi1WYAebMTUy

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.UiCbiMIX.ods

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	87.09 KB
MD5	43d7dc0c5630ac3aaf3341f58f0a060e
SHA1	7d6ba43c34293c67ef11dfa1232f3aac1e080cd5
SHA256	6b727d33f1e2cafa6d5a8c285a0c2cb0e69555de294218c56d06ef36375f7b84
SSDeep	1536:5MXnRFHigqW+hXm383QBPsYSpx0SIJfIIGWjglPmp90/A3fNu7pr3TNZJ320:5M3rdq7UsgBPsYSpxQsWjglPmwyVyr3p

C:\Users\CIiHmnxMn6Ps\Documents/Lock.lqoCl6y.xlsx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	67.87 KB
MD5	7b974d2ea2c1c2035f3b6412e47acfaf
SHA1	6fd2a9553742a50086a470c8870c0716b9b03ea1
SHA256	32089937bb86ca4aa9688837923899d14773ddf75977222f97f943eb9d15856a
SSDeep	1536:SBokOtz7DCBISvURj9l6rQfhXrxmIzhowESSfvB6/wKCGtaYCSK:Xkw7mSSS6rQ9fh4Scvzytaxr

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.sgCJT.jpg

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	64.02 KB
MD5	9c7d8ff39ab3fe4f57a975c062f1fab2
SHA1	150569bbd9cc865f419c797fdc562d0895a09800
SHA256	0ee6d8205d48b11ec763dd8522803de07e3698c64801c258fc71bcc330aedc8f
SSDeep	1536:PpoUcXPFVCZOxQnrmIUKL3NXvttqwX0W6tK+T/fmSh7KP/h:PIIXUKLBCwEWWRXxIh

C:\Users\CIiHmnxMn6Ps\Documents/Lock.Sj6SoGBJ.pptx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	34.42 KB
MD5	f3cfa2ce3d0290eee4125fbbe0b94384
SHA1	744d4398a2e3a634af348976c56deba1fd9a4ac4
SHA256	f579b483325654a1f19f1460d18cf227b0601378a29a6ab1c695ec84e167601b
SSDeep	768:IMPGIMJC/1MhvWTiv2wzd7aOOZZi/0IHqPw8HsPK3of:PGIMJC9+vWT0PCZjIeU6of

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.8ZHaOi1b54EwUUY.wav

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	33.72 KB
MD5	ed3672795f34c44e15608499b8b34b78
SHA1	d5b127fd25e6ea89caa4eaa1559660bb03f21cde
SHA256	c5714b5a17531d8d46f41f679b8b3f214f2bb34fff94875647528951e850ba68
SSDeep	768:URDaHf1r1F7XanldymQGKaQ8uOAnxt5ECegddlJg4Pu:URDaHf1r1F76yCQ8j0EZgdrOd

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.07iDkNP.swf

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	75.07 KB
MD5	b3b89f40cf849646c135c2bc0b5cdfb1
SHA1	086ed5a9a5d3dde1acca3dfd78f69027b81807d5
SHA256	f7a1c01b29913a31c2156737f9b0204c9ae76a5faba7440e2a13e872a026081b
SSDeep	1536:o8ksquPWDKD3YO0MjHmQeIK6rUz7j5dK/JPE+Vwxm0qy9F2i04:o8VquToOhjpeqY3j3KRs+VwxmsW4

C:\Users\CIiHmnxMn6Ps\Documents/Lock.WoAfC7fH.docx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	84.84 KB
MD5	0ed8aa5463d74bda6c2dbbf465d65d0a
SHA1	49e9c64f14205a28fc6edadfac984998290cd39a
SHA256	c95a6c4e442a992ac47f5d964c224c13d10540c22f7c8036978a7bf4e17c1942
SSDeep	1536:b+g2zUAox2Go+L12wXbZ45fjFjKIdOMK/dQQVLt1IPmOzwLqJydE:br4UAox2K12ONSF+AodQQVLtWPPbJya

C:\Users\CIiHmnxMn6Ps\Documents/Lock.dH8KjJr-DCE7s3hc0W.rtf

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	31.41 KB
MD5	8313c9d938ada8e3f5b8bf9694c91f90
SHA1	88007d7c1808108391fb38eb41c03cacdac33bc4
SHA256	1aeddfcedf1454036b26a280c69c74e971095ebd87acadc9a6a491454ddaff66
SSDeep	768:fZK3bLBMLPOsoYrProuGbmdoDuBqvdPTrs/OlkY2vESi:fubLmLmFYrPosok2xI/OX2vfi

C:\Users\CIiHmnxMn6Ps\Documents/Lock.cVtkaJxJuKDO0_4HwRfX.pptx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.64 KB
MD5	5e31eda5d2411824f192069cc107c871
SHA1	8f1873baaa76e2a6572f45ad608cfc279ae8a5c7
SHA256	77efda929c152f01c2d4b438abcee2046ce082d8c7031b0909a67c5cfa2cd1d6
SSDeep	192:+DLMAgeI32t2vbCAET6PyF9N5DhTZvzvgqL3A07ZvZmwd:H/eeNg2Py55NTRMsw+ewd

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.HD1FLLNmLPJ7igO2XSQ.png

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	34.12 KB
MD5	2d3dc65b8e76a52658e1be5267494147
SHA1	b3e7e9f83b6ec89598be39ac481c28a3bc2029ba
SHA256	889611a0267d727fe7a1212e334f8c0319f3db529f0258f4db4c9e98a633cafb
SSDeep	768:x6pAhsp6g6GC3TEevOAWpXFVqAjPl+wKROskwXYJX1n:6A2p7nCAevOAyXqA7l+wK5XwV

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.rzTdzniVDq.csv

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	56.70 KB
MD5	a5e750509d2d95537f6afa4bcd1b035c
SHA1	59041c4452ca60fcbd033a33f8efdc9af301bcc3
SHA256	46f07a2ba403e70bd29249640e7aedb763ca6fc612714432f00fa9473429a273
SSDeep	768:L0xc2NxK6bPrHWbCj42Z/ECcZTH2drOa04Wm774yFNVW80Nrd1heNvU/Ma8NDTLM:Ea6fHn38C7CaVb77m80x8NvUkZDTLBQJ

C:\Users\CIiHmnxMn6Ps\Documents/Lock.oNfvs3LGk1TKi1J4_aSN.xlsx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.40 KB
MD5	bc2f77130b5a6d301671f4d711e04c3b
SHA1	1b33abfc0040c1fd51fc07e8f96a7fb6d846517a
SHA256	af7f5db7186d4350557c6ebd012ccca374357cc9b7e97d77ca40545133fa0c0e
SSDeep	48:IuUi8QL8w+CevG0iajzLwOtvDLugiPM/5nQhcSNmHF80CXh9yN3wR:G7c2fO0BbtvDLx5nQuSNka/s3wR

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.eA3aYZlB_n2DMgb4vCUM.bmp

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	49.99 KB
MD5	947b403b1c8bc63e56b86bc1767396eb
SHA1	452181a7d3c0d0ad3c3faff96a6a10fc3e183d2d
SHA256	8c4813629028a3ea471f5e45b1069248c98f26890a360efb137144c72edcaa71
SSDeep	1536:CyKmKYm71FOwlKTUIumdQXj+UQp9a5EZ8l:CyBE1FTlkbumdaj+z9Ix

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.OHPAk7bl2NSxuhuQR7XV.flv

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	35.41 KB
MD5	a9f7c0bb941e457e2fb2f9bb7b0d3d96
SHA1	1f22fe9eeb6101535bb77a04eb280c20488b36b2
SHA256	424dfb500879a10aa02486694fd93d2c8ad01d55bdcfcf0f3991ca04a9219984
SSDeep	768:adC2SfGn+vOmPeuBuGPuOlRi1YSrqMAfZEcQbEwXRZjE/p:jQMOqBbG5914i3Ex

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.dPayGG-Py.wav

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	6.80 KB
MD5	063955cdae7d736128e8447d79fe0dd2
SHA1	8cb5494412207753ed84ae301eadf50b92d243b4
SHA256	ee238d9e0bd162b2595c8085e5072599be856fbc5311d94c9610be9c78944ed8
SSDeep	192:cwbwYyi1KufS6kKdfxkMZXxg+GQ+Jyw5055viHJmfdl:jaiQufh5dfY+syw54+4fdl

C:\Users\CIiHmnxMn6Ps\Documents/Lock.33ks1nc2w.xlsx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	85.71 KB
MD5	1ce730ed4ddd0e06f3ec6ee252423eb8
SHA1	192526192c3d470fdf0252588810c688717ccafe
SHA256	5709fd5bd8c1e5f9155756a102b0b20f52215c036ffa8ac1e8bc4d2a70452c88
SSDeep	1536:Oa9QNURbMnyFHWU7r74AeN6kxyhdyAYmooXigKkc2:zQSRbMnygode4k+dLriHQ

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.6UcE2 -hZ7ABmj.bmp

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	77.27 KB
MD5	6254c6042998d0b3aa2d5f43835da1b9
SHA1	25db29f864144c94aef32628059a7f112ada434c
SHA256	08d8dacc9e92d1efd86ec29f17c9fd60f4313923361b7dd151faf5607278ebfe
SSDeep	1536:/9zbyQqfmuy/dWQtC3P+657XpDOo+t9rVZFNqvxsMIkyF8Yf:pbyEuy/nar5DOo+rrVXS2M/eXf

C:\Users\CIiHmnxMn6Ps\Documents/Lock.Ihhj7L6.docx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	36.23 KB
MD5	c8d4308e21d92f913ad2a6f2f01321a5
SHA1	d5895fda1cab3f8ef8f21e2db99bb95637b8a641
SHA256	7a38e22bead060e7966b7308a96ee0342ae20d7071b73938ffe4d676a3439d95
SSDeep	768:pv6yBX7Dj6XbeKGIMJiTMQAUSoi5W9XM1uZPti5/4tQBaQI8c:pvjBXQbCJiQRUZQWNM1wti5xa+c

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.P6_LLd2-wg7.gif

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	38.38 KB
MD5	9a659682e57e60da6366fc7ed5515490
SHA1	b13e4f1f44d7907d06fc8ae4f8d99c82e325e927
SHA256	fa5755e6fd3b07eaeb2d95d1deea84a4f8e41a69d326b7470bb994089f1e226c
SSDeep	768:yqWFGKVvzrApmZ++V9QR9OY1z18d5DHIlEbpqSoQQanFYCvLu1tT80lxD7X54:yqw3x7w+k5z1oIKoQN+CvSc0lx3p4

C:\Users\CIiHmnxMn6Ps\Documents/Lock.Database1.accdb

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	348.01 KB
MD5	9af7e3f6135e9157d8c260551d393d2a
SHA1	ea1f600ab97c8021894b9a6734d6532aa200670e
SHA256	7334250c767d958c7394b89d294534bffa2fa38468b67080e45a8c8bb1e63dea
SSDeep	6144:ia4Xn03WRjGfqSWithCqVUhDGMLZcN9ehtoyy9FCAmrr64owvO:D0RaqS/SvtLyNc5yzCrlowG

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.W9JWpaycQhp.pptx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	2.60 KB
MD5	74764eddf7fe5947be99268fc2eab871
SHA1	2c5c160dcfa0bd0127b33b2c49404f8654471ecc
SHA256	23625275a1295446e6b31ea658a76e702cf7929964be049852d3d73b4911d489
SSDeep	48:I6Jw9ve01voCJVx1q5w/iNuZ8vbs/KMsDXpop+BKmnPNdEGh2:Zwg0J7xo5a+W2bsLyXpomKmnPh2

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.TzQzGhO-DVwBiUIbj v.odp

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	93.72 KB
MD5	804d65ed973ca44ac6dfc26d907ad47b
SHA1	790b18981795bf0a01b504c49d93a5a1182399d2
SHA256	3a4c13d168ddaffde2c4325723188919b9f7dd32a6355564d38f8805c1fd2726
SSDeep	1536:ZcEHSkYvCUO8iJ3XZVpnbL8WCBb86/rAutkEiKJWIFPdahWE9yjHezcBMu/y:qEH6Q5VNbubhXrTFPdgWMyjH94

C:\Users\CIiHmnxMn6Ps\Music/Lock.desktop.ini

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.50 KB
MD5	3e5d2582a5d0c915afef6c8cafa343d1
SHA1	7062928a2ec000838f78dce8c48693a1859471e1
SHA256	34ae08d15c34e017facda7c39f7b5f9e8cc891b160072b908969a1a2523772aa
SSDeep	12:x/YcZ74iPoQKG9CHlw5Ok9LIDNV86xqSx95b+1ywId21p4sE0e11:xwA71FCdk9LIU4x3b4bId2Y4er

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.S0Njuyb0MbA8NPe7f.odp

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	44.82 KB
MD5	e98041721764c1fab5c50232ea96e654
SHA1	97308ee81c26eff21e9037e9b257980e4d970ed2
SHA256	5af62335cc205acf7d24db86cc0f441b9909ee966f66a1f4bf6d8546d1b6e93a
SSDeep	768:J5RJp75qJ9VM0CqQNnQvPQkhICnxZbIvl81OQKAqQL7iGZaifcy7gZuJdjQdR:J9p75qJ920LOkrhrxxIv27KrCaifh9G

C:\Users\CIiHmnxMn6Ps\Documents/Lock.FsWV1eA3OkafmtB.xlsx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	63.62 KB
MD5	91a37f47ef6d1fc202e64feed22f8fb3
SHA1	c4c84cd6f54db6f531116fda71db8d33614c869a
SHA256	a011cfbdd10d3d54e17877bfa598f99d4de7e4bd2a844d4a4328d4f7751c2a96
SSDeep	1536:CI8GKIkRFyxJyJz31tUvslJKq021M/mctW8W6/yN/:cGKFjj1tiOA61M/npNu

C:\Users\CIiHmnxMn6Ps\Documents/Lock.desktop.ini

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.40 KB
MD5	7835655816219d921dffbdb312396000
SHA1	bee4392a2a21f1faff64510296ed6d29d5ba6e7a
SHA256	4ef42b28c2d34762c16b1b31beae549b7a01c891ecf402fe5fe84b79f12afce5
SSDeep	6:x/unJ6ZESn4iPU+HID8/KOv9CuA4+2Nof9wWdQM4hW0Zi7DYVc8k:x/YcZ74iPoQKG9CuA4GlqG2k

C:\Users\CIiHmnxMn6Ps\Documents/Lock.IRevt7-Vo2dY1p.docx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	93.05 KB
MD5	cc8d23f8a4ead6ad1ced1e95cffba700
SHA1	47a528bc656639ba8ec9a6e760213ff360e8436e
SHA256	4390ab4a2f7626661838f5ae3b1ef9d611493e93de033c897ab502727c2dcd9d
SSDeep	1536:Zc83T0nphVfm2/qwsQzJHa1kNsYz8W6n3IHTMz/LsA32BZlBgKtNcDp:Zf3wg2iIV9uYoW6n3IzuT532hLNQp

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.Desktop Ransomware.exe

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	808.01 KB
MD5	1286543236c90b1cb75cb9a7aaabee5a
SHA1	92a2e58196f69840ad1c237fb2d60a96780a3b83
SHA256	55f47a683b0c52edf25e6afd61f6872ab2d7202cd682de69e4175f52a564aebc
SSDeep	12288:wvKre4+gyK6YaQZ1GYvDOrge1bNIDFu+VEA2GPXbsVqI0is3UQrULQ/Ex:ws+xK6YaQGYvDOj2u+N/bsV0nUQrSrx

C:\Users\CIiHmnxMn6Ps\Documents/Lock.4 oKstOLjt Ogj.csv

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	72.30 KB
MD5	6a1a55bc8cc6912d44122760b9aa3da1
SHA1	2ccbe6bd682f748f53df833f5271fafac2c78559
SHA256	7b550a29195405e1856392f941d2ac72ab8b314cc6d85e1cb54424ad2c911b5a
SSDeep	1536:lVXbZvO3szmjaGhdPC1aKAvLbZgIC8JQDQGYuIZh0pygt2o049:vXbijhBsrQfZ/5QEmu2

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.Qro3U.bmp

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	47.45 KB
MD5	d5d4294ad1e79c38b028053b1ae5c594
SHA1	cdfa3c26a3e7fac9f59628c2f8854353c4c3bb7c
SHA256	15041f9d9cd5ca2a8495da4fb3f03f80fd68eff820a5ad876d44e364b67428b3
SSDeep	768:V0zAHbUV6zCqA216smzBMM09sunW6R7C2NflTWBc6COpyX8lNF+7n5sCEqLBNi2W:aAowzDA2OC9suBR7C2tlYCOpXlNg7n5w

C:\Users\CIiHmnxMn6Ps\Documents/Lock.5IRX mV-dQwqDIWU8l.docx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	79.51 KB
MD5	83d6d733f7fad2d73b45931fde3dd17a
SHA1	ceed48f7ee254b5cec7591dbbb70ae3262154bf8
SHA256	5b269e3c84b44cdbe245a561903503ac21d0599769747af39cc5b473d38e7006
SSDeep	1536:bB8tte9zLpXSQXak4iHiHMiK3/SbcqKdxxWJgh3TwfcCtMX5BrsS1q1Nz1BNGpAw:NOtAL2+iHnToqzJgh380wMYn3Pi

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.sUead_MVmaeTHpH.bmp

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	71.29 KB
MD5	1e7171ac841afbca69adc30b85fc6459
SHA1	3fc4ac7bd8c0ed72f14705f25f8b5d59044373ba
SHA256	f6e85960b761c0b7e376cd4ab468d30d69d18072342ece3b6327dcf4e647686f
SSDeep	1536:yXjQjFXLXPAkqSLVQfzXFyMkN1/HGvcFOFb+28GZUiQ:yTAjvLGfFUxLFeb3ZUiQ

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.XyTO98.bmp

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	21.46 KB
MD5	4fd9dcfc7a00ff51bcb634f2499dc863
SHA1	0835315f9d83058e34c6b927f76dd4edf453419f
SHA256	219cabcafff610ee6b96c190f511bcfa610d48570de3fec1959a6cab48e213bc
SSDeep	384:JoD7WRRu3XhngcbGUUXot6ECSf8UAgE6hG/8QGrsDaDz/Y/ex0SpoEFxcNQCHiym:CDqj4XhraUq4CIxAgJGTGDY/e/pRMDCn

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.LRfe.m4a

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	38.93 KB
MD5	213033f7f95243e0d081716662e21a4a
SHA1	c7b0b49c5af97e76383ac620ae96928914788ae4
SHA256	688b6a57f76428e75a2cbf4999fc387e6c3a20beb954b39ed09edae6f5aea18d
SSDeep	768:Z7XQ5Lb5U9rSynUPBQjFztiKjww3w5quwLKsowYISe0pnes:Z8b5IJ4KsrAAVqNmes

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.-2zElut.mkv

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	98.02 KB
MD5	467557558ba9cf412e7ab50cb9de620f
SHA1	4b71b2409ba3e87cc2fd1f0c508c919ad36ce36b
SHA256	cc04f7e5922517f244ccafa653de5301df75c12677bc44088bff470b45397e7b
SSDeep	1536:cuflEAc4tRrq7L7klamUrd3iFw1/2fAyvIdJHK5krPGNM0PzLiq:jflRtRW7OaprRiF42fCJH+kruNnXiq

C:\Users\CIiHmnxMn6Ps\Documents/Lock.DzQxuyYypsLJ110Td.docx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	73.61 KB
MD5	7dae3050a85d9682e3f0326cdb43c69c
SHA1	061a0a0125ee2ef3eb72db2fbb2c21437d3c75ac
SHA256	104f2d8a665f20228eac81fd5979a46564dac4fa75369375230b5abf4add007e
SSDeep	1536:d9Syd/X2TFZY1e939Wp17tn18XxoNenX+8cGcqYPKDuaLZN0EriHMK:d9nZXCP3s17NKXxocXLc7fKDzn52sK

C:\Users\CIIHMN~1\AppData\Local\Temp\wl.jpg

Created File

Image

Not Queried

»

Mime Type	image/jpeg
File Size	205.93 KB
MD5	c2ff15c40a01069eb268482e26a43866
SHA1	e32bf7a5d21424cb81c10384fcc2136000482970
SHA256	27e962d5b9da5196be11b95483eceef3f2a9d43808297d7080702164057a7949
SSDeep	6144:BVHTAEeVrUGxoLoxEfO0v8B0/SAJS/NWye:bTAjAloiO2/n4Nfe

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.3 rt.png

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	46.73 KB
MD5	f5e1efa96e3b02f0a1ede22a8ddb0a85
SHA1	201ca097d549ad9144968df5597d6febb1819df1
SHA256	75e250a5515bda8cea73b1cee75afebceb2d2aa1f32a0eca79d8a4172de1f194
SSDeep	768:34mPkNr3AhV+v5lSzPkk/oDf6mydJZyFjetazRt9EyV0lxAJusiBbbCRGgWBsQLf:PPKWVs5lSzPklf6mMJusirEc0lxASRbF

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.lcXeGR.jpg

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	10.63 KB
MD5	df634e283fd8bb46316fd83dc1876ec6
SHA1	35b85d002c03c86db4122a6fc211c1ea24858866
SHA256	82b200c3877eb205e50024dc53b9674877b578e0c7042d00f9b75fe939dede63
SSDeep	192:d+jVShXwHnAESFLQ6S5UvTyzn4txsWekkndd5ahbtHyLvikBIDTdHhgDGFE7UoDX:d+xcXwHV+LQp50TanCePddMhbtHeviZk

C:\Users\CIiHmnxMn6Ps\Documents/Lock.jg83kL7EHzk5tOx.pptx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	86.69 KB
MD5	20de5fd8acf670ca264e7171acc7b6cc
SHA1	8da287e57d2e0d669f32659468b82171277740d3
SHA256	4e8e9d2b809210aed2298d9c4205eb1af41f043aa1bbe59d73e352d5a8c5f4fc
SSDeep	1536:7vbogrYzf3LGCJ+n7I9fVGAuUsFU9IdBbdpbWESAzv1o/006KsRHj96yTG8i/el:uL7JG7IBwduudBbTCELzv13WsRHjQw

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.my4LIyozfPFM.mp4

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	28.58 KB
MD5	3fffa3ffb3c338095c9ae6c8bf0edb82
SHA1	8abe2daeac8bba85630f558338c1e0685876df73
SHA256	87c8b2cba4daa4addcdebe55143a5a66e32fadfe97b5b7bcd891b36abf2afd08
SSDeep	768:4NzPoTKtsn7+wXuuKuKYsWQ1OtAxuHGYmuX/r1Vij:E7ts7nlKXWaO6gm8/a

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.PiMy.wav

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	1.80 KB
MD5	dbae8318821cc7a24304b1b3567af775
SHA1	2923ea576a6d16ef1088a5e31cd5f74d26711c3c
SHA256	e4a19fad6794f805c6fad10e28afff46c2febe392f37fadc28902c6a27ec1e26
SSDeep	48:uEUPxld5lH65HrWxTag4dWOEGUlRVT8Z+qD7/YLej+viMQ6Jw:zuld5lIrWxTh4dWOKl3gsqD7gK5MQl

C:\Users\CIiHmnxMn6Ps\Videos/Lock.Yh3aSzBw6vqSD.mp4

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	67.02 KB
MD5	4b6f76bd2b9dec668b355a09388003a7
SHA1	6318d21225192fd7c7d19a044b94f4c5c39a2f69
SHA256	a39da32f9032c03d2fa7fdc859d76ad16b12b954fc34993382bab7e757e4f3a9
SSDeep	1536:UMStlpPotfHCZORcYh4v5ZNdUmv7EHe+12uRMc0MoB2I3/ffXY3s:UMStlpPo9Hjh4v5SiE+CCc0My2I3/3es

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.YbpOFECxSdU1o.odp

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	79.44 KB
MD5	49934c6919a98d1c9912462d06ea705b
SHA1	50e9589dc395b3d377f2c4f2743a90003b858ffa
SHA256	f1f107aec8c7c288f9319d0650bb653f42cce6ba243719f745ec5f9ace4abcd1
SSDeep	1536:3k3t0yH6AN9ki/2HtRGSGaGC9tQIcnKG1LNhvMsdDSESL45LqejDtGgeiZeZ6H1m:06yaANaiONTGaP932VpfvKL45LNGliUF

C:\Users\CIiHmnxMn6Ps\Documents/Lock.G-L JfK4PzqcH7ER.csv

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	25.66 KB
MD5	bad959de243dcf334a006e4ebc465f78
SHA1	2e7a34c59097c92f01438b71a2af71c0819d825b
SHA256	e78613feae52cc96f450f69af9c45e88e3dcb4be0ad176b60158b904f1ba852b
SSDeep	384:B48QngckFygCEXXNvXhaKjpmLso9QZXzmHMhBXTGrjFoSWGTY5CmUBahIVPVZWEZ:B4dnswSN/NkLso9nVrj4DeNlGERM226

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.IKU0-73q9hf36BYJPVXf.flv

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	29.41 KB
MD5	96f23ade803faa1a16545f9fe6ffde6a
SHA1	77709d6fac78b81380422dd0e3728c6ad4aa09fe
SHA256	eb467045997cbe84ade2821e78ab54c9228205b3b8dcae4ca051350069595c91
SSDeep	768:Po/XdPZff9tTdWTtf8PJvwt+pP+BAGeymU1GOyjN8:AHfSkPJ4t++BAGxrGOq8

C:\Users\CIiHmnxMn6Ps\Documents/Lock.KwL8B1f2HAeXB.ots

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	91.38 KB
MD5	8d72829a904af43db7f489b422ce637b
SHA1	d818f7b165002a753291782521f6978df8731893
SHA256	a4839cc25e8ea58207d212f225c8c94afd516375035a273b71bda4b4984d7eaa
SSDeep	1536:4TCmxrtZhcCztvcGvIio0jl7vfdye8eqawDRCgjbhyU2+AorTknYzERW:E5r/hcCfjl4cDg/hyCnaRW

C:\Users\CIiHmnxMn6Ps/AppData/Local/Lock.TempCHHKSM.exe

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	826.10 KB
MD5	d8fe7c4ac10c250dfe0e808505d4a99f
SHA1	264077792d7d2f62972f063d2bc35157ee563c66
SHA256	3c46ab4bf7b6b8b3a5b8959432966b9a88422fcd7e762a4fcb28dba131c4e0d0
SSDeep	24576:t3IHOvL8GTn4cIQN1t6R/+kMs2wFMiBve:tYkLFHIQNXfDqmiBW

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.xH2Q91hAXQ3Pfvttd_N.wav

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	91.17 KB
MD5	ea5ce45706e2eef2baba047f506fa7cc
SHA1	d657410ae6caca7031ef0edfa3f520340adcc0b8
SHA256	2776b14b7e404dd7448ce5a65c6efe14e2b6c33c1ba596c2723b840760c06a32
SSDeep	1536:+53kjcv+lyZPpVKZ0TTC4WH1mh5Ig8uMiypstbjugDoEZxAVhR5fVWS52:+RV+lyZhV7TIn1uMi0qH9DoErAVh7VX2

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.eZG2gw6YILMiFluj.csv

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	6.75 KB
MD5	b02c087c6279a387903d9ada44bb5bbf
SHA1	518f1d7240fd3866a31f6dded5f57e0d5deb5c85
SHA256	083352332194af9722347d743784d01ebadf22c61a315e78ca07104badb3b0ca
SSDeep	96:ue+4rwGDIKSwbInsD5OfPGNvgeodL4ZpUCTbDQVDA5MAUYXe1pc4qY+CKv+pzKiC:uelrwBQNOjxdL9CT/Gm4/qYJKvhi/YJ

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.lITr E-u.ots

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	53.54 KB
MD5	a8a8fd9f0c4c1f676bf6434d82092140
SHA1	b7ae60dd21936b8a8bccd6359622011a28be2fbc
SHA256	80d4868bbf959c9879054ff58cbf308ead109ddaa21dd6f112c408c7d53dc21d
SSDeep	1536:XK7Snc3idWTKU2H4CDTntd85/C5mbyAvrE7:2iATl2TU/ZvA7

C:\Users\CIIHMN~1\AppData\Local\Temp\aut9F83.tmp

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	158.46 KB
MD5	cdf733d7407b35777abf9878edcf7eff
SHA1	b9180cdec4ad67db8a3f700908648a777927d4ff
SHA256	628281dc8f38559a8669adbde96e91d7b81899d3ab9f25ae341d91a6b1b9f555
SSDeep	3072:hjLSuioNwflplXMkw6kFSUMIjRaAAirK6IT9eRM5r3k:hjGzfXlXzlkjjAAAi29wKU

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.2k9SgaKkgk9oGZO2eWO.wav

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	7.19 KB
MD5	27478ed931c95e07773c94bc1b2ac044
SHA1	dbbd40f0b0fad5ae4b14841c7339538ff6faf805
SHA256	a1721745e4ca75a4188deab353e6446315db52c4a4779191dcff712a304fad13
SSDeep	192:u6XDiae9E4L8g68O+B33+qN48798aiKmAjLsWzE2rRfA:bXDiGy8g6Y3+E4kRmqTzndo

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.K2q1laBaVd-UhyM66s.mkv

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	66.12 KB
MD5	e1cacbfbf743ddc22d6bd6756de7a121
SHA1	4cd3e0e0a3b8e996cfc6ef9292fcfd2d939c08bb
SHA256	a009c9be69905dc090f32268ea88e72b2b2ea467ce240eb5927c4045edacdbaf
SSDeep	1536:pgDCqbUdmQ8pQMH6NtseIgIvR/z/n2cMScJq975VFoO/JLWA:pWCoUd7S6NtsdPprww9ND/cA

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.K1kWG.swf

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	97.43 KB
MD5	39c8efd0de27ea13686a65ae1f31f775
SHA1	f3a36dc08265f72cde0630182a60f83f523e4a68
SHA256	7eab751f9e61ca6ee3e052d702262ecf81f7d090382d34280210d0a62dce5c9d
SSDeep	1536:gwsCwNG0fWmX6qAqJVRCr5Zj09Ih17JilU3gQ9yqV/k+kUKG7QgAVdwe8LS:gtZpWmXWqzRCjFhHilcsqe+kUPUweGS

C:\Users\CIiHmnxMn6Ps\Pictures/Lock.yrGrT5GM2kHnbKjZs.png

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	11.66 KB
MD5	f89dd67365b8cb6a0ead8b6418beca42
SHA1	1fecc1b2ee957cbe72612310d61e7db15e40e273
SHA256	05e8a2e16cbd302ed5d3c413743133bff21d7b9842f2904eccce47e52fc09a44
SSDeep	192:/vaoC7dYWCG5FGM00Ayfzx+fkOVnT1yGFP8Ka8b81wG/:/vd7WCqGt5yfzxkVnBN+8b8Co

C:\Users\CIiHmnxMn6Ps\Documents/Lock.vgl6TzQ9uzGXrbslc.pptx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	63.44 KB
MD5	ea754a41a7a6f9e4cf9cd484ab82e0af
SHA1	723e798dcb0c99e81048e474466a9a3465cf880a
SHA256	932b1c457037662ae6334900eac8a1a18a575a84e9a911de3496448f71414727
SSDeep	1536:TVtgaT1baujvtfMgAWBuWETSaPdL9YMncNwqnU/Ysfzmqryg762ha:RtgMwKBJETSg99YMn+U/BX3a

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.oOD4uhzm Zkl2zk.mp4

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	99.88 KB
MD5	1a4e97b27a6267fec8f1f3fec4c84624
SHA1	ef376db17628ae50c00c2f2c569937d1cef0e3b1
SHA256	1c13abbe91dfb174afa5ff05a144b885f41f92d9b4f38bdc5f6f284ef3c4356d
SSDeep	3072:cBMnNNdclv0rRlQmEjKU0LsgqlvLv448aamu64rsyd0J9:nnNNI0TQTKBLPqlTvwku64ruJ9

C:\Users\CIiHmnxMn6Ps\Music/Lock.ZPcES1.wav

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	43.38 KB
MD5	67381f72e3f7a33306868df97f551bcf
SHA1	a27167948b2ba803dc71c0f464e04af9adf0283c
SHA256	d9b5ed215316596fb0d327df53f1feda249956a670211c2dfb97c163b42b612e
SSDeep	768:RxCGY6o0/yzlds45IHona2bZguRHK2w5TBETbhSTwFc+RhCGN/cDIIBdR/:Rdo0alOvk7q2OYI2JYICr/

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.rDNk37jQ34m.avi

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	96.94 KB
MD5	aed14f9333b2a93202ff9af7368da476
SHA1	abc9855d1a4f818905fb62fbd6a5ca99657212dd
SHA256	d9ba3ea3cc667bf84ec0494d9aff23431be36a4abbc32f165a2008e8413e8648
SSDeep	1536:e5HAajlTIgcc7mK0IfRZz/N75tfhmAs74XaXzC5+kAeUJbtytvx4n8/4f7wtUSxk:eHAHgcc7fLf/9hs4Xaa+kyty7QTUi

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.V9yoC.mp3

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	74.09 KB
MD5	c8580ee6280f3df84530d6e74407a716
SHA1	a937ac148b32efd9703442ac5b8be008ea62fbd5
SHA256	c5b10ac9e5668e66e531d67045b5fcbf0879d443c7c64fd01180367c49bac379
SSDeep	1536:imagLmAjyVSfPk2ahtgsjApFh6WXUpDtCqhlh3mx/tuEw3IkOwY:i3gqAmV8OgrpiWQZEw3IkdY

C:\Users\CIiHmnxMn6Ps\Documents/Lock.Y1zhfb0f.pps

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	99.62 KB
MD5	65c7385cae4ca02c95202134b4755dad
SHA1	4f2ec5107d4e6f717769d9efcef47522b0c73d16
SHA256	ef757998e795045f35e65586e12fc578c0899dd0784c89c0cfd10ceb422c5424
SSDeep	3072:YHEnP2Q3jXcsX3Hgl+H286ruO2tP+rbtwNL:lnPX7csnHgl+H2zuntPCwx

C:\Users\CIiHmnxMn6Ps\Documents/Lock.AkLAPzq8O4g_04G.xlsx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	14.00 KB
MD5	18e6554b26dfa99d3f2c2f4be61adf99
SHA1	99e665dfd77a241a8ed514cdc027374bedcdf987
SHA256	541f11d8cbbd527e9e8705bd42fd29219d32c3ab852848956fb5b14674a3f1af
SSDeep	384:Z369/3PfNGHw6LzYij6DCKxTcUkDJl+Mg:Z36t3PfSwKk86DCeGHXg

C:\Users\CIiHmnxMn6Ps\Desktop/Lock.desktop.ini

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.28 KB
MD5	ba41cfaa9aff58c3b40c7ac73b4d1cd4
SHA1	691f19d9330522a47b16c832c6d6b51a3a2efc72
SHA256	30fb6cb48d4689a02731dedf82483a58738ba4131e4be90b2a44bd1ab9fd6a0a
SSDeep	6:x/unJ6ZESn4iPU+HID8/KOv9C1pO+Q6M/N7P0lXXoU+IHn:x/YcZ74iPoQKG9CDO+eF7P0lXXoFyn

C:\Users\CIiHmnxMn6Ps\Documents/Lock.o5UgHIGv4h72IU.pptx

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	66.62 KB
MD5	4674d139402fecf1ded4946d49a8998c
SHA1	9d2b9ede9c14fc85971720c6b0a15d2357309f97
SHA256	d12202bba734b9e2468dd1b0b0dfcc5d83f20b497e53003c569ac2dcfedd3777
SSDeep	1536:dzPhqxeH/XOyG/GVwolvwPbSjP/PKwCSrg0v6e:dzoxeH//woWPbSznKBe

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.MLN9.csv

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	7.78 KB
MD5	9f7314a34cfcc8c71eab81bdec14c85b
SHA1	851d4ec16e4d4b61e3537114cdd7817c9cbf4350
SHA256	794b29e096c7880d664e97b6d719d7ad4c9bc63cdde2b0c25db75fb588894702
SSDeep	192:cXPHH6FK8me88AyIp0EbfkmHztTA44EHHPCHe5:G982+hEbfXHlSEHHPs+

C:\Users\CIiHmnxMn6Ps/AppData/Roaming/Lock.3- s1lsS.gif

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	58.35 KB
MD5	93453037a01e1a4cefda9b33166b34d1
SHA1	e8663d550f86f564237f042500ef90faa4d0bbfb
SHA256	007bef11bfde71251c031a908ecd91db3bb28387e2c94129c9ddf331b67ec1d4
SSDeep	1536:kTFtv74/LEY+KXpAwqbdU7/JgqsAwoYVhQ:kT8wY+WgbGOqeoGQ

C:\Users\Public\Pictures/Lock.desktop.ini

Created File

Stream

Not Queried

»

Mime Type	application/octet-stream
File Size	0.38 KB
MD5	ab6923299c092b4c0f3fcfbbe65b1621
SHA1	72261916cc9544c36b6f9c50bd3c1ba12d1f058d
SHA256	25e6ceecdbf5de7a584bb272da67f20ddb8fba4f068a7b15ea05eab2bb60bd0f
SSDeep	6:x/unJ6ZESn4iPU+HID8/KOv9Cwd+Iy+DTybApfQ4a94tu7fu7Kesza865InVVdwA:x/YcZ74iPoQKG9Cwd+IPTcAp4P9p7fuo

Notifications (1/1)

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After