329b3ddb...3ef9

C:\$Recycle.Bin\S-1-5-18\d2ca4a09d2ca4deb51b.lock

Created File

Unknown

Whitelisted

»

Also Known As	C:\$Recycle.Bin\S-1-5-21-1462094071-1423818996-289466292-1000\d2ca4a09d2ca4deb51b.lock (Created File) C:\$Recycle.Bin\d2ca4a09d2ca4deb51b.lock (Created File) C:\Config.Msi\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\d2ca4a09d2ca4deb51b.lock (Created File) C:\PerfLogs\d2ca4a09d2ca4deb51b.lock (Created File) C:\Program Files\d2ca4a09d2ca4deb51b.lock (Created File) C:\Program Files (x86)\d2ca4a09d2ca4deb51b.lock (Created File) C:\Recovery\WindowsRE\d2ca4a09d2ca4deb51b.lock (Created File) C:\Recovery\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Collab\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Forms\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\AssetCache\NAHQNPMN\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\AssetCache\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\NativeCache\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Headlights\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Linguistics\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\Logs\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\Sonar1.0\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Identities\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Identities\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\DQQHJZ8C\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\AddIns\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Credentials\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Excel\XLSTART\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Excel\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\UserData\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MMC\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\en-US\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\Pbk\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\16.0\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\PowerPoint\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Proof\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher Building Blocks\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Speech\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\1033\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\1033\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\UProof\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Vault\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Word\STARTUP\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Word\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Extensions\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\bookmarkbackups\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\events\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp\WINNT_x86-msvc\d2ca4a09d2ca4deb51b.lock (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp\d2ca4a09d2ca4deb51b.lock (Created File)
Mime Type	application/x-empty
File Size	0.00 KB
MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep	3::

File Reputation Information

»

Severity	Whitelisted
First Seen	2011-05-27 11:27 (UTC+2)
Last Seen	2017-04-19 12:47 (UTC+2)

C:\Users\CIiHmnxMn6Ps\Desktop\rlxsbp.exe

Sample File

Binary

Unknown

»

Mime Type	application/x-dosexec
File Size	99.00 KB
MD5	78efe80384fa759964c9ea8bada3ac8d
SHA1	6300dca046dee2d99f8429bdb9b5f3edc4d5ec1c
SHA256	329b3ddbf1c00b7767f0ec39b90eb9f4f8bd98ace60e2f6b6fbfb9adf25e3ef9
SSDeep	3072:UKwH7Fxw0GQi8SHa0jNwriVcJLLfO1MYU:XG3wq70pwrimxLB
ImpHash	9cee5c7b897408cb0c3cf964176a2424

PE Information

»

Image Base	0x400000
Entry Point	0x4058ef
Size Of Code	0x11200
Size Of Initialized Data	0x7800
File Type	executable
Subsystem	windows_gui
Machine Type	i386
Compile Timestamp	2019-02-16 12:43:25+00:00

Sections (4)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x11112	0x11200	0x400	cnt_code, mem_execute, mem_read	6.62
.rdata	0x413000	0x1648	0x1800	0x11600	cnt_initialized_data, mem_read	4.94
.data	0x415000	0x56bc	0x5600	0x12e00	cnt_initialized_data, mem_read, mem_write	6.67
.reloc	0x41b000	0x628	0x800	0x18400	cnt_initialized_data, mem_discardable, mem_read	5.59

Imports (7)

»

WININET.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
InternetOpenW	0x0	0x4131c0	0x13e68	0x12468	0x9a

RPCRT4.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
NdrClientCall2	0x0	0x413168	0x13e10	0x12410	0x95

KERNEL32.dll (65)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WaitForMultipleObjects	0x0	0x413060	0x13d08	0x12308	0x4f7
CloseHandle	0x0	0x413064	0x13d0c	0x1230c	0x52
lstrcmpiW	0x0	0x413068	0x13d10	0x12310	0x545
CreateMutexW	0x0	0x41306c	0x13d14	0x12314	0x9e
OpenMutexW	0x0	0x413070	0x13d18	0x12318	0x37d
GetModuleFileNameW	0x0	0x413074	0x13d1c	0x1231c	0x214
ExpandEnvironmentStringsW	0x0	0x413078	0x13d20	0x12320	0x11d
GetDriveTypeA	0x0	0x41307c	0x13d24	0x12324	0x1d2
GetSystemDirectoryW	0x0	0x413080	0x13d28	0x12328	0x270
GetVolumeInformationW	0x0	0x413084	0x13d2c	0x1232c	0x2a7
VirtualUnlock	0x0	0x413088	0x13d30	0x12330	0x4f3
GetComputerNameW	0x0	0x41308c	0x13d34	0x12334	0x18f
MultiByteToWideChar	0x0	0x413090	0x13d38	0x12338	0x367
GetTickCount	0x0	0x413094	0x13d3c	0x1233c	0x293
lstrcmpiA	0x0	0x413098	0x13d40	0x12340	0x544
EnterCriticalSection	0x0	0x41309c	0x13d44	0x12344	0xee
LeaveCriticalSection	0x0	0x4130a0	0x13d48	0x12348	0x339
VirtualLock	0x0	0x4130a4	0x13d4c	0x1234c	0x4ee
GetProcAddress	0x0	0x4130a8	0x13d50	0x12350	0x245
WriteFile	0x0	0x4130ac	0x13d54	0x12354	0x525
GetSystemTime	0x0	0x4130b0	0x13d58	0x12358	0x277
lstrcmpW	0x0	0x4130b4	0x13d5c	0x1235c	0x542
GetModuleHandleW	0x0	0x4130b8	0x13d60	0x12360	0x218
WaitForSingleObject	0x0	0x4130bc	0x13d64	0x12364	0x4f9
WideCharToMultiByte	0x0	0x4130c0	0x13d68	0x12368	0x511
GetNativeSystemInfo	0x0	0x4130c4	0x13d6c	0x1236c	0x225
GetDriveTypeW	0x0	0x4130c8	0x13d70	0x12370	0x1d3
GetDiskFreeSpaceW	0x0	0x4130cc	0x13d74	0x12374	0x1cf
VerSetConditionMask	0x0	0x4130d0	0x13d78	0x12378	0x4e4
LocalAlloc	0x0	0x4130d4	0x13d7c	0x1237c	0x344
LocalFree	0x0	0x4130d8	0x13d80	0x12380	0x348
GetCurrentProcess	0x0	0x4130dc	0x13d84	0x12384	0x1c0
LoadLibraryA	0x0	0x4130e0	0x13d88	0x12388	0x33c
GetModuleHandleA	0x0	0x4130e4	0x13d8c	0x1238c	0x215
DeleteCriticalSection	0x0	0x4130e8	0x13d90	0x12390	0xd1
GlobalAlloc	0x0	0x4130ec	0x13d94	0x12394	0x2b3
GlobalFree	0x0	0x4130f0	0x13d98	0x12398	0x2ba
MulDiv	0x0	0x4130f4	0x13d9c	0x1239c	0x366
GetTempPathW	0x0	0x4130f8	0x13da0	0x123a0	0x285
VirtualQuery	0x0	0x4130fc	0x13da4	0x123a4	0x4f1
LoadLibraryW	0x0	0x413100	0x13da8	0x123a8	0x33f
LoadLibraryExW	0x0	0x413104	0x13dac	0x123ac	0x33e
GetCurrentProcessId	0x0	0x413108	0x13db0	0x123b0	0x1c1
CreateThread	0x0	0x41310c	0x13db4	0x123b4	0xb5
Sleep	0x0	0x413110	0x13db8	0x123b8	0x4b2
ReadFile	0x0	0x413114	0x13dbc	0x123bc	0x3c0
ConnectNamedPipe	0x0	0x413118	0x13dc0	0x123c0	0x65
CreateEventW	0x0	0x41311c	0x13dc4	0x123c4	0x85
CreateNamedPipeW	0x0	0x413120	0x13dc8	0x123c8	0xa0
GetFullPathNameW	0x0	0x413124	0x13dcc	0x123cc	0x1fb
InitializeCriticalSection	0x0	0x413128	0x13dd0	0x123d0	0x2e2
GetLastError	0x0	0x41312c	0x13dd4	0x123d4	0x202
ExitThread	0x0	0x413130	0x13dd8	0x123d8	0x11a
TerminateProcess	0x0	0x413134	0x13ddc	0x123dc	0x4c0
ExitProcess	0x0	0x413138	0x13de0	0x123e0	0x119
OpenProcess	0x0	0x41313c	0x13de4	0x123e4	0x380
GetShortPathNameW	0x0	0x413140	0x13de8	0x123e8	0x261
GetProcessHeap	0x0	0x413144	0x13dec	0x123ec	0x24a
VirtualFree	0x0	0x413148	0x13df0	0x123f0	0x4ec
VirtualAlloc	0x0	0x41314c	0x13df4	0x123f4	0x4e9
lstrlenW	0x0	0x413150	0x13df8	0x123f8	0x54e
UnlockFile	0x0	0x413154	0x13dfc	0x123fc	0x4d4
InterlockedIncrement	0x0	0x413158	0x13e00	0x12400	0x2ef
CreateFileW	0x0	0x41315c	0x13e04	0x12404	0x8f
VerifyVersionInfoW	0x0	0x413160	0x13e08	0x12408	0x4e8

USER32.dll (19)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CreateWindowStationW	0x0	0x413170	0x13e18	0x12418	0x70
SetProcessWindowStation	0x0	0x413174	0x13e1c	0x1241c	0x2aa
DrawTextW	0x0	0x413178	0x13e20	0x12420	0xd0
DrawTextA	0x0	0x41317c	0x13e24	0x12424	0xcd
wsprintfA	0x0	0x413180	0x13e28	0x12428	0x332
SystemParametersInfoW	0x0	0x413184	0x13e2c	0x1242c	0x2ec
wsprintfW	0x0	0x413188	0x13e30	0x12430	0x333
FillRect	0x0	0x41318c	0x13e34	0x12434	0xf6
SetTimer	0x0	0x413190	0x13e38	0x12438	0x2bb
ShowWindow	0x0	0x413194	0x13e3c	0x1243c	0x2df
CreateWindowExW	0x0	0x413198	0x13e40	0x12440	0x6e
RegisterClassW	0x0	0x41319c	0x13e44	0x12444	0x24e
PostQuitMessage	0x0	0x4131a0	0x13e48	0x12448	0x237
DefWindowProcW	0x0	0x4131a4	0x13e4c	0x1244c	0x9c
DispatchMessageW	0x0	0x4131a8	0x13e50	0x12450	0xaf
GetMessageW	0x0	0x4131ac	0x13e54	0x12454	0x15d
ReleaseDC	0x0	0x4131b0	0x13e58	0x12458	0x265
KillTimer	0x0	0x4131b4	0x13e5c	0x1245c	0x1e3
GetDC	0x0	0x4131b8	0x13e60	0x12460	0x121

GDI32.dll (17)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SetBitmapBits	0x0	0x413018	0x13cc0	0x122c0	0x27c
GetBitmapBits	0x0	0x41301c	0x13cc4	0x122c4	0x1a7
CreateCompatibleDC	0x0	0x413020	0x13cc8	0x122c8	0x30
CreateFontW	0x0	0x413024	0x13ccc	0x122cc	0x41
DeleteDC	0x0	0x413028	0x13cd0	0x122d0	0xe3
DeleteObject	0x0	0x41302c	0x13cd4	0x122d4	0xe6
GetDeviceCaps	0x0	0x413030	0x13cd8	0x122d8	0x1cb
GetDIBits	0x0	0x413034	0x13cdc	0x122dc	0x1ca
GetPixel	0x0	0x413038	0x13ce0	0x122e0	0x204
GetStockObject	0x0	0x41303c	0x13ce4	0x122e4	0x20d
SelectObject	0x0	0x413040	0x13ce8	0x122e8	0x277
SetBkColor	0x0	0x413044	0x13cec	0x122ec	0x27e
SetPixel	0x0	0x413048	0x13cf0	0x122f0	0x29b
SetTextColor	0x0	0x41304c	0x13cf4	0x122f4	0x2a6
GetObjectW	0x0	0x413050	0x13cf8	0x122f8	0x1fd
CreateBitmap	0x0	0x413054	0x13cfc	0x122fc	0x29
CreateCompatibleBitmap	0x0	0x413058	0x13d00	0x12300	0x2f

ADVAPI32.dll (5)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetUserNameW	0x0	0x413000	0x13ca8	0x122a8	0x165
GetSidSubAuthorityCount	0x0	0x413004	0x13cac	0x122ac	0x158
GetSidSubAuthority	0x0	0x413008	0x13cb0	0x122b0	0x157
GetTokenInformation	0x0	0x41300c	0x13cb4	0x122b4	0x15a
OpenProcessToken	0x0	0x413010	0x13cb8	0x122b8	0x1f7

ole32.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CoUninitialize	0x0	0x4131c8	0x13e70	0x12470	0x6c
CoCreateInstance	0x0	0x4131cc	0x13e74	0x12474	0x10
CoInitialize	0x0	0x4131d0	0x13e78	0x12478	0x3e

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-addons.json

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-addons.json.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	450.04 KB
MD5	d136c6b32ad956dbea78600a2add77f5
SHA1	59d731ddccdbe799a9b606bdfa19f083449bc820
SHA256	20e62a07c4afda3d9fc27824faf680bdd50dddd3dd7fe46c5a7ec50221625a1a
SSDeep	6144:ucuS/zmxox+9UXSlxv7/Evj2Q1+JvsrfKRDo6kjsOtjswyGKJ2tlGf9+6U3/Al6S:doIX8v7sj2AIvKKDo6kltjdyG5048p

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	11.64 KB
MD5	c54c34deaaef536453104a633c493016
SHA1	7211e53ca9972e0907e08cc86a5030d37d9fe97e
SHA256	394c7deea8cbcbf3924b0b2a69a28c6d64ee4a8ba56a00ccf24d80da0d3e9139
SSDeep	192:q4rxERau5hcPMHeGdtmk+8EUuAJ0IelKb7epXnnBuGg71QfDs3njoR7TDitd2gDG:1r+R35h4GdtnBue0Ie9pKQf4TovutMgC

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	288.15 KB
MD5	0010aea5322f5a732403f973947222af
SHA1	c969952be285801809c57114b32f77e02fb293e0
SHA256	b39b0c8a4c9b73bc4f555a8fcc3740dfc07a17c14a231b2e3dd2a57e49112a63
SSDeep	6144:pEnRo3u7ZVywfgQqQgrgZXJ7A0LDfrT8i01X19uX7vUCcnBcMxb3bnAUTrNuEF:pER+u7ZVXf/IrMlA0X8cVcBPb3bnAUVh

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\8bo5Ma7MZCSN.png

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\8bo5Ma7MZCSN.png.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	17.22 KB
MD5	67c0417bc66cbbe85f90e00cad22fd5a
SHA1	04f6636fdb8051e3d0006183f5984dd0a2e5fcdc
SHA256	2dfa570ede2338bb2274c9a7ba3452eb0a876bf003992776a93fa0ca980f7f40
SSDeep	384:J5K39lkcbQKgvOeAxopWLcHLY9qY9T9E+DdRJ0F5f32Ke0ukp97sOXf/6F:rADUAxdGs9qYnE+DdA5PZuejP/u

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	262.90 KB
MD5	35a3fca4d9ee43727ee296402bbcb3c8
SHA1	c370c2e34b40c47ae008250cea2848232d66fb12
SHA256	05fdcadb437cc13bd87e6d1b658b9b8d4a34019564b48467725c0351176365f0
SSDeep	6144:PfpOnAKIzkx0G25JfTN1IG91e02iBFbolsYW:HEnAKIBx5Jfb3ew07W

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	18.85 KB
MD5	9b7975b24b85aec31dff26e3a051c329
SHA1	5b2ebc33f98f0429917a3387c19f7e3c21e69d06
SHA256	74e1002f0f57429287be71e467e0873f9c3977e110dfe78351115d6d7c5e3cc3
SSDeep	384:8rx3Ke2T9+IS31NdANGotAHOzGy5CstQy8spxft3Oa3CzsuXJ6Kbu25y:8tkczYVAHm/8EX8spxcJJNu4y

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	2.25 MB
MD5	d8b0d2f1fb32148556914ac3e9e5db16
SHA1	4902138de3dde5df8f5cec953d9bb558b328e5cb
SHA256	c8ed1a92af4684f9d6b2aa98cc57e5972b59d9d9fbb0ef96b4b8a3a028ffe9bf
SSDeep	49152:pZ5DQNZomnkUMlZ3FCX3CzwovQTSwW8nT:pZ6ymnHMlZ3oXSzeOwWET

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	594.40 KB
MD5	a9df5ee9e5abcd9d550decf150dbfaa8
SHA1	2d39109df7e95d60ca600d08a6de8b3b6d3fa131
SHA256	eb364a1bbb7ce61997a2ca83fb7c7b63c7a8adf6ea69ee3737c016338a16c37e
SSDeep	12288:WH+bMtMZRw0LmsXwjJpU05FHLJv+FTD7YjYfvl+dQB:xMtow0dXGpX5FH4FTD7Yjavl+dQB

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-gfx.json

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-gfx.json.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	27.83 KB
MD5	e5c37b5e8ed271d64875db5ad726f4a4
SHA1	b3f34d1c04f5369ffc518da9f494882f103f61bf
SHA256	bdb768fd1ac736b30b2b1292c6606c2ad4d864fe3b6396a9eabbaa3bc9f2275c
SSDeep	768:WYnBOR/44uIMq5S4gplj/ez921nbh//R3+o:WYnE24HMq5SZ/ezQhhHh+o

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	6.17 KB
MD5	d5e4d7c7f124f587c070e84e17a737d8
SHA1	0d3913cc6ec79ca2d4de28172bf99cbd1051d9a8
SHA256	db860c20efb4109b8da7b5b034ae0ecd46856e366bc67a201bddad80639e761d
SSDeep	96:4dNKYhcCpVs6NSaR8Hd2Mf78iheqM+0RnS8viPFkoW5Kwir1Q0lYCgApZkDPPU:4dNwC1wuC2c78iZMxSZuF8r1QmYCfP

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\TURABIAN.XSL

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\TURABIAN.XSL.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	337.11 KB
MD5	43837fb6026275a536b883aa458e7123
SHA1	3b6e561fae59f038ebad03aa968c89659f1dc0a0
SHA256	f7965bcde87db67d65c51a32113ec1600a593f8eeac7045957dce453cb2b898e
SSDeep	6144:/xDybtUMeBgKHayLiWoSvhxq05eWrIuiKb0ZNDmSc1nylan5D1k:OtABgNy3oSvhxKWUtmSCntnxG

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	1.57 MB
MD5	a83367b7d259f985f017daaefe4cd4ba
SHA1	e0c74c3d756021cae8539c3113151db1aff5f8dd
SHA256	4ec117745750a6f157c47606694f3d0d9032751dc5a3f0f98c61b82d9cc54f2c
SSDeep	24576:ds+y8WJWEE6AWjMkQxD2a06qJyesVw9Xsm+/cQ9JlBGhJt6rUekDSgyM/LZTl5Kk:W+y5JWejO06+yW+1QtNrugnp6k

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	4.67 KB
MD5	f253cd3810190980393520775071c5a3
SHA1	0392953f163635ed20e7f689b98c42c188f4b0ed
SHA256	51c164f97b49a35b8508fec4da2af5e55505113408251a57775d32610b779875
SSDeep	96:t2MjXcEcF9Ume4BrLclX7CoSMw+xju2J8K+kF7Ah4nkvt0I:sMjMEcLUme0clX7bSMwIj8K7F7AhVveI

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20170518000419

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20170518000419.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.54 KB
MD5	771fc74a593a36442c1d38c3af73c7e3
SHA1	79090f58d4a466e109051aa7aa6092b5892d8450
SHA256	eae2b99ea9ba50b69a8f1718f683491cfd6c7cfad78678cb86af4baf3b672c46
SSDeep	12:dF8JVa2TN6z3gw0h0IygCymLYJgVPdKt/cisYW++Yo2CC:dgVai6z+0Iz/YYkPo7v

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\compatibility.ini

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\compatibility.ini.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.73 KB
MD5	e59e8ce7033dee24d0058bb723f76632
SHA1	202e18600ab8363ac2e64a37bf3e5a6ee96a5860
SHA256	a3b4961ca621061c79bad8033a5b0fde60d193abdba84ab677020fec153ccf51
SSDeep	12:XGy+cPFzzZiE22UUMgPCPMD16uvbsB9aTe6SiCe7oX3+n+41dIN2C:Xt+cPxzUE2x80uTs/YU5X3++4/Ix

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\9v0FgvA-o3wubBpr26.mp3

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\9v0FgvA-o3wubBpr26.mp3.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	80.95 KB
MD5	c215d551219b197a6bf0ceded76074f5
SHA1	b64b09ee2699ee7030dca1ea3f7f0f3448567ebb
SHA256	abffa449d206e92db43b6dd9f7a68cae15ac1fd66a1bcbc367066cb0e3df5210
SSDeep	1536:n+TqUxQgJBUsxoviDpOaXo+I7+MZ3VUIukitn6kdL+Eq75pkOxjx8:+ugJBpI/7+s3VRSnHdLAdpe

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	5.53 KB
MD5	784adc113041fd383a55596b29b7cac3
SHA1	d6e098705a9a9f3c3750f5e358eed656fd9dab61
SHA256	96bd65199982b6434b686845bbc7dbbfe3c524eff0e55a0e85c832da452dca47
SSDeep	96:G2kk+ZQiwnjBYnmRajQQcWLlKd+SRkT+VEbzTzPEYF8qq2hKL:G2FmQBjBYP6WLk+SRWmEHPEYFJhI

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\15d22704-736b-416f-a36b-857f2a5d2a7e

Modified File

Stream

Unknown

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\15d22704-736b-416f-a36b-857f2a5d2a7e.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.98 KB
MD5	75deee13cb3c2cb6b8172f7252619614
SHA1	6d3609e97f83b344562c754f4eb5f1569553be35
SHA256	586ac08fda3ab78f916444abc1c3497092a0b48883a2de465f38e509a79bfec8
SSDeep	12:Wbme8jxqQxmnfhRbgprdVx+CSGsR68LGyHb4+uEzvu0+R6pFDW+xBvISyK0Nrb5X:WbmDIcmnffMbRwLlH0Gvux6n7xBUHOjI

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	249.76 KB
MD5	506f995983fa598242cc942a24660ad1
SHA1	cc45681988fb91773e0e11709b96a51794aa963e
SHA256	80eeec80a2119b353ab52d73ae50bf142ae6f48c058c771b12b8ecd977c1a578
SSDeep	6144:JoTFMfM92g/7SsVbefuKdEPS2IdM0EOU+WepBDlBeolyf:iOfMp/7PeNSSg+BBJy

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.55 KB
MD5	b061ea02de1ad45d14987d528a72ab69
SHA1	b1016734c1e67326c447644e353f90526c68a0ca
SHA256	21d1c944c984bdddc3f524c0f081363e52f47cffdb23b9f5f67b5a44e1a093bb
SSDeep	12:yjd7/I9+/4DoZch7BxzllYDHxeE0WH60EpPamzYS3q6H/9C:k7/JGCe7UDReEQ0oaTS3q6fE

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	1.04 MB
MD5	ed45cb2a5843c833d448b91780084b28
SHA1	3eab9b856c6b5fb9c8d43fe8e155ca230162ae61
SHA256	4ba389dc095bf8410050f0c5eae1e14488eec96e628ccc3d9611c88a8415badf
SSDeep	24576:eLXBc4Uv2sX0GVXfMyYcldrZgtNhX3gfKlVY2XTXpk3Xo9z7l:Vv2sX0GVXxYkr64KE2D5knK9

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-plugins.json

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-plugins.json.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	197.21 KB
MD5	0aea10b5bba2068f7b181892456b8482
SHA1	30f58a808eaec03559aa3be219c08e081d186998
SHA256	eeb3d8795a0d78cd92b4af14029d5fdeeed44a5ce706b54c060f5cd596bdab39
SSDeep	3072:3AzhTjeIljF4I9r9n+BDzTzd4tcOg4/YmlBzPdryznohMLCvOMq1VA8YLDzC3rtJ:wleCyEgrd4uOVlprEom+OED+35Ka

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	290.58 KB
MD5	aa0742764a4bc3de8ccbf916bbf7a8ff
SHA1	426314b85e7b6638a78fba7eca7138d72eb0d22e
SHA256	64c5a2f34db0ba9e37d2f5ac954fa44ac4f02e5210abdbb154b4d72a27ae6512
SSDeep	6144:Jg4It/Uy4vkfitS8IntrGehyks1X9gBwCb/a+1nIHafZ:gikaYvGr/XaGCf1N

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\k8pe.docx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\k8pe.docx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	23.31 KB
MD5	0def914339dba51d2659af1a80e1631d
SHA1	b1a9fe586c1a0700001d5f28355b9f9191c8a392
SHA256	fd3c3485924d78ab5b64720c81df2fdb86671047db8018504ec9e1a8df2fc488
SSDeep	384:A0g8axxPjCP+jxM5UkxPDvH9y05uT++iduG4PY+cU8BIKWAmr+zSlSoIBYqFCu3N:O8WCGjaS0dETc0DcU8BIVAmr+OlSokYm

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\SYNCHIST

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\SYNCHIST.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.60 KB
MD5	1cc10fd7567e4af44bb4307c18007bef
SHA1	e3a005fa707dd76f0446a25d0a0f55794c0fe538
SHA256	5f0af2d52f04d06e75a2cc641e2208e35ef925223379b76bbc62b3854c6224bf
SSDeep	12:oPo7oZYfbtYvoIAv595gmWbDisgC6qfHG8u2NfpkLsGgmnkCBSEmDmq0cC:1ftYwIXbOu6qfdhbCsGgmkCBSEm6n

C:\Recovery\WindowsRE\ReAgent.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\Recovery\WindowsRE\ReAgent.xml.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	1.54 KB
MD5	8ca9d04f57ebd9bcdc2e6e96f778700d
SHA1	40eba6d5f271ee1e5d38fd6c4fe4e8611ad28cb6
SHA256	4d0fadf5c10c0c9a3bda66ba1b5d26c31f61b56907f704975c0a70ca0204dbb7
SSDeep	24:tJCWqL7hiQcput8QCjapZQiniqJkpqL19/7jAPBUj9t/PBh7LQGOKHB2Ud0BDirS:tJCF5cp2Lt/L1VvAEbhhPQGeaUQ6

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\K0spQSfUKxJCGIe.png

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\K0spQSfUKxJCGIe.png.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	66.18 KB
MD5	33ba98a357188cae889b6fc02963ac50
SHA1	346cd5d8083354a0ef7c4c06af0a4067fddaacb2
SHA256	a61331f8537d133f2ad1f68c3b77f2eb5375e9615889abab4b0aedc9fc2ab24c
SSDeep	1536:yPKhPRhxtlDlXdMA0fSoodk2xWb3l9LZpyNyHyw/mORH1sgInk1+G2m/:yah5X1Po/9LZeySw/mOROkA+/

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	5.58 KB
MD5	e148fb82146751eb3275114014ac797d
SHA1	16f2ed351a525ca68f0067bd046dea082e235781
SHA256	6c1b8639969455bfa16ca8fc3b796dbc7c2a4df562cb723864205660237b21dc
SSDeep	96:yG8KVRfMOWsulMxoRYExvNNjKgmNIxj967nCM9EO+VjkQNt5dZH:yG8KHWHMx/2WX8jQTCM9EO+Ltr1

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	545.48 KB
MD5	128267151d35a82f8f3379a11139ed6d
SHA1	495cff7f4e2c3c810de63b39bbea00ae4e9d8039
SHA256	0ea2be63ce9a666a4f4954273824cf1fc4bb7eea0fc60ca2eda890a330cef266
SSDeep	12288:k+p0ucVhJN2FBdiENWna9vxIIJKn8f2ROhw9K+PRQ:oucVhJN2F3iuWalx12t9K9

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\eauLyTsZ.ods

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\eauLyTsZ.ods.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	5.56 KB
MD5	f36cf7ac8ff848ba83d6fc4c30543fa4
SHA1	45e5c1fd4265e399b0a3089a8a2dfe52e72071dd
SHA256	9d9a3f276e1d3e4656bcf03d50b206a41fafba520ee82a0e2caf75cc56e569e8
SSDeep	96:vp6zH8EUvBlWk4IobywVKK5rAj7YN6iQSzUOEJfGbki50H2jcrT:B6phk4IobywVn5GQQIdE1qkiqWgT

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\hnb7PHQYw4L0j.swf

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\hnb7PHQYw4L0j.swf.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	85.96 KB
MD5	7f245ffa9fa2a260e3b305b6fce77326
SHA1	e1baca08746c3f7c8ec2bca969f738749d5d9501
SHA256	30f9f2b307a9d4da3b17a3ab7a4e0dd15fb15cd73c08a8711953e6fec2284134
SSDeep	1536:cKty6kmWhCF+nL/oiLBioxigVRiTOquY0Ae4xt4kgyz5i9zAys2uWhr8YjbPPp/E:VaIsc+hnO2Ae4xfzeOOljbHp0EU

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Cashflow analysis.xltm

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Cashflow analysis.xltm.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	371.63 KB
MD5	7a0206dd85a6d4987623547cffd963a5
SHA1	eff83005cf97e7288339505537bf3aad5901045c
SHA256	e5cf308e3dc618a84d3f9b803de8ef478779091a27a539f698bb1a0f3c74e663
SSDeep	6144:ome817DlPRuIZhTLSRkuZnb7Vo/akEa+OPg+OvS2hJCCjhyMpLOISmM+/0g:Be8zY8Wdd7K/aaRjO/JfN9ZONmAg

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\Preferred

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\Preferred.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.55 KB
MD5	4fa508e84bcb0c2a5dbd2c62998eb3d7
SHA1	4511da17af18bf914fb72f2d625a21d6dcb5d926
SHA256	8824b757f75822c84c474c3938addad8cac849e6ece0e761137cc2a181f33305
SSDeep	12:oe5x6rVvVS0XVObSHtCIzrunEAFFEPZcd5rsYXseOtf5anIQC:tcVvVSuVO+HoIzynRgC5rc

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	3.53 MB
MD5	c25f3ba48690b762e2695d05c1ce09c4
SHA1	07e1d3a8a1bf108b3f86a732dd69e1e38c5c6ce1
SHA256	72322a1dbe5e0b0b8ddfc5119ede99c87664a14df98e4690c5aa253b3325cff6
SSDeep	98304:J0+GgzFanO1+ZOcyOsVp+sFp4qvqgwfvXJ1lKCs:BGAUO1+9Avv3wfPACs

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox

Modified File

Unknown

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox.sfrpesivt (Created File)
Mime Type	application/x-cpio
File Size	6.03 KB
MD5	3493a584295f8e8064247ad8176b88cb
SHA1	3c586ba82489a54566de6ff05531c1b523945877
SHA256	1475da8a3e719ebb0d14668c1059cc4612a8abf2ae7b155c0319d217e8293156
SSDeep	96:WNpvi9jbOWE0BCGb+yMo60lk6UiS5FILMx9lH9GKcqn1VWE+1Nq5aA44+goCW+g+:UIbOWE0BCGNh6ZIwrl4OOEeAvmQ7N

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\kIQ1x4EAWiFzt.mp3

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\kIQ1x4EAWiFzt.mp3.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	22.35 KB
MD5	5c801b9abfd89cc9131e8bf974cd8f5c
SHA1	f2d18c2196cfa23a172a9bf6522743fc12e771d8
SHA256	5b38c60e9a73d4825b015a24168f1665bc23d76670ddee0d58664fde7a0e7982
SSDeep	384:8I3Gz/1YWCOYlPusIcXuBHH4JGvQpNA0Ow92qZvtgqsAVSjkqnYc7ADc:8T1WPuspXuqGvQDAR02qVtgq5SjPnYo

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\h2MVIrGzsQBkTtY4S.png

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\h2MVIrGzsQBkTtY4S.png.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	62.45 KB
MD5	1ce10ab56e7717b57203142e7ad5e145
SHA1	40c168b73c11947c3a08f78e541486285253d50f
SHA256	9df58c5a432c337b1456276282883316dd339703aaa907b46e18b70f2da51c4d
SSDeep	1536:zYJvn7FAGNvvGFn/UOEYA10fh1x/NHlzS4tg0lNPcQ8oQDguN1+:zYJv7FF9vUn/UO/m0fh3NHrgAlcLdguK

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\cert8.db

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\cert8.db.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	96.53 KB
MD5	56d20d89d4ead2e815930e0565d0f00c
SHA1	f31937a76ec082717ef027ffe23078942bfa09a0
SHA256	e5b6c0b03615345b5c9fd423f0ab43b7e10429e41aefb7bf890e03e546c4a7a5
SSDeep	3072:kc6PDgBEdp4r+IrQjIv5c/pfxpdHQC/7bT/EdjoOte7et2co:kcqDgBEd8HvmBflHQQ74veSI

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	475.72 KB
MD5	ab65ed2095d00250139de10b5d8954d8
SHA1	972aec43636085090d9e708841c2892666bcbf1e
SHA256	fd0e74709165d63794f9add0b682d52a1e2daaba0c85fb3b8fd255c0d33c4785
SSDeep	12288:UITn2cp+dcXswiGKA9wyBV6Lz39eyfSxt:UICQswSAtVAz05t

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	5.70 KB
MD5	7b4b5d4b3c45690ed0ca3cb46a308820
SHA1	17eea860ea77d614737c6a7cfead2fe5002da97b
SHA256	f8c6251aa227babac6624c347605914ce14a4cb90eb43e7c6333904fdd1a4031
SSDeep	96:1jcadts1RJSSlZwT+lVCrVVUr+fB0hHuW3C8g1M3EbnQpfRJPfS2rFE:dcadS1LDZlVCZxeull1M3kmfPXS2rFE

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\04cd465a-248d-4abd-853a-5cb67fe43510

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\04cd465a-248d-4abd-853a-5cb67fe43510.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.98 KB
MD5	3a4fb5c64d6556af66e3320558918320
SHA1	75534906f794a65fd7bdcc0523d3d36a4c42d742
SHA256	a92391da85ee092bec48038044fd0ba6f3eddaf25811551744a94fe06a20cac9
SSDeep	24:RIHx/ds3DFTlK/i8CpcSJM+61fhmIhnjYN2KT2Sb0bdczrUv2UZ111Y:Rex/ds3DFB8Cpg+61fmNLT3zrgnZ111Y

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	5.56 KB
MD5	3da475a0cdb4891a9d90711654cde696
SHA1	be902826b85bc206f39d630f186f7de035d8aa82
SHA256	c0a375f3c6965ceb4b3381461c5370922321725f1a736db7c67209e56d8bc83d
SSDeep	96:gqvzbw4M5vMA/+pUBDNXGFobD4bFZXcg+k0ludlmyQEHml37RSyFN4l8vjO:vvpMFXheCPAZMA0MjTmlEwN4kO

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\SIST02.XSL

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\SIST02.XSL.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	245.97 KB
MD5	46a4b6fa936d4765368435a659300bfe
SHA1	1eb2403719d0bb29de1637b2cd4d08f906b585af
SHA256	591d912413871289ea9af12944c133aa785392359fe813caea3f9af48e77c9e7
SSDeep	6144:qG7vkQqdOdd8cV54jPkmBGX6HC12764cxT9jixVAoKX6vVVyZ:J7vkQxKAqPkmBbC1f4chlkwoVe

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\AjZgg7KeVXO.bmp

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\AjZgg7KeVXO.bmp.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	2.62 KB
MD5	2e0d526cbb91dd890e33526e812867a0
SHA1	cdce13871e7b481ba96f0ec7e334e2ec75b66c0f
SHA256	7e635de26919237ff2642c7e07ca1dbe6ecd16c68714cb8ea8a6b78ca01bb14a
SSDeep	48:D2XmDZVGUj180x+qL2pF8w5hMrh6jlM9cY07rQ0/zyCRG3c5Kz8F1u2I3jd+k:D2XSVzpN42Dkhu07rQdoEz2Ih

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	1.15 MB
MD5	591ceecd0518cc847b802fcbac5040b1
SHA1	ccef3243d2c56fe0f0e368fcca01761747a9bad0
SHA256	4a0bbcdebfa57504e3e5e729b74d50761c54d86ca43e70949b9c23c550727136
SSDeep	24576:igyUNwlRW5EKk4PX+RvIh2fgwghc8lvT9t3zYXNcEq/zWoTzRx5QNn8:ioNwlfCXMvHghRxT9hQcH/hR4N8

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	5.40 KB
MD5	cb650c43a53ddb7f267684b0f799113b
SHA1	2e34a8309fb1520da79ff214f9eb6ad73dc13772
SHA256	f890d9ad7972be0d7af88d5dd28cfee27cb6cf25e57dcd01346d56b27da62013
SSDeep	96:zSdJjeu0WrpZf9BKXr6kY23Nl6ifQzqEXGPr4zdO8VeBIqja0lfhe1:cJMoZi76kZ3Nl69dXGP0g8VeBra0ze1

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\1OlD0DrQDAo g7.swf

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\1OlD0DrQDAo g7.swf.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	39.82 KB
MD5	47d504e4778b400a552f14c4410499cf
SHA1	0e4550f328d353ec858ebf9a4d6b1e0b83cdea76
SHA256	415bf94b66d53140a1d48b1e2c73474196ff4fd2be1e3d10a7fb758a33a46576
SSDeep	768:jZ315nlOFeUEQBt+hXjHLP+V4cHj/ZLlA4H6x/dFXwYiwTxZeh8F2:HtXjHLhcHj/ZK4idS3wTxUh8F2

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	6.41 KB
MD5	44ebec02e9d7994aae7bb789e2eaf684
SHA1	cbf69e8fcf02beef19f6b377341301bac71b4ca0
SHA256	dcbed0b18edf96a4e94dc9a47b20e6ebda99181e2eb188d23920f1e3343ee64f
SSDeep	96:q21M9xslg2Lb2U8cfV9p44YV7oZrHRg/+WcFcgwPyzK3LtTAgDeMddR3NO5ah:qteg2L68Nf3FWc/az7tsA3NO5S

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001103[[fn=Headlines]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001103[[fn=Headlines]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	527.49 KB
MD5	10b6d8874f4536086a02026ddb93718f
SHA1	6097a1324c0f8db79d6f9e8191de14a866a01162
SHA256	027ad3a94d5200ae622060a6036f8e961569b06d37dc55b86cc05fda293c4e15
SSDeep	12288:oVGq+I4He5GkI6zwr72o5R9h5u8i8XT7Oj/jwJLD2x:oVG5H2GkISwv28FuY/UjwRKx

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\content-prefs.sqlite

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\content-prefs.sqlite.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	224.53 KB
MD5	5cce4cfaab724fd3aee0ff82bf03c9c0
SHA1	4f8095efca3ce009db3d10ec8ee4542edbfb9939
SHA256	106c8f6549d6d28ebd9c169ef2a54cc189dbb6028c0fb35dcae44d03abea87a7
SSDeep	3072://KYnEzdrLlYyfxMfFYE8Alrn8sKDgGOLhKlLi4pO7tjrODZys/fUeaDy3aj3okE:lQxuMCFXlgIhKqtid/MjRdBZExX/KJs

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	9.50 KB
MD5	f87ff52946c5234ce3b2487930a588dc
SHA1	9c6d3cbb330ddaf5126a8ba9a281364d9f658448
SHA256	15c80c5463ea126813a4979afc4d610adffbbc9b37888b5a153d12d7a2d25072
SSDeep	192:JUAwlgdHjme4qwHG+7i+I+fCPyplwVGDysyMOcu+0BaKYkgkt4IhKl:J1kzxI2CPEfDysy27Kakol

C:\Recovery\WindowsRE\Winre.wim

Modified File

Stream

Not Queried

»

Also Known As	C:\Recovery\WindowsRE\Winre.wim.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	10.00 MB
MD5	4f4dc4c2fad23ccb33140fe7bccb4507
SHA1	d41b973ca1ad94bbfcd284e614b02f48c9716ca6
SHA256	29ccd5bfde69d9c8598f0f7f68f7b0c1ec50bf882073221b0c68bedbc580b3b0
SSDeep	196608:f3aK05QP0NugCFllvMJMyRRW1pcfF2Q4U0DLgywFXBnHtykX6:f3yo0OlGJ5A1pcf0QF0PXwFRnHtM

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	1.67 MB
MD5	91fafe61b93080a76429b22f440f5d82
SHA1	bda0ee81d92a9e973a17b27647b1a0ec4343cfae
SHA256	1ef4cd2811645d850e2f6f0c19dc5c9e469ff005655a1b2be65b70efede905d8
SSDeep	49152:oZAR4OPcal+k8qyL9WmUHJl6eUeW3v0FM:bcalj8vWL63e3FM

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Cross-Functional Flowchart.xltx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Cross-Functional Flowchart.xltx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	141.87 KB
MD5	29215f5fb50a05a2f22dbc89a93359c7
SHA1	a59a1d1497aad9c61768603b04a2db7c91296663
SHA256	d5ac78cfb29ce3910f023142ee76cd4333a0163655b87b324a9fd683e55c27fb
SSDeep	3072:GuktXDHEdRt8n1A8/uhBLDHmVN+JqyO5U0aMgTsKEJmI:GfJDvG8/DVNcvO57aMgumI

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3SgG.png

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3SgG.png.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	71.38 KB
MD5	f6627843b3d042658922fc65e41fbec6
SHA1	6a224c94896c4ff29a595f045b95269a6cbe7723
SHA256	b24eef035a6898f8aa28cfd6fd36f4ee51290aa316afb8a5b6d76bdfb44f3d1c
SSDeep	1536:ZpUdiEEWCry65h4kHXxngT3DUxmVZOS4jwGN4iKaxv6CBnWM3:OibW93QBEmoRSvvFBnL

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.srs

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.srs.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	3.03 KB
MD5	966cedcb940c6161f1fb6dcfd3c170e3
SHA1	60d95859abdb0f99eea396102b01123a1067e8b9
SHA256	ac49464c2b1587eb146ba73f5f24669ae01f55bc2fa7ab2c10b2aacee767f339
SSDeep	48:5SESAr3fVsSWcax+IyeXcbAMkY9H6HdzTuGzA5XZ6L8yN4XGRq:MERLVsSWv+2Xch/HQdzTuV54L8rwq

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	759.95 KB
MD5	bc625f9f5b477b909ad7067db4d67575
SHA1	1134379e6beb854f7293441cf587cf663e23dc50
SHA256	9ed0647bb68d71fd9bd60b2779c1cb7f421cb882100d4867729451c4e88ae3a1
SSDeep	12288:MPuQxao45KkEJVkYmXclBiwHRDz9MQ8ahAsvjOvuqBGLHHjBG8O6:MPJx6a5BiA3Nhda9yjBGn6

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	11.17 KB
MD5	4a609af2cde1f10cafb4c8dcd79af14c
SHA1	ce3606e8bfe9a29ea9e576c7aa9cc7db0e600c86
SHA256	ab9c29d338b16117d87d20b2dab90759bde9da0ec2b9a4adcd70de6a346e9e9f
SSDeep	192:aANW6p4qpt4z/0mChF0pzOEIb5ZHgtUwIBAaRpLxBCdKAZpe8Ji5a0Fk8STl38l/:FNN6KnAyE0pLwPuB/Ke82JbSi/

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.xml.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	2.86 KB
MD5	0ed0570cd29c014f41bfbec98cd54d19
SHA1	16d73bf6ae1852311c81d7f15d0069eb4e689b68
SHA256	7afcd24cdacf3170d3b3a2b40201a730af79d9457f0c2d3d64e89b2fa11ecdad
SSDeep	48:SkPKwYyIZu4uA2qAhR6jyqikzP49kUd64aMAvtntVGXSkRu+55VestS+DvFNqzCN:/PBYyMuA2qAD6jkkryke1aMABPxkRf5r

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	7.72 KB
MD5	aab371d44f40e77d3580c0da0d6fc50e
SHA1	bc081c558f142ba93dfa95230a2578090d3daa1b
SHA256	3d781888c486bb08ff65a5a2b78c067e061090bad184a0e38295a063a974a4c1
SSDeep	192:VqLsq156HSnCfBaOOUhDvV+0ZOEJI4c54ww9gaxD5H9eq/h/N:V8r6HSwaOOUhDv40ZpJIn54w9aN5d3/j

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\System.mdw

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\System.mdw.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	124.53 KB
MD5	136144d0f4b108c1a93f5c34556a3c9b
SHA1	68f7a06b4c4ec2cb019e03752c66d92c299fb5d5
SHA256	73bd855cdd4639601e9f5cfe68a6f2b834a3eb45752b24c001ff5557bef9ab5b
SSDeep	3072:mtzXDUn75uO8r3A7EnlNZUm5ocCQVhrq+MIQq//M/GRhCI:mtKuOMaolrTo50pNQdmhV

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.69 KB
MD5	67d14da7f43cd3cf4cbda3b5f693d5ea
SHA1	29d652246bd9400bb2c97eb00d01c03b0a5a79cd
SHA256	ac3ff9f5e12ee08553779d320df303f1960d2100b177927b80dde9bb9f255671
SSDeep	12:UZkip/vfloIyZhWnoqMpAIgNM8OG+ElMRuG6tA2lKAN5gDhL41Hj2RBq/lyFD43X:UvJCtfGRMuIgNM88EyRuG6tl15OaKKo2

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\496f2c5b-a90f-4380-b805-3bf6ac63451b

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\496f2c5b-a90f-4380-b805-3bf6ac63451b.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.98 KB
MD5	033f75c249e3f3f18b1b7cfaebf41579
SHA1	36dd93dae70069516078fdc4262a002b4cd38bb7
SHA256	99a9b9e5503d2927d0fddbb45f6e3cc813548806039edd15022bd4ffe7b6bf84
SSDeep	24://88K4gBcA8zKMC7LfhqWc8MCX6sXrHmCnoEvg/uhLC5v:/08K4aQKJ7wWldKsXyLSg/uo5v

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\cookies.sqlite

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\cookies.sqlite.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	512.53 KB
MD5	d317b269eb7aa1d0173509883a4fc71e
SHA1	83646da77d2e1b899a1c2caeb1b40328ba7312d7
SHA256	2b83871166a3248963484483dcd668273ca00d24fd19186403792e61f2b03713
SSDeep	12288:sbOpwB57Ug0HhY1fx577k06DS2gb2dLv3AaQBVNp6vuBrQ:sqCBdxShYd7+22g6dLvlw56vAc

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	4.46 KB
MD5	cfa1620743e3089dacb67a9b227c5bdc
SHA1	2b9bc1679ff3f0de5a27e6e373183767b5a74528
SHA256	43506ad19501dfbe561270c6d3a67a0ea1c7ff2eac09c4b554a03bfbe702a2d4
SSDeep	96:39bY5jj6dOfZpIHOzMqniIIFZj9kuM/VeSql0WcnkzhNjyTKticVpRND+s:Nb+jjzRpIHOzMKHIFl9ku+edOWckDyTe

C:\Recovery\WindowsRE\boot.sdi

Modified File

Stream

Not Queried

»

Also Known As	C:\Recovery\WindowsRE\boot.sdi.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	3.02 MB
MD5	cb945accc85db63751563785047c38f9
SHA1	af93fd12ed1f8d233f8212ccf405a19c60ea8c82
SHA256	3a3eb5a4d7fefd641a063c99e425031f11ba89ef3e87959e0bcf99de5a8338a0
SSDeep	24576:CuFq/5R7eoxSUIOE1GoJm5u8217GhtJw7TaoIiNXonN0SSz9pmGSBH/vx:Z4HgUIn1GoJSRbJ4/IuonN4hpMB/Z

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\store.json.mozlz4

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\store.json.mozlz4.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.59 KB
MD5	3b8bc70a156a0ec846eb0b4845b646b1
SHA1	f48ec2f380dfcb46bfe80ba18b4069cce7e4b20d
SHA256	7ce3a662217756002f5384908e9982ef281a53d8c3d95032ee695caa0782d6d5
SSDeep	12:BBxSgwwwgcKowN1uG5repxGpl4VaF6v9bjay8knhtyC:BTbwdKRNo0VPjsFbjdnht

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Email Insights.xltm

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Email Insights.xltm.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	721.31 KB
MD5	c36eec973b574c1c747b03d168e152d2
SHA1	458c261979f48617449def6bf711ae0a8eba230c
SHA256	db33029e90309cc1b0fdd26e5b6135d1f28380b05d8c01af21d1cf6235710d48
SSDeep	12288:8nhrcKxdcMyt2HOuE3aO1J9GLFFzkuxxwN72qQZgSH6UK2mSGnpbzZl:8nhQrAOu0nozlwN72qQZgnUKrpzZl

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	278.65 KB
MD5	f439db7cc80036974c1c01636aff6331
SHA1	136440b9bd20804a25a7ab7c39e95f073c3e866e
SHA256	bc5c5c6af5e8abac7c24cca4831da7482d4e83eec4321bd98939c7951abe6350
SSDeep	6144:PoUbOhXf2ESO3esjBlxgqqbUfCPnQLGSARL:PoUaFf2VyeYqYfmnQw5

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001104[[fn=Feathered]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001104[[fn=Feathered]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	1.96 MB
MD5	06769afd0b74dbd48669be3b05659c16
SHA1	d42e4485b54623fee752919fbada5e2a86917cc1
SHA256	6de1b6c12fbe63e2767435d816480223c6b534239b99985fe2ca30dada022d58
SSDeep	49152:nJygzdZrIRuqQqaIAahBbHetziWp30WUVZY4XApe/xT:Jy86fQjIAahBretziWSWmFXApe/xT

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	558.05 KB
MD5	146ff2ac6238ac6ea96f23fd008f04e2
SHA1	d8f630755da523bd3214b8c5fc759b8e9ff13ce3
SHA256	4652ab3134c492dd9f6cbce60bedfd5189372256738f215a606e4e44aef3921e
SSDeep	12288:OZvcebuDtksNjrqKva2eWMA6KATBDVacDGufw7v7:1ebudhXizBDMQHC

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	4.12 KB
MD5	90ad28a97d3f8640d77e86632bf9d083
SHA1	d43a20beb212903f52aaca06b5c37eaa6d8d917a
SHA256	33a47cff130b78e36c6a860917281d234aacbe631a920e76c0d5b8d526024483
SSDeep	96:2jMq+Q5hHpO3H68m45lq5+i6iNR7gwFrC:lqlhJO35iljkf

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	6.58 KB
MD5	52ed50bb225b9df873b7c32b3b5012f3
SHA1	0772c50747933284f52e6e0da59289ef6e09e5f9
SHA256	437a7e91f9860a4d40bcf67834168c61da59b2ae71332a6efb41ae593f820552
SSDeep	192:4KtW7q939cb67TjD4XXPGDPU4kxv2Hd+jbhv10l+v0:4G93c6fjDg+Ds59bjC+v0

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Basic Flowchart.xltx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Basic Flowchart.xltx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	107.90 KB
MD5	3f90cf45372f07be96655e6e9db65914
SHA1	a740ccddc9eef02aff810970ad0fac4d16bec033
SHA256	5bc25622dbc25598c61acf8a7196ff86c693addcd7b12bb36e97964759c1357e
SSDeep	3072:hBoNxQIHW021exnKUyUm8Sf2xB0Sf4Hz1h:h4v928V5zSf2xfQHzz

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	326.31 KB
MD5	94014964d5cabf8cbaa533ef1bfae00e
SHA1	057f989bc435f15facbb09dc1a7e0095c7c831e4
SHA256	6c648c2f80b690494f157bed29b48ef1f129e8767f7df71da8bbf50734a1d59b
SSDeep	6144:NN4D5Gm8gm83DmqTTo8kwU1FgbucwdyiyzSxsPydz1aO6tq+IRcNh+kZ9ptc+cN3:NN6GmZm83DmqTTdh+gbNRtSxsPydpanI

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\- yv.wav

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\- yv.wav.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	58.89 KB
MD5	fb99df6fb61fc8bec6bfba7d7b9e5e29
SHA1	a0e4c6dc451fbc3a2689c7ae855c23442185c7be
SHA256	7cc05b585a21e9ab88d9b02b3a635c7eaec023263e5c2a7c591a7f8a2a5fa705
SSDeep	1536:FYvDHn2b7m6t0EtxgGeqnGVpqhh+5x17F19dfeStdyX:oz2biQtxgwnpafrT0eds

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	903.54 KB
MD5	b6482d7ce6ef82c8d8ad5e592da26005
SHA1	fe6735237dd3d1849a8bc7ee1a6fb1340848499b
SHA256	3539de5a6a3b15a3775fbe02899e2a9318b93462043c1174593efd6d0e56d7ac
SSDeep	24576:RnIfKUrZWYb9e1NUMuIcVcPjAlMAVEGRYIekp31:Rnl69e1oyUcGQq31

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	2.94 MB
MD5	4e706e4dd0cee2e37a2dbb3f6803ef25
SHA1	ddcecb6c82549660b1a726f182fc1e2ce3c6e787
SHA256	1424a467ec15e36fc0a8b1c0147f786be9d0e97406d158a8265b3ecaa67b230e
SSDeep	49152:GetlaeG/myafVYJHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9P:PlKIfSJA3cimUVxV05aJE2fKaDOXdN9P

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\jgJxxyHOVzXUXod-4.png

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\jgJxxyHOVzXUXod-4.png.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	56.95 KB
MD5	afd4af51319f1a14a400706238e2e5c7
SHA1	d62a3164a26426a9d596e97ca5156b32560ee230
SHA256	76160b5e76c82795560a47fe6ae9c31dfe3438a665ad9892aebc91bedc36ecf2
SSDeep	1536:71RZcMjZmBazLRAwSe7LkdB/HV34WaBmSi:ZRZHjZwazVSYkdBN3MBmSi

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	2.12 MB
MD5	fd66a4eb15eed7cbdaaf18e8471493ff
SHA1	c8a87cb46008f5b9bb730fc877dd95576a505e35
SHA256	d81d214c62cfd83438781ea2228fea52ba4bc2d7080c9b9fd820a6b003967ca4
SSDeep	49152:QaPN2q8mFwTeKB1M6n9l1IdO9wASFntrPEWNec:L96tB1R9MdO9w35PEWB

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.56 KB
MD5	168d98d13975dfe4fa866dfb4bfedf4b
SHA1	6e94af51426aa352cd6ba82adc132e140b689e49
SHA256	ae9828052da41084b204d915d6c759741cf686501866da2973da0ae7340ee49d
SSDeep	12:mF6sZuwHcdXyydABvOV8S0eDwv3xRcrKpEcda1BEoh9JRT7bZGlvLfcC:mdZ3HcIyegfHDwv3xLpEEWEORTZ0N

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Stock symbols comparison.xltm

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Stock symbols comparison.xltm.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	1.39 MB
MD5	5393dee4ca84055fce7810dcbf2ff0f1
SHA1	2423ea61f244aa72ec96a18f7df5f5e2be27c636
SHA256	d0bec23ac20ddb4878622e04483fe6c6833c40d7272df7611708032bab2d4fc0
SSDeep	24576:oTzbmUjJx47Ww3XaysHbQFwI0AJHWfu9AL8XvP26PIEpdowtEV+GXr562DMJR:o6WWWDRUuI0KN9y8XjVpAV+Gb56sMT

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.58 KB
MD5	5b7e2db6e821a5be6d654f703900e8b9
SHA1	20cdf9de16190b51ea05bb8765163c8954a8f839
SHA256	57dc69438a571bc8bcf1eb3d0517bfecae21664b3bc44349f16a2ef030347d5f
SSDeep	12:Uixpmz952G9Nt/9/Gicxs7ok1/bRY4ImXidv8S/9Fr9scEC:Xxpm6G9NtFkxk/9Ypbh8MVscd

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\en-US\Global.MPT

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\en-US\Global.MPT.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	1.21 MB
MD5	7281920ddeb2f18949c7b4be11ca2bea
SHA1	840f048a73ac971bf61f3ee0acf96fb2a482db1a
SHA256	fa951b14343dc081878c23cd171bee2c0e184c96012655bc6b3f343f2537da31
SSDeep	24576:GNYS4JXp2y7BMLC6EFLMEFb0rpH6XLI5uZ8S+FmzH+a/tf+M:wN+7BF/F49H6XLPaS+a/1l

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\mjh24v9h9 fQiLgK.bmp

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\mjh24v9h9 fQiLgK.bmp.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	92.14 KB
MD5	9db6f55335ddc541e111ed79170db0cf
SHA1	fb676b3165f3ed48d0cd8eb527d39b92074a25a8
SHA256	dfce36b56e4bf51849f665049d3e4820aa92da01b8e4e05ac248bfff18aca6e4
SSDeep	1536:FWOqtJ3o0UP6MOCWxgdOT11LdypewzHj8+xgSTX+gExYIIFn3mgUCD:wUpvOT3LdyAH+7DACIIFxUy

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	213.01 KB
MD5	708046e0784868e39dd0c4a10c0ec684
SHA1	a03a4fddca83b033a9fc6fbf819d14b2e30a1ec1
SHA256	0bec68a9e080a1608ca480618a9753419210c9e449b03eb18e193b40db8120ea
SSDeep	6144:0YN0OtVL+Rav2xKueJC7DD/pmI+1y8y276z4vLsGgD+:0M0vjreJC7//V+15LkS

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\60b22e29-462b-4858-9592-1724c7ae07dd

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\60b22e29-462b-4858-9592-1724c7ae07dd.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.98 KB
MD5	890a27546610b5d071cccccd77c92878
SHA1	037ce0f360139181119926e46c5cd3f33d9eeca0
SHA256	1fb0ee21f93056c3de54a880aa6d2ee75681e232fde7454a7406e4256df50ecd
SSDeep	24:dsgT2e6CzzEaO/xkhMSD/RyQf/g22rWMMJGUrse928EdtsCopU:X2SzExkhM1+/D2rWMMJG4sqIspU

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\formhistory.sqlite

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\formhistory.sqlite.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	192.53 KB
MD5	9c3730d1057c74159afdbca3606feb5c
SHA1	f2fa4fc6978db0678da5cefe38695469b7ff78a2
SHA256	0263768834e55a6c6b09242116329e42c642b5d506ed99d5fe8f31741c67eeb1
SSDeep	6144:ryje7j9N5mJOr2clR4f94nKmJLf4LAKV6YFwUP4c47TZCw:CeEuV+f9rmJLf4L7EMP4cw1Cw

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	250.88 KB
MD5	72e2d1d54cb47eaac3702aa553f812e7
SHA1	758ddf96cf7c04dfb9c683bec3a29c24de022da6
SHA256	ff755d2b0a96661c26413437d8773b18bb1f3463f1d28b9061e4886b7eb9f11d
SSDeep	6144:GvFh/wIEl6KKDVNJpKvBrcnR+FA/ltQMNSbgw1Ok3varKQv:0dwzKJpKxcMy/QMNSbgwFvarKQv

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690.XSL

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690.XSL.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	264.83 KB
MD5	ae26ae0f250040e309888a5b99b0700d
SHA1	9af24d123f5b2bcc88207b335f0095a49baea836
SHA256	6d0d74ba3a7e05fcad41dad797c19ee88d2c8509d2a4c185351fe0dfae42aeea
SSDeep	6144:puRMZpdoyrPp/P7vileetArMacF/FUMtzymxzyw:pug1PZ2Fk8umxZ

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\CREDHIST

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\CREDHIST.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.97 KB
MD5	7fce623b2140b6791670f97d7ca05092
SHA1	94cf080ab1ef16c8a9d6f2fe05097a0c320970c3
SHA256	40aff6a620c7866c568f439106338988dbd0496762a836f4011352e2eefa7be7
SSDeep	24:NPYysf+qEKorLiIoXgvTncxsdQnzfMK1vt:6lm/J3ipQ7ncKd2fr

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\addons.json

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\addons.json.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.55 KB
MD5	865078f3aa709dcabf7e4c497e990696
SHA1	18717faf2c47167e42d8133ac769bd81d8b73b90
SHA256	e23c62c52b7ce873c70baf640a2233628f91c0d463141d5ba5419db8d286c842
SSDeep	12:Kcp4Dl4SqoMBLEg/hs2R1z5VkZOqmKSo68PFh3kXFJuC:KVPMBgKfL5VkZOqPSoNPFZk1JD

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\MSO1033.acl

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\MSO1033.acl.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	37.37 KB
MD5	fa954bfd3a953c18e80171c8327b78cb
SHA1	c1896c69cf942f6f04e7d4b5cbae383c1d33b9e6
SHA256	501ee97b09277ad4665dfcdd74e825f2b071590a94457cd7bcf25b1f548382aa
SSDeep	768:ppBVlUA3M43QTa12jiqB9bzqjEMXVtGgOUvqfdmK6dynegeXqB2Y0o1:pPXUbSWpB90hNiAbgHeaf1

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\containers.json

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\containers.json.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	1.32 KB
MD5	10a6fa3bc198f47bcb8ea47546341b06
SHA1	06768cbcc9758a01187a32089f25c36814ce26b9
SHA256	bd9cc04885cce6706ea29eb39124de145991965dddd1732f57696aa194f427e2
SSDeep	24:9VCNnkMcqJmJSzyc6fcDG0UY2DquPNajveevjtVVUaF7QSrwFGLQQwVb:9qkM1oJ0n2XazeKjBUaFkSrw5QA

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.74 KB
MD5	828bacf16249ca8bbf5c1d8331678d14
SHA1	a673d4bdbc3a60893197b97015c0e6bd72471993
SHA256	1bece0ac467cec6b1e39444c01b3d27ac3b9f348ddbf5cc4889308b4e0070a53
SSDeep	12:ah68O6zXFYeGQxGAnxvGdvQQnGJQIhyE4SxwKdUUjgJDw+O/KeDjy6lxOtC:ahxNzXieGAsBQaGKIhrvxwKdNjgJk+yr

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	5.99 KB
MD5	67272bc484950db323e0bad85d46d7fa
SHA1	274eeb564ebde99e3b64cd2858205c9aebc1880f
SHA256	5b57a5f93e6abc38ffd7869163e16020d8dcb6e406dab8bb1d7c0b7fa656e8b9
SSDeep	96:CdFO2+HG5EXQqYXeZvmrCxO+xMIpvRSCBulh5fhQxxk6MMG2XHT08CfUJCkIzhi3:Cdf6GCfYOpmrAR3PBIaxRi2XqGuhiDp9

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	6.82 KB
MD5	750310c45e335467b11974a6be150cd4
SHA1	2b04bbaaed63a90796c5327c669b8a1a3b2f2756
SHA256	0af56bfe093d26134187c6767dbe1aa56d7bec470f5e597f8efdb02b23abd9c2
SSDeep	96:jjbJ6UjlpG66hsYKOmj0LRt3wzvf2DmZCzDGvlpd+//RBu/Hd4IA05t9nQ:vbjpGphqitQvfTwGdXO/wyMfnQ

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\bookmarkbackups\bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\bookmarkbackups\bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	1.86 KB
MD5	a03d3f0e6e32ff37c4b0c82f3c844eb1
SHA1	ccab054dbd8dd7a9b333972fedcf859d50ea2c6d
SHA256	81dc356f627444b533fc79ea12af9fb407f376bc19b38a1341f22966dc749103
SSDeep	48:DRPvIIR8wKjIWKO8tldEUNMFb+MUK48FZOg:lTKjBKO8tfd2s8FEg

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	16.94 KB
MD5	e9aaafc0d8edbadc117c11d240a72351
SHA1	cef288b9bec3b731894b4e59099f20cb316545e4
SHA256	bc14c4e4c18ae81f711339fd184ea83e9b7c0806ba385658e218e5950f5e00ae
SSDeep	384:NbTzWCUVxbFf86VKYzbjPwol6R7RQbffH+VrDkqiadW3rO1:NvzWCUVPf89y/PzX+VrYtaIrU

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	5.68 KB
MD5	4288e3e7e0f2ef4497b9219001a99926
SHA1	810107e747322cec6eedebb6b2b5108c84512c7b
SHA256	e4ad13fc30f340feea9c586fc898268ba1d17f556f349de9687a59b585654cf6
SSDeep	96:qgv/+J623ZRvWgRnneKf76wXSfKtcyvGBVrsuMSOrxPXLGS3v2J7boeJ:qgv/xOkgQKf76ZKSrrsucr1hAboeJ

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	1.15 KB
MD5	069aa992496eccc7897e6124e7d8568b
SHA1	2f9b9ac6d4d13412d99b5783e2b0d9dc5c3e5306
SHA256	a70c47875be02df3c2ae93db7371e5ad42020a46e5ff20042f6d8912a6323ce7
SSDeep	24:J1IoYrUsVxq9bLVicAHJWs2Lz0or6Klxsi3yX9ZSi1q7nTp:Hp/sS9FAHk1z0WlQ9ZSsq7nTp

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\c78b.jpg

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\c78b.jpg.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	3.81 KB
MD5	e2e2652bdc49ad2278265632bde1227f
SHA1	72c13e15b83cc22a11f015ec62f9a4704a2c5df0
SHA256	02c65dfd79d45c2afda25756f19fe7fd2b01af4c6e7f2c7e0046cbc8e7a4c130
SSDeep	96:Y138eJ6R8hpd7pAQsw/qmyk5Hhi29wMUjdkv8u2V+SSSc+W:YlBJFPQ905F+W

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\state.json

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\state.json.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.58 KB
MD5	d16728d819b4e07fcc2f037d7bc3c0ce
SHA1	28ff2a160f10de522bc733a3c6224873106beb4e
SHA256	72ebe812a257041828f372e47e4fd4be6b634077bd56ca3a9ef7c5f87d314f60
SSDeep	12:GQn4vBOypFYA2/dq0y2bvKjJFUCIiJibi8z2ocAJqjFUQrrFC:GQn4ZOUWZFSwKaqA32ocAKFZI

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\AccessCache.accdb

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\AccessCache.accdb.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	196.53 KB
MD5	5eb04e104111cf43528075a33a7f4e03
SHA1	4c28736d85af43d76776eb9f9cf48869fe10db44
SHA256	167be92e6f61c7178fa5cbcb93929cab045ce1bdbc989bda234bc2f6da1a3144
SSDeep	6144:Un/LzoFYOuX2TlrwUy7GpfdLPh3dxxb6xu:MLzopNtWwPh33xOxu

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\kjpbbRBTd.mkv

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\kjpbbRBTd.mkv.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	83.67 KB
MD5	1683e3108aff40174c241777b6a85cd5
SHA1	f664a0943ee14e8fc382f26a5c67a5ee1def3828
SHA256	0e7e20a4d55a39a6b97307f5c891209325d15d18d8cf64712560e7e03dd5260d
SSDeep	1536:MuWHpPBzmWM3BZ2Kf1KSHRtUvMxKBRcDvZQgPfM3/N+DYdG:ML8BZ1f1LXLQ+uuy/k3

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	5.59 KB
MD5	7a637933b530efe3e7f87f828cd1edc6
SHA1	c794f74f4194116ef6e187dde0221583f1ced98e
SHA256	dcf1b4bbf99c3eddf18c7a4b05f196458c6db905eefc5381c6f8069af1dd9480
SSDeep	96:nLbVChmDdWpHzBiBxiavxgrFyxd+8CFqQIAicFDicEiOAZ84oAy0Eu1eCv5V3Xhj:Lx6mDEpNiDSz8CF9acFOIloAye1eCvXl

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\dcu_D0tnAih.swf

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\dcu_D0tnAih.swf.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	11.27 KB
MD5	e804203fa0dee99e1feafbc776a00a62
SHA1	af61b18a153ad60f1c1360dd63ae95f6f218942e
SHA256	d06c7963f2d945509e373977a986375f7116e1d2db0a7e1a6be50f90e32602c4
SSDeep	192:PSVvRxoslJhDUd3mfQazGi9dBqBX5nmVwikyQfCELQe/WmYfHx6Oc0Q2yNUS:PsnoslJXRzGUdBqxXikHQG9gYOP6f

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	5.30 KB
MD5	fcdc0413879f65c5136e9158b84e1b46
SHA1	448a314c4af193589ca7a260d1460bf0827890a6
SHA256	273b0628d2646df71837bd2e47d6acecaaf4698518a19b68c6025f3ee3aef0a1
SSDeep	96:d99NH+qb1E8LCUhlRWa1AIgo9NPmkxCF2ECP6lPKEj/QfSlDlbC/kXS:39E8LCU5xAIgINPmnMsxKFUpbC/kXS

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.94 KB
MD5	9088137c95c406e7263b2dafe3f06cf2
SHA1	8635cacd091fca0badfe771a75ca6ed4abad3531
SHA256	6ffd9b067df874fc10e2543b7cf8a9aa09332bbbc8e1b3b94732817ac420271d
SSDeep	24:Y5joiBZjQMrmtWEQcj+893VQnJkxyjC4AqeFLCL2qf6:Y5F/MD0F69FZUC4AqOCPi

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	953.65 KB
MD5	d3fb5ed0bc52897c97be21cafde3f1b4
SHA1	4830610f0d543ebe0020a8ff096dd71c520935f7
SHA256	2a6918d7bb37efde2b02bd6b27d1fef0bdb1144173a11aee7837a6bdd1201541
SSDeep	24576:JhnhkBQR1ADIHI+tkXELho9Qlbm/yZikm:TnZ0IHIWLC9cLZzm

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\index.dat

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\index.dat.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.62 KB
MD5	47271a0bdb5e75f1d1c1ec82648949c7
SHA1	e5a73459d758417e7372667e6d7b47a506514481
SHA256	2c68ae162f2b65aa452203f05c8f1fc435567650e9df7d41630ba20d070814ba
SSDeep	12:2TLO4g4LrZTYXVaAHc/LPolY8/ZEZFU+O1nVe3HIT9T8VC:6O8r2XVaA8/4/ZnVeXu9T1

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist.xml

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist.xml.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	252.43 KB
MD5	18ad1aaff3cb368fd4359220dfed8e56
SHA1	d62a07bd1f87a28ee771453712d432c8d2863763
SHA256	f1be9d6dcc33e4c438f3def700da764df68881713a3bd989d1aaad5fafdeda94
SSDeep	6144:Fq21AK6/a4sI2gtOXjdllsO7GZBpH9qgH:Fq2Sta4f2g4jpGZ3dqgH

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Welcome to Excel.xltx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Welcome to Excel.xltx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	483.68 KB
MD5	25f37228a350cb780ffab6603150bc4d
SHA1	38ee6e3d26f8693c20217b748285e61f896ac6ae
SHA256	98f5c451f0f87981de15a399c8f5b62704bd4f2d55f914abb7a4bbf0ddd8f21d
SSDeep	12288:IDGssJMvRHSOTHboXzgzxlZWlF8WzkZAQmJ:JJMvRHSO7boXzg1rg6B9mJ

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	4.75 KB
MD5	0e147ff02d17121854a94425230cc9cc
SHA1	a6c4347e58ee5a7c6a5883dd7b8b8b74abe038cb
SHA256	1961bcf6326a41eaf52a6d2496a8d473255b7bcfef147dcb58488f5742a8dd3e
SSDeep	96:E9m5ldyrv5vi/wm92EbdhpeBon0WfiPPHkcKtejlHsJ:E9FvsDfhhpe+0WqPPEptexH8

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\mbGahTIz.jpg

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\mbGahTIz.jpg.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	14.17 KB
MD5	c604e387eef7269bd2fe24624780bad7
SHA1	480810819634ddb73d3fef4e8972d7cb59ed8c02
SHA256	d3375984a7847cab09f2bdc6100cc092dc7ae6c5eac31fa384474f6702e436fc
SSDeep	384:yeDxt93M8IZrf0RdBka5l6Glz8sXCT7hHUDyu96V+:yeH93FErf05TxpS5bu95

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	6.56 KB
MD5	a7ef04b748f328b83799b761a29489b1
SHA1	967eb7812588c211c402e9e7f032fca54d3fa1cc
SHA256	63ff620c26e9d386df3ef1aab5bfa458dce129bc86349f66b71560f39f7c7f49
SSDeep	192:GMs07EFfGCH1i+xZnWn/uSCRRFd8yqXogZ5e0b0wMDcu:GMsAc7Vi+k/ux0yqYgZ5e0bhScu

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Calendar insights.xltm

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Calendar insights.xltm.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	893.37 KB
MD5	81ef88f655cf899b66f568ace6bed75a
SHA1	c094a8ade51966dda428021241ee0c1637f6e115
SHA256	5274ee0305374bb5730145a60695db36070fadb7599e0f2e4f4033e704dabe04
SSDeep	12288:+Nx3LMNv6s4O4VALN5q2PZawGag8m0pQEYoAZSOIC5OIayDK+UBsbf5nWW4HaON+:Wtwv6fcFn1exx+Ccx4UBsD5dIjdxw

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	2.79 MB
MD5	49e7b48863e78f8653f186ca134752d1
SHA1	4106164a5a071ffa8a6e2cdebc3582abb8800755
SHA256	de4fde7fad1171714e89c6da6f8d90bfa1919f150914a07e0369c84117c4c9ce
SSDeep	49152:eAqEmkwLBWqDQRPbuwIsX6jfSUAO/cLf68wy9yxKrOUURBgmai2prx:eAkkw1WY8XAHGJwLx9DBax

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	6.07 KB
MD5	4f538219c5c1f8aedd82663da9d7d793
SHA1	5396cb27f22457eef5681d9b3d4780680c26dee8
SHA256	f6fb0e365a12a1368787973f2cb984b1507a94585951a6d2e5ea1dbc982d46b3
SSDeep	96:TX/GxsHOjphVyiLtilKsL1yJqMn1lFEEpqcTGvq4s3WkrsNsbAr+TpLh:TvGxsHOjHLUllp0/LqwGLs3WkrJkr6

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\d7746ecf-458e-4e71-8557-8ac80457022a

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\d7746ecf-458e-4e71-8557-8ac80457022a.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.98 KB
MD5	625fa473d3d753bc04ea6ca1995e21f0
SHA1	e6a0ce0767d5055ecde75b8220accb729f9203ad
SHA256	64ac3209aa7cd8afaf617cde7a2131e551d59c9bb0b46bed93992383b2e5d7e1
SSDeep	24:IZbC9u+o4KCRmunS8HFthCm415PePfiz/f:cCHo4KCTS8s1EQf

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Normal.dotm

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Normal.dotm.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	18.94 KB
MD5	f405e8c50b19f1554b6b328ab5f97b17
SHA1	39ee076aff2253dea46a4c632a0a8719fec769e4
SHA256	b50cc6767bdc5819108d3a4e6fc442843f5fb47f1c7341e5d8ee2652d5220230
SSDeep	384:T1dWilVuzq7xr1KKyOFj8uN9yyDu8Ba2+VYEYOedZaD0prycKy0wvpyn:T1v3ue7VMKrFj8u3vDuWaJredI8rMdWW

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	549.47 KB
MD5	eecaf2b01243e609fbb80f0efe4de43e
SHA1	799743c402d6db6d12aba5567c4fc75f0ec5e9b3
SHA256	f2d3e3ed3977d66dcfe4afa3003751c7ab6e26589e6883effaa492e562d4c9af
SSDeep	12288:gIWTaAK+u2prVseBdjUp+TNLVjH9UYg8lUvAqop7tkiKvCfeyg:gIWTaAy2LTHIIThTUY1wop7tNKuDg

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	3.44 MB
MD5	e63678ef8b56540cdab06f44e0f9f08e
SHA1	6c735a5fae071186383c4b89ccfc3d65f726d49f
SHA256	2b45d30a64fdb8a1c30bcfb5b012d49498d752d4d8a5a955025f431d05765818
SSDeep	98304:3RACQyHX11RBu83hJLdoaFxTygxcoiX3M0iCL:3RACQ0FrJxpcoinM0im

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.55 KB
MD5	23be76e80679823004c802b6f39df4cb
SHA1	63db79ca9344dbca29b0eaf34750eb0e3e8b4976
SHA256	959f07b619692b6b7d1e0efbcaa0431e7954f450640de9a59f0b28b152264413
SSDeep	12:JV+2J+zpE5yMKCiCUJ36BFLCnn2o7/7yMmGP68ZP5IFDK7fM5M8W/KC:JV+ImMrpiCUJ36B5C92Md6qMK7fIqH

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\JJpO.avi

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\JJpO.avi.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	7.69 KB
MD5	9bb4922fb8662a6e0a117df954d66251
SHA1	d76db8a12a732dd6d92b48ec192919c62ee931c2
SHA256	02d0b189387f40afe90067fc4c0a06942fea182ad6939aae8318eff6ca84b228
SSDeep	96:ikl4Br8U2a9iCUqVb3U1kOwGES4wafzkZ9PxcyaRJ6+IY74bX4kyc93HP705jVcD:iCSP2bCpTUulGElb2czb6+ItnyYXcA

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\extensions.ini

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\extensions.ini.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.71 KB
MD5	9f90bd4ad675c9279066756fdfb84f02
SHA1	c37748e04e57d7a12c6230458f8b44a1ed2901a8
SHA256	5c4ba23fa2706d8f1d59bd2da0db86f610d04c9ea2b2747f7f58891f8497b269
SSDeep	12:0jnVflabPSVA9eQv9vjAxFiDycJLL33oAuD+0Zu2R3NlI5rYaTU2xBvPPHqi0cuU:0jnVdAqS0Qv97AT5cJP34AuJ0udm5XTj

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001106[[fn=Badge]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001106[[fn=Badge]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	648.90 KB
MD5	b16222e0b68fa407e7219b3d6c39bb92
SHA1	6250d537a9499625aec528b1e90fc7e2b990e69b
SHA256	293085a94eddefddba34ff96a8ca76219901bb33398a146f52308bf62554bfef
SSDeep	12288:uubebciP9NX9wH2XzeKa/6D6hCxdIAkJtmewOs405GfRQURt0t83Fj10D:Xat9h9wWXz5a1hCxbkJs540+dZ1+

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\5b8a3202-35dc-4437-b5d7-374f5e872415

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\5b8a3202-35dc-4437-b5d7-374f5e872415.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.98 KB
MD5	50c5d19104a5826e2d40b18495696a52
SHA1	028e15333672870329a1a1b7c793f5a6fb7622d6
SHA256	b4c2b79b328f187d0c697380f3ba46ddb02576720a362d18a3ff28dc6f855f5c
SSDeep	24:59FeTq7lMEAgHojrAPEow73aXt7l/lRvSerAmxmTfq:59ETq7/AQ2rew7A7lTSerAAmzq

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	511.32 KB
MD5	548c6291c2db33c6a8b32c79045cfa8f
SHA1	7e188e7dbae935ec81a35135ec7a8504796e0303
SHA256	f1b56b9cd88fbd497c81878b700f49cea3a94cbfa13e9463b2fb8c5ac82a21c8
SSDeep	12288:MpCqP04b8EOWcT54LTGg186Crf/FuT6mvrkqrD/I2fZ/v:M104a5TXf/FuT6mzTrDrf1v

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.57 KB
MD5	8bc0ba1753f5a7a6fe5b484f6b472aa9
SHA1	013c776184bddacf1dcda49121ed8d8c0e7ce2da
SHA256	d9b9c1c55bf417cca3d6d617da705c2f26d8bae20d58ac50d3fa6cdcbb357739
SSDeep	12:rr7P9OVl+7jVTVDiS70eDqM8Nn3Se2EXqs7pnbjduvVa0xTimRxIGXCxKC:rr7PzvVZzDN813S3s79Xdu72SINB

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	1.02 KB
MD5	6a0be1e606a4a1c0f8d6994349a5115f
SHA1	a5ac39f07d6a2f00194cad1e53f765497ea98837
SHA256	cd68384ecde2758c526e928518cc9d3a11db8b5fc2403a214d71c183667c1af7
SSDeep	24:W7jOZCG3hAZOIRUJ3J4WlTYGzVV0L/16xoufDX:NCG3xmCiWlTh/0z1ov

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\session-state.json

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\session-state.json.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	0.66 KB
MD5	ac813d297f9c38dd8785b2753d71ec59
SHA1	060ffb179297361a3954e46d550ae9804a22f0d7
SHA256	c2f9ea270138e415697f592916a3189335d03d9ead21061a66091b673595a3ca
SSDeep	12:EZMEk4y6ADbG7N8XbIXTMu52zfDOPb0avyOoETb1BGZBayoBeOYva6MkzC:hqy6MbGWgFvGRZBayoBevvarke

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	944.81 KB
MD5	b6b8c934d91d49762a921e407970101f
SHA1	f070d425170b61fd40fed8e806704bce3afe5bdd
SHA256	2e6b8518a318f9ba32e710cbdff4dc70efdd6ea68d0cf50601e22c335331d858
SSDeep	24576:oULv782JJ5i4i5n5RWVtmo3vnQw88kw6ugZU4ruSvpWyXwn4:oULv782JOn5RgtH34wgbxZTZRWyg4

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	1.40 MB
MD5	806254738e8577099c00f0c83e9ba955
SHA1	8d636b5b4787ff4a73eb621aa575dd41a252352c
SHA256	f7645456a2eed0e9d8c5ea6d59198d1bc0d2dde2587a63cd0760ac89a1d79eeb
SSDeep	24576:Q+kWRBRNqpAXW3zzugmkTjHurWOgIIbnFk0uV1CBySgQ7ohZM+byLHx:Q+kauAXW3v/HHu9oLFoyBfL+ZHeLHx

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	246.08 KB
MD5	4bb2474377295bc77e270972a8259cdc
SHA1	873650a06927ea8c59b37ec0f64aef8e81fbbbe3
SHA256	bdffbf14436d3ac44e388a81cf08cd242634ef6cb5c34b999f103b99912b6977
SSDeep	6144:R1p1XOcj0cV2bh9oCb8JfouWkaVpRj6pGpGZ2qS84/v3:7XOObV2b/oCb8+zlVPUwNv3

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	3.53 KB
MD5	21137b64316a6074a0f67a09c0740621
SHA1	ea3f93c5b0a85bc581f429c775dd2efa38df38a6
SHA256	0fc9f85f9069319ec3332e415a8f743eaaca0f2f2efd7c9948b00748d0793dc0
SSDeep	96:fm5BcmwvMTW7pHFrCNyQR5wkSjPk4pwVdy9Tqa2F0KwW:fm5BcmcF55Cxkzk4pQeBe0KwW

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\6iEbBl.jpg

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\6iEbBl.jpg.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	52.57 KB
MD5	ed9a263fa94e753d2344009c755599bb
SHA1	11d0a39837a18451c49c22024ffd5dba283405f7
SHA256	e63cd88c959c93f3dff7f86e01c317c8d40daeb6a046a8b14ad92277b2f6464b
SSDeep	768:A5YTibcnSSylVtW7E7fYP069b7EYYh8+lyRTUO+qaTZjuQi7CYPQLaSktM:A5RbcnSSy/taEzijnPYCRTU/axM/

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001105[[fn=Crop]].thmx

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001105[[fn=Crop]].thmx.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	524.55 KB
MD5	a50091b91f4d64695305bc2cd38940b3
SHA1	9daa0a9ea86183e570236a2422cc7d0f34720b9c
SHA256	12da95c574f3cdd9949e8830f5d8bccc1eb7e9d2ec7ead6ce5f2e0783240cfc8
SSDeep	12288:0rOgIMotAn/W2QyIYQa8rB1fs24Gz+kEOSns6bkWQ/XV4b:0ToyL1EB1fs0z+kgns6h4XVW

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Kfe-zKlAdWswrW6nKu.odp

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Kfe-zKlAdWswrW6nKu.odp.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	29.54 KB
MD5	c41167f2cd7244dae13846abdf81f5f1
SHA1	0549bddcd50d1a89186956c6b0e679b9799b5746
SHA256	edbea9a5c47147deae58ed323edbe6e8973605ef1a6bc6adcc49227de3ce0dad
SSDeep	384:AFtQ9gGVT4IlH3tMSK/MSTcZ/HWVuKYGfwrcCTpNwnHdd/EzG4qSaxn3HDgm8RXl:AMaGWINOk/2V+GmpNwREal3HDgmiXSc

C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\extensions.json

Modified File

Stream

Not Queried

»

Also Known As	C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\extensions.json.sfrpesivt (Created File)
Mime Type	application/octet-stream
File Size	6.32 KB
MD5	682a5dd5ebb23e215459cab462189b72
SHA1	af491df7cacc30975f7ae2bdefcd65c2999216b3
SHA256	8b26ff785ac8729f65db6579ae0c6835c54434be6ca06d6dc80325f7a90edec2
SSDeep	192:TMkG+mxLZh8h3f1IOf/4PaaEl6ySVUjZz:okoxFh89fS6QP5E8ySK5

C:\\SFRPESIVT-DECRYPT.txt

Created File

Text

Not Queried

»

Also Known As	C:\$Recycle.Bin\\SFRPESIVT-DECRYPT.txt (Created File) C:\$Recycle.Bin\S-1-5-18\\SFRPESIVT-DECRYPT.txt (Created File) C:\$Recycle.Bin\S-1-5-21-1462094071-1423818996-289466292-1000\\SFRPESIVT-DECRYPT.txt (Created File) C:\Config.Msi\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\\SFRPESIVT-DECRYPT.txt (Created File) C:\PerfLogs\\SFRPESIVT-DECRYPT.txt (Created File) C:\Program Files\\SFRPESIVT-DECRYPT.txt (Created File) C:\Program Files (x86)\\SFRPESIVT-DECRYPT.txt (Created File) C:\Recovery\\SFRPESIVT-DECRYPT.txt (Created File) C:\Recovery\WindowsRE\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Collab\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Forms\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\AssetCache\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\AssetCache\NAHQNPMN\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\NativeCache\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Headlights\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Linguistics\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\Logs\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\Sonar1.0\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Identities\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Identities\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\DQQHJZ8C\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\AddIns\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Credentials\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Excel\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Excel\XLSTART\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\UserData\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MMC\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\en-US\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\Pbk\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\16.0\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\PowerPoint\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Proof\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher Building Blocks\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Speech\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\1033\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\1033\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\UProof\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Vault\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Word\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Word\STARTUP\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Extensions\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\bookmarkbackups\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\events\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp\\SFRPESIVT-DECRYPT.txt (Created File) C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp\WINNT_x86-msvc\\SFRPESIVT-DECRYPT.txt (Created File)
Mime Type	text/plain
File Size	8.35 KB
MD5	53d0cf7e2f93993aea51495fd98ad0aa
SHA1	f9f34880027be8bbd9b85025c96600a1fcaddf28
SHA256	c655ad1ad0bcc10351228569d79ce0022e0407dd8d4f61d0ae878a61f7e3aad0
SSDeep	192:SbChfZ/2r1LelL+tupOFmZ3/eBK24znUTMIZxHc:+ChBa1Dtupd2wIZ2

Notifications (2/2)

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After