VTI SCORE: 100/100
Dynamic Analysis Report |
Classification: Ransomware, Wiper |
1.exe
Windows Exe (x86-32)
Created at 2019-07-04T17:39:00
Virtual Machine Information
Name | win10_64_rs2 |
Description | Windows 10 RS2 |
Architecture | x86 64-bit |
Operating System | Windows 10 Redstone 2 |
Kernel Version | 10.0.15063.540 (f6f48955-5489-4b24-b4df-942361f0730d) |
Network Scheme Name | Local Gateway |
Network Config Name | Local Gateway |
Analyzer Information
Analyzer Version | 3.0.2 |
Dynamic Engine Version | 3.0.2 / 2019-06-06 12:21 (UTC+2) |
Static Engine Version | 1.1.1 / 2019-06-06 12:22 (UTC+2) |
Local AV Version | AVCORE v2.1 Linux/x86_64 11.0.1.18 (Aug 9, 2017) |
Local AV Database Update Release Date | 2019-07-04 18:21 (UTC+2) |
VTI Ruleset Version | 3.3 |
YARA Built-in Ruleset Version | 1.2 |
Analysis Report Layout Version | 4 |
System Information
Computer Name | NQDPDE |
User Domain | NQDPDE |
User Name | FD1HVy |
User Profile | C:\Users\FD1HVy |
Temp Directory | C:\Users\FD1HVy\AppData\Local\Temp |
System Root | C:\WINDOWS |
Sample Directory | C:\Users\FD1HVy\Desktop |
Software Information
Adobe Acrobat Reader Version | 18.009.20050 |
Internet Explorer Version | 11.540.15063.0 |
Chrome Version | 61.0.3163.79 |
Firefox Version | 55.0.3 |
Flash Version | 25.0.0.148 |
Java Version | 8.0.1440.1 |
.NET Version | 4.7.02046 |
Powershell Version | 5.1.15063.0 |
Microsoft Office | 2016 |
Microsoft Office Version | 16.0.4266.1003 |
Microsoft Project Version | 16.0.4266.1003 |
Microsoft Visio Version | 16.0.4266.1003 |
Randomly Created Artifacts
This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.
Processes (21)
»
Filename | PID | GUI |
---|---|---|
C:\Program Files (x86)\Common Files\screensaver-fireplace.exe | #1200 | |
C:\Program Files (x86)\Common Files\shoot_click_charter.exe | #88 | |
C:\Program Files (x86)\Google\favors_disagree.exe | #3428 | |
C:\Program Files (x86)\Microsoft Office\camel.exe | #3124 | |
C:\Program Files (x86)\Windows Defender\meanwhile.exe | #3256 | |
C:\Program Files (x86)\Windows Mail\indonesian.exe | #3516 | |
C:\Program Files (x86)\Windows Media Player\upperarcobviously.exe | #1240 | |
C:\Program Files (x86)\Windows Sidebar\manager.exe | #3412 | |
C:\Program Files (x86)\WindowsPowerShell\md-upgrading.exe | #2948 | |
C:\Program Files\Common Files\grove_fame_lightning.exe | #3444 | |
C:\Program Files\Internet Explorer\boating.exe | #3404 | |
C:\Program Files\Java\sets.exe | #900 | |
C:\Program Files\MSBuild\mhz-archived-deemed.exe | #1940 | |
C:\Program Files\Microsoft Office\conservative warnings.exe | #3268 | |
C:\Program Files\Reference Assemblies\das.exe | #2700 | |
C:\Program Files\Reference Assemblies\lottery.exe | #1132 | |
C:\Program Files\Windows Defender\mixture.exe | #3292 | |
C:\Program Files\Windows Mail\forgotten.exe | #3300 | |
C:\Program Files\Windows Photo Viewer\federation customs.exe | #3384 | |
C:\Program Files\WindowsPowerShell\compare-hh.exe | #3328 | |
C:\Program Files\rempl\organization-tail.exe | #1620 |
Files (291)
»
Filename |
---|
C:\Users\FD1HVy\AppData\Local\Temp\08o_lsQXH7opv.jpg |
C:\Users\FD1HVy\AppData\Local\Temp\0nbQzy8Ls.m4a |
C:\Users\FD1HVy\AppData\Local\Temp\1cqWvQqFQDPZ.jpg |
C:\Users\FD1HVy\AppData\Local\Temp\1j2jGW4-0.mp4 |
C:\Users\FD1HVy\AppData\Local\Temp\1za_S8IUGeH8Jw-V.mp4 |
C:\Users\FD1HVy\AppData\Local\Temp\4lDxOg4Dgtgj.avi |
C:\Users\FD1HVy\AppData\Local\Temp\9GqQI.avi |
C:\Users\FD1HVy\AppData\Local\Temp\9I2m IJ1Bbhb9O0Jvwir.bmp |
C:\Users\FD1HVy\AppData\Local\Temp\CEcSMM2AshKfObwa.jpg |
C:\Users\FD1HVy\AppData\Local\Temp\Cfipn0jyb pWH0.bmp |
C:\Users\FD1HVy\AppData\Local\Temp\FXYirb6o.gif |
C:\Users\FD1HVy\AppData\Local\Temp\HSxh.png |
C:\Users\FD1HVy\AppData\Local\Temp\HUHkTlIr-fwm-6KN.avi |
C:\Users\FD1HVy\AppData\Local\Temp\Krfx9cWmDnC.wav |
C:\Users\FD1HVy\AppData\Local\Temp\LKs2U4k_i-Z35B.png |
C:\Users\FD1HVy\AppData\Local\Temp\N1yfUTCn fSGRA3pK.xls |
C:\Users\FD1HVy\AppData\Local\Temp\R_LHFT8Rr.swf |
C:\Users\FD1HVy\AppData\Local\Temp\RoVxJ.m4a |
C:\Users\FD1HVy\AppData\Local\Temp\Sf3jz1IwQ.mp3 |
C:\Users\FD1HVy\AppData\Local\Temp\TSWAny7M.gif |
C:\Users\FD1HVy\AppData\Local\Temp\WCV gAY1lmy6J EQmqz.swf |
C:\Users\FD1HVy\AppData\Local\Temp\XPy8IuNtbKJTJ.bmp |
C:\Users\FD1HVy\AppData\Local\Temp\YrcQGf.flv |
C:\Users\FD1HVy\AppData\Local\Temp\iSEziHI7aa.ppt |
C:\Users\FD1HVy\AppData\Local\Temp\ljENG3rWvFwSEAVxKXVp.mp4 |
C:\Users\FD1HVy\AppData\Local\Temp\qmlAYFE4Ffr_N1.jpg |
C:\Users\FD1HVy\AppData\Local\Temp\rTo ngtJX9tKhCr2taY.bmp |
C:\Users\FD1HVy\AppData\Local\Temp\sgJ-0SD3.wav |
C:\Users\FD1HVy\AppData\Local\Temp\v-cj0YlHEiol.odp |
C:\Users\FD1HVy\AppData\Local\Temp\y2lRK.mkv |
C:\Users\FD1HVy\AppData\Roaming\-Xr4R.flv |
C:\Users\FD1HVy\AppData\Roaming\19Azsms-.gif |
C:\Users\FD1HVy\AppData\Roaming\38odVOEGbo2vcxjft7G.doc |
C:\Users\FD1HVy\AppData\Roaming\44M5RmG.mp4 |
C:\Users\FD1HVy\AppData\Roaming\4EJvFicq.m4a |
C:\Users\FD1HVy\AppData\Roaming\4r-CghY.avi |
C:\Users\FD1HVy\AppData\Roaming\6HBwed9GChPK_tTsY.wav |
C:\Users\FD1HVy\AppData\Roaming\AO5Su7uXH.jpg |
C:\Users\FD1HVy\AppData\Roaming\B1z7.jpg |
C:\Users\FD1HVy\AppData\Roaming\F8gh.csv |
C:\Users\FD1HVy\AppData\Roaming\G23tDN5qPG6cvjq.odp |
C:\Users\FD1HVy\AppData\Roaming\HYRq8Atv0wj.avi |
C:\Users\FD1HVy\AppData\Roaming\JM08.xls |
C:\Users\FD1HVy\AppData\Roaming\JQrTGmQj-h.bmp |
C:\Users\FD1HVy\AppData\Roaming\L8 z.png |
C:\Users\FD1HVy\AppData\Roaming\LfL0mOeUQKoxs3m-k.gif |
C:\Users\FD1HVy\AppData\Roaming\LzuMaFf3.odt |
C:\Users\FD1HVy\AppData\Roaming\N Q4sG.mp3 |
C:\Users\FD1HVy\AppData\Roaming\NJE _-.wav |
C:\Users\FD1HVy\AppData\Roaming\QnJjhHBcskizjh5.avi |
C:\Users\FD1HVy\AppData\Roaming\Yl7Z_8Dpl5o.m4a |
C:\Users\FD1HVy\AppData\Roaming\Z-o I8akNUG4sh.wav |
C:\Users\FD1HVy\AppData\Roaming\ZedLkyrXCrwLaO.docx |
C:\Users\FD1HVy\AppData\Roaming\Zqnq1B6xw.avi |
C:\Users\FD1HVy\AppData\Roaming\c-BNnch-d3IdYC_4.m4a |
C:\Users\FD1HVy\AppData\Roaming\gAqA.m4a |
C:\Users\FD1HVy\AppData\Roaming\gAqx8vIpmmGSo_.swf |
C:\Users\FD1HVy\AppData\Roaming\hRZG-WbMyOy.bmp |
C:\Users\FD1HVy\AppData\Roaming\jSIjHl6iIMHMYjD.wav |
C:\Users\FD1HVy\AppData\Roaming\llPj86TdLdyyqMUk.odp |
C:\Users\FD1HVy\AppData\Roaming\nQTvGIYeXR7V.ots |
C:\Users\FD1HVy\AppData\Roaming\p bzX-fmcOMJv oNKD.swf |
C:\Users\FD1HVy\AppData\Roaming\pliy2DMP.wav |
C:\Users\FD1HVy\AppData\Roaming\qhwWKjEZOT.png |
C:\Users\FD1HVy\AppData\Roaming\wt7i2chJUqmSLbnBPO5F.mp4 |
C:\Users\FD1HVy\Desktop\-I5re2IVMHfL_lk.flv |
C:\Users\FD1HVy\Desktop\4ZpehCl8GJo AuK |
C:\Users\FD1HVy\Desktop\4ZpehCl8GJo AuK\-mNSugWonVmjea8bY.jpg |
C:\Users\FD1HVy\Desktop\4ZpehCl8GJo AuK\0fa2.avi |
C:\Users\FD1HVy\Desktop\4ZpehCl8GJo AuK\3a9lqixNHaIqkXW9wmQ.doc |
C:\Users\FD1HVy\Desktop\4ZpehCl8GJo AuK\H5yApyJxb8 186HPfmu.gif |
C:\Users\FD1HVy\Desktop\4ZpehCl8GJo AuK\HZTkQE1 aylm8OHtwyhq.bmp |
C:\Users\FD1HVy\Desktop\4ZpehCl8GJo AuK\NuuUYT5EEVSQFUgIyaZE.flv |
C:\Users\FD1HVy\Desktop\4ZpehCl8GJo AuK\_POFtskh5n lEj.mkv |
C:\Users\FD1HVy\Desktop\4ZpehCl8GJo AuK\atu2L8O70L5u3lqEy.doc |
C:\Users\FD1HVy\Desktop\4ZpehCl8GJo AuK\fIZY_bMvlPVhr.csv |
C:\Users\FD1HVy\Desktop\4ZpehCl8GJo AuK\mLd3-a.jpg |
C:\Users\FD1HVy\Desktop\4ZpehCl8GJo AuK\pYhKa.odt |
C:\Users\FD1HVy\Desktop\4ZpehCl8GJo AuK\wNI4PMHR9jPD6ZXm.xls |
C:\Users\FD1HVy\Desktop\5BK-4qy.wav |
C:\Users\FD1HVy\Desktop\5cMzXtgaUdT17 4oJPUi.ots |
C:\Users\FD1HVy\Desktop\5vyszCSjnY.wav |
C:\Users\FD1HVy\Desktop\DPmBf OeHcC-XTVp.swf |
C:\Users\FD1HVy\Desktop\FO7PuGULxFXE2.mp3 |
C:\Users\FD1HVy\Desktop\FTb mMp.m4a |
C:\Users\FD1HVy\Desktop\FuuneuO.rtf |
C:\Users\FD1HVy\Desktop\Gld4wx5s0NRVpp.mp4 |
C:\Users\FD1HVy\Desktop\H5qa-pgvH1aCxD.gif |
C:\Users\FD1HVy\Desktop\HKyoWYNjT4V.mp3 |
C:\Users\FD1HVy\Desktop\J8TTKT.bmp |
C:\Users\FD1HVy\Desktop\KGzfk-BZLG22zeTD.pptx |
C:\Users\FD1HVy\Desktop\O7Z18i-4df3MqP.mkv |
C:\Users\FD1HVy\Desktop\OF3z9TeEIvNn.rtf |
C:\Users\FD1HVy\Desktop\PXFW2.swf |
C:\Users\FD1HVy\Desktop\U ixh6MSIUN.mp3 |
C:\Users\FD1HVy\Desktop\VAImpZci.jpg |
C:\Users\FD1HVy\Desktop\WuBJXE.odt |
C:\Users\FD1HVy\Desktop\ZT5KgMuX.csv |
C:\Users\FD1HVy\Desktop\_cLGWecBIbh.bmp |
C:\Users\FD1HVy\Desktop\a0oxQD9m1VkiTU.wav |
C:\Users\FD1HVy\Desktop\aU2swND0JjQfGt1l.jpg |
C:\Users\FD1HVy\Desktop\b_XAInZPpJXDAt.swf |
C:\Users\FD1HVy\Desktop\dCml8W1sgcXtkwGY.bmp |
C:\Users\FD1HVy\Desktop\g6JRKcIfm1dhW.mkv |
C:\Users\FD1HVy\Desktop\g9R_Wdz8UYe3.csv |
C:\Users\FD1HVy\Desktop\khBEn6cPJ24CX7as_got.mp3 |
C:\Users\FD1HVy\Desktop\kkTs1g2QyxZl38.ods |
C:\Users\FD1HVy\Desktop\lDFUYUspM6K -RW.jpg |
C:\Users\FD1HVy\Desktop\mLw8JtbPR ti6GniW.xlsx |
C:\Users\FD1HVy\Desktop\riOSfAJ-.png |
C:\Users\FD1HVy\Documents\0p5REZWdR9vK.xlsx |
C:\Users\FD1HVy\Documents\2oM42DzPqI.pptx |
C:\Users\FD1HVy\Documents\48 WHqqSsx.docx |
C:\Users\FD1HVy\Documents\6TfIGV9mEk.docx |
C:\Users\FD1HVy\Documents\9aCUL_quc0nnysYb8_GZ.docx |
C:\Users\FD1HVy\Documents\CHI8u2LQNUK9.pptx |
C:\Users\FD1HVy\Documents\FcEv.xlsx |
C:\Users\FD1HVy\Documents\I_sAE_RPiBf.csv |
C:\Users\FD1HVy\Documents\JmjLgmDEMOSy |
C:\Users\FD1HVy\Documents\JmjLgmDEMOSy\iooYp0USYbj.odp |
C:\Users\FD1HVy\Documents\JmjLgmDEMOSy\uWZ8oYpaXLg5ubZ.pdf |
C:\Users\FD1HVy\Documents\LBP1eWKY.pptx |
C:\Users\FD1HVy\Documents\LXbCpBUxY1j.pptx |
C:\Users\FD1HVy\Documents\QKdo1P |
C:\Users\FD1HVy\Documents\QKdo1P\HjV4WGYMkQN6k |
C:\Users\FD1HVy\Documents\QKdo1P\HjV4WGYMkQN6k\7VGcHLFT9IYtpAN.docx |
C:\Users\FD1HVy\Documents\QKdo1P\HjV4WGYMkQN6k\TfEfXS7vk.csv |
C:\Users\FD1HVy\Documents\QKdo1P\HjV4WGYMkQN6k\jB_Sn_Op6LZc.ods |
C:\Users\FD1HVy\Documents\QKdo1P\gSA-azGzaXPPT9c.odt |
C:\Users\FD1HVy\Documents\QKdo1P\oHxeefrKID5lI5v.pdf |
C:\Users\FD1HVy\Documents\Sq0rJQATZCKCzHHBjkE.docx |
C:\Users\FD1HVy\Documents\TATh.xlsx |
C:\Users\FD1HVy\Documents\TyIKG9FUm |
C:\Users\FD1HVy\Documents\TyIKG9FUm\JvZ795YYYZNf.odp |
C:\Users\FD1HVy\Documents\TyIKG9FUm\lKo5_tPDi.rtf |
C:\Users\FD1HVy\Documents\TyIKG9FUm\mPK6WJDb.xlsx |
C:\Users\FD1HVy\Documents\TyIKG9FUm\oHEBwzY6LtHD_Oy.ods |
C:\Users\FD1HVy\Documents\TyIKG9FUm\qxbdvy.xls |
C:\Users\FD1HVy\Documents\TyIKG9FUm\sel81hl.xls |
C:\Users\FD1HVy\Documents\UDx2iaHxRxqg3y-q3.docx |
C:\Users\FD1HVy\Documents\U_eBv5y-ar |
C:\Users\FD1HVy\Documents\U_eBv5y-ar\3bWV7j2T.odp |
C:\Users\FD1HVy\Documents\U_eBv5y-ar\CaRKOtELnDcN7b |
C:\Users\FD1HVy\Documents\U_eBv5y-ar\CaRKOtELnDcN7b\FmM2oiDi.docx |
C:\Users\FD1HVy\Documents\U_eBv5y-ar\CaRKOtELnDcN7b\SeWMNz.ppt |
C:\Users\FD1HVy\Documents\U_eBv5y-ar\CaRKOtELnDcN7b\bnr_NtGM.doc |
C:\Users\FD1HVy\Documents\U_eBv5y-ar\CaRKOtELnDcN7b\gzeJn Utgqq7Y9Uoqc.pdf |
C:\Users\FD1HVy\Documents\U_eBv5y-ar\Pcz2b3xbkkSj42K.pdf |
C:\Users\FD1HVy\Documents\U_eBv5y-ar\mNGDimuT2Dy35WIr.xls |
C:\Users\FD1HVy\Documents\U_eBv5y-ar\o9t3qppDjkANWrYUj69-.doc |
C:\Users\FD1HVy\Documents\U_eBv5y-ar\xzBo7Khk5yG7spRz |
C:\Users\FD1HVy\Documents\U_eBv5y-ar\xzBo7Khk5yG7spRz\2UsihjjiWQFkY.ots |
C:\Users\FD1HVy\Documents\U_eBv5y-ar\xzBo7Khk5yG7spRz\5hFzCI9iVeguV 63.ots |
C:\Users\FD1HVy\Documents\U_eBv5y-ar\xzBo7Khk5yG7spRz\GCdWslqA3vvFahfSYGT.csv |
C:\Users\FD1HVy\Documents\U_eBv5y-ar\xzBo7Khk5yG7spRz\_DIEgiLF1 PIiA7.pdf |
C:\Users\FD1HVy\Documents\U_eBv5y-ar\xzBo7Khk5yG7spRz\mxtd9_AXrXkRLsSD.xls |
C:\Users\FD1HVy\Documents\Zux1iyPzZtE57Sp.pptx |
C:\Users\FD1HVy\Documents\i3MSJVEI2 |
C:\Users\FD1HVy\Documents\i3MSJVEI2\6QF Fd2IoxX5XpH3q.odp |
C:\Users\FD1HVy\Documents\i3MSJVEI2\9Ll6punKODwTPBMU8.rtf |
C:\Users\FD1HVy\Documents\i3MSJVEI2\S92EXBV2QPj.xls |
C:\Users\FD1HVy\Documents\i3MSJVEI2\mlQ55ThydJYJNZfZqQGB.odp |
C:\Users\FD1HVy\Documents\jYcq.xlsx |
C:\Users\FD1HVy\Documents\jn1gP9gJ7aUZlTc7.xlsx |
C:\Users\FD1HVy\Documents\nUW7r8Vj3u4o |
C:\Users\FD1HVy\Documents\nUW7r8Vj3u4o\98BzcMMe0U.ods |
C:\Users\FD1HVy\Documents\nUW7r8Vj3u4o\9AC1i1.ppt |
C:\Users\FD1HVy\Documents\nUW7r8Vj3u4o\E5W03gpc3ACg4wI9g.pps |
C:\Users\FD1HVy\Documents\nUW7r8Vj3u4o\bnXIz oiZjjjJoM3.doc |
C:\Users\FD1HVy\Documents\nUW7r8Vj3u4o\dobI5.odt |
C:\Users\FD1HVy\Documents\nUW7r8Vj3u4o\k6A7IAt.csv |
C:\Users\FD1HVy\Documents\ssB-Ti.xlsx |
C:\Users\FD1HVy\Music\DjqxcL4994 |
C:\Users\FD1HVy\Music\DjqxcL4994\1oGi9Gqwky |
C:\Users\FD1HVy\Music\DjqxcL4994\1oGi9Gqwky\NpvaBEQ9AAtPvNS.wav |
C:\Users\FD1HVy\Music\DjqxcL4994\1oGi9Gqwky\XNttvkliNibwmflvs8T.mp3 |
C:\Users\FD1HVy\Music\DjqxcL4994\1oGi9Gqwky\tnTTI0aaO.mp3 |
C:\Users\FD1HVy\Music\DjqxcL4994\9Gz3XzfO3dpEmSVy.m4a |
C:\Users\FD1HVy\Music\DjqxcL4994\C1jlIJSWzJD.mp3 |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\-Gi8LzK7O1 |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\-Gi8LzK7O1\4u4bhUe7uKHUg5.wav |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\-Gi8LzK7O1\5RXwTK.wav |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\-Gi8LzK7O1\YFZXcdATXCLV.mp3 |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\-Gi8LzK7O1\sxPhIVK_7Cg.m4a |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\00z 3TH |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\00z 3TH\IhSt6b.wav |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\00z 3TH\QyvTh2817vQ.wav |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\00z 3TH\SNTBE MVoOuCra0V.wav |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\00z 3TH\mUWYS-TrVG.wav |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\00z 3TH\ozzl0gdYo9CAdzXGBGq- |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\00z 3TH\ozzl0gdYo9CAdzXGBGq-\7WrjOev06kwnq6Lb93.wav |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\00z 3TH\ozzl0gdYo9CAdzXGBGq-\RpspO0hHAj.m4a |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\00z 3TH\ozzl0gdYo9CAdzXGBGq-\n2i_e49bF9G5KiqrQg.mp3 |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\00z 3TH\ozzl0gdYo9CAdzXGBGq-\ubzU5oYtWj3JG6A4DJJ.mp3 |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\00z 3TH\ozzl0gdYo9CAdzXGBGq-\vusDIE.wav |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\00z 3TH\qJ4j10 hGwi64s.mp3 |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\0MMI.mp3 |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\3qxhBfws.mp3 |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\7dVUY1 |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\7dVUY1\4Ezx4vu7CMq |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\7dVUY1\4Ezx4vu7CMq\KUahVhYumg.m4a |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\7dVUY1\4Ezx4vu7CMq\hNdtKBEIZRYQSbOHuS1.wav |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\7dVUY1\4Ezx4vu7CMq\mSkiF137I.mp3 |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\7dVUY1\4Ezx4vu7CMq\v2VqZ.m4a |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\7dVUY1\6ggJar4oMo4Pl.wav |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\7dVUY1\soI799I.m4a |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\Aoab.mp3 |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\RlYPwbms2tLNsBwnCdg6.mp3 |
C:\Users\FD1HVy\Music\DjqxcL4994\WyWqwpgT9E2-M\bKHwapl8.wav |
C:\Users\FD1HVy\Music\DjqxcL4994\ktiEmA_gcs_544kzBhBr.wav |
C:\Users\FD1HVy\Music\DjqxcL4994\msnu9uLpJ.mp3 |
C:\Users\FD1HVy\Music\DjqxcL4994\qEBOVrRa7r9p4Q2b1W.m4a |
C:\Users\FD1HVy\Music\DjqxcL4994\uOFef |
C:\Users\FD1HVy\Music\DjqxcL4994\uOFef\M56a3vfYQP3XP.mp3 |
C:\Users\FD1HVy\Music\DjqxcL4994\uOFef\TwwTdhe.m4a |
C:\Users\FD1HVy\Music\DjqxcL4994\uOFef\YgRV4vy3TscsCG3Y.wav |
C:\Users\FD1HVy\Music\DjqxcL4994\uOFef\a4_Cn0KhF1.mp3 |
C:\Users\FD1HVy\Music\DjqxcL4994\uOFef\zj0gIe.m4a |
C:\Users\FD1HVy\Pictures\-Q3tcUrW0hNvl-Pf.jpg |
C:\Users\FD1HVy\Pictures\13tBzmzg6Y7G0z4ygE.bmp |
C:\Users\FD1HVy\Pictures\19e.bmp |
C:\Users\FD1HVy\Pictures\4ZrKxEykMflev2WdxaG.gif |
C:\Users\FD1HVy\Pictures\4oWl-Hxdxo_cRyrzjh.gif |
C:\Users\FD1HVy\Pictures\9Dj5GCRViNR.jpg |
C:\Users\FD1HVy\Pictures\9c73MRlcWH2.png |
C:\Users\FD1HVy\Pictures\AT6k6DQJF.png |
C:\Users\FD1HVy\Pictures\BpVz wH-TJ8f.png |
C:\Users\FD1HVy\Pictures\BsVv0.jpg |
C:\Users\FD1HVy\Pictures\DA4qL-5EGW P.png |
C:\Users\FD1HVy\Pictures\FKEDdyKzMN3 HmMj3t0.png |
C:\Users\FD1HVy\Pictures\H_HsEXVPQpSYz.jpg |
C:\Users\FD1HVy\Pictures\LV-TENGiQpp47-RSQ8b.gif |
C:\Users\FD1HVy\Pictures\Ldu4Mu-gAjT7ekUk2G5.gif |
C:\Users\FD1HVy\Pictures\MPBhkoEa8DR.jpg |
C:\Users\FD1HVy\Pictures\Rlo2BL3c.jpg |
C:\Users\FD1HVy\Pictures\SE8uH2NWoDMK.png |
C:\Users\FD1HVy\Pictures\TR-GX3pwhtO_TrpvniI.jpg |
C:\Users\FD1HVy\Pictures\U4CfLAQ 4TJJG9XpXp.jpg |
C:\Users\FD1HVy\Pictures\Z WIOxa7W8MnspkY.gif |
C:\Users\FD1HVy\Pictures\ZRzWnvGxO0F yhkb.bmp |
C:\Users\FD1HVy\Pictures\Zs14.png |
C:\Users\FD1HVy\Pictures\aL Wva9x8gHV8.png |
C:\Users\FD1HVy\Pictures\b0TH.png |
C:\Users\FD1HVy\Pictures\bRS2DBHR.gif |
C:\Users\FD1HVy\Pictures\dTclk5wYTYXhA54lsS.gif |
C:\Users\FD1HVy\Pictures\dz7fU7sJyW.jpg |
C:\Users\FD1HVy\Pictures\eR9pADxVUOi7s9.bmp |
C:\Users\FD1HVy\Pictures\fjlmMbHazdH.png |
C:\Users\FD1HVy\Pictures\hxlS0cuZpus.png |
C:\Users\FD1HVy\Pictures\j7I-_Uoy.gif |
C:\Users\FD1HVy\Pictures\m5EyUQG.bmp |
C:\Users\FD1HVy\Pictures\r90yyO.jpg |
C:\Users\FD1HVy\Pictures\s03zL3eQOR4.png |
C:\Users\FD1HVy\Pictures\x9xrEwwvuQ.gif |
C:\Users\FD1HVy\Pictures\ycGyxXr2vSuGJnXofXv.bmp |
C:\Users\FD1HVy\Pictures\zl17HPmPPfI.png |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\09VPTbohd__im_DY.mp4 |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\3QRCFnxK.flv |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\56_ojPSC0J EtIRnKo.mp4 |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\A_v4db5znp2.mkv |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\DlNNfmiNAR |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\DlNNfmiNAR\RTe9vrwySA1DWG.avi |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\DlNNfmiNAR\gc2rsyiwmhCin.swf |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\CiaekcK-fQTOOXR.mkv |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\NliSPt 72pD |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\NliSPt 72pD\Jffm9cFxg332.mkv |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\NliSPt 72pD\UDYBfj.flv |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\NliSPt 72pD\pXL1QYDRW |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\NliSPt 72pD\pXL1QYDRW\4OaNfTyCKhEUvdna42p2.mp4 |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\NliSPt 72pD\pXL1QYDRW\FP5P2oSL-MGcTR.mkv |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\NliSPt 72pD\pXL1QYDRW\LbOMX_YkULQnFB.mkv |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\NliSPt 72pD\pXL1QYDRW\T1yp1J8F7wT.avi |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\NliSPt 72pD\pXL1QYDRW\XEMrXrrz_EBA rJUc.mp4 |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\NliSPt 72pD\pXL1QYDRW\l qH.mp4 |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\NliSPt 72pD\pXL1QYDRW\my1caFauCzHZoQvl.mp4 |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\NliSPt 72pD\skq_.swf |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\nZ3Y2hotpAbgQsS- |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\nZ3Y2hotpAbgQsS-\5nB_paQTOhRlpxo.avi |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\nZ3Y2hotpAbgQsS-\73AfvQAqK.swf |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\nZ3Y2hotpAbgQsS-\Q4Fl.swf |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\nZ3Y2hotpAbgQsS-\QvOMKv.mp4 |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\nZ3Y2hotpAbgQsS-\cmkf8 h.mp4 |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\Hr8 e5zT5ajVUjPqC\wwLYcIfpT9.flv |
C:\Users\FD1HVy\Videos\4ayi-JH5EM9SbtjX7Iu\iVh9Zzp44Y3K.swf |
C:\Users\FD1HVy\Videos\OVgbzb3Tcb.mkv |
C:\Users\FD1HVy\Videos\Q9kpNJx1-DDSH 13Je.swf |
C:\Users\FD1HVy\Videos\URS2T DXa3JYlmi.mkv |
C:\Users\FD1HVy\Videos\cymb.avi |