Malicious
Classifications
Ransomware
Threat Names
Trojan.Ransom.Agent.BX
Dynamic Analysis Report
Created on 2021-05-11T03:42:00
sosduf.exe
Windows Exe (x86-32)
Remarks
(0x0200004A): 3 dumps were skipped because they exceeded the maximum dump size of 16 MB. The largest one was 516 MB.
(0x0200001B): The maximum number of file Reputation Analysis requests per analysis (150) was exceeded.
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
File Name | Category | Type | Verdict | Actions |
---|
AV Matches (1)
»
Threat Name | Verdict |
---|---|
Trojan.Ransom.Agent.BX |
malicious
|
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x45a990 |
Size Of Code | 0x101e00 |
Size Of Initialized Data | 0x1bc00 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_cui |
Machine Type | MachineType.i386 |
Compile Timestamp | 1970-01-01 00:00:00+00:00 |
Sections (6)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x401000 | 0x101cba | 0x101e00 | 0x400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.16 |
.rdata | 0x503000 | 0xea514 | 0xea600 | 0x102200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.66 |
.data | 0x5ee000 | 0x3ede0 | 0x1bc00 | 0x1ec800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.74 |
.idata | 0x62d000 | 0x3d6 | 0x400 | 0x208400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.66 |
.reloc | 0x62e000 | 0x1236c | 0x12400 | 0x208800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.57 |
.symtab | 0x641000 | 0x4 | 0x200 | 0x21ac00 | IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.02 |
Imports (1)
»
kernel32.dll (39)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
WriteFile | - | 0x5ee020 | 0x22d336 | 0x208736 | 0x0 |
WriteConsoleW | - | 0x5ee024 | 0x22d33a | 0x20873a | 0x0 |
WaitForMultipleObjects | - | 0x5ee028 | 0x22d33e | 0x20873e | 0x0 |
WaitForSingleObject | - | 0x5ee02c | 0x22d342 | 0x208742 | 0x0 |
VirtualQuery | - | 0x5ee030 | 0x22d346 | 0x208746 | 0x0 |
VirtualFree | - | 0x5ee034 | 0x22d34a | 0x20874a | 0x0 |
VirtualAlloc | - | 0x5ee038 | 0x22d34e | 0x20874e | 0x0 |
SwitchToThread | - | 0x5ee03c | 0x22d352 | 0x208752 | 0x0 |
SuspendThread | - | 0x5ee040 | 0x22d356 | 0x208756 | 0x0 |
Sleep | - | 0x5ee044 | 0x22d35a | 0x20875a | 0x0 |
SetWaitableTimer | - | 0x5ee048 | 0x22d35e | 0x20875e | 0x0 |
SetUnhandledExceptionFilter | - | 0x5ee04c | 0x22d362 | 0x208762 | 0x0 |
SetProcessPriorityBoost | - | 0x5ee050 | 0x22d366 | 0x208766 | 0x0 |
SetEvent | - | 0x5ee054 | 0x22d36a | 0x20876a | 0x0 |
SetErrorMode | - | 0x5ee058 | 0x22d36e | 0x20876e | 0x0 |
SetConsoleCtrlHandler | - | 0x5ee05c | 0x22d372 | 0x208772 | 0x0 |
ResumeThread | - | 0x5ee060 | 0x22d376 | 0x208776 | 0x0 |
PostQueuedCompletionStatus | - | 0x5ee064 | 0x22d37a | 0x20877a | 0x0 |
LoadLibraryA | - | 0x5ee068 | 0x22d37e | 0x20877e | 0x0 |
LoadLibraryW | - | 0x5ee06c | 0x22d382 | 0x208782 | 0x0 |
SetThreadContext | - | 0x5ee070 | 0x22d386 | 0x208786 | 0x0 |
GetThreadContext | - | 0x5ee074 | 0x22d38a | 0x20878a | 0x0 |
GetSystemInfo | - | 0x5ee078 | 0x22d38e | 0x20878e | 0x0 |
GetSystemDirectoryA | - | 0x5ee07c | 0x22d392 | 0x208792 | 0x0 |
GetStdHandle | - | 0x5ee080 | 0x22d396 | 0x208796 | 0x0 |
GetQueuedCompletionStatusEx | - | 0x5ee084 | 0x22d39a | 0x20879a | 0x0 |
GetProcessAffinityMask | - | 0x5ee088 | 0x22d39e | 0x20879e | 0x0 |
GetProcAddress | - | 0x5ee08c | 0x22d3a2 | 0x2087a2 | 0x0 |
GetEnvironmentStringsW | - | 0x5ee090 | 0x22d3a6 | 0x2087a6 | 0x0 |
GetConsoleMode | - | 0x5ee094 | 0x22d3aa | 0x2087aa | 0x0 |
FreeEnvironmentStringsW | - | 0x5ee098 | 0x22d3ae | 0x2087ae | 0x0 |
ExitProcess | - | 0x5ee09c | 0x22d3b2 | 0x2087b2 | 0x0 |
DuplicateHandle | - | 0x5ee0a0 | 0x22d3b6 | 0x2087b6 | 0x0 |
CreateWaitableTimerExW | - | 0x5ee0a4 | 0x22d3ba | 0x2087ba | 0x0 |
CreateThread | - | 0x5ee0a8 | 0x22d3be | 0x2087be | 0x0 |
CreateIoCompletionPort | - | 0x5ee0ac | 0x22d3c2 | 0x2087c2 | 0x0 |
CreateEventA | - | 0x5ee0b0 | 0x22d3c6 | 0x2087c6 | 0x0 |
CloseHandle | - | 0x5ee0b4 | 0x22d3ca | 0x2087ca | 0x0 |
AddVectoredExceptionHandler | - | 0x5ee0b8 | 0x22d3ce | 0x2087ce | 0x0 |
Memory Dumps (2)
»
Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | AV | YARA | Actions |
---|---|---|---|---|---|---|---|---|---|---|
sosduf.exe | 1 | 0x001C0000 | 0x00401FFF | Relevant Image | 32-bit | 0x0021AAB5 |
...
|
|||
sosduf.exe | 1 | 0x001C0000 | 0x00401FFF | Process Termination | 32-bit | - |
...
|
C:\Users\Public\Libraries\RecordedTV.library-ms | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\1Km6TnsAdDf-JeC.jpg | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\1mnoByBkAMXa.png | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\66BvrGNc-jk.wav | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\Cm6l_YapJvSAE.swf | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\HDIuMzsJvMzE8c5R.png | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\IVKiwu3f0ndhBaWgQn.m4a | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\KWcSlr8.m4a | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\LxtgF.png | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\NbdjCTHjUzBe.jpg | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\OKumVv-WW9xG3 X7.wav | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\MLFJsoANMGkL6.png | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\Qvi-dS4n9MsyIpDvRf.swf | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\SnvV951PWU.png | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\ZaUlEzOulRLVBjJU.m4a | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\a95sccTOOgBT.ods | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\_wsI2QZy.swf | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\dE-y9CgieV 4gFU.mp4 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\irbhWMK5C3JR.bmp | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\jJFhRvXx0-HQg\AEQRz5sBzZhVu.bmp | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\jJFhRvXx0-HQg\CVQ7.mp4 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\jJFhRvXx0-HQg\CtCB.avi | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\jJFhRvXx0-HQg\EmxH.ppt | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\jJFhRvXx0-HQg\LYDVGBJ4IFd.png | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\jJFhRvXx0-HQg\O7NH.jpg | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\jJFhRvXx0-HQg\Wl80P.png | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\jJFhRvXx0-HQg\eRZYW5m\DSGla4p6Xu.flv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\jJFhRvXx0-HQg\eRZYW5m\ILqBRPcatX7-wJ.mp3 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\jJFhRvXx0-HQg\eRZYW5m\p6jHL.avi | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\jJFhRvXx0-HQg\eRZYW5m\ySbQKDOOjrDH.m4a | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\jJFhRvXx0-HQg\gSBPZvGU21Z-uNb.mkv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\lL0dIZF59JV6cM.wav | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\lXxjNJbLBvyc-mw.mp3 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\lOzyAQY7oI.bmp | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\lsmenFxq-3ao\0dQqEwX7b_r-zpvAb.wav | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\lsmenFxq-3ao\3W3Heu.mkv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\lsmenFxq-3ao\AQIRwU.png | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\lsmenFxq-3ao\EI7WNGL9jviw5Iu.pps | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\lsmenFxq-3ao\zQmIs_lj7.flv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\mWSShGr5fOi zdg0.csv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\n0_FeAoVLpX4idGJgs.wav | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\nRv9Wkb9.mp3 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\npFe-2XahFj.swf | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\oCYK45iLz.m4a | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\om7geSAayM_.swf | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\qb_CobqM-NNuxFtHqK.mp3 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\qV2oI ZBBRMAHt8w.mkv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\vfF9hHKjAPNcKqxY4A.bmp | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\stBubxBe6y6z4niQjh2c.avi | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\0kERH4Zo.rtf | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Desktop\wzJn2zO_p-yHTkE3g4.gif | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\1fL3-I81Z4OYL.pptx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\4OolYd_eSq8.pptx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\4XkNQsq6XKr_P6HMwtn.doc | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\6KaGGKzw-OwQUh4.docx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\90Gb-.docx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\0T-Vkj2\-JZ ca6GvEB8.xlsx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\0T-Vkj2\-hL1jdjMmVRK1ZFL0_5B.docx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\0T-Vkj2\03GbZMlsTTv_yjD9Hjv.rtf | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\0T-Vkj2\CzW_XpqO6uC53L50.csv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\0T-Vkj2\NJYrymxV9.xls | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\0T-Vkj2\NvhgQY.xls | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\0T-Vkj2\OsT7kWbXlqq8WJ.pps | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\0T-Vkj2\kHLccXDGcWmzYVg9CD\Ke4Xu6HrzU4nsA9.doc | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\0T-Vkj2\YYIkjg13SNtmwKdTH3.csv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\0T-Vkj2\kHLccXDGcWmzYVg9CD\WmDqkoE85dUrhaVe.pps | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\0T-Vkj2\kHLccXDGcWmzYVg9CD\aiei3.doc | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\0T-Vkj2\kHLccXDGcWmzYVg9CD\bNvBM12ZP88xhuWaAeV.docx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\0T-Vkj2\m9rQ-Zp.xls | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\0T-Vkj2\zZgXN8tXya.docx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\5m1S6Vhyy.xlsx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\N4v2AJonjYIfePu-5ySR\-3H43 g4.rtf | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\N4v2AJonjYIfePu-5ySR\0HS-m8AnET_.csv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\N4v2AJonjYIfePu-5ySR\3evmoN uAcG8aZ.doc | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\N4v2AJonjYIfePu-5ySR\CmqUn.odp | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\N4v2AJonjYIfePu-5ySR\Kyrmv4S.odt | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\N4v2AJonjYIfePu-5ySR\aMrWoUh.pdf | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\N4v2AJonjYIfePu-5ySR\keqkXJmj_XVc8NkMC.rtf | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\N4v2AJonjYIfePu-5ySR\q8eTg6wNzG.odt | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\N4v2AJonjYIfePu-5ySR\ve5SvDA4.ods | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\N4v2AJonjYIfePu-5ySR\y8rkdvIeu_ne.odp | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\N4v2AJonjYIfePu-5ySR\yrCi4R1znEIIicM.ods | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\_dteD\C0S2WHYz.ppt | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\_dteD\JnOi1dEaD9FVdj5H8I.docx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\_dteD\kaeNBPAsAQQV.xlsx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\_dteD\sPOK hNDt-tgCki.rtf | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\_dteD\uIuruq649yUtUP0eXHg7.pps | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\byAxU_QdeSYuBunRt.csv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Ea6EH7e6iYLk5qzARj9\uk0z.xlsx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\H09VzhhJy701Zn.pptx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\HZH9ZrMuSr.pptx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\I-BK4YVGg1b.rtf | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Lyucj2S2OOss7KdI.pptx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\N11qWtgLG.docx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\Outlook Files\achoo@gdllo.de.pst | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\VtkM6.xlsx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\XnU2rHF.xlsx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\iNydqE6ZqnU-cP.ppt | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\nlgyKb7bVH6VfuCYA.xlsx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\nzJDx.ods | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\qkKxpDXlhMxB7c.xlsx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\vTz7ukVPLfFQ.xlsx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\vkTMaBRaJZ6X.docx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\wGU4.pps | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Documents\xP-_L.docx | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Favorites\Bing.url | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Links\Desktop.lnk | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Links\Downloads.lnk | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\7VAU_SZVOE6QLBs72.mp3 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\LYJqOLnG68IjaOKql90Y.mp3 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\R2RbR0boE5Lx2X\4Tbto3wSrq.wav | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\R2RbR0boE5Lx2X\7Wh9AxLTsfU1o4fqG\6LV1sbKK-D3XJvtWm.wav | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\R2RbR0boE5Lx2X\7Wh9AxLTsfU1o4fqG\LCvg4MHIIDFXE5UG\3DHMCVhrKOMLCJNnzVMN.m4a | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\R2RbR0boE5Lx2X\7Wh9AxLTsfU1o4fqG\LCvg4MHIIDFXE5UG\IwNwHTkANyQgUz1S.m4a | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\R2RbR0boE5Lx2X\7Wh9AxLTsfU1o4fqG\LCvg4MHIIDFXE5UG\PZ3cyOZFQ.wav | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\R2RbR0boE5Lx2X\7Wh9AxLTsfU1o4fqG\LCvg4MHIIDFXE5UG\VEuQO6swH.mp3 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\R2RbR0boE5Lx2X\7Wh9AxLTsfU1o4fqG\LCvg4MHIIDFXE5UG\dH60-76fNbZrdz2.m4a | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\R2RbR0boE5Lx2X\7Wh9AxLTsfU1o4fqG\LCvg4MHIIDFXE5UG\kZWl531.mp3 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\R2RbR0boE5Lx2X\7Wh9AxLTsfU1o4fqG\nIVzqLF49.wav | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\R2RbR0boE5Lx2X\7Wh9AxLTsfU1o4fqG\yCJwtHQtWZDZ3t2yyS\Xjg2XcAOL2hUX.mp3 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\R2RbR0boE5Lx2X\7Wh9AxLTsfU1o4fqG\yCJwtHQtWZDZ3t2yyS\lk6mWym4EJDZhiVbitZc.wav | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\R2RbR0boE5Lx2X\7Wh9AxLTsfU1o4fqG\yCJwtHQtWZDZ3t2yyS\pG2YkrB6YC7l.wav | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\R2RbR0boE5Lx2X\7Wh9AxLTsfU1o4fqG\yCJwtHQtWZDZ3t2yyS\sykSo4.wav | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\R2RbR0boE5Lx2X\mboAfofw_jCV.mp3 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\R2RbR0boE5Lx2X\rFMIbNTh6SVXWCF.wav | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\R2RbR0boE5Lx2X\uUrZ0.m4a | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\bUeCDFkN.wav | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\hJz6V.mp3 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\jk6FfJO_dz.mp3 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\l3Ukg9xPqGI\DBjkoAN\-d7DGeGff4j3KRJnW.mp3 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\l3Ukg9xPqGI\DBjkoAN\A16LF.mp3 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\l3Ukg9xPqGI\DBjkoAN\ed92X-Z.mp3 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\l3Ukg9xPqGI\DBjkoAN\kuL1W-h.wav | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\l3Ukg9xPqGI\DBjkoAN\nXPIvrum.wav | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\l3Ukg9xPqGI\DBjkoAN\tH2U4LxniYTrw.m4a | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\l3Ukg9xPqGI\MK7VWoo.mp3 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\l3Ukg9xPqGI\PGkxYB cz.mp3 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\l3Ukg9xPqGI\Tj5pc8WH5_1HOaZF0.m4a | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\l3Ukg9xPqGI\nnjv0Ap0trl8.m4a | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Music\l3Ukg9xPqGI\ujenVfUz-oAJdo.m4a | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\07tca.bmp | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\2V5CsG2h.jpg | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\2bKCQml.jpg | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\39ONyQqD1_0DcRWHisH.gif | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\8qMv.bmp | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\95 5vc4ZtmelBq.jpg | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\Bg3SfdVdr.bmp | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\HUFrMqUQLvETR0w0.png | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\LL6gyxEm.png | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\NMFJzJl8.jpg | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\RnOyPWEf6b-wu.gif | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\VQj8Upe PrP5Xy_.bmp | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\WoPtTB-ZULyBg.gif | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\_DZRGDb6qOo Id v9KRz.jpg | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\cpuhbF55vB.gif | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\gNpnccZzyR4yOQ7Kq4.bmp | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\gg43vI1yr8pTZKBdPTM.jpg | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\jr8vAOj2RFtClQI1FqJs.png | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\kZCD.jpg | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\l8LiaunWih5ECuF.gif | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\mh9xwYD.bmp | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\n5A2AmtZcP5kxq23 MP.jpg | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\oEH_Z M5ZBY9lEd.jpg | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\qHoJ-z3pedpS.jpg | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\vJ5FE.png | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\wbH2qH6mqYuF9.png | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Pictures\ymOQymw.png | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Searches\Everywhere.search-ms | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Searches\Indexed Locations.search-ms | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\27aUy Ao90492vIE.flv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\4bqpns7UkgBUaTR.mp4 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\Bo6xMhJa7YQNZtA07\-PtDE674Kqh5Lvu.mp4 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\Bo6xMhJa7YQNZtA07\95qIU6V2taby9rkE-7B.mkv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\Bo6xMhJa7YQNZtA07\HZCrml MO689itQovwz.flv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\Bo6xMhJa7YQNZtA07\N3AG.avi | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\Bo6xMhJa7YQNZtA07\cX6yGT.mkv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\Bo6xMhJa7YQNZtA07\yppx1B7j.flv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\Bo6xMhJa7YQNZtA07\zDAfxOHlO1SRg.avi | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\H9Eu0o86x\99IeKDH3aKF\3Mz6kQ.mp4 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\H9Eu0o86x\99IeKDH3aKF\4coWhXgRWgb.avi | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\H9Eu0o86x\99IeKDH3aKF\bFLtcXnRCEnIr3Q5Ohk.swf | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\H9Eu0o86x\99IeKDH3aKF\e8RxABnO.swf | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\H9Eu0o86x\99IeKDH3aKF\sWGYoz.swf | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\H9Eu0o86x\g0lJSnouVtC.avi | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\H9Eu0o86x\lmoin.mkv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\H9Eu0o86x\nU1mCOq-5XZ.mkv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\9lLzQ.avi | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\AAr6B\AIzBr5ZrKX8.swf | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\AAr6B\fGXoIXk\3aeT y.swf | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\AAr6B\fGXoIXk\UyZKX--DfH6UhPde 1_.mp4 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\AAr6B\fGXoIXk\VOxYfcqy oiokY91TZs.flv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\AAr6B\fGXoIXk\_aFJYVh irMQXFQ3AT.flv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\AAr6B\fGXoIXk\giDMeosqH0NeSG\LNTYHvH3cg5J_RxZQmO.flv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\AAr6B\fGXoIXk\giDMeosqH0NeSG\q7 ECMvYSj2UiPE.mp4 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\AAr6B\fGXoIXk\giDMeosqH0NeSG\yCcF-EtUVUzhsAQ2.flv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\AAr6B\fGXoIXk\oo77\76tOSW6xWOy.flv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\AAr6B\fGXoIXk\oo77\HF2gq.flv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\AAr6B\fGXoIXk\oo77\gwZvyQHZjiAyvA06ZZ.mkv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\AAr6B\mCVrQ3VNk3q9t.mkv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\MF gNOEL8QBz.mkv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\OPzgr0G4CKXjB.mkv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\_eDGK9.mp4 | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\er5glMfqhf7.mkv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\R9kOXEGtjBQG4RnNd\nbeBLlR.avi | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\p8tW\W6cGYh-ZpuhCp.flv | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\p8tW\jtAx.avi | Modified File | Stream |
clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\Videos\umJF5l KUU0k.flv | Modified File | Stream |
clean
|
...
|
»