Ursnif 2019-05-27

Virtual Machine Information

Name	win7_64_sp1-mso2016
Description	-
Architecture	x86 64-bit
Operating System	Windows 7
Kernel Version	6.1.7601.17514 (3844dbb9-2017-4967-be7a-a4a2c20430fa)
Network Scheme Name	Local Gateway
Network Config Name	Local Gateway

Analyzer Information

Analyzer Version	3.0.2
Dynamic Engine Version	3.0.2 / 2019-06-06 12:21 (UTC+2)
Static Engine Version	1.1.1 / 2019-06-06 12:22 (UTC+2)
Local AV Version	AVCORE v2.1 Linux/x86_64 11.0.1.18 (Aug 9, 2017)
Local AV Database Update Release Date	2019-06-09 13:56 (UTC+2)
VTI Ruleset Version	3.3
YARA Built-in Ruleset Version	1.2
Analysis Report Layout Version	4

System Information

Computer Name	YKYD69Q
User Domain	YKYD69Q
User Name	aETAdzjz
User Profile	C:\Users\aETAdzjz
Temp Directory	C:\Users\aETAdzjz\AppData\Local\Temp
System Root	C:\Windows
Sample Directory	C:\Users\aETAdzjz\Desktop

Software Information

Adobe Acrobat Reader Version	10.0.0
Internet Explorer Version	8.0.7601.17514
Chrome Version	59.0.3071.115
Firefox Version	25.0
Flash Version	11.2.202.233
Java Version	7.0.710.14
.NET Version	4.6.00081
Powershell Version	2.0
Microsoft Office	2016
Microsoft Office Version	16.0.8431.2079
Microsoft Project Version	16.0.8431.2079
Microsoft Visio Version	16.0.8431.2079

Randomly Created Artifacts

This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.

Processes (20)

Filename	PID	GUI
C:\Program Files (x86)\Adobe\requirement_float_disability.exe	#2052
C:\Program Files (x86)\Common Files\know.exe	#1448
C:\Program Files (x86)\Common Files\unfortunatelyafterwardsemission.exe	#2032
C:\Program Files (x86)\Google\licenses_miss.exe	#2068
C:\Program Files (x86)\Java\clusters attack.exe	#1520
C:\Program Files (x86)\Java\nr nutrition.exe	#1264
C:\Program Files (x86)\Mozilla Firefox\dishesproductioncottage.exe	#1156
C:\Program Files (x86)\Mozilla Firefox\refers.exe	#2044
C:\Program Files (x86)\Reference Assemblies\ps-workstation.exe	#1508
C:\Program Files (x86)\Windows Mail\plaintiff.exe	#568
C:\Program Files (x86)\Windows Mail\today.exe	#856
C:\Program Files (x86)\Windows Media Player\beat.exe	#312
C:\Program Files (x86)\Windows Photo Viewer\protective quite sessions.exe	#1420
C:\Program Files (x86)\Windows Sidebar\weblogs-waters.exe	#340
C:\Program Files\Common Files\ir grey.exe	#1656
C:\Program Files\Common Files\mumbai.exe	#1384
C:\Program Files\Microsoft Office\oriental.exe	#964
C:\Program Files\Reference Assemblies\chartspresently.exe	#200
C:\Program Files\Uninstall Information\additions.exe	#1560
C:\Program Files\Windows Media Player\greensborooregon.exe	#1416

Files (265)

Filename
C:\Users\aETAdzjz\AppData\Local\Temp\0M1KhNvfO4caY2pZ.odp
C:\Users\aETAdzjz\AppData\Local\Temp\1VhcYEA0yNt0onYU.avi
C:\Users\aETAdzjz\AppData\Local\Temp\5CUrDqd_.jpg
C:\Users\aETAdzjz\AppData\Local\Temp\7T2r.mp4
C:\Users\aETAdzjz\AppData\Local\Temp\9iu_-_1.mkv
C:\Users\aETAdzjz\AppData\Local\Temp\Ef1uyysySs.jpg
C:\Users\aETAdzjz\AppData\Local\Temp\H4Z7.mp4
C:\Users\aETAdzjz\AppData\Local\Temp\HFJVPavVm1zx.mp4
C:\Users\aETAdzjz\AppData\Local\Temp\HfH 1cNXU.mp4
C:\Users\aETAdzjz\AppData\Local\Temp\IhfmYeo_PXDuRggbo.swf
C:\Users\aETAdzjz\AppData\Local\Temp\Iou M_V.flv
C:\Users\aETAdzjz\AppData\Local\Temp\LoKKQ_SN2m4F7ihi.bmp
C:\Users\aETAdzjz\AppData\Local\Temp\NN8MuE EeS0_sOR7mzJ.mp3
C:\Users\aETAdzjz\AppData\Local\Temp\PATkGp2csrp.gif
C:\Users\aETAdzjz\AppData\Local\Temp\PCjaA_ChUz4Pe3FtH.gif
C:\Users\aETAdzjz\AppData\Local\Temp\Ste7YxQ3_M yf1mu.swf
C:\Users\aETAdzjz\AppData\Local\Temp\UYuwpiTko474UazRb.jpg
C:\Users\aETAdzjz\AppData\Local\Temp\W7HSFcWXqnMkIEkw.wav
C:\Users\aETAdzjz\AppData\Local\Temp\YDqCPCpvARwUMW.mkv
C:\Users\aETAdzjz\AppData\Local\Temp\YYDUg0cDb.xlsx
C:\Users\aETAdzjz\AppData\Local\Temp\_sWDnDg50xLELG1QvxE.wav
C:\Users\aETAdzjz\AppData\Local\Temp\eJHJYpV3Ojd9iBfnH.ods
C:\Users\aETAdzjz\AppData\Local\Temp\eJgpPri.wav
C:\Users\aETAdzjz\AppData\Local\Temp\i4wlG5.jpg
C:\Users\aETAdzjz\AppData\Local\Temp\iETKV0o.jpg
C:\Users\aETAdzjz\AppData\Local\Temp\j-e854rtamp- ql.ots
C:\Users\aETAdzjz\AppData\Local\Temp\laTuOpThypgacI4B.wav
C:\Users\aETAdzjz\AppData\Local\Temp\mBTCKMYo0.flv
C:\Users\aETAdzjz\AppData\Local\Temp\mGqZH1U1FsaeOu18Kv.mp4
C:\Users\aETAdzjz\AppData\Local\Temp\n6 tETdq6ewRoNvfF.pdf
C:\Users\aETAdzjz\AppData\Local\Temp\rl9 c.ots
C:\Users\aETAdzjz\AppData\Local\Temp\tK1hI_MTg.png
C:\Users\aETAdzjz\AppData\Local\Temp\uVnZr7w59zD3 iCL.avi
C:\Users\aETAdzjz\AppData\Local\Temp\wZB.wav
C:\Users\aETAdzjz\AppData\Local\Temp\yTbkiIPHVyYJh_m.bmp
C:\Users\aETAdzjz\AppData\Local\Temp\z-qXxt_.mp3
C:\Users\aETAdzjz\AppData\Roaming\3CvbZ27sNVNlEIcDr.png
C:\Users\aETAdzjz\AppData\Roaming\7KviI7VpJ.swf
C:\Users\aETAdzjz\AppData\Roaming\7M gE_Md.xls
C:\Users\aETAdzjz\AppData\Roaming\99en0joo4697S6Ply8c.jpg
C:\Users\aETAdzjz\AppData\Roaming\HYnI7oS3.ots
C:\Users\aETAdzjz\AppData\Roaming\HzagzFTWKPLp-i1qoyY.swf
C:\Users\aETAdzjz\AppData\Roaming\JzhIkR9Hxv6sSVCZ.m4a
C:\Users\aETAdzjz\AppData\Roaming\MpncdNiVe8l4XxDfPC.gif
C:\Users\aETAdzjz\AppData\Roaming\MrwLam.m4a
C:\Users\aETAdzjz\AppData\Roaming\OLq-7a4TJIG.swf
C:\Users\aETAdzjz\AppData\Roaming\OYcjLo0d IQq-ZJE.swf
C:\Users\aETAdzjz\AppData\Roaming\PZfAW1K-b_tgtbasrand.ots
C:\Users\aETAdzjz\AppData\Roaming\QrXE-vX97kmjH7JNQ.odp
C:\Users\aETAdzjz\AppData\Roaming\S4EkYkW8VR.bmp
C:\Users\aETAdzjz\AppData\Roaming\T5dulIYQq84F0WjyJUxJ.ppt
C:\Users\aETAdzjz\AppData\Roaming\VihuLBb9PQiL O.pptx
C:\Users\aETAdzjz\AppData\Roaming\YNCWJDGYQ_wJpW.wav
C:\Users\aETAdzjz\AppData\Roaming\ZXtS8VIt5CaNX9Y.mp4
C:\Users\aETAdzjz\AppData\Roaming\agwS9jwJhHy p1.odt
C:\Users\aETAdzjz\AppData\Roaming\fSLAD4G.m4a
C:\Users\aETAdzjz\AppData\Roaming\fdkus0pnkYX_9FlWPTF.jpg
C:\Users\aETAdzjz\AppData\Roaming\ftVOS 0HNw-wn9DFyDnm.swf
C:\Users\aETAdzjz\AppData\Roaming\jrxIx8SbO.m4a
C:\Users\aETAdzjz\AppData\Roaming\l2 tmDiWaU5LpGo9N.csv
C:\Users\aETAdzjz\AppData\Roaming\l7OxE6hE7M6LrT.avi
C:\Users\aETAdzjz\AppData\Roaming\lC5vY2DseDnk83eN.flv
C:\Users\aETAdzjz\AppData\Roaming\mn2 LcY4GUIecD_.bmp
C:\Users\aETAdzjz\AppData\Roaming\n8M3fjA-kFT1.ots
C:\Users\aETAdzjz\AppData\Roaming\nA h8.mkv
C:\Users\aETAdzjz\AppData\Roaming\o1aH5dN5Y.wav
C:\Users\aETAdzjz\AppData\Roaming\odN690Uv.png
C:\Users\aETAdzjz\AppData\Roaming\rbIgDrZXw.gif
C:\Users\aETAdzjz\AppData\Roaming\th0kck.mkv
C:\Users\aETAdzjz\AppData\Roaming\yV9LGB40R7.jpg
C:\Users\aETAdzjz\Desktop\-lBtKjvttR6.gif
C:\Users\aETAdzjz\Desktop\1drNjTjKcAp.wav
C:\Users\aETAdzjz\Desktop\37faU3 U8a8X.ots
C:\Users\aETAdzjz\Desktop\4KATP.png
C:\Users\aETAdzjz\Desktop\8nF8FXicLEc5Ij.xls
C:\Users\aETAdzjz\Desktop\9U8iW_exGTlwYmtQHD.wav
C:\Users\aETAdzjz\Desktop\AAB8Ugjwnhd.jpg
C:\Users\aETAdzjz\Desktop\AHyV.gif
C:\Users\aETAdzjz\Desktop\CHfCw6OmU8G8iT.jpg
C:\Users\aETAdzjz\Desktop\CxnHb6T3sE6UOsni3FQS.bmp
C:\Users\aETAdzjz\Desktop\D1oAyK3G1TGu.gif
C:\Users\aETAdzjz\Desktop\Gb_F43Mr7o.png
C:\Users\aETAdzjz\Desktop\L9zPPc-Yrgy3.flv
C:\Users\aETAdzjz\Desktop\Ld7Kh.wav
C:\Users\aETAdzjz\Desktop\McduMJNPo.avi
C:\Users\aETAdzjz\Desktop\RkP2X0.bmp
C:\Users\aETAdzjz\Desktop\XE7__nVIHDZVBiwh.doc
C:\Users\aETAdzjz\Desktop\Y8tzWbOK4nv
C:\Users\aETAdzjz\Desktop\Y8tzWbOK4nv\-enYtosxjgDJL24v.swf
C:\Users\aETAdzjz\Desktop\Y8tzWbOK4nv\1JIR6WH.flv
C:\Users\aETAdzjz\Desktop\Y8tzWbOK4nv\2A6bXM9.rtf
C:\Users\aETAdzjz\Desktop\Y8tzWbOK4nv\F9tvnzY y Ws6M.flv
C:\Users\aETAdzjz\Desktop\Y8tzWbOK4nv\KFFJsVbjyjxysr-W.gif
C:\Users\aETAdzjz\Desktop\Y8tzWbOK4nv\NIMuK7.xlsx
C:\Users\aETAdzjz\Desktop\Y8tzWbOK4nv\ptN2ZuQ8amSwzj3Hf.bmp
C:\Users\aETAdzjz\Desktop\Y8tzWbOK4nv\sk2OI4pk.gif
C:\Users\aETAdzjz\Desktop\ZZZQy6dHj8n50KNdV06.mp4
C:\Users\aETAdzjz\Desktop\_q_M.mkv
C:\Users\aETAdzjz\Desktop\bgmOtvTh_exvOety.wav
C:\Users\aETAdzjz\Desktop\biY7nHZrMc.doc
C:\Users\aETAdzjz\Desktop\cL5j2IsQXoG_m811.rtf
C:\Users\aETAdzjz\Desktop\g4SN.xls
C:\Users\aETAdzjz\Desktop\gBd6-4sgl8Sgy5S.gif
C:\Users\aETAdzjz\Desktop\gCHHeDPHfckaHd mlGMq.flv
C:\Users\aETAdzjz\Desktop\gt06Y_qsET.gif
C:\Users\aETAdzjz\Desktop\hKwg8OaHHgS.xlsx
C:\Users\aETAdzjz\Desktop\jfmD.ods
C:\Users\aETAdzjz\Desktop\oJR3TjlT.m4a
C:\Users\aETAdzjz\Desktop\p61-x6Q.ots
C:\Users\aETAdzjz\Desktop\u_7c_imef.gif
C:\Users\aETAdzjz\Desktop\ygyFGqquXH.swf
C:\Users\aETAdzjz\Documents\1Nbjb.csv
C:\Users\aETAdzjz\Documents\2B4wzDIgK8y.docx
C:\Users\aETAdzjz\Documents\3K0zw 5w2qsAHkoes.pptx
C:\Users\aETAdzjz\Documents\4rGyMG.docx
C:\Users\aETAdzjz\Documents\8ZpG.pdf
C:\Users\aETAdzjz\Documents\ANIK59S7NBZeKp.pptx
C:\Users\aETAdzjz\Documents\AqfhNAWOaNpeMnbA.xlsx
C:\Users\aETAdzjz\Documents\Fgu3.rtf
C:\Users\aETAdzjz\Documents\Goqt.pptx
C:\Users\aETAdzjz\Documents\Imdq5H_.pdf
C:\Users\aETAdzjz\Documents\KMr-C2smP.pptx
C:\Users\aETAdzjz\Documents\OQH3M.xlsx
C:\Users\aETAdzjz\Documents\PTsUdLj.xlsx
C:\Users\aETAdzjz\Documents\WBajqFyl.xlsx
C:\Users\aETAdzjz\Documents\XVVo133TnKkCQ.xlsx
C:\Users\aETAdzjz\Documents\XhQD94br1271W
C:\Users\aETAdzjz\Documents\XhQD94br1271W\2_3-k08.xlsx
C:\Users\aETAdzjz\Documents\XhQD94br1271W\56Gkydp.pps
C:\Users\aETAdzjz\Documents\XhQD94br1271W\7C0Fj8t5ztl8.odp
C:\Users\aETAdzjz\Documents\XhQD94br1271W\7I2Otue.odt
C:\Users\aETAdzjz\Documents\XhQD94br1271W\8UJYk.ods
C:\Users\aETAdzjz\Documents\XhQD94br1271W\BF77dVayz84Lz3Pys.odp
C:\Users\aETAdzjz\Documents\XhQD94br1271W\Hof4UNjCwmniuVp7kzhw.csv
C:\Users\aETAdzjz\Documents\XhQD94br1271W\KBQZNG4i7j8.ots
C:\Users\aETAdzjz\Documents\XhQD94br1271W\MfwyTnE4iFa5h9ugGQrN.pdf
C:\Users\aETAdzjz\Documents\XhQD94br1271W\NPKnafg svyW-4p.rtf
C:\Users\aETAdzjz\Documents\XhQD94br1271W\RsHGGmP1G3j3saqYtZFf.pptx
C:\Users\aETAdzjz\Documents\XhQD94br1271W\SjLKY_5Dm-8SOC.xls
C:\Users\aETAdzjz\Documents\XhQD94br1271W\Tlfrf.pdf
C:\Users\aETAdzjz\Documents\XhQD94br1271W\Z3zsui1f6tKO9.odt
C:\Users\aETAdzjz\Documents\XhQD94br1271W\ZtzB50.ods
C:\Users\aETAdzjz\Documents\XhQD94br1271W\aKbv1Oo1ETirSfd1q gy.pdf
C:\Users\aETAdzjz\Documents\XhQD94br1271W\aRTD.ots
C:\Users\aETAdzjz\Documents\XhQD94br1271W\am7J3-.ods
C:\Users\aETAdzjz\Documents\XhQD94br1271W\atEPrko.doc
C:\Users\aETAdzjz\Documents\XhQD94br1271W\cn_0BRgl4hM-kJ8wE.pps
C:\Users\aETAdzjz\Documents\XhQD94br1271W\dwVc1-CZ_s8dDnb6LtW.doc
C:\Users\aETAdzjz\Documents\XhQD94br1271W\ob40zEva5DRKY8OHuTA.pdf
C:\Users\aETAdzjz\Documents\XhQD94br1271W\p0wZEr1Gdg6.xlsx
C:\Users\aETAdzjz\Documents\XhQD94br1271W\wUbOzMUHShGB0.odp
C:\Users\aETAdzjz\Documents\ZdbtJVvb-6FXnFWxnrvN.xlsx
C:\Users\aETAdzjz\Documents\_IJOcqcmeHFr9tYfyh.pptx
C:\Users\aETAdzjz\Documents\c2VYex-ql_WZAAkmz8qA.odp
C:\Users\aETAdzjz\Documents\dQCpeCQAd-tCOwn.docx
C:\Users\aETAdzjz\Documents\lNPXPBJbh2z.docx
C:\Users\aETAdzjz\Documents\mo0DEbXi.xlsx
C:\Users\aETAdzjz\Documents\odSuOiq0XNRIhfz.pptx
C:\Users\aETAdzjz\Documents\q34lq_JbiJsP.doc
C:\Users\aETAdzjz\Documents\qKmq.docx
C:\Users\aETAdzjz\Documents\rPvFAdqEUop.ppt
C:\Users\aETAdzjz\Documents\rw9RSXhngk69iq0H.pptx
C:\Users\aETAdzjz\Documents\t JYhY.ots
C:\Users\aETAdzjz\Documents\x3ae0WPkLee.xlsx
C:\Users\aETAdzjz\Music\-NSSqhnpn.mp3
C:\Users\aETAdzjz\Music\1tmto-B4.wav
C:\Users\aETAdzjz\Music\28zbTbbnrolff0.mp3
C:\Users\aETAdzjz\Music\2LfsLxyu7Ge t_NCsZB.m4a
C:\Users\aETAdzjz\Music\2_RgQ6C4VMAvrepa.mp3
C:\Users\aETAdzjz\Music\2jvLb86r.wav
C:\Users\aETAdzjz\Music\3ADEquEcsjcZ.m4a
C:\Users\aETAdzjz\Music\4ACeM 35QlN_a.mp3
C:\Users\aETAdzjz\Music\4g4W2W_aAO2P8.mp3
C:\Users\aETAdzjz\Music\Ef8YM89Pz.mp3
C:\Users\aETAdzjz\Music\LTQsrkugQfrypV.m4a
C:\Users\aETAdzjz\Music\N3lKZK PSqB.m4a
C:\Users\aETAdzjz\Music\U7G_jJdadOdxPPZgL0.mp3
C:\Users\aETAdzjz\Music\UeTvX_Y3DE.m4a
C:\Users\aETAdzjz\Music\UoP72ZvzzoZ2mbhaSWo.mp3
C:\Users\aETAdzjz\Music\VQnqAv-olw4m4S.mp3
C:\Users\aETAdzjz\Music\VluLl2dzH72aPiyqCL.mp3
C:\Users\aETAdzjz\Music\W1hGaB.m4a
C:\Users\aETAdzjz\Music\briB86U8CaI.wav
C:\Users\aETAdzjz\Music\e5NRqHW09hZ1EbK4n.m4a
C:\Users\aETAdzjz\Music\e9qB7Vwb47c-ic.mp3
C:\Users\aETAdzjz\Music\fM_lLC.mp3
C:\Users\aETAdzjz\Music\hl7cra3Uk7iQYWTw.m4a
C:\Users\aETAdzjz\Music\hqkgcuRC.m4a
C:\Users\aETAdzjz\Music\kWnlhB2wz.m4a
C:\Users\aETAdzjz\Music\vEBG7b4VbFt7wamYQcf.m4a
C:\Users\aETAdzjz\Pictures\4bv6e 0zL
C:\Users\aETAdzjz\Pictures\4bv6e 0zL\ELxtM.gif
C:\Users\aETAdzjz\Pictures\4bv6e 0zL\MVjmbl2VG-kil9l.bmp
C:\Users\aETAdzjz\Pictures\4bv6e 0zL\OZyz34.gif
C:\Users\aETAdzjz\Pictures\4bv6e 0zL\Req5F_foHfyN.bmp
C:\Users\aETAdzjz\Pictures\4bv6e 0zL\bUz0kulIzd.jpg
C:\Users\aETAdzjz\Pictures\4bv6e 0zL\pbyLR8KlH7TIC
C:\Users\aETAdzjz\Pictures\4bv6e 0zL\pbyLR8KlH7TIC\ZqsuflN AEi3v1k.bmp
C:\Users\aETAdzjz\Pictures\4bv6e 0zL\pbyLR8KlH7TIC\_uEHGA5N-.gif
C:\Users\aETAdzjz\Pictures\OkRs5XPatJ-lBBsZ.bmp
C:\Users\aETAdzjz\Pictures\SjMh
C:\Users\aETAdzjz\Pictures\SjMh\1n511.bmp
C:\Users\aETAdzjz\Pictures\SjMh\A3Y6ZiC 6H.gif
C:\Users\aETAdzjz\Pictures\SjMh\K8sS5cZiPNkVmh.jpg
C:\Users\aETAdzjz\Pictures\SjMh\UNj 2EcIBC-S
C:\Users\aETAdzjz\Pictures\SjMh\UNj 2EcIBC-S\MihBgkQ6yu89sgOk.jpg
C:\Users\aETAdzjz\Pictures\SjMh\UNj 2EcIBC-S\cZvpt11ZCV-bnogz
C:\Users\aETAdzjz\Pictures\SjMh\UNj 2EcIBC-S\cZvpt11ZCV-bnogz\7tVJ.bmp
C:\Users\aETAdzjz\Pictures\SjMh\UNj 2EcIBC-S\cZvpt11ZCV-bnogz\BEwDL2lhD.jpg
C:\Users\aETAdzjz\Pictures\SjMh\UNj 2EcIBC-S\cZvpt11ZCV-bnogz\q05zZ.gif
C:\Users\aETAdzjz\Pictures\SjMh\UNj 2EcIBC-S\cZvpt11ZCV-bnogz\xaBuqdV.gif
C:\Users\aETAdzjz\Pictures\SjMh\UNj 2EcIBC-S\oo8ZxMpOJAa2JZ1VYi.gif
C:\Users\aETAdzjz\Pictures\SjMh\UNj 2EcIBC-S\pM2SVtUE.gif
C:\Users\aETAdzjz\Pictures\SjMh\UxNpgcGIbmQ
C:\Users\aETAdzjz\Pictures\SjMh\UxNpgcGIbmQ\E6EbhMwBQFcvigF.png
C:\Users\aETAdzjz\Pictures\SjMh\UxNpgcGIbmQ\O2uYzYjRV1_4DfQj.bmp
C:\Users\aETAdzjz\Pictures\SjMh\UxNpgcGIbmQ\kdQxTUFVVx.bmp
C:\Users\aETAdzjz\Pictures\SjMh\UxNpgcGIbmQ\krVny.jpg
C:\Users\aETAdzjz\Pictures\SjMh\UxNpgcGIbmQ\l1bgOIHxE2P.jpg
C:\Users\aETAdzjz\Pictures\SjMh\UxNpgcGIbmQ\mlAx20rjOPn5Z.bmp
C:\Users\aETAdzjz\Pictures\SjMh\UxNpgcGIbmQ\t_6VwOesN9.gif
C:\Users\aETAdzjz\Pictures\SjMh\UxNpgcGIbmQ\zv2AFyzuzNau.gif
C:\Users\aETAdzjz\Pictures\SjMh\j1z9VOGi PA5X.jpg
C:\Users\aETAdzjz\Pictures\SjMh\pqMkgf CmM
C:\Users\aETAdzjz\Pictures\SjMh\pqMkgf CmM\JQKOZm.jpg
C:\Users\aETAdzjz\Pictures\SjMh\pqMkgf CmM\ofac5F-21ElrB1bmCw4.jpg
C:\Users\aETAdzjz\Pictures\SjMh\pqMkgf CmM\sqp_XIDUP.png
C:\Users\aETAdzjz\Pictures\SjMh\pqMkgf CmM\tba9 8-htsK355Ae3Q.jpg
C:\Users\aETAdzjz\Pictures\SjMh\q1P5U.bmp
C:\Users\aETAdzjz\Pictures\SjMh\xKrI YIsYZAMK3.gif
C:\Users\aETAdzjz\Pictures\nedQWQ4Rzcq.gif
C:\Users\aETAdzjz\Videos\7cs87T6AF.mp4
C:\Users\aETAdzjz\Videos\8JEmUFi9Mlw.flv
C:\Users\aETAdzjz\Videos\DPBFQngyJd3iL.swf
C:\Users\aETAdzjz\Videos\DpBOJ 3gulLwH7.swf
C:\Users\aETAdzjz\Videos\UMKtw0kBXE4kPNCGDpPv.swf
C:\Users\aETAdzjz\Videos\dd3O.mkv
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\2SVXyfZPb.mp4
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\DTP7bDDS-MrFwqpueVgl.swf
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\KpBWj9lp.flv
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\Sa-L8F FOvlYPp_mh.avi
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\U35Aw3DHkP_ua.flv
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\bYEhVOpsx5hHOMxR
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\bYEhVOpsx5hHOMxR\-1PrKyRM QO5HVkwPgg.avi
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\bYEhVOpsx5hHOMxR\3sStWta6v.swf
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\bYEhVOpsx5hHOMxR\9QJv.mp4
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\bYEhVOpsx5hHOMxR\k4sR.mp4
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\bYEhVOpsx5hHOMxR\y8lZCbw.avi
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\cnuuaN6.flv
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\dW6OQzT
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\dW6OQzT\EkzkVW6Q.avi
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\dW6OQzT\FvH7i.mkv
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\dW6OQzT\hki7D3-oWP.swf
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\dW6OQzT\te-NVMLFkE9PBhVr1.swf
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\dW6OQzT\vFMdXpHls-aG1VM2mpz.swf
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\dW6OQzT\vPKaqTW55.mp4
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\dW6OQzT\zDYN.swf
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\etOcWJdo hYXF.swf
C:\Users\aETAdzjz\Videos\hAaKCTy3e NLBRn\s-A fc2HpJDLt.swf
C:\Users\aETAdzjz\Videos\oNeEpnzll.mkv
C:\Users\aETAdzjz\Videos\qCMb0KA7MfMwnqR-.flv
C:\Users\aETAdzjz\Videos\qqiIPehxsG7oP4.mkv
C:\Users\aETAdzjz\Videos\u4W7ouy80phhP-B9lpM.flv
C:\Users\aETAdzjz\Videos\yUidHJTCMwIHB.mkv

Virtual Machine Information

Analyzer Information

System Information

Software Information

Randomly Created Artifacts

Before

After