Sample File: MD5 hash: 1cc146d47918d23cee86a97c77f87918 SHA1 hash: 3d07f8db1010627f1481b5fde714185215971935 SHA256 hash: 5ff8a87fd7626d4beab7a5be7f285f1d1d64478509f27aca6fd9deb3f69155e7 SSDEEP hash: 12288:lUykCSZQeSdPLHNHgdvb0INuK8afD7Gj7qqtisK1yty+79mmUE7evpp:hsQeS9Hpg7ear7GXZgTvmUwup Filename(s): API .doc.rtf Filetype: RTF Document Mutex IOCs: UA9D9D109-343A2EC6-89B2AFB8-7F3B18F0-E80C0038 Registry Key IOCs: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\Monitors HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName HKEY_LOCAL_MACHINE HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Version HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\0a0d020000000000c000000000000046 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\189cba75c69c634996739bac92103ebb HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\1a8bd43e654f65418fbafadeef063a57 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\1cfb96c6c96b454ebff73da2e9f63f51 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\3517490d76624c419a828607e2a54604 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\467888fc50a6c6448d6cc0cf7b5307d6 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\48dea081c9634a43a6861907855add5c HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\55aad8d134512d438564aa678cb92d66 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\71b0295bef58e344911262b243f005ac HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\8503020000000000c000000000000046 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001\Email HKEY_CURRENT_USER HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\Email HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\POP3 Server HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\POP3 User HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\POP3 Port HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\POP3 Password HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\IMAP Server HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\SMTP Server HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\SMTP User HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\SMTP Port HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\SMTP Password HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\Email HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001 HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions\ HKEY_CURRENT_USER\Software\monero-project\monero-core HKEY_CURRENT_USER\Software\monero-project\monero-core\wallet_path HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt\strDataDir HKEY_CURRENT_USER\Software\BitcoinGold\BitcoinGold-Qt HKEY_CURRENT_USER\Software\BitcoinGold\BitcoinGold-Qt\strDataDir HKEY_CURRENT_USER\Software\BitCore\BitCore-Qt HKEY_CURRENT_USER\Software\BitCore\BitCore-Qt\strDataDir HKEY_CURRENT_USER\Software\Litecoin\Litecoin-Qt HKEY_CURRENT_USER\Software\Litecoin\Litecoin-Qt\strDataDir HKEY_CURRENT_USER\Software\BitcoinABC\BitcoinABC-Qt HKEY_CURRENT_USER\Software\BitcoinABC\BitcoinABC-Qt\strDataDir HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Plugin HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Plugin\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Plugin\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE40 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IEData HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 25.0 (x86 en-US) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 25.0 (x86 en-US)\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 25.0 (x86 en-US)\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WIC HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F03217071FF} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F03217071FF}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F03217071FF}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3c3aafc8-d898-43ec-998f-965ffdae065a} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3c3aafc8-d898-43ec-998f-965ffdae065a}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3c3aafc8-d898-43ec-998f-965ffdae065a}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{582EA838-9199-3518-A05C-DB09462F68EC} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{582EA838-9199-3518-A05C-DB09462F68EC}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{582EA838-9199-3518-A05C-DB09462F68EC}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{68306422-7C57-373F-8860-D26CE4BA2A15} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{68306422-7C57-373F-8860-D26CE4BA2A15}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{68306422-7C57-373F-8860-D26CE4BA2A15}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AA0000000001} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{e52a6842-b0ac-476e-b48f-378a97a67346} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{e52a6842-b0ac-476e-b48f-378a97a67346}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{e52a6842-b0ac-476e-b48f-378a97a67346}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{e6e75766-da0f-4ba2-9788-6ea593ce702d} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{f325f05b-f963-4640-a43b-c8a494cdda0f} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{f325f05b-f963-4640-a43b-c8a494cdda0f}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{f325f05b-f963-4640-a43b-c8a494cdda0f}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}\DisplayVersion HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayVersion HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun HKEY_CURRENT_USER\Software\Microsoft\Command Processor HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Domain IOCs: kalpvedafoundation.com onedrive.live.com tarot-sunce.com IP IOCs: 178.218.167.4 13.107.42.13 192.185.76.89 URL IOCs: http://kalpvedafoundation.com/amour/linkder.exe http://kalpvedafoundation.com/amour/linkder.exe http://onedrive.live.com/download?cid=4C3F5C65A99DA195&resid=4C3F5C65A99DA195%21241&authkey=AGyBKeKMs6qKShY tarot-sunce.com/linko/PL341/index.php File IOCs: Filenames: C:\Users\aETAdzjz\Documents\Nu56E.docx C:\Users\aETAdzjz\AppData\Roaming\\FeDQmW2i.flv\electrum.dat C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-datetime-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\Moonchild Productions\Pale Moon\Profiles\\logins.json C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@casalemedia[2].txt C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@pixel.rubiconproject[1].txt C:\Users\aETAdzjz\AppData\Local\Amigo\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\360Browser\Browser\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\.\Web Data C:\Users\aETAdzjz\AppData\Local\Vivaldi\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@google[2].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\EVWhitelist\Login Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\PepperFlash\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-file-l2-1-0.dll C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-multibyte-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\Default\Login Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\First Run\Login Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@api.bing[2].txt C:\Users\aETAdzjz\AppData\Roaming\Thunderbird\Profiles\\logins.json C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\SwReporter\Web Data C:\Users\aETAdzjz\AppData\Roaming\\.\wallets\.wallet C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@bs.serving-sys[1].txt C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@dpm.demdex[1].txt C:\Users\aETAdzjz\Documents\My Shapes C:\Users\aETAdzjz\AppData\Local\Elements Browser\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\8pecxstudios\Cyberfox\Profiles\\\formhistory.sqlite C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\\.\formhistory.sqlite C:\Users\aETAdzjz\AppData\Local\CocCoc\Browser\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\\Identities\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Temp\2035036576518928862638.tmp C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-locale-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\fghvhghvgfdgfhchfg.exe\.wallet C:\Users\aETAdzjz\AppData\Roaming\\eDL9vRODWdK0.avi\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\GU1xEN.png\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\CertificateTransparency\Login Data C:\Users\aETAdzjz\AppData\Local\Temp\182029721896254689506701.tmp C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@msn[2].txt C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-process-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Temp\182031289079242754423543.tmp-journal C:\Users\aETAdzjz\AppData\Local\360Browser\Browser\User Data\\\Web Data C:\Users\aETAdzjz\Documents\Outlook Files C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\Crashpad\Login Data C:\Users\aETAdzjz\AppData\Roaming\\hhMbey-61drTCHdugi.m4a\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\Superbird\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\.\Login Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@ad.360yield[2].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome SxS\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\\GU1xEN.png\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\LYycmo-cjNTfWau.pdf\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Local\Temp\182033787308292230589271.tmp C:\Users\aETAdzjz\Desktop\~$I .doc.rtf C:\Users\aETAdzjz\AppData\Roaming\\LJc6a5Q_MmBs.swf\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Chedot\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\\GU1xEN.png\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\Waterfox\Profiles\\\formhistory.sqlite C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-heap-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\uCozMedia\Uran\User Data\\\Cookies C:\Users\aETAdzjz\Documents\z8Q_yDu1jaODNbm6Rg\uhxF0nw\3wiKno2U6 C:\Users\aETAdzjz\AppData\Local\Google\Chrome SxS\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\\FeDQmW2i.flv\.wallet C:\Users\aETAdzjz\AppData\Local\Temp\182031289079242754423543.tmp C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-file-l1-2-0.dll C:\Users\aETAdzjz\AppData\Local\Suhba\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\FileTypePolicies\Login Data C:\Users\aETAdzjz\AppData\Roaming\\Macromedia\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@rubiconproject[1].txt C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\ C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\Local State\Cookies C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@demdex[1].txt C:\Users\aETAdzjz\Documents\My Shapes\_private C:\Users\aETAdzjz\AppData\Roaming\\LJc6a5Q_MmBs.swf\wallet.dat C:\Users\aETAdzjz\AppData\Local\Go!\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\brave\\\Login Data C:\Users\aETAdzjz\AppData\Local\Go!\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@mathtag[2].txt C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-time-l1-1-0.dll C:\Windows\SysWOW64\timeout.exe C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@m.exactag[2].txt C:\Users\aETAdzjz\AppData\Local\Sputnik\Sputnik\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\EVWhitelist\Cookies C:\Users\aETAdzjz\AppData\Local\Epic Privacy Browser\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\Local State\Login Data C:\Users\aETAdzjz\AppData\Local\Vivaldi\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\\.\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\LYycmo-cjNTfWau.pdf\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\..\logins.json C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@crwdcntrl[1].txt C:\Users\aETAdzjz\AppData\Local\Temp\182028482867542631482656.tmp-journal C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-profile-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Nichrome\User Data\\\Cookies C:\Users\aETAdzjz\Desktop\P0Hc9z_vVr1Uxdn12a\0K3ML.docx C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@c.bing[1].txt C:\Users\aETAdzjz\AppData\Roaming\\kSQ8d9iRcfRWCQRh.gif\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-processenvironment-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@bing[1].txt C:\Users\aETAdzjz\AppData\Roaming\\kSQ8d9iRcfRWCQRh.gif\wallet.dat C:\Users\aETAdzjz\AppData\Local\Safer Technologies\Secure Browser\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-stdio-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Superbird\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\First Run\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-filesystem-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\SwReporter\Cookies C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@ih.adscale[1].txt C:\Users\aETAdzjz\AppData\Roaming\\Macromedia\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-handle-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Xpom\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\pnacl\Web Data C:\Users\aETAdzjz\Documents\tXrvgvZhuK.docx C:\Users\aETAdzjz\AppData\Roaming\\Adobe\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\iY Y.mp3\wallets\wallet.dat Equation3_1 C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-libraryloader-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@bs.serving-sys[3].txt d6dcb74ede20ce104e6cf1b52dd5551105feaf027401ef34d7ca5a5d3333fa95 C:\Users\aETAdzjz\AppData\Local\Comodo\Dragon\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\h7DVpNm6QA.png\.wallet C:\Users\aETAdzjz\Documents\imR3uKJ.xlsx C:\Users\aETAdzjz\AppData\Local\Temp\curbuf.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@c.msn[2].txt C:\Users\aETAdzjz\AppData\Local\Temp\182004765502204915563913.tmp-wal C:\Users\aETAdzjz\AppData\Local\Epic Privacy Browser\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\RockMelt\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Comodo\Dragon\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Orbitum\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-debug-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\INetCookies\\ C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\\..\formhistory.sqlite C:\Users\aETAdzjz\AppData\Roaming\\fghvhghvgfdgfhchfg.exe\electrum.dat C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\OriginTrials\Web Data C:\Users\aETAdzjz\AppData\Roaming\Moonchild Productions\Pale Moon\Profiles\\\formhistory.sqlite C:\Users\aETAdzjz\AppData\Local\Comodo\Dragon\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\FileTypePolicies\Cookies C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\\3y2joh8o.default\formhistory.sqlite C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/msvcp140.dll C:\Windows\SysWOW64\cmd.exe C:\Users\aETAdzjz\AppData\Local\QIP Surf\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\Comodo\IceDragon\Profiles\\\cookies.sqlite C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\\aetadzjz@live[2].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\SwReporter\Login Data C:\Users\aETAdzjz\AppData\Local\Temp\182032848139586271779370.tmp-journal C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-runtime-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Temp\182029721896254689506701.tmp-journal C:\Users\aETAdzjz\AppData\Roaming\\LJc6a5Q_MmBs.swf\.wallet C:\Users\aETAdzjz\Documents\z8Q_yDu1jaODNbm6Rg\uhxF0nw\8O4HGEn56P C:\Users\aETAdzjz\AppData\Roaming\\Mg5zkU.png\.wallet C:\Users\aETAdzjz\AppData\Local\Elements Browser\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\RockMelt\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/softokn3.dll C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\EVWhitelist\Web Data C:\Users\aETAdzjz\AppData\Roaming\\bMn7rPCuez.xls\wallets\.wallet C:\Users\aETAdzjz\AppData\Roaming\\iY Y.mp3\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\TorBro\Profile\\\Cookies C:\Users\aETAdzjz\Documents\z8Q_yDu1jaODNbm6Rg\uhxF0nw C:\Users\aETAdzjz\AppData\Roaming\\bMn7rPCuez.xls\.wallet C:\Users\aETAdzjz\AppData\Local\CentBrowser\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Suhba\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\Waterfox\Profiles\\logins.json C:\Users\aETAdzjz\AppData\Roaming\Opera Software\\\Web Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\pnacl\Cookies C:\Users\aETAdzjz\AppData\Roaming\\kSQ8d9iRcfRWCQRh.gif\wallets\wallet.dat C:\Users\aETAdzjz\Documents\_Lw_Ioi_qC44f0vdNG\jNZkgQds.doc C:\Users\aETAdzjz\AppData\Local\Xpom\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-private-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\SSLErrorAssistant\Web Data C:\Users\aETAdzjz\AppData\Roaming\\..\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\bMn7rPCuez.xls\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\OriginTrials\Cookies C:\Users\aETAdzjz\AppData\Roaming\\hhMbey-61drTCHdugi.m4a\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\..\wallets\.wallet C:\Users\aETAdzjz\AppData\Roaming\\LYycmo-cjNTfWau.pdf\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Xpom\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Yandex\YandexBrowser\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\182032848139586271779370.tmp C:\Users\aETAdzjz\AppData\Local\Temp\182028482867542631482656.tmp C:\Users\aETAdzjz\AppData\Roaming\\LYycmo-cjNTfWau.pdf\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\WidevineCdm\Login Data C:\Users\aETAdzjz\Documents\fqs7LNS.xlsx C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-heap-l1-1-0.dll C:\Program Files\Qemu-ga\qemu-ga.exe C:\Users\aETAdzjz\AppData\Local\TorBro\Profile\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\\3y2joh8o.default\cookies.sqlite C:\Users\aETAdzjz\AppData\Roaming\\..\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@adnxs[2].txt C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@eyeota[1].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\OriginTrials\Login Data C:\Users\aETAdzjz\AppData\Roaming\\.\wallet.dat C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\CrashpadMetrics-active.pma\Login Data C:\Users\aETAdzjz\AppData\Local\Chromium\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@doubleclick[2].txt C:\Users\aETAdzjz\AppData\Local\Bromium\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\CocCoc\Browser\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Suhba\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\pnacl\Login Data C:\Users\aETAdzjz\AppData\Local\Temp\182028482867542631482656.tmp-wal C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@ibeu2.mookie1[2].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\Crashpad\Cookies C:\Users\aETAdzjz\AppData\Roaming\\foOZ1HtoS4PjQ8Udex.avi\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\FeDQmW2i.flv\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Local\Orbitum\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-synch-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\LJc6a5Q_MmBs.swf\electrum.dat 1932d8c415f078ca690f84b2a7ec372d03ff32beb804629619fe3775e7850099 C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\FileTypePolicies\Web Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@addthis[2].txt C:\Users\aETAdzjz\AppData\Roaming\\h7DVpNm6QA.png\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\PepperFlash\Login Data C:\Users\aETAdzjz\AppData\Local\Yandex\YandexBrowser\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\hhMbey-61drTCHdugi.m4a\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\Identities\.wallet C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-namedpipe-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@linkedin[2].txt C:\Users\aETAdzjz\AppData\Local\Temp\182031918183732679381489.tmp-wal C:\Users\aETAdzjz\AppData\Roaming\\.\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\Mg5zkU.png\wallets\electrum.dat \??\C:\Windows\syswow64\msvbvm60.dll C:\Users\aETAdzjz\AppData\Roaming\Comodo\IceDragon\Profiles\\\formhistory.sqlite C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@pubmatic[2].txt C:\Users\aETAdzjz\Documents\z8Q_yDu1jaODNbm6Rg\-B8VZiXAJgeyuxM1J9Dr.docx C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/vcruntime140.dll C:\Users\aETAdzjz\AppData\Roaming\\eDL9vRODWdK0.avi\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Local\Rafotech\Mustang\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-convert-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\.\logins.json C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@www.bing[1].txt C:\Users\aETAdzjz\AppData\Roaming\\h7DVpNm6QA.png\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-string-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@adtech[2].txt C:\Users\aETAdzjz\AppData\Roaming\\eDL9vRODWdK0.avi\wallet.dat bb7c277a1ea7a3bb3882861f8571185ee64edbf10e837b2010361380139f5444 C:\Users\aETAdzjz\AppData\Local\Amigo\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\bMn7rPCuez.xls\wallet.dat C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-processthreads-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\8pecxstudios\Cyberfox\Profiles\\logins.json C:\Program Files\qga\qga.exe C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-file-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\QIP Surf\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@adformdsp[2].txt C:\Users\aETAdzjz\AppData\Local\Go!\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\182032848139586271779370.tmp-wal C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-math-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\..\.wallet C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\SSLErrorAssistant\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-rtlsupport-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Orbitum\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@bluekai[1].txt C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-util-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\iY Y.mp3\.wallet C:\Users\aETAdzjz\AppData\Local\7Star\7Star\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\SSLErrorAssistant\Login Data C:\Users\aETAdzjz\AppData\Roaming\\iY Y.mp3\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@advertising[1].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\Crashpad\Web Data C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-environment-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\..\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Local\uCozMedia\Uran\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Temp\182029721896254689506701.tmp-shm C:\Users\aETAdzjz\AppData\Local\Temp\182029721896254689506701.tmp-wal C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@adscale[1].txt C:\Users\aETAdzjz\AppData\Roaming\\kSQ8d9iRcfRWCQRh.gif\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\Torch\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-timezone-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Bromium\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\hhMbey-61drTCHdugi.m4a\.wallet C:\Users\aETAdzjz\AppData\Roaming\\fghvhghvgfdgfhchfg.exe\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@openx[1].txt C:\Users\aETAdzjz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\\ C:\Users\aETAdzjz\AppData\Roaming\fghvhghvgfdgfhchfg.exe C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@adform[2].txt C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\\aetadzjz@g.live[1].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\..\Cookies C:\Users\aETAdzjz\AppData\Local\CentBrowser\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\\Macromedia\electrum.dat C:\Users\aETAdzjz\AppData\Local\Sputnik\Sputnik\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\3y2joh8o.default\logins.json C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-utility-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\INetCache\\ C:\Users\aETAdzjz\AppData\Roaming\\LJc6a5Q_MmBs.swf\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\Temp\2035036576518928862638.tmp-journal C:\Users\aETAdzjz\AppData\Roaming\\h7DVpNm6QA.png\electrum.dat C:\Users\aETAdzjz\AppData\Local\Safer Technologies\Secure Browser\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-synch-l1-2-0.dll C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@microsoft[1].txt C:\Users\aETAdzjz\AppData\Local\Nichrome\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\\Identities\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\\.\cookies.sqlite C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\CrashpadMetrics-active.pma\Cookies C:\Users\aETAdzjz\AppData\Roaming\\hhMbey-61drTCHdugi.m4a\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\filezilla\recentservers.xml C:\Users\aETAdzjz\AppData\Local\Kometa\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\iY Y.mp3\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-interlocked-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\eDL9vRODWdK0.avi\.wallet C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\CertificateTransparency\Web Data C:\Users\aETAdzjz\AppData\Roaming\brave\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@c1.microsoft[2].txt C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@serving.experianmarketingservices[1].txt C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@angsrvr[2].txt C:\Users\aETAdzjz\AppData\Roaming\\Adobe\wallets\.wallet C:\Users\aETAdzjz\AppData\Roaming\\Identities\wallet.dat C:\Users\aETAdzjz\Documents\OneNote Notebooks C:\Users\aETAdzjz\AppData\Roaming\Waterfox\Profiles\\\cookies.sqlite C:\Users\aETAdzjz\AppData\Roaming\\Mg5zkU.png\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\Opera Software\\\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\182031289079242754423543.tmp-wal C:\Users\aETAdzjz\AppData\Local\Elements Browser\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\\foOZ1HtoS4PjQ8Udex.avi\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\\..\cookies.sqlite C:\Users\aETAdzjz\AppData\Local\Rafotech\Mustang\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@turn[1].txt C:\Users\aETAdzjz\AppData\Roaming\\.\.wallet C:\Users\aETAdzjz\AppData\Local\Bromium\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@w55c[2].txt C:\Users\aETAdzjz\AppData\Local\Chromium\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\Comodo\IceDragon\Profiles\\logins.json C:\Users\aETAdzjz\AppData\Roaming\\LJc6a5Q_MmBs.swf\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\foOZ1HtoS4PjQ8Udex.avi\.wallet C:\Users\aETAdzjz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\Cookies\\ C:\Users\aETAdzjz\AppData\Roaming\8pecxstudios\Cyberfox\Profiles\\\cookies.sqlite C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\WidevineCdm\Cookies C:\Users\aETAdzjz\AppData\Roaming\\Adobe\electrum.dat C:\Users\aETAdzjz\AppData\Local\Superbird\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Torch\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\\Macromedia\.wallet C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@ad13.adfarm1.adition[2].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\CertificateTransparency\Cookies C:\Users\aETAdzjz\AppData\Local\QIP Surf\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\kSQ8d9iRcfRWCQRh.gif\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\FeDQmW2i.flv\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\Identities\wallets\.wallet C:\Users\aETAdzjz\AppData\Roaming\\.\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\kSQ8d9iRcfRWCQRh.gif\.wallet C:\Users\aETAdzjz\AppData\Roaming\\eDL9vRODWdK0.avi\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\Rafotech\Mustang\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@adfarm1.adition[2].txt C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@tapad[2].txt C:\Users\aETAdzjz\AppData\Local\Chedot\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/nss3.dll C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\WidevineCdm\Web Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@www.msn[2].txt C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@adsrvr[1].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\First Run\Web Data C:\Users\aETAdzjz\AppData\Roaming\Moonchild Productions\Pale Moon\Profiles\\\cookies.sqlite C:\Users\aETAdzjz\AppData\Local\Amigo\User Data\\\Web Data C:\Windows\system32\MSVBVM60.DLL C:\Users\aETAdzjz\AppData\Roaming\\hhMbey-61drTCHdugi.m4a\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Local\Chedot\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Kometa\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-processthreads-l1-1-1.dll C:\Users\aETAdzjz\AppData\Roaming\\GU1xEN.png\wallet.dat C:\Users\aETAdzjz\AppData\Local\7Star\7Star\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-string-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\.purple\accounts.xml C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/ucrtbase.dll db997093559061c627f0580b0046fbc6c93be52f6bb3056c17688ab60ea3e729 C:\Users\aETAdzjz\AppData\Roaming\\..\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\brave\\\Web Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\Default\Cookies C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\CrashpadMetrics-active.pma\Web Data C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/freebl3.dll C:\Users\aETAdzjz\AppData\Roaming\\bMn7rPCuez.xls\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@at.atwola[2].txt C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@track.adform[2].txt C:\Users\aETAdzjz\AppData\Roaming\\foOZ1HtoS4PjQ8Udex.avi\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cookies\\ C:\Users\aETAdzjz\AppData\Local\Temp\182031918183732679381489.tmp-journal C:\Users\aETAdzjz\AppData\Local\7Star\7Star\User Data\\\Cookies C:\Users\aETAdzjz\Desktop\API .doc.rtf C:\Users\aETAdzjz\AppData\Local\Chromium\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Vivaldi\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\Local State\Web Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\.\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\182004765502204915563913.tmp-journal C:\Users\aETAdzjz\AppData\Roaming\Opera Software\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\fghvhghvgfdgfhchfg.exe\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\Temp\182033787308292230589271.tmp-wal C:\Users\aETAdzjz\AppData\Local\Temp\182004765502204915563913.tmp C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@adserving.ancoraplatform[2].txt C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@smartadserver[1].txt C:\Users\aETAdzjz\AppData\Roaming\\GU1xEN.png\.wallet C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-errorhandling-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\Mg5zkU.png\wallets\.wallet C:\Users\aETAdzjz\AppData\Roaming\\eDL9vRODWdK0.avi\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\iY Y.mp3\wallet.dat C:\Users\aETAdzjz\AppData\Local\Safer Technologies\Secure Browser\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@scorecardresearch[2].txt C:\Users\aETAdzjz\AppData\Roaming\\Macromedia\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\Adobe\wallet.dat C:\Users\aETAdzjz\Documents\z8Q_yDu1jaODNbm6Rg C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-sysinfo-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Torch\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Sputnik\Sputnik\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@server.adformdsp[2].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\..\Login Data C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-console-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\LYycmo-cjNTfWau.pdf\.wallet C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-conio-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\fghvhghvgfdgfhchfg.exe\wallet.dat C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\PepperFlash\Web Data C:\Users\aETAdzjz\AppData\Roaming\\Mg5zkU.png\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\LYycmo-cjNTfWau.pdf\electrum.dat C:\Users\aETAdzjz\AppData\Local\uCozMedia\Uran\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\FeDQmW2i.flv\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-localization-l1-2-0.dll C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-memory-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\\aetadzjz@google[1].txt C:\Users\aETAdzjz\AppData\Roaming\\FeDQmW2i.flv\wallet.dat C:\Users\aETAdzjz\AppData\Local\360Browser\Browser\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\\h7DVpNm6QA.png\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\RockMelt\User Data\\\Cookies C:\Users\aETAdzjz\Documents\_Lw_Ioi_qC44f0vdNG C:\Users\aETAdzjz\Desktop\P0Hc9z_vVr1Uxdn12a C:\Users\aETAdzjz\AppData\Roaming\\Mg5zkU.png\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\bMn7rPCuez.xls\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\Adobe\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\Identities\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@bidswitch[1].txt C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@semasio[1].txt C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@connextra[2].txt C:\Users\aETAdzjz\AppData\Local\Nichrome\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@www.linkedin[1].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\..\Web Data C:\Users\aETAdzjz\AppData\Local\TorBro\Profile\\\Web Data C:\Users\aETAdzjz\AppData\Local\Temp\182033787308292230589271.tmp-journal C:\Users\aETAdzjz\AppData\Local\Kometa\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/mozglue.dll C:\Users\aETAdzjz\AppData\Roaming\\foOZ1HtoS4PjQ8Udex.avi\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\Macromedia\wallets\.wallet C:\Users\aETAdzjz\AppData\Roaming\\foOZ1HtoS4PjQ8Udex.avi\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Local\Epic Privacy Browser\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@exelator[1].txt C:\Users\aETAdzjz\AppData\Local\Yandex\YandexBrowser\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\\fghvhghvgfdgfhchfg.exe\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\GU1xEN.png\wallets\.wallet C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@serving-sys[2].txt C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/nssdbm3.dll C:\Users\aETAdzjz\AppData\Roaming C:\Users\aETAdzjz\AppData\Local\Google\Chrome SxS\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\h7DVpNm6QA.png\wallet.dat MD5 hashes: 6db54065b33861967b491dd1c8fd8595 88ff191fd8648099592ed28ee6c442a5 4a755de35d5f03cd209e9f5725fe92b5 f167061aa11d4d88bce348a7704db935 19a40af040bd7add901aa967600259d9 4217fd1f9c0d91c9d57cc6767f58c0b5 b8f205f9f2dbf68c60dcfc3df3e9053d aec2268601470050e62cb8066dd41a59 ac290dad7cb4ca2d93516580452eda1c 109f0f02fd37c84bfc7508d4227d7ed5 e2f648ae40d234a3892e1455b4dbbe05 849f2c3ebf1fcba33d16153692d5810f 9910a1bfdc41c5b39f6af37f0a22aacd fefb98394cb9ef4368da798deab00e21 6ea692f862bdeb446e649e4b2893e36f d0873e21721d04e20b6ffb038accf2f1 0755beab2e195850485c6aa4fd79870a a2f2258c32e3ba9abf9e9e38ef7da8c9 6389834774166f7a20359003254939f2 1d0658e804791ee90258526373d8e5c4 8e99b89611a54ea10706d3abcabf3b99 86a42d3b113836c1c1479970288f1b11 babf80608fd68a09656871ec8597296c d500d9e24f33933956df0e26f087fd91 0f079489abd2b16751ceb7447512a70d 71af7ed2a72267aaad8564524903cff6 94ae25c7a5497ca0be6882a00644ca64 8b0ba750e7b15300482ce6c961a932f0 0de20195a34bb53aeec70f622a926f6d 7587bf9cb4147022cd5681b015183046 556ea09421a0f74d31c4c0a89a70dc23 7c342898a34f5fc5ce6dd147f5492427 6d778e83f74a4c7fe4c077dc279f6867 fdba0db0a1652d86cd471eaa509e56ea eff11130bfe0d9c90c0026bf2fb219ae a031e9d545551a24e4c77344f84539d4 0fc9ece6a952fb99876dc1c0ed720b24 569a7a65658a46f9412bdfa04f86e2b2 a2d7d7711f9c0e3e065b2929ff342666 60b900594c282fd33198488327e5fa32 6f6796d1278670cce6e2d85199623e27 35fc66bd813d0f126883e695664e7b83 d41d8cd98f00b204e9800998ecf8427e 41a348f9bedc8681fb30fa78e45edb24 cb978304b79ef53962408c611dfb20f5 1cc146d47918d23cee86a97c77f87918 d6326267ae77655f312d2287903db4d3 d97a1cb141c6806f0101a5ed2673a63d 72e28c902cd947f9a3425b19ac5a64bd 404604cd100a1e60dfdaf6ecf5ba14c0 b7c14ec6110fa820ca6b65f5aec85911 502263c56f931df8440d7fd2fa7b7c00 2ea3901d7b50bf6071ec8732371b821c 0d1aa99ed8069ba73cfd74b0fddc7b3a fee0926aa1bf00f2bec9da5db7b2de56 d0289835d97d103bad0dd7b9637538a1 9e682f1eb98a9d41468fc3e50f907635 343aa83574577727aabe537dccfdeafc 93d3da06bf894f4fa21007bee06b5e7d e479444bdd4ae4577fd32314a68f5d28 67827db2380b5848166a411bae9f0632 b52a0ca52c9c207874639b62b6082242 5f73a814936c8e7e4a2dfd68876143c8 8d02dd4c29bd490e672d271700511371 12cc7d8017023ef04ebdd28ef9558305 SHA1 hashes: 3197cb45787d47bac80223e3e98851e48a122efa f3035a756e2e963764912c6b432e74615ae07011 da39a3ee5e6b4b0d3255bfef95601890afd80709 f7ac28bbc47e46485025a51eeb6c304b70cee215 eca42f7754fb0017e86d50d507674981f80bc0b9 99ef5a5fac0807bce8a5164d0c2e4dca012b0fcc cf4c89a6e46090d3d8feeb9eb697aea8a26e4088 44cc0038e891ae73c43b61a71a46c97f98b1030d 679dd712ed1c46fbd9bc8615598da585d94d5d87 08ad49071afdb4c2b095c6bcb07336ab2f267387 1581961d4cf6f304fbe88233d7017f9e71b6b4e4 f5a4eb3d8ac8fb68af716857629a43cd6be63473 d31a84c1499a9128a8f0efea4230fcfa6c9579be 8ceebe1e9abb0044808122557de8aab28ad14575 f859a66009d1caae88bf36b569b63e1fbdae9493 05b6322979b0b67526ae5cd6e820596cbe7393e4 84fceae03d28ff1907048acee7eae7e45baaf2bd 9ce3b9a182429c0dba9821e2e72d3ab46f5d0a06 f739ba9b548ee64b13eb434a3130406d23f836e3 5ed7e68d094e2a41fca037f9ec12698213c49976 3d07f8db1010627f1481b5fde714185215971935 ed0938bbc0e2a863859aad64606b8fc4c69b810a 681bf1e0ca4394c89d68d2b5ad1f75f4e54e04b1 f5d9cf848f79a57f690da9841c209b4837c2e6c3 f2106306a8f6f0da5afb7fc765cfa0757ad5a628 5806e2ac52fe48573dca9b2ac8e4504d7d781b6e 8aa2155c3d3d5aa23f56cd0bc507255fc953ccc3 7b996a476a9f7fe763ab19c39d3dc318966d18b8 316d86926b558c9f3f6133739c1a8477b9e60740 9e39e505d80d67b347b19a349a1532746c1f7f88 d9d750e828b629cfb7b402a3442947545d8d781b ba1f5384072df8af5743f81fd02c98773b5ed147 1268bef8e2ca6ebc5fb974fdfaff13be5ba7574f 2fd63c18cc5dc4defc7ea82f421050e668f68548 91f3008494f3a842a5b59319c5a75e15ff6c405e e7be926f0f7d842271f7edc7a4989544f4477da7 6c537678ab6cfd6f3ea0dc0f5abefd1c4924f0c0 6f6d35a033e466749b8fd1574d7827a91faaa82c 3814214b06d827b877a6a23944f53720d3682ecd 47fa76778556f34a5e7910c816c78835109e4050 77edf9509a252e886d4da388bf9c9294d95498eb 58469835ab4b916927b3cabf54aee4f380ff6748 363ed259905442c4e3b89901bfd8a43b96bf25e4 608eeb7488042453c9ca40f7e1398fc1a270f3f4 eed8a788db31c39463e24e1f0197f366700fafca 8a8437123de5a22ab843adc24a01ac06f48db0d3 ef7420141bb15ac334d3964082361a460bfdb975 116846ca871114b7c54148ab2d968f364da6142f fa949453557d0049d723f9615e4f390010520eda f68f1096c5a3f7b90824aa0f7b9da372228363ff f02975c3c5d386975ad1e662f094b7cc077a73cf 66e76c0574a549f293323dd6f863a8a5b54f3f9b 523a3d7c3f4491e67fc710575d8e23314db2c1a2 6fb845d6a82102ff74bd35f42a2844d8c450413b 33952578924b0376ca4ae6a10b8d4ed749d10688 1f8eda52d31512ebfdd546be60990b95c8e28bfb d960016c4f553e461afb5b06b039a15d2e76135e 71a2f5d76d23e48cef8f258eaad63e586cfc0e19 6a4f818b53606a5602c609ec343974c2103bc9cc 85e0ceca36f657ddf6547aa0744f0855a27527ee db8b3fd502f0953c7a28e71b75e8c06a460a7449 4dfa181dde8c5ba010cb2a0d6d8a74a835a1ddd7 1e47230a7ebcfaf643087a1929a385e0d554ad15 9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7 a17b1f36e73b82ef9bfb831058f187535a550eb8 SHA256 hashes: fe117e2f56177afe116cd747fe1df06d60f4ab5e324530f8fbdcecb826e63e1c 91eeb842973495deb98cef0377240d2f9c3d370ac4cf513fd215857e9f265a6a c8c499b012d0d63b7afc8b4ca42d6d996b2fcf2e8b5f94cacfbec9e6f33e8a03 8eb5270fa99069709c846db38be743a1a80a42aa1a88776131f79e1d07cc411c 30d99ce1d732f6c9cf82671e1d9088aa94e720382066b79175e2d16778a3dad1 c310cc91464c9431ab0902a561af947fa5c973925ff70482d3de017ed3f73b7d 44f6df4280c8ecc9c6e609b1a4bfee041332d337d84679cfe0d6678ce8f2998a 73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c 90fae0e7c3644a6754833c42b0ac39b6f23859f9a7cf4b6c8624820f59b9dad3 c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d 5ff8a87fd7626d4beab7a5be7f285f1d1d64478509f27aca6fd9deb3f69155e7 c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed 7670fdede524a485c13b11a7c878015e9b0d441b7d8eb15ca675ad6b9c9a7311 58f82370f5b62c631e96b51171d2264c4c759be04bb111ab29f26c6d96e08952 f0e6210d4a0d48c7908d8d1c270449c91eb4523e312a61256833bfeaf699abfb 3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 b00114acc920b170147d1a11b5272f210fd1bb8033ee0c7a072680508d1ee305 03ad57c24ff2cf895b5f533f0ecbd10266fd8634c6b9053cc9cb33b814ad5d97 bb25ccf8694d1fcfce85a7159dcf6985fdb54728d29b021cb3d14242f65909ce c4f60f911068ab6d7f578d449ba7b5b9969f08fc683fd0ce8e2705bbf061f507 945cc64ee04b1964c1f9fcdc3124dd83973d332f5cfb696cdf128ca5c4cbd0e5 4b704b36e1672ae02e697efd1bf46f11b42d776550ba34a90cd189f6c5c61f92 5dd4ccd63e6ed07ca3987ab5634ca4207d69c47c2544dfefc41935617652820f f7d450a0f59151bcefb98d20fcae35f76029df57138002db5651d1b6a33adc86 0bb8c77de80acf9c43de59a8fd75e611cc3eb8200c69f11e94389e8af2ceb7a9 deccd75fc3fc2bb31338b6fe26deffbd7914c6cd6a907e76fd4931b7d141718c 96898930ffb338da45497be019ae1adcd63c5851141169d3023e53ce4c7a483e 9a7f11c212d61856dfc494de111911b7a6d9d5e9795b0b70bbbc998896f068ae c2b933557ca7812205a57a0f724cdb464e7b06cbbb77a657fb337c0307e888c8 393ae7f06fe6cd19ea6d57a93dd0acd839ee39ba386cf1ca774c4c59a3bfebd8 2257fea1e71f7058439b3727ed68ef048bd91dcacd64762eb5c64a9d49df0b57 65ded8d2ce159b2f5569f55b2caf0e2c90f3694bd88c89de790a15a49d8386b9 1932d8c415f078ca690f84b2a7ec372d03ff32beb804629619fe3775e7850099 aecd0296f38fa691e15177c5fe550172c938c61036a910bf05e8f71faa2b442d 7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2 a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0 541a293c450e609810279f121a5e9dfa4e924d52e8b0c6c543512b5026efe7ec 94a5df1227818edbfd0d5091c6a48f86b4117c38550343f780c604eee1cd6231 c85dc081b1964b77d289aac43cc64746e7b141d036f248a731601eb98f827719 c20353043062ed74b77a57e471bf4293b7e57b9b51942a2616c25dc16a9e7e20 2cade4fc6b55395aa4bc691c03755e609bdb1b25b82750d2046929b6d39ca251 b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7 5be8fbb1985582aa220e9bb5d8781c4e3c21206e31cff7f911cdb2fbbed1acb9 bb7c277a1ea7a3bb3882861f8571185ee64edbf10e837b2010361380139f5444 565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33 66abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735 c03124ba691b187917ba79078c66e12cbf5387a3741203070ba23980aa471e8b 9dab884071b1f7d7a167f9bec94ba2bee875e3365603fa29b31de286c6a97a1d 24c9aa0b70e557a49dac159c825a013a71a190df5e7a837bfa047a06bba59eca 7ea06b7050f9ea2bcc12af34374bdf1173646d4e5ebf66ad690b37f4df5f3d4e e000b0cae7df0753ea12d97175e393bacf905613eef1a59d7e1784a913993f58 a97dcca76cdb12e985dff71040815f28508c655ab2b073512e386dd63f4da325 bb33a9e906a5863043753c44f6f8165afe4d5edb7e55efa4c7e6e1ed90778eca 9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4 69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d d6dcb74ede20ce104e6cf1b52dd5551105feaf027401ef34d7ca5a5d3333fa95 db997093559061c627f0580b0046fbc6c93be52f6bb3056c17688ab60ea3e729 c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382 23b1cf9e40b9ba27ec7eb7cd01b4609e4418aba063275fb2a0aebcf28f8f8620 830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d SSDEEP hashes: 1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj 192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP 192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs 96:GKuNQIoYnMvqyWx7pnqH+w/fVIrECuKdPraBdUDBBVWqwmKT/WTPepeWbtxY:tJkMvuzzTP6bt 3072:55B4b9jFsfD22PXsE7TxKRGvgkKkGAkVzM5yrUk75TCpKhs9:osFkKdKRIhKtAkVzM5yrUkha 384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep 384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd 12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI 3072:zAf6suip+z7FEk/oJz69sFaXeu9CoT2nIZvetBWqIBoE9Mv:Q6PpsF4CoT2EeY2eMv 1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF 6144:C+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XP+jW:Cu4Abg7XV72GI/qn6z 384:d6PvVXHWPhWnsnhi00GftpBjaJemyDlD16PamW8:UPvVX85nhoisJeLt8 3072:8Oqe98Ea4usvd5jm6V0InXx/CHzGYC6NccMmxK3atIYHD2JJJsPyimY4kQkE:Vqe98Evua5Sm0ux/5YC6NccMmtXHD2JR 192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q 192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC 24576:XDI7I4/FeoJQuQ3IhXtHfjyqgJ0BnPQAib7/12bg2JSna5xfg0867U4MSpu731hn:uQ3YX5jyqgynPkbd24VwMSpu7Fhn 384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y 192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU 384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V 384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu 48:T9aC3BdjNPp+suktLReRK+nVaNU74ePLrL2Iua6maxNPM5ETQTcrQHIvYysX0jpi:RVdvUVaN+LrL2IlLvU+kYysX0j4t 384:QS+qYFlfk44jGaCvySv3Lxj0eu1Du1ju1Uu1Evdj44V/Dd:1+qYj+cF3LxgYD 192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2 192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB 192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552 192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv 384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV 384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7 384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv 384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0 192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0 384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn 384:cWPhWM4Ri00GftpBj2YILemtclD16PaEC:l10oiBQe/L 192:RWIghWG4U9xluZo123Ouo+Uggs/nGfe4pBjSbMDPxVWh0txKdmVWQ4CWrDry6qnZ:RWPhWFv0i00GftpBjBHem6plUG+zIw 192:NFmxD3PWIghWGJY/luZo123Ouo+Uggs/nGfe4pBjSffcp8Wh0txKdmVWQ4yWRzOr:NFkWPhW60i00GftpBj4emHlD16Pa7v 384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp 192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s 1536:5vNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41ZH:hNGVOiBZbcGmxXMcBqmzoCUZoZebHZMw 384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj 192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7 192:3jBMWIghWGZiKedXe123Ouo+Uggs/nGfe4pBjS/uBmWh0txKdmVWQ4GWDZoiyqnP:GWPhWVXYi00GftpBjSemTltcwpS 96:Dbn5HKlV8/VDHLRilOhFTFf6FdqA9LJp6Y/e2DkrGJ6hmCcaLeU8ukONPk7iriQ:3n5HKEnhTFiPsvW7iri 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX 24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb 192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP 49152:y9zgkv58gK28UBvyFfYELWcLPik69kBREGr1YdgIVWfo74T+BP3E:EFRUaaqnG5ihETCP3E 3:vpqMLJUQ2W0cpStcwVTdD:vEMWXbc8tZhp 384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr 768:Ak9YyFYxwLT2qDk/BRB6FRutiSiHQ6orjcvYGfQjq89Zh116RS2CuD9CbVJsgY6L:j5hf2qgB67uUS+Q6XajRhr6Rs8oyDT+ 3:wcaJHofQdXDk1h2caCi20f6fATikiub78Dv:wcaJofQdXQecH0f64QO8Dv 384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv 384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex 384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53 3:: 3:oqu:oV 384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/ 384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8 24:TLEag/5UcJOyTGVZTPaFpEvg3obNmCFk6Uwcc85fB:ToR/ecVTgPOpEveoJZFrU1cQB 384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp 12288:lUykCSZQeSdPLHNHgdvb0INuK8afD7Gj7qqtisK1yty+79mmUE7evpp:hsQeS9Hpg7ear7GXZgTvmUwup 384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp 24:LLi4N0KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6UwcpYMQW:zNz+JH3yJUheCVE9V8MX0PFlNU1uW 12:DBl/Zed12Of5LZWfY0xpMujuHWMu6N2OHjWOzMbdym/eRgBoQFmgW2FOmO6Mz6LX:DLZs1x7WxHaiSlMxosJF/Ezo 384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH 6144:0DKVMHO3ZKWEZkBetYMIx2SBD7VIXng1dNQ13Si6u4er12v1vTUX7zP7RFk9O73n:0DKVF3wWoNtNE3BPeXgQ1MGp3kYTP9eu