VTI SCORE: 95/100
Dynamic Analysis Report |
Classification: Trojan |
634ad02fba5314a9c69334923a448c452550e08427ca7edb11d2d984eb66c115 (SHA256)
urkotu.exe
Windows Exe (x86-32)
Created at 2019-01-08 09:24:00
Virtual Machine Information
Name | win10_64 |
Description | - |
Architecture | x86 64-bit |
Operating System | Windows 10 Threshold 1 |
Kernel Version | 10.0.10240.16384 (c68ee22f-dcf6-4778-95c5-4a862be16567) |
Network Scheme Name | def |
Network Config Name | def |
System Information
Computer Name | LHNIWSJ |
User Domain | LHNIWSJ |
User Name | CIiHmnxMn6Ps |
User Profile | C:\Users\CIiHmnxMn6Ps |
Temp Directory | C:\Users\CIIHMN~1\AppData\Local\Temp |
System Root | C:\Windows |
Sample Directory | C:\Users\CIiHmnxMn6Ps\Desktop |
Software Information
Adobe Acrobat Reader Version | 18.009.20050 |
Microsoft Office | 2016 |
Microsoft Office Version | 16.0.10228.20134 |
Internet Explorer Version | 11.0.10240.16384 |
Chrome Version | 58.0.3029.110 |
Firefox Version | 53.0.3 |
Flash Version | 25.0.0.148 |
Java Version | 8.0.1310.11 |
Microsoft Project Version | 16.0.10228.20134 |
Microsoft Visio Version | 16.0.10228.20134 |
Randomly Created Artifacts
This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.
Processes (19)
»
Filename | PID | GUI |
---|---|---|
C:\Program Files (x86)\Common Files\engagement cologne.exe | #2264 | |
C:\Program Files (x86)\Common Files\rangestremendous.exe | #1824 | |
C:\Program Files (x86)\Common Files\uncertainty_furnishings_tramadol.exe | #1604 | |
C:\Program Files (x86)\Internet Explorer\cambridge.exe | #1812 | |
C:\Program Files (x86)\Internet Explorer\pdf_incoming_tracked.exe | #308 | |
C:\Program Files (x86)\Microsoft.NET\colininstallations.exe | #2668 | |
C:\Program Files (x86)\Mozilla Maintenance Service\solo.exe | #1800 | |
C:\Program Files (x86)\Reference Assemblies\science old.exe | #696 | |
C:\Program Files (x86)\Windows Multimedia Platform\gp-blank.exe | #2408 | |
C:\Program Files (x86)\WindowsPowerShell\handling investing experimental.exe | #1544 | |
C:\Program Files\Common Files\matching.exe | #2948 | |
C:\Program Files\Internet Explorer\ten.exe | #1484 | |
C:\Program Files\Java\likes skiing.exe | #2900 | |
C:\Program Files\MSBuild\amateur-dishes.exe | #424 | |
C:\Program Files\Uninstall Information\readingsunto.exe | #2588 | |
C:\Program Files\Windows Portable Devices\disorder.exe | #2280 | |
C:\Program Files\Windows Portable Devices\uni.exe | #2800 | |
C:\Program Files\Windows Sidebar\batteries_dirty.exe | #3028 | |
C:\Program Files\Windows Sidebar\touringcontinuedrussia.exe | #2904 |
Files (263)
»
Filename |
---|
C:\Users\CIIHMN~1\AppData\Local\Temp\-DtP.mkv |
C:\Users\CIIHMN~1\AppData\Local\Temp\2INjmY5Ll f9hzJawkhX.bmp |
C:\Users\CIIHMN~1\AppData\Local\Temp\3fcENg.mp3 |
C:\Users\CIIHMN~1\AppData\Local\Temp\8DXv8O4i3VAFCMQIP.mp4 |
C:\Users\CIIHMN~1\AppData\Local\Temp\AF8KmIdq48EK_.jpg |
C:\Users\CIIHMN~1\AppData\Local\Temp\Ar3U5SIYij3S 9.docx |
C:\Users\CIIHMN~1\AppData\Local\Temp\EipGeuHpKF.jpg |
C:\Users\CIIHMN~1\AppData\Local\Temp\K1KG.jpg |
C:\Users\CIIHMN~1\AppData\Local\Temp\KgUe_qsojLS2obeWwF.jpg |
C:\Users\CIIHMN~1\AppData\Local\Temp\L5QqF.gif |
C:\Users\CIIHMN~1\AppData\Local\Temp\MDGpAe5-IZq.pps |
C:\Users\CIIHMN~1\AppData\Local\Temp\NQPSbGTD.wav |
C:\Users\CIIHMN~1\AppData\Local\Temp\NZitRK.avi |
C:\Users\CIIHMN~1\AppData\Local\Temp\NumdEDrSr1A0fOyQQlw.jpg |
C:\Users\CIIHMN~1\AppData\Local\Temp\NzpLPV67liw.flv |
C:\Users\CIIHMN~1\AppData\Local\Temp\UHdXaCVLqHnhUYpzw.mkv |
C:\Users\CIIHMN~1\AppData\Local\Temp\W0KkokSeh.m4a |
C:\Users\CIIHMN~1\AppData\Local\Temp\Y3XLwSzaAukdJOA.ots |
C:\Users\CIIHMN~1\AppData\Local\Temp\ZQ9IyOP13ymlLTgS.jpg |
C:\Users\CIIHMN~1\AppData\Local\Temp\d4UyF6OdgsQ5mg9cx.bmp |
C:\Users\CIIHMN~1\AppData\Local\Temp\d5IbYCen5G dnP6nmm58.avi |
C:\Users\CIIHMN~1\AppData\Local\Temp\h90iMP7n8hBW36Unr.jpg |
C:\Users\CIIHMN~1\AppData\Local\Temp\iZuFW 0mc.png |
C:\Users\CIIHMN~1\AppData\Local\Temp\jTIJH5dBOyVm.mp4 |
C:\Users\CIIHMN~1\AppData\Local\Temp\m1247-hXgFG5H.pptx |
C:\Users\CIIHMN~1\AppData\Local\Temp\oKEBi.ots |
C:\Users\CIIHMN~1\AppData\Local\Temp\pB5tm.swf |
C:\Users\CIIHMN~1\AppData\Local\Temp\qtOp7EVm.png |
C:\Users\CIIHMN~1\AppData\Local\Temp\wdnnT1mt.wav |
C:\Users\CIIHMN~1\AppData\Local\Temp\xH6JhL-j9LlU1nsK4.bmp |
C:\Users\CIIHMN~1\AppData\Local\Temp\z8-O-uaw7WdVeo.ots |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\- nBV11OtZ.gif |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\0j0jRNj5ll.jpg |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\0nBW2Q.jpg |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\1AckXMzH_y-EZKX clO.csv |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\1GWUCZqm.m4a |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\20JqNZHFqgnRceHC.bmp |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3c0J.ppt |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\7tuuY6TdKy.m4a |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\84U6AU.rtf |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\8lF5.pps |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\9Ij7agTU_eL.wav |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\DqG_2Uy.m4a |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\FBswBeBr-ZYj-yl60wII.mp4 |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\ItdgLepYU0_0uymKD.mkv |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\LIueiNIM.m4a |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\MKATOFD.ots |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Ny9MOb2xN3HvVwk3HAF2.mp3 |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RKv s7ykzaasn1ynoQ.mp3 |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RVaMFvy5NSsHenlgg.png |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RqQ4ljZtVymsy.mkv |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\SgK7pizgj.avi |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Uvo6w4pyTNcb.swf |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\VMq3MiZS3p7.jpg |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\VrWIS-JGFnxcy.ppt |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Y4PiUDMUwoxsTMtOAv6.mp3 |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Z5htL.bmp |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\criVQlUd0-C6WxCu.mp3 |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\gtp qAaEV7xc.mp4 |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\meD IkNPB_87KTfYb.mp3 |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\n18KiHRZZX4T.pdf |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\pzr6_ZZAbgNx.docx |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\sHTP-Z.doc |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\sRxgd.jpg |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\sbSEx.xls |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\sf-pzKiISnA1fmEX.odp |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\vHZvX81S36kl.odt |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\ylb2qGtSmNBOwD2Ia.swf |
C:\Users\CIiHmnxMn6Ps\Desktop\4UZtesLMUK9dVB6.flv |
C:\Users\CIiHmnxMn6Ps\Desktop\A7Go69o.odt |
C:\Users\CIiHmnxMn6Ps\Desktop\DcoAl2Cyk BNb Z |
C:\Users\CIiHmnxMn6Ps\Desktop\DcoAl2Cyk BNb Z\1AF4gyQFOUlx31u99mqP.mkv |
C:\Users\CIiHmnxMn6Ps\Desktop\DcoAl2Cyk BNb Z\3q9V-B4 Iq7kkLAG.m4a |
C:\Users\CIiHmnxMn6Ps\Desktop\DcoAl2Cyk BNb Z\CKXKYdnEcqavzgZeqD.png |
C:\Users\CIiHmnxMn6Ps\Desktop\DcoAl2Cyk BNb Z\EnuJ.bmp |
C:\Users\CIiHmnxMn6Ps\Desktop\DcoAl2Cyk BNb Z\KpLkiLzEVW.wav |
C:\Users\CIiHmnxMn6Ps\Desktop\DcoAl2Cyk BNb Z\MWx2CefF.jpg |
C:\Users\CIiHmnxMn6Ps\Desktop\DcoAl2Cyk BNb Z\YQQ5W_QeWadWc6epLYgL.jpg |
C:\Users\CIiHmnxMn6Ps\Desktop\DcoAl2Cyk BNb Z\cIIJ7KHUrPhny.mp3 |
C:\Users\CIiHmnxMn6Ps\Desktop\DcoAl2Cyk BNb Z\idOKTsVxl.gif |
C:\Users\CIiHmnxMn6Ps\Desktop\DcoAl2Cyk BNb Z\nUYpJzCRlBW pGVoj-H.avi |
C:\Users\CIiHmnxMn6Ps\Desktop\DcoAl2Cyk BNb Z\sSynm7cE2KkI9Jb.xlsx |
C:\Users\CIiHmnxMn6Ps\Desktop\DcoAl2Cyk BNb Z\u932rnLEVTR7cIf92j.flv |
C:\Users\CIiHmnxMn6Ps\Desktop\DcoAl2Cyk BNb Z\zjYh.wav |
C:\Users\CIiHmnxMn6Ps\Desktop\FTZca1x.mp4 |
C:\Users\CIiHmnxMn6Ps\Desktop\GqEQwk7EHQ5wtG9fQ.jpg |
C:\Users\CIiHmnxMn6Ps\Desktop\Hl3MMG4xSGw.mp4 |
C:\Users\CIiHmnxMn6Ps\Desktop\N0OxCokJ8aLe8fYmxaA.gif |
C:\Users\CIiHmnxMn6Ps\Desktop\P2wqm71n_VOcDBjHGJ.mkv |
C:\Users\CIiHmnxMn6Ps\Desktop\SrNI7MRF731NZt.jpg |
C:\Users\CIiHmnxMn6Ps\Desktop\U2QyqjgC5sEV4.gif |
C:\Users\CIiHmnxMn6Ps\Desktop\VY1OKo_HHZ.swf |
C:\Users\CIiHmnxMn6Ps\Desktop\WYxY.ppt |
C:\Users\CIiHmnxMn6Ps\Desktop\WzNM4B3CIuCQ7CrDYfD.ppt |
C:\Users\CIiHmnxMn6Ps\Desktop\YBcKgZ.bmp |
C:\Users\CIiHmnxMn6Ps\Desktop\_tfHwyL8gZpJppK.mp4 |
C:\Users\CIiHmnxMn6Ps\Desktop\a_zm8VmWk.ppt |
C:\Users\CIiHmnxMn6Ps\Desktop\d-F9R8gaGDhqsg.swf |
C:\Users\CIiHmnxMn6Ps\Desktop\g-gN2bErFC.bmp |
C:\Users\CIiHmnxMn6Ps\Desktop\hmP0 Su7.png |
C:\Users\CIiHmnxMn6Ps\Desktop\iEthT8Se.jpg |
C:\Users\CIiHmnxMn6Ps\Desktop\l P-DxLMi8pUfhC0PF.pps |
C:\Users\CIiHmnxMn6Ps\Desktop\l41JZuoJm_QRFHUJX.m4a |
C:\Users\CIiHmnxMn6Ps\Desktop\lVW2tIyhIw8gEmF7OFU.gif |
C:\Users\CIiHmnxMn6Ps\Desktop\n9PbH.flv |
C:\Users\CIiHmnxMn6Ps\Desktop\nEK9.gif |
C:\Users\CIiHmnxMn6Ps\Desktop\paL6Q7Emhi.wav |
C:\Users\CIiHmnxMn6Ps\Desktop\qd-r4ceY.flv |
C:\Users\CIiHmnxMn6Ps\Desktop\rbZpjG6h9T9cN.avi |
C:\Users\CIiHmnxMn6Ps\Desktop\rvcFuQW2axKX-0Xn3rB.png |
C:\Users\CIiHmnxMn6Ps\Desktop\siA69T-NV10Fodi88c.mkv |
C:\Users\CIiHmnxMn6Ps\Desktop\sxfPST_oK8GRvs_Ji.gif |
C:\Users\CIiHmnxMn6Ps\Desktop\vtdMoR h0eVGW8Gf.odp |
C:\Users\CIiHmnxMn6Ps\Documents\0SzogCcv4KUwJSzT.docx |
C:\Users\CIiHmnxMn6Ps\Documents\20yslR.docx |
C:\Users\CIiHmnxMn6Ps\Documents\3DBSM15W-0cJiONAsyM.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\4nVEo4wjmf_xFmDccp_t.docx |
C:\Users\CIiHmnxMn6Ps\Documents\AF_MWpb58TvU.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\E7X0FXwykRs2LR.pps |
C:\Users\CIiHmnxMn6Ps\Documents\HwxU0EaULXAkU.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\KK1pgzF9nveXQ4YOzDc.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\OiiKr2Q.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\Or3v0kk.doc |
C:\Users\CIiHmnxMn6Ps\Documents\QGmkT.doc |
C:\Users\CIiHmnxMn6Ps\Documents\QRYnbbX-bndEUK.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\RQj3wHOASAoha.docx |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\4NjIz.ots |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\OnOkucmnnWC.doc |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\YFlF4PnwDORAXYagXtYc.doc |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\aBzByv-TvK |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\aBzByv-TvK\4KJBTGgc21MYT Rsq9.ppt |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\aBzByv-TvK\7LUX_VuyQ3Q.xls |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\aBzByv-TvK\NkIEFhgMjBm5g8.pdf |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\aBzByv-TvK\Po4BDI9NiLqpFUEmZG.odp |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\aBzByv-TvK\gcuYt-1.docx |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\aBzByv-TvK\lxDwC8usEyHBqZ.odt |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\aBzByv-TvK\r0W0Ov4U11.ots |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\g6DPbCStytWMIMFEoY.csv |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\gaKl9QtLztBx_wue.rtf |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\jBD_GH5.ods |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\mvPe9rh3wDX867qaz-y.csv |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\niVukSeRhX.rtf |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\rMorgMWCc6RAZQG46FZ4 |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\rMorgMWCc6RAZQG46FZ4\-QHGOVM.rtf |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\rMorgMWCc6RAZQG46FZ4\4nuu.ots |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\rMorgMWCc6RAZQG46FZ4\OvuidlTCtUwoobHG.ppt |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\rMorgMWCc6RAZQG46FZ4\qZnl2x1bNlyNa.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\rMorgMWCc6RAZQG46FZ4\wAC3pyi3vzQFgMS 5.pdf |
C:\Users\CIiHmnxMn6Ps\Documents\T3S7XjT\rMorgMWCc6RAZQG46FZ4\ztqbyInPqbEceIRu.csv |
C:\Users\CIiHmnxMn6Ps\Documents\T3bSRlQsYZYL2p6uU.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\dJzTFRbrU5u8mZmlCL.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\hcug5mikl.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\lOgwOIG25gh6LDMxi.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\mQ5bvaOETC-dr1fufsF.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\pytecXBX.doc |
C:\Users\CIiHmnxMn6Ps\Documents\ybYsVKxy-czyDpTRw.docx |
C:\Users\CIiHmnxMn6Ps\Music\9SRijl5cLQTfP Ywc.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\DVfPyR6exmm-FW |
C:\Users\CIiHmnxMn6Ps\Music\DVfPyR6exmm-FW\g_GmI0mFFmLZmegI |
C:\Users\CIiHmnxMn6Ps\Music\DVfPyR6exmm-FW\g_GmI0mFFmLZmegI\DnA5h_-hxciAOE1tGw.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\DVfPyR6exmm-FW\g_GmI0mFFmLZmegI\LR4C83uPMFq4AD5h cu.m4a |
C:\Users\CIiHmnxMn6Ps\Music\DVfPyR6exmm-FW\vot_.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\Oo-ngT7aFyav5Sx.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\QNQE4yb5pg2_k |
C:\Users\CIiHmnxMn6Ps\Music\QNQE4yb5pg2_k\2_Nd7G-JagszNZB.wav |
C:\Users\CIiHmnxMn6Ps\Music\QNQE4yb5pg2_k\3THwsa0WuXY 08fIN8.wav |
C:\Users\CIiHmnxMn6Ps\Music\QNQE4yb5pg2_k\7dc3DBy-Ux3xLIBiu.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\QNQE4yb5pg2_k\7vnMX5OqG1.wav |
C:\Users\CIiHmnxMn6Ps\Music\QNQE4yb5pg2_k\M8nEa-0StqAmo.wav |
C:\Users\CIiHmnxMn6Ps\Music\QNQE4yb5pg2_k\zynjrHrQONSTEl.wav |
C:\Users\CIiHmnxMn6Ps\Music\YrqDj.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\dNkwU1Ping53L5lqK-5q |
C:\Users\CIiHmnxMn6Ps\Music\dNkwU1Ping53L5lqK-5q\1otXv2aU |
C:\Users\CIiHmnxMn6Ps\Music\dNkwU1Ping53L5lqK-5q\1otXv2aU\45SjdLyweCFpElq7URLS.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\dNkwU1Ping53L5lqK-5q\1otXv2aU\6sx0ME2xR2P-Jp6t.wav |
C:\Users\CIiHmnxMn6Ps\Music\dNkwU1Ping53L5lqK-5q\1otXv2aU\M8EUKHg1dG |
C:\Users\CIiHmnxMn6Ps\Music\dNkwU1Ping53L5lqK-5q\1otXv2aU\M8EUKHg1dG\Nxtftuunv0ONXt.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\dNkwU1Ping53L5lqK-5q\1otXv2aU\hcXC.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\dNkwU1Ping53L5lqK-5q\1otXv2aU\lxC-guLKIgH.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\dNkwU1Ping53L5lqK-5q\DLLq.wav |
C:\Users\CIiHmnxMn6Ps\Music\dNkwU1Ping53L5lqK-5q\IbhnElr_751F85VU.wav |
C:\Users\CIiHmnxMn6Ps\Music\dNkwU1Ping53L5lqK-5q\etDPH-pB9xeN7.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\dNkwU1Ping53L5lqK-5q\v0fUo.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\j_yssjonNqd.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\mHH8b4DmBvPCAJr7j.wav |
C:\Users\CIiHmnxMn6Ps\Music\q7gLd4O-vNzNJR.m4a |
C:\Users\CIiHmnxMn6Ps\Music\vfMKA3pKxOnhzT7D |
C:\Users\CIiHmnxMn6Ps\Music\vfMKA3pKxOnhzT7D\9 mNyKs59hb B.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\vfMKA3pKxOnhzT7D\DSAQB1cPq2X |
C:\Users\CIiHmnxMn6Ps\Music\vfMKA3pKxOnhzT7D\DSAQB1cPq2X\0f2DTZAm.wav |
C:\Users\CIiHmnxMn6Ps\Music\vfMKA3pKxOnhzT7D\HmN1N_H.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\vfMKA3pKxOnhzT7D\u8gzC.m4a |
C:\Users\CIiHmnxMn6Ps\Pictures\CcOuxRLZHpjqJiC-QER.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\Mf_QVkxH3TTWuXeU.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\UCrJ3 DBoXo |
C:\Users\CIiHmnxMn6Ps\Pictures\UCrJ3 DBoXo\HGdNeI_IhaCE TQW0.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\YAsZMtPoQ76z |
C:\Users\CIiHmnxMn6Ps\Pictures\YAsZMtPoQ76z\3YGx3M XAxnV0Cjnd.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\cDP9ZofpFdc-_Fcql.png |
C:\Users\CIiHmnxMn6Ps\Pictures\dZIkwmOSN |
C:\Users\CIiHmnxMn6Ps\Pictures\dZIkwmOSN\-dl0BK4hDu2F.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\dZIkwmOSN\AVPh.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\dZIkwmOSN\GSyvaIZba35.bmp |
C:\Users\CIiHmnxMn6Ps\Pictures\dZIkwmOSN\a4MbqQBEVPI_oYC7UTTI.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\dZIkwmOSN\dI- VG2NtI_ |
C:\Users\CIiHmnxMn6Ps\Pictures\dZIkwmOSN\dI- VG2NtI_\mBTGFPPUxVGM36yK.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\dZIkwmOSN\dI- VG2NtI_\ri5ATCHREMP.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\9L-1frJNJ |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\9L-1frJNJ\J-JUZB wj y.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\9L-1frJNJ\ShzTcWlJf04.png |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\BoPW |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\BoPW\5AAsNt.png |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\BoPW\7QXW7iA_nKKLH.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\BoPW\JzMb-sOO4iOaDuBD.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\BoPW\jnDdnmhOOcQzf.bmp |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\GV-2TlzluKTJIb4e1lL.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\WG3WEzwR5XcD4UB2H |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\WG3WEzwR5XcD4UB2H\492Nv2Poo.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\WG3WEzwR5XcD4UB2H\IfHhC.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\WG3WEzwR5XcD4UB2H\RPkLEz0YMl0 |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\WG3WEzwR5XcD4UB2H\RPkLEz0YMl0\DungXFleTcPyRvd.bmp |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\WG3WEzwR5XcD4UB2H\RPkLEz0YMl0\V6nLmt.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\WG3WEzwR5XcD4UB2H\_7lfcp |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\WG3WEzwR5XcD4UB2H\_7lfcp\U TGaFzP.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\WG3WEzwR5XcD4UB2H\_7lfcp\vwXzFx _uhS JIBmdo W.bmp |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\WG3WEzwR5XcD4UB2H\_ooXpY s.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\my6Gjt\WG3WEzwR5XcD4UB2H\lg85o.bmp |
C:\Users\CIiHmnxMn6Ps\Videos\2RXx2_ |
C:\Users\CIiHmnxMn6Ps\Videos\2RXx2_\T1szJVYL7jhEgh2.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\2RXx2_\ddI2zmn9z6L3B.flv |
C:\Users\CIiHmnxMn6Ps\Videos\2RXx2_\eW41T8KmGPeFgOL6yi.avi |
C:\Users\CIiHmnxMn6Ps\Videos\KBLj |
C:\Users\CIiHmnxMn6Ps\Videos\KBLj\M_YlVWJiZS4Ve1JD.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\KBLj\NzbllznnXQ1T.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\KBLj\kiTjuX3fzrpxMtxMiueu.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX\O6YJ0 q-UwbfoC-5DY.mkv |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX\TltzUQERHwBN6 |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX\TltzUQERHwBN6\-os1Yjls6TLUnLMBy.swf |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX\TltzUQERHwBN6\2PYpxL.flv |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX\TltzUQERHwBN6\C_vM.swf |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX\TltzUQERHwBN6\ci VTpctNPOxm.avi |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX\TltzUQERHwBN6\iAv7fQYhOUdO4.flv |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX\TltzUQERHwBN6\sGx_HHs5sIn1.swf |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX\WKvAWHye8grw4dcYmb.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX\h1BzGRAFcSDnyTsCy |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX\h1BzGRAFcSDnyTsCy\0w1_XArRSXfPxp.mkv |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX\h1BzGRAFcSDnyTsCy\D5One0tOZYXMiPbl.mkv |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX\h1BzGRAFcSDnyTsCy\kvOaP.swf |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX\h1BzGRAFcSDnyTsCy\oVsqQsRFMjGB.flv |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX\h1BzGRAFcSDnyTsCy\sK X3j.swf |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX\h1BzGRAFcSDnyTsCy\x8Clv13l-CF.mkv |
C:\Users\CIiHmnxMn6Ps\Videos\Kq7t5T_T0t3eNu7sdtrX\tKGkLG9QxFTKSEfpW.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\mpvEH9w258 |
C:\Users\CIiHmnxMn6Ps\Videos\mpvEH9w258\-tbIy-G.avi |
C:\Users\CIiHmnxMn6Ps\Videos\mpvEH9w258\F47Y.swf |
C:\Users\CIiHmnxMn6Ps\Videos\mpvEH9w258\I_hAC.avi |
C:\Users\CIiHmnxMn6Ps\Videos\mpvEH9w258\J1qc.avi |
C:\Users\CIiHmnxMn6Ps\Videos\mpvEH9w258\UV1v.flv |
C:\Users\CIiHmnxMn6Ps\Videos\mpvEH9w258\UoV-.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\mpvEH9w258\ynJ0tiv.flv |