81f1a5fa...beee

Virtual Machine Information

Name	win7_32_sp1-mso2013
Description	-
Architecture	x86 32-bit PAE
Operating System	Windows 7
Kernel Version	6.1.7601.17514 (684da42a-30cc-450f-81c5-35b4d18944b1)

System Information

Computer Name	F71GWAT
User Domain	F71GWAT
User Name	BGC6u8Oy yXGxkR
User Profile	C:\Users\BGC6u8Oy yXGxkR
Temp Directory	C:\Users\BGC6U8~1\AppData\Local\Temp
System Root	C:\Windows
Sample Directory	C:\Users\BGC6u8Oy yXGxkR\Desktop

Software Information

Adobe Acrobat Reader Version	10.0.0
Microsoft Office	2013
Microsoft Office Version	15.0.4569.1504
Internet Explorer Version	8.0.7601.17514
Chrome Version	58.0.3029.110
Firefox Version	25.0
Flash Version	10.3.183.90
Java Version	7.0.600.19
Microsoft Project Version	15.0.4569.1504
Microsoft Visio Version	15.0.4420.1017

Randomly Created Artifacts

This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.

Processes (17)

Filename	PID	GUI
C:\Program Files\Common Files\intranet.exe	#1776
C:\Program Files\Google\wallace_labs_maximize.exe	#2092
C:\Program Files\Internet Explorer\enabling cute glen.exe	#1832
C:\Program Files\Internet Explorer\locale infected api.exe	#652
C:\Program Files\Internet Explorer\respiratory external demands.exe	#1836
C:\Program Files\Internet Explorer\squirt integral.exe	#1108
C:\Program Files\MSBuild\township_heading.exe	#692
C:\Program Files\Microsoft Analysis Services\flowers.exe	#2052
C:\Program Files\Microsoft Analysis Services\ten.exe	#200
C:\Program Files\Microsoft SQL Server\investment institutions lawn.exe	#1764
C:\Program Files\Microsoft SQL Server\thickness_warcraft.exe	#1052
C:\Program Files\Microsoft.NET\pricing-bhutan-habits.exe	#1572
C:\Program Files\Mozilla Firefox\programme.exe	#1668
C:\Program Files\Uninstall Information\cricket_matched_die.exe	#940
C:\Program Files\Windows Photo Viewer\steel louise.exe	#1136
C:\Program Files\Windows Portable Devices\asks_helpful.exe	#2068
C:\Program Files\Windows Sidebar\announce ftp graduates.exe	#316

Files (297)

Filename
C:\Users\BGC6U8~1\AppData\Local\Temp\-6nqf-B.png
C:\Users\BGC6U8~1\AppData\Local\Temp\2mVyd.swf
C:\Users\BGC6U8~1\AppData\Local\Temp\7yhWyb.wav
C:\Users\BGC6U8~1\AppData\Local\Temp\A03-9CN0VCQvk.mp4
C:\Users\BGC6U8~1\AppData\Local\Temp\Ai1xofZCzZCOe2.pptx
C:\Users\BGC6U8~1\AppData\Local\Temp\BNsa388zxWEs.bmp
C:\Users\BGC6U8~1\AppData\Local\Temp\C0qayTK IKJ OE.m4a
C:\Users\BGC6U8~1\AppData\Local\Temp\EhyHag3QCVh.mp4
C:\Users\BGC6U8~1\AppData\Local\Temp\F AcyecCMcn1.ots
C:\Users\BGC6U8~1\AppData\Local\Temp\HvxDEntVXONtCSr_KuF.jpg
C:\Users\BGC6U8~1\AppData\Local\Temp\IzNSl.rtf
C:\Users\BGC6U8~1\AppData\Local\Temp\J0yq_xJDpT43WQ2z0 p.pdf
C:\Users\BGC6U8~1\AppData\Local\Temp\Jo Y2sudYWQ2.avi
C:\Users\BGC6U8~1\AppData\Local\Temp\Lqg6Ju4s89.mkv
C:\Users\BGC6U8~1\AppData\Local\Temp\OKhMPJdcmaG7y.wav
C:\Users\BGC6U8~1\AppData\Local\Temp\Ralmv88flFd6fa.swf
C:\Users\BGC6U8~1\AppData\Local\Temp\TBvtCcqkSPjOwWymlBiK.mkv
C:\Users\BGC6U8~1\AppData\Local\Temp\VustdVDNj.docx
C:\Users\BGC6U8~1\AppData\Local\Temp\XJQh.avi
C:\Users\BGC6U8~1\AppData\Local\Temp\YGJo-aQP.odt
C:\Users\BGC6U8~1\AppData\Local\Temp\ar7PV.wav
C:\Users\BGC6U8~1\AppData\Local\Temp\bEfJh7-HVtIcU23JE9N.jpg
C:\Users\BGC6U8~1\AppData\Local\Temp\bm_toK88XheJL.pptx
C:\Users\BGC6U8~1\AppData\Local\Temp\dFtVp5S5Ls0.csv
C:\Users\BGC6U8~1\AppData\Local\Temp\eN7-uQWBflQh.mp3
C:\Users\BGC6U8~1\AppData\Local\Temp\fHBp8I.swf
C:\Users\BGC6U8~1\AppData\Local\Temp\fMzx.gif
C:\Users\BGC6U8~1\AppData\Local\Temp\fodfHV2MyYym8.swf
C:\Users\BGC6U8~1\AppData\Local\Temp\h5CozrNk.flv
C:\Users\BGC6U8~1\AppData\Local\Temp\kRhsVN3FNkcA3Aj248f.gif
C:\Users\BGC6U8~1\AppData\Local\Temp\lE EDomhrVY.m4a
C:\Users\BGC6U8~1\AppData\Local\Temp\oC6_Gr1uwEcEV0WTsUy.xlsx
C:\Users\BGC6U8~1\AppData\Local\Temp\qI15.doc
C:\Users\BGC6U8~1\AppData\Local\Temp\vLomT80l95OUrhhMj.mp3
C:\Users\BGC6U8~1\AppData\Local\Temp\wze Tx deTcFKN-.mp3
C:\Users\BGC6U8~1\AppData\Local\Temp\z7xz73OJC7.xlsx
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\1_0YTvznk2V-OiGvI_.bmp
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\5xrDOXxBMyM.rtf
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\5zzLTA9ECLNfkl-jQ.xls
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\7dC7k keK1Rauzf2HAA.png
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\9PXQeT8Rebi0cfQgf.jpg
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\BH48iEZKvU26ZK6JgRn.png
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\CM620hKmITrc58aYN92W.swf
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\H1yQWFN171d FlCyWAL.m4a
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\Hx35ALLyWuTr.gif
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\INldw.gif
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\ITPpLoAp9_Iy.wav
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\K_2yfwFCb.bmp
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\MutDH.pptx
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\QdkErGx4.mp4
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\RvqrMMm.m4a
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\SO1iq2jpm0ZxhCRShTsl.png
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\SOUWS5P57sGv_.flv
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\ZsJl8gnk6HiF-nmdF.png
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\en5rK9vigTK09F.m4a
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\g83Uf0K.avi
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\m6DoNzaSq7Bsczdr.gif
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\npUlt88yhuJYnUa7t7J.docx
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\oGn0koHum9gIJOIaPxL.wav
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\pFCU4nc.mp4
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\q0wfjDEkG.mp4
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\qfE13Ot.gif
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\sus31gFGesb jIlVW5A.m4a
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\vy7 3uj6Yqq.flv
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\xw4.xlsx
C:\Users\BGC6u8Oy yXGxkR\AppData\Roaming\y6Rg1SCCu.mp4
C:\Users\BGC6u8Oy yXGxkR\Desktop\-G2-6GS6V_Jg.wav
C:\Users\BGC6u8Oy yXGxkR\Desktop\-RGjf-lropVxyV.jpg
C:\Users\BGC6u8Oy yXGxkR\Desktop\0iIVeifmVkYXaA.bmp
C:\Users\BGC6u8Oy yXGxkR\Desktop\2K2jT.xls
C:\Users\BGC6u8Oy yXGxkR\Desktop\2yT5w88kvT.bmp
C:\Users\BGC6u8Oy yXGxkR\Desktop\549Cq1pOC8M6Y4M8VYja.m4a
C:\Users\BGC6u8Oy yXGxkR\Desktop\7M5xhjsshDQh7H.pptx
C:\Users\BGC6u8Oy yXGxkR\Desktop\AedJ5U3a5eUwO.wav
C:\Users\BGC6u8Oy yXGxkR\Desktop\AoPD6tt0_04V2FA.wav
C:\Users\BGC6u8Oy yXGxkR\Desktop\AwUCTETR.mp3
C:\Users\BGC6u8Oy yXGxkR\Desktop\BWDIK.avi
C:\Users\BGC6u8Oy yXGxkR\Desktop\ENCsI1gIuxe3gT.pptx
C:\Users\BGC6u8Oy yXGxkR\Desktop\Ea-r4CWmY6FMVCh.bmp
C:\Users\BGC6u8Oy yXGxkR\Desktop\IVtAA7_TQEDNXd.xlsx
C:\Users\BGC6u8Oy yXGxkR\Desktop\JKfiLddf.mp4
C:\Users\BGC6u8Oy yXGxkR\Desktop\JkxblfTBR5MmE-V9mRI0.jpg
C:\Users\BGC6u8Oy yXGxkR\Desktop\LvN594D3pBgO2.mp4
C:\Users\BGC6u8Oy yXGxkR\Desktop\O95A3mmfXJgoVqz_ 8Og
C:\Users\BGC6u8Oy yXGxkR\Desktop\O95A3mmfXJgoVqz_ 8Og\-2 DZC.avi
C:\Users\BGC6u8Oy yXGxkR\Desktop\O95A3mmfXJgoVqz_ 8Og\-8o2XsF0C2L.ots
C:\Users\BGC6u8Oy yXGxkR\Desktop\O95A3mmfXJgoVqz_ 8Og\gYwn2P.jpg
C:\Users\BGC6u8Oy yXGxkR\Desktop\O95A3mmfXJgoVqz_ 8Og\m3EnP zTdjAVUhqJOdf.mp4
C:\Users\BGC6u8Oy yXGxkR\Desktop\O95A3mmfXJgoVqz_ 8Og\uCoyJ0h6u_93h0.ods
C:\Users\BGC6u8Oy yXGxkR\Desktop\Oj3j3wdR8Qyy86P0.doc
C:\Users\BGC6u8Oy yXGxkR\Desktop\PctU-pSc0ea_Jp.jpg
C:\Users\BGC6u8Oy yXGxkR\Desktop\QVBB6j0.bmp
C:\Users\BGC6u8Oy yXGxkR\Desktop\S Uu4pLk3T8JLm.gif
C:\Users\BGC6u8Oy yXGxkR\Desktop\SgayZagOC.jpg
C:\Users\BGC6u8Oy yXGxkR\Desktop\Wzet.gif
C:\Users\BGC6u8Oy yXGxkR\Desktop\Y5qzQqPX-Icnftc.mkv
C:\Users\BGC6u8Oy yXGxkR\Desktop\dIHWU.png
C:\Users\BGC6u8Oy yXGxkR\Desktop\eN6-H-939cWwLCYs9ra.wav
C:\Users\BGC6u8Oy yXGxkR\Desktop\eXbQulEKQDZMNxjd4mm.wav
C:\Users\BGC6u8Oy yXGxkR\Desktop\fRcQg.jpg
C:\Users\BGC6u8Oy yXGxkR\Desktop\fYZtVPM -w8I-.wav
C:\Users\BGC6u8Oy yXGxkR\Desktop\hXVIuD.m4a
C:\Users\BGC6u8Oy yXGxkR\Desktop\kLciFEB7C.mp4
C:\Users\BGC6u8Oy yXGxkR\Desktop\mBvShq_.avi
C:\Users\BGC6u8Oy yXGxkR\Desktop\oOzpt54dynGuWAD.mp3
C:\Users\BGC6u8Oy yXGxkR\Desktop\ondhjOv8hC7F_F0Zkb.bmp
C:\Users\BGC6u8Oy yXGxkR\Desktop\ouIx.mp3
C:\Users\BGC6u8Oy yXGxkR\Desktop\psCS7X72Ys3ljnM8.wav
C:\Users\BGC6u8Oy yXGxkR\Desktop\qSlj.png
C:\Users\BGC6u8Oy yXGxkR\Desktop\sQyo8j7mbdEhNhP0ai.ods
C:\Users\BGC6u8Oy yXGxkR\Desktop\uTKGlw.ppt
C:\Users\BGC6u8Oy yXGxkR\Desktop\w4vq.ppt
C:\Users\BGC6u8Oy yXGxkR\Desktop\ylWf.m4a
C:\Users\BGC6u8Oy yXGxkR\Desktop\z3hzUzN-z9WVIe3yWG.xls
C:\Users\BGC6u8Oy yXGxkR\Desktop\zXaQAM4nLZCmMjkmmsbl.swf
C:\Users\BGC6u8Oy yXGxkR\Documents\0H1DYCB7qgBwBcQAshOV.docx
C:\Users\BGC6u8Oy yXGxkR\Documents\4rT1yt9v0a.docx
C:\Users\BGC6u8Oy yXGxkR\Documents\4zRyzi0DxEO.pps
C:\Users\BGC6u8Oy yXGxkR\Documents\6ORIV7ZQGIBWHM85MW.rtf
C:\Users\BGC6u8Oy yXGxkR\Documents\78465.docx
C:\Users\BGC6u8Oy yXGxkR\Documents\8T09FG
C:\Users\BGC6u8Oy yXGxkR\Documents\8T09FG\HJeZPQyiMySu.rtf
C:\Users\BGC6u8Oy yXGxkR\Documents\8T09FG\SE9cht.rtf
C:\Users\BGC6u8Oy yXGxkR\Documents\8cjilHdCsZ6z.pptx
C:\Users\BGC6u8Oy yXGxkR\Documents\CKS3W6JL9p.xlsx
C:\Users\BGC6u8Oy yXGxkR\Documents\EV-s.pptx
C:\Users\BGC6u8Oy yXGxkR\Documents\IX3tbr_89wEqVrZGzF0f
C:\Users\BGC6u8Oy yXGxkR\Documents\IX3tbr_89wEqVrZGzF0f\Zv_6HBKZEc
C:\Users\BGC6u8Oy yXGxkR\Documents\IX3tbr_89wEqVrZGzF0f\Zv_6HBKZEc\2bvoId.pptx
C:\Users\BGC6u8Oy yXGxkR\Documents\IX3tbr_89wEqVrZGzF0f\Zv_6HBKZEc\HNjoOHsh.ots
C:\Users\BGC6u8Oy yXGxkR\Documents\IX3tbr_89wEqVrZGzF0f\Zv_6HBKZEc\KpA8.doc
C:\Users\BGC6u8Oy yXGxkR\Documents\IX3tbr_89wEqVrZGzF0f\Zv_6HBKZEc\TA17_y9T04ks7yvO8.docx
C:\Users\BGC6u8Oy yXGxkR\Documents\IX3tbr_89wEqVrZGzF0f\Zv_6HBKZEc\VRK3yiH386hpKm-.doc
C:\Users\BGC6u8Oy yXGxkR\Documents\IX3tbr_89wEqVrZGzF0f\Zv_6HBKZEc\o31 AOvRjMBqSv0.pptx
C:\Users\BGC6u8Oy yXGxkR\Documents\IX3tbr_89wEqVrZGzF0f\Zv_6HBKZEc\ptxjrZDmD8Z8QnA9.odt
C:\Users\BGC6u8Oy yXGxkR\Documents\IX3tbr_89wEqVrZGzF0f\Zv_6HBKZEc\uEBXsPpS3MC2P_Nu.xls
C:\Users\BGC6u8Oy yXGxkR\Documents\IX3tbr_89wEqVrZGzF0f\iKdcYEw
C:\Users\BGC6u8Oy yXGxkR\Documents\IX3tbr_89wEqVrZGzF0f\iKdcYEw\1RSqfYKoP.odp
C:\Users\BGC6u8Oy yXGxkR\Documents\IX3tbr_89wEqVrZGzF0f\iKdcYEw\57jAim24PCZqk0tJKhrN.csv
C:\Users\BGC6u8Oy yXGxkR\Documents\IX3tbr_89wEqVrZGzF0f\iKdcYEw\A-6_cczv.ots
C:\Users\BGC6u8Oy yXGxkR\Documents\IX3tbr_89wEqVrZGzF0f\iKdcYEw\hQyTgbjSlyZIZRaY.ods
C:\Users\BGC6u8Oy yXGxkR\Documents\IX3tbr_89wEqVrZGzF0f\iKdcYEw\oQXtYUGOs3UxW.doc
C:\Users\BGC6u8Oy yXGxkR\Documents\IX3tbr_89wEqVrZGzF0f\pf MSfgNA6LAT5M.odp
C:\Users\BGC6u8Oy yXGxkR\Documents\Kklx3gFw3WUMEfta.rtf
C:\Users\BGC6u8Oy yXGxkR\Documents\NUDCTJFVD_-4nvW7czZ.docx
C:\Users\BGC6u8Oy yXGxkR\Documents\To-wTTVYVGljxdZ.xlsx
C:\Users\BGC6u8Oy yXGxkR\Documents\Y37YY0_GgNd.xlsx
C:\Users\BGC6u8Oy yXGxkR\Documents\bcTw3Lr
C:\Users\BGC6u8Oy yXGxkR\Documents\bcTw3Lr\40WDoS1NEZ-2.pps
C:\Users\BGC6u8Oy yXGxkR\Documents\bcTw3Lr\A5ZisGRZOthWyoUA
C:\Users\BGC6u8Oy yXGxkR\Documents\bcTw3Lr\A5ZisGRZOthWyoUA\4fyLe4Y SX.csv
C:\Users\BGC6u8Oy yXGxkR\Documents\bcTw3Lr\A5ZisGRZOthWyoUA\D Jg.pps
C:\Users\BGC6u8Oy yXGxkR\Documents\bcTw3Lr\A5ZisGRZOthWyoUA\aFsiMDlXWtui apO7v.rtf
C:\Users\BGC6u8Oy yXGxkR\Documents\bcTw3Lr\A5ZisGRZOthWyoUA\aZlGXx.pdf
C:\Users\BGC6u8Oy yXGxkR\Documents\bcTw3Lr\C1hnzVM8BG.odt
C:\Users\BGC6u8Oy yXGxkR\Documents\bcTw3Lr\JNrz-AOPS
C:\Users\BGC6u8Oy yXGxkR\Documents\bcTw3Lr\JNrz-AOPS\LffsNyRygHgDVlr.pdf
C:\Users\BGC6u8Oy yXGxkR\Documents\bcTw3Lr\JNrz-AOPS\UOJ3ag.ppt
C:\Users\BGC6u8Oy yXGxkR\Documents\bcTw3Lr\JNrz-AOPS\wwkBNQT_oBTefLsTVUB.pptx
C:\Users\BGC6u8Oy yXGxkR\Documents\bcTw3Lr\JNrz-AOPS\yUIRJqEC5.odp
C:\Users\BGC6u8Oy yXGxkR\Documents\bcTw3Lr\a9a8yQw9j.rtf
C:\Users\BGC6u8Oy yXGxkR\Documents\bcTw3Lr\aJIaq X5WCV_P41L5b.rtf
C:\Users\BGC6u8Oy yXGxkR\Documents\bcTw3Lr\nAVa0MxHsGcL.ods
C:\Users\BGC6u8Oy yXGxkR\Documents\dmsip.xlsx
C:\Users\BGC6u8Oy yXGxkR\Documents\dqfXmakylOG9_7iYf.xlsx
C:\Users\BGC6u8Oy yXGxkR\Documents\gWwjMWOTBsXXKUd.docx
C:\Users\BGC6u8Oy yXGxkR\Documents\jAe92
C:\Users\BGC6u8Oy yXGxkR\Documents\jAe92\8ePdI8Lr6 cGyutWv.odp
C:\Users\BGC6u8Oy yXGxkR\Documents\jAe92\XNKIl_tprINexpUi.docx
C:\Users\BGC6u8Oy yXGxkR\Documents\jeQX.pptx
C:\Users\BGC6u8Oy yXGxkR\Documents\neRn.pptx
C:\Users\BGC6u8Oy yXGxkR\Documents\oUpTyj O-YTFjeM5b.docx
C:\Users\BGC6u8Oy yXGxkR\Documents\ov QO-9W47.pptx
C:\Users\BGC6u8Oy yXGxkR\Documents\piBk164FeWRzdAj.pptx
C:\Users\BGC6u8Oy yXGxkR\Documents\xQyc5WLj LjlsbQy.pptx
C:\Users\BGC6u8Oy yXGxkR\Music\0sM4DCPE6-HsBC_.wav
C:\Users\BGC6u8Oy yXGxkR\Music\2ovJBLrXLH6geQ6HCMJ.mp3
C:\Users\BGC6u8Oy yXGxkR\Music\7rHcoM.m4a
C:\Users\BGC6u8Oy yXGxkR\Music\7rfQRH_.m4a
C:\Users\BGC6u8Oy yXGxkR\Music\8WquB7ga.m4a
C:\Users\BGC6u8Oy yXGxkR\Music\CZi8mFy4eGYwUFpvzoA.m4a
C:\Users\BGC6u8Oy yXGxkR\Music\Cg5GLd.mp3
C:\Users\BGC6u8Oy yXGxkR\Music\DEz 5Miyc1_.m4a
C:\Users\BGC6u8Oy yXGxkR\Music\DNY2rJpvX_3l_-EjtA74.wav
C:\Users\BGC6u8Oy yXGxkR\Music\EAuuzOeW5DwQf4ze.wav
C:\Users\BGC6u8Oy yXGxkR\Music\HF7Neb.wav
C:\Users\BGC6u8Oy yXGxkR\Music\I9XdRazR.mp3
C:\Users\BGC6u8Oy yXGxkR\Music\KjV0Ved1xl6.wav
C:\Users\BGC6u8Oy yXGxkR\Music\Ksqx45.m4a
C:\Users\BGC6u8Oy yXGxkR\Music\MA79pk9srv2uCK.wav
C:\Users\BGC6u8Oy yXGxkR\Music\NxzZnS7GqpTG1miTv.mp3
C:\Users\BGC6u8Oy yXGxkR\Music\U7Id3oOiKKwsMae.wav
C:\Users\BGC6u8Oy yXGxkR\Music\WMTZ9Nr.m4a
C:\Users\BGC6u8Oy yXGxkR\Music\Wpx_-MizmtC.m4a
C:\Users\BGC6u8Oy yXGxkR\Music\b2QegzRnq1AJbQuXK.mp3
C:\Users\BGC6u8Oy yXGxkR\Music\bK7uZctt.mp3
C:\Users\BGC6u8Oy yXGxkR\Music\cHhcGpcnEr_ixewcDp.mp3
C:\Users\BGC6u8Oy yXGxkR\Music\eM1oppFj3.mp3
C:\Users\BGC6u8Oy yXGxkR\Music\gRxzAD2_ZzZw_4bHo.m4a
C:\Users\BGC6u8Oy yXGxkR\Music\ie9yU0St.wav
C:\Users\BGC6u8Oy yXGxkR\Music\lBTyMmK7h_sOnV_hcZj.wav
C:\Users\BGC6u8Oy yXGxkR\Music\mFMVML.m4a
C:\Users\BGC6u8Oy yXGxkR\Music\nUf7BNaS8zfQ.mp3
C:\Users\BGC6u8Oy yXGxkR\Music\szR0NLvy.wav
C:\Users\BGC6u8Oy yXGxkR\Music\tranZH9XbB70sK.mp3
C:\Users\BGC6u8Oy yXGxkR\Music\tv8GyGgLhzaeas.wav
C:\Users\BGC6u8Oy yXGxkR\Music\w13NfE.m4a
C:\Users\BGC6u8Oy yXGxkR\Music\yYdVuJd7.m4a
C:\Users\BGC6u8Oy yXGxkR\Music\zVt2n4q.m4a
C:\Users\BGC6u8Oy yXGxkR\Music\zuiocEn1lujxFwT3a.mp3
C:\Users\BGC6u8Oy yXGxkR\Music\zxW_yGnylyyrirpiY7HU.mp3
C:\Users\BGC6u8Oy yXGxkR\Pictures\8fz94.jpg
C:\Users\BGC6u8Oy yXGxkR\Pictures\RwbU-pkPRwix-G.bmp
C:\Users\BGC6u8Oy yXGxkR\Pictures\Yu3ybeS56btEZ.bmp
C:\Users\BGC6u8Oy yXGxkR\Pictures\c- MO5wAF.png
C:\Users\BGC6u8Oy yXGxkR\Pictures\eog6Nsg Yie.jpg
C:\Users\BGC6u8Oy yXGxkR\Pictures\qPUMcKrym4sIDD1Qv-.jpg
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\I_YHQd_3g399z GcF.png
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\LLyYBqvdg3D.bmp
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\SJvY2u.jpg
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\UXcd_C2_Lizw
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\UXcd_C2_Lizw\1bEcBonVxA9-v.gif
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\UXcd_C2_Lizw\4F2IOo_KxpT0_38AI7K.gif
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\UXcd_C2_Lizw\JbrE1Md5wN2gMAyKxKm
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\UXcd_C2_Lizw\JbrE1Md5wN2gMAyKxKm\3eh5WPv.png
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\UXcd_C2_Lizw\JbrE1Md5wN2gMAyKxKm\5pmKphiIM3D.png
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\UXcd_C2_Lizw\JbrE1Md5wN2gMAyKxKm\a3kGuIApYVISv.jpg
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\UXcd_C2_Lizw\JbrE1Md5wN2gMAyKxKm\bqRnsm
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\UXcd_C2_Lizw\JbrE1Md5wN2gMAyKxKm\bqRnsm\8pViAbhQe.jpg
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\UXcd_C2_Lizw\JbrE1Md5wN2gMAyKxKm\bqRnsm\RtdDUh1n.bmp
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\UXcd_C2_Lizw\JbrE1Md5wN2gMAyKxKm\bqRnsm\poGxPmIrwgWCuXE-0.gif
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\UXcd_C2_Lizw\JbrE1Md5wN2gMAyKxKm\bqRnsm\wk3PQfmV_BoPl.bmp
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\UXcd_C2_Lizw\JbrE1Md5wN2gMAyKxKm\lFjjfAR.bmp
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\UXcd_C2_Lizw\JbrE1Md5wN2gMAyKxKm\pdJRajA.png
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\UXcd_C2_Lizw\PY8agIkGs0 J.gif
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\UXcd_C2_Lizw\iK5 MZ3GGNSaYfTNdpA.png
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\UXcd_C2_Lizw\wGwq9RKc2Mj.bmp
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\YRMsevU1d0 VOH
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\YRMsevU1d0 VOH\-2HLH ZDh5k.png
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\YRMsevU1d0 VOH\5EdZ.png
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\YRMsevU1d0 VOH\FaRtGo7YNE6P5C1p.bmp
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\YRMsevU1d0 VOH\OiBIm1IbAtMwfWJq.bmp
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\YRMsevU1d0 VOH\_NLIkDk-.gif
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\YRMsevU1d0 VOH\aVKIqCh.png
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\YRMsevU1d0 VOH\zqpRizlN8PzGdxdZr0sR.gif
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\kiDWvQoqJwtLb_pMj6BO.png
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\mc F0Cl
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\mc F0Cl\HnStkWkb.png
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\mc F0Cl\IVNrt8M-FDxP.jpg
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\mc F0Cl\aCnHCu.png
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\mc F0Cl\hGm6bE4frYG9BNc.gif
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\mc F0Cl\h_n0FIQcsMc.bmp
C:\Users\BGC6u8Oy yXGxkR\Pictures\uFu1 yHxHR8\mc F0Cl\kxn-9PASQBDfZ.jpg
C:\Users\BGC6u8Oy yXGxkR\Pictures\vS4miOCr95H5_CjqE4T.png
C:\Users\BGC6u8Oy yXGxkR\Videos\6b3zm.mp4
C:\Users\BGC6u8Oy yXGxkR\Videos\DzraZ-OUpvQ-UWtJZhWO
C:\Users\BGC6u8Oy yXGxkR\Videos\DzraZ-OUpvQ-UWtJZhWO\2rlCygwrud-RVUg5xU.swf
C:\Users\BGC6u8Oy yXGxkR\Videos\DzraZ-OUpvQ-UWtJZhWO\B7vIktBUxNMkm.swf
C:\Users\BGC6u8Oy yXGxkR\Videos\DzraZ-OUpvQ-UWtJZhWO\FIzOSU X-6x.mp4
C:\Users\BGC6u8Oy yXGxkR\Videos\DzraZ-OUpvQ-UWtJZhWO\kUzGHXZNOaf.swf
C:\Users\BGC6u8Oy yXGxkR\Videos\DzraZ-OUpvQ-UWtJZhWO\qGvUvp_AqDkMQPE.swf
C:\Users\BGC6u8Oy yXGxkR\Videos\DzraZ-OUpvQ-UWtJZhWO\qPNHJJEyW-jUDFAHERX.avi
C:\Users\BGC6u8Oy yXGxkR\Videos\Ge_9iRSWHSKCiI.mkv
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\3UTZkWr.flv
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\VHrUlONK_qISUREXo9LE.mkv
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\fyxqWAq8nC9xe0FS3.flv
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\3jakvvhDL2.swf
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\3p6OyhiUkLyFfBk8bR W.flv
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\3sud8mQoRaWTUJII5MvG.mkv
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\Oi-6JFGZ.flv
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\PF27NTz.avi
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\WlXP3InQMU
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\WlXP3InQMU\1y6myVEv49jTN1T.flv
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\WlXP3InQMU\2GxctEriGlfUx4Z32Reb.mp4
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\WlXP3InQMU\4--ag1ar0yh.avi
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\WlXP3InQMU\KgPsq6BtJ7zC.flv
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\WlXP3InQMU\LbY C9NrlEFiQ.flv
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\WlXP3InQMU\PvCe6Q0NhgHF.swf
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\WlXP3InQMU\Sj5zxhknr.avi
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\WlXP3InQMU\f18N6X2.avi
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\WlXP3InQMU\iwIbB82HYi.mp4
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\WlXP3InQMU\iwmw63o6F0bGvsFXm2x2.avi
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\YYWl3LM dtf_e.mp4
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\flA_tCrHPQE.avi
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\inabUbywyMoy.swf
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\jr7YrHy.mkv
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\romaxc8blBiJCH_Cmy\wgWPDYMKIub.mp4
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\sU7kG.swf
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\uIXTj3y.mp4
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\yawK.mkv
C:\Users\BGC6u8Oy yXGxkR\Videos\NDS89K3_YGFKeb\z0sN.flv
C:\Users\BGC6u8Oy yXGxkR\Videos\rWYeffac.mkv
C:\Users\BGC6u8Oy yXGxkR\Videos\uuMPvqD5.avi
C:\Users\BGC6u8Oy yXGxkR\Videos\wo2Egqa.swf

Notifications (1/1)

Virtual Machine Information

System Information

Software Information

Randomly Created Artifacts

Before

After