VTI SCORE: 100/100
Dynamic Analysis Report |
Classification: Ransomware, Wiper |
hgaibc.exe
Windows Exe (x86-32)
Created at 2019-05-05T21:59:00
Virtual Machine Information
Name | win10_64_rs2 |
Description | - |
Architecture | x86 64-bit |
Operating System | Windows 10 Redstone 2 |
Kernel Version | 10.0.15063.540 (f6f48955-5489-4b24-b4df-942361f0730d) |
Network Scheme Name | Local Gateway |
Network Config Name | Local Gateway |
Analyzer Information
Analyzer Version | 3.0.2 |
Dynamic Engine Version | 3.0.2 / 2019-05-03 14:51 (UTC+2) |
Static Engine Version | 1.1.1 / 2019-05-03 14:52 (UTC+2) |
Local AV Version | AVCORE v2.1 Linux/x86_64 11.0.1.18 (Aug 9, 2017) |
Local AV Database Update Release Date | 2019-05-05 22:38 (UTC+2) |
VTI Ruleset Version | 3.3 |
YARA Built-in Ruleset Version | 1.2 |
Analysis Report Layout Version | 4 |
System Information
Computer Name | NQDPDE |
User Domain | NQDPDE |
User Name | FD1HVy |
User Profile | C:\Users\FD1HVy |
Temp Directory | C:\Users\FD1HVy\AppData\Local\Temp |
System Root | C:\WINDOWS |
Sample Directory | C:\Users\FD1HVy\Desktop |
Software Information
Adobe Acrobat Reader Version | 18.009.20050 |
Internet Explorer Version | 11.540.15063.0 |
Chrome Version | 61.0.3163.79 |
Firefox Version | 55.0.3 |
Flash Version | 25.0.0.148 |
Java Version | 8.0.1440.1 |
.NET Version | 4.7.02046 |
Powershell Version | 5.1.15063.0 |
Microsoft Office | 2016 |
Microsoft Office Version | 16.0.4266.1003 |
Microsoft Project Version | 16.0.4266.1003 |
Microsoft Visio Version | 16.0.4266.1003 |
Randomly Created Artifacts
This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.
Processes (22)
»
Filename | PID | GUI |
---|---|---|
C:\Program Files (x86)\Adobe\arbor-tutorials-lawyers.exe | #2916 | |
C:\Program Files (x86)\Adobe\dim-hindu-customize.exe | #2924 | |
C:\Program Files (x86)\Common Files\organization.exe | #1980 | |
C:\Program Files (x86)\Common Files\printersaerospace.exe | #3428 | |
C:\Program Files (x86)\Internet Explorer\defeat preston.exe | #1264 | |
C:\Program Files (x86)\Mozilla Maintenance Service\joke.exe | #96 | |
C:\Program Files (x86)\Reference Assemblies\defects_burning_rank.exe | #3444 | |
C:\Program Files (x86)\Windows Defender\chubby-er.exe | #1212 | |
C:\Program Files (x86)\Windows Defender\tank attacks.exe | #1924 | |
C:\Program Files (x86)\Windows Mail\elementary-east-examined.exe | #1620 | |
C:\Program Files (x86)\Windows NT\member.exe | #1252 | |
C:\Program Files (x86)\Windows Sidebar\values.exe | #3404 | |
C:\Program Files (x86)\Windows Sidebar\xml upper.exe | #1192 | |
C:\Program Files\Internet Explorer\spray-roman.exe | #3300 | |
C:\Program Files\MSBuild\rebel.exe | #3520 | |
C:\Program Files\Mozilla Firefox\citizenship_surfaces_neil.exe | #3312 | |
C:\Program Files\Windows Mail\rebecca mid developer.exe | #3412 | |
C:\Program Files\Windows Media Player\wires jacket.exe | #3384 | |
C:\Program Files\Windows Multimedia Platform\screensaver.exe | #1208 | |
C:\Program Files\Windows Portable Devices\boss isolated.exe | #876 | |
C:\Program Files\Windows Portable Devices\documents.exe | #3548 | |
C:\Program Files\Windows Sidebar\forgotten awareness anymore.exe | #2532 |
Files (291)
»
Filename |
---|
C:\Users\FD1HVy\AppData\Local\Temp\-llFgZK2OqiB6E M.pptx |
C:\Users\FD1HVy\AppData\Local\Temp\3Td5Aw ml7HUZ9.jpg |
C:\Users\FD1HVy\AppData\Local\Temp\5Gm9R MYe.avi |
C:\Users\FD1HVy\AppData\Local\Temp\64_1zYz3Nh.xls |
C:\Users\FD1HVy\AppData\Local\Temp\6EN7m.png |
C:\Users\FD1HVy\AppData\Local\Temp\6NoT2U06M LTI6rO.mp3 |
C:\Users\FD1HVy\AppData\Local\Temp\7uj-NGa.gif |
C:\Users\FD1HVy\AppData\Local\Temp\As_jNMAE.png |
C:\Users\FD1HVy\AppData\Local\Temp\Ehju6yL0fdW1.mkv |
C:\Users\FD1HVy\AppData\Local\Temp\EkXLu.mp3 |
C:\Users\FD1HVy\AppData\Local\Temp\FOK007JV13rMIq.gif |
C:\Users\FD1HVy\AppData\Local\Temp\JtkfwIawINruF17et5H.mkv |
C:\Users\FD1HVy\AppData\Local\Temp\K9t3xjvQKnb2oZrUKQrY.m4a |
C:\Users\FD1HVy\AppData\Local\Temp\KAjHu4W_l.flv |
C:\Users\FD1HVy\AppData\Local\Temp\LYOdVXlg.jpg |
C:\Users\FD1HVy\AppData\Local\Temp\Li-g4VOFWDp8g7niv9.jpg |
C:\Users\FD1HVy\AppData\Local\Temp\O_Ky9iQse.swf |
C:\Users\FD1HVy\AppData\Local\Temp\ctEm610960sxP.flv |
C:\Users\FD1HVy\AppData\Local\Temp\jKETNBtMRe3w 3Dwe_.ots |
C:\Users\FD1HVy\AppData\Local\Temp\jf6a.png |
C:\Users\FD1HVy\AppData\Local\Temp\jl5uy1rODILsjK7vbt.bmp |
C:\Users\FD1HVy\AppData\Local\Temp\l8oVlyfy7bVcXQZ2QU.bmp |
C:\Users\FD1HVy\AppData\Local\Temp\lC-l4B_q.jpg |
C:\Users\FD1HVy\AppData\Local\Temp\lPTd28tDw2f3QW.mp3 |
C:\Users\FD1HVy\AppData\Local\Temp\laNqkGG.mkv |
C:\Users\FD1HVy\AppData\Local\Temp\nsa7A.mp4 |
C:\Users\FD1HVy\AppData\Local\Temp\qTilMNXRql.mkv |
C:\Users\FD1HVy\AppData\Local\Temp\vUf1NmsXJ7d.doc |
C:\Users\FD1HVy\AppData\Local\Temp\ypzULzChN eXCkymRF.rtf |
C:\Users\FD1HVy\AppData\Local\Temp\zXKf90LZc29txevBEZ.bmp |
C:\Users\FD1HVy\AppData\Roaming\1MFseRii.ppt |
C:\Users\FD1HVy\AppData\Roaming\7qI9o6PR_zE6k-q.png |
C:\Users\FD1HVy\AppData\Roaming\ASZz7.avi |
C:\Users\FD1HVy\AppData\Roaming\BQGh6DHzYIK.jpg |
C:\Users\FD1HVy\AppData\Roaming\Bc5YpEviEoiFxL.jpg |
C:\Users\FD1HVy\AppData\Roaming\BlEjvu.csv |
C:\Users\FD1HVy\AppData\Roaming\CcvQ3govRTeIqe.wav |
C:\Users\FD1HVy\AppData\Roaming\FgH AVD wU.mp3 |
C:\Users\FD1HVy\AppData\Roaming\QoBsAwBcz1I3--FnMx2.avi |
C:\Users\FD1HVy\AppData\Roaming\RuL2.mkv |
C:\Users\FD1HVy\AppData\Roaming\U70Ju4pJNHEbG9.mkv |
C:\Users\FD1HVy\AppData\Roaming\Uj7eN6FvtZ.ppt |
C:\Users\FD1HVy\AppData\Roaming\V2dI.mp3 |
C:\Users\FD1HVy\AppData\Roaming\VyzV2rbr7jSOoJFI.bmp |
C:\Users\FD1HVy\AppData\Roaming\W9a4yixiQKv_8YC.bmp |
C:\Users\FD1HVy\AppData\Roaming\XhrUPtxgHBWcXcI.xlsx |
C:\Users\FD1HVy\AppData\Roaming\YfW6.mp3 |
C:\Users\FD1HVy\AppData\Roaming\_0W_bnTrHi.bmp |
C:\Users\FD1HVy\AppData\Roaming\_7Wu4iA-Jooive.avi |
C:\Users\FD1HVy\AppData\Roaming\_WCM_B520ZOIv.mp3 |
C:\Users\FD1HVy\AppData\Roaming\b0xFh6nd.mkv |
C:\Users\FD1HVy\AppData\Roaming\hScSw4P1Qo6t_9Er5hp.jpg |
C:\Users\FD1HVy\AppData\Roaming\kthzptQ6.m4a |
C:\Users\FD1HVy\AppData\Roaming\m1XExsQToItjJ.pps |
C:\Users\FD1HVy\AppData\Roaming\mIw3K3vTBQs.m4a |
C:\Users\FD1HVy\AppData\Roaming\nr7n4Q0oWGDPFrlt.ods |
C:\Users\FD1HVy\AppData\Roaming\oE6unr_7Q.avi |
C:\Users\FD1HVy\AppData\Roaming\oLgIaaX.swf |
C:\Users\FD1HVy\AppData\Roaming\pmMzUy5m5gSuib5.m4a |
C:\Users\FD1HVy\AppData\Roaming\pudrPH5vOL9bLf7.bmp |
C:\Users\FD1HVy\AppData\Roaming\qX9TEsJap.mp3 |
C:\Users\FD1HVy\AppData\Roaming\rCFzoPcoH.xls |
C:\Users\FD1HVy\AppData\Roaming\rbN.ots |
C:\Users\FD1HVy\AppData\Roaming\sxjNjUacjwQ US.mp3 |
C:\Users\FD1HVy\AppData\Roaming\zs5lLuvDbUOV3G.gif |
C:\Users\FD1HVy\Desktop\-eoWTme.jpg |
C:\Users\FD1HVy\Desktop\1U2yXo-1qwAVW0SbBsud.mp4 |
C:\Users\FD1HVy\Desktop\5oTg6gjzzr tao.bmp |
C:\Users\FD1HVy\Desktop\6NaVx05kO1hiX.gif |
C:\Users\FD1HVy\Desktop\7A7kEPOQa35k.mkv |
C:\Users\FD1HVy\Desktop\B8xcg0iH1pLdhKM.flv |
C:\Users\FD1HVy\Desktop\C6Zw8Xyvk4gZU7S.m4a |
C:\Users\FD1HVy\Desktop\Dr0woDkQLDaVY DaPkX.ots |
C:\Users\FD1HVy\Desktop\FZ oAb84fyzCu.swf |
C:\Users\FD1HVy\Desktop\KUo-ZMFUgk0n_XQD.png |
C:\Users\FD1HVy\Desktop\Owo3ippbDO.flv |
C:\Users\FD1HVy\Desktop\Q1e3zR-Yt0GC8qVYPvK.mp3 |
C:\Users\FD1HVy\Desktop\S2N_f.swf |
C:\Users\FD1HVy\Desktop\SHq2V.wav |
C:\Users\FD1HVy\Desktop\SZiyQp.mp3 |
C:\Users\FD1HVy\Desktop\WWswnzV.gif |
C:\Users\FD1HVy\Desktop\Z9CnzxP.m4a |
C:\Users\FD1HVy\Desktop\_EAL2z.jpg |
C:\Users\FD1HVy\Desktop\cp16y1L9MP_00dqS1P.mkv |
C:\Users\FD1HVy\Desktop\g5bx.mkv |
C:\Users\FD1HVy\Desktop\heZpshyD.mp4 |
C:\Users\FD1HVy\Desktop\ib2pf |
C:\Users\FD1HVy\Desktop\ib2pf\5VlG1snlX9ZlM-S.wav |
C:\Users\FD1HVy\Desktop\ib2pf\N6fvhxJWlAtyTy2K.swf |
C:\Users\FD1HVy\Desktop\ib2pf\SIx9Qv6o7OGp7w4S.png |
C:\Users\FD1HVy\Desktop\ib2pf\X lSgQOpnQCOf0.mp4 |
C:\Users\FD1HVy\Desktop\ib2pf\cp5rk.jpg |
C:\Users\FD1HVy\Desktop\ib2pf\d1P2ThuYpFjV.mkv |
C:\Users\FD1HVy\Desktop\ib2pf\dmjCZe7.swf |
C:\Users\FD1HVy\Desktop\ib2pf\neX-SE5e_9.swf |
C:\Users\FD1HVy\Desktop\ib2pf\rJMczWwID.gif |
C:\Users\FD1HVy\Desktop\ib2pf\vmaMzW02aPkoS.m4a |
C:\Users\FD1HVy\Desktop\jicCAmB9N.bmp |
C:\Users\FD1HVy\Desktop\klbIVXy.bmp |
C:\Users\FD1HVy\Desktop\l-rxVxg4kfYpdUzV1kB.png |
C:\Users\FD1HVy\Desktop\lLGtunE.flv |
C:\Users\FD1HVy\Desktop\nye4h.jpg |
C:\Users\FD1HVy\Desktop\pR0mwkqVm65.png |
C:\Users\FD1HVy\Desktop\pZ_zrnOgxFd__.ppt |
C:\Users\FD1HVy\Desktop\qjx0Hr2rDI.jpg |
C:\Users\FD1HVy\Desktop\v6yV.mp3 |
C:\Users\FD1HVy\Desktop\xGEniA42OB8MJhdj9d.xlsx |
C:\Users\FD1HVy\Desktop\xxtv0Sl PtIBDrOhgI5I.bmp |
C:\Users\FD1HVy\Desktop\zFD-kBACLGdKyA.xls |
C:\Users\FD1HVy\Desktop\zxEt1Ugl0ZjAqw.mp3 |
C:\Users\FD1HVy\Documents\3sI4.docx |
C:\Users\FD1HVy\Documents\7PcbmBKQqIW5Sfyc_.pdf |
C:\Users\FD1HVy\Documents\Fyb9nqjIYZ4 L4G.xlsx |
C:\Users\FD1HVy\Documents\HRRkyIR.doc |
C:\Users\FD1HVy\Documents\IxajpFOn.docx |
C:\Users\FD1HVy\Documents\KLzIYErk.pptx |
C:\Users\FD1HVy\Documents\KiGO.docx |
C:\Users\FD1HVy\Documents\Nec1dvug.xlsx |
C:\Users\FD1HVy\Documents\PCB_hgitEcJFI.pps |
C:\Users\FD1HVy\Documents\Tpy _ArlWeVt6kzfj.ods |
C:\Users\FD1HVy\Documents\VuGu6g7A.pptx |
C:\Users\FD1HVy\Documents\YYYvTV.docx |
C:\Users\FD1HVy\Documents\_oyKn36v.xlsx |
C:\Users\FD1HVy\Documents\bzmq-.xlsx |
C:\Users\FD1HVy\Documents\kVY34jFnd I9sLNhs.pptx |
C:\Users\FD1HVy\Documents\lggO7SPQsjZrs4Fxd.docx |
C:\Users\FD1HVy\Documents\lwyiW.xlsx |
C:\Users\FD1HVy\Documents\m3fqgaWxOKjQGfct9pp.ots |
C:\Users\FD1HVy\Documents\nB2A36pDrk7TpVim.pptx |
C:\Users\FD1HVy\Documents\qn64QAS.ods |
C:\Users\FD1HVy\Documents\rcHeSKjUPAQVTE7P8.pptx |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\47ce0s1bG5qRg |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\47ce0s1bG5qRg\8F82XzpprIhm7y.ots |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\47ce0s1bG5qRg\BI1ybsG2D6ON |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\47ce0s1bG5qRg\BI1ybsG2D6ON\EqTfvi3xol |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\47ce0s1bG5qRg\BI1ybsG2D6ON\EqTfvi3xol\7Jud22AsSn1.xlsx |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\47ce0s1bG5qRg\BI1ybsG2D6ON\EqTfvi3xol\8qfdWiUlWKtsOqPZ82V.ots |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\47ce0s1bG5qRg\BI1ybsG2D6ON\EqTfvi3xol\CMlUFJkP1.rtf |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\47ce0s1bG5qRg\BI1ybsG2D6ON\EqTfvi3xol\IWNtXUHi0j.ods |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\47ce0s1bG5qRg\BI1ybsG2D6ON\EqTfvi3xol\M6o0Jtqxrl91K |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\47ce0s1bG5qRg\BI1ybsG2D6ON\EqTfvi3xol\M6o0Jtqxrl91K\BM31Gp.pps |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\47ce0s1bG5qRg\BI1ybsG2D6ON\EqTfvi3xol\M6o0Jtqxrl91K\J sG-BHmst1okX6gjWKU.pps |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\47ce0s1bG5qRg\BI1ybsG2D6ON\EqTfvi3xol\M6o0Jtqxrl91K\L3_2.pptx |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\47ce0s1bG5qRg\BI1ybsG2D6ON\Z2Apz2KY50Ov9Zsapu.pdf |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\47ce0s1bG5qRg\BI1ybsG2D6ON\osGsIO50GeOzRr-.xls |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\47ce0s1bG5qRg\_AgJ9kWVAN.odp |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\564KaLvvQ4wQidZ.docx |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\5b IWfdXc |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\5b IWfdXc\5TbUatrd6iXuftM.odp |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\5b IWfdXc\73YagV97l5A3cB_V |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\5b IWfdXc\73YagV97l5A3cB_V\EkqBRuPs9Yx_Q.ppt |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\5b IWfdXc\73YagV97l5A3cB_V\TFmzYODx.ods |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\5b IWfdXc\73YagV97l5A3cB_V\pijiTvLt4IQ54oE.pptx |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\5b IWfdXc\BBXdv_r.rtf |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\5b IWfdXc\kfDqBGBEpFK0R7dw.pptx |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\AKync0yykTY1oQeuw87.doc |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\IqkVsbaSNQH-S6NhT3R.pps |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\Mc q0OKjhB6-vJee |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\Mc q0OKjhB6-vJee\IzRtQa4Ka.ots |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\Mc q0OKjhB6-vJee\Mt9-HjMACobp.docx |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\Mc q0OKjhB6-vJee\jMPkdjKM6.ots |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\Mc q0OKjhB6-vJee\nIuy4CFqNkXBldyUu.odp |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\Mc q0OKjhB6-vJee\x9O35LIRx-.xlsx |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\WIfD7-33CDyqv.odt |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\dWNIVHeX |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\dWNIVHeX\1FXhhM_kbfwzWz9EQzQQ.pps |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\dWNIVHeX\5vcXdY0O.odp |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\dWNIVHeX\CYlb9.pps |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\dWNIVHeX\nnRH91t.doc |
C:\Users\FD1HVy\Documents\utr-BHPccL8ABzOLIpW\vOAZMQPcX0wL3p.ppt |
C:\Users\FD1HVy\Documents\waa7O_vHuhnySpK.pptx |
C:\Users\FD1HVy\Music\69xODN |
C:\Users\FD1HVy\Music\69xODN\1-bjT CeSWYQ74P |
C:\Users\FD1HVy\Music\69xODN\1-bjT CeSWYQ74P\B4JDRFQwwiectXb |
C:\Users\FD1HVy\Music\69xODN\1-bjT CeSWYQ74P\B4JDRFQwwiectXb\21m-KWZEYdd5.mp3 |
C:\Users\FD1HVy\Music\69xODN\1-bjT CeSWYQ74P\B4JDRFQwwiectXb\5_yFMiWeqG5GM-6ot0.m4a |
C:\Users\FD1HVy\Music\69xODN\1-bjT CeSWYQ74P\B4JDRFQwwiectXb\6L6d2fDpGvPo3.wav |
C:\Users\FD1HVy\Music\69xODN\1-bjT CeSWYQ74P\B4JDRFQwwiectXb\JY7rhctlt9ZuSyGwEe.mp3 |
C:\Users\FD1HVy\Music\69xODN\1-bjT CeSWYQ74P\G ZStKFFfgB_Zam.mp3 |
C:\Users\FD1HVy\Music\69xODN\1-bjT CeSWYQ74P\M1oGO.mp3 |
C:\Users\FD1HVy\Music\69xODN\1-bjT CeSWYQ74P\aVBbBs9uxpAT7ZyZ.mp3 |
C:\Users\FD1HVy\Music\69xODN\1-bjT CeSWYQ74P\gC0Imvjug.wav |
C:\Users\FD1HVy\Music\69xODN\1-bjT CeSWYQ74P\uCrhf.mp3 |
C:\Users\FD1HVy\Music\69xODN\1-bjT CeSWYQ74P\xyvniTzmuiqEIzn.wav |
C:\Users\FD1HVy\Music\69xODN\Ai-L_ |
C:\Users\FD1HVy\Music\69xODN\Ai-L_\8-0K9p6S1F.mp3 |
C:\Users\FD1HVy\Music\69xODN\Ai-L_\NrTVfYI.m4a |
C:\Users\FD1HVy\Music\69xODN\Ai-L_\dGdrS.m4a |
C:\Users\FD1HVy\Music\69xODN\Ai-L_\dOZiVv.wav |
C:\Users\FD1HVy\Music\69xODN\kdwn_OkVNtV |
C:\Users\FD1HVy\Music\69xODN\kdwn_OkVNtV\4RTqTSvg N.mp3 |
C:\Users\FD1HVy\Music\69xODN\kdwn_OkVNtV\5KXWKt4.m4a |
C:\Users\FD1HVy\Music\69xODN\kdwn_OkVNtV\vhCykLdE.m4a |
C:\Users\FD1HVy\Music\69xODN\kdwn_OkVNtV\y1PQNy0cf.m4a |
C:\Users\FD1HVy\Music\8ldq8XE.mp3 |
C:\Users\FD1HVy\Music\B4xL |
C:\Users\FD1HVy\Music\B4xL\J8fIWq6fmJ.m4a |
C:\Users\FD1HVy\Music\B4xL\WfiQhgyYxFzMeVRgs5wk.m4a |
C:\Users\FD1HVy\Music\B4xL\XUPqhxdwl3OLDC0GY |
C:\Users\FD1HVy\Music\B4xL\XUPqhxdwl3OLDC0GY\7p14znI7 |
C:\Users\FD1HVy\Music\B4xL\XUPqhxdwl3OLDC0GY\7p14znI7\6AF1V0FY.m4a |
C:\Users\FD1HVy\Music\B4xL\XUPqhxdwl3OLDC0GY\7p14znI7\LdHoIkfY3E.m4a |
C:\Users\FD1HVy\Music\B4xL\XUPqhxdwl3OLDC0GY\7p14znI7\aErG.wav |
C:\Users\FD1HVy\Music\B4xL\XUPqhxdwl3OLDC0GY\7p14znI7\iBVxQmuQMsAlTTCp.m4a |
C:\Users\FD1HVy\Music\B4xL\XUPqhxdwl3OLDC0GY\7p14znI7\x8uYHS zqPxBBeeqF.wav |
C:\Users\FD1HVy\Music\B4xL\XUPqhxdwl3OLDC0GY\7p14znI7\y2F T5h8NHOBO1gC.wav |
C:\Users\FD1HVy\Music\B4xL\XUPqhxdwl3OLDC0GY\FsLM-sv0jZiLPZDp.mp3 |
C:\Users\FD1HVy\Music\B4xL\XUPqhxdwl3OLDC0GY\LsYqwJHo.m4a |
C:\Users\FD1HVy\Music\B4xL\XUPqhxdwl3OLDC0GY\RujCAVp6J7_.wav |
C:\Users\FD1HVy\Music\B4xL\XUPqhxdwl3OLDC0GY\bgDyf1RyDJ2Ap.mp3 |
C:\Users\FD1HVy\Music\B4xL\XUPqhxdwl3OLDC0GY\bxfWX1S_qC.mp3 |
C:\Users\FD1HVy\Music\B4xL\XUPqhxdwl3OLDC0GY\zNmxS09x3.mp3 |
C:\Users\FD1HVy\Music\B4xL\se9_O9Zhf9wYWFe1i-A.m4a |
C:\Users\FD1HVy\Music\B4xL\xGuuNaQovm.mp3 |
C:\Users\FD1HVy\Music\TamDP39HJ6Gv.wav |
C:\Users\FD1HVy\Music\_PnMGPdkQVzD9SwDsLSi |
C:\Users\FD1HVy\Music\_PnMGPdkQVzD9SwDsLSi\SQqiYyj_KJFwF.m4a |
C:\Users\FD1HVy\Music\nFyM-k1.mp3 |
C:\Users\FD1HVy\Pictures\0DA-GbTL8y6COdCgv.jpg |
C:\Users\FD1HVy\Pictures\4fisaeIZCqQV4Y58Y6vH.bmp |
C:\Users\FD1HVy\Pictures\4pxXs UlJSwKREQjp.bmp |
C:\Users\FD1HVy\Pictures\57aG2iR4uZI.png |
C:\Users\FD1HVy\Pictures\5aDztGTPadyZ8kE0.png |
C:\Users\FD1HVy\Pictures\5szt6N.gif |
C:\Users\FD1HVy\Pictures\7PjnlLHL6W74zfL.jpg |
C:\Users\FD1HVy\Pictures\9Z2HL.gif |
C:\Users\FD1HVy\Pictures\FHPPLTbxVMw8EuE.gif |
C:\Users\FD1HVy\Pictures\GF153Pi3Sb58mvwO7.png |
C:\Users\FD1HVy\Pictures\GmGjiFXLRX XH4.jpg |
C:\Users\FD1HVy\Pictures\KeUlF8aqoy4qSjL2lx.gif |
C:\Users\FD1HVy\Pictures\L-qd0KRJxi WDNd.png |
C:\Users\FD1HVy\Pictures\M_J9bKvlKXvat5IkDX.png |
C:\Users\FD1HVy\Pictures\RKRiqE6q.gif |
C:\Users\FD1HVy\Pictures\SZTkJUl.jpg |
C:\Users\FD1HVy\Pictures\VEEAujpJK1I.gif |
C:\Users\FD1HVy\Pictures\WML2PR-d.gif |
C:\Users\FD1HVy\Pictures\WpkhwWipe.jpg |
C:\Users\FD1HVy\Pictures\_sjgmT1ln.jpg |
C:\Users\FD1HVy\Pictures\aiYk6.gif |
C:\Users\FD1HVy\Pictures\bLnn71.png |
C:\Users\FD1HVy\Pictures\fdzUMD.png |
C:\Users\FD1HVy\Pictures\g6GIodasdZsudT.gif |
C:\Users\FD1HVy\Pictures\iagHz4OVxdtzpAn-V.png |
C:\Users\FD1HVy\Pictures\jBVbya84d4U9uSNV-ZrI.jpg |
C:\Users\FD1HVy\Pictures\jcP1NV6LTEq.png |
C:\Users\FD1HVy\Pictures\m4lhEAHvLMmYRu1N2Tcx.bmp |
C:\Users\FD1HVy\Pictures\mS45m.gif |
C:\Users\FD1HVy\Pictures\niE wUHmZkN.bmp |
C:\Users\FD1HVy\Pictures\oNo3VnqUPTrmaRYi.bmp |
C:\Users\FD1HVy\Pictures\q3mq.gif |
C:\Users\FD1HVy\Pictures\t yEKfr_MQ9a77ybC.png |
C:\Users\FD1HVy\Pictures\vPskRV geXGqJVyEet.png |
C:\Users\FD1HVy\Pictures\wZfX_NhZqo59I.png |
C:\Users\FD1HVy\Pictures\x8fp.png |
C:\Users\FD1HVy\Pictures\xO49e.gif |
C:\Users\FD1HVy\Pictures\xeZD1aqTFwlkiNb3.gif |
C:\Users\FD1HVy\Videos\3 usoqBQv4ImdZT2.swf |
C:\Users\FD1HVy\Videos\F6isENig1xlYu |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\iVIOe_aAyO10gWocK.swf |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\ojZbnTmW.mp4 |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\AJN0GRAxKKbZ_aw7.flv |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\AzC_uJHv03.flv |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\TqO59z72MwTtUP.mkv |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\iHelhg_RGCAjJRSUh.swf |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\jWN3SUlp0gIrNDp3a.mp4 |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\q2_Tmn_qfGc7 |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\q2_Tmn_qfGc7\2uCDNzAoV6g6Qf.flv |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\q2_Tmn_qfGc7\YpdiGJI2QC |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\q2_Tmn_qfGc7\YpdiGJI2QC\8KHyk-n.swf |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\q2_Tmn_qfGc7\YpdiGJI2QC\Dya1e3EArP4uE.mkv |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\q2_Tmn_qfGc7\YpdiGJI2QC\EweWWwwObzcFB0P.mkv |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\q2_Tmn_qfGc7\YpdiGJI2QC\VoIDn-9iu-1B2597d.avi |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\q2_Tmn_qfGc7\YpdiGJI2QC\Xg9 V-C5iiN.mkv |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\q2_Tmn_qfGc7\YpdiGJI2QC\e35_5WwmsT.avi |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\q2_Tmn_qfGc7\YpdiGJI2QC\zeazxu_fT9.mp4 |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\q2_Tmn_qfGc7\eQP E2ff0TVr2M2T.avi |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\q2_Tmn_qfGc7\uKGZjMwlv0pQgc8.mkv |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\q2_Tmn_qfGc7\xcAm.mkv |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\sMPMTzl |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\sMPMTzl\-VGRo2KzTS360oSn.mkv |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\sMPMTzl\0Qk9Rwxzzxk5aG.swf |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\sMPMTzl\55S23Z |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\sMPMTzl\55S23Z\Af_2F2vwr_CNYa.flv |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\sMPMTzl\55S23Z\BEe7u-u u0EBSOCzF.flv |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\sMPMTzl\55S23Z\ND1VYbSLXa5t.mp4 |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\sMPMTzl\55S23Z\eabJ44.mp4 |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\sMPMTzl\uF61Rt4LNKaFW3.mp4 |
C:\Users\FD1HVy\Videos\F6isENig1xlYu\zfQp4NPXXKZGu9ZaU4I\sMPMTzl\x2su2flF_wW7pZnmw46h.avi |
C:\Users\FD1HVy\Videos\pu3qRWZeby9 iJ3X6p.swf |