9282ffd0...1b86

Monitored Processes

Process Overview

ID	PID	Monitor Reason	Integrity Level	Image Name	Command Line	Origin ID
#1	0xa50	Analysis Target	High (Elevated)	r.exe	"C:\Users\EEBsYm5\Desktop\r.exe"	-
#3	0xb34	Child Process	High (Elevated)	nslookup.exe	nslookup politiaromana.bit ns1.virmach.ru	#1
#4	0x338	Autostart	Medium	igkphg.exe	"C:\Users\EEBsYm5\AppData\Roaming\Microsoft\igkphg.exe"	-
#5	0x55c	Child Process	Medium	nslookup.exe	nslookup politiaromana.bit ns1.virmach.ru	#4

Behavior Information - Grouped by Category

Process #1: r.exe

852

Information	Value
ID	#1
File Name	c:\users\eebsym5\desktop\r.exe
Command Line	"C:\Users\EEBsYm5\Desktop\r.exe"
Initial Working Directory	C:\Users\EEBsYm5\Desktop\
Monitor	Start Time: 00:01:04, Reason: Analysis Target
Unmonitor	End Time: 00:03:14, Reason: Terminated by Timeout
Monitor Duration	00:02:10

OS Process Information

Information	Value
PID	0xa50
Parent PID	0x608 (c:\windows\explorer.exe)
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	CRH2YWU7\EEBsYm5
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x A54 0x A60 0x A64 0x A70 0x A78 0x A7C 0x A80 0x A84 0x A88 0x B30

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	Readable, Writable	-
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	-
pagefile_0x0000000000020000	0x00020000	0x00026fff	Pagefile Backed Memory	Readable	-
private_0x0000000000030000	0x00030000	0x0012ffff	Private Memory	Readable, Writable	-
private_0x0000000000030000	0x00030000	0x00030fff	Private Memory	Readable, Writable	-
private_0x0000000000030000	0x00030000	0x0003ffff	Private Memory	Readable, Writable	-
private_0x0000000000040000	0x00040000	0x00040fff	Private Memory	Readable, Writable	-
pagefile_0x0000000000040000	0x00040000	0x00046fff	Pagefile Backed Memory	Readable, Writable	-
private_0x0000000000050000	0x00050000	0x00050fff	Private Memory	Readable, Writable	-
private_0x0000000000060000	0x00060000	0x00060fff	Private Memory	Readable, Writable, Executable	-
private_0x0000000000070000	0x00070000	0x00070fff	Private Memory	Readable, Writable	-
private_0x0000000000080000	0x00080000	0x00080fff	Private Memory	Readable, Writable	-
private_0x0000000000090000	0x00090000	0x00090fff	Private Memory	Readable, Writable	-
private_0x00000000000a0000	0x000a0000	0x000a0fff	Private Memory	Readable, Writable	-
private_0x00000000000b0000	0x000b0000	0x000b0fff	Private Memory	Readable, Writable	-
private_0x00000000000c0000	0x000c0000	0x000c0fff	Private Memory	Readable, Writable	-
private_0x00000000000d0000	0x000d0000	0x000d0fff	Private Memory	Readable, Writable	-
private_0x00000000000e0000	0x000e0000	0x000e0fff	Private Memory	Readable, Writable	-
private_0x00000000000f0000	0x000f0000	0x000f0fff	Private Memory	Readable, Writable	-
private_0x0000000000100000	0x00100000	0x0010ffff	Private Memory	Readable, Writable	-
pagefile_0x0000000000100000	0x00100000	0x00106fff	Pagefile Backed Memory	Readable, Writable	-
private_0x0000000000100000	0x00100000	0x00100fff	Private Memory	Readable, Writable	-
pagefile_0x0000000000110000	0x00110000	0x00116fff	Pagefile Backed Memory	Readable, Writable	-
pagefile_0x0000000000110000	0x00110000	0x00111fff	Pagefile Backed Memory	Readable	-
windowsshell.manifest	0x00120000	0x00120fff	Memory Mapped File	Readable	-
pagefile_0x0000000000120000	0x00120000	0x00120fff	Pagefile Backed Memory	Readable, Writable	-
pagefile_0x0000000000130000	0x00130000	0x00133fff	Pagefile Backed Memory	Readable	-
pagefile_0x0000000000140000	0x00140000	0x00140fff	Pagefile Backed Memory	Readable	-
locale.nls	0x00150000	0x001b6fff	Memory Mapped File	Readable	-
pagefile_0x00000000001c0000	0x001c0000	0x001c1fff	Pagefile Backed Memory	Readable, Writable	-
private_0x00000000001d0000	0x001d0000	0x002cffff	Private Memory	Readable, Writable	-
private_0x00000000002d0000	0x002d0000	0x0033ffff	Private Memory	Readable, Writable	-
private_0x00000000002d0000	0x002d0000	0x002f3fff	Private Memory	Readable, Writable	-
private_0x00000000002d0000	0x002d0000	0x002e5fff	Private Memory	Readable, Writable, Executable	-
imm32.dll	0x002f0000	0x0030cfff	Memory Mapped File	Readable	-
private_0x00000000002f0000	0x002f0000	0x002f0fff	Private Memory	Readable, Writable	-
private_0x0000000000300000	0x00300000	0x00300fff	Private Memory	Readable, Writable	-
private_0x0000000000310000	0x00310000	0x00310fff	Private Memory	Readable, Writable	-
private_0x0000000000320000	0x00320000	0x00320fff	Private Memory	Readable, Writable, Executable	-
pagefile_0x0000000000320000	0x00320000	0x00321fff	Pagefile Backed Memory	Readable	-
private_0x0000000000330000	0x00330000	0x0033ffff	Private Memory	Readable, Writable	-
kernelbase.dll.mui	0x00340000	0x003fffff	Memory Mapped File	Readable, Writable	-
r.exe	0x00400000	0x00c31fff	Memory Mapped File	Readable, Writable, Executable	... Region Actions Download Dump
private_0x0000000000c40000	0x00c40000	0x00dcffff	Private Memory	Readable, Writable	-
private_0x0000000000c40000	0x00c40000	0x00cfffff	Private Memory	Readable, Writable	-
rsaenh.dll	0x00c40000	0x00c7bfff	Memory Mapped File	Readable	-
pagefile_0x0000000000c40000	0x00c40000	0x00c80fff	Pagefile Backed Memory	Readable, Writable	-
index.dat	0x00c40000	0x00c6bfff	Memory Mapped File	Readable, Writable	-
index.dat	0x00c70000	0x00c77fff	Memory Mapped File	Readable, Writable	-
index.dat	0x00c80000	0x00c8ffff	Memory Mapped File	Readable, Writable	-
private_0x0000000000c90000	0x00c90000	0x00c92fff	Private Memory	Readable, Writable, Executable	-
private_0x0000000000ca0000	0x00ca0000	0x00ca2fff	Private Memory	Readable, Writable, Executable	-
private_0x0000000000cb0000	0x00cb0000	0x00cb0fff	Private Memory	Readable, Writable	-
pagefile_0x0000000000cb0000	0x00cb0000	0x00cb0fff	Pagefile Backed Memory	Readable	-
pagefile_0x0000000000cc0000	0x00cc0000	0x00cc0fff	Pagefile Backed Memory	Readable	-
pagefile_0x0000000000cd0000	0x00cd0000	0x00cd0fff	Pagefile Backed Memory	Readable	-
pagefile_0x0000000000ce0000	0x00ce0000	0x00ce0fff	Pagefile Backed Memory	Readable, Writable	-
private_0x0000000000cf0000	0x00cf0000	0x00cfffff	Private Memory	Readable, Writable	-
private_0x0000000000d00000	0x00d00000	0x00d4ffff	Private Memory	Readable, Writable	-
private_0x0000000000dc0000	0x00dc0000	0x00dcffff	Private Memory	Readable, Writable	-
pagefile_0x0000000000dd0000	0x00dd0000	0x00e97fff	Pagefile Backed Memory	Readable	-
pagefile_0x0000000000ea0000	0x00ea0000	0x00fa0fff	Pagefile Backed Memory	Readable	-
pagefile_0x0000000000fb0000	0x00fb0000	0x01baffff	Pagefile Backed Memory	Readable	-
private_0x0000000001bb0000	0x01bb0000	0x01caffff	Private Memory	Readable, Writable	-
sortdefault.nls	0x01cb0000	0x01f7efff	Memory Mapped File	Readable	-
pagefile_0x0000000001f80000	0x01f80000	0x02372fff	Pagefile Backed Memory	Readable	-
private_0x0000000002380000	0x02380000	0x0247ffff	Private Memory	Readable, Writable	-
private_0x0000000002480000	0x02480000	0x025cffff	Private Memory	Readable, Writable	-
private_0x0000000002480000	0x02480000	0x0257ffff	Private Memory	Readable, Writable	-
private_0x0000000002590000	0x02590000	0x025cffff	Private Memory	Readable, Writable	-
private_0x00000000025d0000	0x025d0000	0x027fffff	Private Memory	Readable, Writable	-
private_0x00000000025d0000	0x025d0000	0x026cffff	Private Memory	Readable, Writable	-
private_0x00000000026d0000	0x026d0000	0x027bffff	Private Memory	Readable, Writable	-
private_0x00000000027c0000	0x027c0000	0x027fffff	Private Memory	Readable, Writable	-
private_0x0000000002800000	0x02800000	0x028fffff	Private Memory	Readable, Writable	-
private_0x0000000002900000	0x02900000	0x02a0ffff	Private Memory	Readable, Writable	-
private_0x0000000002900000	0x02900000	0x029fffff	Private Memory	Readable, Writable	-
private_0x0000000002a00000	0x02a00000	0x02a0ffff	Private Memory	Readable, Writable	-
private_0x0000000002a10000	0x02a10000	0x02b0ffff	Private Memory	Readable, Writable	-
private_0x0000000002c00000	0x02c00000	0x02c3ffff	Private Memory	Readable, Writable	-
private_0x0000000002c40000	0x02c40000	0x02d3ffff	Private Memory	Readable, Writable	-
npmproxy.dll	0x6efd0000	0x6efd7fff	Memory Mapped File	Readable, Writable, Executable	-
rasadhlp.dll	0x6f850000	0x6f855fff	Memory Mapped File	Readable, Writable, Executable	-
msvcr100.dll	0x70240000	0x702fefff	Memory Mapped File	Readable, Writable, Executable	-
netprofm.dll	0x70600000	0x70659fff	Memory Mapped File	Readable, Writable, Executable	-
sensapi.dll	0x73120000	0x73125fff	Memory Mapped File	Readable, Writable, Executable	-
rasman.dll	0x73730000	0x73744fff	Memory Mapped File	Readable, Writable, Executable	-
rasapi32.dll	0x73750000	0x737a1fff	Memory Mapped File	Readable, Writable, Executable	-
dhcpcsvc.dll	0x73fc0000	0x73fd1fff	Memory Mapped File	Readable, Writable, Executable	-
fwpuclnt.dll	0x73fe0000	0x74017fff	Memory Mapped File	Readable, Writable, Executable	-
dhcpcsvc6.dll	0x74030000	0x7403cfff	Memory Mapped File	Readable, Writable, Executable	-
winnsi.dll	0x74120000	0x74126fff	Memory Mapped File	Readable, Writable, Executable	-
iphlpapi.dll	0x74130000	0x7414bfff	Memory Mapped File	Readable, Writable, Executable	-
nlaapi.dll	0x74240000	0x7424ffff	Memory Mapped File	Readable, Writable, Executable	-
ntmarta.dll	0x74550000	0x74570fff	Memory Mapped File	Readable, Writable, Executable	-
rtutils.dll	0x74650000	0x7465cfff	Memory Mapped File	Readable, Writable, Executable	-
winrnr.dll	0x74880000	0x74887fff	Memory Mapped File	Readable, Writable, Executable	-
pnrpnsp.dll	0x74890000	0x748a1fff	Memory Mapped File	Readable, Writable, Executable	-
napinsp.dll	0x748c0000	0x748cffff	Memory Mapped File	Readable, Writable, Executable	-
comctl32.dll	0x74eb0000	0x7504dfff	Memory Mapped File	Readable, Writable, Executable	-
wshtcpip.dll	0x754b0000	0x754b4fff	Memory Mapped File	Readable, Writable, Executable	-
userenv.dll	0x75580000	0x75596fff	Memory Mapped File	Readable, Writable, Executable	-
rsaenh.dll	0x75740000	0x7577afff	Memory Mapped File	Readable, Writable, Executable	-
dnsapi.dll	0x75820000	0x75863fff	Memory Mapped File	Readable, Writable, Executable	-
wship6.dll	0x75950000	0x75955fff	Memory Mapped File	Readable, Writable, Executable	-
mswsock.dll	0x75960000	0x7599bfff	Memory Mapped File	Readable, Writable, Executable	-
cryptsp.dll	0x759a0000	0x759b5fff	Memory Mapped File	Readable, Writable, Executable	-
sspicli.dll	0x75e00000	0x75e1afff	Memory Mapped File	Readable, Writable, Executable	-
cryptbase.dll	0x75e20000	0x75e2bfff	Memory Mapped File	Readable, Writable, Executable	-
rpcrtremote.dll	0x75ec0000	0x75ecdfff	Memory Mapped File	Readable, Writable, Executable	-
profapi.dll	0x75ed0000	0x75edafff	Memory Mapped File	Readable, Writable, Executable	-
msasn1.dll	0x75f40000	0x75f4bfff	Memory Mapped File	Readable, Writable, Executable	-
kernelbase.dll	0x75f70000	0x75fb9fff	Memory Mapped File	Readable, Writable, Executable	-
crypt32.dll	0x76050000	0x7616cfff	Memory Mapped File	Readable, Writable, Executable	-
kernel32.dll	0x761d0000	0x762a3fff	Memory Mapped File	Readable, Writable, Executable	-
imm32.dll	0x762b0000	0x762cefff	Memory Mapped File	Readable, Writable, Executable	-
nsi.dll	0x762d0000	0x762d5fff	Memory Mapped File	Readable, Writable, Executable	-
sechost.dll	0x762e0000	0x762f8fff	Memory Mapped File	Readable, Writable, Executable	-
shlwapi.dll	0x76300000	0x76356fff	Memory Mapped File	Readable, Writable, Executable	-
normaliz.dll	0x76390000	0x76392fff	Memory Mapped File	Readable, Writable, Executable	-
wldap32.dll	0x763a0000	0x763e4fff	Memory Mapped File	Readable, Writable, Executable	-
iertutil.dll	0x763f0000	0x765eafff	Memory Mapped File	Readable, Writable, Executable	-
lpk.dll	0x765f0000	0x765f9fff	Memory Mapped File	Readable, Writable, Executable	-
wininet.dll	0x76600000	0x766f4fff	Memory Mapped File	Readable, Writable, Executable	-
advapi32.dll	0x76700000	0x7679ffff	Memory Mapped File	Readable, Writable, Executable	-
shell32.dll	0x767a0000	0x773e9fff	Memory Mapped File	Readable, Writable, Executable	-
usp10.dll	0x773f0000	0x7748cfff	Memory Mapped File	Readable, Writable, Executable	-
ws2_32.dll	0x77510000	0x77544fff	Memory Mapped File	Readable, Writable, Executable	-
rpcrt4.dll	0x77550000	0x775f0fff	Memory Mapped File	Readable, Writable, Executable	-
clbcatq.dll	0x77600000	0x77682fff	Memory Mapped File	Readable, Writable, Executable	-
oleaut32.dll	0x77690000	0x7771efff	Memory Mapped File	Readable, Writable, Executable	-
msvcrt.dll	0x77720000	0x777cbfff	Memory Mapped File	Readable, Writable, Executable	-
urlmon.dll	0x77830000	0x77965fff	Memory Mapped File	Readable, Writable, Executable	-
ole32.dll	0x77970000	0x77acbfff	Memory Mapped File	Readable, Writable, Executable	-
user32.dll	0x77ad0000	0x77b98fff	Memory Mapped File	Readable, Writable, Executable	-
msctf.dll	0x77ba0000	0x77c6bfff	Memory Mapped File	Readable, Writable, Executable	-
psapi.dll	0x77c70000	0x77c74fff	Memory Mapped File	Readable, Writable, Executable	-
gdi32.dll	0x77c80000	0x77ccdfff	Memory Mapped File	Readable, Writable, Executable	-
apisetschema.dll	0x77e80000	0x77e80fff	Memory Mapped File	Readable, Writable, Executable	-
ntdll.dll	0x77ec0000	0x77ffbfff	Memory Mapped File	Readable, Writable, Executable	-
pagefile_0x000000007f6f0000	0x7f6f0000	0x7f7effff	Pagefile Backed Memory	Readable	-
pagefile_0x000000007ffb0000	0x7ffb0000	0x7ffd2fff	Pagefile Backed Memory	Readable	-
private_0x000000007ffd8000	0x7ffd8000	0x7ffd8fff	Private Memory	Readable, Writable	-
private_0x000000007ffd9000	0x7ffd9000	0x7ffd9fff	Private Memory	Readable, Writable	-
private_0x000000007ffda000	0x7ffda000	0x7ffdafff	Private Memory	Readable, Writable	-
private_0x000000007ffdb000	0x7ffdb000	0x7ffdbfff	Private Memory	Readable, Writable	-
private_0x000000007ffdc000	0x7ffdc000	0x7ffdcfff	Private Memory	Readable, Writable	-
private_0x000000007ffdd000	0x7ffdd000	0x7ffddfff	Private Memory	Readable, Writable	-
private_0x000000007ffde000	0x7ffde000	0x7ffdefff	Private Memory	Readable, Writable	-
private_0x000000007ffdf000	0x7ffdf000	0x7ffdffff	Private Memory	Readable, Writable	-
For performance reasons, the remaining 20 entries are omitted. The remaining entries can be found in flog.txt.

Hook Information

Type	Installer	Target	Size	Information	Actions
IAT	private_0x00000000001d0000:+0xffb4	18. entry of r.exe	4 bytes	kernel32.dll:SetUnhandledExceptionFilter+0x0 now points to halmacpi.dll:ExTryToAcquireFastMutex+0x51d	... Actions Go to Installer Region Go to Target Region

Created Files

Filename	File Size	Hash Values	YARA Match	Actions
c:\users\eebsym5\appdata\roaming\microsoft\igkphg.exe	259.01 KB	MD5: 3d1eac0c2e2e4eebc58d9bc6b35c887a SHA1: 68803bbd188af4f11f54da3d0b59f261d498cbb1 SHA256: 67f045e217a582aeaa04875b1876c8bfce6b77b71e521aefaf3a68b30023735e		... File Actions Show Properties Download
c:\users\eebsym5\appdata\local\microsoft\windows\temporary internet files\content.ie5\qn4dse0e\ipv4bot_whatismyipaddress_com[1].htm	0.01 KB	MD5: 65e71abef82987dc3884e180cb149235 SHA1: 7e74cfd799cc250be2e587357d666a4f99a37e9f SHA256: 800551405196cde4a9e6df0b7a5bf6cd5f82a16191b0c383feb3c0a061388a95		... File Actions Show Properties Download

Modified Files

Filename	File Size	Hash Values	YARA Match	Actions
c:\users\eebsym5\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-3785418085-2572485238-895829336-1000\b652534aebe43ee746cbc40ead5a6d17_cdd36b99-6027-4bbf-bf10-e7f8b416e3fb	0.05 KB	MD5: b203621a65475445e6fcdca717c667b5 SHA1: c17fd92682ca5b304ac71074b558dda9e8eb4d66 SHA256: 17b0761f87b081d5cf10757ccc89f12be355c70e2e29df288b65b30710dcbcd1		... File Actions Show Properties Download

Host Behavior

File (16)

Operation	Filename	Additional Information	Count	Logfile
Create	C:\Users\EEBsYm5\Desktop\r.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\igkphg.exe	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Desktop\r.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
Create Pipe	Anonymous read pipe	size = 0	1	Fn
Create Pipe	Anonymous read pipe	size = 0	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\r.exe	type = size	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\r.exe	type = size	1	Fn
Open	STD_INPUT_HANDLE	-	2	Fn
Open	STD_OUTPUT_HANDLE	-	2	Fn
Open	STD_ERROR_HANDLE	-	2	Fn
Read	C:\Users\EEBsYm5\Desktop\r.exe	size = 265224, size_out = 265224	1	Fn Data
Read	-	size = 4096	1	Fn
Write	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\igkphg.exe	size = 265224	1	Fn Data

Registry (28)

Operation	Key	Additional Information	Count	Logfile
Create Key	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	-	2	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	-	2	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters	-	1	Fn
Open Key	HKEY_CURRENT_USER\Control Panel\International	-	1	Fn
Open Key	HKEY_CURRENT_USER\Keyboard Layout\Preload	-	2	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	-	2	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters	value_name = Domain, data = 0	1	Fn
Read Value	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	value_name = ProcessorNameString, data = 73	1	Fn
Read Value	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	value_name = Identifier, data = 120	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters	value_name = Domain, data = 0	1	Fn
Read Value	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	value_name = ProcessorNameString, data = 73	1	Fn
Read Value	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	value_name = Identifier, data = 120	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters	value_name = Domain, data = 0	1	Fn
Read Value	HKEY_CURRENT_USER\Control Panel\International	value_name = LocaleName, data = 101	1	Fn
Read Value	HKEY_CURRENT_USER\Keyboard Layout\Preload	value_name = 1, data = 48	1	Fn
Read Value	HKEY_CURRENT_USER\Keyboard Layout\Preload	value_name = 2, data = 48	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	value_name = productName, data = 87	1	Fn
Read Value	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	value_name = ProcessorNameString, data = 73	1	Fn
Read Value	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	value_name = Identifier, data = 120	1	Fn
Write Value	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	value_name = anggmbawxyj, data = "C:\Users\EEBsYm5\AppData\Roaming\Microsoft\igkphg.exe", size = 110, type = REG_SZ	1	Fn

Process (2)

Operation	Process	Additional Information	Success	Count	Logfile
Create	nslookup politiaromana.bit ns1.virmach.ru	os_pid = 0xb34, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE		1	Fn
Open	System Idle Process	-		1	Fn

Module (265)

Operation	Module	Additional Information	Count	Logfile
Load	kernel32.dll	base_address = 0x761d0000	2	Fn
Load	KERNEL32.dll	base_address = 0x761d0000	2	Fn
Load	msvcr100.dll	base_address = 0x70240000	1	Fn
Load	USER32.dll	base_address = 0x77ad0000	1	Fn
Load	GDI32.dll	base_address = 0x77c80000	1	Fn
Load	ADVAPI32.dll	base_address = 0x76700000	1	Fn
Load	SHELL32.dll	base_address = 0x767a0000	1	Fn
Load	CRYPT32.dll	base_address = 0x76050000	1	Fn
Load	WININET.dll	base_address = 0x76600000	1	Fn
Load	PSAPI.DLL	base_address = 0x77c70000	1	Fn
Get Handle	c:\windows\system32\kernel32.dll	base_address = 0x761d0000	4	Fn
Get Handle	c:\windows\system32\ntdll.dll	base_address = 0x77ec0000	4	Fn
Get Handle	c:\windows\system32\advapi32.dll	base_address = 0x76700000	3	Fn
Get Filename	-	process_name = c:\users\eebsym5\desktop\r.exe, file_name_orig = C:\Users\EEBsYm5\Desktop\r.exe, size = 260	2	Fn
Get Filename	-	process_name = c:\users\eebsym5\desktop\r.exe, file_name_orig = C:\Users\EEBsYm5\Desktop\r.exe, size = 256	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FlsAlloc, address_out = 0x7622418d	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FlsGetValue, address_out = 0x76221e16	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FlsSetValue, address_out = 0x762276e6	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FlsFree, address_out = 0x76221f61	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GlobalAlloc, address_out = 0x76219ce1	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = VirtualProtect, address_out = 0x76212341	3	Fn
Get Address	c:\windows\system32\kernel32.dll	function = LoadLibraryA, address_out = 0x7622395c	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = VirtualAlloc, address_out = 0x76222fb6	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = VirtualFree, address_out = 0x76221da4	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetVersionExA, address_out = 0x76223861	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = TerminateProcess, address_out = 0x76212331	3	Fn
Get Address	c:\windows\system32\kernel32.dll	function = ExitProcess, address_out = 0x7622214f	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = OpenProcess, address_out = 0x762159d7	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = Sleep, address_out = 0x7621ba46	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = ExitThread, address_out = 0x77eef611	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetLastError, address_out = 0x7621bf00	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CloseHandle, address_out = 0x7621ca7c	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = WriteConsoleW, address_out = 0x762182f1	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetFilePointerEx, address_out = 0x7620f5b2	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetStdHandle, address_out = 0x7625f589	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetCommandLineA, address_out = 0x762298ff	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetLastError, address_out = 0x7621bb08	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetCurrentThreadId, address_out = 0x7621bb80	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = EncodePointer, address_out = 0x77f1a295	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = DecodePointer, address_out = 0x77f1cd10	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetModuleHandleExW, address_out = 0x76213e39	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetProcAddress, address_out = 0x762233d3	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = MultiByteToWideChar, address_out = 0x7622452b	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = WideCharToMultiByte, address_out = 0x7622450e	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetProcessHeap, address_out = 0x76221280	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetStdHandle, address_out = 0x76221e46	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetFileType, address_out = 0x762275a5	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = DeleteCriticalSection, address_out = 0x77f19ac5	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetStartupInfoW, address_out = 0x76223891	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetModuleFileNameA, address_out = 0x762233f6	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = WriteFile, address_out = 0x76221400	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetModuleFileNameW, address_out = 0x76223c26	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = QueryPerformanceCounter, address_out = 0x7621bb9f	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetCurrentProcessId, address_out = 0x7621cac4	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetSystemTimeAsFileTime, address_out = 0x76222fde	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetEnvironmentStringsW, address_out = 0x76221dbc	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FreeEnvironmentStringsW, address_out = 0x76221dc3	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = IsDebuggerPresent, address_out = 0x76213ea8	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = IsProcessorFeaturePresent, address_out = 0x762276b5	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = UnhandledExceptionFilter, address_out = 0x7622ed38	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetUnhandledExceptionFilter, address_out = 0x76223d01	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = InitializeCriticalSectionAndSpinCount, address_out = 0x76223939	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetCurrentProcess, address_out = 0x7621cdcf	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = TlsAlloc, address_out = 0x762235a1	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = TlsGetValue, address_out = 0x7621da70	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = TlsSetValue, address_out = 0x7621da88	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = TlsFree, address_out = 0x762213b8	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetModuleHandleW, address_out = 0x7622374d	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = EnterCriticalSection, address_out = 0x77f077a0	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = LeaveCriticalSection, address_out = 0x77f07760	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = HeapFree, address_out = 0x7621bbd0	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = IsValidCodePage, address_out = 0x7622c1c0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetACP, address_out = 0x762239aa	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetOEMCP, address_out = 0x76213db9	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetCPInfo, address_out = 0x76221e2e	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = LoadLibraryExW, address_out = 0x76214775	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = RtlUnwind, address_out = 0x76207f70	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = OutputDebugStringW, address_out = 0x76206b91	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = HeapAlloc, address_out = 0x77f12dd6	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = HeapReAlloc, address_out = 0x77f2ff51	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetStringTypeW, address_out = 0x762267c8	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = HeapSize, address_out = 0x77f19bec	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = LCMapStringW, address_out = 0x762213d0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FlushFileBuffers, address_out = 0x76207f81	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetConsoleCP, address_out = 0x76222c8a	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetConsoleMode, address_out = 0x76222412	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateFileW, address_out = 0x7621cc56	2	Fn
Get Address	c:\windows\system32\msvcr100.dll	function = atexit, address_out = 0x7025c544	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = InitializeCriticalSectionEx, address_out = 0x76223879	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateEventExW, address_out = 0x761d24d8	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateSemaphoreExW, address_out = 0x76202111	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetThreadStackGuarantee, address_out = 0x76212510	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateThreadpoolTimer, address_out = 0x7620b009	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetThreadpoolTimer, address_out = 0x77ee89be	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = WaitForThreadpoolTimerCallbacks, address_out = 0x77edc02a	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CloseThreadpoolTimer, address_out = 0x77edc0d2	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateThreadpoolWait, address_out = 0x76203f78	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetThreadpoolWait, address_out = 0x77ee8bfb	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CloseThreadpoolWait, address_out = 0x77edb567	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FlushProcessWriteBuffers, address_out = 0x77f05998	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FreeLibraryWhenCallbackReturns, address_out = 0x77ed2251	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetCurrentProcessorNumber, address_out = 0x77ed28f6	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetLogicalProcessorInformation, address_out = 0x76202004	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateSymbolicLinkW, address_out = 0x76259aa9	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetDefaultDllDirectories, address_out = 0x0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = EnumSystemLocalesEx, address_out = 0x7625f3cf	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CompareStringEx, address_out = 0x7622ebc6	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetDateFormatEx, address_out = 0x7626f29f	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetLocaleInfoEx, address_out = 0x762053a5	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetTimeFormatEx, address_out = 0x7626f21a	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetUserDefaultLocaleName, address_out = 0x7625f70b	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = IsValidLocaleName, address_out = 0x7625f71b	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = LCMapStringEx, address_out = 0x7625f72b	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetCurrentPackageId, address_out = 0x0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetTickCount64, address_out = 0x7620eb4e	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetFileInformationByHandleExW, address_out = 0x0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetFileInformationByHandleW, address_out = 0x0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = ReadFile, address_out = 0x762196fb	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetFilePointer, address_out = 0x7621db36	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetFileAttributesW, address_out = 0x762264ff	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = MoveFileW, address_out = 0x7623548a	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrcpyW, address_out = 0x76208bfa	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetFileAttributesW, address_out = 0x7620ad1b	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateMutexW, address_out = 0x76212aee	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetDriveTypeW, address_out = 0x76223be6	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = VerSetConditionMask, address_out = 0x77ee3030	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = WaitForSingleObject, address_out = 0x7621ba90	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetTickCount, address_out = 0x7621ba60	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = InitializeCriticalSection, address_out = 0x77f1a149	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetSystemDirectoryW, address_out = 0x762240fb	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = TerminateThread, address_out = 0x762222a7	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = VerifyVersionInfoW, address_out = 0x76210e91	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = WaitForMultipleObjects, address_out = 0x7621bce4	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = ExpandEnvironmentStringsW, address_out = 0x76214680	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrlenW, address_out = 0x7621d9e8	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetHandleInformation, address_out = 0x76208856	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrcatA, address_out = 0x7621a19f	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreatePipe, address_out = 0x762335b7	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrcmpiA, address_out = 0x76212249	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = Process32NextW, address_out = 0x7620faca	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateToolhelp32Snapshot, address_out = 0x7620f731	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FindFirstFileW, address_out = 0x762253b2	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrcmpW, address_out = 0x762267b0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FindClose, address_out = 0x76220e62	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FindNextFileW, address_out = 0x7621963a	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetNativeSystemInfo, address_out = 0x7620be77	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetComputerNameW, address_out = 0x762103ff	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetDiskFreeSpaceW, address_out = 0x76203530	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetWindowsDirectoryW, address_out = 0x762104b6	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetVolumeInformationW, address_out = 0x76227598	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrcmpiW, address_out = 0x7621a8eb	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateThread, address_out = 0x7622375d	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrcatW, address_out = 0x76234be7	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateFileMappingW, address_out = 0x76210a7f	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = UnmapViewOfFile, address_out = 0x7621db13	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = MapViewOfFile, address_out = 0x7621899b	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetFileSize, address_out = 0x76210273	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetEnvironmentVariableW, address_out = 0x762265c4	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrcpyA, address_out = 0x76219793	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetModuleHandleA, address_out = 0x7621cf41	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = Process32FirstW, address_out = 0x7620fa35	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetTempPathW, address_out = 0x76208b33	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrlenA, address_out = 0x7621a611	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateProcessW, address_out = 0x761d204d	1	Fn
Get Address	c:\windows\system32\user32.dll	function = BeginPaint, address_out = 0x77ae5d14	1	Fn
Get Address	c:\windows\system32\user32.dll	function = wsprintfW, address_out = 0x77af426d	1	Fn
Get Address	c:\windows\system32\user32.dll	function = TranslateMessage, address_out = 0x77ae64c7	1	Fn
Get Address	c:\windows\system32\user32.dll	function = LoadCursorW, address_out = 0x77aded90	1	Fn
Get Address	c:\windows\system32\user32.dll	function = LoadIconW, address_out = 0x77adf142	1	Fn
Get Address	c:\windows\system32\user32.dll	function = MessageBoxA, address_out = 0x77b2ea11	1	Fn
Get Address	c:\windows\system32\user32.dll	function = GetMessageW, address_out = 0x77aecde8	1	Fn
Get Address	c:\windows\system32\user32.dll	function = EndPaint, address_out = 0x77ae5d42	1	Fn
Get Address	c:\windows\system32\user32.dll	function = DestroyWindow, address_out = 0x77adb2f4	1	Fn
Get Address	c:\windows\system32\user32.dll	function = RegisterClassExW, address_out = 0x77ae0162	1	Fn
Get Address	c:\windows\system32\user32.dll	function = ShowWindow, address_out = 0x77adf2a9	1	Fn
Get Address	c:\windows\system32\user32.dll	function = CreateWindowExW, address_out = 0x77adec7c	1	Fn
Get Address	c:\windows\system32\user32.dll	function = SendMessageW, address_out = 0x77ae5539	1	Fn
Get Address	c:\windows\system32\user32.dll	function = DispatchMessageW, address_out = 0x77aecc61	1	Fn
Get Address	c:\windows\system32\user32.dll	function = DefWindowProcW, address_out = 0x77ae507d	1	Fn
Get Address	c:\windows\system32\user32.dll	function = UpdateWindow, address_out = 0x77adffa8	1	Fn
Get Address	c:\windows\system32\user32.dll	function = wsprintfA, address_out = 0x77ae3f47	1	Fn
Get Address	c:\windows\system32\user32.dll	function = GetForegroundWindow, address_out = 0x77ae335d	1	Fn
Get Address	c:\windows\system32\user32.dll	function = SetWindowLongW, address_out = 0x77ae4449	1	Fn
Get Address	c:\windows\system32\gdi32.dll	function = TextOutW, address_out = 0x77c8fde4	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = FreeSid, address_out = 0x7671412e	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = RegSetValueExW, address_out = 0x767114d6	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = RegCreateKeyExW, address_out = 0x767140fe	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = RegCloseKey, address_out = 0x7671469d	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptExportKey, address_out = 0x767091ea	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptAcquireContextW, address_out = 0x7670df14	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptGetKeyParam, address_out = 0x767277cb	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptReleaseContext, address_out = 0x7670e124	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptImportKey, address_out = 0x7670c532	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptEncrypt, address_out = 0x7672779b	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptGenKey, address_out = 0x76708ee9	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptDestroyKey, address_out = 0x7670c51a	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = GetUserNameW, address_out = 0x7671157a	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = RegQueryValueExW, address_out = 0x767146ad	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = RegOpenKeyExW, address_out = 0x7671468d	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = AllocateAndInitializeSid, address_out = 0x767140e6	1	Fn
Get Address	c:\windows\system32\shell32.dll	function = ShellExecuteW, address_out = 0x767b3c71	1	Fn
Get Address	c:\windows\system32\shell32.dll	function = SHGetSpecialFolderPathW, address_out = 0x767c0468	1	Fn
Get Address	c:\windows\system32\shell32.dll	function = ShellExecuteExW, address_out = 0x767c1e46	1	Fn
Get Address	c:\windows\system32\crypt32.dll	function = CryptStringToBinaryA, address_out = 0x76085d77	1	Fn
Get Address	c:\windows\system32\crypt32.dll	function = CryptBinaryToStringA, address_out = 0x7608a8c5	1	Fn
Get Address	c:\windows\system32\wininet.dll	function = InternetCloseHandle, address_out = 0x7661ab49	1	Fn
Get Address	c:\windows\system32\wininet.dll	function = HttpAddRequestHeadersW, address_out = 0x76624fae	1	Fn
Get Address	c:\windows\system32\wininet.dll	function = HttpSendRequestW, address_out = 0x7662ba12	1	Fn
Get Address	c:\windows\system32\wininet.dll	function = InternetConnectW, address_out = 0x7662492c	1	Fn
Get Address	c:\windows\system32\wininet.dll	function = HttpOpenRequestW, address_out = 0x76624a42	1	Fn
Get Address	c:\windows\system32\wininet.dll	function = InternetOpenW, address_out = 0x76629197	1	Fn
Get Address	c:\windows\system32\wininet.dll	function = InternetReadFile, address_out = 0x7661b406	1	Fn
Get Address	c:\windows\system32\psapi.dll	function = EnumDeviceDrivers, address_out = 0x77c714cc	1	Fn
Get Address	c:\windows\system32\psapi.dll	function = GetDeviceDriverBaseNameW, address_out = 0x77c71514	1	Fn
Get Address	c:\windows\system32\ntdll.dll	function = RtlComputeCrc32, address_out = 0x77ecdd8a	4	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptGenRandom, address_out = 0x7670dfc8	3	Fn
Create Mapping	C:\Users\EEBsYm5\Desktop\r.exe	filename = C:\Users\EEBsYm5\Desktop\r.exe, protection = PAGE_WRITECOPY, maximum_size = 0	1	Fn
Map	C:\Users\EEBsYm5\Desktop\r.exe	process_name = c:\users\eebsym5\desktop\r.exe, desired_access = FILE_MAP_COPY	1	Fn

Driver (524)

Operation	Driver	Additional Information	Count	Logfile
Enumerate	-	load_addresses = 1244944	3	Fn
Enumerate	-	load_addresses = 3211264	7	Fn
Enumerate	-	load_addresses = 1244832	1	Fn
Enumerate	-	load_addresses = 1244844	3	Fn
Enumerate	-	load_addresses = 1244792	3	Fn
Enumerate	-	load_addresses = 3276800	6	Fn
Enumerate	-	load_addresses = 1244804	3	Fn
Get Name	-	load_address = 2187456512	4	Fn
Get Name	-	load_address = 2191724544	4	Fn
Get Name	-	load_address = 2159828992	4	Fn
Get Name	-	load_address = 2284056576	4	Fn
Get Name	-	load_address = 2284601344	4	Fn
Get Name	-	load_address = 2284670976	4	Fn
Get Name	-	load_address = 2284703744	4	Fn
Get Name	-	load_address = 2284974080	4	Fn
Get Name	-	load_address = 2285924352	4	Fn
Get Name	-	load_address = 2286387200	4	Fn
Get Name	-	load_address = 2286444544	4	Fn
Get Name	-	load_address = 2286739456	4	Fn
Get Name	-	load_address = 2286776320	4	Fn
Get Name	-	load_address = 2286809088	4	Fn
Get Name	-	load_address = 2286981120	4	Fn
Get Name	-	load_address = 2287026176	4	Fn
Get Name	-	load_address = 2287095808	4	Fn
Get Name	-	load_address = 2287161344	4	Fn
Get Name	-	load_address = 2287468544	4	Fn
Get Name	-	load_address = 2287558656	4	Fn
Get Name	-	load_address = 2287730688	4	Fn
Get Name	-	load_address = 2287804416	4	Fn
Get Name	-	load_address = 2287841280	4	Fn
Get Name	-	load_address = 2285674496	4	Fn
Get Name	-	load_address = 2285715456	4	Fn
Get Name	-	load_address = 2285772800	4	Fn
Get Name	-	load_address = 2283798528	4	Fn
Get Name	-	load_address = 2285809664	4	Fn
Get Name	-	load_address = 2288197632	4	Fn
Get Name	-	load_address = 2289438720	4	Fn
Get Name	-	load_address = 2289614848	4	Fn
Get Name	-	load_address = 2289692672	4	Fn
Get Name	-	load_address = 2287992832	4	Fn
Get Name	-	load_address = 2288050176	4	Fn
Get Name	-	load_address = 2290171904	4	Fn
Get Name	-	load_address = 2290921472	4	Fn
Get Name	-	load_address = 2291175424	4	Fn
Get Name	-	load_address = 2292416512	4	Fn
Get Name	-	load_address = 2293768192	4	Fn
Get Name	-	load_address = 2293968896	4	Fn
Get Name	-	load_address = 2294005760	4	Fn
Get Name	-	load_address = 2292187136	4	Fn
Get Name	-	load_address = 2292219904	4	Fn
Get Name	-	load_address = 2291326976	4	Fn
Get Name	-	load_address = 2291392512	4	Fn
Get Name	-	load_address = 2291425280	4	Fn
Get Name	-	load_address = 2291630080	4	Fn
Get Name	-	load_address = 2291699712	4	Fn
Get Name	-	load_address = 2290089984	4	Fn
Get Name	-	load_address = 2290118656	4	Fn
Get Name	-	load_address = 2292060160	4	Fn
Get Name	-	load_address = 2485350400	4	Fn
Get Name	-	load_address = 2485485568	4	Fn
Get Name	-	load_address = 2485538816	4	Fn
Get Name	-	load_address = 2485571584	4	Fn
Get Name	-	load_address = 2485604352	4	Fn
Get Name	-	load_address = 2485637120	4	Fn
Get Name	-	load_address = 2485682176	4	Fn
Get Name	-	load_address = 2485739520	4	Fn
Get Name	-	load_address = 2485833728	4	Fn
Get Name	-	load_address = 2485882880	4	Fn
Get Name	-	load_address = 2486251520	4	Fn
Get Name	-	load_address = 2486456320	4	Fn
Get Name	-	load_address = 2486484992	4	Fn
Get Name	-	load_address = 2486611968	4	Fn
Get Name	-	load_address = 2486669312	4	Fn
Get Name	-	load_address = 2486747136	4	Fn
Get Name	-	load_address = 2486816768	4	Fn
Get Name	-	load_address = 2487083008	4	Fn
Get Name	-	load_address = 2487123968	4	Fn
Get Name	-	load_address = 2487164928	4	Fn
Get Name	-	load_address = 2487418880	4	Fn
Get Name	-	load_address = 2487828480	4	Fn
Get Name	-	load_address = 2487926784	4	Fn
Get Name	-	load_address = 2487984128	4	Fn
Get Name	-	load_address = 2488119296	4	Fn
Get Name	-	load_address = 2488172544	4	Fn
Get Name	-	load_address = 2488299520	4	Fn
Get Name	-	load_address = 2488360960	4	Fn
Get Name	-	load_address = 2488786944	4	Fn
Get Name	-	load_address = 2488860672	4	Fn
Get Name	-	load_address = 2488913920	4	Fn
Get Name	-	load_address = 2488987648	4	Fn
Get Name	-	load_address = 2489085952	4	Fn
Get Name	-	load_address = 2489131008	4	Fn
Get Name	-	load_address = 2487222272	4	Fn
Get Name	-	load_address = 2487320576	4	Fn
Get Name	-	load_address = 2485125120	4	Fn
Get Name	-	load_address = 2489270272	4	Fn
Get Name	-	load_address = 2485219328	4	Fn
Get Name	-	load_address = 2485272576	4	Fn
Get Name	-	load_address = 2489311232	4	Fn
Get Name	-	load_address = 2495852544	4	Fn
Get Name	-	load_address = 2496065536	4	Fn
Get Name	-	load_address = 2496122880	4	Fn
Get Name	-	load_address = 2496401408	4	Fn
Get Name	-	load_address = 2496471040	4	Fn
Get Name	-	load_address = 2496798720	4	Fn
Get Name	-	load_address = 2496991232	4	Fn
Get Name	-	load_address = 2497093632	4	Fn
Get Name	-	load_address = 2497146880	4	Fn
Get Name	-	load_address = 2497191936	4	Fn
Get Name	-	load_address = 2497232896	4	Fn
Get Name	-	load_address = 2514092032	4	Fn
Get Name	-	load_address = 2497302528	4	Fn
Get Name	-	load_address = 2512388096	4	Fn
Get Name	-	load_address = 2497343488	4	Fn
Get Name	-	load_address = 2512584704	4	Fn
Get Name	-	load_address = 2513108992	4	Fn
Get Name	-	load_address = 2497388544	4	Fn
Get Name	-	load_address = 2497433600	4	Fn
Get Name	-	load_address = 2497511424	4	Fn
Get Name	-	load_address = 2497540096	4	Fn
Get Name	-	load_address = 2497548288	4	Fn
Get Name	-	load_address = 2497597440	4	Fn
Get Name	-	load_address = 2495610880	2	Fn
Get Name	-	load_address = 2495655936	2	Fn
Get Name	-	load_address = 2495721472	2	Fn
Get Name	-	load_address = 2541789184	2	Fn
Get Name	-	load_address = 2542333952	2	Fn
Get Name	-	load_address = 2542436352	2	Fn
Get Name	-	load_address = 2542510080	2	Fn
Get Name	-	load_address = 2542653440	2	Fn
Get Name	-	load_address = 2542895104	2	Fn
Get Name	-	load_address = 2543104000	2	Fn
Get Name	-	load_address = 2543722496	2	Fn
Get Name	-	load_address = 2291851264	2	Fn
Get Name	-	load_address = 2543763456	2	Fn
Get Name	-	load_address = 2617335808	2	Fn
Get Name	-	load_address = 2617659392	2	Fn
Get Name	-	load_address = 2617991168	2	Fn
Get Name	-	load_address = 2011955200	2	Fn
Get Name	-	load_address = 1200488448	2	Fn
Get Name	-	load_address = 2011693056	2	Fn

System (11)

Operation	Additional Information	Count	Logfile
Get Computer Name	result_out = CRH2YWU7	1	Fn
Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
Get Time	type = System Time, time = 2018-03-16 23:08:32 (UTC)	1	Fn
Get Time	type = Ticks, time = 123287	1	Fn
Get Time	type = System Time, time = 2018-03-16 23:08:33 (UTC)	1	Fn
Get Time	type = Ticks, time = 128217	1	Fn
Get Info	type = Operating System	1	Fn
Get Info	type = Windows Directory, result_out = C:\Windows	3	Fn
Get Info	type = Hardware Information	1	Fn

Mutex (1)

Operation	Additional Information	Success	Count	Logfile
Create	mutex_name = Global\pc_group=WORKGROUP&ransom_id=acc4531c90c08a66		1	Fn

Environment (3)

Operation	Additional Information	Success	Count	Logfile
Get Environment String	-		2	Fn Data
Get Environment String	name = AppData, result_out = C:\Users\EEBsYm5\AppData\Roaming		1	Fn

Network Behavior

HTTP Sessions (1)

Information	Value
Total Data Sent	295 bytes
Total Data Received	13 bytes
Contacted Host Count	1
Contacted Hosts	ipv4bot.whatismyipaddress.com

HTTP Session #1

Information	Value
User Agent	Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
Server Name	ipv4bot.whatismyipaddress.com
Server Port	80
Data Sent	295
Data Received	13

Operation	Additional Information	Count	Logfile
Open Session	user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36, access_type = INTERNET_OPEN_TYPE_PRECONFIG	1	Fn
Open Connection	protocol = HTTP, server_name = ipv4bot.whatismyipaddress.com, server_port = 80	1	Fn
Open HTTP Request	http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD	1	Fn
Add HTTP Request Headers	headers = Host: malwarehunterteam.bit	1	Fn
Send HTTP Request	headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = ipv4bot.whatismyipaddress.com/	1	Fn
Read Response	size = 10238, size_out = 13	1	Fn Data
Read Response	size = 10238, size_out = 0	1	Fn
Close Session	-	2	Fn

Process #3: nslookup.exe

Information	Value
ID	#3
File Name	c:\windows\system32\nslookup.exe
Command Line	nslookup politiaromana.bit ns1.virmach.ru
Initial Working Directory	C:\Users\EEBsYm5\Desktop\
Monitor	Start Time: 00:01:40, Reason: Child Process
Unmonitor	End Time: 00:03:14, Reason: Terminated by Timeout
Monitor Duration	00:01:34

OS Process Information

Information	Value
PID	0xb34
Parent PID	0xa50 (c:\users\eebsym5\desktop\r.exe)
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	CRH2YWU7\EEBsYm5
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x B38 0x B4C

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	Readable, Writable	-
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	-
pagefile_0x0000000000020000	0x00020000	0x0002ffff	Pagefile Backed Memory	Readable, Writable	-
pagefile_0x0000000000030000	0x00030000	0x00033fff	Pagefile Backed Memory	Readable	-
pagefile_0x0000000000040000	0x00040000	0x00040fff	Pagefile Backed Memory	Readable	-
locale.nls	0x00050000	0x000b6fff	Memory Mapped File	Readable	-
pagefile_0x00000000000c0000	0x000c0000	0x000c6fff	Pagefile Backed Memory	Readable	-
pagefile_0x00000000000d0000	0x000d0000	0x000d1fff	Pagefile Backed Memory	Readable, Writable	-
nslookup.exe.mui	0x000e0000	0x000e4fff	Memory Mapped File	Readable, Writable	-
private_0x00000000000f0000	0x000f0000	0x000f0fff	Private Memory	Readable, Writable	-
private_0x0000000000100000	0x00100000	0x00100fff	Private Memory	Readable, Writable	-
private_0x0000000000160000	0x00160000	0x0016ffff	Private Memory	Readable, Writable	-
private_0x0000000000170000	0x00170000	0x001fffff	Private Memory	Readable, Writable	-
private_0x0000000000210000	0x00210000	0x0024ffff	Private Memory	Readable, Writable	-
pagefile_0x0000000000250000	0x00250000	0x00317fff	Pagefile Backed Memory	Readable	-
private_0x0000000000320000	0x00320000	0x003effff	Private Memory	Readable, Writable	-
private_0x0000000000400000	0x00400000	0x004fffff	Private Memory	Readable, Writable	-
nslookup.exe	0x00600000	0x0061dfff	Memory Mapped File	Readable, Writable, Executable	-
pagefile_0x0000000000620000	0x00620000	0x00720fff	Pagefile Backed Memory	Readable	-
pagefile_0x0000000000730000	0x00730000	0x0132ffff	Pagefile Backed Memory	Readable	-
private_0x0000000001340000	0x01340000	0x0137ffff	Private Memory	Readable, Writable	-
private_0x0000000001520000	0x01520000	0x0155ffff	Private Memory	Readable, Writable	-
sortdefault.nls	0x01560000	0x0182efff	Memory Mapped File	Readable	-
private_0x0000000001830000	0x01830000	0x019effff	Private Memory	Readable, Writable	-
rasadhlp.dll	0x6f850000	0x6f855fff	Memory Mapped File	Readable, Writable, Executable	-
wsock32.dll	0x72da0000	0x72da6fff	Memory Mapped File	Readable, Writable, Executable	-
fwpuclnt.dll	0x73fe0000	0x74017fff	Memory Mapped File	Readable, Writable, Executable	-
winnsi.dll	0x74120000	0x74126fff	Memory Mapped File	Readable, Writable, Executable	-
iphlpapi.dll	0x74130000	0x7414bfff	Memory Mapped File	Readable, Writable, Executable	-
nlaapi.dll	0x74240000	0x7424ffff	Memory Mapped File	Readable, Writable, Executable	-
winrnr.dll	0x74880000	0x74887fff	Memory Mapped File	Readable, Writable, Executable	-
pnrpnsp.dll	0x74890000	0x748a1fff	Memory Mapped File	Readable, Writable, Executable	-
napinsp.dll	0x748c0000	0x748cffff	Memory Mapped File	Readable, Writable, Executable	-
wshtcpip.dll	0x754b0000	0x754b4fff	Memory Mapped File	Readable, Writable, Executable	-
dnsapi.dll	0x75820000	0x75863fff	Memory Mapped File	Readable, Writable, Executable	-
wship6.dll	0x75950000	0x75955fff	Memory Mapped File	Readable, Writable, Executable	-
mswsock.dll	0x75960000	0x7599bfff	Memory Mapped File	Readable, Writable, Executable	-
kernelbase.dll	0x75f70000	0x75fb9fff	Memory Mapped File	Readable, Writable, Executable	-
kernel32.dll	0x761d0000	0x762a3fff	Memory Mapped File	Readable, Writable, Executable	-
imm32.dll	0x762b0000	0x762cefff	Memory Mapped File	Readable, Writable, Executable	-
nsi.dll	0x762d0000	0x762d5fff	Memory Mapped File	Readable, Writable, Executable	-
sechost.dll	0x762e0000	0x762f8fff	Memory Mapped File	Readable, Writable, Executable	-
lpk.dll	0x765f0000	0x765f9fff	Memory Mapped File	Readable, Writable, Executable	-
advapi32.dll	0x76700000	0x7679ffff	Memory Mapped File	Readable, Writable, Executable	-
usp10.dll	0x773f0000	0x7748cfff	Memory Mapped File	Readable, Writable, Executable	-
ws2_32.dll	0x77510000	0x77544fff	Memory Mapped File	Readable, Writable, Executable	-
rpcrt4.dll	0x77550000	0x775f0fff	Memory Mapped File	Readable, Writable, Executable	-
msvcrt.dll	0x77720000	0x777cbfff	Memory Mapped File	Readable, Writable, Executable	-
user32.dll	0x77ad0000	0x77b98fff	Memory Mapped File	Readable, Writable, Executable	-
msctf.dll	0x77ba0000	0x77c6bfff	Memory Mapped File	Readable, Writable, Executable	-
gdi32.dll	0x77c80000	0x77ccdfff	Memory Mapped File	Readable, Writable, Executable	-
apisetschema.dll	0x77e80000	0x77e80fff	Memory Mapped File	Readable, Writable, Executable	-
ntdll.dll	0x77ec0000	0x77ffbfff	Memory Mapped File	Readable, Writable, Executable	-
pagefile_0x000000007f6f0000	0x7f6f0000	0x7f7effff	Pagefile Backed Memory	Readable	-
pagefile_0x000000007ffb0000	0x7ffb0000	0x7ffd2fff	Pagefile Backed Memory	Readable	-
private_0x000000007ffd3000	0x7ffd3000	0x7ffd3fff	Private Memory	Readable, Writable	-
private_0x000000007ffde000	0x7ffde000	0x7ffdefff	Private Memory	Readable, Writable	-
private_0x000000007ffdf000	0x7ffdf000	0x7ffdffff	Private Memory	Readable, Writable	-

Host Behavior

Registry (7)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DNSClient	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters	value_name = DNSLookupOrder	1	Fn
Read Value	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters	value_name = Domain	1	Fn
Read Value	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters	value_name = DhcpDomain	1	Fn
Read Value	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters	value_name = SearchList	1	Fn
Read Value	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters	value_name = DhcpSearchList	1	Fn

Module (1)

Operation	Module	Additional Information	Success	Count	Logfile
Get Handle	c:\windows\system32\nslookup.exe	base_address = 0x600000		1	Fn

System (2)

Operation	Additional Information	Success	Count	Logfile
Get Time	type = System Time, time = 2018-03-16 23:08:49 (UTC)		1	Fn
Get Time	type = Ticks, time = 140432		1	Fn

Network Behavior

DNS (2)

Operation	Additional Information	Success	Count	Logfile
Get Hostname	name_out = cRh2YWu7		1	Fn
Resolve Name	host = ns1.virmach.ru, address_out = 89.203.10.56, 189.210.188.78, 94.249.60.127		1	Fn

UDP Sessions (2)

Information	Value
Total Data Sent	78 bytes
Total Data Received	0 bytes
Contacted Host Count	1
Contacted Hosts	89.203.10.56:53

UDP Session #1

Information	Value
Handle	0x128
Address Family	AF_INET
Type	SOCK_DGRAM
Protocol	IPPROTO_IP
Remote Address	89.203.10.56
Remote Port	53
Local Address	-
Local Port	-
Data Sent	43 bytes
Data Received	0 bytes

Operation	Additional Information	Count	Logfile
Create	protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM	1	Fn
Connect	remote_address = 89.203.10.56, remote_port = 53	1	Fn
Send	flags = NO_FLAG_SET, size = 43, size_out = 43	1	Fn Data
Close	type = SOCK_DGRAM	1	Fn

UDP Session #2

Information	Value
Handle	0x128
Address Family	AF_INET
Type	SOCK_DGRAM
Protocol	IPPROTO_IP
Remote Address	89.203.10.56
Remote Port	53
Local Address	-
Local Port	-
Data Sent	35 bytes
Data Received	0 bytes

Operation	Additional Information	Count	Logfile
Create	protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM	1	Fn
Connect	remote_address = 89.203.10.56, remote_port = 53	1	Fn
Send	flags = NO_FLAG_SET, size = 35, size_out = 35	1	Fn Data

Process #4: igkphg.exe

6430

Information	Value
ID	#4
File Name	c:\users\eebsym5\appdata\roaming\microsoft\igkphg.exe
Command Line	"C:\Users\EEBsYm5\AppData\Roaming\Microsoft\igkphg.exe"
Initial Working Directory	C:\Windows\system32\
Monitor	Start Time: 00:02:27, Reason: Autostart
Unmonitor	End Time: 00:03:14, Reason: Terminated by Timeout
Monitor Duration	00:00:47

OS Process Information

Information	Value
PID	0x338
Parent PID	0x724 (c:\windows\explorer.exe)
Is Created or Modified Executable
Integrity Level	Medium
Username	CRH2YWU7\EEBsYm5
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 364 0x 37C 0x 518 0x 570 0x 57C 0x 584 0x 478 0x 458 0x 53C 0x 7CC

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	Readable, Writable	-
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	-
pagefile_0x0000000000020000	0x00020000	0x00026fff	Pagefile Backed Memory	Readable	-
private_0x0000000000030000	0x00030000	0x0012ffff	Private Memory	Readable, Writable	-
private_0x0000000000030000	0x00030000	0x00030fff	Private Memory	Readable, Writable	-
private_0x0000000000030000	0x00030000	0x0003ffff	Private Memory	Readable, Writable	-
private_0x0000000000040000	0x00040000	0x00040fff	Private Memory	Readable, Writable	-
pagefile_0x0000000000040000	0x00040000	0x00043fff	Pagefile Backed Memory	Readable, Writable	-
private_0x0000000000050000	0x00050000	0x00050fff	Private Memory	Readable, Writable	-
private_0x0000000000060000	0x00060000	0x00060fff	Private Memory	Readable, Writable, Executable	-
private_0x0000000000070000	0x00070000	0x00070fff	Private Memory	Readable, Writable	-
private_0x0000000000080000	0x00080000	0x00080fff	Private Memory	Readable, Writable	-
private_0x0000000000090000	0x00090000	0x00090fff	Private Memory	Readable, Writable	-
private_0x00000000000a0000	0x000a0000	0x000a0fff	Private Memory	Readable, Writable	-
private_0x00000000000b0000	0x000b0000	0x000b0fff	Private Memory	Readable, Writable	-
private_0x00000000000c0000	0x000c0000	0x000c0fff	Private Memory	Readable, Writable	-
private_0x00000000000d0000	0x000d0000	0x000d0fff	Private Memory	Readable, Writable	-
private_0x00000000000e0000	0x000e0000	0x000e0fff	Private Memory	Readable, Writable	-
private_0x00000000000f0000	0x000f0000	0x000f0fff	Private Memory	Readable, Writable	-
private_0x0000000000100000	0x00100000	0x0010ffff	Private Memory	Readable, Writable	-
pagefile_0x0000000000100000	0x00100000	0x00103fff	Pagefile Backed Memory	Readable, Writable	-
private_0x0000000000100000	0x00100000	0x00100fff	Private Memory	Readable, Writable	-
pagefile_0x0000000000110000	0x00110000	0x00113fff	Pagefile Backed Memory	Readable, Writable	-
pagefile_0x0000000000110000	0x00110000	0x00111fff	Pagefile Backed Memory	Readable	-
windowsshell.manifest	0x00120000	0x00120fff	Memory Mapped File	Readable	-
pagefile_0x0000000000120000	0x00120000	0x00120fff	Pagefile Backed Memory	Readable, Writable	-
pagefile_0x0000000000130000	0x00130000	0x00133fff	Pagefile Backed Memory	Readable	-
pagefile_0x0000000000140000	0x00140000	0x00140fff	Pagefile Backed Memory	Readable	-
locale.nls	0x00150000	0x001b6fff	Memory Mapped File	Readable	-
private_0x00000000001c0000	0x001c0000	0x0032ffff	Private Memory	Readable, Writable	-
pagefile_0x00000000001c0000	0x001c0000	0x001c1fff	Pagefile Backed Memory	Readable, Writable	-
kernelbase.dll.mui	0x001d0000	0x0028ffff	Memory Mapped File	Readable, Writable	-
private_0x0000000000290000	0x00290000	0x002b3fff	Private Memory	Readable, Writable	-
private_0x0000000000290000	0x00290000	0x0031ffff	Private Memory	Readable, Writable	-
private_0x0000000000290000	0x00290000	0x002a5fff	Private Memory	Readable, Writable, Executable	-
imm32.dll	0x002b0000	0x002ccfff	Memory Mapped File	Readable	-
private_0x00000000002b0000	0x002b0000	0x002b0fff	Private Memory	Readable, Writable	-
private_0x00000000002c0000	0x002c0000	0x002c0fff	Private Memory	Readable, Writable	-
private_0x00000000002d0000	0x002d0000	0x002d0fff	Private Memory	Readable, Writable	-
private_0x00000000002e0000	0x002e0000	0x002e0fff	Private Memory	Readable, Writable, Executable	-
pagefile_0x00000000002e0000	0x002e0000	0x002e1fff	Pagefile Backed Memory	Readable	-
index.dat	0x002f0000	0x002f7fff	Memory Mapped File	Readable, Writable	... Region Actions Download Dump
index.dat	0x00300000	0x0030ffff	Memory Mapped File	Readable, Writable	... Region Actions Download Dump
private_0x0000000000310000	0x00310000	0x0031ffff	Private Memory	Readable, Writable	-
private_0x0000000000320000	0x00320000	0x0032ffff	Private Memory	Readable, Writable	-
pagefile_0x0000000000330000	0x00330000	0x003f7fff	Pagefile Backed Memory	Readable	-
igkphg.exe	0x00400000	0x00c31fff	Memory Mapped File	Readable, Writable, Executable	... Region Actions Download Dump
private_0x0000000000c40000	0x00c40000	0x00deffff	Private Memory	Readable, Writable	-
pagefile_0x0000000000c40000	0x00c40000	0x00d40fff	Pagefile Backed Memory	Readable	-
rsaenh.dll	0x00d50000	0x00d8bfff	Memory Mapped File	Readable	-
index.dat	0x00d50000	0x00d7bfff	Memory Mapped File	Readable, Writable	... Region Actions Download Dump
private_0x0000000000d80000	0x00d80000	0x00d82fff	Private Memory	Readable, Writable, Executable	-
private_0x0000000000d80000	0x00d80000	0x00d97fff	Private Memory	Readable, Writable, Executable	-
private_0x0000000000d90000	0x00d90000	0x00d92fff	Private Memory	Readable, Writable, Executable	-
private_0x0000000000da0000	0x00da0000	0x00da0fff	Private Memory	Readable, Writable	-
pagefile_0x0000000000da0000	0x00da0000	0x00da0fff	Pagefile Backed Memory	Readable	-
pagefile_0x0000000000db0000	0x00db0000	0x00db0fff	Pagefile Backed Memory	Readable, Writable	-
urlmon.dll.mui	0x00dc0000	0x00dc7fff	Memory Mapped File	Readable, Writable	-
private_0x0000000000dd0000	0x00dd0000	0x00dd0fff	Private Memory	Readable, Writable, Executable	-
private_0x0000000000de0000	0x00de0000	0x00deffff	Private Memory	Readable, Writable	-
c_20127.nls	0x00df0000	0x00e00fff	Memory Mapped File	Readable	-
private_0x0000000000e10000	0x00e10000	0x00e10fff	Private Memory	Readable, Writable, Executable	-
private_0x0000000000e20000	0x00e20000	0x00f1ffff	Private Memory	Readable, Writable	-
pagefile_0x0000000000f20000	0x00f20000	0x01b1ffff	Pagefile Backed Memory	Readable	-
private_0x0000000001b20000	0x01b20000	0x01c1ffff	Private Memory	Readable, Writable	-
sortdefault.nls	0x01c20000	0x01eeefff	Memory Mapped File	Readable	-
pagefile_0x0000000001ef0000	0x01ef0000	0x022e2fff	Pagefile Backed Memory	Readable	-
private_0x00000000022f0000	0x022f0000	0x023effff	Private Memory	Readable, Writable	-
private_0x00000000023f0000	0x023f0000	0x024affff	Private Memory	Readable, Writable	-
private_0x00000000023f0000	0x023f0000	0x0246ffff	Private Memory	Readable, Writable	-
private_0x00000000023f0000	0x023f0000	0x02430fff	Private Memory	Readable, Writable	-
private_0x0000000002440000	0x02440000	0x02440fff	Private Memory	Readable, Writable	-
private_0x0000000002450000	0x02450000	0x02450fff	Private Memory	Readable, Writable	-
private_0x0000000002470000	0x02470000	0x024affff	Private Memory	Readable, Writable	-
private_0x00000000024b0000	0x024b0000	0x025dffff	Private Memory	Readable, Writable	-
private_0x00000000025e0000	0x025e0000	0x026dffff	Private Memory	Readable, Writable	-
private_0x00000000026e0000	0x026e0000	0x027dffff	Private Memory	Readable, Writable	-
private_0x00000000027e0000	0x027e0000	0x028dffff	Private Memory	Readable, Writable	-
private_0x00000000028e0000	0x028e0000	0x02adffff	Private Memory	Readable, Writable	-
private_0x00000000028e0000	0x028e0000	0x02a6ffff	Private Memory	Readable, Writable	-
private_0x00000000028e0000	0x028e0000	0x029dffff	Private Memory	Readable, Writable	-
private_0x0000000002a60000	0x02a60000	0x02a6ffff	Private Memory	Readable, Writable	-
private_0x0000000002ad0000	0x02ad0000	0x02adffff	Private Memory	Readable, Writable	-
private_0x0000000002ae0000	0x02ae0000	0x02bdffff	Private Memory	Readable, Writable	-
private_0x0000000002ca0000	0x02ca0000	0x02cdffff	Private Memory	Readable, Writable	-
private_0x0000000002ce0000	0x02ce0000	0x02ddffff	Private Memory	Readable, Writable	-
winrnr.dll	0x70c90000	0x70c97fff	Memory Mapped File	Readable, Writable, Executable	-
pnrpnsp.dll	0x70ca0000	0x70cb1fff	Memory Mapped File	Readable, Writable, Executable	-
napinsp.dll	0x70cc0000	0x70ccffff	Memory Mapped File	Readable, Writable, Executable	-
rasadhlp.dll	0x70d00000	0x70d05fff	Memory Mapped File	Readable, Writable, Executable	-
rasapi32.dll	0x720c0000	0x72111fff	Memory Mapped File	Readable, Writable, Executable	-
msvcr100.dll	0x72280000	0x7233efff	Memory Mapped File	Readable, Writable, Executable	-
rtutils.dll	0x73170000	0x7317cfff	Memory Mapped File	Readable, Writable, Executable	-
fwpuclnt.dll	0x735a0000	0x735d7fff	Memory Mapped File	Readable, Writable, Executable	-
rasman.dll	0x73610000	0x73624fff	Memory Mapped File	Readable, Writable, Executable	-
sensapi.dll	0x73670000	0x73675fff	Memory Mapped File	Readable, Writable, Executable	-
winnsi.dll	0x736d0000	0x736d6fff	Memory Mapped File	Readable, Writable, Executable	-
iphlpapi.dll	0x737e0000	0x737fbfff	Memory Mapped File	Readable, Writable, Executable	-
comctl32.dll	0x74030000	0x741cdfff	Memory Mapped File	Readable, Writable, Executable	-
nlaapi.dll	0x74390000	0x7439ffff	Memory Mapped File	Readable, Writable, Executable	-
ntmarta.dll	0x743a0000	0x743c0fff	Memory Mapped File	Readable, Writable, Executable	-
version.dll	0x746a0000	0x746a8fff	Memory Mapped File	Readable, Writable, Executable	-
wshtcpip.dll	0x74730000	0x74734fff	Memory Mapped File	Readable, Writable, Executable	-
userenv.dll	0x74800000	0x74816fff	Memory Mapped File	Readable, Writable, Executable	-
rsaenh.dll	0x749c0000	0x749fafff	Memory Mapped File	Readable, Writable, Executable	-
dnsapi.dll	0x74aa0000	0x74ae3fff	Memory Mapped File	Readable, Writable, Executable	-
wship6.dll	0x74bd0000	0x74bd5fff	Memory Mapped File	Readable, Writable, Executable	-
mswsock.dll	0x74be0000	0x74c1bfff	Memory Mapped File	Readable, Writable, Executable	-
cryptsp.dll	0x74c20000	0x74c35fff	Memory Mapped File	Readable, Writable, Executable	-
sspicli.dll	0x75080000	0x7509afff	Memory Mapped File	Readable, Writable, Executable	-
cryptbase.dll	0x750a0000	0x750abfff	Memory Mapped File	Readable, Writable, Executable	-
profapi.dll	0x75150000	0x7515afff	Memory Mapped File	Readable, Writable, Executable	-
msasn1.dll	0x751c0000	0x751cbfff	Memory Mapped File	Readable, Writable, Executable	-
crypt32.dll	0x751f0000	0x7530cfff	Memory Mapped File	Readable, Writable, Executable	-
kernelbase.dll	0x75340000	0x75389fff	Memory Mapped File	Readable, Writable, Executable	-
iertutil.dll	0x75450000	0x7564afff	Memory Mapped File	Readable, Writable, Executable	-
lpk.dll	0x75650000	0x75659fff	Memory Mapped File	Readable, Writable, Executable	-
usp10.dll	0x75660000	0x756fcfff	Memory Mapped File	Readable, Writable, Executable	-
oleaut32.dll	0x75700000	0x7578efff	Memory Mapped File	Readable, Writable, Executable	-
kernel32.dll	0x75790000	0x75863fff	Memory Mapped File	Readable, Writable, Executable	-
msvcrt.dll	0x75870000	0x7591bfff	Memory Mapped File	Readable, Writable, Executable	-
normaliz.dll	0x75920000	0x75922fff	Memory Mapped File	Readable, Writable, Executable	-
wldap32.dll	0x75930000	0x75974fff	Memory Mapped File	Readable, Writable, Executable	-
sechost.dll	0x75a00000	0x75a18fff	Memory Mapped File	Readable, Writable, Executable	-
shell32.dll	0x75a20000	0x76669fff	Memory Mapped File	Readable, Writable, Executable	-
urlmon.dll	0x76670000	0x767a5fff	Memory Mapped File	Readable, Writable, Executable	-
msctf.dll	0x767b0000	0x7687bfff	Memory Mapped File	Readable, Writable, Executable	-
shlwapi.dll	0x76880000	0x768d6fff	Memory Mapped File	Readable, Writable, Executable	-
ole32.dll	0x768e0000	0x76a3bfff	Memory Mapped File	Readable, Writable, Executable	-
ws2_32.dll	0x76a40000	0x76a74fff	Memory Mapped File	Readable, Writable, Executable	-
user32.dll	0x76a80000	0x76b48fff	Memory Mapped File	Readable, Writable, Executable	-
gdi32.dll	0x76cf0000	0x76d3dfff	Memory Mapped File	Readable, Writable, Executable	-
advapi32.dll	0x76dd0000	0x76e6ffff	Memory Mapped File	Readable, Writable, Executable	-
wininet.dll	0x76e70000	0x76f64fff	Memory Mapped File	Readable, Writable, Executable	-
ntdll.dll	0x77000000	0x7713bfff	Memory Mapped File	Readable, Writable, Executable	-
nsi.dll	0x77140000	0x77145fff	Memory Mapped File	Readable, Writable, Executable	-
psapi.dll	0x77150000	0x77154fff	Memory Mapped File	Readable, Writable, Executable	-
imm32.dll	0x77160000	0x7717efff	Memory Mapped File	Readable, Writable, Executable	-
rpcrt4.dll	0x77180000	0x77220fff	Memory Mapped File	Readable, Writable, Executable	-
apisetschema.dll	0x77240000	0x77240fff	Memory Mapped File	Readable, Writable, Executable	-
pagefile_0x000000007f6f0000	0x7f6f0000	0x7f7effff	Pagefile Backed Memory	Readable	-
pagefile_0x000000007ffb0000	0x7ffb0000	0x7ffd2fff	Pagefile Backed Memory	Readable	-
private_0x000000007ffd8000	0x7ffd8000	0x7ffd8fff	Private Memory	Readable, Writable	-
private_0x000000007ffd9000	0x7ffd9000	0x7ffd9fff	Private Memory	Readable, Writable	-
private_0x000000007ffda000	0x7ffda000	0x7ffdafff	Private Memory	Readable, Writable	-
private_0x000000007ffdb000	0x7ffdb000	0x7ffdbfff	Private Memory	Readable, Writable	-
private_0x000000007ffdc000	0x7ffdc000	0x7ffdcfff	Private Memory	Readable, Writable	-
private_0x000000007ffdd000	0x7ffdd000	0x7ffddfff	Private Memory	Readable, Writable	-
private_0x000000007ffde000	0x7ffde000	0x7ffdefff	Private Memory	Readable, Writable	-
private_0x000000007ffdf000	0x7ffdf000	0x7ffdffff	Private Memory	Readable, Writable	-
For performance reasons, the remaining 101 entries are omitted. The remaining entries can be found in flog.txt.

Hook Information

Type	Installer	Target	Size	Information	Actions
IAT	private_0x0000000000e20000:+0x100d4	18. entry of igkphg.exe	4 bytes	kernel32.dll:SetUnhandledExceptionFilter+0x0 now points to ntkrnlpa.exe:__NULL_IMPORT_DESCRIPTOR+0x4e4b3	... Actions Go to Installer Region Go to Target Region

Created Files

Filename	File Size	Hash Values	Actions
c:\users\eebsym5\appdata\local\microsoft\windows\temporary internet files\content.ie5\qn4dse0e\ssauf[1].txt	0.54 KB	MD5: 3e8ba82b37bf10a9959010a51d5a4b55 SHA1: fcabe3b90ff877fa0c69efd4e63e1db521452f9e SHA256: 1040f44e7dcae40f945a2ecc35106676a02a903e9679bca2f7e8b2e81d304d18	... File Actions Show Properties Download
c:\$recycle.bin\s-1-5-21-3785418085-2572485238-895829336-1000\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\acrobat\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\acrobat\10.0\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\acrobat\10.0\collab\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\acrobat\10.0\forms\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\acrobat\10.0\javascripts\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\acrobat\10.0\security\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\acrobat\10.0\security\crlcache\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\flash player\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\flash player\assetcache\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\headlights\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\linguistics\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\linguistics\dictionaries\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\logtransport2\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\identities\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\identities\{74a13782-b361-4204-9daa-0a3d49da4337}\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\macromedia\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\macromedia\flash player\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\macromedia\flash player\macromedia.com\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\macromedia\flash player\macromedia.com\support\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\addins\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\credentials\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\crypto\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\crypto\rsa\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-3785418085-2572485238-895829336-1000\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\document building blocks\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\document building blocks\1033\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\document building blocks\1033\14\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\excel\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\excel\xlstart\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\html help\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\ime12\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\imjp12\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\imjp8_1\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\imjp9_0\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\quick launch\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\l3dk0kah\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\low\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\low\05p2c0fb\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\low\3q4bcxjf\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\low\sfx4rkm5\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\low\t9dx4t6q\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\pb5uwkxi\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\tiizucfy\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\zqh8ngyd\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\mmc\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\ms project\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\ms project\14\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\ms project\14\1033\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\network\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\network\connections\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\network\connections\pbk\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\network\connections\pbk\_hiddenpbk\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\office\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\office\recent\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\outlook\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\powerpoint\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\proof\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\protect\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\protect\s-1-5-21-3149542145-3322839065-4058237693-500\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\protect\s-1-5-21-3785418085-2572485238-895829336-1000\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\publisher\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\publisher building blocks\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\speech\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\systemcertificates\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\systemcertificates\my\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\systemcertificates\my\certificates\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\systemcertificates\my\crls\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\systemcertificates\my\ctls\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\templates\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\uproof\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\word\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\word\startup\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\extensions\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\crash reports\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\bookmarkbackups\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\healthreport\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\indexeddb\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\indexeddb\moz-safe-about+home\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\indexeddb\moz-safe-about+home\idb\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\indexeddb\moz-safe-about+home\idb\818200132aebmoouht\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\minidumps\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\webapps\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\contacts\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\windows\cookies\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\desktop\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\desktop\qxvlvpdgkwwfnebo\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\desktop\viwp\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\documents\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\documents\du k7oszoj3hlunu\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\music\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\pictures\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\documents\my shapes\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\documents\my shapes\_private\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\videos\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\documents\outlook files\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\uz5fioslh2es4mr tns\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\uz5fioslh2es4mr tns\znuc10gkdhhn\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\downloads\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\favorites\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\favorites\links\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\favorites\microsoft websites\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\favorites\msn websites\crab-decrypt.txt	3.62 KB	MD5: 0f063ca9c97d90ec8d4afc7cb61b44da SHA1: ff04661ebfd1ac39fcead01f22506baaafa6317c SHA256: 5fcae9183522d659e5aa710722af7f30364e5c031ea0a1f402684b60b1b699f1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\-0vr-5eof.bmp.crab	8.81 KB	MD5: 41a4f7ccfd49c22ff0478ce3e601b805 SHA1: bb2e80999a2c7978e828f70944607c2481d7b40a SHA256: 3c0cf47f985887b33070201ced385b2402e079e725ae4bfcaf37cd1d9e26556b	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\1hjlhgslyadwrp8.m4a.crab	43.53 KB	MD5: 85e8ebd42186047f4f949c6b36977e61 SHA1: 88e608c6c038233f2247927d017f8204ba80d142 SHA256: d03239769691f75ed19735e3b38585fa4fec4c54f3725b96095dbff175b7449f	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\1ia7iqccqa.jpg.crab	71.47 KB	MD5: d848fcf991d7ac9c7d9c0238857e1cd3 SHA1: ce5be878c0c756867ba8512e05b0dd65381df432 SHA256: c244b227d742ea8d768ed4f9f6eca57763104cdcf5e15fa993ea029c6ff707e2	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\2guaeuf.odt.crab	99.81 KB	MD5: 916a1ff98b77c05b29a2dfbbfa0ef2d6 SHA1: 99ca9a175bdc0f6f7e107c0369279dc668a9f4ee SHA256: efe9d5b5d943dd6825fb71be9b3abf027aa3f9565619d9c58d8ccffdb5875839	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\36kwsmalqicd0te_3c_.flv.crab	67.28 KB	MD5: bc777f5f193f46e061992433c1d31be1 SHA1: 648e661b8beeec4776e1d547054acfc84a943987 SHA256: 1e9876621133c50acef8e21a462ab061518fad6e0ab1083006affef8ebc7f906	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\3gxalqztxgxdfkqcu.mp3.crab	30.44 KB	MD5: 71549f1565be5741c7f9d146aa9d7eb7 SHA1: c17f68a33cf54c2b23947f6f7f28ff72bad74b6e SHA256: ee08ceea7e0b818e9cf2a9036acabdc727bc585282ffa23f6f1d4b0b5b5a844a	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\3lj9rcs6puveaqdr7fmm.mp3.crab	23.14 KB	MD5: a3860548384eccadf2a760654babe147 SHA1: 6fb9877c0df3735cda1bca70fefd402bfae671c5 SHA256: 90f8587f750507b0e1055a1eb468a21c4378692014e072bc7328400efd238d3c	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\3zyad7e5phr.bmp.crab	38.55 KB	MD5: c19b35ed1c0948ac42c1cebca7b9d0d3 SHA1: f2ddf846d6d51e33aadc8949d5f8e03e3b8d1cab SHA256: bec2310e71b4805138f1bb3b4d75bb78de77697624e3f020a84c85903bb6450f	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\654dktfxjcr.flv.crab	41.55 KB	MD5: d4decf8d6ee443ff7d6d4f7e3d9edd87 SHA1: 453d9b16c9817c46746458016e05b6a2b93a8de4 SHA256: 9dea85508574be759883403405ffb6d1e4725070557662563eb1c7f8f78ae464	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\6d_t.flv.crab	65.20 KB	MD5: 28109bad07d4b9e2faf7f7e6a28ad1ec SHA1: 34a2523552733aefd04b11527fe92767bb0caea1 SHA256: b7760d734515d01d37b4170c4ea8d05d043b0e746daba091616596264662bd38	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\6elt.avi.crab	33.34 KB	MD5: 367ccdfcc15fdc888f5951c54ded38ef SHA1: 4530bf54e552d9e37b64a6c313aaca1389a85e84 SHA256: 19ccee3ec096d9e46438f722edd4149faed981a4c3eddd7dce9e4a589104afa1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\7oznzjtu6n.odt.crab	42.69 KB	MD5: b3a0770176eca21a306bfd6cae61c9f1 SHA1: eb1c907773160429b7688a4655902d18271e8593 SHA256: ab2a9806ecce331e1653584200350329f2a09153c354465633c72d58971438e3	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\8io7tx06zxi2.docx.crab	50.20 KB	MD5: 67ec708339187479f7ee79f60b355cc5 SHA1: 9a054cedfb177206f7a15afeb0454a1f220f6066 SHA256: ea798a45aa9d563ccbeccae0ab5ab89bcdc9a4cae69636bdbd019b315bc8dcd0	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\9ugr.jpg.crab	50.67 KB	MD5: 849d085ab7768a24f70b30e6373affc5 SHA1: 1f6f1d6d67faa355e014b28cdb6b66c48d1e4248 SHA256: 19c5212f12da0b4e1da4fa399bbf661cf2757bb39d1d3b08c29d98269985e9ec	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\acrobat\10.0\javascripts\glob.settings.js.crab	0.53 KB	MD5: 3f07dd32d3a9b0798575931c941b07d6 SHA1: 96eaa7b7ba9d501f14dfd8ea52786c5fc82cef56 SHA256: 35d0d470d8ebe40b150787f5bccef5e921c6c126a087ff9d2b8a4bf3b21e9ff1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\acrobat\10.0\security\addressbook.acrodata.crab	5.80 KB	MD5: a5e10e01d7a07eb2472146d2c2b3ae84 SHA1: f6561113d3fdcb03af62ea9ed6ebf2e8d6099457 SHA256: 9ba554b5d9d97cf609d8b7d5a600fbfd3b04519151baa94a6d18a1b70eef09cd	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\acrobat\10.0\security\crlcache\48b76449f3d5fefa1133aa805e420f0fca643651.crl.crab	1.44 KB	MD5: 56f6c43d26d35b4216b2bf211aad7593 SHA1: 4c2a452949cb28f59121b7704d7128b6e0509359 SHA256: 59a63b70fe02c5cf7f527c877440fcfb0293e6527cf88f80c5ebaa164d90fd3e	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\acrobat\10.0\security\crlcache\a9b8213768adc68af64fcc6409e8be414726687f.crl.crab	37.34 KB	MD5: 86213b04f0ce0fb3ad13645aa8710b20 SHA1: e5b2664681afb3839e471175d928df42d00deb72 SHA256: afd51593bba3d07eabcb511c4445d6ae7f394211ebde8f6570fc9e1018508953	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\awzyh7svl_1d.odp.crab	86.11 KB	MD5: 2d42c904d789f748abc8a8c8f3a2fd05 SHA1: ff9ab47b5350d3602ca04bc84b3a160ec699cf9f SHA256: f3d21ca009a63f9a09d9a99fe16633f4f4b896ae2deda617f84cd3aea7807a53	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\ccj4o2.mkv.crab	7.70 KB	MD5: 4e27ce38f2f29fdefd1a41ab821095ce SHA1: b29479f9a0075697680761caa0cda11687b003d5 SHA256: a12496f524d729bbbde3b53d759cec9f295af81f1c1a1cd24e2fbb74224ee12c	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\cdfvmiax-yi7imdbsdw.mkv.crab	76.83 KB	MD5: c9d32948f03d3f3f275fd109f989470d SHA1: 3a2afa0f8ea3261313d060916641f685666bde6b SHA256: 6a8cc0395936c08d1ea21bb3eaaac326bc0ccaf634bd0e5c51225e312d2867b4	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\fcvygu7i.odp.crab	66.36 KB	MD5: 19c6036aaff5d32d5425ffa17f844769 SHA1: bbdbaa4cfe7308f47c3bd7715f2e3da13fff23c5 SHA256: 522ef46bbbcd3b43ea92a538a14de54fe7b4353d0a647df525d2e8c5837808fc	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\fhwy wcclsa.odt.crab	52.91 KB	MD5: 63634fca99a9b038f67dac9ab3682811 SHA1: b7359c1aa71b017ab0daf4b1bf13e36f5cdab23e SHA256: 4a3ce3578935b3dc858b726f9fa8ef707c44b67345e3dc833da1b280b9a50516	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\fjhrhun6pyz8v.avi.crab	83.31 KB	MD5: 178a75eecbffedd5d205c873193cc483 SHA1: a61c260bf030f15f3c76d9ccc39d202e16297b1d SHA256: bc17fedc04d777cdc3205a959ad3ea90eedf9ee0d1496e3bbeec6bfc74600dc3	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\fwodx8_7rn.bmp.crab	83.89 KB	MD5: 017dc38d5294ec8c3685a39c65ed2bce SHA1: 812036be1ef90f6b8c9365b7af7eb6be07c5902e SHA256: 9b2c02cd670f0146110e81d3d0e18535bf5d4259ce1da6d05af5cd3e1e26d6e0	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\g48xrkc.flv.crab	50.64 KB	MD5: cf91fc3d1bd9cd55b0ccdd4c550eb6f2 SHA1: 6a6cf8cf41cf9f5016a7c6f90d5a4b7a0732b143 SHA256: 2f0fad01babbb1a993762f35b967439e3fa6a6eae0e1ef39eabab7df655b3514	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\i6qddagp0lynso_f26z.mkv.crab	62.59 KB	MD5: 560f6571305462ec7d07b8d8a1598e56 SHA1: 23f837d4189a59b06431ba40fc0580b34f0d56d3 SHA256: fdc5d8dab7b2d4a5c1a75e1d5d9e3c0c9c332d916d8e4ee0efd76d156f1f5627	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\jamin.xlsx.crab	74.88 KB	MD5: 046d84fe5999b40f683c3fb7753265d6 SHA1: 17bf808da55452a56a65b7373df7a6a6b3d90f7a SHA256: 6bd233f4ea0a9f91d80c501c8db9280c2be83f9a0186bae12617442ff9e581e6	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\jidr.avi.crab	65.94 KB	MD5: 34a96fab332ecf03121924dea4ccd4dc SHA1: 976f9226c2e21cc67b42bf75b0135ba8e7aa12a3 SHA256: c5a4e333928ac47049ae7b0d5e00fb0d1b6a3d71b482c46024aba9463afc96d9	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\jmpm2rfng.wav.crab	24.56 KB	MD5: 28f06fdf8768b42f0f2bec755adb7644 SHA1: 8c3cbc4389188c821f654409e8f090e9795b727f SHA256: ff2b59a6c2747834e40652422122c60c3eedb102386320bc26d35935835930d1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\jqsqsbeg7ooe6rbkwxb.png.crab	50.75 KB	MD5: dd9c58e39ce1e5902801e92dfb037e62 SHA1: 5e187b162db3efa25c09f6c8d50676456f5edd9f SHA256: ef44e5abb9297d3ecbb54067035f3de00895640627aabf59418569abe0cf2555	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\l60o3wuif7gy5ixnj.bmp.crab	71.30 KB	MD5: dc8cadf13c092fe056e79039f8c1e1a9 SHA1: 9ba02ada13a34bd97bca3466b86e55b375ec6146 SHA256: f4473342a207f80c467d045b4acc4a7d8f9f34d821f9104aeab06fe514cf27dd	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\lrgejhu.swf.crab	83.27 KB	MD5: 1864ad89a0798bfdea9182e2bcec324c SHA1: 89b6079698d3f26cafa26931a49aa3128e40d6ec SHA256: 98eeb236098869ebe1d4e018851b70f17b2f015adcf82e527e5cede849dab786	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol.crab	0.81 KB	MD5: 2aff22425ed152531069d6d5c8bcff82 SHA1: 39435b79e8fe078f1c0d2f3975df36fc1e2346a8 SHA256: ba890f2f68a9564a192bce6f8e74ad97f3ace3f4c08e4c36147e890756cf1f86	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\document building blocks\1033\14\built-in building blocks.dotx.crab	3.99 MB	MD5: ae6ec0efdd65e8a664da8cfd23adfb67 SHA1: 14cf142dc4071327020965d20a405fb5acce82c9 SHA256: 246bd34f8b4179a299568239a03e536d5924175e85101fb3dc8c6664f5d9ec94	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\html help\hh.dat.crab	8.91 KB	MD5: 94ab132e7df4db9fe3f413216fb05679 SHA1: aa427498087be720131e65924ddce80d6b913aea SHA256: 72978cd00656b1eb16c052326960c2162ae67ba2916388d6a1e204568f1ea0fb	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\index.dat.crab	32.52 KB	MD5: 8c9405527820cfe6d125654621c915e5 SHA1: 9b72e90cd2a7367bb558989f69e551f89b81c424 SHA256: cf57cf517805476bda125054a2472eecdef84123a6b9550d3e372f352ccdf095	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\l3dk0kah\id[1].xml.crab	0.61 KB	MD5: 2a657bc4baae85a8083e5b08553d47fd SHA1: e20836979fa53f23b22c01460cc693b110782c29 SHA256: 5ffd17c44700e277a50bb81ed12e93d5faf5f737638c06c085d0719e381c41f4	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\low\3q4bcxjf\id[1].xml.crab	0.61 KB	MD5: 533c4d3d1d3cc67ebcf992ee17a37ecc SHA1: d8f37f53419b268623a5b99c6b100509378bd30d SHA256: 764de2dfc00e596a92fca5927b5e33d8dc7af54293d678d13e8ab0ee35e51297	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\low\index.dat.crab	32.52 KB	MD5: a0329225ea92144a169ea0ce4357bf3c SHA1: 20f191f4e4d6674dc2d0241ebf57bfd0187a2268 SHA256: 3d602eead1e951ffdbebab77a5089e8721713acd5686db5c9f889c0748aab970	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\ms project\14\1033\global.mpt.crab	382.02 KB	MD5: a885b5767e70008c32aad2e36ee02c05 SHA1: 9edf8bded7faf4b3179f3555c0e16e7b5a6ab8b0 SHA256: 016e56b8db2bd466fdf45afcc5575dfa085c9fbeb5f7a3148b8b772a5544de79	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\office\mso1033.acl.crab	37.41 KB	MD5: ac138a26437d2cf7d682951f861d1f5b SHA1: 0279dbc58e8d1927949e7eab81406b5bb827a5a6 SHA256: bb782bf0f6a61870bd2ce2d7358b152908f2ddaffc0bf9a17ca2ae5778a91cc5	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\office\recent\global.lnk.crab	1.88 KB	MD5: 02c84097d0b3de6224bb3ce0d44c1215 SHA1: d929600143b47f4eba2e89ff093d7d277c586e56 SHA256: 96bcb1157d28b976ab63a7d9e724c141db6c3b0d5ef7649e2f7a27e947d014cc	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\office\recent\index.dat.crab	0.59 KB	MD5: dc54aa59163f73219366faf0e5fb3e53 SHA1: 15db951e81b8e0b423aef5b8d814b24864f45ed3 SHA256: 35741a7e6c26f0d10297052a4aae776ee1b8d6519e6e6015b6e20e457aa0ee18	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\office\recent\templates.lnk.crab	1.59 KB	MD5: 53e0666e818d768340dd1f58273df0f2 SHA1: 0926be13143f841338237b4f80eb6ede75befc87 SHA256: f5b225c72d9351ebe46bfb3aa251ad43544ac6b6879f44c08e89d3639e57f4ee	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\outlook\outlook.srs.crab	3.02 KB	MD5: 58d1472e52149dbcb87c98dfe2dd921b SHA1: 00dbcbf7280939e0ec96cc80c51bb61abe4cc911 SHA256: 1ac4aaf7188dde38eebf3d4e37672a6814b3e3620b174fc1e771c84b43a7aeaa	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\outlook\outlook.xml.crab	2.80 KB	MD5: ca746216bc1fe8bb1a7f01b955f7e21c SHA1: 178b3db6f71b92747346c255ea6b9a21ec47d827 SHA256: 5c1da85f907883fbc10582d4752aacb49c081c114e35772117722534245db514	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\publisher building blocks\contentstore.xml.crab	0.69 KB	MD5: d6d343bcf9d2a32d9dde84ca237b17aa SHA1: 74a5622724d72002e50ffcea8bb90889ff108830 SHA256: 3572e05df3152837dcf528a65f98ac3c1b5ba23e926105442c4bed46ff158562	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\templates\normal.dotm.crab	20.67 KB	MD5: 025dcae4ede524024c54e99ff442c406 SHA1: e379279c16293cd0f39ed8272b5421debce6b018 SHA256: 3779b22494e816a716736ee4603eb272ee7f643baeda3848b09fa18bf0dc2e26	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\templates\normalemail.dotm.crab	20.50 KB	MD5: 248e3cee946c1736dadf85ba6d5ae9b5 SHA1: 707fc03119b364d7daafc326c75fa73b5026a2c1 SHA256: a5f5a06166856ef7914578ba4b65e3e5ffed342da6550fde61e7ecb37a10eeb9	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\addons.json.crab	0.55 KB	MD5: 96e17bf3afd456d9bd11730b240a6f3b SHA1: 59ddc7408f8a3cb225864c9e1ee86cbf550e7f55 SHA256: 3a4efb0edf06fabeecf2f5094d3608c0a0074e5a18a6bda110317f98f809d989	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\bookmarkbackups\bookmarks-2017-05-31_5.json.crab	3.48 KB	MD5: 01fd910ce11c46fc14368660248abf47 SHA1: 8b17ee3e2204cbe7ceb6b393aadd455c7b17217f SHA256: 12e623be44f953ab8a170c4e761126c6a1240206279f27845ec0f46dce675ced	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\bookmarkbackups\bookmarks-2017-07-12_5.json.crab	3.48 KB	MD5: ea1a1e0ac7c5578c108ebdd1591ea1f9 SHA1: 638d7fd7a48e23f38ef104b252d60a43e0727372 SHA256: 68cc0c927b069ce677b6e2eecfc9509bbdf70a6f327815472cf681296c25d506	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\cert8.db.crab	64.52 KB	MD5: 85f607cf75f12379d73248dabcfa9222 SHA1: a1ef256bb6d79789973c69d250490fecab58117d SHA256: 12bfc40d88429c8bff59bd347bd028dabd5646bcfabc13376fe7418714d3428a	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\compatibility.ini.crab	0.72 KB	MD5: 4d2bcaaaf198fcfde333166cf203816e SHA1: acddf85c8020907f3c3c978221f8a179b996baa9 SHA256: 55c875e1d6d6f4026f4f8f3ab1577152e9d9a9a19d8c46afa6a5cb45603a3f0c	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\content-prefs.sqlite.crab	224.52 KB	MD5: 7de4627b6474b4059248f8b75119ad01 SHA1: dc54491ed1884dee67cdda57605e524bf5247111 SHA256: 758533855a2ec885cb0dd7d56f05b75f6b1d9cba9e0f65965b4cde68560a8517	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\cookies.sqlite.crab	512.52 KB	MD5: b354ae0670c1a46cb9293c537b32f554 SHA1: fca9a5e00e1be807cc0dc52a3dc4029b41064f82 SHA256: 3d6e043237323fb634a50df0fa12cf9259e9d04dde8eb0067ab009f4c07ef2a4	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\downloads.sqlite.crab	96.52 KB	MD5: 777941ec4d04f7dfb8dbb4015c03f4fb SHA1: ce530fb6e43b38c13bc2f1b031b24cd9c24cb04b SHA256: 5c9ce123eb8f95517c37d918d637c80fc708a118443c82c7b295fac85327ac9c	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\extensions.ini.crab	0.66 KB	MD5: 5095ad000caacad579a96be7b6a24ffc SHA1: 5c947c4877bb93c0d7260eb5aeaeeab916c84a71 SHA256: b741ae23537873b7792b3e92338dd287253c958980ad18a8f35053ae5b1d31d0	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\extensions.sqlite.crab	448.52 KB	MD5: 77477c9bcfbd14e3eee2de9d33f00f7e SHA1: f5b680de430c48b31a98aaeba36556b86f00ab19 SHA256: d8063ec23df0c5bc9de85e859056feb980418a5e21f3ca16365ac9218bf73ed6	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\healthreport.sqlite.crab	1.09 MB	MD5: 1cce41b605ff3b3f8777b11a91796811 SHA1: 310f2f463c1576a784a16e7ffb34a31592ecc83d SHA256: 273fbd7625ea86af896e09fc2f166a403e4295e897656b53072e7c944307d2d3	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\indexeddb\moz-safe-about+home\idb\818200132aebmoouht.sqlite.crab	1.03 MB	MD5: b7003198cc322def4894e7c100932cdd SHA1: b9c1205c88a43f41559ac8fe065c1a00543b8e0a SHA256: 766e0ae9b9bce41c57841c29b8b467efb42e8cc102343360257274e126367b9b	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\key3.db.crab	16.52 KB	MD5: 3f68e1424cbcb8fe05dffc3d9e8f5b33 SHA1: d6b36733607350e65b72c915e3df1dbaec544aaa SHA256: ad393a7ae6f25360e48395eaee5998076d8c09353726efbc1aecda7266305f7e	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\localstore.rdf.crab	1.95 KB	MD5: 4c28e8bce5c488f260ff15def7351d95 SHA1: cb431e288013ed967871b031faff762682a64079 SHA256: 27027492820f31965a450a92058d503c4d730965ed5f2dcaff558488e46d0fb4	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\marionette.log.crab	0.58 KB	MD5: 733bfa950150452d182304df623be36a SHA1: e50bf0717d918cabd86d37ac7e8202b85059d9a2 SHA256: ddf71c396ce488b9507c2a5c4d98ee310d0a8a2fe686a1f5455329a4e49c07f7	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\mimetypes.rdf.crab	4.27 KB	MD5: 9f1f625911656835c5dc8229e9a36d4e SHA1: e1dca45af5fb53f4571ffca1c47116c2e15c8e24 SHA256: bd09fbd8dca883bdc8f3366380c6eaf5d07cb5ec55691df506c4145ad10315cd	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\permissions.sqlite.crab	64.52 KB	MD5: e91f1ddf0c9db6a71e7d2e87aec5ed25 SHA1: e0d99a22d1e0f5da57c28026d07d976a5fe10ecb SHA256: c70f043548f4680fd2068d63dff35ba5a55854a7e515da8500d9ef8a79e7af36	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\places.sqlite.crab	10.00 MB	MD5: a5fff19ba31df531dc22dd925c539e23 SHA1: 99ec318bcf5605dca26a2c6bfe64991e2251838c SHA256: 05d58bbf18b92b58dadaa135b3c949b91186a86c8de2e2c41d7e74048c982516	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\pluginreg.dat.crab	4.03 KB	MD5: ffba447139979cc704821ff5b029c24b SHA1: f263692c3cf1457a93549781694fcd002f281e6b SHA256: 81819eebd1b7191bbbd918f9048095d3ee0ba8f0edd12a464f55edc8360d6267	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\prefs.js.crab	5.00 KB	MD5: 23f801ac882b4e4a9dc395157f948acc SHA1: 523beb1a038a0ad871cd2e7925def1cd8535ba36 SHA256: 81ef61052da2694d9e480175a4a99d1ec2d7b486a8dd36bc512b1e3282e27be4	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\search.json.crab	16.86 KB	MD5: f44d88edbc54a3c1212f990fe55f74fb SHA1: 09cdcb3a5b4ed280c2baec508ab5bd0760fdd053 SHA256: 4cab320daf85f4c89c362d65a2f68a010dd6e98e75d58ba307e626971579b650	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\secmod.db.crab	16.52 KB	MD5: 2b138785af431b9ad9f854f02dc5bc26 SHA1: a73e672fd30f53ffb2fcbe8dfb7128f439aee29f SHA256: 92f6939be78add242f1a5321725e78bce5437999ba39e09778559ab319b9ca3e	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\sessionstore.bak.crab	1.09 KB	MD5: ad76eee20ac672499e04c11341e9a13d SHA1: bccc4a20869fbda16e4bffa3f2ea9282d9d5e96d SHA256: b315c1e2b1c570d9f3d0ef91a1b8ec5662c0c70f4d9f7160302c13ebb1e7f175	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\sessionstore.js.crab	1.09 KB	MD5: 41eee4ae6f2e51bccd197272372aa5a0 SHA1: 3b83d6e001a6f721c6af412f1a32adba894e57d4 SHA256: b91d876f4077fc1d493d9cb9561f18ae25244c432f4e4d8a6130745cd5707f10	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\signons.sqlite.crab	320.52 KB	MD5: 4276475ec146709732603ce13b6b7921 SHA1: 78ec37d31f3f6c1505b9f886bad80bb43b2844bd SHA256: ed5ba50e1351ad0a032ab51ed1d13cbb1d3b6a77b5f6a9be05beaccb09994faa	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\times.json.crab	0.55 KB	MD5: ea0fe6e6b2f5d390fb3736cc818564f4 SHA1: 08df48a93dc1e4ca67a7caa074b3a9676fc38ea5 SHA256: 7dab453566db4782ecc6cc33faa365abea9db3d3b8bcc7a7ad1c400d5a89cb00	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\urlclassifierkey3.txt.crab	0.67 KB	MD5: e079342544439aff4537296c664be9b2 SHA1: 10680e8b8816a676e83bb7592dfd3f0f270b8b8d SHA256: 92764d5f444b3e027bca9ad1949068863c54c5ccf679b2238f848e3e94015a37	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\webappsstore.sqlite.crab	96.52 KB	MD5: b644aa9599a915ce320d1116f8aec34b SHA1: 68b5c817d40584cfa81cda2970b67c85f22a0e81 SHA256: f507ba728e4be75cf2afb4aff94598accc2a20607126279ef1894bfc48f6780f	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles.ini.crab	0.62 KB	MD5: 65439b3b9430a6f0ab4e7a1348a31b2f SHA1: 7463b785f83471a99a19f75848d82b81cd4cd883 SHA256: bb08baa28aa079d372c1f4935de41c8423a6fb71ca0d2eb297cc9a9e04e30b2c	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\nhq1hcgmsg8b.flv.crab	90.19 KB	MD5: d4172b883893e5f4ae3d2f8a8679a3ce SHA1: 8258e38b183adb15e1ef96e1f3c310ccd0677e9b SHA256: 22273e78080dcc943753fa8af124d9ecd3bc7c55437b9aef02e13a428d1eb90b	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\pdsdf-o2xexbw.avi.crab	54.56 KB	MD5: 70efdd7433493b62d8559a48f6242b37 SHA1: 2b113d07e65afc8b2c53c31a620656ff096b9d00 SHA256: 2daf2ffc6357e8c401d0501ffa92ce0ff7ad5cafac3f585c7f23c288bb132d08	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\q-s_4qhd1.gif.crab	52.72 KB	MD5: 752461aeb93d008c52267f979dfb50a6 SHA1: b4643cb755ef1e6ab139e075d186dc6f22b9f334 SHA256: 79bd54fc741fd1ad9b4d6697b30e667983a45f19f4a4cac6dfad24f888519c1e	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\qnouhz1japy0u.m4a.crab	8.00 KB	MD5: c8cf148f70b6dd53a58378c5a497d700 SHA1: 2b9f5767ed01ee3acd68433ab367ef7dde9201b4 SHA256: 544e75bf9782231c8c1eced9669585d9c9346df1f2ddf3e45dc1a98b0db73d41	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\tvzjzs.bmp.crab	21.72 KB	MD5: 4f738e78ace9a8b7c9f8653f6577f27f SHA1: f2aa0c8c53ef266265e19168bdc0686c0d10d138 SHA256: 948818232e2b1947f9b1c164cee16008775fe422df3c8e59383d94c3fc2cc46f	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\uhi52n.flv.crab	46.72 KB	MD5: 594b44957e6e481ef3f7d576261f1cf0 SHA1: 852ee835d38b1d2e1332831c406e5226eb7d1ca7 SHA256: 60d672804f51ee2af9c61210a6236afe77a86cf20163047e072182c1e9455de8	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\uw1opw43z.mp3.crab	94.67 KB	MD5: 5181b75e00a01ca26d8a71bac5b63405 SHA1: 2be2451a5a923c6ba2acb081a7a037c035d594ca SHA256: 0f7ca33ce964a50ecc641634d347deda248ae13ec92716ecebdd225c1ecbfa29	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\vaau_auct2-v.swf.crab	74.09 KB	MD5: ecfd61dbebaeec300878cae6c16b3b53 SHA1: aa91422e0419770ab80af0c4e4cbb05e062b677a SHA256: 9c7547b5876ccc0a6b1add5c787302e50ac411ec825583f8b76268edf5b9875c	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\vgm32iz-b.swf.crab	98.66 KB	MD5: cf9fddd159bb3f73ac020f7a662b6591 SHA1: b80a1941687cdd066bab51ad95a9b8c321b5d655 SHA256: c2cdb89331cec146e697c3fe7849529304fd94612893a53ec7b8f72908300f6d	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\z9ok2xvdtxxzz_svtrt.mp4.crab	78.86 KB	MD5: 7c07488bec09ee0e0b182bab1f573985 SHA1: 5d3011e98d2205e5d8b915e7f6cb3afdd3fe62c5 SHA256: 7cbe55c95e8f2cc2500d36241202dfee14bcfdcedab9ed274e32fec4b3a207d5	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\_1eugfemd.png.crab	96.91 KB	MD5: d24e0f0936032e48eff73d4243afbd6c SHA1: c6fe4ca3779d268c0362bdcc2916d6ab63888785 SHA256: e723e2c63adb3c51466cd6a09e8306717016489729970cde0185eb7faec72b92	... File Actions Show Properties Download
c:\users\eebsym5\contacts\administrator.contact.crab	67.30 KB	MD5: ebf1dc9cd72f479150c6f8d5f8248c51 SHA1: b1506fb8c0bbcacbc1a084581fb3348c039171d6 SHA256: 476b35924daca751f0c6d265c10822e31e4c5e0e91cbd2a36b56d2a2c81c7b19	... File Actions Show Properties Download
c:\users\eebsym5\contacts\ihnvbh euuncnh.contact.crab	1.75 KB	MD5: 47a0e44c69fc2aa194b740575db191e4 SHA1: b969b252ec488511495c70687df1b0d50e9a7d12 SHA256: 5ddb4679420b67edc866ab2af8acb6a9c11d0171a42c1f8187dedb54e9281d2c	... File Actions Show Properties Download
c:\users\eebsym5\contacts\lodkd auftnm.contact.crab	1.75 KB	MD5: 3648cf128ac84b3af06cc2ac75ad8cb8 SHA1: 837fefa9f705739f4773ba866d377035cd845192 SHA256: 1e22664b5ed5fef1c64795efd98692a77b7e1182d2f1ee5eeaee62635ebbebc1	... File Actions Show Properties Download
c:\users\eebsym5\contacts\mneuc uhnfghgg.contact.crab	1.75 KB	MD5: 3962fdfafb4dcd21c2937d643b6871d7 SHA1: 6fd69eea7bfdd06976f36301eb3e3a756e038dfd SHA256: d2e6466c09562931c01a4881ff7d3751bc1d21a28d2abf9c5b504d447223c6d1	... File Actions Show Properties Download
c:\users\eebsym5\contacts\ofhbnh edferrr.contact.crab	1.77 KB	MD5: e9ac08abcf7f9411a02ecf345fa884ce SHA1: 2ed51b52c9907d75c9b05ce17008844f7e9d5c98 SHA256: 50b4d834817144e2cb48dfc7816ef28f0c30235a5a9c166e6d1b36a2ef29526e	... File Actions Show Properties Download
c:\users\eebsym5\contacts\uosjfl sidvllie.contact.crab	1.77 KB	MD5: 018f0b55b0f51558fc6e0afcf968a0a1 SHA1: 2725a74f5e7b637394a091067f337a486ffff7eb SHA256: a4f23c56ca26f01983bba990ca038ebe91937b19051791ae2c557db73b289b73	... File Actions Show Properties Download
c:\users\eebsym5\desktop\0dvhpomjlytro_v.mp4.crab	49.53 KB	MD5: f0c35c27c2d4a1ba2c56e1aa31a5495a SHA1: 52e8601079ffc29a4bcc909392e0bba87855666b SHA256: 9f365ecfb0ebe1263be08d428b80032758c874bcf11f424811663772761f86e8	... File Actions Show Properties Download
c:\users\eebsym5\desktop\1ml-7apj0jkjqdbzzwxj.wav.crab	8.11 KB	MD5: 8fe94c15219e13426975774dca645380 SHA1: baa6405e7c4d0be3fcb804c028a9b142b4e82868 SHA256: a3b50e7668f4f08129e5e376502356a475de963b1a584e275fd569e5d8413c67	... File Actions Show Properties Download
c:\users\eebsym5\desktop\3jua.swf.crab	63.62 KB	MD5: 2a9559ebc5392da50314ed4ff9130c75 SHA1: 4c6426c337b9b2cd794b452beaa6a7c8f1ae5bc5 SHA256: 913c45e7c08a361ed2a7943a6e68aa2574919c3deee51b4c930e31ef8023fc79	... File Actions Show Properties Download
c:\users\eebsym5\desktop\6tvjswia-wbr5.avi.crab	17.44 KB	MD5: 4b670bc9500cee2a8ad943cfc968d2b5 SHA1: 86d41b9444a5aad83de427f9ebb923e0b1d5ecd0 SHA256: cff83ec9179365966b3726905e66e8a8d9293e2780c4dee5a064182c3ed48fce	... File Actions Show Properties Download
c:\users\eebsym5\desktop\9b2i7c_e8rispmxl6f6.bmp.crab	85.19 KB	MD5: cca8871eda7d2f7d7c896d75ea5ba39c SHA1: d2dd4eda5e08fc334b9621289d133d8629fa0cd6 SHA256: 3e1e2c1d6defbe40a752fea156a96603bad993f49a4f453db4a08e5e97089d66	... File Actions Show Properties Download
c:\users\eebsym5\desktop\bjgohqsuapvhv hfx8a1.m4a.crab	28.95 KB	MD5: 4863c11cc13f33aebe6b86af3ecae158 SHA1: 190d72c0c6b82b012f3c69771df52dc1b6d8bb0c SHA256: 661bf3dbea75e1e1a97392c13b01ecbd5722d8a9f7de5134e00ff23c8d8b4fbb	... File Actions Show Properties Download
c:\users\eebsym5\desktop\dl13.jpg.crab	53.88 KB	MD5: a0dc131f42938127e00cba31f68664e0 SHA1: 6cfeaf063013c97749bb283326676fb5cc0b2ab8 SHA256: 01d6c871a8398b1b9b7753ab3cf122d9dabe5a3270c3e5968cc1093865e2949d	... File Actions Show Properties Download
c:\users\eebsym5\desktop\e3i0xdqbd.mp4.crab	25.53 KB	MD5: bff2f8ed16eb361ff9cfe339261730e3 SHA1: 8d51ac1a8203a52c20c30ed004092a14251ec405 SHA256: 79d876355c252bf2cfdc55be99899bf121e357939eb79a0a72b3adca50b258e5	... File Actions Show Properties Download
c:\users\eebsym5\desktop\gaqtftuchs.flv.crab	49.00 KB	MD5: 2abedc4597afc32abd8030c35adafa82 SHA1: 1b93ceaf7013bc42fab4945a1070be49769837e3 SHA256: 5d26c8176797bb6a1b64ebb508379a7f95eca08edef25c3320788dda1f26c039	... File Actions Show Properties Download
c:\users\eebsym5\desktop\he2m.mkv.crab	47.36 KB	MD5: fd7bbc3a02bbaadf8f0c26b29b5a1d08 SHA1: 8aa4abfb5bed47bab7b72c5d4932cfa2a03fdff8 SHA256: e4b1c98272f1b3524c80f61f35e54d82e7b3d827e66877460391604cf39ab50c	... File Actions Show Properties Download
c:\users\eebsym5\desktop\lbl9s.avi.crab	16.70 KB	MD5: 3fcb52913e5eebbea3714f5389357fc0 SHA1: 00be664e5007683d0a39750fd18bade2da30a1d7 SHA256: f87189425a428b17642952c208a01569d518622f3832e70c8d8bd4e25b036aa6	... File Actions Show Properties Download
c:\users\eebsym5\desktop\oelmejsl85h.m4a.crab	37.42 KB	MD5: 361564e03d815e91fda03b82b06120cc SHA1: d79f4845f550d77aef6779ca712716d97753949e SHA256: 2d1316eff868efe39f69b6998e633a91cba8726fe8d23bbbeb6d10d0f967d50e	... File Actions Show Properties Download
c:\users\eebsym5\desktop\ospatbxgjzl.wav.crab	85.39 KB	MD5: 8b209add8a0b836ea089e1451d4552d4 SHA1: bd55cc5d7de3e19768f28e303aad72e2cb4c9db4 SHA256: a2673cc4506892ee2c73b2d94ab8573edc8fb07d44bfa9983ee619d554a1f87d	... File Actions Show Properties Download
c:\users\eebsym5\desktop\pue6unyh0mmp-vcx.gif.crab	74.34 KB	MD5: 365413b379f2a4170c81b3b713fe343e SHA1: aac6ca62af4729d9b85549ff0f99262028ad5946 SHA256: 3125cb200a217139a648a441340312ce25c226004674338fa7e16655fb3bc5a8	... File Actions Show Properties Download
c:\users\eebsym5\desktop\q3a_7vje.swf.crab	60.95 KB	MD5: 81ecfdf8f82a242ff08fd64b8e50d337 SHA1: aa9d89bafb7ed83406e626d5f1788879f37563c0 SHA256: 9efa9e2814737b210988b2e6dcbd9d8610e941cb65f6b323470746ec0e774dcd	... File Actions Show Properties Download
c:\users\eebsym5\desktop\qxvlvpdgkwwfnebo\f2-_w1qzinees1i.png.crab	80.20 KB	MD5: bf2f31568ce40cd91bbb083f413e1f96 SHA1: 5045fb052a3754d330b242380a83496e9119cc99 SHA256: 66b8e9ad7fe140640fd25eb77a5858fb87ddd5dac78d47e482f9f1c45ffd3480	... File Actions Show Properties Download
c:\users\eebsym5\desktop\qxvlvpdgkwwfnebo\mcrwx.flv.crab	90.69 KB	MD5: 7d23eda19afd8c3c372574de29e5b9d2 SHA1: 73bf4507ff97c00a571bf0978a6f8b8b46fe42b7 SHA256: 807fc52971f481d82f0c1a0af5f6da7f3bfb47a1e4b83ce12604cc5e9094a923	... File Actions Show Properties Download
c:\users\eebsym5\desktop\qxvlvpdgkwwfnebo\qvimwuq.mp4.crab	85.69 KB	MD5: 6af04f4f5dc330b59c1abbbe4e5d9f3b SHA1: 50190179779100282546b8515beb164bbf16575e SHA256: 616de61b67dbffec7c9f4f4903716bdbec9ae2e36f078f789c1420f172fe1f1c	... File Actions Show Properties Download
c:\users\eebsym5\desktop\qxvlvpdgkwwfnebo\yst.mp3.crab	73.56 KB	MD5: 1f69dc48c76c679eded61c2a042c1613 SHA1: 16c9188b5d5b4cb6548880b8e50cc8738786bb56 SHA256: 889490c4792bb32b900862719139963a21995f8d76d641d37cf42cc88f3823c2	... File Actions Show Properties Download
c:\users\eebsym5\desktop\siom.bmp.crab	26.58 KB	MD5: 0364d785270d794d3712672c3e68966d SHA1: b2469f117adb91049050ab023078227260375911 SHA256: 79a04cd03a073a5683ae602778512238c4f0edd3a20aa57749b068b3fcf5a970	... File Actions Show Properties Download
c:\users\eebsym5\desktop\sk4m18olbpy.m4a.crab	6.77 KB	MD5: 987e9d3defd93f31e5a72424c6898a3c SHA1: bf8aa9c5e5f8b110c97e63a6ac7fe742c338f426 SHA256: 4dd0520d1d2b45ac823f2018cdb80fa63c79da464d80b6cb48532b8bd8fde0b7	... File Actions Show Properties Download
c:\users\eebsym5\desktop\sz uo4.m4a.crab	79.64 KB	MD5: a9eaa9dc4fdba33850a1109aea511665 SHA1: b99876d3796276c35ab062977bd9c7a683ca618f SHA256: 8bfc42c12d6ebf14777f8181d86231fe179776e50326a972e7e74d1fdca64861	... File Actions Show Properties Download
c:\users\eebsym5\desktop\trcdxhdihdm.jpg.crab	9.27 KB	MD5: 96b61f94c71cb8a27243e6662f64bd1e SHA1: 632d670f1bb88d20d738233f27b3716d7cb1bb28 SHA256: ab3bf70f6710189d725e4dbeb8e044bd656d89484e0ca6b0dd973befb56f2259	... File Actions Show Properties Download
c:\users\eebsym5\desktop\uhzcnq.mp3.crab	4.06 KB	MD5: 29f38f630f2a9dda0d1f61d0ffdf7c34 SHA1: cd044101d46571daa97c92344e752d073dfebbc7 SHA256: d2b473135b223b1a5266d1af497d935f191fe5b9cc41530d4b40f41ada1b22f7	... File Actions Show Properties Download
c:\users\eebsym5\desktop\viwp\2twq-1xpvbzcu.wav.crab	59.69 KB	MD5: ec9a56876f3524278b72d987fef1f142 SHA1: b2c85da286739c63e9979cabeac97fb92400be35 SHA256: 2a13c92ca9b232f85d53be63ba2463be7d2e9566f775d7c9bd4004c70afa0ee7	... File Actions Show Properties Download
c:\users\eebsym5\desktop\viwp\dhp8.mkv.crab	28.45 KB	MD5: 7537a4b569a0d7927ff5a1b611c1f7a9 SHA1: f63c6c1a41dbae1cdb187d206e1f7cbc3518218e SHA256: b8dea00016ba595b6480109aefa6d086b778b8a6ebbd43bd68f0e12279645721	... File Actions Show Properties Download
c:\users\eebsym5\desktop\viwp\diep9gcl_kvxmgwu3r.png.crab	86.16 KB	MD5: 30c2c1b8d69a21e6783691dea85272fe SHA1: e44411d60768b35e2be4034c511e2a4f1c826b83 SHA256: b73867d55571a7fa1a32c1d453999091bb81020b666c8ecd19e25dfd80329300	... File Actions Show Properties Download
c:\users\eebsym5\desktop\viwp\lklyw-il4wra.ods.crab	7.41 KB	MD5: facc3df60171b89e3c38475fee1f8d05 SHA1: e5279cb78d449e562f22fceab399c58c58842d14 SHA256: 77c5951fc1cceacf1a1df11dcbc315b7510dc159ef059c7545d5a46efe11f515	... File Actions Show Properties Download
c:\users\eebsym5\desktop\xckhq1j0co.jpg.crab	33.02 KB	MD5: 059021c8910ee4b91318af18a3d09a81 SHA1: cecfbd152bb1ee2ecebfb5d161dc001b7f49b7f8 SHA256: 25affe96a7df550f2a715bb3d6e590d28397de296717c36159ae93bb2fd95b6f	... File Actions Show Properties Download
c:\users\eebsym5\desktop\y16hxoz8ujx7n.flv.crab	22.20 KB	MD5: 3804fc267972dd5ec2c66fff7ac8f6f9 SHA1: 365e6804d94a0bbf0e5a7c76f4c40f18893af051 SHA256: 1d2888abdc05367e2c31c967f1d65ccc84045fab5eaee12a95139e9df611cda1	... File Actions Show Properties Download
c:\users\eebsym5\desktop\yln2_.gif.crab	43.02 KB	MD5: a989a34d3502368b4ec7bb6b409ec777 SHA1: 24906ecf880a648e586fd17fb0540c57d6bdcc7d SHA256: e55790dd1ca18a8314a5ba7b96de5fe31fd4480185f1ed928ece73278bd372dc	... File Actions Show Properties Download
c:\users\eebsym5\desktop\ysaobn7ufb0kib2.swf.crab	78.94 KB	MD5: 1b91407f1fb861a65e63c3919d31849d SHA1: 66af4b4975e858cd5975a5cad5d90bb8cb3d2891 SHA256: 321a1485f2083e397cda39a1f3c18e0d19065e27759645eb2c6b4a27c37a1315	... File Actions Show Properties Download
c:\users\eebsym5\desktop\z3h7xk7.ppt.crab	57.61 KB	MD5: 26fce98f0368b7cbc5166320cffe5975 SHA1: 03d00dbf8b2a708167f4bb960fecc6edcacf3b39 SHA256: 0b4c889533062734ff5fe3a0d929e479e449d080d38a636c653ca4ff3c88503e	... File Actions Show Properties Download
c:\users\eebsym5\desktop\zmgna.mp3.crab	27.92 KB	MD5: 281abe467c54dc7f3d7ec8f8648b876d SHA1: 7e5cdc8615be2d427cbc5f7a5bd9b0f1c3eb35e4 SHA256: 00b2ad52ade13495d25465f06ce2e962354fc6a601e1840467dffca81741fb2b	... File Actions Show Properties Download
c:\users\eebsym5\documents\0qsqlpnxj.pptx.crab	95.70 KB	MD5: 76ad4080734bdbf334675612b731f0c3 SHA1: ff0429afff46f14d2009dae69a29429bc2e8cc51 SHA256: 9bc7eee1e950134043ac431de13d49fcf5be3244a930893c7b82c8c9ee1f964b	... File Actions Show Properties Download
c:\users\eebsym5\documents\6krllw7id8y.docx.crab	3.42 KB	MD5: 865ce514dd2b8c20088f596941489ed5 SHA1: 074cc1a4459d9a94b6bb347b389e6cbb02e7167d SHA256: 45709a9fa7cc99147f243c75e17f613bb43f867e0909388f756f41fe2c51b887	... File Actions Show Properties Download
c:\users\eebsym5\documents\77oczsqvld5.docx.crab	15.09 KB	MD5: 451e5e0d7a38df5ad9a6145ae4094c32 SHA1: 0038568d0135a37f49dcb1bc16f37b7d31aa7bcc SHA256: e6b5b189934a13cebf3bae63a9cfc2bc2bd003cdfdead2101f9fe1d191d8b835	... File Actions Show Properties Download
c:\users\eebsym5\documents\77_r-.pptx.crab	35.77 KB	MD5: e257ffacc2f55561ec544630418a2273 SHA1: 978796d9c762489ae81c6a72d386a94622b7e6d1 SHA256: 622e02833a413b4a564489e70aa2d0729eafc1745eddfba7aa0ba6f0849dc6ec	... File Actions Show Properties Download
c:\users\eebsym5\documents\bsmf9q-s18uqwv 2qec.xlsx.crab	75.11 KB	MD5: 19aa92ae90a8ba2e1af82123a843eb8b SHA1: 4ad07737d3e134c249bd7eca02f79868c40396b3 SHA256: 639d468807360296a7a45ceac4e293e8f7c465ba759feacdb7d9f345ba518f80	... File Actions Show Properties Download
c:\users\eebsym5\documents\ch1aq1nifb.xlsx.crab	43.88 KB	MD5: a169818f987c90ffd13b5aba54aca62d SHA1: fab15e69de4248fd4cfec58948849f9789694504 SHA256: 53f2e0ace020668e9de9df717f71a2ca86ac4d23aa96d79a189701f500437543	... File Actions Show Properties Download
c:\users\eebsym5\documents\cshivohp5t7axydy7tk.pdf.crab	15.83 KB	MD5: cbfd05db37994d36ce9b2456546f3dd9 SHA1: 7c0b07a66e14986b14b56e196e1bbbd0dd2f9147 SHA256: 216ac7f95f40fd782c1c8f7b047dceb304f28ec23a35cec7eb3d79d07530d0a4	... File Actions Show Properties Download
c:\users\eebsym5\documents\du k7oszoj3hlunu\8cbdyzx6or.pdf.crab	29.06 KB	MD5: acd215fd34c69ba8dcc97e52e8752b76 SHA1: 960493c0881ab8b16934a24e655046266b9b1879 SHA256: c6685f387c80589e9143c7afe5cf3584ae354e8abb61f56b52d1f49d410d5cfe	... File Actions Show Properties Download
c:\users\eebsym5\documents\du k7oszoj3hlunu\lrk87zrnofur2siehy.pps.crab	94.94 KB	MD5: 398460a1f47e8780d0ed000722018c97 SHA1: f493abf7e03b34dfe1e40b8c72ddc957fbedf8fb SHA256: 6c78905e61b33d8626bfbe83e7140d4494225432bb81bd63814592ce98fb481d	... File Actions Show Properties Download
c:\users\eebsym5\documents\du k7oszoj3hlunu\mfgg.xls.crab	88.47 KB	MD5: c2570abab93ab65953a7d524353e249b SHA1: 17d62a6e0a75dffad6d00995ae2752ebfebd1aa0 SHA256: 41179b7a0f2b8fb1bded807f0b27507f8c5345ba28f16ceef7ef070cef8fe8d7	... File Actions Show Properties Download
c:\users\eebsym5\documents\du k7oszoj3hlunu\un2ks4.pptx.crab	9.62 KB	MD5: 75afa1e380ffa6a9f0bac0a253744b3c SHA1: 095d48afb6036ecfeb45928f9f82e1eed1d0a501 SHA256: 3b73e7e4cbb4b507c3c6132a89b1e7f4e7223d9b352cdc52670e6d9ab1d74845	... File Actions Show Properties Download
c:\users\eebsym5\documents\du k7oszoj3hlunu\vz9na83wbdghk9way.ppt.crab	75.86 KB	MD5: f5859f18514d5626a82787866f6051e4 SHA1: fda497fc25b133d81250b5b2473fa227c924a1be SHA256: 35380f075b249f54b67ebdabcb17128ecb6190d8513e6a9451650d2d09fc4e64	... File Actions Show Properties Download
c:\users\eebsym5\documents\du k7oszoj3hlunu\ywk4khhv.csv.crab	56.91 KB	MD5: 2e559f6c654f39e8ce41220d792d9ee8 SHA1: d6c240ba4b1a87ea44ef9f084be87dafb678ead9 SHA256: 2c9362b1c2c1f87834d14fbfd15f012b247ef9901f3674c2fe310703b627e8fc	... File Actions Show Properties Download
c:\users\eebsym5\documents\duec7mr w 5v.odt.crab	40.06 KB	MD5: c7d118ee669ca99b8582e2b679eb7cfd SHA1: f5e275d3d8326d558f03cccc8a4f6759781ae9ec SHA256: 58a97affd747eb44e0bbd08972caf785398496f26a4a4c4ce6284fb6f3e44751	... File Actions Show Properties Download
c:\users\eebsym5\documents\ik8r5v-n3rxf e3o.xlsx.crab	88.72 KB	MD5: 8a5db70c75736b8ddf9f050da9e8fef9 SHA1: 9f5253141719670d2d163b2eaf4618f59f1e2e15 SHA256: b00bc249eb887b1e2b61a6c7b82a1a4976073fc19edf42ba7b22e8a4a80f0139	... File Actions Show Properties Download
c:\users\eebsym5\documents\k_-fc6z.rtf.crab	70.86 KB	MD5: 25af09b0c0a79c40ea3a5f69c920ba42 SHA1: 0b796967ed8c463c9acf3087f9e8ccdadea7b291 SHA256: 1cccdadc2acc19754c4c338793c875edec39ecf0ef0817b0f11c2db364974189	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\5xayfjs7v 4p7.csv.crab	21.38 KB	MD5: 4c9195879e8ca4a8c70ad64167ef655d SHA1: a06663d4e121d0326686dedae4de1f2b1258b08e SHA256: 8aa33f1071258d4d51826e1ad7d6848000ffc8ce49a4e43d349cb7935b311ac7	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\e9iupbuvzv.odp.crab	74.42 KB	MD5: 6a5d50a639212ffb459a17b238bd8620 SHA1: 4d0e646f18e30d0b7f11f1e7215842b95cd6b1ae SHA256: 2eaad9485c3badf046e485bc4ce5918aed21e9ff231392273025eb245dc39fcd	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\d13e5u.odp.crab	61.00 KB	MD5: 706fd646c4bfdc8569180f2ef51aad6b SHA1: a026d8e5e2835e6ffe2d0cd7efbf37b0899d371b SHA256: 67d38f4a0ab8352a44a3e12c3c0b63fa4051a91f6ec210f99f5bbe79e1d8ef38	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\dn8jjte7.csv.crab	30.92 KB	MD5: 2b84d038e2299ae2e07e2689ae0fd6ef SHA1: 85552ec9f47b2de92fbe9f176de95a1d0637ed33 SHA256: a8d173cb3cb9ae4c04059661fd578a69ddba58cbdda23d70056dd31085904cd9	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\jzjq6zgmd3.odt.crab	39.66 KB	MD5: 9104894f71c772191b226e5b90a8f462 SHA1: bdcf10b3f066e21e79b9eb2b884240cc0b041532 SHA256: 2cd7c7855322bc14919d060e2b86c0cbe44e08936c75f77cb0f2f943ec1aa849	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\n 4im.pps.crab	33.34 KB	MD5: 7d2e3a562952fc7f812672a0b4e0a038 SHA1: a4b8e99e91cb9fd06c276b48274508026a851423 SHA256: 1dd69a83334cfb9abb24eafdc46287eee22fcf95c50ece2620e87b4d56282592	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\p i51dum47znpt.ppt.crab	71.62 KB	MD5: 72c5310dd0494cd10ecd8a6a89dee60e SHA1: 6ae23a9a26249e6cea77c287ddac788af341b8cd SHA256: 3d6bd97698bcce58014d0282a41c73447c9787ef3e329cae956a10fca1bb8eb5	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\v2ax 2o10jyijz.pptx.crab	20.98 KB	MD5: b84ce34194f05cab05bff046e018be34 SHA1: e5b04ea3bc40b9aeed9ade114e97e931b46f26ae SHA256: e9841f9672f15d26f47967ce5b44844fc72253a3c9a96c83bc88e9472d22d71c	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\wcaqi2idigh5rkdfeps.doc.crab	14.89 KB	MD5: 6d6297e18a8194d63395fff540de16ea SHA1: 273a7fd740f889ddee11bd7b2baaac7596d1b4c5 SHA256: d90a0f99e8ad349ac237039842bdec2ad3da849bd886d0114878b12baeda4e47	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\wogsuwwod.odp.crab	85.55 KB	MD5: 07bbb01d915a3f5ddd54522fb323055b SHA1: 785e46d50921c8e3383ce03397e5206d694b7ee9 SHA256: 55946e82e477d2395fb902fcbb7a2b411e028561b8155a4666c7ee5ad3c37ab4	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\ztgx092l1vp_ g0bfh.xlsx.crab	2.73 KB	MD5: f62dd63c15435a7faf21f1fe7f452c45 SHA1: 029a527cbe99566b5270e38bf6fe225e687400df SHA256: e29d76306f0e8ea87ec080e2f80a2a3ec811b6789654a21f32dc8507bd00a360	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\pnvjm15.ods.crab	43.22 KB	MD5: 6902c1faa010adf20c350e5e9cf2f0ee SHA1: 80e0db76df113ddd75dbd1fa6fa46612800828ab SHA256: 2be3196ea000e53397b0b5b86b5b58c69e313a4ca01c1d924fc5f1266de8ff5f	... File Actions Show Properties Download
c:\users\eebsym5\documents\ofdyndxzgobzng.pptx.crab	98.95 KB	MD5: efd65c05b7b2b41115247eada8481441 SHA1: bf669da340b3d7a2d91dc66d401c27dfbc68ccf8 SHA256: 69814b39377bbb058fd25290636a24d3c6912251e6c9dcc6e62981507b179e25	... File Actions Show Properties Download
c:\users\eebsym5\documents\oh9agy41ppuv jg3b.docx.crab	78.12 KB	MD5: 532883779582f21c69b647c734e0f0d3 SHA1: 46435febfebf78043898484c9650f8e5bde13106 SHA256: 913332e7b6bd0531c15a7d2e8aa3a69fd233b017a253f4bb8a1fe9bd1a8ffcf2	... File Actions Show Properties Download
c:\users\eebsym5\documents\ojd7p.docx.crab	32.84 KB	MD5: 2bcac27bef60a2eeacf0286dda87c3e7 SHA1: 719c6dcdd95b0e4b27101321acc946be31530315 SHA256: 4674c9899bad334f1f5755c80642f868e0bee0b13826e10cb26d560e321a2b98	... File Actions Show Properties Download
c:\users\eebsym5\documents\outlook files\feasf@efw.com.pst.crab	265.52 KB	MD5: 7caa9f32326c211acd20d62cc27822ee SHA1: 56c056b3d8c36375d25983794e9a3238024087fb SHA256: 9ad062f4c58df4590abd4bcfa8ce595f48c20b3777c4c559882e9fef29efb8c2	... File Actions Show Properties Download
c:\users\eebsym5\documents\outlook files\outlook data file - mail.pst.crab	265.52 KB	MD5: 8f51ec960eb3ccd4909abb440f91d304 SHA1: f2e613c5882a8bef4b6243cbd99a3a96f2e7c6a1 SHA256: 2d3e3e4858db2639d01a5c7b2c2e70a2974f1dd2ebba2d3c9c83c101c82a489c	... File Actions Show Properties Download
c:\users\eebsym5\documents\pmz0w5lsrnua.pptx.crab	51.64 KB	MD5: df5e2536086a0ed8f8a37dfe1220ad01 SHA1: d6839957b38485e5fe9537460fad6baf4fa04ae6 SHA256: 43480a13e77b2d45c8bbdaad14bc1745d16165333ffeca75edc1eb304dc997f2	... File Actions Show Properties Download
c:\users\eebsym5\documents\qbuqvozg4 sryx-0.docx.crab	66.72 KB	MD5: 084ea15d1cac1a74dbfb69eb01741e85 SHA1: 0c340253ed575b510ccc802b88e60d2d2db81ca6 SHA256: 8bdf7773cb719f8a10f104c5a3714dbdb347c2ac7debbc57ac2aa73a750eff68	... File Actions Show Properties Download
c:\users\eebsym5\documents\u-pabak2.pptx.crab	73.94 KB	MD5: 4d7e410b3e6e7c9e09f18ce1cc9d66c3 SHA1: d761846c910b6115e80f973d7828656268ede869 SHA256: 1f9ce654f2f575b968e311634cccb6994921d27c425e0a92410be1b53c91d4a2	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\8zzc6vss5o.odt.crab	72.19 KB	MD5: 1b776a5576527da2fd5659667de3da75 SHA1: dc8b300515c8a5e297dda2f268104239bb4aaaa6 SHA256: db7f0986307ef537eb6209df3e9508881c4e2289363e8c90c8e43994d26af780	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\dvq88.pptx.crab	9.14 KB	MD5: 92811502f5f7dd65f240e6a847889e7e SHA1: 6c6e315ba29a1e3ea1ce5d6956c49c0488d9f12e SHA256: f32faa721f97f37a4e6960f4d412a2fc96341779ee4330243592175cc246aed8	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\iptbfo r8xn6yx-i3w.doc.crab	88.70 KB	MD5: 48a640bb60e738b342b8b7e328f4bbbc SHA1: 7cbf7ac43bddaabeb1477f6353debae43b4c9b73 SHA256: 0b7cc34c81f1007772b428bf586b2d840b6cab7ae804d0b1a68dc35c39670782	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\r3mwt9fzu rm4wo.pps.crab	68.80 KB	MD5: be45e3393dda880330384f115abd5af4 SHA1: 733c65ce879c3faafcd5cc196321384cf87fa6b0 SHA256: 926e4468048e06b6439ae11dd540223a14cbe11cc40c4c75e9a1950200c98f6c	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\uz5fioslh2es4mr tns\2bds85u6tr.ots.crab	58.42 KB	MD5: b9cdaa2f1c0011a64cba26ac3640db37 SHA1: e90fc3211aa098fdf1055741cbde97b6d3c4f03b SHA256: e56a2293ff007ee57dad6474ffac22e53d00e5f6bb56e212612c2aeac37afdfa	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\uz5fioslh2es4mr tns\40szfgmqdyq fkolzt.ppt.crab	70.81 KB	MD5: 650a73204cfe04f36e5372b9b368a7f9 SHA1: 7eabd09051e02b3e1b971d9d56615b118a7a4691 SHA256: 8e87a7b773db04e0ab236450fd5993aab168063a11d70ea7807c57eb12f6a60a	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\uz5fioslh2es4mr tns\9jvkqa3b.ods.crab	70.88 KB	MD5: 40c4f2b19e5bbc85991637adcdf253c2 SHA1: 323a014b109c42f77634957d71f819a4160a9ab9 SHA256: 9a276d08ff8b8562ee7d96f0fa5ea8db344a68e772e57c7fec9b1b2b653155d1	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\uz5fioslh2es4mr tns\ogkc1_kj1h.odt.crab	22.86 KB	MD5: 3338be6562a03bd7818f5ff48b01d0fd SHA1: c147e8a3d8b29dea09527b2a9014f58c9461c6c8 SHA256: 421eea1ad5b216c74caaabe2635fbc32da65e9a09685825b477009fd17dca042	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\uz5fioslh2es4mr tns\znuc10gkdhhn\-uirpy3k97h9x4-.pdf.crab	69.64 KB	MD5: 2e918dadfeaefd9976c55af69b1033c0 SHA1: edb89612ae1e20103b3ee4cde93feac55da16f82 SHA256: 80d986c4e56f6d311ec4fd701cd2b4a0230f99c41d85697f5aa03f64869018c3	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\uz5fioslh2es4mr tns\znuc10gkdhhn\1290gyerslm.pps.crab	40.38 KB	MD5: c103f02bc517fad8f8db07bc604f621e SHA1: c8b9a0f882e843aae4eb38330d82ee96d253f2d2 SHA256: f691e4b516fd993c1acf54cf93ac7e3a0d06c6241d0f99ef5476d6be40cc1c10	... File Actions Show Properties Download
c:\users\eebsym5\documents\z0u8zp7s7.pptx.crab	90.98 KB	MD5: 376235f56e40596110690285e2d867ee SHA1: e2d8f98fc82542b952ad87a4816208ea30555362 SHA256: cd0b252bc204e751647f8c75fc0de90b2cf5775d77e0fd282799420f1b697c03	... File Actions Show Properties Download
c:\users\eebsym5\documents\zb5aqjwgnsznrvtqe3u.docx.crab	33.11 KB	MD5: c6dbf79869b0057dfb82b94b8cc55754 SHA1: ab9f1d47efac9df53a3a088b314f31e85656ca60 SHA256: cbeae133cec1705d15d9bcee3681b2ed5efce76ac434ebf77a08049cb78f0c3f	... File Actions Show Properties Download
c:\users\eebsym5\documents\zhfq.xlsx.crab	27.27 KB	MD5: 10527d66201e0722091bac6b50dd3173 SHA1: b3b06f9bd776032167d4cdbdc8627dd7519788f3 SHA256: 70da415c037e9ec2fd5e1b59a65d37e20d83fdc8a77e3572f180303aa9a84d78	... File Actions Show Properties Download
c:\users\eebsym5\documents\zrcfqsfwpcdv1u.xlsx.crab	59.77 KB	MD5: 959949f81cb3c3411e423fa2384a1abc SHA1: cc213ce56b7c8cc6f0f3fd16901afa5ee91ba172 SHA256: b312f6fdadbd2e799857fb94c7c382d51ef0aecdbc7b15a10d366995128f8cd8	... File Actions Show Properties Download
c:\users\eebsym5\favorites\links\suggested sites.url.crab	0.75 KB	MD5: 1c680852edb365ccaac1f08a39c46906 SHA1: 58b435f5ec2d9a8ebc8c009f3c4dc050f5d130f1 SHA256: a4e6a781d41970216fb4a4c7b3106c29de81c23d07a4fc4d64a8ff0e535c5fd4	... File Actions Show Properties Download
c:\users\eebsym5\favorites\links\web slice gallery.url.crab	0.75 KB	MD5: 69ea5cb945dbc6124a954aa713866aa2 SHA1: 187533f4214b5ffcad831e9cd4b1a80169959990 SHA256: d2c56fd983c82b6695c12e480ff2b7540e01a24b3b526240eca24cb2711b7cca	... File Actions Show Properties Download
c:\users\eebsym5\favorites\microsoft websites\ie add-on site.url.crab	0.66 KB	MD5: 8b452c4089acb0aa8d58af28b9d58221 SHA1: 507b6d944cde82869a50aa469f58de8b0db44461 SHA256: 1bdf0980f1b61fd7c784afdb7fab25b6127bd6ed4424835ae5100c3e065d7adb	... File Actions Show Properties Download
c:\users\eebsym5\favorites\microsoft websites\ie site on microsoft.com.url.crab	0.66 KB	MD5: 6162ec3829eb2d76e29f5d0a5c6bdd9c SHA1: e5d0210ef21ae001aaf9ebe08c934b6913bc9d27 SHA256: 50f09b682b16c6aaf07e4a54f96a47620f8707a3d70b7aec5511ae457cb90b86	... File Actions Show Properties Download
c:\users\eebsym5\favorites\microsoft websites\microsoft at home.url.crab	0.66 KB	MD5: 3bca280c2934305c58e5daedbc41703c SHA1: dbcefb7d889e5a17e69b4da3200a5f13cc64f236 SHA256: db7c597b2a2e02189fe07e7e9edca2782fd9fd9149edab6965e8e623d1a7f57b	... File Actions Show Properties Download
c:\users\eebsym5\favorites\microsoft websites\microsoft at work.url.crab	0.66 KB	MD5: 7f6477346b89c1d77c6ae97193cc44d4 SHA1: 9f21d372bc9e9a53737da8ed05d2dfa5c7decb3c SHA256: eb45e58e4c7de81fd459eefeaff69f3e15897f1b8c889b76a87f806ea0f176ef	... File Actions Show Properties Download
c:\users\eebsym5\favorites\microsoft websites\microsoft store.url.crab	0.66 KB	MD5: 5be7db0f8451da4e8d3354928b904d60 SHA1: deb7cf237862826a73d840ed5f5448a46057c324 SHA256: f993b2d339d6d5ba0f6bd816bf490163786d5dfd2d5ed4f2f944471ef0e4bab3	... File Actions Show Properties Download
c:\users\eebsym5\favorites\msn websites\msn autos.url.crab	0.66 KB	MD5: 83b9b64c38e8e2038308e5ee477cbe3d SHA1: 9486b9c55ef7bfea6aabeb236bcb51396b246361 SHA256: 9d05b52e4bef81cd488cb8ba1b722dc118e48c7275a04c4602e3046eb6870b3d	... File Actions Show Properties Download
c:\users\eebsym5\favorites\msn websites\msn entertainment.url.crab	0.66 KB	MD5: 724f999168f77940676adf53b530bb8e SHA1: f21930d03443f4b34a4811df7fb830b9c6d9bb6a SHA256: b90bcd2a00c3fbdb194e41658c139ed72546bf5e6d3ad4c969e6fd857686b858	... File Actions Show Properties Download
c:\users\eebsym5\favorites\msn websites\msn money.url.crab	0.66 KB	MD5: c44e6da4c3e1a45df05a1332cd6957bc SHA1: e116d135d8c93027b3041d91177eddf69d6ba9f5 SHA256: 315881576fcdb14c2120718778c69ef2447f58875093bef2bab6153b8de5cab3	... File Actions Show Properties Download
c:\users\eebsym5\favorites\msn websites\msn sports.url.crab	0.66 KB	MD5: f5c3284aa4f01516d1d044ce7bac3a94 SHA1: 77a005e90f4f3e456e1f5504e07639e378d61bb6 SHA256: e299f4b897509fe3ac6b67e46d387d220b272d6d084671b357946ff435485def	... File Actions Show Properties Download
c:\users\eebsym5\favorites\msn websites\msn.url.crab	0.66 KB	MD5: 3c1247295d479e9eab8a702308257458 SHA1: 16dacb952a930fb4a29bf9bc8d3087b09a3336cc SHA256: c5e2a1daaf6d7250696d914167f1f2931818d7342efdcb95c186d64fbfa0ca6b	... File Actions Show Properties Download
c:\users\eebsym5\favorites\msn websites\msnbc news.url.crab	0.66 KB	MD5: aef3ca9ccd67b56c4adff34ce9e934ea SHA1: f47b20c9fb4251b6b476567f2fd564189621488a SHA256: cd3cb65d80c4579966f978cc25e9cf108e82a5bbac34c5e3ea7f0b4ccbf05998	... File Actions Show Properties Download

Modified Files

Filename	File Size	Hash Values	Actions
c:\users\eebsym5\appdata\roaming\-0vr-5eof.bmp	8.81 KB	MD5: 41a4f7ccfd49c22ff0478ce3e601b805 SHA1: bb2e80999a2c7978e828f70944607c2481d7b40a SHA256: 3c0cf47f985887b33070201ced385b2402e079e725ae4bfcaf37cd1d9e26556b	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\1hjlhgslyadwrp8.m4a	43.53 KB	MD5: 85e8ebd42186047f4f949c6b36977e61 SHA1: 88e608c6c038233f2247927d017f8204ba80d142 SHA256: d03239769691f75ed19735e3b38585fa4fec4c54f3725b96095dbff175b7449f	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\1ia7iqccqa.jpg	71.47 KB	MD5: d848fcf991d7ac9c7d9c0238857e1cd3 SHA1: ce5be878c0c756867ba8512e05b0dd65381df432 SHA256: c244b227d742ea8d768ed4f9f6eca57763104cdcf5e15fa993ea029c6ff707e2	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\2guaeuf.odt	99.81 KB	MD5: 916a1ff98b77c05b29a2dfbbfa0ef2d6 SHA1: 99ca9a175bdc0f6f7e107c0369279dc668a9f4ee SHA256: efe9d5b5d943dd6825fb71be9b3abf027aa3f9565619d9c58d8ccffdb5875839	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\36kwsmalqicd0te_3c_.flv	67.28 KB	MD5: bc777f5f193f46e061992433c1d31be1 SHA1: 648e661b8beeec4776e1d547054acfc84a943987 SHA256: 1e9876621133c50acef8e21a462ab061518fad6e0ab1083006affef8ebc7f906	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\3gxalqztxgxdfkqcu.mp3	30.44 KB	MD5: 71549f1565be5741c7f9d146aa9d7eb7 SHA1: c17f68a33cf54c2b23947f6f7f28ff72bad74b6e SHA256: ee08ceea7e0b818e9cf2a9036acabdc727bc585282ffa23f6f1d4b0b5b5a844a	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\3lj9rcs6puveaqdr7fmm.mp3	23.14 KB	MD5: a3860548384eccadf2a760654babe147 SHA1: 6fb9877c0df3735cda1bca70fefd402bfae671c5 SHA256: 90f8587f750507b0e1055a1eb468a21c4378692014e072bc7328400efd238d3c	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\3zyad7e5phr.bmp	38.55 KB	MD5: c19b35ed1c0948ac42c1cebca7b9d0d3 SHA1: f2ddf846d6d51e33aadc8949d5f8e03e3b8d1cab SHA256: bec2310e71b4805138f1bb3b4d75bb78de77697624e3f020a84c85903bb6450f	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\654dktfxjcr.flv	41.55 KB	MD5: d4decf8d6ee443ff7d6d4f7e3d9edd87 SHA1: 453d9b16c9817c46746458016e05b6a2b93a8de4 SHA256: 9dea85508574be759883403405ffb6d1e4725070557662563eb1c7f8f78ae464	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\6d_t.flv	65.20 KB	MD5: 28109bad07d4b9e2faf7f7e6a28ad1ec SHA1: 34a2523552733aefd04b11527fe92767bb0caea1 SHA256: b7760d734515d01d37b4170c4ea8d05d043b0e746daba091616596264662bd38	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\6elt.avi	33.34 KB	MD5: 367ccdfcc15fdc888f5951c54ded38ef SHA1: 4530bf54e552d9e37b64a6c313aaca1389a85e84 SHA256: 19ccee3ec096d9e46438f722edd4149faed981a4c3eddd7dce9e4a589104afa1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\7oznzjtu6n.odt	42.69 KB	MD5: b3a0770176eca21a306bfd6cae61c9f1 SHA1: eb1c907773160429b7688a4655902d18271e8593 SHA256: ab2a9806ecce331e1653584200350329f2a09153c354465633c72d58971438e3	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\8io7tx06zxi2.docx	50.20 KB	MD5: 67ec708339187479f7ee79f60b355cc5 SHA1: 9a054cedfb177206f7a15afeb0454a1f220f6066 SHA256: ea798a45aa9d563ccbeccae0ab5ab89bcdc9a4cae69636bdbd019b315bc8dcd0	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\9ugr.jpg	50.67 KB	MD5: 849d085ab7768a24f70b30e6373affc5 SHA1: 1f6f1d6d67faa355e014b28cdb6b66c48d1e4248 SHA256: 19c5212f12da0b4e1da4fa399bbf661cf2757bb39d1d3b08c29d98269985e9ec	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\acrobat\10.0\javascripts\glob.settings.js	0.53 KB	MD5: 3f07dd32d3a9b0798575931c941b07d6 SHA1: 96eaa7b7ba9d501f14dfd8ea52786c5fc82cef56 SHA256: 35d0d470d8ebe40b150787f5bccef5e921c6c126a087ff9d2b8a4bf3b21e9ff1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\acrobat\10.0\security\addressbook.acrodata	5.80 KB	MD5: a5e10e01d7a07eb2472146d2c2b3ae84 SHA1: f6561113d3fdcb03af62ea9ed6ebf2e8d6099457 SHA256: 9ba554b5d9d97cf609d8b7d5a600fbfd3b04519151baa94a6d18a1b70eef09cd	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\acrobat\10.0\security\crlcache\48b76449f3d5fefa1133aa805e420f0fca643651.crl	1.44 KB	MD5: 56f6c43d26d35b4216b2bf211aad7593 SHA1: 4c2a452949cb28f59121b7704d7128b6e0509359 SHA256: 59a63b70fe02c5cf7f527c877440fcfb0293e6527cf88f80c5ebaa164d90fd3e	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\adobe\acrobat\10.0\security\crlcache\a9b8213768adc68af64fcc6409e8be414726687f.crl	37.34 KB	MD5: 86213b04f0ce0fb3ad13645aa8710b20 SHA1: e5b2664681afb3839e471175d928df42d00deb72 SHA256: afd51593bba3d07eabcb511c4445d6ae7f394211ebde8f6570fc9e1018508953	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\awzyh7svl_1d.odp	86.11 KB	MD5: 2d42c904d789f748abc8a8c8f3a2fd05 SHA1: ff9ab47b5350d3602ca04bc84b3a160ec699cf9f SHA256: f3d21ca009a63f9a09d9a99fe16633f4f4b896ae2deda617f84cd3aea7807a53	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\ccj4o2.mkv	7.70 KB	MD5: 4e27ce38f2f29fdefd1a41ab821095ce SHA1: b29479f9a0075697680761caa0cda11687b003d5 SHA256: a12496f524d729bbbde3b53d759cec9f295af81f1c1a1cd24e2fbb74224ee12c	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\cdfvmiax-yi7imdbsdw.mkv	76.83 KB	MD5: c9d32948f03d3f3f275fd109f989470d SHA1: 3a2afa0f8ea3261313d060916641f685666bde6b SHA256: 6a8cc0395936c08d1ea21bb3eaaac326bc0ccaf634bd0e5c51225e312d2867b4	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\fcvygu7i.odp	66.36 KB	MD5: 19c6036aaff5d32d5425ffa17f844769 SHA1: bbdbaa4cfe7308f47c3bd7715f2e3da13fff23c5 SHA256: 522ef46bbbcd3b43ea92a538a14de54fe7b4353d0a647df525d2e8c5837808fc	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\fhwy wcclsa.odt	52.91 KB	MD5: 63634fca99a9b038f67dac9ab3682811 SHA1: b7359c1aa71b017ab0daf4b1bf13e36f5cdab23e SHA256: 4a3ce3578935b3dc858b726f9fa8ef707c44b67345e3dc833da1b280b9a50516	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\fjhrhun6pyz8v.avi	83.31 KB	MD5: 178a75eecbffedd5d205c873193cc483 SHA1: a61c260bf030f15f3c76d9ccc39d202e16297b1d SHA256: bc17fedc04d777cdc3205a959ad3ea90eedf9ee0d1496e3bbeec6bfc74600dc3	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\fwodx8_7rn.bmp	83.89 KB	MD5: 017dc38d5294ec8c3685a39c65ed2bce SHA1: 812036be1ef90f6b8c9365b7af7eb6be07c5902e SHA256: 9b2c02cd670f0146110e81d3d0e18535bf5d4259ce1da6d05af5cd3e1e26d6e0	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\g48xrkc.flv	50.64 KB	MD5: cf91fc3d1bd9cd55b0ccdd4c550eb6f2 SHA1: 6a6cf8cf41cf9f5016a7c6f90d5a4b7a0732b143 SHA256: 2f0fad01babbb1a993762f35b967439e3fa6a6eae0e1ef39eabab7df655b3514	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\i6qddagp0lynso_f26z.mkv	62.59 KB	MD5: 560f6571305462ec7d07b8d8a1598e56 SHA1: 23f837d4189a59b06431ba40fc0580b34f0d56d3 SHA256: fdc5d8dab7b2d4a5c1a75e1d5d9e3c0c9c332d916d8e4ee0efd76d156f1f5627	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\jamin.xlsx	74.88 KB	MD5: 046d84fe5999b40f683c3fb7753265d6 SHA1: 17bf808da55452a56a65b7373df7a6a6b3d90f7a SHA256: 6bd233f4ea0a9f91d80c501c8db9280c2be83f9a0186bae12617442ff9e581e6	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\jidr.avi	65.94 KB	MD5: 34a96fab332ecf03121924dea4ccd4dc SHA1: 976f9226c2e21cc67b42bf75b0135ba8e7aa12a3 SHA256: c5a4e333928ac47049ae7b0d5e00fb0d1b6a3d71b482c46024aba9463afc96d9	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\jmpm2rfng.wav	24.56 KB	MD5: 28f06fdf8768b42f0f2bec755adb7644 SHA1: 8c3cbc4389188c821f654409e8f090e9795b727f SHA256: ff2b59a6c2747834e40652422122c60c3eedb102386320bc26d35935835930d1	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\jqsqsbeg7ooe6rbkwxb.png	50.75 KB	MD5: dd9c58e39ce1e5902801e92dfb037e62 SHA1: 5e187b162db3efa25c09f6c8d50676456f5edd9f SHA256: ef44e5abb9297d3ecbb54067035f3de00895640627aabf59418569abe0cf2555	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\l60o3wuif7gy5ixnj.bmp	71.30 KB	MD5: dc8cadf13c092fe056e79039f8c1e1a9 SHA1: 9ba02ada13a34bd97bca3466b86e55b375ec6146 SHA256: f4473342a207f80c467d045b4acc4a7d8f9f34d821f9104aeab06fe514cf27dd	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\lrgejhu.swf	83.27 KB	MD5: 1864ad89a0798bfdea9182e2bcec324c SHA1: 89b6079698d3f26cafa26931a49aa3128e40d6ec SHA256: 98eeb236098869ebe1d4e018851b70f17b2f015adcf82e527e5cede849dab786	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol	0.81 KB	MD5: 2aff22425ed152531069d6d5c8bcff82 SHA1: 39435b79e8fe078f1c0d2f3975df36fc1e2346a8 SHA256: ba890f2f68a9564a192bce6f8e74ad97f3ace3f4c08e4c36147e890756cf1f86	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\document building blocks\1033\14\built-in building blocks.dotx	3.99 MB	MD5: ae6ec0efdd65e8a664da8cfd23adfb67 SHA1: 14cf142dc4071327020965d20a405fb5acce82c9 SHA256: 246bd34f8b4179a299568239a03e536d5924175e85101fb3dc8c6664f5d9ec94	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\html help\hh.dat	8.91 KB	MD5: 94ab132e7df4db9fe3f413216fb05679 SHA1: aa427498087be720131e65924ddce80d6b913aea SHA256: 72978cd00656b1eb16c052326960c2162ae67ba2916388d6a1e204568f1ea0fb	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\index.dat	32.52 KB	MD5: 8c9405527820cfe6d125654621c915e5 SHA1: 9b72e90cd2a7367bb558989f69e551f89b81c424 SHA256: cf57cf517805476bda125054a2472eecdef84123a6b9550d3e372f352ccdf095	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\l3dk0kah\id[1].xml	0.61 KB	MD5: 2a657bc4baae85a8083e5b08553d47fd SHA1: e20836979fa53f23b22c01460cc693b110782c29 SHA256: 5ffd17c44700e277a50bb81ed12e93d5faf5f737638c06c085d0719e381c41f4	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\low\3q4bcxjf\id[1].xml	0.61 KB	MD5: 533c4d3d1d3cc67ebcf992ee17a37ecc SHA1: d8f37f53419b268623a5b99c6b100509378bd30d SHA256: 764de2dfc00e596a92fca5927b5e33d8dc7af54293d678d13e8ab0ee35e51297	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\internet explorer\userdata\low\index.dat	32.52 KB	MD5: a0329225ea92144a169ea0ce4357bf3c SHA1: 20f191f4e4d6674dc2d0241ebf57bfd0187a2268 SHA256: 3d602eead1e951ffdbebab77a5089e8721713acd5686db5c9f889c0748aab970	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\ms project\14\1033\global.mpt	382.02 KB	MD5: a885b5767e70008c32aad2e36ee02c05 SHA1: 9edf8bded7faf4b3179f3555c0e16e7b5a6ab8b0 SHA256: 016e56b8db2bd466fdf45afcc5575dfa085c9fbeb5f7a3148b8b772a5544de79	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\office\mso1033.acl	37.41 KB	MD5: ac138a26437d2cf7d682951f861d1f5b SHA1: 0279dbc58e8d1927949e7eab81406b5bb827a5a6 SHA256: bb782bf0f6a61870bd2ce2d7358b152908f2ddaffc0bf9a17ca2ae5778a91cc5	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\office\recent\global.lnk	1.88 KB	MD5: 02c84097d0b3de6224bb3ce0d44c1215 SHA1: d929600143b47f4eba2e89ff093d7d277c586e56 SHA256: 96bcb1157d28b976ab63a7d9e724c141db6c3b0d5ef7649e2f7a27e947d014cc	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\office\recent\index.dat	0.59 KB	MD5: dc54aa59163f73219366faf0e5fb3e53 SHA1: 15db951e81b8e0b423aef5b8d814b24864f45ed3 SHA256: 35741a7e6c26f0d10297052a4aae776ee1b8d6519e6e6015b6e20e457aa0ee18	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\office\recent\templates.lnk	1.59 KB	MD5: 53e0666e818d768340dd1f58273df0f2 SHA1: 0926be13143f841338237b4f80eb6ede75befc87 SHA256: f5b225c72d9351ebe46bfb3aa251ad43544ac6b6879f44c08e89d3639e57f4ee	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\outlook\outlook.srs	3.02 KB	MD5: 58d1472e52149dbcb87c98dfe2dd921b SHA1: 00dbcbf7280939e0ec96cc80c51bb61abe4cc911 SHA256: 1ac4aaf7188dde38eebf3d4e37672a6814b3e3620b174fc1e771c84b43a7aeaa	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\outlook\outlook.xml	2.80 KB	MD5: ca746216bc1fe8bb1a7f01b955f7e21c SHA1: 178b3db6f71b92747346c255ea6b9a21ec47d827 SHA256: 5c1da85f907883fbc10582d4752aacb49c081c114e35772117722534245db514	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\publisher building blocks\contentstore.xml	0.69 KB	MD5: d6d343bcf9d2a32d9dde84ca237b17aa SHA1: 74a5622724d72002e50ffcea8bb90889ff108830 SHA256: 3572e05df3152837dcf528a65f98ac3c1b5ba23e926105442c4bed46ff158562	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\templates\normal.dotm	20.67 KB	MD5: 025dcae4ede524024c54e99ff442c406 SHA1: e379279c16293cd0f39ed8272b5421debce6b018 SHA256: 3779b22494e816a716736ee4603eb272ee7f643baeda3848b09fa18bf0dc2e26	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\microsoft\templates\normalemail.dotm	20.50 KB	MD5: 248e3cee946c1736dadf85ba6d5ae9b5 SHA1: 707fc03119b364d7daafc326c75fa73b5026a2c1 SHA256: a5f5a06166856ef7914578ba4b65e3e5ffed342da6550fde61e7ecb37a10eeb9	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\addons.json	0.55 KB	MD5: 96e17bf3afd456d9bd11730b240a6f3b SHA1: 59ddc7408f8a3cb225864c9e1ee86cbf550e7f55 SHA256: 3a4efb0edf06fabeecf2f5094d3608c0a0074e5a18a6bda110317f98f809d989	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\bookmarkbackups\bookmarks-2017-05-31_5.json	3.48 KB	MD5: 01fd910ce11c46fc14368660248abf47 SHA1: 8b17ee3e2204cbe7ceb6b393aadd455c7b17217f SHA256: 12e623be44f953ab8a170c4e761126c6a1240206279f27845ec0f46dce675ced	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\bookmarkbackups\bookmarks-2017-07-12_5.json	3.48 KB	MD5: ea1a1e0ac7c5578c108ebdd1591ea1f9 SHA1: 638d7fd7a48e23f38ef104b252d60a43e0727372 SHA256: 68cc0c927b069ce677b6e2eecfc9509bbdf70a6f327815472cf681296c25d506	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\cert8.db	64.52 KB	MD5: 85f607cf75f12379d73248dabcfa9222 SHA1: a1ef256bb6d79789973c69d250490fecab58117d SHA256: 12bfc40d88429c8bff59bd347bd028dabd5646bcfabc13376fe7418714d3428a	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\compatibility.ini	0.72 KB	MD5: 4d2bcaaaf198fcfde333166cf203816e SHA1: acddf85c8020907f3c3c978221f8a179b996baa9 SHA256: 55c875e1d6d6f4026f4f8f3ab1577152e9d9a9a19d8c46afa6a5cb45603a3f0c	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\content-prefs.sqlite	224.52 KB	MD5: 7de4627b6474b4059248f8b75119ad01 SHA1: dc54491ed1884dee67cdda57605e524bf5247111 SHA256: 758533855a2ec885cb0dd7d56f05b75f6b1d9cba9e0f65965b4cde68560a8517	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\cookies.sqlite	512.52 KB	MD5: b354ae0670c1a46cb9293c537b32f554 SHA1: fca9a5e00e1be807cc0dc52a3dc4029b41064f82 SHA256: 3d6e043237323fb634a50df0fa12cf9259e9d04dde8eb0067ab009f4c07ef2a4	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\downloads.sqlite	96.52 KB	MD5: 777941ec4d04f7dfb8dbb4015c03f4fb SHA1: ce530fb6e43b38c13bc2f1b031b24cd9c24cb04b SHA256: 5c9ce123eb8f95517c37d918d637c80fc708a118443c82c7b295fac85327ac9c	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\extensions.ini	0.66 KB	MD5: 5095ad000caacad579a96be7b6a24ffc SHA1: 5c947c4877bb93c0d7260eb5aeaeeab916c84a71 SHA256: b741ae23537873b7792b3e92338dd287253c958980ad18a8f35053ae5b1d31d0	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\extensions.sqlite	448.52 KB	MD5: 77477c9bcfbd14e3eee2de9d33f00f7e SHA1: f5b680de430c48b31a98aaeba36556b86f00ab19 SHA256: d8063ec23df0c5bc9de85e859056feb980418a5e21f3ca16365ac9218bf73ed6	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\healthreport.sqlite	1.09 MB	MD5: 1cce41b605ff3b3f8777b11a91796811 SHA1: 310f2f463c1576a784a16e7ffb34a31592ecc83d SHA256: 273fbd7625ea86af896e09fc2f166a403e4295e897656b53072e7c944307d2d3	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\indexeddb\moz-safe-about+home\idb\818200132aebmoouht.sqlite	1.03 MB	MD5: b7003198cc322def4894e7c100932cdd SHA1: b9c1205c88a43f41559ac8fe065c1a00543b8e0a SHA256: 766e0ae9b9bce41c57841c29b8b467efb42e8cc102343360257274e126367b9b	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\key3.db	16.52 KB	MD5: 3f68e1424cbcb8fe05dffc3d9e8f5b33 SHA1: d6b36733607350e65b72c915e3df1dbaec544aaa SHA256: ad393a7ae6f25360e48395eaee5998076d8c09353726efbc1aecda7266305f7e	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\localstore.rdf	1.95 KB	MD5: 4c28e8bce5c488f260ff15def7351d95 SHA1: cb431e288013ed967871b031faff762682a64079 SHA256: 27027492820f31965a450a92058d503c4d730965ed5f2dcaff558488e46d0fb4	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\marionette.log	0.58 KB	MD5: 733bfa950150452d182304df623be36a SHA1: e50bf0717d918cabd86d37ac7e8202b85059d9a2 SHA256: ddf71c396ce488b9507c2a5c4d98ee310d0a8a2fe686a1f5455329a4e49c07f7	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\mimetypes.rdf	4.27 KB	MD5: 9f1f625911656835c5dc8229e9a36d4e SHA1: e1dca45af5fb53f4571ffca1c47116c2e15c8e24 SHA256: bd09fbd8dca883bdc8f3366380c6eaf5d07cb5ec55691df506c4145ad10315cd	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\permissions.sqlite	64.52 KB	MD5: e91f1ddf0c9db6a71e7d2e87aec5ed25 SHA1: e0d99a22d1e0f5da57c28026d07d976a5fe10ecb SHA256: c70f043548f4680fd2068d63dff35ba5a55854a7e515da8500d9ef8a79e7af36	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\places.sqlite	10.00 MB	MD5: a5fff19ba31df531dc22dd925c539e23 SHA1: 99ec318bcf5605dca26a2c6bfe64991e2251838c SHA256: 05d58bbf18b92b58dadaa135b3c949b91186a86c8de2e2c41d7e74048c982516	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\pluginreg.dat	4.03 KB	MD5: ffba447139979cc704821ff5b029c24b SHA1: f263692c3cf1457a93549781694fcd002f281e6b SHA256: 81819eebd1b7191bbbd918f9048095d3ee0ba8f0edd12a464f55edc8360d6267	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\prefs.js	5.00 KB	MD5: 23f801ac882b4e4a9dc395157f948acc SHA1: 523beb1a038a0ad871cd2e7925def1cd8535ba36 SHA256: 81ef61052da2694d9e480175a4a99d1ec2d7b486a8dd36bc512b1e3282e27be4	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\search.json	16.86 KB	MD5: f44d88edbc54a3c1212f990fe55f74fb SHA1: 09cdcb3a5b4ed280c2baec508ab5bd0760fdd053 SHA256: 4cab320daf85f4c89c362d65a2f68a010dd6e98e75d58ba307e626971579b650	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\secmod.db	16.52 KB	MD5: 2b138785af431b9ad9f854f02dc5bc26 SHA1: a73e672fd30f53ffb2fcbe8dfb7128f439aee29f SHA256: 92f6939be78add242f1a5321725e78bce5437999ba39e09778559ab319b9ca3e	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\sessionstore.bak	1.09 KB	MD5: ad76eee20ac672499e04c11341e9a13d SHA1: bccc4a20869fbda16e4bffa3f2ea9282d9d5e96d SHA256: b315c1e2b1c570d9f3d0ef91a1b8ec5662c0c70f4d9f7160302c13ebb1e7f175	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\sessionstore.js	1.09 KB	MD5: 41eee4ae6f2e51bccd197272372aa5a0 SHA1: 3b83d6e001a6f721c6af412f1a32adba894e57d4 SHA256: b91d876f4077fc1d493d9cb9561f18ae25244c432f4e4d8a6130745cd5707f10	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\signons.sqlite	320.52 KB	MD5: 4276475ec146709732603ce13b6b7921 SHA1: 78ec37d31f3f6c1505b9f886bad80bb43b2844bd SHA256: ed5ba50e1351ad0a032ab51ed1d13cbb1d3b6a77b5f6a9be05beaccb09994faa	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\times.json	0.55 KB	MD5: ea0fe6e6b2f5d390fb3736cc818564f4 SHA1: 08df48a93dc1e4ca67a7caa074b3a9676fc38ea5 SHA256: 7dab453566db4782ecc6cc33faa365abea9db3d3b8bcc7a7ad1c400d5a89cb00	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\urlclassifierkey3.txt	0.67 KB	MD5: e079342544439aff4537296c664be9b2 SHA1: 10680e8b8816a676e83bb7592dfd3f0f270b8b8d SHA256: 92764d5f444b3e027bca9ad1949068863c54c5ccf679b2238f848e3e94015a37	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles\h231daer.default\webappsstore.sqlite	96.52 KB	MD5: b644aa9599a915ce320d1116f8aec34b SHA1: 68b5c817d40584cfa81cda2970b67c85f22a0e81 SHA256: f507ba728e4be75cf2afb4aff94598accc2a20607126279ef1894bfc48f6780f	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\mozilla\firefox\profiles.ini	0.62 KB	MD5: 65439b3b9430a6f0ab4e7a1348a31b2f SHA1: 7463b785f83471a99a19f75848d82b81cd4cd883 SHA256: bb08baa28aa079d372c1f4935de41c8423a6fb71ca0d2eb297cc9a9e04e30b2c	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\nhq1hcgmsg8b.flv	90.19 KB	MD5: d4172b883893e5f4ae3d2f8a8679a3ce SHA1: 8258e38b183adb15e1ef96e1f3c310ccd0677e9b SHA256: 22273e78080dcc943753fa8af124d9ecd3bc7c55437b9aef02e13a428d1eb90b	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\pdsdf-o2xexbw.avi	54.56 KB	MD5: 70efdd7433493b62d8559a48f6242b37 SHA1: 2b113d07e65afc8b2c53c31a620656ff096b9d00 SHA256: 2daf2ffc6357e8c401d0501ffa92ce0ff7ad5cafac3f585c7f23c288bb132d08	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\q-s_4qhd1.gif	52.72 KB	MD5: 752461aeb93d008c52267f979dfb50a6 SHA1: b4643cb755ef1e6ab139e075d186dc6f22b9f334 SHA256: 79bd54fc741fd1ad9b4d6697b30e667983a45f19f4a4cac6dfad24f888519c1e	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\qnouhz1japy0u.m4a	8.00 KB	MD5: c8cf148f70b6dd53a58378c5a497d700 SHA1: 2b9f5767ed01ee3acd68433ab367ef7dde9201b4 SHA256: 544e75bf9782231c8c1eced9669585d9c9346df1f2ddf3e45dc1a98b0db73d41	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\tvzjzs.bmp	21.72 KB	MD5: 4f738e78ace9a8b7c9f8653f6577f27f SHA1: f2aa0c8c53ef266265e19168bdc0686c0d10d138 SHA256: 948818232e2b1947f9b1c164cee16008775fe422df3c8e59383d94c3fc2cc46f	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\uhi52n.flv	46.72 KB	MD5: 594b44957e6e481ef3f7d576261f1cf0 SHA1: 852ee835d38b1d2e1332831c406e5226eb7d1ca7 SHA256: 60d672804f51ee2af9c61210a6236afe77a86cf20163047e072182c1e9455de8	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\uw1opw43z.mp3	94.67 KB	MD5: 5181b75e00a01ca26d8a71bac5b63405 SHA1: 2be2451a5a923c6ba2acb081a7a037c035d594ca SHA256: 0f7ca33ce964a50ecc641634d347deda248ae13ec92716ecebdd225c1ecbfa29	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\vaau_auct2-v.swf	74.09 KB	MD5: ecfd61dbebaeec300878cae6c16b3b53 SHA1: aa91422e0419770ab80af0c4e4cbb05e062b677a SHA256: 9c7547b5876ccc0a6b1add5c787302e50ac411ec825583f8b76268edf5b9875c	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\vgm32iz-b.swf	98.66 KB	MD5: cf9fddd159bb3f73ac020f7a662b6591 SHA1: b80a1941687cdd066bab51ad95a9b8c321b5d655 SHA256: c2cdb89331cec146e697c3fe7849529304fd94612893a53ec7b8f72908300f6d	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\z9ok2xvdtxxzz_svtrt.mp4	78.86 KB	MD5: 7c07488bec09ee0e0b182bab1f573985 SHA1: 5d3011e98d2205e5d8b915e7f6cb3afdd3fe62c5 SHA256: 7cbe55c95e8f2cc2500d36241202dfee14bcfdcedab9ed274e32fec4b3a207d5	... File Actions Show Properties Download
c:\users\eebsym5\appdata\roaming\_1eugfemd.png	96.91 KB	MD5: d24e0f0936032e48eff73d4243afbd6c SHA1: c6fe4ca3779d268c0362bdcc2916d6ab63888785 SHA256: e723e2c63adb3c51466cd6a09e8306717016489729970cde0185eb7faec72b92	... File Actions Show Properties Download
c:\users\eebsym5\contacts\administrator.contact	67.30 KB	MD5: ebf1dc9cd72f479150c6f8d5f8248c51 SHA1: b1506fb8c0bbcacbc1a084581fb3348c039171d6 SHA256: 476b35924daca751f0c6d265c10822e31e4c5e0e91cbd2a36b56d2a2c81c7b19	... File Actions Show Properties Download
c:\users\eebsym5\contacts\ihnvbh euuncnh.contact	1.75 KB	MD5: 47a0e44c69fc2aa194b740575db191e4 SHA1: b969b252ec488511495c70687df1b0d50e9a7d12 SHA256: 5ddb4679420b67edc866ab2af8acb6a9c11d0171a42c1f8187dedb54e9281d2c	... File Actions Show Properties Download
c:\users\eebsym5\contacts\lodkd auftnm.contact	1.75 KB	MD5: 3648cf128ac84b3af06cc2ac75ad8cb8 SHA1: 837fefa9f705739f4773ba866d377035cd845192 SHA256: 1e22664b5ed5fef1c64795efd98692a77b7e1182d2f1ee5eeaee62635ebbebc1	... File Actions Show Properties Download
c:\users\eebsym5\contacts\mneuc uhnfghgg.contact	1.75 KB	MD5: 3962fdfafb4dcd21c2937d643b6871d7 SHA1: 6fd69eea7bfdd06976f36301eb3e3a756e038dfd SHA256: d2e6466c09562931c01a4881ff7d3751bc1d21a28d2abf9c5b504d447223c6d1	... File Actions Show Properties Download
c:\users\eebsym5\contacts\ofhbnh edferrr.contact	1.77 KB	MD5: e9ac08abcf7f9411a02ecf345fa884ce SHA1: 2ed51b52c9907d75c9b05ce17008844f7e9d5c98 SHA256: 50b4d834817144e2cb48dfc7816ef28f0c30235a5a9c166e6d1b36a2ef29526e	... File Actions Show Properties Download
c:\users\eebsym5\contacts\uosjfl sidvllie.contact	1.77 KB	MD5: 018f0b55b0f51558fc6e0afcf968a0a1 SHA1: 2725a74f5e7b637394a091067f337a486ffff7eb SHA256: a4f23c56ca26f01983bba990ca038ebe91937b19051791ae2c557db73b289b73	... File Actions Show Properties Download
c:\users\eebsym5\desktop\0dvhpomjlytro_v.mp4	49.53 KB	MD5: f0c35c27c2d4a1ba2c56e1aa31a5495a SHA1: 52e8601079ffc29a4bcc909392e0bba87855666b SHA256: 9f365ecfb0ebe1263be08d428b80032758c874bcf11f424811663772761f86e8	... File Actions Show Properties Download
c:\users\eebsym5\desktop\1ml-7apj0jkjqdbzzwxj.wav	8.11 KB	MD5: 8fe94c15219e13426975774dca645380 SHA1: baa6405e7c4d0be3fcb804c028a9b142b4e82868 SHA256: a3b50e7668f4f08129e5e376502356a475de963b1a584e275fd569e5d8413c67	... File Actions Show Properties Download
c:\users\eebsym5\desktop\3jua.swf	63.62 KB	MD5: 2a9559ebc5392da50314ed4ff9130c75 SHA1: 4c6426c337b9b2cd794b452beaa6a7c8f1ae5bc5 SHA256: 913c45e7c08a361ed2a7943a6e68aa2574919c3deee51b4c930e31ef8023fc79	... File Actions Show Properties Download
c:\users\eebsym5\desktop\6tvjswia-wbr5.avi	17.44 KB	MD5: 4b670bc9500cee2a8ad943cfc968d2b5 SHA1: 86d41b9444a5aad83de427f9ebb923e0b1d5ecd0 SHA256: cff83ec9179365966b3726905e66e8a8d9293e2780c4dee5a064182c3ed48fce	... File Actions Show Properties Download
c:\users\eebsym5\desktop\9b2i7c_e8rispmxl6f6.bmp	85.19 KB	MD5: cca8871eda7d2f7d7c896d75ea5ba39c SHA1: d2dd4eda5e08fc334b9621289d133d8629fa0cd6 SHA256: 3e1e2c1d6defbe40a752fea156a96603bad993f49a4f453db4a08e5e97089d66	... File Actions Show Properties Download
c:\users\eebsym5\desktop\bjgohqsuapvhv hfx8a1.m4a	28.95 KB	MD5: 4863c11cc13f33aebe6b86af3ecae158 SHA1: 190d72c0c6b82b012f3c69771df52dc1b6d8bb0c SHA256: 661bf3dbea75e1e1a97392c13b01ecbd5722d8a9f7de5134e00ff23c8d8b4fbb	... File Actions Show Properties Download
c:\users\eebsym5\desktop\dl13.jpg	53.88 KB	MD5: a0dc131f42938127e00cba31f68664e0 SHA1: 6cfeaf063013c97749bb283326676fb5cc0b2ab8 SHA256: 01d6c871a8398b1b9b7753ab3cf122d9dabe5a3270c3e5968cc1093865e2949d	... File Actions Show Properties Download
c:\users\eebsym5\desktop\e3i0xdqbd.mp4	25.53 KB	MD5: bff2f8ed16eb361ff9cfe339261730e3 SHA1: 8d51ac1a8203a52c20c30ed004092a14251ec405 SHA256: 79d876355c252bf2cfdc55be99899bf121e357939eb79a0a72b3adca50b258e5	... File Actions Show Properties Download
c:\users\eebsym5\desktop\gaqtftuchs.flv	49.00 KB	MD5: 2abedc4597afc32abd8030c35adafa82 SHA1: 1b93ceaf7013bc42fab4945a1070be49769837e3 SHA256: 5d26c8176797bb6a1b64ebb508379a7f95eca08edef25c3320788dda1f26c039	... File Actions Show Properties Download
c:\users\eebsym5\desktop\he2m.mkv	47.36 KB	MD5: fd7bbc3a02bbaadf8f0c26b29b5a1d08 SHA1: 8aa4abfb5bed47bab7b72c5d4932cfa2a03fdff8 SHA256: e4b1c98272f1b3524c80f61f35e54d82e7b3d827e66877460391604cf39ab50c	... File Actions Show Properties Download
c:\users\eebsym5\desktop\lbl9s.avi	16.70 KB	MD5: 3fcb52913e5eebbea3714f5389357fc0 SHA1: 00be664e5007683d0a39750fd18bade2da30a1d7 SHA256: f87189425a428b17642952c208a01569d518622f3832e70c8d8bd4e25b036aa6	... File Actions Show Properties Download
c:\users\eebsym5\desktop\oelmejsl85h.m4a	37.42 KB	MD5: 361564e03d815e91fda03b82b06120cc SHA1: d79f4845f550d77aef6779ca712716d97753949e SHA256: 2d1316eff868efe39f69b6998e633a91cba8726fe8d23bbbeb6d10d0f967d50e	... File Actions Show Properties Download
c:\users\eebsym5\desktop\ospatbxgjzl.wav	85.39 KB	MD5: 8b209add8a0b836ea089e1451d4552d4 SHA1: bd55cc5d7de3e19768f28e303aad72e2cb4c9db4 SHA256: a2673cc4506892ee2c73b2d94ab8573edc8fb07d44bfa9983ee619d554a1f87d	... File Actions Show Properties Download
c:\users\eebsym5\desktop\pue6unyh0mmp-vcx.gif	74.34 KB	MD5: 365413b379f2a4170c81b3b713fe343e SHA1: aac6ca62af4729d9b85549ff0f99262028ad5946 SHA256: 3125cb200a217139a648a441340312ce25c226004674338fa7e16655fb3bc5a8	... File Actions Show Properties Download
c:\users\eebsym5\desktop\q3a_7vje.swf	60.95 KB	MD5: 81ecfdf8f82a242ff08fd64b8e50d337 SHA1: aa9d89bafb7ed83406e626d5f1788879f37563c0 SHA256: 9efa9e2814737b210988b2e6dcbd9d8610e941cb65f6b323470746ec0e774dcd	... File Actions Show Properties Download
c:\users\eebsym5\desktop\qxvlvpdgkwwfnebo\f2-_w1qzinees1i.png	80.20 KB	MD5: bf2f31568ce40cd91bbb083f413e1f96 SHA1: 5045fb052a3754d330b242380a83496e9119cc99 SHA256: 66b8e9ad7fe140640fd25eb77a5858fb87ddd5dac78d47e482f9f1c45ffd3480	... File Actions Show Properties Download
c:\users\eebsym5\desktop\qxvlvpdgkwwfnebo\mcrwx.flv	90.69 KB	MD5: 7d23eda19afd8c3c372574de29e5b9d2 SHA1: 73bf4507ff97c00a571bf0978a6f8b8b46fe42b7 SHA256: 807fc52971f481d82f0c1a0af5f6da7f3bfb47a1e4b83ce12604cc5e9094a923	... File Actions Show Properties Download
c:\users\eebsym5\desktop\qxvlvpdgkwwfnebo\qvimwuq.mp4	85.69 KB	MD5: 6af04f4f5dc330b59c1abbbe4e5d9f3b SHA1: 50190179779100282546b8515beb164bbf16575e SHA256: 616de61b67dbffec7c9f4f4903716bdbec9ae2e36f078f789c1420f172fe1f1c	... File Actions Show Properties Download
c:\users\eebsym5\desktop\qxvlvpdgkwwfnebo\yst.mp3	73.56 KB	MD5: 1f69dc48c76c679eded61c2a042c1613 SHA1: 16c9188b5d5b4cb6548880b8e50cc8738786bb56 SHA256: 889490c4792bb32b900862719139963a21995f8d76d641d37cf42cc88f3823c2	... File Actions Show Properties Download
c:\users\eebsym5\desktop\siom.bmp	26.58 KB	MD5: 0364d785270d794d3712672c3e68966d SHA1: b2469f117adb91049050ab023078227260375911 SHA256: 79a04cd03a073a5683ae602778512238c4f0edd3a20aa57749b068b3fcf5a970	... File Actions Show Properties Download
c:\users\eebsym5\desktop\sk4m18olbpy.m4a	6.77 KB	MD5: 987e9d3defd93f31e5a72424c6898a3c SHA1: bf8aa9c5e5f8b110c97e63a6ac7fe742c338f426 SHA256: 4dd0520d1d2b45ac823f2018cdb80fa63c79da464d80b6cb48532b8bd8fde0b7	... File Actions Show Properties Download
c:\users\eebsym5\desktop\sz uo4.m4a	79.64 KB	MD5: a9eaa9dc4fdba33850a1109aea511665 SHA1: b99876d3796276c35ab062977bd9c7a683ca618f SHA256: 8bfc42c12d6ebf14777f8181d86231fe179776e50326a972e7e74d1fdca64861	... File Actions Show Properties Download
c:\users\eebsym5\desktop\trcdxhdihdm.jpg	9.27 KB	MD5: 96b61f94c71cb8a27243e6662f64bd1e SHA1: 632d670f1bb88d20d738233f27b3716d7cb1bb28 SHA256: ab3bf70f6710189d725e4dbeb8e044bd656d89484e0ca6b0dd973befb56f2259	... File Actions Show Properties Download
c:\users\eebsym5\desktop\uhzcnq.mp3	4.06 KB	MD5: 29f38f630f2a9dda0d1f61d0ffdf7c34 SHA1: cd044101d46571daa97c92344e752d073dfebbc7 SHA256: d2b473135b223b1a5266d1af497d935f191fe5b9cc41530d4b40f41ada1b22f7	... File Actions Show Properties Download
c:\users\eebsym5\desktop\viwp\2twq-1xpvbzcu.wav	59.69 KB	MD5: ec9a56876f3524278b72d987fef1f142 SHA1: b2c85da286739c63e9979cabeac97fb92400be35 SHA256: 2a13c92ca9b232f85d53be63ba2463be7d2e9566f775d7c9bd4004c70afa0ee7	... File Actions Show Properties Download
c:\users\eebsym5\desktop\viwp\dhp8.mkv	28.45 KB	MD5: 7537a4b569a0d7927ff5a1b611c1f7a9 SHA1: f63c6c1a41dbae1cdb187d206e1f7cbc3518218e SHA256: b8dea00016ba595b6480109aefa6d086b778b8a6ebbd43bd68f0e12279645721	... File Actions Show Properties Download
c:\users\eebsym5\desktop\viwp\diep9gcl_kvxmgwu3r.png	86.16 KB	MD5: 30c2c1b8d69a21e6783691dea85272fe SHA1: e44411d60768b35e2be4034c511e2a4f1c826b83 SHA256: b73867d55571a7fa1a32c1d453999091bb81020b666c8ecd19e25dfd80329300	... File Actions Show Properties Download
c:\users\eebsym5\desktop\viwp\lklyw-il4wra.ods	7.41 KB	MD5: facc3df60171b89e3c38475fee1f8d05 SHA1: e5279cb78d449e562f22fceab399c58c58842d14 SHA256: 77c5951fc1cceacf1a1df11dcbc315b7510dc159ef059c7545d5a46efe11f515	... File Actions Show Properties Download
c:\users\eebsym5\desktop\xckhq1j0co.jpg	33.02 KB	MD5: 059021c8910ee4b91318af18a3d09a81 SHA1: cecfbd152bb1ee2ecebfb5d161dc001b7f49b7f8 SHA256: 25affe96a7df550f2a715bb3d6e590d28397de296717c36159ae93bb2fd95b6f	... File Actions Show Properties Download
c:\users\eebsym5\desktop\y16hxoz8ujx7n.flv	22.20 KB	MD5: 3804fc267972dd5ec2c66fff7ac8f6f9 SHA1: 365e6804d94a0bbf0e5a7c76f4c40f18893af051 SHA256: 1d2888abdc05367e2c31c967f1d65ccc84045fab5eaee12a95139e9df611cda1	... File Actions Show Properties Download
c:\users\eebsym5\desktop\yln2_.gif	43.02 KB	MD5: a989a34d3502368b4ec7bb6b409ec777 SHA1: 24906ecf880a648e586fd17fb0540c57d6bdcc7d SHA256: e55790dd1ca18a8314a5ba7b96de5fe31fd4480185f1ed928ece73278bd372dc	... File Actions Show Properties Download
c:\users\eebsym5\desktop\ysaobn7ufb0kib2.swf	78.94 KB	MD5: 1b91407f1fb861a65e63c3919d31849d SHA1: 66af4b4975e858cd5975a5cad5d90bb8cb3d2891 SHA256: 321a1485f2083e397cda39a1f3c18e0d19065e27759645eb2c6b4a27c37a1315	... File Actions Show Properties Download
c:\users\eebsym5\desktop\z3h7xk7.ppt	57.61 KB	MD5: 26fce98f0368b7cbc5166320cffe5975 SHA1: 03d00dbf8b2a708167f4bb960fecc6edcacf3b39 SHA256: 0b4c889533062734ff5fe3a0d929e479e449d080d38a636c653ca4ff3c88503e	... File Actions Show Properties Download
c:\users\eebsym5\desktop\zmgna.mp3	27.92 KB	MD5: 281abe467c54dc7f3d7ec8f8648b876d SHA1: 7e5cdc8615be2d427cbc5f7a5bd9b0f1c3eb35e4 SHA256: 00b2ad52ade13495d25465f06ce2e962354fc6a601e1840467dffca81741fb2b	... File Actions Show Properties Download
c:\users\eebsym5\documents\0qsqlpnxj.pptx	95.70 KB	MD5: 76ad4080734bdbf334675612b731f0c3 SHA1: ff0429afff46f14d2009dae69a29429bc2e8cc51 SHA256: 9bc7eee1e950134043ac431de13d49fcf5be3244a930893c7b82c8c9ee1f964b	... File Actions Show Properties Download
c:\users\eebsym5\documents\6krllw7id8y.docx	3.42 KB	MD5: 865ce514dd2b8c20088f596941489ed5 SHA1: 074cc1a4459d9a94b6bb347b389e6cbb02e7167d SHA256: 45709a9fa7cc99147f243c75e17f613bb43f867e0909388f756f41fe2c51b887	... File Actions Show Properties Download
c:\users\eebsym5\documents\77oczsqvld5.docx	15.09 KB	MD5: 451e5e0d7a38df5ad9a6145ae4094c32 SHA1: 0038568d0135a37f49dcb1bc16f37b7d31aa7bcc SHA256: e6b5b189934a13cebf3bae63a9cfc2bc2bd003cdfdead2101f9fe1d191d8b835	... File Actions Show Properties Download
c:\users\eebsym5\documents\77_r-.pptx	35.77 KB	MD5: e257ffacc2f55561ec544630418a2273 SHA1: 978796d9c762489ae81c6a72d386a94622b7e6d1 SHA256: 622e02833a413b4a564489e70aa2d0729eafc1745eddfba7aa0ba6f0849dc6ec	... File Actions Show Properties Download
c:\users\eebsym5\documents\bsmf9q-s18uqwv 2qec.xlsx	75.11 KB	MD5: 19aa92ae90a8ba2e1af82123a843eb8b SHA1: 4ad07737d3e134c249bd7eca02f79868c40396b3 SHA256: 639d468807360296a7a45ceac4e293e8f7c465ba759feacdb7d9f345ba518f80	... File Actions Show Properties Download
c:\users\eebsym5\documents\ch1aq1nifb.xlsx	43.88 KB	MD5: a169818f987c90ffd13b5aba54aca62d SHA1: fab15e69de4248fd4cfec58948849f9789694504 SHA256: 53f2e0ace020668e9de9df717f71a2ca86ac4d23aa96d79a189701f500437543	... File Actions Show Properties Download
c:\users\eebsym5\documents\cshivohp5t7axydy7tk.pdf	15.83 KB	MD5: cbfd05db37994d36ce9b2456546f3dd9 SHA1: 7c0b07a66e14986b14b56e196e1bbbd0dd2f9147 SHA256: 216ac7f95f40fd782c1c8f7b047dceb304f28ec23a35cec7eb3d79d07530d0a4	... File Actions Show Properties Download
c:\users\eebsym5\documents\du k7oszoj3hlunu\8cbdyzx6or.pdf	29.06 KB	MD5: acd215fd34c69ba8dcc97e52e8752b76 SHA1: 960493c0881ab8b16934a24e655046266b9b1879 SHA256: c6685f387c80589e9143c7afe5cf3584ae354e8abb61f56b52d1f49d410d5cfe	... File Actions Show Properties Download
c:\users\eebsym5\documents\du k7oszoj3hlunu\lrk87zrnofur2siehy.pps	94.94 KB	MD5: 398460a1f47e8780d0ed000722018c97 SHA1: f493abf7e03b34dfe1e40b8c72ddc957fbedf8fb SHA256: 6c78905e61b33d8626bfbe83e7140d4494225432bb81bd63814592ce98fb481d	... File Actions Show Properties Download
c:\users\eebsym5\documents\du k7oszoj3hlunu\mfgg.xls	88.47 KB	MD5: c2570abab93ab65953a7d524353e249b SHA1: 17d62a6e0a75dffad6d00995ae2752ebfebd1aa0 SHA256: 41179b7a0f2b8fb1bded807f0b27507f8c5345ba28f16ceef7ef070cef8fe8d7	... File Actions Show Properties Download
c:\users\eebsym5\documents\du k7oszoj3hlunu\un2ks4.pptx	9.62 KB	MD5: 75afa1e380ffa6a9f0bac0a253744b3c SHA1: 095d48afb6036ecfeb45928f9f82e1eed1d0a501 SHA256: 3b73e7e4cbb4b507c3c6132a89b1e7f4e7223d9b352cdc52670e6d9ab1d74845	... File Actions Show Properties Download
c:\users\eebsym5\documents\du k7oszoj3hlunu\vz9na83wbdghk9way.ppt	75.86 KB	MD5: f5859f18514d5626a82787866f6051e4 SHA1: fda497fc25b133d81250b5b2473fa227c924a1be SHA256: 35380f075b249f54b67ebdabcb17128ecb6190d8513e6a9451650d2d09fc4e64	... File Actions Show Properties Download
c:\users\eebsym5\documents\du k7oszoj3hlunu\ywk4khhv.csv	56.91 KB	MD5: 2e559f6c654f39e8ce41220d792d9ee8 SHA1: d6c240ba4b1a87ea44ef9f084be87dafb678ead9 SHA256: 2c9362b1c2c1f87834d14fbfd15f012b247ef9901f3674c2fe310703b627e8fc	... File Actions Show Properties Download
c:\users\eebsym5\documents\duec7mr w 5v.odt	40.06 KB	MD5: c7d118ee669ca99b8582e2b679eb7cfd SHA1: f5e275d3d8326d558f03cccc8a4f6759781ae9ec SHA256: 58a97affd747eb44e0bbd08972caf785398496f26a4a4c4ce6284fb6f3e44751	... File Actions Show Properties Download
c:\users\eebsym5\documents\ik8r5v-n3rxf e3o.xlsx	88.72 KB	MD5: 8a5db70c75736b8ddf9f050da9e8fef9 SHA1: 9f5253141719670d2d163b2eaf4618f59f1e2e15 SHA256: b00bc249eb887b1e2b61a6c7b82a1a4976073fc19edf42ba7b22e8a4a80f0139	... File Actions Show Properties Download
c:\users\eebsym5\documents\k_-fc6z.rtf	70.86 KB	MD5: 25af09b0c0a79c40ea3a5f69c920ba42 SHA1: 0b796967ed8c463c9acf3087f9e8ccdadea7b291 SHA256: 1cccdadc2acc19754c4c338793c875edec39ecf0ef0817b0f11c2db364974189	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\5xayfjs7v 4p7.csv	21.38 KB	MD5: 4c9195879e8ca4a8c70ad64167ef655d SHA1: a06663d4e121d0326686dedae4de1f2b1258b08e SHA256: 8aa33f1071258d4d51826e1ad7d6848000ffc8ce49a4e43d349cb7935b311ac7	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\e9iupbuvzv.odp	74.42 KB	MD5: 6a5d50a639212ffb459a17b238bd8620 SHA1: 4d0e646f18e30d0b7f11f1e7215842b95cd6b1ae SHA256: 2eaad9485c3badf046e485bc4ce5918aed21e9ff231392273025eb245dc39fcd	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\d13e5u.odp	61.00 KB	MD5: 706fd646c4bfdc8569180f2ef51aad6b SHA1: a026d8e5e2835e6ffe2d0cd7efbf37b0899d371b SHA256: 67d38f4a0ab8352a44a3e12c3c0b63fa4051a91f6ec210f99f5bbe79e1d8ef38	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\dn8jjte7.csv	30.92 KB	MD5: 2b84d038e2299ae2e07e2689ae0fd6ef SHA1: 85552ec9f47b2de92fbe9f176de95a1d0637ed33 SHA256: a8d173cb3cb9ae4c04059661fd578a69ddba58cbdda23d70056dd31085904cd9	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\jzjq6zgmd3.odt	39.66 KB	MD5: 9104894f71c772191b226e5b90a8f462 SHA1: bdcf10b3f066e21e79b9eb2b884240cc0b041532 SHA256: 2cd7c7855322bc14919d060e2b86c0cbe44e08936c75f77cb0f2f943ec1aa849	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\n 4im.pps	33.34 KB	MD5: 7d2e3a562952fc7f812672a0b4e0a038 SHA1: a4b8e99e91cb9fd06c276b48274508026a851423 SHA256: 1dd69a83334cfb9abb24eafdc46287eee22fcf95c50ece2620e87b4d56282592	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\p i51dum47znpt.ppt	71.62 KB	MD5: 72c5310dd0494cd10ecd8a6a89dee60e SHA1: 6ae23a9a26249e6cea77c287ddac788af341b8cd SHA256: 3d6bd97698bcce58014d0282a41c73447c9787ef3e329cae956a10fca1bb8eb5	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\v2ax 2o10jyijz.pptx	20.98 KB	MD5: b84ce34194f05cab05bff046e018be34 SHA1: e5b04ea3bc40b9aeed9ade114e97e931b46f26ae SHA256: e9841f9672f15d26f47967ce5b44844fc72253a3c9a96c83bc88e9472d22d71c	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\wcaqi2idigh5rkdfeps.doc	14.89 KB	MD5: 6d6297e18a8194d63395fff540de16ea SHA1: 273a7fd740f889ddee11bd7b2baaac7596d1b4c5 SHA256: d90a0f99e8ad349ac237039842bdec2ad3da849bd886d0114878b12baeda4e47	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\wogsuwwod.odp	85.55 KB	MD5: 07bbb01d915a3f5ddd54522fb323055b SHA1: 785e46d50921c8e3383ce03397e5206d694b7ee9 SHA256: 55946e82e477d2395fb902fcbb7a2b411e028561b8155a4666c7ee5ad3c37ab4	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\gdyykq85q2ywlj1yb\ztgx092l1vp_ g0bfh.xlsx	2.73 KB	MD5: f62dd63c15435a7faf21f1fe7f452c45 SHA1: 029a527cbe99566b5270e38bf6fe225e687400df SHA256: e29d76306f0e8ea87ec080e2f80a2a3ec811b6789654a21f32dc8507bd00a360	... File Actions Show Properties Download
c:\users\eebsym5\documents\mlv3ptcfak3 r\pnvjm15.ods	43.22 KB	MD5: 6902c1faa010adf20c350e5e9cf2f0ee SHA1: 80e0db76df113ddd75dbd1fa6fa46612800828ab SHA256: 2be3196ea000e53397b0b5b86b5b58c69e313a4ca01c1d924fc5f1266de8ff5f	... File Actions Show Properties Download
c:\users\eebsym5\documents\ofdyndxzgobzng.pptx	98.95 KB	MD5: efd65c05b7b2b41115247eada8481441 SHA1: bf669da340b3d7a2d91dc66d401c27dfbc68ccf8 SHA256: 69814b39377bbb058fd25290636a24d3c6912251e6c9dcc6e62981507b179e25	... File Actions Show Properties Download
c:\users\eebsym5\documents\oh9agy41ppuv jg3b.docx	78.12 KB	MD5: 532883779582f21c69b647c734e0f0d3 SHA1: 46435febfebf78043898484c9650f8e5bde13106 SHA256: 913332e7b6bd0531c15a7d2e8aa3a69fd233b017a253f4bb8a1fe9bd1a8ffcf2	... File Actions Show Properties Download
c:\users\eebsym5\documents\ojd7p.docx	32.84 KB	MD5: 2bcac27bef60a2eeacf0286dda87c3e7 SHA1: 719c6dcdd95b0e4b27101321acc946be31530315 SHA256: 4674c9899bad334f1f5755c80642f868e0bee0b13826e10cb26d560e321a2b98	... File Actions Show Properties Download
c:\users\eebsym5\documents\outlook files\feasf@efw.com.pst	265.52 KB	MD5: 7caa9f32326c211acd20d62cc27822ee SHA1: 56c056b3d8c36375d25983794e9a3238024087fb SHA256: 9ad062f4c58df4590abd4bcfa8ce595f48c20b3777c4c559882e9fef29efb8c2	... File Actions Show Properties Download
c:\users\eebsym5\documents\outlook files\outlook data file - mail.pst	265.52 KB	MD5: 8f51ec960eb3ccd4909abb440f91d304 SHA1: f2e613c5882a8bef4b6243cbd99a3a96f2e7c6a1 SHA256: 2d3e3e4858db2639d01a5c7b2c2e70a2974f1dd2ebba2d3c9c83c101c82a489c	... File Actions Show Properties Download
c:\users\eebsym5\documents\pmz0w5lsrnua.pptx	51.64 KB	MD5: df5e2536086a0ed8f8a37dfe1220ad01 SHA1: d6839957b38485e5fe9537460fad6baf4fa04ae6 SHA256: 43480a13e77b2d45c8bbdaad14bc1745d16165333ffeca75edc1eb304dc997f2	... File Actions Show Properties Download
c:\users\eebsym5\documents\qbuqvozg4 sryx-0.docx	66.72 KB	MD5: 084ea15d1cac1a74dbfb69eb01741e85 SHA1: 0c340253ed575b510ccc802b88e60d2d2db81ca6 SHA256: 8bdf7773cb719f8a10f104c5a3714dbdb347c2ac7debbc57ac2aa73a750eff68	... File Actions Show Properties Download
c:\users\eebsym5\documents\u-pabak2.pptx	73.94 KB	MD5: 4d7e410b3e6e7c9e09f18ce1cc9d66c3 SHA1: d761846c910b6115e80f973d7828656268ede869 SHA256: 1f9ce654f2f575b968e311634cccb6994921d27c425e0a92410be1b53c91d4a2	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\8zzc6vss5o.odt	72.19 KB	MD5: 1b776a5576527da2fd5659667de3da75 SHA1: dc8b300515c8a5e297dda2f268104239bb4aaaa6 SHA256: db7f0986307ef537eb6209df3e9508881c4e2289363e8c90c8e43994d26af780	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\dvq88.pptx	9.14 KB	MD5: 92811502f5f7dd65f240e6a847889e7e SHA1: 6c6e315ba29a1e3ea1ce5d6956c49c0488d9f12e SHA256: f32faa721f97f37a4e6960f4d412a2fc96341779ee4330243592175cc246aed8	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\iptbfo r8xn6yx-i3w.doc	88.70 KB	MD5: 48a640bb60e738b342b8b7e328f4bbbc SHA1: 7cbf7ac43bddaabeb1477f6353debae43b4c9b73 SHA256: 0b7cc34c81f1007772b428bf586b2d840b6cab7ae804d0b1a68dc35c39670782	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\r3mwt9fzu rm4wo.pps	68.80 KB	MD5: be45e3393dda880330384f115abd5af4 SHA1: 733c65ce879c3faafcd5cc196321384cf87fa6b0 SHA256: 926e4468048e06b6439ae11dd540223a14cbe11cc40c4c75e9a1950200c98f6c	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\uz5fioslh2es4mr tns\2bds85u6tr.ots	58.42 KB	MD5: b9cdaa2f1c0011a64cba26ac3640db37 SHA1: e90fc3211aa098fdf1055741cbde97b6d3c4f03b SHA256: e56a2293ff007ee57dad6474ffac22e53d00e5f6bb56e212612c2aeac37afdfa	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\uz5fioslh2es4mr tns\40szfgmqdyq fkolzt.ppt	70.81 KB	MD5: 650a73204cfe04f36e5372b9b368a7f9 SHA1: 7eabd09051e02b3e1b971d9d56615b118a7a4691 SHA256: 8e87a7b773db04e0ab236450fd5993aab168063a11d70ea7807c57eb12f6a60a	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\uz5fioslh2es4mr tns\9jvkqa3b.ods	70.88 KB	MD5: 40c4f2b19e5bbc85991637adcdf253c2 SHA1: 323a014b109c42f77634957d71f819a4160a9ab9 SHA256: 9a276d08ff8b8562ee7d96f0fa5ea8db344a68e772e57c7fec9b1b2b653155d1	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\uz5fioslh2es4mr tns\ogkc1_kj1h.odt	22.86 KB	MD5: 3338be6562a03bd7818f5ff48b01d0fd SHA1: c147e8a3d8b29dea09527b2a9014f58c9461c6c8 SHA256: 421eea1ad5b216c74caaabe2635fbc32da65e9a09685825b477009fd17dca042	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\uz5fioslh2es4mr tns\znuc10gkdhhn\-uirpy3k97h9x4-.pdf	69.64 KB	MD5: 2e918dadfeaefd9976c55af69b1033c0 SHA1: edb89612ae1e20103b3ee4cde93feac55da16f82 SHA256: 80d986c4e56f6d311ec4fd701cd2b4a0230f99c41d85697f5aa03f64869018c3	... File Actions Show Properties Download
c:\users\eebsym5\documents\xhxak8vlnpfno9\uz5fioslh2es4mr tns\znuc10gkdhhn\1290gyerslm.pps	40.38 KB	MD5: c103f02bc517fad8f8db07bc604f621e SHA1: c8b9a0f882e843aae4eb38330d82ee96d253f2d2 SHA256: f691e4b516fd993c1acf54cf93ac7e3a0d06c6241d0f99ef5476d6be40cc1c10	... File Actions Show Properties Download
c:\users\eebsym5\documents\z0u8zp7s7.pptx	90.98 KB	MD5: 376235f56e40596110690285e2d867ee SHA1: e2d8f98fc82542b952ad87a4816208ea30555362 SHA256: cd0b252bc204e751647f8c75fc0de90b2cf5775d77e0fd282799420f1b697c03	... File Actions Show Properties Download
c:\users\eebsym5\documents\zb5aqjwgnsznrvtqe3u.docx	33.11 KB	MD5: c6dbf79869b0057dfb82b94b8cc55754 SHA1: ab9f1d47efac9df53a3a088b314f31e85656ca60 SHA256: cbeae133cec1705d15d9bcee3681b2ed5efce76ac434ebf77a08049cb78f0c3f	... File Actions Show Properties Download
c:\users\eebsym5\documents\zhfq.xlsx	27.27 KB	MD5: 10527d66201e0722091bac6b50dd3173 SHA1: b3b06f9bd776032167d4cdbdc8627dd7519788f3 SHA256: 70da415c037e9ec2fd5e1b59a65d37e20d83fdc8a77e3572f180303aa9a84d78	... File Actions Show Properties Download
c:\users\eebsym5\documents\zrcfqsfwpcdv1u.xlsx	59.77 KB	MD5: 959949f81cb3c3411e423fa2384a1abc SHA1: cc213ce56b7c8cc6f0f3fd16901afa5ee91ba172 SHA256: b312f6fdadbd2e799857fb94c7c382d51ef0aecdbc7b15a10d366995128f8cd8	... File Actions Show Properties Download
c:\users\eebsym5\favorites\links\suggested sites.url	0.75 KB	MD5: 1c680852edb365ccaac1f08a39c46906 SHA1: 58b435f5ec2d9a8ebc8c009f3c4dc050f5d130f1 SHA256: a4e6a781d41970216fb4a4c7b3106c29de81c23d07a4fc4d64a8ff0e535c5fd4	... File Actions Show Properties Download
c:\users\eebsym5\favorites\links\web slice gallery.url	0.75 KB	MD5: 69ea5cb945dbc6124a954aa713866aa2 SHA1: 187533f4214b5ffcad831e9cd4b1a80169959990 SHA256: d2c56fd983c82b6695c12e480ff2b7540e01a24b3b526240eca24cb2711b7cca	... File Actions Show Properties Download
c:\users\eebsym5\favorites\microsoft websites\ie add-on site.url	0.66 KB	MD5: 8b452c4089acb0aa8d58af28b9d58221 SHA1: 507b6d944cde82869a50aa469f58de8b0db44461 SHA256: 1bdf0980f1b61fd7c784afdb7fab25b6127bd6ed4424835ae5100c3e065d7adb	... File Actions Show Properties Download
c:\users\eebsym5\favorites\microsoft websites\ie site on microsoft.com.url	0.66 KB	MD5: 6162ec3829eb2d76e29f5d0a5c6bdd9c SHA1: e5d0210ef21ae001aaf9ebe08c934b6913bc9d27 SHA256: 50f09b682b16c6aaf07e4a54f96a47620f8707a3d70b7aec5511ae457cb90b86	... File Actions Show Properties Download
c:\users\eebsym5\favorites\microsoft websites\microsoft at home.url	0.66 KB	MD5: 3bca280c2934305c58e5daedbc41703c SHA1: dbcefb7d889e5a17e69b4da3200a5f13cc64f236 SHA256: db7c597b2a2e02189fe07e7e9edca2782fd9fd9149edab6965e8e623d1a7f57b	... File Actions Show Properties Download
c:\users\eebsym5\favorites\microsoft websites\microsoft at work.url	0.66 KB	MD5: 7f6477346b89c1d77c6ae97193cc44d4 SHA1: 9f21d372bc9e9a53737da8ed05d2dfa5c7decb3c SHA256: eb45e58e4c7de81fd459eefeaff69f3e15897f1b8c889b76a87f806ea0f176ef	... File Actions Show Properties Download
c:\users\eebsym5\favorites\microsoft websites\microsoft store.url	0.66 KB	MD5: 5be7db0f8451da4e8d3354928b904d60 SHA1: deb7cf237862826a73d840ed5f5448a46057c324 SHA256: f993b2d339d6d5ba0f6bd816bf490163786d5dfd2d5ed4f2f944471ef0e4bab3	... File Actions Show Properties Download
c:\users\eebsym5\favorites\msn websites\msn autos.url	0.66 KB	MD5: 83b9b64c38e8e2038308e5ee477cbe3d SHA1: 9486b9c55ef7bfea6aabeb236bcb51396b246361 SHA256: 9d05b52e4bef81cd488cb8ba1b722dc118e48c7275a04c4602e3046eb6870b3d	... File Actions Show Properties Download
c:\users\eebsym5\favorites\msn websites\msn entertainment.url	0.66 KB	MD5: 724f999168f77940676adf53b530bb8e SHA1: f21930d03443f4b34a4811df7fb830b9c6d9bb6a SHA256: b90bcd2a00c3fbdb194e41658c139ed72546bf5e6d3ad4c969e6fd857686b858	... File Actions Show Properties Download
c:\users\eebsym5\favorites\msn websites\msn money.url	0.66 KB	MD5: c44e6da4c3e1a45df05a1332cd6957bc SHA1: e116d135d8c93027b3041d91177eddf69d6ba9f5 SHA256: 315881576fcdb14c2120718778c69ef2447f58875093bef2bab6153b8de5cab3	... File Actions Show Properties Download
c:\users\eebsym5\favorites\msn websites\msn sports.url	0.66 KB	MD5: f5c3284aa4f01516d1d044ce7bac3a94 SHA1: 77a005e90f4f3e456e1f5504e07639e378d61bb6 SHA256: e299f4b897509fe3ac6b67e46d387d220b272d6d084671b357946ff435485def	... File Actions Show Properties Download
c:\users\eebsym5\favorites\msn websites\msn.url	0.66 KB	MD5: 3c1247295d479e9eab8a702308257458 SHA1: 16dacb952a930fb4a29bf9bc8d3087b09a3336cc SHA256: c5e2a1daaf6d7250696d914167f1f2931818d7342efdcb95c186d64fbfa0ca6b	... File Actions Show Properties Download
c:\users\eebsym5\favorites\msn websites\msnbc news.url	0.66 KB	MD5: aef3ca9ccd67b56c4adff34ce9e934ea SHA1: f47b20c9fb4251b6b476567f2fd564189621488a SHA256: cd3cb65d80c4579966f978cc25e9cf108e82a5bbac34c5e3ea7f0b4ccbf05998	... File Actions Show Properties Download

Host Behavior

File (2997)

Operation	Filename	Additional Information	Count	Logfile
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\igkphg.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\$Recycle.Bin\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\$Recycle.Bin\S-1-5-21-3785418085-2572485238-895829336-1000\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Documents and Settings\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\MSOCache\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\PerfLogs\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Recovery\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\System Volume Information\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Application Data\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\History\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Credentials\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Feeds\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\0TOZKA9V\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\28NUQX6M\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\8S73DLQL\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\index.dat	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\QVTV2WL1\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Internet Explorer\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Internet Explorer\brndlog.txt	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\01_Music_auto_rated_at_5_stars.wpl	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\02_Music_added_in_the_last_month.wpl	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\03_Music_rated_at_4_or_5_stars.wpl	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\04_Music_played_in_the_last_month.wpl	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\05_Pictures_taken_in_the_last_month.wpl	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\06_Pictures_rated_4_or_5_stars.wpl	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\07_TV_recorded_in_the_last_week.wpl	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\08_Video_rated_at_4_or_5_stars.wpl	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\09_Music_played_the_most.wpl	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\10_All_Music.wpl	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\11_All_Pictures.wpl	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\12_All_Video.wpl	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\account{553187ED-CFB2-4763-8DAE-48D3609A76AC}.oeaccount	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\account{91E541D8-6C9E-48C0-AB69-0A7168AA62DE}.oeaccount	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\account{DD8DA3D5-48F0-4F18-846C-50E4200467F0}.oeaccount	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\new\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\new\edb00001.log	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.MSMessageStore	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.pat	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edb.chk	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edb.log	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edb00001.log	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edbres00001.jrs	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edbres00002.jrs	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\oeold.xml	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.htm	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.htm	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Green Bubbles.htm	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Hand Prints.htm	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Orange Circles.htm	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.htm	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.htm	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Shades of Blue.htm	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Soft Blue.htm	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.htm	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Media\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Media\12.0\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\Settings.ini	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Temp\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Local\Temp\ConfigureMachine.log	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\AppData\Local\Temporary Internet Files\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\LocalLow\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Roaming\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Roaming\Identities\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Roaming\Identities\{74A13782-B361-4204-9DAA-0A3D49DA4337}\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Roaming\Microsoft\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Roaming\Microsoft\Credentials\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Roaming\Microsoft\Protect\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\AppData\Roaming\Microsoft\Protect\S-1-5-21-3149542145-3322839065-4058237693-500\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Application Data\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Contacts\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Contacts\Administrator.contact	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Cookies\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Desktop\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Documents\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Documents\My Music\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Documents\My Pictures\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Documents\My Videos\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Downloads\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Favorites\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Favorites\Links\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Favorites\Links\Web Slice Gallery.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Favorites\Microsoft Websites\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Favorites\Microsoft Websites\IE Add-on site.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Favorites\Microsoft Websites\IE site on Microsoft.com.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Home.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Work.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Favorites\Microsoft Websites\Microsoft Store.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Favorites\MSN Websites\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Favorites\MSN Websites\MSN Autos.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Favorites\MSN Websites\MSN Entertainment.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Favorites\MSN Websites\MSN Money.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Favorites\MSN Websites\MSN Sports.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Favorites\MSN Websites\MSN.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Favorites\MSN Websites\MSNBC News.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Favorites\Windows Live\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Favorites\Windows Live\Get Windows Live.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Favorites\Windows Live\Windows Live Gallery.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Favorites\Windows Live\Windows Live Mail.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Favorites\Windows Live\Windows Live Spaces.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Links\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Music\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\My Documents\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\NetHood\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\NTUSER.DAT.LOG1	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\ntuser.ini	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Pictures\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\PrintHood\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Recent\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Saved Games\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Searches\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Searches\Everywhere.search-ms	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\Searches\Indexed Locations.search-ms	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Default\SendTo\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Start Menu\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Templates\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default\Videos\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Default User\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\-0vR-5Eof.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\1hJlHgSlYadwrp8.m4a	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\1Ia7iQCcQA.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\2guAeuf.odt	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\36kWsMALQicD0te_3c_.flv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\3gXALqztxgXdFkQCu.mp3	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\3Lj9rCs6PUveAQdr7FMm.mp3	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\3ZYAD7e5PHR.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\654dKTfXJCr.flv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\6D_T.flv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\6ELT.avi	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\7OznzJtu6N.odt	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\8io7Tx06zxI2.docx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\9ugR.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Acrobat\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Acrobat\10.0\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Acrobat\10.0\Collab\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Acrobat\10.0\Forms\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Acrobat\10.0\JavaScripts\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Acrobat\10.0\JavaScripts\glob.settings.js	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Acrobat\10.0\Security\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Acrobat\10.0\Security\addressbook.acrodata	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Acrobat\10.0\Security\CRLCache\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Acrobat\10.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Acrobat\10.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Flash Player\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Flash Player\AssetCache\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Headlights\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Linguistics\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Linguistics\Dictionaries\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Adobe\LogTransport2\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\aWZYh7SvL_1D.odp	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\cCj4O2.mkv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\CdFVMiaX-yi7IMdBsDw.mkv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\fCvygU7i.odp	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\FhWY wcClSA.odt	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\fJhRhUN6PyZ8V.avi	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\FwOdx8_7Rn.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\g48XRKC.flv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\I6QdDAGp0lYnso_F26z.mkv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Identities\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Identities\{74A13782-B361-4204-9DAA-0A3D49DA4337}\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\JAmIn.xlsx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\jIDR.avi	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\JMPm2RfNg.wav	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\JqsqsBEG7ooE6RbKwXB.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\L60o3WuIf7Gy5ixnJ.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\lrgeJhU.swf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Macromedia\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Macromedia\Flash Player\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Macromedia\Flash Player\macromedia.com\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\AddIns\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Credentials\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Crypto\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Crypto\RSA\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3785418085-2572485238-895829336-1000\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Document Building Blocks\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Document Building Blocks\1033\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\Built-In Building Blocks.dotx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Excel\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Excel\XLSTART\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\HTML Help\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\HTML Help\hh.dat	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\IME12\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\IMJP12\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\IMJP8_1\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\IMJP9_0\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\index.dat	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\L3DK0KAH\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\L3DK0KAH\id[1].xml	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\05P2C0FB\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\3Q4BCXJF\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\3Q4BCXJF\id[1].xml	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\index.dat	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\SFX4RKM5\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\T9DX4T6Q\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\PB5UWKXI\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\TIIZUCFY\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\ZQH8NGYD\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\MMC\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\MS Project\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\MS Project\14\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\MS Project\14\1033\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\MS Project\14\1033\Global.MPT	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Network\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Network\Connections\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Network\Connections\Pbk\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Office\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Office\MSO1033.acl	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Office\Recent\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Office\Recent\Global.LNK	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Office\Recent\index.dat	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Outlook\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Outlook\Outlook.srs	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Outlook\Outlook.xml	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\PowerPoint\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Proof\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Protect\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Protect\S-1-5-21-3149542145-3322839065-4058237693-500\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Protect\S-1-5-21-3785418085-2572485238-895829336-1000\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Publisher\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Publisher Building Blocks\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Speech\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\SystemCertificates\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\SystemCertificates\My\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Templates\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Templates\Normal.dotm	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\UProof\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Word\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Word\STARTUP\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Extensions\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Crash Reports\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\addons.json	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\bookmarkbackups\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\bookmarkbackups\bookmarks-2017-05-31_5.json	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\bookmarkbackups\bookmarks-2017-07-12_5.json	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\cert8.db	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\compatibility.ini	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\content-prefs.sqlite	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\cookies.sqlite	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\downloads.sqlite	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\extensions.ini	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\extensions.sqlite	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\healthreport\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\healthreport.sqlite	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\indexedDB\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\indexedDB\moz-safe-about+home\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\indexedDB\moz-safe-about+home\idb\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\indexedDB\moz-safe-about+home\idb\818200132aebmoouht\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\indexedDB\moz-safe-about+home\idb\818200132aebmoouht.sqlite	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\key3.db	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\localstore.rdf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\marionette.log	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\mimeTypes.rdf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\minidumps\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\permissions.sqlite	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\places.sqlite	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\pluginreg.dat	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\prefs.js	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\search.json	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\secmod.db	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\sessionstore.bak	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\sessionstore.js	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\signons.sqlite	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\times.json	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\urlclassifierkey3.txt	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\webapps\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\webappsstore.sqlite	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\profiles.ini	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\NHQ1HCgmSG8B.flv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\pdSDF-O2XEXbw.avi	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Q-s_4Qhd1.gif	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\QNouhZ1JaPY0u.m4a	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\tvzjzS.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\UHi52n.flv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\uW1opw43z.mp3	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\Vaau_AuCt2-v.swf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\VGm32iz-b.swf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\z9oK2XVdTXxZz_svtRT.mp4	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\AppData\Roaming\_1EuGfemD.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Application Data\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Contacts\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Contacts\Administrator.contact	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Contacts\ihnvbh euuncnh.contact	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Contacts\lodkd auftnm.contact	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Contacts\mneuc uhnfghgg.contact	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Contacts\ofhbnh edferrr.contact	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Contacts\uosjfl sidvllie.contact	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Cookies\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Desktop\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Desktop\0dvhPOmJlYtro_v.mp4	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\1Ml-7aPJ0jKjQdbzzWXJ.wav	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\3JuA.swf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\6TvJSWiA-Wbr5.avi	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\9B2i7C_e8RIsPMXL6f6.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\bjgohQsUApVHV hfX8a1.m4a	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\dL13.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\e3I0XDQBd.mp4	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\gaqTFTuCHS.flv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\He2M.mkv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\lbl9s.avi	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\OelMejSL85H.m4a	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\osPAtBxgjZl.wav	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\pue6UNYH0mMp-vcx.gif	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\Q3a_7VjE.swf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\QxvLVPdGKwwfnEBo\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Desktop\QxvLVPdGKwwfnEBo\F2-_W1QZInEES1i.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\QxvLVPdGKwwfnEBo\MCrWX.flv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\QxvLVPdGKwwfnEBo\qviMWuq.mp4	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\QxvLVPdGKwwfnEBo\ySt.mp3	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\sIOM.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\sK4m18olbpY.m4a	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\sz uo4.m4a	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\TRCDXhDihDM.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\UhzcNQ.mp3	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\Viwp\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Desktop\Viwp\2TWq-1xPVBzCu.wav	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\Viwp\Dhp8.mkv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\Viwp\diep9Gcl_kvXMgwU3R.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\Viwp\lKLYw-il4wRA.ods	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\xckHq1j0cO.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\y16hxOz8ujX7n.flv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\YLn2_.gif	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\YsAOBn7ufb0kiB2.swf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\Z3H7Xk7.ppt	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Desktop\ZmgNa.mp3	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Documents\0qSqlpnxJ.pptx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\6KRllW7ID8y.docx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\77OczSqvld5.docx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\77_r-.pptx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\bsmF9q-s18UQwV 2QeC.xlsx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\ch1Aq1nIfB.xlsx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\cshIVOHP5t7axydY7Tk.pdf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\du k7OsZOj3hLunu\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Documents\du k7OsZOj3hLunu\8cBdYZX6OR.pdf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\du k7OsZOj3hLunu\LRK87zrnofUR2SIEHY.pps	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\du k7OsZOj3hLunu\MfGg.xls	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\du k7OsZOj3hLunu\uN2KS4.pptx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\du k7OsZOj3hLunu\VZ9nA83WbdGHK9Way.ppt	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\du k7OsZOj3hLunu\YWK4KhhV.csv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\DuEC7MR W 5V.odt	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\ik8r5v-n3rXf E3o.xlsx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\k_-fc6z.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\5xAyFJs7V 4p7.csv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\e9IUPBuVZv.odp	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\D13e5u.odp	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\dN8jJtE7.csv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\JZjq6zgmd3.odt	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\N 4im.pps	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\p i51dUM47znpT.ppt	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\V2AX 2O10jYiJz.pptx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\wCaQi2iDiGH5RkDFepS.doc	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\WOgsUWwOd.odp	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\Ztgx092l1Vp_ G0BfH.xlsx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\PnvJm15.ods	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\My Music\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Documents\My Pictures\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Documents\My Shapes\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Documents\My Shapes\_private\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Documents\My Videos\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Documents\OfdynDXzGObznG.pptx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\oH9Agy41PpuV JG3b.docx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\OjD7P.docx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\Outlook Files\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Documents\Outlook Files\feasf@efw.com.pst	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\Outlook Files\Outlook Data File - mail.pst	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\pmz0w5LsRNua.pptx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\qbuQVoZG4 sryX-0.docx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\u-PaBAK2.pptx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\8zzC6VSS5o.odt	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\DVq88.pptx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\IPTBfO R8XN6YX-i3w.doc	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\r3mWT9fZu RM4Wo.pps	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\uz5fIOSLh2es4MR TnS\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\uz5fIOSLh2es4MR TnS\2bdS85U6Tr.ots	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\uz5fIOSLh2es4MR TnS\40sZfGmqdyq FkOlzt.ppt	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\uz5fIOSLh2es4MR TnS\9JvkqA3b.ods	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\uz5fIOSLh2es4MR TnS\ogkC1_KJ1H.odt	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\uz5fIOSLh2es4MR TnS\zNUC10gkDHhN\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\uz5fIOSLh2es4MR TnS\zNUC10gkDHhN\-UIRpy3K97H9X4-.pdf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\uz5fIOSLh2es4MR TnS\zNUC10gkDHhN\1290GYErsLm.pps	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\Z0u8ZP7s7.pptx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\Zb5AQJwGNSznRVtqe3U.docx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\zhFQ.xlsx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Documents\zrcfqsFwPCDV1U.xlsx	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Downloads\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Favorites\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Favorites\Links\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Favorites\Links\Suggested Sites.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Favorites\Links\Web Slice Gallery.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Favorites\Microsoft Websites\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Favorites\Microsoft Websites\IE Add-on site.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Favorites\Microsoft Websites\IE site on Microsoft.com.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Favorites\Microsoft Websites\Microsoft At Home.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Favorites\Microsoft Websites\Microsoft At Work.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Favorites\Microsoft Websites\Microsoft Store.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Favorites\MSN Websites\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Favorites\MSN Websites\MSN Autos.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Favorites\MSN Websites\MSN Entertainment.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Favorites\MSN Websites\MSN Money.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Favorites\MSN Websites\MSN Sports.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Favorites\MSN Websites\MSN.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Favorites\MSN Websites\MSNBC News.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Favorites\Windows Live\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Favorites\Windows Live\Get Windows Live.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Favorites\Windows Live\Windows Live Gallery.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Favorites\Windows Live\Windows Live Mail.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Favorites\Windows Live\Windows Live Spaces.url	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Links\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Music\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\1QmXUMl1oWdr.m4a	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3 PW-Ui J15ZiazoDJ.mp3	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3PRe6lFPXnoV\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3PRe6lFPXnoV\dPOt3gFaJ-Z6\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3PRe6lFPXnoV\dPOt3gFaJ-Z6\2pbVfF b7rTJ78.wav	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3PRe6lFPXnoV\dPOt3gFaJ-Z6\iQrAsVXlz3lznnVOsCOs.wav	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3PRe6lFPXnoV\dPOt3gFaJ-Z6\Q5dZD.wav	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3PRe6lFPXnoV\Hfnq-cR6N2E4U.mp3	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3PRe6lFPXnoV\OwzbZbPLB0o.wav	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3PRe6lFPXnoV\Vos9O.m4a	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3PRe6lFPXnoV\Yo_w2TuZ.wav	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\KUo1DWpbXwZ0_80R\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\ThgP5gx.wav	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\U4D-0SVGPJJ4Dryb\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\U4D-0SVGPJJ4Dryb\H7ff_GwOhsVGEXsihXt.wav	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\U4D-0SVGPJJ4Dryb\mRjftTtKKqf0xRNw2.m4a	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\U4D-0SVGPJJ4Dryb\Rpr9kZlt_u.m4a	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\U4D-0SVGPJJ4Dryb\YX4mBHiukJu6.m4a	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\yvxKHo\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\yvxKHo\f5OyyZ.wav	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\yvxKHo\f_kp.mp3	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\yvxKHo\gELsA6F7pttjUe.mp3	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\yvxKHo\KUTgNDbqhOgDz.wav	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\yvxKHo\TR2W.mp3	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\K3ee4zeF9Y7Dz8tV4d\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Music\K3ee4zeF9Y7Dz8tV4d\45Nk1i_BoauAP8Q-z.mp3	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\K3ee4zeF9Y7Dz8tV4d\QOfNPVQ G.wav	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\PEM21hcjp\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Music\PEM21hcjp\-E09CgTxs9XudMT.wav	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\PEM21hcjp\0w4-fEH.mp3	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\PEM21hcjp\9ekfhikfPvBx8_x-.m4a	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\PEM21hcjp\bkbdPdxuTFgURx7v.m4a	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\PEM21hcjp\qpY9FYnWoKtkjTIOjgP.wav	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\tm39iVkClG.m4a	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Music\Y3YiRdbksEQBqCKoTAO.mp3	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\My Documents\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\NetHood\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\ntuser.dat.LOG1	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\ntuser.ini	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Pictures\016Di.gif	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\-1kkZleyIZ1R\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\-1kkZleyIZ1R\1k2hAvfCtB.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\-1kkZleyIZ1R\aHN_mm.gif	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\-1kkZleyIZ1R\illI47uGvN2wZztPH.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\-1kkZleyIZ1R\JuEs.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\-egVHIB991RXL.gif	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\6TRx7EFUqWYpm\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\6TRx7EFUqWYpm\4MhCMx8mxOZ4R6sUU.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\6TRx7EFUqWYpm\HuDTaOFF2Rc_f3-.gif	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\6TRx7EFUqWYpm\IpmSIACSNVg.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\6TRx7EFUqWYpm\N2f4N0vc_293oxyBm.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\6TRx7EFUqWYpm\NNs9wHpVaYC.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\6TRx7EFUqWYpm\SQ8lb5W7drgmeYNEF1S.gif	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\6TRx7EFUqWYpm\tkcS0JUG4KsMmhDvh.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\G2YPsFrieefZqVB.gif	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\GTyheWzufun9Zx fpetH\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\GTyheWzufun9Zx fpetH\3XWQLTyq_.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\GTyheWzufun9Zx fpetH\G9L4cvJBDoCuf58V.gif	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\GTyheWzufun9Zx fpetH\iQlDSU1tF2smN.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\GTyheWzufun9Zx fpetH\u5T6V5I8xWuu3Nh3mf.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\GTyheWzufun9Zx fpetH\WfA NLZgPC3bXWOwixF.gif	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\GTyheWzufun9Zx fpetH\z6H9-.gif	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\-rgMiko5CL5HfCCaj0.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\H55uX138oMsgwlKc.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\ImEm\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\ImEm\BFoix Z1s4jC8CZm-48h.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\ImEm\UF-kf.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\ImEm\wW5N4X9XUvTA.gif	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\QpLL969CGE.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\T3BHF4GPgRUH u W.gif	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\TO8LjytzKJ.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\ydfz.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\xYk2ZoNkyQMgjNrk.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\y77WbMwmdpln7CPFnu\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\y77WbMwmdpln7CPFnu\vh3O.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\y77WbMwmdpln7CPFnu\y8inPj-Y7tYbW8a.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\YHytB7K92.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\mn7M8P.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\qr ECTLYN9.png	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Pictures\uvMJhU4PE.gif	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\PrintHood\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Recent\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Saved Games\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Searches\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Searches\Everywhere.search-ms	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Searches\Indexed Locations.search-ms	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\SendTo\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Start Menu\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Templates\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Videos\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\2aUe1NFW\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\2aUe1NFW\ij6D1Hmnd5pXI\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\2aUe1NFW\ij6D1Hmnd5pXI\10n6Z.avi	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\2aUe1NFW\ij6D1Hmnd5pXI\jQVUvqNRBz8THfZ\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\2aUe1NFW\ij6D1Hmnd5pXI\jQVUvqNRBz8THfZ\dGeT7.avi	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\2aUe1NFW\ij6D1Hmnd5pXI\jQVUvqNRBz8THfZ\enwnlBrv-lyZm7Dt-Z.swf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\2aUe1NFW\ij6D1Hmnd5pXI\jQVUvqNRBz8THfZ\gdOj.mp4	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\2aUe1NFW\ij6D1Hmnd5pXI\jQVUvqNRBz8THfZ\qgw500AlRUcpyvPh6.swf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\2aUe1NFW\ij6D1Hmnd5pXI\jQVUvqNRBz8THfZ\sNmTi-go2qxqHW.mp4	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\2aUe1NFW\Jzf9ZcO.mp4	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\2aUe1NFW\uDUbW7qghuGbI34Av.mkv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\2aUe1NFW\ZOcI-b4EAgXyyysZ.flv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\dJ96B.swf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\LxnortQAc_u 3V\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\LxnortQAc_u 3V\ZCvhFcVgvW\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\LxnortQAc_u 3V\ZCvhFcVgvW\cd5ZfGUTUJU\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\LxnortQAc_u 3V\ZCvhFcVgvW\cd5ZfGUTUJU\jqIKt2MhD.avi	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\LxnortQAc_u 3V\ZCvhFcVgvW\cd5ZfGUTUJU\QwHMVE-IW.swf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\LxnortQAc_u 3V\ZCvhFcVgvW\JXLZBbsjZaSAGRfN8OF.swf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\N4ZvXTAJINrUgp.swf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\Rm jz\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\Rm jz\0gb79HkoUckigH0hO.mp4	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\Rm jz\sIlL7Z\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\Rm jz\sIlL7Z\KniD -471.avi	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\Rm jz\ssEsI.flv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\ToR-X-Oe9S.mkv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\UjALJvTHxSHPbDaHuDL\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\UjALJvTHxSHPbDaHuDL\7Ibxzs4j.avi	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\UjALJvTHxSHPbDaHuDL\Dk2MtpxhhHI7j.mp4	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\UjALJvTHxSHPbDaHuDL\xQHSBl8.mp4	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\iWGSAiHu-A9u PDI70M\v2Ng-VgncwLk.swf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\o Ro7hV1IRA.swf	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\qm v0h.avi	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\EEBsYm5\Videos\ZX mVxf6sMFvxv1OoW.flv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Public\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Public\Desktop\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Public\Documents\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Public\Documents\My Music\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Public\Documents\My Pictures\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Public\Documents\My Videos\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Public\Downloads\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Public\Favorites\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Public\Libraries\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Public\Libraries\RecordedTV.library-ms	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Public\Music\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Public\Music\Sample Music\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Public\Music\Sample Music\Kalimba.mp3	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Public\Music\Sample Music\Sleep Away.mp3	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Public\Pictures\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Public\Pictures\Sample Pictures\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Public\Pictures\Sample Pictures\Desert.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Public\Pictures\Sample Pictures\Koala.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Public\Recorded TV\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Public\Recorded TV\Sample Media\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\Public\Videos\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Public\Videos\Sample Videos\\CRAB-DECRYPT.txt	desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Create	C:\Users\Public\Videos\Sample Videos\Wildlife.wmv	desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Create Pipe	Anonymous read pipe	size = 0	1	Fn
Create Pipe	Anonymous read pipe	size = 0	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\igkphg.exe	type = size	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\index.dat	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Internet Explorer\brndlog.txt	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\01_Music_auto_rated_at_5_stars.wpl	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\02_Music_added_in_the_last_month.wpl	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\03_Music_rated_at_4_or_5_stars.wpl	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\04_Music_played_in_the_last_month.wpl	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\05_Pictures_taken_in_the_last_month.wpl	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\06_Pictures_rated_4_or_5_stars.wpl	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\07_TV_recorded_in_the_last_week.wpl	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\08_Video_rated_at_4_or_5_stars.wpl	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\09_Music_played_the_most.wpl	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\10_All_Music.wpl	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\11_All_Pictures.wpl	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0001692D\12_All_Video.wpl	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\account{553187ED-CFB2-4763-8DAE-48D3609A76AC}.oeaccount	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\account{91E541D8-6C9E-48C0-AB69-0A7168AA62DE}.oeaccount	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\account{DD8DA3D5-48F0-4F18-846C-50E4200467F0}.oeaccount	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\new\edb00001.log	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.MSMessageStore	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.pat	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edb.chk	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edb.log	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edb00001.log	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edbres00001.jrs	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edbres00002.jrs	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\oeold.xml	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.htm	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.htm	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Green Bubbles.htm	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Hand Prints.htm	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Orange Circles.htm	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.htm	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.htm	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Shades of Blue.htm	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Soft Blue.htm	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.htm	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\Settings.ini	type = file_attributes	1	Fn
Get Info	C:\Users\Default\AppData\Local\Temp\ConfigureMachine.log	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Contacts\Administrator.contact	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Favorites\Links\Web Slice Gallery.url	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Favorites\Microsoft Websites\IE Add-on site.url	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Favorites\Microsoft Websites\IE site on Microsoft.com.url	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Home.url	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Work.url	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Favorites\Microsoft Websites\Microsoft Store.url	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Favorites\MSN Websites\MSN Autos.url	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Favorites\MSN Websites\MSN Entertainment.url	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Favorites\MSN Websites\MSN Money.url	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Favorites\MSN Websites\MSN Sports.url	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Favorites\MSN Websites\MSN.url	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Favorites\MSN Websites\MSNBC News.url	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Favorites\Windows Live\Get Windows Live.url	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Favorites\Windows Live\Windows Live Gallery.url	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Favorites\Windows Live\Windows Live Mail.url	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Favorites\Windows Live\Windows Live Spaces.url	type = file_attributes	1	Fn
Get Info	C:\Users\Default\NTUSER.DAT.LOG1	type = file_attributes	1	Fn
Get Info	C:\Users\Default\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf	type = file_attributes	1	Fn
Get Info	C:\Users\Default\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms	type = file_attributes	1	Fn
Get Info	C:\Users\Default\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms	type = file_attributes	1	Fn
Get Info	C:\Users\Default\ntuser.ini	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Searches\Everywhere.search-ms	type = file_attributes	1	Fn
Get Info	C:\Users\Default\Searches\Indexed Locations.search-ms	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\-0vR-5Eof.bmp	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\1hJlHgSlYadwrp8.m4a	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\1Ia7iQCcQA.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\2guAeuf.odt	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\36kWsMALQicD0te_3c_.flv	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\3gXALqztxgXdFkQCu.mp3	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\3Lj9rCs6PUveAQdr7FMm.mp3	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\3ZYAD7e5PHR.bmp	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\654dKTfXJCr.flv	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\6D_T.flv	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\6ELT.avi	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\7OznzJtu6N.odt	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\8io7Tx06zxI2.docx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\9ugR.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Acrobat\10.0\JavaScripts\glob.settings.js	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Acrobat\10.0\Security\addressbook.acrodata	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Acrobat\10.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Adobe\Acrobat\10.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\aWZYh7SvL_1D.odp	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\cCj4O2.mkv	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\CdFVMiaX-yi7IMdBsDw.mkv	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\fCvygU7i.odp	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\FhWY wcClSA.odt	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\fJhRhUN6PyZ8V.avi	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\FwOdx8_7Rn.bmp	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\g48XRKC.flv	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\I6QdDAGp0lYnso_F26z.mkv	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\JAmIn.xlsx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\jIDR.avi	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\JMPm2RfNg.wav	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\JqsqsBEG7ooE6RbKwXB.png	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\L60o3WuIf7Gy5ixnJ.bmp	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\lrgeJhU.swf	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\Built-In Building Blocks.dotx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\HTML Help\hh.dat	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\index.dat	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\L3DK0KAH\id[1].xml	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\3Q4BCXJF\id[1].xml	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\index.dat	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\MS Project\14\1033\Global.MPT	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Office\MSO1033.acl	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Office\Recent\Global.LNK	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Office\Recent\index.dat	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Outlook\Outlook.srs	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Outlook\Outlook.xml	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Templates\Normal.dotm	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\addons.json	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\bookmarkbackups\bookmarks-2017-05-31_5.json	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\bookmarkbackups\bookmarks-2017-07-12_5.json	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\cert8.db	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\compatibility.ini	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\content-prefs.sqlite	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\cookies.sqlite	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\downloads.sqlite	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\extensions.ini	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\extensions.sqlite	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\healthreport.sqlite	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\indexedDB\moz-safe-about+home\idb\818200132aebmoouht.sqlite	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\key3.db	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\localstore.rdf	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\marionette.log	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\mimeTypes.rdf	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\permissions.sqlite	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\places.sqlite	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\pluginreg.dat	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\prefs.js	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\search.json	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\secmod.db	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\sessionstore.bak	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\sessionstore.js	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\signons.sqlite	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\times.json	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\urlclassifierkey3.txt	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\webappsstore.sqlite	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\profiles.ini	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\NHQ1HCgmSG8B.flv	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\pdSDF-O2XEXbw.avi	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Q-s_4Qhd1.gif	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\QNouhZ1JaPY0u.m4a	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\tvzjzS.bmp	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\UHi52n.flv	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\uW1opw43z.mp3	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\Vaau_AuCt2-v.swf	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\VGm32iz-b.swf	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\z9oK2XVdTXxZz_svtRT.mp4	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\AppData\Roaming\_1EuGfemD.png	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Contacts\Administrator.contact	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Contacts\ihnvbh euuncnh.contact	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Contacts\lodkd auftnm.contact	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Contacts\mneuc uhnfghgg.contact	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Contacts\ofhbnh edferrr.contact	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Contacts\uosjfl sidvllie.contact	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\0dvhPOmJlYtro_v.mp4	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\1Ml-7aPJ0jKjQdbzzWXJ.wav	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\3JuA.swf	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\6TvJSWiA-Wbr5.avi	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\9B2i7C_e8RIsPMXL6f6.bmp	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\bjgohQsUApVHV hfX8a1.m4a	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\dL13.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\e3I0XDQBd.mp4	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\gaqTFTuCHS.flv	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\He2M.mkv	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\lbl9s.avi	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\OelMejSL85H.m4a	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\osPAtBxgjZl.wav	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\pue6UNYH0mMp-vcx.gif	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\Q3a_7VjE.swf	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\QxvLVPdGKwwfnEBo\F2-_W1QZInEES1i.png	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\QxvLVPdGKwwfnEBo\MCrWX.flv	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\QxvLVPdGKwwfnEBo\qviMWuq.mp4	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\QxvLVPdGKwwfnEBo\ySt.mp3	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\sIOM.bmp	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\sK4m18olbpY.m4a	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\sz uo4.m4a	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\TRCDXhDihDM.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\UhzcNQ.mp3	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\Viwp\2TWq-1xPVBzCu.wav	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\Viwp\Dhp8.mkv	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\Viwp\diep9Gcl_kvXMgwU3R.png	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\Viwp\lKLYw-il4wRA.ods	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\xckHq1j0cO.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\y16hxOz8ujX7n.flv	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\YLn2_.gif	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\YsAOBn7ufb0kiB2.swf	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\Z3H7Xk7.ppt	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Desktop\ZmgNa.mp3	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\0qSqlpnxJ.pptx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\6KRllW7ID8y.docx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\77OczSqvld5.docx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\77_r-.pptx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\bsmF9q-s18UQwV 2QeC.xlsx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\ch1Aq1nIfB.xlsx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\cshIVOHP5t7axydY7Tk.pdf	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\du k7OsZOj3hLunu\8cBdYZX6OR.pdf	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\du k7OsZOj3hLunu\LRK87zrnofUR2SIEHY.pps	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\du k7OsZOj3hLunu\MfGg.xls	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\du k7OsZOj3hLunu\uN2KS4.pptx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\du k7OsZOj3hLunu\VZ9nA83WbdGHK9Way.ppt	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\du k7OsZOj3hLunu\YWK4KhhV.csv	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\DuEC7MR W 5V.odt	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\ik8r5v-n3rXf E3o.xlsx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\k_-fc6z.rtf	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\5xAyFJs7V 4p7.csv	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\e9IUPBuVZv.odp	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\D13e5u.odp	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\dN8jJtE7.csv	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\JZjq6zgmd3.odt	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\N 4im.pps	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\p i51dUM47znpT.ppt	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\V2AX 2O10jYiJz.pptx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\wCaQi2iDiGH5RkDFepS.doc	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\WOgsUWwOd.odp	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\GdyyKq85q2YwLJ1YB\Ztgx092l1Vp_ G0BfH.xlsx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\mLV3ptcfAK3 R\PnvJm15.ods	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\OfdynDXzGObznG.pptx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\oH9Agy41PpuV JG3b.docx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\OjD7P.docx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\Outlook Files\feasf@efw.com.pst	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\Outlook Files\Outlook Data File - mail.pst	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\pmz0w5LsRNua.pptx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\qbuQVoZG4 sryX-0.docx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\u-PaBAK2.pptx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\8zzC6VSS5o.odt	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\DVq88.pptx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\IPTBfO R8XN6YX-i3w.doc	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\r3mWT9fZu RM4Wo.pps	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\uz5fIOSLh2es4MR TnS\2bdS85U6Tr.ots	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\uz5fIOSLh2es4MR TnS\40sZfGmqdyq FkOlzt.ppt	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\uz5fIOSLh2es4MR TnS\9JvkqA3b.ods	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\uz5fIOSLh2es4MR TnS\ogkC1_KJ1H.odt	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\uz5fIOSLh2es4MR TnS\zNUC10gkDHhN\-UIRpy3K97H9X4-.pdf	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\XhXAK8VlNpfnO9\uz5fIOSLh2es4MR TnS\zNUC10gkDHhN\1290GYErsLm.pps	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\Z0u8ZP7s7.pptx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\Zb5AQJwGNSznRVtqe3U.docx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\zhFQ.xlsx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Documents\zrcfqsFwPCDV1U.xlsx	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Favorites\Links\Suggested Sites.url	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Favorites\Links\Web Slice Gallery.url	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Favorites\Microsoft Websites\IE Add-on site.url	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Favorites\Microsoft Websites\IE site on Microsoft.com.url	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Favorites\Microsoft Websites\Microsoft At Home.url	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Favorites\Microsoft Websites\Microsoft At Work.url	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Favorites\Microsoft Websites\Microsoft Store.url	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Favorites\MSN Websites\MSN Autos.url	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Favorites\MSN Websites\MSN Entertainment.url	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Favorites\MSN Websites\MSN Money.url	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Favorites\MSN Websites\MSN Sports.url	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Favorites\MSN Websites\MSN.url	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Favorites\MSN Websites\MSNBC News.url	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Favorites\Windows Live\Get Windows Live.url	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Favorites\Windows Live\Windows Live Gallery.url	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Favorites\Windows Live\Windows Live Mail.url	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Favorites\Windows Live\Windows Live Spaces.url	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\1QmXUMl1oWdr.m4a	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3 PW-Ui J15ZiazoDJ.mp3	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3PRe6lFPXnoV\dPOt3gFaJ-Z6\2pbVfF b7rTJ78.wav	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3PRe6lFPXnoV\dPOt3gFaJ-Z6\iQrAsVXlz3lznnVOsCOs.wav	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3PRe6lFPXnoV\dPOt3gFaJ-Z6\Q5dZD.wav	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3PRe6lFPXnoV\Hfnq-cR6N2E4U.mp3	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3PRe6lFPXnoV\OwzbZbPLB0o.wav	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3PRe6lFPXnoV\Vos9O.m4a	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\3PRe6lFPXnoV\Yo_w2TuZ.wav	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\ThgP5gx.wav	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\U4D-0SVGPJJ4Dryb\H7ff_GwOhsVGEXsihXt.wav	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\U4D-0SVGPJJ4Dryb\mRjftTtKKqf0xRNw2.m4a	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\U4D-0SVGPJJ4Dryb\Rpr9kZlt_u.m4a	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\U4D-0SVGPJJ4Dryb\YX4mBHiukJu6.m4a	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\yvxKHo\f5OyyZ.wav	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\yvxKHo\f_kp.mp3	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\yvxKHo\gELsA6F7pttjUe.mp3	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\yvxKHo\KUTgNDbqhOgDz.wav	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\h3kDxp5SE_TAKuqr9v\yvxKHo\TR2W.mp3	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\K3ee4zeF9Y7Dz8tV4d\45Nk1i_BoauAP8Q-z.mp3	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\K3ee4zeF9Y7Dz8tV4d\QOfNPVQ G.wav	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\PEM21hcjp\-E09CgTxs9XudMT.wav	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\PEM21hcjp\0w4-fEH.mp3	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\PEM21hcjp\9ekfhikfPvBx8_x-.m4a	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\PEM21hcjp\bkbdPdxuTFgURx7v.m4a	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\PEM21hcjp\qpY9FYnWoKtkjTIOjgP.wav	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\tm39iVkClG.m4a	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Music\Y3YiRdbksEQBqCKoTAO.mp3	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\ntuser.dat.LOG1	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\ntuser.ini	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\016Di.gif	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\-1kkZleyIZ1R\1k2hAvfCtB.png	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\-1kkZleyIZ1R\aHN_mm.gif	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\-1kkZleyIZ1R\illI47uGvN2wZztPH.png	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\-1kkZleyIZ1R\JuEs.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\-egVHIB991RXL.gif	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\6TRx7EFUqWYpm\4MhCMx8mxOZ4R6sUU.bmp	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\6TRx7EFUqWYpm\HuDTaOFF2Rc_f3-.gif	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\6TRx7EFUqWYpm\IpmSIACSNVg.png	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\6TRx7EFUqWYpm\N2f4N0vc_293oxyBm.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\6TRx7EFUqWYpm\NNs9wHpVaYC.bmp	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\6TRx7EFUqWYpm\SQ8lb5W7drgmeYNEF1S.gif	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\6TRx7EFUqWYpm\tkcS0JUG4KsMmhDvh.bmp	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\G2YPsFrieefZqVB.gif	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\GTyheWzufun9Zx fpetH\3XWQLTyq_.png	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\GTyheWzufun9Zx fpetH\G9L4cvJBDoCuf58V.gif	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\GTyheWzufun9Zx fpetH\iQlDSU1tF2smN.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\GTyheWzufun9Zx fpetH\u5T6V5I8xWuu3Nh3mf.png	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\GTyheWzufun9Zx fpetH\WfA NLZgPC3bXWOwixF.gif	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\GTyheWzufun9Zx fpetH\z6H9-.gif	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\-rgMiko5CL5HfCCaj0.png	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\H55uX138oMsgwlKc.png	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\ImEm\BFoix Z1s4jC8CZm-48h.png	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\ImEm\UF-kf.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\ImEm\wW5N4X9XUvTA.gif	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\QpLL969CGE.png	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\T3BHF4GPgRUH u W.gif	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\TO8LjytzKJ.bmp	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\scEr\ydfz.png	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\xYk2ZoNkyQMgjNrk.png	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\y77WbMwmdpln7CPFnu\vh3O.bmp	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\y77WbMwmdpln7CPFnu\y8inPj-Y7tYbW8a.png	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\8a44DSeeapV260wHYlK_\YHytB7K92.jpg	type = file_attributes	1	Fn
Get Info	C:\Users\EEBsYm5\Pictures\mn7M8P.png	type = file_attributes	1	Fn
Move	C:\Users\EEBsYm5\AppData\Roaming\uW1opw43z.mp3.CRAB	source_filename = C:\Users\EEBsYm5\AppData\Roaming\uW1opw43z.mp3	1	Fn
Read	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\cookies.sqlite	size = 1048576, size_out = 524288	1	Fn Data
Read	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\key3.db	size = 1048576, size_out = 16384	1	Fn Data
Read	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\places.sqlite	size = 1048576, size_out = 1048576	10	Fn Data
Read	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\places.sqlite	size = 1048576, size_out = 0	1	Fn
Read	C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\signons.sqlite	size = 1048576, size_out = 327680	1	Fn Data
Write	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\SystemCertificates\\CRAB-DECRYPT.txt	size = 3704	1	Fn Data
Write	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\SystemCertificates\My\\CRAB-DECRYPT.txt	size = 3704	1	Fn Data
Write	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\\CRAB-DECRYPT.txt	size = 3704	1	Fn Data
Write	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\\CRAB-DECRYPT.txt	size = 3704	1	Fn Data
Write	C:\Users\EEBsYm5\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\\CRAB-DECRYPT.txt	size = 3704	1	Fn Data
For performance reasons, the remaining 1661 entries are omitted. The remaining entries can be found in glog.xml.

Registry (28)

Operation	Key	Additional Information	Count	Logfile
Create Key	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	-	2	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	-	2	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters	-	1	Fn
Open Key	HKEY_CURRENT_USER\Control Panel\International	-	1	Fn
Open Key	HKEY_CURRENT_USER\Keyboard Layout\Preload	-	2	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	-	2	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters	value_name = Domain, data = 0	1	Fn
Read Value	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	value_name = ProcessorNameString, data = 73	1	Fn
Read Value	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	value_name = Identifier, data = 120	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters	value_name = Domain, data = 0	1	Fn
Read Value	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	value_name = ProcessorNameString, data = 73	1	Fn
Read Value	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	value_name = Identifier, data = 120	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters	value_name = Domain, data = 0	1	Fn
Read Value	HKEY_CURRENT_USER\Control Panel\International	value_name = LocaleName, data = 101	1	Fn
Read Value	HKEY_CURRENT_USER\Keyboard Layout\Preload	value_name = 1, data = 48	1	Fn
Read Value	HKEY_CURRENT_USER\Keyboard Layout\Preload	value_name = 2, data = 48	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	value_name = productName, data = 87	1	Fn
Read Value	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	value_name = ProcessorNameString, data = 73	1	Fn
Read Value	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	value_name = Identifier, data = 120	1	Fn
Write Value	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	value_name = gjxnevhwtye, data = "C:\Users\EEBsYm5\AppData\Roaming\Microsoft\igkphg.exe", size = 110, type = REG_SZ	1	Fn

Process (2)

Operation	Process	Additional Information	Success	Count	Logfile
Create	nslookup politiaromana.bit ns1.virmach.ru	os_pid = 0x55c, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE		1	Fn
Open	System Idle Process	-		1	Fn

Module (1823)

Operation	Module	Additional Information	Count	Logfile
Load	kernel32.dll	base_address = 0x75790000	2	Fn
Load	KERNEL32.dll	base_address = 0x75790000	2	Fn
Load	msvcr100.dll	base_address = 0x72280000	1	Fn
Load	USER32.dll	base_address = 0x76a80000	1	Fn
Load	GDI32.dll	base_address = 0x76cf0000	1	Fn
Load	ADVAPI32.dll	base_address = 0x76dd0000	1	Fn
Load	SHELL32.dll	base_address = 0x75a20000	1	Fn
Load	CRYPT32.dll	base_address = 0x751f0000	1	Fn
Load	WININET.dll	base_address = 0x76e70000	1	Fn
Load	PSAPI.DLL	base_address = 0x77150000	1	Fn
Get Handle	c:\windows\system32\kernel32.dll	base_address = 0x75790000	4	Fn
Get Handle	c:\windows\system32\ntdll.dll	base_address = 0x77000000	5	Fn
Get Handle	c:\windows\system32\advapi32.dll	base_address = 0x76dd0000	782	Fn
Get Filename	-	process_name = c:\users\eebsym5\appdata\roaming\microsoft\igkphg.exe, file_name_orig = C:\Users\EEBsYm5\AppData\Roaming\Microsoft\igkphg.exe, size = 260	2	Fn
Get Filename	-	process_name = c:\users\eebsym5\appdata\roaming\microsoft\igkphg.exe, file_name_orig = C:\Users\EEBsYm5\AppData\Roaming\Microsoft\igkphg.exe, size = 256	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FlsAlloc, address_out = 0x757e418d	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FlsGetValue, address_out = 0x757e1e16	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FlsSetValue, address_out = 0x757e76e6	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FlsFree, address_out = 0x757e1f61	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GlobalAlloc, address_out = 0x757d9ce1	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = VirtualProtect, address_out = 0x757d2341	3	Fn
Get Address	c:\windows\system32\kernel32.dll	function = LoadLibraryA, address_out = 0x757e395c	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = VirtualAlloc, address_out = 0x757e2fb6	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = VirtualFree, address_out = 0x757e1da4	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetVersionExA, address_out = 0x757e3861	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = TerminateProcess, address_out = 0x757d2331	3	Fn
Get Address	c:\windows\system32\kernel32.dll	function = ExitProcess, address_out = 0x757e214f	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = OpenProcess, address_out = 0x757d59d7	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = Sleep, address_out = 0x757dba46	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = ExitThread, address_out = 0x7702f611	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetLastError, address_out = 0x757dbf00	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CloseHandle, address_out = 0x757dca7c	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = WriteConsoleW, address_out = 0x757d82f1	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetFilePointerEx, address_out = 0x757cf5b2	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetStdHandle, address_out = 0x7581f589	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetCommandLineA, address_out = 0x757e98ff	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetLastError, address_out = 0x757dbb08	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetCurrentThreadId, address_out = 0x757dbb80	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = EncodePointer, address_out = 0x7705a295	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = DecodePointer, address_out = 0x7705cd10	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetModuleHandleExW, address_out = 0x757d3e39	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetProcAddress, address_out = 0x757e33d3	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = MultiByteToWideChar, address_out = 0x757e452b	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = WideCharToMultiByte, address_out = 0x757e450e	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetProcessHeap, address_out = 0x757e1280	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetStdHandle, address_out = 0x757e1e46	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetFileType, address_out = 0x757e75a5	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = DeleteCriticalSection, address_out = 0x77059ac5	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetStartupInfoW, address_out = 0x757e3891	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetModuleFileNameA, address_out = 0x757e33f6	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = WriteFile, address_out = 0x757e1400	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetModuleFileNameW, address_out = 0x757e3c26	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = QueryPerformanceCounter, address_out = 0x757dbb9f	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetCurrentProcessId, address_out = 0x757dcac4	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetSystemTimeAsFileTime, address_out = 0x757e2fde	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetEnvironmentStringsW, address_out = 0x757e1dbc	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FreeEnvironmentStringsW, address_out = 0x757e1dc3	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = IsDebuggerPresent, address_out = 0x757d3ea8	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = IsProcessorFeaturePresent, address_out = 0x757e76b5	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = UnhandledExceptionFilter, address_out = 0x757eed38	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetUnhandledExceptionFilter, address_out = 0x757e3d01	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = InitializeCriticalSectionAndSpinCount, address_out = 0x757e3939	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetCurrentProcess, address_out = 0x757dcdcf	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = TlsAlloc, address_out = 0x757e35a1	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = TlsGetValue, address_out = 0x757dda70	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = TlsSetValue, address_out = 0x757dda88	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = TlsFree, address_out = 0x757e13b8	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetModuleHandleW, address_out = 0x757e374d	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = EnterCriticalSection, address_out = 0x770477a0	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = LeaveCriticalSection, address_out = 0x77047760	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = HeapFree, address_out = 0x757dbbd0	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = IsValidCodePage, address_out = 0x757ec1c0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetACP, address_out = 0x757e39aa	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetOEMCP, address_out = 0x757d3db9	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetCPInfo, address_out = 0x757e1e2e	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = LoadLibraryExW, address_out = 0x757d4775	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = RtlUnwind, address_out = 0x757c7f70	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = OutputDebugStringW, address_out = 0x757c6b91	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = HeapAlloc, address_out = 0x77052dd6	2	Fn
Get Address	c:\windows\system32\kernel32.dll	function = HeapReAlloc, address_out = 0x7706ff51	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetStringTypeW, address_out = 0x757e67c8	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = HeapSize, address_out = 0x77059bec	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = LCMapStringW, address_out = 0x757e13d0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FlushFileBuffers, address_out = 0x757c7f81	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetConsoleCP, address_out = 0x757e2c8a	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetConsoleMode, address_out = 0x757e2412	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateFileW, address_out = 0x757dcc56	2	Fn
Get Address	c:\windows\system32\msvcr100.dll	function = atexit, address_out = 0x7229c544	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = InitializeCriticalSectionEx, address_out = 0x757e3879	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateEventExW, address_out = 0x757924d8	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateSemaphoreExW, address_out = 0x757c2111	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetThreadStackGuarantee, address_out = 0x757d2510	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateThreadpoolTimer, address_out = 0x757cb009	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetThreadpoolTimer, address_out = 0x770289be	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = WaitForThreadpoolTimerCallbacks, address_out = 0x7701c02a	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CloseThreadpoolTimer, address_out = 0x7701c0d2	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateThreadpoolWait, address_out = 0x757c3f78	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetThreadpoolWait, address_out = 0x77028bfb	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CloseThreadpoolWait, address_out = 0x7701b567	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FlushProcessWriteBuffers, address_out = 0x77045998	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FreeLibraryWhenCallbackReturns, address_out = 0x77012251	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetCurrentProcessorNumber, address_out = 0x770128f6	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetLogicalProcessorInformation, address_out = 0x757c2004	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateSymbolicLinkW, address_out = 0x75819aa9	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetDefaultDllDirectories, address_out = 0x0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = EnumSystemLocalesEx, address_out = 0x7581f3cf	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CompareStringEx, address_out = 0x757eebc6	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetDateFormatEx, address_out = 0x7582f29f	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetLocaleInfoEx, address_out = 0x757c53a5	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetTimeFormatEx, address_out = 0x7582f21a	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetUserDefaultLocaleName, address_out = 0x7581f70b	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = IsValidLocaleName, address_out = 0x7581f71b	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = LCMapStringEx, address_out = 0x7581f72b	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetCurrentPackageId, address_out = 0x0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetTickCount64, address_out = 0x757ceb4e	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetFileInformationByHandleExW, address_out = 0x0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetFileInformationByHandleW, address_out = 0x0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = ReadFile, address_out = 0x757d96fb	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetFilePointer, address_out = 0x757ddb36	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetFileAttributesW, address_out = 0x757e64ff	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = MoveFileW, address_out = 0x757f548a	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrcpyW, address_out = 0x757c8bfa	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetFileAttributesW, address_out = 0x757cad1b	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateMutexW, address_out = 0x757d2aee	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetDriveTypeW, address_out = 0x757e3be6	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = VerSetConditionMask, address_out = 0x77023030	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = WaitForSingleObject, address_out = 0x757dba90	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetTickCount, address_out = 0x757dba60	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = InitializeCriticalSection, address_out = 0x7705a149	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetSystemDirectoryW, address_out = 0x757e40fb	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = TerminateThread, address_out = 0x757e22a7	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = VerifyVersionInfoW, address_out = 0x757d0e91	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = WaitForMultipleObjects, address_out = 0x757dbce4	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = ExpandEnvironmentStringsW, address_out = 0x757d4680	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrlenW, address_out = 0x757dd9e8	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetHandleInformation, address_out = 0x757c8856	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrcatA, address_out = 0x757da19f	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreatePipe, address_out = 0x757f35b7	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrcmpiA, address_out = 0x757d2249	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = Process32NextW, address_out = 0x757cfaca	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateToolhelp32Snapshot, address_out = 0x757cf731	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FindFirstFileW, address_out = 0x757e53b2	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrcmpW, address_out = 0x757e67b0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FindClose, address_out = 0x757e0e62	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = FindNextFileW, address_out = 0x757d963a	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetNativeSystemInfo, address_out = 0x757cbe77	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetComputerNameW, address_out = 0x757d03ff	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetDiskFreeSpaceW, address_out = 0x757c3530	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetWindowsDirectoryW, address_out = 0x757d04b6	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetVolumeInformationW, address_out = 0x757e7598	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrcmpiW, address_out = 0x757da8eb	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateThread, address_out = 0x757e375d	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrcatW, address_out = 0x757f4be7	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateFileMappingW, address_out = 0x757d0a7f	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = UnmapViewOfFile, address_out = 0x757ddb13	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = MapViewOfFile, address_out = 0x757d899b	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetFileSize, address_out = 0x757d0273	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetEnvironmentVariableW, address_out = 0x757e65c4	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrcpyA, address_out = 0x757d9793	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetModuleHandleA, address_out = 0x757dcf41	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = Process32FirstW, address_out = 0x757cfa35	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = GetTempPathW, address_out = 0x757c8b33	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = lstrlenA, address_out = 0x757da611	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CreateProcessW, address_out = 0x7579204d	1	Fn
Get Address	c:\windows\system32\user32.dll	function = BeginPaint, address_out = 0x76a95d14	1	Fn
Get Address	c:\windows\system32\user32.dll	function = wsprintfW, address_out = 0x76aa426d	1	Fn
Get Address	c:\windows\system32\user32.dll	function = TranslateMessage, address_out = 0x76a964c7	1	Fn
Get Address	c:\windows\system32\user32.dll	function = LoadCursorW, address_out = 0x76a8ed90	1	Fn
Get Address	c:\windows\system32\user32.dll	function = LoadIconW, address_out = 0x76a8f142	1	Fn
Get Address	c:\windows\system32\user32.dll	function = MessageBoxA, address_out = 0x76adea11	1	Fn
Get Address	c:\windows\system32\user32.dll	function = GetMessageW, address_out = 0x76a9cde8	1	Fn
Get Address	c:\windows\system32\user32.dll	function = EndPaint, address_out = 0x76a95d42	1	Fn
Get Address	c:\windows\system32\user32.dll	function = DestroyWindow, address_out = 0x76a8b2f4	1	Fn
Get Address	c:\windows\system32\user32.dll	function = RegisterClassExW, address_out = 0x76a90162	1	Fn
Get Address	c:\windows\system32\user32.dll	function = ShowWindow, address_out = 0x76a8f2a9	1	Fn
Get Address	c:\windows\system32\user32.dll	function = CreateWindowExW, address_out = 0x76a8ec7c	1	Fn
Get Address	c:\windows\system32\user32.dll	function = SendMessageW, address_out = 0x76a95539	1	Fn
Get Address	c:\windows\system32\user32.dll	function = DispatchMessageW, address_out = 0x76a9cc61	1	Fn
Get Address	c:\windows\system32\user32.dll	function = DefWindowProcW, address_out = 0x76a9507d	1	Fn
Get Address	c:\windows\system32\user32.dll	function = UpdateWindow, address_out = 0x76a8ffa8	1	Fn
Get Address	c:\windows\system32\user32.dll	function = wsprintfA, address_out = 0x76a93f47	1	Fn
Get Address	c:\windows\system32\user32.dll	function = GetForegroundWindow, address_out = 0x76a9335d	1	Fn
Get Address	c:\windows\system32\user32.dll	function = SetWindowLongW, address_out = 0x76a94449	1	Fn
Get Address	c:\windows\system32\gdi32.dll	function = TextOutW, address_out = 0x76cffde4	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = FreeSid, address_out = 0x76de412e	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = RegSetValueExW, address_out = 0x76de14d6	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = RegCreateKeyExW, address_out = 0x76de40fe	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = RegCloseKey, address_out = 0x76de469d	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptExportKey, address_out = 0x76dd91ea	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptAcquireContextW, address_out = 0x76dddf14	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptGetKeyParam, address_out = 0x76df77cb	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptReleaseContext, address_out = 0x76dde124	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptImportKey, address_out = 0x76ddc532	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptEncrypt, address_out = 0x76df779b	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptGenKey, address_out = 0x76dd8ee9	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptDestroyKey, address_out = 0x76ddc51a	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = GetUserNameW, address_out = 0x76de157a	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = RegQueryValueExW, address_out = 0x76de46ad	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = RegOpenKeyExW, address_out = 0x76de468d	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = AllocateAndInitializeSid, address_out = 0x76de40e6	1	Fn
Get Address	c:\windows\system32\shell32.dll	function = ShellExecuteW, address_out = 0x75a33c71	1	Fn
Get Address	c:\windows\system32\shell32.dll	function = SHGetSpecialFolderPathW, address_out = 0x75a40468	1	Fn
Get Address	c:\windows\system32\shell32.dll	function = ShellExecuteExW, address_out = 0x75a41e46	1	Fn
Get Address	c:\windows\system32\crypt32.dll	function = CryptStringToBinaryA, address_out = 0x75225d77	1	Fn
Get Address	c:\windows\system32\crypt32.dll	function = CryptBinaryToStringA, address_out = 0x7522a8c5	1	Fn
Get Address	c:\windows\system32\wininet.dll	function = InternetCloseHandle, address_out = 0x76e8ab49	1	Fn
Get Address	c:\windows\system32\wininet.dll	function = HttpAddRequestHeadersW, address_out = 0x76e94fae	1	Fn
Get Address	c:\windows\system32\wininet.dll	function = HttpSendRequestW, address_out = 0x76e9ba12	1	Fn
Get Address	c:\windows\system32\wininet.dll	function = InternetConnectW, address_out = 0x76e9492c	1	Fn
Get Address	c:\windows\system32\wininet.dll	function = HttpOpenRequestW, address_out = 0x76e94a42	1	Fn
Get Address	c:\windows\system32\wininet.dll	function = InternetOpenW, address_out = 0x76e99197	1	Fn
Get Address	c:\windows\system32\wininet.dll	function = InternetReadFile, address_out = 0x76e8b406	1	Fn
Get Address	c:\windows\system32\psapi.dll	function = EnumDeviceDrivers, address_out = 0x771514cc	1	Fn
Get Address	c:\windows\system32\psapi.dll	function = GetDeviceDriverBaseNameW, address_out = 0x77151514	1	Fn
Get Address	c:\windows\system32\ntdll.dll	function = RtlComputeCrc32, address_out = 0x7700dd8a	5	Fn
Get Address	c:\windows\system32\advapi32.dll	function = CryptGenRandom, address_out = 0x76dddfc8	782	Fn

Driver (263)

Operation	Driver	Additional Information	Count	Logfile
Enumerate	-	load_addresses = 1244944	3	Fn
Enumerate	-	load_addresses = 2949120	7	Fn
Enumerate	-	load_addresses = 1244832	1	Fn
Enumerate	-	load_addresses = 1244844	3	Fn
Get Name	-	load_address = 2187649024	2	Fn
Get Name	-	load_address = 2187423744	2	Fn
Get Name	-	load_address = 2159857664	2	Fn
Get Name	-	load_address = 2283831296	2	Fn
Get Name	-	load_address = 2284376064	2	Fn
Get Name	-	load_address = 2284445696	2	Fn
Get Name	-	load_address = 2284478464	2	Fn
Get Name	-	load_address = 2284748800	2	Fn
Get Name	-	load_address = 2286096384	2	Fn
Get Name	-	load_address = 2286559232	2	Fn
Get Name	-	load_address = 2286616576	2	Fn
Get Name	-	load_address = 2286911488	2	Fn
Get Name	-	load_address = 2286948352	2	Fn
Get Name	-	load_address = 2286981120	2	Fn
Get Name	-	load_address = 2287153152	2	Fn
Get Name	-	load_address = 2287198208	2	Fn
Get Name	-	load_address = 2287267840	2	Fn
Get Name	-	load_address = 2287333376	2	Fn
Get Name	-	load_address = 2287640576	2	Fn
Get Name	-	load_address = 2287730688	2	Fn
Get Name	-	load_address = 2287902720	2	Fn
Get Name	-	load_address = 2285895680	2	Fn
Get Name	-	load_address = 2285932544	2	Fn
Get Name	-	load_address = 2285449216	2	Fn
Get Name	-	load_address = 2285490176	2	Fn
Get Name	-	load_address = 2285547520	2	Fn
Get Name	-	load_address = 2285584384	2	Fn
Get Name	-	load_address = 2285797376	2	Fn
Get Name	-	load_address = 2288103424	2	Fn
Get Name	-	load_address = 2289344512	2	Fn
Get Name	-	load_address = 2289520640	2	Fn
Get Name	-	load_address = 2289598464	2	Fn
Get Name	-	load_address = 2289979392	2	Fn
Get Name	-	load_address = 2290036736	2	Fn
Get Name	-	load_address = 2290274304	2	Fn
Get Name	-	load_address = 2291023872	2	Fn
Get Name	-	load_address = 2291277824	2	Fn
Get Name	-	load_address = 2292322304	2	Fn
Get Name	-	load_address = 2293673984	2	Fn
Get Name	-	load_address = 2293874688	2	Fn
Get Name	-	load_address = 2293911552	2	Fn
Get Name	-	load_address = 2294169600	2	Fn
Get Name	-	load_address = 2291429376	2	Fn
Get Name	-	load_address = 2294202368	2	Fn
Get Name	-	load_address = 2292187136	2	Fn
Get Name	-	load_address = 2291613696	2	Fn
Get Name	-	load_address = 2292219904	2	Fn
Get Name	-	load_address = 2291818496	2	Fn
Get Name	-	load_address = 2292289536	2	Fn
Get Name	-	load_address = 2290216960	2	Fn
Get Name	-	load_address = 2290089984	2	Fn
Get Name	-	load_address = 2371891200	2	Fn
Get Name	-	load_address = 2372026368	2	Fn
Get Name	-	load_address = 2372079616	2	Fn
Get Name	-	load_address = 2372112384	2	Fn
Get Name	-	load_address = 2372145152	2	Fn
Get Name	-	load_address = 2372177920	2	Fn
Get Name	-	load_address = 2372222976	2	Fn
Get Name	-	load_address = 2372280320	2	Fn
Get Name	-	load_address = 2372374528	2	Fn
Get Name	-	load_address = 2372423680	2	Fn
Get Name	-	load_address = 2372792320	2	Fn
Get Name	-	load_address = 2372997120	2	Fn
Get Name	-	load_address = 2373025792	2	Fn
Get Name	-	load_address = 2373152768	2	Fn
Get Name	-	load_address = 2373210112	2	Fn
Get Name	-	load_address = 2373287936	2	Fn
Get Name	-	load_address = 2373357568	2	Fn
Get Name	-	load_address = 2373623808	2	Fn
Get Name	-	load_address = 2373664768	2	Fn
Get Name	-	load_address = 2373705728	2	Fn
Get Name	-	load_address = 2367799296	2	Fn
Get Name	-	load_address = 2368208896	2	Fn
Get Name	-	load_address = 2368307200	2	Fn
Get Name	-	load_address = 2368364544	2	Fn
Get Name	-	load_address = 2368499712	2	Fn
Get Name	-	load_address = 2368552960	2	Fn
Get Name	-	load_address = 2368679936	2	Fn
Get Name	-	load_address = 2368741376	2	Fn
Get Name	-	load_address = 2369048576	2	Fn
Get Name	-	load_address = 2369167360	2	Fn
Get Name	-	load_address = 2369241088	2	Fn
Get Name	-	load_address = 2369294336	2	Fn
Get Name	-	load_address = 2369368064	2	Fn
Get Name	-	load_address = 2369466368	2	Fn
Get Name	-	load_address = 2369511424	2	Fn
Get Name	-	load_address = 2369650688	2	Fn
Get Name	-	load_address = 2367684608	2	Fn
Get Name	-	load_address = 2373754880	2	Fn
Get Name	-	load_address = 2373849088	2	Fn
Get Name	-	load_address = 2373890048	2	Fn
Get Name	-	load_address = 2290139136	2	Fn
Get Name	-	load_address = 2367778816	2	Fn
Get Name	-	load_address = 2382548992	2	Fn
Get Name	-	load_address = 2382761984	2	Fn
Get Name	-	load_address = 2382819328	2	Fn
Get Name	-	load_address = 2383097856	2	Fn
Get Name	-	load_address = 2383167488	2	Fn
Get Name	-	load_address = 2383495168	2	Fn
Get Name	-	load_address = 2383687680	2	Fn
Get Name	-	load_address = 2383790080	2	Fn
Get Name	-	load_address = 2383843328	2	Fn
Get Name	-	load_address = 2383888384	2	Fn
Get Name	-	load_address = 2383929344	2	Fn
Get Name	-	load_address = 2383998976	2	Fn
Get Name	-	load_address = 2384044032	2	Fn
Get Name	-	load_address = 2384121856	2	Fn
Get Name	-	load_address = 2384150528	2	Fn
Get Name	-	load_address = 2384158720	2	Fn
Get Name	-	load_address = 2415984640	2	Fn
Get Name	-	load_address = 2384207872	2	Fn
Get Name	-	load_address = 2384248832	2	Fn
Get Name	-	load_address = 2418409472	2	Fn
Get Name	-	load_address = 2384293888	2	Fn
Get Name	-	load_address = 2418606080	2	Fn
Get Name	-	load_address = 2419130368	1	Fn
Get Name	-	load_address = 2384338944	1	Fn
Get Name	-	load_address = 2382364672	1	Fn
Get Name	-	load_address = 2382430208	1	Fn
Get Name	-	load_address = 2437021696	1	Fn
Get Name	-	load_address = 2437566464	1	Fn
Get Name	-	load_address = 2437668864	1	Fn
Get Name	-	load_address = 2437742592	1	Fn
Get Name	-	load_address = 2437885952	1	Fn
Get Name	-	load_address = 2438127616	1	Fn
Get Name	-	load_address = 2438336512	1	Fn
Get Name	-	load_address = 2436890624	1	Fn
Get Name	-	load_address = 2291970048	1	Fn
Get Name	-	load_address = 2436931584	1	Fn
Get Name	-	load_address = 2512625664	1	Fn
Get Name	-	load_address = 2512949248	1	Fn
Get Name	-	load_address = 1996488704	1	Fn
Get Name	-	load_address = 1206976512	1	Fn
Get Name	-	load_address = 1998848000	1	Fn

System (13)

Operation	Additional Information	Count	Logfile
Get Computer Name	result_out = CRH2YWU7	1	Fn
Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
Sleep	duration = -1 (infinite)	1	Fn
Get Time	type = System Time, time = 1627-01-28 19:38:23 (UTC)	1	Fn
Get Time	type = Ticks, time = 33509	1	Fn
Get Time	type = System Time, time = 1627-01-28 19:38:24 (UTC)	1	Fn
Get Time	type = Ticks, time = 35708	1	Fn
Get Time	type = Ticks, time = 43290	1	Fn
Get Info	type = Operating System	1	Fn
Get Info	type = Windows Directory, result_out = C:\Windows	3	Fn
Get Info	type = Hardware Information	1	Fn

Mutex (1)

Operation	Additional Information	Success	Count	Logfile
Create	mutex_name = Global\pc_group=WORKGROUP&ransom_id=acc4531c90c08a66		1	Fn

Environment (3)

Operation	Additional Information	Success	Count	Logfile
Get Environment String	-		2	Fn Data
Get Environment String	name = AppData, result_out = C:\Users\EEBsYm5\AppData\Roaming		1	Fn

Network Behavior

HTTP Sessions (2)

Information	Value
Total Data Sent	564 bytes
Total Data Received	565 bytes
Contacted Host Count	2
Contacted Hosts	ipv4bot.whatismyipaddress.com, 41.74.170.134

HTTP Session #1

Information	Value
User Agent	Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
Server Name	ipv4bot.whatismyipaddress.com
Server Port	80
Data Sent	295
Data Received	13

Operation	Additional Information	Count	Logfile
Open Session	user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36, access_type = INTERNET_OPEN_TYPE_PRECONFIG	1	Fn
Open Connection	protocol = HTTP, server_name = ipv4bot.whatismyipaddress.com, server_port = 80	1	Fn
Open HTTP Request	http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD	1	Fn
Add HTTP Request Headers	headers = Host: malwarehunterteam.bit	1	Fn
Send HTTP Request	headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = ipv4bot.whatismyipaddress.com/	1	Fn
Read Response	size = 10238, size_out = 13	1	Fn Data
Read Response	size = 10238, size_out = 0	1	Fn
Close Session	-	4	Fn

HTTP Session #2

Information	Value
User Agent	Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
Server Name	41.74.170.134
Server Port	80
Data Sent	269
Data Received	552

Operation	Additional Information	Count	Logfile
Open Session	user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36, access_type = INTERNET_OPEN_TYPE_PRECONFIG	1	Fn
Open Connection	protocol = HTTP, server_name = 41.74.170.134, server_port = 80	1	Fn
Open HTTP Request	http_verb = POST, http_version = HTTP/1.1, target_resource = ssauf, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD	1	Fn
Add HTTP Request Headers	headers = Host: malwarehunterteam.bit	1	Fn
Send HTTP Request	headers = Content-Type: application/x-www-form-urlencoded, url = 41.74.170.134/ssauf	1	Fn Data
Read Response	size = 204798, size_out = 552	1	Fn Data
Read Response	size = 204798, size_out = 0	1	Fn
Close Session	-	4	Fn

Process #5: nslookup.exe

Information	Value
ID	#5
File Name	c:\windows\system32\nslookup.exe
Command Line	nslookup politiaromana.bit ns1.virmach.ru
Initial Working Directory	C:\Windows\system32\
Monitor	Start Time: 00:02:30, Reason: Child Process
Unmonitor	End Time: 00:03:14, Reason: Terminated by Timeout
Monitor Duration	00:00:44

OS Process Information

Information	Value
PID	0x55c
Parent PID	0x338 (c:\users\eebsym5\appdata\roaming\microsoft\igkphg.exe)
Is Created or Modified Executable
Integrity Level	Medium
Username	CRH2YWU7\EEBsYm5
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 5B4 0x 6B0

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	Readable, Writable	-
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	-
pagefile_0x0000000000020000	0x00020000	0x0002ffff	Pagefile Backed Memory	Readable, Writable	-
pagefile_0x0000000000030000	0x00030000	0x00033fff	Pagefile Backed Memory	Readable	-
pagefile_0x0000000000040000	0x00040000	0x00040fff	Pagefile Backed Memory	Readable	-
locale.nls	0x00050000	0x000b6fff	Memory Mapped File	Readable	-
pagefile_0x00000000000c0000	0x000c0000	0x000c6fff	Pagefile Backed Memory	Readable	-
pagefile_0x00000000000d0000	0x000d0000	0x000d1fff	Pagefile Backed Memory	Readable, Writable	-
nslookup.exe.mui	0x000e0000	0x000e4fff	Memory Mapped File	Readable, Writable	-
private_0x00000000000f0000	0x000f0000	0x000f0fff	Private Memory	Readable, Writable	-
private_0x0000000000100000	0x00100000	0x00100fff	Private Memory	Readable, Writable	-
private_0x0000000000130000	0x00130000	0x0016ffff	Private Memory	Readable, Writable	-
pagefile_0x0000000000170000	0x00170000	0x00237fff	Pagefile Backed Memory	Readable	-
private_0x00000000002b0000	0x002b0000	0x003affff	Private Memory	Readable, Writable	-
private_0x0000000000410000	0x00410000	0x0044ffff	Private Memory	Readable, Writable	-
nslookup.exe	0x004b0000	0x004cdfff	Memory Mapped File	Readable, Writable, Executable	-
pagefile_0x00000000004d0000	0x004d0000	0x005d0fff	Pagefile Backed Memory	Readable	-
private_0x0000000000610000	0x00610000	0x0061ffff	Private Memory	Readable, Writable	-
pagefile_0x0000000000620000	0x00620000	0x0121ffff	Pagefile Backed Memory	Readable	-
sortdefault.nls	0x01220000	0x014eefff	Memory Mapped File	Readable	-
private_0x00000000014f0000	0x014f0000	0x0163ffff	Private Memory	Readable, Writable	-
private_0x00000000014f0000	0x014f0000	0x0159ffff	Private Memory	Readable, Writable	-
private_0x0000000001630000	0x01630000	0x0163ffff	Private Memory	Readable, Writable	-
private_0x0000000001690000	0x01690000	0x016cffff	Private Memory	Readable, Writable	-
private_0x00000000016d0000	0x016d0000	0x0188ffff	Private Memory	Readable, Writable	-
private_0x00000000016d0000	0x016d0000	0x017cffff	Private Memory	Readable, Writable	-
private_0x0000000001850000	0x01850000	0x0188ffff	Private Memory	Readable, Writable	-
winrnr.dll	0x70c90000	0x70c97fff	Memory Mapped File	Readable, Writable, Executable	-
pnrpnsp.dll	0x70ca0000	0x70cb1fff	Memory Mapped File	Readable, Writable, Executable	-
napinsp.dll	0x70cc0000	0x70ccffff	Memory Mapped File	Readable, Writable, Executable	-
rasadhlp.dll	0x70d00000	0x70d05fff	Memory Mapped File	Readable, Writable, Executable	-
fwpuclnt.dll	0x735a0000	0x735d7fff	Memory Mapped File	Readable, Writable, Executable	-
wsock32.dll	0x73600000	0x73606fff	Memory Mapped File	Readable, Writable, Executable	-
winnsi.dll	0x736d0000	0x736d6fff	Memory Mapped File	Readable, Writable, Executable	-
iphlpapi.dll	0x737e0000	0x737fbfff	Memory Mapped File	Readable, Writable, Executable	-
nlaapi.dll	0x74390000	0x7439ffff	Memory Mapped File	Readable, Writable, Executable	-
wshtcpip.dll	0x74730000	0x74734fff	Memory Mapped File	Readable, Writable, Executable	-
dnsapi.dll	0x74aa0000	0x74ae3fff	Memory Mapped File	Readable, Writable, Executable	-
wship6.dll	0x74bd0000	0x74bd5fff	Memory Mapped File	Readable, Writable, Executable	-
mswsock.dll	0x74be0000	0x74c1bfff	Memory Mapped File	Readable, Writable, Executable	-
kernelbase.dll	0x75340000	0x75389fff	Memory Mapped File	Readable, Writable, Executable	-
lpk.dll	0x75650000	0x75659fff	Memory Mapped File	Readable, Writable, Executable	-
usp10.dll	0x75660000	0x756fcfff	Memory Mapped File	Readable, Writable, Executable	-
kernel32.dll	0x75790000	0x75863fff	Memory Mapped File	Readable, Writable, Executable	-
msvcrt.dll	0x75870000	0x7591bfff	Memory Mapped File	Readable, Writable, Executable	-
sechost.dll	0x75a00000	0x75a18fff	Memory Mapped File	Readable, Writable, Executable	-
msctf.dll	0x767b0000	0x7687bfff	Memory Mapped File	Readable, Writable, Executable	-
ws2_32.dll	0x76a40000	0x76a74fff	Memory Mapped File	Readable, Writable, Executable	-
user32.dll	0x76a80000	0x76b48fff	Memory Mapped File	Readable, Writable, Executable	-
gdi32.dll	0x76cf0000	0x76d3dfff	Memory Mapped File	Readable, Writable, Executable	-
advapi32.dll	0x76dd0000	0x76e6ffff	Memory Mapped File	Readable, Writable, Executable	-
ntdll.dll	0x77000000	0x7713bfff	Memory Mapped File	Readable, Writable, Executable	-
nsi.dll	0x77140000	0x77145fff	Memory Mapped File	Readable, Writable, Executable	-
imm32.dll	0x77160000	0x7717efff	Memory Mapped File	Readable, Writable, Executable	-
rpcrt4.dll	0x77180000	0x77220fff	Memory Mapped File	Readable, Writable, Executable	-
apisetschema.dll	0x77240000	0x77240fff	Memory Mapped File	Readable, Writable, Executable	-
pagefile_0x000000007f6f0000	0x7f6f0000	0x7f7effff	Pagefile Backed Memory	Readable	-
pagefile_0x000000007ffb0000	0x7ffb0000	0x7ffd2fff	Pagefile Backed Memory	Readable	-
private_0x000000007ffdd000	0x7ffdd000	0x7ffddfff	Private Memory	Readable, Writable	-
private_0x000000007ffde000	0x7ffde000	0x7ffdefff	Private Memory	Readable, Writable	-
private_0x000000007ffdf000	0x7ffdf000	0x7ffdffff	Private Memory	Readable, Writable	-

Host Behavior

Registry (7)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DNSClient	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters	value_name = DNSLookupOrder	1	Fn
Read Value	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters	value_name = Domain	1	Fn
Read Value	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters	value_name = DhcpDomain	1	Fn
Read Value	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters	value_name = SearchList	1	Fn
Read Value	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters	value_name = DhcpSearchList	1	Fn

Module (1)

Operation	Module	Additional Information	Success	Count	Logfile
Get Handle	c:\windows\system32\nslookup.exe	base_address = 0x4b0000		1	Fn

System (2)

Operation	Additional Information	Success	Count	Logfile
Get Time	type = System Time, time = 1627-01-28 19:38:26 (UTC)		1	Fn
Get Time	type = Ticks, time = 36800		1	Fn

Network Behavior

DNS (2)

Operation	Additional Information	Success	Count	Logfile
Get Hostname	name_out = cRh2YWu7		1	Fn
Resolve Name	host = ns1.virmach.ru, address_out = 189.210.188.78, 89.203.10.56, 94.249.60.127		1	Fn

UDP Sessions (3)

Information	Value
Total Data Sent	115 bytes
Total Data Received	791 bytes
Contacted Host Count	1
Contacted Hosts	189.210.188.78:53

UDP Session #1

Information	Value
Handle	0x128
Address Family	AF_INET
Type	SOCK_DGRAM
Protocol	IPPROTO_IP
Remote Address	189.210.188.78
Remote Port	53
Local Address	-
Local Port	-
Data Sent	45 bytes
Data Received	0 bytes

Operation	Additional Information	Count	Logfile
Create	protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM	1	Fn
Connect	remote_address = 189.210.188.78, remote_port = 53	1	Fn
Send	flags = NO_FLAG_SET, size = 45, size_out = 45	1	Fn Data
Close	type = SOCK_DGRAM	1	Fn

UDP Session #2

Information	Value
Handle	0x128
Address Family	AF_INET
Type	SOCK_DGRAM
Protocol	IPPROTO_IP
Remote Address	189.210.188.78
Remote Port	53
Local Address	-
Local Port	-
Data Sent	35 bytes
Data Received	195 bytes

Operation	Additional Information	Count	Logfile
Create	protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM	1	Fn
Connect	remote_address = 189.210.188.78, remote_port = 53	1	Fn
Send	flags = NO_FLAG_SET, size = 35, size_out = 35	1	Fn Data
Receive	flags = NO_FLAG_SET, size = 65536, size_out = 195	1	Fn Data
Close	type = SOCK_DGRAM	1	Fn

UDP Session #3

Information	Value
Handle	0x128
Address Family	AF_INET
Type	SOCK_DGRAM
Protocol	IPPROTO_IP
Remote Address	189.210.188.78
Remote Port	53
Local Address	-
Local Port	-
Data Sent	35 bytes
Data Received	596 bytes

Operation	Additional Information	Count	Logfile
Create	protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM	1	Fn
Connect	remote_address = 189.210.188.78, remote_port = 53	1	Fn
Send	flags = NO_FLAG_SET, size = 35, size_out = 35	1	Fn Data
Receive	flags = NO_FLAG_SET, size = 65536, size_out = 596	1	Fn Data
Close	type = SOCK_DGRAM	1	Fn

Notifications (2/2)

Monitored Processes

Behavior Information - Grouped by Category

Before

After