94db3977...09c6

Virtual Machine Information

Name	win7_64_sp1
Description	-
Architecture	x86 64-bit
Operating System	Windows 7
Kernel Version	6.1.7601.17514 (3844dbb9-2017-4967-be7a-a4a2c20430fa)
Network Scheme Name	Local Gateway
Network Config Name	Local Gateway

Analyzer Information

Analyzer Version	3.0.2
Dynamic Engine Version	3.0.2 / 2019-07-09 16:03 (UTC+2)
Static Engine Version	1.1.1 / 2019-07-09 16:05 (UTC+2)
Local AV Version	AVCORE v2.1 Linux/x86_64 11.0.1.18 (Aug 9, 2017)
Local AV Database Update Release Date	2019-07-17 05:34 (UTC+2)
VTI Ruleset Version	3.3
YARA Built-in Ruleset Version	1.2
Analysis Report Layout Version	4

System Information

Computer Name	XDUWTFONO
User Domain	XDUWTFONO
User Name	5p5NrGJn0jS HALPmcxz
User Profile	C:\Users\5p5NrGJn0jS HALPmcxz
Temp Directory	C:\Users\5P5NRG~1\AppData\Local\Temp
System Root	C:\Windows
Sample Directory	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop

Software Information

Adobe Acrobat Reader Version	10.0.0
Internet Explorer Version	8.0.7601.17514
Chrome Version	58.0.3029.110
Firefox Version	25.0
Flash Version	11.2.202.233
Java Version	7.0.450.18
.NET Version	4.6.00081
Powershell Version	2.0
Microsoft Office	2010
Microsoft Office Version	14.0.4762.1000
Microsoft Project Version	14.0.6023.1000
Microsoft Visio Version	14.0.6022.1000

Randomly Created Artifacts

This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.

Processes (18)

Filename	PID	GUI
C:\Program Files (x86)\Common Files\cove qualifying maker.exe	#1444
C:\Program Files (x86)\Common Files\event gilbert.exe	#1580
C:\Program Files (x86)\Internet Explorer\inner_pn_streams.exe	#196
C:\Program Files (x86)\Java\confprinciplesb.exe	#1828
C:\Program Files (x86)\Microsoft Analysis Services\todd.exe	#1972
C:\Program Files (x86)\Mozilla Firefox\rebates-registered.exe	#1672
C:\Program Files (x86)\Reference Assemblies\kidneycontribute.exe	#2044
C:\Program Files (x86)\Windows Media Player\anacustomer.exe	#1476
C:\Program Files (x86)\Windows Photo Viewer\platformlingerierussia.exe	#1928
C:\Program Files (x86)\Windows Photo Viewer\transformation.exe	#528
C:\Program Files\Common Files\somerset lets incentive.exe	#284
C:\Program Files\Microsoft Analysis Services\scripting_resulted_ky.exe	#800
C:\Program Files\Microsoft Office\desktopfa.exe	#784
C:\Program Files\Microsoft Office\garcia.exe	#1920
C:\Program Files\Reference Assemblies\humidityenlargement.exe	#860
C:\Program Files\Windows Defender\brick cm voters.exe	#1784
C:\Program Files\Windows Photo Viewer\usageswim.exe	#1968
C:\Program Files\Windows Sidebar\requires-push.exe	#576

Files (296)

Filename
C:\Users\5P5NRG~1\AppData\Local\Temp\-9BS3S3btqNI3tauv3k.mp4
C:\Users\5P5NRG~1\AppData\Local\Temp\-B3AAsu2bO.mp4
C:\Users\5P5NRG~1\AppData\Local\Temp\0gs2fm1ITbPnh.wav
C:\Users\5P5NRG~1\AppData\Local\Temp\1r4Ger.bmp
C:\Users\5P5NRG~1\AppData\Local\Temp\3Yj8IZPJzhQ 5x.png
C:\Users\5P5NRG~1\AppData\Local\Temp\3mhimO.gif
C:\Users\5P5NRG~1\AppData\Local\Temp\4wJ6D6vUx7X8cJuJqWE9.bmp
C:\Users\5P5NRG~1\AppData\Local\Temp\8hg3wu-PFwSvvIZWQt.wav
C:\Users\5P5NRG~1\AppData\Local\Temp\8jYT-dR7 6BPLebcn.csv
C:\Users\5P5NRG~1\AppData\Local\Temp\A gEmFeTIEz5Kngk6.png
C:\Users\5P5NRG~1\AppData\Local\Temp\BL-lkOiSFzXs36rjxPWf.gif
C:\Users\5P5NRG~1\AppData\Local\Temp\BoHrcaYfCDtcIj.rtf
C:\Users\5P5NRG~1\AppData\Local\Temp\BxUMUs-6ovG 0jr82p.flv
C:\Users\5P5NRG~1\AppData\Local\Temp\C3JDaMlnZLQBXG6rpNM.m4a
C:\Users\5P5NRG~1\AppData\Local\Temp\ELgBiRzL34.mkv
C:\Users\5P5NRG~1\AppData\Local\Temp\FB8iKQzidTLjpTqbApSr.swf
C:\Users\5P5NRG~1\AppData\Local\Temp\IH qQNwLuL-3V5DpBR.pdf
C:\Users\5P5NRG~1\AppData\Local\Temp\KSmn7BtYAW.avi
C:\Users\5P5NRG~1\AppData\Local\Temp\KvfN6.doc
C:\Users\5P5NRG~1\AppData\Local\Temp\KwJMjGtPsc9tc_UGjHSF.swf
C:\Users\5P5NRG~1\AppData\Local\Temp\McG6PSsqGPRgVdz.rtf
C:\Users\5P5NRG~1\AppData\Local\Temp\OzDiBwp8yqAinUl95AD.bmp
C:\Users\5P5NRG~1\AppData\Local\Temp\S9CXFUj4xeY Dx9FH.mp3
C:\Users\5P5NRG~1\AppData\Local\Temp\SDZ6m.swf
C:\Users\5P5NRG~1\AppData\Local\Temp\Tt1Nr2-cpozO.xlsx
C:\Users\5P5NRG~1\AppData\Local\Temp\UEpJCY.jpg
C:\Users\5P5NRG~1\AppData\Local\Temp\WV3BOg.flv
C:\Users\5P5NRG~1\AppData\Local\Temp\XIPk68mCDCGL6-SE1OJ_.mkv
C:\Users\5P5NRG~1\AppData\Local\Temp\XVC-w-EM9.doc
C:\Users\5P5NRG~1\AppData\Local\Temp\YKtkDB.csv
C:\Users\5P5NRG~1\AppData\Local\Temp\blP4q-Ooyv k.wav
C:\Users\5P5NRG~1\AppData\Local\Temp\cgUqc_YS.bmp
C:\Users\5P5NRG~1\AppData\Local\Temp\eCZuTJ2f2OsBdQ Q.swf
C:\Users\5P5NRG~1\AppData\Local\Temp\kE6qm2 FEzz7.bmp
C:\Users\5P5NRG~1\AppData\Local\Temp\rQLbN7_9MSFK_xnSdK_.docx
C:\Users\5P5NRG~1\AppData\Local\Temp\rz4NYsQNtt.bmp
C:\Users\5P5NRG~1\AppData\Local\Temp\saTk-ZkQ5WeS1E_.mp3
C:\Users\5P5NRG~1\AppData\Local\Temp\tBTYIWHS8VK1T5aq4.wav
C:\Users\5P5NRG~1\AppData\Local\Temp\zBf0pd0aBPUj.ots
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\-teJO.avi
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\0Z1JYkqadTEoS9fD.flv
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\1OwplniT27xBtxGwh00.avi
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\5r iZ _McMyTCfVwezaF.ots
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\5sMnS J-qxWdUR.avi
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\7vXER2k9amYaV.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\9bQa.png
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\CbSu15x9Cgi.doc
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Gb84iiKyH6azEuqU.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\GjgifAHn.png
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\HtFfbU8.avi
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\I bzDr6ilz_x-f.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\O3VDUdUNSiCAZvN2BEIT.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\TFyTqzU.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\WQild8IBRJgHNXHkEN3.csv
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\XzcL4hzV.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_fILKDdhwQ2I9zDZYc.csv
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_hZaMlYBl7CjOiwB.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\aM6BuhU78tAh.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\a_t7VjgcrxN.flv
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\c0m4GTNd.flv
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\clLwiWhZ-nearJ-T.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\ehPgsN7BxXLGNlOkpLT.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\gd4QDgQ3J95Nsc.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\h3YWGRfT-DD.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\k-wsYHxp.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\lUi20.gif
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\p VzrW7 A6.png
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\qF_YitP1raD4.avi
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\uSg_kIrbj.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\ujWAU.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\vZ795w4M7M8XNT.pptx
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\vpbSLToxl_Jl.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\-r8M3O4d3UY67U.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1N1gJ F7.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\4_Nx0.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8p90EmM
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8p90EmM\3IaU.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8p90EmM\4oxyan536qA4Nj5.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8p90EmM\5AmAGFfA19-58EPy.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8p90EmM\AaALHhVRxMc.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8p90EmM\Cpo279ODYdyM0 bI-.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8p90EmM\EaMGMjVa.avi
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8p90EmM\GJvOlaGrt E8BWZadrN.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8p90EmM\UDzv5Z6KbI5NAh5c6y.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8p90EmM\_8_7AHunb2gM5joY.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8p90EmM\aKVO9yJ K4-tgNlyDfet.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8p90EmM\jE0H9SpIk_JN1Fa8krSo.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8p90EmM\jeIwNUAHV wPKq.pdf
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8p90EmM\mYB4NdhCqmVtl.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8p90EmM\oyjVIk2Rz8dglS_.odp
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\8p90EmM\s1g2HSjB2LspMZoL0V.pps
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9 FxVbE.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9-_mObrAzxq.png
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9HytI.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CWU N.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\EkWtpg18lXdEkr.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Gk_IjzZoBLsQaZko.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\IrfYKUnwyued4.ppt
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\IxLdxxbVEikBYv.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\JbswPa.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\JljK.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\O0csL5p6UC4Qvhi.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OanDDKcGuYqGIDoTQ5fB.ods
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\T1zmzS.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZcPEzblH09He1S_m1f9n.csv
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\b06-c7E1q.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\biwqKC2RBWajNac.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gT-J181HAGE6B7pQd.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nNkPU Nt9yMoWFKkui.avi
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qRdDN1dqd8.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qTtL9W6rOdf1ds_.avi
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\r2lND.doc
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\uCxfgoxPfh_Ld.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wcNwh6T11Kp2CZHD.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\02MP9wRDo3h.docx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\0F4AsE81-S6F0tu.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\7HSnV_HBjh_plgIvwVBQ.docx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9ZzIQSFhAFGIH9.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9eobOd.pptx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9jSQoGaitOBfsHrBDR3.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\CklsiV7PPfIW0B.docx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NJ21vC5YSe.odt
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\Gi7T-v8j4lPhWDHTq-_d.odp
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\HaMkBZ9DV02CRvnueQ_.csv
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\NTb6xc5tPCDcpjw.odp
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\U5RKyG.xls
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\Yh6XzTtISi3dIoy5.odp
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\05M8ICLqRnic0t.csv
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\Ed7fTRU
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\Ed7fTRU\uPJOT-ROOTttZ2.xls
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\Ed7fTRU\z5_x7i31aAwt6Vo.ppt
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\LkpRT_LKo U_t8jl5S2.odt
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\dt0oSxbxv5rF-QX.pdf
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\fUValbEeKI607
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\fUValbEeKI607\T11eV98 0OT5Lp.rtf
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\fUValbEeKI607\iZrd45Y8uN7q8SLQC.ods
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\fUValbEeKI607\mj4nMLiDAhPL13bG878_.pps
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\fUValbEeKI607\nDjrZI1EbZO4w-G.odp
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\fUValbEeKI607\pNtFk.rtf
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\fUValbEeKI607\pekRNqCOulpYnJZJD_ J.odt
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\kc_iTFKw.ods
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\s3ljTd3-ExQJRB-qeB.docx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\u 3QbAE.pdf
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\yi71Mdh8xYNKkK-bGdr
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\yi71Mdh8xYNKkK-bGdr\0 mmgYL_Y_p e
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\yi71Mdh8xYNKkK-bGdr\0 mmgYL_Y_p e\-Fki.rtf
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\yi71Mdh8xYNKkK-bGdr\0 mmgYL_Y_p e\73EQLpyCo7Qx.xls
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\yi71Mdh8xYNKkK-bGdr\0 mmgYL_Y_p e\Ut8RWJFGSUiw XpGY-KM
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\yi71Mdh8xYNKkK-bGdr\0 mmgYL_Y_p e\Ut8RWJFGSUiw XpGY-KM\U124qnQr7icWLk.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\yi71Mdh8xYNKkK-bGdr\0 mmgYL_Y_p e\eq_3VuJS3QzA6et_R.ods
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\yi71Mdh8xYNKkK-bGdr\76EM4m8V _43XOkPcrX.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\yi71Mdh8xYNKkK-bGdr\RJKQ6x7HPoznN8IuOlRE.doc
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\yi71Mdh8xYNKkK-bGdr\TSA3t9YtdsgwFr6870ZN.ppt
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\yi71Mdh8xYNKkK-bGdr\Z5BlZBpQ3SErBwtG.pptx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\yi71Mdh8xYNKkK-bGdr\igEFwBOISjrU.docx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\calZq\yi71Mdh8xYNKkK-bGdr\ye-jqi1p.pdf
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\lrvUBs.doc
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\ypJJs55P
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\ypJJs55P\3D1x5mTh_-Iow
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\ypJJs55P\3D1x5mTh_-Iow\8yX ux.ppt
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\ypJJs55P\N_gRqBn9nJSTcHDfR.ppt
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\ypJJs55P\Pbbk-hlLdq0UyxM13CR.pps
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\ypJJs55P\Rnbm9EXU_D.doc
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\ypJJs55P\UCevFKzZPFAw_S.pps
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OebTVbIe3yK1iFMe9EI\ypJJs55P\b0JGRvSVJ.ppt
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\RGlPgWeNHEv59g.pptx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ZmAgx_1RaKd3nkad-y.odt
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\d4F1yZCfCwp.pptx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\f0a1ZqjHvOv5l4t8C4.ots
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\jxsNzM9n8F.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\k1UAYzE_.pptx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mqT2 UiqA4vXhnb-.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\nz8IL3JTAst.docx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\rF19Q8MQ.xls
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\renhPE2fk.docx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\w8CxsWJm5dJz.pptx
C:\Users\5p5NrGJn0jS HALPmcxz\Music\1oTzQRxS2ih-tk_YB_Fm.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\67ETYBYw6vCisVCC4.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Music\BOF5hcu.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\DyHO08hpF4pEO9ZIcF
C:\Users\5p5NrGJn0jS HALPmcxz\Music\DyHO08hpF4pEO9ZIcF\2hEpYKQ.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\DyHO08hpF4pEO9ZIcF\5lteQKDB1A.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\DyHO08hpF4pEO9ZIcF\EcBlz2p5wOV_8.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\DyHO08hpF4pEO9ZIcF\JjmXjeOgPIn4.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\DyHO08hpF4pEO9ZIcF\S6m6bT.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Music\DyHO08hpF4pEO9ZIcF\W9aphma9nrL3.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\DyHO08hpF4pEO9ZIcF\YIL0klI_X8FZGdpnhqr.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\DyHO08hpF4pEO9ZIcF\pnClYj _WhvxLb.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Music\DyHO08hpF4pEO9ZIcF\tilGq.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\DyHO08hpF4pEO9ZIcF\yPvmMyRcrumc0L.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\IqriILb.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\ZcdjO8 9ka.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Music\acThNtccHnuS2wOA.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\awxIo.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\iP5 -QV-FBg5Iol7Apj
C:\Users\5p5NrGJn0jS HALPmcxz\Music\iP5 -QV-FBg5Iol7Apj\-UusX8SJngD8qQo2lfu.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\iP5 -QV-FBg5Iol7Apj\FOMqfGCyyCPJgaUhyDC.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\iP5 -QV-FBg5Iol7Apj\PBxpuwUUL.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\iP5 -QV-FBg5Iol7Apj\TvR_NK5rlCUoJ.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\iP5 -QV-FBg5Iol7Apj\WzZHhZYBMysoWG1.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Music\iP5 -QV-FBg5Iol7Apj\YyIIuHeUSzbzD8.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Music\iP5 -QV-FBg5Iol7Apj\ka1iIL.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\iP5 -QV-FBg5Iol7Apj\phnIUf0TY3bLS75Cjs_.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Music\iP5 -QV-FBg5Iol7Apj\sldIS9pIsgC9AepQ.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\ohlMHZtTj-Wm_.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\qUHJEgiEdYK.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\tsrRkJnS.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\NAYw4rC_FU.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\RrR1Whu-igNjv7Yi6.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\2sAIhvXtnAwUUWM
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\2sAIhvXtnAwUUWM\SJm2.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\2sAIhvXtnAwUUWM\TQFPAYw1.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\2sAIhvXtnAwUUWM\U4Gv4b9_476D2lDBz.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\2sAIhvXtnAwUUWM\a-N7DijYlh9y2IoSfvM
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\2sAIhvXtnAwUUWM\a-N7DijYlh9y2IoSfvM\qc5CLo0-eDwbk.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\2sAIhvXtnAwUUWM\eP-OvzmNt2NuW.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\2sAIhvXtnAwUUWM\pHNo4nK40dF.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\kP371x78xG_lWbpsq
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\kP371x78xG_lWbpsq\-U7WT5NfCSmOR.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\kP371x78xG_lWbpsq\8U3SVXwC.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\kP371x78xG_lWbpsq\E7 U4PgAszxlI0PV1.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\kP371x78xG_lWbpsq\GESDFTpobQZGx.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\kP371x78xG_lWbpsq\KcOvc.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\kP371x78xG_lWbpsq\Q2qE1VwQdtzrZoHY.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\kP371x78xG_lWbpsq\SBlO1ugVo.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\kP371x78xG_lWbpsq\ZHlEo9kwDz_vgY.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\kP371x78xG_lWbpsq\mkB8K 0H0t7kDNcjm.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\kP371x78xG_lWbpsq\yMoZww4sKM3gSO.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\X-vzX1TFy4oTENm\sL9PZb.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\mSW-0.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\03xFgDUYWTP\raM3Mm0dhBHzLVUeb.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\1oLxb albSKeD.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\E2akwVfNNd_1iK
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\E2akwVfNNd_1iK\1lDH3MHknLB7PIDL.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\E2akwVfNNd_1iK\OSvMAeU0VUB7L.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\HrSxQzeCOf.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\KsVBdV
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\KsVBdV\0Knp.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\KsVBdV\Mel0uFCO.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\KsVBdV\PjcZvGtk1.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\KsVBdV\_BPrTE.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\KsVBdV\bv65fdtN46v.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\KsVBdV\ieaN4q-q21dPa.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\KsVBdV\oVN6kytkt.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\Lg1XlbGNH_bb.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lQceZCPHpBwhPV7uChU.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\pewBmNu
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\pewBmNu\OotAmXuXSl.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\pewBmNu\ZWKPH7_kHZT.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\pewBmNu\fxEs6vv5Z0 --Ye.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zcVb0
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zcVb0\wMbpAFSSSTFR9nga.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Ar8PZxB8NDl2knS4ee.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\XjDr8q0 mlIUJqCR47.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\QSyQw-4jzl47pMpyYpm6
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\QSyQw-4jzl47pMpyYpm6\42EFD4EsbjBUTbHRqQco.avi
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\QSyQw-4jzl47pMpyYpm6\CfznqQT1jw.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\QSyQw-4jzl47pMpyYpm6\oxPSjewxr9cQ.flv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\QSyQw-4jzl47pMpyYpm6\x91Km.flv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\7zDcT-3B.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\850hhon2ho.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\PxbVlP4rRKScxq6R
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\PxbVlP4rRKScxq6R\FE8cz4p3qcd
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\PxbVlP4rRKScxq6R\FE8cz4p3qcd\FfENHekhJ0Vgqe0ph9.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\PxbVlP4rRKScxq6R\FE8cz4p3qcd\b me.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\PxbVlP4rRKScxq6R\ZWW22
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\PxbVlP4rRKScxq6R\_TTnYas3
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\PxbVlP4rRKScxq6R\_TTnYas3\07LiHWwIhKwkLkrAO8.avi
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\PxbVlP4rRKScxq6R\_TTnYas3\ZCwh.flv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\PxbVlP4rRKScxq6R\pi3v Wcb.flv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\PxbVlP4rRKScxq6R\zYj-hfKPvFxDy7K
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\PxbVlP4rRKScxq6R\zYj-hfKPvFxDy7K\2TYSBM27cavW50.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\PxbVlP4rRKScxq6R\zYj-hfKPvFxDy7K\fzCD5FpjgL.flv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\QrqbajpIkExHmtDlg.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\SqZsjik
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\SqZsjik\1Qt1jXqAk.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\SqZsjik\88kf4RYHxaj.flv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\_yp3vUb6ZcixB9WQlam.avi
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\ed8F4MyBFGKrA.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\gtUmvb z3dk_8
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\gtUmvb z3dk_8\1DDCPXSZef9 qc4goeE.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\gtUmvb z3dk_8\MjBA7AWK2IX.avi
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\gtUmvb z3dk_8\q5IxYETVgCwTeD.avi
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\WpkCCzG6XZofAmSJ\gtUmvb z3dk_8\rSOA.avi
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\n9tVNTH1QUyEC35LFON4.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\p7_Sx.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cx7Lx3L8kW GwY_bWt\zTsHaUlSCSrNc5G.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gIgnHmbu7UoExFDw.avi
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hfWaEZ00.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\uOqzsceq08DtreT92Z7.swf

Remarks (1/1)

Virtual Machine Information

Analyzer Information

System Information

Software Information

Randomly Created Artifacts

Before

After