VMRay Analyzer Report for Sample #502430
VMRay Analyzer
2.3.2
Process
1
3380
scn0tification.exe
1404
scn0tification.exe
"C:\Users\CIiHmnxMn6Ps\Desktop\SCN0tification.exe"
C:\Users\CIiHmnxMn6Ps\Desktop\
c:\users\ciihmnxmn6ps\desktop\scn0tification.exe
Child_Of
Created
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Read_From
Created
Created
Created
Created
Created
Created
Created
Created
Process
2
3500
cmd.exe
3380
cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\CIiHmnxMn6Ps\Desktop\clearnetworkdns_11-22-33.bat" "
C:\Users\CIiHmnxMn6Ps\Desktop\
c:\windows\syswow64\cmd.exe
Child_Of
Child_Of
Created
Opened
Opened
Opened
Created
Opened
Opened
Opened
Process
4
3612
vssadmin.exe
3500
vssadmin.exe
vssadmin Delete Shadows /all /quiet
C:\Users\CIiHmnxMn6Ps\Desktop\
c:\windows\syswow64\vssadmin.exe
Process
5
3680
vssadmin.exe
3500
vssadmin.exe
vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
C:\Users\CIiHmnxMn6Ps\Desktop\
c:\windows\syswow64\vssadmin.exe
File
bootnxt
bootnxt
c:\
c:\bootnxt
File
recovery\windowsre\reagent.xml
recovery\windowsre\reagent.xml
c:\
c:\recovery\windowsre\reagent.xml
xml
File
users\ciihmnxmn6ps\contacts\aclviho asldjfl.contact
users\ciihmnxmn6ps\contacts\aclviho asldjfl.contact
c:\
c:\users\ciihmnxmn6ps\contacts\aclviho asldjfl.contact
contact
File
users\ciihmnxmn6ps\contacts\asdlfk poopvy.contact
users\ciihmnxmn6ps\contacts\asdlfk poopvy.contact
c:\
c:\users\ciihmnxmn6ps\contacts\asdlfk poopvy.contact
contact
File
users\ciihmnxmn6ps\contacts\chucu jadnvk.contact
users\ciihmnxmn6ps\contacts\chucu jadnvk.contact
c:\
c:\users\ciihmnxmn6ps\contacts\chucu jadnvk.contact
contact
File
users\ciihmnxmn6ps\contacts\lulcit amkdfe.contact
users\ciihmnxmn6ps\contacts\lulcit amkdfe.contact
c:\
c:\users\ciihmnxmn6ps\contacts\lulcit amkdfe.contact
contact
File
users\ciihmnxmn6ps\contacts\sikvnb huvuib.contact
users\ciihmnxmn6ps\contacts\sikvnb huvuib.contact
c:\
c:\users\ciihmnxmn6ps\contacts\sikvnb huvuib.contact
contact
File
users\ciihmnxmn6ps\documents\1u1ptmsi_p5i6kp0gvz.xlsx
users\ciihmnxmn6ps\documents\1u1ptmsi_p5i6kp0gvz.xlsx
c:\
c:\users\ciihmnxmn6ps\documents\1u1ptmsi_p5i6kp0gvz.xlsx
xlsx
File
users\ciihmnxmn6ps\documents\4cdcevloogdnnc.xlsx
users\ciihmnxmn6ps\documents\4cdcevloogdnnc.xlsx
c:\
c:\users\ciihmnxmn6ps\documents\4cdcevloogdnnc.xlsx
xlsx
File
users\ciihmnxmn6ps\documents\5eq4al0vbsul.pps
users\ciihmnxmn6ps\documents\5eq4al0vbsul.pps
c:\
c:\users\ciihmnxmn6ps\documents\5eq4al0vbsul.pps
pps
File
users\ciihmnxmn6ps\documents\5euw6x.xlsx
users\ciihmnxmn6ps\documents\5euw6x.xlsx
c:\
c:\users\ciihmnxmn6ps\documents\5euw6x.xlsx
xlsx
File
users\ciihmnxmn6ps\documents\database1.accdb
users\ciihmnxmn6ps\documents\database1.accdb
c:\
c:\users\ciihmnxmn6ps\documents\database1.accdb
accdb
File
users\ciihmnxmn6ps\documents\fnczf1a7h gxenh83.pptx
users\ciihmnxmn6ps\documents\fnczf1a7h gxenh83.pptx
c:\
c:\users\ciihmnxmn6ps\documents\fnczf1a7h gxenh83.pptx
pptx
File
users\ciihmnxmn6ps\documents\gcljm xynmawr.xlsx
users\ciihmnxmn6ps\documents\gcljm xynmawr.xlsx
c:\
c:\users\ciihmnxmn6ps\documents\gcljm xynmawr.xlsx
xlsx
File
users\ciihmnxmn6ps\documents\hfokw.pptx
users\ciihmnxmn6ps\documents\hfokw.pptx
c:\
c:\users\ciihmnxmn6ps\documents\hfokw.pptx
pptx
File
users\ciihmnxmn6ps\documents\hjzx8afototuk b35pj_.pdf
users\ciihmnxmn6ps\documents\hjzx8afototuk b35pj_.pdf
c:\
c:\users\ciihmnxmn6ps\documents\hjzx8afototuk b35pj_.pdf
pdf
File
users\ciihmnxmn6ps\documents\jf6z1xvdfv.docx
users\ciihmnxmn6ps\documents\jf6z1xvdfv.docx
c:\
c:\users\ciihmnxmn6ps\documents\jf6z1xvdfv.docx
docx
File
users\ciihmnxmn6ps\documents\mi47.xlsx
users\ciihmnxmn6ps\documents\mi47.xlsx
c:\
c:\users\ciihmnxmn6ps\documents\mi47.xlsx
xlsx
File
users\ciihmnxmn6ps\documents\mlv6gzv7da-bgmdc.docx
users\ciihmnxmn6ps\documents\mlv6gzv7da-bgmdc.docx
c:\
c:\users\ciihmnxmn6ps\documents\mlv6gzv7da-bgmdc.docx
docx
File
users\ciihmnxmn6ps\documents\np0r3x5d.ods
users\ciihmnxmn6ps\documents\np0r3x5d.ods
c:\
c:\users\ciihmnxmn6ps\documents\np0r3x5d.ods
ods
File
users\ciihmnxmn6ps\documents\o1_fy8.pptx
users\ciihmnxmn6ps\documents\o1_fy8.pptx
c:\
c:\users\ciihmnxmn6ps\documents\o1_fy8.pptx
pptx
File
users\ciihmnxmn6ps\documents\obhpe.pptx
users\ciihmnxmn6ps\documents\obhpe.pptx
c:\
c:\users\ciihmnxmn6ps\documents\obhpe.pptx
pptx
File
users\ciihmnxmn6ps\documents\satdqcfmyoplh.docx
users\ciihmnxmn6ps\documents\satdqcfmyoplh.docx
c:\
c:\users\ciihmnxmn6ps\documents\satdqcfmyoplh.docx
docx
File
users\ciihmnxmn6ps\documents\u6hncyve2vuu.docx
users\ciihmnxmn6ps\documents\u6hncyve2vuu.docx
c:\
c:\users\ciihmnxmn6ps\documents\u6hncyve2vuu.docx
docx
File
users\ciihmnxmn6ps\documents\zinabl4ebqn3jc_djnr.pptx
users\ciihmnxmn6ps\documents\zinabl4ebqn3jc_djnr.pptx
c:\
c:\users\ciihmnxmn6ps\documents\zinabl4ebqn3jc_djnr.pptx
pptx
File
users\ciihmnxmn6ps\documents\zmbkh2wunbqmsh-.docx
users\ciihmnxmn6ps\documents\zmbkh2wunbqmsh-.docx
c:\
c:\users\ciihmnxmn6ps\documents\zmbkh2wunbqmsh-.docx
docx
File
users\ciihmnxmn6ps\documents\my shapes\_private\folder.ico
users\ciihmnxmn6ps\documents\my shapes\_private\folder.ico
c:\
c:\users\ciihmnxmn6ps\documents\my shapes\_private\folder.ico
ico
File
users\ciihmnxmn6ps\documents\onenote notebooks\my notebook\open notebook.onetoc2
users\ciihmnxmn6ps\documents\onenote notebooks\my notebook\open notebook.onetoc2
c:\
c:\users\ciihmnxmn6ps\documents\onenote notebooks\my notebook\open notebook.onetoc2
onetoc2
File
users\ciihmnxmn6ps\documents\onenote notebooks\my notebook\quick notes.one
users\ciihmnxmn6ps\documents\onenote notebooks\my notebook\quick notes.one
c:\
c:\users\ciihmnxmn6ps\documents\onenote notebooks\my notebook\quick notes.one
one
File
users\ciihmnxmn6ps\documents\outlook files\lcfkj@kiekc.df.pst
users\ciihmnxmn6ps\documents\outlook files\lcfkj@kiekc.df.pst
c:\
c:\users\ciihmnxmn6ps\documents\outlook files\lcfkj@kiekc.df.pst
pst
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\uhl6pzjxrzwaaetb.ods
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\uhl6pzjxrzwaaetb.ods
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\uhl6pzjxrzwaaetb.ods
ods
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\-pzcxu.pps
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\-pzcxu.pps
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\-pzcxu.pps
pps
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\gagdtv.ods
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\gagdtv.ods
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\gagdtv.ods
ods
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\yha0twh2qix.odt
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\yha0twh2qix.odt
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\yha0twh2qix.odt
odt
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\2pwzntbd\51gz9cs6qyqwb.xlsx
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\2pwzntbd\51gz9cs6qyqwb.xlsx
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\2pwzntbd\51gz9cs6qyqwb.xlsx
xlsx
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\2pwzntbd\fmvnxbvv7u9rp.docx
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\2pwzntbd\fmvnxbvv7u9rp.docx
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\2pwzntbd\fmvnxbvv7u9rp.docx
docx
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\2pwzntbd\ttyea5k8bn5b.ppt
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\2pwzntbd\ttyea5k8bn5b.ppt
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\2pwzntbd\ttyea5k8bn5b.ppt
ppt
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\7hk2lc8byx_mxaozre\r873fj.xls
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\7hk2lc8byx_mxaozre\r873fj.xls
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\7hk2lc8byx_mxaozre\r873fj.xls
xls
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\7hk2lc8byx_mxaozre\s9_ob4rjjavsdjpcs.pdf
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\7hk2lc8byx_mxaozre\s9_ob4rjjavsdjpcs.pdf
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\7hk2lc8byx_mxaozre\s9_ob4rjjavsdjpcs.pdf
pdf
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\7hk2lc8byx_mxaozre\umcqx7d.pptx
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\7hk2lc8byx_mxaozre\umcqx7d.pptx
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\7hk2lc8byx_mxaozre\umcqx7d.pptx
pptx
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\7hk2lc8byx_mxaozre\xj2od9lqq0bg.docx
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\7hk2lc8byx_mxaozre\xj2od9lqq0bg.docx
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\-3ostnyb\7hk2lc8byx_mxaozre\xj2od9lqq0bg.docx
docx
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\1gqxj7phl\lj2-zso63v_7d.xlsx
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\1gqxj7phl\lj2-zso63v_7d.xlsx
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\1gqxj7phl\lj2-zso63v_7d.xlsx
xlsx
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\1gqxj7phl\pdkaxjhzd7zyz7o.doc
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\1gqxj7phl\pdkaxjhzd7zyz7o.doc
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\1gqxj7phl\pdkaxjhzd7zyz7o.doc
doc
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\4cjd3sacmw1\3kj8y-edptfo.pptx
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\4cjd3sacmw1\3kj8y-edptfo.pptx
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\4cjd3sacmw1\3kj8y-edptfo.pptx
pptx
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\4cjd3sacmw1\5neacjn_lqi_2wf_a.pdf
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\4cjd3sacmw1\5neacjn_lqi_2wf_a.pdf
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\4cjd3sacmw1\5neacjn_lqi_2wf_a.pdf
pdf
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\4cjd3sacmw1\ggpxr1si06pikwmcd.rtf
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\4cjd3sacmw1\ggpxr1si06pikwmcd.rtf
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\4cjd3sacmw1\ggpxr1si06pikwmcd.rtf
rtf
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\4cjd3sacmw1\nhki1vmmaxowuhnr.pdf
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\4cjd3sacmw1\nhki1vmmaxowuhnr.pdf
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\4cjd3sacmw1\nhki1vmmaxowuhnr.pdf
pdf
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\4cjd3sacmw1\tyddeyuppbuilessl.odt
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\4cjd3sacmw1\tyddeyuppbuilessl.odt
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\4cjd3sacmw1\tyddeyuppbuilessl.odt
odt
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\3b2v8p-dhiekn7fyat.docx
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\3b2v8p-dhiekn7fyat.docx
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\3b2v8p-dhiekn7fyat.docx
docx
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\5qiwp0jfq.pps
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\5qiwp0jfq.pps
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\5qiwp0jfq.pps
pps
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\fsxqueavod0el-v.pps
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\fsxqueavod0el-v.pps
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\fsxqueavod0el-v.pps
pps
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\h8ihxzo4v.csv
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\h8ihxzo4v.csv
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\h8ihxzo4v.csv
csv
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\hpvwb5ehttvn89.pps
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\hpvwb5ehttvn89.pps
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\hpvwb5ehttvn89.pps
pps
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\ogyow62ehp.pdf
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\ogyow62ehp.pdf
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\ogyow62ehp.pdf
pdf
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\q0wdni_cejvl.pdf
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\q0wdni_cejvl.pdf
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\q0wdni_cejvl.pdf
pdf
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\tpkopghxv.xls
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\tpkopghxv.xls
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\tpkopghxv.xls
xls
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\vv1t.doc
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\vv1t.doc
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\vv1t.doc
doc
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\rmpn_zry5sqnhaj8agld\iclup5fusoioguepj 8n.pps
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\rmpn_zry5sqnhaj8agld\iclup5fusoioguepj 8n.pps
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\rmpn_zry5sqnhaj8agld\iclup5fusoioguepj 8n.pps
pps
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\rmpn_zry5sqnhaj8agld\k4lj2wygo9qfwudpot.doc
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\rmpn_zry5sqnhaj8agld\k4lj2wygo9qfwudpot.doc
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\rmpn_zry5sqnhaj8agld\k4lj2wygo9qfwudpot.doc
doc
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\rmpn_zry5sqnhaj8agld\qq3r.ots
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\rmpn_zry5sqnhaj8agld\qq3r.ots
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\rmpn_zry5sqnhaj8agld\qq3r.ots
ots
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\0kk10l8yj9psdd5_rli8.pptx
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\0kk10l8yj9psdd5_rli8.pptx
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\0kk10l8yj9psdd5_rli8.pptx
pptx
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\6w48s.rtf
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\6w48s.rtf
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\6w48s.rtf
rtf
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\b-2cmw.doc
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\b-2cmw.doc
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\b-2cmw.doc
doc
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\cqjd3nsx.ppt
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\cqjd3nsx.ppt
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\cqjd3nsx.ppt
ppt
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\dynsh7i.xls
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\dynsh7i.xls
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\dynsh7i.xls
xls
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\mr4szz7.pptx
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\mr4szz7.pptx
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\snkhgs\mr4szz7.pptx
pptx
File
users\ciihmnxmn6ps\favorites\bing.url
users\ciihmnxmn6ps\favorites\bing.url
c:\
c:\users\ciihmnxmn6ps\favorites\bing.url
url
File
users\ciihmnxmn6ps\music\2g6m.mp3
users\ciihmnxmn6ps\music\2g6m.mp3
c:\
c:\users\ciihmnxmn6ps\music\2g6m.mp3
mp3
File
users\ciihmnxmn6ps\music\eemxkuz3.wav
users\ciihmnxmn6ps\music\eemxkuz3.wav
c:\
c:\users\ciihmnxmn6ps\music\eemxkuz3.wav
wav
File
users\ciihmnxmn6ps\music\i8dv-9gtrmud.mp3
users\ciihmnxmn6ps\music\i8dv-9gtrmud.mp3
c:\
c:\users\ciihmnxmn6ps\music\i8dv-9gtrmud.mp3
mp3
File
users\ciihmnxmn6ps\music\n0rl.wav
users\ciihmnxmn6ps\music\n0rl.wav
c:\
c:\users\ciihmnxmn6ps\music\n0rl.wav
wav
File
users\ciihmnxmn6ps\music\p6uexqwlp.mp3
users\ciihmnxmn6ps\music\p6uexqwlp.mp3
c:\
c:\users\ciihmnxmn6ps\music\p6uexqwlp.mp3
mp3
File
users\ciihmnxmn6ps\music\pf3r-b3dbtl.wav
users\ciihmnxmn6ps\music\pf3r-b3dbtl.wav
c:\
c:\users\ciihmnxmn6ps\music\pf3r-b3dbtl.wav
wav
File
users\ciihmnxmn6ps\music\vecrh3plvrcz1o.mp3
users\ciihmnxmn6ps\music\vecrh3plvrcz1o.mp3
c:\
c:\users\ciihmnxmn6ps\music\vecrh3plvrcz1o.mp3
mp3
File
users\ciihmnxmn6ps\music\z8pr_v.mp3
users\ciihmnxmn6ps\music\z8pr_v.mp3
c:\
c:\users\ciihmnxmn6ps\music\z8pr_v.mp3
mp3
File
users\ciihmnxmn6ps\music\go5j 80\2hvoirftbyws.mp3
users\ciihmnxmn6ps\music\go5j 80\2hvoirftbyws.mp3
c:\
c:\users\ciihmnxmn6ps\music\go5j 80\2hvoirftbyws.mp3
mp3
File
users\ciihmnxmn6ps\music\go5j 80\69_uahnrs.mp3
users\ciihmnxmn6ps\music\go5j 80\69_uahnrs.mp3
c:\
c:\users\ciihmnxmn6ps\music\go5j 80\69_uahnrs.mp3
mp3
File
users\ciihmnxmn6ps\music\go5j 80\dcyptvg.wav
users\ciihmnxmn6ps\music\go5j 80\dcyptvg.wav
c:\
c:\users\ciihmnxmn6ps\music\go5j 80\dcyptvg.wav
wav
File
users\ciihmnxmn6ps\music\go5j 80\dg7 crsqu k7xp.mp3
users\ciihmnxmn6ps\music\go5j 80\dg7 crsqu k7xp.mp3
c:\
c:\users\ciihmnxmn6ps\music\go5j 80\dg7 crsqu k7xp.mp3
mp3
File
users\ciihmnxmn6ps\music\go5j 80\grzdqiy3h.mp3
users\ciihmnxmn6ps\music\go5j 80\grzdqiy3h.mp3
c:\
c:\users\ciihmnxmn6ps\music\go5j 80\grzdqiy3h.mp3
mp3
File
users\ciihmnxmn6ps\music\go5j 80\gsswfcqipn.wav
users\ciihmnxmn6ps\music\go5j 80\gsswfcqipn.wav
c:\
c:\users\ciihmnxmn6ps\music\go5j 80\gsswfcqipn.wav
wav
File
users\ciihmnxmn6ps\music\go5j 80\lg0lj99m.mp3
users\ciihmnxmn6ps\music\go5j 80\lg0lj99m.mp3
c:\
c:\users\ciihmnxmn6ps\music\go5j 80\lg0lj99m.mp3
mp3
File
users\ciihmnxmn6ps\music\go5j 80\p6xcw vob.mp3
users\ciihmnxmn6ps\music\go5j 80\p6xcw vob.mp3
c:\
c:\users\ciihmnxmn6ps\music\go5j 80\p6xcw vob.mp3
mp3
File
users\ciihmnxmn6ps\music\go5j 80\t41qgp8zl.wav
users\ciihmnxmn6ps\music\go5j 80\t41qgp8zl.wav
c:\
c:\users\ciihmnxmn6ps\music\go5j 80\t41qgp8zl.wav
wav
File
users\ciihmnxmn6ps\music\go5j 80\tvn8aqpc_u.wav
users\ciihmnxmn6ps\music\go5j 80\tvn8aqpc_u.wav
c:\
c:\users\ciihmnxmn6ps\music\go5j 80\tvn8aqpc_u.wav
wav
File
users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\ar-iiw.m4a
users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\ar-iiw.m4a
c:\
c:\users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\ar-iiw.m4a
m4a
File
users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\bwux20g7mm7g1y.wav
users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\bwux20g7mm7g1y.wav
c:\
c:\users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\bwux20g7mm7g1y.wav
wav
File
users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\g8l7418fmzslf.wav
users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\g8l7418fmzslf.wav
c:\
c:\users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\g8l7418fmzslf.wav
wav
File
users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\lqlp4y.wav
users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\lqlp4y.wav
c:\
c:\users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\lqlp4y.wav
wav
File
users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\nrnil.wav
users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\nrnil.wav
c:\
c:\users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\nrnil.wav
wav
File
users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\rkqboo.m4a
users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\rkqboo.m4a
c:\
c:\users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\rkqboo.m4a
m4a
File
users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\zdz3oj-bfmju.wav
users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\zdz3oj-bfmju.wav
c:\
c:\users\ciihmnxmn6ps\music\zzakb_at-x eadqbsw\zdz3oj-bfmju.wav
wav
File
users\ciihmnxmn6ps\pictures\mgygavvq5w6fl7ar1hfa.bmp
users\ciihmnxmn6ps\pictures\mgygavvq5w6fl7ar1hfa.bmp
c:\
c:\users\ciihmnxmn6ps\pictures\mgygavvq5w6fl7ar1hfa.bmp
bmp
File
users\ciihmnxmn6ps\pictures\qp-3yc7d3frgiw.jpg
users\ciihmnxmn6ps\pictures\qp-3yc7d3frgiw.jpg
c:\
c:\users\ciihmnxmn6ps\pictures\qp-3yc7d3frgiw.jpg
jpg
File
users\ciihmnxmn6ps\pictures\vxt7wz-uz xffndp.png
users\ciihmnxmn6ps\pictures\vxt7wz-uz xffndp.png
c:\
c:\users\ciihmnxmn6ps\pictures\vxt7wz-uz xffndp.png
png
File
users\ciihmnxmn6ps\pictures\7b iyirm\4lav.png
users\ciihmnxmn6ps\pictures\7b iyirm\4lav.png
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\4lav.png
png
File
users\ciihmnxmn6ps\pictures\7b iyirm\aclnmcka4 sh9md3hwo.png
users\ciihmnxmn6ps\pictures\7b iyirm\aclnmcka4 sh9md3hwo.png
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\aclnmcka4 sh9md3hwo.png
png
File
users\ciihmnxmn6ps\pictures\7b iyirm\qm paxelf.bmp
users\ciihmnxmn6ps\pictures\7b iyirm\qm paxelf.bmp
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qm paxelf.bmp
bmp
File
users\ciihmnxmn6ps\desktop\-axvf.flv
users\ciihmnxmn6ps\desktop\-axvf.flv
c:\
c:\users\ciihmnxmn6ps\desktop\-axvf.flv
flv
File
users\ciihmnxmn6ps\pictures\7b iyirm\wgsfbii.jpg
users\ciihmnxmn6ps\pictures\7b iyirm\wgsfbii.jpg
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\wgsfbii.jpg
jpg
File
users\ciihmnxmn6ps\desktop\-nlso.bmp
users\ciihmnxmn6ps\desktop\-nlso.bmp
c:\
c:\users\ciihmnxmn6ps\desktop\-nlso.bmp
bmp
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\ja0o4ao7ru.jpg
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\ja0o4ao7ru.jpg
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\ja0o4ao7ru.jpg
jpg
File
users\ciihmnxmn6ps\desktop\2sxcpvlns73bqpatgxc.png
users\ciihmnxmn6ps\desktop\2sxcpvlns73bqpatgxc.png
c:\
c:\users\ciihmnxmn6ps\desktop\2sxcpvlns73bqpatgxc.png
png
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\z-ap6tzbw hexwllgorb.jpg
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\z-ap6tzbw hexwllgorb.jpg
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\z-ap6tzbw hexwllgorb.jpg
jpg
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\jf2gmudsnpxqc znvvv.jpg
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\jf2gmudsnpxqc znvvv.jpg
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\jf2gmudsnpxqc znvvv.jpg
jpg
File
users\ciihmnxmn6ps\desktop\45dq123.wav
users\ciihmnxmn6ps\desktop\45dq123.wav
c:\
c:\users\ciihmnxmn6ps\desktop\45dq123.wav
wav
File
users\ciihmnxmn6ps\desktop\ape_je.m4a
users\ciihmnxmn6ps\desktop\ape_je.m4a
c:\
c:\users\ciihmnxmn6ps\desktop\ape_je.m4a
m4a
File
users\ciihmnxmn6ps\desktop\av64x7o3la2k.wav
users\ciihmnxmn6ps\desktop\av64x7o3la2k.wav
c:\
c:\users\ciihmnxmn6ps\desktop\av64x7o3la2k.wav
wav
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\lahcz7usad.gif
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\lahcz7usad.gif
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\lahcz7usad.gif
gif
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\msxtzgw tpkdjn.gif
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\msxtzgw tpkdjn.gif
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\msxtzgw tpkdjn.gif
gif
File
users\ciihmnxmn6ps\desktop\bu5bp9.avi
users\ciihmnxmn6ps\desktop\bu5bp9.avi
c:\
c:\users\ciihmnxmn6ps\desktop\bu5bp9.avi
avi
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\tqgqxxg.bmp
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\tqgqxxg.bmp
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\tqgqxxg.bmp
bmp
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\e6jxhv-d_ ucg59vks\ddtdafbzrtbh.png
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\e6jxhv-d_ ucg59vks\ddtdafbzrtbh.png
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\e6jxhv-d_ ucg59vks\ddtdafbzrtbh.png
png
File
users\ciihmnxmn6ps\desktop\dbpsfcucln3nuq6je7.rtf
users\ciihmnxmn6ps\desktop\dbpsfcucln3nuq6je7.rtf
c:\
c:\users\ciihmnxmn6ps\desktop\dbpsfcucln3nuq6je7.rtf
rtf
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\e6jxhv-d_ ucg59vks\uof1gcg-syx.bmp
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\e6jxhv-d_ ucg59vks\uof1gcg-syx.bmp
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\e6jxhv-d_ ucg59vks\uof1gcg-syx.bmp
bmp
File
users\ciihmnxmn6ps\desktop\dizklxpxe.ppt
users\ciihmnxmn6ps\desktop\dizklxpxe.ppt
c:\
c:\users\ciihmnxmn6ps\desktop\dizklxpxe.ppt
ppt
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\e6jxhv-d_ ucg59vks\xbtg.bmp
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\e6jxhv-d_ ucg59vks\xbtg.bmp
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\e6jxhv-d_ ucg59vks\xbtg.bmp
bmp
File
users\ciihmnxmn6ps\desktop\lgbl1f9.swf
users\ciihmnxmn6ps\desktop\lgbl1f9.swf
c:\
c:\users\ciihmnxmn6ps\desktop\lgbl1f9.swf
swf
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\-z88rwvekhn2yhbc6ys.gif
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\-z88rwvekhn2yhbc6ys.gif
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\-z88rwvekhn2yhbc6ys.gif
gif
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\h72i_b.bmp
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\h72i_b.bmp
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\h72i_b.bmp
bmp
File
users\ciihmnxmn6ps\desktop\nykivmtiatrvxlz.xls
users\ciihmnxmn6ps\desktop\nykivmtiatrvxlz.xls
c:\
c:\users\ciihmnxmn6ps\desktop\nykivmtiatrvxlz.xls
xls
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\ithsyuxpeg8bbyggv.jpg
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\ithsyuxpeg8bbyggv.jpg
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\ithsyuxpeg8bbyggv.jpg
jpg
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\lypit_a_zainffhfudv.jpg
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\lypit_a_zainffhfudv.jpg
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\lypit_a_zainffhfudv.jpg
jpg
File
users\ciihmnxmn6ps\desktop\o4rscofawvnz.mp4
users\ciihmnxmn6ps\desktop\o4rscofawvnz.mp4
c:\
c:\users\ciihmnxmn6ps\desktop\o4rscofawvnz.mp4
mp4
File
users\ciihmnxmn6ps\desktop\oalkmuc2ka4.gif
users\ciihmnxmn6ps\desktop\oalkmuc2ka4.gif
c:\
c:\users\ciihmnxmn6ps\desktop\oalkmuc2ka4.gif
gif
File
users\ciihmnxmn6ps\desktop\p9on_mvj_5gz wuo.avi
users\ciihmnxmn6ps\desktop\p9on_mvj_5gz wuo.avi
c:\
c:\users\ciihmnxmn6ps\desktop\p9on_mvj_5gz wuo.avi
avi
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\j7dcvsjumb\50yqio4i.jpg
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\j7dcvsjumb\50yqio4i.jpg
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\j7dcvsjumb\50yqio4i.jpg
jpg
File
users\ciihmnxmn6ps\desktop\rohzjx8ipu.mp3
users\ciihmnxmn6ps\desktop\rohzjx8ipu.mp3
c:\
c:\users\ciihmnxmn6ps\desktop\rohzjx8ipu.mp3
mp3
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\j7dcvsjumb\6orqlc9av8hkhylq04z2.png
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\j7dcvsjumb\6orqlc9av8hkhylq04z2.png
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\j7dcvsjumb\6orqlc9av8hkhylq04z2.png
png
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\j7dcvsjumb\n6 e0qhuxbm.bmp
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\j7dcvsjumb\n6 e0qhuxbm.bmp
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\j7dcvsjumb\n6 e0qhuxbm.bmp
bmp
File
users\ciihmnxmn6ps\desktop\rvq7ekaax.gif
users\ciihmnxmn6ps\desktop\rvq7ekaax.gif
c:\
c:\users\ciihmnxmn6ps\desktop\rvq7ekaax.gif
gif
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\j7dcvsjumb\7luf9ikqys 6\0ebemc7.bmp
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\j7dcvsjumb\7luf9ikqys 6\0ebemc7.bmp
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\j7dcvsjumb\7luf9ikqys 6\0ebemc7.bmp
bmp
File
users\ciihmnxmn6ps\desktop\s5dmlepmozey.pdf
users\ciihmnxmn6ps\desktop\s5dmlepmozey.pdf
c:\
c:\users\ciihmnxmn6ps\desktop\s5dmlepmozey.pdf
pdf
File
users\ciihmnxmn6ps\desktop\t39geveg0wynnp.m4a
users\ciihmnxmn6ps\desktop\t39geveg0wynnp.m4a
c:\
c:\users\ciihmnxmn6ps\desktop\t39geveg0wynnp.m4a
m4a
File
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\j7dcvsjumb\7luf9ikqys 6\lmwumumstcomwqg.bmp
users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\j7dcvsjumb\7luf9ikqys 6\lmwumumstcomwqg.bmp
c:\
c:\users\ciihmnxmn6ps\pictures\7b iyirm\qvr-mzonfhsqrr\q0yprzhhsmv\72aejtrdw7i\xdtcma3q\j7dcvsjumb\7luf9ikqys 6\lmwumumstcomwqg.bmp
bmp
File
users\ciihmnxmn6ps\desktop\uqndwbw1y.avi
users\ciihmnxmn6ps\desktop\uqndwbw1y.avi
c:\
c:\users\ciihmnxmn6ps\desktop\uqndwbw1y.avi
avi
File
users\ciihmnxmn6ps\pictures\bldid5xjzq jcm\iwwqywdx1-oo2.gif
users\ciihmnxmn6ps\pictures\bldid5xjzq jcm\iwwqywdx1-oo2.gif
c:\
c:\users\ciihmnxmn6ps\pictures\bldid5xjzq jcm\iwwqywdx1-oo2.gif
gif
File
users\ciihmnxmn6ps\desktop\vx9fugey-mvlyfl6.gif
users\ciihmnxmn6ps\desktop\vx9fugey-mvlyfl6.gif
c:\
c:\users\ciihmnxmn6ps\desktop\vx9fugey-mvlyfl6.gif
gif
File
users\ciihmnxmn6ps\desktop\wh 8krd6enshe.gif
users\ciihmnxmn6ps\desktop\wh 8krd6enshe.gif
c:\
c:\users\ciihmnxmn6ps\desktop\wh 8krd6enshe.gif
gif
File
users\ciihmnxmn6ps\desktop\xj7qox0- 7l3fo.mkv
users\ciihmnxmn6ps\desktop\xj7qox0- 7l3fo.mkv
c:\
c:\users\ciihmnxmn6ps\desktop\xj7qox0- 7l3fo.mkv
mkv
File
users\ciihmnxmn6ps\searches\everywhere.search-ms
users\ciihmnxmn6ps\searches\everywhere.search-ms
c:\
c:\users\ciihmnxmn6ps\searches\everywhere.search-ms
search-ms
File
users\ciihmnxmn6ps\searches\indexed locations.search-ms
users\ciihmnxmn6ps\searches\indexed locations.search-ms
c:\
c:\users\ciihmnxmn6ps\searches\indexed locations.search-ms
search-ms
File
users\ciihmnxmn6ps\desktop\y_li3 4-qp.m4a
users\ciihmnxmn6ps\desktop\y_li3 4-qp.m4a
c:\
c:\users\ciihmnxmn6ps\desktop\y_li3 4-qp.m4a
m4a
File
users\ciihmnxmn6ps\videos\bvhx1g7lg6.swf
users\ciihmnxmn6ps\videos\bvhx1g7lg6.swf
c:\
c:\users\ciihmnxmn6ps\videos\bvhx1g7lg6.swf
swf
File
users\ciihmnxmn6ps\desktop\z29lckbw5rcm_xd.png
users\ciihmnxmn6ps\desktop\z29lckbw5rcm_xd.png
c:\
c:\users\ciihmnxmn6ps\desktop\z29lckbw5rcm_xd.png
png
File
users\ciihmnxmn6ps\desktop\zsdqjc9p9rp.png
users\ciihmnxmn6ps\desktop\zsdqjc9p9rp.png
c:\
c:\users\ciihmnxmn6ps\desktop\zsdqjc9p9rp.png
png
File
users\ciihmnxmn6ps\videos\up-xczd9p 2yrwn.mp4
users\ciihmnxmn6ps\videos\up-xczd9p 2yrwn.mp4
c:\
c:\users\ciihmnxmn6ps\videos\up-xczd9p 2yrwn.mp4
mp4
File
users\ciihmnxmn6ps\desktop\37pif51-yjt\3eetfbjdu0.m4a
users\ciihmnxmn6ps\desktop\37pif51-yjt\3eetfbjdu0.m4a
c:\
c:\users\ciihmnxmn6ps\desktop\37pif51-yjt\3eetfbjdu0.m4a
m4a
File
users\ciihmnxmn6ps\desktop\37pif51-yjt\3ivedjbz33f.mkv
users\ciihmnxmn6ps\desktop\37pif51-yjt\3ivedjbz33f.mkv
c:\
c:\users\ciihmnxmn6ps\desktop\37pif51-yjt\3ivedjbz33f.mkv
mkv
File
users\ciihmnxmn6ps\videos\vynmkqyqyi.mkv
users\ciihmnxmn6ps\videos\vynmkqyqyi.mkv
c:\
c:\users\ciihmnxmn6ps\videos\vynmkqyqyi.mkv
mkv
File
users\ciihmnxmn6ps\videos\xj74 9 m.flv
users\ciihmnxmn6ps\videos\xj74 9 m.flv
c:\
c:\users\ciihmnxmn6ps\videos\xj74 9 m.flv
flv
File
users\ciihmnxmn6ps\videos\zdzpwp-28.avi
users\ciihmnxmn6ps\videos\zdzpwp-28.avi
c:\
c:\users\ciihmnxmn6ps\videos\zdzpwp-28.avi
avi
File
users\ciihmnxmn6ps\desktop\37pif51-yjt\8p2msya3098kvulu.wav
users\ciihmnxmn6ps\desktop\37pif51-yjt\8p2msya3098kvulu.wav
c:\
c:\users\ciihmnxmn6ps\desktop\37pif51-yjt\8p2msya3098kvulu.wav
wav
File
users\ciihmnxmn6ps\desktop\37pif51-yjt\ak8m al1ystdgk.odt
users\ciihmnxmn6ps\desktop\37pif51-yjt\ak8m al1ystdgk.odt
c:\
c:\users\ciihmnxmn6ps\desktop\37pif51-yjt\ak8m al1ystdgk.odt
odt
File
users\ciihmnxmn6ps\desktop\37pif51-yjt\ifwd4toa.jpg
users\ciihmnxmn6ps\desktop\37pif51-yjt\ifwd4toa.jpg
c:\
c:\users\ciihmnxmn6ps\desktop\37pif51-yjt\ifwd4toa.jpg
jpg
File
users\ciihmnxmn6ps\videos\wnn lopk\33g0h-qvwgtgnhceha.mp4
users\ciihmnxmn6ps\videos\wnn lopk\33g0h-qvwgtgnhceha.mp4
c:\
c:\users\ciihmnxmn6ps\videos\wnn lopk\33g0h-qvwgtgnhceha.mp4
mp4
File
users\ciihmnxmn6ps\desktop\37pif51-yjt\kdpdv 3nnsnjmgqpo.ppt
users\ciihmnxmn6ps\desktop\37pif51-yjt\kdpdv 3nnsnjmgqpo.ppt
c:\
c:\users\ciihmnxmn6ps\desktop\37pif51-yjt\kdpdv 3nnsnjmgqpo.ppt
ppt
File
users\ciihmnxmn6ps\videos\wnn lopk\s20n9cabg0uo.mp4
users\ciihmnxmn6ps\videos\wnn lopk\s20n9cabg0uo.mp4
c:\
c:\users\ciihmnxmn6ps\videos\wnn lopk\s20n9cabg0uo.mp4
mp4
File
users\ciihmnxmn6ps\videos\wnn lopk\ugeh\62ud.avi
users\ciihmnxmn6ps\videos\wnn lopk\ugeh\62ud.avi
c:\
c:\users\ciihmnxmn6ps\videos\wnn lopk\ugeh\62ud.avi
avi
File
users\ciihmnxmn6ps\videos\wnn lopk\ugeh\eowo0nlnhzdtxx7wgkmw.mp4
users\ciihmnxmn6ps\videos\wnn lopk\ugeh\eowo0nlnhzdtxx7wgkmw.mp4
c:\
c:\users\ciihmnxmn6ps\videos\wnn lopk\ugeh\eowo0nlnhzdtxx7wgkmw.mp4
mp4
File
users\ciihmnxmn6ps\desktop\37pif51-yjt\lzukcb-ugvex.png
users\ciihmnxmn6ps\desktop\37pif51-yjt\lzukcb-ugvex.png
c:\
c:\users\ciihmnxmn6ps\desktop\37pif51-yjt\lzukcb-ugvex.png
png
File
users\ciihmnxmn6ps\desktop\ccqskcj2ss\fntkrrerf_0vwyksizp.xls
users\ciihmnxmn6ps\desktop\ccqskcj2ss\fntkrrerf_0vwyksizp.xls
c:\
c:\users\ciihmnxmn6ps\desktop\ccqskcj2ss\fntkrrerf_0vwyksizp.xls
xls
File
users\ciihmnxmn6ps\videos\wnn lopk\ugeh\valp\gbg6iyo.avi
users\ciihmnxmn6ps\videos\wnn lopk\ugeh\valp\gbg6iyo.avi
c:\
c:\users\ciihmnxmn6ps\videos\wnn lopk\ugeh\valp\gbg6iyo.avi
avi
File
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\4iowumxhz ndf1n_b.flv
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\4iowumxhz ndf1n_b.flv
c:\
c:\users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\4iowumxhz ndf1n_b.flv
flv
File
users\ciihmnxmn6ps\desktop\ccqskcj2ss\mjbzyvv0bw4ofq1.bmp
users\ciihmnxmn6ps\desktop\ccqskcj2ss\mjbzyvv0bw4ofq1.bmp
c:\
c:\users\ciihmnxmn6ps\desktop\ccqskcj2ss\mjbzyvv0bw4ofq1.bmp
bmp
File
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\ojolhasyb.mkv
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\ojolhasyb.mkv
c:\
c:\users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\ojolhasyb.mkv
mkv
File
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\pb rgu0a_4l5krvtz sr.mp4
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\pb rgu0a_4l5krvtz sr.mp4
c:\
c:\users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\pb rgu0a_4l5krvtz sr.mp4
mp4
File
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\_f8m3hu10142ds4cz1.avi
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\_f8m3hu10142ds4cz1.avi
c:\
c:\users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\_f8m3hu10142ds4cz1.avi
avi
File
users\ciihmnxmn6ps\desktop\ccqskcj2ss\nmkbd_etp705mk8.odt
users\ciihmnxmn6ps\desktop\ccqskcj2ss\nmkbd_etp705mk8.odt
c:\
c:\users\ciihmnxmn6ps\desktop\ccqskcj2ss\nmkbd_etp705mk8.odt
odt
File
users\ciihmnxmn6ps\desktop\ccqskcj2ss\y_62xf6x1fjeo5b7p.avi
users\ciihmnxmn6ps\desktop\ccqskcj2ss\y_62xf6x1fjeo5b7p.avi
c:\
c:\users\ciihmnxmn6ps\desktop\ccqskcj2ss\y_62xf6x1fjeo5b7p.avi
avi
File
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\hput\0_psbc9.avi
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\hput\0_psbc9.avi
c:\
c:\users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\hput\0_psbc9.avi
avi
File
users\ciihmnxmn6ps\desktop\ccqskcj2ss\1bwm2r-ai\dqxosfvu6y thx.wav
users\ciihmnxmn6ps\desktop\ccqskcj2ss\1bwm2r-ai\dqxosfvu6y thx.wav
c:\
c:\users\ciihmnxmn6ps\desktop\ccqskcj2ss\1bwm2r-ai\dqxosfvu6y thx.wav
wav
File
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\hput\3m7qhv7t5mgufh2a31q.avi
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\hput\3m7qhv7t5mgufh2a31q.avi
c:\
c:\users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\hput\3m7qhv7t5mgufh2a31q.avi
avi
File
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\hput\4xodva0z5l5w0l.mkv
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\hput\4xodva0z5l5w0l.mkv
c:\
c:\users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\hput\4xodva0z5l5w0l.mkv
mkv
File
users\ciihmnxmn6ps\desktop\ccqskcj2ss\1bwm2r-ai\ijyjhrgq2a2pzmtzl.swf
users\ciihmnxmn6ps\desktop\ccqskcj2ss\1bwm2r-ai\ijyjhrgq2a2pzmtzl.swf
c:\
c:\users\ciihmnxmn6ps\desktop\ccqskcj2ss\1bwm2r-ai\ijyjhrgq2a2pzmtzl.swf
swf
File
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\hput\h9o_u92tz2ho9-mh.swf
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\hput\h9o_u92tz2ho9-mh.swf
c:\
c:\users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\hput\h9o_u92tz2ho9-mh.swf
swf
File
users\ciihmnxmn6ps\desktop\ccqskcj2ss\1bwm2r-ai\ir-tjqbzzd_n5h-s0 pi.doc
users\ciihmnxmn6ps\desktop\ccqskcj2ss\1bwm2r-ai\ir-tjqbzzd_n5h-s0 pi.doc
c:\
c:\users\ciihmnxmn6ps\desktop\ccqskcj2ss\1bwm2r-ai\ir-tjqbzzd_n5h-s0 pi.doc
doc
File
users\ciihmnxmn6ps\desktop\ccqskcj2ss\1bwm2r-ai\mienbi8.docx
users\ciihmnxmn6ps\desktop\ccqskcj2ss\1bwm2r-ai\mienbi8.docx
c:\
c:\users\ciihmnxmn6ps\desktop\ccqskcj2ss\1bwm2r-ai\mienbi8.docx
docx
File
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\pqzym\34z4dfhq5fy_tfb.mkv
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\pqzym\34z4dfhq5fy_tfb.mkv
c:\
c:\users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\pqzym\34z4dfhq5fy_tfb.mkv
mkv
File
users\ciihmnxmn6ps\desktop\ccqskcj2ss\1bwm2r-ai\_7sien5ix oq_luu n.m4a
users\ciihmnxmn6ps\desktop\ccqskcj2ss\1bwm2r-ai\_7sien5ix oq_luu n.m4a
c:\
c:\users\ciihmnxmn6ps\desktop\ccqskcj2ss\1bwm2r-ai\_7sien5ix oq_luu n.m4a
m4a
File
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\pqzym\bvv97lko.swf
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\pqzym\bvv97lko.swf
c:\
c:\users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\pqzym\bvv97lko.swf
swf
File
users\ciihmnxmn6ps\desktop\ccqskcj2ss\85kqqfxpbtbepm1ws\0-tv symfqgkma 6x.wav
users\ciihmnxmn6ps\desktop\ccqskcj2ss\85kqqfxpbtbepm1ws\0-tv symfqgkma 6x.wav
c:\
c:\users\ciihmnxmn6ps\desktop\ccqskcj2ss\85kqqfxpbtbepm1ws\0-tv symfqgkma 6x.wav
wav
File
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\pqzym\w w7r5kgwid8.mkv
users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\pqzym\w w7r5kgwid8.mkv
c:\
c:\users\ciihmnxmn6ps\videos\xtvcrj2m0wzyx7ebejj\pqzym\w w7r5kgwid8.mkv
mkv
File
users\ciihmnxmn6ps\videos\_eel\1hsy82y7uutj0jd69.mp4
users\ciihmnxmn6ps\videos\_eel\1hsy82y7uutj0jd69.mp4
c:\
c:\users\ciihmnxmn6ps\videos\_eel\1hsy82y7uutj0jd69.mp4
mp4
File
users\ciihmnxmn6ps\desktop\ccqskcj2ss\85kqqfxpbtbepm1ws\hgqtnsokzq5a1.ods
users\ciihmnxmn6ps\desktop\ccqskcj2ss\85kqqfxpbtbepm1ws\hgqtnsokzq5a1.ods
c:\
c:\users\ciihmnxmn6ps\desktop\ccqskcj2ss\85kqqfxpbtbepm1ws\hgqtnsokzq5a1.ods
ods
File
users\ciihmnxmn6ps\videos\_eel\eztfyazpk0.mkv
users\ciihmnxmn6ps\videos\_eel\eztfyazpk0.mkv
c:\
c:\users\ciihmnxmn6ps\videos\_eel\eztfyazpk0.mkv
mkv
File
users\ciihmnxmn6ps\videos\_eel\q07hptbyaa2ssmp7jyw8.swf
users\ciihmnxmn6ps\videos\_eel\q07hptbyaa2ssmp7jyw8.swf
c:\
c:\users\ciihmnxmn6ps\videos\_eel\q07hptbyaa2ssmp7jyw8.swf
swf
File
users\ciihmnxmn6ps\videos\_eel\qgtwvwhnjohyh0 tv.swf
users\ciihmnxmn6ps\videos\_eel\qgtwvwhnjohyh0 tv.swf
c:\
c:\users\ciihmnxmn6ps\videos\_eel\qgtwvwhnjohyh0 tv.swf
swf
File
users\ciihmnxmn6ps\desktop\ccqskcj2ss\85kqqfxpbtbepm1ws\na0n0w_tvh__rg.bmp
users\ciihmnxmn6ps\desktop\ccqskcj2ss\85kqqfxpbtbepm1ws\na0n0w_tvh__rg.bmp
c:\
c:\users\ciihmnxmn6ps\desktop\ccqskcj2ss\85kqqfxpbtbepm1ws\na0n0w_tvh__rg.bmp
bmp
File
users\ciihmnxmn6ps\desktop\ccqskcj2ss\fkya9y5pgzm9_q\22-j61dy1gkz.jpg
users\ciihmnxmn6ps\desktop\ccqskcj2ss\fkya9y5pgzm9_q\22-j61dy1gkz.jpg
c:\
c:\users\ciihmnxmn6ps\desktop\ccqskcj2ss\fkya9y5pgzm9_q\22-j61dy1gkz.jpg
jpg
File
users\public\libraries\recordedtv.library-ms
users\public\libraries\recordedtv.library-ms
c:\
c:\users\public\libraries\recordedtv.library-ms
library-ms
File
users\ciihmnxmn6ps\desktop\ccqskcj2ss\fkya9y5pgzm9_q\ins8esh4idpaiiypl td.avi
users\ciihmnxmn6ps\desktop\ccqskcj2ss\fkya9y5pgzm9_q\ins8esh4idpaiiypl td.avi
c:\
c:\users\ciihmnxmn6ps\desktop\ccqskcj2ss\fkya9y5pgzm9_q\ins8esh4idpaiiypl td.avi
avi
File
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\gl54xs.odt
users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\gl54xs.odt
c:\
c:\users\ciihmnxmn6ps\documents\wzso9vkmm1pxfg\us_5u4ni7qwinoue\iszluu\gl54xs.odt
odt
File
bootmgr
bootmgr
c:\
c:\bootmgr
File
users\ciihmnxmn6ps\documents\my music\ciopreadme.txt
users\ciihmnxmn6ps\documents\my music\ciopreadme.txt
c:\
c:\users\ciihmnxmn6ps\documents\my music\ciopreadme.txt
txt
File
users\ciihmnxmn6ps\documents\my pictures\ciopreadme.txt
users\ciihmnxmn6ps\documents\my pictures\ciopreadme.txt
c:\
c:\users\ciihmnxmn6ps\documents\my pictures\ciopreadme.txt
txt
File
users\ciihmnxmn6ps\my documents\zzakb_at-x eadqbsw\zdz3oj-bfmju.wav
users\ciihmnxmn6ps\my documents\zzakb_at-x eadqbsw\zdz3oj-bfmju.wav
c:\
c:\users\ciihmnxmn6ps\my documents\zzakb_at-x eadqbsw\zdz3oj-bfmju.wav
wav
File
users\ciihmnxmn6ps\my documents\zzakb_at-x eadqbsw\ciopreadme.txt
users\ciihmnxmn6ps\my documents\zzakb_at-x eadqbsw\ciopreadme.txt
c:\
c:\users\ciihmnxmn6ps\my documents\zzakb_at-x eadqbsw\ciopreadme.txt
txt
File
users\ciihmnxmn6ps\nethood\zzakb_at-x eadqbsw\zdz3oj-bfmju.wav
users\ciihmnxmn6ps\nethood\zzakb_at-x eadqbsw\zdz3oj-bfmju.wav
c:\
c:\users\ciihmnxmn6ps\nethood\zzakb_at-x eadqbsw\zdz3oj-bfmju.wav
wav
File
users\ciihmnxmn6ps\nethood\zzakb_at-x eadqbsw\ciopreadme.txt
users\ciihmnxmn6ps\nethood\zzakb_at-x eadqbsw\ciopreadme.txt
c:\
c:\users\ciihmnxmn6ps\nethood\zzakb_at-x eadqbsw\ciopreadme.txt
txt
Mutex
^_-HappyLife^_-
File
STD_OUTPUT_HANDLE
File
STD_INPUT_HANDLE
File
STD_ERROR_HANDLE
File
users\ciihmnxmn6ps\desktop\clearnetworkdns_11-22-33.bat
users\ciihmnxmn6ps\desktop\clearnetworkdns_11-22-33.bat
c:\
c:\users\ciihmnxmn6ps\desktop\clearnetworkdns_11-22-33.bat
bat
WinRegistryKey
Software\Policies\Microsoft\Windows\System
HKEY_CURRENT_USER
WinRegistryKey
Software\Microsoft\Command Processor
HKEY_LOCAL_MACHINE
DisableUNCCheck
EnableExtensions
DelayedExpansion
DefaultColor
CompletionChar
PathCompletionChar
AutoRun
WinRegistryKey
Software\Microsoft\Command Processor
HKEY_CURRENT_USER
DisableUNCCheck
EnableExtensions
DelayedExpansion
DefaultColor
CompletionChar
PathCompletionChar
AutoRun
Analyzed Sample #502430
Malware Artifacts
502430
Sample-ID: #502430
Job-ID: #685837
This sample was analyzed by VMRay Analyzer 2.3.2 on a Windows 10 Threshold 1 system
100
VTI Score based on VTI Database Version 3.1
Metadata of Sample File #502430
Submission-ID: #856582
a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.exe
exe
MD5
a04eb443870896fbe9a0b6468c4844f7
SHA1
e3001ef25b1386763caec9b5339ec6ddb0275a71
SHA256
a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02
Opened_By
Metadata of Analysis for Job-ID #685837
Timeout
LHNIWSJ
win10_64_th1
LHNIWSJ
True
x86 64-bit
True
Windows 10 Threshold 1
10.0.10240.16384 (c68ee22f-dcf6-4778-95c5-4a862be16567)
240.017
CIiHmnxMn6Ps
This is a property collection for additional information of VMRay analysis
VMRay Analyzer
Anti Analysis
VTI rule match with VTI rule score 1/5
vmray_dynamic_api_usage_by_api
Resolves an unusually high number of APIs.
Resolves APIs dynamically
Process
VTI rule match with VTI rule score 1/5
vmray_create_process_with_hidden_window
The process "C:\Users\CIiHmnxMn6Ps\Desktop\clearnetworkdns_11-22-33.bat" starts with hidden window.
Creates process with hidden window
Process
VTI rule match with VTI rule score 1/5
vmray_install_ipc_endpoint
Creates mutex with name "^_-HappyLife^_-".
Creates system object
Anti Analysis
VTI rule match with VTI rule score 2/5
vmray_delay_execution_by_sleep
One thread sleeps more than 5 minutes.
Delays execution
File System
VTI rule match with VTI rule score 1/5
vmray_create_many_files
Creates an unusually large number of files.
Creates an unusually large number of files
File System
VTI rule match with VTI rule score 5/5
vmray_encrypt_user_files
Encrypts the content of multiple user files. This is an indicator for ransomware.
Encrypts content of user files