a867deb1...fb02 | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Wiper, Ransomware

a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02 (SHA256)

SCN0tification.exe

Windows Exe (x86-32)

Created at 2019-03-02 17:30:00

...

Notifications (2/2)

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

The overall sleep time of all monitored processes was truncated from "12 hours, 46 minutes" to "6 minutes, 30 seconds" to reveal dormant functionality.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0xd34 Analysis Target High (Elevated) scn0tification.exe "C:\Users\CIiHmnxMn6Ps\Desktop\SCN0tification.exe" -
#2 0xdac Child Process High (Elevated) cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\CIiHmnxMn6Ps\Desktop\clearnetworkdns_11-22-33.bat" " #1
#4 0xe1c Child Process High (Elevated) vssadmin.exe vssadmin Delete Shadows /all /quiet #2
#5 0xe60 Child Process High (Elevated) vssadmin.exe vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB #2

Behavior Information - Grouped by Category

Process #1: scn0tification.exe
3143 0
»
Information Value
ID #1
File Name c:\users\ciihmnxmn6ps\desktop\scn0tification.exe
Command Line "C:\Users\CIiHmnxMn6Ps\Desktop\SCN0tification.exe"
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:00:53, Reason: Analysis Target
Unmonitor End Time: 00:04:57, Reason: Terminated by Timeout
Monitor Duration 00:04:04
OS Process Information
»
Information Value
PID 0xd34
Parent PID 0x57c (c:\windows\explorer.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x D38
0x D3C
0x D68
0x D7C
0x D80
0x D84
0x D88
0x D8C
0x F44
0x F48
0x F60
0x F64
0x F68
0x F6C
0x F70
0x F74
0x F78
0x F7C
0x F80
0x F84
0x F88
0x F8C
0x F90
0x F94
0x F98
0x F9C
0x FA0
0x FA4
0x FA8
0x FAC
0x FB0
0x FB4
0x FB8
0x FBC
0x FC0
0x FC4
0x FC8
0x FCC
0x FD0
0x FD4
0x FD8
0x FDC
0x FE0
0x FE4
0x FE8
0x FEC
0x FF0
0x FF4
0x FF8
0x FFC
0x 910
0x 754
0x 264
0x C28
0x C30
0x C34
0x D0
0x A90
0x C4C
0x B6C
0x 5B8
0x 61C
0x B64
0x 4F0
0x 554
0x A10
0x 924
0x 8C4
0x B80
0x 648
0x AE4
0x 51C
0x 90C
0x AD8
0x 618
0x 788
0x 858
0x A5C
0x 7FC
0x 8D0
0x AF4
0x 7C4
0x 15C
0x 204
0x 340
0x 434
0x 70C
0x 414
0x A60
0x 510
0x AD4
0x AEC
0x 384
0x 2BC
0x 4E8
0x 538
0x B24
0x 54C
0x 3A0
0x 804
0x 60C
0x C24
0x 5C0
0x 860
0x 954
0x 878
0x 518
0x C78
0x C74
0x CAC
0x CF4
0x C8C
0x C98
0x CA0
0x C9C
0x C94
0x CA4
0x CB0
0x C88
0x C84
0x C90
0x CA8
0x D08
0x D2C
0x C50
0x C54
0x 900
0x 5BC
0x 98C
0x C80
0x 270
0x B38
0x D28
0x CEC
0x 2EC
0x A94
0x 148
0x 4F8
0x 8A4
0x 378
0x 3DC
0x 890
0x AE8
0x 7B8
0x A7C
0x A8C
0x 7A0
0x EC
0x D14
0x D20
0x D30
0x D18
0x D10
0x CCC
0x CE0
0x CE4
0x CF8
0x CD0
0x CC8
0x C70
0x C6C
0x C5C
0x C64
0x C68
0x C7C
0x C60
0x C58
0x 790
0x DC4
0x 3C0
0x DF4
0x DEC
0x 764
0x E0C
0x E04
0x D44
0x E24
0x E28
0x E2C
0x E30
0x D40
0x D4C
0x D50
0x D54
0x D58
0x D5C
0x E40
0x E10
0x E4C
0x E48
0x E20
0x E38
0x E3C
0x E34
0x E1C
0x E64
0x E6C
0x E68
0x E60
0x DCC
0x DB0
0x DD8
0x DAC
0x DD4
0x DC8
0x DC0
0x E58
0x E7C
0x E78
0x E18
0x C40
0x C48
0x ED0
0x ED4
0x EBC
0x EFC
0x C3C
0x 114
0x CBC
0x 56C
0x 9B4
0x 8E0
0x 920
0x 92C
0x B70
0x BAC
0x 950
0x EB8
0x 0
0x EA4
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
private_0x0000000000020000 0x00020000 0x00023fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00031fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00030fff Private Memory rw True False False -
pagefile_0x0000000000040000 0x00040000 0x00053fff Pagefile Backed Memory r True False False -
private_0x0000000000060000 0x00060000 0x0009ffff Private Memory rw True False False -
private_0x00000000000a0000 0x000a0000 0x0019ffff Private Memory rw True False False -
pagefile_0x00000000001a0000 0x001a0000 0x001a3fff Pagefile Backed Memory r True False False -
pagefile_0x00000000001b0000 0x001b0000 0x001b0fff Pagefile Backed Memory r True False False -
private_0x00000000001c0000 0x001c0000 0x001c1fff Private Memory rw True False False -
locale.nls 0x001d0000 0x0028dfff Memory Mapped File r False False False -
private_0x0000000000290000 0x00290000 0x00290fff Private Memory rw True False False -
private_0x00000000002a0000 0x002a0000 0x002affff Private Memory rw True False False -
private_0x00000000002b0000 0x002b0000 0x002b0fff Private Memory rwx True False False -
private_0x00000000002c0000 0x002c0000 0x002cffff Private Memory rw True False False -
private_0x00000000002d0000 0x002d0000 0x0030ffff Private Memory rw True False False -
private_0x0000000000310000 0x00310000 0x0037ffff Private Memory rw True False False -
private_0x0000000000310000 0x00310000 0x00325fff Private Memory rw True False False -
private_0x0000000000310000 0x00310000 0x0031ffff Private Memory rw True False False -
private_0x0000000000310000 0x00310000 0x00323fff Private Memory rw True False False -
pagefile_0x0000000000310000 0x00310000 0x00317fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000310000 0x00310000 0x00310fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000320000 0x00320000 0x00320fff Pagefile Backed Memory r True False False -
private_0x0000000000320000 0x00320000 0x0032ffff Private Memory rw True False False -
pagefile_0x0000000000320000 0x00320000 0x00327fff Pagefile Backed Memory rw True False False -
mpr.dll.mui 0x00320000 0x00320fff Memory Mapped File r False False False -
private_0x0000000000330000 0x00330000 0x00349fff Private Memory rw True False False -
pagefile_0x0000000000350000 0x00350000 0x00357fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000350000 0x00350000 0x00350fff Pagefile Backed Memory r True False False -
cversions.2.db 0x00360000 0x00363fff Memory Mapped File r True False False -
private_0x0000000000370000 0x00370000 0x0037ffff Private Memory rw True False False -
cversions.2.db 0x00380000 0x00383fff Memory Mapped File r True False False -
private_0x0000000000390000 0x00390000 0x0039ffff Private Memory rw True False False -
private_0x00000000003a0000 0x003a0000 0x003dffff Private Memory rw True False False -
propsys.dll.mui 0x003e0000 0x003f0fff Memory Mapped File r False False False -
scn0tification.exe 0x00400000 0x00437fff Memory Mapped File rwx True True False
...
private_0x0000000000440000 0x00440000 0x0053ffff Private Memory rw True False False -
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000013.db 0x00540000 0x00582fff Memory Mapped File r True False False -
cversions.1.db 0x00590000 0x00593fff Memory Mapped File r True False False -
pagefile_0x0000000000590000 0x00590000 0x00590fff Pagefile Backed Memory rw True False False -
private_0x0000000000590000 0x00590000 0x00593fff Private Memory rw True False False -
private_0x00000000005a0000 0x005a0000 0x0069ffff Private Memory rw True False False -
pagefile_0x00000000006a0000 0x006a0000 0x00827fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000830000 0x00830000 0x009b0fff Pagefile Backed Memory r True False False -
pagefile_0x00000000009c0000 0x009c0000 0x01dbffff Pagefile Backed Memory r True False False -
private_0x0000000001dc0000 0x01dc0000 0x01ebffff Private Memory rw True False False -
private_0x0000000001ec0000 0x01ec0000 0x01fbffff Private Memory rw True False False -
sortdefault.nls 0x01fc0000 0x022f6fff Memory Mapped File r False False False -
private_0x0000000002300000 0x02300000 0x023bffff Private Memory rw True False False -
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db 0x02300000 0x0238afff Memory Mapped File r True False False -
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db 0x02390000 0x023a2fff Memory Mapped File r True False False -
private_0x00000000023b0000 0x023b0000 0x023bffff Private Memory rw True False False -
pagefile_0x00000000023c0000 0x023c0000 0x023c0fff Pagefile Backed Memory rw True False False -
private_0x00000000023d0000 0x023d0000 0x0240ffff Private Memory rw True False False -
private_0x0000000002410000 0x02410000 0x0250ffff Private Memory rw True False False -
private_0x0000000002510000 0x02510000 0x0254ffff Private Memory rw True False False -
private_0x0000000002550000 0x02550000 0x0264ffff Private Memory rw True False False -
private_0x0000000002650000 0x02650000 0x0268ffff Private Memory rw True False False -
private_0x0000000002690000 0x02690000 0x0278ffff Private Memory rw True False False -
private_0x0000000002790000 0x02790000 0x027cffff Private Memory rw True False False -
private_0x00000000027d0000 0x027d0000 0x028cffff Private Memory rw True False False -
private_0x00000000028d0000 0x028d0000 0x0290ffff Private Memory rw True False False -
private_0x0000000002910000 0x02910000 0x02a0ffff Private Memory rw True False False -
private_0x0000000002a10000 0x02a10000 0x02a4ffff Private Memory rw True False False -
private_0x0000000002a50000 0x02a50000 0x02b4ffff Private Memory rw True False False -
private_0x0000000002b50000 0x02b50000 0x02b8ffff Private Memory rw True False False -
private_0x0000000002b90000 0x02b90000 0x02c8ffff Private Memory rw True False False -
private_0x0000000002c90000 0x02c90000 0x02ca5fff Private Memory rw True False False -
private_0x0000000002c90000 0x02c90000 0x02ccffff Private Memory rw True False False -
private_0x0000000002cd0000 0x02cd0000 0x02dcffff Private Memory rw True False False -
private_0x0000000002dd0000 0x02dd0000 0x02e0ffff Private Memory rw True False False -
private_0x0000000002e10000 0x02e10000 0x02f0ffff Private Memory rw True False False -
private_0x0000000002f10000 0x02f10000 0x02f10fff Private Memory rw True False False -
winre.wim 0x02f10000 0x031ecfff Memory Mapped File rw True True False
...
private_0x0000000002f20000 0x02f20000 0x02f20fff Private Memory rw True False False -
private_0x0000000002f30000 0x02f30000 0x02f6ffff Private Memory rw True False False -
private_0x0000000002f70000 0x02f70000 0x0306ffff Private Memory rw True False False -
boot.sdi 0x03070000 0x0334cfff Memory Mapped File rw True True False
...
wow64cpu.dll 0x5baa0000 0x5baa7fff Memory Mapped File rwx False False False -
wow64win.dll 0x5bab0000 0x5bb22fff Memory Mapped File rwx False False False -
wow64.dll 0x5bb30000 0x5bb7efff Memory Mapped File rwx False False False -
iertutil.dll 0x73ef0000 0x741b0fff Memory Mapped File rwx False False False -
urlmon.dll 0x741c0000 0x7431ffff Memory Mapped File rwx False False False -
userenv.dll 0x74210000 0x74228fff Memory Mapped File rwx False False False -
browcli.dll 0x74230000 0x7423efff Memory Mapped File rwx False False False -
netutils.dll 0x74240000 0x74249fff Memory Mapped File rwx False False False -
cscapi.dll 0x74250000 0x7425efff Memory Mapped File rwx False False False -
wkscli.dll 0x74260000 0x7426ffff Memory Mapped File rwx False False False -
davhlpr.dll 0x74270000 0x7427afff Memory Mapped File rwx False False False -
davclnt.dll 0x74280000 0x74299fff Memory Mapped File rwx False False False -
ntlanman.dll 0x742a0000 0x742b1fff Memory Mapped File rwx False False False -
winsta.dll 0x742c0000 0x74303fff Memory Mapped File rwx False False False -
drprov.dll 0x74310000 0x74318fff Memory Mapped File rwx False False False -
rsaenh.dll 0x74320000 0x7434efff Memory Mapped File rwx False False False -
cryptsp.dll 0x74350000 0x74362fff Memory Mapped File rwx False False False -
propsys.dll 0x74370000 0x744b1fff Memory Mapped File rwx False False False -
mpr.dll 0x744c0000 0x744d6fff Memory Mapped File rwx False False False -
bcrypt.dll 0x744e0000 0x744fafff Memory Mapped File rwx False False False -
winspool.drv 0x74500000 0x74566fff Memory Mapped File rwx False False False -
comctl32.dll 0x74570000 0x74601fff Memory Mapped File rwx False False False -
uxtheme.dll 0x74630000 0x746a4fff Memory Mapped File rwx False False False -
apphelp.dll 0x746b0000 0x74740fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74750000 0x747a8fff Memory Mapped File rwx False False False -
cryptbase.dll 0x747b0000 0x747b9fff Memory Mapped File rwx False False False -
sspicli.dll 0x747c0000 0x747ddfff Memory Mapped File rwx False False False -
crypt32.dll 0x74880000 0x749f4fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x74a00000 0x74aabfff Memory Mapped File rwx False False False -
kernel.appcore.dll 0x74ab0000 0x74abbfff Memory Mapped File rwx False False False -
shlwapi.dll 0x74da0000 0x74de3fff Memory Mapped File rwx False False False -
msctf.dll 0x74df0000 0x74f0ffff Memory Mapped File rwx False False False -
imm32.dll 0x74f10000 0x74f3afff Memory Mapped File rwx False False False -
kernel32.dll 0x74f40000 0x7502ffff Memory Mapped File rwx False False False -
gdi32.dll 0x75030000 0x7517cfff Memory Mapped File rwx False False False -
profapi.dll 0x75180000 0x7518efff Memory Mapped File rwx False False False -
kernelbase.dll 0x75190000 0x75305fff Memory Mapped File rwx False False False -
shell32.dll 0x75310000 0x766cefff Memory Mapped File rwx False False False -
comdlg32.dll 0x766d0000 0x7678dfff Memory Mapped File rwx False False False -
windows.storage.dll 0x76790000 0x76c6cfff Memory Mapped File rwx False False False -
user32.dll 0x76c70000 0x76daffff Memory Mapped File rwx False False False -
msvcrt.dll 0x76f20000 0x76fddfff Memory Mapped File rwx False False False -
clbcatq.dll 0x76fe0000 0x77061fff Memory Mapped File rwx False False False -
msasn1.dll 0x77070000 0x7707dfff Memory Mapped File rwx False False False -
cfgmgr32.dll 0x77080000 0x770b5fff Memory Mapped File rwx False False False -
oleaut32.dll 0x770d0000 0x77161fff Memory Mapped File rwx False False False -
ole32.dll 0x77170000 0x77259fff Memory Mapped File rwx False False False -
powrprof.dll 0x77260000 0x772a3fff Memory Mapped File rwx False False False -
sechost.dll 0x772b0000 0x772f2fff Memory Mapped File rwx False False False -
shcore.dll 0x77300000 0x7738cfff Memory Mapped File rwx False False False -
combase.dll 0x77390000 0x77549fff Memory Mapped File rwx False False False -
advapi32.dll 0x77550000 0x775cafff Memory Mapped File rwx False False False -
ntdll.dll 0x776b0000 0x77828fff Memory Mapped File rwx False False False -
private_0x000000007fe95000 0x7fe95000 0x7fe97fff Private Memory rw True False False -
private_0x000000007fe98000 0x7fe98000 0x7fe9afff Private Memory rw True False False -
private_0x000000007fe9b000 0x7fe9b000 0x7fe9dfff Private Memory rw True False False -
private_0x000000007fe9e000 0x7fe9e000 0x7fea0fff Private Memory rw True False False -
private_0x000000007fea1000 0x7fea1000 0x7fea3fff Private Memory rw True False False -
private_0x000000007fea4000 0x7fea4000 0x7fea6fff Private Memory rw True False False -
private_0x000000007fea7000 0x7fea7000 0x7fea9fff Private Memory rw True False False -
private_0x000000007feaa000 0x7feaa000 0x7feacfff Private Memory rw True False False -
private_0x000000007fead000 0x7fead000 0x7feaffff Private Memory rw True False False -
pagefile_0x000000007feb0000 0x7feb0000 0x7ffaffff Pagefile Backed Memory r True False False -
pagefile_0x000000007ffb0000 0x7ffb0000 0x7ffd2fff Pagefile Backed Memory r True False False -
private_0x000000007ffd5000 0x7ffd5000 0x7ffd7fff Private Memory rw True False False -
private_0x000000007ffd8000 0x7ffd8000 0x7ffdafff Private Memory rw True False False -
private_0x000000007ffdb000 0x7ffdb000 0x7ffddfff Private Memory rw True False False -
private_0x000000007ffde000 0x7ffde000 0x7ffdefff Private Memory rw True False False -
private_0x000000007ffdf000 0x7ffdf000 0x7ffdffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7ffc57b4ffff Private Memory r True False False -
ntdll.dll 0x7ffc57b50000 0x7ffc57d11fff Memory Mapped File rwx False False False -
private_0x00007ffc57d12000 0x7ffc57d12000 0x7ffffffeffff Private Memory r True False False -
For performance reasons, the remaining 120 entries are omitted.
The remaining entries can be found in flog.txt.
Created Files
»
Filename File Size Hash Values YARA Match Actions
\\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\g8L7418FmZslF.wav.CIop 26.37 KB MD5: 154aee6ab94f5b023687d36b9d89c79c
SHA1: fcc061ef2cd8371c2cbd5c0eb8ce8499f58aac38
SHA256: 1c3d8947e66633fec650207ec933c276cb810269210525431a8857b902b9d676
SSDeep: 768:XpI8798hRCRbhoNl37F926WOKH9h/Li/tGX78HFyl7FqN:XphuC143n2Rhni1GwHFyHi 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\0KK10L8Yj9PSdD5_rlI8.pptx.CIop 2.10 KB MD5: bb37723a2bf99aa3da01fd2fcc55275f
SHA1: c570c8f7112c1b2d124d179ef2d4335af61247fb
SHA256: 21d5502f119889a86b564df49829f36023acfdf57ad1a10b290e9f2f6ca1fec3
SSDeep: 48:8iB4C7d46H9Pf7Zz0BkO5Pq130qQJmrkdAuZw7dVPRk:8ii27dLZzcPs0NIrkZb 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\FnCzF1A7H gxenH83.pptx.CIop 16.00 KB MD5: 501921d7dc51ec92bc71343757a5c772
SHA1: 6dad21b1b1113ef0b241def099c30eb04d832f11
SHA256: 2534e1be77022d8716db58e17966e718dce111a6f7b848beb5418201d6ca6167
SSDeep: 384:IELfyehkYDsVSB1zYMKWuU0XFuBcNE+GFFqYTZL8yw7bA:P7LhkYDswzzYMqF6cq+GuYTZoyw7U 		False
...
\\?\C:\Recovery\WindowsRE\boot.sdi 3.02 MB MD5: 88a02e4e89be9931cac88d6f1e9e6fcb
SHA1: d2084e3c2f3114a53b5890f4e3abf7d812eed606
SHA256: c621b9135c2fe470b16e287f3f8c1f29817ed85f058b76d49536edc287cf309f
SSDeep: 98304:z138O4SxhVJD6A8NdHooe19i5nhBPkotyJ:xR4SXYdIRTUhBQ 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\Eowo0nLnhzDtXx7wGkmW.mp4.CIop 25.32 KB MD5: 23728cb401a013e8e113f42c9f10ed9c
SHA1: 502838af620c64ec7727fca9f14c60fcc820c52a
SHA256: 5568116bc71a061728e3aba7b6d852afcaa4a12f9e2f9280d8a7d142747eaa2c
SSDeep: 384:YRgw0gbjFs0uG8BhMusVBG9cpRLAdaXsxSY8gV4X5XQvmEy5DefJFnckfzihwkWJ:YazdDn9cpOEa8gGEysvzlDNn 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Favorites\Bing.url.CIop 0.33 KB MD5: 167857e7cd0be8cdf58f7b0112ec2efd
SHA1: da7aa486486321e688e772720b5ca8b2fe6898fd
SHA256: e1be7b6faa59b5160043312753b5e162d2a9ad27eef67a8edb3795ee71524bba
SSDeep: 6:6Pu16JB3IV2uFGPUzymB3OxqEPz/pLmE7hO89nNzK5cUxRDBFzVzYYibcN3NuMBn:Gu18W2uFcAW3pLmeFVN+5pxJvZibcNdN 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\3IveDjbz33f.mkv.CIop 66.65 KB MD5: 0158b3a7815dcbb48f4665d3126ab786
SHA1: c1af37dcb803d5438fbc8fffc24246a8f5a432f8
SHA256: 3d534d5f31305817fa95a5cca42cc10914fc4b906993700448189f6520813d7c
SSDeep: 1536:w9C98HG9FYd93EvylUuavPBZ/UtYnexou6KR6Y:kU8Haid9/UdvPBZs7ozLY 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\w w7R5kGwiD8.mkv.CIop 3.86 KB MD5: 10173d9bfc7804c0556f85d82c838df6
SHA1: b4db26f644699d8f253fd1f6246e4cb732fbcd8e
SHA256: d4e96f620eae8b55d4311ad93ad4b815db5167bd1be180ae6936c32f8d3a93de
SSDeep: 96:c7YxMKF3Uk2k4XtlbV/+hen8zg6IJTYRxR3uFFyTx:ckeKdbtm/+heixINsCF+x 		False
...
\\?\C:\Recovery\WindowsRE\Winre.wim 10.00 MB MD5: 4127808520f1f3656db64ea6f3848ee7
SHA1: 73ef69e3c39a5161d5557bc2bd4106f123308753
SHA256: 59f17da9b319a40d69ed648d6914dd09cbf7e4a24413231a3370d66df22aec3d
SSDeep: 196608:PKSpk2zfH2/NC8slvMJMyRRW1pcfF2Q4U0DLgywFXBnHtykX6:ySO2zWs8sGJ5A1pcf0QF0PXwFRnHtM 		False
...
\\?\C:\Users\Public\Libraries\RecordedTV.library-ms.CIop 1.11 KB MD5: 94ac350bae4ba9a22afe54fdaae23836
SHA1: b22d1aee151c0808fdaba715721186a499db7034
SHA256: add24c50a8993c17ef6de0fc61ab80b89ebcfd7f0ae7dbeb1be9f263b38220e7
SSDeep: 24:TB1NODIRD4Y0yAWk/GhuFZA4t6nulq8GSQr9KX3t64g87gXR:TjNO8D4Nvt/jA4DY8Kkg4gqeR 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\N6 e0qhUxBM.bmp.CIop 28.99 KB MD5: e7567739290e56b1e0cb6e5a558fdc08
SHA1: 0a83e9e2aa3893ad2da89a8dc997fc0b4dfaeef4
SHA256: 62806380438eaabd3c002ef05bda53c207d1794875cb7dd95e238848de9ac34d
SSDeep: 768:sPXujG21re8pWcKcG6uO4L5IRpD/gp+PCQfRnIdf+:6uDZBlKC4L5KD/gtMof+ 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\2SXCpVLNs73BQPAtgxC.png.CIop 78.79 KB MD5: 95c3414bf0d683014a8badd1a397311d
SHA1: 1ff4f782ac249b843e4c59c18274bfa0751b3ce4
SHA256: 91052b9ca22cd1f5d8e643c882478e12d2c638e819e10bb1469bc5edafd81026
SSDeep: 1536:Ewd/3KoGRLdsJg0IG5fVvEQSrSy6HjeI5F0TLxOLzHGUtVA3Y:E6PKdBwg0VFSrL6HjeEGTLxOnH9CY 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\62uD.avi.CIop 25.52 KB MD5: f837c42c8024cd6cc5456827689220ec
SHA1: 622cb3814f245dd63e5589b914e75cf0680a2978
SHA256: 61de804f8e702e9328502bcbdaa09dd9ba059a34ad047c3d31c40663a02ddf7f
SSDeep: 384:No2TL4fkuMQn5DJslOHwiLKJ07++LXkSEFAb7nt/CoNDodoaAL2K/j02Vqw9JI:No23vuM0tNHvWqB0UBhDodoJ3/LVI 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\hGqTnSOKZQ5a1.ods.CIop 49.01 KB MD5: f758323c28e83f5fc0fbd8d72dabcc97
SHA1: fb313a7ae4defc9b76198735d9e9c21d3826425b
SHA256: c1f6cb626e1931b5244257ea884c973feae4c88be8333ccdbe3e81085551a7b3
SSDeep: 768:rhd3W7WqOs1mhdCNQDHV2CzSRs1jqJmCMAJyyI6hZnF2AVGZ90SgGkE:ri7mAQx7SRs1jqkCNw0hSaD/GD 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\lqlP4y.wav.CIop 92.70 KB MD5: 47dbc43380ac7154e923da3cbe3d9c42
SHA1: 1bb84f5e2e2aac8f265fcc1348603d2985e7cf43
SHA256: 2a6def158390741579c01f994c9797f71bfa4bbd84e577a28467402696bf85b8
SSDeep: 1536:Sq/JT4b+nVfxEY0UCDxtp1KA8WMHbliTxCzFXsMktrqtYrl4WsfRRHGzRulrPa7V:SqpWafC7DxzJ8Web4JUyrlSlBs 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\dizklXpXe.ppt.CIop 75.92 KB MD5: 1c4f14b3186bd518c86ee85534fa1209
SHA1: b9295aee7e0a9a3a227e2783bba3d8fd47085994
SHA256: eb76e3f7e535cf4a852fe3f8548d466b2a003f28e60fdcbad3ed8e77dd9fb99c
SSDeep: 1536:M9q1DI2yDn11xELWl8qJMrvFyOVjAXpTOSG5TxXRyyiLwN/AYT04YXLFRfQpmFZL:MgBy5Zl8ncpe5TxdBAYbSLFRfpPL 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\z8Pr_v.mp3.CIop 49.77 KB MD5: dabb7f293ae4b6bacfabee56c3c0e197
SHA1: a4df89dab3cb65d6bccdb71f8dfbfc6dc2490e8e
SHA256: d85dbcae0d27f2798acc924f228bf010df63029c5634f860b06ccaae6e5efa51
SSDeep: 768:EQBpwx47X66Y5CfEhQT4wX1COusVHAtcdrOR0pb:HpwyzFvfEhjcUIVLdrtb 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\mlv6Gzv7Da-BgmdC.docx.CIop 67.20 KB MD5: 0baf4bb17fd05aa235a91ffd40fc3ad3
SHA1: 533876bb66e38af17de221ba46d4670c2f9989a2
SHA256: 7ac4ea0ed8319f05720f3893d15e5c714b5d460e287ff60555fa49e12b673a63
SSDeep: 1536:tO1Nph/V2icyclYdz8QIJ9I4tpELO32k47bpyspiaxecpZoQZ:tOFhd2mhYQI3IuN32k471ys1xelQZ 		False
...
C:\CIopReadMe.txt 1.84 KB MD5: e04a195c34b605286fbf1b6e3ae48ea8
SHA1: aabf5de2dbe86487229b9a39e050c2af76679dc7
SHA256: d686127553bc8f72d8441ad441afa795fde914550fdb9fad46889e8fe1019ed7
SSDeep: 48:LqfsW9FjQ5G1I5c4O3lowslY6emGT/WQZ:L+sYjJy5c4OVotK6tE/Wa 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\_eEl\Q07hPTbYaA2sSmp7JYW8.swf.CIop 59.91 KB MD5: c38cd38e829cd8978a7054123f6b6079
SHA1: 3e689f4b575d576ca761ff67a2a9a1c69092aa7b
SHA256: f999e24e58e5fded00733be4dd0e318b402396c41a5de081cc2d3ee361f49765
SSDeep: 768:KeKjwiIBmcs1GByqA5YyD9UNPV5F5fIRm5TPqEZVeZaqG+i6cT6ivWD5865VAN2j:e0lBfsOXnVCUlPoGZ6ct6D1Fq41sjY/x 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\0-Tv sYMFqGkma 6x.wav.CIop 16.76 KB MD5: f9854b579a121ffaa0750c5e16649192
SHA1: e48f45e549838c4cdc72ff0b85c02c93c79cfd55
SHA256: 84e44f4df33d59eaf4015d9531c3f8d551ba320c1a8ed657fa4d54d6c4ead2e3
SSDeep: 384:WkSlXmwShikYwj96pLZvjbG8xqhtcJ0NdytvyqFs88X:TSlXmwUrYnPbRcAJ/VP38X 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\Y_62XF6X1FjEo5B7P.avi.CIop 21.73 KB MD5: 26831f08d10434527cb2e9e0d76a5b26
SHA1: e496d057dd379d2b485874c5741af71a306315b5
SHA256: 5a531e3b33e8bd6779d3879ec8d7bbb71587bd571b1831ed33a7d8d58b0c376c
SSDeep: 384:riR1EAGlM4zwImqlZUFJk95JoqfQggf2XUR8gjrLgh9hD+/aeQ:ri4tM4zpmqlmFu6pRfWUKgj/e9hDSaJ 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\Y_LI3 4-qP.m4a.CIop 71.81 KB MD5: 772e47bbdb35ff40ca216b56b85a1bca
SHA1: 6ba9fece85cc199143695aba9b748bd8b449057a
SHA256: c7cbefff4887e88eea8d5fe19fdcd0d4656bc7a838fd0b884af65cd3ef27590a
SSDeep: 1536:7IoLwxbW+xkO/EolLqk5mp9vyAjHThf0ohiHz2xPBKl:7Io2bfxkapikAjHT2ohGzQsl 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\tyDDeYuppbUilesSL.odt.CIop 80.73 KB MD5: ba24e713e475e8f02cbcdd520f3ff9d5
SHA1: eca9055d306ffa42a8e9a4a6f44433ff67f5fd19
SHA256: 71f6fda78fabd8fbdaeaf28604afaf8c5d46be6817687aea799d1b983757a01a
SSDeep: 1536:kKPb3ymWy5SrfUzkgnFBeIS/sf5qweKhBWe1dexKH+yU:kebSyMz6pS0fVhYq6KeyU 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\vv1t.doc.CIop 11.31 KB MD5: 1dee974b12dfd4a95e4daa4d0edacb4d
SHA1: f69ee3e9b5481af6a9b98a6ae91c36c98a08d8df
SHA256: 4cc062af6a35ba94b1a13db32f6119ea1207bf8df287c75dcd057e321083e305
SSDeep: 192:TnBS4qDr9Nwl3qXzwsqviOGhU88Qpnb3ytv6rHrMZCaPNIv7o0pKJpMPm9:TnY9Djwl3qDwEhbh5AirS1IvbpkMPm9 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\_7SiEN5ix Oq_lUu N.m4a.CIop 70.26 KB MD5: 7471a56962f72b773e3e922171be8600
SHA1: 7f1122a7c1e8dc6a0311ff4afbd922c411f4df0c
SHA256: a2e65f99c3efc71603d6683668a7b13b14175fe7d4c6d215c90f8d9293d118c2
SSDeep: 1536:p4FLfyh/HxSw/DckWTQuFITj6jCICfrshlUbffh4IITRNba5cMQ92:p4FLfkV/DATjF+FQMLh4XTRN8cMQg 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\eEmxkUZ3.wav.CIop 67.20 KB MD5: 9df36b645c0c17b3c8b636ad2c525cb4
SHA1: 746ddf4bc7f46d8b99665203740afb6efb4dc242
SHA256: a166daca8eec6043f70492a363b04839eb58bffb2df6bd3d1a22b5808f2a1813
SSDeep: 1536:57cY+dpLSxnOYpKfxwyq2W7xSDu01LuU4VGzJtEEJ/jks0DG6uzoSw25VxZN:57cYdnZqkX7Q1LTr0Dgzw2vN 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\zdZ3oJ-bfmJu.wav.CIop 19.28 KB MD5: 4fd152047a8d215b495a297e5fe63727
SHA1: 165ab6d8b07a4248ec8373569ac4c32b0d2ff4b4
SHA256: ad3647a7edd84713e4eeeba720dfa877fa97dd648f85fc802199396715109fde
SSDeep: 384:3MLaMon3OctohEIo2MPupibJ1+5UmsP7VLvhSbxK5xjIGzqjFRm:3MqrohEI4bPpBLobi0jFo 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\lAHCz7usAd.gif.CIop 26.34 KB MD5: 7a6c80194976e1ff589438c5e70bf049
SHA1: 8bb0eeef6d6892e7e3c3071824b40b70dfc76815
SHA256: 5b6abdfb1e9c350382952b3bf5313d6bae5dd9be752a2a817729aa70e3687718
SSDeep: 768:4dCWuSqkbp3EUF/tV1tES25B0tpikvsagyXFZcF:4dChS39XF3EUsFa5VZa 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\B-2cmW.doc.CIop 17.97 KB MD5: 3086c0250de56e5cfcc8b74fbaaf03d5
SHA1: ead511e5be1268a5f069f1f74e5d1cc33af1e76d
SHA256: c8243b0dae699913f35d1f14c50ab7754a7e4516c25f71693df1f80802396621
SSDeep: 384:g8cUWmwOqzZJaiZpJ+GkZwMxBmUeafrGJ9F36cyKFkNZuvQXwE:UvzjaiZp2yMxBbPfrm/QKGZsJE 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ROHZJx8ipU.mp3.CIop 92.73 KB MD5: 3f88d094ed21b3c9ae1f2f607b852b74
SHA1: f38dc8b9f76f135d767c2eefa631d71aaaaa6cf7
SHA256: aab553a7792088724118451b693645e1c6aaca0dd0c1ac890c069ed36c6500bc
SSDeep: 1536:aGOMTjHYFrEJf07f1VkupksTOez8qU94y9V0/UPpEy8v5Db9/aulAHNZ:aY2vpkyJsZb0/zvv5b9iqAHNZ 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\50YQIo4i.jpg.CIop 31.50 KB MD5: a5660b1ec0cddc2879e80b3f67743099
SHA1: fa5d965c04f144fa436e6f163187159154ecda17
SHA256: 1747f78925eacee84ea5f3fca0c80a05b888b7244cacd53efe6b7367d6101104
SSDeep: 768:pCdM+b7cb7N/mBxnmqDA6n1ax4tmgxEorhVji8tnzRz4o4S:6M+bIbxmBxmqEW84pxHrhVji8tnzRf4S 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\2HvoIrFtByws.mp3.CIop 37.54 KB MD5: 67457b2bb37e380648f27c8891ef9ab4
SHA1: 882154dbabfabb048305a794d3c3b1fff22762b1
SHA256: 82cd6cac7fcba877c3216afb42c9083edc4bbca410d67d02e69286148d05d227
SSDeep: 768:vXSaVjyh2MxV+YF/2y8a2EmJSaP6poSLoZTKCxTRe0gOtmx++lfL:vCbhdfB8a2EoSaP6po1xlxTRvg6mx3 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\obHPe.pptx.CIop 11.72 KB MD5: c19e9418714fcea0aa9117abd41056aa
SHA1: d920a95a79c88bcf83cf3f01182692c943dc727f
SHA256: f92a720107a55839d28227c998e9ce413fd04a5b1f4118ba6100452a9e8f35ff
SSDeep: 192:zEImtcBZZw7sLOJ7oWo9phmdgjQ6XMUZZq8mjtApW/MY+Egg5Sfn3Y9usy3q:IxmBZZx636kMVq8m70YWBfn3cus 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\IR-tjQBZzd_N5h-S0 pI.doc.CIop 57.59 KB MD5: 9c8805a38d4b39120e0022bd0136df6f
SHA1: d89685ff5a959289275cfdd41be2e62adb96e2a3
SHA256: af28db9925c8954038497ce1e87f487aa88cc58b982cdd29bb47d7a88d36915e
SSDeep: 1536:1gonC9Z4FFrrgS4Sfj4Pn5WaEd54in0LeZ956XUn6mNzmj21XhMs:1Xc+FQS3fInQ/P5YeX8ktzmqXF 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\H9o_U92tz2Ho9-mh.swf.CIop 18.90 KB MD5: f2e2b1a83258757112ea7b22d09f2395
SHA1: a41e3fae4aadfbd3bc0bf44ff3e6e700d3e9f1a5
SHA256: 26722e5dda8c801ac883d9949d48b62a8f371d40375e59ab7ed46dcbe46de0b3
SSDeep: 384:53us7U80rxja810fS5yRD4F0IiTXuLaVZfiDK/QKMa9eBRDIj2m:5+s7IvF5w6geYiWIAeDDQR 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\7Luf9iKqys 6\0eBemC7.bmp.CIop 81.97 KB MD5: 882697f7118b53a3ca71681e716947d1
SHA1: ba3f42dd2facec08df1ebb66061a50ee6f32ba05
SHA256: 4b8bc8aef82186aca95c57ca910a0062b2a7ba1d015b3699261d8cd21f9759f7
SSDeep: 1536:bxhLCXKADKiAYss1agJOPNIPAyYXhBg+C4THcomWZHP/LBtDPo1UBsErMVsnNG:NUX+xYJ1aGOPNIZkhe+7Tm0BtDkk84Y 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\o1_fy8.pptx.CIop 10.09 KB MD5: b92e3c0deb976311493c0867ec25f19e
SHA1: 3a4054f3439e73cc53461b3e9b46830447af3452
SHA256: 75d8fd088101659c22fbca0b94d2c9af98d6e267b4d04caa76e8a74374a533f3
SSDeep: 192:/IqsuC00tTRliL2R2oFLf7Z9YxlXOGI4aRUbv3mVHN7P:/rsuC0olk2R7FLf7Z94l+p4+HN7P 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\clearnetworkdns_11-22-33.bat 0.93 KB MD5: f7840e8e5f106572107932598b7c2592
SHA1: 379bd55eb0bf40eb1a7804959af8022b8eb6f0e7
SHA256: 0f107cd86bcfca29408499d6e0631a482623ad25f26e74898c26072e94fa6000
SSDeep: 12:B6rKIqKKIYeCuqKCuYefqKfYepqKpYeDqKDYeZSIqKZSIYdOHBXVdn:vIAIYhuQuYmhYwbYm9Y8zYe/d 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\fkya9Y5PGZm9_q\22-J61Dy1gKz.jpg.CIop 8.60 KB MD5: e15bd0a51ad554572ae9e221a3cf413c
SHA1: c5badf9af4a0ebbcbe127c6265a375239ba53603
SHA256: c9535080e0221b3a754af8525d007dfc02af78e52136e2ad0f6a12a8b5c30a78
SSDeep: 192:BGSUG9zxNUHD7rd6YNew7/B2LDVHX9Yb19Gut2bRqOJ5eKhpZt:BzJxNUrgw7APV3txF 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\FMVnxBVv7u9Rp.docx.CIop 65.96 KB MD5: 80089af56f61bff2fb043b7a61517909
SHA1: c710b154c4501ada5b712d85ebcb7b05f194ae3d
SHA256: 1499b6603666dc5dfd8758b773a0f60c780374db606f3bf6ab50705e528c3e20
SSDeep: 1536:pOdCPXaDhsBUXbRVOQdIHB5IirR13LPYUuX4AzQi9rcTV3fwBBR:byDmUXbzOiIHoirrbwpJzQi9r6VPwrR 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\gCLjM xynMaWR.xlsx.CIop 84.09 KB MD5: 52b0a4b17c95e3246572513028a32ddc
SHA1: f1fb72452f8fb2b5baca34a03d2135131eb06c23
SHA256: 6b6b0b7412fb92e666933444696f800628638f8ec5439d3617acf5e89cfc2f0b
SSDeep: 1536:rkSmWry5+MNZn457rcmXsMfUKy866yWkApDnUkom/cSLymNEdQFEIfD+naz:bmWry5lNZn4FcIhT8viDUko0P/N3FEIP 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\6w48s.rtf.CIop 84.58 KB MD5: 99c828a308f14622a0fdfc88183785ea
SHA1: a1b0c1a310b536e03372cb5015c8877843795f80
SHA256: 4e931cb91e98440e84d80a7d208071880cb2e83674120a55147d2546af603790
SSDeep: 1536:TfGt4bQxjn0xo4PK4KHRwcKn/2bVh7Ct5JTRdSJNiSUvAl82BmxhueT:TfGt4bQt0fK4u4n/6VpCD9RWUhUmxgw 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\33G0h-QVWGTGNhCEha.mp4.CIop 74.69 KB MD5: d7c0848e608eb3f58b3527a71dd397a5
SHA1: dfc7bc070cd1847d046525b33ea52c15f7e754c0
SHA256: d2eb91e5f78a8a9a745215f7dd4eb27f6fd54b8de4fcac5a492981ceb60dd719
SSDeep: 1536:dWODAPDgKTCB0ZrN7N6hdAPjj9x6A+auuEijQWNg3LSTspA:EODAPDgy9r7iCPv7B4E/NpUA 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\t39geveg0wynNP.m4a.CIop 4.49 KB MD5: 381cf7d22d47a188c4ef529d4730eb69
SHA1: 9b8043e1e50a5f6725904174903d26beafb9b5ea
SHA256: eea675b4d767a1f1566329cfd0fd6a0e2055a3326bdd86a32223115b895bac80
SSDeep: 96:usu/AiyJ4PIZcGN55/M0ywD9EXIYtgjYib1zaAPqz9eqgBU:7uoikZcGp/rEXaf9Sz9eRBU 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\k4LJ2WYGO9QfwUDPoT.doc.CIop 94.48 KB MD5: d75d7a9943d2f54d92a1c29402ecabb3
SHA1: b5c3daf0341eb3649709a77295334c47bc623f48
SHA256: 33f771558f4cda8780b1aa6b51944cab44ddda360b69a22d115c6d51d2b7ae36
SSDeep: 1536:E2GXdfndNpkI337DIrePfn+0+S7fGIWV3AQKrokw9TOQq7sXcaULP700kaZBWWd1:Epv5bcGP1WRfMIItD70IB7 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb.CIop 348.13 KB MD5: 4db754547469e2a0ac06bd37a9c1edd2
SHA1: d1cca067ba56b4ad0eb77a03bb6d27fe0506b373
SHA256: 4db849986990eba36c51c872aa5c5bf8202bf6cc988f9df7da3da173ee5588fe
SSDeep: 6144:QC6UcklTAZiIRU68xDccGcUE2wG5TF/mepX0IKjuMtJFXqqU2uk2y10YYbWX1Dn1:QCEkxaUT4EU2GuepX0aMpaqU2uo0tbmH 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ape_Je.m4a.CIop 49.82 KB MD5: b8ddee2d8ebdea55ca381f1669467401
SHA1: 9793c76edd7cf3b07d65f114c925d51de6b6cbfc
SHA256: 5ed0ab29020684c4beb732323c09a98e0ebd02075857b2133f01db39b96401cc
SSDeep: 1536:I7cJQdcaKcxnNWRBD4W5MF1mNj4WbwMaNOWU+l:X/abnNWbUWmF1KPbw9NOWtl 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\MiEnBI8.docx.CIop 44.00 KB MD5: 9cd394847a69833b2cf8fb2b9fcda906
SHA1: dc2c03924aca9e306eaaf8fcea50e3371ca0e5cf
SHA256: ef234033677260489107c443ea159a2dbcf365d3417166fd52c74fd23d7dcc9f
SSDeep: 768:yqvoEt8iSZj1zbKQLVLtB4IJG0XgCRipq2xOSAZC0paTo1oM4HM8dydtnhEDXRf2:y2t8iSZR6iZB4Tqsp1xO1ZC0co1oMuM9 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\4xODVA0z5L5w0l.mkv.CIop 37.41 KB MD5: f37242cc92c0ac2eb24adb50a1336575
SHA1: 9f3575030cc89c54d2deda9e1da488ccdcbc2fc2
SHA256: bb600e6bc222e0d280dc1c1c75464d01998bb3a3df33e8dcba95347548cd390d
SSDeep: 768:EkpxIpqFTr2J0/gnIxIuLW/WEnu8fAzohXgmWfhCUS/qHxPN:hWOYnItW/WQu82oFPWPS/+dN 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\GAgDtV.ods.CIop 57.88 KB MD5: dcaab3c421ac9b6bf3dbd3e8102f94f7
SHA1: 5b3a431aafa17d45c5a9f47c2b8966721f5810f0
SHA256: 45f184c57a747b0429aeb9abcc1df66ce4ad2448b2974ac1508ff729631f6304
SSDeep: 1536:+01rhSiGnQs0LbMP+EIFcx1rmaO+MXBdCcrxq6P80Xht6Qd1:+mXGnQhMVycioc7C3U80X1d1 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\Q0WDNI_cEJvL.pdf.CIop 56.87 KB MD5: 2e9ca1085efd846503b8bd896065b1fe
SHA1: 3732be6477b6ab728b7fc6ea762764c4c5d7034d
SHA256: 960a7013ab2772050c3ae4cbb6dc0fa549c47881bca4cc51bfbc4d1ba9a11893
SSDeep: 1536:x7oeUKHwGdTsj4Jyds+n/O5HBFsfgOQlY0uOgBkdyXpqQMeHwyL3JEc2:x7MWd4juGsmW5HBFYoY0+kAZMM3Jw 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\z29LckBw5RcM_XD.png.CIop 99.05 KB MD5: c19549465b5eee1bd171cd4e13f89eb9
SHA1: e7232e114e1c750772313de99abedcd6e4492cba
SHA256: d6a47d237bd1e30f55c3e55e0238d8e03c38c46a232a43fa7fda5dcc970fdfd1
SSDeep: 3072:OAxvKLMkwZ2QVP7B0BVBIkYFoym/9XZJ1:OAAMkw74g3m/ZZJ1 		False
...
HotGIrls 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep: 3:: 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\Dg7 CrsqU k7Xp.mp3.CIop 19.13 KB MD5: 39261579f9859d444500737b04f3351f
SHA1: 3f2af1a59c4682a733241f259454fa54f8a09ee5
SHA256: 73e2f6995f60a9923b52dcd93c0f20a239ca1d26384cd05bfbef6289ed55fa3e
SSDeep: 384:MFepO6d3PhW1t69AWSeKKF/mQZtbSEG9dES1CW3fW9XuqzfftFt5XoF:hJVpWL6uWL/mQbbq9dE0CWOxuqzflz5y 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\6ORqLC9av8hKhylQ04z2.png.CIop 60.17 KB MD5: 5bef697b3f045f084ac2a34b2ff20c6e
SHA1: fab7672d48ba1b171d450703d165bda9bd360b6e
SHA256: be3191c2d6581c58d27cf9a2cbc08661f19ac0ea728b99e46d9aeb960c63f696
SSDeep: 1536:BPrwHxFwo7b2U9uO2PZzet0J5h0apNUJ/1sylKctv:prcFwsgWIv0apS1sylKctv 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\u6hnCYVE2vuu.docx.CIop 74.52 KB MD5: d1e9058341d217932c3706925f7b92d5
SHA1: 3d11f1170611313213ac863bdeb5bd0f7efbe622
SHA256: 22694b1330da7a44128fb84973593ba301963630a345cd69cb9576275d5c4a58
SSDeep: 1536:W7BUvNCaj4DjbthkZqe8bkaqnn1Kt4oASjVyMaBlThC1rLskNpEDrb12z:W78Nnj4zthMeka6WAGraBlMFpYrJ2z 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\4ioWuMxhZ Ndf1N_b.flv.CIop 99.84 KB MD5: 57a19e537ef477ad3b2e7db4d2f98795
SHA1: 47cd3c2ef5ea1e49c5bac21d1006f08696ed2f74
SHA256: 15a186d9cc5a2dd7fb81a590bfad5d8a26dcfc2a2649de5ac688a9fc151597f4
SSDeep: 3072:kAW9iqw5LAcwg3a6ClbQpymzR2w13mvTu2Mk:RW9iq2LA43a5lbyzzhFmbTMk 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\fsxQuEAvOd0El-v.pps.CIop 38.99 KB MD5: 0b85c0f662f22b7b36bbe97add4dbcdf
SHA1: daa27112a892b86beab374ad6e1a1de5b42b23c5
SHA256: fab6d876bbfbd96e37a9096dfa1381ea3026feae21718c4240a4dfe6e1b706c1
SSDeep: 768:WVmxFLm6ZzrPgrRAC34X0Q6wmFQjn8qpj2nSmwvrd5fLyUiK:MQLm6ZrI9ACd9SAqpj2n5kfLriK 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\xBTg.bmp.CIop 83.82 KB MD5: 550bc17d47de1cfcbf6bf5a46eeef333
SHA1: 62a9c0abd0e0bed42bc656e22d1fdcc065f88c35
SHA256: 9dce8cd689ad0210944c67312580384acfea6fee82906b5eb974671276c5ef75
SSDeep: 1536:XAQplk70l8x2H+iRp04TO8K57+AkI3CLF7ROEJUStmuO5dDFph1em28FjUYA+/E7:XAQplgV0HI0O8aKVI38AGUUjKdDFpWmg 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\uhL6PZJxrZwaAeTB.ods.CIop 25.87 KB MD5: 79867c506c052c8ba9be95166d6e3463
SHA1: d13eb06aa263154dc7ddb3d0a16360f21a4777e5
SHA256: 3f1febccfc2f63a005acf6538b1b4c0bcb4774a8aafd07fcec2fa4f9530aafda
SSDeep: 768:OPjviKbBoLZqXTsweV6tcEuo3BtizI59B5BW8I:OPjvJbyLUXwVUmLo3DizAzsB 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\hJZX8AFOtoTuk B35pJ_.pdf.CIop 2.47 KB MD5: 6b1084e93bf269cbf8d68c4f251a1a53
SHA1: dbb2a0b5d8d8d06405c1dca37c9dd4040abe6615
SHA256: a839de6c7c9b45a730666bbd56b2b6d638e51eeaf9aa843140f69f8eb8738cd2
SSDeep: 48:CS2qUFqgtJE1Ya+VP+uSKuzqvjeT0VBfB59pQYbllXOwKT/rd2Mc9QE1:Cvq0JAsVkKuy60P9p1lex/h2McGE1 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\Pf3R-b3DBtl.wav.CIop 4.96 KB MD5: 1d2df9e343e85548483205780cd21a7d
SHA1: b7e2a4cfd4a7df71c2448aa6361da934bc76fcee
SHA256: 6e23849b3d5ac03c66fcac7e2ff29c787c207e2790f8e8c12e2fa6fae35a61dd
SSDeep: 96:jPOnVTwofr5lfHkNgAIARMcZCaCJTBVfmF02Nym0gXXzn/iKYCFI7b:qtwofnchIA6cw5JTfmF020m0gnb/i2+P 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\iJYJHrgQ2a2pzMtZL.swf.CIop 10.44 KB MD5: cea8cb466cb317aac08c37108d9d2be2
SHA1: e4060538b76eb9116ecee342b254277477378559
SHA256: cd01197b3f5761b8e48f1cf657c424961a97deeef6a1cebd7a51b17bb4187b91
SSDeep: 192:yC6miQapWPKJbieicngPT5ibIMua4jerAVxv929Ga3yHTHHbQwY7eKCZo:yz9wPKFtUG/QecHv9JaCHTH7Y7W6 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\bVHx1G7LG6.swf.CIop 85.01 KB MD5: 2b28721cb2640cd617c7b0f8a55ca159
SHA1: c3bb5700473ae1f2e898ec4f881abd9793a3ec32
SHA256: 0cd03a3cfb0b42b39c12d5a1a65a2684f4c9f798d9215ff5018de882401ec1b1
SSDeep: 1536:EqYdvNgWvf83jJVJlvEceo8IuGJRBIbcmvs59lpRc8K3KCS6cnGr3pNLeh:C1gi0LTeo8fsjMcz5NixQ6cnG7pYh 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\dDTdaFbzRTbH.png.CIop 97.99 KB MD5: 2219269cec98f7524f233f3003f093dd
SHA1: 1e9857204c9645fcc718f9c1aa1c56793191fdb8
SHA256: 5d4f22490115dc7b2b1709ed4d0a6ac76469596dd00f25c073270ada7b3f685c
SSDeep: 1536:cRr7xFCR293K5/lGcGyQbV2h8CcZqJfm3teeIbn/kV2rgR946G9:cRh3KPnGyQZiRdfm3Inno/a 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\t41qgP8Zl.wav.CIop 27.66 KB MD5: 65fcc3e65e8e8d466ff5390f6eff6ed6
SHA1: 1c46871325994f41335ef1fb90711ee1516aff05
SHA256: b7511e1b0713a04d05e0718df61689123098d3c768ee7a6db8399e6c147ebfce
SSDeep: 768:wYCW3sWONjxA6HwoLP4HdLSCFir/H8OpR:2xdxA6QokHVNir/H7pR 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\bvv97LkO.swf.CIop 3.65 KB MD5: 296977bd1b84e2497451c947623b774f
SHA1: 2299ce545b0a36ef3be5f26eef034a40692957c9
SHA256: af4c668e19badae0dd8e90f342e3d13542b8b014b0d2b66c76cf2892a3a7b4b9
SSDeep: 96:/XfMD+MFmFQwYTqyk3IfmLc+y9sImrqonF2W1OtohoPMU/k5j68:PvMFmFQwYlk3Ifmwr9RSF2WUuWC5m8 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\VAlp\gbg6IyO.avi.CIop 30.13 KB MD5: ace86cbbeedd7f0b4045507607e05b1b
SHA1: 4fc45defa4a5ee74093951829b573435bbcbf406
SHA256: 3b0c4acc087a60e5cd667cd4a25fb2c43ecab66da3c026e13ea88fd147cc25de
SSDeep: 768:h2Q3CB8GgvcU1Ee8l1JCa37EWg9WQxFb7ahcLK2P7YpsiZfv:h2Q3ArwcUaeLfggahXpsiR 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\XJ2OD9lQq0BG.docx.CIop 18.22 KB MD5: 2649fe2f758ab68673970f2be692c6d3
SHA1: 27c4f15684ae021b2cc21eb66699600be4474a53
SHA256: 469fc764c2220ac9b5bdb3b38f69674d0abc0df9168340837da0d1af3d9017fc
SSDeep: 384:yItDg5IuIDKIs5gGC9yKfF0Hp25L15pBnIZdqf01ayxzwTc9:dtk5IVkcyO0HpWZ5DnMqHaU6 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\itHSyuXpEG8bbygGV.jpg.CIop 89.91 KB MD5: 2338e7adb61bb52d05c8ecf5ebd7c13b
SHA1: 7511a66e077a2ee0e6c2b65c9ccb9b97512192fc
SHA256: 334fd40c29b4de83ff3e1357e9e5b65c98fb47ae58e7f772969b7ed41c1161de
SSDeep: 1536:3I38fsmw0RGAD5ji3eABRs+lB4P9K+Q6KXfilA2eXNWeidhKmtNVbkZQNg2H9:N7wA9ji3eAE+lKYVHXql9edVQN7 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\5eq4aL0vBSUL.pps.CIop 74.01 KB MD5: cb335aad4935cfdaf4f6b35837659566
SHA1: 5b0fbcf575ff353a5442cbf79dff9c9533a481fa
SHA256: c0cc8512658290fc7acc9756d93b1c6bb29537fde672fe06fb0dcd158d888fb0
SSDeep: 768:G2tqimVuYAeBNUJLESA1+iF7qDzvtF5wnpPLFo99Sf6ZbtuxWJiKX9eL0Hc/oBo7:GfpVlAC4GxQ/5KXUnOx4GL12o13F/ee 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\_eEl\1HSy82Y7UuTj0Jd69.mp4.CIop 10.24 KB MD5: 8425870c18c93efa4bb6240197890b9f
SHA1: 1063b60c464ede86b626093663cac82abd237c42
SHA256: 6ed3df3d638b5b5198e69155fdb3a6484359bc4008c2e67f1a40e36152d7f595
SSDeep: 192:B/hoha8lAqauW/UZvSjpFGUyzrbEzzu4QgHjAJcRBNBcITBCe2mCLIAt61NrXPC:B+ha2AqauW/Pj/y4z/nH0J2TkehN+ 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\FnTKrRERf_0VWyksIzp.xls.CIop 29.53 KB MD5: eb935fdd5d7b0c041808a18669102f09
SHA1: 0e7849b02d9905a73c548b43daaa99fa73eaac28
SHA256: db303f5d8e08365f1eace720b381f18400b601dbf1b802269e306b9532f97846
SSDeep: 768:T60pReP3Yd3xDiSW49b4zP25u3k3zWNkrM/YaYHg/2PR:T1mYNxD5WXzPh0iNkr3ZHY+ 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\Up-xCZd9p 2yrWN.mp4.CIop 87.29 KB MD5: 3d1025765bda68f960420044a8120532
SHA1: 9961181b5eb350933c394d1a0e5b74757f8fc938
SHA256: 250bb888db07ff8bcac331bcd22787a56d411293d3aacee0df5ffb0412647474
SSDeep: 1536:l4JTsa2zaPPz+u0H8GWMjSBJVINv0jXpAzWHi423mlGvneqwfO:l5aZaZHcMjR90jX7i4gmlGvneW 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Quick Notes.one.CIop 351.83 KB MD5: c456d4f0cdee008a309fef75bc3ec73c
SHA1: dd24ff26696092ea3b10a6ba43c1de32fadecfb5
SHA256: e1f3cfcd2121f665b3cba7c3753d1d3ce4288c08e1b198a0fe33fb3b539df570
SSDeep: 6144:UpXh1BKpUB4YPLDzxCTzdy7cN3aFXQF0MR1CCN7OXLeCxguRFp:UpBBTxyM7cUJ091hONLH 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\3eETFbJdu0.m4a.CIop 70.10 KB MD5: 73e5fd790eafd937db7f6f27e97cda7c
SHA1: 467af4155b4793b037b089230a5bf5fd776078f2
SHA256: eecb818da7094aae80f87d3c140019e833c66b82eeade64a263202cc405e269f
SSDeep: 1536:XZx84bHwzXYFqqyZRjLJ+06DeSp1tryiq+QkNXAeRMzK/E+Ogfi:XZCcwUMZRJF6iw/yiJNXAeb/E+zi 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\-NlSo.bmp.CIop 86.10 KB MD5: a1f97affc45b7502f205d1f2d6eaaeff
SHA1: 0c533734c42015bc32f2b7b70915e7aa4a033272
SHA256: 45a799fcc1d6aa0acce9974234fb7558d09f086e4076bfb3111ab23a7fc499de
SSDeep: 1536:oSQfC+hFMgidiL1dzlQsyElGCJ8o4uCUYwOyiebvutU1ZZf:oSQf9O81dzlRwC+o47UY3yi9Up 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\lGBL1f9.swf.CIop 8.54 KB MD5: 183dfb0c6e4abbc359d31c27df5e2a2f
SHA1: 2383fff53f52ad815190d906b3ee88fd53a10e03
SHA256: 5886d95bf8c490ebe01637e7bd9e09ced4d34122402a7c5564e3370ff9887687
SSDeep: 192:/qsCzmcuIRkfoDHRlCi44oCgkL4UKdLtgtHy9LVGNXOh:yUShA2L476Hy5 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\4LAv.png.CIop 72.26 KB MD5: 70c14b8ef9483773e56ae1b0ce5506e6
SHA1: 8af9a98bbd3a8ed0de4c9ab5164ea77cd158c9d2
SHA256: 917c4eadb9c8580186ef1f25e8230e41c5fe6366b9c6ef8ca6af83aef7dd3afc
SSDeep: 1536:81wyx0ot6SsjNAB3TZX7bm2MILgivGPx6RIeVqc/xsvh1U:81J0+6Vit1LbmAQ0R1l/xs51U 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\dBpSfcucLn3NuQ6je7.rtf.CIop 54.36 KB MD5: 1b687818e80276693a2f9ca65ad1e9cd
SHA1: 51a3e4a34260ce24c58d3710b0d29444a911acf1
SHA256: 16eeaca97cc1bc8cc726848d9e87bed5f34d75fc150ef44d54ae45e3396b0f64
SSDeep: 1536:spwBRWMPXsbzeNRJnTLP9lxsiCdHovytP11rkv/:2ewIwmn/P9lxsxxt9q/ 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\hfoKW.pptx.CIop 86.37 KB MD5: 441f734e733b7e077c4436bb382c06d6
SHA1: f1a076fddd245114edba37ee0a37e56128e9cacc
SHA256: 4f95e02b2893848a742219e7af7437f93848accc1a1dc7d99c66bc900a32e407
SSDeep: 1536:uSE6N7+HBM74OReXLWna32nFgeNxQNRElqAyeS10fNN2GRxRTScX5G4M8:C6N7+u7NYLa+eNxQfUNSq5mqgb8 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\yhA0tWH2QIX.odt.CIop 58.04 KB MD5: 0b5832a492a056f3d9f46e6781679c85
SHA1: f8b7015244b8ef6c0e8b7a1b5e6a3325b8c81211
SHA256: f0234c1e493956b86152aa8367fb106327b201a30780f8949b65471e44792210
SSDeep: 1536:S+ubW4JrTgRbGaSqL2w3vJqOXmNUn1XIqyQVcc6:aC4Jrsh9Sq62gOXoUqqmN 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\GsSWFcQiPn.wav.CIop 32.64 KB MD5: 26f220e02092f9ecbcb9a209b835843a
SHA1: f977edfe8b49693c7bb3ec404ecea783b787fb42
SHA256: 3240e75c161d7d5471df842c7ce8b1a03e9d560c57e77a11436ecf9c9ad3f4e1
SSDeep: 768:Q1sLsPTnB2LsEawQmY9GqaUGEIiPaQfTCGYzfBWEIH2:Q15ms3VmY9GqaUKVQfeGYx42 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\MI47.xlsx.CIop 32.01 KB MD5: 774cfd026bef648602a1e8133c92fc19
SHA1: 1eadbcb79faab3aad6be8c81cd8c570fe25daf20
SHA256: 9e8b536ee015c72dab50c93728aea56240c923f936b4fd0944643e0d467a16ad
SSDeep: 768:nrcedx0DSIjuvUHbpWqbFAtTfLmIJ3/iUlGeuoUcf:rn4MU116fn5RG8Ucf 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\45dQ123.wav.CIop 41.28 KB MD5: 5eedbb30103593ffd6b9df7020333282
SHA1: c4e4cdcf931e136b519f26d0bd05eee282e066e2
SHA256: 9ec59434e957e9209dbc4c628c403bb9f97e8461f8538c98d6b0e693144acd26
SSDeep: 768:zU+sedTiDv+TYMtJsyew91c4xPE9XiCR5n55NOh0jy2bCcRNYOiN09EvHx:TplyvkdUyndaX5XOWjy2R+dNr5 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\s5DMlEpMOzEY.pdf.CIop 8.22 KB MD5: 2ed292f68bc57f1b9d523caa0ec6ed75
SHA1: 8864ce6a27bcbe3d10548d5f8bf8a4d2c49992a5
SHA256: 441ebc29d16dd1bc996f849650abdade0edcda84b7d9633dc2a161b9b8ea2916
SSDeep: 192:axmzzaGRvjyngTaOZYAFKH3dPSLoLlpKH46o291Ddkh:DXaqTlcNgClQY6or 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\aR-iIw.m4a.CIop 29.75 KB MD5: 31815627fb39ab010bf29cf9b1be9ded
SHA1: 129a6969e6af1a1692467aadc2c04f26463911b1
SHA256: 1c9fb57a78da3cdeb9f8341109bfeedab3099f443050b2bc9f32b07ae8b87d0f
SSDeep: 384:8L/Zxrgg1g/1NquABjBNj4edqZapvntTRmidfdrCHxpLKaUHGwGZSSEq+dJmKWHE:srgg2dNqpFNkeOapyid1eHvBUHhSdvtw 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\aClNMcka4 SH9Md3Hwo.png.CIop 70.01 KB MD5: ceab398695485d7324e478dd45afd397
SHA1: 7b5d46094e526b02033b5c8d6ddebaa2777d5869
SHA256: 75dcfc1116e6defdbd2cb8c01dd6e13bc891566a887806373c980c554f705947
SSDeep: 1536:zUCEi6enCxJZqWQd97RSbjb49TJU0PqWdy7Lo4GAP+vOkD/dnw80PvL:YnGCxJZ+P7RQbmTJU0PqZLo9AP+vvD/w 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\0_psbc9.avi.CIop 44.28 KB MD5: 8f39bd98c8f0d6d992ca21305fa6374c
SHA1: 05a868e3314706922d7f6eb2856ff4a865481ea2
SHA256: 2ac58550192c121c2fd93deacc7c24e60afd34d00a017452b1ced9eb81631db7
SSDeep: 768:rhqbQQqF4fBy6HMWFK/eiO4v4GZ/ZayfzEFankURTutvu6yP4BpHkchqgxs2BQ:rhqOF4M6HMWFKG14vx/pgU4URwBhzO2O 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\aV64x7o3lA2K.wav.CIop 42.83 KB MD5: 29adc4200818724615e5185f72e11343
SHA1: 2709a7099336ea26c2caf566f0832407a22e8e97
SHA256: 84e43fb042fafcbba44b4235dd22776f3de200e023d4f5c0651ec3cb8c1a3afd
SSDeep: 768:Ie1XEG31YigKNPHyLFFpyWFS5D7WN5dTK+/p9x8AVNWUndS/lKW/+3Je3LrWPfB7:Ie1XxYOFShY5fmNKa388ln4/lKf83Lrk 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Contacts\lulcit amkdfe.contact.CIop 1.28 KB MD5: 9d90076c4387afc568b8d00a86fd526c
SHA1: 04f31151e7da61e0bde9d7fd8f5d1a9cdec08f01
SHA256: 1182c53bd0060a3c5b22ddf7f1469daa2b518244ebd932718eb0db93f5fe021b
SSDeep: 24:THQwyr15OEPrwzmb+95qnz1yRfPBpVl3FbZVfmkTj5:T/Q1Frwzm+95qnz8Rf5pVldf3J 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\8P2mSya3098KVulU.wav.CIop 78.56 KB MD5: 797b1bf52d9efdf3d257e093222f9e93
SHA1: 64b94dbac9c6690433516d98c8d2d26c9341643d
SHA256: b408e729a466c3078b5deb1958a6fb9b6bec51758f9730bc905300e0bdd6b53a
SSDeep: 1536:NlZJVnTWc/3sVCRWfJJ1CXaNHbdoPS66YN+kyHpHJiNh8LlatZkC+MZ5XFAYkNO:NfJxScvsCIMXMbdoSYNwvKvPNZ5XJz 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\h8IhXzO4v.csv.CIop 20.97 KB MD5: 4d1bfcb60620d6ff4596525a272850ee
SHA1: 88aa266ba71fa8da22265bb1fe9967c8f2147512
SHA256: fc221f6e7d3ac609835a2b1fe84395de510c16453d9c242975727bc411fdc271
SSDeep: 384:fsOeX+5JnNTcDXgWBYHKaRxQvRweDcO6MYCGZBE8:fk+Zgr/yKqeNbtYph 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\bWUX20g7Mm7g1y.wav.CIop 46.38 KB MD5: c43cea70b490bddbe442560e0be3cb6c
SHA1: c192ea5332296f7d1656be5cba2c542c3a0302d9
SHA256: 094427083360852559a5bf56c867df0e27e9a30fbbde1f44d5b445d90364f25b
SSDeep: 768:i9SRTFhVGs5b1yZd/viOlyOsWs3l3zoIM/Dd5KDU08VF8iOkkHFoHlKOQk1z:i2KhpZNsJjoIMLzKDU0iONHFoHcrkl 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\rvq7ekaaX.gif.CIop 16.07 KB MD5: c6f7578dc4f0e26a5e386442b5b2b063
SHA1: ea0f28aad827da3affc6bbf6a15746129e8137b3
SHA256: 4b19769df879fbd39f99f5e4fc841ce65ea0cd6a96dd74b1a2322272e23d9d71
SSDeep: 384:y17dapZS5NTNf/751mPWkjIOxiFc8UKw/yZpDe5:cdgSzT954PWknX8VOCe5 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\rKQbOo.m4a.CIop 58.97 KB MD5: ac2f2c12c34f18f7bb63e7885b6fe729
SHA1: 7376ac39fda4f1390d5dfbf7f5c6dfe8190a60f7
SHA256: c1ce540686bfb989fdcc438847402e6469418e75a4b01865be702f6213768d2c
SSDeep: 1536:ZHkFsQfn+X8f1is3r0pART/RY1sZBsWJS3sAElTWExP+Tdoi0j:pkFsy+Mn3rLlRY1GDJaElT/G0j 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\5NEaCJn_lqI_2wf_A.pdf.CIop 84.11 KB MD5: 912f33f4a52b1776cf6e21c2faa5d8ce
SHA1: 1d78ac313264a2526cc1f78709a666b62a1911cc
SHA256: ca70b8efcaa02467a6ac3ff5469e8cfb592eca6c1748ce06a49b3357dc26e0a3
SSDeep: 1536:E/2daBRvAngYtoYypKjVO7KZBQgINSBV/9ozIGqUyRMPbxSQWu8C1ALbxCnUc:EedaBRSgJKO7K7QYBV/9oMGOMPbxSQ6G 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\pdKaXJhzd7zYz7o.doc.CIop 14.93 KB MD5: 51489c67ff609a8394c2ae0df6d4ed32
SHA1: 33cf149b90956857eaa29b9e59419a9b0b4b3004
SHA256: 987b4fcc36651bd22b4d958f089291059db869b7ebb8f9fa8d4fd6c54618ab9d
SSDeep: 384:5kgeUAlWVLCaMcc8J9V5d0OJ9mjmUWP/dCmnWKvX:ej8Vf68JBqOJ9KmdCmnTvX 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\3kj8Y-EDPTFO.pptx.CIop 72.64 KB MD5: a5f628c60db84b9078ce641f56cdff5c
SHA1: cac83b67ccb5cf21537e6ba1ff0ef95adcdebd47
SHA256: 3c6a7ce22da0ab6947c97f542bdcfeee3b09ea641cdbbbae500ff2ca57198a30
SSDeep: 1536:vJrGSoYTq5TzMG1hwoPHCJGThhcGfqnELgYDwel/IlQPRn:BgWG1hU4FhcGCnS8VKJn 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\qp-3yc7D3FrGiW.jpg.CIop 53.89 KB MD5: f4fda9048b8b8dcc9ea7ca99afd3a700
SHA1: 2a8350816b189b43fbcc47faceda0c60bcab80e0
SHA256: a7f4f0569fa98849599c829422dd745f26bc3fc3cf2741862d6321ff0412c439
SSDeep: 1536:gqU/pGe2b9n1gBDkuIAGk3Xc3E1XkcJJA5gikuNDuh:gqQpGJ9n1gRkuL9+vcs5gikuNDuh 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\h72I_b.bmp.CIop 53.88 KB MD5: 299251bde594645b6b774df6d410a9d9
SHA1: fb47d9141d06be50829157b0ab4be2996ada48b1
SHA256: 80db010a3441320536233137288bdaeb4c6003f66516fb89f3c77a4fe3cf3ac6
SSDeep: 1536:HFPlDUAG/bc6M4Zxma4ALJIfOgXIexmV6R:lPBG/gx+Ia4ALuWSItq 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\lYPIT_a_zAinFFHfUDV.jpg.CIop 92.68 KB MD5: 35b1e177aac9974b5a04375ee2013b44
SHA1: 0d9b24837566f2c11ddbb664d50c4f3a89236bd9
SHA256: 64134f5eeb6cdc386943a730548751ebb2347f5824700778ee7a5505b7ea7f41
SSDeep: 1536:J/gJWcCDx6SRbGuJm1xUhwoatvk2MNY4n1Ei6mNjEzJ/EcwFKoTj5N18YEPfosiC:JY/GbGuJ2UfatjQY41ERAEzJcc0Z578p 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Contacts\Aclviho ASldjfl.contact.CIop 1.28 KB MD5: fbbe7445e159c08ed95977db9ba22a2d
SHA1: 82750d0f38484d9e904b51c9ad89550d43d823a8
SHA256: 4c825310a6fe93ab99680d1811a17f1986a4b3b5d50b8b220f1e9a3e61768e41
SSDeep: 24:VxcbbvLYQSeOxrXw6dePnOu1j5NfLDunzTKRLOyWZ125BS1lchjzVD2mZj2:VxcvvR7OxrXwiuDNXGTMgZyBS1l4Ed 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\HpvWb5EHtTvn89.pps.CIop 74.17 KB MD5: 66085a39e45e83cc0b9742d23694fcf9
SHA1: df5a549bfcdc05a4f87f5299d978833091085791
SHA256: 3dc24a3832646a4a6fc9bc44dcca2816114daabcaadbcc05b9cf6347fa49d800
SSDeep: 1536:SCwzrzsVk0Yky3mUwdUdT96DB4ci/8Om+rDUp9Up0+Wd0PkX:PArgk5rmM6DWBxfUppskX 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\N0rL.wav.CIop 44.72 KB MD5: 2f48c8a5caaa98dea7a2e80ca566ad85
SHA1: eb7df8a262f0aeccd8f17c7f04e3b0e56441f8a9
SHA256: 9d552d2b70d42a8f3db6b00ef7cf28123f06290474534ea71e723bd5399f8680
SSDeep: 768:er2ok8PBBompQz9Urpbvk1xcNmNsDNcroLTQOJ9z4YcNwF02yL1l:sk8JBTuzOrpbAEO+Nl1yO2 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\uQNDwbW1Y.avi.CIop 66.97 KB MD5: 8c537f998fb897a0067633d137a6430b
SHA1: 84ea31b6715237c558636aa88c42be52bfbcc5d1
SHA256: 99656e37818874b4f02b03676fd2737b0a28216d89e492a566aef58a23cabecf
SSDeep: 1536:Luh22hJiZf+2B/9qkJwEt3BOrTWrRxskG5F/mOzQ2:Luhlhi/9qKtROrTWrRxsJ5dmOzQ2 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\gl54xs.odt.CIop 78.32 KB MD5: 8bb3b3a02537ba4a50eb774e7417a091
SHA1: 53f64f46cbabb02f21245faf4bf1ad4a77526abc
SHA256: d0a7e46166a4adfe40ac516e3bf7fe0347782759defffdd8f83cc0a5fbf010cd
SSDeep: 1536:WYRJjxGxjDDuyqHfRwLua6Va7HoWWfArdtv2Aw4y7:WYRJjwhuLHfRwiaua7HoWWwD+A07 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\Xj74 9 m.flv.CIop 13.12 KB MD5: e01ca11b646645d759f7d5d34d1f2b5d
SHA1: 2751527d53f01a44f3c5f913484a0904df880976
SHA256: 417336267b13a398f6e95dc2665852acd1b1f98971d0017445aba359d785c8ce
SSDeep: 384:XhSX501Ny4CvxIO5AP4ndNWRy15cpnEHehZ:Xhw501NyiOYwdNh5Eff 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\5EUw6X.xlsx.CIop 29.65 KB MD5: dfc2bead27d27ae443957c25bd7685c6
SHA1: 2f864d5726f68a9dd4704896aeb7f739e0a705c9
SHA256: 6d13901ea65b8230e0b4e8e465d697c078b0e28b9be7d15c759219bf027abcb6
SSDeep: 768:OtYaplSK+UvQh5Tjk64+4F4YzxMgfsugit0wsi2sQZPUH4H80iNtKw:Ot7p7+UvQh5TR4+Du7ft0wGrNU3DNL 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\VYNmKqyqyi.mkv.CIop 75.89 KB MD5: 180f7d8f368fa59047edebd9513b5a12
SHA1: cf107dfc450b046da5cd71efb728293c7fefe7f3
SHA256: da7fb40a9f6d007237b2873a758e537f29ac6afca98be465d89c6a1e0664a6d4
SSDeep: 1536:doTzKLa9Da9pmffIT/mT7G0s7A66J4Ig+UXi8u66m/Ax:dOWu+8fITmT7G0sB6J4gn89d4x 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\I8Dv-9gTrMuD.mp3.CIop 58.09 KB MD5: 4a0f84ee705008f29c26fa6644ad9100
SHA1: d1aecf9476fe90015294557e6122b2934efc5cf0
SHA256: f40736334471bd1d4111e6f7ec73ec7358e5a36db06e20b48e51ebad6791234d
SSDeep: 1536:mzbiriaxYvSv8BicfZ6Xc9Fo71n3QXCUuAwaajsqZu0BX:YH+YvSvCJZ6Xc9FAt3lNNjsqISX 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\Qm paxELf.bmp.CIop 18.23 KB MD5: a28248f78f9530b03d4849c1bb695b90
SHA1: 999693540c2873c4d936781d9096638bf6b19fa7
SHA256: a7dd4a8205ba3ae1f3b67377d014dd931861c5e3e4f4e9c585fd1002b9aadc5a
SSDeep: 384:gXTVVthm+dA9G8ql4yWlQtcNYqyiTPF9rgm8dimY5ED4/TLlrr+5N0pXvh:cTZhmcpPqfam1yGd9rWUmY5UgTc5N0pJ 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\OALKMuc2ka4.gif.CIop 60.67 KB MD5: f308327183521580c5826b6453e443b2
SHA1: daf9ef3eac3f2c210b673db9f79d93a6289c903f
SHA256: bbdbcec2dea28ebdda4092d95034dc62f9cec46bc6a056f195315eacb0199bfe
SSDeep: 768:6rh+XCQDmlUYTEOf86CFW97uylI2Sp40AB0PqhPwB9iHxFf32cm+TyB6cov486Tk:69ySCwJfhCFs7+xYB0TB9Oiovfv+W7 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\dCyPtvG.wav.CIop 90.61 KB MD5: 8045ae17ebc4f061cf5e935d1ce10308
SHA1: d1a0f3e07d320d93041b5e8c2243e2d23fa6f222
SHA256: c545ead6f366fb7b5faff18ab6f8b1ced293240d4299237e2d6c11efc9ac5618
SSDeep: 1536:OvLqHwaLRUZqHyP/EotSShZJ6mssyR/EtiZS3oOIt2MgAgCSl0SYP6w80RXijkVc:OvLKR46y0sSShTwzR/EtiZjO+waPw0u9 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\zsdQJc9p9rp.png.CIop 23.02 KB MD5: dc90116ffd71d9920e97bc7702df3c3c
SHA1: a2c8f699fbfb35bc1e01723ff39b893548fd1b31
SHA256: b7657608b3637bf83c41fd64d8ba57f930e13b9183848579168b4dbcf2b763ef
SSDeep: 384:pbqSikkTUJy+BrNblAvpTySexWeqilXijYuu/SpwhHp6oSi5cQUscU9Z5/:p+S/4MrNblAvpT5exWHUijYxSpwhHp/Z 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\2G6M.mp3.CIop 66.29 KB MD5: 831dedab27bb3b218b82e2df02fc7f85
SHA1: 5fb70237065c4888077074315c2ec058c1d3d365
SHA256: 5fe9888806276ba12b3e6bbf6f9be226cdc183a65194426a1d8839ae3fa73dc7
SSDeep: 1536:k3RezONaBzpoFc83PH9tlpRYTD1HpFCrygqYJw49R0jh2G:PKNa5poX/H9tlp2ZH3fhv 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Contacts\asdlfk poopvy.contact.CIop 1.28 KB MD5: 1be8025a2b13bb8527fac22c7c473025
SHA1: 05de3a34a0e3f9cf115f3a28e3d088048f77dba2
SHA256: 892483ae2a5729b11fde34b2673e073ff2ea6622f463e4acbb18739ea1e09910
SSDeep: 24:caGczm+fDLbuI22GX0/F/nRZbpxu9LRMiWCwXQpHHbD7eQ617Agbb:cr6rLE7X2F/nRZbp+L6CSQjJFa 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\TqgqXxG.bmp.CIop 42.37 KB MD5: ab9e6d68c674e536a331d964b7a945fd
SHA1: 16232f8cfdee71735dd83b3c16ee788c834d0891
SHA256: 32fc299727e997d89651f47cc036542dd955dc8586c8d061b460b68b9ad2f295
SSDeep: 768:zgf+ng2CK7LUdFAy7qDYq877PFu8pcu/vJnGkJ7rBcbLW38YA:UB2CK70D48f1pX/vJGS7rBcHNYA 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\vEcRh3pLVRcZ1O.mp3.CIop 66.34 KB MD5: 51ec3d11888d74394314f74b07e940dd
SHA1: 75a8f171fb8f708cc271a4b86c9bdfed8e990f3b
SHA256: cb6701a0c154f8432565e9581d0ed0d4c49697f59be92c7ab4f4eaf11480670f
SSDeep: 1536:lo+zosWvnpb0/KCp8ytjAiC6a5ACC+Com3i3ENSUxRBLVKpan7I87NOdzjh:lvzXWvn90/bp8+9CLkbomS0NSEga7dNS 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\nmKbd_Etp705mK8.odt.CIop 81.33 KB MD5: ae78fbe841ec556f0a313b6eb63ef3a9
SHA1: bf802549a33320c01ead111f05e50dced29a7a8d
SHA256: a7606eddbf719687b4e7f7a9f2f7dd2daa33882c333c7bb80c26df5777ed47fd
SSDeep: 1536:Wo0qBHOxP0Tu5a6qeUx5XNIGWL0J+gXyCIwf4FdlKdsmx1NpYDDs+GfzPGIiz:Wo0qBHw0TEa638vIGI2XyCI8GCzx1NpG 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\LzUKcb-uGVeX.png.CIop 52.47 KB MD5: 4a36db3ea6d85ef0283a7a99c282afc8
SHA1: 4152e3d84732496b4bb57d3fc2c9ac4a6026ccd4
SHA256: 82e27f5f1afb2080131dd397959b13cb78e05e539309b92d8745e78077b405d6
SSDeep: 1536:Z7CFXjucHu1ae8ojUn1Feoug86oEQRrHLuakza:ZWTZOk1ojuBugIr3 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\_eEl\QGtWvWHnjohYH0 tv.swf.CIop 28.41 KB MD5: 777dd5cf07d7ae6f07f6ec0d7254aafa
SHA1: 07c161a37b85cce974dc46ffb3467cc99dbe78c2
SHA256: ad59dbbcbf81cc1cb8e35147d73509c0ec071df5f4b9ed76b1227a57684d1d38
SSDeep: 768:KviCYqKJbBto5j9xutO4XTeOrQwwfzCuCwcEPvC2S/LtyEA:KviC6JdtwbZq6OrUzXWZLoEA 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\ttYeA5K8BN5b.ppt.CIop 45.65 KB MD5: 281b3d8908d17f8f944f32f29328a34c
SHA1: a75d81c5193d48f864e5322ef7d0e71e6c71c440
SHA256: 19c029578e68113848b7fa2023b1881778c90fd315dd126647510b5319ce5540
SSDeep: 768:tQPIoh1SnthqmiW6NKdUslQbNcowodx44Gz/0z7jEzAnm1SikJpx/uvwarEqAvp3:SPvhUUWCKabNcotX4no7d2SikJpxCrqR 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\-Z88RWVEKHn2YHbC6YS.gif.CIop 32.38 KB MD5: 7663e37be81b36da6d410ccbf0c00e25
SHA1: 2d78e80718fa46a79afbbf0a0d202ed4078b4e39
SHA256: fb13bc3de86585bd4e72d7ada6260473848df563ca35db0bb458bda18082e343
SSDeep: 768:HappWM/OCgRo0s1+EiHbBPlNvT6VoAsaSVdeqFD8rCQ8jGqLV:wpW+OCgRo0s1eHbNlNWVojcXrijGC 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\DYnSH7i.xls.CIop 68.74 KB MD5: 54c1f7afeba88741ba4e54fed17715ef
SHA1: 16985389c5d3ce4321736e286ffd62533066597c
SHA256: 3814eb0ebe680e1e80fcfcc402ed0bcd3766b24f5e2d4af9cb8283ca73181ced
SSDeep: 1536:emEYt9ZiRMLeM5py+XDw1a8NtitZ6Cs5z+R2RVRvG+zAy:emAMLeLsAak66CsZ+avFb 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\xj7qoX0- 7l3FO.mkv.CIop 20.90 KB MD5: afb1e5846f11efd4de8c1425d5d4bf7e
SHA1: 3721ddad66f70ad3882dbb7cc1c61679e556eecd
SHA256: 6052730f1889243cfd6fd3b7d19c9160d9e97164bbf43b7deeb404bf437fcaf3
SSDeep: 384:K7dGsJtbL/vopshKDRs+IOOKtZzYQt+T4wUQB+ToFLgsjUXPHWoK52CG5zu:MdGsJtbbjMRs+YKhSpUQB+UBeXf65Mzu 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\zDzpwp-28.avi.CIop 80.67 KB MD5: 4cb3dfac104784f1f7faa0ce1fa685ba
SHA1: f6a6f7e2c929e719861d385e4a645cc91dc87365
SHA256: 49c2c5de571a882218a1d555e7937c68b551965be9dbead11aa4007882d74682
SSDeep: 1536:3JMeQLI+Ze5y08K1Z6P4cN2hnYhRXHRxT2TybV86uOjR7YMZia:5Mst8K1mEnY3HR5cybV86uMR7YMIa 		False
...
\\?\C:\Recovery\WindowsRE\ReAgent.xml.CIop 1.15 KB MD5: 4714ed885bd6ee1810a310ffda52b26c
SHA1: c7dc24f4a3a47c4b24cdce3ca122ad763bdf1d07
SHA256: e9e9adacbe62c78ab5935e3c6b9517b12f31af30b1da2ff7fe28b87ba2b3c5c5
SSDeep: 24:spQZU1EIeJ0JrAE0G3rjRkMr6HLadksu1f/1e2ZepFx0OE0tsUN:I51nRJrAyrNpr6HLausofNjZKg72H 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\69_UAHNRs.mp3.CIop 29.02 KB MD5: 3337092a442a5c699fe1502ca1ce03c0
SHA1: fa3166c7e56fa7e046702c5c105113a483b382ae
SHA256: c6fd78114daa3c50fd61c5f8583eec0c60e08cbf08a656387ad21fa0599e3e55
SSDeep: 768:ERnHEKrxwJcDzaORYJoHnFOt15BUrYEcedUOxPL:EWK6cDzaCOtBbelZ 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\51gZ9cs6QyQwB.xlsx.CIop 47.77 KB MD5: 345798afcc21551927866858e61c6290
SHA1: 1a8976c33700150656daf3a0ba37d9f9124691fd
SHA256: 649669206075c8bfdd0d6be0467bdae9a25723c6e1d9e822e6b1c6de42a42474
SSDeep: 768:jxuBZlGD+ia6OWhLG+zmQIIbRYPTMxIwldqgENEP8k5xy2ysO9Esp9aOSeIHHiua:jxt7i6KCm9MXdqgEdExhA9XamKiDa4Ui 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\Bu5bp9.avi.CIop 84.62 KB MD5: 9123e62be98707e3b3972921de71fad1
SHA1: ca43dea8dc13a73f83897892c513fb49e1f6d6f2
SHA256: 673db8bf99ed700b4512c4df4fdac75d84f537ffaefb28c4da18dc5934bea998
SSDeep: 1536:7yluXien3EeJl3AknjVJ5bg6Puf2dxYVh01MqZx8TDqFU8y086LmvGt5umyMsayw:7yluJn3RJl3AkJJ5b302dxi78OTDaU8n 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\O4rsCOfAWVNZ.mp4.CIop 55.80 KB MD5: b113b413d14d8508f77046b7eeebd498
SHA1: 2b01279d73976957bc9598b55451ecdc13d2a5f1
SHA256: 7eec4e264f4588340a52391e971e242dec3a296dc71b6853e6702084528c129c
SSDeep: 768:UkfAzTKwYo9ZjNIKBX31NK6kH3A7adqtzDsdMgrR0i9x/0P3s8v2Rv0f2S3GRYk:UkcTKHoPzTNe1dE3Orf9UMvyyYk 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\jA0o4Ao7ru.jpg.CIop 88.35 KB MD5: 38a7683618f36993a4916c4f23e3a8ff
SHA1: 6978a20837ef1c76f02baccf0fbcbe793c8242f7
SHA256: 73b7fc392ccbe6773b9235b9dde45b1ede3d3241ef0b323ab17468f4b75c2a0c
SSDeep: 1536:hgMZIkPPjTCPXp7Nqi6ZzPS5/SDdHGQ3u9vTxd9+PnUcsj1KPtAelPIEIJ:qWTevHqdB+SxmIu9vTxd9+PO1KPtOjJ 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\mR4SZZ7.pptx.CIop 96.60 KB MD5: 2b3c8070de52d8a8171a7bcc3fe346dd
SHA1: c62b5f998989ccc0227fc3e8d351ae0b6bf6f045
SHA256: 6d8c8faab166ace33027671a4db97b13103e8cb196df2cc4949f59776d21a50d
SSDeep: 3072:+Y216tTr6nHzI59rTFIKedp8dCCg2u3CX+ZaI6:n2QtyoFMghyCucI6 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\MgyGAvvq5w6fl7AR1Hfa.bmp.CIop 71.81 KB MD5: 158c023de85000b901fee2d91fef4ce4
SHA1: cb87ffc734ff7118f487591ad8caf18828495411
SHA256: 4d624ebd82955e43641755998fa651c444817578031d7e19a85832d69c69433a
SSDeep: 1536:qjtwIwMYcVbo4O9lMB0GDsCXckpjJAVwxAwd27W6QlSBRrgg267:qaCbV+Q0erMAjJAVwxAY277fRETS 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\DqXOsfvU6Y tHX.wav.CIop 27.26 KB MD5: ff541eddebd27711616b5d98cde41a11
SHA1: a17dd593d12d2d9e489e518cfb2f03d4a76360b0
SHA256: 68860c651a644b998223a296b340393ced4823382c4fd70f49541e0764c9d005
SSDeep: 384:03cgYRjqYi2nGAleLr8GkTwiXz5m7n1mM0Lcg7lCp1sxUi33SgsBEPpBYX7ivSK:+cXw/2nGAwcGzS21mMOh7Ep2r3NRTvF 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\7Luf9iKqys 6\lMwuMumsTcOMWQg.bmp.CIop 65.18 KB MD5: c95136e1b1fa0083a8b6895c30a3dd0e
SHA1: 2b449e051b3df66525c33b9a78b54d84ba37b0db
SHA256: 09db23695a4c851f70ff27f007a5b2e3b2dfe52652dbd97a6cdac5e7a053b5ee
SSDeep: 1536:doqdUHobeTDrUvng4MsqzXxtjo8jpt3cO1nxw0i4Wq:Fds/Iv+NtBLnS09Wq 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\UmcQX7d.pptx.CIop 38.33 KB MD5: da3593b0dbeba6e83f1e022a338957e6
SHA1: 206f819e5574712c0a806ba271d9d314b327b9c6
SHA256: 732888c5c0c69661c8dfdcc2cfc3ec4d403c5a842b1a85295577c05a659ea68f
SSDeep: 768:forPgTIWIQBNlKpU8YlYSe0g8uZ0b1gkqAM1QmuyKInfO1iScfaSKH4axiXz9H:gT0lph7e0g8U0b1IA+uTymiXbpachH 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\vxT7Wz-UZ XFfNDp.png.CIop 91.33 KB MD5: 1bca7acdce64cd9f91d53fa9e7433b92
SHA1: 1a417f304354df583fd94fabbd8a325ba46e12de
SHA256: 0dffa8d2825b21236e0ce61467caa83adc92b8f52b9ede04df95d74533f3e971
SSDeep: 1536:hEsWQL1Y1dOVLmEYqYVdI68fgAO1GJAxCA9orRmnBamkMBfczkZRs7D5QFvoW/x:hDxmZqYT8fgyanBaTaRs7Wp 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\bLdID5XJzq jCM\IwWqYwDX1-Oo2.gif.CIop 59.76 KB MD5: d68d412dd9e34fc8fdfa4df5aee61916
SHA1: 30effe1ef31edfb60b90fe9c74a3546cbc61f088
SHA256: f561ab1020b0345d1e19e60a2bea0f232b2eab1b10101c0a1ff1ae80bdbce1a9
SSDeep: 1536:TzdSIo6XawMnlE4erf8lNiXmHUc6B/W8zAt97:TBS4XlXrfCNRWO8zaV 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\r873fj.xls.CIop 56.94 KB MD5: b1c82a5a0ac4d027613b8ff43f27b839
SHA1: fd682700ec0352cb2c253ab0fdf870770af1412e
SHA256: 3d75db4bce6c611d78862a838e557cfe8966a922a24157ea935ad88f92a48c0b
SSDeep: 1536:4rVoxNyMb8Vrg+OIOXMNHE83K08IRzTFwpcB1z:qVoyjrg++XWEIl5wK/z 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\uOf1gCg-syx.bmp.CIop 28.85 KB MD5: 662437f401f31d0b64dd381cae7b370a
SHA1: 759c6f0e03e11c0c2f66cd56fcdd521dda6ef8ae
SHA256: 7cbad5d7cdae31c15b190d58c2feef2c034a639b2cff69b77b0906e2b312b0eb
SSDeep: 768:Y9G+xlBJq6woYQrV4jIjwEyj44FbTkTZKl1gfRTk:DaBA6fZZjw6Cv 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\p6xCw Vob.mp3.CIop 51.54 KB MD5: c4854b8752d1a6719bd40c6ef264c8f2
SHA1: e73fc4b59301233cd9424a0bad85968e302be744
SHA256: b30546b11b8fc8b15c2c8cb6250d54b6046918a3523278145b84691ce4d969ba
SSDeep: 1536:7gMdbo7nOXU0JAa0EsazINqAQVUW85BIIzrQpPO8/yP4i/:sMpo7wU0OEsazQW8TIIfQBO8qPX 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop 58.41 KB MD5: ad7f99d010615301ae0a0a2b101c6139
SHA1: d2146ccb53ee330dd362005e89b6d8553bf00ccc
SHA256: a5e511751ee8fc614e5bd611c2d31d0b308df1ef02b12bc3fe18649dac142fdd
SSDeep: 1536:x45wfpMyOALoqaYZsbXvEDVKsyjuCe4aEJPBDSYvX:AwfaxiWDvM+j3zQYvX 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.CIop 6.17 KB MD5: b054e357fb7e72ec1e994868fcee9d35
SHA1: d676410cb946096d0fb239d0d0217e8bab3fbcf9
SHA256: 017c350c821db600aa4e83ff07620f9e58577224d0bb0eadec761f528c9ae5ae
SSDeep: 96:1SL/gIUArN2ZwMdv4efMc28ZLieM3cQC5wFEPiJZzqbtWkqX8HerjzJvezqSJgMF:PIOZldvkYLJlXPiDzqb8kQWeH1vCqS1F 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Searches\Indexed Locations.search-ms.CIop 0.37 KB MD5: 3d27c2548bad2f39c55b2289cf0442ff
SHA1: 70c08cf9c968a5a98b1bf0e6666b1a68097d6826
SHA256: de688cf7bbc67424642eea5a463553af556ba6a21af1ad0bcbd18b713d023cf8
SSDeep: 6:kisFNRuO3XV+1kb9eH8fPiT/1PPhxj6wURsYbAgQrBu7jPztcuM5tVj8H03+RyxG:kisFeO3XA2ZeuPm/1PJV+sYbVUaPquMG 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\3m7QHv7T5mGuFh2A31Q.avi.CIop 99.30 KB MD5: 35e8934d83c211682351e6bd915f02ae
SHA1: 4e134aba5064efd4df007806c2c5eeb8e5480623
SHA256: d1526614c139f9c16a69294cfae20ac332f395744abcca4febfb0ad89e27bc29
SSDeep: 3072:aKBlEpZPeRPT9Ruh8340RfHpJpTHsJbiC:ZB9RuhGNp+X 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Contacts\sikvnb huvuib.contact.CIop 1.41 KB MD5: 37c20c0f3c3b11e766a19a68c5146b49
SHA1: 31274170b13e26dec2ac6006289c520aa7c6f9ce
SHA256: e0c0ca85948f3d384da358b6773286b10e5a9760860eea49fc460665b7cbcd1e
SSDeep: 24:5uSGTtCJyQKE+2jj65h9b+zCttFQuPwFBbBa1m6GvyWJTFEvXw+MWXui7J4u:5u1JQw2vy9bwEQuPV1GvTRF8vML+J4u 		False
...
\\?\C:\BOOTNXT.CIop 0.13 KB MD5: 9104b7055abe0e6c41e9b32864e5be1a
SHA1: 7685bb6c6a35b88ea68bf219909f05c100c87ce3
SHA256: 8c266189dfc1aa4c6c342a0ae0706a4163ce33b5b7bab04a620fd3ca4b3be5ab
SSDeep: 3:YU6IouBkiLDrbt6o9CAdexNi2hDDVpyt8pXdZsuGzTxsHLhw:cIoUt6o9ki2VVcstJk9X 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\-aXVf.flv.CIop 91.12 KB MD5: 3e23d0cdd40e3932ef28e449bfda3ce1
SHA1: c3a3c5770de9a744917dc3cbe0413a326592404a
SHA256: 7d0d3abbcb8ffe757e05ede794c2b72c2d2b21c102ec1ff26b9da86c6c40e8e8
SSDeep: 1536:pdn2m9hiYfTGSN0VkqrWfBXifYh8m5TUFIulhQ9WRP2Neh3vVa+nIjbro43RAiN:ymX3N0VriJi3m1kpb4+IjbE4BAG 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\NHki1vMmaXoWuhnR.pdf.CIop 63.13 KB MD5: 7b153bdf21f71718e407643dc6e6bfcd
SHA1: 4b033c130e9dc3c9a17a74d88891fd283f4b2e3a
SHA256: ad99242d78109871bc4fa85c07c155be565a3c88fea51c887509770f814c8240
SSDeep: 1536:uetEdQXiHFIHq3ETbrVMOjmhhJJAy6hYuq3eimt:NtkMilIHbrlKhKyvq 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\LJ2-ZSo63V_7d.xlsx.CIop 75.81 KB MD5: 52fb3196ccad0e2e005925a7c4118517
SHA1: 2c31b865e62a21da6867b7b3cf149112a777f846
SHA256: 35a1b5294423a8b8ca5b2158092da44a258036febeee07be724c5810ea312742
SSDeep: 1536:Jeuy5DqMSwSvIHSyBq7SkIF2hb6wYdgKTPdp5/aha+pOgflkB:s5mM3IZsiuwYdgKTPdXCha+ZkB 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\folder.ico.CIop 29.36 KB MD5: 662b210c05b05e615da1e4faa4fe105f
SHA1: 93af041467f4481705691a841916fc44913a40ba
SHA256: 9b12f0824cde1c4762e9d7b6bce6522483b44c35b926f00c0f9447c2473cf085
SSDeep: 384:T3DAgZLSdl30s6+tiK6R1PIGY9N+6htwfKEk5hXQkyJuuKZ68QbjC2tsmhN245G1:XBZLSdCJK6s79htNRwJDrbZlnhUuzCp 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\nYkivMTIATrvxLZ.xls.CIop 95.47 KB MD5: a03a56167c95ea69ff16a46e726638cd
SHA1: f450edfc3bb9485f5fa8b9277b9818b1bd514cdb
SHA256: 19ff1f8fd2b64b9721a17ba3c97a9838f7560bdcc3ffb39a5ce6572726474f41
SSDeep: 1536:/M4dSYwdhC98OvEDiCkI4BPzZE0b2fSLDOwmzHvcsToZZZRcoVMvCeWenRkNGURN:U4IdhC98OvRI4BPnSfiD8Hvc5/ZqoVMI 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\-PZcxu.pps.CIop 74.75 KB MD5: 363f48e75ced4e8a8f9de2374deb95f8
SHA1: 4c4214a6a8a67b8dce84b7daf35a293960099241
SHA256: ad355587f65263b96cfe4bb1c4c21bc670a1fac3c78b68ccfddb27e4c6ce3449
SSDeep: 1536:CxOEQhlrBDVk3BVI7dCkqmfCtv/FeabqTm9jw7dkhAv:+OElMqmyFemeOjwRkw 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\kDpdV 3nnSnJmGqPO.ppt.CIop 86.38 KB MD5: f86439244e79f7c981f4324d78626c7d
SHA1: e02d6db5028da8c2f03a349d713436205d463d34
SHA256: 2443d4e3effa9e0e74762e9fe1efe12c8c5aedf225ee0a4d81ca51f1066e954d
SSDeep: 1536:2CFD3/WYxtqb38UGQLKJMHACSjkkTLwg0L37XG2i5fVR5Rx1Xe4rJ:rbdxtqj8UrLKiHACSAe0LAlVfxe4rJ 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\wh 8KrD6eNSHE.gif.CIop 58.02 KB MD5: 7fe0168fbbbc3c8ebc5fba008f5618e8
SHA1: dd06540e617ba621e5bab9a0338dae5501b37451
SHA256: 7e4093763afdce9de0b95d9771e0da5fb3b88c3fa73ef4d82c5e5604b1bb897f
SSDeep: 1536:PxJOu/Q4xSID/zPhyrL6Ag58PIxB+w4ZlPlx19HBOEgFcEP:fOu/DSI7zP0r5ax4xZl9x1TCFcA 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\Z-AP6tzBW HexwllgoRb.jpg.CIop 83.58 KB MD5: 76543ccbf469a7ec81d1121f6f82694a
SHA1: 3897c24809a8afdf2c871ad4f5c70ff441fbd9d0
SHA256: 604dd3bc36eaff94f3d9bcfaa420e729299b1183bc5728779c64f1217d51f156
SSDeep: 1536:0kW5HyaWtP7fMi0NcNtRIfUKzmsfc8Iky25XQEpgNnQg4Q0lzt0s/DULK7eU/0EM:FW5Hqt/0NcBI8K3f/Iky25QnsQ0h/YmI 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\VX9FUGeY-MvLyFL6.gif.CIop 73.04 KB MD5: 61e436b2dab207a844fd4501c8570984
SHA1: baf893d7c1678020bf2d40ad6087dfbcc94fe59e
SHA256: 33e50c0ead2e296894d40fa7853489de2489e05fd95fed5f35e06458554e9052
SSDeep: 1536:rKUvpnbBCsse/CJVtv94T3DAI6p8UDfn68Bma86StbzK1WTUAgOf:rfn/se/+fCDArTDfx8JK1jAlf 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\5qiwP0Jfq.pps.CIop 76.46 KB MD5: a9386b5a2f5c82137bad082344a19385
SHA1: bb92237c9b86377ef27d0a0c4104ab2c639dac57
SHA256: 3ffd92ae25877e2b82d4343cfb675b883a397481ce45eabe86f02dbbbb0430e6
SSDeep: 1536:tYuZFe8tA77ame1J+pt2W/qAcxGS6U6Bhm4g04yx8zRHG9ewHia0WZqLm/ebCcPA:tYuZrc70+pP/qALJHyGum9ewHiKqK2be 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\P9oN_mVJ_5GZ wuO.avi.CIop 14.97 KB MD5: b8bac99b87da57d65e4ec9239da3c1a0
SHA1: 7e154766d888010f28c0fbf4545e81e080d35010
SHA256: c216ac8f712ad7479c2515d7f3ae76412fc26051d16cb6322f110f9243c2899b
SSDeep: 384:aihPFxwLZWfBBTiRWBKFvA/iGI4rWG/jz517uAFLZhVrGb:aqFt7eRW2Y/iG3DjLDhVS 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\mJbzYvV0BW4OFQ1.bmp.CIop 37.55 KB MD5: 47dbe79487ed9854abca60831fd86af1
SHA1: 3e4ef2f241945603362dedd067a11cbdfd00cd39
SHA256: b317db0060a088d482cdd2f5afa9dd01cc907ad092adc49dba410605c9d7eb09
SSDeep: 768:Ay6gv2gbtizfh2iBRkmEWbuPorInLo/vDzLIBNLwXbE9a59unMKDO0JVn:cMFbwzfFYWbiNnLon8GbE9a09DO0JVn 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\gRZdqIY3h.mp3.CIop 32.66 KB MD5: 57fcee1ebee3efa964317588efc23e03
SHA1: 5aef7da87aa8c29e8ba1f499609894a9f148cab5
SHA256: 1b95f80cc7478f83a60cc45c9724e89ec8930d0d736fa9c225b63aa6dbd29609
SSDeep: 768:aoSItAkwZkRD48pxlDDzp7MKxfkmA/h0H71fZPLR5/Nlu:vAkwZkRc8pxgKxfBR7Nlu 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\4CDCeVLoOGDNNc.xlsx.CIop 50.64 KB MD5: d43b43b2be6d1c8249ab86e1811483c5
SHA1: 315179df5e993152be8dbbc5b0317178dd590e82
SHA256: 532a6a3dc6b1ccd7885dbf7db6fef5a4a08917388e05f194dadcda71f8d22abb
SSDeep: 1536:bfRFY38wHRNUU7fOUc+CVCqCxEXTodefG1FatH:LRFY38wAU7OX+YX/tH 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\jf2gmUDSNpxqc ZNVVv.jpg.CIop 88.80 KB MD5: 85b5a6894ccc29eb726f65e2d5e37ed0
SHA1: a1533ecb002e9fb809cc4e1ccfb443531acdadef
SHA256: 0a32c933caeaa5f41788e29330e6bf1821b6b1ccdc9922364a592673044dfbcd
SSDeep: 1536:1/xsAID1eoXYlj9ivXHFweqwp0voT9iSfZUzS7a4KVoO7EpEkIDOdm//:rsA8PD8wp0AT/UzS7D2tEu6dS/ 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\ZmbKh2wUNBqMsH-.docx.CIop 41.40 KB MD5: 6a3400e9306e02c95f46a8880d1728fd
SHA1: 5820ea98cdf6631f27c92b49dd7decb51189008a
SHA256: b2bc0e41d1df1524ab2585a346cecd37d8ff5b555a0ab0202d1af0ad6a5bd078
SSDeep: 768:zpB8dfPSHZrLsWVq3fKdpPxUpVE79DXmxjaST8sz/waJc5kCQ:FB8dnaVAKqQhCW1mdaSwywC+kCQ 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\3B2V8p-DhIekN7FYAT.docx.CIop 64.19 KB MD5: 1c418b6ddbf981ce004fecf7df9d660d
SHA1: 5e6085068e704f4ee411a8b5d9166fd407353cc4
SHA256: 834e0a668367de896236e42859631bfbb5d8e3a827ccddc5cd054586edcd8657
SSDeep: 1536:Pg4X3ZJ1CSxpPs2137WULETZueMRLJG0rSDJ/PtTQGKx/cLHF:o+JJPE2NG1uHRooSDVPKNcLHF 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\oJoLhaSYb.mkv.CIop 20.28 KB MD5: a9549fd1fcaa8c5f69d0deaf499d2ba4
SHA1: 92ac47f3dbb6320230b516f0a5511efc0d7aabf0
SHA256: 5f397e3a1e46eeaad44bb11323a1bd6a8f5ffa8765292fe25e10b39d7eec16d9
SSDeep: 384:T7WECl9bxgAzj4N5sUpjamU1EYxY0ICs4I+yLtAtNRC1wHS629:T7CH1XsqxmU9/o4TiArRC1wHS629 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\ziNabL4eBQn3JC_djnr.pptx.CIop 36.50 KB MD5: 253a35a9f23516a6c88437bcd79e0602
SHA1: ababe7d2ec5b5bc5bbf5c9090ac8a38d8708dfd7
SHA256: 7d365010d8d1fd61fea1595a740c9589eed9f4b25c066687aaabfc0fd46eb1b2
SSDeep: 768:bWmpbQzthZhQI/TVviESFsVK48wJQJeojEB7lPhi/3q1jsJVsW:Dpb+tukTVvB9Kd4B5PA/3qy4W 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Searches\Everywhere.search-ms.CIop 0.37 KB MD5: b8ecf73675aafd7bab2a595c91ea164a
SHA1: 905afea338eea4946fdfc97c01eb0c7fc55a5937
SHA256: 66bb8c74492b331e8f109179525daf8b9ecee42d53b4e49a86fe67e407a082cb
SSDeep: 6:kwSjyvAmt5bDAQA9fdaiT80seilL6yb8x2t2bPvWAtuHEqI0il1LAKoyyzUBjM14:kwwlmtZDKl8ijseiR6ybEtbP+AtuHEqS 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\_eEl\eztfYAzpK0.mkv.CIop 44.98 KB MD5: f83637bddc2c02ce9e16bc8af48b4afe
SHA1: a3753920e591790765775bba0b2e07e131d52eca
SHA256: e4d6420a7b31f31e6b70130c9f0d742e9854f3f0c7394fe029be956c53ba1e37
SSDeep: 768:/3Zk5RCDVMUn9R96/5am9z5jP2hjaCAGCPNn3vHVA6U6ddqicGliu:fZk5RCDVMi96YUz1oCJ3nU9u 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\iclup5FUSoIoGUEpJ 8n.pps.CIop 29.63 KB MD5: 9f8edd7f93f9b43e3004c28ab4c265bc
SHA1: 9377e81ac275cd5694e6c07e1549bdb166ffaae6
SHA256: 52aefbb7419742500c05c5491cf554f369c253eacb88bb7f2caef456ad233958
SSDeep: 768:Kt5vrLqGSyXwHXOEYUh8uTawqNxR2kD5dkos8rBDkX6SZjC:+rLqKXUeEYUhhYcQP5s8Gq/ 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\MsxtzGW tpKDJN.gif.CIop 24.05 KB MD5: 9f4c179c84a20f6dafc30a4dde93b00a
SHA1: a34f8ab57c1c69e9714038514de3217a90675f20
SHA256: 3ad4526b31f36d42a8544c5ce27161fab53e2d989af0fdff8fa54c90ef5812f4
SSDeep: 384:tAkqX+rPW9Meyck+ubrjo117QzvW3VRMJ73wdC7ehdvR4mYsRn5DktLJwqb:tA7O7W9hjp17IulRw73wiYp4mF5wDjb 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Contacts\chucu jadnvk.contact.CIop 1.28 KB MD5: 762cb2b507c62a90a03e2f39ed5a7400
SHA1: 515bb389b97d4bff5b3f22c15ed45ae9e091b030
SHA256: 9007b9d98da592b2fd0968f4592353b73a9cacab7b91f490c4c7894427bc7ea3
SSDeep: 24:zPUCxQUa2ro07I3iLLOLjH3h21h95Brgj3WJ7E/8o:zPUCxfn7I3OKLb3hW9XsiJw/8o 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\wGSFbii.jpg.CIop 34.89 KB MD5: f7dea04d5a64daf0b53525314e58995a
SHA1: cc28a5c224173707ee12fd04fd88dcc70d40d382
SHA256: a652aacebb4b35f91dcf7fa78fb4ec6d2085b2742607492ed77719e50ccaed67
SSDeep: 768:6zXWRyv9wsrBRGSoJJfNH2cSVNk3G0VnhkAiLTvzr0JFE:+jv5rCBXfNg+3Gahi3cy 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\Na0N0W_tVH__RG.bmp.CIop 82.38 KB MD5: f6d629217adbb44f83c6f81d5aabcd88
SHA1: 5769b13433ce62863cb72aa4cf73d0194650d780
SHA256: c4be9466612bb75c63ee52e887712a8616b028bc036a46243ef9085a39961f91
SSDeep: 1536:NR78+NiAvDoQy7AosEISeHb28nclPBoqEzE3PAtsoqusQSIvljamAr:NRVFvMQ5o0LalP6q8cZG4j 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\CQjd3NSx.ppt.CIop 89.63 KB MD5: 65593ae77db532c7a659b8a39545a2d2
SHA1: 3219dfc582babbccfdf845ed6f0f2f6506340e81
SHA256: f03957ce3395e8b81b3bb09f5cc2553df6a89c4c624f0e84794c3843363f2db5
SSDeep: 1536:DdjP/C6JZM4wRVVAx92ESwCZJETnDZVHRRaHRhrjwqHb6BNXjUZUg:DpP/CC6HZByUJETnl1wnrkYUXOUg 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\oGyow62Ehp.pdf.CIop 15.50 KB MD5: b5924c85b12582162c661e9d1ce56b80
SHA1: 3f2d6d05bf16271f6bbbfa58a0a3f1e97332a24a
SHA256: 8b48712ed8e2012f48ec9611091b6e82c460c89ec10d9a70a3d3601e5e93c8b5
SSDeep: 384:CwyOTfAQcLv7pp2shrvLSa4E9K8Lhzo3xL/MREAbwm/FFI:CQTfAdLrBDLd9bLhwtYE6JFa 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\NRNil.wav.CIop 16.04 KB MD5: e42964ef1d3e798f5d6940b93011aa69
SHA1: baedc039c0fa7ec27eee23ff9bc310cd5bd06c45
SHA256: 4ca159c624c20a6049eeb0ae4665039562e4a2311c9b458597c563b6501ca16d
SSDeep: 384:GlfgxPu8hAu5UdGsQh9eaL9kX6vi1AaB3wkKhycFH9LT:G4rAWsQfeiha9jKh1LT 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\SATDQcfMYoPlh.docx.CIop 15.56 KB MD5: fe89c4959111e89d8a93cf83a1ab6235
SHA1: be0f9ae81a66fa22fb7e71a62265dd3342f87197
SHA256: ae88ecee6cc650b501ea37b78fc7143b0f03566adcf73f20fd81c393b095c6f3
SSDeep: 384:ZSQIbY3vsV2TuhaBXl6rnNCO80q1ArG9krT5QhWIHETkD3y4I:obY3vAKuYaNCO80HKkX6h9ETkD3y3 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\iFWD4toa.jpg.CIop 79.74 KB MD5: d039134951fe19aaf0871a8771e63edc
SHA1: 322e714c15d1143bf955f36a1465cece70b76f19
SHA256: e78c7a7e9aa948175622e543c1407f5b7e394b7744c0fba1c0539e649b3c5645
SSDeep: 1536:9AzvlyKSrc8GdK4aCI9GzY1zkVbCrtWFJuxf/wTQHOIglhPSBYpH6TsF:9ArlHSgSnGzdI++f/O8OIaPSaH6QF 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\Qq3R.ots.CIop 17.52 KB MD5: 1e27fb9276248c9476e9db0101a7928d
SHA1: 7b31a2a1c3d5f8bd8e8c45b0ba0da382fa165672
SHA256: b764fb8223e4f9f75b791f46628092c9b33ef56a06a6cfdac94cc2db28aa5657
SSDeep: 384:Hsw46FkDFqYvKElrY//fXrEigG/xtAI3/l29:Hsh60UYvKElrSQ+ndo 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\_F8m3hu10142ds4cz1.avi.CIop 80.65 KB MD5: 7d480a2c79132b83d562e74c1c196b1d
SHA1: 5016609cf078c665452556e18c914c0ba076fb86
SHA256: f35857b55fbd73ea1a4344cbe77286a90f934fd05c9df80c382f40b761704b05
SSDeep: 1536:0RD/xPG5DC3pONFl+dtNuzjSUYH8gQKkNWTaF28QJtNptB3nCw9w:0RDdG5D3GdtNuSJq4z3tB3nCwO 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pB rGU0A_4l5KRvtZ sr.mp4.CIop 46.52 KB MD5: 2654c80248934abc1878114a993c78f3
SHA1: c2e60e6a36be6f9c3ac489860d8f5b6b80f710ea
SHA256: 41884b49f71611b2b1c1464bb2b3ca75e40aa3cb380aa56f44fb174f8a47b016
SSDeep: 768:JugCcPmvlbc+eQ/KKp0NnILwFnQ8G1csJw4pPf6N/VSTqcs0ZGJWjKYq4:JHPH+rKzikFndmw4pP2V2qcJoEBq4 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\lcfkj@kiekc.df.pst.CIop 265.13 KB MD5: 3093a7d3b66b92c61a04e91c4a4cd3c9
SHA1: db3b8c84f31d898fea3216dc7415f0fe1139fcfd
SHA256: 94e422c679445cc3076c62bf1d3ac37a9f78b1b6d42f547efd4c8c4f048eae64
SSDeep: 6144:Wj27z724vpiP/NAyL2/WUhxhgHIGIRViSadVYx2RD9E8rE/iBhr:Wj27TpiXx+WhCkLYOpt 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\fkya9Y5PGZm9_q\Ins8Esh4IdpaiiYPl TD.avi.CIop 62.51 KB MD5: ac0c4a5dcb3154aae6f79715c1d2c1f8
SHA1: 6f4717775db9aee60fb8b2069893bf7a18870ac9
SHA256: 3596cdfed796d7332fe6ce4aeb9ef508ee1fbec75c5c0f4f17ff96f6ceb6cb6d
SSDeep: 1536:0mmOzHf2rnQXVxfLW1zs0zM4nvGuGQ3SFrviVdzYQi5T/:0mmqHf2rgLzunuQMLiVVYQu/ 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\Tvn8aqPC_U.wav.CIop 73.27 KB MD5: 1f26aa7399db3e9ab803a9ad83807e91
SHA1: 4b28a04df0993e7fd8a3c8b2a3275ece0f507668
SHA256: 5bbbcb56f725c0e0bb8e820d98ba5c9b5da5d353f6f687023e495d64fac9f101
SSDeep: 1536:bCRrp9PsvvE7WwCtano4hoxcGkMEV5yMJgJCUoFBk7SSk0TT+:IrESWqn4C4IBvGm 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\nP0r3x5d.ods.CIop 75.74 KB MD5: 04fcab666ef32883b672c14eebe50335
SHA1: e1fe3726b0fc8b9c26e98ef6cb41a3a51c96fc98
SHA256: a84328c62bc53bbd03a63a47584b05b114e285ba6eb78b41e34ca3c6e2fe6cfb
SSDeep: 1536:Eae6veVuhSoqs/R2XyyqfataE4Mu7YmvVCQLayfgc1wEMZmXwenLNGse7HVEXHrQ:EarWVugon2XydCtaE7cYm9fgqMQNJGsI 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\p6UEXQwLP.mp3.CIop 86.93 KB MD5: e86f28c5a5de17cb7d91dcb25dfdc96e
SHA1: 23a9522d2ac5de480a218c346a3f09e1afe3f886
SHA256: 082112b97769f1ff9faba9cc22c87213e80e11063285ed476eeada70dd91b838
SSDeep: 1536:gWnjs31SrQ9VdYmjmYkjU8sar4Lk8yyjJaugzAXobyQ9QrD7N5TlLd8yh0WEMipI:vS16QzdgYQUTNYJi4ugzAXob2X7Ndz7f 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\34Z4dfhq5fY_tfB.mkv.CIop 7.04 KB MD5: 245a82559e6a57b06ed29184428cd7fa
SHA1: 3f1bb0809e33fc1176dd3a278980e17fcb7fc6f3
SHA256: a984782741abcb7d89b5dc82d3f3fed13ccc4dbbf1a40b5d623e2dbcce355f14
SSDeep: 192:4/cuDGERE7zdCBrryfaGFCuUFaf40Z2DWc888mvo8GLP:KDGEW7ZCBH0aGX2D58mo3L 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\S20n9CABG0uo.mp4.CIop 7.48 KB MD5: 3ea374c2b790c0f91727e51e1c687f96
SHA1: 0cde67f79a9eff79a4f23d0a9e0da885b505d63f
SHA256: 82b6e1329e7556d9414536280d059f0c2715a65da815ad9b09075c5eefd4a176
SSDeep: 192:AYtwPOau3ygIxj9kOSfzPqj7cAHJ4NDIXFO7ocJnpKXC7R5rOH7nvaCamEjg3Epd:APPtuT29k/TqMAHJarJnNtRGvFlmKQ 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\tpkoPGhxV.xls.CIop 16.72 KB MD5: c62fc3670b1b4da4224d020a8e197bcc
SHA1: 264fb2a1e1e044c954d32540348c26fda06440b9
SHA256: 19674d9e90b317c9d69acd091723b31f21832f57bb22c0a5826fb7488a255d62
SSDeep: 384:l6wGSgnPQ6Ov4IhHykgjMhzI+aNUNlB2mTGUv8GG7FD5s/VLE1Ndy:owGSgn46OwIlyfmaNUNPKUEJ7FaV41NI 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\AK8M AL1ySTdgK.odt.CIop 60.37 KB MD5: ab47e62db4c362d749d70e4018661b0f
SHA1: 290fc5776462f16f4cb546c1878a4b921f52c2ea
SHA256: 53dae5294e2e5e4cb65530f932f8471490bdf5e0391061e7eae5f2e16b6e42e0
SSDeep: 1536:OvUyV8SF/vZ62J8p8EhlDdcdPuSMQTlYe08RkT0XOB+9wGyi:WU61tvZjJDoqdP1Ye0EI5+9wbi 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\JF6Z1xvDFv.docx.CIop 73.64 KB MD5: ee0a9a5dd60550dea4bda43e3ca0a119
SHA1: 246cc0d9ef307275d869e721a98beaa37a0844c2
SHA256: fec6631afabbf15a1b94a7916c8d5bd0a7737e91312de4edc4642af6518bb2a3
SSDeep: 1536:U2Kn4U5x+RRD+bibwxamV1+QIASEweqUeEdSg:BKn4+wRTrtHTg 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\s9_oB4RJJAVSDjPCS.pdf.CIop 1.42 KB MD5: de35ca97e2bcb1acb4d709e44feca549
SHA1: a95dda08ab1024d9b1b369478e1b1ee73d6e0e5d
SHA256: 42e106db66ab5573407a79cd3d4b58396a0bea7c9c605dd7a61ef6c90e78a92e
SSDeep: 24:fomHApTaw48g3o/lXPTXGL5b8UcQ2j27Lsn4dq6FyAIbXNjWc:fomgpGC/l6dbIlj2q4dnyAIbZ 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\gGPxR1SI06PikWMCd.rtf.CIop 67.90 KB MD5: 6c44fce89c2c3834abab819795e5464d
SHA1: 696753b94cc691beaa967cb9bab1d88101358bad
SHA256: d6047f58eb0da513884869728582edbebac2665c10280a338b6c601bf0861f14
SSDeep: 768:GCgv9DJJJJvXDZATwd/gDGPY/V9/1V02ETJceeBYAYyTXoarxOjJWdmorebF3vMn:detLJLZAT+gt9/U4YLaBrxKxzZM0Or8S 		False
...
\\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\LG0LJ99M.mp3.CIop 68.28 KB MD5: 4e39e4e7211b072df579cf65cce66dd2
SHA1: a1159851714330da581b6bb5baf479e712e45fee
SHA256: 827ea62f54b0d33927b9afe9dff13cea5fdc86cafc40930fa6c5a4ca2318c469
SSDeep: 1536:yKbg54zgtsCjLN6I3LU6oCBdqPtW6GVW3rjWalv3IijfM:RbBsqCn1LdoCB2WVVQWg/Y 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: d0a0fbd882671b4ce169eaad87126869
SHA1: 4e50562a549916f1c813adb591a0c8995f2d3621
SHA256: c1442b0b3161974f119632c5333cbff02240489c2b17f240faf442f12005d35b
SSDeep: 24:ewtO/Jz+NU9MZU8umeKBg4nh+NBD9CHx0M4RgPkBw0L9:xtO/JQUu68BFg4nITUIRgOwE 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f1cc78582dfa2ec51a63f3f664562f54
SHA1: c3ceccb431e5316ca949a7ba5fd6d9776073012e
SHA256: 43832206c30bc91ae70f5119d6add537b1864c8d1595d9dfa3f2f0417f9de91e
SSDeep: 24:ewtOjvoPFkjeUPo18+fxAOe/x1oBQ1SsvU7bavM0+my/uLe5Tq:xtOyZUJ+ZCx1oB+Sshf+my/uLe5Tq 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f70c54cd8d84066172f408af4444d54f
SHA1: 108fceecb9b0f48a2618a9ab15b1f3bee95289bc
SHA256: 2e63d1e63efbd6ee4cfb67c8e34b5886facb1a93d9f2d17f66888f723e98e57b
SSDeep: 24:ewtOx/Hrrc2U7Br20Mt3bj0UAU2ArIdwkhQnu5bi9JtX61L3XGauhKDoPjCVZ:xtOx/U2UVtMt3PyU2CIdwJ8WTtXin3uA 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 16274fdccf9d564643cee636a875f251
SHA1: 5149b740b6a9472d896e453ee83e4e014679dfe7
SHA256: 9139494657cf31df3089a5ab97de531b811f3077e99f0d05852e0a0dfe0f0c53
SSDeep: 24:ewtOSxbI/WU9lPPtwMl9tN85qQfdtLaAMYbxqsDihtxo4OEKYJIUw00:xtOSxbI/WU9lPlJl9DxYbxqsDihtlOpL 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: de3767d016154c85c5d63c449bc2aa4c
SHA1: 0c1ee4ef50b838bd41db0533d19958495482c218
SHA256: 643df95f50f1cdd83a3f7c3d3dd16d4ff3f714e666223cf0dbe593bda6101388
SSDeep: 24:ewtORbT4vtf/6UmkKXRk2VqKmH8RKF1/Zz/O8ZvW4/uZxkEsU/1OXFqUjUVFJmS:xtORbT4pCUmX+28JHGKF1Bz/O8ZW42ZL 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: d9e25a92319981ee0e2f864238e04d89
SHA1: a30f61fdbbe04f223454ae7b4ec81dd85babd832
SHA256: b4becb5d824e4d9cde5b9f9f4b859502e9f9e8cd2e56ad47a15a9fada149fa38
SSDeep: 24:ewtOAEOcQdZkgx9kULGSfH+pZRG8Y9ArURaE/5SWDktROWKZTQzZDof+AmjnDWNb:xtOLEk3Up/UY8mRXXDkfdgSDogjnRAT 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 4426e183b9e0995bd3e4e8e6179834ef
SHA1: fb3943f2520d23d61ed5a7017620a7941c0cabe2
SHA256: 58458442ddfc731b3955cdab93d218596afbea321248c15c705f29eb509e4dce
SSDeep: 24:ewtO2dP8aDE4wUHsPf0vfgzCcZfqVonAzUJ4eFi/R5p0K0+lF6yct6ejZ:xtO2dP8OEHU0svfjcZfGonAwSeFi/DPa 		False
...
\\?\C:\Recovery\WindowsRE\boot.sdi 3.02 MB MD5: 88a02e4e89be9931cac88d6f1e9e6fcb
SHA1: d2084e3c2f3114a53b5890f4e3abf7d812eed606
SHA256: c621b9135c2fe470b16e287f3f8c1f29817ed85f058b76d49536edc287cf309f
SSDeep: 98304:z138O4SxhVJD6A8NdHooe19i5nhBPkotyJ:xR4SXYdIRTUhBQ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 1cdef55d5d860c1475811eae2781c692
SHA1: d3443d174a669f4de630704be1e746fa76dcf338
SHA256: 746f1c8485254a9ec6cd967691bb44307aab234b9bb4016c452226d2a4cb4b44
SSDeep: 24:ewtOJAIU+Zl6zjHTmS2bNKpQ3yfZBYX0UPuneIDu90ZR0Dv:xtOJAIU+0KnNLifZcueIKeZq 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 9e71bc3e35be0bdb6c48358b5a902d76
SHA1: de3e9524b21a1e646475b03b6ab11d16cf81d63b
SHA256: eb6a935ffd7fe8a62e5d3662a7e1ad1ed231ecaa52a0eff8f6573a8e7528d638
SSDeep: 24:ewtOrGzuk8OUrIim2B9tD5mmcU1ZBwjTH9pet+t+RmyAztGv5Fh3c:xtOrGmOUUoBMmcMwvH9pe0IMYv2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 68eac1cbc9715dae1aa6408be638f987
SHA1: 340641f14ed6259fc8d311f232dd000bc7a927d1
SHA256: 08282d7f11bf3c3a3383f013e98edf92889bceef2c8dd949316d46e9adfe3214
SSDeep: 24:ewtOqSAJUUUJoXjKR32E4P8ONrwhTf7vbc/9i1qP4uJADfuJm3Aw4K708Xw4:xtOqSAJUUUmjK94kONyg/9iqwuJA6Jlk 		False
...
\\?\C:\Recovery\WindowsRE\Winre.wim 10.00 MB MD5: 4127808520f1f3656db64ea6f3848ee7
SHA1: 73ef69e3c39a5161d5557bc2bd4106f123308753
SHA256: 59f17da9b319a40d69ed648d6914dd09cbf7e4a24413231a3370d66df22aec3d
SSDeep: 196608:PKSpk2zfH2/NC8slvMJMyRRW1pcfF2Q4U0DLgywFXBnHtykX6:ySO2zWs8sGJ5A1pcf0QF0PXwFRnHtM 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: ef5385c3f9e9f5acf2bbf5b03318bff5
SHA1: 7ef3ee4290799a422951c4b09b7909d71786d4a2
SHA256: d98aec0d69c0d68629a6af08ab9b9fed7d6c0fea704e9273855de80f7e97ed1d
SSDeep: 24:ewtO4/pfgU9/bwB1c8cFZ2TzdDngTQ2IKQE3PqRifmCQ7eTZ:xtO4/pfgURbwfc8eZIBDgTQFRifbRZ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 11739b084702cfecba02474710c14f93
SHA1: dce631c19c605d91fa653ac9f498befd4b735254
SHA256: 0c7d417d0419253de359dc1c513c2b34725a51a423922f5f2846f6fef2036483
SSDeep: 24:ewtO3LsZzNUkC+/zVYWnOxJs92uZGjlDY1aDtOwRdGCAqPjV9IWvhe9kS52GmBl:xtOwZzNUkT/c82EGjl+aROwawjVPhxKA 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: b45d8c9d899330a233dc79599eb77eec
SHA1: 1613d0d6e56a959215ae5ae3b427772a04a6ad05
SHA256: 9f361c340fb4ae4d5c53021c8c55ecb92f8c9d5b121b52cafb8ea6318072eaf9
SSDeep: 24:ewtOYXnC7U9H8orh52VClEiRvQJ/9SAJ1E4EqyCv9Hf2Rz9kaZpjSSBghf9xkQqp:xtOYXkUhH32VhiuvI4Xy0u19kejJBgPC 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 333bd50d51048f3d07389529448127ff
SHA1: 2e226790b9418a80807d255a763711e9799550e1
SHA256: 9754fd8504a4126262f79faebcd9f39ac18b16abe9400625e83cf446c63ce751
SSDeep: 24:ewtO2ZNKWypKIU7a0PSRvoVTLBx3419gfLefT8mLn7PN7lZQFsZBjKVBKzY0:xtO2ZNypxUW1iTLBx4gf6T8W7F7bjHGQ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: b9b68be93bca4dcf8a2952ccc462f3ad
SHA1: 0aecce5d33e5414a4f91d61c56f83b8840230c42
SHA256: 328b2ce0ce20e3f287f4040ec22147c9869c55e8c2321cc736c71a44e80ec71b
SSDeep: 24:ewtOKThe5UfWXOfEOpR4ciySROU8SxEt18WOYGrilICltM+FUEJsr7:xtOKUUO+zviySQ1/OYeiyIef 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 19353751d7320a57b813d8a5fdbd4c2b
SHA1: 1035de63c7d2806426dd34ca6ef9e019468bcaca
SHA256: 99ebc347f8418d8df5cba209070002aff31cec356ed297da8e04e8e2f38b49ae
SSDeep: 24:ewtO5dRCLJlU/BB/2I4gcKMEGGKZ+i1KrdnO/ymhy94MNsxvPQn4ua8/wb:xtOFCLrU+IVn1ZEw4u+b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 6401b783e810c73ccd074f7c1648e04b
SHA1: 750a2198c21ed8a6be4780b579d9ae21d197cf5c
SHA256: c32be5adc5411fb20d01217ef0d6bc6118f85771203564e994d4a756144faf67
SSDeep: 24:ewtOeHkvm2UcvhcZ8Km2HxqoDSUod+0CjVorCtdR+dBKxHYJLXDog7AHvHsjt:xtOeHk+2UGhcZ8Km24oDSB+3jK8R+TKU 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 84d3800f1708964b90a4f79464f45782
SHA1: db5e434418aba17ceaff1a273871920239958dc4
SHA256: 7845eb4f4d40415599714a850cd76730b1abc9722e955c3437a5730983667531
SSDeep: 24:ewtOYFKJUo1uHvT4CCgFxtmPybRM6/gbgbuyMWxXYo2cOVbXUWyWNi2443ZrNdEG:xtOYFKJUoQ79Cgftm4/RXxX12rVbXUWl 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 03cd8f3d694bce441e29703a336bfdc1
SHA1: 245d98c17639c4f9ac0cedcb91a352a707774218
SHA256: 125ab07010ada842125f87ce7643b735c8493772bad7db31d8fb00f815e28227
SSDeep: 24:ewtO6BiUge+o2KdXcHEZWUacKSgZZZfblr9kvv52nB06tWa/ALUFrKNtn:xtOVUt+o2KCEZRZKS+plyYB0mWNLU5ot 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 34337bed1d797380a04fdb1eee26f965
SHA1: 761eeb9f50e40031cd8c84b06155c4e991c4a0ce
SHA256: 75d4e03795ec91eb7e91669a8a25844e93ec7c5bcbf06695f7f6df9a6f3f58d7
SSDeep: 24:ewtO6ppwo2veUjzbMxDx3o8UuJnWtZUqyY3zJdWJgm2h+sk2MM7vcLiZKd1:xtO6Lwo2mU4xtUuRWU8wgm2hhk2MM7vw 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 9bcb8c0b2b6a8acb2f50f89c1ba2d4a3
SHA1: e27eb27c635521b5f0388324ea66437eac26eb33
SHA256: bfd2ce3d7b151713f2619e9a866d0e91d4e9734d66c421a3c70ecd57aa931d8f
SSDeep: 24:ewtOJ9s9JUA7LF+50/Uji+YUfosACXcxSjBq9qF+7czKQVnVJJiqpm:xtOJ2JUA7i0/UD/QW+Sj89qFt2QVntiT 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f53abe830998ca59c3d40f7cf7a42009
SHA1: aab6dd8eee280fb09a5856d92b776371c2914116
SHA256: 9e92fe76796656f3681d8c35bbbff0f271117244294170153955d1fd0a499430
SSDeep: 24:ewtOFeFI0UjkpTzn1LI5yOU9ReP7P0MDvxTZJHTlaYZVl2ewhtLwM8f:xtO0I0UApT25tWeP7PvxTZJzlXDURrsf 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 40c0a3a550a9c27cf2b0e7cd18ab43ec
SHA1: dfeb6cb92a3e4c87cbfeb8ab6042b16fd61f66a2
SHA256: feaf486000bd0ef10989ab25beb6e71a88d5ffbd42b539b473b7dd279cc3f5ef
SSDeep: 24:ewtOHLRkU458aFpbfgUH6ryXyF6DTmwvmX9oMj9eRyZtHCqnihxnu0TQQ3+fwzGH:xtOHLeU2PflH6ryXyF6DywvqoMARkdVD 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: c822c0c6c72aa2f4147d0227ff4335da
SHA1: 4a1edb7bdd4ad81d48e2b03041e2a194a3372044
SHA256: 2ee278889b9ef712f4a6feaa838e6e11dbdace70f5947df15a79501a67ace951
SSDeep: 24:ewtO8Md3QGEwU8gJGXonBOHVMLZrZPdHkQjb36u3dh4OIvt4fkJ:xtO8MdAcU8gwXOLZR6QljYtakJ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 15a81a93aadfea10084fcdb67f6a145a
SHA1: d875a9006cac69b8b7e38427d08196672c26f4e7
SHA256: a326882b584d7ef0c417a15af73d411818a1bf11ee8d51b494562ebba93df313
SSDeep: 24:ewtOSWLuu4K5UddvOAGYWwhwFC+W1yXPfkVCHl6KFuvwVAu7m:xtOSOuuLUddvZGYWwhsC/2EYFhEIGu7m 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 4b9bdefc7b9510bba9477300d353072d
SHA1: 84d28802e3441ff5e9695e584bc3357f0c783fe4
SHA256: 153df47c331247ef2d248832fcd6f90894ab8d50490c889ae56f340c0788b64d
SSDeep: 24:ewtODdU0m8BGUMXmcYg3wl+1xPRI544JPobijdkeFc64mtv3b+qLcL9p9Hfv/5W7:xtOJTmYGUIlDK9P4Adkea64kCqor9/ng 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f434f4a7deb87d8aec6f0a612889cf08
SHA1: ac429d37130abf9ccfe0f7de30678a7e3c3fff2a
SHA256: 1d06d452908db4ac86fb7b05cf3b2065e2c430eb726553e6148807a258771717
SSDeep: 24:ewtOWEoWqoWfUQA8443LgXa0E88BmnxBV520LjE+VO/1YgKYLc:xtOWjdUQA8443LaXE+nfn2+jE//1YgKt 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 63bf12d602e8610ac7fdfe08ae0f1e8b
SHA1: 3f0cf313e3bb6eca3b788378402b8d3894d42ccd
SHA256: acd49f1f8ff4efba357d0dd6277b65e279a2978bc283571b96ec728206fc2a2a
SSDeep: 24:ewtO/NhGReIwHn2Uet3CGUSlPCXefREHNsnfNY/DcssoTVROcU/0AHkLlzMD:xtO/OeIwWUwyglP2ymCNcU/0AAlze 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 9baa2d6f9057b95f09c9c934e243d180
SHA1: a80187dcbee2c3871105926f298e81b4e0de43ad
SHA256: e17328b6d28a92e1b1bc5554518b99d3e1644891eb5d08aaeab7e6fe987f4d78
SSDeep: 24:ewtOFwpoJrseUBjVpP+h+LOpa5Qwq+3HnLmndQuJnMFaGlNleG+nig7psgel+D8d:xtO+poJnUBxpP+Ui65ynKCoaGcGgig9A 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 2fa0513ed988239c38b6fadcbb582cb9
SHA1: e0a93f6b85a6dbf006113f83fcf17e70c1fb07b7
SHA256: 45ef96070cd6305934ed72c2e8f9199f2a4e415e8a1170b87c9e49c4cee4a5ff
SSDeep: 24:ewtOZ0N1XyUv12/reUEZ6ZDkqZNMHvQ3dPavCiJSxnI5VRNQ3RQkt:xtOC3XyUErefZ0kq2Yt/xxn+VLWRQ0 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: ac696c4b7e55545d0070a2219ad53800
SHA1: 8eda169508511ab0360ec367aeb5bfe7c993bf9b
SHA256: 7dad8c71ff50823e51db938a8e74a43455bf4d8b50bc9c881fa383c3380c1531
SSDeep: 24:ewtOMJQFPUsUl1MstJmqQwnqgwWXNl22CSbYdlGbitoge7/tuZgQZxI00:xtONFPrUUHwq3W982fbYdlGbimgeggQO 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: caba0a22fd48e32f9eefdc1b2ccdec28
SHA1: 6841306a913fc94c70ba058800c634c8c93f6c8e
SHA256: 2e12e275b33a52d6c72318dd54a963b488e5e3488248ae093627924a3890a7aa
SSDeep: 24:ewtOA20jgMwpUUR13+95CD25nDQOzQx9ueySdyF6bqkdlQTEHGWpJ6:xtOXUUL+Db5h8vpbqknQTT/ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f146093bc3ca68a6b375960e1c21c1aa
SHA1: e64fdb6fbf8fbf0841b307d2abdc0b6c6e5adf14
SHA256: 0c0dbfdff60c57108ee5923e1baf40dca15e318c6f6aeead7e314b0d5b601b12
SSDeep: 24:ewtOyLeUCanBqbx4m5Bcw2s6TBQ6bS21E/6Nmbu4iVwiMWlzGl4muBu7RC4:xtOyqUjO3AsYk2q/6I0Vvlzy4m9C4 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 45ce62b93eddafbb36c512f80942a711
SHA1: 8cf9cfcb26f89dc6fe26f7a61271a4d13ae647db
SHA256: a2cc022764f93c0ff724a0d0801f66aeddef112a0a2d5c12e7be2ec1549a0a9f
SSDeep: 24:ewtOK0/G2UlmWe2bzExi6DGDEEFBahqN4qFHIknX9hkKOVk1eHqHgDh:xtOK0RUlm7ZiDEEbah7qr9hZuOeagl 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: dcdc3236dcb0748f25b290603c66efa2
SHA1: 6dc811b3b6d2c99923674ca17113fc50200e2a89
SHA256: 311df1b6a44c74e01408e8a825017fbb5a1acbf8ea60447ac9d26abd496e6c59
SSDeep: 24:ewtObKMJuyUJXZogeOIRo8YL2TOMiY3JbTM6YlyxKVeYihWUidlyy06FD:xtOuM1UJezOnbPMiY3JrK/i0UidlyyjN 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 64ce941b2c559303142cd398339c108e
SHA1: ed4f7a10f9620076b0b22491a8b8ce5cfb03567b
SHA256: 90cef183c1dd99433518aec7982f42da03dbee318e6e40b6e2b8682a2d1c142a
SSDeep: 24:ewtOA+NAKcxUDY+52pXiwPTipa6q2+28JMCvn5NSpMmbpUHJZs:xtOhNqxUDl4bTP6qm/Cv5NL2aZs 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 05579ac157251b439f26a92db5dcef95
SHA1: bc8b96d675a424013fec59c4044fe7f1263d5e96
SHA256: 4eda936162011a6a5ba732b05ba7ced81d9ef3790c14af98214b0d93726d332c
SSDeep: 24:ewtOhbtHmTMULXB9UaOBWy0LQJYKxpTnNxnM6tWRLy0rWxXKu/x0BkapExsrR:xtOdtHDUcaDoJhbNxMGMLyZJV/xxEzR 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 24c6027fbad94c283b4a5107621eeb70
SHA1: 415f2f52b1ce07107b448ca45df8454b7dc18b17
SHA256: 604951bc6aa92046d6df656b7e7a4138c3eb522a54e118665705e1decfe8dcf6
SSDeep: 24:ewtOLpl3UdwuGlZx/781D1P0rjqYszcl/PRIZQkrM7Z5WQ1ErELgRu2C:xtOL3U+uGlZxD8nZclXGZ9qSQ1ErELgk 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 1a9f182d98c7d0016f46d09912fc17fd
SHA1: dc0bca57d7fbd93f0efe8fd1851f8844ba32708f
SHA256: 7c6289972346d2ae0bfb77d5a5ed558cd6227ad2318010eeca9fe6699d389c4d
SSDeep: 24:ewtOkCuqxniNkwUTAPGjsXXH2Kwyj4Vcg7m0cdF4wRLurv9jyRhDcHlU/oseK:xtOLRxiSwUkRHuP7lhBvZyPcHYeK 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 5e5a99a79dfa9572772af021b28bfeca
SHA1: e713dfa5e94b71426553697bc95ab4df99c098e4
SHA256: c16fb0246261b396fce08bbca7b8a4f74aa944aad1ab667738f7a15a74f81639
SSDeep: 24:ewtOC/DdUmP8ZGHHdPWesSpBt8eJTKF7AURxtvtB3wUXOyx2B9y:xtOC/DdUmEZiRBtqF0UzJtpwUe7y 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 4bf2e9d808d8065d0dda032743ad04fc
SHA1: 13ccd97d01031acb83504479dcd8ae2824914ec4
SHA256: 52d2ce338e2add329441beae1ddeb62b2baf22a247ffcad620e158e7bfaedad2
SSDeep: 24:ewtOpVZ052sqUJi3C5GMp8Y+SPevdNWJs316i9b3GGfbdob/Q7UUvHJVf:xtOrZ08bUYC5iUe14JgAUdb7fL 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 74dbbf531713cfff34a63c8f5bf6210c
SHA1: b784344d2aba7b84bfc15533d0763bdde864a9ef
SHA256: 21619bedaf520daaf1043d231817fa9f840c338df475c6dff5bd3ad914d588bd
SSDeep: 24:ewtOB+WNu+U+JkiOxwy8JB+qHor9GZkVdQNoacAkeQQlYha0IsVcy3Bet:xtOZu+Uy6wy8JBuUA4QQ6haZast 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 1ed6195e609ea5d3015644c8a0ffe807
SHA1: ad4e3a808110bc58851c1cc6b5a41d5782a5e43e
SHA256: 3c50619beda257a9c17ea84845975b6bb13fe1dbbebfdd6f04c5b38db0e19d39
SSDeep: 24:ewtORP2U+S+9l3wVTekrZylSD8xLWezNQDPhHe2ysBRYsPTIJPda3wc:xtOIU+7QMkDEaezW7hHe2VBFsJPdQz 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 8a0499a7f5e39a20670b60e3d97eba0e
SHA1: fa20e30a056ba88a4091f956d0ef5079ef918eaf
SHA256: fe2b33107766859335e0fe9f097d80edb880cd8fead3ce88dad46034524c1d28
SSDeep: 24:ewtOidWKs8IqUusFZWQv86clO04FDTY4Cw/nhlMWfUZsWVnCiYAdr4GA6SYHcOvd:xtOidW8IqUusFZE6cM00DTY4bnv/iZVh 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f3d233378ca5fcc58f58fc84e62a2c6b
SHA1: 9a765212455c9d33e8f25a335c4d86cc2459ee78
SHA256: 8d6745fe5780cf48ac395243dd88dde2b6a53cac027e77b7ad9cc6ef23db13da
SSDeep: 24:ewtOYW4f52U9mJrNxjvEPpCpbyZBa/e0DXHNlrhsFdTsl65pCSoiMxVdpLJiE:xtOYWjUcJT+pieZY//DXtoFRsl65pCSA 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: cfda0f9bc34fe4bfec980824a72e15e7
SHA1: d458ecad8da6054952742184a20bec1e28bc10d6
SHA256: 5c3b18873b217d1e92e02ddd88a886eec5eef2f0f0507aa0daca3ddc2a49ab6f
SSDeep: 24:ewtOA6FkUC9iiZ9jB8U7nzLomN0xrqFrpYIz1Nt6TeDShz:xtOA+kUC9iKB8OfohGFqS1L6TeQ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: a2edaf63cbe92ee9ea5fe70305b66c50
SHA1: d3d83d659ec0f914eda9650421c6cea44ebb721c
SHA256: f1ca6e28113bfd768b9faa2671341350659d208243c3701e55b4b019ad574e4a
SSDeep: 24:ewtOomonY6gU9R9idyIuUa2MKH4K/svRnpq4/NusZ/kjmv2lxDaoF2:xtOoYFU9T0XhH1svRnrgs1xYxDg 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 98b2650f005fad82c2b8f41236be6d3a
SHA1: 432326708d5592de8ef6955f6edea86d26b9e949
SHA256: d736927e1f2da440f197f9e43256f40efaa59a381c12fba35cc6e0b7ab029cea
SSDeep: 24:ewtOCZYIryKIUjargXgFxFUPESKoz5nhQPXDbo7eiF30sfjdItTEhadPp:xtOyYIlIUjS9FbEERoz5SPTU7eo7MToi 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: cf1cd50daa8fdceb5839cd3e7a764f10
SHA1: 724e51c14be299beff586eea9b0af633810d9181
SHA256: e9cd77a904ac428b4d9ebcdb1488a07556ad9af31a240dbb70d1f76205361645
SSDeep: 24:ewtOlW4yeoUYACFe9CzNhmAOIP3+9ds2VXOTxQQi/AiG5:xtO9RoURCICz7v1POY2VXExQQi+5 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 1bfa341cd7e719efd5f19606452e7726
SHA1: f89bdce48c69ae24eb2bf8c9c4627fcc2186a3c6
SHA256: 691d72dec407757d89485d9258c65a7cd78467ab080e572864b75fbcd2063cae
SSDeep: 24:ewtOVEA8gxXdilOUWUFDES8hSliFedo1ksXIPaoltVDQLZcdxtWoBk1GL:xtOScXIlOUTFYlLFedKktPaouLktWoBd 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: ead3df99b76e5abe9031cbc61761fb5a
SHA1: da16ec36eac402e656d8afb73130065028bbc497
SHA256: a51081fa91792754678126a13d84dc8f144d4748c9a89a35312ac633cd929fb4
SSDeep: 24:ewtOAFHNypLd/5MUr/gl21t2sTCOrkLvasPA/Vv1mbRX5FAQqa0HkM9j/Uf9qBqy:xtOAhNyraULOGmCNmbRQQfMkG/1B1 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 945cdca4ebf284136273856ad117be21
SHA1: 31f87dabc1cfb6fb6cb801f9a105acd9a34fa980
SHA256: ef6b280a100318a1025ba30df4c08a61a004f799139a0f98f311527e95e384f9
SSDeep: 24:ewtOg6IElmwUFVl8GUI7X51uhzYs91cxsX75m2fSOJXxiRwuD2O5:xtOqzwUHl1dBnsXVuKX4Rn 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 0a89a00f721f8057eebfa328eeecb681
SHA1: 6a8faef4ffcd1aad9bc9e99b51e8a2ef04594c5e
SHA256: f209b5c5bf27fc550d3edd0bf28e0b752e56d0b11d4d7db9fcde996cf3716166
SSDeep: 24:ewtOVofAWbUNolQdN2qCaM7wehtS/KOWQPymRC7Q30A2FeorUzCwzs:xtOVofAWbUNoH7weh0yXtmM7QkAhoruQ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 8aa88ccc4c2ecc03d85369eadbde0316
SHA1: 704a7e00027cc91cb8c1e99b1a1dce39ca79d8e5
SHA256: 63b23cd2279f86e38de9c1868621321729990fe2a8525b6190de239eea6491de
SSDeep: 24:ewtOAH3UWedteUs308s+ligiP85+6KATZUbxH9oVRIFHesRhJuUFDPtI:xtO2UWedteUs3rJpiU5/PTZ29orIFTR2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 3f0ca76a2cc23a9cfbc7c249bdcd75aa
SHA1: 2560384c5280c85907b9925620dadfc04bca2465
SHA256: c5fd0b8aab63175babc863b8de0a6adc267148a5f8ff9e5c77477f85156f952e
SSDeep: 24:ewtOwZzmRUzjiCbydQiQh3bdIzeva8rqt4J8iMQwfk6KoOFtQv6AKR3Y:xtOwZ4UaFdQiKbdtCSqOpMQwfgo6uvxz 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: eb3d5f31b2162719b5e3b684cad76722
SHA1: d6235a6d5b6a421ec621ab12e589937bbe67e818
SHA256: 8975ad83f7e6c9d78740a33080d0beaff37eb1b7f6348c52e240006b6ba2ff03
SSDeep: 24:ewtOm09IdzgUNLhgardlwYTGWeI/ELWfn7GIysDcQXMIC1odaKxMRcmo3/:xtOm0HUth9rvwLHLu7ryqtdZxMRS3/ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: dd4a64c672bbf806a2f7faaba14b9221
SHA1: def52264ffb93e53a13d83bd054e7c48d86b7ec5
SHA256: 4babc27f85d5fc0566c0bbdbbf45e8607c441ad9319356155a8f4711b57b3130
SSDeep: 24:ewtOvs6SwNUk6syuR8LSluIfX8rCAIB3ncg7/7maNeubL/ZS6T3qAB3Mx3z:xtO0DwNUAQ6X8rC5ncgfNFbL/ZS6DqkA 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 9cb8584ba332364c5ccb9536effd3611
SHA1: c3893b35c47591f926292edd05ac2403a5a3defe
SHA256: 41568265258f7f8024183cc5c7b394d34b3e9f896b3af6b53925ce92fcec01f7
SSDeep: 24:ewtOINAc4+8qHUr1rcm68Nh2RFloCJbvRp2kB5oo0z/R62zlJfKYBHbViDojVdjM:xtOKAcmOUhQGNEn12no2zlJZZViUjVdo 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 68d0209e27262cb5fa06dcf327422df8
SHA1: 4f4e4417e420fdab08856f3383484fcbf50e9263
SHA256: 35fc4e51c65456a3097a0762dc059aaafece1a9bc54196ceb9ca903b36d959ca
SSDeep: 24:ewtObkG9GX+nSVQRUqKrl0PcxCG/7We9P0vqVryA8yXgOx3m6XY13r41aNc:xtObkvX+nOQRUqKrl0PcxCG/CYP0MZXP 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 306d67f2eb159f1bd09f4a0ea1962fbf
SHA1: 19142eaa50993bd93cb269adc8d1f91a76de679e
SHA256: 6adf4b1824e0fcdb462886eec57564a29f71e2433b410495bf6373e673d5708f
SSDeep: 24:ewtOkLJQk2tDUsyQJ1q9y1Tu3vH74MUrwgDy9U1H+LC2g5TC2M+wckLAO16EUI:xtOLtDUG1I3vHP0wD9Uo7g5TC2CEO16s 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 14525ccc43f8f11f5ca884102e7d7843
SHA1: 4e9953cb8c7d4e4758ed4fcb19517c5f49a5c796
SHA256: c502d234d07399edf28e88397f4226890cafc80271de05cde1f758f8d5e74331
SSDeep: 24:ewtO7CCU9UE0+T3IptCQhLLzhqW5PJAJI1u/Gxua1XZSsi4O9TjqQ:xtO7IU6IptCUHzhd1N1AGxua1XZS4e2Q 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 214138e5ed16a0a38a69d60bd40a4283
SHA1: 9cb83d3bbf999ebceec2eb4ad7fe0899921211fa
SHA256: 1b2a79faa48704b272e2733f9033cd6f76f77b2e6e50d1314fcb412ee639c28e
SSDeep: 24:ewtOMKbK06OUJkh1EHJuZWVZawVCXj8PS+GOq4Q0KCRUEUUUFZgKfo:xtOLO0pUGvEpuZWV0T8gO1mCRhUvr4 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: b308af9a2bfbc9ae0d07d0f409fe30cf
SHA1: 6f29902907dcd3410935759d58554884305e0195
SHA256: b09ea23aa883e32fe1bd9c49be64b390b2155ee231d3e040a1e8914f1ac9eda2
SSDeep: 24:ewtOCpeydkg7U1r0Ykq9Ich0qGIWpcKkVhIx03UqR2T3zgAbdhUBP:xtOC5df7UKYkMd8De3VR2T3sAbj8P 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 337c98c5acf1074af55197a79458cbfa
SHA1: cc83329494e61815ce018bc56a22047c14f03721
SHA256: 8d74ab88f393e167b01bc361a3bb52b4b2f34abddf56c9647e4cb79257e76870
SSDeep: 24:ewtOqhnjYUeNUqpyOuqG8xqP+k92X4QjNgCiKAITXZKJmGW0L5yijzE7IOWf82dS:xtOqhnjYtUuG+I+k8wKzKWiEnIndEl 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 63b08b695085b3004d2be03e3175aefd
SHA1: 6956629c1549b449444da401ccba0042ec25fc08
SHA256: 7237a0e25f9a603d4486dfb73a79041dbb5742f092626833a192e14aa6924e97
SSDeep: 24:ewtOlig/kUxMH8zHoEHzXAkICI+1cBPsx2Q/mcBwlU4Ep9rBL7Wt:xtOogsUxXbBAkJI+1ykcQ/7N4EZL7q 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 313d06e43f3e7eb79357d77b5ade2f87
SHA1: a3f18be2dfc65004410bdff805eb1d85c8687173
SHA256: 52034da9a87e69bfa0578ecddd1edf9e8a1258be0e77923fb62a525bdd8c21d6
SSDeep: 24:ewtOqvA3jaSUeFsXVYMlBomeXrND8/u0M8wUnLUk7hzP6jSyw1ZsunqdQahH3EK:xtOqcjaSUeyXe8a9biXM8wULvP6jS/Tm 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: c4caaba5609b2aad77d6604fc263af9e
SHA1: efaac689e8008a53c827364879f5d5ed3120a4f6
SHA256: 1f9fdaf1ce793f1ed1aa69ce0813d556d9286bbe3307ace264ab95913526042c
SSDeep: 24:ewtO0edFyceUl/OU/0HIOuzJyVNK/uYzuIq0Vtnmal6MGosjSgUK9:xtOnd2UlmYtJmK//L2MLsjpJ9 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: df35d294a61f3f13b28145f3007a766c
SHA1: 094fdeed5879b8421a2475f53546d580990a3715
SHA256: 277377d8afa25fc97fca92d489c6ca910110db0bc43e1564d2f16fb0025d6144
SSDeep: 24:ewtOvXKaiSwUP9SlytKVOARJZhc9hhNEyKU+7xw4w9KYkc2VngVotH1ye1y3:xtO/sUPU8t9A5wNEHX1w4w9KYkFngVo2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 89bcde1a53553dde1968cc7096651221
SHA1: 9a56c720a60f8040e919e1b20a9085e645dc0986
SHA256: 76da330e2de426cdc3c6d9272fd1a0645c4bdce1d43b99a357d035c9d2857340
SSDeep: 24:ewtOTFEcepZUAxi5xg+fNHWH3hkWznDYSvdKKqkss8r5ttOw+rny:xtOTF1WUAsHUXhkWDUksBrxOz+ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f69c98de0d68feb5260570f798bd4bb7
SHA1: c43886be7e4760b32562a7358cc0cbb5dfac8857
SHA256: 3feb0d0f5d805b7d6cdcb8168f7f774d800ee05995657c78d7769038f4f96eeb
SSDeep: 24:ewtOwlc//1YMkwUIt5qKrj09oXoUtAR+iKk2dq5sflKtBMCqmMl5MQtlyzQC:xtOwlskwU+5TYUtYqRKt6Dmu5tlQQC 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: cf71257b7c24ca145509d57ff033e49b
SHA1: 7dac405304a89912669c24925b83341b6564aae2
SHA256: 6925546e94981a7c358cde95c33580b80d03eb29d78db8024615a72eb7681ef4
SSDeep: 24:ewtO8vaN+TtUt/pWuQoGG7iiBAX5CrZk9yBuQ9ySD1sqm+tura48cDYR8hCHE4//:xtO/85UnRGpWAElgyx8SD1p4ra48EYRB 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 415ffbcb3492679770b7e6a14fb7be12
SHA1: 213acfbfd01d22a67d2120fe53a7e3be3f34dfe3
SHA256: d0eb28b4eb732e59df43f28ed6ef0a33c18ab7b23bf1f76469f9483d1e80cf75
SSDeep: 24:ewtO+n4xoBOUXBUzU/Pwmqz0qXnYxcEZgVCty+uT4qjDG8JJZ4bAHftGZk4eEt:xtO+n4mBUzU/6YAIc6s+WzjDG8jGJ2kt 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 7fe503ac4012f5bc7c2a3baca34b11a4
SHA1: 1ff66617b9f2fa73516d4a737137105280640eb5
SHA256: 2021a265f1e925a55344d8316b9c0646de8860618da906801c311989caa88e43
SSDeep: 24:ewtOBm8IwU2mf1TM14Dm9scv+b7a0g8WbYq1HlgI6vL2QKXb:xtOBmfwUlTM14En9Ps8avLOL 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 9d618b2dd4e14f48e552297b3d439ae9
SHA1: bcea46543c9c4a37104cad523a195c1855f417d0
SHA256: 4b1f1ef7a2cfdadb6a0540bd524a2055f72c4fd401535fec0dd9b25cf656c8af
SSDeep: 24:ewtOtOvq61UYGVG7Z2UoigWM9lKbUTWMf7SpX6ytxymU5AvYBHDrgba5:xtO0q62SQUoRWm3LSwSJUAYBjV 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: d447e211aa2a0f8fbaafb7cb17352c60
SHA1: 91002ee6e016428cfd0f3193feca09966093b85b
SHA256: bac93005b98fb42c2312543b92345a84b806e82b4b5a3f4efc079227455cc6bf
SSDeep: 24:ewtO6B6Uerr+V2xMCfajCpLgElUapoH0Kh2ays:xtORUerbxjfGCFJSlH0Kga9 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 8cd5b33826faed0f34599b0f182e8a0c
SHA1: 7cd75ce8b83f538265e983fc9e0c59a4825e4525
SHA256: f9ea3e3401af0b290c042d885f7e10ad86ca118d89fc55c9eee249eeff2e0a99
SSDeep: 24:ewtOCfJEIXUeuTpA4QcKgUkoDXNST2hOhEJeCHznQl6f6Lo3GI8HEw3K67A:xtOEEEUYORohST2ZeqnE83GIu3K6k 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 2e7da304d8b3db58917635dbb2c3bfef
SHA1: 85a7458d8a5ea40bcaf30cf881949e419b4e8649
SHA256: 6465a25bb63d324b8a4c40c6aaf550992d07c173bade649fc335bdc3d5d4889f
SSDeep: 24:ewtOmocp2PUfeCuwQ69pVB1fhqzIbSI2Qb4a+jDZfVFth9JKu7pzwvW39RKm4KBZ:xtOmtpgUfeCuwQ6VBphqEbOIcDHfzo0J 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 9da872d51e9c7a527fa2d2892b931ec7
SHA1: bfd32d96dcc7969adc962acc140d488307ebdb34
SHA256: df095f5a6a64f5143f7e59bdc2b14ee71ffea84abcded9cf9f6586d09b7b7aae
SSDeep: 24:ewtOSNSpUv6lbUCnGaPBKPjStmTqPw3sfW0RVhiEqeM8IV6Y+f/S+rCMV:xtOSYpUv6VHnGaPNaOwWnHhbM8PY+bC6 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 5d4dd0551be533a00ac29489b65a4b8a
SHA1: ae87a5d6e15237c564971e949808114eb35cd403
SHA256: ad8a792d197ef1caa232ac9c1f7e27cff2ebeb28f84c861e440cb1b21dd88754
SSDeep: 24:ewtOW+EY1BUAUSu2d0RlZgzGx7JdubVPkio81so47nviuwhRsWZeOB4JD5HTPrgg:xtOPEOU3SuZgG1Jd/itB47nvohRsAeOS 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 40a251031cc1b71758855eee99b7fc86
SHA1: 0a842a15e0719819cbffbff3b391a92d41450a17
SHA256: a94eca415862a183fcfacdc4da1d7cf238fa68b5243669f9ec1dba9bc4d49c52
SSDeep: 24:ewtOhf0ciAUrBmqoUNateY8Aa4HYJYItIzpyFJZsf8LtxPepTq:xtOOciAUr47N74JSybZfLWpW 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: b596016dbbf59b2634ef6dee1dba8ff9
SHA1: c8e92e8893668615183d7807298d8aff3f16aa19
SHA256: cefe98dcd794f3273e1366eeea59d39c3a03ee41eae5ca5faca6f29d8823dab0
SSDeep: 24:ewtO0HvhsU45GTDfmksSyqPIiHz5i0rQYoMRHh5prqMdvGc/3GUGKq69y3p19N9j:xtO0Hv+U48THxyFiz5/UUHh5EMgceUOP 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 6fdf1080da7454561137ecea0348da7b
SHA1: 4906da3652a431782450dd2ce20d49eeff98bcb0
SHA256: 522f66c793d6c274ee05b231cfe574bce5f537fae9f8c333b77b9f1cbf5ebd18
SSDeep: 24:ewtOioHVTUAMZJUNyXxoi2z5dR203KOTPzT/YJJNizm5mMMIOK4bmLUw6dVLRs:xtOiMT0DU8Xxoi2z5dA0h7QJGm5MIAmv 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 8380d12cacd2913a308f650e4132997a
SHA1: b93cf7b6b84073416e4d908c400617f055200be1
SHA256: 94726cc20c8d03688714efe45db001d483b46e1db02dae7708ed63e1603a69ea
SSDeep: 24:ewtOaNAJngUWFAvWiKxDIZGe23bbCyyVE9HAijiWvwHjAxbu4FcDjD1l+AFCg:xtOgQgU9vWiQsQe2LMsiOwabu4FcDXWS 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: a834c2b1f40968125955147544f0e3fb
SHA1: 7cc0b7d7597ad0cde880b3236b537178829dc77d
SHA256: 319b15a22a5513df65c003c4749213af8b5a3b162b39ecac2df28b1ee71f1361
SSDeep: 24:ewtOKMGmUnJoyHf/HFreQkMa+xeRmQWJcVVQsfyg1WBMeyZIKaCETLJIAbPh:xtOKMNUnJoyHHFWNouVVQsfVsWVIxCET 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: e950ac5ec3a67c4ee722770da93df69e
SHA1: 5b25e71f01d09bdb4eba916f927589a55a6bf219
SHA256: 99b89b6ed4bbd018e7f54c6413ae2e363534b9406c3bf1060488ce0e878c6ef0
SSDeep: 24:ewtOmSpz5U7/7ke/gdah/520ddK71UNPtUTw61lgTSoXx8If7POnqb:xtO3ULvsK/003K71YSTw61qTSoh8A7mw 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 74e20f05d448d7692526249a2cdfaec0
SHA1: a337bf494a6b18bf8ababcb2a258ca298799ec2c
SHA256: f1d73db5119f9458ad0a3660124193a0587ef1dd39ac19a43e8363094564f0ea
SSDeep: 24:ewtOjm6eUonp5YmJLUjbapj/XaSY56ztJOpUTC/F2:xtOjmNUop5YmJLUipDaSY52vO+CI 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 17fa4ff4617915ef24319b299c23cdad
SHA1: d6af85a058d621ba27d65466d691de15b591743e
SHA256: 45a8726ad7d34415e5d1cb5b235a4ad03aebc54de41fcdb47f697ce285baa37d
SSDeep: 24:ewtOu+eltV1k9ZUQU63913+YWZVxzgnLw4GYikQ0cOGgTQdEftmdfUD0zEKO:xtOuL7ujUN63R6AXiJaGgTtfodM4gKO 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: e4b23be4847dd3d9abd02907cba4f1a5
SHA1: c8841fbfffcf7d411af18d06512fc474a8965645
SHA256: b32d89ece5780905fd9518133ac462dbfa57df6d2cf77bd47f0c282ee794b0f8
SSDeep: 24:ewtOC/9pUwAIWT7iicB/B8QHovGUaja6UxtUyVd9HMPlQQQFfXeGbg:xtOCbUlIW68QHovGUajKtUtWxgug 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 524ca8c09459f2baeecc94f23be8fb52
SHA1: 0a5f38547a36e43283eace4d4d9bd5952a501c0e
SHA256: 0e363708911b57b5c91db10f73f81cee578647825683f6b5b4958f9e44c62f43
SSDeep: 24:ewtOEeV2KUVKMmh0Q8DEFdpmxm8FVuub8tpGJxkfQlbw8Q7EcWeXnM4WJjbj:xtOE4U8bADEBmxmsVIpGJFkvAVeXnM4w 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 1ac9f38b64136d610892e8f8a01bf16d
SHA1: 7bf4eb44baa66c6eb8e4e80893e026f96593742a
SHA256: ff2d95f9f31abe9732cf6fa3bcee068f759ebea510fa0227291cb3648e1937e8
SSDeep: 24:ewtOZpf0U4bqF6QSo05bL+r3wuRLvWABSVUm49+U3+TuE8FainqSz7:xtOzsUkqF68WL+FL+kSD49+UHE8FarSv 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 9a522010599b1947875a2ca17675880c
SHA1: 21e04f622b00d880f1c42ee9066b90c6a11ad28d
SHA256: af7bbff4de0db8d986285b68d8af9a6d4a13daf72dbb2897d29fd0dc9564c2ea
SSDeep: 24:ewtOEBgt7M4UUXpRGPaUZDVrRbg5OOMO5uzJRmICS3Y2JPwZwbc3pYqt:xtOzUUTGPaeTbgwOPuzaS5rAZht 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 605c515dd5a5627602faac9e24dd055d
SHA1: a8e8bbaf8739fc07e847e4c82de0b03264b9e873
SHA256: 4251fb22db050518c03e06c8a0650e78deb0238d072b877919d0568f78689112
SSDeep: 24:ewtOivJkTUqvsk0Oe7t70uijz5xz/VxVyVBzkr3j7asWL7+ckYIwiVeJk05xoc9H:xtOivmTUuZTq70D5HyVBzkr3jrWLWN1e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: c63e1d4d8b3c182014de66d8ae9e7cfe
SHA1: f20452e84b166ccd91999879f10456723b488fc9
SHA256: e7119db6523ada5db8329f66fbb0ce62b3d99efab8b61977a256d4e36ca7ff37
SSDeep: 24:ewtOQmfkogtUd5LlYLTKicBeFdVaLLvE/gsborBTEjyqvA6vuzgrxzP+5xs7va:xtOQmfiUHS3RccYPvERbiVQv3uzAxr+p 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: aa62f1bde0e8e3c5f71a0891e633149d
SHA1: 4e8c529b282b6101d85c1a3a6084b9e63841ae45
SHA256: 606f9702691c8f8c3c7eed171682352a31820f030840c3b5965fad3a589b1e34
SSDeep: 24:ewtOrAckFyjNUetrv6NamigTi1hzKd0p0nuJAeCCCbquJk21HWynmW/AcWaRf/:xtOqFyjNU0SNligTi1pKd04uJAeLuJk2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 76a87f09caf5409e1d4406967b49ef7d
SHA1: 4abcc804e96c678f71dadb3007077d7a919283dd
SHA256: 31555c521b9b340902c9e5ece259d567cace8d49528767edd426104f7271c8be
SSDeep: 24:ewtOBhtsszU+Uwlw5uXffyYzrnGyON9nMLhW+YQuHdMkClkYQWZ:xtOBf5U+Fw5e3LRGFBlQa2l/3Z 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: ab293fdef079b4e2cd0b83ac5402e2a9
SHA1: 9eef2aa394c45592f150fa2fa28d28f34e9324f9
SHA256: 5e743a0f8802da7906eb24e17063b6fb0e812c4302c3fbec4b4e6f93def65933
SSDeep: 24:ewtOG2y/2z10eUiOaAL35gg+XsZB4YCRA67ZY605OQLNcUJeqzRxLzFfXKS:xtOG2y/2z10eUiOfkYB4YCmQZV5NUZzN 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 3d068353f27d1320ddb9c2767890a659
SHA1: ad97a874de20b7edb99a4389823c5b0b8a290ab1
SHA256: 439db5cb04bc1390914ff99f1d48e512ada5a24038addfa1ac0e2aea69e5e212
SSDeep: 24:ewtO/0ZIRUaMgykzE6MmmuIzr0otSjGdaSRPC3RmpTx91INhkckjdWFKK36yAKG:xtOsYUahyQxMmmBzooMjGjRPYmBREkcE 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 054586cd86f33ed2db1a0a65df6ed515
SHA1: 2a4dd6bd6d5d699908542d52888128036e17c1ff
SHA256: aeae9014c61b75bf39425836bbf1e6631cafeb1d9a258160cef45254e75f6e0b
SSDeep: 24:ewtOkRS8veUhzj2LP1bRtyH4McPLfS/2U4s/y3IuUhkb/eaE:xtOAveUFKLP1bRtbM+L2py3IuUhkbGt 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: c34964332e9b775f117cb97356124064
SHA1: 14766b66ff2cb331fd8eca62e9ed1607bd3a3f79
SHA256: 4f988781988a75eda22ba1ebcf1602d9083f3bb1f7be68a0b87dd0d00238609a
SSDeep: 24:ewtOU20JiUbOn9k/iFoQ5NBkV91uO/4zYqHn3PzkiFM0M2diI8NsJQXaN8D8lH40:xtOU208UbOu/iqQDBkVPGn3PIihgWSKV 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 50cd6e385544dce3951998d3bf1196e9
SHA1: 723cbb1ebd3d139acd398603af4d16e098e8d00e
SHA256: df83332c72ed740f1a558e60e2d92e028ee86e370a27428c01405f9a6fbbfb15
SSDeep: 24:ewtOShOEQ4m82Us016CJWb8Q9QvZiOe0et/65kQeSQoX9TpASj78+2iuTNgNl3gl:xtOShOEN12Uh6CAAjvZiOe06y5j79hp4 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 2de8ca7b21ffa12b047b86d7e3161424
SHA1: af15b6debfaec6c96dd0180b8319fe7ae8a6aa96
SHA256: 4a0ae62565c579a35bc7ff26c6432d28b85ab4389f0f20cb37b7e7998a7138fd
SSDeep: 24:ewtODLWMUhziH2E7nCAp35iuLniBz1OKNZ6/dw2U+9cS72oFzMbTHw4/:xtOHWMUN0xCIiuTi2Kr6Ff5cS7DFzow0 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 60920b7725e2596d259ffe4c0e429fa7
SHA1: 437253cf339b812d26053048a1d3f4b1ab858e17
SHA256: 96893883f8607e9f998630c15f0156cbf8bdf6305d7cc7e6b60268f0b9cb9ab1
SSDeep: 24:ewtOqN/U64KKNPalEAIuYQaQkGECiwXwP5DqIVKwIehxKoJZDNWgv7lORi:xtOqN/UXLRHuYQ09pP5Dd5hxKo/IgD8o 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 6590dbd5fe3448cb4529469314934360
SHA1: cb1216bc754b4e28e7ec2cb3bfdb91f897a016a4
SHA256: bd7a99689bd372cbe8ccd176f3f3b7aa56218e7b15bfac1d59f582319e01a3bf
SSDeep: 24:ewtOL+vdr+gUx4HuhUK1LlJHxZmdrNplpygo9z4yrUK3i2Y4RU6bg2Mm:xtOL+vdhUx4OGcLlJRZmtenzQCiOU6bD 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 0e0e0b5f8723c42b6e823f51b4de567a
SHA1: 09fe91b9719b02cd748d4841418860bcd3e76d0e
SHA256: 8f06ec99e19bf09616dc0b5fb2cadb3622d77ca4add419899f2dce3d470a43ca
SSDeep: 24:ewtOaWYBMTxkCW/UE9TBEVptVTyaIAqZKf/nbWfPAY32Q1V06+y5mxjf2UrTMZtT:xtOjM2W/UEzEVp+wqAf/nGnmQr06+nj+ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 1bf23d509e193ce0fa165ce5efe8fb68
SHA1: 6d21f038a22924cb6fe7cf2fdacefd82961c5faf
SHA256: 3badf24749e353cbb174d73fbcebb6fa4c516c479955afdd22570120ac02dbc7
SSDeep: 24:ewtOJVR7heeUamk/XgBf/Q36bJBdqL9a2ATjOxq9uJDRKo90Ss33b:xtOJ1DUamk/Xc/7JBdq8O8uDQoCP3b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 401a254dd8105945e3e4926ce8572315
SHA1: 1f3999d9c50125d7c15b1e7873942d6535638868
SHA256: eedaf27ccf8e56e789c44a79c0585bcfce358b256586cb9ee3ddd399195071e5
SSDeep: 24:ewtOguIFIIULJhVhbAHASTqVOM98au2iNCHc1gXvSGA1rLwNe:xtOgFCIU1fnSTqB9LioXS/yQ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 1b4f15030741d467bb5c0721fbbaa840
SHA1: a78591eeb201685dd9e75a07c87a728318eb27b2
SHA256: c2caadb9401f3be4f89a1960113a122e5a31804dcdcbbb7a55f54f08a9593bf7
SSDeep: 24:ewtOMYe+zF1gUAluQrC7vzMGb8e6qkMcvQXklE9HkLBUKHzquR4tZfSVc8nziAK1:xtOMYzF1gU+1rC7rM08vqoWHkdtHzqs2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 8f00de994b82d9a1246df5f70d2750f8
SHA1: 67f1abe68fcf0e2ceffabbe0bfbdceebbe33b06d
SHA256: 7fcd84e14b74694866e7279dfef064b31d8ff59edcb0859803d368924b0a3a9f
SSDeep: 24:ewtOoCetysUlB2Y4JZvr8+WaXVHf2hkt5wZkVniDgKCRezzsKHgb:xtO2ysUBMz8+WaVfskt50kVnsgKCUzzw 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 9b58c78c07fbf664ded599585e7c68c1
SHA1: 352e0d9140f27b4c5147530bb5049d8ca15aca22
SHA256: cdf45435260475e2927c87d06224af44832500a45c9d61df9b63e4e51ac79bb3
SSDeep: 24:ewtOhuDRXqySS2UFkhRhAFgZK/fIsvkJjusra2FFcspYI/6sJP//aNLFWIjFzwxw:xtOhODeUORhZkwPjuKa2FFbYwXyT7FMy 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 9b00ff64a7f878d81fe864059cb979d1
SHA1: e01e6c2347c7bdf09049f0e7ebcf5d3f60cab7fa
SHA256: 63d42a6748503c0ae40ed067f49def55c28d8000a5ab02f76909f289b7cee860
SSDeep: 24:ewtOPhf5qUBl5VxjnNuAEW5FRtCBntxhBfiPhMWY0lm3T9ceufHDPMY9xC6PGHB:xtOPhxqUpVr4rBfqMT9ALd9giE 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: c48c9c624fe4e83ef66f7cea8ccb660f
SHA1: 5c1c0647ef999b8cad3a1dc641c5f91ae6355563
SHA256: 551d37f2acc2fbe5ff31a834409a7755e7af80320c2fa35ee8ada0f30d5e613e
SSDeep: 24:ewtOMB8PDeUKgBgxVGPJjU5McnJWI7nWF1Ip2vSPx7PKyDz6xJjZxYR+ZW1C:xtOMKyUKgGVe6MeeQp2vSBPKyf6xNZ6y 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 78a0dd52001f8d13e33261e3130f57a6
SHA1: 38c21947eb76085f865c95583fb8d0f1315595b5
SHA256: 8fc415479f5184c8f95b60368785de8665124552d2c2c41760c30762013a68b6
SSDeep: 24:ewtOmv9MvYUYZnZLb5BQaLQQQ+Y2PcJ5sKr+8fEE+qd:xtOPwUUnxb5B9m+Y2Pc/r++7b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f69fadfc90212e16c36d9398947bfc79
SHA1: 9514d7e4007d3726441cb202a7d80dc9d048a3cb
SHA256: a94182f9250c9946ffff395ebd21483483f25fdf246cf3d83514421111933d8e
SSDeep: 24:ewtOKGIK0UxJJ7TY/Zmjw4jXNel4t38/SLGwi5+LriPDrY7pUToSpNaksiXs:xtOJILUx7TYRyNoG3NLzi5+yrY72TFpU 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: be2946358da76ab1963454ca77424680
SHA1: c23dee47898e5529f547426005e684b40133897c
SHA256: 08b3b5f044189325b7bf9f43d95f1cd1bdbf30b7f6abdae1e2a31843a677c46b
SSDeep: 24:ewtOX5ZjLRUr+VuhrbrWdu4bVlaRKaX1/jQN48d9K/C/AFK:xtOX5RRUr+V6rW4LRbu48d98FK 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 78312a006f9e66190e1d18882d8bce4c
SHA1: 032149678c5176c97d4244750dafa17a7fd32315
SHA256: 762dd488f8483869212a92668931b5f4a7aa3127b042429f9a8ef778fdd701bd
SSDeep: 24:ewtOrzUytVrqxnVOUp9tDKnpoHXBI38wnotOYepn9cKHJCASfCYvMI:xtO/UUlCOUpXD1xI38xtOYCXHJQ9EI 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 0b4b8e9b9e5a9cfa72cf754b3add86ef
SHA1: ce751c5ec9e09d4b88c16ce8c978599867f48089
SHA256: 97808f835212486b7252b4442d97afa9c2d852994b9b8303bd9be4de549ccb0e
SSDeep: 24:ewtOP/FROeUSX026dPGtiSirWx5vSTtbp5oET+a+jtuTF4anmOj1XxeHO2C3PhJ:xtOFMeUA026du+05vopoLa+jtuJnp1XP 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 4b45e59366459b2c5fc9d8718b8feaf7
SHA1: f37ded8b9fecc5ab712fd7f411b4a8192c4f2ca9
SHA256: 1212272063df02a73466131dfd95cf4c42cc8249ab5b4648f1264b0496a532a1
SSDeep: 24:ewtO+BAoQXWAwogUqeqyv0FLa+xoIhKJwiNePNGU8EezNerLiAnfbnC8wHwn:xtO+9QXmUqeBOLa+acKJuPUU8CrxnbCy 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 67f2fa31c505cb54f131a98b5497598a
SHA1: 80f47e56faaa4d94bff46ca361eeef65eab01bd1
SHA256: 7b46c6c570424ba4d3478c76b15e23c1db0a0693941b1d8f95e3e1c6cba67660
SSDeep: 24:ewtO9TYihGiUH6ttGZld9F5Wy5Amag6+B/:xtOWioiUH6t2trAhHs 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 982d914443ea21375549e7dcd9e52260
SHA1: b652d042f8f37424856010ec42800840e19d5412
SHA256: 6380e699a4ada0b92b79740ed2268d8a2966a0380903cb479456211a719dd025
SSDeep: 24:ewtOqdoZel3tLUp0I89EvjCgPyWSElWctTO2/IFwkvpstuIt5cpsLro5JeU:xtOqdom3pU58aL/PYqttTO20zxIuItLY 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 4398239e74918eeb7522fc2f0e90c89e
SHA1: 29718d11033094d67430dbf13ee44d80a5994df8
SHA256: 877a432dacf1d289bee538878d4fbafb99faecca2359b6ebde55bc909fb30703
SSDeep: 24:ewtOJjsdbYU8w9h24awGnWR98uFS9x/Kc5ALKtiUuREak1HuMaOM1yO49edIx5A:xtOJUEU8wmwrR98uFSz/Kc5A7gOMu494 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: b33a41b368f5b7878ced4b24cc8122bc
SHA1: 124f1b339ffbb7e3123881473d4867bc90ace6bb
SHA256: 27043a1e36d8f22d258711dae02c4dbdb8992367c9e43939fe4fb88d61594cda
SSDeep: 24:ewtObpsYwwUlAj3IegwvZbCTjVJhI1+ztqaDJzvwsRJvjWaHkJDCD:xtOGYwwUATg8YjBMGqS9osHWayi 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 6b1a1e75cf3e207e412ce1db3d49d45a
SHA1: 200f5b11de795a6f5db14a0885fdabcc95b30ddf
SHA256: a242b51b4b651e13b8dd7a8ca01a78288da7e37a85e30aae6a4980e1e5ff2138
SSDeep: 24:ewtOfQqHv1Uv3QUGmp5KKaw/HL4chE+PyALdqS6b8O+p9L/RFkpC6Qn:xtO4kv1UvlGi5ppHMWlXLdqJb8O+n1Fx 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 4c786576ff5e113df5585f460323bd0a
SHA1: c211ab3ef88e08d8f2e7f0bc56a2e556c239be9a
SHA256: 15b820f79fd4adbc1195340040e6a61919099ba69bb9b88e0113c1d5ad880708
SSDeep: 24:ewtOmEEViULUyDQj3gEQfn5FX+C0fGKIjmoWk7JuF64QNb5QMUhDyAG:xtOmEE4eU+QsEQfn5FXIGKIjmI7YF6Bt 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 6e86199610283183ff4f5d14d7c2aace
SHA1: 9f893cf06fb6c47d5c6ee44c94fc6b6235571fa8
SHA256: a1be992d0432edeaf1765b7ad70f7791ef515269ea4d58049e284e02f82ce80b
SSDeep: 24:ewtOfo9/w5CcUI8wuK4QMHDtMqlSgRjmD7hX6ca5NHQstD7db01NkTcIEvc4:xtOfoHcUI8wWQmPl/RjMhX6ca3HntPdY 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f8365d9f53c5b00977c05d4e570b016a
SHA1: cdc6a5a926daa9d2c2d6068e1c406b137b99bf15
SHA256: c358552b5c3c16a1011356b681cc9faefd0432ee2513fa33286ba31834803b44
SSDeep: 24:ewtON7PuUSwUUNmjz8bsopcaKyuWGa2KBW8wvo2hkyke3aIHS:xtON7GBwUUsz8b4a0CE9keKF 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: e8390064e47093e93eeeb454f3c231b6
SHA1: 4f1443bde74add82ff30d7e644b68306753ffdd7
SHA256: ff30a0c68a5827b2a31f403ec49e6dd091e64e7da7dbbf7646983360266b7e34
SSDeep: 24:ewtOtZQ0d9UOQ6YvSmkeieLVDA+liX6UaqKkeWI10HZlgmlmQUN7Kd:xtObQ0XUOQXye31UukdykbgFtId 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 98a3d8206c6b3963cfbb512d26734609
SHA1: 5a9c1683ef7af56ff889267715fdf51ad8cbfeae
SHA256: a858c90445a45e2735a72f23f86b74c839dc17b4386d65310e4cfc2f9b8fdfda
SSDeep: 24:ewtOKyoQSZ6UpanGWOb3jzXWuatDhQKI9YUG3JUu8t6u25:xtOJY6UEn38/2KK3JUuSjS 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 95cce8f2889a216a066d6435bafc3703
SHA1: 8f0e56c9c63fa5a2c2930243dfe89021303545b4
SHA256: 125cd68df95088ac8edf3ad8bf26bab411970977c7fee1c78ffbee314f552f50
SSDeep: 24:ewtO/EfvWUy0f7tU4C2qyCDnukkFbbwqbge7HXjN5TYvf4qtgAD3Yd:xtO/OOUy0fy4cJneLHXr6gYb2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 50aef6dfae27009a802e69129b59564d
SHA1: e9153e0c6a24b921bd8b4a9a8714fae9b72be353
SHA256: c468688d963247076aa7b508708c1a3b60971918634d60effab0549e095e4281
SSDeep: 24:ewtO1mC0GtkwUqYo5l25K5vof8r0GheSYi4jhZGZAMqkem5WidvT2MDt6AbX8:xtO1mC0GVU4QKdoU/hLsfkX8ipSMDt63 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 099378a9dce32a91cd10fcbe7aff93bc
SHA1: b7d90aaafd570e1567a0d49ca5b7e7fa49a8029c
SHA256: d98571ca66803d79f9afb04ab57a17c4235a2fb862846a52a1750b6d9143ebd0
SSDeep: 24:ewtOlx9R81U3KE41DgrGS/fTIwpOpPVgFuYEhCND2OvEZi3ZnA:xtOX41U3KHirGS/kc3FrMCNDAZi3ZA 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 39225c836f6dcdffae72968fbf6e8869
SHA1: 723bdd4f3c2fc841ae493d8ca5096d215bbd55d4
SHA256: 9cc4ecaf2ace4f8a6290c15085cad6c7310fa48460f8cebc6f90aaf853b08b36
SSDeep: 24:ewtOCsrjz6UCYmiCAVi7ibutmoXmPh/dbm+AhlUDV7A/AafS8EdM3AqYqrOYe:xtOLjOUV+wi7i6tZiJJ4D/AIrZ3bvrOF 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 65bc659736751d190f5d4f5b37a2d630
SHA1: e66b448c8b569a25800dea91f5545e1a568111f8
SHA256: 7a4f844c3f4ddd4c9a640677d7c505986ecdfd623b5d8e2a88bfef43c214ed3d
SSDeep: 24:ewtOveTAVEtUHUEu0/wMsFLT5cIyhpy/kmnPert9AQNRyz/Ucwg2+W3IKNC:xtOviFU0r0/IxT5tfeR9Ncdc3hNC 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 94af5b38bec828b3864cc645917cfe59
SHA1: bf2acd0a9543909e413fb9da79aafc327e648211
SHA256: f88bfac800e332fff1297f92c2955b96ef64b519c4c3ca84666505a1e60f492d
SSDeep: 24:ewtOoOk8k7j02U6IRq0XwFeixC0wZBRJycd7uRL6qlpVt1M44N7dHLPh/gwR:xtOop8kzU69owFh9wPiQqZFMXr9R 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: a5d6f0b7fe4b1764dda4db75f4305fef
SHA1: be8228095fa8e614ff7609f1702342f63aef4ceb
SHA256: 068237e2461d029d5a7eceffe9cfce3567ccc5a0742f254ed32d013735568e5b
SSDeep: 24:ewtOwpVWNQ+ZU1HuIQEX7Qa0K5SpQRUIz6YjXoOlpvRGTSWv+6rZrt3bk0d8FZAk:xtO73U1Nr7QOSERWUZMW6Np/8FZSG 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: a553b2303340d2c790007aba7a3ce6c1
SHA1: a9c3cfb4ac59fbfee3c6e5824d90c595cdbfa3b0
SHA256: a773933e71ba9cccb51207d88d119348ccd643b0eb568f363a5cd71074103502
SSDeep: 24:ewtO0Ami/l/hAGUCIV3Sqh5pP7OsZ2nIkTF+Zg1/LqWCZEA5tYWhA03mhD8:xtO0Amo/aGUV5SIPSsAT4ZK/m96+w8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 8326bd1ac2b2724bfe2407891ecb9392
SHA1: 9ded55bae82bbcd44916d1d69bc9c55f0a693b1b
SHA256: a406ba0b5b8a048d4f706b56e48265512e7cc184ad88b8a562125d40071ab346
SSDeep: 24:ewtOOlmhaIKUKHyciaNnCZZxv4G2f7hg6PPqJ5U9lZvV7Z5mcuoB2NE7suvgVjR/:xtOOldzUKSc/C/OxPPPx9/RZ5RuE2NEC 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f4fe924b9a266304fca3b77d67cff89c
SHA1: 24ed7fc3ead02b21226f24caa13ef663ed531395
SHA256: 5f19c8e4c6614ef52b8f7caf9919a28f6df8424e328d08d0b61473d3a776b5d4
SSDeep: 24:ewtOdh7XKUlkBg9cfzQEw9enba750J9GCzNw0IxSqnkoLMnxn:xtOD7aUlkBg95h9e+1KlwLoaMx 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: d67a281de02fcfe9ab1859f6927403a8
SHA1: 736caf1ecf7f60b3be68311a26a874f774b7d01f
SHA256: 4bce7836e4cbcef2b74c20a1ea06eacb73de5d8fa07166e39dc1dc2400524c98
SSDeep: 24:ewtO7r+lcUhtJEPCDMC4ryzAAK4r+lxKM++qhM4XadNUA7XFTGB:xtO7r+aUht2CoNsaXdUhM3GArFu 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: bdff0efc3b0e3146c9faa0ad27d63025
SHA1: 3a11c616ff5a3b8f5ec3f522a67fdcd4d20669b9
SHA256: e116a3e8ef0440fc02d3d855a0c76f9570b2a1423dda37ab58ee93d504f99cd3
SSDeep: 24:ewtO4QJUKqzdRXFckC83nENofQ6JkF0UATPJ1xRig+mqjiGiGgHqF:xtO4gUK2dROk3qoI6JkFDATPD4jliGg2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 53850181326aa9a1af704460d82921de
SHA1: 9e40746f9ac2cc19f1b117c4160108423d53afc5
SHA256: b03cefaf0e54f8e5efa90a7fe3db1bcb804908534e8dd8761db4ec95d933f972
SSDeep: 24:ewtOr5Q2U1XxjnNwLIK8FyBgQzA7DRTBBiMz4+283kL6SZLbiv:xtOrdU1hjnNwLI8zA7Dl/vpCL6S1bq 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: c0e6a2777b17fc767a15d8f01c483d13
SHA1: 3ea99362ef518f3ef1e36ed3aa420ee271054cfc
SHA256: 4cd8dc5178eede8bc5c27f001d883fb314d94583293ef2f0356d00b3a68f7e5b
SSDeep: 24:ewtOwMsyrUOvJ1xSojHzPFNF0rmB9IiSLC1qvKMaZ6KgjZqSBxnE35ih6R3PyMk:xtOwDyrUOzxSkTPFNF5BzRruKgjZxnEg 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 0d7dcdfc8bed45966eafd27cfeabafe5
SHA1: d593bf6ede26628c68a4550ee7812b7896351196
SHA256: acc83ee3cf372f99f75e37daadd65fa7c130e31b120fc4013c71fc2d2da1bda3
SSDeep: 24:ewtOx/9UjhMXCBZdUKEK3W0M6fX8wYoVGKYPdErqyFnx2xYD8O9/K8fXk+KZZWUl:xtOx1UiX0JBW1cDEPIpv2xYD8yfU+6gE 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 9b868241c1fd2d1541ceea971b0b3413
SHA1: de51363e9c584e283460387916636209085ba4b1
SHA256: 89b0f64f95d46818a266bb86eb42c705727e6663986a6e0542418442677dad44
SSDeep: 24:ewtOrD0jrUUcVFUCs/QaO7IGvAbq1W6y0MXbGVdVXV78iqwIy4ZeG8OAWd:xtO3UkUd6Abf/TXiVzRqwz4xNAo 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 89bfffefc3a330d49ecf18692dccf4c8
SHA1: 0a2cbfb40ad3002fe55642baab8c64b5ae9d6628
SHA256: d86754d7867cfe8ee2668e7830070abe00bf6ff151bdd46b62e7e3cc125c8ae0
SSDeep: 24:ewtO91VRiq73OMU/BRW2ZZB06uVTHT4jF2mNPKxNllUnGaL1KdJgtcTan:xtOZRiqaMU/hZFATw2mm3lUG21yJg+un 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 066268a4664fe5c0a67da4e91dcb3867
SHA1: 4d12f2fffc878cb753f94f4bdbd3a99c70ad9ce4
SHA256: c99e49da194ed6f3efe07b9749c16d950f457dba0ac7622e8d3fe81a574b320a
SSDeep: 24:ewtO11QLxeIXeUdEPVSLMssavb0OwZmQrS/nWqW//QqQ8BW:xtO11uxeUeUTNsavwOwpSfFW3TQ8BW 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f8c59488959e24e28210ab62ada1e560
SHA1: 2a518bf6d9d34d01b1bcbdde587c92ec408ef518
SHA256: b55465168d1fd16fd0ae1ed257d36f8cbb3d4f282e8406799073c7a5fe408c46
SSDeep: 24:ewtO+qY+I/qPUVw/5+WgmERY8WTK/NutuL17ud8EesNLbSVNarFkGFDrpXciQ:xtO+Z+PPUVwx+xmCQKKd8psNXMcWUDrg 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 74e17a0831d3d32b5744cc6b3919a189
SHA1: 8239636604b6529dd72627e7527a08646d0c1bd6
SHA256: 1625313e13174c956fa4138ef0e1885f45ab82206da341b233a3819606972c54
SSDeep: 24:ewtO2xR6h3QeUY5jUlVt7H33ld35x1bksmn7wu06sG1fffbys2OBwXA/3coDI3sB:xtOgR6FvU0jUlVBX3ldRpmnEuRlXb/eQ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: bfe2d8fa4b102c58d38ff5476f8bcf71
SHA1: 20d22081ca629c7eb418a9e5d6f8484e0875e399
SHA256: c02ec78e878eb69a1a9e76e4a04172b3cc9b019c17def0e2b3c9124ad571e0c0
SSDeep: 24:ewtObNXXK2RUKkOddNptojg37UPP4Ir1Prgl9SeCRM:xtO564UK7GEm4+PrglGM 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: db121227706beafb90220131cc77e5f6
SHA1: b55daff104c49543432109c9391615aeacd1dc7b
SHA256: 7e93fce58238d46d420dcc82eb07b99911ec43eefbb94c9085dddc1b04f60b6e
SSDeep: 24:ewtOygZBq2U8peADDwBZCbTfsm6Jcf+/K4RtIa1MkgjNM6D8AOmBowP:xtOyCDU8peO0Efayva31MkgZMAD 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: e2bcd6fcbf36f4220999659ae62ca066
SHA1: b4ced38ea154e2b198f4d28bb548afad5889ad61
SHA256: 877bfaeb601929a72be82bc22c0f1da02484346c7aef62a718d3b96cb866f471
SSDeep: 24:ewtO9Zh8v4UlZrYGuxTHr8HO2VOGfRFvPTPFzGwMA2vlV7VX5/784/1BVCu6IgMi:xtObhO4UTrCTHrt2VJhPTtXgvlFpSq1w 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 6755d30b56644896ab58396e956ddde1
SHA1: b7c207ee53035f51acbaae22802fee978b2cef48
SHA256: ee5f4bb08601d2a287f081e1c20f739822cc3871e8dcab3670e9b123e16fce3b
SSDeep: 24:ewtOoiEoKuNwUAze8vfrCuZDFZ+9G7Eib8o9zTp40CpQgi4zpnyuZ6MR:xtOottuNwUAz1jRJZ+9GQiT9XILn/Z6U 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 7274bcbc912f9ec31ccdd784962ffe65
SHA1: 1331fc165d3dbf53757949786846f16e1276cd31
SHA256: 0960fffabb4890549609a09ca5ac0c967cc6cec637c2c7b480c51fcfba3cfce1
SSDeep: 24:ewtOqLyq72URPw34AOgUWWBswzQQY0nPAAk1v31sOLdj/qcLXsZsQ:xtOqLyJU9wIADD0P9k11RDXL8yQ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: da0333f19e38aedd90f700d7cd4e2e91
SHA1: 60fcb509d05f6aa9fb6cc587529380d9349b4d8a
SHA256: 62663af0b8d9114a3c59739a6f29089e9340f376f8cad15a356a596e9dfed533
SSDeep: 24:ewtO0VnjUUSsZO96MvQ0MXCGCuVXvPxHNqFpbN0QNtLw1r82aZKF:xtOSnjUAZ0sndNq7bN8821 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 0cfbadc296cc81dd1f0fc09f86c2d2ed
SHA1: 411b79b6455f5fa0cb8a46ab2e38c4294d248b2b
SHA256: 4f5bed6772b1198c0d6f4bcaa61f20b8107bfccdecf13aa031a6a8549d9fb57d
SSDeep: 24:ewtOOV77hCngS1fdvat/XUBKmDqmHolMbmGjTkTiCDdunJR0QHvVbTvllQwnii:xtOUSXa5UBKIqWqMb3jFnJR0QPtPn 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: a5ec7404448e9f532b6ee193165a9504
SHA1: e3bafea2a2c0e26b0c1708ab19c9e20b20bf8746
SHA256: d63c9b42fac21022db78cbd9c177fb4074f22fd2da43c0404f655edf073efb96
SSDeep: 24:ewtO1FRpd/ULgx4XZOH6bSkm0RDk0xGhrQ43CgibjAdWJWR90OOrmS6Yu2:xtO1dd/ULg4JY6Okm060xGVMDCRzOrmC 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 223e89d5016e8244286374f526f3c5ce
SHA1: bb95686f309730413afb04177cd6793c5a888f04
SHA256: 52cb846cd479f55a62ef4da99bc90d0805830225aebea17e2fa703a6a8156b77
SSDeep: 24:ewtOsu7v4DThUHOoA6DyPK6tGvn4MCDZoaitx7lBOGI6PVKXShmwZ+s9U65p8GRo:xtOs1DFUHOozDN6svLC0pI69wSzZ19Vq 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: ae752dd6f12e8feef20c8ff7005a35c4
SHA1: 24cc694fc6a54d0507ac505e848c43c64eb17a90
SHA256: bd24be6e093499ca968bc3642dd90feb833a040cd690da4126c766251e5973f6
SSDeep: 24:ewtOxuqZfnzUWuqDy2EhTsFsjHu6Hm+k+kwpVwJ4ITEMYzMr2RWOzO9:xtOr/zUSDy2EVsOLuKJXJeFTEM5yUOa 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 5927af31f6418f2c15a863e3736a0ad9
SHA1: 203ad63c24ae41e619858a66f10320c15b828616
SHA256: 22f8617dbb6076e63cc33c5351f9f7129ac498fc5dd533ea12948dcfee2f6f12
SSDeep: 24:ewtOZeUDivvzvtWJJZXJcybC4V3vm83DVSiLMZ55yQsWnEOLGC2KT2:xtOZeUivTt+JZ5cybC45m6U6q55TbSX/ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 218f8ee46476146a10f5b6c109246334
SHA1: 339f32cbd871ba0a61c570f4dff33f375603c698
SHA256: 9112840c08943997a7a3dae802ed2f2cc88a6845d9c3382ebb7a3515ac239d97
SSDeep: 24:ewtO+n5DYWAU4N9s7eq/q2aR4AsJWmufxuKZKC/mtWtTvA8FLWaWlvFtdE:xtO+iJUReoqDRLEUxB0C/mt8bAiLWac6 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 37b31b9bb4a40abd0a49e5e4f61fe176
SHA1: dacdd14e4076e35f03aa0f8bf0f13eda7642532e
SHA256: 3b6902484f558c2a620baa3c38766da3c49c20d10b63e5e6f08e8d05cb39c825
SSDeep: 24:ewtObLgUTof1CLX5vJNMysD9YORtdPwcZqh/31uTvv7nSt1Vb:xtOXgUTlXNx4nmcZ2/MTDSN 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 91d083f1b2da50094e24b8b7c1e7e0ca
SHA1: 1128a107d80ba61e19c4046723db29a9ec440371
SHA256: b72cd223cfa3fcabc5a5fb48f3f0d7d1e8223f523b95e70ba9dc9df0db86bec8
SSDeep: 24:ewtOeMhSRuUyP7Wm1FXBH5EYtt/Z7mordA4yHWDVnFISHBxyzEAZJXpb:xtOeMQsUQXBH5ECVmqgHEVBifZdpb 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 5a73aa94ad24c80e2415f8c54d06ca31
SHA1: c0718d49bfbadcf8ba889ee0c033b1ee813ac2a6
SHA256: c96bab1d2f81e052edee3320bda0bd3f56691a45a194e12b50876a2b5ae2a5bc
SSDeep: 24:ewtO1ialcEpNn2UiuTNysXR1+YHOmzgVnTQE0fszUUE1V3gmpgJWMzw7/x3tpohY:xtOFlN2UNZXXRwYu/dJ0fTP1HgM/xdKG 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: a5e0c0e9514b88ab240a4ee201a8ad33
SHA1: fc479383dbf617d1b4ff925f6715f50f3895a746
SHA256: ea3ac5ee0b8148947b4cc6a83e17fc677e0c8fd32e9a3350ac1917dc455759a8
SSDeep: 24:ewtODcrXegUcR9gjTnRPHYykmt9J4bziKOilBAQZkxsz+TBDqn+KGAVDn:xtOYrXegUc7gjBltH4KKPlSQZkuz2Dqh 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: cdf5ef0a61e91cb977d5a86846664017
SHA1: 0e2d1624b5a6c1a74218b16d74690b85a46a8ca8
SHA256: 59ce2a9f2e64692292cffbc687a540bda26739f22b54bcd7e6929764fdc91533
SSDeep: 24:ewtO3QRyL7UHGG8DLxmpkYt9xG9J+MFYlbmvE04r/sDx61N/sMBZ+oaCbfao8b6e:xtO3XPUqLRYt9xG9Eq2EEJgDiSMBZ+oQ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 6f87072597584b3ac936bc3b4fb07a2e
SHA1: 41392419649fee64cde5646e448a8452d3b10206
SHA256: dd27e0a6cc85a02a23e76622a29ef6a43dc6defa7a9501e7d3d938ce937cf394
SSDeep: 24:ewtOdWg5pXUHmatggw65L4swwReAM24FoYPhrXWCoRqoaszG0zsg/GYk:xtOdWg/UGatg765UhwRpDEZXRoRqlszO 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 1624bfd1f4579e2b21b7cc2772ef202f
SHA1: 83d7e9903dfbaa522e48d9d9c635ce24593a8463
SHA256: ea5f0ab823700c4acca86cb1a0eedcbad6ed90bc92f007a3ab37403dfaca89a0
SSDeep: 24:ewtO4EVOn8JNPvUE1JA/wPTS1nqmD0BccVzt+LwXx3A+Xa+ebAoV6SSsVXnj65K:xtO42c8JNvU//oT+n9QbD3BeBWUEK 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 376fc284fb4d84519c818959bb5fc131
SHA1: 68b99a63a3a7ccb68ca9d59441510bd664bb8958
SHA256: fc287941d005407940aeedfcf5037f588534383502eb4c0b7fce230d168680b1
SSDeep: 24:ewtOhFHym3UJOHqn9yXuGOzL0hiMbLQnIoSSVhFphJWXeqnRQJ7r:xtOhIiUJgqn9CMv0hHXoS8hJsdKJ7r 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 477f490b11b38ea907c924a50327062f
SHA1: 15eea6788e526cdca3008d04b424d3ded3a0129c
SHA256: b6e06c46422a643f6e2b146d9a559b9cf95a33342dbc5ce888ca312ac18b1a06
SSDeep: 24:ewtOstjUprKwkuoXFBLoyhglTZ5+hqZMEXvtsWJBI07nv3A7mjku/LSo6uwHLzqd:xtOstjUZKwLkLor5egeyBI07nPYu/LSu 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 6d3e4e6ed7e2bc982c3e7c57fd4225b6
SHA1: e975afeefeb1aed7c258943181a3362c60a80ecc
SHA256: 3291316a0287d8b4b74cf721ae12b5fbfbb5fc0fb0d1b0c332bd587341fba5b2
SSDeep: 24:ewtOEakKtUUswhG32Ceie2PhagW5xY7tMdMHe3vmkWF0xp7I2Vju/GI+r:xtOvkaU5wU2Ceie2PQgW5e7YM+/Nlxqk 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f404a13cb40f605f505af793db97322f
SHA1: 6c5bd30525c160e8cad347802cbdf695be13115f
SHA256: a8fc741ed1c6f06e186cfa7244f537abdea9bc656fae15030165c371b6cbc7d9
SSDeep: 24:ewtOfpfjT4ltwUIrXvN+cW2XLQpTh14aJ6Kpq3XZdJ6hMaQ4mSfawxS4CtwBNSMu:xtOhfjUltwUIjljW2XLQpRJ6KE5P6JQz 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 197cd1fed5bb0d0e1fda61f5c284b71c
SHA1: b00027ebb89a6ccfa43eb803e314db833b34cf2d
SHA256: 9905e37760a75146de0f916bf8cfa148286572e0c7cc97b0159dfa0c70fbdcbe
SSDeep: 24:ewtOOqDVEbyFvibLPPUBNomyXO0+L859e9mGNCTSqeODtuVb7njVAVCUmsNUzZil:xtOOqDub6v+PPUBNomyXTRe9mGNCwOce 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 8ff0d854d2f0957b972c68a117cd65a4
SHA1: 7042dbd09d0ebdf96ec3b84edce77f0ab74caff8
SHA256: 266ca4a5319e001d53851f73d06ab8d752b01647f8d16a3fdd143b536ccdf409
SSDeep: 24:ewtOVmKHSqUPanMRw93cbK+eaBoxLStCAgtMUIKE6bsfgl4Tso0BbE:xtOVzUGMRwZAKxaguxgtF1l4n8E 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: c7b3cf0821dd6bfce567c65ef9f03790
SHA1: e0d612f7c60bd8666263c17d050201725588a804
SHA256: 917a5c56901a43525b410851306a0e309b7093a095d7ae1dd9861d377a66ce6e
SSDeep: 24:ewtOrdCNuYkSHjwU2eDFHluC7LZDt2U7n9pO1tXGjFCCsI/d7h4ruZeft7s1l:xtO5aDPjwU1FF1AU7e0F3l7OyZefN+l 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 36e3f2e67128423a5312ca7bc21343a4
SHA1: 8c0e1368059ef019377fc693647053a86485e04e
SHA256: 6a4f67e0c4ebe7d8e78ab1b5a5f00edc9f6db7e6cc8837551b3ba358733b5064
SSDeep: 24:ewtO4+gR1dIc0pIUNswtXlL4sYdDfIpr/5qRfJ11BUJh6kFUbogefNF4aiAgKYy:xtO4+s2cfU2w1BOdDf4rwfJ1wqrewt5a 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: a05fac17729332680c64b0f0f8ce13ad
SHA1: 5e9f4208f6ab69e651e517b8d191ffb3b83f291a
SHA256: 221fd7e3d86a7876d7bbac8551f9cb0cec4fb39478b22814f14064a37fe0d9f6
SSDeep: 24:ewtO9LhUd/gsxu5dv7DL5qKPQYGQF+gx76k3np241NZEFjzx+Rz9/E:xtO9tUR45qKPNVF+gRznp24zizxK2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 6db061d680aa624385286e2a77e54953
SHA1: d9df35d1a67088c31ce17a494a97a9a1c0c582a8
SHA256: ad31768cb235a390d26d0620b46e5eda0013b026fd483a02cc8e8f62feee1479
SSDeep: 24:ewtOV2XS02UP6Jy3VijncTBfBobaQDTrdVlIinX6lLGdnysEO3:xtO4i02UPzlO+BoGaT7lI0GLGh 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: edeafe306436559fe1ffac50bbc95f97
SHA1: 272584c1ab28c68369807ee783e9702a77085e21
SHA256: 6ecad70d33c5fb864c00f89e0fc26c45050d117fff0b86c0b9cb7497de14c64c
SSDeep: 24:ewtOS3pUVSTXE+cxEK+9ITaMjth/8tjskKAJsRSkST8qkqLvwC:xtO+pUVSTU+2EK+9ITbRx8FsTssUT5VX 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 767efa76ed4179e6adb4f61933517ac0
SHA1: 18fa52a572616e1c08ca023f087a95b449f66597
SHA256: 65013239d4ba0ab3b5863422fa2c0c6a4c306d68806450eed9c570125d6e93e3
SSDeep: 24:ewtO9D2/UZXGhXf85M32WdD9X4NJz5wXQzFmCt+ysFMTpXQh5:xtOU/UZXz522M5mj8Qzxt+ysFN 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: b13d6d9885153a373c1ecf21ef75c1af
SHA1: be28ee7d2fd97fcbf8fced7d0bcc3edbcaa6988e
SHA256: 5fba16a5ceaf2168e611963fa59e51698aaa32a961ab93903f110a7a7c913254
SSDeep: 24:ewtOpz3nQuwU2UiVOvV0r/Rct6ak/vUC//WQnpt1Ai6PpgwMQzns6iXrI0:xtOF3ZwUTk/RdV/vU4u4rAMwg6iL 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: bc24507359ac8865ffd4f6d81c56f66b
SHA1: b54ac91f5e35fbff7efe2ecdcd6acd8402e8fc9d
SHA256: dade0a1a0684cd77a160ad25a9cad76bdb2b3b01b3e625fe4cfba9d092051354
SSDeep: 24:ewtOT2zuj0XSUoK6k/QVLXyRPwoBPZ1PPzfLpKrtGiHU7ayNIQTxXl6NhITDMUV6:xtOyujrUoK6rObhBPzTpKho5oeMUVaX 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 921415a2dc55b76ed3864b467c41e970
SHA1: 2ef0f712136035225012b772ceae786cdc8dd726
SHA256: bfe8481fb6f370aef1a13ccffa07517ed46876d65b866648da4f27cb6e453719
SSDeep: 24:ewtOBEKsT6UzKo9dc9Ft0GpZ2NyHYgvc++bL7trPUbwHZG0Oub:xtOBEKsT6UuekVT2oHDvchbL7JPUEknQ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: ed13a0cf43cc4213cb32569bcbb9d449
SHA1: 28a184fdddf59bbbec59f0c168e617f9ed4727bd
SHA256: 9723feda948085c522145dd9637bf6fe07f19e51ad0e7a30bbb5f17f882f5407
SSDeep: 24:ewtOLrQBFrUV3xtdY6HTs3STyfdvjxpOVucLk9hnqrhgo/Qg9CgWG:xtOojUhxtdYv3S4djOPY3ekNG 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f57d2032266cf84a577a6ae18cdda89d
SHA1: 7f3f76f3e0a09929f2bf821e3848cf082f1a3c5d
SHA256: 6c9348d313839767e3c0e801810a693b173f7e6c4bd10b514c842bec6c4d4630
SSDeep: 24:ewtO+daTcgWUc60OSULFfhx1bu0ZHrVHKW3Vtll8cFGgmflebPHfZn8k6fIzhi:xtOsgWU1ph+01gqvzFkfluPZ8k6fSi 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 85c88d8b91dd86296a8d81afbb8b6f18
SHA1: 77de180919dbebb911b0ea5ad8e65df1745a91dd
SHA256: 6136916171f7ed941f815c562d378a08d4696ff8bb59575b544c0e14fc0060f2
SSDeep: 24:ewtOW/EBDVeUthOtFsDz7vzU9fHzEu2+vkUZH/g+O5YBjEOv0Vbh4HRlM3AciUSE:xtOVQUmnsz+zt2+vkefgByd1vwCxlGA4 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: c450c5e8059628928ca0b9d34085a21a
SHA1: 7617da6e8efd1fedb7ba169b78951c98febd81c5
SHA256: c8ac2a4d6f72dad721275540075ad684087cb54f03af473b8e15309fe67f7f02
SSDeep: 24:ewtO1YlmjU7DqX/hx1VqaRjbTw172GdjLn8QmiUKCU6IKaD:xtO+lmjU7OvhnZU172G1kiUKCqn 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: abf629bda1e3666e46e90f25e03895d1
SHA1: 764374a164313b05008f926926af18a4291d4200
SHA256: 1b83e5f1b82e51b06844b44540ba30bccddbf28eeb76f8357e4de83ef0fd3661
SSDeep: 24:ewtOqC2b8X347UI28ivnjv93N2iAzQ2AZOH21ImWbTVHYR701Bf4r:xtOq7bd7UIO53wiAzQ2AUHtzbTlY2196 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: e5282a891201820acc5de524823816ec
SHA1: 021946a4d7883940d9e5fbc4cef748230ed9fe80
SHA256: e92fdeb7bb4d271773c21248a1dbe861ce5bf9bc49c0558377d1994f6e12a062
SSDeep: 24:ewtOv2D7UcPFSMU+r7zAVNsJcd7sdoD8x0Q0WcEmu9WvomSR:xtOeD7UsFSMXgNLhsdoZXw4QL 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 22915de3326a7db86264fd1a5cdfa335
SHA1: 881fac1481671a6ad7d1ecaa4e682592d18a60c8
SHA256: bda49814fc18135aa3058d2e466567e6bb1b9783520c00e18a7ca3c38fb39657
SSDeep: 24:ewtOLKa11oUoIGRyBWtHYXYYHhFTv+TQW1i8QoBV+tKR74pWrj9YuDSK:xtOn11oUovRcdjvEg8jDR74Mrj9YoSK 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f1d038f4498ae4e708af3ab2d208c76f
SHA1: 02fc85217753dc9671c0b27b879ae16793077c88
SHA256: 106fa9affa4e7d05ff2f5f9e9f5c1b64c19285140543cfb3242ac3f7497712bb
SSDeep: 24:ewtOMk0VUYrk9MARlKMXxAOIs73tFGsR+NAsNgt7U6zmH+Qott4rovX2Tns:xtOUUYrk9VlLnF7INL0HE+Q+462Tns 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 12bbd6c9ff7caebaac8a34845f02eede
SHA1: 9f1ded867bf523d8b54d132ebd0e698b2aafcd3c
SHA256: cbae20e352e039591fc1e1cfd2b39f51fa9b261ced747317fa3504dbecee06c2
SSDeep: 24:ewtO3HhrnVi2Uv3/F6WJ1X2nWGZ7kA/OYhb22lBF8un2zylwl4veu21:xtO3hA2UV6WTQWGub222lBF4zy7v6 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 1dad8f7f5c4737bea9c0d8af5e5cf65d
SHA1: b72c841c787c2195695d660da07d0fb012d43c17
SHA256: a12419612d613a742dc0e0cfd074a14d0a0d0db8bd5c2c637313095424204f1c
SSDeep: 24:ewtOabjq4TUU4qnHr42+sz6bpJI40Rx8TF/4R4OsaT3OMRsT+A/1O7GetcktBZQN:xtOWU042d2qx8tA4OLH0+WQvtV1M 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 719aaab4d8e943ccda9cdbe1ab01cc12
SHA1: 8a35f14ae012483c463fd0c8768958cf0592d7c4
SHA256: 5bcb4a1a7ae142ad699e4027f7135befacf2398cdc537529bd0af5a01115af4b
SSDeep: 24:ewtO6SeLSUMS08RH0d2dGGW/tgaufyqNWATMytz8mFLays1slmuc/5tm8:xtO6FSUMcO2cb/tdo9MCvFLTEsrc/5x 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 010c1b6b32a710c4d1c057e5eb0325ce
SHA1: c6e9c8ae73e99fc9c5eb10e9b4489ae017b82dba
SHA256: f35d3c1ee91d1ba0b3241a0a4df7838050caa677fedf78d150796154e75759e3
SSDeep: 24:ewtO0Ped0UkMQv76R/PlmNyxgvgphSufVu4UCLliGBQDd:xtO3d0Uktv7uVmNnIpEu9WCLLQx 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 6df28826f04ff4d3131261c208fadd90
SHA1: 29b84a94fc1f9793414ab1fcfe79eb4550c34a54
SHA256: 990eb3f0d68957f4999f693c6a244966358e02a58871c99b778dfcced32f70d5
SSDeep: 24:ewtOUt/dF+UeW4V6Qt/NHfm5dokK9qphvVZn9T5rN+I9zMb42t/Ipwj3hKq:xtOUt/dQUeT4o/RfmKqjvb51wANm/Iiv 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 70d06eb1f2af6e3a2d909975f80ec8d4
SHA1: f98f3b0cc1f352206969b9e2184f1c401b9072e1
SHA256: 68c67795faddfe1ccf484736c30d2796f8fd5104c55e13e04d34a052d5271606
SSDeep: 24:ewtOE4M2VolUqkIshyi0AvYWjDNRicGDmurJQ0ziSAkRAnXTAV0mjSmq+46:xtOBhSlU9xLjpGtRzirMAjAamTr 		False
...
Host Behavior
File (1889)
»
Operation Filename Additional Information Success Count Logfile
Create HotGIrls share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\clearnetworkdns_11-22-33.bat desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\bootmgr desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 7
Fn
Create C:\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\BOOTNXT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Recovery\WindowsRE\boot.sdi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\BOOTNXT.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Recovery\WindowsRE\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Recovery\WindowsRE\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Recovery\WindowsRE\ReAgent.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Recovery\WindowsRE\ReAgent.xml.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Recovery\WindowsRE\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Recovery\WindowsRE\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Recovery\WindowsRE\Winre.wim desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Contacts\Aclviho ASldjfl.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Contacts\Aclviho ASldjfl.contact.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Contacts\asdlfk poopvy.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Contacts\asdlfk poopvy.contact.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Contacts\chucu jadnvk.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Contacts\chucu jadnvk.contact.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Contacts\lulcit amkdfe.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Contacts\lulcit amkdfe.contact.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Contacts\sikvnb huvuib.contact desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Contacts\sikvnb huvuib.contact.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\1u1PtMsi_p5I6Kp0gVZ.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\4CDCeVLoOGDNNc.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\4CDCeVLoOGDNNc.xlsx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\5eq4aL0vBSUL.pps desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\5eq4aL0vBSUL.pps.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\5EUw6X.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\5EUw6X.xlsx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\FnCzF1A7H gxenH83.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\FnCzF1A7H gxenH83.pptx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\gCLjM xynMaWR.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\gCLjM xynMaWR.xlsx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\hfoKW.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\hJZX8AFOtoTuk B35pJ_.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\hfoKW.pptx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\hJZX8AFOtoTuk B35pJ_.pdf.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\JF6Z1xvDFv.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\JF6Z1xvDFv.docx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\MI47.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\MI47.xlsx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\mlv6Gzv7Da-BgmdC.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\nP0r3x5d.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\mlv6Gzv7Da-BgmdC.docx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\nP0r3x5d.ods.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\o1_fy8.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\o1_fy8.pptx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\obHPe.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\obHPe.pptx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\SATDQcfMYoPlh.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\SATDQcfMYoPlh.docx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\u6hnCYVE2vuu.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\u6hnCYVE2vuu.docx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\ziNabL4eBQn3JC_djnr.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\ziNabL4eBQn3JC_djnr.pptx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\ZmbKh2wUNBqMsH-.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Music\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Music\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\ZmbKh2wUNBqMsH-.docx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Pictures\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Pictures\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\folder.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\folder.ico.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Quick Notes.one desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Quick Notes.one.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\lcfkj@kiekc.df.pst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\lcfkj@kiekc.df.pst.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\uhL6PZJxrZwaAeTB.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\uhL6PZJxrZwaAeTB.ods.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\-PZcxu.pps desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\-PZcxu.pps.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\GAgDtV.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\GAgDtV.ods.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\yhA0tWH2QIX.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\yhA0tWH2QIX.odt.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\51gZ9cs6QyQwB.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\51gZ9cs6QyQwB.xlsx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\FMVnxBVv7u9Rp.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\FMVnxBVv7u9Rp.docx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\ttYeA5K8BN5b.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\ttYeA5K8BN5b.ppt.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\r873fj.xls desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\r873fj.xls.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\s9_oB4RJJAVSDjPCS.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\s9_oB4RJJAVSDjPCS.pdf.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\UmcQX7d.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\UmcQX7d.pptx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\XJ2OD9lQq0BG.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\XJ2OD9lQq0BG.docx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\LJ2-ZSo63V_7d.xlsx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\LJ2-ZSo63V_7d.xlsx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\pdKaXJhzd7zYz7o.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\pdKaXJhzd7zYz7o.doc.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\3kj8Y-EDPTFO.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\3kj8Y-EDPTFO.pptx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\5NEaCJn_lqI_2wf_A.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\5NEaCJn_lqI_2wf_A.pdf.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\gGPxR1SI06PikWMCd.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\gGPxR1SI06PikWMCd.rtf.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\NHki1vMmaXoWuhnR.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\tyDDeYuppbUilesSL.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\NHki1vMmaXoWuhnR.pdf.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\tyDDeYuppbUilesSL.odt.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\3B2V8p-DhIekN7FYAT.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\3B2V8p-DhIekN7FYAT.docx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\5qiwP0Jfq.pps desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\5qiwP0Jfq.pps.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\fsxQuEAvOd0El-v.pps desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\fsxQuEAvOd0El-v.pps.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\h8IhXzO4v.csv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\h8IhXzO4v.csv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\h8IhXzO4v.csv.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\HpvWb5EHtTvn89.pps desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\HpvWb5EHtTvn89.pps.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\oGyow62Ehp.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\oGyow62Ehp.pdf.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\Q0WDNI_cEJvL.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\tpkoPGhxV.xls desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\Q0WDNI_cEJvL.pdf.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\tpkoPGhxV.xls.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\vv1t.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\vv1t.doc.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\iclup5FUSoIoGUEpJ 8n.pps desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\iclup5FUSoIoGUEpJ 8n.pps.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\k4LJ2WYGO9QfwUDPoT.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\k4LJ2WYGO9QfwUDPoT.doc.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\Qq3R.ots desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\Qq3R.ots.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\0KK10L8Yj9PSdD5_rlI8.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\0KK10L8Yj9PSdD5_rlI8.pptx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\6w48s.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\6w48s.rtf.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 3
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\B-2cmW.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\B-2cmW.doc.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\CQjd3NSx.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\CQjd3NSx.ppt.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\DYnSH7i.xls desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\DYnSH7i.xls.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\mR4SZZ7.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\mR4SZZ7.pptx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Favorites\Bing.url desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Favorites\Bing.url.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Favorites\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Favorites\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\2G6M.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\2G6M.mp3.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\eEmxkUZ3.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\eEmxkUZ3.wav.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\I8Dv-9gTrMuD.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\N0rL.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\p6UEXQwLP.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\I8Dv-9gTrMuD.mp3.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\p6UEXQwLP.mp3.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\N0rL.wav.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\Pf3R-b3DBtl.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\Pf3R-b3DBtl.wav.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\vEcRh3pLVRcZ1O.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\vEcRh3pLVRcZ1O.mp3.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\z8Pr_v.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\2HvoIrFtByws.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\z8Pr_v.mp3.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\2HvoIrFtByws.mp3.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\69_UAHNRs.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\69_UAHNRs.mp3.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\dCyPtvG.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\dCyPtvG.wav.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\Dg7 CrsqU k7Xp.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\gRZdqIY3h.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\Dg7 CrsqU k7Xp.mp3.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\gRZdqIY3h.mp3.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\GsSWFcQiPn.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\GsSWFcQiPn.wav.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\LG0LJ99M.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\LG0LJ99M.mp3.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\p6xCw Vob.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\t41qgP8Zl.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\p6xCw Vob.mp3.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\t41qgP8Zl.wav.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\Tvn8aqPC_U.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\Tvn8aqPC_U.wav.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\aR-iIw.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\aR-iIw.m4a.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\bWUX20g7Mm7g1y.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\bWUX20g7Mm7g1y.wav.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\g8L7418FmZslF.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\g8L7418FmZslF.wav.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\lqlP4y.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\NRNil.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\NRNil.wav.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\lqlP4y.wav.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\rKQbOo.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\rKQbOo.m4a.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\zdZ3oJ-bfmJu.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\zdZ3oJ-bfmJu.wav.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\My Documents\ZZaKb_aT-x EADqBsw\zdZ3oJ-bfmJu.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\My Documents\ZZaKb_aT-x EADqBsw\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\My Documents\ZZaKb_aT-x EADqBsw\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\NetHood\ZZaKb_aT-x EADqBsw\zdZ3oJ-bfmJu.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\NetHood\ZZaKb_aT-x EADqBsw\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\NetHood\ZZaKb_aT-x EADqBsw\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\MgyGAvvq5w6fl7AR1Hfa.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\MgyGAvvq5w6fl7AR1Hfa.bmp.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\qp-3yc7D3FrGiW.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\qp-3yc7D3FrGiW.jpg.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\vxT7Wz-UZ XFfNDp.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\vxT7Wz-UZ XFfNDp.png.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\4LAv.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\aClNMcka4 SH9Md3Hwo.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\4LAv.png.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\aClNMcka4 SH9Md3Hwo.png.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\Qm paxELf.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\-aXVf.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\Qm paxELf.bmp.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\-aXVf.flv.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\wGSFbii.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\-NlSo.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\-NlSo.bmp.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\wGSFbii.jpg.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\jA0o4Ao7ru.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\2SXCpVLNs73BQPAtgxC.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\Z-AP6tzBW HexwllgoRb.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\2SXCpVLNs73BQPAtgxC.png.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\jA0o4Ao7ru.jpg.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\Z-AP6tzBW HexwllgoRb.jpg.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\jf2gmUDSNpxqc ZNVVv.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\45dQ123.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\45dQ123.wav.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\jf2gmUDSNpxqc ZNVVv.jpg.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 4
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ape_Je.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ape_Je.m4a.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\aV64x7o3lA2K.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\lAHCz7usAd.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\aV64x7o3lA2K.wav.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\lAHCz7usAd.gif.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\MsxtzGW tpKDJN.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Bu5bp9.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\TqgqXxG.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Bu5bp9.avi.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\MsxtzGW tpKDJN.gif.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\TqgqXxG.bmp.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\dDTdaFbzRTbH.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\dBpSfcucLn3NuQ6je7.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\dBpSfcucLn3NuQ6je7.rtf.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\dDTdaFbzRTbH.png.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\uOf1gCg-syx.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\dizklXpXe.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\uOf1gCg-syx.bmp.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\xBTg.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\dizklXpXe.ppt.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\lGBL1f9.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\-Z88RWVEKHn2YHbC6YS.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\xBTg.bmp.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\lGBL1f9.swf.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\-Z88RWVEKHn2YHbC6YS.gif.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\h72I_b.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\nYkivMTIATrvxLZ.xls desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\nYkivMTIATrvxLZ.xls.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\h72I_b.bmp.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\itHSyuXpEG8bbygGV.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\lYPIT_a_zAinFFHfUDV.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\itHSyuXpEG8bbygGV.jpg.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\O4rsCOfAWVNZ.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\lYPIT_a_zAinFFHfUDV.jpg.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\OALKMuc2ka4.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\O4rsCOfAWVNZ.mp4.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\OALKMuc2ka4.gif.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\P9oN_mVJ_5GZ wuO.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\P9oN_mVJ_5GZ wuO.avi.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\50YQIo4i.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\50YQIo4i.jpg.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ROHZJx8ipU.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\6ORqLC9av8hKhylQ04z2.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ROHZJx8ipU.mp3.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\N6 e0qhUxBM.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\6ORqLC9av8hKhylQ04z2.png.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\rvq7ekaaX.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\N6 e0qhUxBM.bmp.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\7Luf9iKqys 6\0eBemC7.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\s5DMlEpMOzEY.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\rvq7ekaaX.gif.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\7Luf9iKqys 6\0eBemC7.bmp.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\t39geveg0wynNP.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\s5DMlEpMOzEY.pdf.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\t39geveg0wynNP.m4a.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\7Luf9iKqys 6\lMwuMumsTcOMWQg.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\7Luf9iKqys 6\lMwuMumsTcOMWQg.bmp.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\uQNDwbW1Y.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\bLdID5XJzq jCM\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\bLdID5XJzq jCM\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\uQNDwbW1Y.avi.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\bLdID5XJzq jCM\IwWqYwDX1-Oo2.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\PrintHood\vxT7Wz-UZ XFfNDp.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Pictures\bLdID5XJzq jCM\IwWqYwDX1-Oo2.gif.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\PrintHood\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\PrintHood\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\VX9FUGeY-MvLyFL6.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\wh 8KrD6eNSHE.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\VX9FUGeY-MvLyFL6.gif.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\wh 8KrD6eNSHE.gif.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\xj7qoX0- 7l3FO.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Recent\vxT7Wz-UZ XFfNDp.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Recent\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Recent\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Searches\Everywhere.search-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Searches\Everywhere.search-ms.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\xj7qoX0- 7l3FO.mkv.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Searches\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Searches\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Searches\Indexed Locations.search-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Searches\Indexed Locations.search-ms.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Y_LI3 4-qP.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Searches\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Y_LI3 4-qP.m4a.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\bVHx1G7LG6.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\bVHx1G7LG6.swf.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\z29LckBw5RcM_XD.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\z29LckBw5RcM_XD.png.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\zsdQJc9p9rp.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\Up-xCZd9p 2yrWN.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\3eETFbJdu0.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\Up-xCZd9p 2yrWN.mp4.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\zsdQJc9p9rp.png.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\3eETFbJdu0.m4a.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\3IveDjbz33f.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\VYNmKqyqyi.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\3IveDjbz33f.mkv.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\Xj74 9 m.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\VYNmKqyqyi.mkv.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\zDzpwp-28.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\Xj74 9 m.flv.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\8P2mSya3098KVulU.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\AK8M AL1ySTdgK.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\iFWD4toa.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\zDzpwp-28.avi.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\AK8M AL1ySTdgK.odt.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\iFWD4toa.jpg.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\33G0h-QVWGTGNhCEha.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\8P2mSya3098KVulU.wav.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\33G0h-QVWGTGNhCEha.mp4.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\kDpdV 3nnSnJmGqPO.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\S20n9CABG0uo.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\62uD.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\kDpdV 3nnSnJmGqPO.ppt.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\62uD.avi.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\S20n9CABG0uo.mp4.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\Eowo0nLnhzDtXx7wGkmW.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\Eowo0nLnhzDtXx7wGkmW.mp4.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\LzUKcb-uGVeX.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\FnTKrRERf_0VWyksIzp.xls desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\LzUKcb-uGVeX.png.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\VAlp\gbg6IyO.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\FnTKrRERf_0VWyksIzp.xls.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\VAlp\gbg6IyO.avi.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\VAlp\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\VAlp\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\4ioWuMxhZ Ndf1N_b.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\4ioWuMxhZ Ndf1N_b.flv.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\mJbzYvV0BW4OFQ1.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\mJbzYvV0BW4OFQ1.bmp.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\oJoLhaSYb.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\oJoLhaSYb.mkv.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pB rGU0A_4l5KRvtZ sr.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\_F8m3hu10142ds4cz1.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\nmKbd_Etp705mK8.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pB rGU0A_4l5KRvtZ sr.mp4.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\_F8m3hu10142ds4cz1.avi.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\Y_62XF6X1FjEo5B7P.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\Y_62XF6X1FjEo5B7P.avi.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\nmKbd_Etp705mK8.odt.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\0_psbc9.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\DqXOsfvU6Y tHX.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\DqXOsfvU6Y tHX.wav.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\0_psbc9.avi.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\3m7QHv7T5mGuFh2A31Q.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\4xODVA0z5L5w0l.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\iJYJHrgQ2a2pzMtZL.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\3m7QHv7T5mGuFh2A31Q.avi.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\iJYJHrgQ2a2pzMtZL.swf.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\H9o_U92tz2Ho9-mh.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\4xODVA0z5L5w0l.mkv.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\H9o_U92tz2Ho9-mh.swf.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\IR-tjQBZzd_N5h-S0 pI.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\IR-tjQBZzd_N5h-S0 pI.doc.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\MiEnBI8.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\34Z4dfhq5fY_tfB.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\_7SiEN5ix Oq_lUu N.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\34Z4dfhq5fY_tfB.mkv.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\MiEnBI8.docx.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\_7SiEN5ix Oq_lUu N.m4a.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\bvv97LkO.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\0-Tv sYMFqGkma 6x.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\bvv97LkO.swf.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\w w7R5kGwiD8.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\0-Tv sYMFqGkma 6x.wav.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\_eEl\1HSy82Y7UuTj0Jd69.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\w w7R5kGwiD8.mkv.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\_eEl\1HSy82Y7UuTj0Jd69.mp4.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\hGqTnSOKZQ5a1.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\_eEl\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\_eEl\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\_eEl\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\hGqTnSOKZQ5a1.ods.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\_eEl\eztfYAzpK0.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\_eEl\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\_eEl\Q07hPTbYaA2sSmp7JYW8.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\_eEl\eztfYAzpK0.mkv.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\_eEl\QGtWvWHnjohYH0 tv.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\_eEl\Q07hPTbYaA2sSmp7JYW8.swf.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Videos\_eEl\QGtWvWHnjohYH0 tv.swf.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\Na0N0W_tVH__RG.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\fkya9Y5PGZm9_q\22-J61Dy1gKz.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\_eEl\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\Na0N0W_tVH__RG.bmp.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\fkya9Y5PGZm9_q\22-J61Dy1gKz.jpg.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\fkya9Y5PGZm9_q\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\fkya9Y5PGZm9_q\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\Public\Libraries\RecordedTV.library-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\Public\Libraries\RecordedTV.library-ms.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\fkya9Y5PGZm9_q\Ins8Esh4IdpaiiYPl TD.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\Public\Libraries\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\Public\Libraries\CIopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\fkya9Y5PGZm9_q\Ins8Esh4IdpaiiYPl TD.avi.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\fkya9Y5PGZm9_q\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\gl54xs.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\gl54xs.odt.CIop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\CIopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Move \\?\C:\Recovery\WindowsRE\boot.sdi.CIop source_filename = \\?\C:\Recovery\WindowsRE\boot.sdi, flags = MOVEFILE_REPLACE_EXISTING False 1
Fn
Move \\?\C:\Recovery\WindowsRE\boot.sdi.CIop source_filename = \\?\C:\Recovery\WindowsRE\boot.sdi, flags = MOVEFILE_REPLACE_EXISTING True 1
Fn
Move \\?\C:\Recovery\WindowsRE\Winre.wim.CIop source_filename = \\?\C:\Recovery\WindowsRE\Winre.wim, flags = MOVEFILE_REPLACE_EXISTING False 1
Fn
Move \\?\C:\Recovery\WindowsRE\Winre.wim.CIop source_filename = \\?\C:\Recovery\WindowsRE\Winre.wim, flags = MOVEFILE_REPLACE_EXISTING True 1
Fn
Read \\?\C:\BOOTNXT size = 1, size_out = 1 True 1
Fn
Data
Read \\?\C:\Recovery\WindowsRE\ReAgent.xml size = 1041, size_out = 1041 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Contacts\Aclviho ASldjfl.contact size = 1178, size_out = 1178 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Contacts\asdlfk poopvy.contact size = 1171, size_out = 1171 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Contacts\chucu jadnvk.contact size = 1177, size_out = 1177 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Contacts\lulcit amkdfe.contact size = 1174, size_out = 1174 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Contacts\sikvnb huvuib.contact size = 1311, size_out = 1311 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\1u1PtMsi_p5I6Kp0gVZ.xlsx size = 59679, size_out = 59679 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\4CDCeVLoOGDNNc.xlsx size = 51718, size_out = 51718 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\5eq4aL0vBSUL.pps size = 75650, size_out = 75650 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\5EUw6X.xlsx size = 30228, size_out = 30228 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb size = 356352, size_out = 356352 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\FnCzF1A7H gxenH83.pptx size = 16246, size_out = 16246 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\gCLjM xynMaWR.xlsx size = 85977, size_out = 85977 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\hfoKW.pptx size = 88310, size_out = 88310 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\hJZX8AFOtoTuk B35pJ_.pdf size = 2395, size_out = 2395 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\JF6Z1xvDFv.docx size = 75271, size_out = 75271 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\MI47.xlsx size = 32640, size_out = 32640 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\mlv6Gzv7Da-BgmdC.docx size = 68679, size_out = 68679 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\nP0r3x5d.ods size = 77425, size_out = 77425 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\o1_fy8.pptx size = 10196, size_out = 10196 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\obHPe.pptx size = 11865, size_out = 11865 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\SATDQcfMYoPlh.docx size = 15796, size_out = 15796 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\u6hnCYVE2vuu.docx size = 76175, size_out = 76175 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\ziNabL4eBQn3JC_djnr.pptx size = 37241, size_out = 37241 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\ZmbKh2wUNBqMsH-.docx size = 42259, size_out = 42259 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\folder.ico size = 29926, size_out = 29926 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2 size = 6184, size_out = 6184 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Quick Notes.one size = 360136, size_out = 360136 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\lcfkj@kiekc.df.pst size = 271360, size_out = 271360 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\uhL6PZJxrZwaAeTB.ods size = 26357, size_out = 26357 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\-PZcxu.pps size = 76406, size_out = 76406 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\GAgDtV.ods size = 59132, size_out = 59132 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\yhA0tWH2QIX.odt size = 59298, size_out = 59298 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\51gZ9cs6QyQwB.xlsx size = 48779, size_out = 48779 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\FMVnxBVv7u9Rp.docx size = 67411, size_out = 67411 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\ttYeA5K8BN5b.ppt size = 46614, size_out = 46614 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\r873fj.xls size = 58172, size_out = 58172 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\s9_oB4RJJAVSDjPCS.pdf size = 1321, size_out = 1321 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\UmcQX7d.pptx size = 39116, size_out = 39116 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\XJ2OD9lQq0BG.docx size = 18524, size_out = 18524 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\LJ2-ZSo63V_7d.xlsx size = 77494, size_out = 77494 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\pdKaXJhzd7zYz7o.doc size = 15153, size_out = 15153 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\3kj8Y-EDPTFO.pptx size = 74244, size_out = 74244 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\5NEaCJn_lqI_2wf_A.pdf size = 85991, size_out = 85991 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\gGPxR1SI06PikWMCd.rtf size = 69399, size_out = 69399 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\NHki1vMmaXoWuhnR.pdf size = 64515, size_out = 64515 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\tyDDeYuppbUilesSL.odt size = 82532, size_out = 82532 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\3B2V8p-DhIekN7FYAT.docx size = 65599, size_out = 65599 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\5qiwP0Jfq.pps size = 78161, size_out = 78161 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\fsxQuEAvOd0El-v.pps size = 39795, size_out = 39795 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\h8IhXzO4v.csv size = 21338, size_out = 21338 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\HpvWb5EHtTvn89.pps size = 75818, size_out = 75818 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\oGyow62Ehp.pdf size = 15737, size_out = 15737 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\Q0WDNI_cEJvL.pdf size = 58097, size_out = 58097 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\tpkoPGhxV.xls size = 16985, size_out = 16985 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\vv1t.doc size = 11447, size_out = 11447 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\iclup5FUSoIoGUEpJ 8n.pps size = 30207, size_out = 30207 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\k4LJ2WYGO9QfwUDPoT.doc size = 96608, size_out = 96608 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\Qq3R.ots size = 17808, size_out = 17808 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\0KK10L8Yj9PSdD5_rlI8.pptx size = 2020, size_out = 2020 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\6w48s.rtf size = 86473, size_out = 86473 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\B-2cmW.doc size = 18267, size_out = 18267 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\CQjd3NSx.ppt size = 91647, size_out = 91647 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\DYnSH7i.xls size = 70255, size_out = 70255 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\mR4SZZ7.pptx size = 98779, size_out = 98779 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Favorites\Bing.url size = 208, size_out = 208 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\2G6M.mp3 size = 67745, size_out = 67745 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\eEmxkUZ3.wav size = 68679, size_out = 68679 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\I8Dv-9gTrMuD.mp3 size = 59348, size_out = 59348 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\N0rL.wav size = 45654, size_out = 45654 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\p6UEXQwLP.mp3 size = 88886, size_out = 88886 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\Pf3R-b3DBtl.wav size = 4947, size_out = 4947 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\vEcRh3pLVRcZ1O.mp3 size = 67793, size_out = 67793 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\z8Pr_v.mp3 size = 50834, size_out = 50834 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\2HvoIrFtByws.mp3 size = 38307, size_out = 38307 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\69_UAHNRs.mp3 size = 29585, size_out = 29585 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\dCyPtvG.wav size = 92647, size_out = 92647 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\Dg7 CrsqU k7Xp.mp3 size = 19453, size_out = 19453 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\gRZdqIY3h.mp3 size = 33312, size_out = 33312 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\GsSWFcQiPn.wav size = 33292, size_out = 33292 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\LG0LJ99M.mp3 size = 69782, size_out = 69782 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\p6xCw Vob.mp3 size = 52643, size_out = 52643 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\t41qgP8Zl.wav size = 28186, size_out = 28186 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\Tvn8aqPC_U.wav size = 74890, size_out = 74890 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\aR-iIw.m4a size = 30332, size_out = 30332 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\bWUX20g7Mm7g1y.wav size = 47362, size_out = 47362 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\g8L7418FmZslF.wav size = 26867, size_out = 26867 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\lqlP4y.wav size = 94794, size_out = 94794 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\NRNil.wav size = 16288, size_out = 16288 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\rKQbOo.m4a size = 60249, size_out = 60249 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\zdZ3oJ-bfmJu.wav size = 19604, size_out = 19604 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\MgyGAvvq5w6fl7AR1Hfa.bmp size = 73396, size_out = 73396 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\qp-3yc7D3FrGiW.jpg size = 55051, size_out = 55051 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\vxT7Wz-UZ XFfNDp.png size = 93390, size_out = 93390 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\4LAv.png size = 73858, size_out = 73858 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\aClNMcka4 SH9Md3Hwo.png size = 71559, size_out = 71559 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\Qm paxELf.bmp size = 18534, size_out = 18534 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\-aXVf.flv size = 93176, size_out = 93176 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\wGSFbii.jpg size = 35594, size_out = 35594 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\-NlSo.bmp size = 88029, size_out = 88029 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\jA0o4Ao7ru.jpg size = 90338, size_out = 90338 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\2SXCpVLNs73BQPAtgxC.png size = 80546, size_out = 80546 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\Z-AP6tzBW HexwllgoRb.jpg size = 85453, size_out = 85453 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\jf2gmUDSNpxqc ZNVVv.jpg size = 90794, size_out = 90794 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\45dQ123.wav size = 42133, size_out = 42133 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\ape_Je.m4a size = 50876, size_out = 50876 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\aV64x7o3lA2K.wav size = 43728, size_out = 43728 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\lAHCz7usAd.gif size = 26835, size_out = 26835 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\MsxtzGW tpKDJN.gif size = 24491, size_out = 24491 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\Bu5bp9.avi size = 86512, size_out = 86512 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\TqgqXxG.bmp size = 43251, size_out = 43251 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\dDTdaFbzRTbH.png size = 100207, size_out = 100207 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\dBpSfcucLn3NuQ6je7.rtf size = 55530, size_out = 55530 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\uOf1gCg-syx.bmp size = 29410, size_out = 29410 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\dizklXpXe.ppt size = 77611, size_out = 77611 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\xBTg.bmp size = 85696, size_out = 85696 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\lGBL1f9.swf size = 8613, size_out = 8613 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\-Z88RWVEKHn2YHbC6YS.gif size = 33023, size_out = 33023 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\h72I_b.bmp size = 55036, size_out = 55036 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\nYkivMTIATrvxLZ.xls size = 97628, size_out = 97628 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\itHSyuXpEG8bbygGV.jpg size = 91937, size_out = 91937 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\lYPIT_a_zAinFFHfUDV.jpg size = 94774, size_out = 94774 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\O4rsCOfAWVNZ.mp4 size = 57001, size_out = 57001 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\OALKMuc2ka4.gif size = 61987, size_out = 61987 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\P9oN_mVJ_5GZ wuO.avi size = 15194, size_out = 15194 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\50YQIo4i.jpg size = 32116, size_out = 32116 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\ROHZJx8ipU.mp3 size = 94823, size_out = 94823 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\6ORqLC9av8hKhylQ04z2.png size = 61483, size_out = 61483 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\N6 e0qhUxBM.bmp size = 29548, size_out = 29548 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\rvq7ekaaX.gif size = 16321, size_out = 16321 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\7Luf9iKqys 6\0eBemC7.bmp size = 83804, size_out = 83804 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\s5DMlEpMOzEY.pdf size = 8281, size_out = 8281 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\t39geveg0wynNP.m4a size = 4463, size_out = 4463 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\7Luf9iKqys 6\lMwuMumsTcOMWQg.bmp size = 66606, size_out = 66606 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\uQNDwbW1Y.avi size = 68441, size_out = 68441 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Pictures\bLdID5XJzq jCM\IwWqYwDX1-Oo2.gif size = 61064, size_out = 61064 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\VX9FUGeY-MvLyFL6.gif size = 74654, size_out = 74654 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\wh 8KrD6eNSHE.gif size = 59279, size_out = 59279 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\xj7qoX0- 7l3FO.mkv size = 21267, size_out = 21267 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Searches\Everywhere.search-ms size = 248, size_out = 248 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Searches\Indexed Locations.search-ms size = 248, size_out = 248 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\Y_LI3 4-qP.m4a size = 73397, size_out = 73397 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\bVHx1G7LG6.swf size = 86911, size_out = 86911 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\z29LckBw5RcM_XD.png size = 101289, size_out = 101289 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\zsdQJc9p9rp.png size = 23438, size_out = 23438 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\Up-xCZd9p 2yrWN.mp4 size = 89251, size_out = 89251 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\3eETFbJdu0.m4a size = 71651, size_out = 71651 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\3IveDjbz33f.mkv size = 68117, size_out = 68117 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\VYNmKqyqyi.mkv size = 77581, size_out = 77581 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\Xj74 9 m.flv size = 13295, size_out = 13295 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\zDzpwp-28.avi size = 82468, size_out = 82468 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\8P2mSya3098KVulU.wav size = 80311, size_out = 80311 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\AK8M AL1ySTdgK.odt size = 61680, size_out = 61680 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\iFWD4toa.jpg size = 81518, size_out = 81518 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\33G0h-QVWGTGNhCEha.mp4 size = 76349, size_out = 76349 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\kDpdV 3nnSnJmGqPO.ppt size = 88318, size_out = 88318 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\S20n9CABG0uo.mp4 size = 7520, size_out = 7520 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\62uD.avi size = 26000, size_out = 26000 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\Eowo0nLnhzDtXx7wGkmW.mp4 size = 25794, size_out = 25794 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\LzUKcb-uGVeX.png size = 53592, size_out = 53592 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\FnTKrRERf_0VWyksIzp.xls size = 30100, size_out = 30100 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\VAlp\gbg6IyO.avi size = 30723, size_out = 30723 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\4ioWuMxhZ Ndf1N_b.flv size = 102103, size_out = 102103 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\mJbzYvV0BW4OFQ1.bmp size = 38314, size_out = 38314 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\oJoLhaSYb.mkv size = 20630, size_out = 20630 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pB rGU0A_4l5KRvtZ sr.mp4 size = 47505, size_out = 47505 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\_F8m3hu10142ds4cz1.avi size = 82448, size_out = 82448 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\nmKbd_Etp705mK8.odt size = 83152, size_out = 83152 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\Y_62XF6X1FjEo5B7P.avi size = 22120, size_out = 22120 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\0_psbc9.avi size = 45211, size_out = 45211 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\DqXOsfvU6Y tHX.wav size = 27780, size_out = 27780 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\3m7QHv7T5mGuFh2A31Q.avi size = 101548, size_out = 101548 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\4xODVA0z5L5w0l.mkv size = 38168, size_out = 38168 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\iJYJHrgQ2a2pzMtZL.swf size = 10558, size_out = 10558 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\H9o_U92tz2Ho9-mh.swf size = 19222, size_out = 19222 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\IR-tjQBZzd_N5h-S0 pI.doc size = 58841, size_out = 58841 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\MiEnBI8.docx size = 44920, size_out = 44920 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\34Z4dfhq5fY_tfB.mkv size = 7077, size_out = 7077 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\_7SiEN5ix Oq_lUu N.m4a size = 71815, size_out = 71815 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\bvv97LkO.swf size = 3604, size_out = 3604 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\0-Tv sYMFqGkma 6x.wav size = 17028, size_out = 17028 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\w w7R5kGwiD8.mkv size = 3814, size_out = 3814 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\_eEl\1HSy82Y7UuTj0Jd69.mp4 size = 10347, size_out = 10347 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\hGqTnSOKZQ5a1.ods size = 50054, size_out = 50054 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\_eEl\eztfYAzpK0.mkv size = 45922, size_out = 45922 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\_eEl\Q07hPTbYaA2sSmp7JYW8.swf size = 61211, size_out = 61211 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Videos\_eEl\QGtWvWHnjohYH0 tv.swf size = 28956, size_out = 28956 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\Na0N0W_tVH__RG.bmp size = 84219, size_out = 84219 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\fkya9Y5PGZm9_q\22-J61Dy1gKz.jpg size = 8671, size_out = 8671 True 1
Fn
Data
Read \\?\C:\Users\Public\Libraries\RecordedTV.library-ms size = 999, size_out = 999 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\fkya9Y5PGZm9_q\Ins8Esh4IdpaiiYPl TD.avi size = 63877, size_out = 63877 True 1
Fn
Data
Read \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\gl54xs.odt size = 80065, size_out = 80065 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\clearnetworkdns_11-22-33.bat size = 948 True 1
Fn
Data
Write C:\CIopReadMe.txt size = 1881 True 1
Fn
Data
Write \\?\C:\BOOTNXT.CIop size = 1 True 1
Fn
Data
Write \\?\C:\BOOTNXT.CIop size = 7 True 1
Fn
Data
Write \\?\C:\BOOTNXT.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Recovery\WindowsRE\boot.sdi size = 7 True 1
Fn
Data
Write \\?\C:\Recovery\WindowsRE\boot.sdi size = 128 True 1
Fn
Data
Write C:\Recovery\WindowsRE\CIopReadMe.txt size = 1881 True 1
Fn
Data
Write \\?\C:\Recovery\WindowsRE\ReAgent.xml.CIop size = 1041 True 1
Fn
Data
Write \\?\C:\Recovery\WindowsRE\ReAgent.xml.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Recovery\WindowsRE\ReAgent.xml.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Contacts\Aclviho ASldjfl.contact.CIop size = 1178 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Contacts\Aclviho ASldjfl.contact.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Contacts\Aclviho ASldjfl.contact.CIop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Contacts\CIopReadMe.txt size = 1881 True 1
Fn
Data
Write \\?\C:\Recovery\WindowsRE\Winre.wim size = 7 True 1
Fn
Data
Write \\?\C:\Recovery\WindowsRE\Winre.wim size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Contacts\asdlfk poopvy.contact.CIop size = 1171 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Contacts\asdlfk poopvy.contact.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Contacts\asdlfk poopvy.contact.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Contacts\chucu jadnvk.contact.CIop size = 1177 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Contacts\chucu jadnvk.contact.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Contacts\chucu jadnvk.contact.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Contacts\lulcit amkdfe.contact.CIop size = 1174 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Contacts\lulcit amkdfe.contact.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Contacts\lulcit amkdfe.contact.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Contacts\sikvnb huvuib.contact.CIop size = 1311 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Contacts\sikvnb huvuib.contact.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Contacts\sikvnb huvuib.contact.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop size = 59679 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Documents\CIopReadMe.txt size = 1881 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\4CDCeVLoOGDNNc.xlsx.CIop size = 51718 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\4CDCeVLoOGDNNc.xlsx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\4CDCeVLoOGDNNc.xlsx.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\5eq4aL0vBSUL.pps.CIop size = 75650 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\5eq4aL0vBSUL.pps.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\5eq4aL0vBSUL.pps.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\5EUw6X.xlsx.CIop size = 30228 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\5EUw6X.xlsx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\5EUw6X.xlsx.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb.CIop size = 356352 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\FnCzF1A7H gxenH83.pptx.CIop size = 16246 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\FnCzF1A7H gxenH83.pptx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\FnCzF1A7H gxenH83.pptx.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\gCLjM xynMaWR.xlsx.CIop size = 85977 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\gCLjM xynMaWR.xlsx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\gCLjM xynMaWR.xlsx.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\hfoKW.pptx.CIop size = 88310 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\hfoKW.pptx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\hfoKW.pptx.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\hJZX8AFOtoTuk B35pJ_.pdf.CIop size = 2395 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\hJZX8AFOtoTuk B35pJ_.pdf.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\hJZX8AFOtoTuk B35pJ_.pdf.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\JF6Z1xvDFv.docx.CIop size = 75271 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\JF6Z1xvDFv.docx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\JF6Z1xvDFv.docx.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\MI47.xlsx.CIop size = 32640 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\MI47.xlsx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\MI47.xlsx.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\mlv6Gzv7Da-BgmdC.docx.CIop size = 68679 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\mlv6Gzv7Da-BgmdC.docx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\mlv6Gzv7Da-BgmdC.docx.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\nP0r3x5d.ods.CIop size = 77425 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\nP0r3x5d.ods.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\nP0r3x5d.ods.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\o1_fy8.pptx.CIop size = 10196 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\o1_fy8.pptx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\o1_fy8.pptx.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\obHPe.pptx.CIop size = 11865 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\obHPe.pptx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\obHPe.pptx.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\SATDQcfMYoPlh.docx.CIop size = 15796 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\SATDQcfMYoPlh.docx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\SATDQcfMYoPlh.docx.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\u6hnCYVE2vuu.docx.CIop size = 76175 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\u6hnCYVE2vuu.docx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\u6hnCYVE2vuu.docx.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\ziNabL4eBQn3JC_djnr.pptx.CIop size = 37241 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\ziNabL4eBQn3JC_djnr.pptx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\ziNabL4eBQn3JC_djnr.pptx.CIop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Documents\My Music\CIopReadMe.txt size = 1881 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\ZmbKh2wUNBqMsH-.docx.CIop size = 42259 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\ZmbKh2wUNBqMsH-.docx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\ZmbKh2wUNBqMsH-.docx.CIop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Documents\My Pictures\CIopReadMe.txt size = 1881 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\CIopReadMe.txt size = 1881 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\folder.ico.CIop size = 29926 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\folder.ico.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\folder.ico.CIop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\CIopReadMe.txt size = 1881 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2 size = 1881 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.CIop size = 6184 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Quick Notes.one.CIop size = 360136 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Quick Notes.one.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Quick Notes.one.CIop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\CIopReadMe.txt size = 1881 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\lcfkj@kiekc.df.pst.CIop size = 271360 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\lcfkj@kiekc.df.pst.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\lcfkj@kiekc.df.pst.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\uhL6PZJxrZwaAeTB.ods size = 1881 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\uhL6PZJxrZwaAeTB.ods.CIop size = 26357 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\uhL6PZJxrZwaAeTB.ods.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\uhL6PZJxrZwaAeTB.ods.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\-PZcxu.pps.CIop size = 76406 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\-PZcxu.pps.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\-PZcxu.pps.CIop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\CIopReadMe.txt size = 1881 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\GAgDtV.ods.CIop size = 59132 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\GAgDtV.ods.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\GAgDtV.ods.CIop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\CIopReadMe.txt size = 1881 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\yhA0tWH2QIX.odt.CIop size = 59298 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\yhA0tWH2QIX.odt.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\yhA0tWH2QIX.odt.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\51gZ9cs6QyQwB.xlsx.CIop size = 48779 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\51gZ9cs6QyQwB.xlsx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\51gZ9cs6QyQwB.xlsx.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\FMVnxBVv7u9Rp.docx.CIop size = 67411 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\FMVnxBVv7u9Rp.docx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\FMVnxBVv7u9Rp.docx.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\ttYeA5K8BN5b.ppt.CIop size = 46614 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\ttYeA5K8BN5b.ppt.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\ttYeA5K8BN5b.ppt.CIop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\CIopReadMe.txt size = 1881 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\r873fj.xls.CIop size = 58172 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\r873fj.xls.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\r873fj.xls.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\s9_oB4RJJAVSDjPCS.pdf.CIop size = 1321 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\s9_oB4RJJAVSDjPCS.pdf.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\s9_oB4RJJAVSDjPCS.pdf.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\UmcQX7d.pptx.CIop size = 39116 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\UmcQX7d.pptx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\UmcQX7d.pptx.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\XJ2OD9lQq0BG.docx.CIop size = 18524 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\XJ2OD9lQq0BG.docx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\XJ2OD9lQq0BG.docx.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\LJ2-ZSo63V_7d.xlsx.CIop size = 77494 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\LJ2-ZSo63V_7d.xlsx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\LJ2-ZSo63V_7d.xlsx.CIop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\CIopReadMe.txt size = 1881 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\pdKaXJhzd7zYz7o.doc.CIop size = 15153 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\pdKaXJhzd7zYz7o.doc.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\pdKaXJhzd7zYz7o.doc.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\3kj8Y-EDPTFO.pptx.CIop size = 74244 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\3kj8Y-EDPTFO.pptx.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\3kj8Y-EDPTFO.pptx.CIop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\CIopReadMe.txt size = 1881 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\5NEaCJn_lqI_2wf_A.pdf.CIop size = 85991 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\5NEaCJn_lqI_2wf_A.pdf.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\5NEaCJn_lqI_2wf_A.pdf.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\gGPxR1SI06PikWMCd.rtf.CIop size = 69399 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\gGPxR1SI06PikWMCd.rtf.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\gGPxR1SI06PikWMCd.rtf.CIop size = 128 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\NHki1vMmaXoWuhnR.pdf.CIop size = 64515 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\NHki1vMmaXoWuhnR.pdf.CIop size = 7 True 1
Fn
Data
Write \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\NHki1vMmaXoWuhnR.pdf.CIop size = 128 True 1
Fn
Data
Delete \\?\C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\HpvWb5EHtTvn89.pps - True 1
Fn
For performance reasons, the remaining 857 entries are omitted.
The remaining entries can be found in glog.xml.
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Users\CIiHmnxMn6Ps\Desktop\clearnetworkdns_11-22-33.bat show_window = SW_HIDE True 1
Fn
Module (367)
»
Operation Module Additional Information Success Count Logfile
Load user32.dll base_address = 0x76c70000 True 1
Fn
Load KERNEL32.dll base_address = 0x74f40000 True 1
Fn
Load USER32.dll base_address = 0x76c70000 True 1
Fn
Load GDI32.dll base_address = 0x75030000 True 1
Fn
Load WINSPOOL.DRV base_address = 0x74500000 True 1
Fn
Load COMDLG32.dll base_address = 0x766d0000 True 1
Fn
Load ADVAPI32.dll base_address = 0x77550000 True 1
Fn
Load SHELL32.dll base_address = 0x75310000 True 1
Fn
Load SHLWAPI.dll base_address = 0x74da0000 True 1
Fn
Load CRYPT32.dll base_address = 0x74880000 True 1
Fn
Load MPR.dll base_address = 0x744c0000 True 1
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x75190000 True 2
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x75190000 True 2
Fn
Load api-ms-win-core-localization-l1-2-1 base_address = 0x75190000 True 1
Fn
Get Handle c:\users\ciihmnxmn6ps\desktop\scn0tification.exe base_address = 0x400000 True 52
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x74f40000 True 2
Fn
Get Handle c:\windows\syswow64\kernelbase.dll base_address = 0x75190000 True 26
Fn
Get Filename - process_name = c:\users\ciihmnxmn6ps\desktop\scn0tification.exe, file_name_orig = C:\Users\CIiHmnxMn6Ps\Desktop\SCN0tification.exe, size = 260 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x74f5a330 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x74f57580 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x74f59910 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x74f5f400 True 1
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = EncodePointer, address_out = 0x7770f190 True 9
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = DecodePointer, address_out = 0x7770a200 True 17
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x75242e70 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetWindowContextHelpId, address_out = 0x76cc8df0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x74f58b70 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x74f58c50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryA, address_out = 0x74f5d8d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x74f58c70 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualQuery, address_out = 0x74f58c90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x74f66020 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableA, address_out = 0x74f5a390 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexA, address_out = 0x74f65fb0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileAttributesW, address_out = 0x74f66340 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibraryAndExitThread, address_out = 0x74f5a570 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemCodePagesW, address_out = 0x74f80d40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteTapemark, address_out = 0x74f8b570 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ResumeThread, address_out = 0x74f5a280 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x74f58770 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x74f592b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersion, address_out = 0x74f5a300 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x74f67510 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleExA, address_out = 0x74f5a3d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeZoneInformation, address_out = 0x74f5a530 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringA, address_out = 0x74f5db10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x74f5c9b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetEvent, address_out = 0x74f660c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThread, address_out = 0x74f575c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DefineDosDeviceW, address_out = 0x74f66190 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileA, address_out = 0x74f661a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x74f5ee30 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FileTimeToLocalFileTime, address_out = 0x74f661c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateWaitableTimerA, address_out = 0x74f5db30 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindAtomA, address_out = 0x74f5e640 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x74f57940 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x74f674f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringW, address_out = 0x74f59a40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameW, address_out = 0x74f63e90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x74f51d90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x74f828e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x74f575a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadConsoleOutputCharacterW, address_out = 0x74f66a40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalReAlloc, address_out = 0x74f64b60 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryA, address_out = 0x74f66140 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x74f52dc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStringTypeW, address_out = 0x74f579b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x74f5a3b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x74f5a790 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetExitCodeProcess, address_out = 0x74f5f6f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentDirectoryA, address_out = 0x74f80ff0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x74f66170 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LockResource, address_out = 0x74f57a50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadResource, address_out = 0x74f578f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindResourceW, address_out = 0x74f63a50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x74f59660 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumResourceNamesA, address_out = 0x74f7d980 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x7770a200 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteConsoleW, address_out = 0x74f66920 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileMappingW, address_out = 0x74f591e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleMode, address_out = 0x74f66870 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x74f662a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x776ebae0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapSize, address_out = 0x77704f40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x74f57910 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileType, address_out = 0x74f66390 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetStdHandle, address_out = 0x74f826a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x74f5a0f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x74f5a4b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineA, address_out = 0x74f5a3c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x74f59fc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetOEMCP, address_out = 0x74f5fd10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidCodePage, address_out = 0x74f5a090 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileA, address_out = 0x74f66270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileExA, address_out = 0x74f66220 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x776eda90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x74f525e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x74f59ec0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleExW, address_out = 0x74f59fa0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x74f52d60 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x74f5a060 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x74f57920 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x74f598f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsFree, address_out = 0x74f59930 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x74f51ba0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsAlloc, address_out = 0x74f59a70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x77709920 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x776f5e00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SignalObjectAndWait, address_out = 0x74f82850 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleCP, address_out = 0x74f66860 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x74f5fbc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpynW, address_out = 0x74f5fbe0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x74f51da0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringW, address_out = 0x74f62230 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EraseTape, address_out = 0x74f8b350 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileA, address_out = 0x74f66210 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SizeofResource, address_out = 0x74f58cb0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x74f5a040 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetShortPathNameA, address_out = 0x74f5c3a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDriveTypeW, address_out = 0x74f66300 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpW, address_out = 0x74f578d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MapViewOfFile, address_out = 0x74f58c10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x776f5e80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x74f52af0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyW, address_out = 0x74f7d410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileExW, address_out = 0x74f5a820 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x74f59700 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemInfo, address_out = 0x74f5a1f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x74f65f20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalFree, address_out = 0x74f63a70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyA, address_out = 0x74f5e320 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x74f661b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalAlloc, address_out = 0x74f59600 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatW, address_out = 0x74f7d320 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x74f52db0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x74f577b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesW, address_out = 0x74f66510 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnmapViewOfFile, address_out = 0x74f594b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x74f66180 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x74f66110 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x74f661d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x74f63a30 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointer, address_out = 0x74f66530 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x74f58bf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x74f66590 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x74f52d80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x74f66290 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x74f59a80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoW, address_out = 0x74f5a080 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeSListHead, address_out = 0x77711fc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x74f52b90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x74f66250 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x74f66540 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x74f664a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x74f51b90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x74f59680 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x74f52da0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x74f5a2c0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = wsprintfW, address_out = 0x76c9ddf0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharUpperW, address_out = 0x76c8df20 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharNextA, address_out = 0x76c9d030 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DispatchMessageA, address_out = 0x76ca0660 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetDC, address_out = 0x76ca4dd0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = IsWindowVisible, address_out = 0x76c96e80 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetMenuItemCount, address_out = 0x76c8ff00 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CreateWindowExW, address_out = 0x76c891c0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetSystemMetrics, address_out = 0x76c855d0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBeep, address_out = 0x76cc95b0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetWindowPlacement, address_out = 0x76ca5a70 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DrawIcon, address_out = 0x76c9dc70 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = wsprintfA, address_out = 0x76c9ea00 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetSubMenu, address_out = 0x76c8fe30 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DialogBoxIndirectParamA, address_out = 0x76ccbf20 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = InvalidateRgn, address_out = 0x76ca59a0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = IsDialogMessageA, address_out = 0x76c98f40 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = ClientToScreen, address_out = 0x76c82460 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = EmptyClipboard, address_out = 0x76ca5ca0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = PeekMessageW, address_out = 0x76c8ac30 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetWindowTextA, address_out = 0x76c94690 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MapWindowPoints, address_out = 0x76c81f60 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetKeyboardLayout, address_out = 0x76c8ceb0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MoveWindow, address_out = 0x76ca5300 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetDialogBaseUnits, address_out = 0x76c91650 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DefWindowProcA, address_out = 0x7772ca90 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadBitmapW, address_out = 0x76c90550 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DrawTextExW, address_out = 0x76c92ef0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CreateWindowExA, address_out = 0x76ca4720 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadIconW, address_out = 0x76c87710 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SendDlgItemMessageA, address_out = 0x76c91420 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadCursorW, address_out = 0x76c87740 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetWindowDC, address_out = 0x76ca5360 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = AppendMenuA, address_out = 0x76cf67c0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetDlgItem, address_out = 0x76c91540 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DrawTextW, address_out = 0x76c92f20 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharUpperBuffW, address_out = 0x76ca3140 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = HiliteMenuItem, address_out = 0x76ca8940 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetDesktopWindow, address_out = 0x76c81520 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetParent, address_out = 0x76c8b790 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DialogBoxParamW, address_out = 0x76ccc010 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = SwapMouseButton, address_out = 0x76cca110 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = UnpackDDElParam, address_out = 0x76cd7390 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadStringW, address_out = 0x76c8cf10 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = SelectObject, address_out = 0x750afc80 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = GetTextFaceW, address_out = 0x750bc0e0 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = AbortDoc, address_out = 0x75110820 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = CreateDCW, address_out = 0x750df0a0 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = GetTextCharset, address_out = 0x750dfd40 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = GetTextMetricsW, address_out = 0x750c9190 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = GetSystemPaletteEntries, address_out = 0x750e06c0 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = SelectClipRgn, address_out = 0x750bd640 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = CreateFontIndirectA, address_out = 0x750c0940 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = PtInRegion, address_out = 0x750dd000 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = EnumObjects, address_out = 0x75110390 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = DeleteMetaFile, address_out = 0x750b6910 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = SetAbortProc, address_out = 0x750e1390 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = EndPage, address_out = 0x750dfbc0 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = ExtTextOutA, address_out = 0x750da100 True 1
Fn
Get Address c:\windows\syswow64\winspool.drv function = ClosePrinter, address_out = 0x74513de0 True 1
Fn
Get Address c:\windows\syswow64\comdlg32.dll function = GetOpenFileNameA, address_out = 0x76726e20 True 1
Fn
Get Address c:\windows\syswow64\comdlg32.dll function = ReplaceTextW, address_out = 0x7672b8d0 True 1
Fn
Get Address c:\windows\syswow64\comdlg32.dll function = ChooseFontA, address_out = 0x7672bf10 True 1
Fn
Get Address c:\windows\syswow64\comdlg32.dll function = PrintDlgA, address_out = 0x76730b20 True 1
Fn
Get Address c:\windows\syswow64\comdlg32.dll function = GetFileTitleW, address_out = 0x766db730 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegDeleteValueW, address_out = 0x77570ca0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptGenKey, address_out = 0x77573fd0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptExportKey, address_out = 0x7756f8f0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExA, address_out = 0x7756ee40 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = SetServiceStatus, address_out = 0x77570ce0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenSCManagerA, address_out = 0x77570f30 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenUserClassesRoot, address_out = 0x77586810 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSaveKeyExW, address_out = 0x77586890 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = InitializeSecurityDescriptor, address_out = 0x7756f870 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExA, address_out = 0x7756f000 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x7756ed80 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptEncrypt, address_out = 0x77585bd0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegDeleteValueA, address_out = 0x77570fb0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDestroyKey, address_out = 0x7756fc10 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptAcquireContextW, address_out = 0x77570730 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptReleaseContext, address_out = 0x77570ad0 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetSpecialFolderPathW, address_out = 0x7549edb0 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteA, address_out = 0x75572110 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = StrStrW, address_out = 0x74db81d0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = PathFindFileNameW, address_out = 0x74db80d0 True 1
Fn
Get Address c:\windows\syswow64\crypt32.dll function = CryptStringToBinaryA, address_out = 0x748c8040 True 1
Fn
Get Address c:\windows\syswow64\crypt32.dll function = CryptDecodeObjectEx, address_out = 0x748b4470 True 1
Fn
Get Address c:\windows\syswow64\crypt32.dll function = CryptImportPublicKeyInfoEx, address_out = 0x748b0cc0 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumW, address_out = 0x744c3810 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceW, address_out = 0x744c32d0 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x744c3710 True 1
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = InitializeCriticalSectionEx, address_out = 0x75243ae0 True 2
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = FlsAlloc, address_out = 0x75246530 True 2
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = FlsSetValue, address_out = 0x75243770 True 2
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = FlsGetValue, address_out = 0x7523a7b0 True 1
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = LCMapStringEx, address_out = 0x75233690 True 1
Fn
Create Mapping \\?\C:\Recovery\WindowsRE\boot.sdi filename = \\?\C:\Recovery\WindowsRE\boot.sdi, protection = PAGE_READWRITE, maximum_size = 0 True 1
Fn
Create Mapping \\?\C:\Recovery\WindowsRE\Winre.wim filename = \\?\C:\Recovery\WindowsRE\Winre.wim, protection = PAGE_READWRITE, maximum_size = 0 True 1
Fn
Map \\?\C:\Recovery\WindowsRE\boot.sdi process_name = c:\users\ciihmnxmn6ps\desktop\scn0tification.exe, desired_access = FILE_MAP_WRITE, FILE_MAP_READ True 1
Fn
Map \\?\C:\Recovery\WindowsRE\Winre.wim process_name = c:\users\ciihmnxmn6ps\desktop\scn0tification.exe, desired_access = FILE_MAP_WRITE, FILE_MAP_READ True 1
Fn
Keyboard (1)
»
Operation Additional Information Success Count Logfile
Get Info type = KB_LOCALE_ID, os_tid = 0, result_out = 67699721 True 1
Fn
System (273)
»
Operation Additional Information Success Count Logfile
Sleep duration = -1 (infinite) True 2
Fn
Sleep duration = 5000 milliseconds (5.000 seconds) True 3
Fn
Sleep duration = 6666 milliseconds (6.666 seconds) True 1
Fn
Sleep duration = 1800000 milliseconds (1800.000 seconds) True 22
Fn
Sleep duration = 13 milliseconds (0.013 seconds) True 218
Fn
Sleep duration = 1560000 milliseconds (1560.000 seconds) True 1
Fn
Sleep duration = 300000 milliseconds (300.000 seconds) True 16
Fn
Get Time type = System Time, time = 2019-03-02 17:31:18 (UTC) True 1
Fn
Get Info type = Operating System True 1
Fn
Get Info type = Hardware Information True 8
Fn
Mutex (1)
»
Operation Additional Information Success Count Logfile
Create mutex_name = ^_-HappyLife^_- True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Process #2: cmd.exe
108 0
»
Information Value
ID #2
File Name c:\windows\syswow64\cmd.exe
Command Line C:\Windows\system32\cmd.exe /c ""C:\Users\CIiHmnxMn6Ps\Desktop\clearnetworkdns_11-22-33.bat" "
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:01:09, Reason: Child Process
Unmonitor End Time: 00:01:15, Reason: Self Terminated
Monitor Duration 00:00:06
OS Process Information
»
Information Value
PID 0xdac
Parent PID 0xd34 (c:\users\ciihmnxmn6ps\desktop\scn0tification.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x DB0
0x DD8
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000ad0000 0x00ad0000 0x00aeffff Private Memory rw True False False -
pagefile_0x0000000000ad0000 0x00ad0000 0x00adffff Pagefile Backed Memory rw True False False -
private_0x0000000000ae0000 0x00ae0000 0x00ae3fff Private Memory rw True False False -
private_0x0000000000af0000 0x00af0000 0x00af1fff Private Memory rw True False False -
private_0x0000000000af0000 0x00af0000 0x00af3fff Private Memory rw True False False -
pagefile_0x0000000000b00000 0x00b00000 0x00b13fff Pagefile Backed Memory r True False False -
private_0x0000000000b20000 0x00b20000 0x00b5ffff Private Memory rw True False False -
private_0x0000000000b60000 0x00b60000 0x00c5ffff Private Memory rw True False False -
pagefile_0x0000000000c60000 0x00c60000 0x00c63fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000c70000 0x00c70000 0x00c70fff Pagefile Backed Memory r True False False -
private_0x0000000000c80000 0x00c80000 0x00c81fff Private Memory rw True False False -
private_0x0000000000c90000 0x00c90000 0x00c9ffff Private Memory rw True False False -
private_0x0000000000cc0000 0x00cc0000 0x00ccffff Private Memory rw True False False -
locale.nls 0x00cd0000 0x00d8dfff Memory Mapped File r False False False -
private_0x0000000000d90000 0x00d90000 0x00dcffff Private Memory rw True False False -
cmd.exe.mui 0x00dd0000 0x00df0fff Memory Mapped File r False False False -
private_0x0000000000e20000 0x00e20000 0x00e2ffff Private Memory rw True False False -
private_0x0000000000e50000 0x00e50000 0x00f4ffff Private Memory rw True False False -
cmd.exe 0x00fa0000 0x00feffff Memory Mapped File rwx True False False -
pagefile_0x0000000000ff0000 0x00ff0000 0x04feffff Pagefile Backed Memory - True False False -
private_0x0000000004ff0000 0x04ff0000 0x050effff Private Memory rw True False False -
sortdefault.nls 0x050f0000 0x05426fff Memory Mapped File r False False False -
wow64cpu.dll 0x5baa0000 0x5baa7fff Memory Mapped File rwx False False False -
wow64win.dll 0x5bab0000 0x5bb22fff Memory Mapped File rwx False False False -
wow64.dll 0x5bb30000 0x5bb7efff Memory Mapped File rwx False False False -
cmdext.dll 0x74310000 0x74317fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74750000 0x747a8fff Memory Mapped File rwx False False False -
cryptbase.dll 0x747b0000 0x747b9fff Memory Mapped File rwx False False False -
sspicli.dll 0x747c0000 0x747ddfff Memory Mapped File rwx False False False -
rpcrt4.dll 0x74a00000 0x74aabfff Memory Mapped File rwx False False False -
kernel32.dll 0x74f40000 0x7502ffff Memory Mapped File rwx False False False -
kernelbase.dll 0x75190000 0x75305fff Memory Mapped File rwx False False False -
msvcrt.dll 0x76f20000 0x76fddfff Memory Mapped File rwx False False False -
sechost.dll 0x772b0000 0x772f2fff Memory Mapped File rwx False False False -
advapi32.dll 0x77550000 0x775cafff Memory Mapped File rwx False False False -
ntdll.dll 0x776b0000 0x77828fff Memory Mapped File rwx False False False -
pagefile_0x000000007e8e0000 0x7e8e0000 0x7e9dffff Pagefile Backed Memory r True False False -
pagefile_0x000000007e9e0000 0x7e9e0000 0x7ea02fff Pagefile Backed Memory r True False False -
private_0x000000007ea08000 0x7ea08000 0x7ea0afff Private Memory rw True False False -
private_0x000000007ea0b000 0x7ea0b000 0x7ea0dfff Private Memory rw True False False -
private_0x000000007ea0e000 0x7ea0e000 0x7ea0efff Private Memory rw True False False -
private_0x000000007ea0f000 0x7ea0f000 0x7ea0ffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7dfc57b4ffff Private Memory r True False False -
pagefile_0x00007dfc57b50000 0x7dfc57b50000 0x7ffc57b4ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ffc57b50000 0x7ffc57d11fff Memory Mapped File rwx False False False -
private_0x00007ffc57d12000 0x7ffc57d12000 0x7ffffffeffff Private Memory r True False False -
Host Behavior
File (47)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\CIiHmnxMn6Ps\Desktop\clearnetworkdns_11-22-33.bat desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 2
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\clearnetworkdns_11-22-33.bat desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\clearnetworkdns_11-22-33.bat desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop type = file_attributes True 2
Fn
Get Info "C:\Users\CIiHmnxMn6Ps\Desktop\clearnetworkdns_11-22-33.bat" type = file_attributes False 1
Fn
Get Info - type = file_type True 2
Fn
Get Info - type = file_type True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 11
Fn
Open STD_INPUT_HANDLE - True 6
Fn
Open - - True 8
Fn
Open - - True 4
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Read - size = 8191, size_out = 948 True 1
Fn
Data
Read - size = 8191, size_out = 937 True 1
Fn
Data
Read - size = 8191, size_out = 900 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 33 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 194, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (2)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\vssadmin.exe os_pid = 0xe1c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Create C:\Windows\system32\vssadmin.exe os_pid = 0xe60, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0xfa0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x74f40000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x74f82780 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x74f5fa80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x74f5a790 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x752a35c0 True 1
Fn
Environment (32)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 10
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 5
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 6
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\CIiHmnxMn6Ps\Desktop True 1
Fn
Set Environment String name = COPYCMD True 2
Fn
Set Environment String name = =ExitCode, value = 00000002 True 2
Fn
Set Environment String name = =ExitCodeAscii True 2
Fn
Process #4: vssadmin.exe
0 0
»
Information Value
ID #4
File Name c:\windows\syswow64\vssadmin.exe
Command Line vssadmin Delete Shadows /all /quiet
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:01:13, Reason: Child Process
Unmonitor End Time: 00:01:14, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xe1c
Parent PID 0xdac (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x E20
0x E34
0x E38
0x E48
0x E4C
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
vssadmin.exe 0x00130000 0x0014dfff Memory Mapped File rwx False False False -
pagefile_0x0000000000c20000 0x00c20000 0x04c1ffff Pagefile Backed Memory - True False False -
private_0x0000000004c20000 0x04c20000 0x04c3ffff Private Memory rw True False False -
pagefile_0x0000000004c20000 0x04c20000 0x04c2ffff Pagefile Backed Memory rw True False False -
private_0x0000000004c30000 0x04c30000 0x04c33fff Private Memory rw True False False -
private_0x0000000004c40000 0x04c40000 0x04c41fff Private Memory rw True False False -
vssadmin.exe.mui 0x04c40000 0x04c4cfff Memory Mapped File r False False False -
pagefile_0x0000000004c50000 0x04c50000 0x04c63fff Pagefile Backed Memory r True False False -
private_0x0000000004c70000 0x04c70000 0x04caffff Private Memory rw True False False -
private_0x0000000004cb0000 0x04cb0000 0x04ceffff Private Memory rw True False False -
pagefile_0x0000000004cf0000 0x04cf0000 0x04cf3fff Pagefile Backed Memory r True False False -
pagefile_0x0000000004d00000 0x04d00000 0x04d00fff Pagefile Backed Memory r True False False -
private_0x0000000004d10000 0x04d10000 0x04d11fff Private Memory rw True False False -
private_0x0000000004d20000 0x04d20000 0x04d5ffff Private Memory rw True False False -
private_0x0000000004d60000 0x04d60000 0x04d9ffff Private Memory rw True False False -
private_0x0000000004da0000 0x04da0000 0x04da0fff Private Memory rw True False False -
private_0x0000000004db0000 0x04db0000 0x04db0fff Private Memory rw True False False -
private_0x0000000004dc0000 0x04dc0000 0x04dcffff Private Memory rw True False False -
private_0x0000000004dd0000 0x04dd0000 0x04dd3fff Private Memory rw True False False -
pagefile_0x0000000004df0000 0x04df0000 0x04df0fff Pagefile Backed Memory r True False False -
private_0x0000000004e00000 0x04e00000 0x04e3ffff Private Memory rw True False False -
vsstrace.dll.mui 0x04e40000 0x04e48fff Memory Mapped File r False False False -
private_0x0000000004e60000 0x04e60000 0x04f5ffff Private Memory rw True False False -
locale.nls 0x04f60000 0x0501dfff Memory Mapped File r False False False -
private_0x0000000005020000 0x05020000 0x0505ffff Private Memory rw True False False -
private_0x0000000005060000 0x05060000 0x0509ffff Private Memory rw True False False -
private_0x00000000050a0000 0x050a0000 0x050dffff Private Memory rw True False False -
private_0x00000000050e0000 0x050e0000 0x0511ffff Private Memory rw True False False -
private_0x0000000005140000 0x05140000 0x0514ffff Private Memory rw True False False -
pagefile_0x0000000005150000 0x05150000 0x052d7fff Pagefile Backed Memory r True False False -
pagefile_0x00000000052e0000 0x052e0000 0x05460fff Pagefile Backed Memory r True False False -
pagefile_0x0000000005470000 0x05470000 0x0686ffff Pagefile Backed Memory r True False False -
sortdefault.nls 0x06870000 0x06ba6fff Memory Mapped File r False False False -
private_0x0000000006bb0000 0x06bb0000 0x06beffff Private Memory rw True False False -
kernelbase.dll.mui 0x06bf0000 0x06ccefff Memory Mapped File r False False False -
private_0x0000000006cd0000 0x06cd0000 0x06d4ffff Private Memory rw True False False -
wow64cpu.dll 0x5baa0000 0x5baa7fff Memory Mapped File rwx False False False -
wow64win.dll 0x5bab0000 0x5bb22fff Memory Mapped File rwx False False False -
wow64.dll 0x5bb30000 0x5bb7efff Memory Mapped File rwx False False False -
vssapi.dll 0x741b0000 0x742cafff Memory Mapped File rwx False False False -
vsstrace.dll 0x742d0000 0x742e0fff Memory Mapped File rwx False False False -
atl.dll 0x742f0000 0x74307fff Memory Mapped File rwx False False False -
rsaenh.dll 0x74320000 0x7434efff Memory Mapped File rwx False False False -
cryptsp.dll 0x74350000 0x74362fff Memory Mapped File rwx False False False -
bcrypt.dll 0x744e0000 0x744fafff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74750000 0x747a8fff Memory Mapped File rwx False False False -
cryptbase.dll 0x747b0000 0x747b9fff Memory Mapped File rwx False False False -
sspicli.dll 0x747c0000 0x747ddfff Memory Mapped File rwx False False False -
rpcrt4.dll 0x74a00000 0x74aabfff Memory Mapped File rwx False False False -
kernel.appcore.dll 0x74ab0000 0x74abbfff Memory Mapped File rwx False False False -
ws2_32.dll 0x74d30000 0x74d8bfff Memory Mapped File rwx False False False -
shlwapi.dll 0x74da0000 0x74de3fff Memory Mapped File rwx False False False -
msctf.dll 0x74df0000 0x74f0ffff Memory Mapped File rwx False False False -
imm32.dll 0x74f10000 0x74f3afff Memory Mapped File rwx False False False -
kernel32.dll 0x74f40000 0x7502ffff Memory Mapped File rwx False False False -
gdi32.dll 0x75030000 0x7517cfff Memory Mapped File rwx False False False -
kernelbase.dll 0x75190000 0x75305fff Memory Mapped File rwx False False False -
user32.dll 0x76c70000 0x76daffff Memory Mapped File rwx False False False -
msvcrt.dll 0x76f20000 0x76fddfff Memory Mapped File rwx False False False -
clbcatq.dll 0x76fe0000 0x77061fff Memory Mapped File rwx False False False -
nsi.dll 0x770c0000 0x770c6fff Memory Mapped File rwx False False False -
oleaut32.dll 0x770d0000 0x77161fff Memory Mapped File rwx False False False -
sechost.dll 0x772b0000 0x772f2fff Memory Mapped File rwx False False False -
combase.dll 0x77390000 0x77549fff Memory Mapped File rwx False False False -
advapi32.dll 0x77550000 0x775cafff Memory Mapped File rwx False False False -
ntdll.dll 0x776b0000 0x77828fff Memory Mapped File rwx False False False -
private_0x000000007eb47000 0x7eb47000 0x7eb49fff Private Memory rw True False False -
private_0x000000007eb4a000 0x7eb4a000 0x7eb4cfff Private Memory rw True False False -
private_0x000000007eb4d000 0x7eb4d000 0x7eb4ffff Private Memory rw True False False -
pagefile_0x000000007eb50000 0x7eb50000 0x7ec4ffff Pagefile Backed Memory r True False False -
pagefile_0x000000007ec50000 0x7ec50000 0x7ec72fff Pagefile Backed Memory r True False False -
private_0x000000007ec75000 0x7ec75000 0x7ec75fff Private Memory rw True False False -
private_0x000000007ec78000 0x7ec78000 0x7ec7afff Private Memory rw True False False -
private_0x000000007ec7b000 0x7ec7b000 0x7ec7bfff Private Memory rw True False False -
private_0x000000007ec7d000 0x7ec7d000 0x7ec7ffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7dfc57b4ffff Private Memory r True False False -
pagefile_0x00007dfc57b50000 0x7dfc57b50000 0x7ffc57b4ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ffc57b50000 0x7ffc57d11fff Memory Mapped File rwx False False False -
private_0x00007ffc57d12000 0x7ffc57d12000 0x7ffffffeffff Private Memory r True False False -
Process #5: vssadmin.exe
0 0
»
Information Value
ID #5
File Name c:\windows\syswow64\vssadmin.exe
Command Line vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:01:14, Reason: Child Process
Unmonitor End Time: 00:01:15, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xe60
Parent PID 0xdac (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x E64
0x E68
0x E6C
0x E70
0x E74
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
vssadmin.exe 0x00130000 0x0014dfff Memory Mapped File rwx False False False -
pagefile_0x0000000000f10000 0x00f10000 0x04f0ffff Pagefile Backed Memory - True False False -
private_0x0000000004f10000 0x04f10000 0x04f2ffff Private Memory rw True False False -
pagefile_0x0000000004f10000 0x04f10000 0x04f1ffff Pagefile Backed Memory rw True False False -
private_0x0000000004f20000 0x04f20000 0x04f23fff Private Memory rw True False False -
private_0x0000000004f30000 0x04f30000 0x04f31fff Private Memory rw True False False -
vssadmin.exe.mui 0x04f30000 0x04f3cfff Memory Mapped File r False False False -
pagefile_0x0000000004f40000 0x04f40000 0x04f53fff Pagefile Backed Memory r True False False -
private_0x0000000004f60000 0x04f60000 0x04f9ffff Private Memory rw True False False -
private_0x0000000004fa0000 0x04fa0000 0x04fdffff Private Memory rw True False False -
pagefile_0x0000000004fe0000 0x04fe0000 0x04fe3fff Pagefile Backed Memory r True False False -
pagefile_0x0000000004ff0000 0x04ff0000 0x04ff0fff Pagefile Backed Memory r True False False -
private_0x0000000005000000 0x05000000 0x05001fff Private Memory rw True False False -
private_0x0000000005010000 0x05010000 0x05010fff Private Memory rw True False False -
private_0x0000000005020000 0x05020000 0x05020fff Private Memory rw True False False -
private_0x0000000005030000 0x05030000 0x05033fff Private Memory rw True False False -
private_0x0000000005040000 0x05040000 0x0513ffff Private Memory rw True False False -
private_0x0000000005140000 0x05140000 0x0517ffff Private Memory rw True False False -
private_0x0000000005180000 0x05180000 0x051bffff Private Memory rw True False False -
private_0x00000000051e0000 0x051e0000 0x051effff Private Memory rw True False False -
locale.nls 0x051f0000 0x052adfff Memory Mapped File r False False False -
private_0x00000000053f0000 0x053f0000 0x053fffff Private Memory rw True False False -
pagefile_0x0000000005400000 0x05400000 0x05587fff Pagefile Backed Memory r True False False -
pagefile_0x0000000005590000 0x05590000 0x05710fff Pagefile Backed Memory r True False False -
pagefile_0x0000000005720000 0x05720000 0x06b1ffff Pagefile Backed Memory r True False False -
wow64cpu.dll 0x5baa0000 0x5baa7fff Memory Mapped File rwx False False False -
wow64win.dll 0x5bab0000 0x5bb22fff Memory Mapped File rwx False False False -
wow64.dll 0x5bb30000 0x5bb7efff Memory Mapped File rwx False False False -
vssapi.dll 0x741b0000 0x742cafff Memory Mapped File rwx False False False -
vsstrace.dll 0x742d0000 0x742e0fff Memory Mapped File rwx False False False -
atl.dll 0x742f0000 0x74307fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74750000 0x747a8fff Memory Mapped File rwx False False False -
cryptbase.dll 0x747b0000 0x747b9fff Memory Mapped File rwx False False False -
sspicli.dll 0x747c0000 0x747ddfff Memory Mapped File rwx False False False -
rpcrt4.dll 0x74a00000 0x74aabfff Memory Mapped File rwx False False False -
kernel.appcore.dll 0x74ab0000 0x74abbfff Memory Mapped File rwx False False False -
ws2_32.dll 0x74d30000 0x74d8bfff Memory Mapped File rwx False False False -
shlwapi.dll 0x74da0000 0x74de3fff Memory Mapped File rwx False False False -
msctf.dll 0x74df0000 0x74f0ffff Memory Mapped File rwx False False False -
imm32.dll 0x74f10000 0x74f3afff Memory Mapped File rwx False False False -
kernel32.dll 0x74f40000 0x7502ffff Memory Mapped File rwx False False False -
gdi32.dll 0x75030000 0x7517cfff Memory Mapped File rwx False False False -
kernelbase.dll 0x75190000 0x75305fff Memory Mapped File rwx False False False -
user32.dll 0x76c70000 0x76daffff Memory Mapped File rwx False False False -
msvcrt.dll 0x76f20000 0x76fddfff Memory Mapped File rwx False False False -
nsi.dll 0x770c0000 0x770c6fff Memory Mapped File rwx False False False -
oleaut32.dll 0x770d0000 0x77161fff Memory Mapped File rwx False False False -
sechost.dll 0x772b0000 0x772f2fff Memory Mapped File rwx False False False -
combase.dll 0x77390000 0x77549fff Memory Mapped File rwx False False False -
advapi32.dll 0x77550000 0x775cafff Memory Mapped File rwx False False False -
ntdll.dll 0x776b0000 0x77828fff Memory Mapped File rwx False False False -
pagefile_0x000000007f4a0000 0x7f4a0000 0x7f59ffff Pagefile Backed Memory r True False False -
pagefile_0x000000007f5a0000 0x7f5a0000 0x7f5c2fff Pagefile Backed Memory r True False False -
private_0x000000007f5c6000 0x7f5c6000 0x7f5c8fff Private Memory rw True False False -
private_0x000000007f5c9000 0x7f5c9000 0x7f5c9fff Private Memory rw True False False -
private_0x000000007f5cb000 0x7f5cb000 0x7f5cbfff Private Memory rw True False False -
private_0x000000007f5cd000 0x7f5cd000 0x7f5cffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7dfc57b4ffff Private Memory r True False False -
pagefile_0x00007dfc57b50000 0x7dfc57b50000 0x7ffc57b4ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ffc57b50000 0x7ffc57d11fff Memory Mapped File rwx False False False -
private_0x00007ffc57d12000 0x7ffc57d12000 0x7ffffffeffff Private Memory r True False False -
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image