Sample File: MD5 hash: 6826c287f78462c8dd70a6fb3731768f SHA1 hash: f1c38c5c4052304e30d54debf7483353064e3666 SHA256 hash: b0cbe3c24b1e610a9c4c8308f1996b128a4686e6a80edd1b3f22900b4dd95aee SSDEEP hash: 12288:hxEV8N4wsFqSyw4+J/v/6uTznISb3yWgomsns++ZG:zupqSvdH1TzXWWgvTo Filename(s): dwm.exe Filetype: Windows Exe (x86-32) Mutex IOCs: Global\c1a76b5a-12ab-45c5-b9d9-d692faa6e7a2 Registry Key IOCs: HKEY_CURRENT_USER\Software\Borland\Locales HKEY_LOCAL_MACHINE\Software\Borland\Locales HKEY_CURRENT_USER\Software\Borland\Delphi\Locales HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\InstallRoot HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType HKEY_CURRENT_USER HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\LegacyWPADSupport HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\TZI HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST\FirstEntry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST\LastEntry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST\2007 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST\2008 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\MUI_Display HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\MUI_Std HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\MUI_Dlt HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\HWRPortReuseOnSocketBind HKEY_PERFORMANCE_DATA HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun HKEY_CURRENT_USER\Software\Microsoft\Command Processor HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Domain IOCs: f0402724.xsph.ru IP IOCs: 141.8.192.151 URL IOCs: http://f0402724.xsph.ru/wallpaper/Ravack.bmp File IOCs: Filenames: C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\icon_128.png C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Favicons-journal C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\01_Music_auto_rated_at_5_stars.wpl C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\K5dvl7fT\JmSx0qR1yqJH4W.pptx C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\sb 40mThxX\tBG_E2z ON7kvTl6.mkv C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\HELP_ME_RECOVER_MY_FILES.txt C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Qt4 x3LEEV\yCl1TKdXx8.mp4 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Origin Bound Certs-journal C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\K5dvl7fT\8f ywCzsY517.ots C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\Viq_4QKI2.swf C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico C:\Users\Default\NTUSER.DAT.LOG1 C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\o9js.m4a C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\03_Music_rated_at_4_or_5_stars.wpl C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico C:\ProgramData\Microsoft\MF\Pending.GRL C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\05_Pictures_taken_in_the_last_month.wpl C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\JWWFC2T3w\GYSIpX0OtduD.bmp C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Shortcuts C:\Users\5p5NrGJn0jS HALPmcxz\Videos\J6NdUTbj3DbtY.swf C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\04_Music_played_in_the_last_month.wpl C:\Users\Default\Favorites\MSN Websites\MSN.url C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\4_ZMgeAEIx.pps C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest C:\ProgramData\Microsoft\OFFICE\AssetLibrary.ico C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\JWWFC2T3w\6s_UcgaOk3wAB0zvyd\l_QNcKeGQXWHKIVov\EIYaLUJujUMq.jpg C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\HELP_ME_RECOVER_MY_FILES.txt C:\Users\Default\Pictures\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\sessionstore.js C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\pt_PT\messages.json C:\Users\Default\Links\Downloads.lnk C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\fI8ePonh MPy9Cl.m4a C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aVk7q.mp4 C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\MXgm5UhX-F.bmp C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\sr\messages.json C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Top Sites-journal C:\Users\All Users\Microsoft\Network\Downloader\qmgr1.dat C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\ACECache11.lst C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Qt4 x3LEEV\Xfr1EQhj3ifkO.png C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Yk8fp6.pptx C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\-4yY.flv C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml C:\Users\All Users\Microsoft\OFFICE\MySite.ico C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QnfRKUpY1vkXPAwePnb.docx C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\pt_BR\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\nb\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150 C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\KSnyCjA.bmp C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\zh_CN\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\id\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\times.json C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\LVQDCWarYFzD_\z0-hGRgP.pdf C:\Users\5p5NrGJn0jS HALPmcxz\Links\Desktop.lnk C:\Boot\Fonts\cht_boot.ttf C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\Outlook.sharing.xml.obi C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\mtsH\EeP7 z3X.pptx C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\MD0.avi C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\10_All_Music.wpl C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\TrRtfx2cJO4BBngXdF6\975BR3VH\7BXVbHNSO57K.flv C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\07_TV_recorded_in_the_last_week.wpl C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\webappsstore.sqlite C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\th\messages.json C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\downloads.sqlite C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\t7MEY4ltCFPi8hFpFEB.pptx C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\MI-J.odp C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\STgA9T8b\05Ah6-nmBhSPZhlV_.png C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SVVWdciAcn7QzMN_.png C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973 C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Qt4 x3LEEV\U9th4-ZhT.bmp C:\Users\Default\Links\Desktop.lnk C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\CYou-CThfFRIMtGy.mp3 C:\Users\Default\AppData\Local\Temp\FXSAPIDebugLogFile.txt C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HELP_ME_RECOVER_MY_FILES.txt C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\STgA9T8b\fwT-B2i.jpg C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\STgA9T8b\-2bboA.gif C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\hr\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Current Session C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\LDdH1V23A4jz8W6dNceZ.m4a C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\gBOZ7irGH.m4a C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9 C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\mtsH\s5_WbUKr.ots C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20131025151332 C:\Users\Public\Pictures\Sample Pictures\Desert.jpg C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\localstore.rdf C:\Users\Default\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\STgA9T8b\46jRHfovoPUaROzN.gif C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_metadata\verified_contents.json C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\MpNXkI_J7uBt.gif C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\06_Pictures_rated_4_or_5_stars.wpl C:\Boot\nb-NO\bootmgr.exe.mui C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\GoogleUpdateSetup.exe C:\Boot\BCD.LOG2 C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7ALZQhqLIT0vwxSz.png C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor-journal C:\Users\5p5NrGJn0jS HALPmcxz\Documents\6soIpue4aDpj61n-.pptx C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\CURRENT C:\Users\5p5NrGJn0jS HALPmcxz\Documents\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\LVQDCWarYFzD_\VA8wqNUBs 8 7zQduA.odp C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\XT1RPYG9\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico C:\Users\5p5NrGJn0jS HALPmcxz\Links\Downloads.lnk C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml C:\Users\5p5NrGJn0jS HALPmcxz\Documents\AlyiD6.pptx C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\D68G7BIJ\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\xb76AA39E6ULdAotFF0.mp3 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\oKvcPp6ZhS.m4a C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\LPWbPz8iUPFF.avi C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\ru\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.sig C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC C:\Users\Default\Searches\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\11_All_Pictures.wpl C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\TrRtfx2cJO4BBngXdF6\vO2XQs jA8cLQt.bmp C:\Users\5p5NrGJn0jS HALPmcxz\Music\nFQ4.mp3 C:\Users\Default\Documents\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\01_Music_auto_rated_at_5_stars.wpl C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77 C:\Users\5p5NrGJn0jS HALPmcxz\Documents\HzLI_2ewrA.xlsx C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\vi\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qtnunG.png C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4 C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\AdobeARM.log C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398 C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\pMhyRpumznpsLPYT5R.ots C:\Users\All Users\Adobe\Acrobat\10.0\Replicate\Security\directories.acrodata C:\Users\Public\Desktop\Google Chrome.lnk C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\RcDO_z0f1_ld\_VT7xCcr5xK2-lH6dh.bmp C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Cu1_c2JA_uY9.wav C:\Boot\ja-JP\bootmgr.exe.mui C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\sb 40mThxX\1VUNy9NB0jTGh-0d.swf C:\Boot\sv-SE\bootmgr.exe.mui C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_.ico C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\ca\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\j6StL.odp C:\Users\Default\Contacts\Administrator.contact C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD\fwlink[1] C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\pl\messages.json C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url C:\Boot\es-ES\bootmgr.exe.mui C:\Users\Default\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\Preferred C:\Boot\Fonts\wgl4_boot.ttf C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini C:\Boot\BCD C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\ja\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\hi\messages.json C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\1NBUR4HR\fwlink[1] C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\H8-CZ88c.mp3 C:\Users\Public\Videos\desktop.ini C:\Users\Default\Favorites\Microsoft Websites\IE Add-on site.url C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\tr\messages.json C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Origin Bound Certs C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\ro\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\11_All_Pictures.wpl C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\3rmB.bmp C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\mDlj.mp3 C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\-gWW2l0K7rkFiODlBGLj.bmp C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\el\messages.json C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico C:\Users\Default\Contacts\desktop.ini C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\1KmbO-tdhmvcD6cGzxVS.ods C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\F0re1Wn6WdyC7kdc.wav C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.cdf-ms C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\vtLqZuY.flv C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml C:\Windows\SysWOW64\cmd.exe C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\First Run C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\03_Music_rated_at_4_or_5_stars.wpl C:\Users\Default\Favorites\Links\desktop.ini C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\it\messages.json C:\Users\All Users\Microsoft\OFFICE\MySharePoints.ico C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\S-Wi.png C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\CsPLmlSwdooPR.jpg C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\JWWFC2T3w\6s_UcgaOk3wAB0zvyd\l_QNcKeGQXWHKIVov\zW1aWG90Tk O1f.png C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\content-prefs.sqlite C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\en\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\92JB-.png C:\Users\Default\Music\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\xpx4JG5Z5WN4qKet5.avi C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\JtYY o7x1rWYqtXE.wav C:\Users\All Users\Microsoft\OFFICE\AssetLibrary.ico C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal C:\Users\5p5NrGJn0jS HALPmcxz\Documents\t9A_Y7biy1Qa0YsT1Bd\dGBJ-u5MN1QRiUb8uftD.xlsx C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\6ASVN7J7\fwlink[1] C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\12_All_Video.wpl C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\indexedDB\moz-safe-about+home\idb\818200132aebmoouht.sqlite C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\nl\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\Documents\t9A_Y7biy1Qa0YsT1Bd\ZeKWt56ooOrzs4g4dm.odp C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db-journal C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_BestBet.H1W C:\Users\5p5NrGJn0jS HALPmcxz\Links\RecentPlaces.lnk C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml C:\ProgramData\Microsoft\OFFICE\MySite.ico C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\MANIFEST-000001 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\u1KyoWHevcQhL.csv C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst C:\Users\5p5NrGJn0jS HALPmcxz\Music\AyOKTsoqe3mu0v6E8.m4a C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\v6ypS Ud1IRdV5I25.xls C:\Users\Public\Desktop\Adobe Reader X.lnk C:\Users\Public\Downloads\desktop.ini C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\LVQDCWarYFzD_\O1x-x.odp C:\Users\Default\Videos\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\sl\messages.json C:\Users\Public\Music\Sample Music\desktop.ini C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico C:\Users\5p5NrGJn0jS HALPmcxz\Desktop C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wcmTQ5SYlr2.m4a C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Gxp.mp3 C:\Users\Default\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms C:\Users\5p5NrGJn0jS HALPmcxz\Documents\t9A_Y7biy1Qa0YsT1Bd\Mk5vFn8Jvo.docx C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\dmTq347f.mp4 C:\Users\Public\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOCK C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\nYTmv6EGXIe0v5D.odt C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\index.dat C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\JWWFC2T3w\1m7xVeNxwh-hvLLsqWG.png C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_4 XUKPL6.pptx C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\K5dvl7fT\X5LnKXeVD.ppt C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.Lck C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\LVQDCWarYFzD_\KiE6.xls C:\Windows\SysWOW64\net1.exe C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\lsVSIxqWSB.doc C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\MqcPFV5vqywkz8KcF9o.jpg C:\Users\Default\NTUSER.DAT.LOG2 C:\Users\Default\Saved Games\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\compatibility.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7396C420A8E1BC1DA97F1AF0D10BAD21 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\D68G7BIJ\desktop.ini C:\hiberfil.sys C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\5QnuI0EoHmdocSpSz6PR.mkv C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\RlusW4o9Q.xls C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD C:\Users\All Users\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\tP eHR_qRbeuhW0 DiI.pps C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\3KSx7l9urtj6.mp3 C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\RcDO_z0f1_ld\iH9IPKB.gif C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\extensions.ini C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\STgA9T8b\J07L87qfzaZBl15x.jpg C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\~last~.sharing.xml.obi C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\mtsH\FuuZtgqTwAXWYmpEZI.xls C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Top Sites C:\ProgramData\Microsoft\MF\Active.GRL C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\cs\messages.json C:\Boot\BCD.LOG1 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\qPCv1yt vWf8V6_gl.odt C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab C:\Boot\el-GR\bootmgr.exe.mui C:\Users\Public\Documents\desktop.ini C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\11_All_Pictures.wpl C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\EJo8qh7l1uCC.bmp C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Mozilla\updates\E7CF176E110C211B\updates.xml C:\Users\Public\Music\Sample Music\Kalimba.mp3 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\sk\messages.json C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\08_Video_rated_at_4_or_5_stars.wpl C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\TerX9ifWPsHh3Gl5IB.m4a C:\Users\Default\Favorites\MSN Websites\MSN Money.url C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url C:\ C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_property.ico C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD\ieonline.microsoft[1] C:\Boot\pt-BR\bootmgr.exe.mui C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2 C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\tDH0GbrIBu8Em\hkXEKmzjCX La5cH8eT3.swf C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\tDH0GbrIBu8Em\s55Qk9yhgt-v7rwcM\im9M0sjvC50 H_8_Oe.mp4 C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\fav5h8Eo1PFzm.mkv C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\01_Music_auto_rated_at_5_stars.wpl C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\InfoSWaXQc.rtf C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\uk\messages.json C:\ProgramData\Microsoft\IdentityCRL\ppcrlui.dll C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398 C:\Users\5p5NrGJn0jS HALPmcxz\Videos\LfyHA0-Xlcsf.flv C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\KETAJP6D\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3130B1871A126520A8C47861EFE3ED4D C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\tDH0GbrIBu8Em\s55Qk9yhgt-v7rwcM\5wOPvbKUZ1xq3.swf C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Web Data C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\sUO2HrjZvfhX7e.mkv C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Y3rXyK9qA6.xlsx C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\LVQDCWarYFzD_\tAMiRJDp.csv C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\3 HEHgwVR7oB.doc C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\UYXgNVO8D.flv C:\Users\Default\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\History C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\TrRtfx2cJO4BBngXdF6\SJKS.gif C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wUcXBtyJUQzh 1V SGOf.avi C:\Boot\BCD.LOG C:\Users\All Users\Microsoft\MF\Pending.GRL C:\Users\Default\AppData\Roaming\Microsoft\Protect\CREDHIST C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\XDgpoAPIbr.m4a C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\bst449D.tmp C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\K5dvl7fT\yXNnBj.odt C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Mozilla\updates\E7CF176E110C211B\active-update.xml C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Local State C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Safe Browsing Channel IDs C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\06_Pictures_rated_4_or_5_stars.wpl C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Wyli67G.swf C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875 C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Default\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension State\CURRENT C:\Users\5p5NrGJn0jS HALPmcxz\Documents\djKv5u4ShNy5rO0t.xlsx C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\STgA9T8b\QItw.bmp C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\tDH0GbrIBu8Em\s55Qk9yhgt-v7rwcM\42so.swf C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\aS3Az_ Ym.ods C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll C:\Users\5p5NrGJn0jS HALPmcxz\Documents\t9A_Y7biy1Qa0YsT1Bd\M-9H ZXFyi.odp C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Current Tabs C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\cert8.db C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\IyNs2uyZUDMfgyr.mkv C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\bg\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\TrRtfx2cJO4BBngXdF6\fwhCUdOA6zT0iKJ.swf C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4 C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms C:\Users\Public\Recorded TV\desktop.ini C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_BestBet.H1W C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\lt\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\index C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Visio\content14.dat C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\marionette.log C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\08_Video_rated_at_4_or_5_stars.wpl C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.xml C:\BOOTSECT.BAK C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\TrRtfx2cJO4BBngXdF6\g0rjnL4s_HlAcyOf0Qmb.mp3 C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe C:\Users\Public\Pictures\desktop.ini C:\ProgramData\Microsoft\OFFICE\MySharePoints.ico C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\WXVsDf_xz.flv C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\desktop.ini C:\bootmgr C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\STgA9T8b\D86Vg5IvNPI.gif C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG C:\Boot\hu-HU\bootmgr.exe.mui C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\fi\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\ReaderMessages C:\Users\Default\Favorites\desktop.ini C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\profiles.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\TrRtfx2cJO4BBngXdF6\5SOAmPLPViVXtn.swf C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\7QJTz3oOCYOaV.pptx C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Qt4 x3LEEV\4yUM.jpg C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\uZKBEc.wav C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Mozilla\Firefox\Profiles\silmbjec.default\thumbnails\ce8c0453589216a67cddb50284fbfe8d.png C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\tDH0GbrIBu8Em\IUPd5RSS6BRTuv.flv C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\9zXM0uXDU4mqWBd_.m4a C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\IconCache.db C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9 C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\04_Music_played_in_the_last_month.wpl C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\10_All_Music.wpl C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1 C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dwm.exe.config C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\03J4UQW0\desktop.ini C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\sessionstore.bak C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD C:\Users\Default\Favorites\MSN Websites\MSNBC News.url C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\TrRtfx2cJO4BBngXdF6\SpMVcb6V6jn0QJJ6v.flv C:\Boot\fr-FR\bootmgr.exe.mui C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Cookies\index.dat C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\MQseUwY1iQlPKmCIRgor.flv C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\MsUuZs6.png C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\sb 40mThxX\OC7pHKUd s9CD.avi C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1d rOVjjG6_MpXF.xlsx C:\Users\Default\Favorites\MSN Websites\MSN Autos.url C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3 C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\sb 40mThxX\76RJcdY1iTQV.flv C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\SPyTMvwg2.m4a C:\ProgramData\Sun\Java\Java Update\jaureglist.xml C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\STgA9T8b\U0Dj1xrqIIJ.png C:\Users\desktop.ini C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\prefs.js C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Mozilla\Firefox\Profiles\silmbjec.default\startupCache\startupCache.4.little C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\P3-IBmITJml1zDNs.odt C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\desktop.ini C:\Users\Public\Pictures\Sample Pictures\Koala.jpg C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1DAF2884EC4DFA96BA4A58D4DBC9C406 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\index.dat C:\Users\All Users\Microsoft\IdentityCRL\ppcrlui.dll C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\STgA9T8b\Q89_VxAL6I.bmp C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\ar\messages.json C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico C:\Users\Default\AppData\Local\IconCache.db C:\Users\Default\Links\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\e5FCVDJyKt.flv C:\Users\5p5NrGJn0jS HALPmcxz\Documents\u7Qo_33-.docx C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\ClUx4HyYTk.avi C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD C:\Users\All Users\Microsoft\OFFICE\DocumentRepository.ico C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\1NBUR4HR\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies-journal C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\K5dvl7fT\m06ibM4-TYPjvy5YO_l.xls C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\T4NhMxbw-K436.csv C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\r4EsWZtlr_nANSHj-X.mkv C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\-wKnlLrCZAuwc.mp3 C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\D68G7BIJ\fwlink[1] C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\cookies.sqlite C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml C:\Users\Default\Searches\Everywhere.search-ms C:\ProgramData\Microsoft\OFFICE\DocumentRepository.ico C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Preferences C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\README C:\Boot\en-US\bootmgr.exe.mui C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\QuotaManager-journal C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\Mj7J.mp3 C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi C:\Users\5p5NrGJn0jS HALPmcxz\Documents\t9A_Y7biy1Qa0YsT1Bd\jo4YikyU9ljcA.odp C:\Boot\ru-RU\bootmgr.exe.mui C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\sb 40mThxX\Uk0Yuil1ydf8.avi C:\Boot\Fonts\jpn_boot.ttf C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\SharedDataEvents C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Iuq-3G05ivFB734n77.pptx C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\fr\messages.json C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_property.ico C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Mozilla\Firefox\Profiles\silmbjec.default\safebrowsing\test-phish-simple.sbstore C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\JWWFC2T3w\mbfYDD2.bmp C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\XZk1wTU5h yKkmtkDI.pptx C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\k kLRgJgC1C K.ots C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\TrRtfx2cJO4BBngXdF6\975BR3VH\LFfO ddWk.avi C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\JWWFC2T3w\ktbBaIxr3.gif C:\Recovery\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\Winre.wim C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Crashpad\metadata C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Ig8DuRpe97v.wav C:\Users\5p5NrGJn0jS HALPmcxz\Documents\RP3RFeDA_.pps C:\Users\5p5NrGJn0jS HALPmcxz\Documents\G-Us5qHLtPVHYlm.docx C:\Boot\BOOTSTAT.DAT C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1DAF2884EC4DFA96BA4A58D4DBC9C406 C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST C:\Users\Public\Desktop\Mozilla Firefox.lnk C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Mozilla\Firefox\Profiles\silmbjec.default\thumbnails\ba182bcd131f1f3c6b6fbbb1ba078341.png C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\07_TV_recorded_in_the_last_week.wpl C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\bookmarkbackups\bookmarks-2017-06-05_5.json C:\Boot\zh-TW\bootmgr.exe.mui C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\TrRtfx2cJO4BBngXdF6\975BR3VH\DGT_mTB.wav C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\FXSAPIDebugLogFile.txt.ravack C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.icc C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\TmywRy0I8pDn5cw41nE.wav C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\sv\messages.json C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml C:\Users\Default\Favorites\Microsoft Websites\Microsoft Store.url C:\Users\Default\Favorites\Links\Web Slice Gallery.url C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\ImDs4oRcQ.docx C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\QyFbg2t48F2Voph.mp3 C:\Boot\Fonts\chs_boot.ttf C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56 C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\08_Video_rated_at_4_or_5_stars.wpl C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dosAXTpOCkelE-hGZ.mp3 C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\07_TV_recorded_in_the_last_week.wpl C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\mimeTypes.rdf C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\JWWFC2T3w\6s_UcgaOk3wAB0zvyd\L C2sbLXp_ll68UDi 7.gif C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico C:\Boot\nl-NL\bootmgr.exe.mui C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\manifest.json C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\02_Music_added_in_the_last_month.wpl C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\bookmarkbackups\bookmarks-2017-06-16_5.json C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XGruBY0M0rV.xlsx C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\09_Music_played_the_most.wpl C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hUTPaxs6zKMqH.mkv C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml C:\Boot\zh-CN\bootmgr.exe.mui C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\D68G7BIJ\fwlink[1] C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\TrRtfx2cJO4BBngXdF6\DhJ_c.m4a C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\05_Pictures_taken_in_the_last_month.wpl C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\da\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\Videos\K3bCiyCA.swf C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\WZOF-Zx-zhWFdZvNE2Kx.xlsx C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\09_Music_played_the_most.wpl C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\JWWFC2T3w\6s_UcgaOk3wAB0zvyd\rmuX__y XZqc.bmp C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0 C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\pvCDG.bmp C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Qt4 x3LEEV\Sseeknx8rQzlL.bmp C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml C:\Recovery\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\boot.sdi C:\Users\Public\Videos\Sample Videos\desktop.ini C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.Lck C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21 C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.dat.LOG2 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\02_Music_added_in_the_last_month.wpl C:\Boot\pl-PL\bootmgr.exe.mui C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\extensions.sqlite C:\Users\Default\ntuser.ini C:\Users\Public\Desktop\desktop.ini C:\Users\All Users\Microsoft\Crypto\RSA\S-1-5-18\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\ko\messages.json C:\Boot\Fonts\kor_boot.ttf C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\mfsDCVaQ1AdCr-.mp3 C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\02_Music_added_in_the_last_month.wpl C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000003.log C:\Boot\it-IT\bootmgr.exe.mui C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOCK C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.manifest C:\Boot\de-DE\bootmgr.exe.mui C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\12_All_Video.wpl C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi C:\Users\5p5NrGJn0jS HALPmcxz\Music\wWwqvV_jJKfVyhs4tA.mp3 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8 C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\JWWFC2T3w\YYzd.jpg C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\GAZgzbkttHoZ 4VA.mp3 C:\Users\Default\NTUSER.DAT.LOG C:\Users\5p5NrGJn0jS HALPmcxz\Music\E 8sXY.mp3 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Mozilla\Firefox\Profiles\silmbjec.default\safebrowsing\test-malware-simple.sbstore C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\6ASVN7J7\fwlink[1] C:\Users\All Users\Sun\Java\Java Update\jaureglist.xml C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Login Data C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Qt4 x3LEEV\pnuRWX-eI0_k_2yHB.swf C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\secmod.db C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Mozilla\updates\E7CF176E110C211B\updates\0\update.status C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\As1oYU2q.mp4 C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\tDH0GbrIBu8Em\s55Qk9yhgt-v7rwcM\kkBcbeJI31V77Yg.flv C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\6ASVN7J7\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\History-journal C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\sb 40mThxX\PKe78kV yn0sFvlE.mp4 C:\Users\5p5NrGJn0jS HALPmcxz\Documents\6tvq.docx C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\sRombPrL.mp3 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\GoogleUpdateSetup.exe C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\History\History.IE5\index.dat C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\places.sqlite C:\Users\5p5NrGJn0jS HALPmcxz\Documents\npOz8.ppt C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\permissions.sqlite C:\Boot\en-US\memtest.exe.mui C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD\fwlink[1] C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\tDH0GbrIBu8Em\7KYy 9Sbnv2NMs.mp4 C:\Users\All Users\Microsoft\MF\Active.GRL C:\Boot\cs-CZ\bootmgr.exe.mui C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\huxJd8 _Y.flv C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\sb 40mThxX\nw0Umn.mp4 C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\_wuxjnnl_t.rtf C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\tDH0GbrIBu8Em\Q xT9NqhH5HFUW.flv C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\tDH0GbrIBu8Em\0dNeZhXLAqIN4BurN7i.avi C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\uKGDufC.xls C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.H1D C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Mozilla\updates\E7CF176E110C211B\updates\0\update.mar C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\parent.lock C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\QuotaManager C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\XY6RlQywgZns.wav C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\04_Music_played_in_the_last_month.wpl C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\JWWFC2T3w\6s_UcgaOk3wAB0zvyd\l_QNcKeGQXWHKIVov\TmSNCrEhnJURI5tea_3e.bmp C:\Users\Public\Libraries\desktop.ini C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_AssetId.H1W C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Favicons C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_AssetId.H1W C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\tDH0GbrIBu8Em\YzjQCB2ljes66.flv C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\signons.sqlite C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\tDH0GbrIBu8Em\s55Qk9yhgt-v7rwcM\frotZ5BT4nze.mkv C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6 C:\Users\5p5NrGJn0jS HALPmcxz\Music\3Na1.wav C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\addons.json C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_.ico C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\09_Music_played_the_most.wpl C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF C:\Users\All Users\Microsoft\IdentityCRL\ppcrlconfig.dll C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\1NBUR4HR\fwlink[1] C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_property.ico C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\desktop.ini C:\pagefile.sys C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.manifest C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\FGXl.wav C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Mozilla\Firefox\Profiles\silmbjec.default\safebrowsing\test-phish-simple.cache C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi C:\Users\Default\Favorites\MSN Websites\MSN Entertainment.url C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\mtsH\3AMulGMDrPOVNnHTR7r.ppt C:\Boot\da-DK\bootmgr.exe.mui C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\lv\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\FXSAPIDebugLogFile.txt C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7r6pSc8vfV5bLykEHU.mp4 C:\Users\5p5NrGJn0jS HALPmcxz\Documents\pOO7Nz62r.xlsx C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\K5dvl7fT\VcMrSy6jy.odt C:\Users\Default\Desktop\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\VB18B0KB\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\12_All_Video.wpl C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\JWWFC2T3w\6s_UcgaOk3wAB0zvyd\l_QNcKeGQXWHKIVov\XuTry.bmp C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\pluginreg.dat C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\JWWFC2T3w\gxfLvVmyJou9GcmxB.png C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Visio\thumbs.dat C:\Users\Default\AppData\Local\Temp\FXSAPIDebugLogFile.txt.ravack C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JhZakkZek.pptx C:\Users\5p5NrGJn0jS HALPmcxz\Documents\t9A_Y7biy1Qa0YsT1Bd\EWj5g IIOR.xlsx C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\5DNYdY4pN.mp3 C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_property.ico C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Work.url C:\Users\Default\Links\RecentPlaces.lnk C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\IMYY2.mp3 C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.ini C:\Users\Public\Videos\Sample Videos\Wildlife.wmv C:\Boot\ko-KR\bootmgr.exe.mui C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\oSMwx.wav C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\zh_TW\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\Documents\7JvFIKF0kqAyZ6-gz.docx C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\RcDO_z0f1_ld\ivGCq4xIt.gif C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dwm.exe C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\4KtApTqfElhIRl.pdf C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\1NBUR4HR\desktop.ini C:\Users\Default\Favorites\Microsoft Websites\IE site on Microsoft.com.url C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Shortcuts-journal C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\ov dhtAOILEiRuzwzD.mkv C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\2zlKaTqq i9XT iJWLA6.pdf C:\ProgramData\Microsoft\IdentityCRL\ppcrlconfig.dll C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\C_8HQlzjtcsb s7.csv C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.dat.LOG1 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\History\History.IE5\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\Music\RYvL3kMeOY.mp3 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cookies C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\de\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7396C420A8E1BC1DA97F1AF0D10BAD21 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.cdf-ms C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\6ASVN7J7\desktop.ini C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\triThadW JjKq.mp3 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Outlook\mapisvc.inf C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Mozilla\Firefox\Profiles\silmbjec.default\safebrowsing\test-malware-simple.pset C:\Users\5p5NrGJn0jS HALPmcxz\Music\De5gAH7h6N.mp3 C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms C:\Users\Public\Music\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1L6_F.jpg C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KSPt2mRMc-.gif C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416 C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9 C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Visited Links C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\key3.db C:\Users\Default\Favorites\MSN Websites\MSN Sports.url C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Mozilla\Firefox\Profiles\silmbjec.default\safebrowsing\test-phish-simple.pset C:\Users\5p5NrGJn0jS HALPmcxz\Links\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3130B1871A126520A8C47861EFE3ED4D C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\tDH0GbrIBu8Em\HkR4NfoS.avi C:\Boot\memtest.exe C:\Users\Default\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms C:\Users\Public\Libraries\RecordedTV.library-ms C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1 C:\Users\Default\Downloads\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\fil\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\128.png C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\tDH0GbrIBu8Em\6tn-.mp4 C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\NxA4MDP.mp4 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest C:\Users\5p5NrGJn0jS HALPmcxz\Documents\my0UQGSHN\fejpucERprfje\RBeQl.ppt C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\Vrg5-u.png C:\Users\5p5NrGJn0jS HALPmcxz\Videos\YlQsm3dIl-q49g.mp4 C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini C:\Users\Default\Searches\Indexed Locations.search-ms C:\Users\Default\NTUSER.DAT C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\wallpaper.bmp C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\_locales\hu\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\Music\09kLIgkz.m4a C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\oD5j.bmp C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kgi6bSwR\ce7PmkpSFHMkQQnE.wav C:\Users\5p5NrGJn0jS HALPmcxz\Documents\t9A_Y7biy1Qa0YsT1Bd\6q6IhzyajTn0Lv9.pptx C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\webapps\webapps.json C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Qt4 x3LEEV\JLuRNAWPgACPkgbPN.jpg C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\indexedDB\moz-safe-about+home\.metadata C:\Boot\tr-TR\bootmgr.exe.mui C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\JWWFC2T3w\6s_UcgaOk3wAB0zvyd\2crz.png C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\r3SYZ85_GQIxusl\tDH0GbrIBu8Em\s55Qk9yhgt-v7rwcM\Z3SmmdAhz9g.flv C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\0G7k3zd4HkUex.gif C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD\desktop.ini C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\sb 40mThxX\ziVDTCMUzwqElk54yh9Y.flv C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Safe Browsing Channel IDs-journal C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db C:\Boot\pt-PT\bootmgr.exe.mui C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.H1D C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\03_Music_rated_at_4_or_5_stars.wpl C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778 C:\Boot\fi-FI\bootmgr.exe.mui C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi C:\Users\5p5NrGJn0jS HALPmcxz\Documents\t9A_Y7biy1Qa0YsT1Bd\R2Q-pWYd.doc C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\es\messages.json C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Mozilla\Firefox\Profiles\silmbjec.default\thumbnails\4cc87c1409819bf06f42b782d4902b2f.png C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Au3lbVRbKt_X9 qS\9o0DtLmSgchW.mp4 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\bOR5x1UvBZo4LKLM.avi C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml C:\Users\Public\Music\Sample Music\Sleep Away.mp3 C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\Temporary Internet Files\Content.IE5\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\10_All_Music.wpl C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\JWWFC2T3w\6s_UcgaOk3wAB0zvyd\anpzsgaghiA-pg.bmp C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000E713\05_Pictures_taken_in_the_last_month.wpl C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Home.url C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOCK C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\ADLLouxoZv.flv C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\sVGBrfaHNQdB7egD-x0.mp4 C:\Boot\zh-HK\bootmgr.exe.mui C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\06_Pictures_rated_4_or_5_stars.wpl C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gKqCfTTjlTSLPG.mkv C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\search.json MD5 hashes: c7d0f430e92111ab844c5367a7924a83 d41d8cd98f00b204e9800998ecf8427e 6826c287f78462c8dd70a6fb3731768f 00a7288926e3b1e80aed5b286fd1b0ce SHA1 hashes: daddb8030a1df2fefb98246ef1b5979995c52cfd eaad5702d27b5628bab13298baa73308a1f9d946 da39a3ee5e6b4b0d3255bfef95601890afd80709 f1c38c5c4052304e30d54debf7483353064e3666 SHA256 hashes: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 48a7515822768ad77b6c021cd6bd20388c97429f50b79f547535b4218969b975 b0cbe3c24b1e610a9c4c8308f1996b128a4686e6a80edd1b3f22900b4dd95aee 2bea2f11a499a60eab951a5b0bad6955fa16bc862b4ebe622b979f6ecc22d315 SSDEEP hashes: 12288:hxEV8N4wsFqSyw4+J/v/6uTznISb3yWgomsns++ZG:zupqSvdH1TzXWWgvTo 3:: 48:6cgIvtWn9gQ81xQIDo2fa8ka8bugBC+pWuX:DgKtHp5DPfsDTBhpP 49152:F/7L9jX1sn6ucE2uJhuKKobCI6vOE/xDogMmUhq:F/7L92n6uczgua+vOEJDogMmUhq